chore(release): prepare for v0.6.0

Inject the build version into the binary using the CI_COMMIT 
argument for better traceability of deployments. Update the 
Dockerfile to pass the commit hash to the build process, 
ensuring that each build contains version information tied 
to the specific commit.

.gitignore

@@ -5,3 +5,5 @@ coverage.html
 /exported
 /release
 /schemactl
+CHANGES.md
+VERSION

.gitlab-ci.yml

@@ -1,22 +1,32 @@
 include:
 - template: 'Workflows/MergeRequest-Pipelines.gitlab-ci.yml'
+- project: unboundsoftware/ci-templates
+  file: Defaults.gitlab-ci.yml
+- project: unboundsoftware/ci-templates
+  file: Release.gitlab-ci.yml
+- project: unboundsoftware/ci-templates
+  file: Pre-Commit-Go.gitlab-ci.yml
 
 stages:
 - build
+- test
 - deploy-prod
 - release
 
 variables:
-  DOCKER_HOST: tcp://docker:2376
-  DOCKER_TLS_CERTDIR: "/certs"
-  DOCKER_TLS_VERIFY: 1
-  DOCKER_CERT_PATH: "$DOCKER_TLS_CERTDIR/client"
-  DOCKER_DRIVER: overlay2
+  UNBOUND_RELEASE_TAG_ONLY: true
 
 .buildtools:
   image: buildtool/build-tools:${BUILDTOOLS_VERSION}
-  services:
-  - docker:dind
+
+check:
+  stage: .pre
+  image: amd64/golang:1.24.4@sha256:3494bbe140127d12656113203ec91b8e3ff34e8a2b06a0a22bb0d8a41cc69e53
+  script:
+  - go install mvdan.cc/gofumpt@latest
+  - go install golang.org/x/tools/cmd/goimports@latest
+  - go generate ./...
+  - git diff --stat  --exit-code
 
 build:
   extends: .buildtools
@@ -30,7 +40,7 @@ build:
 
 vulnerabilities:
   stage: build
-  image: golang:1.19.2
+  image: amd64/golang:1.24.4@sha256:3494bbe140127d12656113203ec91b8e3ff34e8a2b06a0a22bb0d8a41cc69e53
   script:
   - go install golang.org/x/vuln/cmd/govulncheck@latest
   - govulncheck ./...
@@ -46,31 +56,34 @@ deploy-prod:
   - if: $CI_COMMIT_BRANCH == "main"
   environment:
     name: prod
+  resource_group: prod
+
+check_release:
+  stage: test
+  image:
+    name: goreleaser/goreleaser:v2.10.2@sha256:ebc884882268c835edd70c628dbdf830481ae23a569b343cd7d7b178c91573ac
+    entrypoint: [ '' ]
+  variables:
+    GOTOOLCHAIN: auto
+  script: |
+    goreleaser check
+    goreleaser release --snapshot --clean
 
 release:
   stage: release
-  image: docker:stable
-  services:
-  - docker:dind
-
+  needs:
+  - unbound_release_prepare_release
+  image:
+    name: goreleaser/goreleaser:v2.10.2@sha256:ebc884882268c835edd70c628dbdf830481ae23a569b343cd7d7b178c91573ac
+    entrypoint: [ '' ]
   variables:
-    GORELEASER_IMAGE: goreleaser/goreleaser:v1.11.5-amd64
     # Disable shallow cloning so that goreleaser can diff between tags to
     # generate a changelog.
     GIT_DEPTH: 0
-
+    GITLAB_TOKEN: $GITLAB_CI_TOKEN
+    GOTOOLCHAIN: auto
   # Only run this release job for tags, not every commit (for example).
   rules:
   - if: $CI_COMMIT_TAG
-
   script: |
-    docker pull $GORELEASER_IMAGE
-
-    # GITLAB_TOKEN is needed to create GitLab releases.
-    # DOCKER_* are needed to push Docker images.
-    docker run --rm --privileged \
-      -v $PWD:/src \
-      -w /src \
-      -v /var/run/docker.sock:/var/run/docker.sock \
-      -e GITLAB_TOKEN \
-      $GORELEASER_IMAGE release --rm-dist
+    goreleaser release --clean --release-notes=CHANGES.md

.golangci.yml

@@ -0,0 +1,22 @@
+version: "2"
+run:
+  allow-parallel-runners: true
+linters:
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

.goreleaser.yml

@@ -1,4 +1,5 @@
 project_name: unbound-schemas
+version: 2
 
 env:
 - CGO_ENABLED=0
@@ -15,33 +16,33 @@ builds:
   - amd64
   - arm64
 
-brews:
+homebrew_casks:
 - name: unbound-schemas
-  tap:
+  repository:
     owner: unboundsoftware
     name: homebrew-taps
-  folder: Formula
-  install: |
-    bin.install "schemactl"
+  binary: schemactl
+  directory: Casks
+  conflicts:
+    - formula: unbound-schemas
   commit_author:
     name: "Joakim Olsson"
     email: joakim@unbound.se
   homepage: "https://schemas.unbound.se/"
+  hooks:
+    post:
+      install: |
+        # replace foo with the actual binary name
+        system_command "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "#{staged_path}/schemactl"]
 
 archives:
 - id: unbound-schemas
-  replacements:
-    darwin: Darwin
-    linux: Linux
-    windows: Windows
-    386: i386
-    amd64: x86_64
 
 checksum:
   name_template: 'checksums.txt'
 
 snapshot:
-  name_template: "{{ .Tag }}-next"
+  version_template: "{{ .Tag }}-next"
 
 changelog:
   sort: asc

.pre-commit-config.yaml

@@ -2,7 +2,7 @@
 # See https://pre-commit.com/hooks.html for more hooks
 repos:
 - repo: https://github.com/pre-commit/pre-commit-hooks
-  rev: v4.3.0
+  rev: v5.0.0
   hooks:
   - id: trailing-whitespace
   - id: end-of-file-fixer
@@ -10,27 +10,38 @@ repos:
     args:
     - --allow-multiple-documents
   - id: check-added-large-files
-- repo: https://github.com/jumanjihouse/pre-commit-hooks
-  rev: 3.0.0
-  hooks:
-  - id: markdownlint
 - repo: https://gitlab.com/devopshq/gitlab-ci-linter
-  rev: v1.0.3
+  rev: v1.0.6
   hooks:
   - id: gitlab-ci-linter
+    args:
+    - --project
+    - unboundsoftware/schemas
 - repo: https://github.com/alessandrojcm/commitlint-pre-commit-hook
-  rev: v9.1.0
+  rev: v9.22.0
   hooks:
   - id: commitlint
     stages: [ commit-msg ]
     additional_dependencies: [ '@commitlint/config-conventional' ]
-- repo: https://github.com/lietu/go-pre-commit
-  rev: v0.0.1
+- repo: https://github.com/dnephin/pre-commit-golang
+  rev: v0.5.1
+  hooks:
+  - id: go-mod-tidy
+  - id: go-imports
+    args:
+    - -local
+    - gitlab.com/unboundsoftware/schemas
+- repo: https://github.com/lietu/go-pre-commit
+  rev: v0.1.0
   hooks:
-  - id: errcheck
-  - id: go-fmt-goimports
   - id: go-test
-  - id: go-vet
-  - id: golangci-lint
   - id: gofumpt
-  - id: staticcheck
+- repo: https://github.com/golangci/golangci-lint
+  rev: v2.2.0
+  hooks:
+  - id: golangci-lint-full
+- repo: https://github.com/gitleaks/gitleaks
+  rev: v8.27.2
+  hooks:
+  - id: gitleaks
+exclude: '^ctl/generated.go|graph/generated/.*$|^graph/model/models_gen.go|^tools/.*$$'

CHANGELOG.md

@@ -0,0 +1,381 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+## [0.6.0] - 2025-06-29
+
+### 🚀 Features
+
+- *(k8s)* Add OpenTelemetry exporter endpoint to deploy.yaml
+- Add build version injection via CI_COMMIT argument
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.190
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.28
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.75
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.192
+- *(deps)* Update module github.com/alecthomas/kong to v1.12.0
+- *(deps)* Update opentelemetry-go monorepo
+- *(deps)* Update module go.opentelemetry.io/contrib/bridges/otelslog to v0.12.0
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.29
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.194
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.30
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.76
+
+## [0.5.3] - 2025-06-13
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.187
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.188
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.189
+
+### 🚜 Refactor
+
+- Remove Sentry integration and replace with OpenTelemetry
+
+## [0.5.2] - 2025-06-09
+
+### 🐛 Bug Fixes
+
+- *(goreleaser)* Specify binary name in configuration
+
+## [0.5.1] - 2025-06-09
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update module github.com/alecthomas/kong to v1.11.0
+- *(deps)* Update module github.com/getsentry/sentry-go to v0.33.0
+- *(deps)* Update module github.com/khan/genqlient to v0.8.1
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.179
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.180
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.181
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.182
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.183
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.74
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.184
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.185
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.186
+
+## [0.5.0] - 2025-05-15
+
+### 🚀 Features
+
+- *(k8s)* Add PodDisruptionBudget for schemas service
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.26
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.173
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.174
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.175
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.176
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.73
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.177
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.178
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.24.3
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.27
+- *(k8s)* Update apiVersion for external secrets
+
+### ⚙️ Miscellaneous Tasks
+
+- *(ci)* Update GitLab CI configuration for templates
+
+## [0.4.1] - 2025-04-24
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.25
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.170
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.71
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.72
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.171
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.172
+
+## [0.4.0] - 2025-04-12
+
+### 🚀 Features
+
+- *(service)* Implement graceful shutdown for HTTP server
+
+### 🐛 Bug Fixes
+
+- *(secrets)* Remove namespace from ExternalSecret definition
+- *(deps)* Update module github.com/sparetimecoders/goamqp to v0.3.2
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.24
+- *(deps)* Update module github.com/getsentry/sentry-go to v0.32.0
+- *(k8s)* Increase CPU request for better performance
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/amqp to v1.8.1
+
+### 🚜 Refactor
+
+- *(deploy)* Remove cpu and memory limits for schemas
+
+## [0.3.0] - 2025-04-08
+
+### 🚀 Features
+
+- *(k8s)* Add RabbitMQ configurations and update secrets
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.161
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.162
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.163
+- *(deps)* Update module github.com/auth0/go-jwt-middleware/v2 to v2.3.0
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/eventsourced to v1.18.0
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/eventsourced to v1.18.1
+- *(deps)* Update module github.com/alecthomas/kong to v1.9.0
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.164
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.165
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.68
+- *(deps)* Update module github.com/golang-jwt/jwt/v5 to v5.2.2
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.166
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/eventsourced to v1.19.0
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.69
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.70
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.167
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/eventsourced to v1.19.1
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.24.2
+- *(deps)* Update module github.com/alecthomas/kong to v1.10.0
+- *(deps)* Update eventsourced
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.168
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.169
+
+## [0.2.0] - 2025-02-28
+
+### 🚀 Features
+
+- *(dependencies)* Add Eventsourced package group for updates
+- *(sdlmerge)* Add shared types for GraphQL schema handling
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.64
+- *(deps)* Update module github.com/alecthomas/kong to v1.7.0
+- *(deps)* Update module github.com/khan/genqlient to v0.8.0
+- *(deps)* Update module github.com/alecthomas/kong to v1.8.0
+- *(ci)* Update golang image to improve compatibility
+- *(ci)* Add resource group to production deployment configuration
+- *(deps)* Update module github.com/alecthomas/kong to v1.8.1
+- *(deps)* Update dependencies to latest versions
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.65
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.66
+- *(deps)* Update eventsourced
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.23
+
+### ⚙️ Miscellaneous Tasks
+
+- *(go)* Update go version to 1.23.6 and remove toolchain
+- *(docker)* Update base image architecture to amd64
+
+## [0.1.1] - 2025-01-24
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update module github.com/getsentry/sentry-go to v0.31.0
+- *(deps)* Update module github.com/getsentry/sentry-go to v0.31.1
+- *(deps)* Update module github.com/alecthomas/kong to v1.6.1
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.24.1
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.63
+- *(k8s)* Standardize app label to app.kubernetes.io/name
+
+## [0.1.0] - 2025-01-01
+
+### 🚀 Features
+
+- Add timeout configuration to golangci-lint
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update module github.com/alecthomas/kong to v1.3.0
+- No digest pinning of own image
+- *(deps)* Update module github.com/alecthomas/kong to v1.4.0
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.19
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.56
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.23.0
+- *(deps)* Update module github.com/stretchr/testify to v1.10.0
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.57
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.20
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/eventsourced to v1.16.0
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/amqp to v1.7.0
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/pg to v1.15.0
+- *(deps)* Update module github.com/alecthomas/kong to v1.5.0
+- *(deps)* Update module github.com/alecthomas/kong to v1.5.1
+- *(deps)* Update module github.com/getsentry/sentry-go to v0.30.0
+- *(deps)* Update module github.com/alecthomas/kong to v1.6.0
+- *(k8s)* Adjust CPU requests for better resource allocation
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.58
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.59
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.60
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.23.1
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.24.0
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.61
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.21
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.62
+
+### 🚜 Refactor
+
+- Use common pre-commit job
+
+### ⚙️ Miscellaneous Tasks
+
+- Remove unnecessary Docker variables from configuration
+- *(ci)* Remove unused docker service from buildtools
+
+## [0.0.7] - 2024-10-22
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.20.0
+- *(deps)* Update module github.com/jmoiron/sqlx to v1.4.0
+- *(deps)* Update module github.com/rs/cors to v1.11.0
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.46
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.12
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.47
+- *(deps)* Update module github.com/getsentry/sentry-go to v0.28.0
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.48
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.16
+- *(deps)* Update module github.com/getsentry/sentry-go to v0.28.1
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools to v1.67.3
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.49
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.21.0
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.21.1
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools to v1.67.4
+- *(deps)* Update module github.com/sparetimecoders/goamqp to v0.3.1
+- *(deps)* Update module github.com/auth0/go-jwt-middleware/v2 to v2.2.2
+- *(deps)* Update module github.com/rs/cors to v1.11.1
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.22.0
+- *(deps)* Update module github.com/getsentry/sentry-go to v0.29.0
+- *(deps)* Update module github.com/alecthomas/kong to v1
+- *(deps)* Update module github.com/alecthomas/kong to v1.2.1
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.50
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.51
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.52
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.22.1
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.53
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.54
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.17
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.55
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/amqp to v1.6.5
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/eventsourced to v1.15.0
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/pg to v1.14.4
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/amqp to v1.6.6
+- *(deps)* Update module github.com/getsentry/sentry-go to v0.29.1
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.18
+
+### ⚙️ Miscellaneous Tasks
+
+- Update golangci-lint hook identifier in pre-commit config
+- Update goreleaser image to v2.3.1
+- Add generate check
+- Add release notes for goreleaser command in .gitlab-ci.yml
+
+## [0.0.6] - 2024-04-04
+
+### 🐛 Bug Fixes
+
+- Don't set fixed global_sequence_no
+
+### ⚙️ Miscellaneous Tasks
+
+- Add step for checking release
+
+## [0.0.5] - 2024-04-03
+
+### 🚀 Features
+
+- Add full SDL to SupGraph response
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update module github.com/stretchr/testify to v1.9.0
+- *(deps)* Update module github.com/golang-jwt/jwt/v4 to v5
+- Update default migrations
+- *(deps)* Update module github.com/golang-jwt/jwt/v5 to v5.2.1
+- *(deps)* Update module github.com/khan/genqlient to v0.7.0
+- *(deps)* Update module github.com/alecthomas/kong to v0.9.0
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.19.1
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.45
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.19.2
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/pg to v1.14.0
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/pg to v1.14.3
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools to v1.67.2
+
+### ⚙️ Miscellaneous Tasks
+
+- Update golangci-lint
+- Update Go version for vulnerabilities
+- Update to Go 1.20.7
+- Update to Golang 1.21.0 for vulnerabilities
+- Update pre-commit versions
+- Update to Go 1.21.1 for vulnerabilities
+- Use OrbStack for local dev
+- Add gitleaks to pre-commit setup
+- Update resources
+- Run release on medium instance
+- Back to small and upgrade goreleaser
+- Remove deprecated replacements
+
+## [0.0.4] - 2023-05-29
+
+### 🐛 Bug Fixes
+
+- Explicitly set dialect to make goose use correct version table
+
+### ⚙️ Miscellaneous Tasks
+
+- Update Go version for vulnerabilities
+- Update pre-commit and fix golangci-lint
+- Actually validate API key privileges and refs
+
+## [0.0.3] - 2023-04-27
+
+### 🚀 Features
+
+- Add Sentry setup
+- Add Sentry setup
+- Organizations and API keys
+
+### 🐛 Bug Fixes
+
+- Use correct healthcheck path
+
+### ⚙️ Miscellaneous Tasks
+
+- Update schema if URLs have changed
+- Add pre-commit and remove those checks from Dockerfile
+- Add context and error handling
+- Move to default ingress group
+- Decrease trace sample rate
+- Improve docker caching
+- Add local module to pre-commit config
+- Only ignore generated files with do not edit
+- Default ingress group
+- Use Docker DinD version from variable
+- Switch to manual rebases for Dependabot
+- Update to golang 1.20.1
+- Update Go verion for vulnerabilities scan
+- Reduce sample rate
+- Update to Go 1.20.3
+- Fix Gitlab CI lint
+
+## [0.0.2] - 2022-10-14
+
+### ⚙️ Miscellaneous Tasks
+
+- Add docker ignore
+- Handle push of unchanged schema
+
+## [0.0.1] - 2022-10-09
+
+### 🚀 Features
+
+- Initial commit
+
+### 🐛 Bug Fixes
+
+- Remove GITLAB_TOKEN
+
+<!-- generated by git-cliff -->

Dockerfile

@@ -1,12 +1,15 @@
-FROM golang:1.19.2 as build
+FROM amd64/golang:1.24.4@sha256:3494bbe140127d12656113203ec91b8e3ff34e8a2b06a0a22bb0d8a41cc69e53 as modules
+WORKDIR /build
+ADD go.* /build
+RUN go mod download
+
+FROM modules as build
+ARG CI_COMMIT
 WORKDIR /build
 ENV CGO_ENABLED=0
 ADD . /build
-RUN if [ $(go mod tidy -v 2>&1 | grep -c unused) != 0 ]; then echo "Unused modules, please run 'go mod tidy'"; exit 1; fi
-RUN go fmt ./...
-RUN go vet ./...
 RUN CGO_ENABLED=1 go test -mod=readonly -race -coverprofile=coverage.txt.tmp -covermode=atomic -coverpkg=$(go list ./... | tr '\n' , | sed 's/,$//') ./...
-RUN ["/bin/bash", "-c", "cat coverage.txt.tmp | grep -v testing.go | grep -v -f <(find . -type f | xargs grep -l 'Code generated') > coverage.txt"]
+RUN ["/bin/bash", "-c", "cat coverage.txt.tmp | grep -v testing.go | grep -v -f <(find . -type f | xargs grep -l 'Code generated by github.com/99designs/gqlgen, DO NOT EDIT') > coverage.txt"]
 RUN go tool cover -html=coverage.txt -o coverage.html
 RUN go tool cover -func=coverage.txt
 RUN rm coverage.txt.tmp
@@ -15,7 +18,7 @@ RUN GOOS=linux GOARCH=amd64 go build \
         -a -installsuffix cgo \
         -mod=readonly \
         -o /release/service \
-         -ldflags '-w -s' \
+        -ldflags "-w -s -X main.buildVersion=${CI_COMMIT}" \
          ./cmd/service/service.go
 
 FROM scratch as export

cache/cache.go

@@ -2,64 +2,144 @@ package cache
 
 import (
 	"fmt"
+	"log/slog"
 	"time"
 
-	"github.com/apex/log"
 	"github.com/sparetimecoders/goamqp"
 
 	"gitlab.com/unboundsoftware/schemas/domain"
+	"gitlab.com/unboundsoftware/schemas/hash"
 )
 
-const subGraphKey = "%s<->%s"
-
 type Cache struct {
-	services   map[string]map[string]struct{}
-	subGraphs  map[string]string
-	lastUpdate map[string]string
-	logger     log.Interface
+	organizations map[string]domain.Organization
+	users         map[string][]string
+	apiKeys       map[string]domain.APIKey
+	services      map[string]map[string]map[string]struct{}
+	subGraphs     map[string]string
+	lastUpdate    map[string]string
+	logger        *slog.Logger
 }
 
