@grantjs/schema 1.9.1 → 1.10.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@grantjs/schema",
-  "version": "1.9.1",
+  "version": "1.10.0",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -23,18 +23,18 @@
   },
   "devDependencies": {
     "@graphql-codegen/add": "^7.1.0",
-    "@graphql-codegen/cli": "^7.4.0",
+    "@graphql-codegen/cli": "^7.4.1",
     "@graphql-codegen/typed-document-node": "^7.1.0",
     "@graphql-codegen/typescript": "^6.1.0",
     "@graphql-codegen/typescript-operations": "^6.1.6",
     "@graphql-codegen/typescript-resolvers": "^6.1.0",
     "@parcel/watcher": "^2.6.0",
-    "@types/node": "^26.4.1",
+    "@types/node": "^26.6.1",
     "eslint": "^10.10.0",
     "graphql": "^16.14.2",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
-    "vitest": "^4.1.11"
+    "vitest": "^5.0.1"
   },
   "scripts": {
     "dev": "graphql-codegen --config codegen.ts generate --watch",

package/src/generated/graphql.ts

@@ -1257,6 +1257,44 @@ export type UploadProjectAppPictureMutation = {
   uploadProjectAppPicture: { url: string; path: string };
 };
 
+export type ClearProjectOAuthConnectionMutationVariables = Exact<{
+  input: Types.ClearProjectOAuthConnectionInput;
+}>;
+
+export type ClearProjectOAuthConnectionMutation = { clearProjectOAuthConnection: boolean };
+
+export type GetProjectOAuthConnectionsQueryVariables = Exact<{
+  scope: Types.Scope;
+}>;
+
+export type GetProjectOAuthConnectionsQuery = {
+  projectOAuthConnections: Array<{
+    id: string;
+    projectId: string;
+    provider: Types.ProjectOAuthConnectionProvider;
+    clientId: string;
+    isConfigured: boolean;
+    createdAt: Date;
+    updatedAt: Date;
+  }>;
+};
+
+export type UpsertProjectOAuthConnectionMutationVariables = Exact<{
+  input: Types.UpsertProjectOAuthConnectionInput;
+}>;
+
+export type UpsertProjectOAuthConnectionMutation = {
+  upsertProjectOAuthConnection: {
+    id: string;
+    projectId: string;
+    provider: Types.ProjectOAuthConnectionProvider;
+    clientId: string;
+    isConfigured: boolean;
+    createdAt: Date;
+    updatedAt: Date;
+  };
+};
+
 export type CancelProjectSyncMutationVariables = Exact<{
   id: string | number;
   scope: Types.Scope;
@@ -7188,6 +7226,153 @@ export const UploadProjectAppPictureDocument = {
   UploadProjectAppPictureMutation,
   UploadProjectAppPictureMutationVariables
 >;
+export const ClearProjectOAuthConnectionDocument = {
+  kind: 'Document',
+  definitions: [
+    {
+      kind: 'OperationDefinition',
+      operation: 'mutation',
+      name: { kind: 'Name', value: 'ClearProjectOAuthConnection' },
+      variableDefinitions: [
+        {
+          kind: 'VariableDefinition',
+          variable: { kind: 'Variable', name: { kind: 'Name', value: 'input' } },
+          type: {
+            kind: 'NonNullType',
+            type: {
+              kind: 'NamedType',
+              name: { kind: 'Name', value: 'ClearProjectOAuthConnectionInput' },
+            },
+          },
+        },
+      ],
+      selectionSet: {
+        kind: 'SelectionSet',
+        selections: [
+          {
+            kind: 'Field',
+            name: { kind: 'Name', value: 'clearProjectOAuthConnection' },
+            arguments: [
+              {
+                kind: 'Argument',
+                name: { kind: 'Name', value: 'input' },
+                value: { kind: 'Variable', name: { kind: 'Name', value: 'input' } },
+              },
+            ],
+          },
+        ],
+      },
+    },
+  ],
+} as unknown as DocumentNode<
+  ClearProjectOAuthConnectionMutation,
+  ClearProjectOAuthConnectionMutationVariables
+>;
+export const GetProjectOAuthConnectionsDocument = {
+  kind: 'Document',
+  definitions: [
+    {
+      kind: 'OperationDefinition',
