Fix various bad tenant isolation

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
2025-10-30 15:39:38 +01:00
parent a42670d5bd
commit 29917578fc
30 changed files with 1259 additions and 1369 deletions
--- a/pkg/server/api/console/v1/resolver.go
+++ b/pkg/server/api/console/v1/resolver.go
@@ -410,6 +410,10 @@ func (r *Resolver) AuthzService(ctx context.Context, tenantID gid.TenantID) *aut
 	return GetTenantAuthzService(ctx, r.authzSvc, tenantID)
 }

+func (r *Resolver) AuthService(ctx context.Context, tenantID gid.TenantID) *auth.TenantAuthService {
+	return GetTenantAuthService(ctx, r.authSvc, tenantID)
+}
+
 func UnwrapOmittable[T any](field graphql.Omittable[T]) *T {
 	if !field.IsSet() {
 		return nil
@@ -428,6 +432,11 @@ func GetTenantAuthzService(ctx context.Context, authzSvc *authz.Service, tenantI
 	return authzSvc.WithTenant(tenantID)
 }

+func GetTenantAuthService(ctx context.Context, authSvc *auth.Service, tenantID gid.TenantID) *auth.TenantAuthService {
+	validateTenantAccess(ctx, tenantID)
+	return authSvc.WithTenant(tenantID)
+}
+
 func validateTenantAccess(ctx context.Context, tenantID gid.TenantID) {
 	access, _ := ctx.Value(userTenantContextKey).(*userTenantAccess)

--- a/pkg/server/api/console/v1/schema.graphql
+++ b/pkg/server/api/console/v1/schema.graphql
@@ -2402,15 +2402,6 @@ type Viewer {
    before: CursorKey
    orderBy: OrganizationOrder
  ): OrganizationConnection! @goField(forceResolver: true)
-
-  invitations(
-    first: Int
-    after: CursorKey
-    last: Int
-    before: CursorKey
-    orderBy: InvitationOrder
-    filter: InvitationFilter
-  ): InvitationConnection! @goField(forceResolver: true)
 }

 # Connection Types
--- a/pkg/server/api/console/v1/schema/schema.go
+++ b/pkg/server/api/console/v1/schema/schema.go
@@ -1749,7 +1749,6 @@ type ComplexityRoot struct {

 	Viewer struct {
 		ID            func(childComplexity int) int
-		Invitations   func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.InvitationOrder, filter *types.InvitationFilter) int
 		Organizations func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.OrganizationOrder) int
 		User          func(childComplexity int) int
 	}
@@ -2172,7 +2171,6 @@ type VendorServiceResolver interface {
 }
 type ViewerResolver interface {
 	Organizations(ctx context.Context, obj *types.Viewer, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.OrganizationOrder) (*types.OrganizationConnection, error)
-	Invitations(ctx context.Context, obj *types.Viewer, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.InvitationOrder, filter *types.InvitationFilter) (*types.InvitationConnection, error)
 }

 type executableSchema struct {
@@ -9422,18 +9420,6 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin

 		return e.complexity.Viewer.ID(childComplexity), true

-	case "Viewer.invitations":
-		if e.complexity.Viewer.Invitations == nil {
-			break
-		}
-
-		args, err := ec.field_Viewer_invitations_args(ctx, rawArgs)
-		if err != nil {
-			return 0, false
-		}
-
-		return e.complexity.Viewer.Invitations(childComplexity, args["first"].(*int), args["after"].(*page.CursorKey), args["last"].(*int), args["before"].(*page.CursorKey), args["orderBy"].(*types.InvitationOrder), args["filter"].(*types.InvitationFilter)), true
-
 	case "Viewer.organizations":
 		if e.complexity.Viewer.Organizations == nil {
 			break
@@ -12142,15 +12128,6 @@ type Viewer {
    before: CursorKey
    orderBy: OrganizationOrder
  ): OrganizationConnection! @goField(forceResolver: true)
-
-  invitations(
-    first: Int
-    after: CursorKey
-    last: Int
-    before: CursorKey
-    orderBy: InvitationOrder
-    filter: InvitationFilter
-  ): InvitationConnection! @goField(forceResolver: true)
 }

 # Connection Types
@@ -22840,119 +22817,6 @@ func (ec *executionContext) field_Vendor_services_argsOrderBy(
 	return zeroVal, nil
 }