-func (c *Cache) Services(ref, lastUpdate string) ([]string, string) {
+func (c *Cache) OrganizationByAPIKey(apiKey string) *domain.Organization {
+	key, exists := c.apiKeys[apiKey]
+	if !exists {
+		return nil
+	}
+	org, exists := c.organizations[key.OrganizationId]
+	if !exists {
+		return nil
+	}
+	return &org
+}
+
+func (c *Cache) OrganizationsByUser(sub string) []domain.Organization {
+	orgIds := c.users[sub]
+	orgs := make([]domain.Organization, len(orgIds))
+	for i, id := range orgIds {
+		orgs[i] = c.organizations[id]
+	}
+	return orgs
+}
+
+func (c *Cache) ApiKeyByKey(key string) *domain.APIKey {
+	k, exists := c.apiKeys[hash.String(key)]
+	if !exists {
+		return nil
+	}
+	return &k
+}
+
+func (c *Cache) Services(orgId, ref, lastUpdate string) ([]string, string) {
+	key := refKey(orgId, ref)
 	var services []string
-	if lastUpdate == "" || c.lastUpdate[ref] > lastUpdate {
-		for k := range c.services[ref] {
+	if lastUpdate == "" || c.lastUpdate[key] > lastUpdate {
+		for k := range c.services[orgId][ref] {
 			services = append(services, k)
 		}
 	}
-	return services, c.lastUpdate[ref]
+	return services, c.lastUpdate[key]
 }
 
-func (c *Cache) SubGraphId(ref, service string) string {
-	return c.subGraphs[fmt.Sprintf(subGraphKey, ref, service)]
+func (c *Cache) SubGraphId(orgId, ref, service string) string {
+	return c.subGraphs[subGraphKey(orgId, ref, service)]
 }
 
 func (c *Cache) Update(msg any, _ goamqp.Headers) (any, error) {
 	switch m := msg.(type) {
+	case *domain.OrganizationAdded:
+		o := domain.Organization{}
+		m.UpdateOrganization(&o)
+		c.organizations[m.ID.String()] = o
+		c.addUser(m.Initiator, o)
+	case *domain.APIKeyAdded:
+		key := domain.APIKey{
+			Name:           m.Name,
+			OrganizationId: m.OrganizationId,
+			Key:            m.Key,
+			Refs:           m.Refs,
+			Read:           m.Read,
+			Publish:        m.Publish,
+			CreatedBy:      m.Initiator,
+			CreatedAt:      m.When(),
+		}
+		c.apiKeys[m.Key] = key
+		org := c.organizations[m.OrganizationId]
+		org.APIKeys = append(org.APIKeys, key)
+		c.organizations[m.OrganizationId] = org
 	case *domain.SubGraphUpdated:
-		if _, exists := c.services[m.Ref]; !exists {
-			c.services[m.Ref] = make(map[string]struct{})
+		c.updateSubGraph(m.OrganizationId, m.Ref, m.ID.String(), m.Service, m.Time)
+	case *domain.Organization:
+		c.organizations[m.ID.String()] = *m
+		c.addUser(m.CreatedBy, *m)
+		for _, k := range m.APIKeys {
+			c.apiKeys[k.Key] = k
 		}
-		c.services[m.Ref][m.ID.String()] = struct{}{}
-		c.subGraphs[fmt.Sprintf(subGraphKey, m.Ref, m.Service)] = m.ID.String()
-		c.lastUpdate[m.Ref] = m.Time.Format(time.RFC3339Nano)
 	case *domain.SubGraph:
-		if _, exists := c.services[m.Ref]; !exists {
-			c.services[m.Ref] = make(map[string]struct{})
-		}
-		c.services[m.Ref][m.ID.String()] = struct{}{}
-		c.subGraphs[fmt.Sprintf(subGraphKey, m.Ref, m.Service)] = m.ID.String()
-		c.lastUpdate[m.Ref] = m.ChangedAt.Format(time.RFC3339Nano)
+		c.updateSubGraph(m.OrganizationId, m.Ref, m.ID.String(), m.Service, m.ChangedAt)
 	default:
-		c.logger.Warnf("unexpected message received: %+v", msg)
+		c.logger.With("msg", msg).Warn("unexpected message received")
 	}
 	return nil, nil
 }
 
-func New(logger log.Interface) *Cache {
-	return &Cache{
-		subGraphs:  make(map[string]string),
-		services:   make(map[string]map[string]struct{}),
-		lastUpdate: make(map[string]string),
-		logger:     logger,
+func (c *Cache) updateSubGraph(orgId string, ref string, subGraphId string, service string, updated time.Time) {
+	if _, exists := c.services[orgId]; !exists {
+		c.services[orgId] = make(map[string]map[string]struct{})
+	}
+	if _, exists := c.services[orgId][ref]; !exists {
+		c.services[orgId][ref] = make(map[string]struct{})
+	}
+	c.services[orgId][ref][subGraphId] = struct{}{}
+	c.subGraphs[subGraphKey(orgId, ref, service)] = subGraphId
+	c.lastUpdate[refKey(orgId, ref)] = updated.Format(time.RFC3339Nano)
+}
+
+func (c *Cache) addUser(sub string, organization domain.Organization) {
+	user, exists := c.users[sub]
+	if !exists {
+		c.users[sub] = []string{organization.ID.String()}
+	} else {
+		c.users[sub] = append(user, organization.ID.String())
 	}
 }
+
+func New(logger *slog.Logger) *Cache {
+	return &Cache{
+		organizations: make(map[string]domain.Organization),
+		users:         make(map[string][]string),
+		apiKeys:       make(map[string]domain.APIKey),
+		services:      make(map[string]map[string]map[string]struct{}),
+		subGraphs:     make(map[string]string),
+		lastUpdate:    make(map[string]string),
+		logger:        logger,
+	}
+}
+
+func refKey(orgId string, ref string) string {
+	return fmt.Sprintf("%s<->%s", orgId, ref)
+}
+
+func subGraphKey(orgId string, ref string, service string) string {
+	return fmt.Sprintf("%s<->%s<->%s", orgId, ref, service)
+}

cmd/service/service.go

@@ -2,22 +2,26 @@ package main
 
 import (
 	"context"
+	"errors"
 	"fmt"
+	"log/slog"
 	"net/http"
 	"os"
 	"os/signal"
 	"reflect"
 	"sync"
 	"syscall"
+	"time"
 
 	"github.com/99designs/gqlgen/graphql/handler"
+	"github.com/99designs/gqlgen/graphql/handler/extension"
+	"github.com/99designs/gqlgen/graphql/handler/lru"
+	"github.com/99designs/gqlgen/graphql/handler/transport"
 	"github.com/99designs/gqlgen/graphql/playground"
 	"github.com/alecthomas/kong"
-	"github.com/apex/log"
-	"github.com/apex/log/handlers/json"
-	sentryhttp "github.com/getsentry/sentry-go/http"
 	"github.com/rs/cors"
 	"github.com/sparetimecoders/goamqp"
+	"github.com/vektah/gqlparser/v2/ast"
 	"gitlab.com/unboundsoftware/eventsourced/amqp"
 	"gitlab.com/unboundsoftware/eventsourced/eventsourced"
 	"gitlab.com/unboundsoftware/eventsourced/pg"
@@ -26,93 +30,108 @@ import (
 	"gitlab.com/unboundsoftware/schemas/domain"
 	"gitlab.com/unboundsoftware/schemas/graph"
 	"gitlab.com/unboundsoftware/schemas/graph/generated"
+	"gitlab.com/unboundsoftware/schemas/logging"
 	"gitlab.com/unboundsoftware/schemas/middleware"
+	"gitlab.com/unboundsoftware/schemas/monitoring"
 	"gitlab.com/unboundsoftware/schemas/store"
 )
 
-var CLI struct {
-	AmqpURL            string `name:"amqp-url" env:"AMQP_URL" help:"URL to use to connect to RabbitMQ" default:"amqp://user:password@localhost:5672/"`
+type CLI struct {
+	AmqpURL            string `name:"amqp-url" env:"AMQP_URL" help:"URL to use to connect to RabbitMQ" default:"amqp://user:password@unbound-control-plane.orb.local:5672/"`
 	Port               int    `name:"port" env:"PORT" help:"Listen-port for GraphQL API" default:"8080"`
-	APIKey             string `name:"api-key" env:"API_KEY" help:"The API-key that is required"`
 	LogLevel           string `name:"log-level" env:"LOG_LEVEL" help:"The level of logging to use (debug, info, warn, error, fatal)" default:"info"`
-	DatabaseURL        string `name:"postgres-url" env:"POSTGRES_URL" help:"URL to use to connect to Postgres" default:"postgres://postgres:postgres@:5432/schemas?sslmode=disable"`
+	LogFormat          string `name:"log-format" env:"LOG_FORMAT" help:"The format of logs" default:"text" enum:"otel,json,text"`
+	DatabaseURL        string `name:"postgres-url" env:"POSTGRES_URL" help:"URL to use to connect to Postgres" default:"postgres://postgres:postgres@unbound-control-plane.orb.local:5432/schemas?sslmode=disable"`
 	DatabaseDriverName string `name:"db-driver" env:"DB_DRIVER" help:"Driver to use to connect to db" default:"postgres"`
+	Issuer             string `name:"issuer" env:"ISSUER" help:"The JWT token issuer to use" default:"unbound.eu.auth0.com"`
+	StrictSSL          bool   `name:"strict-ssl" env:"STRICT_SSL" help:"Should strict SSL handling be enabled" default:"true"`
+	Environment        string `name:"environment" env:"ENVIRONMENT" help:"The environment we are running in" default:"development" enum:"development,staging,production"`
 }
 
+var buildVersion = "none"
+
 const serviceName = "schemas"
 
 func main() {
-	_ = kong.Parse(&CLI)
-	log.SetHandler(json.New(os.Stdout))
-	log.SetLevelFromString(CLI.LogLevel)
-	logger := log.WithField("service", serviceName)
+	var cli CLI
+	_ = kong.Parse(&cli)
+	logger := logging.SetupLogger(cli.LogLevel, cli.LogFormat, serviceName, buildVersion)
 	closeEvents := make(chan error)
 
 	if err := start(
 		closeEvents,
 		logger,
 		ConnectAMQP,
+		cli,
 	); err != nil {
-		logger.WithError(err).Error("process error")
+		logger.With("error", err).Error("process error")
 	}
 }
 
-func start(closeEvents chan error, logger *log.Entry, connectToAmqpFunc func(url string) (Connection, error)) error {
+func start(closeEvents chan error, logger *slog.Logger, connectToAmqpFunc func(url string) (Connection, error), cli CLI) error {
 	rootCtx, rootCancel := context.WithCancel(context.Background())
 	defer rootCancel()
 
-	db, err := store.SetupDB(CLI.DatabaseDriverName, CLI.DatabaseURL)
+	shutdownFn, err := monitoring.SetupOTelSDK(rootCtx, cli.LogFormat == "otel", serviceName, buildVersion, cli.Environment)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		_ = errors.Join(shutdownFn(context.Background()))
+	}()
+
+	db, err := store.SetupDB(cli.DatabaseDriverName, cli.DatabaseURL)
 	if err != nil {
 		return fmt.Errorf("failed to setup DB: %v", err)
 	}
 
 	eventStore, err := pg.New(
+		rootCtx,
 		db.DB,
 		pg.WithEventTypes(
 			&domain.SubGraphUpdated{},
+			&domain.OrganizationAdded{},
+			&domain.APIKeyAdded{},
 		),
 	)
 	if err != nil {
 		return fmt.Errorf("failed to create eventstore: %v", err)
 	}
-	eventPublisher, err := goamqp.NewPublisher(
-		goamqp.Route{
-			Type: domain.SubGraphUpdated{},
-			Key:  "SubGraph.Updated",
-		},
-	)
+
+	if err := store.RunEventStoreMigrations(db); err != nil {
+		return fmt.Errorf("event migrations: %w", err)
+	}
+
+	publisher := goamqp.NewPublisher()
+	eventPublisher, err := amqp.New(publisher)
 	if err != nil {
 		return fmt.Errorf("failed to create event publisher: %v", err)
 	}
-	amqp.New(eventPublisher)
-	conn, err := connectToAmqpFunc(CLI.AmqpURL)
+	conn, err := connectToAmqpFunc(cli.AmqpURL)
 	if err != nil {
 		return fmt.Errorf("failed to connect to AMQP: %v", err)
 	}
 
 	serviceCache := cache.New(logger)
-	roots, err := eventStore.GetAggregateRoots(reflect.TypeOf(domain.SubGraph{}))
-	if err != nil {
-		return err
+	if err := loadOrganizations(rootCtx, eventStore, serviceCache); err != nil {
+		return fmt.Errorf("caching organizations: %w", err)
 	}
-	for _, root := range roots {
-		subGraph := &domain.SubGraph{BaseAggregate: eventsourced.BaseAggregateFromString(root.String())}
-		if _, err := eventsourced.NewHandler(subGraph, eventStore); err != nil {
-			return err
-		}
-		_, err := serviceCache.Update(subGraph, nil)
-		if err != nil {
-			return err
-		}
+	if err := loadSubGraphs(rootCtx, eventStore, serviceCache); err != nil {
+		return fmt.Errorf("caching subgraphs: %w", err)
 	}
 	setups := []goamqp.Setup{
-		goamqp.UseLogger(logger.Errorf),
+		goamqp.UseLogger(func(s string) { logger.Error(s) }),
 		goamqp.CloseListener(closeEvents),
 		goamqp.WithPrefetchLimit(20),
-		goamqp.EventStreamPublisher(eventPublisher),
+		goamqp.EventStreamPublisher(publisher),
 		goamqp.TransientEventStreamConsumer("SubGraph.Updated", serviceCache.Update, domain.SubGraphUpdated{}),
+		goamqp.TransientEventStreamConsumer("Organization.Added", serviceCache.Update, domain.OrganizationAdded{}),
+		goamqp.TransientEventStreamConsumer("Organization.APIKeyAdded", serviceCache.Update, domain.APIKeyAdded{}),
+		goamqp.WithTypeMapping("SubGraph.Updated", domain.SubGraphUpdated{}),
+		goamqp.WithTypeMapping("Organization.Added", domain.OrganizationAdded{}),
+		goamqp.WithTypeMapping("Organization.APIKeyAdded", domain.APIKeyAdded{}),
 	}
-	if err := conn.Start(setups...); err != nil {
+	if err := conn.Start(rootCtx, setups...); err != nil {
 		return fmt.Errorf("failed to setup AMQP: %v", err)
 	}
 
@@ -121,7 +140,7 @@ func start(closeEvents chan error, logger *log.Entry, connectToAmqpFunc func(url
 	logger.Info("Started")
 
 	mux := http.NewServeMux()
-	httpSrv := &http.Server{Addr: fmt.Sprintf(":%d", CLI.Port), Handler: mux}
+	httpSrv := &http.Server{Addr: fmt.Sprintf(":%d", cli.Port), Handler: mux}
 
 	wg := sync.WaitGroup{}
 
@@ -147,7 +166,7 @@ func start(closeEvents chan error, logger *log.Entry, connectToAmqpFunc func(url
 		defer wg.Done()
 		err := <-closeEvents
 		if err != nil {
-			logger.WithError(err).Error("received close from AMQP")
+			logger.With("error", err).Error("received close from AMQP")
 			rootCancel()
 		}
 	}()
@@ -157,8 +176,11 @@ func start(closeEvents chan error, logger *log.Entry, connectToAmqpFunc func(url
 		defer wg.Done()
 		<-rootCtx.Done()
 
-		if err := httpSrv.Close(); err != nil {
-			logger.WithError(err).Error("close http server")
+		shutdownCtx, shutdownRelease := context.WithTimeout(context.Background(), 10*time.Second)
+		defer shutdownRelease()
+
+		if err := httpSrv.Shutdown(shutdownCtx); err != nil {
+			logger.With("error", err).Error("close http server")
 		}
 		close(sigint)
 		close(closeEvents)
@@ -170,7 +192,7 @@ func start(closeEvents chan error, logger *log.Entry, connectToAmqpFunc func(url
 
 		resolver := &graph.Resolver{
 			EventStore: eventStore,
-			Publisher:  amqp.New(eventPublisher),
+			Publisher:  eventPublisher,
 			Logger:     logger,
 			Cache:      serviceCache,
 		}
@@ -179,21 +201,43 @@ func start(closeEvents chan error, logger *log.Entry, connectToAmqpFunc func(url
 			Resolvers:  resolver,
 			Complexity: generated.ComplexityRoot{},
 		}
-		apiKeyMiddleware := middleware.NewApiKey(CLI.APIKey, logger)
-		config.Directives.HasApiKey = apiKeyMiddleware.Directive
-		srv := handler.NewDefaultServer(generated.NewExecutableSchema(
-			config,
+		apiKeyMiddleware := middleware.NewApiKey()
+		mw := middleware.NewAuth0("https://schemas.unbound.se", cli.Issuer, cli.StrictSSL)
+		authMiddleware := middleware.NewAuth(serviceCache)
+		config.Directives.Auth = authMiddleware.Directive
+		srv := handler.New(generated.NewExecutableSchema(config))
+
+		srv.AddTransport(transport.Websocket{
+			KeepAlivePingInterval: 10 * time.Second,
+		})
+		srv.AddTransport(transport.Options{})
+		srv.AddTransport(transport.GET{})
+		srv.AddTransport(transport.POST{})
+		srv.AddTransport(transport.MultipartForm{})
+
+		srv.SetQueryCache(lru.New[*ast.QueryDocument](1000))
+
+		srv.Use(extension.Introspection{})
+		srv.Use(extension.AutomaticPersistedQuery{
+			Cache: lru.New[string](100),
+		})
+
+		mux.Handle("/", monitoring.Handler(playground.Handler("GraphQL playground", "/query")))
+		mux.Handle("/health", http.HandlerFunc(healthFunc))
+		mux.Handle("/query", cors.AllowAll().Handler(
+			monitoring.Handler(
+				mw.Middleware().CheckJWT(
+					apiKeyMiddleware.Handler(
+						authMiddleware.Handler(srv),
+					),
+				),
+			),
 		))
 
-		sentryHandler := sentryhttp.New(sentryhttp.Options{Repanic: true})
-		mux.Handle("/", sentryHandler.HandleFunc(playground.Handler("GraphQL playground", "/query")))
-		mux.Handle("/health", sentryHandler.HandleFunc(healthFunc))
-		mux.Handle("/query", cors.AllowAll().Handler(sentryHandler.Handle(apiKeyMiddleware.Handler(srv))))
+		logger.Info(fmt.Sprintf("connect to http://localhost:%d/ for GraphQL playground", cli.Port))
 
-		logger.Infof("connect to http://localhost:%d/ for GraphQL playground", CLI.Port)
-
-		if err := httpSrv.ListenAndServe(); err != nil {
-			logger.WithError(err).Error("listen http")
+		if err := httpSrv.ListenAndServe(); !errors.Is(err, http.ErrServerClosed) {
+			logger.With("error", err).Error("listen http")
 		}
 	}()
 
@@ -202,6 +246,42 @@ func start(closeEvents chan error, logger *log.Entry, connectToAmqpFunc func(url
 	return nil
 }
 
+func loadOrganizations(ctx context.Context, eventStore eventsourced.EventStore, serviceCache *cache.Cache) error {
+	roots, err := eventStore.GetAggregateRoots(ctx, reflect.TypeOf(domain.Organization{}))
+	if err != nil {
+		return err
+	}
+	for _, root := range roots {
+		organization := &domain.Organization{BaseAggregate: eventsourced.BaseAggregateFromString(root.String())}
+		if _, err := eventsourced.NewHandler(ctx, organization, eventStore); err != nil {
+			return err
+		}
+		_, err := serviceCache.Update(organization, nil)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func loadSubGraphs(ctx context.Context, eventStore eventsourced.EventStore, serviceCache *cache.Cache) error {
+	roots, err := eventStore.GetAggregateRoots(ctx, reflect.TypeOf(domain.SubGraph{}))
+	if err != nil {
+		return err
+	}
+	for _, root := range roots {
+		subGraph := &domain.SubGraph{BaseAggregate: eventsourced.BaseAggregateFromString(root.String())}
+		if _, err := eventsourced.NewHandler(ctx, subGraph, eventStore); err != nil {
+			return err
+		}
+		_, err := serviceCache.Update(subGraph, nil)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 func healthFunc(w http.ResponseWriter, _ *http.Request) {
 	_, _ = w.Write([]byte("OK"))
 }
@@ -211,6 +291,6 @@ func ConnectAMQP(url string) (Connection, error) {
 }
 
 type Connection interface {
-	Start(opts ...goamqp.Setup) error
+	Start(ctx context.Context, opts ...goamqp.Setup) error
 	Close() error
 }

ctl/generated.go

@@ -43,6 +43,7 @@ type SubGraphsResponse struct {
 func (v *SubGraphsResponse) GetSupergraph() SubGraphsSupergraph { return v.Supergraph }
 
 func (v *SubGraphsResponse) UnmarshalJSON(b []byte) error {
+
 	if string(b) == "null" {
 		return nil
 	}
@@ -148,6 +149,7 @@ func __unmarshalSubGraphsSupergraph(b []byte, v *SubGraphsSupergraph) error {
 }
 
 func __marshalSubGraphsSupergraph(v *SubGraphsSupergraph) ([]byte, error) {
+
 	var typename string
 	switch v := (*v).(type) {
 	case *SubGraphsSupergraphSubGraphs:
@@ -270,14 +272,8 @@ type __UpdateSubGraphInput struct {
 // GetInput returns __UpdateSubGraphInput.Input, and is useful for accessing the field via an interface.
 func (v *__UpdateSubGraphInput) GetInput() *InputSubGraph { return v.Input }
 
