Rewrite the global id system to include tenant id

The API should be aware of the tenant they are working on. Many solution
is possible like passing a header, adding the tenant id in each function
call, encode the tenant id in the GID.

I consider the header as a hack it force the client to keep in mind to
pass this header, having to returns an error in case of not defined
header and add a non standard header make the API more harder to use.

Passing the tenant id everywhere will be a good option but since Relay
impose to have node(id: ID!) Node interface it is not possible or by
hacking by wrapping node(id: ID!) Node in top query who getting the
tenant_id.

I finish by simpliy encode the tenant id directly in the object id, it
what AWS do too, it allow to always have the information, and it ensure
a right data isolation.

Signed-off-by: gearnode <bryan@frimin.fr>

pkg/gid/gid.go

@@ -1,51 +1,40 @@
-// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
-//
-// Permission to use, copy, modify, and/or distribute this software for any
-// purpose with or without fee is hereby granted, provided that the above
-// copyright notice and this permission notice appear in all copies.
-//
-// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
-// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
-// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
-// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-// PERFORMANCE OF THIS SOFTWARE.
-
 package gid
 
 import (
+	"crypto/rand"
 	"database/sql/driver"
 	"encoding/base64"
 	"encoding/binary"
 	"fmt"
+	"time"
+)
 
-	"go.gearno.de/crypto/uuid"
+const (
+	GIDSize = 32 // 256 bits total
 )
 
 type (
-	GID uuid.UUID
+	GID      [GIDSize]byte
+	TenantID [16]byte // 128-bit tenant ID
 )
 
 var (
-	Nil = GID(uuid.Nil)
+	Nil = GID{}
 )
 
 // ParseGID parses a string representation of a GID
 func ParseGID(encoded string) (GID, error) {
 	gid := GID{}
-
 	err := gid.UnmarshalText([]byte(encoded))
 	if err != nil {
 		return Nil, err
 	}
-
 	return gid, nil
 }
 
-// New creates a new GID with a default entity type of 0
-func New() GID {
-	id, err := NewGID(0)
+// New creates a new GID with default entity type and nil tenant ID
+func New(tenantID TenantID, entityType uint16) GID {
+	id, err := NewGID(tenantID, entityType)
 	if err != nil {
 		// This should never happen with a valid random source
 		panic(fmt.Sprintf("failed to generate GID: %v", err))
@@ -53,26 +42,58 @@ func New() GID {
 	return id
 }
 
-// NewGID creates a new GID with the specified entity type
-func NewGID(et uint32) (GID, error) {
-	id, err := uuid.NewV7()
+// NewGID creates a new GID with the specified entity type and tenant ID
+// Structure:
+// - Bytes 0-15: Tenant ID (full 16 bytes)
+// - Bytes 16-17: Entity Type (uint16)
+// - Bytes 18-25: Timestamp (milliseconds since epoch)
+// - Bytes 26-31: Random data for uniqueness
+func NewGID(tenantID TenantID, entityType uint16) (GID, error) {
+	var id GID
+
+	// Write full tenant ID (16 bytes)
+	copy(id[0:16], tenantID[:])
+
+	// Write entity type (2 bytes)
+	binary.BigEndian.PutUint16(id[16:18], entityType)
+
+	// Get current timestamp (milliseconds) and write it (8 bytes)
+	now := time.Now().UnixMilli()
+	binary.BigEndian.PutUint64(id[18:26], uint64(now))
+
+	// Fill the rest with random data (6 bytes)
+	_, err := rand.Read(id[26:32])
 	if err != nil {
-		return Nil, err
+		return Nil, fmt.Errorf("failed to generate random bytes: %v", err)
 	}
 
-	binary.BigEndian.PutUint32(id[10:14], et)
-
-	return GID(id), nil
+	return id, nil
 }
 
+// Value implements the database/sql/driver.Valuer interface
 func (gid GID) Value() (driver.Value, error) {
 	return gid.String(), nil
 }
 
-func (gid GID) EntityType() uint32 {
-	return binary.BigEndian.Uint32(gid[10:14])
+// TenantID extracts the tenant ID from the GID
+func (gid GID) TenantID() TenantID {
+	var tenantID TenantID
+	copy(tenantID[:], gid[0:16])
+	return tenantID
 }
 
+// EntityType extracts the entity type from the GID
+func (gid GID) EntityType() uint16 {
+	return binary.BigEndian.Uint16(gid[16:18])
+}
+
+// Timestamp extracts the timestamp from the GID
+func (gid GID) Timestamp() time.Time {
+	millis := binary.BigEndian.Uint64(gid[18:26])
+	return time.UnixMilli(int64(millis))
+}
+
+// Scan implements the database/sql/driver.Scanner interface
 func (gid *GID) Scan(value interface{}) error {
 	switch v := value.(type) {
 	case string:
@@ -82,33 +103,43 @@ func (gid *GID) Scan(value interface{}) error {
 			return err
 		}
 
-		*gid = GID(id)
+		if len(id) != GIDSize {
+			return fmt.Errorf("invalid length for GID: got %d, want %d", len(id), GIDSize)
+		}
+
+		copy((*gid)[:], id)
 	default:
 		return fmt.Errorf("invalid type for GID: expected string, got %T", value)
 	}
 	return nil
 }
 
+// String returns the base64url encoded representation of the GID
 func (gid GID) String() string {
 	return base64.RawURLEncoding.EncodeToString(gid[:])
 }
 
+// MarshalText returns the base64url encoded representation of the GID
 func (gid GID) MarshalText() ([]byte, error) {
 	enc := base64.RawURLEncoding
-
 	buf := make([]byte, enc.EncodedLen(len(gid)))
 	enc.Encode(buf, gid[:])
-
 	return buf, nil
 }
 
+// UnmarshalText decodes a base64url encoded GID
 func (gid *GID) UnmarshalText(encoded []byte) error {
 	enc := base64.RawURLEncoding
-
-	_, err := enc.Decode(gid[:], encoded)
+	dst := make([]byte, enc.DecodedLen(len(encoded)))
+	n, err := enc.Decode(dst, encoded)
 	if err != nil {
 		return err
 	}
 
+	if n != GIDSize {
+		return fmt.Errorf("invalid length for GID: got %d, want %d", n, GIDSize)
+	}
+
+	copy((*gid)[:], dst)
 	return nil
 }