-func (ec *executionContext) field_Viewer_invitations_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
-	var err error
-	args := map[string]any{}
-	arg0, err := ec.field_Viewer_invitations_argsFirst(ctx, rawArgs)
-	if err != nil {
-		return nil, err
-	}
-	args["first"] = arg0
-	arg1, err := ec.field_Viewer_invitations_argsAfter(ctx, rawArgs)
-	if err != nil {
-		return nil, err
-	}
-	args["after"] = arg1
-	arg2, err := ec.field_Viewer_invitations_argsLast(ctx, rawArgs)
-	if err != nil {
-		return nil, err
-	}
-	args["last"] = arg2
-	arg3, err := ec.field_Viewer_invitations_argsBefore(ctx, rawArgs)
-	if err != nil {
-		return nil, err
-	}
-	args["before"] = arg3
-	arg4, err := ec.field_Viewer_invitations_argsOrderBy(ctx, rawArgs)
-	if err != nil {
-		return nil, err
-	}
-	args["orderBy"] = arg4
-	arg5, err := ec.field_Viewer_invitations_argsFilter(ctx, rawArgs)
-	if err != nil {
-		return nil, err
-	}
-	args["filter"] = arg5
-	return args, nil
-}
-func (ec *executionContext) field_Viewer_invitations_argsFirst(
-	ctx context.Context,
-	rawArgs map[string]any,
-) (*int, error) {
-	ctx = graphql.WithPathContext(ctx, graphql.NewPathWithField("first"))
-	if tmp, ok := rawArgs["first"]; ok {
-		return ec.unmarshalOInt2ᚖint(ctx, tmp)
-	}
-
-	var zeroVal *int
-	return zeroVal, nil
-}
-
-func (ec *executionContext) field_Viewer_invitations_argsAfter(
-	ctx context.Context,
-	rawArgs map[string]any,
-) (*page.CursorKey, error) {
-	ctx = graphql.WithPathContext(ctx, graphql.NewPathWithField("after"))
-	if tmp, ok := rawArgs["after"]; ok {
-		return ec.unmarshalOCursorKey2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋpageᚐCursorKey(ctx, tmp)
-	}
-
-	var zeroVal *page.CursorKey
-	return zeroVal, nil
-}
-
-func (ec *executionContext) field_Viewer_invitations_argsLast(
-	ctx context.Context,
-	rawArgs map[string]any,
-) (*int, error) {
-	ctx = graphql.WithPathContext(ctx, graphql.NewPathWithField("last"))
-	if tmp, ok := rawArgs["last"]; ok {
-		return ec.unmarshalOInt2ᚖint(ctx, tmp)
-	}
-
-	var zeroVal *int
-	return zeroVal, nil
-}
-
-func (ec *executionContext) field_Viewer_invitations_argsBefore(
-	ctx context.Context,
-	rawArgs map[string]any,
-) (*page.CursorKey, error) {
-	ctx = graphql.WithPathContext(ctx, graphql.NewPathWithField("before"))
-	if tmp, ok := rawArgs["before"]; ok {
-		return ec.unmarshalOCursorKey2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋpageᚐCursorKey(ctx, tmp)
-	}
-
-	var zeroVal *page.CursorKey
-	return zeroVal, nil
-}
-
-func (ec *executionContext) field_Viewer_invitations_argsOrderBy(
-	ctx context.Context,
-	rawArgs map[string]any,
-) (*types.InvitationOrder, error) {
-	ctx = graphql.WithPathContext(ctx, graphql.NewPathWithField("orderBy"))
-	if tmp, ok := rawArgs["orderBy"]; ok {
-		return ec.unmarshalOInvitationOrder2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐInvitationOrder(ctx, tmp)
-	}
-
-	var zeroVal *types.InvitationOrder
-	return zeroVal, nil
-}
-
-func (ec *executionContext) field_Viewer_invitations_argsFilter(
-	ctx context.Context,
-	rawArgs map[string]any,
-) (*types.InvitationFilter, error) {
-	ctx = graphql.WithPathContext(ctx, graphql.NewPathWithField("filter"))
-	if tmp, ok := rawArgs["filter"]; ok {
-		return ec.unmarshalOInvitationFilter2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐInvitationFilter(ctx, tmp)
-	}
-
-	var zeroVal *types.InvitationFilter
-	return zeroVal, nil
-}
-
 func (ec *executionContext) field_Viewer_organizations_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
 	var err error
 	args := map[string]any{}
@@ -54498,8 +54362,6 @@ func (ec *executionContext) fieldContext_Query_viewer(_ context.Context, field g
 				return ec.fieldContext_Viewer_user(ctx, field)
 			case "organizations":
 				return ec.fieldContext_Viewer_organizations(ctx, field)
-			case "invitations":
-				return ec.fieldContext_Viewer_invitations(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type Viewer", field.Name)
 		},
@@ -71204,69 +71066,6 @@ func (ec *executionContext) fieldContext_Viewer_organizations(ctx context.Contex
 	return fc, nil
 }