-func SubGraphs(
-	ctx context.Context,
-	client graphql.Client,
-	ref string,
-) (*SubGraphsResponse, error) {
-	req := &graphql.Request{
-		OpName: "SubGraphs",
-		Query: `
+// The query executed by SubGraphs.
+const SubGraphs_Operation = `
 query SubGraphs ($ref: String!) {
 	supergraph(ref: $ref) {
 		__typename
@@ -292,33 +288,35 @@ query SubGraphs ($ref: String!) {
 		}
 	}
 }
-`,
+`
+
+func SubGraphs(
+	ctx_ context.Context,
+	client_ graphql.Client,
+	ref string,
+) (data_ *SubGraphsResponse, err_ error) {
+	req_ := &graphql.Request{
+		OpName: "SubGraphs",
+		Query:  SubGraphs_Operation,
 		Variables: &__SubGraphsInput{
 			Ref: ref,
 		},
 	}
-	var err error
 
-	var data SubGraphsResponse
-	resp := &graphql.Response{Data: &data}
+	data_ = &SubGraphsResponse{}
+	resp_ := &graphql.Response{Data: data_}
 
-	err = client.MakeRequest(
-		ctx,
-		req,
-		resp,
+	err_ = client_.MakeRequest(
+		ctx_,
+		req_,
+		resp_,
 	)
 
-	return &data, err
+	return data_, err_
 }
 
-func UpdateSubGraph(
-	ctx context.Context,
-	client graphql.Client,
-	input *InputSubGraph,
-) (*UpdateSubGraphResponse, error) {
-	req := &graphql.Request{
-		OpName: "UpdateSubGraph",
-		Query: `
+// The mutation executed by UpdateSubGraph.
+const UpdateSubGraph_Operation = `
 mutation UpdateSubGraph ($input: InputSubGraph!) {
 	updateSubGraph(input: $input) {
 		service
@@ -328,21 +326,29 @@ mutation UpdateSubGraph ($input: InputSubGraph!) {
 		changedAt
 	}
 }
-`,
+`
+
+func UpdateSubGraph(
+	ctx_ context.Context,
+	client_ graphql.Client,
+	input *InputSubGraph,
+) (data_ *UpdateSubGraphResponse, err_ error) {
+	req_ := &graphql.Request{
+		OpName: "UpdateSubGraph",
+		Query:  UpdateSubGraph_Operation,
 		Variables: &__UpdateSubGraphInput{
 			Input: input,
 		},
 	}
-	var err error
 
-	var data UpdateSubGraphResponse
-	resp := &graphql.Response{Data: &data}
+	data_ = &UpdateSubGraphResponse{}
+	resp_ := &graphql.Response{Data: data_}
 
-	err = client.MakeRequest(
-		ctx,
-		req,
-		resp,
+	err_ = client_.MakeRequest(
+		ctx_,
+		req_,
+		resp_,
 	)
 
-	return &data, err
+	return data_, err_
 }

domain/aggregates.go

@@ -8,19 +8,67 @@ import (
 	"gitlab.com/unboundsoftware/eventsourced/eventsourced"
 )
 
-type SubGraph struct {
+type Organization struct {
 	eventsourced.BaseAggregate
-	Ref       string
-	Service   string
-	Url       *string
-	WSUrl     *string
-	Sdl       string
+	Name      string
+	Users     []string
+	APIKeys   []APIKey
 	CreatedBy string
 	CreatedAt time.Time
 	ChangedBy string
 	ChangedAt time.Time
 }
 
+func (o *Organization) Apply(event eventsourced.Event) error {
+	switch e := event.(type) {
+	case *OrganizationAdded:
+		e.UpdateOrganization(o)
+	case *APIKeyAdded:
+		o.APIKeys = append(o.APIKeys, APIKey{
+			Name:           e.Name,
+			OrganizationId: o.ID.String(),
+			Key:            e.Key,
+			Refs:           e.Refs,
+			Read:           e.Read,
+			Publish:        e.Publish,
+			CreatedBy:      e.Initiator,
+			CreatedAt:      e.When(),
+		})
+		o.ChangedBy = e.Initiator
+		o.ChangedAt = e.When()
+	default:
+		return fmt.Errorf("unexpected event type: %+v", event)
+	}
+	return nil
+}
+
+var _ eventsourced.Aggregate = &Organization{}
+
+type APIKey struct {
+	Name           string
+	OrganizationId string
+	Key            string
+	Refs           []string
+	Read           bool
+	Publish        bool
+	CreatedBy      string
+	CreatedAt      time.Time
+}
+
+type SubGraph struct {
+	eventsourced.BaseAggregate
+	OrganizationId string
+	Ref            string
+	Service        string
+	Url            *string
+	WSUrl          *string
+	Sdl            string
+	CreatedBy      string
+	CreatedAt      time.Time
+	ChangedBy      string
+	ChangedAt      time.Time
+}
+
 func (s *SubGraph) Apply(event eventsourced.Event) error {
 	switch e := event.(type) {
 	case *SubGraphUpdated:
@@ -28,6 +76,9 @@ func (s *SubGraph) Apply(event eventsourced.Event) error {
 			s.CreatedBy = e.Initiator
 			s.CreatedAt = e.When()
 		}
+		if s.OrganizationId == "" {
+			s.OrganizationId = e.OrganizationId
+		}
 		s.ChangedBy = e.Initiator
 		s.ChangedAt = e.When()
 		s.Ref = e.Ref

domain/commands.go

@@ -6,17 +6,78 @@ import (
 	"strings"
 
 	"gitlab.com/unboundsoftware/eventsourced/eventsourced"
+
+	"gitlab.com/unboundsoftware/schemas/hash"
 )
 
-type UpdateSubGraph struct {
-	Ref       string
-	Service   string
-	Url       *string
-	WSUrl     *string
-	Sdl       string
+type AddOrganization struct {
+	Name      string
 	Initiator string
 }
 
+func (a AddOrganization) Validate(_ context.Context, aggregate eventsourced.Aggregate) error {
+	if aggregate.Identity() != nil {
+		return fmt.Errorf("organization already exists")
+	}
+	if len(a.Name) == 0 {
+		return fmt.Errorf("name is required")
+	}
+	return nil
+}
+
+func (a AddOrganization) Event(context.Context) eventsourced.Event {
+	return &OrganizationAdded{
+		Name:      a.Name,
+		Initiator: a.Initiator,
+	}
+}
+
+var _ eventsourced.Command = AddOrganization{}
+
+type AddAPIKey struct {
+	Name      string
+	Key       string
+	Refs      []string
+	Read      bool
+	Publish   bool
+	Initiator string
+}
+
+func (a AddAPIKey) Validate(_ context.Context, aggregate eventsourced.Aggregate) error {
+	if aggregate.Identity() == nil {
+		return fmt.Errorf("organization does not exist")
+	}
+	for _, k := range aggregate.(*Organization).APIKeys {
+		if k.Name == a.Name {
+			return fmt.Errorf("a key named '%s' already exist", a.Name)
+		}
+	}
+	return nil
+}
+
+func (a AddAPIKey) Event(context.Context) eventsourced.Event {
+	return &APIKeyAdded{
+		Name:      a.Name,
+		Key:       hash.String(a.Key),
+		Refs:      a.Refs,
+		Read:      a.Read,
+		Publish:   a.Publish,
+		Initiator: a.Initiator,
+	}
+}
+
+var _ eventsourced.Command = AddAPIKey{}
+
+type UpdateSubGraph struct {
+	OrganizationId string
+	Ref            string
+	Service        string
+	Url            *string
+	WSUrl          *string
+	Sdl            string
+	Initiator      string
+}
+
 func (u UpdateSubGraph) Validate(_ context.Context, aggregate eventsourced.Aggregate) error {
 	switch a := aggregate.(type) {
 	case *SubGraph:
@@ -40,12 +101,13 @@ func (u UpdateSubGraph) Validate(_ context.Context, aggregate eventsourced.Aggre
 
 func (u UpdateSubGraph) Event(context.Context) eventsourced.Event {
 	return &SubGraphUpdated{
-		Ref:       u.Ref,
-		Service:   u.Service,
-		Url:       u.Url,
-		WSUrl:     u.WSUrl,
-		Sdl:       u.Sdl,
-		Initiator: u.Initiator,
+		OrganizationId: u.OrganizationId,
+		Ref:            u.Ref,
+		Service:        u.Service,
+		Url:            u.Url,
+		WSUrl:          u.WSUrl,
+		Sdl:            u.Sdl,
+		Initiator:      u.Initiator,
 	}
 }
 

domain/commands_test.go

@@ -0,0 +1,63 @@
+package domain
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"gitlab.com/unboundsoftware/eventsourced/eventsourced"
+)
+
+func TestAddAPIKey_Event(t *testing.T) {
+	type fields struct {
+		Name      string
+		Key       string
+		Refs      []string
+		Read      bool
+		Publish   bool
+		Initiator string
+	}
+	type args struct {
+		in0 context.Context
+	}
+	tests := []struct {
+		name   string
+		fields fields
+		args   args
+		want   eventsourced.Event
+	}{
+		{
+			name: "event",
+			fields: fields{
+				Name:      "test",
+				Key:       "us_ak_1234567890123456",
+				Refs:      []string{"Example@dev"},
+				Read:      true,
+				Publish:   true,
+				Initiator: "jim@example.org",
+			},
+			args: args{},
+			want: &APIKeyAdded{
+				Name:      "test",
+				Key:       "dXNfYWtfMTIzNDU2Nzg5MDEyMzQ1NuOwxEKY/BwUmvv0yJlvuSQnrkHkZJuTTKSVmRt4UrhV",
+				Refs:      []string{"Example@dev"},
+				Read:      true,
+				Publish:   true,
+				Initiator: "jim@example.org",
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			a := AddAPIKey{
+				Name:      tt.fields.Name,
+				Key:       tt.fields.Key,
+				Refs:      tt.fields.Refs,
+				Read:      tt.fields.Read,
+				Publish:   tt.fields.Publish,
+				Initiator: tt.fields.Initiator,
+			}
+			assert.Equalf(t, tt.want, a.Event(tt.args.in0), "Event(%v)", tt.args.in0)
+		})
+	}
+}

domain/events.go

@@ -2,13 +2,45 @@ package domain
 
 import "gitlab.com/unboundsoftware/eventsourced/eventsourced"
 
-type SubGraphUpdated struct {
-	eventsourced.EventAggregateId
-	eventsourced.EventTime
-	Ref       string
-	Service   string
-	Url       *string
-	WSUrl     *string
-	Sdl       string
-	Initiator string
+type OrganizationAdded struct {
+	eventsourced.BaseEvent
+	Name      string `json:"name"`
+	Initiator string `json:"initiator"`
+}
+
+func (a *OrganizationAdded) UpdateOrganization(o *Organization) {
+	o.Name = a.Name
+	o.Users = []string{a.Initiator}
+	o.CreatedBy = a.Initiator
+	o.CreatedAt = a.When()
+	o.ChangedBy = a.Initiator
+	o.ChangedAt = a.When()
+}
+
+type APIKeyAdded struct {
+	eventsourced.BaseEvent
+	OrganizationId string   `json:"organizationId"`
+	Name           string   `json:"name"`
+	Key            string   `json:"key"`
+	Refs           []string `json:"refs"`
+	Read           bool     `json:"read"`
+	Publish        bool     `json:"publish"`
+	Initiator      string   `json:"initiator"`
+}
+
+func (a *APIKeyAdded) EnrichFromAggregate(aggregate eventsourced.Aggregate) {
+	a.OrganizationId = aggregate.Identity().String()
+}
+
+var _ eventsourced.EnrichableEvent = &APIKeyAdded{}
+
+type SubGraphUpdated struct {
+	eventsourced.BaseEvent
+	OrganizationId string  `json:"organizationId"`
+	Ref            string  `json:"ref"`
+	Service        string  `json:"service"`
+	Url            *string `json:"url"`
+	WSUrl          *string `json:"wsUrl"`
+	Sdl            string  `json:"sdl"`
+	Initiator      string  `json:"initiator"`
 }

go.mod

@@ -1,53 +1,79 @@
 module gitlab.com/unboundsoftware/schemas
 
-go 1.19
+go 1.24.4
 
 require (
-	github.com/99designs/gqlgen v0.17.20
-	github.com/Khan/genqlient v0.5.0
-	github.com/alecthomas/kong v0.6.1
+	github.com/99designs/gqlgen v0.17.76
+	github.com/Khan/genqlient v0.8.1
+	github.com/alecthomas/kong v1.12.0
 	github.com/apex/log v1.9.0
-	github.com/getsentry/sentry-go v0.14.0
-	github.com/jmoiron/sqlx v1.3.5
-	github.com/rs/cors v1.8.2
-	github.com/sparetimecoders/goamqp v0.1.1
-	github.com/stretchr/testify v1.8.0
-	github.com/vektah/gqlparser/v2 v2.5.1
-	github.com/wundergraph/graphql-go-tools v1.57.2-0.20221005155749-a4fdba38990b
-	gitlab.com/unboundsoftware/eventsourced/amqp v1.5.0
-	gitlab.com/unboundsoftware/eventsourced/eventsourced v1.9.3
-	gitlab.com/unboundsoftware/eventsourced/pg v1.9.0
+	github.com/auth0/go-jwt-middleware/v2 v2.3.0
+	github.com/golang-jwt/jwt/v5 v5.2.2
+	github.com/jmoiron/sqlx v1.4.0
+	github.com/pkg/errors v0.9.1
+	github.com/pressly/goose/v3 v3.24.3
+	github.com/rs/cors v1.11.1
+	github.com/sparetimecoders/goamqp v0.3.2
+	github.com/stretchr/testify v1.10.0
+	github.com/vektah/gqlparser/v2 v2.5.30
+	github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.194
+	gitlab.com/unboundsoftware/eventsourced/amqp v1.8.1
+	gitlab.com/unboundsoftware/eventsourced/eventsourced v1.19.2
+	gitlab.com/unboundsoftware/eventsourced/pg v1.17.0
+	go.opentelemetry.io/contrib/bridges/otelslog v0.12.0
+	go.opentelemetry.io/otel v1.37.0
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.37.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.37.0
+	go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.13.0
+	go.opentelemetry.io/otel/log v0.13.0
+	go.opentelemetry.io/otel/sdk v1.37.0
+	go.opentelemetry.io/otel/sdk/log v0.13.0
+	go.opentelemetry.io/otel/sdk/metric v1.37.0
+	go.opentelemetry.io/otel/trace v1.37.0
 )
 
