Consolidate hub type definitions into their own files

Move Organization, Identity, TrustCenter, and Viewer definitions to
include all their connection fields directly, removing all extend type
blocks for these hub types from entity files.

This eliminates the Relay schemaExtensions constraint where extend type
could only target types defined in the main schema file. Entity files
now only define their own standalone types and extend type Mutation.

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/server/api/connect/v1/audit_log.resolvers.go

@@ -10,12 +10,9 @@ import (
 
 	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/coredata"
-	"go.probo.inc/probo/pkg/iam"
-	"go.probo.inc/probo/pkg/page"
 	"go.probo.inc/probo/pkg/server/api/connect/v1/schema"
 	"go.probo.inc/probo/pkg/server/api/connect/v1/types"
 	"go.probo.inc/probo/pkg/server/gqlutils"
-	"go.probo.inc/probo/pkg/server/gqlutils/types/cursor"
 )
 
 // Organization is the resolver for the organization field.
@@ -44,50 +41,6 @@ func (r *auditLogEntryConnectionResolver) TotalCount(ctx context.Context, obj *t
 	return count, nil
 }
 
-// AuditLogEntries is the resolver for the auditLogEntries field.
-func (r *organizationResolver) AuditLogEntries(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AuditLogEntryOrderBy, filter *types.AuditLogEntryFilter) (*types.AuditLogEntryConnection, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionAuditLogEntryList); err != nil {
-		return nil, err
-	}
-
-	pageOrderBy := page.OrderBy[coredata.AuditLogEntryOrderField]{
-		Field:     coredata.AuditLogEntryOrderFieldCreatedAt,
-		Direction: page.OrderDirectionDesc,
-	}
-	if orderBy != nil {
-		pageOrderBy = page.OrderBy[coredata.AuditLogEntryOrderField]{
-			Field:     orderBy.Field,
-			Direction: orderBy.Direction,
-		}
-	}
-
-	c := cursor.NewCursor(first, after, last, before, pageOrderBy)
-
-	coredataFilter := coredata.NewAuditLogEntryFilter()
-	if filter != nil {
-		if filter.Action != nil {
-			coredataFilter.WithAction(*filter.Action)
-		}
-		if filter.ActorID != nil {
-			coredataFilter.WithActorID(*filter.ActorID)
-		}
-		if filter.ResourceType != nil {
-			coredataFilter.WithResourceType(*filter.ResourceType)
-		}
-		if filter.ResourceID != nil {
-			coredataFilter.WithResourceID(*filter.ResourceID)
-		}
-	}
-
-	p, err := r.iam.OrganizationService.ListAuditLogEntries(ctx, obj.ID, c, coredataFilter)
-	if err != nil {
-		r.logger.ErrorCtx(ctx, "cannot list audit log entries", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	return types.NewAuditLogEntryConnection(p, r, obj.ID, coredataFilter), nil
-}
-
 // AuditLogEntry returns schema.AuditLogEntryResolver implementation.
 func (r *Resolver) AuditLogEntry() schema.AuditLogEntryResolver { return &auditLogEntryResolver{r} }
 

pkg/server/api/connect/v1/base.resolvers.go

@@ -10,7 +10,6 @@ import (
 	"errors"
 	"fmt"
 	"strings"
-	"time"
 
 	"github.com/99designs/gqlgen/graphql"
 	"github.com/vektah/gqlparser/v2/gqlerror"
@@ -19,13 +18,123 @@ import (
 	"go.probo.inc/probo/pkg/gid"
 	"go.probo.inc/probo/pkg/iam"
 	"go.probo.inc/probo/pkg/mail"
+	"go.probo.inc/probo/pkg/page"
 	"go.probo.inc/probo/pkg/server/api/authn"
 	"go.probo.inc/probo/pkg/server/api/authz"
 	"go.probo.inc/probo/pkg/server/api/connect/v1/schema"
 	"go.probo.inc/probo/pkg/server/api/connect/v1/types"
 	"go.probo.inc/probo/pkg/server/gqlutils"
+	"go.probo.inc/probo/pkg/server/gqlutils/types/cursor"
 )
 