+      operation: 'query',
+      name: { kind: 'Name', value: 'GetProjectOAuthConnections' },
+      variableDefinitions: [
+        {
+          kind: 'VariableDefinition',
+          variable: { kind: 'Variable', name: { kind: 'Name', value: 'scope' } },
+          type: {
+            kind: 'NonNullType',
+            type: { kind: 'NamedType', name: { kind: 'Name', value: 'Scope' } },
+          },
+        },
+      ],
+      selectionSet: {
+        kind: 'SelectionSet',
+        selections: [
+          {
+            kind: 'Field',
+            name: { kind: 'Name', value: 'projectOAuthConnections' },
+            arguments: [
+              {
+                kind: 'Argument',
+                name: { kind: 'Name', value: 'scope' },
+                value: { kind: 'Variable', name: { kind: 'Name', value: 'scope' } },
+              },
+            ],
+            selectionSet: {
+              kind: 'SelectionSet',
+              selections: [
+                { kind: 'Field', name: { kind: 'Name', value: 'id' } },
+                { kind: 'Field', name: { kind: 'Name', value: 'projectId' } },
+                { kind: 'Field', name: { kind: 'Name', value: 'provider' } },
+                { kind: 'Field', name: { kind: 'Name', value: 'clientId' } },
+                { kind: 'Field', name: { kind: 'Name', value: 'isConfigured' } },
+                { kind: 'Field', name: { kind: 'Name', value: 'createdAt' } },
+                { kind: 'Field', name: { kind: 'Name', value: 'updatedAt' } },
+              ],
+            },
+          },
+        ],
+      },
+    },
+  ],
+} as unknown as DocumentNode<
+  GetProjectOAuthConnectionsQuery,
+  GetProjectOAuthConnectionsQueryVariables
+>;
+export const UpsertProjectOAuthConnectionDocument = {
+  kind: 'Document',
+  definitions: [
+    {
+      kind: 'OperationDefinition',
+      operation: 'mutation',
+      name: { kind: 'Name', value: 'UpsertProjectOAuthConnection' },
+      variableDefinitions: [
+        {
+          kind: 'VariableDefinition',
+          variable: { kind: 'Variable', name: { kind: 'Name', value: 'input' } },
+          type: {
+            kind: 'NonNullType',
+            type: {
+              kind: 'NamedType',
+              name: { kind: 'Name', value: 'UpsertProjectOAuthConnectionInput' },
+            },
+          },
+        },
+      ],
+      selectionSet: {
+        kind: 'SelectionSet',
+        selections: [
+          {
+            kind: 'Field',
+            name: { kind: 'Name', value: 'upsertProjectOAuthConnection' },
+            arguments: [
+              {
+                kind: 'Argument',
+                name: { kind: 'Name', value: 'input' },
+                value: { kind: 'Variable', name: { kind: 'Name', value: 'input' } },
+              },
+            ],
+            selectionSet: {
+              kind: 'SelectionSet',
+              selections: [
+                { kind: 'Field', name: { kind: 'Name', value: 'id' } },
+                { kind: 'Field', name: { kind: 'Name', value: 'projectId' } },
+                { kind: 'Field', name: { kind: 'Name', value: 'provider' } },
+                { kind: 'Field', name: { kind: 'Name', value: 'clientId' } },
+                { kind: 'Field', name: { kind: 'Name', value: 'isConfigured' } },
+                { kind: 'Field', name: { kind: 'Name', value: 'createdAt' } },
+                { kind: 'Field', name: { kind: 'Name', value: 'updatedAt' } },
+              ],
+            },
+          },
+        ],
+      },
+    },
+  ],
+} as unknown as DocumentNode<
+  UpsertProjectOAuthConnectionMutation,
+  UpsertProjectOAuthConnectionMutationVariables
+>;
 export const CancelProjectSyncDocument = {
   kind: 'Document',
   definitions: [