 require (
-	github.com/agnivade/levenshtein v1.1.1 // indirect
+	github.com/agnivade/levenshtein v1.2.1 // indirect
 	github.com/buger/jsonparser v1.1.1 // indirect
-	github.com/cespare/xxhash/v2 v2.1.2 // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.2 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/golang/mock v1.4.4 // indirect
-	github.com/google/uuid v1.3.0 // indirect
-	github.com/gorilla/websocket v1.5.0 // indirect
-	github.com/hashicorp/golang-lru v0.5.4 // indirect
-	github.com/kr/text v0.2.0 // indirect
-	github.com/lib/pq v1.10.6 // indirect
-	github.com/mitchellh/mapstructure v1.5.0 // indirect
-	github.com/pkg/errors v0.9.1 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-viper/mapstructure/v2 v2.3.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/gorilla/websocket v1.5.1 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 // indirect
+	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
+	github.com/lib/pq v1.10.9 // indirect
+	github.com/mfridman/interpolate v0.0.2 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/qri-io/jsonpointer v0.1.1 // indirect
-	github.com/qri-io/jsonschema v0.2.1 // indirect
-	github.com/rabbitmq/amqp091-go v1.3.4 // indirect
+	github.com/rabbitmq/amqp091-go v1.10.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	github.com/tidwall/gjson v1.14.3 // indirect
+	github.com/sethvargo/go-retry v0.3.0 // indirect
+	github.com/sosodev/duration v1.3.1 // indirect
+	github.com/tidwall/gjson v1.17.0 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.1 // indirect
 	github.com/tidwall/sjson v1.2.5 // indirect
-	github.com/urfave/cli/v2 v2.8.1 // indirect
-	github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 // indirect
-	golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4 // indirect
-	golang.org/x/sys v0.0.0-20221006211917-84dc82d7e875 // indirect
-	golang.org/x/text v0.3.7 // indirect
-	golang.org/x/tools v0.1.12 // indirect
-	golang.org/x/xerrors v0.0.0-20220517211312-f3a8303e98df // indirect
+	github.com/urfave/cli/v2 v2.27.7 // indirect
+	github.com/wundergraph/astjson v0.0.0-20250106123708-be463c97e083 // indirect
+	github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 // indirect
+	go.opentelemetry.io/otel/metric v1.37.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.7.0 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	golang.org/x/mod v0.25.0 // indirect
+	golang.org/x/net v0.41.0 // indirect
+	golang.org/x/sync v0.15.0 // indirect
+	golang.org/x/sys v0.33.0 // indirect
+	golang.org/x/text v0.26.0 // indirect
+	golang.org/x/tools v0.34.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect
+	google.golang.org/grpc v1.73.0 // indirect
+	google.golang.org/protobuf v1.36.6 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -1,24 +1,25 @@
-github.com/99designs/gqlgen v0.17.2/go.mod h1:K5fzLKwtph+FFgh9j7nFbRUdBKvTcGnsta51fsMTn3o=
-github.com/99designs/gqlgen v0.17.20 h1:O7WzccIhKB1dm+7g6dhQcULINftfiLSBg2l/mwbpJMw=
-github.com/99designs/gqlgen v0.17.20/go.mod h1:Mja2HI23kWT1VRH09hvWshFgOzKswpO20o4ScpJIES4=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/toml v1.1.0/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
-github.com/DATA-DOG/go-sqlmock v1.5.0 h1:Shsta01QNfFxHCfpW6YH2STWB0MudeXXEWMr20OEh60=
-github.com/DATA-DOG/go-sqlmock v1.5.0/go.mod h1:f/Ixk793poVmq4qj/V1dPUg2JEAKC73Q5eFN3EC/SaM=
-github.com/Khan/genqlient v0.5.0 h1:TMZJ+tl/BpbmGyIBiXzKzUftDhw4ZWxQZ+1ydn0gyII=
-github.com/Khan/genqlient v0.5.0/go.mod h1:EpIvDVXYm01GP6AXzjA7dKriPTH6GmtpmvTAwUUqIX8=
-github.com/agnivade/levenshtein v1.0.1/go.mod h1:CURSv5d9Uaml+FovSIICkLbAUZ9S4RqaHDIsdSBg7lM=
-github.com/agnivade/levenshtein v1.1.0/go.mod h1:veldBMzWxcCG2ZvUTKD2kJNRdCk5hVbJomOvKkmgYbo=
-github.com/agnivade/levenshtein v1.1.1 h1:QY8M92nrzkmr798gCo3kmMyqXFzdQVpxLlGPRBij0P8=
-github.com/agnivade/levenshtein v1.1.1/go.mod h1:veldBMzWxcCG2ZvUTKD2kJNRdCk5hVbJomOvKkmgYbo=
-github.com/alecthomas/kong v0.6.1 h1:1kNhcFepkR+HmasQpbiKDLylIL8yh5B5y1zPp5bJimA=
-github.com/alecthomas/kong v0.6.1/go.mod h1:JfHWDzLmbh/puW6I3V7uWenoh56YNVONW+w8eKeUr9I=
-github.com/alecthomas/repr v0.0.0-20210801044451-80ca428c5142 h1:8Uy0oSf5co/NZXje7U1z8Mpep++QJOldL2hs/sBQf48=
-github.com/alecthomas/repr v0.0.0-20210801044451-80ca428c5142/go.mod h1:2kn6fqh/zIyPLmm3ugklbEi5hg5wS435eygvNfaDQL8=
-github.com/alexflint/go-arg v1.4.2/go.mod h1:9iRbDxne7LcR/GSvEr7ma++GLpdIU1zrghf2y2768kM=
-github.com/alexflint/go-scalar v1.0.0/go.mod h1:GpHzbCOZXEKMEcygYQ5n/aa4Aq84zbxjy3MxYW0gjYw=
+filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
+filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
+github.com/99designs/gqlgen v0.17.76 h1:YsJBcfACWmXWU2t1yCjoGdOmqcTfOFpjbLAE443fmYI=
+github.com/99designs/gqlgen v0.17.76/go.mod h1:miiU+PkAnTIDKMQ1BseUOIVeQHoiwYDZGCswoxl7xec=
+github.com/DATA-DOG/go-sqlmock v1.5.2 h1:OcvFkGmslmlZibjAjaHm3L//6LiuBgolP7OputlJIzU=
+github.com/DATA-DOG/go-sqlmock v1.5.2/go.mod h1:88MAG/4G7SMwSE3CeA0ZKzrT5CiOU3OJ+JlNzwDqpNU=
+github.com/Khan/genqlient v0.8.1 h1:wtOCc8N9rNynRLXN3k3CnfzheCUNKBcvXmVv5zt6WCs=
+github.com/Khan/genqlient v0.8.1/go.mod h1:R2G6DzjBvCbhjsEajfRjbWdVglSH/73kSivC9TLWVjU=
+github.com/PuerkitoBio/goquery v1.10.3 h1:pFYcNSqHxBD06Fpj/KsbStFRsgRATgnf3LeXiUkhzPo=
+github.com/PuerkitoBio/goquery v1.10.3/go.mod h1:tMUX0zDMHXYlAQk6p35XxQMqMweEKB7iK7iLNd4RH4Y=
+github.com/agnivade/levenshtein v1.2.1 h1:EHBY3UOn1gwdy/VbFwgo4cxecRznFk7fKWN1KOX7eoM=
+github.com/agnivade/levenshtein v1.2.1/go.mod h1:QVVI16kDrtSuwcpd0p1+xMC6Z/VfhtCyDIjcwga4/DU=
+github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
+github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
+github.com/alecthomas/kong v1.12.0 h1:oKd/0fHSdajj5PfGDd3ScvEvpVJf9mT2mb5r9xYadYM=
+github.com/alecthomas/kong v1.12.0/go.mod h1:p2vqieVMeTAnaC83txKtXe8FLke2X07aruPWXyMPQrU=
+github.com/alecthomas/repr v0.4.0 h1:GhI2A8MACjfegCPVq9f1FLvIBS+DrQ2KQBFZP1iFzXc=
+github.com/alecthomas/repr v0.4.0/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883 h1:bvNMNQO63//z+xNgfBlViaCIJKLlCJ6/fmUseuG0wVQ=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
+github.com/andybalholm/cascadia v1.3.3 h1:AG2YHrzJIm4BZ19iwJ/DAua6Btl3IwJX+VI4kktS1LM=
+github.com/andybalholm/cascadia v1.3.3/go.mod h1:xNd9bqTn98Ln4DwST8/nG+H0yuB8Hmgu1YHNnWw0GeA=
 github.com/apex/log v1.9.0 h1:FHtw/xuaM8AgmvDDTI9fiwoAL25Sq2cxojnZICUU8l0=
 github.com/apex/log v1.9.0/go.mod h1:m82fZlWIuiWzWP04XCTXmnX0xRkYYbCdYn8jbJeLBEA=
 github.com/apex/logs v1.0.0/go.mod h1:XzxuLZ5myVHDy9SAmYpamKKRNApGj54PfYLcFrXqDwo=
@@ -26,138 +27,131 @@ github.com/aphistic/golf v0.0.0-20180712155816-02c07f170c5a/go.mod h1:3NqKYiepwy
 github.com/aphistic/sweet v0.2.0/go.mod h1:fWDlIh/isSE9n6EPsRmC0det+whmX6dJid3stzu0Xys=
 github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0 h1:jfIu9sQUG6Ig+0+Ap1h4unLjW6YQJpKZVmUzxsD4E/Q=
 github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0/go.mod h1:t2tdKJDJF9BV14lnkjHmOQgcvEKgtqs5a1N3LNdJhGE=
+github.com/auth0/go-jwt-middleware/v2 v2.3.0 h1:4QREj6cS3d8dS05bEm443jhnqQF97FX9sMBeWqnNRzE=
+github.com/auth0/go-jwt-middleware/v2 v2.3.0/go.mod h1:dL4ObBs1/dj4/W4cYxd8rqAdDGXYyd5rqbpMIxcbVrU=
 github.com/aws/aws-sdk-go v1.20.6/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
 github.com/aybabtme/rgbterm v0.0.0-20170906152045-cc83f3b3ce59/go.mod h1:q/89r3U2H7sSsE2t6Kca0lfwTK8JdoNGS/yzM/4iH5I=
-github.com/bradleyjkemp/cupaloy/v2 v2.6.0/go.mod h1:bm7JXdkRd4BHJk9HpwqAI8BoAY1lps46Enkdqw6aRX0=
 github.com/buger/jsonparser v1.1.1 h1:2PnMjfWD7wBILjqQbt530v576A/cAbQvEW9gGIpYMUs=
 github.com/buger/jsonparser v1.1.1/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
-github.com/caarlos0/env v3.5.0+incompatible h1:Yy0UN8o9Wtr/jGHZDpCBLpNrzcFLLM2yixi/rBrKyJs=
-github.com/caarlos0/env v3.5.0+incompatible/go.mod h1:tdCsowwCzMLdkqRYDlHpZCp2UooDD3MspDBjZ2AD02Y=
-github.com/cespare/xxhash/v2 v2.1.2 h1:YRXhKfTDauu4ajMg1TPgFO5jnlC2HCbmLXMcTG5cbYE=
-github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
-github.com/cpuguy83/go-md2man/v2 v2.0.1/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
-github.com/cpuguy83/go-md2man/v2 v2.0.2 h1:p1EgwI/C7NhT0JmVkwCD2ZBK8j4aeHQX2pMHHBfMQ6w=
-github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/davecgh/go-spew v0.0.0-20161028175848-04cdfd42973b/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/cenkalti/backoff/v5 v5.0.2 h1:rIfFVxEf1QsI7E1ZHfp/B4DF/6QBAUhmgkxc0H7Zss8=
+github.com/cenkalti/backoff/v5 v5.0.2/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
+github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dgryski/trifles v0.0.0-20200323201526-dd97f9abfb48 h1:fRzb/w+pyskVMQ+UbP35JkH8yB7MYb4q/qhBarqZE6g=
-github.com/dgryski/trifles v0.0.0-20200323201526-dd97f9abfb48/go.mod h1:if7Fbed8SFyPtHLHbg49SI7NAdJiC5WIA09pe59rfAA=
-github.com/evanphx/json-patch/v5 v5.1.0 h1:B0aXl1o/1cP8NbviYiBMkcHBtUjIJ1/Ccg6b+SwCLQg=
+github.com/dgryski/trifles v0.0.0-20230903005119-f50d829f2e54 h1:SG7nF6SRlWhcT7cNTs5R6Hk4V2lcmLz2NsG2VnInyNo=
+github.com/dgryski/trifles v0.0.0-20230903005119-f50d829f2e54/go.mod h1:if7Fbed8SFyPtHLHbg49SI7NAdJiC5WIA09pe59rfAA=
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
-github.com/getsentry/sentry-go v0.14.0 h1:rlOBkuFZRKKdUnKO+0U3JclRDQKlRu5vVQtkWSQvC70=
-github.com/getsentry/sentry-go v0.14.0/go.mod h1:RZPJKSw+adu8PBNygiri/A98FqVr2HtRckJk9XVxJ9I=
-github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
-github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE=
-github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
-github.com/golang/mock v1.4.4 h1:l75CXGRSwbaYNpl/Z2X1XIIAMSCquvXgpVZDhwEIJsc=
-github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
+github.com/go-sql-driver/mysql v1.9.2 h1:4cNKDYQ1I84SXslGddlsrMhc8k4LeDVj6Ad6WRjiHuU=
+github.com/go-sql-driver/mysql v1.9.2/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
+github.com/go-viper/mapstructure/v2 v2.3.0 h1:27XbWsHIqhbdR5TIC911OfYvgSaW93HM+dX7970Q7jk=
+github.com/go-viper/mapstructure/v2 v2.3.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
+github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
-github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWmnc=
-github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc=
-github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gorilla/websocket v1.5.1 h1:gmztn0JnHVt9JZquRuzLw3g4wouNVzKL15iLr/zn/QY=
+github.com/gorilla/websocket v1.5.1/go.mod h1:x3kM2JMyaluk02fnUJpQuwD2dCS5NDG2ZHL0uE0tcaY=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 h1:X5VWvz21y3gzm9Nw/kaUeku/1+uBhcekkmy4IkffJww=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1/go.mod h1:Zanoh4+gvIgluNqcfMVTJueD4wSS5hT7zTt4Mrutd90=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
+github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
+github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/jensneuse/diffview v1.0.0 h1:4b6FQJ7y3295JUHU3tRko6euyEboL825ZsXeZZM47Z4=
+github.com/jensneuse/diffview v1.0.0/go.mod h1:i6IacuD8LnEaPuiyzMHA+Wfz5mAuycMOf3R/orUY9y4=
 github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
-github.com/jmoiron/sqlx v1.3.5 h1:vFFPA71p1o5gAeqtEAwLU4dnX2napprKtHr7PYIcN3g=
-github.com/jmoiron/sqlx v1.3.5/go.mod h1:nRVWtLre0KfCLJvgxzCsLVMogSvQ1zNJtpYr2Ccp0mQ=
+github.com/jmoiron/sqlx v1.4.0 h1:1PLqN7S1UYp5t4SrVVnt4nUVNemrDAtxlulVe+Qgm3o=
+github.com/jmoiron/sqlx v1.4.0/go.mod h1:ZrZ7UsYB/weZdl2Bxg6jCRO9c3YHl8r3ahlKmRT4JLY=
 github.com/jpillora/backoff v0.0.0-20180909062703-3050d21c67d7/go.mod h1:2iMrUgbbvHEiQClaW2NsSzMyGHqN+rDFqY705q49KG0=
-github.com/kevinmbeaulieu/eq-go v1.0.0/go.mod h1:G3S8ajA56gKBZm4UB9AOyoOS37JO3roToPzKNM8dtdM=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
-github.com/lib/pq v1.10.6 h1:jbk+ZieJ0D7EVGJYpL9QTz7/YW6UHbmdnZWYyK5cdBs=
-github.com/lib/pq v1.10.6/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/logrusorgru/aurora/v3 v3.0.0/go.mod h1:vsR12bk5grlLvLXAYrBsb5Oc/N+LxAlxggSjiwMnCUc=
-github.com/matryer/moq v0.2.3/go.mod h1:9RtPYjTnH1bSBIkpvtHkFN7nbWAnO7oRpdJkEIn6UtE=
-github.com/matryer/moq v0.2.7/go.mod h1:kITsx543GOENm48TUAQyJ9+SAvFSr7iGQXPoth/VUBk=
+github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
+github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ=
 github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
-github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
-github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-isatty v0.0.5/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
-github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-sqlite3 v1.14.6 h1:dNPt6NO46WmLVt2DLNpwczCmdV5boIZ6g/tlDrlRUbg=
-github.com/mattn/go-sqlite3 v1.14.6/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU=
+github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/mfridman/interpolate v0.0.2 h1:pnuTK7MQIxxFz1Gr+rjSIx9u7qVjf5VOoM/u6BbAxPY=
+github.com/mfridman/interpolate v0.0.2/go.mod h1:p+7uk6oE07mpE/Ik1b8EckO0O4ZXiGAfshKBWLUM9Xg=
 github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
-github.com/mitchellh/mapstructure v1.2.3/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/mitchellh/mapstructure v1.3.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
-github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
+github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
+github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/gomega v1.5.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
-github.com/pingcap/errors v0.11.4 h1:lFuQV/oaUMGcD2tqt+01ROSmJs75VG1ToEOkZIZ4nE4=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pmezard/go-difflib v0.0.0-20151028094244-d8ed2627bdf0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/qri-io/jsonpointer v0.1.1 h1:prVZBZLL6TW5vsSB9fFHFAMBLI4b0ri5vribQlTJiBA=
-github.com/qri-io/jsonpointer v0.1.1/go.mod h1:DnJPaYgiKu56EuDp8TU5wFLdZIcAnb/uH9v37ZaMV64=
-github.com/qri-io/jsonschema v0.2.1 h1:NNFoKms+kut6ABPf6xiKNM5214jzxAhDBrPHCJ97Wg0=
-github.com/qri-io/jsonschema v0.2.1/go.mod h1:g7DPkiOsK1xv6T/Ao5scXRkd+yTFygcANPBaaqW+VrI=
-github.com/rabbitmq/amqp091-go v1.3.4 h1:tXuIslN1nhDqs2t6Jrz3BAoqvt4qIZzxvdbdcxWtHYU=
-github.com/rabbitmq/amqp091-go v1.3.4/go.mod h1:ogQDLSOACsLPsIq0NpbtiifNZi2YOz0VTJ0kHRghqbM=
+github.com/pressly/goose/v3 v3.24.3 h1:DSWWNwwggVUsYZ0X2VitiAa9sKuqtBfe+Jr9zFGwWlM=
+github.com/pressly/goose/v3 v3.24.3/go.mod h1:v9zYL4xdViLHCUUJh/mhjnm6JrK7Eul8AS93IxiZM4E=
+github.com/rabbitmq/amqp091-go v1.10.0 h1:STpn5XsHlHGcecLmMFCtg7mqq0RnD+zFr4uzukfVhBw=
+github.com/rabbitmq/amqp091-go v1.10.0/go.mod h1:Hy4jKW5kQART1u+JkDTF9YYOQUHXqMuhrgxOEeS7G4o=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rogpeppe/fastuuid v1.1.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
-github.com/rs/cors v1.8.2 h1:KCooALfAYGs415Cwu5ABvv9n9509fSiG5SQJn/AQo4U=
-github.com/rs/cors v1.8.2/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
-github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/rs/cors v1.11.1 h1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=
+github.com/rs/cors v1.11.1/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/sanity-io/litter v1.5.5 h1:iE+sBxPBzoK6uaEP5Lt3fHNgpKcHXc/A2HGETy0uJQo=
-github.com/sanity-io/litter v1.5.5/go.mod h1:9gzJgR2i4ZpjZHsKvUXIRQVk7P+yM3e+jAF7bU2UI5U=
+github.com/sanity-io/litter v1.5.8 h1:uM/2lKrWdGbRXDrIq08Lh9XtVYoeGtcQxk9rtQ7+rYg=
+github.com/sanity-io/litter v1.5.8/go.mod h1:9gzJgR2i4ZpjZHsKvUXIRQVk7P+yM3e+jAF7bU2UI5U=
 github.com/sebdah/goldie/v2 v2.5.3 h1:9ES/mNN+HNUbNWpVAlrzuZ7jE+Nrczbj8uFRjM7624Y=
+github.com/sebdah/goldie/v2 v2.5.3/go.mod h1:oZ9fp0+se1eapSRjfYbsV/0Hqhbuu3bJVvKI/NNtssI=
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
-github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0=
-github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
-github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
+github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
+github.com/sergi/go-diff v1.3.1/go.mod h1:aMJSSKb2lpPvRNec0+w3fl7LP9IOFzdc9Pa4NFbPK1I=
+github.com/sethvargo/go-retry v0.3.0 h1:EEt31A35QhrcRZtrYFDTBg91cqZVnFL2navjDrah2SE=
+github.com/sethvargo/go-retry v0.3.0/go.mod h1:mNX17F0C/HguQMyMyJxcnU471gOZGxCLyYaFyAZraas=
 github.com/smartystreets/assertions v1.0.0/go.mod h1:kHHU4qYBaI3q23Pp3VPrmWhuIUrLW/7eUrw0BU5VaoM=
 github.com/smartystreets/go-aws-auth v0.0.0-20180515143844-0c1422d1fdb9/go.mod h1:SnhjPscd9TpLiy1LpzGSKh3bXCfxxXuqd9xmQJy3slM=
 github.com/smartystreets/gunit v1.0.0/go.mod h1:qwPWnhz6pn0NnRBP++URONOVyNkPyr4SauJk4cUOwJs=
-github.com/sparetimecoders/goamqp v0.1.1 h1:+TSwlrrnfJIyM+MKpnzk+4mnIvt6M8gdEFNRN4Q0wQA=
-github.com/sparetimecoders/goamqp v0.1.1/go.mod h1:JIydmIgCqETEHIiGYmN03gNSs2bghWBHEqnR/Lfmzb0=
+github.com/sosodev/duration v1.3.1 h1:qtHBDMQ6lvMQsL15g4aopM4HEfOaYuhWBw3NPTtlqq4=
+github.com/sosodev/duration v1.3.1/go.mod h1:RQIBBX0+fMLc/D9+Jb/fwvVmo0eZvDDEERAikUR6SDg=
+github.com/sparetimecoders/goamqp v0.3.2 h1:XdlyUBAJS5RcURw+SnnPjPJJuofddZwQsjAf05VPXvI=
+github.com/sparetimecoders/goamqp v0.3.2/go.mod h1:W9NRCpWLE+Vruv2dcRSbszNil2O826d2Nv6kAkETW5o=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/testify v0.0.0-20161117074351-18a02ba4a312/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
-github.com/stretchr/testify v1.7.3/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
-github.com/tidwall/gjson v1.14.3 h1:9jvXn7olKEHU1S9vwoMGliaT8jq1vJ7IH/n9zD9Dnlw=
-github.com/tidwall/gjson v1.14.3/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/gjson v1.17.0 h1:/Jocvlh98kcTfpN2+JzGQWQcqrPQwDrVEMApx/M5ZwM=
+github.com/tidwall/gjson v1.17.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
 github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
 github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
 github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
@@ -172,105 +166,112 @@ github.com/tj/go-buffer v1.1.0/go.mod h1:iyiJpfFcR2B9sXu7KvjbT9fpM4mOelRSDTbntVj
 github.com/tj/go-elastic v0.0.0-20171221160941-36157cbbebc2/go.mod h1:WjeM0Oo1eNAjXGDx2yma7uG2XoyRZTq1uv3M/o7imD0=
 github.com/tj/go-kinesis v0.0.0-20171128231115-08b17f58cb1b/go.mod h1:/yhzCV0xPfx6jb1bBgRFjl5lytqVqZXEaeqWP8lTEao=
 github.com/tj/go-spin v1.1.0/go.mod h1:Mg1mzmePZm4dva8Qz60H2lHwmJ2loum4VIrLgVnKwh4=
-github.com/urfave/cli/v2 v2.3.0/go.mod h1:LJmUH05zAU44vOAcrfzZQKsZbVcdbOG8rtL3/XcUArI=
-github.com/urfave/cli/v2 v2.8.1 h1:CGuYNZF9IKZY/rfBe3lJpccSoIY1ytfvmgQT90cNOl4=
-github.com/urfave/cli/v2 v2.8.1/go.mod h1:Z41J9TPoffeoqP0Iza0YbAhGvymRdZAd2uPmZ5JxRdY=
-github.com/vektah/gqlparser/v2 v2.4.0/go.mod h1:flJWIR04IMQPGz+BXLrORkrARBxv/rtyIAFvd/MceW0=
-github.com/vektah/gqlparser/v2 v2.4.5/go.mod h1:flJWIR04IMQPGz+BXLrORkrARBxv/rtyIAFvd/MceW0=
-github.com/vektah/gqlparser/v2 v2.5.1 h1:ZGu+bquAY23jsxDRcYpWjttRZrUz07LbiY77gUOHcr4=
-github.com/vektah/gqlparser/v2 v2.5.1/go.mod h1:mPgqFBu/woKTVYWyNk8cO3kh4S/f4aRFZrvOnp3hmCs=
-github.com/wundergraph/graphql-go-tools v1.57.2-0.20221005155749-a4fdba38990b h1:ACY3sLD/diOLMB6uvtpZPB0EWtrlH498mT0N7T1bnm4=
-github.com/wundergraph/graphql-go-tools v1.57.2-0.20221005155749-a4fdba38990b/go.mod h1:gacwbFD8atVwDwzY5btN0/1QXvTprQ/gbT+XlZaQg4c=
-github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 h1:bAn7/zixMGCfxrRTfdpNzjtPYqr8smhKouy9mxVdGPU=
-github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673/go.mod h1:N3UwUGtsrSj3ccvlPHLoLsHnpR27oXr4ZE984MbSER8=
-github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
-github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-gitlab.com/unboundsoftware/eventsourced/amqp v1.5.0 h1:YJu6oD8vzxuSZZqPv2N3UyQzvWDWW0h/XTHiy0aiWSo=
-gitlab.com/unboundsoftware/eventsourced/amqp v1.5.0/go.mod h1:dDShzDLym/gM7Mad26Y0K2TTLUy97hO46XC69Zi91qQ=
-gitlab.com/unboundsoftware/eventsourced/eventsourced v1.9.0/go.mod h1:nm3W8Gr8shALbgBepOocFRqDenG/oZFBON8WLIlOvck=
-gitlab.com/unboundsoftware/eventsourced/eventsourced v1.9.2/go.mod h1:i1Woh2JHIgAK27nFxS7q6/fAceSqX4VR7PYTizY5EMI=
-gitlab.com/unboundsoftware/eventsourced/eventsourced v1.9.3 h1:Khls+eq34tovtDBnSPHpC4tKswUlNDCYHH9Vl5A+hTo=
-gitlab.com/unboundsoftware/eventsourced/eventsourced v1.9.3/go.mod h1:c4rRdyIFW2s49hnLv5c5HsfL3I144mLnvvIOb0JZdpk=
-gitlab.com/unboundsoftware/eventsourced/pg v1.9.0 h1:Hr8kgACHTFICDMV71waf/+CZVKkKJWzXqPGbomMUs70=
-gitlab.com/unboundsoftware/eventsourced/pg v1.9.0/go.mod h1:tfwAGkvmnCpJCAIr94hljJzZXm+W1aHAXjuYJXbXYiI=
+github.com/urfave/cli/v2 v2.27.7 h1:bH59vdhbjLv3LAvIu6gd0usJHgoTTPhCFib8qqOwXYU=
+github.com/urfave/cli/v2 v2.27.7/go.mod h1:CyNAG/xg+iAOg0N4MPGZqVmv2rCoP267496AOXUZjA4=
+github.com/vektah/gqlparser/v2 v2.5.30 h1:EqLwGAFLIzt1wpx1IPpY67DwUujF1OfzgEyDsLrN6kE=
+github.com/vektah/gqlparser/v2 v2.5.30/go.mod h1:D1/VCZtV3LPnQrcPBeR/q5jkSQIPti0uYCP/RI0gIeo=
+github.com/wundergraph/astjson v0.0.0-20250106123708-be463c97e083 h1:8/D7f8gKxTBjW+SZK4mhxTTBVpxcqeBgWF1Rfmltbfk=
+github.com/wundergraph/astjson v0.0.0-20250106123708-be463c97e083/go.mod h1:eOTL6acwctsN4F3b7YE+eE2t8zcJ/doLm9sZzsxxxrE=
+github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.194 h1:qBGT+5oyo86EdTtBIIExE/TPbqa2iBkNb0HTl+kGKJQ=
+github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.194/go.mod h1:DaBrBCMgKGd3t7zg7z11jKm+0mVJiesr/IQCRG9qgP0=
+github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 h1:gEOO8jv9F4OT7lGCjxCBTO/36wtF6j2nSip77qHd4x4=
+github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1/go.mod h1:Ohn+xnUBiLI6FVj/9LpzZWtj1/D6lUovWYBkxHVV3aM=
+gitlab.com/unboundsoftware/eventsourced/amqp v1.8.1 h1:MGHH2Uxp68J9i4V3/3vApB6gjBUjn6RjiPHhbc8Wsno=
+gitlab.com/unboundsoftware/eventsourced/amqp v1.8.1/go.mod h1:clGBkdpFWb5/27aLOhJ6+DB15enJf+T4J5lR6X0lqAs=
+gitlab.com/unboundsoftware/eventsourced/eventsourced v1.19.2 h1:8sCnThNHEPB3BQomcJ7u6fmc2t043fAZSMmVPDDbQOs=
+gitlab.com/unboundsoftware/eventsourced/eventsourced v1.19.2/go.mod h1:KeLn3U67hxbdFLfeXd0c0LI/r1C5rijbWrfNdARWe98=
+gitlab.com/unboundsoftware/eventsourced/pg v1.17.0 h1:pUJzMpNPX0GVsffRZXlpKR1d7Ws96KTxJwbLFPpASSc=
+gitlab.com/unboundsoftware/eventsourced/pg v1.17.0/go.mod h1:WgPrZhyCbsZ3TG2tPUbh2MUjOEaANJjsWi/0hlIwRVU=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/contrib/bridges/otelslog v0.12.0 h1:lFM7SZo8Ce01RzRfnUFQZEYeWRf/MtOA3A5MobOqk2g=
+go.opentelemetry.io/contrib/bridges/otelslog v0.12.0/go.mod h1:Dw05mhFtrKAYu72Tkb3YBYeQpRUJ4quDgo2DQw3No5A=
+go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
+go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.37.0 h1:9PgnL3QNlj10uGxExowIDIZu66aVBwWhXmbOp1pa6RA=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.37.0/go.mod h1:0ineDcLELf6JmKfuo0wvvhAVMuxWFYvkTin2iV4ydPQ=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 h1:Ahq7pZmv87yiyn3jeFz/LekZmPLLdKejuO3NcK9MssM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0/go.mod h1:MJTqhM0im3mRLw1i8uGHnCvUEeS7VwRyxlLC78PA18M=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.37.0 h1:bDMKF3RUSxshZ5OjOTi8rsHGaPKsAt76FaqgvIUySLc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.37.0/go.mod h1:dDT67G/IkA46Mr2l9Uj7HsQVwsjASyV9SjGofsiUZDA=
+go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.13.0 h1:yEX3aC9KDgvYPhuKECHbOlr5GLwH6KTjLJ1sBSkkxkc=
+go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.13.0/go.mod h1:/GXR0tBmmkxDaCUGahvksvp66mx4yh5+cFXgSlhg0vQ=
+go.opentelemetry.io/otel/log v0.13.0 h1:yoxRoIZcohB6Xf0lNv9QIyCzQvrtGZklVbdCoyb7dls=
+go.opentelemetry.io/otel/log v0.13.0/go.mod h1:INKfG4k1O9CL25BaM1qLe0zIedOpvlS5Z7XgSbmN83E=
+go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
+go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
+go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
+go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg=
+go.opentelemetry.io/otel/sdk/log v0.13.0 h1:I3CGUszjM926OphK8ZdzF+kLqFvfRY/IIoFq/TjwfaQ=
+go.opentelemetry.io/otel/sdk/log v0.13.0/go.mod h1:lOrQyCCXmpZdN7NchXb6DOZZa1N5G1R2tm5GMMTpDBw=
+go.opentelemetry.io/otel/sdk/log/logtest v0.13.0 h1:9yio6AFZ3QD9j9oqshV1Ibm9gPLlHNxurno5BreMtIA=
+go.opentelemetry.io/otel/sdk/log/logtest v0.13.0/go.mod h1:QOGiAJHl+fob8Nu85ifXfuQYmJTFAvcrxL6w5/tu168=
+go.opentelemetry.io/otel/sdk/metric v1.37.0 h1:90lI228XrB9jCMuSdA0673aubgRobVZFhbjxHHspCPc=
+go.opentelemetry.io/otel/sdk/metric v1.37.0/go.mod h1:cNen4ZWfiD37l5NhS+Keb5RXVWZWpRE+9WyVCpbo5ps=
+go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
+go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
+go.opentelemetry.io/proto/otlp v1.7.0 h1:jX1VolD6nHuFzOYso2E73H85i92Mv8JQYk0K9vz09os=
+go.opentelemetry.io/proto/otlp v1.7.0/go.mod h1:fSKjH6YJ7HDlwzltzyMj036AJ3ejJLCgCSHGj4efDDo=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
+go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190426145343-a29dc8fdc734/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
-golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4 h1:6zppjxzCulZykYSLyVDYbneBfbaBIQPYMevg0bEwv2s=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/crypto v0.39.0 h1:SHs+kF4LP+f+p14esP5jAoDpHU8Gu/v9lFRK6IT5imM=
+golang.org/x/crypto v0.39.0/go.mod h1:L+Xg3Wf6HoL4Bn4238Z6ft6KfEpN0tJGo53AAPC632U=
+golang.org/x/exp v0.0.0-20250506013437-ce4c2cf36ca6 h1:y5zboxd6LQAqYIhHnB48p0ByQ/GnQx2BE33L8BOHQkI=
+golang.org/x/exp v0.0.0-20250506013437-ce4c2cf36ca6/go.mod h1:U6Lno4MTRCDY+Ba7aCcauB9T60gsv5s4ralQzP72ZoQ=
+golang.org/x/mod v0.25.0 h1:n7a+ZbQKQA/Ysbyb0/6IbB1H/X41mKgbhfv7AfG/44w=
+golang.org/x/mod v0.25.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.41.0 h1:vBTly1HeNPEn3wtREYfy4GZ/NECgw2Cnl+nK6Nz3uvw=
+golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8=
+golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220319134239-a9b59b0215f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20221006211917-84dc82d7e875 h1:AzgQNqF+FKwyQ5LbVrVqOcuuFB67N47F9+htZYH0wFM=
-golang.org/x/sys v0.0.0-20221006211917-84dc82d7e875/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
+golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7 h1:olpwvP2KacW1ZWvsR7uQhoyTYvKAupfQrRGBFM352Gk=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.26.0 h1:P42AVeLghgTYr4+xUnTRKDMqpar+PtX7KWuNQL21L8M=
+golang.org/x/text v0.26.0/go.mod h1:QK15LZJUUQVJxhz7wXgxSy/CJaTFjd0G+YLonydOVQA=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20200815165600-90abf76919f3/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.1.9/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU=
-golang.org/x/tools v0.1.10/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E=
-golang.org/x/tools v0.1.12 h1:VveCTK38A2rkS8ZqFY25HIDFscX5X9OoEhJd3quQmXU=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20220517211312-f3a8303e98df h1:5Pf6pFKu98ODmgnpvkJ3kFUOQGGLIzLIkbzUHp47618=
-golang.org/x/xerrors v0.0.0-20220517211312-f3a8303e98df/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+golang.org/x/tools v0.34.0 h1:qIpSLOxeCYGg9TrcJokLBG4KFA6d795g0xkBkiESGlo=
+golang.org/x/tools v0.34.0/go.mod h1:pAP9OwEaY1CAW3HOmg3hLZC5Z0CCmzjAF2UQMSqNARg=
+google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 h1:oWVWY3NzT7KJppx2UKhKmzPq4SRe0LdCijVRwvGeikY=
+google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822/go.mod h1:h3c4v36UTKzUiuaOKQ6gr3S+0hovBtUrXzTG/i3+XEc=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 h1:fc6jSaCT0vBduLYZHYrBBNY4dsWuvgyff9noRNDdBeE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
+google.golang.org/grpc v1.73.0 h1:VIWSmpI2MegBtTuFt5/JWy2oXxtjJ/e89Z70ImfD2ok=
+google.golang.org/grpc v1.73.0/go.mod h1:50sbHOUqWoCQGI8V2HQLJM0B+LMlIUjNSZmow7EVBQc=
+google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
+google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU=
-gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
+gopkg.in/go-jose/go-jose.v2 v2.6.3 h1:nt80fvSDlhKWQgSWyHyy5CfmlQr+asih51R8PTWNKKs=
+gopkg.in/go-jose/go-jose.v2 v2.6.3/go.mod h1:zzZDPkNNw/c9IE7Z9jr11mBZQhKQTMzoEEIoEdZlFBI=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0-20200605160147-a5ece683394c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+modernc.org/libc v1.65.0 h1:e183gLDnAp9VJh6gWKdTy0CThL9Pt7MfcR/0bgb7Y1Y=
+modernc.org/libc v1.65.0/go.mod h1:7m9VzGq7APssBTydds2zBcxGREwvIGpuUBaKTXdm2Qs=
+modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
+modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
+modernc.org/memory v1.10.0 h1:fzumd51yQ1DxcOxSO+S6X7+QTuVU+n8/Aj7swYjFfC4=
+modernc.org/memory v1.10.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/sqlite v1.37.0 h1:s1TMe7T3Q3ovQiK2Ouz4Jwh7dw4ZDqbebSDTlSJdfjI=
+modernc.org/sqlite v1.37.0/go.mod h1:5YiWv+YviqGMuGw4V+PNplcyaJ5v+vQd7TQOgkACoJM=