+// Profiles is the resolver for the profiles field.
+func (r *identityResolver) Profiles(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ProfileOrderBy, filter *types.ProfileFilter) (*types.ProfileConnection, error) {
+	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileList, authz.WithSkipAssumptionCheck()); err != nil {
+		return nil, err
+	}
+
+	filters := coredata.NewMembershipProfileFilter(nil).WithMembership()
+	if filter != nil {
+		filters = coredata.NewMembershipProfileFilter(filter.ExcludeContractEnded).WithMembership()
+		if filter.State != nil {
+			filters.WithState(*filter.State)
+		}
+	}
+
+	if gqlutils.OnlyTotalCountSelected(ctx) {
+		return &types.ProfileConnection{
+			Resolver: r,
+			ParentID: obj.ID,
+			Filters:  filters,
+		}, nil
+	}
+
+	pageOrderBy := page.OrderBy[coredata.MembershipProfileOrderField]{
+		Field:     coredata.MembershipProfileOrderFieldFullName,
+		Direction: page.OrderDirectionAsc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.MembershipProfileOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := cursor.NewCursor(first, after, last, before, pageOrderBy)
+
+	page, err := r.iam.AccountService.ListProfilesForIdentity(ctx, obj.ID, cursor, filters)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot list profiles", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewProfileConnection(page, r, obj.ID, filters), nil
+}
+
+// Sessions is the resolver for the sessions field.
+func (r *identityResolver) Sessions(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.SessionOrder) (*types.SessionConnection, error) {
+	if err := r.authorize(ctx, obj.ID, iam.ActionSessionList); err != nil {
+		return nil, err
+	}
+
+	if gqlutils.OnlyTotalCountSelected(ctx) {
+		return &types.SessionConnection{
+			Resolver: r,
+			ParentID: obj.ID,
+		}, nil
+	}
+
+	pageOrderBy := page.OrderBy[coredata.SessionOrderField]{
+		Field:     coredata.SessionOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.SessionOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := cursor.NewCursor(first, after, last, before, pageOrderBy)
+
+	page, err := r.iam.AccountService.ListSessions(ctx, obj.ID, cursor)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot list sessions", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewSessionConnection(page, r, obj.ID), nil
+}
+
+// PersonalAPIKeys is the resolver for the personalAPIKeys field.
+func (r *identityResolver) PersonalAPIKeys(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.PersonalAPIKeyConnection, error) {
+	if err := r.authorize(ctx, obj.ID, iam.ActionPersonalAPIKeyList); err != nil {
+		return nil, err
+	}
+
+	if gqlutils.OnlyTotalCountSelected(ctx) {
+		return &types.PersonalAPIKeyConnection{
+			Resolver: r,
+			ParentID: obj.ID,
+		}, nil
+	}
+
+	pageOrderBy := page.OrderBy[coredata.PersonalAPIKeyOrderField]{
+		Field:     coredata.PersonalAPIKeyOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+
+	cursor := cursor.NewCursor(first, after, last, before, pageOrderBy)
+
+	page, err := r.iam.AccountService.ListPersonalAPIKeys(ctx, obj.ID, cursor)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot list personal api keys", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewPersonalAPIKeyConnection(page, r, obj.ID), nil
+}
+
 // SsoLoginURL is the resolver for the ssoLoginURL field.
 func (r *identityResolver) SsoLoginURL(ctx context.Context, obj *types.Identity) (*string, error) {
 	if err := r.authorize(ctx, obj.ID, iam.ActionIdentityGet); err != nil {
@@ -525,63 +634,6 @@ func (r *mutationResolver) RevokeAllSessions(ctx context.Context) (*types.Revoke
 	return &types.RevokeAllSessionsPayload{RevokedCount: int(revokedCount)}, nil
 }
 
-// LogoURL is the resolver for the logoUrl field.
-func (r *organizationResolver) LogoURL(ctx context.Context, obj *types.Organization) (*string, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionOrganizationGet, authz.WithSkipAssumptionCheck()); err != nil {
-		return nil, err
-	}
-
-	presignedURL, err := r.iam.OrganizationService.GenerateLogoURL(ctx, obj.ID, 1*time.Hour)
-	if err != nil {
-		r.logger.ErrorCtx(ctx, "cannot generate logo URL", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	return presignedURL, nil
-}
-
-// HorizontalLogoURL is the resolver for the horizontalLogoUrl field.
-func (r *organizationResolver) HorizontalLogoURL(ctx context.Context, obj *types.Organization) (*string, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionOrganizationGet); err != nil {
-		return nil, err
-	}
-
-	presignedURL, err := r.iam.OrganizationService.GenerateHorizontalLogoURL(ctx, obj.ID, 1*time.Hour)
-	if err != nil {
-		r.logger.ErrorCtx(ctx, "cannot generate horizontal logo URL", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	return presignedURL, nil
-}
-
-// Viewer is the resolver for the viewer field.
-func (r *organizationResolver) Viewer(ctx context.Context, obj *types.Organization) (*types.Profile, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
-		return nil, err
-	}
-
-	identity := authn.IdentityFromContext(ctx)
-
-	profile, err := r.iam.OrganizationService.GetProfileForIdentityAndOrganization(ctx, identity.ID, obj.ID)
-	if err != nil {
-		var errNotFound *iam.ErrProfileNotFound
-		if errors.As(err, &errNotFound) {
-			return nil, gqlutils.NotFound(ctx, err)
-		}
-
-		r.logger.ErrorCtx(ctx, "cannot get profile", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	return types.NewProfile(profile), nil
-}
-
-// Permission is the resolver for the permission field.
-func (r *organizationResolver) Permission(ctx context.Context, obj *types.Organization, action string) (bool, error) {
-	return r.Resolver.Permission(ctx, obj, action)
-}
-
 // Node is the resolver for the node field.
 func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error) {
 	var (
@@ -797,13 +849,9 @@ func (r *Resolver) Identity() schema.IdentityResolver { return &identityResolver
 // Mutation returns schema.MutationResolver implementation.
 func (r *Resolver) Mutation() schema.MutationResolver { return &mutationResolver{r} }
 
