From 272f63828f31f50b51fd8b0791ce4cd10a83e0c4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89mile=20R=C3=A9?= <emile@getprobo.com>
Date: Fri, 24 Apr 2026 11:45:52 +0400
Subject: [PATCH] Add state to MCP profile and refactor contract filter
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the profile state attribute (ACTIVE/INACTIVE) to the MCP
Profile schema so listUsers and getUser tools expose it, and
add a state filter to listUsers.

Rename excludeContractEnded to contractEnded across the entire
stack (MCP, GraphQL, CLI, frontend). The new boolean is two-way:
true returns only users with ended contracts, false returns only
users with active or no contract, and null returns all.

Signed-off-by: Émile Ré <emile@getprobo.com>
---
 .../components/form/PeopleMultiSelectField.tsx |  2 +-
 .../src/components/form/PeopleSelectField.tsx  |  2 +-
 .../src/components/table/PeopleCell.tsx        |  2 +-
 apps/console/src/hooks/graph/PeopleGraph.ts    |  4 ++--
 .../_components/SignatureDocumentsDialog.tsx   |  2 +-
 .../signatures/DocumentSignaturesPage.tsx      |  2 +-
 .../organizations/findings/FindingsPage.tsx    |  2 +-
 pkg/cmd/user/list/list.go                      |  4 ++--
 pkg/coredata/membership_profile_filter.go      | 14 ++++++++------
 .../api/connect/v1/graphql/profile.graphql     |  2 +-
 .../api/connect/v1/identity_resolvers.go       |  2 +-
 .../console/v1/graphql/organization.graphql    |  2 +-
 .../api/console/v1/organization_resolvers.go   |  2 +-
 pkg/server/api/mcp/v1/schema.resolvers.go      |  5 ++++-
 pkg/server/api/mcp/v1/specification.yaml       | 18 ++++++++++++++++--
 pkg/server/api/mcp/v1/types/profile.go         |  1 +
 16 files changed, 43 insertions(+), 23 deletions(-)

diff --git a/apps/console/src/components/form/PeopleMultiSelectField.tsx b/apps/console/src/components/form/PeopleMultiSelectField.tsx
index 1cbb6b602..b1f7c6d6a 100644
--- a/apps/console/src/components/form/PeopleMultiSelectField.tsx
+++ b/apps/console/src/components/form/PeopleMultiSelectField.tsx
@@ -65,7 +65,7 @@ function PeopleMultiSelectWithQuery<T extends FieldValues = FieldValues>(
 ) {
   const { __ } = useTranslate();
   const { name, organizationId, control, selectedPeople = [], placeholder } = props;
-  const people = usePeople(organizationId, { excludeContractEnded: true });
+  const people = usePeople(organizationId, { contractEnded: false });
   const [isOpen, setIsOpen] = useState(false);
 
   const allPeople = [...people];
diff --git a/apps/console/src/components/form/PeopleSelectField.tsx b/apps/console/src/components/form/PeopleSelectField.tsx
index 667fb3dcc..78b158987 100644
--- a/apps/console/src/components/form/PeopleSelectField.tsx
+++ b/apps/console/src/components/form/PeopleSelectField.tsx
@@ -61,7 +61,7 @@ function PeopleSelectWithQuery<TFieldValues extends FieldValues = FieldValues>(
 ) {
   const { __ } = useTranslate();
   const { name, organizationId, control } = props;
-  const people = usePeople(organizationId, { excludeContractEnded: true });
+  const people = usePeople(organizationId, { contractEnded: false });
 