gqlgen.yml

@@ -39,6 +39,8 @@ resolver:
 # Optional: set to speed up generation time by not performing a final validation pass.
 # skip_validation: true
 
+omit_gqlgen_version_in_file_notice: true
+
 # gqlgen will search for any type names in the schema in these go packages
 # if they match it will use them, otherwise it will generate them.
 autobind:

graph/converter.go

@@ -0,0 +1,49 @@
+package graph
+
+import (
+	"gitlab.com/unboundsoftware/schemas/domain"
+	"gitlab.com/unboundsoftware/schemas/graph/model"
+)
+
+func ToGqlOrganizations(orgs []domain.Organization) []*model.Organization {
+	result := make([]*model.Organization, len(orgs))
+	for i, o := range orgs {
+		result[i] = ToGqlOrganization(o)
+	}
+	return result
+}
+
+func ToGqlOrganization(o domain.Organization) *model.Organization {
+	users := ToGqlUsers(o.Users)
+	apiKeys := ToGqlAPIKeys(o.APIKeys)
+	return &model.Organization{
+		ID:      o.ID.String(),
+		Name:    o.Name,
+		Users:   users,
+		APIKeys: apiKeys,
+	}
+}
+
+func ToGqlUsers(users []string) []*model.User {
+	result := make([]*model.User, len(users))
+	for i, u := range users {
+		result[i] = &model.User{ID: u}
+	}
+	return result
+}
+
+func ToGqlAPIKeys(keys []domain.APIKey) []*model.APIKey {
+	result := make([]*model.APIKey, len(keys))
+	for i, k := range keys {
+		result[i] = &model.APIKey{
+			ID:           apiKeyId(k.OrganizationId, k.Name),
+			Name:         k.Name,
+			Key:          &k.Key,
+			Organization: nil,
+			Refs:         k.Refs,
+			Read:         k.Read,
+			Publish:      k.Publish,
+		}
+	}
+	return result
+}

graph/model/models_gen.go

@@ -10,19 +10,50 @@ type Supergraph interface {
 	IsSupergraph()
 }
 
+type APIKey struct {
+	ID           string        `json:"id"`
+	Name         string        `json:"name"`
+	Key          *string       `json:"key,omitempty"`
+	Organization *Organization `json:"organization"`
+	Refs         []string      `json:"refs"`
+	Read         bool          `json:"read"`
+	Publish      bool          `json:"publish"`
+}
+
+type InputAPIKey struct {
+	Name           string   `json:"name"`
+	OrganizationID string   `json:"organizationId"`
+	Refs           []string `json:"refs"`
+	Read           bool     `json:"read"`
+	Publish        bool     `json:"publish"`
+}
+
 type InputSubGraph struct {
 	Ref     string  `json:"ref"`
 	Service string  `json:"service"`
-	URL     *string `json:"url"`
-	WsURL   *string `json:"wsUrl"`
+	URL     *string `json:"url,omitempty"`
+	WsURL   *string `json:"wsUrl,omitempty"`
 	Sdl     string  `json:"sdl"`
 }
 
+type Mutation struct {
+}
+
+type Organization struct {
+	ID      string    `json:"id"`
+	Name    string    `json:"name"`
+	Users   []*User   `json:"users"`
+	APIKeys []*APIKey `json:"apiKeys"`
+}
+
+type Query struct {
+}
+
 type SubGraph struct {
 	ID        string    `json:"id"`
 	Service   string    `json:"service"`
-	URL       *string   `json:"url"`
-	WsURL     *string   `json:"wsUrl"`
+	URL       *string   `json:"url,omitempty"`
+	WsURL     *string   `json:"wsUrl,omitempty"`
 	Sdl       string    `json:"sdl"`
 	ChangedBy string    `json:"changedBy"`
 	ChangedAt time.Time `json:"changedAt"`
@@ -31,6 +62,7 @@ type SubGraph struct {
 type SubGraphs struct {
 	ID              string      `json:"id"`
 	MinDelaySeconds int         `json:"minDelaySeconds"`
+	Sdl             string      `json:"sdl"`
 	SubGraphs       []*SubGraph `json:"subGraphs"`
 }
 
@@ -42,3 +74,7 @@ type Unchanged struct {
 }
 
 func (Unchanged) IsSupergraph() {}
+
+type User struct {
+	ID string `json:"id"`
+}

graph/resolver.go

@@ -1,30 +1,59 @@
 package graph
 
 import (
-	"github.com/apex/log"
+	"context"
+	"fmt"
+	"log/slog"
+
 	"gitlab.com/unboundsoftware/eventsourced/eventsourced"
 
 	"gitlab.com/unboundsoftware/schemas/cache"
+	"gitlab.com/unboundsoftware/schemas/middleware"
 )
 
 //go:generate go run github.com/99designs/gqlgen
+//go:generate gofumpt -w .
+//go:generate goimports -w -local gitlab.com/unboundsoftware/schemas .
 
 // This file will not be regenerated automatically.
 //
 // It serves as dependency injection for your app, add any dependencies you require here.
 
 type Publisher interface {
-	Publish(event eventsourced.Event) error
-	Stop() error
+	Publish(ctx context.Context, event eventsourced.Event) error
 }
 
 type Resolver struct {
 	EventStore eventsourced.EventStore
 	Publisher  Publisher
-	Logger     log.Interface
+	Logger     *slog.Logger
 	Cache      *cache.Cache
 }
 
-func (r *Resolver) handler(aggregate eventsourced.Aggregate) (eventsourced.CommandHandler, error) {
-	return eventsourced.NewHandler(aggregate, r.EventStore, eventsourced.WithEventPublisher(r.Publisher))
+func (r *Resolver) apiKeyCanAccessRef(ctx context.Context, ref string, publish bool) (string, error) {
+	key, err := middleware.ApiKeyFromContext(ctx)
+	if err != nil {
+		return "", err
+	}
+	apiKey := r.Cache.ApiKeyByKey(key)
+	if publish && !apiKey.Publish {
+		return "", fmt.Errorf("provided API-key doesn't have publish privilege")
+	}
+	if !publish && !apiKey.Read {
+		return "", fmt.Errorf("provided API-key doesn't have read privilege")
+	}
+	for _, rr := range apiKey.Refs {
+		if rr == ref {
+			return apiKey.Name, nil
+		}
+	}
+	return "", fmt.Errorf("provided API-key doesn't have the required privilege on the requested Schema Ref")
+}
+
+func (r *Resolver) handler(ctx context.Context, aggregate eventsourced.Aggregate) (eventsourced.CommandHandler, error) {
+	return eventsourced.NewHandler(ctx, aggregate, r.EventStore, eventsourced.WithEventPublisher(r.Publisher))
+}
+
+func apiKeyId(orgId, name string) string {
+	return fmt.Sprintf("%s-%s", orgId, name)
 }

graph/schema.graphqls

@@ -1,10 +1,33 @@
 type Query {
-  subGraphs(ref: String!): [SubGraph!]! @hasApiKey @deprecated(reason: "Use supergraph instead")
-  supergraph(ref: String!, isAfter: String): Supergraph! @hasApiKey
+  organizations: [Organization!]! @auth(user: true)
+  supergraph(ref: String!, isAfter: String): Supergraph! @auth(organization: true)
 }
 
 type Mutation {
-  updateSubGraph(input: InputSubGraph!): SubGraph! @hasApiKey
+  addOrganization(name: String!): Organization! @auth(user: true)
+  addAPIKey(input: InputAPIKey): APIKey! @auth(user: true)
+  updateSubGraph(input: InputSubGraph!): SubGraph! @auth(organization: true)
+}
+
+type Organization {
+  id: ID!
+  name: String!
+  users: [User!]!
+  apiKeys: [APIKey!]!
+}
+
+type User {
+  id: String!
+}
+
+type APIKey {
+  id: ID!
+  name: String!
+  key: String
+  organization: Organization!
+  refs: [String!]!
+  read: Boolean!
+  publish: Boolean!
 }
 
 union Supergraph = Unchanged | SubGraphs
@@ -17,6 +40,7 @@ type Unchanged {
 type SubGraphs {
   id: ID!
   minDelaySeconds: Int!
+  sdl: String!
   subGraphs: [SubGraph!]!
 }
 
@@ -30,6 +54,14 @@ type SubGraph {
   changedAt: Time!
 }
 
+input InputAPIKey {
+  name: String!
+  organizationId: ID!
+  refs: [String!]!
+  read: Boolean!
+  publish: Boolean!
+}
+
 input InputSubGraph {
   ref: String!
   service: String!
@@ -40,4 +72,4 @@ input InputSubGraph {
 
 scalar Time
 
-directive @hasApiKey on FIELD_DEFINITION
+directive @auth(user: Boolean, organization: Boolean) on FIELD_DEFINITION

graph/schema.helpers.go

@@ -1,15 +1,17 @@
 package graph
 
 import (
+	"context"
+
 	"gitlab.com/unboundsoftware/eventsourced/eventsourced"
 
 	"gitlab.com/unboundsoftware/schemas/domain"
 	"gitlab.com/unboundsoftware/schemas/graph/model"
 )
 
-func (r *Resolver) fetchSubGraph(subGraphId string) (*domain.SubGraph, error) {
+func (r *Resolver) fetchSubGraph(ctx context.Context, subGraphId string) (*domain.SubGraph, error) {
 	subGraph := &domain.SubGraph{BaseAggregate: eventsourced.BaseAggregateFromString(subGraphId)}
-	_, err := r.handler(subGraph)
+	_, err := r.handler(ctx, subGraph)
 	if err != nil {
 		return nil, err
 	}
@@ -27,3 +29,13 @@ func (r *Resolver) toGqlSubGraph(subGraph *domain.SubGraph) *model.SubGraph {
 		ChangedAt: subGraph.ChangedAt,
 	}
 }
+
+func (r *Resolver) stringEqual(s1, s2 *string) bool {
+	if s1 == nil && s2 == nil {
+		return true
+	}
+	if s1 != nil && s2 != nil && *s1 == *s2 {
+		return true
+	}
+	return false
+}

graph/schema.resolvers.go

@@ -2,38 +2,100 @@ package graph
 
 // This file will be automatically regenerated based on the schema, any resolver implementations
 // will be copied through when generating and any unknown code will be moved to the end.
+// Code generated by github.com/99designs/gqlgen
 
 import (
 	"context"
 	"fmt"
 	"strings"
 