-func (ec *executionContext) _Viewer_invitations(ctx context.Context, field graphql.CollectedField, obj *types.Viewer) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Viewer_invitations(ctx, field)
-	if err != nil {
-		return graphql.Null
-	}
-	ctx = graphql.WithFieldContext(ctx, fc)
-	defer func() {
-		if r := recover(); r != nil {
-			ec.Error(ctx, ec.Recover(ctx, r))
-			ret = graphql.Null
-		}
-	}()
-	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
-		ctx = rctx // use context from middleware stack in children
-		return ec.resolvers.Viewer().Invitations(rctx, obj, fc.Args["first"].(*int), fc.Args["after"].(*page.CursorKey), fc.Args["last"].(*int), fc.Args["before"].(*page.CursorKey), fc.Args["orderBy"].(*types.InvitationOrder), fc.Args["filter"].(*types.InvitationFilter))
-	})
-	if err != nil {
-		ec.Error(ctx, err)
-		return graphql.Null
-	}
-	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
-		return graphql.Null
-	}
-	res := resTmp.(*types.InvitationConnection)
-	fc.Result = res
-	return ec.marshalNInvitationConnection2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐInvitationConnection(ctx, field.Selections, res)
-}
-
-func (ec *executionContext) fieldContext_Viewer_invitations(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
-	fc = &graphql.FieldContext{
-		Object:     "Viewer",
-		Field:      field,
-		IsMethod:   true,
-		IsResolver: true,
-		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			switch field.Name {
-			case "totalCount":
-				return ec.fieldContext_InvitationConnection_totalCount(ctx, field)
-			case "edges":
-				return ec.fieldContext_InvitationConnection_edges(ctx, field)
-			case "pageInfo":
-				return ec.fieldContext_InvitationConnection_pageInfo(ctx, field)
-			}
-			return nil, fmt.Errorf("no field named %q was found under type InvitationConnection", field.Name)
-		},
-	}
-	defer func() {
-		if r := recover(); r != nil {
-			err = ec.Recover(ctx, r)
-			ec.Error(ctx, err)
-		}
-	}()
-	ctx = graphql.WithFieldContext(ctx, fc)
-	if fc.Args, err = ec.field_Viewer_invitations_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
-		ec.Error(ctx, err)
-		return fc, err
-	}
-	return fc, nil
-}
-
 func (ec *executionContext) ___Directive_name(ctx context.Context, field graphql.CollectedField, obj *introspection.Directive) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext___Directive_name(ctx, field)
 	if err != nil {
@@ -98483,42 +98282,6 @@ func (ec *executionContext) _Viewer(ctx context.Context, sel ast.SelectionSet, o
 				continue
 			}

-			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
-		case "invitations":
-			field := field
-
-			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
-				defer func() {
-					if r := recover(); r != nil {
-						ec.Error(ctx, ec.Recover(ctx, r))
-					}
-				}()
-				res = ec._Viewer_invitations(ctx, field, obj)
-				if res == graphql.Null {
-					atomic.AddUint32(&fs.Invalids, 1)
-				}
-				return res
-			}
-
-			if field.Deferrable != nil {
-				dfs, ok := deferred[field.Deferrable.Label]
-				di := 0
-				if ok {
-					dfs.AddField(field)
-					di = len(dfs.Values) - 1
-				} else {
-					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
-					deferred[field.Deferrable.Label] = dfs
-				}
-				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
-					return innerFunc(ctx, dfs)
-				})
-
-				// don't run the out.Concurrently() call below
-				out.Values[i] = graphql.Null
-				continue
-			}
-
 			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
--- a/pkg/server/api/console/v1/types/types.go
+++ b/pkg/server/api/console/v1/types/types.go
@@ -2480,5 +2480,4 @@ type Viewer struct {
 	ID            gid.GID                 `json:"id"`
 	User          *User                   `json:"user"`
 	Organizations *OrganizationConnection `json:"organizations"`
-	Invitations   *InvitationConnection   `json:"invitations"`
 }
--- a/pkg/server/api/console/v1/v1_resolver.go
+++ b/pkg/server/api/console/v1/v1_resolver.go
@@ -901,7 +901,9 @@ func (r *frameworkConnectionResolver) TotalCount(ctx context.Context, obj *types