package/src/generated/resolvers.ts

@@ -128,6 +128,7 @@ export type ResolversInterfaceTypes<_RefType extends Record<string, unknown>> =
     | Types.ProjectApp
     | Types.ProjectAppTag
     | Types.ProjectGroup
+    | Types.ProjectOAuthConnection
     | Types.ProjectPermission
     | Types.ProjectResource
     | Types.ProjectRole
@@ -238,6 +239,7 @@ export type ResolversTypes = ResolversObject<{
   ChangeMyPasswordInput: Types.ChangeMyPasswordInput;
   ChangeMyPasswordResult: ResolverTypeWrapper<Types.ChangeMyPasswordResult>;
   ClearProjectAppPictureInput: Types.ClearProjectAppPictureInput;
+  ClearProjectOAuthConnectionInput: Types.ClearProjectOAuthConnectionInput;
   ClearProjectPictureInput: Types.ClearProjectPictureInput;
   ConfirmMyProjectMembershipPictureUploadInput: Types.ConfirmMyProjectMembershipPictureUploadInput;
   ConfirmMyUserPictureUploadInput: Types.ConfirmMyUserPictureUploadInput;
@@ -359,6 +361,8 @@ export type ResolversTypes = ResolversObject<{
   ProjectAppTag: ResolverTypeWrapper<Types.ProjectAppTag>;
   ProjectGroup: ResolverTypeWrapper<Types.ProjectGroup>;
   ProjectMembershipExportData: ResolverTypeWrapper<Types.ProjectMembershipExportData>;
+  ProjectOAuthConnection: ResolverTypeWrapper<Types.ProjectOAuthConnection>;
+  ProjectOAuthConnectionProvider: Types.ProjectOAuthConnectionProvider;
   ProjectPage: ResolverTypeWrapper<Types.ProjectPage>;
   ProjectPermission: ResolverTypeWrapper<Types.ProjectPermission>;
   ProjectResource: ResolverTypeWrapper<Types.ProjectResource>;
@@ -545,6 +549,7 @@ export type ResolversTypes = ResolversObject<{
   UploadUrlHeader: ResolverTypeWrapper<Types.UploadUrlHeader>;
   UploadUserPictureInput: Types.UploadUserPictureInput;
   UploadUserPictureResult: ResolverTypeWrapper<Types.UploadUserPictureResult>;
+  UpsertProjectOAuthConnectionInput: Types.UpsertProjectOAuthConnectionInput;
   User: ResolverTypeWrapper<Types.User>;
   UserApiKeyCdmInput: Types.UserApiKeyCdmInput;
   UserAuthenticationEmailProviderAction: Types.UserAuthenticationEmailProviderAction;
@@ -639,6 +644,7 @@ export type ResolversParentTypes = ResolversObject<{
   ChangeMyPasswordInput: Types.ChangeMyPasswordInput;
   ChangeMyPasswordResult: Types.ChangeMyPasswordResult;
   ClearProjectAppPictureInput: Types.ClearProjectAppPictureInput;
+  ClearProjectOAuthConnectionInput: Types.ClearProjectOAuthConnectionInput;
   ClearProjectPictureInput: Types.ClearProjectPictureInput;
   ConfirmMyProjectMembershipPictureUploadInput: Types.ConfirmMyProjectMembershipPictureUploadInput;
   ConfirmMyUserPictureUploadInput: Types.ConfirmMyUserPictureUploadInput;
@@ -741,6 +747,7 @@ export type ResolversParentTypes = ResolversObject<{
   ProjectAppTag: Types.ProjectAppTag;
   ProjectGroup: Types.ProjectGroup;
   ProjectMembershipExportData: Types.ProjectMembershipExportData;
+  ProjectOAuthConnection: Types.ProjectOAuthConnection;
   ProjectPage: Types.ProjectPage;
   ProjectPermission: Types.ProjectPermission;
   ProjectResource: Types.ProjectResource;
@@ -913,6 +920,7 @@ export type ResolversParentTypes = ResolversObject<{
   UploadUrlHeader: Types.UploadUrlHeader;
   UploadUserPictureInput: Types.UploadUserPictureInput;
   UploadUserPictureResult: Types.UploadUserPictureResult;
+  UpsertProjectOAuthConnectionInput: Types.UpsertProjectOAuthConnectionInput;
   User: Types.User;
   UserApiKeyCdmInput: Types.UserApiKeyCdmInput;
   UserAuthenticationMethod: Types.UserAuthenticationMethod;
@@ -1143,6 +1151,7 @@ export type AuditableResolvers<
     | 'ProjectApp'
     | 'ProjectAppTag'
     | 'ProjectGroup'
+    | 'ProjectOAuthConnection'
     | 'ProjectPermission'
     | 'ProjectResource'
     | 'ProjectRole'
@@ -1512,6 +1521,12 @@ export type MutationResolvers<
     ContextType,
     RequireFields<Types.MutationClearProjectAppPictureArgs, 'input'>
   >;
+  clearProjectOAuthConnection?: Resolver<
+    ResolversTypes['Boolean'],
+    ParentType,
+    ContextType,
+    RequireFields<Types.MutationClearProjectOAuthConnectionArgs, 'input'>
+  >;
   clearProjectPicture?: Resolver<
     ResolversTypes['Project'],
     ParentType,
@@ -2030,6 +2045,12 @@ export type MutationResolvers<
     ContextType,
     RequireFields<Types.MutationUploadUserPictureArgs, 'input'>
   >;
+  upsertProjectOAuthConnection?: Resolver<
+    ResolversTypes['ProjectOAuthConnection'],
+    ParentType,
+    ContextType,
+    RequireFields<Types.MutationUpsertProjectOAuthConnectionArgs, 'input'>
+  >;
   verifyEmail?: Resolver<
     ResolversTypes['VerifyEmailResponse'],
     ParentType,
@@ -2568,6 +2589,22 @@ export type ProjectMembershipExportDataResolvers<
   role?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
 }>;
 