-	"github.com/wundergraph/graphql-go-tools/pkg/federation/sdlmerge"
 	"gitlab.com/unboundsoftware/eventsourced/eventsourced"
 
 	"gitlab.com/unboundsoftware/schemas/domain"
 	"gitlab.com/unboundsoftware/schemas/graph/generated"
 	"gitlab.com/unboundsoftware/schemas/graph/model"
+	"gitlab.com/unboundsoftware/schemas/middleware"
+	"gitlab.com/unboundsoftware/schemas/rand"
+	"gitlab.com/unboundsoftware/schemas/sdlmerge"
 )
 
+// AddOrganization is the resolver for the addOrganization field.
+func (r *mutationResolver) AddOrganization(ctx context.Context, name string) (*model.Organization, error) {
+	sub := middleware.UserFromContext(ctx)
+	org := &domain.Organization{}
+	h, err := r.handler(ctx, org)
+	if err != nil {
+		return nil, err
+	}
+	_, err = h.Handle(ctx, &domain.AddOrganization{
+		Name:      name,
+		Initiator: sub,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return ToGqlOrganization(*org), nil
+}
+
+// AddAPIKey is the resolver for the addAPIKey field.
+func (r *mutationResolver) AddAPIKey(ctx context.Context, input *model.InputAPIKey) (*model.APIKey, error) {
+	sub := middleware.UserFromContext(ctx)
+	org := &domain.Organization{BaseAggregate: eventsourced.BaseAggregateFromString(input.OrganizationID)}
+	h, err := r.handler(ctx, org)
+	if err != nil {
+		return nil, err
+	}
+	key := fmt.Sprintf("us_ak_%s", rand.String(16))
+	_, err = h.Handle(ctx, &domain.AddAPIKey{
+		Name:      input.Name,
+		Key:       key,
+		Refs:      input.Refs,
+		Read:      input.Read,
+		Publish:   input.Publish,
+		Initiator: sub,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return &model.APIKey{
+		ID:   apiKeyId(input.OrganizationID, input.Name),
+		Name: input.Name,
+		Key:  &key,
+		Organization: &model.Organization{
+			ID:   input.OrganizationID,
+			Name: org.Name,
+		},
+		Refs:    input.Refs,
+		Read:    input.Read,
+		Publish: input.Publish,
+	}, nil
+}
+
 // UpdateSubGraph is the resolver for the updateSubGraph field.
 func (r *mutationResolver) UpdateSubGraph(ctx context.Context, input model.InputSubGraph) (*model.SubGraph, error) {
-	subGraphId := r.Cache.SubGraphId(input.Ref, input.Service)
+	orgId := middleware.OrganizationFromContext(ctx)
+	name, err := r.apiKeyCanAccessRef(ctx, input.Ref, true)
+	if err != nil {
+		return nil, err
+	}
+	subGraphId := r.Cache.SubGraphId(orgId, input.Ref, input.Service)
 	subGraph := &domain.SubGraph{}
 	if subGraphId != "" {
 		subGraph.BaseAggregate = eventsourced.BaseAggregateFromString(subGraphId)
 	}
-	handler, err := r.handler(subGraph)
+	handler, err := r.handler(ctx, subGraph)
 	if err != nil {
 		return nil, err
 	}
-	if strings.TrimSpace(input.Sdl) == strings.TrimSpace(subGraph.Sdl) {
+	if strings.TrimSpace(input.Sdl) == strings.TrimSpace(subGraph.Sdl) &&
+		r.stringEqual(input.URL, subGraph.Url) &&
+		r.stringEqual(input.WsURL, subGraph.WSUrl) {
 		return r.toGqlSubGraph(subGraph), nil
 	}
 	serviceSDLs := []string{input.Sdl}
-	services, _ := r.Cache.Services(input.Ref, "")
+	services, _ := r.Cache.Services(orgId, input.Ref, "")
 	for _, id := range services {
-		sg, err := r.fetchSubGraph(id)
+		sg, err := r.fetchSubGraph(ctx, id)
 		if err != nil {
 			return nil, err
 		}
@@ -45,13 +107,14 @@ func (r *mutationResolver) UpdateSubGraph(ctx context.Context, input model.Input
 	if err != nil {
 		return nil, err
 	}
-	_, err = handler.Handle(domain.UpdateSubGraph{
-		Ref:       input.Ref,
-		Service:   input.Service,
-		Url:       input.URL,
-		WSUrl:     input.WsURL,
-		Sdl:       input.Sdl,
-		Initiator: "Fetch name from API-key?",
+	_, err = handler.Handle(ctx, domain.UpdateSubGraph{
+		OrganizationId: orgId,
+		Ref:            input.Ref,
+		Service:        input.Service,
+		Url:            input.URL,
+		WSUrl:          input.WsURL,
+		Sdl:            input.Sdl,
+		Initiator:      name,
 	})
 	if err != nil {
 		return nil, err
@@ -59,25 +122,25 @@ func (r *mutationResolver) UpdateSubGraph(ctx context.Context, input model.Input
 	return r.toGqlSubGraph(subGraph), nil
 }
 
-// SubGraphs is the resolver for the subGraphs field.
-func (r *queryResolver) SubGraphs(ctx context.Context, ref string) ([]*model.SubGraph, error) {
-	res, err := r.Supergraph(ctx, ref, nil)
-	if err != nil {
-		return nil, err
-	}
-	if s, ok := res.(*model.SubGraphs); ok {
-		return s.SubGraphs, nil
-	}
-	return nil, fmt.Errorf("unexpected response")
+// Organizations is the resolver for the organizations field.
+func (r *queryResolver) Organizations(ctx context.Context) ([]*model.Organization, error) {
+	sub := middleware.UserFromContext(ctx)
+	orgs := r.Cache.OrganizationsByUser(sub)
+	return ToGqlOrganizations(orgs), nil
 }
 
 // Supergraph is the resolver for the supergraph field.
 func (r *queryResolver) Supergraph(ctx context.Context, ref string, isAfter *string) (model.Supergraph, error) {
+	orgId := middleware.OrganizationFromContext(ctx)
+	_, err := r.apiKeyCanAccessRef(ctx, ref, false)
+	if err != nil {
+		return nil, err
+	}
 	after := ""
 	if isAfter != nil {
 		after = *isAfter
 	}
-	services, lastUpdate := r.Cache.Services(ref, after)
+	services, lastUpdate := r.Cache.Services(orgId, ref, after)
 	if after == lastUpdate {
 		return &model.Unchanged{
 			ID:              lastUpdate,
@@ -86,7 +149,7 @@ func (r *queryResolver) Supergraph(ctx context.Context, ref string, isAfter *str
 	}
 	subGraphs := make([]*model.SubGraph, len(services))
 	for i, id := range services {
-		sg, err := r.fetchSubGraph(id)
+		sg, err := r.fetchSubGraph(ctx, id)
 		if err != nil {
 			return nil, err
 		}
@@ -100,9 +163,23 @@ func (r *queryResolver) Supergraph(ctx context.Context, ref string, isAfter *str
 			ChangedAt: sg.ChangedAt,
 		}
 	}
+
+	var serviceSDLs []string
+	for _, id := range services {
+		sg, err := r.fetchSubGraph(ctx, id)
+		if err != nil {
+			return nil, err
+		}
+		serviceSDLs = append(serviceSDLs, sg.Sdl)
+	}
+	sdl, err := sdlmerge.MergeSDLs(serviceSDLs...)
+	if err != nil {
+		return nil, err
+	}
 	return &model.SubGraphs{
 		ID:              lastUpdate,
 		SubGraphs:       subGraphs,
+		Sdl:             sdl,
 		MinDelaySeconds: 10,
 	}, nil
 }

hash/hash.go

@@ -0,0 +1,11 @@
+package hash
+
+import (
+	"crypto/sha256"
+	"encoding/base64"
+)
+
+func String(s string) string {
+	encoded := sha256.New().Sum([]byte(s))
+	return base64.StdEncoding.EncodeToString(encoded)
+}

k8s/autoscale.yaml

@@ -2,7 +2,7 @@ apiVersion: autoscaling/v2
 kind: HorizontalPodAutoscaler
 metadata:
   labels:
-    app: schemas
+    app.kubernetes.io/name: schemas
   name: schemas
 spec:
   scaleTargetRef:

k8s/config-prod.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: schemas
+data:
+  LOG_FORMAT: "otel"
+  ENVIRONMENT: "production"

k8s/config.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: schemas
+data:
+  ENVIRONMENT: "development"

k8s/deploy.yaml

@@ -7,7 +7,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   labels:
-    app: schemas
+    app.kubernetes.io/name: schemas
   name: schemas
   annotations:
     kubernetes.io/change-cause: "${TIMESTAMP} Deployed commit id: ${COMMIT}"
@@ -15,7 +15,7 @@ spec:
   replicas: 1
   selector:
     matchLabels:
-      app: schemas
+      app.kubernetes.io/name: schemas
   strategy:
     rollingUpdate:
       maxSurge: 1
@@ -24,7 +24,7 @@ spec:
   template:
     metadata:
       labels:
-        app: schemas
+        app.kubernetes.io/name: schemas
     spec:
       affinity:
         podAntiAffinity:
@@ -33,7 +33,7 @@ spec:
             podAffinityTerm:
               labelSelector:
                 matchExpressions:
-                - key: "app"
+                - key: "app.kubernetes.io/name"
                   operator: In
                   values:
                   - schemas
@@ -41,10 +41,9 @@ spec:
       containers:
       - name: schemas
         resources:
-          limits:
-            memory: "100Mi"
           requests:
-            memory: "100Mi"
+            cpu: "20m"
+            memory: "20Mi"
         readinessProbe:
           httpGet:
             path: /health
@@ -57,11 +56,14 @@ spec:
         ports:
         - name: api
           containerPort: 8080
+        env:
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: http://k8s-monitoring-alloy-receiver.monitoring.svc.cluster.local:4318
         envFrom:
-        - secretRef:
+        - configMapRef:
             name: schemas
         - secretRef:
-            name: rabbitmq
+            name: schemas
       restartPolicy: Always
       serviceAccountName: schemas
 ---
@@ -77,5 +79,5 @@ spec:
     protocol: TCP
     targetPort: 8080
   selector:
-    app: schemas
+    app.kubernetes.io/name: schemas
   type: NodePort

k8s/ingress-prod.yaml

@@ -4,11 +4,12 @@ metadata:
   name: schemas-ingress
   annotations:
     kubernetes.io/ingress.class: "alb"
-    alb.ingress.kubernetes.io/group.name: "unbound"
+    alb.ingress.kubernetes.io/group.name: "default"
     alb.ingress.kubernetes.io/scheme: internet-facing
     alb.ingress.kubernetes.io/target-type: instance
     alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80},{"HTTPS": 443}]'
     alb.ingress.kubernetes.io/ssl-redirect: "443"
+    alb.ingress.kubernetes.io/healthcheck-path: '/health'
 spec:
   rules:
   - host: "schemas.unbound.se"

k8s/pdb-prod.yaml

@@ -0,0 +1,9 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: schemas-pdb
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: schemas

k8s/secrets-local.yaml

@@ -5,3 +5,4 @@ metadata:
 stringData:
   API_KEY: supersecret123!
   POSTGRES_URL: "postgres://postgres:postgres@postgres:5432/schemas?sslmode=disable"
+  AMQP_URL: "amqp://user:password@rabbitmq:5672/"

k8s/secrets.yaml

@@ -1,8 +1,7 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: schemas
-  namespace: default
 spec:
   refreshInterval: 1h
   secretStoreRef:
@@ -11,6 +10,8 @@ spec:
   target:
     creationPolicy: Owner
     template:
+      mergePolicy: Merge
+      engineVersion: 'v2'
       data:
         POSTGRES_URL: "postgres://{{ .DB_USERNAME }}:{{ .DB_PASSWORD }}@{{ .DB_HOST }}:{{ .DB_PORT }}/schemas?sslmode=disable"
         API_KEY: "{{ .API_KEY }}"
@@ -19,3 +20,5 @@ spec:
       key: services/schemas
   - extract:
       key: rds/postgres/prod-psql
+  - extract:
+      key: mq/rabbit/prod

logging/log.go

@@ -0,0 +1,65 @@
+package logging
+
+import (
+	"context"
+	"log/slog"
+	"os"
+
+	"go.opentelemetry.io/contrib/bridges/otelslog"
+)
+
+type Logger interface {
+	Info(msg string, args ...any)
+	Warn(msg string, args ...any)
+	Error(msg string, args ...any)
+}
+
+var defaultLogger *slog.Logger
+
+type contextKey string
+
+const loggerKey = contextKey("logger")
+
+func SetupLogger(logLevel, logFormat, serviceName, buildVersion string) *slog.Logger {
+	var leveler slog.LevelVar
+
+	err := leveler.UnmarshalText([]byte(logLevel))
+
+	handlerOpts := &slog.HandlerOptions{
+		AddSource:   false,
+		Level:       leveler.Level(),
+		ReplaceAttr: nil,
+	}
+
+	var handler slog.Handler
+	switch logFormat {
+	case "json":
+		handler = slog.NewJSONHandler(os.Stdout, handlerOpts)
+	case "text":
+		handler = slog.NewTextHandler(os.Stdout, handlerOpts)
+	case "otel":
+		handler = otelslog.NewHandler(serviceName,
+			otelslog.WithVersion(buildVersion))
+	}
+	defaultLogger = slog.New(handler).With("service", serviceName).With("version", buildVersion)
+	if err != nil {
+		defaultLogger.With("err", err).Error("Failed to parse log level")
+		os.Exit(1)
+	}
+	slog.SetDefault(defaultLogger)
+	return defaultLogger
+}
+
+// ContextWithLogger returns a new Context with the logger attached
+func ContextWithLogger(ctx context.Context, logger *slog.Logger) context.Context {
+	return context.WithValue(ctx, loggerKey, logger)
+}
+
+// LoggerFromContext returns a logger from the passed context or the default logger
+func LoggerFromContext(ctx context.Context) *slog.Logger {
+	logger := ctx.Value(loggerKey)
+	if l, ok := logger.(*slog.Logger); ok {
+		return l
+	}
+	return defaultLogger
+}

logging/mocklogger.go

@@ -0,0 +1,48 @@
+package logging
+
+import (
+	"bytes"
+	"log/slog"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func NewMockLogger() *MockLogger {
+	logged := &bytes.Buffer{}
+
+	return &MockLogger{
+		logged: logged,
+		logger: slog.New(slog.NewTextHandler(logged, &slog.HandlerOptions{
+			ReplaceAttr: func(groups []string, a slog.Attr) slog.Attr {
+				if a.Key == "time" {
+					return slog.Attr{}
+				}
+				return a
+			},
+		})),
+	}
+}
+
+type MockLogger struct {
+	logger *slog.Logger
+	logged *bytes.Buffer
+}
+
+func (m *MockLogger) Logger() *slog.Logger {
+	return m.logger
+}
+
+func (m *MockLogger) Check(t testing.TB, wantLogged []string) {
+	var gotLogged []string
+	if m.logged.String() != "" {
+		gotLogged = strings.Split(m.logged.String(), "\n")
+		gotLogged = gotLogged[:len(gotLogged)-1]
+	}
+	if len(wantLogged) == 0 {
+		assert.Empty(t, gotLogged)
+		return
+	}
+	assert.Equal(t, wantLogged, gotLogged)
+}

middleware/apikey.go

@@ -4,26 +4,17 @@ import (
 	"context"
 	"fmt"
 	"net/http"
-
-	"github.com/99designs/gqlgen/graphql"
-	"github.com/apex/log"
 )
 
-type ContextKey string
-
 const (
 	ApiKey = ContextKey("apikey")
 )
 
-func NewApiKey(apiKey string, logger log.Interface) *ApiKeyMiddleware {
-	return &ApiKeyMiddleware{
-		apiKey: apiKey,
-	}
+func NewApiKey() *ApiKeyMiddleware {
+	return &ApiKeyMiddleware{}
 }
 
-type ApiKeyMiddleware struct {
-	apiKey string
-}
+type ApiKeyMiddleware struct{}
 
 func (m *ApiKeyMiddleware) Handler(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -37,23 +28,12 @@ func (m *ApiKeyMiddleware) Handler(next http.Handler) http.Handler {
 	})
 }
 
-func (m *ApiKeyMiddleware) Directive(ctx context.Context, obj interface{}, next graphql.Resolver) (res interface{}, err error) {
-	key, err := m.fromContext(ctx)
-	if err != nil {
-		return nil, err
-	}
-	if key != m.apiKey {
-		return nil, fmt.Errorf("invalid API-key")
-	}
-	return next(ctx)
-}
-
-func (m *ApiKeyMiddleware) fromContext(ctx context.Context) (string, error) {
+func ApiKeyFromContext(ctx context.Context) (string, error) {
 	if value := ctx.Value(ApiKey); value != nil {
 		if u, ok := value.(string); ok {
 			return u, nil
 		}
 		return "", fmt.Errorf("current API-key is in wrong format")
 	}
-	return "", fmt.Errorf("no API-key found")
+	return "", nil
 }

middleware/auth.go

@@ -0,0 +1,90 @@
+package middleware
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+
+	"github.com/99designs/gqlgen/graphql"
+	"github.com/golang-jwt/jwt/v5"
+
+	"gitlab.com/unboundsoftware/schemas/domain"
+	"gitlab.com/unboundsoftware/schemas/hash"
+)
+
+const (
+	UserKey         = ContextKey("user")
+	OrganizationKey = ContextKey("organization")
+)
+
+type Cache interface {
+	OrganizationByAPIKey(apiKey string) *domain.Organization
+}
+
+func NewAuth(cache Cache) *AuthMiddleware {
+	return &AuthMiddleware{
+		cache: cache,
+	}
+}
+
+type AuthMiddleware struct {
+	cache Cache
+}
+
+func (m *AuthMiddleware) Handler(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		ctx := r.Context()
+		token, err := TokenFromContext(r.Context())
+		if err != nil {
+			w.WriteHeader(http.StatusInternalServerError)
+			_, _ = w.Write([]byte("Invalid JWT token format"))
+			return
+		}
+		if token != nil {
+			ctx = context.WithValue(ctx, UserKey, token.Claims.(jwt.MapClaims)["sub"])
+		}
+		apiKey, err := ApiKeyFromContext(r.Context())
+		if err != nil {
+			w.WriteHeader(http.StatusInternalServerError)
+			_, _ = w.Write([]byte("Invalid API Key format"))
+			return
+		}
+		if organization := m.cache.OrganizationByAPIKey(hash.String(apiKey)); organization != nil {
+			ctx = context.WithValue(ctx, OrganizationKey, *organization)
+		}
+
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
+
+func UserFromContext(ctx context.Context) string {
+	if value := ctx.Value(UserKey); value != nil {
+		if u, ok := value.(string); ok {
+			return u
+		}
+	}
+	return ""
+}
+
+func OrganizationFromContext(ctx context.Context) string {
+	if value := ctx.Value(OrganizationKey); value != nil {
+		if u, ok := value.(domain.Organization); ok {
+			return u.ID.String()
+		}
+	}
+	return ""
+}
+
+func (m *AuthMiddleware) Directive(ctx context.Context, _ interface{}, next graphql.Resolver, user *bool, organization *bool) (res interface{}, err error) {
+	if user != nil && *user {
+		if u := UserFromContext(ctx); u == "" {
+			return nil, fmt.Errorf("no user available in request")
+		}
+	}
+	if organization != nil && *organization {
+		if orgId := OrganizationFromContext(ctx); orgId == "" {
+			return nil, fmt.Errorf("no organization available in request")
+		}
+	}
+	return next(ctx)
+}