 // Organization is the resolver for the organization field.
 func (r *invitationResolver) Organization(ctx context.Context, obj *types.Invitation) (*types.Organization, error) {
-	organization, err := r.authzSvc.GetOrganizationByInvitationID(ctx, obj.ID)
+	authz := r.AuthzService(ctx, obj.ID.TenantID())
+
+	organization, err := authz.GetOrganizationByInvitationID(ctx, obj.ID)
 	if err != nil {
 		panic(fmt.Errorf("cannot load organization: %w", err))
 	}
@@ -918,28 +920,12 @@ func (r *invitationConnectionResolver) TotalCount(ctx context.Context, obj *type
 			invitationFilter = coredata.NewInvitationFilter(obj.Filter.Statuses)
 		}

-		authzSvc := r.AuthzService(ctx, obj.ParentID.TenantID())
-		count, err := authzSvc.CountOrganizationInvitations(ctx, obj.ParentID, invitationFilter)
+		authz := r.AuthzService(ctx, obj.ParentID.TenantID())
+		count, err := authz.CountOrganizationInvitations(ctx, obj.ParentID, invitationFilter)
 		if err != nil {
 			panic(fmt.Errorf("cannot count organization invitations: %w", err))
 		}
 		return count, nil
-	case *viewerResolver:
-		user := UserFromContext(ctx)
-		if user == nil {
-			panic(fmt.Errorf("no authenticated user"))
-		}
-
-		invitationFilter := coredata.NewInvitationFilter(nil)
-		if obj.Filter != nil {
-			invitationFilter = coredata.NewInvitationFilter(obj.Filter.Statuses)
-		}
-
-		count, err := r.authzSvc.CountUserInvitations(ctx, user.EmailAddress, invitationFilter)
-		if err != nil {
-			panic(fmt.Errorf("cannot count user invitations: %w", err))
-		}
-		return count, nil
 	}

 	panic(fmt.Errorf("unsupported resolver: %T", obj.Resolver))
@@ -1090,7 +1076,9 @@ func (r *membershipResolver) AuthMethod(ctx context.Context, obj *types.Membersh
 		return coredata.UserAuthMethodPassword, nil
 	}

-	authMethod, err := r.authSvc.GetUserAuthMethod(ctx, coredata.NewScope(obj.UserID.TenantID()), obj.UserID, obj.OrganizationID, session)
+	auth := r.AuthService(ctx, obj.UserID.TenantID())
+
+	authMethod, err := auth.GetUserAuthMethod(ctx, obj.UserID, obj.OrganizationID, session)
 	if err != nil {
 		return "", fmt.Errorf("cannot get user auth method: %w", err)
 	}
@@ -1101,22 +1089,26 @@ func (r *membershipResolver) AuthMethod(ctx context.Context, obj *types.Membersh
 func (r *membershipConnectionResolver) TotalCount(ctx context.Context, obj *types.MembershipConnection) (int, error) {
 	switch obj.Resolver.(type) {
 	case *organizationResolver:
-		authzSvc := r.AuthzService(ctx, obj.ParentID.TenantID())
-		count, err := authzSvc.CountOrganizationMemberships(ctx, obj.ParentID)
+		authz := r.AuthzService(ctx, obj.ParentID.TenantID())
+		count, err := authz.CountOrganizationMemberships(ctx, obj.ParentID)
 		if err != nil {
 			panic(fmt.Errorf("cannot count organization memberships: %w", err))
 		}
+
 		return count, nil
-	default:
-		panic(fmt.Errorf("unknown resolver type for membership connection"))
 	}
+
+	panic(fmt.Errorf("unknown resolver type for membership connection"))
 }

