Split GraphQL schemas into per-entity files

Split each API's monolithic schema.graphql into per-coredata-model
files under graphql/ subdirectories. gqlgen's follow-schema layout
with {name}.resolvers.go template generates one resolver file per
schema file. Relay uses schema + schemaExtensions to load the split
files.

Connect API: 8 files (base, session, organization, profile,
personal_api_key, saml, scim, audit_log)

Trust API: 5 files (base, trust_center, auth, nda, mailing_list)

Console API: 25 files covering all domain entities

Types extended across files (Organization, Mutation, Viewer,
TrustCenter, Identity) are defined in base.graphql as required by
Relay's schemaExtensions.

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/server/api/connect/v1/graphql/audit_log.graphql

@@ -0,0 +1,83 @@
+extend type Organization {
+  auditLogEntries(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: AuditLogEntryOrder
+    filter: AuditLogEntryFilter
+  ): AuditLogEntryConnection! @goField(forceResolver: true)
+}
+
+enum AuditLogActorType
+  @goModel(
+    model: "go.probo.inc/probo/pkg/coredata.AuditLogActorType"
+  ) {
+  USER
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.AuditLogActorTypeUser"
+    )
+  API_KEY
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.AuditLogActorTypeAPIKey"
+    )
+  SYSTEM
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.AuditLogActorTypeSystem"
+    )
+}
+
+enum AuditLogEntryOrderField
+  @goModel(
+    model: "go.probo.inc/probo/pkg/coredata.AuditLogEntryOrderField"
+  ) {
+  CREATED_AT
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.AuditLogEntryOrderFieldCreatedAt"
+    )
+}
+
+input AuditLogEntryOrder
+  @goModel(
+    model: "go.probo.inc/probo/pkg/server/api/connect/v1/types.AuditLogEntryOrderBy"
+  ) {
+  field: AuditLogEntryOrderField!
+  direction: OrderDirection!
+}
+
+input AuditLogEntryFilter {
+  action: String
+  actorId: ID
+  resourceType: String
+  resourceId: ID
+}
+
+type AuditLogEntry implements Node {
+  id: ID!
+  organization: Organization @goField(forceResolver: true)
+  actorId: ID!
+  actorType: AuditLogActorType!
+  action: String!
+  resourceType: String!
+  resourceId: ID!
+  metadata: String
+  createdAt: Datetime!
+
+  permission(action: String!): Boolean!
+    @goField(forceResolver: true)
+    @session(required: PRESENT)
+}
+
+type AuditLogEntryConnection
+  @goModel(
+    model: "go.probo.inc/probo/pkg/server/api/connect/v1/types.AuditLogEntryConnection"
+  ) {
+  edges: [AuditLogEntryEdge!]!
+  pageInfo: PageInfo!
+  totalCount: Int! @goField(forceResolver: true)
+}
+
+type AuditLogEntryEdge {
+  cursor: CursorKey!
+  node: AuditLogEntry!
+}