pkg/gid/tenant_id.go

@@ -0,0 +1,173 @@
+package gid
+
+import (
+	"crypto/rand"
+	"database/sql/driver"
+	"encoding/base64"
+	"encoding/binary"
+	"fmt"
+	"os"
+	"sync/atomic"
+	"time"
+)
+
+var (
+	// NilTenant represents an empty tenant ID
+	NilTenant = TenantID{}
+
+	// Global generation singleton
+	defaultTenantGenerator = newTenantGenerator()
+)
+
+// TenantGenerator handles creation of unique tenant IDs
+type tenantGenerator struct {
+	// Process-specific values
+	machineID [6]byte // 48 bits for machine identifier
+	processID uint16  // 16 bits for process
+	counter   uint32  // Counter for the sequence
+}
+
+// NewTenantID generates a new globally unique tenant ID
+func NewTenantID() TenantID {
+	return defaultTenantGenerator.NewTenantID()
+}
+
+// ParseTenantID parses a string representation into a TenantID
+func ParseTenantID(s string) (TenantID, error) {
+	var id TenantID
+	decoded, err := base64.RawURLEncoding.DecodeString(s)
+	if err != nil {
+		return NilTenant, fmt.Errorf("invalid tenant ID encoding: %w", err)
+	}
+
+	if len(decoded) != len(id) {
+		return NilTenant, fmt.Errorf("invalid tenant ID length: got %d, want %d", len(decoded), len(id))
+	}
+
+	copy(id[:], decoded)
+	return id, nil
+}
+
+// newTenantGenerator creates a new generator with machine-specific components
+func newTenantGenerator() *tenantGenerator {
+	g := &tenantGenerator{
+		counter: 0,
+	}
+
+	// Generate machine ID component
+	if _, err := rand.Read(g.machineID[:]); err != nil {
+		// Fallback if random source fails
+		hostname, _ := os.Hostname()
+		copy(g.machineID[:], []byte(hostname))
+
+		// Pad with timestamp bits if hostname is short
+		if len(hostname) < len(g.machineID) {
+			ts := time.Now().UnixNano()
+			binary.BigEndian.PutUint32(g.machineID[len(hostname):], uint32(ts))
+		}
+	}
+
+	// Set process ID from OS PID
+	g.processID = uint16(os.Getpid() & 0xFFFF)
+
+	return g
+}
+
+// NewTenantID generates a new 128-bit tenant ID with the structure:
+// - 48 bits: Machine ID (random, unique per machine)
+// - 16 bits: Process ID (unique per process on machine)
+// - 48 bits: Timestamp (milliseconds, sequential)
+// - 16 bits: Counter (increments per ID)
+func (g *tenantGenerator) NewTenantID() TenantID {
+	// Create new ID
+	var id TenantID
+
+	// 1. Get timestamp (48 bits = milliseconds since epoch)
+	now := time.Now().UnixMilli()
+
+	// 2. Increment counter atomically (16 bits used)
+	count := atomic.AddUint32(&g.counter, 1) & 0xFFFF
+
+	// 3. Assemble the ID
+	// First 6 bytes: Machine ID
+	copy(id[0:6], g.machineID[:])
+
+	// Next 2 bytes: Process ID
+	binary.BigEndian.PutUint16(id[6:8], g.processID)
+
+	// Next 6 bytes: Timestamp (48 bits)
+	id[8] = byte(now >> 40)
+	id[9] = byte(now >> 32)
+	id[10] = byte(now >> 24)
+	id[11] = byte(now >> 16)
+	id[12] = byte(now >> 8)
+	id[13] = byte(now)
+
+	// Last 2 bytes: Counter
+	binary.BigEndian.PutUint16(id[14:16], uint16(count))
+
+	return id
+}
+
+// Value implements the database/sql/driver.Valuer interface
+func (id TenantID) Value() (driver.Value, error) {
+	return id.String(), nil
+}
+
+// Scan implements the database/sql.Scanner interface
+func (id *TenantID) Scan(value interface{}) error {
+	switch v := value.(type) {
+	case string:
+		decoded, err := base64.RawURLEncoding.DecodeString(v)
+		if err != nil {
+			return err
+		}
+
+		if len(decoded) != len(*id) {
+			return fmt.Errorf("invalid tenant ID length: got %d, want %d", len(decoded), len(*id))
+		}
+
+		copy((*id)[:], decoded)
+		return nil
+	default:
+		return fmt.Errorf("invalid type for TenantID: expected string, got %T", value)
+	}
+}
+
+// String returns the base64 representation of the TenantID
+func (id TenantID) String() string {
+	return base64.RawURLEncoding.EncodeToString(id[:])
+}
+
+// MarshalText returns the base64 representation for JSON encoding
+func (id TenantID) MarshalText() ([]byte, error) {
+	encoded := base64.RawURLEncoding.EncodeToString(id[:])
+	return []byte(encoded), nil
+}
+
+// UnmarshalText parses the base64 representation for JSON decoding
+func (id *TenantID) UnmarshalText(text []byte) error {
+	decoded, err := base64.RawURLEncoding.DecodeString(string(text))
+	if err != nil {
+		return err
+	}
+
+	if len(decoded) != len(*id) {
+		return fmt.Errorf("invalid tenant ID length: got %d, want %d", len(decoded), len(*id))
+	}
+
+	copy((*id)[:], decoded)
+	return nil
+}
+
+// IsValid returns true if the tenant ID is not nil
+func (id TenantID) IsValid() bool {
+	return id != NilTenant
+}
+
+// Timestamp extracts the timestamp from the TenantID
+func (id TenantID) Timestamp() time.Time {
+	millis := int64(id[8])<<40 | int64(id[9])<<32 | int64(id[10])<<24 |
+		int64(id[11])<<16 | int64(id[12])<<8 | int64(id[13])
+	return time.UnixMilli(millis)
+}

pkg/probo/coredata/control_state_transition.go

@@ -92,6 +92,7 @@ func (cst *ControlStateTransitions) LoadByControlID(
 	q := `
 SELECT
     id,
+	tenant_id,
     control_id,
     from_state,
     to_state,

pkg/probo/coredata/entity_type_reg.go

@@ -15,7 +15,7 @@
 package coredata
 
 const (
-	OrganizationEntityType uint32 = iota
+	OrganizationEntityType uint16 = iota
 	FrameworkEntityType
 	ControlEntityType
 	TaskEntityType

pkg/probo/coredata/organization.go

@@ -27,11 +27,12 @@ import (
 
 type (
 	Organization struct {
-		ID        gid.GID   `db:"id"`
-		Name      string    `db:"name"`
-		LogoURL   string    `db:"logo_url"`
-		CreatedAt time.Time `db:"created_at"`
-		UpdatedAt time.Time `db:"updated_at"`
+		ID        gid.GID      `db:"id"`
+		TenantID  gid.TenantID `db:"tenant_id"`
+		Name      string       `db:"name"`
+		LogoURL   string       `db:"logo_url"`
+		CreatedAt time.Time    `db:"created_at"`
+		UpdatedAt time.Time    `db:"updated_at"`
 	}
 )
 
@@ -43,6 +44,7 @@ func (o *Organization) LoadByID(
 ) error {
 	q := `
 SELECT
+    tenant_id,
     id,
     name,
     logo_url,
@@ -92,7 +94,7 @@ INSERT INTO organizations (
 `
 
 	args := pgx.StrictNamedArgs{
-		"tenant_id":  o.ID, // We use the organization ID as tenant ID
+		"tenant_id":  o.TenantID,
 		"id":         o.ID,
 		"name":       o.Name,
 		"logo_url":   o.LogoURL,

pkg/probo/coredata/scope.go

@@ -15,6 +15,9 @@
 package coredata
 
 import (
+	"fmt"
+
+	"github.com/getprobo/probo/pkg/gid"
 	"github.com/jackc/pgx/v5"
 )
 
@@ -22,13 +25,13 @@ type (
 	Scoper interface {
 		SQLArguments() pgx.StrictNamedArgs
 		SQLFragment() string
-		GetTenantID() *string
+		GetTenantID() gid.TenantID
 	}
 
 	NoScope struct{}
 
 	Scope struct {
-		TenantID string
+		tenantID gid.TenantID
 	}
 )
 
@@ -49,19 +52,19 @@ func (*NoScope) SQLFragment() string {
 	return "TRUE"
 }
 
-func (*NoScope) GetTenantID() *string {
-	return nil
+func (*NoScope) GetTenantID() gid.TenantID {
+	panic(fmt.Errorf("cannot get tenant id from no scope"))
 }
 
-func NewScope(tenantID string) *Scope {
+func NewScope(tenantID gid.TenantID) *Scope {
 	return &Scope{
-		TenantID: tenantID,
+		tenantID: tenantID,
 	}
 }
 
 func (s *Scope) SQLArguments() pgx.StrictNamedArgs {
 	return pgx.StrictNamedArgs{
-		"tenant_id": s.TenantID,
+		"tenant_id": s.tenantID,
 	}
 }
 
@@ -69,6 +72,6 @@ func (*Scope) SQLFragment() string {
 	return "tenant_id = @tenant_id"
 }
 
-func (s *Scope) GetTenantID() *string {
-	return &s.TenantID
+func (s *Scope) GetTenantID() gid.TenantID {
+	return s.tenantID
 }

pkg/probo/coredata/task.go

@@ -69,7 +69,7 @@ WITH
              controls_tasks ct ON
                  ct.task_id = t.id
          WHERE
-             %s
+             t.tenant_id = @tenant_id
              AND id = @task_id
     ),
     task_states AS (
@@ -104,9 +104,7 @@ WHERE
 LIMIT 1;
 `
 
-	q = fmt.Sprintf(q, scope.SQLFragment())
-
-	args := pgx.StrictNamedArgs{"task_id": taskID}
+	args := pgx.StrictNamedArgs{"tenant_id": scope.GetTenantID(), "task_id": taskID}
 	maps.Copy(args, scope.SQLArguments())
 
 	rows, err := conn.Query(ctx, q, args)
@@ -153,11 +151,13 @@ WITH task_insert AS (
 )
 INSERT INTO controls_tasks (
    task_id,
+   tenant_id,
    control_id,
    created_at
 )
 VALUES (
    (SELECT id FROM task_insert),
+   @tenant_id,
    @control_id,
    @created_at
 );
@@ -202,7 +202,7 @@ WITH
                  ct.task_id = t.id
                  AND ct.control_id = @control_id
          WHERE
-             %s
+             t.tenant_id = @tenant_id
     ),
     task_states AS (
         SELECT
@@ -233,9 +233,9 @@ WHERE
     AND %s
 `
 
-	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+	q = fmt.Sprintf(q, cursor.SQLFragment())
 