 // CreateOrganization is the resolver for the createOrganization field.
 func (r *mutationResolver) CreateOrganization(ctx context.Context, input types.CreateOrganizationInput) (*types.CreateOrganizationPayload, error) {
 	currentUser := UserFromContext(ctx)

-	prb := r.proboSvc.WithTenant(gid.NewTenantID())
+	tenantID := gid.NewTenantID()
+
+	prb := r.proboSvc.WithTenant(tenantID)
+	authz := r.authzSvc.WithTenant(tenantID)

 	organization, err := prb.Organizations.Create(
 		ctx,
@@ -1128,21 +1120,16 @@ func (r *mutationResolver) CreateOrganization(ctx context.Context, input types.C
 		return nil, fmt.Errorf("cannot create organization: %w", err)
 	}

-	err = r.authzSvc.AddUserToOrganization(
+	authz.AddUserToOrganization(
 		ctx,
 		currentUser.ID,
 		organization.ID,
-		string(authz.RoleMember),
+		"MEMBER",
 	)
 	if err != nil {
 		return nil, fmt.Errorf("cannot add user to organization: %w", err)
 	}

-	tenantIDs, _ := ctx.Value(userTenantContextKey).(*[]gid.TenantID)
-	*tenantIDs = append(*tenantIDs, organization.ID.TenantID())
-
-	prb = r.ProboService(ctx, organization.ID.TenantID())
-
 	_, err = prb.Peoples.Create(
 		ctx,
 		probo.CreatePeopleRequest{
@@ -1158,6 +1145,10 @@ func (r *mutationResolver) CreateOrganization(ctx context.Context, input types.C
 		return nil, fmt.Errorf("cannot create people: %w", err)
 	}

+	// Append tenant to allowed one
+	tenantIDs, _ := ctx.Value(userTenantContextKey).(*[]gid.TenantID)
+	*tenantIDs = append(*tenantIDs, organization.ID.TenantID())
+
 	return &types.CreateOrganizationPayload{
 		OrganizationEdge: types.NewOrganizationEdge(organization, coredata.OrganizationOrderFieldCreatedAt),
 	}, nil
@@ -1917,11 +1908,7 @@ func (r *mutationResolver) GenerateFrameworkStateOfApplicability(ctx context.Con
 // ExportFramework is the resolver for the exportFramework field.
 func (r *mutationResolver) ExportFramework(ctx context.Context, input types.ExportFrameworkInput) (*types.ExportFrameworkPayload, error) {
 	prb := r.ProboService(ctx, input.FrameworkID.TenantID())
-
 	user := UserFromContext(ctx)
-	if user == nil {
-		panic(fmt.Errorf("user not found"))
-	}

 	err, exportJobID := prb.Frameworks.RequestExport(
 		ctx,
@@ -2773,11 +2760,7 @@ func (r *mutationResolver) BulkExportDocuments(ctx context.Context, input types.
 	}

 	prb := r.ProboService(ctx, input.DocumentIds[0].TenantID())
-
 	user := UserFromContext(ctx)
-	if user == nil {
-		panic(fmt.Errorf("user not found"))
-	}

 	options := probo.BulkExportOptions{
 		WithWatermark:  input.WithWatermark,
@@ -3557,15 +3540,11 @@ func (r *mutationResolver) DeleteCustomDomain(ctx context.Context, input types.D

 // InitiateDomainVerification is the resolver for the initiateDomainVerification field.
 func (r *mutationResolver) InitiateDomainVerification(ctx context.Context, input types.InitiateDomainVerificationInput) (*types.InitiateDomainVerificationPayload, error) {
-	user := UserFromContext(ctx)
-	if user == nil {
-		return nil, fmt.Errorf("user not authenticated")
-	}
-
 	organizationID := input.OrganizationID
 	tenantID := organizationID.TenantID()

-	config, err := r.authSvc.InitiateDomainVerification(ctx, tenantID, organizationID, input.EmailDomain)
+	authSvc := r.AuthService(ctx, tenantID)
+	config, err := authSvc.InitiateDomainVerification(ctx, organizationID, input.EmailDomain)
 	if err != nil {
 		return nil, fmt.Errorf("cannot initiate domain verification: %w", err)
 	}
@@ -3584,15 +3563,11 @@ func (r *mutationResolver) InitiateDomainVerification(ctx context.Context, input