pkg/server/api/connect/v1/graphql/base.graphql

@@ -0,0 +1,121 @@
+directive @goField(
+  forceResolver: Boolean
+  name: String
+  omittable: Boolean
+) on INPUT_FIELD_DEFINITION | FIELD_DEFINITION
+
+directive @goModel(
+  model: String
+  models: [String!]
+) on OBJECT | INPUT_OBJECT | SCALAR | ENUM | INTERFACE | UNION
+
+directive @goEnum(value: String) on ENUM_VALUE
+
+scalar CursorKey
+scalar Datetime
+scalar Upload
+scalar EmailAddr
+
+enum OrderDirection
+  @goModel(model: "go.probo.inc/probo/pkg/page.OrderDirection") {
+  ASC @goEnum(value: "go.probo.inc/probo/pkg/page.OrderDirectionAsc")
+  DESC @goEnum(value: "go.probo.inc/probo/pkg/page.OrderDirectionDesc")
+}
+
+interface Node {
+  id: ID!
+}
+
+type PageInfo {
+  hasNextPage: Boolean!
+  hasPreviousPage: Boolean!
+  startCursor: CursorKey
+  endCursor: CursorKey
+}
+
+type OIDCProviderInfo {
+  name: String!
+  loginURL: String!
+}
+
+enum ReauthenticationReason {
+  SESSION_EXPIRED
+  SENSITIVE_ACTION
+  POLICY_REQUIREMENT
+}
+
+type Query {
+  node(id: ID!): Node @session(required: PRESENT)
+  viewer: Identity @session(required: PRESENT)
+  ssoLoginURL(email: EmailAddr!): String
+    @goField(forceResolver: true)
+    @session(required: OPTIONAL)
+  oidcProviders: [OIDCProviderInfo!]!
+    @goField(forceResolver: true)
+    @session(required: OPTIONAL)
+  signUpEnabled: Boolean!
+    @goField(forceResolver: true)
+    @session(required: OPTIONAL)
+}
+
+type Identity implements Node {
+  id: ID!
+  email: EmailAddr!
+  fullName: String!
+  emailVerified: Boolean!
+  createdAt: Datetime!
+  updatedAt: Datetime!
+
+  ssoLoginURL: String
+    @goField(forceResolver: true)
+    @session(required: PRESENT)
+
+  permission(action: String!): Boolean!
+    @goField(forceResolver: true)
+    @session(required: PRESENT)
+}
+
+type Organization implements Node {
+  id: ID!
+  name: String!
+  logoUrl: String @goField(forceResolver: true)
+  horizontalLogoUrl: String @goField(forceResolver: true)
+  email: String
+  description: String
+  websiteUrl: String
+  headquarterAddress: String
+  createdAt: Datetime!
+  updatedAt: Datetime!
+
+  viewer: Profile @goField(forceResolver: true)
+
+  permission(action: String!): Boolean!
+    @goField(forceResolver: true)
+    @session(required: PRESENT)
+}
+
+type Mutation {
+  signIn(input: SignInInput!): SignInPayload @session(required: OPTIONAL)
+  signUp(input: SignUpInput!): SignUpPayload @session(required: NONE)
+  signOut: SignOutPayload @session(required: PRESENT)
+  activateAccount(
+    input: ActivateAccountInput!
+  ): ActivateAccountPayload @session(required: OPTIONAL)
+  forgotPassword(input: ForgotPasswordInput!): ForgotPasswordPayload
+    @session(required: NONE)
+  resetPassword(input: ResetPasswordInput!): ResetPasswordPayload
+    @session(required: NONE)
+  verifyEmail(input: VerifyEmailInput!): VerifyEmailPayload
+    @session(required: OPTIONAL)
+  changePassword(input: ChangePasswordInput!): ChangePasswordPayload
+    @session(required: PRESENT)
+  changeEmail(input: ChangeEmailInput!): ChangeEmailPayload
+    @session(required: PRESENT)
+  assumeOrganizationSession(
+    input: AssumeOrganizationSessionInput!
+  ): AssumeOrganizationSessionPayload @session(required: PRESENT)
+
+  revokeSession(input: RevokeSessionInput!): RevokeSessionPayload!
+    @session(required: PRESENT)
+  revokeAllSessions: RevokeAllSessionsPayload @session(required: PRESENT)
+}

pkg/server/api/connect/v1/graphql/organization.graphql

@@ -0,0 +1,56 @@
+extend type Mutation {
+  createOrganization(
+    input: CreateOrganizationInput!
+  ): CreateOrganizationPayload @session(required: PRESENT)
+  updateOrganization(
+    input: UpdateOrganizationInput!
+  ): UpdateOrganizationPayload @session(required: PRESENT)
+  deleteOrganization(
+    input: DeleteOrganizationInput!
+  ): DeleteOrganizationPayload @session(required: PRESENT)
+  deleteOrganizationHorizontalLogo(
+    input: DeleteOrganizationHorizontalLogoInput!
+  ): DeleteOrganizationHorizontalLogoPayload @session(required: PRESENT)
+}
+
+input CreateOrganizationInput {
+  name: String!
+  logoFile: Upload
+  horizontalLogoFile: Upload
+}
+
+input UpdateOrganizationInput {
+  organizationId: ID!
+  name: String
+  logoFile: Upload
+  horizontalLogoFile: Upload
+  description: String @goField(omittable: true)
+  websiteUrl: String @goField(omittable: true)
+  email: String @goField(omittable: true)
+  headquarterAddress: String @goField(omittable: true)
+}
+
+input DeleteOrganizationInput {
+  organizationId: ID!
+}
+
+input DeleteOrganizationHorizontalLogoInput {
+  organizationId: ID!
+}
+
+type CreateOrganizationPayload {
+  organization: Organization
+  profile: Profile!
+}
+
+type UpdateOrganizationPayload {
+  organization: Organization
+}
+
+type DeleteOrganizationPayload {
+  deletedOrganizationId: ID!
+}
+
+type DeleteOrganizationHorizontalLogoPayload {
+  organization: Organization!
+}

