Slim base.graphql to directives, scalars, Query, Node, and Mutation

Move Identity, Organization, Viewer, PageInfo, OrderDirection,
CountryCode, OIDCProviderInfo, File, and ReauthenticationReason out
of base.graphql into their own dedicated files across all three APIs.

base.graphql now only contains directives, scalars, Node interface,
Query type, and an empty Mutation type (required by Relay
schemaExtensions). Entity files use extend type Mutation for their
mutations.

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/server/api/connect/v1/base.resolvers.go

@@ -12,628 +12,17 @@ import (
 	"strings"
 
 	"github.com/99designs/gqlgen/graphql"
-	"github.com/vektah/gqlparser/v2/gqlerror"
 	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/gid"
 	"go.probo.inc/probo/pkg/iam"
 	"go.probo.inc/probo/pkg/mail"
-	"go.probo.inc/probo/pkg/page"
 	"go.probo.inc/probo/pkg/server/api/authn"
-	"go.probo.inc/probo/pkg/server/api/authz"
 	"go.probo.inc/probo/pkg/server/api/connect/v1/schema"
 	"go.probo.inc/probo/pkg/server/api/connect/v1/types"
 	"go.probo.inc/probo/pkg/server/gqlutils"
-	"go.probo.inc/probo/pkg/server/gqlutils/types/cursor"
 )
 