 // VerifyDomain is the resolver for the verifyDomain field.
 func (r *mutationResolver) VerifyDomain(ctx context.Context, input types.VerifyDomainInput) (*types.VerifyDomainPayload, error) {
-	user := UserFromContext(ctx)
-	if user == nil {
-		return nil, fmt.Errorf("user not authenticated")
-	}
-
 	configID := input.ID
 	tenantID := configID.TenantID()

-	config, verified, err := r.authSvc.VerifyDomain(ctx, tenantID, configID)
+	authSvc := r.AuthService(ctx, tenantID)
+	config, verified, err := authSvc.VerifyDomain(ctx, configID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot verify domain: %w", err)
 	}
@@ -3609,11 +3584,6 @@ func (r *mutationResolver) VerifyDomain(ctx context.Context, input types.VerifyD

 // CreateSAMLConfiguration is the resolver for the createSAMLConfiguration field.
 func (r *mutationResolver) CreateSAMLConfiguration(ctx context.Context, input types.CreateSAMLConfigurationInput) (*types.CreateSAMLConfigurationPayload, error) {
-	user := UserFromContext(ctx)
-	if user == nil {
-		return nil, fmt.Errorf("user not authenticated")
-	}
-
 	organizationID := input.OrganizationID
 	tenantID := organizationID.TenantID()

@@ -3670,7 +3640,8 @@ func (r *mutationResolver) CreateSAMLConfiguration(ctx context.Context, input ty
 		autoSignupEnabled = *input.AutoSignupEnabled
 	}

-	config, err := r.authSvc.WithTenant(tenantID).CreateSAMLConfiguration(ctx, auth.CreateSAMLConfigurationRequest{
+	authSvc := r.AuthService(ctx, tenantID)
+	config, err := authSvc.CreateSAMLConfiguration(ctx, auth.CreateSAMLConfigurationRequest{
 		OrganizationID:     organizationID,
 		EmailDomain:        input.EmailDomain,
 		EnforcementPolicy:  input.EnforcementPolicy,
@@ -3699,15 +3670,11 @@ func (r *mutationResolver) CreateSAMLConfiguration(ctx context.Context, input ty

 // UpdateSAMLConfiguration is the resolver for the updateSAMLConfiguration field.
 func (r *mutationResolver) UpdateSAMLConfiguration(ctx context.Context, input types.UpdateSAMLConfigurationInput) (*types.UpdateSAMLConfigurationPayload, error) {
-	user := UserFromContext(ctx)
-	if user == nil {
-		return nil, fmt.Errorf("user not authenticated")
-	}
-
 	configID := input.ID
 	tenantID := configID.TenantID()

-	updatedConfig, err := r.authSvc.WithTenant(tenantID).UpdateSAMLConfiguration(ctx, auth.UpdateSAMLConfigurationRequest{
+	authSvc := r.AuthService(ctx, tenantID)
+	updatedConfig, err := authSvc.UpdateSAMLConfiguration(ctx, auth.UpdateSAMLConfigurationRequest{
 		ID:                 configID,
 		Enabled:            input.Enabled,
 		EnforcementPolicy:  input.EnforcementPolicy,
@@ -3736,15 +3703,11 @@ func (r *mutationResolver) UpdateSAMLConfiguration(ctx context.Context, input ty

 // DeleteSAMLConfiguration is the resolver for the deleteSAMLConfiguration field.
 func (r *mutationResolver) DeleteSAMLConfiguration(ctx context.Context, input types.DeleteSAMLConfigurationInput) (*types.DeleteSAMLConfigurationPayload, error) {
-	user := UserFromContext(ctx)
-	if user == nil {
-		return nil, fmt.Errorf("user not authenticated")
-	}
-
 	configID := input.ID
 	tenantID := configID.TenantID()

-	err := r.authSvc.WithTenant(tenantID).DeleteSAMLConfiguration(ctx, configID)
+	authSvc := r.AuthService(ctx, tenantID)
+	err := authSvc.DeleteSAMLConfiguration(ctx, configID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot delete SAML configuration: %w", err)
 	}
@@ -3756,15 +3719,11 @@ func (r *mutationResolver) DeleteSAMLConfiguration(ctx context.Context, input ty