+export type ProjectOAuthConnectionResolvers<
+  ContextType = any,
+  ParentType extends ResolversParentTypes['ProjectOAuthConnection'] =
+    ResolversParentTypes['ProjectOAuthConnection'],
+> = ResolversObject<{
+  clientId?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+  createdAt?: Resolver<ResolversTypes['Date'], ParentType, ContextType>;
+  deletedAt?: Resolver<Types.Maybe<ResolversTypes['Date']>, ParentType, ContextType>;
+  id?: Resolver<ResolversTypes['ID'], ParentType, ContextType>;
+  isConfigured?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+  projectId?: Resolver<ResolversTypes['ID'], ParentType, ContextType>;
+  provider?: Resolver<ResolversTypes['ProjectOAuthConnectionProvider'], ParentType, ContextType>;
+  updatedAt?: Resolver<ResolversTypes['Date'], ParentType, ContextType>;
+  __isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>;
+}>;
+
 export type ProjectPageResolvers<
   ContextType = any,
   ParentType extends ResolversParentTypes['ProjectPage'] = ResolversParentTypes['ProjectPage'],
@@ -2883,6 +2920,12 @@ export type QueryResolvers<
     ContextType,
     RequireFields<Types.QueryProjectAppsArgs, 'scope'>
   >;
+  projectOAuthConnections?: Resolver<
+    Array<ResolversTypes['ProjectOAuthConnection']>,
+    ParentType,
+    ContextType,
+    RequireFields<Types.QueryProjectOAuthConnectionsArgs, 'scope'>
+  >;
   projectSyncJob?: Resolver<
     ResolversTypes['ProjectSyncJob'],
     ParentType,
@@ -3696,6 +3739,7 @@ export type Resolvers<ContextType = any> = ResolversObject<{
   ProjectAppTag?: ProjectAppTagResolvers<ContextType>;
   ProjectGroup?: ProjectGroupResolvers<ContextType>;
   ProjectMembershipExportData?: ProjectMembershipExportDataResolvers<ContextType>;
+  ProjectOAuthConnection?: ProjectOAuthConnectionResolvers<ContextType>;
   ProjectPage?: ProjectPageResolvers<ContextType>;
   ProjectPermission?: ProjectPermissionResolvers<ContextType>;
   ProjectResource?: ProjectResourceResolvers<ContextType>;

