graphqlad 0.1.0__py3-none-any.whl

graphqlad/__init__.py

@@ -0,0 +1,7 @@
+"""graphqlAD: a read-only GraphQL interface over the msad library."""
+
+from __future__ import annotations
+
+__all__ = ["__version__"]
+
+__version__ = "0.1.0"

graphqlad/__main__.py

@@ -0,0 +1,25 @@
+"""Console entry point: run the graphqlAD API with uvicorn.
+
+Usage:
+    graphqlad                      # listen on 127.0.0.1:8000
+    GRAPHQLAD_HOST=0.0.0.0 GRAPHQLAD_PORT=9000 graphqlad
+
+Host/port are read from GRAPHQLAD_HOST / GRAPHQLAD_PORT (not the MSAD_* vars,
+which configure the directory connection).
+"""
+
+from __future__ import annotations
+
+import os
+
+
+def main() -> None:
+    import uvicorn
+
+    host = os.environ.get("GRAPHQLAD_HOST", "127.0.0.1")
+    port = int(os.environ.get("GRAPHQLAD_PORT", "8000"))
+    uvicorn.run("graphqlad.app:app", host=host, port=port, factory=False)
+
+
+if __name__ == "__main__":
+    main()

graphqlad/app.py

@@ -0,0 +1,124 @@
+"""FastAPI application factory and lifespan for graphqlAD.
+
+At startup the lifespan resolves the effective :class:`msad.DomainConfig`
+(TOML + ``MSAD_*`` env overrides), opens a single bound LDAP connection and
+stores both on ``app.state``. At shutdown it unbinds the connection.
+
+By default a failure to connect at startup is fatal. Set
+``GRAPHQLAD_LAZY_CONNECT=true`` to start anyway (the ``health`` query still
+works and reports the error; data queries return a GraphQL error until a
+connection is available).
+
+The GraphiQL in-browser IDE is served at ``/graphql`` by default; disable it
+with ``GRAPHQLAD_GRAPHIQL=false``.
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+from collections.abc import AsyncIterator
+from contextlib import asynccontextmanager
+
+from fastapi import FastAPI, Request
+from msad import connect
+from strawberry.fastapi import GraphQLRouter
+
+from .context import Context
+from .schema import schema
+
+logger = logging.getLogger("graphqlad")
+
+_TRUE = {"1", "true", "yes", "on"}
+
+
+def _env_flag(name: str, default: bool = False) -> bool:
+    value = os.environ.get(name)
+    if value is None:
+        return default
+    return value.strip().lower() in _TRUE
+
+
+@asynccontextmanager
+async def lifespan(app: FastAPI) -> AsyncIterator[None]:
+    """Resolve config, open the LDAP connection, and tear it down on exit."""
+    # Imported lazily so importing the module never triggers config resolution.
+    from .config import resolve_domain_config
+
+    lazy = _env_flag("GRAPHQLAD_LAZY_CONNECT")
+
+    config = resolve_domain_config()
+    app.state.config = config
+    app.state.conn = None
+
+    try:
+        app.state.conn = connect(config)
+        auth = "kerberos" if config.uses_kerberos else config.user
+        logger.info("Connected to the directory as %s", auth)
+    except Exception as exc:
+        # MsadConnectionError on bind/connect failure, but also e.g. environment
+        # issues raised deeper in ldap3. In lazy mode we start anyway; otherwise
+        # startup fails loudly.
+        if not lazy:
+            raise
+        logger.warning("Startup connection failed (lazy mode, continuing): %s", exc)
+
+    try:
+        yield
+    finally:
+        conn = app.state.conn
+        if conn is not None:
+            try:
+                conn.unbind()
+            except Exception:  # best-effort teardown
+                logger.debug("unbind on shutdown failed", exc_info=True)
+
+
+async def get_context(request: Request) -> Context:
+    """Build the per-request GraphQL context from app.state."""
+    return Context(
+        config=getattr(request.app.state, "config", None),
+        conn=getattr(request.app.state, "conn", None),
+    )
+
+
+def create_app() -> FastAPI:
+    """Build and configure the FastAPI application.
+
+    GraphiQL (the in-browser GraphQL IDE at ``/graphql``) is enabled by
+    default. Set ``GRAPHQLAD_GRAPHIQL=false`` to disable it (the GraphQL
+    endpoint itself keeps serving POST queries).
+    """
+    graphiql = _env_flag("GRAPHQLAD_GRAPHIQL", default=True)
+
+    app = FastAPI(
+        title="graphqlAD",
+        version="0.1.0",
+        summary="Read-only GraphQL interface over Active Directory (msad).",
+        lifespan=lifespan,
+    )
+
+    graphql_app: GraphQLRouter = GraphQLRouter(
+        schema,
+        context_getter=get_context,
+        graphql_ide="graphiql" if graphiql else None,
+    )
+    app.include_router(graphql_app, prefix="/graphql")
+
+    @app.get("/", tags=["meta"], summary="Service metadata")
+    def root() -> dict[str, str]:
+        return {
+            "service": "graphqlad",
+            "version": "0.1.0",
+            "graphql": "/graphql",
+            "graphiql": "/graphql" if graphiql else "disabled",
+        }
+
+    return app
+
+
+# Module-level app for `uvicorn graphqlad.app:app` and ASGI servers.
+app = create_app()
+
+
+__all__ = ["app", "create_app", "lifespan", "get_context"]

