Make profile state filters multi-value

Address PR review feedback on the profile-state split: SAML sign-in now
activates a pending profile, deactivation counts owners against the
profile's own organization to close a last-owner bypass, the migration
leaves historical activated_at/deactivated_at NULL rather than
fabricating timestamps, and pending members are no longer rendered with
the deactivated (faded) styling.

Drop the single-value state filter in favor of the multi-value states
across the profile and signatory surfaces. Remove ProfileFilter.state
(only states[] remains) and convert the signatures profileState filter
to profileStates. Turn the console people filter, the CLI
"user list --state" flag, and the n8n listUsers and getAllSignatures
state inputs into multi-select controls, where an empty selection means
all states.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/server/api/connect/v1/graphql/profile.graphql

@@ -71,7 +71,6 @@ enum ProfileOrderField
 
 input ProfileFilter {
   contractEnded: Boolean
-  state: ProfileState
   states: [ProfileState!]
   query: String
   role: MembershipRole

pkg/server/api/connect/v1/identity_resolvers.go

@@ -36,10 +36,6 @@ func (r *identityResolver) Profiles(ctx context.Context, obj *types.Identity, fi
 			filters.WithStates(filter.States...)
 		}
 
-		if filter.State != nil {
-			filters.WithState(*filter.State)
-		}
-
 		if filter.Query != nil {
 			filters.WithQuery(filter.Query)
 		}

pkg/server/api/connect/v1/organization_resolvers.go

@@ -192,10 +192,6 @@ func (r *organizationResolver) Profiles(ctx context.Context, obj *types.Organiza
 			filters.WithStates(filter.States...)
 		}
 
-		if filter.State != nil {
-			filters.WithState(*filter.State)
-		}
-
 		if filter.Query != nil {
 			filters.WithQuery(filter.Query)
 		}

pkg/server/api/console/v1/document_resolvers.go

@@ -282,7 +282,7 @@ func (r *documentVersionResolver) Signatures(ctx context.Context, obj *types.Doc
 	var (
 		signatureStates []coredata.DocumentVersionSignatureState
 		activeContract  *bool
-		profileState    *coredata.ProfileState
+		profileStates   []coredata.ProfileState
 	)
 
 	if filter != nil {
@@ -294,12 +294,12 @@ func (r *documentVersionResolver) Signatures(ctx context.Context, obj *types.Doc
 			activeContract = filter.ActiveContract
 		}
 
-		if filter.ProfileState != nil {
-			profileState = filter.ProfileState
+		if filter.ProfileStates != nil {
+			profileStates = filter.ProfileStates
 		}
 	}
 
-	signatureFilter := coredata.NewDocumentVersionSignatureFilter(signatureStates, activeContract, profileState)
+	signatureFilter := coredata.NewDocumentVersionSignatureFilter(signatureStates, activeContract, profileStates)
 
 	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
 

pkg/server/api/console/v1/graphql/document.graphql

@@ -247,7 +247,7 @@ input DocumentVersionSignatureOrder {
 input DocumentVersionSignatureFilter {
     states: [DocumentVersionSignatureState!]
     activeContract: Boolean
-    profileState: ProfileState
+    profileStates: [ProfileState!]
 }
 
 input DocumentVersionApprovalQuorumOrder {

pkg/server/api/console/v1/graphql/organization.graphql

@@ -69,7 +69,6 @@ input ProfileOrder
 
 input ProfileFilter {
     contractEnded: Boolean
-    state: ProfileState
     states: [ProfileState!]
     query: String
     role: MembershipRole

pkg/server/api/console/v1/organization_resolvers.go

@@ -123,10 +123,6 @@ func (r *organizationResolver) Profiles(ctx context.Context, obj *types.Organiza
 			filters.WithStates(filter.States...)
 		}
 
-		if filter.State != nil {
-			filters.WithState(*filter.State)
-		}
-
 		if filter.Query != nil {
 			filters.WithQuery(filter.Query)
 		}

pkg/server/api/mcp/v1/schema.resolvers.go

@@ -2401,7 +2401,7 @@ func (r *Resolver) ListDocumentVersionSignaturesTool(ctx context.Context, req *m
 	var (
 		signatureStates []coredata.DocumentVersionSignatureState
 		activeContract  *bool
-		profileState    *coredata.ProfileState
+		profileStates   []coredata.ProfileState
 	)
 
 	if input.Filter != nil {
@@ -2413,12 +2413,12 @@ func (r *Resolver) ListDocumentVersionSignaturesTool(ctx context.Context, req *m
 			activeContract = input.Filter.ActiveContract
 		}
 
-		if input.Filter.ProfileState != nil {
-			profileState = input.Filter.ProfileState
+		if input.Filter.ProfileStates != nil {
+			profileStates = input.Filter.ProfileStates
 		}
 	}
 
-	signatureFilter := coredata.NewDocumentVersionSignatureFilter(signatureStates, activeContract, profileState)
+	signatureFilter := coredata.NewDocumentVersionSignatureFilter(signatureStates, activeContract, profileStates)
 
 	page, err := prb.Documents.ListSignatures(ctx, scope, input.DocumentVersionID, cursor, signatureFilter)
 	if err != nil {
@@ -2780,10 +2780,6 @@ func (r *Resolver) ListUsersTool(ctx context.Context, req *mcp.CallToolRequest,
 			filter.WithStates(input.Filter.States...)
 		}
 
-		if input.Filter.State != nil {
-			filter.WithState(*input.Filter.State)
-		}
-
 		if input.Filter.Query != nil {
 			filter.WithQuery(input.Filter.Query)
 		}

pkg/server/api/mcp/v1/specification.yaml

@@ -577,9 +577,6 @@ components:
             contract_ended:
               type: boolean
               description: Filter by contract status. True returns only users with ended contracts, false returns only users with active or no contract.
-            state:
-              $ref: "#/components/schemas/ProfileState"
-              description: Filter by profile state (PENDING, ACTIVE, or DEACTIVATED)
             states:
               type: array
               items:
@@ -6421,9 +6418,11 @@ components:
             active_contract:
               type: boolean
               description: Signatory contract status
-            profile_state:
-              $ref: "#/components/schemas/ProfileState"
-              description: Signatory profile state
+            profile_states:
+              type: array
+              items:
+                $ref: "#/components/schemas/ProfileState"
+              description: Signatory profile states
 
     ListDocumentVersionSignaturesOutput:
       type: object