pkg/server/api/connect/v1/graphql/personal_api_key.graphql

@@ -0,0 +1,63 @@
+extend type Identity {
+  personalAPIKeys(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+  ): PersonalAPIKeyConnection @goField(forceResolver: true)
+}
+
+type PersonalAPIKey implements Node {
+  id: ID!
+  name: String!
+  expiresAt: Datetime!
+  lastUsedAt: Datetime
+  createdAt: Datetime!
+
+  token: String @goField(forceResolver: true)
+
+  permission(action: String!): Boolean!
+    @goField(forceResolver: true)
+    @session(required: PRESENT)
+}
+
+type PersonalAPIKeyConnection
+  @goModel(
+    model: "go.probo.inc/probo/pkg/server/api/connect/v1/types.PersonalAPIKeyConnection"
+  ) {
+  edges: [PersonalAPIKeyEdge!]!
+  pageInfo: PageInfo!
+  totalCount: Int @goField(forceResolver: true)
+}
+
+type PersonalAPIKeyEdge {
+  node: PersonalAPIKey!
+  cursor: CursorKey!
+}
+
+extend type Mutation {
+  createPersonalAPIKey(
+    input: CreatePersonalAPIKeyInput!
+  ): CreatePersonalAPIKeyPayload @session(required: PRESENT)
+  revokePersonalAPIKey(
+    input: RevokePersonalAPIKeyInput!
+  ): RevokePersonalAPIKeyPayload @session(required: PRESENT)
+}
+
+input CreatePersonalAPIKeyInput {
+  name: String!
+  expiresAt: Datetime!
+}
+
+input RevokePersonalAPIKeyInput {
+  personalAPIKeyId: ID!
+}
+
+type CreatePersonalAPIKeyPayload {
+  personalAPIKeyEdge: PersonalAPIKeyEdge!
+  token: String!
+}
+
+type RevokePersonalAPIKeyPayload {
+  personalAPIKeyId: ID!
+}