-// Profiles is the resolver for the profiles field.
-func (r *identityResolver) Profiles(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ProfileOrderBy, filter *types.ProfileFilter) (*types.ProfileConnection, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileList, authz.WithSkipAssumptionCheck()); err != nil {
-		return nil, err
-	}
-
-	filters := coredata.NewMembershipProfileFilter(nil).WithMembership()
-	if filter != nil {
-		filters = coredata.NewMembershipProfileFilter(filter.ExcludeContractEnded).WithMembership()
-		if filter.State != nil {
-			filters.WithState(*filter.State)
-		}
-	}
-
-	if gqlutils.OnlyTotalCountSelected(ctx) {
-		return &types.ProfileConnection{
-			Resolver: r,
-			ParentID: obj.ID,
-			Filters:  filters,
-		}, nil
-	}
-
-	pageOrderBy := page.OrderBy[coredata.MembershipProfileOrderField]{
-		Field:     coredata.MembershipProfileOrderFieldFullName,
-		Direction: page.OrderDirectionAsc,
-	}
-	if orderBy != nil {
-		pageOrderBy = page.OrderBy[coredata.MembershipProfileOrderField]{
-			Field:     orderBy.Field,
-			Direction: orderBy.Direction,
-		}
-	}
-
-	cursor := cursor.NewCursor(first, after, last, before, pageOrderBy)
-
-	page, err := r.iam.AccountService.ListProfilesForIdentity(ctx, obj.ID, cursor, filters)
-	if err != nil {
-		r.logger.ErrorCtx(ctx, "cannot list profiles", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	return types.NewProfileConnection(page, r, obj.ID, filters), nil
-}
-
-// Sessions is the resolver for the sessions field.
-func (r *identityResolver) Sessions(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.SessionOrder) (*types.SessionConnection, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionSessionList); err != nil {
-		return nil, err
-	}
-
-	if gqlutils.OnlyTotalCountSelected(ctx) {
-		return &types.SessionConnection{
-			Resolver: r,
-			ParentID: obj.ID,
-		}, nil
-	}
-
-	pageOrderBy := page.OrderBy[coredata.SessionOrderField]{
-		Field:     coredata.SessionOrderFieldCreatedAt,
-		Direction: page.OrderDirectionDesc,
-	}
-	if orderBy != nil {
-		pageOrderBy = page.OrderBy[coredata.SessionOrderField]{
-			Field:     orderBy.Field,
-			Direction: orderBy.Direction,
-		}
-	}
-
-	cursor := cursor.NewCursor(first, after, last, before, pageOrderBy)
-
-	page, err := r.iam.AccountService.ListSessions(ctx, obj.ID, cursor)
-	if err != nil {
-		r.logger.ErrorCtx(ctx, "cannot list sessions", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	return types.NewSessionConnection(page, r, obj.ID), nil
-}
-
-// PersonalAPIKeys is the resolver for the personalAPIKeys field.
-func (r *identityResolver) PersonalAPIKeys(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.PersonalAPIKeyConnection, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionPersonalAPIKeyList); err != nil {
-		return nil, err
-	}
-
-	if gqlutils.OnlyTotalCountSelected(ctx) {
-		return &types.PersonalAPIKeyConnection{
-			Resolver: r,
-			ParentID: obj.ID,
-		}, nil
-	}
-
-	pageOrderBy := page.OrderBy[coredata.PersonalAPIKeyOrderField]{
-		Field:     coredata.PersonalAPIKeyOrderFieldCreatedAt,
-		Direction: page.OrderDirectionDesc,
-	}
-
-	cursor := cursor.NewCursor(first, after, last, before, pageOrderBy)
-
-	page, err := r.iam.AccountService.ListPersonalAPIKeys(ctx, obj.ID, cursor)
-	if err != nil {
-		r.logger.ErrorCtx(ctx, "cannot list personal api keys", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	return types.NewPersonalAPIKeyConnection(page, r, obj.ID), nil
-}
-
-// SsoLoginURL is the resolver for the ssoLoginURL field.
-func (r *identityResolver) SsoLoginURL(ctx context.Context, obj *types.Identity) (*string, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionIdentityGet); err != nil {
-		return nil, err
-	}
-
-	identity := authn.IdentityFromContext(ctx)
-
-	count, err := r.iam.AccountService.CountSAMLConfigurationsForEmail(ctx, identity.EmailAddress)
-	if err != nil {
-		r.logger.ErrorCtx(ctx, "cannot count SAML configurations for email", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	if count != 1 {
-		if count == 0 {
-			return nil, graphql.ErrorOnPath(
-				ctx,
-				fmt.Errorf("no SAML configuration for email"),
-			)
-		}
-
-		return nil, graphql.ErrorOnPath(
-			ctx,
-			fmt.Errorf("multiple SSO configurations found for this domain. Please use your organization-specific SSO login URL"),
-		)
-	}
-
-	samlConfigs, err := r.iam.AccountService.ListSAMLConfigurationsForEmail(ctx, identity.EmailAddress)
-	if err != nil {
-		r.logger.ErrorCtx(ctx, "cannot list SAML configurations for email", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	if len(samlConfigs) == 0 {
-		r.logger.ErrorCtx(ctx, "cannot find SAML config")
-		return nil, gqlutils.NotFoundf(ctx, "cannot find SAML config")
-	}
-	samlConfig := samlConfigs[0]
-
-	loginURL := r.SSOLoginURL(samlConfig.ID)
-	return &loginURL, nil
-}
-
-// Permission is the resolver for the permission field.
-func (r *identityResolver) Permission(ctx context.Context, obj *types.Identity, action string) (bool, error) {
-	return r.Resolver.Permission(ctx, obj, action)
-}
-
-// SignIn is the resolver for the signIn field.
-func (r *mutationResolver) SignIn(ctx context.Context, input types.SignInInput) (*types.SignInPayload, error) {
-	identity, err := r.iam.AuthService.CheckCredentials(ctx, input.Email, input.Password)
-	if err != nil {
-		var errInvalidPassword *iam.ErrInvalidPassword
-		if errors.As(err, &errInvalidPassword) {
-			return nil, gqlutils.Invalid(ctx, err)
-		}
-
-		var errInvalidCredentials *iam.ErrInvalidCredentials
-		if errors.As(err, &errInvalidCredentials) {
-			return nil, &gqlerror.Error{
-				Message: err.Error(),
-				Extensions: map[string]any{
-					"code": "INVALID_CREDENTIALS",
-				},
-			}
-		}
-
-		r.logger.ErrorCtx(ctx, "cannot check credentials", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	session := authn.SessionFromContext(ctx)
-
-	switch {
-	case session == nil:
-		var err error
-		session, err = r.iam.AuthService.OpenSessionWithPassword(
-			ctx,
-			identity.ID,
-		)
-		if err != nil {
-			r.logger.ErrorCtx(ctx, "cannot create session", log.Error(err))
-			return nil, gqlutils.Internal(ctx)
-		}
-	case session.IdentityID != identity.ID:
-		if err := r.iam.SessionService.CloseSession(ctx, session.ID); err != nil {
-			r.logger.ErrorCtx(ctx, "cannot close session", log.Error(err))
-			return nil, gqlutils.Internal(ctx)
-		}
-
-		session, err = r.iam.AuthService.OpenSessionWithPassword(
-			ctx,
-			identity.ID,
-		)
-		if err != nil {
-			r.logger.ErrorCtx(ctx, "cannot create session", log.Error(err))
-			return nil, gqlutils.Internal(ctx)
-		}
-	}
-
-	w := gqlutils.HTTPResponseWriterFromContext(ctx)
-	r.sessionCookie.Set(w, session)
-
-	if input.OrganizationID != nil {
-		var err error
-		_, _, err = r.iam.SessionService.OpenPasswordChildSessionForOrganization(ctx, session.ID, *input.OrganizationID)
-		if err != nil {
-			// Here session middleware already took care of expired/nil root session so we only handle membership related errors
-			var errMembershipNotFound *iam.ErrMembershipNotFound
-			var errUserInactive *iam.ErrUserInactive
-
-			if errors.As(err, &errMembershipNotFound) || errors.As(err, &errUserInactive) {
-				return nil, gqlutils.Forbiddenf(ctx, "forbidden")
-			}
-
-			r.logger.ErrorCtx(ctx, "cannot assume organization", log.Error(err))
-			return nil, gqlutils.Internal(ctx)
-		}
-	}
-
-	return &types.SignInPayload{
-		Identity: types.NewIdentity(identity),
-		Session:  types.NewSession(session),
-	}, nil
-}
-
-// SignUp is the resolver for the signUp field.
-func (r *mutationResolver) SignUp(ctx context.Context, input types.SignUpInput) (*types.SignUpPayload, error) {
-	identity, session, err := r.iam.AuthService.CreateIdentityWithPassword(
-		ctx,
-		&iam.CreateIdentityWithPasswordRequest{
-			Email:    input.Email,
-			Password: input.Password,
-			FullName: input.FullName,
-		},
-	)
-	if err != nil {
-		var errIdentityAlreadyExists *iam.ErrIdentityAlreadyExists
-		if errors.As(err, &errIdentityAlreadyExists) {
-			return nil, gqlutils.Invalid(ctx, err)
-		}
-
-		var errSignupDisabled *iam.ErrSignupDisabled
-		if errors.As(err, &errSignupDisabled) {
-			return nil, gqlutils.Forbidden(ctx, err)
-		}
-
-		r.logger.ErrorCtx(ctx, "cannot create identity with password", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	w := gqlutils.HTTPResponseWriterFromContext(ctx)
-	r.sessionCookie.Set(w, session)
-
-	return &types.SignUpPayload{
-		Identity: types.NewIdentity(identity),
-	}, nil
-}
-
-// SignOut is the resolver for the signOut field.
-func (r *mutationResolver) SignOut(ctx context.Context) (*types.SignOutPayload, error) {
-	session := authn.SessionFromContext(ctx)
-
-	err := r.iam.SessionService.CloseSession(ctx, session.ID)
-	if err != nil {
-		var ErrSessionNotFound *iam.ErrSessionNotFound
-		if errors.As(err, &ErrSessionNotFound) {
-			return &types.SignOutPayload{}, nil
-		}
-
-		r.logger.ErrorCtx(ctx, "cannot close session", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	w := gqlutils.HTTPResponseWriterFromContext(ctx)
-	r.sessionCookie.Clear(w)
-
-	return &types.SignOutPayload{Success: true}, nil
-}
-
-// ActivateAccount is the resolver for the activateAccount field.
-func (r *mutationResolver) ActivateAccount(ctx context.Context, input types.ActivateAccountInput) (*types.ActivateAccountPayload, error) {
-	session := authn.SessionFromContext(ctx)
-
-	if session != nil {
-		// Sign out any other account before activating a new one
-		err := r.iam.SessionService.CloseSession(ctx, session.ID)
-		if err != nil {
-			var ErrSessionNotFound *iam.ErrSessionNotFound