package/src/generated/schema-types.ts

@@ -488,6 +488,11 @@ export type ClearProjectAppPictureInput = {
   scope: Scope;
 };
 
+export type ClearProjectOAuthConnectionInput = {
+  provider: ProjectOAuthConnectionProvider;
+  scope: Scope;
+};
+
 export type ClearProjectPictureInput = {
   projectId: Scalars['ID']['input'];
   scope: Scope;
@@ -1038,6 +1043,12 @@ export type Mutation = {
   changeMyPassword: ChangeMyPasswordResult;
   /** Clear the project-app logo. Does not delete the stored object. */
   clearProjectAppPicture: ProjectApp;
+  /**
+   * Remove the project's GitHub or Google OAuth connection.
+   * Ciphertext is wiped; the secret is never returned.
+   * Requires Project Update on the scoped project.
+   */
+  clearProjectOAuthConnection: Scalars['Boolean']['output'];
   /** Clear the project logo. Does not delete the stored object. */
   clearProjectPicture: Project;
   /**
@@ -1254,6 +1265,12 @@ export type Mutation = {
   /** Upload a project logo and persist its public URL. */
   uploadProjectPicture: UploadProjectPictureResult;
   uploadUserPicture: UploadUserPictureResult;
+  /**
+   * Create or replace the project's GitHub or Google OAuth connection.
+   * The client secret is write-only and is never returned.
+   * Requires Project Update on the scoped project.
+   */
+  upsertProjectOAuthConnection: ProjectOAuthConnection;
   verifyEmail: VerifyEmailResponse;
   verifyMfa: MfaVerifyResponse;
   verifyMfaRecoveryCode: MfaVerifyResponse;
@@ -1286,6 +1303,10 @@ export type MutationClearProjectAppPictureArgs = {
   input: ClearProjectAppPictureInput;
 };
 
+export type MutationClearProjectOAuthConnectionArgs = {
+  input: ClearProjectOAuthConnectionInput;
+};
+
 export type MutationClearProjectPictureArgs = {
   input: ClearProjectPictureInput;
 };
@@ -1650,6 +1671,10 @@ export type MutationUploadUserPictureArgs = {
   input: UploadUserPictureInput;
 };
 
+export type MutationUpsertProjectOAuthConnectionArgs = {
+  input: UpsertProjectOAuthConnectionInput;
+};
+
 export type MutationVerifyEmailArgs = {
   input: VerifyEmailInput;
 };
@@ -2180,6 +2205,33 @@ export type ProjectMembershipExportData = {
   role: Scalars['String']['output'];
 };
 