pkg/server/api/connect/v1/graphql/profile.graphql

@@ -0,0 +1,271 @@
+extend type Identity {
+  profiles(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: ProfileOrder
+    filter: ProfileFilter
+  ): ProfileConnection @goField(forceResolver: true)
+}
+
+extend type Organization {
+  profiles(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: ProfileOrder
+  ): ProfileConnection @goField(forceResolver: true)
+}
+
+type Profile implements Node {
+  id: ID!
+  fullName: String!
+  emailAddress: EmailAddr!
+  source: String!
+  state: ProfileState!
+  additionalEmailAddresses: [EmailAddr!]!
+  kind: String
+  position: String
+  contractStartDate: Datetime
+  contractEndDate: Datetime
+  createdAt: Datetime!
+  updatedAt: Datetime!
+
+  identity: Identity @goField(forceResolver: true)
+  organization: Organization @goField(forceResolver: true)
+  membership: Membership @goField(forceResolver: true)
+  pendingInvitations(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: InvitationOrder
+  ): InvitationConnection @goField(forceResolver: true)
+
+  permission(action: String!): Boolean!
+    @goField(forceResolver: true)
+    @session(required: PRESENT)
+}
+
+enum ProfileState
+  @goModel(model: "go.probo.inc/probo/pkg/coredata.ProfileState") {
+  ACTIVE @goEnum(value: "go.probo.inc/probo/pkg/coredata.ProfileStateActive")
+  INACTIVE
+    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ProfileStateInactive")
+}
+
+enum ProfileSource
+  @goModel(model: "go.probo.inc/probo/pkg/coredata.ProfileSource") {
+  MANUAL
+    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ProfileSourceManual")
+  SAML @goEnum(value: "go.probo.inc/probo/pkg/coredata.ProfileSourceSAML")
+  SCIM @goEnum(value: "go.probo.inc/probo/pkg/coredata.ProfileSourceSCIM")
+}
+
+enum MembershipRole
+  @goModel(model: "go.probo.inc/probo/pkg/coredata.MembershipRole") {
+  OWNER @goEnum(value: "go.probo.inc/probo/pkg/coredata.MembershipRoleOwner")
+  ADMIN @goEnum(value: "go.probo.inc/probo/pkg/coredata.MembershipRoleAdmin")
+  EMPLOYEE
+    @goEnum(value: "go.probo.inc/probo/pkg/coredata.MembershipRoleEmployee")
+  VIEWER @goEnum(value: "go.probo.inc/probo/pkg/coredata.MembershipRoleViewer")
+  AUDITOR
+    @goEnum(value: "go.probo.inc/probo/pkg/coredata.MembershipRoleAuditor")
+}
+
+type Membership implements Node {
+  id: ID!
+  createdAt: Datetime!
+  role: MembershipRole!
+
+  lastSession: Session @goField(forceResolver: true)
+
+  permission(action: String!): Boolean!
+    @goField(forceResolver: true)
+    @session(required: PRESENT)
+}
+
+type Invitation implements Node {
+  id: ID!
+  expiresAt: Datetime!
+  acceptedAt: Datetime
+  createdAt: Datetime!
+  status: InvitationStatus!
+
+  permission(action: String!): Boolean!
+    @goField(forceResolver: true)
+    @session(required: PRESENT)
+}
+
+enum InvitationStatus
+  @goModel(model: "go.probo.inc/probo/pkg/coredata.InvitationStatus") {
+  PENDING
+    @goEnum(value: "go.probo.inc/probo/pkg/coredata.InvitationStatusPending")
+  ACCEPTED
+    @goEnum(value: "go.probo.inc/probo/pkg/coredata.InvitationStatusAccepted")
+  EXPIRED
+    @goEnum(value: "go.probo.inc/probo/pkg/coredata.InvitationStatusExpired")
+}
+
+enum InvitationOrderField
+  @goModel(model: "go.probo.inc/probo/pkg/coredata.InvitationOrderField") {
+  CREATED_AT
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.InvitationOrderFieldCreatedAt"
+    )
+}
+
+input InvitationOrder
+  @goModel(