-			if !errors.As(err, &ErrSessionNotFound) {
-				r.logger.ErrorCtx(ctx, "cannot close session", log.Error(err))
-				return nil, gqlutils.Internal(ctx)
-			}
-
-		}
-
-		w := gqlutils.HTTPResponseWriterFromContext(ctx)
-		r.sessionCookie.Clear(w)
-	}
-
-	identity, user, err := r.iam.AuthService.ActivateAccount(
-		ctx,
-		&iam.ActivateAccountRequest{
-			InvitationToken: input.Token,
-		},
-	)
-	if err != nil {
-		var (
-			errInvalidToken       *iam.ErrInvalidToken
-			errInvitationNotFound *iam.ErrInvitationNotFound
-			errInvitationExpired  *iam.ErrInvitationExpired
-
-			isInvalidErr = errors.As(err, &errInvalidToken) ||
-				errors.As(err, &errInvitationNotFound) ||
-				errors.As(err, &errInvitationExpired)
-		)
-
-		if isInvalidErr {
-			return nil, gqlutils.Invalid(ctx, err)
-		}
-
-		if _, ok := errors.AsType[*iam.ErrInvitationAlreadyAccepted](err); ok {
-			return nil, gqlutils.AccountAlreadyActivated(ctx, err)
-		}
-
-		r.logger.ErrorCtx(ctx, "cannot activate account from invitation", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	var ssoLoginURL *string
-	samlConfigs, err := r.iam.AccountService.ListSAMLConfigurationsForEmail(ctx, user.EmailAddress)
-	if err != nil {
-		r.logger.ErrorCtx(ctx, "cannot list saml configurations", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	for _, samlConfig := range samlConfigs {
-		if samlConfig.OrganizationID != user.OrganizationID {
-			continue
-		}
-
-		ssoLoginURL = new(r.SSOLoginURL(samlConfig.ID))
-	}
-
-	if ssoLoginURL != nil {
-		return &types.ActivateAccountPayload{
-			CreatePasswordToken: nil,
-			SsoLoginURL:         ssoLoginURL,
-			Profile:             types.NewProfile(user),
-		}, nil
-	}
-
-	var createPasswordToken *string
-	if identity.HashedPassword == nil {
-		token, err := r.iam.AuthService.GetResetPasswordToken(ctx, identity.EmailAddress)
-		if err != nil {
-			r.logger.ErrorCtx(ctx, "cannot generate password create token", log.Error(err))
-			return nil, gqlutils.Internal(ctx)
-		}
-
-		createPasswordToken = &token
-	}
-
-	return &types.ActivateAccountPayload{
-		CreatePasswordToken: createPasswordToken,
-		SsoLoginURL:         nil,
-		Profile:             types.NewProfile(user),
-	}, nil
-}
-
-// ForgotPassword is the resolver for the forgotPassword field.
-func (r *mutationResolver) ForgotPassword(ctx context.Context, input types.ForgotPasswordInput) (*types.ForgotPasswordPayload, error) {
-	err := r.iam.AuthService.SendPasswordResetInstructionByEmail(
-		ctx,
-		input.Email,
-	)
-	if err != nil {
-		r.logger.ErrorCtx(ctx, "cannot send password reset instruction by email", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	return &types.ForgotPasswordPayload{
-		Success: true,
-	}, nil
-}
-
-// ResetPassword is the resolver for the resetPassword field.
-func (r *mutationResolver) ResetPassword(ctx context.Context, input types.ResetPasswordInput) (*types.ResetPasswordPayload, error) {
-	err := r.iam.AuthService.ResetPassword(
-		ctx,
-		&iam.ResetPasswordRequest{
-			Token:    input.Token,
-			Password: input.Password,
-		},
-	)
-	if err != nil {
-		var errInvalidToken *iam.ErrInvalidToken
-		if errors.As(err, &errInvalidToken) {
-			return nil, gqlutils.Invalid(ctx, err)
-		}
-
-		r.logger.ErrorCtx(ctx, "cannot reset password", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	return &types.ResetPasswordPayload{
-		Success: true,
-	}, nil
-}
-
-// VerifyEmail is the resolver for the verifyEmail field.
-func (r *mutationResolver) VerifyEmail(ctx context.Context, input types.VerifyEmailInput) (*types.VerifyEmailPayload, error) {
-	err := r.iam.AccountService.VerifyEmail(ctx, input.Token)
-	if err != nil {
-		var (
-			errInvalidToken              *iam.ErrInvalidToken
-			errIdentityNotFound          *iam.ErrIdentityNotFound
-			errEmailAlreadyVerified      *iam.ErrEmailAlreadyVerified
-			errEmailVerificationMismatch *iam.ErrEmailVerificationMismatch
-
-			isInvalidErr = errors.As(err, &errInvalidToken) ||
-				errors.As(err, &errEmailVerificationMismatch)
-		)
-
-		if isInvalidErr {
-			return nil, gqlutils.Invalid(ctx, err)
-		}
-
-		if errors.As(err, &errEmailAlreadyVerified) {
-			return nil, gqlutils.Conflict(ctx, err)
-		}
-
-		if errors.As(err, &errIdentityNotFound) {
-			return nil, gqlutils.NotFound(ctx, err)
-		}
-
-		r.logger.ErrorCtx(ctx, "cannot verify email", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	return &types.VerifyEmailPayload{
-		Success: true,
-	}, nil
-}
-
-// ChangePassword is the resolver for the changePassword field.
-func (r *mutationResolver) ChangePassword(ctx context.Context, input types.ChangePasswordInput) (*types.ChangePasswordPayload, error) {
-	identity := authn.IdentityFromContext(ctx)
-
-	err := r.iam.AccountService.ChangePassword(
-		ctx,
-		identity.ID,
-		&iam.ChangePasswordRequest{
-			CurrentPassword: input.CurrentPassword,
-			NewPassword:     input.NewPassword,
-		},
-	)
-	if err != nil {
-		var (
-			errInvalidPassword  *iam.ErrInvalidPassword
-			errIdentityNotFound *iam.ErrIdentityNotFound
-		)
-
-		if errors.As(err, &errInvalidPassword) {
-			return nil, gqlutils.Invalid(ctx, err)
-		}
-
-		if errors.As(err, &errIdentityNotFound) {
-			return nil, gqlutils.NotFound(ctx, err)
-		}
-
-		r.logger.ErrorCtx(ctx, "cannot change password", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	return &types.ChangePasswordPayload{
-		Success: true,
-	}, nil
-}
-
-// ChangeEmail is the resolver for the changeEmail field.
-func (r *mutationResolver) ChangeEmail(ctx context.Context, input types.ChangeEmailInput) (*types.ChangeEmailPayload, error) {
-	identity := authn.IdentityFromContext(ctx)
-
-	err := r.iam.AccountService.ChangeEmail(
-		ctx,
-		identity.ID,
-		&iam.ChangeEmailRequest{
-			NewEmail: input.NewEmail,
-			Password: input.Password,
-		},
-	)
-	if err != nil {
-		var (
-			errInvalidPassword  *iam.ErrInvalidPassword
-			errIdentityNotFound *iam.ErrIdentityNotFound
-		)
-
-		if errors.As(err, &errInvalidPassword) {
-			return nil, gqlutils.Invalid(ctx, err)
-		}
-
-		if errors.As(err, &errIdentityNotFound) {
-			return nil, gqlutils.NotFound(ctx, err)
-		}
-
-		r.logger.ErrorCtx(ctx, "cannot change email", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	return &types.ChangeEmailPayload{
-		Success: true,
-	}, nil
-}
-
-// AssumeOrganizationSession is the resolver for the assumeOrganizationSession field.
-func (r *mutationResolver) AssumeOrganizationSession(ctx context.Context, input types.AssumeOrganizationSessionInput) (*types.AssumeOrganizationSessionPayload, error) {
-	rootSession := authn.SessionFromContext(ctx)
-
-	childSession, membership, err := r.iam.SessionService.AssumeOrganizationSession(ctx, rootSession.ID, input.OrganizationID, input.Continue)
-	if err != nil {
-		var (
-			errMembershipNotFound             *iam.ErrMembershipNotFound
-			errPasswordAuthenticationRequired *iam.ErrPasswordAuthenticationRequired
-			errSAMLAuthenticationRequired     *iam.ErrSAMLAuthenticationRequired
-		)
-
-		switch {
-		case errors.As(err, &errMembershipNotFound):
-			return nil, gqlutils.NotFound(ctx, err)
-
-		case errors.As(err, &errPasswordAuthenticationRequired):
-			return &types.AssumeOrganizationSessionPayload{
-				Result: types.PasswordRequired{
-					Reason: types.ReauthenticationReason(errPasswordAuthenticationRequired.Reason),
-				},
-			}, nil
-
-		case errors.As(err, &errSAMLAuthenticationRequired):
-			return &types.AssumeOrganizationSessionPayload{
-				Result: types.SAMLAuthenticationRequired{
-					Reason: types.ReauthenticationReason(errSAMLAuthenticationRequired.Reason),
-				},
-			}, nil
-
-		default:
-			r.logger.ErrorCtx(ctx, "cannot assume organization session", log.Error(err))
-			return nil, gqlutils.Internal(ctx)
-		}
-	}
-
-	return &types.AssumeOrganizationSessionPayload{
-		Result: types.OrganizationSessionCreated{
-			Session:    types.NewSession(childSession),
-			Membership: types.NewMembership(membership),
-		},
-	}, nil
-}
-
-// RevokeSession is the resolver for the revokeSession field.
-func (r *mutationResolver) RevokeSession(ctx context.Context, input types.RevokeSessionInput) (*types.RevokeSessionPayload, error) {
-	if err := r.authorize(ctx, input.SessionID, iam.ActionSessionRevoke); err != nil {
-		return nil, err
-	}
-
-	identity := authn.IdentityFromContext(ctx)
-
-	err := r.iam.SessionService.RevokeSession(ctx, identity.ID, input.SessionID)
-	if err != nil {
-		var ErrSessionExpired *iam.ErrSessionExpired
-		if errors.As(err, &ErrSessionExpired) {
-			return &types.RevokeSessionPayload{Success: true}, nil
-		}
-
-		r.logger.ErrorCtx(ctx, "cannot revoke session", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	return &types.RevokeSessionPayload{Success: true}, nil
-}
-
-// RevokeAllSessions is the resolver for the revokeAllSessions field.
-func (r *mutationResolver) RevokeAllSessions(ctx context.Context) (*types.RevokeAllSessionsPayload, error) {
-	if err := r.authorize(ctx, authn.SessionFromContext(ctx).ID, iam.ActionSessionRevokeAll); err != nil {
-		return nil, err
-	}
-
-	session := authn.SessionFromContext(ctx)
-
-	revokedCount, err := r.iam.SessionService.RevokeAllSessions(ctx, session.ID)
-	if err != nil {
-		r.logger.ErrorCtx(ctx, "cannot revoke all sessions", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	return &types.RevokeAllSessionsPayload{RevokedCount: int(revokedCount)}, nil
-}
-
 // Node is the resolver for the node field.
 func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error) {
 	var (
@@ -843,15 +232,11 @@ func (r *queryResolver) SignUpEnabled(ctx context.Context) (bool, error) {
 	return r.iam.IsSignUpEnabled(), nil
 }
 