-// Organization returns schema.OrganizationResolver implementation.
-func (r *Resolver) Organization() schema.OrganizationResolver { return &organizationResolver{r} }
-
 // Query returns schema.QueryResolver implementation.
 func (r *Resolver) Query() schema.QueryResolver { return &queryResolver{r} }
 
 type identityResolver struct{ *Resolver }
 type mutationResolver struct{ *Resolver }
-type organizationResolver struct{ *Resolver }
 type queryResolver struct{ *Resolver }

pkg/server/api/connect/v1/graphql/audit_log.graphql

@@ -1,14 +1,3 @@
-extend type Organization {
-  auditLogEntries(
-    first: Int
-    after: CursorKey
-    last: Int
-    before: CursorKey
-    orderBy: AuditLogEntryOrder
-    filter: AuditLogEntryFilter
-  ): AuditLogEntryConnection! @goField(forceResolver: true)
-}
-
 enum AuditLogActorType
   @goModel(
     model: "go.probo.inc/probo/pkg/coredata.AuditLogActorType"

pkg/server/api/connect/v1/graphql/base.graphql

@@ -66,6 +66,30 @@ type Identity implements Node {
   createdAt: Datetime!
   updatedAt: Datetime!
 
+  profiles(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: ProfileOrder
+    filter: ProfileFilter
+  ): ProfileConnection @goField(forceResolver: true)
+
+  sessions(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: SessionOrder
+  ): SessionConnection @goField(forceResolver: true)
+
+  personalAPIKeys(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+  ): PersonalAPIKeyConnection @goField(forceResolver: true)
+
   ssoLoginURL: String
     @goField(forceResolver: true)
     @session(required: PRESENT)
@@ -75,25 +99,6 @@ type Identity implements Node {
     @session(required: PRESENT)
 }
 
-type Organization implements Node {
-  id: ID!
-  name: String!
-  logoUrl: String @goField(forceResolver: true)
-  horizontalLogoUrl: String @goField(forceResolver: true)
-  email: String
-  description: String
-  websiteUrl: String
-  headquarterAddress: String
-  createdAt: Datetime!
-  updatedAt: Datetime!
-
-  viewer: Profile @goField(forceResolver: true)
-
-  permission(action: String!): Boolean!
-    @goField(forceResolver: true)
-    @session(required: PRESENT)
-}
-
 type Mutation {
   signIn(input: SignInInput!): SignInPayload @session(required: OPTIONAL)
   signUp(input: SignUpInput!): SignUpPayload @session(required: NONE)

pkg/server/api/connect/v1/graphql/organization.graphql

@@ -1,3 +1,49 @@
+type Organization implements Node {
+  id: ID!
+  name: String!
+  logoUrl: String @goField(forceResolver: true)
+  horizontalLogoUrl: String @goField(forceResolver: true)
+  email: String
+  description: String
+  websiteUrl: String
+  headquarterAddress: String
+  createdAt: Datetime!
+  updatedAt: Datetime!
+
+  profiles(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: ProfileOrder
+  ): ProfileConnection @goField(forceResolver: true)
+
+  samlConfigurations(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+  ): SAMLConfigurationConnection @goField(forceResolver: true)
+
+  scimConfiguration: SCIMConfiguration @goField(forceResolver: true)
+  scimBridgeTypes: [SCIMBridgeTypeInfo!]! @goField(forceResolver: true)
+
+  auditLogEntries(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: AuditLogEntryOrder
+    filter: AuditLogEntryFilter
+  ): AuditLogEntryConnection! @goField(forceResolver: true)
+
+  viewer: Profile @goField(forceResolver: true)
+
+  permission(action: String!): Boolean!
+    @goField(forceResolver: true)
+    @session(required: PRESENT)
+}
+
 extend type Mutation {
   createOrganization(
     input: CreateOrganizationInput!