-	args := pgx.StrictNamedArgs{"control_id": controlID}
+	args := pgx.StrictNamedArgs{"tenant_id": scope.GetTenantID(), "control_id": controlID}
 	maps.Copy(args, scope.SQLArguments())
 	maps.Copy(args, cursor.SQLArguments())
 

pkg/probo/create_control.go

@@ -40,11 +40,11 @@ func (s Service) CreateControl(
 	req CreateControlRequest,
 ) (*coredata.Control, error) {
 	now := time.Now()
-	controlID, err := gid.NewGID(coredata.ControlEntityType)
+	controlID, err := gid.NewGID(s.scope.GetTenantID(), coredata.ControlEntityType)
 	if err != nil {
 		return nil, fmt.Errorf("cannot create control global id: %w", err)
 	}
-	controlStateTransitionID, err := gid.NewGID(coredata.ControlStateTransitionEntityType)
+	controlStateTransitionID, err := gid.NewGID(s.scope.GetTenantID(), coredata.ControlStateTransitionEntityType)
 	if err != nil {
 		return nil, fmt.Errorf("cannot create control state transition global id: %w", err)
 	}

pkg/probo/create_evidence.go

@@ -44,11 +44,11 @@ func (s Service) CreateEvidence(
 	req CreateEvidenceRequest,
 ) (*coredata.Evidence, error) {
 	now := time.Now()
-	evidenceID, err := gid.NewGID(coredata.EvidenceEntityType)
+	evidenceID, err := gid.NewGID(s.scope.GetTenantID(), coredata.EvidenceEntityType)
 	if err != nil {
 		return nil, fmt.Errorf("cannot create evidence global id: %w", err)
 	}
-	evidenceStateTransitionID, err := gid.NewGID(coredata.EvidenceStateTransitionEntityType)
+	evidenceStateTransitionID, err := gid.NewGID(s.scope.GetTenantID(), coredata.EvidenceStateTransitionEntityType)
 	if err != nil {
 		return nil, fmt.Errorf("cannot create evidence state transition: %w", err)
 	}

pkg/probo/create_framework.go

@@ -38,7 +38,7 @@ func (s Service) CreateFramework(
 	req CreateFrameworkRequest,
 ) (*coredata.Framework, error) {
 	now := time.Now()
-	frameworkID, err := gid.NewGID(coredata.FrameworkEntityType)
+	frameworkID, err := gid.NewGID(s.scope.GetTenantID(), coredata.FrameworkEntityType)
 	if err != nil {
 		return nil, fmt.Errorf("cannot create global id: %w", err)
 	}

pkg/probo/create_organization.go

@@ -34,14 +34,17 @@ func (s Service) CreateOrganization(
 	ctx context.Context,
 	req CreateOrganizationRequest,
 ) (*coredata.Organization, error) {
+	tenantID := gid.NewTenantID()
+
 	now := time.Now()
-	organizationID, err := gid.NewGID(coredata.OrganizationEntityType)
+	organizationID, err := gid.NewGID(tenantID, coredata.OrganizationEntityType)
 	if err != nil {
 		return nil, fmt.Errorf("cannot create organization global id: %w", err)
 	}
 
 	organization := &coredata.Organization{
 		ID:        organizationID,
+		TenantID:  tenantID,
 		Name:      req.Name,
 		CreatedAt: now,
 		UpdatedAt: now,

pkg/probo/create_people.go

@@ -39,7 +39,7 @@ func (s Service) CreatePeople(
 	req CreatePeopleRequest,
 ) (*coredata.People, error) {
 	now := time.Now()
-	peopleID, err := gid.NewGID(coredata.PeopleEntityType)
+	peopleID, err := gid.NewGID(s.scope.GetTenantID(), coredata.PeopleEntityType)
 	if err != nil {
 		return nil, fmt.Errorf("cannot create people global id: %w", err)
 	}

pkg/probo/create_task.go

@@ -39,11 +39,11 @@ func (s Service) CreateTask(
 	req CreateTaskRequest,
 ) (*coredata.Task, error) {
 	now := time.Now()
-	taskID, err := gid.NewGID(coredata.TaskEntityType)
+	taskID, err := gid.NewGID(s.scope.GetTenantID(), coredata.TaskEntityType)
 	if err != nil {
 		return nil, fmt.Errorf("cannot create task global id: %w", err)
 	}
-	taskStateTransitionID, err := gid.NewGID(coredata.TaskStateTransitionEntityType)
+	taskStateTransitionID, err := gid.NewGID(s.scope.GetTenantID(), coredata.TaskStateTransitionEntityType)
 	if err != nil {
 		return nil, fmt.Errorf("cannot create task state transition global id: %w", err)
 	}

pkg/probo/create_vendor.go

@@ -44,7 +44,7 @@ func (s Service) CreateVendor(
 	req CreateVendorRequest,
 ) (*coredata.Vendor, error) {
 	now := time.Now()
-	vendorID, err := gid.NewGID(coredata.VendorEntityType)
+	vendorID, err := gid.NewGID(s.scope.GetTenantID(), coredata.VendorEntityType)
 	if err != nil {
 		return nil, fmt.Errorf("cannot create vendor global id: %w", err)
 	}

pkg/probo/policy_service.go

@@ -61,7 +61,7 @@ func (s *PolicyService) Create(
 	req CreatePolicyRequest,
 ) (*coredata.Policy, error) {
 	now := time.Now()
-	policyID, err := gid.NewGID(coredata.PolicyEntityType)
+	policyID, err := gid.NewGID(s.svc.scope.GetTenantID(), coredata.PolicyEntityType)
 	if err != nil {
 		return nil, fmt.Errorf("cannot create policy global id: %w", err)
 	}

pkg/probo/service.go

@@ -19,6 +19,7 @@ import (
 	"fmt"
 
 	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/getprobo/probo/pkg/gid"
 	"github.com/getprobo/probo/pkg/probo/coredata"
 	"go.gearno.de/kit/migrator"
 	"go.gearno.de/kit/pg"
@@ -62,7 +63,7 @@ func NewService(
 	return svc, nil
 }
 
-func (s *Service) WithTenant(tenantID string) *Service {
+func (s *Service) WithTenant(tenantID gid.TenantID) *Service {
 	newSvc := &Service{
 		pg:     s.pg,
 		s3:     s.s3,

pkg/probo/update_task_state.go

@@ -46,7 +46,7 @@ func (s Service) UpdateTaskState(
 		return task, nil
 	}
 
-	taskStateTransitionID, err := gid.NewGID(coredata.TaskStateTransitionEntityType)
+	taskStateTransitionID, err := gid.NewGID(s.scope.GetTenantID(), coredata.TaskStateTransitionEntityType)
 	if err != nil {
 		return nil, fmt.Errorf("cannot create task state transition global id: %w", err)
 	}

pkg/server/api/console/v1/schema/schema.go

@@ -4166,6 +4166,52 @@ func (ec *executionContext) field_User_organizations_argsBefore(
 	return zeroVal, nil
 }
 
+func (ec *executionContext) field___Directive_args_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := ec.field___Directive_args_argsIncludeDeprecated(ctx, rawArgs)
+	if err != nil {
+		return nil, err
+	}
+	args["includeDeprecated"] = arg0
+	return args, nil
+}
+func (ec *executionContext) field___Directive_args_argsIncludeDeprecated(
+	ctx context.Context,
+	rawArgs map[string]any,
+) (*bool, error) {
+	ctx = graphql.WithPathContext(ctx, graphql.NewPathWithField("includeDeprecated"))
+	if tmp, ok := rawArgs["includeDeprecated"]; ok {
+		return ec.unmarshalOBoolean2ᚖbool(ctx, tmp)
+	}
+
+	var zeroVal *bool
+	return zeroVal, nil
+}
+
+func (ec *executionContext) field___Field_args_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := ec.field___Field_args_argsIncludeDeprecated(ctx, rawArgs)
+	if err != nil {
+		return nil, err
+	}
+	args["includeDeprecated"] = arg0
+	return args, nil
+}
+func (ec *executionContext) field___Field_args_argsIncludeDeprecated(
+	ctx context.Context,
+	rawArgs map[string]any,
+) (*bool, error) {
+	ctx = graphql.WithPathContext(ctx, graphql.NewPathWithField("includeDeprecated"))
+	if tmp, ok := rawArgs["includeDeprecated"]; ok {
+		return ec.unmarshalOBoolean2ᚖbool(ctx, tmp)
+	}
+
+	var zeroVal *bool
+	return zeroVal, nil
+}
+
 func (ec *executionContext) field___Type_enumValues_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
 	var err error
 	args := map[string]any{}
@@ -9984,6 +10030,8 @@ func (ec *executionContext) fieldContext_Query___type(ctx context.Context, field
 				return ec.fieldContext___Type_name(ctx, field)
 			case "description":
 				return ec.fieldContext___Type_description(ctx, field)
+			case "specifiedByURL":
+				return ec.fieldContext___Type_specifiedByURL(ctx, field)
 			case "fields":
 				return ec.fieldContext___Type_fields(ctx, field)
 			case "interfaces":
@@ -9996,8 +10044,8 @@ func (ec *executionContext) fieldContext_Query___type(ctx context.Context, field
 				return ec.fieldContext___Type_inputFields(ctx, field)
 			case "ofType":
 				return ec.fieldContext___Type_ofType(ctx, field)
-			case "specifiedByURL":
-				return ec.fieldContext___Type_specifiedByURL(ctx, field)
+			case "isOneOf":
+				return ec.fieldContext___Type_isOneOf(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type __Type", field.Name)
 		},
@@ -12435,6 +12483,44 @@ func (ec *executionContext) fieldContext___Directive_description(_ context.Conte
 	return fc, nil
 }
 