-// Identity returns schema.IdentityResolver implementation.
-func (r *Resolver) Identity() schema.IdentityResolver { return &identityResolver{r} }
-
 // Mutation returns schema.MutationResolver implementation.
 func (r *Resolver) Mutation() schema.MutationResolver { return &mutationResolver{r} }
 
 // Query returns schema.QueryResolver implementation.
 func (r *Resolver) Query() schema.QueryResolver { return &queryResolver{r} }
 
-type identityResolver struct{ *Resolver }
 type mutationResolver struct{ *Resolver }
 type queryResolver struct{ *Resolver }

pkg/server/api/connect/v1/graphql/base.graphql

@@ -16,34 +16,10 @@ scalar Datetime
 scalar Upload
 scalar EmailAddr
 
-enum OrderDirection
-  @goModel(model: "go.probo.inc/probo/pkg/page.OrderDirection") {
-  ASC @goEnum(value: "go.probo.inc/probo/pkg/page.OrderDirectionAsc")
-  DESC @goEnum(value: "go.probo.inc/probo/pkg/page.OrderDirectionDesc")
-}
-
 interface Node {
   id: ID!
 }
 
-type PageInfo {
-  hasNextPage: Boolean!
-  hasPreviousPage: Boolean!
-  startCursor: CursorKey
-  endCursor: CursorKey
-}
-
-type OIDCProviderInfo {
-  name: String!
-  loginURL: String!
-}
-
-enum ReauthenticationReason {
-  SESSION_EXPIRED
-  SENSITIVE_ACTION
-  POLICY_REQUIREMENT
-}
-
 type Query {
   node(id: ID!): Node @session(required: PRESENT)
   viewer: Identity @session(required: PRESENT)
@@ -58,69 +34,4 @@ type Query {
     @session(required: OPTIONAL)
 }
 
-type Identity implements Node {
-  id: ID!
-  email: EmailAddr!
-  fullName: String!
-  emailVerified: Boolean!
-  createdAt: Datetime!
-  updatedAt: Datetime!
-
-  profiles(
-    first: Int
-    after: CursorKey
-    last: Int
-    before: CursorKey
-    orderBy: ProfileOrder
-    filter: ProfileFilter
-  ): ProfileConnection @goField(forceResolver: true)
-
-  sessions(
-    first: Int
-    after: CursorKey
-    last: Int
-    before: CursorKey
-    orderBy: SessionOrder
-  ): SessionConnection @goField(forceResolver: true)
-
-  personalAPIKeys(
-    first: Int
-    after: CursorKey
-    last: Int
-    before: CursorKey
-  ): PersonalAPIKeyConnection @goField(forceResolver: true)
-
-  ssoLoginURL: String
-    @goField(forceResolver: true)
-    @session(required: PRESENT)
-
-  permission(action: String!): Boolean!
-    @goField(forceResolver: true)
-    @session(required: PRESENT)
-}
-
-type Mutation {
-  signIn(input: SignInInput!): SignInPayload @session(required: OPTIONAL)
-  signUp(input: SignUpInput!): SignUpPayload @session(required: NONE)
-  signOut: SignOutPayload @session(required: PRESENT)
-  activateAccount(
-    input: ActivateAccountInput!
-  ): ActivateAccountPayload @session(required: OPTIONAL)
-  forgotPassword(input: ForgotPasswordInput!): ForgotPasswordPayload
-    @session(required: NONE)
-  resetPassword(input: ResetPasswordInput!): ResetPasswordPayload
-    @session(required: NONE)
-  verifyEmail(input: VerifyEmailInput!): VerifyEmailPayload
-    @session(required: OPTIONAL)
-  changePassword(input: ChangePasswordInput!): ChangePasswordPayload
-    @session(required: PRESENT)
-  changeEmail(input: ChangeEmailInput!): ChangeEmailPayload
-    @session(required: PRESENT)
-  assumeOrganizationSession(
-    input: AssumeOrganizationSessionInput!
-  ): AssumeOrganizationSessionPayload @session(required: PRESENT)
-
-  revokeSession(input: RevokeSessionInput!): RevokeSessionPayload!
-    @session(required: PRESENT)
-  revokeAllSessions: RevokeAllSessionsPayload @session(required: PRESENT)
-}
+type Mutation