+    model: "go.probo.inc/probo/pkg/server/api/connect/v1/types.InvitationOrderBy"
+  ) {
+  direction: OrderDirection!
+  field: InvitationOrderField!
+}
+
+type InvitationConnection
+  @goModel(
+    model: "go.probo.inc/probo/pkg/server/api/connect/v1/types.InvitationConnection"
+  ) {
+  edges: [InvitationEdge!]!
+  pageInfo: PageInfo!
+}
+
+type InvitationEdge {
+  node: Invitation!
+  cursor: CursorKey!
+}
+
+enum ProfileOrderField
+  @goModel(model: "go.probo.inc/probo/pkg/coredata.MembershipProfileOrderField") {
+  FULL_NAME
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.MembershipProfileOrderFieldFullName"
+    )
+  CREATED_AT
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.MembershipProfileOrderFieldCreatedAt"
+    )
+  KIND @goEnum(value: "go.probo.inc/probo/pkg/coredata.MembershipProfileOrderFieldKind")
+  ORGANIZATION_NAME
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.MembershipProfileOrderFieldOrganizationName"
+    )
+  STATE
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.MembershipProfileOrderFieldState"
+    )
+}
+
+input ProfileFilter {
+  excludeContractEnded: Boolean
+  state: ProfileState
+}
+
+input ProfileOrder
+  @goModel(
+    model: "go.probo.inc/probo/pkg/server/api/connect/v1/types.ProfileOrderBy"
+  ) {
+  direction: OrderDirection!
+  field: ProfileOrderField!
+}
+
+type ProfileConnection
+  @goModel(
+    model: "go.probo.inc/probo/pkg/server/api/connect/v1/types.ProfileConnection"
+  ) {
+  totalCount: Int @goField(forceResolver: true)
+  edges: [ProfileEdge!]!
+  pageInfo: PageInfo!
+}
+
+type ProfileEdge {
+  cursor: CursorKey!
+  node: Profile!
+}
+
+extend type Mutation {
+  createUser(input: CreateUserInput!): CreateUserPayload
+    @session(required: PRESENT)
+  inviteUser(input: InviteUserInput!): InviteUserPayload
+    @session(required: PRESENT)
+  deactivateUser(input: DeactivateUserInput!): DeactivateUserPayload
+  updateUser(input: UpdateUserInput!): UpdateUserPayload!
+  updateMembership(input: UpdateMembershipInput!): UpdateMembershipPayload!
+  removeUser(input: RemoveUserInput!): RemoveUserPayload
+    @session(required: PRESENT)
+}
+
+input CreateUserInput {
+  organizationId: ID!
+  fullName: String!
+  emailAddress: EmailAddr!
+  role: MembershipRole!
+  additionalEmailAddresses: [EmailAddr!]
+  kind: String
+  position: String
+  contractStartDate: Datetime @goField(omittable: true)
+  contractEndDate: Datetime @goField(omittable: true)
+}
+
+input InviteUserInput {
+  organizationId: ID!
+  profileId: ID!
+}
+
+input ActivateUserInput {
+  organizationId: ID!
+  profileId: ID!
+}
+
+input DeactivateUserInput {
+  organizationId: ID!
+  profileId: ID!
+}
+
+input UpdateUserInput {
+  id: ID!
+  fullName: String!
+  additionalEmailAddresses: [EmailAddr!]
+  kind: String
+  position: String
+  contractStartDate: Datetime @goField(omittable: true)
+  contractEndDate: Datetime @goField(omittable: true)
+}
+
+input UpdateMembershipInput {
+  organizationId: ID!
+  membershipId: ID!
+  role: MembershipRole!
+}
+
+input RemoveUserInput {
+  organizationId: ID!
+  profileId: ID!
+}
+
+type CreateUserPayload {
+  profileEdge: ProfileEdge!
+}
+
+type InviteUserPayload {
+  invitationEdge: InvitationEdge!
+}
+
+type DeactivateUserPayload {
+  success: Boolean!
+}
+
+type UpdateUserPayload {
+  profile: Profile!
+}
+
+type UpdateMembershipPayload {
+  membership: Membership!
+}
+
+type RemoveUserPayload {
+  deletedProfileId: ID!
+}