middleware/auth0.go

@@ -0,0 +1,174 @@
+package middleware
+
+import (
+	"context"
+	"crypto/tls"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	mw "github.com/auth0/go-jwt-middleware/v2"
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/pkg/errors"
+)
+
+type Auth0 struct {
+	domain   string
+	audience string
+	client   *http.Client
+	cache    JwksCache
+}
+
+func NewAuth0(audience, domain string, strictSsl bool) *Auth0 {
+	customTransport := http.DefaultTransport.(*http.Transport).Clone()
+	customTransport.TLSClientConfig = &tls.Config{InsecureSkipVerify: !strictSsl}
+	client := &http.Client{Transport: customTransport}
+
+	return &Auth0{
+		domain:   domain,
+		audience: audience,
+		client:   client,
+		cache: JwksCache{
+			RWMutex: &sync.RWMutex{},
+			cache:   make(map[string]cacheItem),
+		},
+	}
+}
+
+type Response struct {
+	Message string `json:"message"`
+}
+
+type Jwks struct {
+	Keys []JSONWebKeys `json:"keys"`
+}
+
+type JSONWebKeys struct {
+	Kty string   `json:"kty"`
+	Kid string   `json:"kid"`
+	Use string   `json:"use"`
+	N   string   `json:"n"`
+	E   string   `json:"e"`
+	X5c []string `json:"x5c"`
+}
+
+func (a *Auth0) ValidationKeyGetter() func(token *jwt.Token) (interface{}, error) {
+	return func(token *jwt.Token) (interface{}, error) {
+		// Verify 'aud' claim
+
+		cert, err := a.getPemCert(token)
+		if err != nil {
+			panic(err.Error())
+		}
+
+		result, _ := jwt.ParseRSAPublicKeyFromPEM([]byte(cert))
+		return result, nil
+	}
+}
+
+func (a *Auth0) Middleware() *mw.JWTMiddleware {
+	issuer := fmt.Sprintf("https://%s/", a.domain)
+	jwtMiddleware := mw.New(func(ctx context.Context, token string) (interface{}, error) {
+		jwtToken, err := jwt.Parse(token, a.ValidationKeyGetter(), jwt.WithAudience(a.audience), jwt.WithIssuer(issuer))
+		if err != nil {
+			return nil, err
+		}
+		if _, ok := jwtToken.Method.(*jwt.SigningMethodRSA); !ok {
+			return nil, fmt.Errorf("unexpected signing method: %v", jwtToken.Header["alg"])
+		}
+		return jwtToken, nil
+	},
+		mw.WithTokenExtractor(func(r *http.Request) (string, error) {
+			token := r.Header.Get("Authorization")
+			if strings.HasPrefix(token, "Bearer ") {
+				return token[7:], nil
+			}
+			return "", nil
+		}),
+		mw.WithCredentialsOptional(true),
+	)
+
+	return jwtMiddleware
+}
+
+func TokenFromContext(ctx context.Context) (*jwt.Token, error) {
+	if value := ctx.Value(mw.ContextKey{}); value != nil {
+		if u, ok := value.(*jwt.Token); ok {
+			return u, nil
+		}
+		return nil, fmt.Errorf("token is in wrong format")
+	}
+	return nil, nil
+}
+
+func (a *Auth0) cacheGetWellknown(url string) (*Jwks, error) {
+	if value := a.cache.get(url); value != nil {
+		return value, nil
+	}
+	jwks := &Jwks{}
+	resp, err := a.client.Get(url)
+	if err != nil {
+		return jwks, err
+	}
+	defer func() {
+		_ = resp.Body.Close()
+	}()
+	err = json.NewDecoder(resp.Body).Decode(jwks)
+	if err == nil && jwks != nil {
+		a.cache.put(url, jwks)
+	}
+	return jwks, err
+}
+
+func (a *Auth0) getPemCert(token *jwt.Token) (string, error) {
+	jwks, err := a.cacheGetWellknown(fmt.Sprintf("https://%s/.well-known/jwks.json", a.domain))
+	if err != nil {
+		return "", err
+	}
+	var cert string
+	for k := range jwks.Keys {
+		if token.Header["kid"] == jwks.Keys[k].Kid {
+			cert = "-----BEGIN CERTIFICATE-----\n" + jwks.Keys[k].X5c[0] + "\n-----END CERTIFICATE-----"
+		}
+	}
+
+	if cert == "" {
+		err := errors.New("Unable to find appropriate key.")
+		return cert, err
+	}
+
+	return cert, nil
+}
+
+type JwksCache struct {
+	*sync.RWMutex
+	cache map[string]cacheItem
+}
+type cacheItem struct {
+	data       *Jwks
+	expiration time.Time
+}
+
+func (c *JwksCache) get(url string) *Jwks {
+	c.RLock()
+	defer c.RUnlock()
+	if value, ok := c.cache[url]; ok {
+		if time.Now().After(value.expiration) {
+			return nil
+		}
+		return value.data
+	}
+	return nil
+}
+
+func (c *JwksCache) put(url string, jwks *Jwks) {
+	c.Lock()
+	defer c.Unlock()
+	c.cache[url] = cacheItem{
+		data:       jwks,
+		expiration: time.Now().Add(time.Minute * 60),
+	}
+}

middleware/context.go

@@ -0,0 +1,3 @@
+package middleware
+
+type ContextKey string

monitoring/graphql.go

@@ -0,0 +1,41 @@
+package monitoring
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/99designs/gqlgen/graphql"
+	"go.opentelemetry.io/otel/trace"
+)
+
+func AroundOperations(ctx context.Context, next graphql.OperationHandler) graphql.ResponseHandler {
+	op := graphql.GetOperationContext(ctx)
+	spanName := fmt.Sprintf("graphql:operation:%s", op.OperationName)
+	// Span always injected in the http handler above
+	sp := trace.SpanFromContext(ctx)
+	if sp != nil {
+		sp.SetName(spanName)
+	}
+	return next(ctx)
+}
+
+func AroundRootFields(ctx context.Context, next graphql.RootResolver) graphql.Marshaler {
+	oc := graphql.GetRootFieldContext(ctx)
+	spanCtx, span := StartSpan(ctx, fmt.Sprintf("graphql:rootfield:%s", oc.Field.Name))
+	defer span.Finish()
+	return next(spanCtx)
+}
+
+func AroundFields(ctx context.Context, next graphql.Resolver) (res any, err error) {
+	oc := graphql.GetFieldContext(ctx)
+	var span Span
+	if oc.IsResolver {
+		ctx, span = StartSpan(ctx, fmt.Sprintf("graphql:field:%s", oc.Field.Name))
+	}
+	defer func() {
+		if span != nil {
+			span.Finish()
+		}
+	}()
+	return next(ctx)
+}

monitoring/otel.go

@@ -0,0 +1,100 @@
+package monitoring
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"os"
+	"time"
+
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp"
+	"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp"
+	"go.opentelemetry.io/otel/exporters/stdout/stdoutlog"
+	"go.opentelemetry.io/otel/log/global"
+	"go.opentelemetry.io/otel/propagation"
+	"go.opentelemetry.io/otel/sdk/log"
+	"go.opentelemetry.io/otel/sdk/metric"
+	"go.opentelemetry.io/otel/sdk/trace"
+)
+
+// SetupOTelSDK bootstraps the OpenTelemetry pipeline.
+func SetupOTelSDK(ctx context.Context, enabled bool, serviceName, buildVersion, environment string) (func(context.Context) error, error) {
+	if os.Getenv("OTEL_RESOURCE_ATTRIBUTES") == "" {
+		if err := os.Setenv("OTEL_RESOURCE_ATTRIBUTES", fmt.Sprintf("service.name=%s,service.version=%s,service.environment=%s", serviceName, buildVersion, environment)); err != nil {
+			return func(context.Context) error {
+				return nil
+			}, err
+		}
+	}
+	var shutdownFuncs []func(context.Context) error
+	if !enabled {
+		return func(context.Context) error {
+			return nil
+		}, nil
+	}
+	shutdown := func(ctx context.Context) error {
+		var err error
+		for _, fn := range shutdownFuncs {
+			err = errors.Join(err, fn(ctx))
+		}
+		shutdownFuncs = nil
+		return err
+	}
+
+	// handleErr calls shutdown for cleanup and makes sure that all errors are returned.
+	handleErr := func(inErr error) (func(context.Context) error, error) {
+		return nil, errors.Join(inErr, shutdown(ctx))
+	}
+
+	// Set up the propagator.
+	prop := propagation.NewCompositeTextMapPropagator(
+		propagation.TraceContext{},
+		propagation.Baggage{},
+	)
+	otel.SetTextMapPropagator(prop)
+
+	traceExporter, err := otlptracehttp.New(ctx)
+	if err != nil {
+		return handleErr(err)
+	}
+	shutdownFuncs = append(shutdownFuncs, traceExporter.Shutdown)
+
+	tracerProvider := trace.NewTracerProvider(
+		trace.WithBatcher(traceExporter,
+			trace.WithBatchTimeout(5*time.Second)),
+	)
+	shutdownFuncs = append(shutdownFuncs, tracerProvider.Shutdown)
+	otel.SetTracerProvider(tracerProvider)
+
+	logExporter, err := stdoutlog.New()
+	if err != nil {
+		return handleErr(err)
+	}
+	processor := log.NewSimpleProcessor(logExporter)
+	logProvider := log.NewLoggerProvider(log.WithProcessor(processor))
+
+	global.SetLoggerProvider(logProvider)
+	shutdownFuncs = append(shutdownFuncs, logProvider.Shutdown)
+
+	exp, err := otlpmetrichttp.New(ctx)
+	if err != nil {
+		return handleErr(err)
+	}
+	meterProvider := metric.NewMeterProvider(metric.WithReader(metric.NewPeriodicReader(exp)))
+	shutdownFuncs = append(shutdownFuncs, meterProvider.Shutdown)
+
+	otel.SetMeterProvider(meterProvider)
+	return shutdown, err
+}
+
+func Handler(h http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		ctx := otel.GetTextMapPropagator().Extract(r.Context(), propagation.HeaderCarrier(r.Header))
+		spanCtx, s := StartSpan(ctx, "http")
+		defer s.Finish()
+
+		h.ServeHTTP(w, r.WithContext(spanCtx))
+	})
+}

monitoring/span.go

@@ -0,0 +1,46 @@
+package monitoring
+
+import (
+	"context"
+
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/trace"
+)
+
+type Span interface {
+	Context() context.Context
+	Finish()
+}
+
+type span struct {
+	otelSpan trace.Span
+	ctx      context.Context
+}
+
+func (s *span) Finish() {
+	s.otelSpan.End()
+}
+
+func (s *span) Context() context.Context {
+	return s.ctx
+}
+
+func StartSpan(ctx context.Context, name string, opts ...trace.SpanStartOption) (context.Context, Span) {
+	ctx, otelSpan := otel.Tracer("").Start(ctx, name, opts...)
+
+	return ctx, &span{
+		otelSpan: otelSpan,
+		ctx:      ctx,
+	}
+}
+
+type TraceHandlerFunc func(ctx context.Context, name string) (context.Context, func())
+
+func (t TraceHandlerFunc) Trace(tx context.Context, name string) (context.Context, func()) {
+	return t(tx, name)
+}
+
+func Trace(ctx context.Context, name string) (context.Context, func()) {
+	ctx, s := StartSpan(ctx, name)
+	return ctx, s.Finish
+}

rand/string.go

@@ -0,0 +1,24 @@
+package rand
+
+import (
+	"math/rand"
+	"time"
+)
+
+const charset = "abcdefghijklmnopqrstuvwxyz" +
+	"ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
+
+var seededRand *rand.Rand = rand.New(
+	rand.NewSource(time.Now().UnixNano()))
+
+func StringWithCharset(length int, charset string) string {
+	b := make([]byte, length)
+	for i := range b {
+		b[i] = charset[seededRand.Intn(len(charset))]
+	}
+	return string(b)
+}
+
+func String(length int) string {
+	return StringWithCharset(length, charset)
+}

renovate.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ],
+  "packageRules": [
+    {
+      "matchManagers": [
+        "kubernetes"
+      ],
+      "matchPackageNames": [
+        "registry.gitlab.com/unboundsoftware/schemas"
+      ],
+      "enabled": false
+    },
+    {
+      "groupName": "Eventsourced",
+      "matchPackageNames": [
+        "gitlab.com/unboundsoftware/eventsourced/**"
+      ]
+    }
+  ]
+}

sdlmerge/collect_entities.go

@@ -0,0 +1,61 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/operationreport"
+)
+
+type collectEntitiesVisitor struct {
+	*astvisitor.Walker
+	document          *ast.Document
+	collectedEntities entitySet
+}
+
+func newCollectEntitiesVisitor(collectedEntities entitySet) *collectEntitiesVisitor {
+	return &collectEntitiesVisitor{
+		collectedEntities: collectedEntities,
+	}
+}
+
+func (c *collectEntitiesVisitor) Register(walker *astvisitor.Walker) {
+	c.Walker = walker
+	walker.RegisterEnterDocumentVisitor(c)
+	walker.RegisterEnterInterfaceTypeDefinitionVisitor(c)
+	walker.RegisterEnterObjectTypeDefinitionVisitor(c)
+}
+
+func (c *collectEntitiesVisitor) EnterDocument(operation, _ *ast.Document) {
+	c.document = operation
+}
+
+func (c *collectEntitiesVisitor) EnterInterfaceTypeDefinition(ref int) {
+	interfaceType := c.document.InterfaceTypeDefinitions[ref]
+	name := c.document.InterfaceTypeDefinitionNameString(ref)
+	if err := c.resolvePotentialEntity(name, interfaceType.Directives.Refs); err != nil {
+		c.StopWithExternalErr(*err)
+	}
+}
+
+func (c *collectEntitiesVisitor) EnterObjectTypeDefinition(ref int) {
+	objectType := c.document.ObjectTypeDefinitions[ref]
+	name := c.document.ObjectTypeDefinitionNameString(ref)
+	if err := c.resolvePotentialEntity(name, objectType.Directives.Refs); err != nil {
+		c.StopWithExternalErr(*err)
+	}
+}
+
+func (c *collectEntitiesVisitor) resolvePotentialEntity(name string, directiveRefs []int) *operationreport.ExternalError {
+	if _, exists := c.collectedEntities[name]; exists {
+		err := operationreport.ErrEntitiesMustNotBeDuplicated(name)
+		return &err
+	}
+	for _, directiveRef := range directiveRefs {
+		if c.document.DirectiveNameString(directiveRef) != "key" {
+			continue
+		}
+		c.collectedEntities[name] = struct{}{}
+		return nil
+	}
+	return nil
+}

sdlmerge/enum_type_extending.go

@@ -0,0 +1,50 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/operationreport"
+)
+
+type extendEnumTypeDefinitionVisitor struct {
+	*astvisitor.Walker
+	document *ast.Document
+}
+
+func newExtendEnumTypeDefinition() *extendEnumTypeDefinitionVisitor {
+	return &extendEnumTypeDefinitionVisitor{}
+}
+
+func (e *extendEnumTypeDefinitionVisitor) Register(walker *astvisitor.Walker) {
+	e.Walker = walker
+	walker.RegisterEnterDocumentVisitor(e)
+	walker.RegisterEnterEnumTypeExtensionVisitor(e)
+}
+
+func (e *extendEnumTypeDefinitionVisitor) EnterDocument(operation, _ *ast.Document) {
+	e.document = operation
+}
+
+func (e *extendEnumTypeDefinitionVisitor) EnterEnumTypeExtension(ref int) {
+	nodes, exists := e.document.Index.NodesByNameBytes(e.document.EnumTypeExtensionNameBytes(ref))
+	if !exists {
+		return
+	}
+
+	hasExtended := false
+	for i := range nodes {
+		if nodes[i].Kind != ast.NodeKindEnumTypeDefinition {
+			continue
+		}
+		if hasExtended {
+			e.StopWithExternalErr(operationreport.ErrSharedTypesMustNotBeExtended(e.document.EnumTypeExtensionNameString(ref)))
+			return
+		}
+		e.document.ExtendEnumTypeDefinitionByEnumTypeExtension(nodes[i].Ref, ref)
+		hasExtended = true
+	}
+
+	if !hasExtended {
+		e.StopWithExternalErr(operationreport.ErrExtensionOrphansMustResolveInSupergraph(e.document.EnumTypeExtensionNameBytes(ref)))
+	}
+}

sdlmerge/input_type_extending.go

@@ -0,0 +1,50 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/operationreport"
+)
+
+func newExtendInputObjectTypeDefinition() *extendInputObjectTypeDefinitionVisitor {
+	return &extendInputObjectTypeDefinitionVisitor{}
+}
+
+type extendInputObjectTypeDefinitionVisitor struct {
+	*astvisitor.Walker
+	document *ast.Document
+}
+
+func (e *extendInputObjectTypeDefinitionVisitor) Register(walker *astvisitor.Walker) {
+	e.Walker = walker
+	walker.RegisterEnterDocumentVisitor(e)
+	walker.RegisterEnterInputObjectTypeExtensionVisitor(e)
+}
+
+func (e *extendInputObjectTypeDefinitionVisitor) EnterDocument(operation, _ *ast.Document) {
+	e.document = operation
+}
+
+func (e *extendInputObjectTypeDefinitionVisitor) EnterInputObjectTypeExtension(ref int) {
+	nodes, exists := e.document.Index.NodesByNameBytes(e.document.InputObjectTypeExtensionNameBytes(ref))
+	if !exists {
+		return
+	}
+
+	hasExtended := false
+	for i := range nodes {
+		if nodes[i].Kind != ast.NodeKindInputObjectTypeDefinition {
+			continue
+		}
+		if hasExtended {
+			e.StopWithExternalErr(operationreport.ErrSharedTypesMustNotBeExtended(e.document.InputObjectTypeExtensionNameString(ref)))
+			return
+		}
+		e.document.ExtendInputObjectTypeDefinitionByInputObjectTypeExtension(nodes[i].Ref, ref)
+		hasExtended = true
+	}
+
+	if !hasExtended {
+		e.StopWithExternalErr(operationreport.ErrExtensionOrphansMustResolveInSupergraph(e.document.InputObjectTypeExtensionNameBytes(ref)))
+	}
+}

sdlmerge/interface_type_extending.go

@@ -0,0 +1,63 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/operationreport"
+)
+
+func newExtendInterfaceTypeDefinition(collectedEntities entitySet) *extendInterfaceTypeDefinitionVisitor {
+	return &extendInterfaceTypeDefinitionVisitor{
+		collectedEntities: collectedEntities,
+	}
+}
+
+type extendInterfaceTypeDefinitionVisitor struct {
+	*astvisitor.Walker
+	document          *ast.Document
+	collectedEntities entitySet
+}
+
+func (e *extendInterfaceTypeDefinitionVisitor) Register(walker *astvisitor.Walker) {
+	e.Walker = walker
+	walker.RegisterEnterDocumentVisitor(e)
+	walker.RegisterEnterInterfaceTypeExtensionVisitor(e)
+}
+
+func (e *extendInterfaceTypeDefinitionVisitor) EnterDocument(operation, _ *ast.Document) {
+	e.document = operation
+}
+
+func (e *extendInterfaceTypeDefinitionVisitor) EnterInterfaceTypeExtension(ref int) {
+	nameBytes := e.document.InterfaceTypeExtensionNameBytes(ref)
+	nodes, exists := e.document.Index.NodesByNameBytes(nameBytes)
+	if !exists {
+		return
+	}
+
+	var nodeToExtend *ast.Node
+	isEntity := false
+	for i := range nodes {
+		if nodes[i].Kind != ast.NodeKindInterfaceTypeDefinition {
+			continue
+		}
+		if nodeToExtend != nil {
+			e.StopWithExternalErr(*multipleExtensionError(isEntity, nameBytes))
+			return
+		}
+		var err *operationreport.ExternalError
+		extension := e.document.InterfaceTypeExtensions[ref]
+		if isEntity, err = e.collectedEntities.isExtensionForEntity(nameBytes, extension.Directives.Refs, e.document); err != nil {
+			e.StopWithExternalErr(*err)
+			return
+		}
+		nodeToExtend = &nodes[i]
+	}
+
+	if nodeToExtend == nil {
+		e.StopWithExternalErr(operationreport.ErrExtensionOrphansMustResolveInSupergraph(e.document.InterfaceTypeExtensionNameBytes(ref)))
+		return
+	}
+
+	e.document.ExtendInterfaceTypeDefinitionByInterfaceTypeExtension(nodeToExtend.Ref, ref)
+}

sdlmerge/merge_duplicated_fields.go

@@ -0,0 +1,62 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/operationreport"
+)
+
+type mergeDuplicatedFieldsVisitor struct {
+	*astvisitor.Walker
+	document *ast.Document
+}
+
+func newMergeDuplicatedFieldsVisitor() *mergeDuplicatedFieldsVisitor {
+	return &mergeDuplicatedFieldsVisitor{
+		nil,
+		nil,
+	}
+}
+
+func (m *mergeDuplicatedFieldsVisitor) Register(walker *astvisitor.Walker) {
+	m.Walker = walker
+	walker.RegisterEnterDocumentVisitor(m)
+	walker.RegisterLeaveObjectTypeDefinitionVisitor(m)
+}
+
+func (m *mergeDuplicatedFieldsVisitor) EnterDocument(document, _ *ast.Document) {
+	m.document = document
+}
+
+func (m *mergeDuplicatedFieldsVisitor) LeaveObjectTypeDefinition(ref int) {
+	var refsForDeletion []int
+	fieldByTypeRefSet := make(map[string]int)
+	for _, fieldRef := range m.document.ObjectTypeDefinitions[ref].FieldsDefinition.Refs {
+		fieldName := m.document.FieldDefinitionNameString(fieldRef)
+		newTypeRef := m.document.FieldDefinitions[fieldRef].Type
+		if oldTypeRef, ok := fieldByTypeRefSet[fieldName]; ok {
+			if m.document.TypesAreEqualDeep(oldTypeRef, newTypeRef) {
+				refsForDeletion = append(refsForDeletion, fieldRef)
+				continue
+			}
+			oldFieldTypeNameBytes, err := m.document.PrintTypeBytes(oldTypeRef, nil)
+			if err != nil {
+				m.StopWithInternalErr(err)
+				return
+			}
+			newFieldTypeNameBytes, err := m.document.PrintTypeBytes(newTypeRef, nil)
+			if err != nil {
+				m.StopWithInternalErr(err)
+				return
+			}
+			m.StopWithExternalErr(operationreport.ErrDuplicateFieldsMustBeIdentical(
+				fieldName, m.document.ObjectTypeDefinitionNameString(ref), string(oldFieldTypeNameBytes), string(newFieldTypeNameBytes),
+			))
+			return
+		}
+
+		fieldByTypeRefSet[fieldName] = newTypeRef
+	}
+
+	m.document.RemoveFieldDefinitionsFromObjectTypeDefinition(refsForDeletion, ref)
+}