pkg/server/api/connect/v1/graphql/personal_api_key.graphql

@@ -1,12 +1,3 @@
-extend type Identity {
-  personalAPIKeys(
-    first: Int
-    after: CursorKey
-    last: Int
-    before: CursorKey
-  ): PersonalAPIKeyConnection @goField(forceResolver: true)
-}
-
 type PersonalAPIKey implements Node {
   id: ID!
   name: String!

pkg/server/api/connect/v1/graphql/profile.graphql

@@ -1,24 +1,3 @@
-extend type Identity {
-  profiles(
-    first: Int
-    after: CursorKey
-    last: Int
-    before: CursorKey
-    orderBy: ProfileOrder
-    filter: ProfileFilter
-  ): ProfileConnection @goField(forceResolver: true)
-}
-
-extend type Organization {
-  profiles(
-    first: Int
-    after: CursorKey
-    last: Int
-    before: CursorKey
-    orderBy: ProfileOrder
-  ): ProfileConnection @goField(forceResolver: true)
-}
-
 type Profile implements Node {
   id: ID!
   fullName: String!

pkg/server/api/connect/v1/graphql/saml.graphql

@@ -1,12 +1,3 @@
-extend type Organization {
-  samlConfigurations(
-    first: Int
-    after: CursorKey
-    last: Int
-    before: CursorKey
-  ): SAMLConfigurationConnection @goField(forceResolver: true)
-}
-
 type SAMLConfiguration implements Node {
   id: ID!
   emailDomain: String!

pkg/server/api/connect/v1/graphql/scim.graphql

@@ -1,8 +1,3 @@
-extend type Organization {
-  scimConfiguration: SCIMConfiguration @goField(forceResolver: true)
-  scimBridgeTypes: [SCIMBridgeTypeInfo!]! @goField(forceResolver: true)
-}
-
 type SCIMConfiguration implements Node {
   id: ID!
   endpointUrl: String! @goField(forceResolver: true)

pkg/server/api/connect/v1/graphql/session.graphql

@@ -13,16 +13,6 @@ input SessionOrder {
   field: SessionOrderField!
 }
 
-extend type Identity {
-  sessions(
-    first: Int
-    after: CursorKey
-    last: Int
-    before: CursorKey
-    orderBy: SessionOrder
-  ): SessionConnection @goField(forceResolver: true)
-}
-
 type Session implements Node {
   id: ID!
   identity: Identity @goField(forceResolver: true)

pkg/server/api/connect/v1/organization.resolvers.go

@@ -9,13 +9,19 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"time"
 
 	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/iam"
+	"go.probo.inc/probo/pkg/iam/scim/bridge/provider/googleworkspace"
+	"go.probo.inc/probo/pkg/page"
 	"go.probo.inc/probo/pkg/server/api/authn"
+	"go.probo.inc/probo/pkg/server/api/authz"
+	"go.probo.inc/probo/pkg/server/api/connect/v1/schema"
 	"go.probo.inc/probo/pkg/server/api/connect/v1/types"
 	"go.probo.inc/probo/pkg/server/gqlutils"
+	"go.probo.inc/probo/pkg/server/gqlutils/types/cursor"
 )
 