 // EnableSaml is the resolver for the enableSAML field.
 func (r *mutationResolver) EnableSaml(ctx context.Context, input types.EnableSAMLInput) (*types.EnableSAMLPayload, error) {
-	user := UserFromContext(ctx)
-	if user == nil {
-		return nil, fmt.Errorf("user not authenticated")
-	}
-
 	configID := input.ID
 	tenantID := configID.TenantID()

-	enabledConfig, err := r.authSvc.WithTenant(tenantID).EnableSAMLConfiguration(ctx, configID)
+	authSvc := r.AuthService(ctx, tenantID)
+	enabledConfig, err := authSvc.EnableSAMLConfiguration(ctx, configID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot enable SAML: %w", err)
 	}
@@ -3780,15 +3739,11 @@ func (r *mutationResolver) EnableSaml(ctx context.Context, input types.EnableSAM

 // DisableSaml is the resolver for the disableSAML field.
 func (r *mutationResolver) DisableSaml(ctx context.Context, input types.DisableSAMLInput) (*types.DisableSAMLPayload, error) {
-	user := UserFromContext(ctx)
-	if user == nil {
-		return nil, fmt.Errorf("user not authenticated")
-	}
-
 	configID := input.ID
 	tenantID := configID.TenantID()

-	disabledConfig, err := r.authSvc.WithTenant(tenantID).DisableSAMLConfiguration(ctx, configID)
+	authSvc := r.AuthService(ctx, tenantID)
+	disabledConfig, err := authSvc.DisableSAMLConfiguration(ctx, configID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot disable SAML: %w", err)
 	}
@@ -4551,7 +4506,8 @@ func (r *organizationResolver) CustomDomain(ctx context.Context, obj *types.Orga
 func (r *organizationResolver) SamlConfigurations(ctx context.Context, obj *types.Organization) ([]*types.SAMLConfiguration, error) {
 	tenantID := obj.ID.TenantID()

-	configs, err := r.authSvc.WithTenant(tenantID).GetSAMLConfigurationsByOrganizationID(ctx, obj.ID)
+	authSvc := r.AuthService(ctx, tenantID)
+	configs, err := authSvc.GetSAMLConfigurationsByOrganizationID(ctx, obj.ID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot load SAML configurations: %w", err)
 	}
@@ -5018,7 +4974,8 @@ func (r *sAMLConfigurationResolver) Organization(ctx context.Context, obj *types
 	tenantID := obj.ID.TenantID()
 	prb := r.ProboService(ctx, tenantID)

-	config, err := r.authSvc.WithTenant(tenantID).GetSAMLConfigurationByID(ctx, obj.ID)
+	authSvc := r.AuthService(ctx, tenantID)
+	config, err := authSvc.GetSAMLConfigurationByID(ctx, obj.ID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot load SAML configuration: %w", err)
 	}
@@ -5848,35 +5805,6 @@ func (r *viewerResolver) Organizations(ctx context.Context, obj *types.Viewer, f
 	return types.NewOrganizationConnection(page), nil
 }

-// Invitations is the resolver for the invitations field.
-func (r *viewerResolver) Invitations(ctx context.Context, obj *types.Viewer, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.InvitationOrder, filter *types.InvitationFilter) (*types.InvitationConnection, error) {
-	user := UserFromContext(ctx)
-
-	pageOrderBy := page.OrderBy[coredata.InvitationOrderField]{
-		Field:     coredata.InvitationOrderFieldCreatedAt,
-		Direction: page.OrderDirectionDesc,
-	}
-	if orderBy != nil {
-		pageOrderBy = page.OrderBy[coredata.InvitationOrderField]{
-			Field:     orderBy.Field,
-			Direction: orderBy.Direction,
-		}
-	}
-	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
-
-	invitationFilter := coredata.NewInvitationFilter(nil)
-	if filter != nil {
-		invitationFilter = coredata.NewInvitationFilter(filter.Statuses)
-	}
-
-	invitations, err := r.authzSvc.GetUserInvitations(ctx, user.EmailAddress, cursor, invitationFilter)
-	if err != nil {
-		panic(fmt.Errorf("cannot list invitations for user: %w", err))
-	}
-
-	return types.NewInvitationConnection(invitations, r, gid.GID{}, filter), nil
-}
-
 // Asset returns schema.AssetResolver implementation.
 func (r *Resolver) Asset() schema.AssetResolver { return &assetResolver{r} }