+func (ec *executionContext) ___Directive_isRepeatable(ctx context.Context, field graphql.CollectedField, obj *introspection.Directive) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext___Directive_isRepeatable(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.IsRepeatable, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(bool)
+	fc.Result = res
+	return ec.marshalNBoolean2bool(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext___Directive_isRepeatable(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "__Directive",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Boolean does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) ___Directive_locations(ctx context.Context, field graphql.CollectedField, obj *introspection.Directive) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext___Directive_locations(ctx, field)
 	if err != nil {
@@ -12498,7 +12584,7 @@ func (ec *executionContext) ___Directive_args(ctx context.Context, field graphql
 	return ec.marshalN__InputValue2ᚕgithubᚗcomᚋ99designsᚋgqlgenᚋgraphqlᚋintrospectionᚐInputValueᚄ(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext___Directive_args(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext___Directive_args(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
 		Object:     "__Directive",
 		Field:      field,
@@ -12514,47 +12600,18 @@ func (ec *executionContext) fieldContext___Directive_args(_ context.Context, fie
 				return ec.fieldContext___InputValue_type(ctx, field)
 			case "defaultValue":
 				return ec.fieldContext___InputValue_defaultValue(ctx, field)
+			case "isDeprecated":
+				return ec.fieldContext___InputValue_isDeprecated(ctx, field)
+			case "deprecationReason":
+				return ec.fieldContext___InputValue_deprecationReason(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type __InputValue", field.Name)
 		},
 	}
-	return fc, nil
-}
-
-func (ec *executionContext) ___Directive_isRepeatable(ctx context.Context, field graphql.CollectedField, obj *introspection.Directive) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext___Directive_isRepeatable(ctx, field)
-	if err != nil {
-		return graphql.Null
-	}
 	ctx = graphql.WithFieldContext(ctx, fc)
-	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
-		ctx = rctx // use context from middleware stack in children
-		return obj.IsRepeatable, nil
-	})
-	if err != nil {
+	if fc.Args, err = ec.field___Directive_args_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
 		ec.Error(ctx, err)
-		return graphql.Null
-	}
-	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
-		return graphql.Null
-	}
-	res := resTmp.(bool)
-	fc.Result = res
-	return ec.marshalNBoolean2bool(ctx, field.Selections, res)
-}
-
-func (ec *executionContext) fieldContext___Directive_isRepeatable(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
-	fc = &graphql.FieldContext{
-		Object:     "__Directive",
-		Field:      field,
-		IsMethod:   false,
-		IsResolver: false,
-		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type Boolean does not have child fields")
-		},
+		return fc, err
 	}
 	return fc, nil
 }
@@ -12803,7 +12860,7 @@ func (ec *executionContext) ___Field_args(ctx context.Context, field graphql.Col
 	return ec.marshalN__InputValue2ᚕgithubᚗcomᚋ99designsᚋgqlgenᚋgraphqlᚋintrospectionᚐInputValueᚄ(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext___Field_args(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext___Field_args(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
 		Object:     "__Field",
 		Field:      field,
@@ -12819,10 +12876,19 @@ func (ec *executionContext) fieldContext___Field_args(_ context.Context, field g
 				return ec.fieldContext___InputValue_type(ctx, field)
 			case "defaultValue":
 				return ec.fieldContext___InputValue_defaultValue(ctx, field)
+			case "isDeprecated":
+				return ec.fieldContext___InputValue_isDeprecated(ctx, field)
+			case "deprecationReason":
+				return ec.fieldContext___InputValue_deprecationReason(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type __InputValue", field.Name)
 		},
 	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field___Field_args_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
 	return fc, nil
 }
 
@@ -12865,6 +12931,8 @@ func (ec *executionContext) fieldContext___Field_type(_ context.Context, field g
 				return ec.fieldContext___Type_name(ctx, field)
 			case "description":
 				return ec.fieldContext___Type_description(ctx, field)
+			case "specifiedByURL":
+				return ec.fieldContext___Type_specifiedByURL(ctx, field)
 			case "fields":
 				return ec.fieldContext___Type_fields(ctx, field)
 			case "interfaces":
@@ -12877,8 +12945,8 @@ func (ec *executionContext) fieldContext___Field_type(_ context.Context, field g
 				return ec.fieldContext___Type_inputFields(ctx, field)
 			case "ofType":
 				return ec.fieldContext___Type_ofType(ctx, field)
-			case "specifiedByURL":
-				return ec.fieldContext___Type_specifiedByURL(ctx, field)
+			case "isOneOf":
+				return ec.fieldContext___Type_isOneOf(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type __Type", field.Name)
 		},
@@ -13071,6 +13139,8 @@ func (ec *executionContext) fieldContext___InputValue_type(_ context.Context, fi
 				return ec.fieldContext___Type_name(ctx, field)
 			case "description":
 				return ec.fieldContext___Type_description(ctx, field)
+			case "specifiedByURL":
+				return ec.fieldContext___Type_specifiedByURL(ctx, field)
 			case "fields":
 				return ec.fieldContext___Type_fields(ctx, field)
 			case "interfaces":
@@ -13083,8 +13153,8 @@ func (ec *executionContext) fieldContext___InputValue_type(_ context.Context, fi
 				return ec.fieldContext___Type_inputFields(ctx, field)
 			case "ofType":
 				return ec.fieldContext___Type_ofType(ctx, field)
-			case "specifiedByURL":
-				return ec.fieldContext___Type_specifiedByURL(ctx, field)
+			case "isOneOf":
+				return ec.fieldContext___Type_isOneOf(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type __Type", field.Name)
 		},
@@ -13127,6 +13197,79 @@ func (ec *executionContext) fieldContext___InputValue_defaultValue(_ context.Con
 	return fc, nil
 }
 
+func (ec *executionContext) ___InputValue_isDeprecated(ctx context.Context, field graphql.CollectedField, obj *introspection.InputValue) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext___InputValue_isDeprecated(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.IsDeprecated(), nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(bool)
+	fc.Result = res
+	return ec.marshalNBoolean2bool(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext___InputValue_isDeprecated(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "__InputValue",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Boolean does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) ___InputValue_deprecationReason(ctx context.Context, field graphql.CollectedField, obj *introspection.InputValue) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext___InputValue_deprecationReason(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.DeprecationReason(), nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		return graphql.Null
+	}
+	res := resTmp.(*string)
+	fc.Result = res
+	return ec.marshalOString2ᚖstring(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext___InputValue_deprecationReason(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "__InputValue",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) ___Schema_description(ctx context.Context, field graphql.CollectedField, obj *introspection.Schema) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext___Schema_description(ctx, field)
 	if err != nil {
@@ -13201,6 +13344,8 @@ func (ec *executionContext) fieldContext___Schema_types(_ context.Context, field
 				return ec.fieldContext___Type_name(ctx, field)
 			case "description":
 				return ec.fieldContext___Type_description(ctx, field)
+			case "specifiedByURL":
+				return ec.fieldContext___Type_specifiedByURL(ctx, field)
 			case "fields":
 				return ec.fieldContext___Type_fields(ctx, field)
 			case "interfaces":
@@ -13213,8 +13358,8 @@ func (ec *executionContext) fieldContext___Schema_types(_ context.Context, field
 				return ec.fieldContext___Type_inputFields(ctx, field)
 			case "ofType":
 				return ec.fieldContext___Type_ofType(ctx, field)
-			case "specifiedByURL":
-				return ec.fieldContext___Type_specifiedByURL(ctx, field)
+			case "isOneOf":
+				return ec.fieldContext___Type_isOneOf(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type __Type", field.Name)
 		},
@@ -13261,6 +13406,8 @@ func (ec *executionContext) fieldContext___Schema_queryType(_ context.Context, f
 				return ec.fieldContext___Type_name(ctx, field)
 			case "description":
 				return ec.fieldContext___Type_description(ctx, field)
+			case "specifiedByURL":
+				return ec.fieldContext___Type_specifiedByURL(ctx, field)
 			case "fields":
 				return ec.fieldContext___Type_fields(ctx, field)
 			case "interfaces":
@@ -13273,8 +13420,8 @@ func (ec *executionContext) fieldContext___Schema_queryType(_ context.Context, f
 				return ec.fieldContext___Type_inputFields(ctx, field)
 			case "ofType":
 				return ec.fieldContext___Type_ofType(ctx, field)
-			case "specifiedByURL":
-				return ec.fieldContext___Type_specifiedByURL(ctx, field)
+			case "isOneOf":
+				return ec.fieldContext___Type_isOneOf(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type __Type", field.Name)
 		},
@@ -13318,6 +13465,8 @@ func (ec *executionContext) fieldContext___Schema_mutationType(_ context.Context
 				return ec.fieldContext___Type_name(ctx, field)
 			case "description":
 				return ec.fieldContext___Type_description(ctx, field)
+			case "specifiedByURL":
+				return ec.fieldContext___Type_specifiedByURL(ctx, field)
 			case "fields":
 				return ec.fieldContext___Type_fields(ctx, field)
 			case "interfaces":
@@ -13330,8 +13479,8 @@ func (ec *executionContext) fieldContext___Schema_mutationType(_ context.Context
 				return ec.fieldContext___Type_inputFields(ctx, field)
 			case "ofType":
 				return ec.fieldContext___Type_ofType(ctx, field)
-			case "specifiedByURL":
-				return ec.fieldContext___Type_specifiedByURL(ctx, field)
+			case "isOneOf":
+				return ec.fieldContext___Type_isOneOf(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type __Type", field.Name)
 		},
@@ -13375,6 +13524,8 @@ func (ec *executionContext) fieldContext___Schema_subscriptionType(_ context.Con
 				return ec.fieldContext___Type_name(ctx, field)
 			case "description":
 				return ec.fieldContext___Type_description(ctx, field)
+			case "specifiedByURL":
+				return ec.fieldContext___Type_specifiedByURL(ctx, field)
 			case "fields":
 				return ec.fieldContext___Type_fields(ctx, field)
 			case "interfaces":
@@ -13387,8 +13538,8 @@ func (ec *executionContext) fieldContext___Schema_subscriptionType(_ context.Con
 				return ec.fieldContext___Type_inputFields(ctx, field)
 			case "ofType":
 				return ec.fieldContext___Type_ofType(ctx, field)
-			case "specifiedByURL":
-				return ec.fieldContext___Type_specifiedByURL(ctx, field)
+			case "isOneOf":
+				return ec.fieldContext___Type_isOneOf(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type __Type", field.Name)
 		},
@@ -13433,12 +13584,12 @@ func (ec *executionContext) fieldContext___Schema_directives(_ context.Context,
 				return ec.fieldContext___Directive_name(ctx, field)
 			case "description":
 				return ec.fieldContext___Directive_description(ctx, field)
+			case "isRepeatable":
+				return ec.fieldContext___Directive_isRepeatable(ctx, field)
 			case "locations":
 				return ec.fieldContext___Directive_locations(ctx, field)
 			case "args":
 				return ec.fieldContext___Directive_args(ctx, field)
-			case "isRepeatable":
-				return ec.fieldContext___Directive_isRepeatable(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type __Directive", field.Name)
 		},
@@ -13554,6 +13705,41 @@ func (ec *executionContext) fieldContext___Type_description(_ context.Context, f
 	return fc, nil
 }
 