 // CreateOrganization is the resolver for the createOrganization field.
@@ -148,3 +154,206 @@ func (r *mutationResolver) DeleteOrganization(ctx context.Context, input types.D
 func (r *mutationResolver) DeleteOrganizationHorizontalLogo(ctx context.Context, input types.DeleteOrganizationHorizontalLogoInput) (*types.DeleteOrganizationHorizontalLogoPayload, error) {
 	panic(fmt.Errorf("not implemented: DeleteOrganizationHorizontalLogo - deleteOrganizationHorizontalLogo"))
 }
+
+// LogoURL is the resolver for the logoUrl field.
+func (r *organizationResolver) LogoURL(ctx context.Context, obj *types.Organization) (*string, error) {
+	if err := r.authorize(ctx, obj.ID, iam.ActionOrganizationGet, authz.WithSkipAssumptionCheck()); err != nil {
+		return nil, err
+	}
+
+	presignedURL, err := r.iam.OrganizationService.GenerateLogoURL(ctx, obj.ID, 1*time.Hour)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot generate logo URL", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return presignedURL, nil
+}
+
+// HorizontalLogoURL is the resolver for the horizontalLogoUrl field.
+func (r *organizationResolver) HorizontalLogoURL(ctx context.Context, obj *types.Organization) (*string, error) {
+	if err := r.authorize(ctx, obj.ID, iam.ActionOrganizationGet); err != nil {
+		return nil, err
+	}
+
+	presignedURL, err := r.iam.OrganizationService.GenerateHorizontalLogoURL(ctx, obj.ID, 1*time.Hour)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot generate horizontal logo URL", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return presignedURL, nil
+}
+
+// Profiles is the resolver for the profiles field.
+func (r *organizationResolver) Profiles(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ProfileOrderBy) (*types.ProfileConnection, error) {
+	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileList); err != nil {
+		return nil, err
+	}
+
+	filter := coredata.NewMembershipProfileFilter(nil).WithMembership()
+
+	if gqlutils.OnlyTotalCountSelected(ctx) {
+		return &types.ProfileConnection{
+			Resolver: r,
+			ParentID: obj.ID,
+			Filters:  filter,
+		}, nil
+	}
+
+	pageOrderBy := page.OrderBy[coredata.MembershipProfileOrderField]{
+		Field:     coredata.MembershipProfileOrderFieldFullName,
+		Direction: page.OrderDirectionAsc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.MembershipProfileOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := cursor.NewCursor(first, after, last, before, pageOrderBy)
+
+	page, err := r.iam.OrganizationService.ListProfiles(ctx, obj.ID, cursor, filter)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot list profiles", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewProfileConnection(page, r, obj.ID, filter), nil
+}
+
+// SamlConfigurations is the resolver for the samlConfigurations field.
+func (r *organizationResolver) SamlConfigurations(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.SAMLConfigurationConnection, error) {
+	if err := r.authorize(ctx, obj.ID, iam.ActionSAMLConfigurationList); err != nil {
+		return nil, err
+	}
+
+	if gqlutils.OnlyTotalCountSelected(ctx) {
+		return &types.SAMLConfigurationConnection{
+			Resolver: r,
+			ParentID: obj.ID,
+		}, nil
+	}
+
+	pageOrderBy := page.OrderBy[coredata.SAMLConfigurationOrderField]{
+		Field:     coredata.SAMLConfigurationOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+
+	cursor := cursor.NewCursor(first, after, last, before, pageOrderBy)
+
+	page, err := r.iam.OrganizationService.ListSAMLConfigurations(ctx, obj.ID, cursor)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot list saml configurations", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewSAMLConfigurationConnection(page, r, obj.ID), nil
+}
+
+// ScimConfiguration is the resolver for the scimConfiguration field.
+func (r *organizationResolver) ScimConfiguration(ctx context.Context, obj *types.Organization) (*types.SCIMConfiguration, error) {
+	if err := r.authorize(ctx, obj.ID, iam.ActionSCIMConfigurationGet); err != nil {
+		return nil, err
+	}
+
+	config, err := r.iam.OrganizationService.GetSCIMConfiguration(ctx, obj.ID)
+	if err != nil {
+		var notFound *iam.ErrNoSCIMConfigurationFound
+		if errors.As(err, &notFound) {
+			return nil, nil
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot get scim configuration", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewSCIMConfiguration(config), nil
+}
+
+// ScimBridgeTypes is the resolver for the scimBridgeTypes field.
+func (r *organizationResolver) ScimBridgeTypes(ctx context.Context, obj *types.Organization) ([]*types.SCIMBridgeTypeInfo, error) {
+	return []*types.SCIMBridgeTypeInfo{
+		{
+			Type:         coredata.SCIMBridgeTypeGoogleWorkspace,
+			Oauth2Scopes: googleworkspace.OAuth2Scopes,
+		},
+	}, nil
+}
+
+// AuditLogEntries is the resolver for the auditLogEntries field.
+func (r *organizationResolver) AuditLogEntries(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AuditLogEntryOrderBy, filter *types.AuditLogEntryFilter) (*types.AuditLogEntryConnection, error) {
+	if err := r.authorize(ctx, obj.ID, iam.ActionAuditLogEntryList); err != nil {
+		return nil, err
+	}
+
+	pageOrderBy := page.OrderBy[coredata.AuditLogEntryOrderField]{
+		Field:     coredata.AuditLogEntryOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.AuditLogEntryOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	c := cursor.NewCursor(first, after, last, before, pageOrderBy)
+
+	coredataFilter := coredata.NewAuditLogEntryFilter()
+	if filter != nil {
+		if filter.Action != nil {
+			coredataFilter.WithAction(*filter.Action)
+		}
+		if filter.ActorID != nil {
+			coredataFilter.WithActorID(*filter.ActorID)
+		}
+		if filter.ResourceType != nil {
+			coredataFilter.WithResourceType(*filter.ResourceType)
+		}
+		if filter.ResourceID != nil {
+			coredataFilter.WithResourceID(*filter.ResourceID)
+		}
+	}
+
+	p, err := r.iam.OrganizationService.ListAuditLogEntries(ctx, obj.ID, c, coredataFilter)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot list audit log entries", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewAuditLogEntryConnection(p, r, obj.ID, coredataFilter), nil
+}
+
+// Viewer is the resolver for the viewer field.
+func (r *organizationResolver) Viewer(ctx context.Context, obj *types.Organization) (*types.Profile, error) {
+	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
+		return nil, err
+	}
+
+	identity := authn.IdentityFromContext(ctx)
+
+	profile, err := r.iam.OrganizationService.GetProfileForIdentityAndOrganization(ctx, identity.ID, obj.ID)
+	if err != nil {
+		var errNotFound *iam.ErrProfileNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, gqlutils.NotFound(ctx, err)
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot get profile", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewProfile(profile), nil
+}
+
+// Permission is the resolver for the permission field.
+func (r *organizationResolver) Permission(ctx context.Context, obj *types.Organization, action string) (bool, error) {
+	return r.Resolver.Permission(ctx, obj, action)
+}
+
+// Organization returns schema.OrganizationResolver implementation.
+func (r *Resolver) Organization() schema.OrganizationResolver { return &organizationResolver{r} }
+
+type organizationResolver struct{ *Resolver }