+/**
+ * Per-project GitHub or Google OAuth app (Auth0-style connection).
+ * The client secret is write-only and is never returned.
+ */
+export type ProjectOAuthConnection = Auditable & {
+  __typename?: 'ProjectOAuthConnection';
+  /** Public OAuth client id of the customer's GitHub or Google app. Not a secret. */
+  clientId: Scalars['String']['output'];
+  createdAt: Scalars['Date']['output'];
+  deletedAt?: Maybe<Scalars['Date']['output']>;
+  id: Scalars['ID']['output'];
+  /** True when a BYO client secret is stored for this provider. The secret itself is never returned. */
+  isConfigured: Scalars['Boolean']['output'];
+  projectId: Scalars['ID']['output'];
+  provider: ProjectOAuthConnectionProvider;
+  updatedAt: Scalars['Date']['output'];
+};
+
+/**
+ * Social identity providers that can have a per-project OAuth connection.
+ * Email magic-link is not a connection.
+ */
+export enum ProjectOAuthConnectionProvider {
+  Github = 'github',
+  Google = 'google',
+}
+
 export type ProjectPage = PaginatedResults & {
   __typename?: 'ProjectPage';
   hasNextPage: Scalars['Boolean']['output'];
@@ -2420,6 +2472,12 @@ export type Query = {
   permissions: PermissionPage;
   /** List OAuth apps for the given project scope. Allowed scopes: accountProject, organizationProject. */
   projectApps: ProjectAppPage;
+  /**
+   * List GitHub/Google OAuth connections for the project in `scope`.
+   * Secrets and ciphertext are never returned.
+   * Allowed scopes: accountProject, organizationProject.
+   */
+  projectOAuthConnections: Array<ProjectOAuthConnection>;
   /**
    * Read the current state of a project CDM sync job. Use this to poll
    * the lifecycle of a job started via `startProjectSync`.
@@ -2541,6 +2599,10 @@ export type QueryProjectAppsArgs = {
   tagIds?: InputMaybe<Array<Scalars['ID']['input']>>;
 };
 
+export type QueryProjectOAuthConnectionsArgs = {
+  scope: Scope;
+};
+
 export type QueryProjectSyncJobArgs = {
   id: Scalars['ID']['input'];
   jobId: Scalars['ID']['input'];
@@ -3853,6 +3915,15 @@ export type UploadUserPictureResult = {
   url: Scalars['String']['output'];
 };
 
+export type UpsertProjectOAuthConnectionInput = {
+  /** Public OAuth client id of the customer's GitHub or Google app. */
+  clientId: Scalars['String']['input'];
+  /** OAuth client secret. Write-only; never returned on the connection type or in logs. */
+  clientSecret: Scalars['String']['input'];
+  provider: ProjectOAuthConnectionProvider;
+  scope: Scope;
+};
+
 export type User = Auditable & {
   __typename?: 'User';
   accounts?: Maybe<Array<Account>>;

package/src/operations/project-oauth-connections/clear-project-oauth-connection.graphql

@@ -0,0 +1,3 @@
+mutation ClearProjectOAuthConnection($input: ClearProjectOAuthConnectionInput!) {
+  clearProjectOAuthConnection(input: $input)
+}

package/src/operations/project-oauth-connections/get-project-oauth-connections.graphql

@@ -0,0 +1,11 @@
+query GetProjectOAuthConnections($scope: Scope!) {
+  projectOAuthConnections(scope: $scope) {
+    id
+    projectId
+    provider
+    clientId
+    isConfigured
+    createdAt
+    updatedAt
+  }
+}

package/src/operations/project-oauth-connections/upsert-project-oauth-connection.graphql

@@ -0,0 +1,11 @@
+mutation UpsertProjectOAuthConnection($input: UpsertProjectOAuthConnectionInput!) {
+  upsertProjectOAuthConnection(input: $input) {
+    id
+    projectId
+    provider
+    clientId
+    isConfigured
+    createdAt
+    updatedAt
+  }
+}