+func (ec *executionContext) ___Type_specifiedByURL(ctx context.Context, field graphql.CollectedField, obj *introspection.Type) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext___Type_specifiedByURL(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.SpecifiedByURL(), nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		return graphql.Null
+	}
+	res := resTmp.(*string)
+	fc.Result = res
+	return ec.marshalOString2ᚖstring(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext___Type_specifiedByURL(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "__Type",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) ___Type_fields(ctx context.Context, field graphql.CollectedField, obj *introspection.Type) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext___Type_fields(ctx, field)
 	if err != nil {
@@ -13644,6 +13830,8 @@ func (ec *executionContext) fieldContext___Type_interfaces(_ context.Context, fi
 				return ec.fieldContext___Type_name(ctx, field)
 			case "description":
 				return ec.fieldContext___Type_description(ctx, field)
+			case "specifiedByURL":
+				return ec.fieldContext___Type_specifiedByURL(ctx, field)
 			case "fields":
 				return ec.fieldContext___Type_fields(ctx, field)
 			case "interfaces":
@@ -13656,8 +13844,8 @@ func (ec *executionContext) fieldContext___Type_interfaces(_ context.Context, fi
 				return ec.fieldContext___Type_inputFields(ctx, field)
 			case "ofType":
 				return ec.fieldContext___Type_ofType(ctx, field)
-			case "specifiedByURL":
-				return ec.fieldContext___Type_specifiedByURL(ctx, field)
+			case "isOneOf":
+				return ec.fieldContext___Type_isOneOf(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type __Type", field.Name)
 		},
@@ -13701,6 +13889,8 @@ func (ec *executionContext) fieldContext___Type_possibleTypes(_ context.Context,
 				return ec.fieldContext___Type_name(ctx, field)
 			case "description":
 				return ec.fieldContext___Type_description(ctx, field)
+			case "specifiedByURL":
+				return ec.fieldContext___Type_specifiedByURL(ctx, field)
 			case "fields":
 				return ec.fieldContext___Type_fields(ctx, field)
 			case "interfaces":
@@ -13713,8 +13903,8 @@ func (ec *executionContext) fieldContext___Type_possibleTypes(_ context.Context,
 				return ec.fieldContext___Type_inputFields(ctx, field)
 			case "ofType":
 				return ec.fieldContext___Type_ofType(ctx, field)
-			case "specifiedByURL":
-				return ec.fieldContext___Type_specifiedByURL(ctx, field)
+			case "isOneOf":
+				return ec.fieldContext___Type_isOneOf(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type __Type", field.Name)
 		},
@@ -13810,6 +14000,10 @@ func (ec *executionContext) fieldContext___Type_inputFields(_ context.Context, f
 				return ec.fieldContext___InputValue_type(ctx, field)
 			case "defaultValue":
 				return ec.fieldContext___InputValue_defaultValue(ctx, field)
+			case "isDeprecated":
+				return ec.fieldContext___InputValue_isDeprecated(ctx, field)
+			case "deprecationReason":
+				return ec.fieldContext___InputValue_deprecationReason(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type __InputValue", field.Name)
 		},
@@ -13853,6 +14047,8 @@ func (ec *executionContext) fieldContext___Type_ofType(_ context.Context, field
 				return ec.fieldContext___Type_name(ctx, field)
 			case "description":
 				return ec.fieldContext___Type_description(ctx, field)
+			case "specifiedByURL":
+				return ec.fieldContext___Type_specifiedByURL(ctx, field)
 			case "fields":
 				return ec.fieldContext___Type_fields(ctx, field)
 			case "interfaces":
@@ -13865,8 +14061,8 @@ func (ec *executionContext) fieldContext___Type_ofType(_ context.Context, field
 				return ec.fieldContext___Type_inputFields(ctx, field)
 			case "ofType":
 				return ec.fieldContext___Type_ofType(ctx, field)
-			case "specifiedByURL":
-				return ec.fieldContext___Type_specifiedByURL(ctx, field)
+			case "isOneOf":
+				return ec.fieldContext___Type_isOneOf(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type __Type", field.Name)
 		},
@@ -13874,15 +14070,15 @@ func (ec *executionContext) fieldContext___Type_ofType(_ context.Context, field
 	return fc, nil
 }
 
-func (ec *executionContext) ___Type_specifiedByURL(ctx context.Context, field graphql.CollectedField, obj *introspection.Type) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext___Type_specifiedByURL(ctx, field)
+func (ec *executionContext) ___Type_isOneOf(ctx context.Context, field graphql.CollectedField, obj *introspection.Type) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext___Type_isOneOf(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
 	ctx = graphql.WithFieldContext(ctx, fc)
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.SpecifiedByURL(), nil
+		return obj.IsOneOf(), nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -13891,19 +14087,19 @@ func (ec *executionContext) ___Type_specifiedByURL(ctx context.Context, field gr
 	if resTmp == nil {
 		return graphql.Null
 	}
-	res := resTmp.(*string)
+	res := resTmp.(bool)
 	fc.Result = res
-	return ec.marshalOString2ᚖstring(ctx, field.Selections, res)
+	return ec.marshalOBoolean2bool(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext___Type_specifiedByURL(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext___Type_isOneOf(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
 		Object:     "__Type",
 		Field:      field,
 		IsMethod:   true,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
+			return nil, errors.New("field of type Boolean does not have child fields")
 		},
 	}
 	return fc, nil
@@ -18254,6 +18450,11 @@ func (ec *executionContext) ___Directive(ctx context.Context, sel ast.SelectionS
 			}
 		case "description":
 			out.Values[i] = ec.___Directive_description(ctx, field, obj)
+		case "isRepeatable":
+			out.Values[i] = ec.___Directive_isRepeatable(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
 		case "locations":
 			out.Values[i] = ec.___Directive_locations(ctx, field, obj)
 			if out.Values[i] == graphql.Null {
@@ -18264,11 +18465,6 @@ func (ec *executionContext) ___Directive(ctx context.Context, sel ast.SelectionS
 			if out.Values[i] == graphql.Null {
 				out.Invalids++
 			}
-		case "isRepeatable":
-			out.Values[i] = ec.___Directive_isRepeatable(ctx, field, obj)
-			if out.Values[i] == graphql.Null {
-				out.Invalids++
-			}
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
@@ -18423,6 +18619,13 @@ func (ec *executionContext) ___InputValue(ctx context.Context, sel ast.Selection
 			}
 		case "defaultValue":
 			out.Values[i] = ec.___InputValue_defaultValue(ctx, field, obj)
+		case "isDeprecated":
+			out.Values[i] = ec.___InputValue_isDeprecated(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "deprecationReason":
+			out.Values[i] = ec.___InputValue_deprecationReason(ctx, field, obj)
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
@@ -18521,6 +18724,8 @@ func (ec *executionContext) ___Type(ctx context.Context, sel ast.SelectionSet, o
 			out.Values[i] = ec.___Type_name(ctx, field, obj)
 		case "description":
 			out.Values[i] = ec.___Type_description(ctx, field, obj)
+		case "specifiedByURL":
+			out.Values[i] = ec.___Type_specifiedByURL(ctx, field, obj)
 		case "fields":
 			out.Values[i] = ec.___Type_fields(ctx, field, obj)
 		case "interfaces":
@@ -18533,8 +18738,8 @@ func (ec *executionContext) ___Type(ctx context.Context, sel ast.SelectionSet, o
 			out.Values[i] = ec.___Type_inputFields(ctx, field, obj)
 		case "ofType":
 			out.Values[i] = ec.___Type_ofType(ctx, field, obj)
-		case "specifiedByURL":
-			out.Values[i] = ec.___Type_specifiedByURL(ctx, field, obj)
+		case "isOneOf":
+			out.Values[i] = ec.___Type_isOneOf(ctx, field, obj)
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}