pkg/server/api/connect/v1/personal_api_key.resolvers.go

@@ -11,43 +11,12 @@ import (
 	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/iam"
-	"go.probo.inc/probo/pkg/page"
 	"go.probo.inc/probo/pkg/server/api/authn"
 	"go.probo.inc/probo/pkg/server/api/connect/v1/schema"
 	"go.probo.inc/probo/pkg/server/api/connect/v1/types"
 	"go.probo.inc/probo/pkg/server/gqlutils"
-	"go.probo.inc/probo/pkg/server/gqlutils/types/cursor"
 )
 
-// PersonalAPIKeys is the resolver for the personalAPIKeys field.
-func (r *identityResolver) PersonalAPIKeys(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.PersonalAPIKeyConnection, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionPersonalAPIKeyList); err != nil {
-		return nil, err
-	}
-
-	if gqlutils.OnlyTotalCountSelected(ctx) {
-		return &types.PersonalAPIKeyConnection{
-			Resolver: r,
-			ParentID: obj.ID,
-		}, nil
-	}
-
-	pageOrderBy := page.OrderBy[coredata.PersonalAPIKeyOrderField]{
-		Field:     coredata.PersonalAPIKeyOrderFieldCreatedAt,
-		Direction: page.OrderDirectionDesc,
-	}
-
-	cursor := cursor.NewCursor(first, after, last, before, pageOrderBy)
-
-	page, err := r.iam.AccountService.ListPersonalAPIKeys(ctx, obj.ID, cursor)
-	if err != nil {
-		r.logger.ErrorCtx(ctx, "cannot list personal api keys", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	return types.NewPersonalAPIKeyConnection(page, r, obj.ID), nil
-}
-
 // CreatePersonalAPIKey is the resolver for the createPersonalAPIKey field.
 func (r *mutationResolver) CreatePersonalAPIKey(ctx context.Context, input types.CreatePersonalAPIKeyInput) (*types.CreatePersonalAPIKeyPayload, error) {
 	identity := authn.IdentityFromContext(ctx)

pkg/server/api/connect/v1/profile.resolvers.go

@@ -21,50 +21,6 @@ import (
 	"go.probo.inc/probo/pkg/server/gqlutils/types/cursor"
 )
 