pkg/server/api/connect/v1/graphql/identity.graphql

@@ -0,0 +1,40 @@
+type Identity implements Node {
+  id: ID!
+  email: EmailAddr!
+  fullName: String!
+  emailVerified: Boolean!
+  createdAt: Datetime!
+  updatedAt: Datetime!
+
+  profiles(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: ProfileOrder
+    filter: ProfileFilter
+  ): ProfileConnection @goField(forceResolver: true)
+
+  sessions(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: SessionOrder
+  ): SessionConnection @goField(forceResolver: true)
+
+  personalAPIKeys(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+  ): PersonalAPIKeyConnection @goField(forceResolver: true)
+
+  ssoLoginURL: String
+    @goField(forceResolver: true)
+    @session(required: PRESENT)
+
+  permission(action: String!): Boolean!
+    @goField(forceResolver: true)
+    @session(required: PRESENT)
+}

pkg/server/api/connect/v1/graphql/oidc.graphql

@@ -0,0 +1,4 @@
+type OIDCProviderInfo {
+  name: String!
+  loginURL: String!
+}

pkg/server/api/connect/v1/graphql/pagination.graphql

@@ -0,0 +1,12 @@
+type PageInfo {
+  hasNextPage: Boolean!
+  hasPreviousPage: Boolean!
+  startCursor: CursorKey
+  endCursor: CursorKey
+}
+
+enum OrderDirection
+  @goModel(model: "go.probo.inc/probo/pkg/page.OrderDirection") {
+  ASC @goEnum(value: "go.probo.inc/probo/pkg/page.OrderDirectionAsc")
+  DESC @goEnum(value: "go.probo.inc/probo/pkg/page.OrderDirectionDesc")
+}

pkg/server/api/connect/v1/graphql/session.graphql

@@ -1,3 +1,35 @@
+enum ReauthenticationReason {
+  SESSION_EXPIRED
+  SENSITIVE_ACTION
+  POLICY_REQUIREMENT
+}
+
+extend type Mutation {
+  signIn(input: SignInInput!): SignInPayload @session(required: OPTIONAL)
+  signUp(input: SignUpInput!): SignUpPayload @session(required: NONE)
+  signOut: SignOutPayload @session(required: PRESENT)
+  activateAccount(
+    input: ActivateAccountInput!
+  ): ActivateAccountPayload @session(required: OPTIONAL)
+  forgotPassword(input: ForgotPasswordInput!): ForgotPasswordPayload
+    @session(required: NONE)
+  resetPassword(input: ResetPasswordInput!): ResetPasswordPayload
+    @session(required: NONE)
+  verifyEmail(input: VerifyEmailInput!): VerifyEmailPayload
+    @session(required: OPTIONAL)
+  changePassword(input: ChangePasswordInput!): ChangePasswordPayload
+    @session(required: PRESENT)
+  changeEmail(input: ChangeEmailInput!): ChangeEmailPayload
+    @session(required: PRESENT)
+  assumeOrganizationSession(
+    input: AssumeOrganizationSessionInput!
+  ): AssumeOrganizationSessionPayload @session(required: PRESENT)
+
+  revokeSession(input: RevokeSessionInput!): RevokeSessionPayload!
+    @session(required: PRESENT)
+  revokeAllSessions: RevokeAllSessionsPayload @session(required: PRESENT)
+}
+
 enum SessionOrderField
   @goModel(model: "go.probo.inc/probo/pkg/coredata.SessionOrderField") {
   CREATED_AT