pkg/server/api/console/v1/v1_resolver.go

@@ -2,7 +2,7 @@ package console_v1
 
 // This file will be automatically regenerated based on the schema, any resolver implementations
 // will be copied through when generating and any unknown code will be moved to the end.
-// Code generated by github.com/99designs/gqlgen version v0.17.63
+// Code generated by github.com/99designs/gqlgen version v0.17.66
 
 import (
 	"context"
@@ -20,9 +20,10 @@ import (
 
 // StateTransisions is the resolver for the stateTransisions field.
 func (r *controlResolver) StateTransisions(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.ControlStateTransitionConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
 	cursor := types.NewCursor(first, after, last, before)
 
-	page, err := r.proboSvc.ListControlStateTransitions(ctx, obj.ID, cursor)
+	page, err := svc.ListControlStateTransitions(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list control tasks: %w", err)
 	}
@@ -32,9 +33,10 @@ func (r *controlResolver) StateTransisions(ctx context.Context, obj *types.Contr
 
 // Tasks is the resolver for the tasks field.
 func (r *controlResolver) Tasks(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.TaskConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
 	cursor := types.NewCursor(first, after, last, before)
 
-	page, err := r.proboSvc.ListControlTasks(ctx, obj.ID, cursor)
+	page, err := svc.ListControlTasks(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list control tasks: %w", err)
 	}
@@ -44,7 +46,9 @@ func (r *controlResolver) Tasks(ctx context.Context, obj *types.Control, first *
 
 // FileURL is the resolver for the fileUrl field.
 func (r *evidenceResolver) FileURL(ctx context.Context, obj *types.Evidence) (string, error) {
-	fileURL, err := r.proboSvc.GetEvidenceFileURL(ctx, obj.ID, 15*time.Minute)
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
+
+	fileURL, err := svc.GetEvidenceFileURL(ctx, obj.ID, 15*time.Minute)
 	if err != nil {
 		return "", fmt.Errorf("cannot generate file URL: %w", err)
 	}
@@ -54,9 +58,10 @@ func (r *evidenceResolver) FileURL(ctx context.Context, obj *types.Evidence) (st
 
 // StateTransisions is the resolver for the stateTransisions field.
 func (r *evidenceResolver) StateTransisions(ctx context.Context, obj *types.Evidence, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.EvidenceStateTransitionConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
 	cursor := types.NewCursor(first, after, last, before)
 
-	page, err := r.proboSvc.ListEvidenceStateTransitions(ctx, obj.ID, cursor)
+	page, err := svc.ListEvidenceStateTransitions(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list evidence state transitions: %w", err)
 	}
@@ -66,9 +71,10 @@ func (r *evidenceResolver) StateTransisions(ctx context.Context, obj *types.Evid
 
 // Controls is the resolver for the controls field.
 func (r *frameworkResolver) Controls(ctx context.Context, obj *types.Framework, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.ControlConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
 	cursor := types.NewCursor(first, after, last, before)
 
-	page, err := r.proboSvc.ListFrameworkControls(ctx, obj.ID, cursor)
+	page, err := svc.ListFrameworkControls(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list framework controls: %w", err)
 	}
@@ -78,7 +84,9 @@ func (r *frameworkResolver) Controls(ctx context.Context, obj *types.Framework,
 
 // CreateVendor is the resolver for the createVendor field.
 func (r *mutationResolver) CreateVendor(ctx context.Context, input types.CreateVendorInput) (*types.CreateVendorPayload, error) {
-	vendor, err := r.proboSvc.CreateVendor(ctx, probo.CreateVendorRequest{
+	svc := r.proboSvc.WithTenant(input.OrganizationID.TenantID())
+
+	vendor, err := svc.CreateVendor(ctx, probo.CreateVendorRequest{
 		OrganizationID:       input.OrganizationID,
 		Name:                 input.Name,
 		Description:          input.Description,
@@ -100,7 +108,9 @@ func (r *mutationResolver) CreateVendor(ctx context.Context, input types.CreateV
 
 // UpdateVendor is the resolver for the updateVendor field.
 func (r *mutationResolver) UpdateVendor(ctx context.Context, input types.UpdateVendorInput) (*types.UpdateVendorPayload, error) {
-	vendor, err := r.proboSvc.UpdateVendor(ctx, probo.UpdateVendorRequest{
+	svc := r.proboSvc.WithTenant(input.ID.TenantID())
+
+	vendor, err := svc.UpdateVendor(ctx, probo.UpdateVendorRequest{
 		ID:                   input.ID,
 		ExpectedVersion:      input.ExpectedVersion,
 		Name:                 input.Name,
@@ -124,7 +134,9 @@ func (r *mutationResolver) UpdateVendor(ctx context.Context, input types.UpdateV
 
 // DeleteVendor is the resolver for the deleteVendor field.
 func (r *mutationResolver) DeleteVendor(ctx context.Context, input types.DeleteVendorInput) (*types.DeleteVendorPayload, error) {
-	err := r.proboSvc.DeleteVendor(ctx, input.VendorID)
+	svc := r.proboSvc.WithTenant(input.VendorID.TenantID())
+
+	err := svc.DeleteVendor(ctx, input.VendorID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot delete vendor: %w", err)
 	}
@@ -136,7 +148,9 @@ func (r *mutationResolver) DeleteVendor(ctx context.Context, input types.DeleteV
 
 // CreatePeople is the resolver for the createPeople field.
 func (r *mutationResolver) CreatePeople(ctx context.Context, input types.CreatePeopleInput) (*types.CreatePeoplePayload, error) {
-	people, err := r.proboSvc.CreatePeople(ctx, probo.CreatePeopleRequest{
+	svc := r.proboSvc.WithTenant(input.OrganizationID.TenantID())
+
+	people, err := svc.CreatePeople(ctx, probo.CreatePeopleRequest{
 		OrganizationID:           input.OrganizationID,
 		FullName:                 input.FullName,
 		PrimaryEmailAddress:      input.PrimaryEmailAddress,
@@ -155,7 +169,9 @@ func (r *mutationResolver) CreatePeople(ctx context.Context, input types.CreateP
 
 // UpdatePeople is the resolver for the updatePeople field.
 func (r *mutationResolver) UpdatePeople(ctx context.Context, input types.UpdatePeopleInput) (*types.UpdatePeoplePayload, error) {
-	people, err := r.proboSvc.UpdatePeople(ctx, probo.UpdatePeopleRequest{
+	svc := r.proboSvc.WithTenant(input.ID.TenantID())
+
+	people, err := svc.UpdatePeople(ctx, probo.UpdatePeopleRequest{
 		ID:                       input.ID,
 		ExpectedVersion:          input.ExpectedVersion,
 		FullName:                 input.FullName,
@@ -174,7 +190,9 @@ func (r *mutationResolver) UpdatePeople(ctx context.Context, input types.UpdateP
 
 // DeletePeople is the resolver for the deletePeople field.
 func (r *mutationResolver) DeletePeople(ctx context.Context, input types.DeletePeopleInput) (*types.DeletePeoplePayload, error) {
-	err := r.proboSvc.DeletePeople(ctx, input.PeopleID)
+	svc := r.proboSvc.WithTenant(input.PeopleID.TenantID())
+
+	err := svc.DeletePeople(ctx, input.PeopleID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot delete people: %w", err)
 	}
@@ -210,7 +228,9 @@ func (r *mutationResolver) DeleteOrganization(ctx context.Context, input types.D
 
 // UpdateTaskState is the resolver for the updateTaskState field.
 func (r *mutationResolver) UpdateTaskState(ctx context.Context, input types.UpdateTaskStateInput) (*types.UpdateTaskStatePayload, error) {
-	task, err := r.proboSvc.UpdateTaskState(ctx, probo.UpdateTaskStateRequest{
+	svc := r.proboSvc.WithTenant(input.TaskID.TenantID())
+
+	task, err := svc.UpdateTaskState(ctx, probo.UpdateTaskStateRequest{
 		TaskID: input.TaskID,
 		State:  input.State,
 		Reason: nil,
@@ -226,7 +246,9 @@ func (r *mutationResolver) UpdateTaskState(ctx context.Context, input types.Upda
 