   return (
     <Controller
diff --git a/apps/console/src/components/table/PeopleCell.tsx b/apps/console/src/components/table/PeopleCell.tsx
index 68c4d1b6d..c99e5f785 100644
--- a/apps/console/src/components/table/PeopleCell.tsx
+++ b/apps/console/src/components/table/PeopleCell.tsx
@@ -31,7 +31,7 @@ export function PeopleCell(props: Props) {
       query={peopleQuery}
       variables={{
         organizationId: props.organizationId,
-        filter: { excludeContractEnded: true },
+        filter: { contractEnded: false },
       }}
       items={data =>
         data.organization?.profiles?.edges.map(edge => edge.node) ?? []}
diff --git a/apps/console/src/hooks/graph/PeopleGraph.ts b/apps/console/src/hooks/graph/PeopleGraph.ts
index 5ab8f0ea9..df20a4e2e 100644
--- a/apps/console/src/hooks/graph/PeopleGraph.ts
+++ b/apps/console/src/hooks/graph/PeopleGraph.ts
@@ -49,13 +49,13 @@ export const peopleQuery = graphql`
  */
 export function usePeople(
   organizationId: string,
-  { excludeContractEnded }: { excludeContractEnded?: boolean } = {},
+  { contractEnded }: { contractEnded?: boolean } = {},
 ) {
   const data = useLazyLoadQuery<PeopleGraphQuery>(
     peopleQuery,
     {
       organizationId: organizationId,
-      filter: excludeContractEnded ? { excludeContractEnded: true } : null,
+      filter: contractEnded !== undefined ? { contractEnded } : null,
     },
     { fetchPolicy: "network-only" },
   );
diff --git a/apps/console/src/pages/organizations/documents/_components/SignatureDocumentsDialog.tsx b/apps/console/src/pages/organizations/documents/_components/SignatureDocumentsDialog.tsx
index 98082c79b..dabf2cffa 100644
--- a/apps/console/src/pages/organizations/documents/_components/SignatureDocumentsDialog.tsx
+++ b/apps/console/src/pages/organizations/documents/_components/SignatureDocumentsDialog.tsx
@@ -196,7 +196,7 @@ function PeopleList({
     signatureDocumentsDialogPeopleQuery,
     {
       organizationId,
-      filter: { excludeContractEnded: true },
+      filter: { contractEnded: false },
     },
   );
   const {
diff --git a/apps/console/src/pages/organizations/documents/signatures/DocumentSignaturesPage.tsx b/apps/console/src/pages/organizations/documents/signatures/DocumentSignaturesPage.tsx
index a23775c16..993476b32 100644
--- a/apps/console/src/pages/organizations/documents/signatures/DocumentSignaturesPage.tsx
+++ b/apps/console/src/pages/organizations/documents/signatures/DocumentSignaturesPage.tsx
@@ -27,7 +27,7 @@ export const documentSignaturesPageQuery = graphql`
   query DocumentSignaturesPageQuery($documentId: ID! $organizationId: ID! $versionId: ID! $versionSpecified: Boolean!) {
     organization: node(id: $organizationId) {
       __typename
-      ...DocumentSignatureList_peopleFragment @arguments(filter: { excludeContractEnded: true })
+      ...DocumentSignatureList_peopleFragment @arguments(filter: { contractEnded: false })
     }
     # We use this on /documents/:documentId
     document: node(id: $documentId) @skip(if: $versionSpecified) {
diff --git a/apps/console/src/pages/organizations/findings/FindingsPage.tsx b/apps/console/src/pages/organizations/findings/FindingsPage.tsx
index e7d774d99..1be34507d 100644
--- a/apps/console/src/pages/organizations/findings/FindingsPage.tsx
+++ b/apps/console/src/pages/organizations/findings/FindingsPage.tsx
@@ -550,7 +550,7 @@ function OwnerFilterSelect({
   onChange,
 }: OwnerFilterSelectProps) {
   const { __ } = useTranslate();
-  const people = usePeople(organizationId, { excludeContractEnded: true });
+  const people = usePeople(organizationId, { contractEnded: false });
 
   return (
     <Select value={value ?? "ALL"} onValueChange={onChange}>
diff --git a/pkg/cmd/user/list/list.go b/pkg/cmd/user/list/list.go
index 30f4b51b1..ad27db72b 100644
--- a/pkg/cmd/user/list/list.go
+++ b/pkg/cmd/user/list/list.go
@@ -126,7 +126,7 @@ func NewCmdList(f *cmdutil.Factory) *cobra.Command {
 
 			if flagActive {
 				variables["filter"] = map[string]any{
-					"excludeContractEnded": true,
+					"contractEnded": false,
 				}
 			}
 