graphqlad/config.py

@@ -0,0 +1,145 @@
+"""Configuration resolution for graphqlAD.
+
+The effective :class:`msad.DomainConfig` is built in two layers:
+
+1. Optionally load an msad TOML config file (``~/.msad.toml`` by default, or
+   the path in ``MSAD_CONFIG_FILE``) and pick a domain.
+2. Apply ``MSAD_*`` environment-variable overrides on top. Environment values
+   always win, so credentials (and any connection parameter) can be injected
+   at runtime without ever being written to the TOML file.
+
+Supported environment variables
+--------------------------------
+=========================  =================================================
+Variable                   Effect
+=========================  =================================================
+``MSAD_CONFIG_FILE``       Path to the msad TOML file (default ``~/.msad.toml``).
+``MSAD_DOMAIN``            Which ``[domains.<name>]`` section to use.
+``MSAD_HOST``              Override ``host``.
+``MSAD_BASE``              Override ``base`` (search base DN).
+``MSAD_PORT``              Override ``port`` (int).
+``MSAD_USE_SSL``           Override ``use_ssl`` (true/false/1/0/yes/no).
+``MSAD_USER``              Override bind ``user`` (enables user/password bind).
+``MSAD_PASSWORD``          Override bind ``password``.
+``MSAD_QUERY_TIMEOUT``     Override ``query_timeout`` (int seconds).
+=========================  =================================================
+
+If no TOML file exists, the configuration is built entirely from the
+environment: at minimum ``MSAD_HOST`` and ``MSAD_BASE`` must be set.
+"""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+from msad import DomainConfig, MsadConfigError, load_config
+
+#: Env var holding the path to the msad TOML config file.
+ENV_CONFIG_FILE = "MSAD_CONFIG_FILE"
+#: Env var selecting which domain section to use.
+ENV_DOMAIN = "MSAD_DOMAIN"
+
+_TRUE = {"1", "true", "yes", "on"}
+_FALSE = {"0", "false", "no", "off"}
+
+
+class ConfigError(RuntimeError):
+    """Raised when the effective configuration cannot be resolved."""
+
+
+def _parse_bool(value: str, name: str) -> bool:
+    lowered = value.strip().lower()
+    if lowered in _TRUE:
+        return True
+    if lowered in _FALSE:
+        return False
+    raise ConfigError(f"{name}: expected a boolean, got {value!r}")
+
+
+def _parse_int(value: str, name: str) -> int:
+    try:
+        return int(value.strip())
+    except ValueError as exc:
+        raise ConfigError(f"{name}: expected an integer, got {value!r}") from exc
+
+
+def _base_from_toml(env: dict[str, str]) -> dict[str, object]:
+    """Load the TOML file (if any) and return the chosen domain as a dict.
+
+    Returns an empty dict when no config file is present, so the configuration
+    can be built purely from environment variables.
+    """
+    config_file = env.get(ENV_CONFIG_FILE)
+    domain = env.get(ENV_DOMAIN)
+
+    path = Path(config_file) if config_file else None
+    # Only attempt to load when a file is explicitly given or the default
+    # exists; otherwise fall back to a pure-env configuration.
+    from msad import DEFAULT_CONFIG_PATH
+
+    if path is None and DEFAULT_CONFIG_PATH.is_file():
+        path = DEFAULT_CONFIG_PATH
+
+    if path is None:
+        return {}
+
+    try:
+        config = load_config(path)
+        domain_config = config.get_domain(domain)
+    except MsadConfigError as exc:
+        raise ConfigError(str(exc)) from exc
+
+    return domain_config.model_dump()
+
+
+def _apply_env_overrides(data: dict[str, object], env: dict[str, str]) -> dict[str, object]:
+    """Overlay ``MSAD_*`` environment overrides onto a config dict."""
+    if (host := env.get("MSAD_HOST")) is not None:
+        data["host"] = host
+    if (base := env.get("MSAD_BASE")) is not None:
+        data["base"] = base
+    if (port := env.get("MSAD_PORT")) is not None:
+        data["port"] = _parse_int(port, "MSAD_PORT")
+    if (use_ssl := env.get("MSAD_USE_SSL")) is not None:
+        data["use_ssl"] = _parse_bool(use_ssl, "MSAD_USE_SSL")
+    if (user := env.get("MSAD_USER")) is not None:
+        data["user"] = user
+    if (password := env.get("MSAD_PASSWORD")) is not None:
+        data["password"] = password
+    if (timeout := env.get("MSAD_QUERY_TIMEOUT")) is not None:
+        data["query_timeout"] = _parse_int(timeout, "MSAD_QUERY_TIMEOUT")
+    return data
+
+
+def resolve_domain_config(env: dict[str, str] | None = None) -> DomainConfig:
+    """Resolve the effective :class:`msad.DomainConfig`.
+
+    Args:
+        env: environment mapping to read from (defaults to ``os.environ``).
+            Injectable for testing.
+
+    Returns:
+        A validated :class:`msad.DomainConfig`.
+
+    Raises:
+        ConfigError: if required fields are missing or values are invalid.
+    """
+    environ = dict(os.environ if env is None else env)
+
+    data = _base_from_toml(environ)
+    data = _apply_env_overrides(data, environ)
+
+    missing = [k for k in ("host", "base") if not data.get(k)]
+    if missing:
+        raise ConfigError(
+            "Missing required configuration: "
+            + ", ".join(missing)
+            + ". Provide them via the msad TOML file or the MSAD_HOST / MSAD_BASE "
+            "environment variables."
+        )
+
+    try:
+        return DomainConfig.model_validate(data)
+    except Exception as exc:  # pydantic ValidationError and friends
+        raise ConfigError(f"Invalid configuration: {exc}") from exc