 // CreateTask is the resolver for the createTask field.
 func (r *mutationResolver) CreateTask(ctx context.Context, input types.CreateTaskInput) (*types.CreateTaskPayload, error) {
-	task, err := r.proboSvc.CreateTask(ctx, probo.CreateTaskRequest{
+	svc := r.proboSvc.WithTenant(input.ControlID.TenantID())
+
+	task, err := svc.CreateTask(ctx, probo.CreateTaskRequest{
 		ControlID:   input.ControlID,
 		Name:        input.Name,
 		Description: input.Description,
@@ -242,7 +264,9 @@ func (r *mutationResolver) CreateTask(ctx context.Context, input types.CreateTas
 
 // DeleteTask is the resolver for the deleteTask field.
 func (r *mutationResolver) DeleteTask(ctx context.Context, input types.DeleteTaskInput) (*types.DeleteTaskPayload, error) {
-	err := r.proboSvc.DeleteTask(ctx, input.TaskID)
+	svc := r.proboSvc.WithTenant(input.TaskID.TenantID())
+
+	err := svc.DeleteTask(ctx, input.TaskID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot delete task: %w", err)
 	}
@@ -254,7 +278,9 @@ func (r *mutationResolver) DeleteTask(ctx context.Context, input types.DeleteTas
 
 // CreateFramework is the resolver for the createFramework field.
 func (r *mutationResolver) CreateFramework(ctx context.Context, input types.CreateFrameworkInput) (*types.CreateFrameworkPayload, error) {
-	framework, err := r.proboSvc.CreateFramework(ctx, probo.CreateFrameworkRequest{
+	svc := r.proboSvc.WithTenant(input.OrganizationID.TenantID())
+
+	framework, err := svc.CreateFramework(ctx, probo.CreateFrameworkRequest{
 		OrganizationID: input.OrganizationID,
 		Name:           input.Name,
 		Description:    input.Description,
@@ -270,7 +296,9 @@ func (r *mutationResolver) CreateFramework(ctx context.Context, input types.Crea
 
 // CreateControl is the resolver for the createControl field.
 func (r *mutationResolver) CreateControl(ctx context.Context, input types.CreateControlInput) (*types.CreateControlPayload, error) {
-	control, err := r.proboSvc.CreateControl(ctx, probo.CreateControlRequest{
+	svc := r.proboSvc.WithTenant(input.FrameworkID.TenantID())
+
+	control, err := svc.CreateControl(ctx, probo.CreateControlRequest{
 		FrameworkID: input.FrameworkID,
 		Name:        input.Name,
 		Description: input.Description,
@@ -287,19 +315,13 @@ func (r *mutationResolver) CreateControl(ctx context.Context, input types.Create
 
 // UpdateFramework is the resolver for the updateFramework field.
 func (r *mutationResolver) UpdateFramework(ctx context.Context, input types.UpdateFrameworkInput) (*types.UpdateFrameworkPayload, error) {
-	var name, description *string
-	if input.Name != nil {
-		name = input.Name
-	}
-	if input.Description != nil {
-		description = input.Description
-	}
+	svc := r.proboSvc.WithTenant(input.ID.TenantID())
 
-	framework, err := r.proboSvc.UpdateFramework(ctx, probo.UpdateFrameworkRequest{
+	framework, err := svc.UpdateFramework(ctx, probo.UpdateFrameworkRequest{
 		ID:              input.ID,
 		ExpectedVersion: input.ExpectedVersion,
-		Name:            name,
-		Description:     description,
+		Name:            input.Name,
+		Description:     input.Description,
 	})
 	if err != nil {
 		return nil, fmt.Errorf("cannot update framework: %w", err)
@@ -312,29 +334,15 @@ func (r *mutationResolver) UpdateFramework(ctx context.Context, input types.Upda
 
 // UpdateControl is the resolver for the updateControl field.
 func (r *mutationResolver) UpdateControl(ctx context.Context, input types.UpdateControlInput) (*types.UpdateControlPayload, error) {
-	var name, description, category *string
-	var state *coredata.ControlState
+	svc := r.proboSvc.WithTenant(input.ID.TenantID())
 
-	if input.Name != nil {
-		name = input.Name
-	}
-	if input.Description != nil {
-		description = input.Description
-	}
-	if input.Category != nil {
-		category = input.Category
-	}
-	if input.State != nil {
-		state = input.State
-	}
-
-	control, err := r.proboSvc.UpdateControl(ctx, probo.UpdateControlRequest{
+	control, err := svc.UpdateControl(ctx, probo.UpdateControlRequest{
 		ID:              input.ID,
 		ExpectedVersion: input.ExpectedVersion,
-		Name:            name,
-		Description:     description,
-		Category:        category,
-		State:           state,
+		Name:            input.Name,
+		Description:     input.Description,
+		Category:        input.Category,
+		State:           input.State,
 	})
 	if err != nil {
 		return nil, fmt.Errorf("cannot update control: %w", err)
@@ -347,13 +355,15 @@ func (r *mutationResolver) UpdateControl(ctx context.Context, input types.Update
 
 // UploadEvidence is the resolver for the uploadEvidence field.
 func (r *mutationResolver) UploadEvidence(ctx context.Context, input types.UploadEvidenceInput) (*types.UploadEvidencePayload, error) {
+	svc := r.proboSvc.WithTenant(input.TaskID.TenantID())
+
 	req := probo.CreateEvidenceRequest{
 		TaskID: input.TaskID,
 		Name:   input.Name,
 		File:   input.File.File,
 	}
 
-	evidence, err := r.proboSvc.CreateEvidence(ctx, req)
+	evidence, err := svc.CreateEvidence(ctx, req)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create evidence: %w", err)
 	}
@@ -365,7 +375,9 @@ func (r *mutationResolver) UploadEvidence(ctx context.Context, input types.Uploa
 
 // DeleteEvidence is the resolver for the deleteEvidence field.
 func (r *mutationResolver) DeleteEvidence(ctx context.Context, input types.DeleteEvidenceInput) (*types.DeleteEvidencePayload, error) {
-	err := r.proboSvc.DeleteEvidence(ctx, input.EvidenceID)
+	svc := r.proboSvc.WithTenant(input.EvidenceID.TenantID())
+
+	err := svc.DeleteEvidence(ctx, input.EvidenceID)
 	if err != nil {
 		return nil, fmt.Errorf("failed to delete evidence: %w", err)
 	}
@@ -377,7 +389,9 @@ func (r *mutationResolver) DeleteEvidence(ctx context.Context, input types.Delet
 
 // CreatePolicy is the resolver for the createPolicy field.
 func (r *mutationResolver) CreatePolicy(ctx context.Context, input types.CreatePolicyInput) (*types.CreatePolicyPayload, error) {
-	policy, err := r.proboSvc.Policies.Create(ctx, probo.CreatePolicyRequest{
+	svc := r.proboSvc.WithTenant(input.OrganizationID.TenantID())
+
+	policy, err := svc.Policies.Create(ctx, probo.CreatePolicyRequest{
 		OrganizationID: input.OrganizationID,
 		Name:           input.Name,
 		Content:        input.Content,
@@ -396,7 +410,9 @@ func (r *mutationResolver) CreatePolicy(ctx context.Context, input types.CreateP
 
 // UpdatePolicy is the resolver for the updatePolicy field.
 func (r *mutationResolver) UpdatePolicy(ctx context.Context, input types.UpdatePolicyInput) (*types.UpdatePolicyPayload, error) {
-	policy, err := r.proboSvc.Policies.Update(ctx, probo.UpdatePolicyRequest{
+	svc := r.proboSvc.WithTenant(input.ID.TenantID())
+
+	policy, err := svc.Policies.Update(ctx, probo.UpdatePolicyRequest{
 		ID:              input.ID,
 		ExpectedVersion: input.ExpectedVersion,
 		Name:            input.Name,
@@ -416,7 +432,9 @@ func (r *mutationResolver) UpdatePolicy(ctx context.Context, input types.UpdateP
 
 // DeletePolicy is the resolver for the deletePolicy field.
 func (r *mutationResolver) DeletePolicy(ctx context.Context, input types.DeletePolicyInput) (*types.DeletePolicyPayload, error) {
-	err := r.proboSvc.Policies.Delete(ctx, input.PolicyID)
+	svc := r.proboSvc.WithTenant(input.PolicyID.TenantID())
+
+	err := svc.Policies.Delete(ctx, input.PolicyID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot delete policy: %w", err)
 	}
@@ -428,9 +446,11 @@ func (r *mutationResolver) DeletePolicy(ctx context.Context, input types.DeleteP
 
 // Frameworks is the resolver for the frameworks field.
 func (r *organizationResolver) Frameworks(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.FrameworkConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
+
 	cursor := types.NewCursor(first, after, last, before)
 