@@ -210,7 +210,7 @@ func NewCmdList(f *cmdutil.Factory) *cobra.Command {
 	cmd.Flags().IntVarP(&flagLimit, "limit", "L", 30, "Maximum number of users to list")
 	cmd.Flags().StringVar(&flagOrder, "order-by", "", "Order by field (FULL_NAME, CREATED_AT, KIND)")
 	cmd.Flags().StringVar(&flagOrderDir, "order-direction", "DESC", "Sort direction (ASC, DESC)")
-	cmd.Flags().BoolVar(&flagActive, "active", false, "Exclude users whose contract has ended")
+	cmd.Flags().BoolVar(&flagActive, "active", false, "Show only users with active or no contract")
 	flagOutput = cmdutil.AddOutputFlag(cmd)
 
 	return cmd
diff --git a/pkg/coredata/membership_profile_filter.go b/pkg/coredata/membership_profile_filter.go
index 44a7a073a..fa8beee15 100644
--- a/pkg/coredata/membership_profile_filter.go
+++ b/pkg/coredata/membership_profile_filter.go
@@ -25,7 +25,7 @@ type (
 	MembershipProfileFilter struct {
 		withMembership        *bool
 		withTrustCenterAccess *bool
-		excludeContractEnded  *bool
+		contractEnded         *bool
 		currentDate           time.Time
 		email                 *mail.Addr
 		userName              *string
@@ -35,10 +35,10 @@ type (
 	}
 )
 
-func NewMembershipProfileFilter(excludeContractEnded *bool) *MembershipProfileFilter {
+func NewMembershipProfileFilter(contractEnded *bool) *MembershipProfileFilter {
 	return &MembershipProfileFilter{
-		excludeContractEnded: excludeContractEnded,
-		currentDate:          time.Now(),
+		contractEnded: contractEnded,
+		currentDate:   time.Now(),
 	}
 }
 
@@ -96,7 +96,7 @@ func (f *MembershipProfileFilter) SQLArguments() pgx.StrictNamedArgs {
 		"filter_external_id":       f.externalID,
 		"with_membership":          f.withMembership,
 		"with_trust_center_access": f.withTrustCenterAccess,
-		"exclude_contract_ended":   f.excludeContractEnded,
+		"contract_ended":           f.contractEnded,
 		"current_date":             f.currentDate,
 		"filter_state":             f.state,
 		"filter_source":            f.source,
@@ -132,7 +132,9 @@ AND (
 )
 AND (
     CASE
-        WHEN @exclude_contract_ended::boolean IS NOT NULL AND @exclude_contract_ended::boolean = true THEN
+        WHEN @contract_ended::boolean IS NOT NULL AND @contract_ended::boolean = true THEN
+            (p.contract_end_date IS NOT NULL AND p.contract_end_date < @current_date::date)
+        WHEN @contract_ended::boolean IS NOT NULL AND @contract_ended::boolean = false THEN
             (p.contract_end_date IS NULL OR p.contract_end_date >= @current_date::date)
         ELSE TRUE
     END
diff --git a/pkg/server/api/connect/v1/graphql/profile.graphql b/pkg/server/api/connect/v1/graphql/profile.graphql
index ca65f8de5..cd762ee30 100644
--- a/pkg/server/api/connect/v1/graphql/profile.graphql
+++ b/pkg/server/api/connect/v1/graphql/profile.graphql
@@ -65,7 +65,7 @@ enum ProfileOrderField
 }
 
 input ProfileFilter {
-  excludeContractEnded: Boolean
+  contractEnded: Boolean
   state: ProfileState
 }
 
diff --git a/pkg/server/api/connect/v1/identity_resolvers.go b/pkg/server/api/connect/v1/identity_resolvers.go
index febdfcca0..996bf776d 100644
--- a/pkg/server/api/connect/v1/identity_resolvers.go
+++ b/pkg/server/api/connect/v1/identity_resolvers.go
@@ -30,7 +30,7 @@ func (r *identityResolver) Profiles(ctx context.Context, obj *types.Identity, fi
 
 	filters := coredata.NewMembershipProfileFilter(nil).WithMembership()
 	if filter != nil {
-		filters = coredata.NewMembershipProfileFilter(filter.ExcludeContractEnded).WithMembership()
+		filters = coredata.NewMembershipProfileFilter(filter.ContractEnded).WithMembership()
 		if filter.State != nil {
 			filters.WithState(*filter.State)
 		}
diff --git a/pkg/server/api/console/v1/graphql/organization.graphql b/pkg/server/api/console/v1/graphql/organization.graphql
index 0db78280c..49c59d0d5 100644
--- a/pkg/server/api/console/v1/graphql/organization.graphql
+++ b/pkg/server/api/console/v1/graphql/organization.graphql
@@ -52,7 +52,7 @@ input ProfileOrder
 }
 