graphqlad/context.py

@@ -0,0 +1,59 @@
+"""GraphQL execution context.
+
+The LDAP connection and resolved configuration are created once during the
+application lifespan (see :mod:`graphqlad.app`) and stored on ``app.state``.
+The context getter exposes them to resolvers, mirroring restAD's FastAPI
+dependencies.
+"""
+
+from __future__ import annotations
+
+from msad import DomainConfig
+from msad.types import LdapConnection
+from strawberry.fastapi import BaseContext
+
+
+class ConnectionUnavailableError(RuntimeError):
+    """Raised by resolvers when no bound LDAP connection is available.
+
+    Happens when the directory was unreachable at startup and lazy-connect is
+    enabled; GraphQL surfaces this as an error entry in the response.
+    """
+
+
+class Context(BaseContext):
+    """Per-request GraphQL context.
+
+    Inherits from strawberry's :class:`BaseContext` (required by
+    ``GraphQLRouter``). ``conn`` is ``None`` when the directory could not be
+    reached at startup (lazy mode); ``config`` is always present once the
+    lifespan has run.
+    """
+
+    def __init__(
+        self,
+        config: DomainConfig | None = None,
+        conn: LdapConnection | None = None,
+    ) -> None:
+        super().__init__()
+        self.config = config
+        self.conn = conn
+
+    def require_conn(self) -> LdapConnection:
+        """Return the bound connection or raise if it is unavailable."""
+        if self.conn is None:
+            raise ConnectionUnavailableError(
+                "LDAP connection is not available (directory unreachable at startup)."
+            )
+        return self.conn
+
+    def require_config(self) -> DomainConfig:
+        """Return the resolved config or raise if it is missing."""
+        if self.config is None:  # pragma: no cover - should not happen post-lifespan
+            raise ConnectionUnavailableError("Configuration not initialized.")
+        return self.config
+
+    @property
+    def base(self) -> str:
+        """The configured search base DN."""
+        return self.require_config().base