pkg/server/api/connect/v1/identity.resolvers.go

@@ -0,0 +1,185 @@
+package connect_v1
+
+// This file will be automatically regenerated based on the schema, any resolver
+// implementations
+// will be copied through when generating and any unknown code will be moved to the end.
+// Code generated by github.com/99designs/gqlgen version v0.17.87
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/99designs/gqlgen/graphql"
+	"go.gearno.de/kit/log"
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/iam"
+	"go.probo.inc/probo/pkg/page"
+	"go.probo.inc/probo/pkg/server/api/authn"
+	"go.probo.inc/probo/pkg/server/api/authz"
+	"go.probo.inc/probo/pkg/server/api/connect/v1/schema"
+	"go.probo.inc/probo/pkg/server/api/connect/v1/types"
+	"go.probo.inc/probo/pkg/server/gqlutils"
+	"go.probo.inc/probo/pkg/server/gqlutils/types/cursor"
+)
+
+// Profiles is the resolver for the profiles field.
+func (r *identityResolver) Profiles(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ProfileOrderBy, filter *types.ProfileFilter) (*types.ProfileConnection, error) {
+	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileList, authz.WithSkipAssumptionCheck()); err != nil {
+		return nil, err
+	}
+
+	filters := coredata.NewMembershipProfileFilter(nil).WithMembership()
+	if filter != nil {
+		filters = coredata.NewMembershipProfileFilter(filter.ExcludeContractEnded).WithMembership()
+		if filter.State != nil {
+			filters.WithState(*filter.State)
+		}
+	}
+
+	if gqlutils.OnlyTotalCountSelected(ctx) {
+		return &types.ProfileConnection{
+			Resolver: r,
+			ParentID: obj.ID,
+			Filters:  filters,
+		}, nil
+	}
+
+	pageOrderBy := page.OrderBy[coredata.MembershipProfileOrderField]{
+		Field:     coredata.MembershipProfileOrderFieldFullName,
+		Direction: page.OrderDirectionAsc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.MembershipProfileOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := cursor.NewCursor(first, after, last, before, pageOrderBy)
+
+	page, err := r.iam.AccountService.ListProfilesForIdentity(ctx, obj.ID, cursor, filters)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot list profiles", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewProfileConnection(page, r, obj.ID, filters), nil
+}
+
+// Sessions is the resolver for the sessions field.
+func (r *identityResolver) Sessions(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.SessionOrder) (*types.SessionConnection, error) {
+	if err := r.authorize(ctx, obj.ID, iam.ActionSessionList); err != nil {
+		return nil, err
+	}
+
+	if gqlutils.OnlyTotalCountSelected(ctx) {
+		return &types.SessionConnection{
+			Resolver: r,
+			ParentID: obj.ID,
+		}, nil
+	}
+
+	pageOrderBy := page.OrderBy[coredata.SessionOrderField]{
+		Field:     coredata.SessionOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.SessionOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := cursor.NewCursor(first, after, last, before, pageOrderBy)
+
+	page, err := r.iam.AccountService.ListSessions(ctx, obj.ID, cursor)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot list sessions", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewSessionConnection(page, r, obj.ID), nil
+}
+
+// PersonalAPIKeys is the resolver for the personalAPIKeys field.
+func (r *identityResolver) PersonalAPIKeys(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.PersonalAPIKeyConnection, error) {
+	if err := r.authorize(ctx, obj.ID, iam.ActionPersonalAPIKeyList); err != nil {
+		return nil, err
+	}
+
+	if gqlutils.OnlyTotalCountSelected(ctx) {
+		return &types.PersonalAPIKeyConnection{
+			Resolver: r,
+			ParentID: obj.ID,
+		}, nil
+	}
+
+	pageOrderBy := page.OrderBy[coredata.PersonalAPIKeyOrderField]{
+		Field:     coredata.PersonalAPIKeyOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+
+	cursor := cursor.NewCursor(first, after, last, before, pageOrderBy)
+
+	page, err := r.iam.AccountService.ListPersonalAPIKeys(ctx, obj.ID, cursor)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot list personal api keys", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewPersonalAPIKeyConnection(page, r, obj.ID), nil
+}
+
+// SsoLoginURL is the resolver for the ssoLoginURL field.
+func (r *identityResolver) SsoLoginURL(ctx context.Context, obj *types.Identity) (*string, error) {
+	if err := r.authorize(ctx, obj.ID, iam.ActionIdentityGet); err != nil {
+		return nil, err
+	}
+
+	identity := authn.IdentityFromContext(ctx)
+
+	count, err := r.iam.AccountService.CountSAMLConfigurationsForEmail(ctx, identity.EmailAddress)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot count SAML configurations for email", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	if count != 1 {
+		if count == 0 {
+			return nil, graphql.ErrorOnPath(
+				ctx,
+				fmt.Errorf("no SAML configuration for email"),
+			)
+		}
+
+		return nil, graphql.ErrorOnPath(
+			ctx,
+			fmt.Errorf("multiple SSO configurations found for this domain. Please use your organization-specific SSO login URL"),
+		)
+	}
+
+	samlConfigs, err := r.iam.AccountService.ListSAMLConfigurationsForEmail(ctx, identity.EmailAddress)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot list SAML configurations for email", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	if len(samlConfigs) == 0 {
+		r.logger.ErrorCtx(ctx, "cannot find SAML config")
+		return nil, gqlutils.NotFoundf(ctx, "cannot find SAML config")
+	}
+	samlConfig := samlConfigs[0]
+
+	loginURL := r.SSOLoginURL(samlConfig.ID)
+	return &loginURL, nil
+}
+
+// Permission is the resolver for the permission field.
+func (r *identityResolver) Permission(ctx context.Context, obj *types.Identity, action string) (bool, error) {
+	return r.Resolver.Permission(ctx, obj, action)
+}
+
+// Identity returns schema.IdentityResolver implementation.
+func (r *Resolver) Identity() schema.IdentityResolver { return &identityResolver{r} }
+
+type identityResolver struct{ *Resolver }

pkg/server/api/connect/v1/session.resolvers.go

@@ -7,13 +7,467 @@ package connect_v1
 
 import (
 	"context"
+	"errors"
 
+	"github.com/vektah/gqlparser/v2/gqlerror"
 	"go.gearno.de/kit/log"
+	"go.probo.inc/probo/pkg/iam"
+	"go.probo.inc/probo/pkg/server/api/authn"
 	"go.probo.inc/probo/pkg/server/api/connect/v1/schema"
 	"go.probo.inc/probo/pkg/server/api/connect/v1/types"
 	"go.probo.inc/probo/pkg/server/gqlutils"
 )
 