-// Profiles is the resolver for the profiles field.
-func (r *identityResolver) Profiles(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ProfileOrderBy, filter *types.ProfileFilter) (*types.ProfileConnection, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileList, authz.WithSkipAssumptionCheck()); err != nil {
-		return nil, err
-	}
-
-	filters := coredata.NewMembershipProfileFilter(nil).WithMembership()
-	if filter != nil {
-		filters = coredata.NewMembershipProfileFilter(filter.ExcludeContractEnded).WithMembership()
-		if filter.State != nil {
-			filters.WithState(*filter.State)
-		}
-	}
-
-	if gqlutils.OnlyTotalCountSelected(ctx) {
-		return &types.ProfileConnection{
-			Resolver: r,
-			ParentID: obj.ID,
-			Filters:  filters,
-		}, nil
-	}
-
-	pageOrderBy := page.OrderBy[coredata.MembershipProfileOrderField]{
-		Field:     coredata.MembershipProfileOrderFieldFullName,
-		Direction: page.OrderDirectionAsc,
-	}
-	if orderBy != nil {
-		pageOrderBy = page.OrderBy[coredata.MembershipProfileOrderField]{
-			Field:     orderBy.Field,
-			Direction: orderBy.Direction,
-		}
-	}
-
-	cursor := cursor.NewCursor(first, after, last, before, pageOrderBy)
-
-	page, err := r.iam.AccountService.ListProfilesForIdentity(ctx, obj.ID, cursor, filters)
-	if err != nil {
-		r.logger.ErrorCtx(ctx, "cannot list profiles", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	return types.NewProfileConnection(page, r, obj.ID, filters), nil
-}
-
 // Permission is the resolver for the permission field.
 func (r *invitationResolver) Permission(ctx context.Context, obj *types.Invitation, action string) (bool, error) {
 	return r.Resolver.Permission(ctx, obj, action)
@@ -268,44 +224,6 @@ func (r *mutationResolver) RemoveUser(ctx context.Context, input types.RemoveUse
 	return &types.RemoveUserPayload{DeletedProfileID: input.ProfileID}, nil
 }
 
-// Profiles is the resolver for the profiles field.
-func (r *organizationResolver) Profiles(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ProfileOrderBy) (*types.ProfileConnection, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileList); err != nil {
-		return nil, err
-	}
-
-	filter := coredata.NewMembershipProfileFilter(nil).WithMembership()
-
-	if gqlutils.OnlyTotalCountSelected(ctx) {
-		return &types.ProfileConnection{
-			Resolver: r,
-			ParentID: obj.ID,
-			Filters:  filter,
-		}, nil
-	}
-
-	pageOrderBy := page.OrderBy[coredata.MembershipProfileOrderField]{
-		Field:     coredata.MembershipProfileOrderFieldFullName,
-		Direction: page.OrderDirectionAsc,
-	}
-	if orderBy != nil {
-		pageOrderBy = page.OrderBy[coredata.MembershipProfileOrderField]{
-			Field:     orderBy.Field,
-			Direction: orderBy.Direction,
-		}
-	}
-
-	cursor := cursor.NewCursor(first, after, last, before, pageOrderBy)
-
-	page, err := r.iam.OrganizationService.ListProfiles(ctx, obj.ID, cursor, filter)
-	if err != nil {
-		r.logger.ErrorCtx(ctx, "cannot list profiles", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	return types.NewProfileConnection(page, r, obj.ID, filter), nil
-}
-
 // Identity is the resolver for the identity field.
 func (r *profileResolver) Identity(ctx context.Context, obj *types.Profile) (*types.Identity, error) {
 	if err := r.authorize(

pkg/server/api/connect/v1/saml.resolvers.go

@@ -12,11 +12,9 @@ import (
 	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/iam"
-	"go.probo.inc/probo/pkg/page"
 	"go.probo.inc/probo/pkg/server/api/connect/v1/schema"
 	"go.probo.inc/probo/pkg/server/api/connect/v1/types"
 	"go.probo.inc/probo/pkg/server/gqlutils"
-	"go.probo.inc/probo/pkg/server/gqlutils/types/cursor"
 )
 
 // CreateSAMLConfiguration is the resolver for the createSAMLConfiguration field.
@@ -116,35 +114,6 @@ func (r *mutationResolver) DeleteSAMLConfiguration(ctx context.Context, input ty
 	return &types.DeleteSAMLConfigurationPayload{DeletedSamlConfigurationID: input.SamlConfigurationID}, nil
 }
 
-// SamlConfigurations is the resolver for the samlConfigurations field.
-func (r *organizationResolver) SamlConfigurations(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.SAMLConfigurationConnection, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionSAMLConfigurationList); err != nil {
-		return nil, err
-	}
-
-	if gqlutils.OnlyTotalCountSelected(ctx) {
-		return &types.SAMLConfigurationConnection{
-			Resolver: r,
-			ParentID: obj.ID,
-		}, nil
-	}
-
-	pageOrderBy := page.OrderBy[coredata.SAMLConfigurationOrderField]{
-		Field:     coredata.SAMLConfigurationOrderFieldCreatedAt,
-		Direction: page.OrderDirectionDesc,
-	}
-
-	cursor := cursor.NewCursor(first, after, last, before, pageOrderBy)
-
-	page, err := r.iam.OrganizationService.ListSAMLConfigurations(ctx, obj.ID, cursor)
-	if err != nil {
-		r.logger.ErrorCtx(ctx, "cannot list saml configurations", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	return types.NewSAMLConfigurationConnection(page, r, obj.ID), nil
-}
-
 // TestLoginURL is the resolver for the testLoginUrl field.
 func (r *sAMLConfigurationResolver) TestLoginURL(ctx context.Context, obj *types.SAMLConfiguration) (string, error) {
 	return r.baseURL.WithPath("/api/connect/v1/saml/2.0/" + obj.ID.String()).MustString(), nil