package/src/project-oauth-connection.sdl.test.ts

@@ -0,0 +1,61 @@
+import { parse, validate } from 'graphql';
+import { describe, expect, it } from 'vitest';
+
+import { buildMergedSchema, operationFiles, readAll } from './test-support/sdl-fixture';
+
+const SECRET_FIELD = /secret|encrypted|ciphertext|^iv$/i;
+
+describe('ProjectOAuthConnection public types', () => {
+  const schema = buildMergedSchema();
+
+  it('does not expose secrets on the connection output type', () => {
+    const connection = schema.getType('ProjectOAuthConnection');
+    expect(connection).toBeDefined();
+    expect(connection?.astNode?.kind).toBe('ObjectTypeDefinition');
+    const fields =
+      connection && 'getFields' in connection ? Object.keys(connection.getFields()) : [];
+
+    expect(fields).toEqual(
+      expect.arrayContaining([
+        'id',
+        'projectId',
+        'provider',
+        'clientId',
+        'isConfigured',
+        'createdAt',
+        'updatedAt',
+      ])
+    );
+    expect(fields.filter((name) => SECRET_FIELD.test(name))).toEqual([]);
+  });
+
+  it('accepts the client secret only as a write-only upsert input', () => {
+    const input = schema.getType('UpsertProjectOAuthConnectionInput');
+    expect(input).toBeDefined();
+    const fields = input && 'getFields' in input ? Object.keys(input.getFields()) : [];
+
+    expect(fields).toEqual(
+      expect.arrayContaining(['scope', 'provider', 'clientId', 'clientSecret'])
+    );
+    expect(schema.getType('ClearProjectOAuthConnectionInput')).toBeDefined();
+    expect(schema.getQueryType()?.getFields().projectOAuthConnections).toBeDefined();
+    expect(schema.getMutationType()?.getFields().upsertProjectOAuthConnection).toBeDefined();
+    expect(schema.getMutationType()?.getFields().clearProjectOAuthConnection).toBeDefined();
+  });
+
+  it('keeps operation documents from selecting secret fields', () => {
+    const files = operationFiles().filter((file) => file.includes('project-oauth-connections'));
+    expect(files.length).toBe(3);
+
+    for (const file of files) {
+      const errors = validate(schema, parse(readAll([file])));
+      expect(errors.map((e) => e.message)).toEqual([]);
+    }
+
+    const documents = readAll(files);
+    expect(documents).not.toMatch(/\bclientSecret\b/);
+    expect(documents).not.toMatch(/\bencryptedSecret\b/);
+    expect(documents).not.toMatch(/\bsecretIv\b/);
+    expect(documents).not.toMatch(/\bsecretTag\b/);
+  });
+});

package/src/project-oauth.types.test.ts

@@ -1,5 +1,6 @@
 import { describe, expect, it } from 'vitest';
 
+import type { ProjectAppPublicInfo } from './project-oauth.types';
 import { isProjectOAuthThemeMode } from './project-oauth.types';
 
 describe('isProjectOAuthThemeMode', () => {
@@ -16,3 +17,23 @@ describe('isProjectOAuthThemeMode', () => {
     expect(isProjectOAuthThemeMode('DARK')).toBe(false);
   });
 });
+
+const SECRET_FIELD = /secret|encrypted|ciphertext|^iv$/i;
+
+describe('ProjectAppPublicInfo', () => {
+  it('does not declare secret or ciphertext fields', () => {
+    const sample: ProjectAppPublicInfo = {
+      name: null,
+      projectName: null,
+      pictureUrl: null,
+      primaryColor: null,
+      showHelpPanel: true,
+      themeMode: null,
+      enabledProviders: ['github'],
+      configuredProviders: ['github'],
+      scopes: [],
+    };
+
+    expect(Object.keys(sample).filter((key) => SECRET_FIELD.test(key))).toEqual([]);
+  });
+});

package/src/project-oauth.types.ts

@@ -29,6 +29,11 @@ export interface ProjectAppPublicInfo {
   showHelpPanel: boolean;
   themeMode: ProjectOAuthThemeMode | null;
   enabledProviders: string[] | null;
+  /**
+   * Social providers this project can offer (BYO connection and/or platform fallback).
+   * Hosted sign-in uses this instead of GET /api/auth/providers.
+   */
+  configuredProviders?: string[];
   scopes: ProjectAppScopeInfo[];
 }
 

package/src/schema/project-oauth-connections/inputs/clear-project-oauth-connection.graphql