pkg/server/api/connect/v1/graphql/saml.graphql

@@ -0,0 +1,119 @@
+extend type Organization {
+  samlConfigurations(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+  ): SAMLConfigurationConnection @goField(forceResolver: true)
+}
+
+type SAMLConfiguration implements Node {
+  id: ID!
+  emailDomain: String!
+  enforcementPolicy: SAMLEnforcementPolicy!
+  domainVerifiedAt: Datetime
+  domainVerificationToken: String
+  idpEntityId: String!
+  idpSsoUrl: String!
+  idpCertificate: String!
+  autoSignupEnabled: Boolean!
+  createdAt: Datetime!
+  updatedAt: Datetime!
+  testLoginUrl: String! @goField(forceResolver: true)
+  attributeMappings: SAMLAttributeMappings!
+
+  permission(action: String!): Boolean!
+    @goField(forceResolver: true)
+    @session(required: PRESENT)
+}
+
+type SAMLAttributeMappings {
+  email: String!
+  firstName: String!
+  lastName: String!
+  role: String!
+}
+
+enum SAMLEnforcementPolicy
+  @goModel(model: "go.probo.inc/probo/pkg/coredata.SAMLEnforcementPolicy") {
+  OFF @goEnum(value: "go.probo.inc/probo/pkg/coredata.SAMLEnforcementPolicyOff")
+  OPTIONAL
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.SAMLEnforcementPolicyOptional"
+    )
+  REQUIRED
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.SAMLEnforcementPolicyRequired"
+    )
+}
+
+type SAMLConfigurationConnection
+  @goModel(
+    model: "go.probo.inc/probo/pkg/server/api/connect/v1/types.SAMLConfigurationConnection"
+  ) {
+  edges: [SAMLConfigurationEdge!]!
+  pageInfo: PageInfo!
+  totalCount: Int @goField(forceResolver: true)
+}
+
+type SAMLConfigurationEdge {
+  node: SAMLConfiguration!
+  cursor: CursorKey!
+}
+
+extend type Mutation {
+  createSAMLConfiguration(
+    input: CreateSAMLConfigurationInput!
+  ): CreateSAMLConfigurationPayload @session(required: PRESENT)
+  updateSAMLConfiguration(
+    input: UpdateSAMLConfigurationInput!
+  ): UpdateSAMLConfigurationPayload @session(required: PRESENT)
+  deleteSAMLConfiguration(
+    input: DeleteSAMLConfigurationInput!
+  ): DeleteSAMLConfigurationPayload @session(required: PRESENT)
+}
+
+input CreateSAMLConfigurationInput {
+  organizationId: ID!
+  emailDomain: String!
+  idpEntityId: String!
+  idpSsoUrl: String!
+  idpCertificate: String!
+  autoSignupEnabled: Boolean!
+  attributeMappings: SAMLAttributeMappingsInput
+}
+
+input SAMLAttributeMappingsInput {
+  email: String
+  firstName: String
+  lastName: String
+  role: String
+}
+
+input UpdateSAMLConfigurationInput {
+  organizationId: ID!
+  samlConfigurationId: ID!
+  idpEntityId: String
+  idpSsoUrl: String
+  idpCertificate: String
+  autoSignupEnabled: Boolean
+  enforcementPolicy: SAMLEnforcementPolicy!
+  attributeMappings: SAMLAttributeMappingsInput
+}
+
+input DeleteSAMLConfigurationInput {
+  organizationId: ID!
+  samlConfigurationId: ID!
+}
+
+type CreateSAMLConfigurationPayload {
+  samlConfigurationEdge: SAMLConfigurationEdge!
+}
+
+type UpdateSAMLConfigurationPayload {
+  samlConfiguration: SAMLConfiguration
+}
+
+type DeleteSAMLConfigurationPayload {
+  deletedSamlConfigurationId: ID!
+}