-	page, err := r.proboSvc.ListOrganizationFrameworks(ctx, obj.ID, cursor)
+	page, err := svc.ListOrganizationFrameworks(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list organization frameworks: %w", err)
 	}
@@ -440,9 +460,11 @@ func (r *organizationResolver) Frameworks(ctx context.Context, obj *types.Organi
 
 // Vendors is the resolver for the vendors field.
 func (r *organizationResolver) Vendors(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.VendorConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
+
 	cursor := types.NewCursor(first, after, last, before)
 
-	page, err := r.proboSvc.ListOrganizationVendors(ctx, obj.ID, cursor)
+	page, err := svc.ListOrganizationVendors(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list organization vendors: %w", err)
 	}
@@ -452,9 +474,11 @@ func (r *organizationResolver) Vendors(ctx context.Context, obj *types.Organizat
 
 // Peoples is the resolver for the peoples field.
 func (r *organizationResolver) Peoples(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.PeopleConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
+
 	cursor := types.NewCursor(first, after, last, before)
 
-	page, err := r.proboSvc.ListOrganizationPeoples(ctx, obj.ID, cursor)
+	page, err := svc.ListOrganizationPeoples(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list organization peoples: %w", err)
 	}
@@ -464,9 +488,10 @@ func (r *organizationResolver) Peoples(ctx context.Context, obj *types.Organizat
 
 // Policies is the resolver for the policies field.
 func (r *organizationResolver) Policies(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.PolicyConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
 	cursor := types.NewCursor(first, after, last, before)
 
-	page, err := r.proboSvc.Policies.ListByOrganization(ctx, obj.ID, cursor)
+	page, err := svc.Policies.ListByOrganization(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list organization policies: %w", err)
 	}
@@ -476,13 +501,15 @@ func (r *organizationResolver) Policies(ctx context.Context, obj *types.Organiza
 
 // Owner is the resolver for the owner field.
 func (r *policyResolver) Owner(ctx context.Context, obj *types.Policy) (*types.People, error) {
-	policy, err := r.proboSvc.Policies.Get(ctx, obj.ID)
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
+
+	policy, err := svc.Policies.Get(ctx, obj.ID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot get policy: %w", err)
 	}
 
 	// Get the owner
-	owner, err := r.proboSvc.GetPeople(ctx, policy.OwnerID)
+	owner, err := svc.GetPeople(ctx, policy.OwnerID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot get owner: %w", err)
 	}
@@ -492,58 +519,60 @@ func (r *policyResolver) Owner(ctx context.Context, obj *types.Policy) (*types.P
 
 // Node is the resolver for the node field.
 func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error) {
+	svc := r.proboSvc.WithTenant(id.TenantID())
+
 	switch id.EntityType() {
 	case coredata.OrganizationEntityType:
-		organization, err := r.proboSvc.GetOrganization(ctx, id)
+		organization, err := svc.GetOrganization(ctx, id)
 		if err != nil {
 			return nil, err
 		}
 
 		return types.NewOrganization(organization), nil
 	case coredata.PeopleEntityType:
-		people, err := r.proboSvc.GetPeople(ctx, id)
+		people, err := svc.GetPeople(ctx, id)
 		if err != nil {
 			return nil, err
 		}
 
 		return types.NewPeople(people), nil
 	case coredata.VendorEntityType:
-		vendor, err := r.proboSvc.GetVendor(ctx, id)
+		vendor, err := svc.GetVendor(ctx, id)
 		if err != nil {
 			return nil, err
 		}
 
 		return types.NewVendor(vendor), nil
 	case coredata.FrameworkEntityType:
-		framework, err := r.proboSvc.GetFramework(ctx, id)
+		framework, err := svc.GetFramework(ctx, id)
 		if err != nil {
 			return nil, err
 		}
 
 		return types.NewFramework(framework), nil
 	case coredata.ControlEntityType:
-		control, err := r.proboSvc.GetControl(ctx, id)
+		control, err := svc.GetControl(ctx, id)
 		if err != nil {
 			return nil, err
 		}
 
 		return types.NewControl(control), nil
 	case coredata.TaskEntityType:
-		task, err := r.proboSvc.GetTask(ctx, id)
+		task, err := svc.GetTask(ctx, id)
 		if err != nil {
 			return nil, err
 		}
 
 		return types.NewTask(task), nil
 	case coredata.EvidenceEntityType:
-		evidence, err := r.proboSvc.GetEvidence(ctx, id)
+		evidence, err := svc.GetEvidence(ctx, id)
 		if err != nil {
 			return nil, err
 		}
 
 		return types.NewEvidence(evidence), nil
 	case coredata.PolicyEntityType:
-		policy, err := r.proboSvc.Policies.Get(ctx, id)
+		policy, err := svc.Policies.Get(ctx, id)
 		if err != nil {
 			return nil, err
 		}
@@ -562,9 +591,10 @@ func (r *queryResolver) Viewer(ctx context.Context) (*types.User, error) {
 
 // StateTransisions is the resolver for the stateTransisions field.
 func (r *taskResolver) StateTransisions(ctx context.Context, obj *types.Task, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.TaskStateTransitionConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
 	cursor := types.NewCursor(first, after, last, before)
 
-	page, err := r.proboSvc.ListTaskStateTransitions(ctx, obj.ID, cursor)
+	page, err := svc.ListTaskStateTransitions(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list control tasks: %w", err)
 	}
@@ -574,9 +604,10 @@ func (r *taskResolver) StateTransisions(ctx context.Context, obj *types.Task, fi
 
 // Evidences is the resolver for the evidences field.
 func (r *taskResolver) Evidences(ctx context.Context, obj *types.Task, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.EvidenceConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
 	cursor := types.NewCursor(first, after, last, before)
 
-	page, err := r.proboSvc.ListTaskEvidences(ctx, obj.ID, cursor)
+	page, err := svc.ListTaskEvidences(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list organization frameworks: %w", err)
 	}

pkg/usrmgr/coredata/migrations/20150310T133000Z.sql

@@ -0,0 +1 @@
+ALTER TABLE usrmgr_users DROP COLUMN organization_id;

pkg/usrmgr/coredata/user.go

@@ -31,7 +31,6 @@ type (
 		EmailAddress   string    `db:"email_address"`
 		HashedPassword []byte    `db:"hashed_password"`
 		FullName       string    `db:"fullname"`
-		OrganizationID gid.GID   `db:"organization_id"`
 		CreatedAt      time.Time `db:"created_at"`
 		UpdatedAt      time.Time `db:"updated_at"`
 	}
@@ -52,7 +51,6 @@ SELECT
     email_address,
     hashed_password,
     fullname,
-    organization_id,
     created_at,
     updated_at
 FROM
@@ -90,7 +88,6 @@ SELECT
     email_address,
     hashed_password,
     fullname,
-    organization_id,
     created_at,
     updated_at
 FROM
@@ -123,13 +120,12 @@ func (u *User) Insert(
 ) error {
 	q := `
 INSERT INTO
-    usrmgr_users (id, email_address, hashed_password, fullname, organization_id, created_at, updated_at)
+    usrmgr_users (id, email_address, hashed_password, fullname, created_at, updated_at)
 VALUES (
     @user_id,
     @email_address,
     @hashed_password,
     @fullname,
-    @organization_id,
     @created_at,
     @updated_at
 )
@@ -140,7 +136,6 @@ VALUES (
 		"email_address":   u.EmailAddress,
 		"hashed_password": u.HashedPassword,
 		"fullname":        u.FullName,
-		"organization_id": "AZSfP_xAcAC5IAAAAAAltA",
 		"created_at":      u.CreatedAt,
 		"updated_at":      u.UpdatedAt,
 	}

pkg/usrmgr/usrmgr.go

@@ -109,7 +109,7 @@ func (s Service) RegisterUser(
 
 	now := time.Now()
 	user := &coredata.User{
-		ID:             gid.New(),
+		ID:             gid.New(gid.NilTenant, 0),
 		EmailAddress:   params.Email,
 		HashedPassword: hashedPassword,
 		FullName:       params.FullName,
@@ -151,8 +151,8 @@ func (s Service) Login(
 	now := time.Now()
 	user := &coredata.User{}
 	session := &coredata.Session{
-		ID:        gid.New(),
-		UserID:    gid.GID{}, // Will be set after user is loaded
+		ID:        gid.New(gid.NilTenant, 0),
+		UserID:    gid.Nil,
 		ExpiredAt: now.Add(24 * time.Hour),
 		CreatedAt: now,
 		UpdatedAt: now,
@@ -310,19 +310,6 @@ func (s Service) GetUserBySession(
 	return s.GetUserByID(ctx, session.UserID)
 }
 
-// GetUserOrganization gets the organization ID for a user
-func (s Service) GetUserOrganization(
-	ctx context.Context,
-	userID gid.GID,
-) (gid.GID, error) {
-	user, err := s.GetUserByID(ctx, userID)
-	if err != nil {
-		return gid.GID{}, err
-	}
-
-	return user.OrganizationID, nil
-}
-
 // GetUserOrganizations gets all organizations for a user
 func (s Service) GetUserOrganizations(
 	ctx context.Context,