+// SignIn is the resolver for the signIn field.
+func (r *mutationResolver) SignIn(ctx context.Context, input types.SignInInput) (*types.SignInPayload, error) {
+	identity, err := r.iam.AuthService.CheckCredentials(ctx, input.Email, input.Password)
+	if err != nil {
+		var errInvalidPassword *iam.ErrInvalidPassword
+		if errors.As(err, &errInvalidPassword) {
+			return nil, gqlutils.Invalid(ctx, err)
+		}
+
+		var errInvalidCredentials *iam.ErrInvalidCredentials
+		if errors.As(err, &errInvalidCredentials) {
+			return nil, &gqlerror.Error{
+				Message: err.Error(),
+				Extensions: map[string]any{
+					"code": "INVALID_CREDENTIALS",
+				},
+			}
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot check credentials", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	session := authn.SessionFromContext(ctx)
+
+	switch {
+	case session == nil:
+		var err error
+		session, err = r.iam.AuthService.OpenSessionWithPassword(
+			ctx,
+			identity.ID,
+		)
+		if err != nil {
+			r.logger.ErrorCtx(ctx, "cannot create session", log.Error(err))
+			return nil, gqlutils.Internal(ctx)
+		}
+	case session.IdentityID != identity.ID:
+		if err := r.iam.SessionService.CloseSession(ctx, session.ID); err != nil {
+			r.logger.ErrorCtx(ctx, "cannot close session", log.Error(err))
+			return nil, gqlutils.Internal(ctx)
+		}
+
+		session, err = r.iam.AuthService.OpenSessionWithPassword(
+			ctx,
+			identity.ID,
+		)
+		if err != nil {
+			r.logger.ErrorCtx(ctx, "cannot create session", log.Error(err))
+			return nil, gqlutils.Internal(ctx)
+		}
+	}
+
+	w := gqlutils.HTTPResponseWriterFromContext(ctx)
+	r.sessionCookie.Set(w, session)
+
+	if input.OrganizationID != nil {
+		var err error
+		_, _, err = r.iam.SessionService.OpenPasswordChildSessionForOrganization(ctx, session.ID, *input.OrganizationID)
+		if err != nil {
+			// Here session middleware already took care of expired/nil root session so we only handle membership related errors
+			var errMembershipNotFound *iam.ErrMembershipNotFound
+			var errUserInactive *iam.ErrUserInactive
+
+			if errors.As(err, &errMembershipNotFound) || errors.As(err, &errUserInactive) {
+				return nil, gqlutils.Forbiddenf(ctx, "forbidden")
+			}
+
+			r.logger.ErrorCtx(ctx, "cannot assume organization", log.Error(err))
+			return nil, gqlutils.Internal(ctx)
+		}
+	}
+
+	return &types.SignInPayload{
+		Identity: types.NewIdentity(identity),
+		Session:  types.NewSession(session),
+	}, nil
+}
+
+// SignUp is the resolver for the signUp field.
+func (r *mutationResolver) SignUp(ctx context.Context, input types.SignUpInput) (*types.SignUpPayload, error) {
+	identity, session, err := r.iam.AuthService.CreateIdentityWithPassword(
+		ctx,
+		&iam.CreateIdentityWithPasswordRequest{
+			Email:    input.Email,
+			Password: input.Password,
+			FullName: input.FullName,
+		},
+	)
+	if err != nil {
+		var errIdentityAlreadyExists *iam.ErrIdentityAlreadyExists
+		if errors.As(err, &errIdentityAlreadyExists) {
+			return nil, gqlutils.Invalid(ctx, err)
+		}
+
+		var errSignupDisabled *iam.ErrSignupDisabled
+		if errors.As(err, &errSignupDisabled) {
+			return nil, gqlutils.Forbidden(ctx, err)
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot create identity with password", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	w := gqlutils.HTTPResponseWriterFromContext(ctx)
+	r.sessionCookie.Set(w, session)
+
+	return &types.SignUpPayload{
+		Identity: types.NewIdentity(identity),
+	}, nil
+}
+
+// SignOut is the resolver for the signOut field.
+func (r *mutationResolver) SignOut(ctx context.Context) (*types.SignOutPayload, error) {
+	session := authn.SessionFromContext(ctx)
+
+	err := r.iam.SessionService.CloseSession(ctx, session.ID)
+	if err != nil {
+		var ErrSessionNotFound *iam.ErrSessionNotFound
+		if errors.As(err, &ErrSessionNotFound) {
+			return &types.SignOutPayload{}, nil
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot close session", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	w := gqlutils.HTTPResponseWriterFromContext(ctx)
+	r.sessionCookie.Clear(w)
+
+	return &types.SignOutPayload{Success: true}, nil
+}
+
+// ActivateAccount is the resolver for the activateAccount field.
+func (r *mutationResolver) ActivateAccount(ctx context.Context, input types.ActivateAccountInput) (*types.ActivateAccountPayload, error) {
+	session := authn.SessionFromContext(ctx)
+
+	if session != nil {
+		// Sign out any other account before activating a new one
+		err := r.iam.SessionService.CloseSession(ctx, session.ID)
+		if err != nil {
+			var ErrSessionNotFound *iam.ErrSessionNotFound
+			if !errors.As(err, &ErrSessionNotFound) {
+				r.logger.ErrorCtx(ctx, "cannot close session", log.Error(err))
+				return nil, gqlutils.Internal(ctx)
+			}
+
+		}
+
+		w := gqlutils.HTTPResponseWriterFromContext(ctx)
+		r.sessionCookie.Clear(w)
+	}
+
+	identity, user, err := r.iam.AuthService.ActivateAccount(
+		ctx,
+		&iam.ActivateAccountRequest{
+			InvitationToken: input.Token,
+		},
+	)
+	if err != nil {
+		var (
+			errInvalidToken       *iam.ErrInvalidToken
+			errInvitationNotFound *iam.ErrInvitationNotFound
+			errInvitationExpired  *iam.ErrInvitationExpired
+
+			isInvalidErr = errors.As(err, &errInvalidToken) ||
+				errors.As(err, &errInvitationNotFound) ||
+				errors.As(err, &errInvitationExpired)
+		)
+
+		if isInvalidErr {
+			return nil, gqlutils.Invalid(ctx, err)
+		}
+
+		if _, ok := errors.AsType[*iam.ErrInvitationAlreadyAccepted](err); ok {
+			return nil, gqlutils.AccountAlreadyActivated(ctx, err)
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot activate account from invitation", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	var ssoLoginURL *string
+	samlConfigs, err := r.iam.AccountService.ListSAMLConfigurationsForEmail(ctx, user.EmailAddress)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot list saml configurations", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	for _, samlConfig := range samlConfigs {
+		if samlConfig.OrganizationID != user.OrganizationID {
+			continue
+		}
+
+		ssoLoginURL = new(r.SSOLoginURL(samlConfig.ID))
+	}
+
+	if ssoLoginURL != nil {
+		return &types.ActivateAccountPayload{
+			CreatePasswordToken: nil,
+			SsoLoginURL:         ssoLoginURL,
+			Profile:             types.NewProfile(user),
+		}, nil
+	}
+
+	var createPasswordToken *string
+	if identity.HashedPassword == nil {
+		token, err := r.iam.AuthService.GetResetPasswordToken(ctx, identity.EmailAddress)
+		if err != nil {
+			r.logger.ErrorCtx(ctx, "cannot generate password create token", log.Error(err))
+			return nil, gqlutils.Internal(ctx)
+		}
+
+		createPasswordToken = &token
+	}
+
+	return &types.ActivateAccountPayload{
+		CreatePasswordToken: createPasswordToken,
+		SsoLoginURL:         nil,
+		Profile:             types.NewProfile(user),
+	}, nil
+}
+
+// ForgotPassword is the resolver for the forgotPassword field.
+func (r *mutationResolver) ForgotPassword(ctx context.Context, input types.ForgotPasswordInput) (*types.ForgotPasswordPayload, error) {
+	err := r.iam.AuthService.SendPasswordResetInstructionByEmail(
+		ctx,
+		input.Email,