pkg/server/api/connect/v1/graphql/scim.graphql

@@ -0,0 +1,182 @@
+extend type Organization {
+  scimConfiguration: SCIMConfiguration @goField(forceResolver: true)
+  scimBridgeTypes: [SCIMBridgeTypeInfo!]! @goField(forceResolver: true)
+}
+
+type SCIMConfiguration implements Node {
+  id: ID!
+  endpointUrl: String! @goField(forceResolver: true)
+  createdAt: Datetime!
+  updatedAt: Datetime!
+  organization: Organization @goField(forceResolver: true)
+
+  bridge: SCIMBridge @goField(forceResolver: true)
+
+  events(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: SCIMEventOrder
+  ): SCIMEventConnection @goField(forceResolver: true)
+
+  permission(action: String!): Boolean!
+    @goField(forceResolver: true)
+    @session(required: PRESENT)
+}
+
+type SCIMBridge implements Node {
+  id: ID!
+  state: SCIMBridgeState!
+  scimConfiguration: SCIMConfiguration @goField(forceResolver: true)
+  connector: Connector @goField(forceResolver: true)
+  type: SCIMBridgeType!
+  excludedUserNames: [String!]!
+  createdAt: Datetime!
+  updatedAt: Datetime!
+
+  permission(action: String!): Boolean!
+    @goField(forceResolver: true)
+    @session(required: PRESENT)
+}
+
+type Connector implements Node {
+  id: ID!
+  provider: ConnectorProvider!
+  createdAt: Datetime!
+  updatedAt: Datetime!
+
+  permission(action: String!): Boolean!
+    @goField(forceResolver: true)
+    @session(required: PRESENT)
+}
+
+enum ConnectorProvider
+  @goModel(model: "go.probo.inc/probo/pkg/coredata.ConnectorProvider") {
+  SLACK @goEnum(value: "go.probo.inc/probo/pkg/coredata.ConnectorProviderSlack")
+  GOOGLE_WORKSPACE
+    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ConnectorProviderGoogleWorkspace")
+  BREX @goEnum(value: "go.probo.inc/probo/pkg/coredata.ConnectorProviderBrex")
+  TALLY @goEnum(value: "go.probo.inc/probo/pkg/coredata.ConnectorProviderTally")
+  CLOUDFLARE
+    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ConnectorProviderCloudflare")
+}
+
+enum SCIMBridgeType
+  @goModel(model: "go.probo.inc/probo/pkg/coredata.SCIMBridgeType") {
+  GOOGLE_WORKSPACE @goEnum(value: "go.probo.inc/probo/pkg/coredata.SCIMBridgeTypeGoogleWorkspace")
+}
+
+type SCIMBridgeTypeInfo {
+  type: SCIMBridgeType!
+  oauth2Scopes: [String!]!
+}
+
+enum SCIMBridgeState
+  @goModel(model: "go.probo.inc/probo/pkg/coredata.SCIMBridgeState") {
+  PENDING @goEnum(value: "go.probo.inc/probo/pkg/coredata.SCIMBridgeStatePending")
+  ACTIVE @goEnum(value: "go.probo.inc/probo/pkg/coredata.SCIMBridgeStateActive")
+  FAILED @goEnum(value: "go.probo.inc/probo/pkg/coredata.SCIMBridgeStateFailed")
+}
+
+type SCIMEvent implements Node {
+  id: ID!
+  method: String!
+  path: String!
+  statusCode: Int!
+  requestBody: String
+  responseBody: String
+  errorMessage: String
+  userName: String!
+  ipAddress: String!
+  createdAt: Datetime!
+
+  permission(action: String!): Boolean!
+    @goField(forceResolver: true)
+    @session(required: PRESENT)
+}
+
+enum SCIMEventOrderField
+  @goModel(model: "go.probo.inc/probo/pkg/coredata.SCIMEventOrderField") {
+  CREATED_AT
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.SCIMEventOrderFieldCreatedAt"
+    )
+}
+
+input SCIMEventOrder
+  @goModel(
+    model: "go.probo.inc/probo/pkg/server/api/connect/v1/types.SCIMEventOrderBy"
+  ) {
+  direction: OrderDirection!
+  field: SCIMEventOrderField!
+}
+
+type SCIMEventConnection
+  @goModel(
+    model: "go.probo.inc/probo/pkg/server/api/connect/v1/types.SCIMEventConnection"
+  ) {
+  edges: [SCIMEventEdge!]!
+  pageInfo: PageInfo!
+  totalCount: Int @goField(forceResolver: true)
+}
+
+type SCIMEventEdge {
+  node: SCIMEvent!
+  cursor: CursorKey!
+}
+
+extend type Mutation {
+  createSCIMConfiguration(
+    input: CreateSCIMConfigurationInput!
+  ): CreateSCIMConfigurationPayload @session(required: PRESENT)
+  deleteSCIMConfiguration(
+    input: DeleteSCIMConfigurationInput!
+  ): DeleteSCIMConfigurationPayload @session(required: PRESENT)
+  regenerateSCIMToken(
+    input: RegenerateSCIMTokenInput!
+  ): RegenerateSCIMTokenPayload @session(required: PRESENT)
+  updateSCIMBridge(
+    input: UpdateSCIMBridgeInput!
+  ): UpdateSCIMBridgePayload @session(required: PRESENT)
+}
+
+input CreateSCIMConfigurationInput {
+  organizationId: ID!
+  connectorId: ID
+}
+
+input DeleteSCIMConfigurationInput {
+  organizationId: ID!
+  scimConfigurationId: ID!
+}
+
+input RegenerateSCIMTokenInput {
+  organizationId: ID!
+  scimConfigurationId: ID!
+}
+
+input UpdateSCIMBridgeInput {
+  organizationId: ID!
+  scimBridgeId: ID!
+  excludedUserNames: [String!]!
+}
+
+type CreateSCIMConfigurationPayload {
+  scimConfiguration: SCIMConfiguration!
+  scimBridge: SCIMBridge
+  token: String!
+}
+
+type DeleteSCIMConfigurationPayload {
+  deletedScimConfigurationId: ID!
+}
+
+type RegenerateSCIMTokenPayload {
+  scimConfiguration: SCIMConfiguration!
+  token: String!
+}
+
+type UpdateSCIMBridgePayload {
+  scimBridge: SCIMBridge!
+}