 input ProfileFilter {
-    excludeContractEnded: Boolean
+    contractEnded: Boolean
 }
 
 type ProfileConnection
diff --git a/pkg/server/api/console/v1/organization_resolvers.go b/pkg/server/api/console/v1/organization_resolvers.go
index 4bbab9c0b..655473e9e 100644
--- a/pkg/server/api/console/v1/organization_resolvers.go
+++ b/pkg/server/api/console/v1/organization_resolvers.go
@@ -123,7 +123,7 @@ func (r *organizationResolver) Profiles(ctx context.Context, obj *types.Organiza
 
 	filters := coredata.NewMembershipProfileFilter(nil).WithMembership()
 	if filter != nil {
-		filters = coredata.NewMembershipProfileFilter(filter.ExcludeContractEnded).WithMembership()
+		filters = coredata.NewMembershipProfileFilter(filter.ContractEnded).WithMembership()
 	}
 
 	pageOrderBy := page.OrderBy[coredata.MembershipProfileOrderField]{
diff --git a/pkg/server/api/mcp/v1/schema.resolvers.go b/pkg/server/api/mcp/v1/schema.resolvers.go
index 77750d29b..0b510785d 100644
--- a/pkg/server/api/mcp/v1/schema.resolvers.go
+++ b/pkg/server/api/mcp/v1/schema.resolvers.go
@@ -2491,7 +2491,10 @@ func (r *Resolver) ListUsersTool(ctx context.Context, req *mcp.CallToolRequest,
 
 	filter := coredata.NewMembershipProfileFilter(nil).WithMembership()
 	if input.Filter != nil {
-		filter = coredata.NewMembershipProfileFilter(input.Filter.ExcludeContractEnded).WithMembership()
+		filter = coredata.NewMembershipProfileFilter(input.Filter.ContractEnded).WithMembership()
+		if input.Filter.State != nil {
+			filter.WithState(*input.Filter.State)
+		}
 	}
 
 	pageResult, err := r.iamSvc.OrganizationService.ListProfiles(ctx, input.OrganizationID, cursor, filter)
diff --git a/pkg/server/api/mcp/v1/specification.yaml b/pkg/server/api/mcp/v1/specification.yaml
index fcb37746e..b89272f0b 100644
--- a/pkg/server/api/mcp/v1/specification.yaml
+++ b/pkg/server/api/mcp/v1/specification.yaml
@@ -180,6 +180,13 @@ components:
         - AUDITOR
       go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.MembershipRole
 
+    ProfileState:
+      type: string
+      enum:
+        - ACTIVE
+        - INACTIVE
+      go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ProfileState
+
     Profile:
       type: object
       required:
@@ -189,6 +196,7 @@ components:
         - email_address
         - additional_email_addresses
         - kind
+        - state
         - created_at
         - updated_at
       properties:
@@ -214,6 +222,9 @@ components:
             - string
             - "null"
           description: Profile kind
+        state:
+          $ref: "#/components/schemas/ProfileState"
+          description: Profile state (ACTIVE or INACTIVE)
         position:
           type:
             - string
@@ -260,9 +271,12 @@ components:
         filter:
           type: object
           properties:
-            exclude_contract_ended:
+            contract_ended:
               type: boolean
-              description: Exclude users with ended contracts
+              description: Filter by contract status. True returns only users with ended contracts, false returns only users with active or no contract.
+            state:
+              $ref: "#/components/schemas/ProfileState"
+              description: Filter by profile state (ACTIVE or INACTIVE)
 
     ListUsersOutput:
       type: object
diff --git a/pkg/server/api/mcp/v1/types/profile.go b/pkg/server/api/mcp/v1/types/profile.go
index 97dc2c5c5..a6e8fb1c2 100644
--- a/pkg/server/api/mcp/v1/types/profile.go
+++ b/pkg/server/api/mcp/v1/types/profile.go
@@ -24,6 +24,7 @@ func NewProfile(p *coredata.MembershipProfile) *Profile {
 		EmailAddress:             p.EmailAddress,
 		AdditionalEmailAddresses: p.AdditionalEmailAddresses,
 		Kind:                     p.Kind,
+		State:                    p.State,
 		Position:                 p.Position,
 		ContractStartDate:        p.ContractStartDate,
 		ContractEndDate:          p.ContractEndDate,