pkg/server/api/connect/v1/scim.resolvers.go

@@ -12,7 +12,6 @@ import (
 	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/iam"
-	"go.probo.inc/probo/pkg/iam/scim/bridge/provider/googleworkspace"
 	"go.probo.inc/probo/pkg/page"
 	"go.probo.inc/probo/pkg/server/api/connect/v1/schema"
 	"go.probo.inc/probo/pkg/server/api/connect/v1/types"
@@ -107,36 +106,6 @@ func (r *mutationResolver) UpdateSCIMBridge(ctx context.Context, input types.Upd
 	}, nil
 }
 
-// ScimConfiguration is the resolver for the scimConfiguration field.
-func (r *organizationResolver) ScimConfiguration(ctx context.Context, obj *types.Organization) (*types.SCIMConfiguration, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionSCIMConfigurationGet); err != nil {
-		return nil, err
-	}
-
-	config, err := r.iam.OrganizationService.GetSCIMConfiguration(ctx, obj.ID)
-	if err != nil {
-		var notFound *iam.ErrNoSCIMConfigurationFound
-		if errors.As(err, &notFound) {
-			return nil, nil
-		}
-
-		r.logger.ErrorCtx(ctx, "cannot get scim configuration", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	return types.NewSCIMConfiguration(config), nil
-}
-
-// ScimBridgeTypes is the resolver for the scimBridgeTypes field.
-func (r *organizationResolver) ScimBridgeTypes(ctx context.Context, obj *types.Organization) ([]*types.SCIMBridgeTypeInfo, error) {
-	return []*types.SCIMBridgeTypeInfo{
-		{
-			Type:         coredata.SCIMBridgeTypeGoogleWorkspace,
-			Oauth2Scopes: googleworkspace.OAuth2Scopes,
-		},
-	}, nil
-}
-
 // ScimConfiguration is the resolver for the scimConfiguration field.
 func (r *sCIMBridgeResolver) ScimConfiguration(ctx context.Context, obj *types.SCIMBridge) (*types.SCIMConfiguration, error) {
 	if err := r.authorize(ctx, obj.ScimConfiguration.ID, iam.ActionSCIMConfigurationGet); err != nil {

pkg/server/api/connect/v1/session.resolvers.go

@@ -9,50 +9,11 @@ import (
 	"context"
 
 	"go.gearno.de/kit/log"
-	"go.probo.inc/probo/pkg/coredata"
-	"go.probo.inc/probo/pkg/iam"
-	"go.probo.inc/probo/pkg/page"
 	"go.probo.inc/probo/pkg/server/api/connect/v1/schema"
 	"go.probo.inc/probo/pkg/server/api/connect/v1/types"
 	"go.probo.inc/probo/pkg/server/gqlutils"
-	"go.probo.inc/probo/pkg/server/gqlutils/types/cursor"
 )
 
-// Sessions is the resolver for the sessions field.
-func (r *identityResolver) Sessions(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.SessionOrder) (*types.SessionConnection, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionSessionList); err != nil {
-		return nil, err
-	}
-
-	if gqlutils.OnlyTotalCountSelected(ctx) {
-		return &types.SessionConnection{
-			Resolver: r,
-			ParentID: obj.ID,
-		}, nil
-	}
-
-	pageOrderBy := page.OrderBy[coredata.SessionOrderField]{
-		Field:     coredata.SessionOrderFieldCreatedAt,
-		Direction: page.OrderDirectionDesc,
-	}
-	if orderBy != nil {
-		pageOrderBy = page.OrderBy[coredata.SessionOrderField]{
-			Field:     orderBy.Field,
-			Direction: orderBy.Direction,
-		}
-	}
-
-	cursor := cursor.NewCursor(first, after, last, before, pageOrderBy)
-
-	page, err := r.iam.AccountService.ListSessions(ctx, obj.ID, cursor)
-	if err != nil {
-		r.logger.ErrorCtx(ctx, "cannot list sessions", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	return types.NewSessionConnection(page, r, obj.ID), nil
-}
-
 // Identity is the resolver for the identity field.
 func (r *sessionResolver) Identity(ctx context.Context, obj *types.Session) (*types.Identity, error) {
 	if gqlutils.OnlyIDSelected(ctx) {