pkg/server/api/connect/v1/graphql/session.graphql

@@ -0,0 +1,169 @@
+enum SessionOrderField
+  @goModel(model: "go.probo.inc/probo/pkg/coredata.SessionOrderField") {
+  CREATED_AT
+    @goEnum(value: "go.probo.inc/probo/pkg/coredata.SessionOrderFieldCreatedAt")
+  EXPIRED_AT
+    @goEnum(value: "go.probo.inc/probo/pkg/coredata.SessionOrderFieldExpiredAt")
+  UPDATED_AT
+    @goEnum(value: "go.probo.inc/probo/pkg/coredata.SessionOrderFieldUpdatedAt")
+}
+
+input SessionOrder {
+  direction: OrderDirection!
+  field: SessionOrderField!
+}
+
+extend type Identity {
+  sessions(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: SessionOrder
+  ): SessionConnection @goField(forceResolver: true)
+}
+
+type Session implements Node {
+  id: ID!
+  identity: Identity @goField(forceResolver: true)
+  ipAddress: String!
+  userAgent: String!
+  updatedAt: Datetime!
+  createdAt: Datetime!
+  expiresAt: Datetime!
+
+  permission(action: String!): Boolean!
+    @goField(forceResolver: true)
+    @session(required: PRESENT)
+}
+
+type SessionConnection
+  @goModel(
+    model: "go.probo.inc/probo/pkg/server/api/connect/v1/types.SessionConnection"
+  ) {
+  edges: [SessionEdge!]!
+  pageInfo: PageInfo!
+  totalCount: Int @goField(forceResolver: true)
+}
+
+type SessionEdge {
+  node: Session!
+  cursor: CursorKey!
+}
+
+input SignInInput {
+  organizationId: ID
+  email: EmailAddr!
+  password: String!
+}
+
+input SignUpInput {
+  email: EmailAddr!
+  password: String!
+  fullName: String!
+}
+
+input ActivateAccountInput {
+  token: String!
+}
+
+input ForgotPasswordInput {
+  email: EmailAddr!
+}
+
+input ResetPasswordInput {
+  token: String!
+  password: String!
+}
+
+input VerifyEmailInput {
+  token: String!
+}
+
+input ChangePasswordInput {
+  currentPassword: String!
+  newPassword: String!
+}
+
+input ChangeEmailInput {
+  newEmail: EmailAddr!
+  password: String!
+}
+
+input AssumeOrganizationSessionInput {
+  organizationId: ID!
+  continue: String!
+}
+
+input RevokeSessionInput {
+  sessionId: ID!
+}
+
+type SignInPayload {
+  identity: Identity
+  session: Session
+}
+
+type SignUpPayload {
+  identity: Identity
+}
+
+type SignOutPayload {
+  success: Boolean!
+}
+
+type ActivateAccountPayload {
+  createPasswordToken: String
+  ssoLoginUrl: String
+  profile: Profile
+}
+
+type ForgotPasswordPayload {
+  success: Boolean!
+}
+
+type ResetPasswordPayload {
+  success: Boolean!
+}
+
+type VerifyEmailPayload {
+  success: Boolean!
+}
+
+type ChangePasswordPayload {
+  success: Boolean!
+}
+
+type ChangeEmailPayload {
+  success: Boolean!
+}
+
+union AssumeOrganizationSessionResult =
+  | OrganizationSessionCreated
+  | PasswordRequired
+  | SAMLAuthenticationRequired
+
+type OrganizationSessionCreated {
+  session: Session!
+  membership: Membership!
+}
+
+type PasswordRequired {
+  reason: ReauthenticationReason!
+}
+
+type SAMLAuthenticationRequired {
+  reason: ReauthenticationReason!
+}
+
+type AssumeOrganizationSessionPayload {
+  result: AssumeOrganizationSessionResult!
+}
+
+type RevokeSessionPayload {
+  success: Boolean!
+}
+
+type RevokeAllSessionsPayload {
+  revokedCount: Int!
+}