graphqlad/schema.py

@@ -0,0 +1,321 @@
+"""GraphQL schema: a single read-only ``Query`` type.
+
+Every field maps to an msad read function. There is intentionally **no
+Mutation type**: all msad write operations (add/remove member, change
+password, unlock account) are out of scope, so the API is read-only by
+construction.
+
+The shared LDAP connection and search base come from the request
+:class:`~graphqlad.context.Context`.
+"""
+
+from __future__ import annotations
+
+import strawberry
+from msad import (
+    check_connection,
+    find_computers,
+    find_groups,
+    find_inactive_users,
+    find_ous,
+    find_stale_computers,
+    find_users,
+    get_computer,
+    get_domain_info,
+    get_gpo,
+    get_group,
+    get_ou,
+    get_ou_contents,
+    get_password_policy,
+    get_password_policy_violations,
+    get_privileged_groups,
+    get_user,
+    is_member,
+    list_domain_controllers,
+    list_empty_groups,
+    list_fine_grained_password_policies,
+    list_fsmo_roles,
+    list_gpos,
+    list_sites,
+    list_trusts,
+    summarize_computer_os,
+    user_groups,
+)
+from msad.exceptions import MsadNotFoundError
+from msad.group import group_members
+from msad.user import (
+    has_expired_password,
+    has_never_expires_password,
+    is_disabled,
+    is_locked,
+)
+from strawberry.types import Info
+
+from .context import Context
+from .types import Entries, Entry, Health, OsSummary, OsSummaryItem, UserStatus
+
+
+def _ctx(info: Info) -> Context:
+    return info.context
+
+
+@strawberry.type
+class Query:
+    """Read-only queries over Active Directory via msad."""
+
+    # ----- health -------------------------------------------------------
+    @strawberry.field(description="Test connectivity/bind without raising.")
+    def health(self, info: Info) -> Health:
+        ctx = _ctx(info)
+        config = ctx.require_config()
+        scheme = "ldaps" if config.use_ssl else "ldap"
+        target = f"{scheme}://{config.host}:{config.port}"
+        auth = "kerberos" if config.uses_kerberos else f"user {config.user!r}"
+        try:
+            status = check_connection(config)
+        except Exception as exc:  # defensive: check_connection should not raise
+            return Health(ok=False, target=target, auth=auth, error=str(exc))
+        return Health(
+            ok=bool(status.get("ok")),
+            target=str(status.get("target", target)),
+            auth=str(status.get("auth", auth)),
+            error=status.get("error"),
+        )
+
+    # ----- users --------------------------------------------------------
+    @strawberry.field(description="Find users by field (all ANDed; * wildcards ok).")
+    def users(
+        self,
+        info: Info,
+        name: str | None = None,
+        surname: str | None = None,
+        mail: str | None = None,
+        sam: str | None = None,
+        department: str | None = None,
+        limit: int = 0,
+    ) -> Entries:
+        ctx = _ctx(info)
+        return Entries.of(
+            find_users(
+                ctx.require_conn(),
+                ctx.base,
+                name=name,
+                surname=surname,
+                mail=mail,
+                sam=sam,
+                department=department,
+                limit=limit,
+            )
+        )
+
+    @strawberry.field(description="Enabled users whose last logon is older than `days`.")
+    def inactive_users(
+        self, info: Info, days: int = 90, include_never: bool = False, limit: int = 0
+    ) -> Entries:
+        ctx = _ctx(info)
+        return Entries.of(
+            find_inactive_users(
+                ctx.require_conn(), ctx.base, days=days, include_never=include_never, limit=limit
+            )
+        )
+
+    @strawberry.field(description="Get a single user (sAMAccountName/UPN/mail/cn).")
+    def user(self, info: Info, identifier: str) -> Entry:
+        ctx = _ctx(info)
+        return Entry(entry=get_user(ctx.require_conn(), ctx.base, identifier))
+
+    @strawberry.field(description="Groups a user belongs to (nested by default).")
+    def user_groups(
+        self, info: Info, identifier: str, nested: bool = True, limit: int = 0
+    ) -> Entries:
+        ctx = _ctx(info)
+        return Entries.of(
+            user_groups(ctx.require_conn(), ctx.base, limit, identifier, nested=nested)
+        )
+
+    @strawberry.field(description="Bundle of boolean status checks for a user.")
+    def user_status(self, info: Info, identifier: str) -> UserStatus:
+        ctx = _ctx(info)
+        conn, base = ctx.require_conn(), ctx.base
+        return UserStatus(
+            is_disabled=is_disabled(conn, base, identifier),
+            is_locked=is_locked(conn, base, identifier),
+            has_never_expires_password=has_never_expires_password(conn, base, identifier),
+            has_expired_password=has_expired_password(conn, base, identifier),
+        )
+
+    # ----- groups -------------------------------------------------------
+    @strawberry.field(description="Search groups by cn/name/sAMAccountName/displayName.")
+    def groups(self, info: Info, q: str = "*", limit: int = 0) -> Entries:
+        ctx = _ctx(info)
+        return Entries.of(find_groups(ctx.require_conn(), ctx.base, q, limit=limit))
+
+    @strawberry.field(description="Groups with no direct members.")
+    def empty_groups(self, info: Info, limit: int = 0) -> Entries:
+        ctx = _ctx(info)
+        return Entries.of(list_empty_groups(ctx.require_conn(), ctx.base, limit=limit))
+
+    @strawberry.field(description="Get a single group (sAMAccountName/cn).")
+    def group(self, info: Info, identifier: str) -> Entry:
+        ctx = _ctx(info)
+        return Entry(entry=get_group(ctx.require_conn(), ctx.base, identifier))
+
+    @strawberry.field(description="Members of a group (direct, or nested).")
+    def group_members(
+        self, info: Info, identifier: str, nested: bool = False, limit: int = 0
+    ) -> Entries:
+        ctx = _ctx(info)
+        try:
+            members = group_members(
+                ctx.require_conn(), ctx.base, identifier, nested=nested, limit=limit
+            )
+        except MsadNotFoundError:
+            members = []
+        return Entries.of(members)
+
+    @strawberry.field(description="Is `user` a (nested) member of `group`?")
+    def is_member(self, info: Info, group: str, user: str) -> bool | None:
+        ctx = _ctx(info)
+        try:
+            return is_member(ctx.require_conn(), ctx.base, group=group, user=user)
+        except MsadNotFoundError:
+            return None
+
+    # ----- computers ----------------------------------------------------
+    @strawberry.field(description="Find computers by name/dns/os (* wildcards ok).")
+    def computers(
+        self,
+        info: Info,
+        name: str | None = None,
+        dns: str | None = None,
+        os: str | None = None,
+        limit: int = 0,
+    ) -> Entries:
+        ctx = _ctx(info)
+        return Entries.of(
+            find_computers(ctx.require_conn(), ctx.base, name=name, dns=dns, os=os, limit=limit)
+        )
+
+    @strawberry.field(description="Computers whose last logon is older than `days`.")
+    def stale_computers(
+        self, info: Info, days: int = 90, include_never: bool = False, limit: int = 0
+    ) -> Entries:
+        ctx = _ctx(info)
+        return Entries.of(
+            find_stale_computers(
+                ctx.require_conn(), ctx.base, days=days, include_never=include_never, limit=limit
+            )
+        )
+
+    @strawberry.field(description="List domain controllers (DC computer accounts).")
+    def domain_controllers(self, info: Info, limit: int = 0) -> Entries:
+        ctx = _ctx(info)
+        return Entries.of(list_domain_controllers(ctx.require_conn(), ctx.base, limit=limit))
+
+    @strawberry.field(description="Computer accounts grouped by operatingSystem.")
+    def os_summary(self, info: Info, limit: int = 0) -> OsSummary:
+        ctx = _ctx(info)
+        items = summarize_computer_os(ctx.require_conn(), ctx.base, limit=limit) or []
+        rows = [
+            OsSummaryItem(
+                operating_system=str(it.get("operatingSystem", "")),
+                count=int(it.get("count", 0)),
+            )
+            for it in items
+        ]
+        return OsSummary(count=len(rows), items=rows)
+