@@ -0,0 +1,4 @@
+input ClearProjectOAuthConnectionInput {
+  scope: Scope!
+  provider: ProjectOAuthConnectionProvider!
+}

package/src/schema/project-oauth-connections/inputs/upsert-project-oauth-connection.graphql

@@ -0,0 +1,12 @@
+input UpsertProjectOAuthConnectionInput {
+  scope: Scope!
+  provider: ProjectOAuthConnectionProvider!
+  """
+  Public OAuth client id of the customer's GitHub or Google app.
+  """
+  clientId: String!
+  """
+  OAuth client secret. Write-only; never returned on the connection type or in logs.
+  """
+  clientSecret: String!
+}

package/src/schema/project-oauth-connections/mutations/clear-project-oauth-connection.graphql

@@ -0,0 +1,8 @@
+extend type Mutation {
+  """
+  Remove the project's GitHub or Google OAuth connection.
+  Ciphertext is wiped; the secret is never returned.
+  Requires Project Update on the scoped project.
+  """
+  clearProjectOAuthConnection(input: ClearProjectOAuthConnectionInput!): Boolean!
+}

package/src/schema/project-oauth-connections/mutations/upsert-project-oauth-connection.graphql

@@ -0,0 +1,8 @@
+extend type Mutation {
+  """
+  Create or replace the project's GitHub or Google OAuth connection.
+  The client secret is write-only and is never returned.
+  Requires Project Update on the scoped project.
+  """
+  upsertProjectOAuthConnection(input: UpsertProjectOAuthConnectionInput!): ProjectOAuthConnection!
+}

package/src/schema/project-oauth-connections/queries/get-project-oauth-connections.graphql

@@ -0,0 +1,8 @@
+extend type Query {
+  """
+  List GitHub/Google OAuth connections for the project in `scope`.
+  Secrets and ciphertext are never returned.
+  Allowed scopes: accountProject, organizationProject.
+  """
+  projectOAuthConnections(scope: Scope!): [ProjectOAuthConnection!]!
+}

package/src/schema/project-oauth-connections/types/project-oauth-connection-provider.graphql

@@ -0,0 +1,8 @@
+"""
+Social identity providers that can have a per-project OAuth connection.
+Email magic-link is not a connection.
+"""
+enum ProjectOAuthConnectionProvider {
+  github
+  google
+}

package/src/schema/project-oauth-connections/types/project-oauth-connection.graphql

@@ -0,0 +1,20 @@
+"""
+Per-project GitHub or Google OAuth app (Auth0-style connection).
+The client secret is write-only and is never returned.
+"""
+type ProjectOAuthConnection implements Auditable {
+  id: ID!
+  projectId: ID!
+  provider: ProjectOAuthConnectionProvider!
+  """
+  Public OAuth client id of the customer's GitHub or Google app. Not a secret.
+  """
+  clientId: String!
+  """
+  True when a BYO client secret is stored for this provider. The secret itself is never returned.
+  """
+  isConfigured: Boolean!
+  createdAt: Date!
+  updatedAt: Date!
+  deletedAt: Date
+}

package/src/sdl-contract.test.ts

@@ -48,10 +48,11 @@ describe('operation documents', () => {
   // 124 after slice 17b: organization request/confirm (the last upload target).
   // 132 after project branding: request/confirm/upload/clear for project and
   // project-app pictures (eight operation documents).
+  // 135 after project OAuth connections: get/upsert/clear (three operation documents).
   // Updating this number is the point of the pin, not a nuisance: every change
   // to it should be a line in a commit message.
   it('finds every document under src/operations', () => {
-    expect(files).toHaveLength(132);
+    expect(files).toHaveLength(135);
   });
 
   it.each(files.map((f) => [relative(process.cwd(), f), f]))('%s validates', (_label, file) => {