+	)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot send password reset instruction by email", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return &types.ForgotPasswordPayload{
+		Success: true,
+	}, nil
+}
+
+// ResetPassword is the resolver for the resetPassword field.
+func (r *mutationResolver) ResetPassword(ctx context.Context, input types.ResetPasswordInput) (*types.ResetPasswordPayload, error) {
+	err := r.iam.AuthService.ResetPassword(
+		ctx,
+		&iam.ResetPasswordRequest{
+			Token:    input.Token,
+			Password: input.Password,
+		},
+	)
+	if err != nil {
+		var errInvalidToken *iam.ErrInvalidToken
+		if errors.As(err, &errInvalidToken) {
+			return nil, gqlutils.Invalid(ctx, err)
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot reset password", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return &types.ResetPasswordPayload{
+		Success: true,
+	}, nil
+}
+
+// VerifyEmail is the resolver for the verifyEmail field.
+func (r *mutationResolver) VerifyEmail(ctx context.Context, input types.VerifyEmailInput) (*types.VerifyEmailPayload, error) {
+	err := r.iam.AccountService.VerifyEmail(ctx, input.Token)
+	if err != nil {
+		var (
+			errInvalidToken              *iam.ErrInvalidToken
+			errIdentityNotFound          *iam.ErrIdentityNotFound
+			errEmailAlreadyVerified      *iam.ErrEmailAlreadyVerified
+			errEmailVerificationMismatch *iam.ErrEmailVerificationMismatch
+
+			isInvalidErr = errors.As(err, &errInvalidToken) ||
+				errors.As(err, &errEmailVerificationMismatch)
+		)
+
+		if isInvalidErr {
+			return nil, gqlutils.Invalid(ctx, err)
+		}
+
+		if errors.As(err, &errEmailAlreadyVerified) {
+			return nil, gqlutils.Conflict(ctx, err)
+		}
+
+		if errors.As(err, &errIdentityNotFound) {
+			return nil, gqlutils.NotFound(ctx, err)
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot verify email", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return &types.VerifyEmailPayload{
+		Success: true,
+	}, nil
+}
+
+// ChangePassword is the resolver for the changePassword field.
+func (r *mutationResolver) ChangePassword(ctx context.Context, input types.ChangePasswordInput) (*types.ChangePasswordPayload, error) {
+	identity := authn.IdentityFromContext(ctx)
+
+	err := r.iam.AccountService.ChangePassword(
+		ctx,
+		identity.ID,
+		&iam.ChangePasswordRequest{
+			CurrentPassword: input.CurrentPassword,
+			NewPassword:     input.NewPassword,
+		},
+	)
+	if err != nil {
+		var (
+			errInvalidPassword  *iam.ErrInvalidPassword
+			errIdentityNotFound *iam.ErrIdentityNotFound
+		)
+
+		if errors.As(err, &errInvalidPassword) {
+			return nil, gqlutils.Invalid(ctx, err)
+		}
+
+		if errors.As(err, &errIdentityNotFound) {
+			return nil, gqlutils.NotFound(ctx, err)
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot change password", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return &types.ChangePasswordPayload{
+		Success: true,
+	}, nil
+}
+
+// ChangeEmail is the resolver for the changeEmail field.
+func (r *mutationResolver) ChangeEmail(ctx context.Context, input types.ChangeEmailInput) (*types.ChangeEmailPayload, error) {
+	identity := authn.IdentityFromContext(ctx)
+
+	err := r.iam.AccountService.ChangeEmail(
+		ctx,
+		identity.ID,
+		&iam.ChangeEmailRequest{
+			NewEmail: input.NewEmail,
+			Password: input.Password,
+		},
+	)
+	if err != nil {
+		var (
+			errInvalidPassword  *iam.ErrInvalidPassword
+			errIdentityNotFound *iam.ErrIdentityNotFound
+		)
+
+		if errors.As(err, &errInvalidPassword) {
+			return nil, gqlutils.Invalid(ctx, err)
+		}
+
+		if errors.As(err, &errIdentityNotFound) {
+			return nil, gqlutils.NotFound(ctx, err)
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot change email", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return &types.ChangeEmailPayload{
+		Success: true,
+	}, nil
+}
+
+// AssumeOrganizationSession is the resolver for the assumeOrganizationSession field.
+func (r *mutationResolver) AssumeOrganizationSession(ctx context.Context, input types.AssumeOrganizationSessionInput) (*types.AssumeOrganizationSessionPayload, error) {
+	rootSession := authn.SessionFromContext(ctx)
+
+	childSession, membership, err := r.iam.SessionService.AssumeOrganizationSession(ctx, rootSession.ID, input.OrganizationID, input.Continue)
+	if err != nil {
+		var (
+			errMembershipNotFound             *iam.ErrMembershipNotFound
+			errPasswordAuthenticationRequired *iam.ErrPasswordAuthenticationRequired
+			errSAMLAuthenticationRequired     *iam.ErrSAMLAuthenticationRequired
+		)
+
+		switch {
+		case errors.As(err, &errMembershipNotFound):
+			return nil, gqlutils.NotFound(ctx, err)
+
+		case errors.As(err, &errPasswordAuthenticationRequired):
+			return &types.AssumeOrganizationSessionPayload{
+				Result: types.PasswordRequired{
+					Reason: types.ReauthenticationReason(errPasswordAuthenticationRequired.Reason),
+				},
+			}, nil
+
+		case errors.As(err, &errSAMLAuthenticationRequired):
+			return &types.AssumeOrganizationSessionPayload{
+				Result: types.SAMLAuthenticationRequired{
+					Reason: types.ReauthenticationReason(errSAMLAuthenticationRequired.Reason),
+				},
+			}, nil
+
+		default:
+			r.logger.ErrorCtx(ctx, "cannot assume organization session", log.Error(err))
+			return nil, gqlutils.Internal(ctx)
+		}
+	}
+
+	return &types.AssumeOrganizationSessionPayload{
+		Result: types.OrganizationSessionCreated{
+			Session:    types.NewSession(childSession),
+			Membership: types.NewMembership(membership),
+		},
+	}, nil
+}
+
+// RevokeSession is the resolver for the revokeSession field.
+func (r *mutationResolver) RevokeSession(ctx context.Context, input types.RevokeSessionInput) (*types.RevokeSessionPayload, error) {
+	if err := r.authorize(ctx, input.SessionID, iam.ActionSessionRevoke); err != nil {
+		return nil, err
+	}
+
+	identity := authn.IdentityFromContext(ctx)
+
+	err := r.iam.SessionService.RevokeSession(ctx, identity.ID, input.SessionID)
+	if err != nil {
+		var ErrSessionExpired *iam.ErrSessionExpired
+		if errors.As(err, &ErrSessionExpired) {
+			return &types.RevokeSessionPayload{Success: true}, nil
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot revoke session", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return &types.RevokeSessionPayload{Success: true}, nil
+}
+
+// RevokeAllSessions is the resolver for the revokeAllSessions field.
+func (r *mutationResolver) RevokeAllSessions(ctx context.Context) (*types.RevokeAllSessionsPayload, error) {
+	if err := r.authorize(ctx, authn.SessionFromContext(ctx).ID, iam.ActionSessionRevokeAll); err != nil {
+		return nil, err
+	}
+
+	session := authn.SessionFromContext(ctx)
+
+	revokedCount, err := r.iam.SessionService.RevokeAllSessions(ctx, session.ID)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot revoke all sessions", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return &types.RevokeAllSessionsPayload{RevokedCount: int(revokedCount)}, nil
+}
+
 // Identity is the resolver for the identity field.
 func (r *sessionResolver) Identity(ctx context.Context, obj *types.Session) (*types.Identity, error) {
 	if gqlutils.OnlyIDSelected(ctx) {