+    @strawberry.field(description="Get a single computer (sAMAccountName/cn/dNSHostName).")
+    def computer(self, info: Info, identifier: str) -> Entry:
+        ctx = _ctx(info)
+        return Entry(entry=get_computer(ctx.require_conn(), ctx.base, identifier))
+
+    # ----- OUs ----------------------------------------------------------
+    @strawberry.field(description="Find organizational units by name (* wildcards ok).")
+    def ous(self, info: Info, name: str | None = None, limit: int = 0) -> Entries:
+        ctx = _ctx(info)
+        return Entries.of(find_ous(ctx.require_conn(), ctx.base, name=name, limit=limit))
+
+    @strawberry.field(description="List objects directly under an OU (by its DN).")
+    def ou_contents(
+        self, info: Info, ou_dn: str, object_class: str | None = None, limit: int = 0
+    ) -> Entries:
+        ctx = _ctx(info)
+        return Entries.of(
+            get_ou_contents(ctx.require_conn(), ou_dn, object_class=object_class, limit=limit)
+        )
+
+    @strawberry.field(description="Get a single OU (ou name or full DN).")
+    def ou(self, info: Info, identifier: str) -> Entry:
+        ctx = _ctx(info)
+        return Entry(entry=get_ou(ctx.require_conn(), ctx.base, identifier))
+
+    # ----- audit --------------------------------------------------------
+    @strawberry.field(description="Domain object: security-relevant settings and metadata.")
+    def domain_info(self, info: Info) -> Entry:
+        ctx = _ctx(info)
+        return Entry(entry=get_domain_info(ctx.require_conn(), ctx.base))
+
+    @strawberry.field(description="Default domain password policy.")
+    def password_policy(self, info: Info) -> Entry:
+        ctx = _ctx(info)
+        return Entry(entry=get_password_policy(ctx.require_conn(), ctx.base))
+
+    @strawberry.field(description="Enabled users whose password violates the policy.")
+    def password_policy_violations(
+        self, info: Info, include_never_set: bool = True, limit: int = 0
+    ) -> Entries:
+        ctx = _ctx(info)
+        return Entries.of(
+            get_password_policy_violations(
+                ctx.require_conn(), ctx.base, include_never_set=include_never_set, limit=limit
+            )
+        )
+
+    @strawberry.field(description="Well-known privileged groups with member counts.")
+    def privileged_groups(
+        self, info: Info, with_members: bool = False, nested: bool = False
+    ) -> Entries:
+        ctx = _ctx(info)
+        return Entries.of(
+            get_privileged_groups(
+                ctx.require_conn(), ctx.base, with_members=with_members, nested=nested
+            )
+        )
+
+    @strawberry.field(description="Owner of each of the five FSMO roles.")
+    def fsmo_roles(self, info: Info) -> Entries:
+        ctx = _ctx(info)
+        return Entries.of(list_fsmo_roles(ctx.require_conn(), ctx.base))
+
+    @strawberry.field(description="Domain trust relationships.")
+    def trusts(self, info: Info, limit: int = 0) -> Entries:
+        ctx = _ctx(info)
+        return Entries.of(list_trusts(ctx.require_conn(), ctx.base, limit=limit))
+
+    @strawberry.field(description="AD sites from the Configuration NC.")
+    def sites(self, info: Info, limit: int = 0) -> Entries:
+        ctx = _ctx(info)
+        return Entries.of(list_sites(ctx.require_conn(), ctx.base, limit=limit))
+
+    @strawberry.field(description="Group Policy Objects.")
+    def gpos(self, info: Info, limit: int = 0) -> Entries:
+        ctx = _ctx(info)
+        return Entries.of(list_gpos(ctx.require_conn(), ctx.base, limit=limit))
+
+    @strawberry.field(description="Get a single GPO (cn GUID or displayName).")
+    def gpo(self, info: Info, identifier: str) -> Entry:
+        ctx = _ctx(info)
+        return Entry(entry=get_gpo(ctx.require_conn(), ctx.base, identifier))
+
+    @strawberry.field(description="Fine-grained password policies (PSOs).")
+    def fine_grained_password_policies(self, info: Info, limit: int = 0) -> Entries:
+        ctx = _ctx(info)
+        return Entries.of(
+            list_fine_grained_password_policies(ctx.require_conn(), ctx.base, limit=limit)
+        )
+
+
+schema = strawberry.Schema(query=Query)
+
+__all__ = ["Query", "schema"]