sdlmerge/object_type_extending.go

@@ -0,0 +1,66 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/operationreport"
+)
+
+func newExtendObjectTypeDefinition(collectedEntities entitySet) *extendObjectTypeDefinitionVisitor {
+	return &extendObjectTypeDefinitionVisitor{
+		collectedEntities: collectedEntities,
+	}
+}
+
+type extendObjectTypeDefinitionVisitor struct {
+	*astvisitor.Walker
+	document          *ast.Document
+	collectedEntities entitySet
+}
+
+func (e *extendObjectTypeDefinitionVisitor) Register(walker *astvisitor.Walker) {
+	e.Walker = walker
+	walker.RegisterEnterDocumentVisitor(e)
+	walker.RegisterEnterObjectTypeExtensionVisitor(e)
+}
+
+func (e *extendObjectTypeDefinitionVisitor) EnterDocument(operation, _ *ast.Document) {
+	e.document = operation
+}
+
+func (e *extendObjectTypeDefinitionVisitor) EnterObjectTypeExtension(ref int) {
+	nameBytes := e.document.ObjectTypeExtensionNameBytes(ref)
+	nodes, exists := e.document.Index.NodesByNameBytes(nameBytes)
+	if !exists {
+		return
+	}
+
+	var nodeToExtend *ast.Node
+	isEntity := false
+	for i := range nodes {
+		if nodes[i].Kind != ast.NodeKindObjectTypeDefinition {
+			continue
+		}
+		if nodeToExtend != nil {
+			e.StopWithExternalErr(*multipleExtensionError(isEntity, nameBytes))
+			return
+		}
+		var err *operationreport.ExternalError
+		extension := e.document.ObjectTypeExtensions[ref]
+		if isEntity, err = e.collectedEntities.isExtensionForEntity(nameBytes, extension.Directives.Refs, e.document); err != nil {
+			e.StopWithExternalErr(*err)
+			return
+		}
+		nodeToExtend = &nodes[i]
+		if ast.IsRootType(nameBytes) {
+			break
+		}
+	}
+
+	if nodeToExtend == nil {
+		e.StopWithExternalErr(operationreport.ErrExtensionOrphansMustResolveInSupergraph(nameBytes))
+		return
+	}
+
+	e.document.ExtendObjectTypeDefinitionByObjectTypeExtension(nodeToExtend.Ref, ref)
+}

sdlmerge/remove_duplicate_fielded_shared_types.go

@@ -0,0 +1,107 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/operationreport"
+)
+
+type removeDuplicateFieldedSharedTypesVisitor struct {
+	*astvisitor.Walker
+	document          *ast.Document
+	sharedTypeSet     map[string]fieldedSharedType
+	rootNodesToRemove []ast.Node
+	lastInputRef      int
+	lastInterfaceRef  int
+	lastObjectRef     int
+}
+
+func newRemoveDuplicateFieldedSharedTypesVisitor() *removeDuplicateFieldedSharedTypesVisitor {
+	return &removeDuplicateFieldedSharedTypesVisitor{
+		nil,
+		nil,
+		make(map[string]fieldedSharedType),
+		nil,
+		ast.InvalidRef,
+		ast.InvalidRef,
+		ast.InvalidRef,
+	}
+}
+
+func (r *removeDuplicateFieldedSharedTypesVisitor) Register(walker *astvisitor.Walker) {
+	r.Walker = walker
+	walker.RegisterEnterDocumentVisitor(r)
+	walker.RegisterEnterInputObjectTypeDefinitionVisitor(r)
+	walker.RegisterEnterInterfaceTypeDefinitionVisitor(r)
+	walker.RegisterEnterObjectTypeDefinitionVisitor(r)
+	walker.RegisterLeaveDocumentVisitor(r)
+}
+
+func (r *removeDuplicateFieldedSharedTypesVisitor) EnterDocument(operation, _ *ast.Document) {
+	r.document = operation
+}
+
+func (r *removeDuplicateFieldedSharedTypesVisitor) EnterInputObjectTypeDefinition(ref int) {
+	if ref <= r.lastInputRef {
+		return
+	}
+	name := r.document.InputObjectTypeDefinitionNameString(ref)
+	refs := r.document.InputObjectTypeDefinitions[ref].InputFieldsDefinition.Refs
+	input, exists := r.sharedTypeSet[name]
+	if exists {
+		if !input.areFieldsIdentical(refs) {
+			r.StopWithExternalErr(operationreport.ErrSharedTypesMustBeIdenticalToFederate(name))
+			return
+		}
+		r.rootNodesToRemove = append(r.rootNodesToRemove, ast.Node{Kind: ast.NodeKindInputObjectTypeDefinition, Ref: ref})
+	} else {
+		r.sharedTypeSet[name] = newFieldedSharedType(r.document, ast.NodeKindInputValueDefinition, refs)
+	}
+	r.lastInputRef = ref
+}
+
+func (r *removeDuplicateFieldedSharedTypesVisitor) EnterInterfaceTypeDefinition(ref int) {
+	if ref <= r.lastInterfaceRef {
+		return
+	}
+	name := r.document.InterfaceTypeDefinitionNameString(ref)
+	interfaceType := r.document.InterfaceTypeDefinitions[ref]
+	refs := interfaceType.FieldsDefinition.Refs
+	iFace, exists := r.sharedTypeSet[name]
+	if exists {
+		if !iFace.areFieldsIdentical(refs) {
+			r.StopWithExternalErr(operationreport.ErrSharedTypesMustBeIdenticalToFederate(name))
+			return
+		}
+		r.rootNodesToRemove = append(r.rootNodesToRemove, ast.Node{Kind: ast.NodeKindInterfaceTypeDefinition, Ref: ref})
+	} else {
+		r.sharedTypeSet[name] = newFieldedSharedType(r.document, ast.NodeKindFieldDefinition, refs)
+	}
+	r.lastInterfaceRef = ref
+}
+
+func (r *removeDuplicateFieldedSharedTypesVisitor) EnterObjectTypeDefinition(ref int) {
+	if ref <= r.lastObjectRef {
+		return
+	}
+	name := r.document.ObjectTypeDefinitionNameString(ref)
+	objectType := r.document.ObjectTypeDefinitions[ref]
+	refs := objectType.FieldsDefinition.Refs
+	object, exists := r.sharedTypeSet[name]
+	if exists {
+		if !object.areFieldsIdentical(refs) {
+			r.StopWithExternalErr(operationreport.ErrSharedTypesMustBeIdenticalToFederate(name))
+			return
+		}
+		r.rootNodesToRemove = append(r.rootNodesToRemove, ast.Node{Kind: ast.NodeKindObjectTypeDefinition, Ref: ref})
+	} else {
+		r.sharedTypeSet[name] = newFieldedSharedType(r.document, ast.NodeKindFieldDefinition, refs)
+	}
+	r.lastObjectRef = ref
+}
+
+func (r *removeDuplicateFieldedSharedTypesVisitor) LeaveDocument(_, _ *ast.Document) {
+	if r.rootNodesToRemove != nil {
+		r.document.DeleteRootNodes(r.rootNodesToRemove)
+	}
+}

sdlmerge/remove_duplicate_fieldless_shared_types.go

@@ -0,0 +1,98 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/operationreport"
+)
+
+type removeDuplicateFieldlessSharedTypesVisitor struct {
+	*astvisitor.Walker
+	document          *ast.Document
+	sharedTypeSet     map[string]fieldlessSharedType
+	rootNodesToRemove []ast.Node
+	lastEnumRef       int
+	lastUnionRef      int
+	lastScalarRef     int
+}
+
+func newRemoveDuplicateFieldlessSharedTypesVisitor() *removeDuplicateFieldlessSharedTypesVisitor {
+	return &removeDuplicateFieldlessSharedTypesVisitor{
+		nil,
+		nil,
+		make(map[string]fieldlessSharedType),
+		nil,
+		ast.InvalidRef,
+		ast.InvalidRef,
+		ast.InvalidRef,
+	}
+}
+
+func (r *removeDuplicateFieldlessSharedTypesVisitor) Register(walker *astvisitor.Walker) {
+	r.Walker = walker
+	walker.RegisterEnterDocumentVisitor(r)
+	walker.RegisterEnterEnumTypeDefinitionVisitor(r)
+	walker.RegisterEnterScalarTypeDefinitionVisitor(r)
+	walker.RegisterEnterUnionTypeDefinitionVisitor(r)
+	walker.RegisterLeaveDocumentVisitor(r)
+}
+
+func (r *removeDuplicateFieldlessSharedTypesVisitor) EnterDocument(operation, _ *ast.Document) {
+	r.document = operation
+}
+
+func (r *removeDuplicateFieldlessSharedTypesVisitor) EnterEnumTypeDefinition(ref int) {
+	if ref <= r.lastEnumRef {
+		return
+	}
+	name := r.document.EnumTypeDefinitionNameString(ref)
+	enum, exists := r.sharedTypeSet[name]
+	if exists {
+		if !enum.areValuesIdentical(r.document.EnumTypeDefinitions[ref].EnumValuesDefinition.Refs) {
+			r.StopWithExternalErr(operationreport.ErrSharedTypesMustBeIdenticalToFederate(name))
+			return
+		}
+		r.rootNodesToRemove = append(r.rootNodesToRemove, ast.Node{Kind: ast.NodeKindEnumTypeDefinition, Ref: ref})
+	} else {
+		r.sharedTypeSet[name] = newEnumSharedType(r.document, ref)
+	}
+	r.lastEnumRef = ref
+}
+
+func (r *removeDuplicateFieldlessSharedTypesVisitor) EnterScalarTypeDefinition(ref int) {
+	if ref <= r.lastScalarRef {
+		return
+	}
+	name := r.document.ScalarTypeDefinitionNameString(ref)
+	_, exists := r.sharedTypeSet[name]
+	if exists {
+		r.rootNodesToRemove = append(r.rootNodesToRemove, ast.Node{Kind: ast.NodeKindScalarTypeDefinition, Ref: ref})
+	} else {
+		r.sharedTypeSet[name] = scalarSharedType{}
+	}
+	r.lastScalarRef = ref
+}
+
+func (r *removeDuplicateFieldlessSharedTypesVisitor) EnterUnionTypeDefinition(ref int) {
+	if ref <= r.lastUnionRef {
+		return
+	}
+	name := r.document.UnionTypeDefinitionNameString(ref)
+	union, exists := r.sharedTypeSet[name]
+	if exists {
+		if !union.areValuesIdentical(r.document.UnionTypeDefinitions[ref].UnionMemberTypes.Refs) {
+			r.StopWithExternalErr(operationreport.ErrSharedTypesMustBeIdenticalToFederate(name))
+			return
+		}
+		r.rootNodesToRemove = append(r.rootNodesToRemove, ast.Node{Kind: ast.NodeKindUnionTypeDefinition, Ref: ref})
+	} else {
+		r.sharedTypeSet[name] = newUnionSharedType(r.document, ref)
+	}
+	r.lastUnionRef = ref
+}
+
+func (r *removeDuplicateFieldlessSharedTypesVisitor) LeaveDocument(_, _ *ast.Document) {
+	if r.rootNodesToRemove != nil {
+		r.document.DeleteRootNodes(r.rootNodesToRemove)
+	}
+}

sdlmerge/remove_empty_object_type_definition.go

@@ -0,0 +1,32 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+)
+
+func newRemoveEmptyObjectTypeDefinition() *removeEmptyObjectTypeDefinition {
+	return &removeEmptyObjectTypeDefinition{}
+}
+
+type removeEmptyObjectTypeDefinition struct{}
+
+func (r *removeEmptyObjectTypeDefinition) Register(walker *astvisitor.Walker) {
+	walker.RegisterLeaveDocumentVisitor(r)
+}
+
+func (r *removeEmptyObjectTypeDefinition) LeaveDocument(operation, _ *ast.Document) {
+	for ref := range operation.ObjectTypeDefinitions {
+		if operation.ObjectTypeDefinitions[ref].HasFieldDefinitions {
+			continue
+		}
+
+		name := operation.ObjectTypeDefinitionNameString(ref)
+		node, ok := operation.Index.FirstNodeByNameStr(name)
+		if !ok {
+			return
+		}
+
+		operation.RemoveRootNode(node)
+	}
+}

sdlmerge/remove_field_definition_by_directive.go

@@ -0,0 +1,46 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+)
+
+func newRemoveFieldDefinitions(directives ...string) *removeFieldDefinitionByDirective {
+	directivesSet := make(map[string]struct{}, len(directives))
+	for _, directive := range directives {
+		directivesSet[directive] = struct{}{}
+	}
+
+	return &removeFieldDefinitionByDirective{
+		directives: directivesSet,
+	}
+}
+
+type removeFieldDefinitionByDirective struct {
+	operation  *ast.Document
+	directives map[string]struct{}
+}
+
+func (r *removeFieldDefinitionByDirective) Register(walker *astvisitor.Walker) {
+	walker.RegisterEnterDocumentVisitor(r)
+	walker.RegisterLeaveObjectTypeDefinitionVisitor(r)
+}
+
+func (r *removeFieldDefinitionByDirective) EnterDocument(operation, _ *ast.Document) {
+	r.operation = operation
+}
+
+func (r *removeFieldDefinitionByDirective) LeaveObjectTypeDefinition(ref int) {
+	var refsForDeletion []int
+	// select fields for deletion
+	for _, fieldRef := range r.operation.ObjectTypeDefinitions[ref].FieldsDefinition.Refs {
+		for _, directiveRef := range r.operation.FieldDefinitions[fieldRef].Directives.Refs {
+			directiveName := r.operation.DirectiveNameString(directiveRef)
+			if _, ok := r.directives[directiveName]; ok {
+				refsForDeletion = append(refsForDeletion, fieldRef)
+			}
+		}
+	}
+	// delete fields
+	r.operation.RemoveFieldDefinitionsFromObjectTypeDefinition(refsForDeletion, ref)
+}

sdlmerge/remove_field_definition_directive.go

@@ -0,0 +1,44 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+)
+
+func newRemoveFieldDefinitionDirective(directives ...string) *removeFieldDefinitionDirective {
+	directivesSet := make(map[string]struct{}, len(directives))
+	for _, directive := range directives {
+		directivesSet[directive] = struct{}{}
+	}
+
+	return &removeFieldDefinitionDirective{
+		directives: directivesSet,
+	}
+}
+
+type removeFieldDefinitionDirective struct {
+	operation  *ast.Document
+	directives map[string]struct{}
+}
+
+func (r *removeFieldDefinitionDirective) Register(walker *astvisitor.Walker) {
+	walker.RegisterEnterDocumentVisitor(r)
+	walker.RegisterEnterFieldDefinitionVisitor(r)
+}
+
+func (r *removeFieldDefinitionDirective) EnterDocument(operation, _ *ast.Document) {
+	r.operation = operation
+}
+
+func (r *removeFieldDefinitionDirective) EnterFieldDefinition(ref int) {
+	var refsForDeletion []int
+	// select directives for deletion
+	for _, directiveRef := range r.operation.FieldDefinitions[ref].Directives.Refs {
+		directiveName := r.operation.DirectiveNameString(directiveRef)
+		if _, ok := r.directives[directiveName]; ok {
+			refsForDeletion = append(refsForDeletion, directiveRef)
+		}
+	}
+	// delete directives
+	r.operation.RemoveDirectivesFromNode(ast.Node{Kind: ast.NodeKindFieldDefinition, Ref: ref}, refsForDeletion)
+}

sdlmerge/remove_interface_definition_directive.go

@@ -0,0 +1,45 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+)
+
+func newRemoveInterfaceDefinitionDirective(directives ...string) *removeInterfaceDefinitionDirective {
+	directivesSet := make(map[string]struct{}, len(directives))
+	for _, directive := range directives {
+		directivesSet[directive] = struct{}{}
+	}
+
+	return &removeInterfaceDefinitionDirective{
+		directives: directivesSet,
+	}
+}
+
+type removeInterfaceDefinitionDirective struct {
+	*astvisitor.Walker
+	operation  *ast.Document
+	directives map[string]struct{}
+}
+
+func (r *removeInterfaceDefinitionDirective) Register(walker *astvisitor.Walker) {
+	walker.RegisterEnterDocumentVisitor(r)
+	walker.RegisterEnterInterfaceTypeDefinitionVisitor(r)
+}
+
+func (r *removeInterfaceDefinitionDirective) EnterDocument(operation, _ *ast.Document) {
+	r.operation = operation
+}
+
+func (r *removeInterfaceDefinitionDirective) EnterInterfaceTypeDefinition(ref int) {
+	var refsForDeletion []int
+	// select fields for deletion
+	for _, directiveRef := range r.operation.InterfaceTypeDefinitions[ref].Directives.Refs {
+		directiveName := r.operation.DirectiveNameString(directiveRef)
+		if _, ok := r.directives[directiveName]; ok {
+			refsForDeletion = append(refsForDeletion, directiveRef)
+		}
+	}
+	// delete directives
+	r.operation.RemoveDirectivesFromNode(ast.Node{Kind: ast.NodeKindInterfaceTypeDefinition, Ref: ref}, refsForDeletion)
+}

sdlmerge/remove_object_type_definition_directive.go

@@ -0,0 +1,44 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+)
+
+func newRemoveObjectTypeDefinitionDirective(directives ...string) *removeObjectTypeDefinitionDirective {
+	directivesSet := make(map[string]struct{}, len(directives))
+	for _, directive := range directives {
+		directivesSet[directive] = struct{}{}
+	}
+
+	return &removeObjectTypeDefinitionDirective{
+		directives: directivesSet,
+	}
+}
+
+type removeObjectTypeDefinitionDirective struct {
+	operation  *ast.Document
+	directives map[string]struct{}
+}
+
+func (r *removeObjectTypeDefinitionDirective) Register(walker *astvisitor.Walker) {
+	walker.RegisterEnterDocumentVisitor(r)
+	walker.RegisterEnterObjectTypeDefinitionVisitor(r)
+}
+
+func (r *removeObjectTypeDefinitionDirective) EnterDocument(operation, _ *ast.Document) {
+	r.operation = operation
+}
+
+func (r *removeObjectTypeDefinitionDirective) EnterObjectTypeDefinition(ref int) {
+	var refsForDeletion []int
+	// select fields for deletion
+	for _, directiveRef := range r.operation.ObjectTypeDefinitions[ref].Directives.Refs {
+		directiveName := r.operation.DirectiveNameString(directiveRef)
+		if _, ok := r.directives[directiveName]; ok {
+			refsForDeletion = append(refsForDeletion, directiveRef)
+		}
+	}
+	// delete directives
+	r.operation.RemoveDirectivesFromNode(ast.Node{Kind: ast.NodeKindObjectTypeDefinition, Ref: ref}, refsForDeletion)
+}

sdlmerge/remove_type_extensions.go

@@ -0,0 +1,20 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+)
+
+func newRemoveMergedTypeExtensions() *removeMergedTypeExtensionsVisitor {
+	return &removeMergedTypeExtensionsVisitor{}
+}
+
+type removeMergedTypeExtensionsVisitor struct{}
+
+func (r *removeMergedTypeExtensionsVisitor) Register(walker *astvisitor.Walker) {
+	walker.RegisterLeaveDocumentVisitor(r)
+}
+
+func (r *removeMergedTypeExtensionsVisitor) LeaveDocument(operation, definition *ast.Document) {
+	operation.RemoveMergedTypeExtensions()
+}

sdlmerge/scalar_type_extending.go

@@ -0,0 +1,49 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/operationreport"
+)
+
+func newExtendScalarTypeDefinition() *extendScalarTypeDefinitionVisitor {
+	return &extendScalarTypeDefinitionVisitor{}
+}
+
+type extendScalarTypeDefinitionVisitor struct {
+	*astvisitor.Walker
+	document *ast.Document
+}
+
+func (e *extendScalarTypeDefinitionVisitor) Register(walker *astvisitor.Walker) {
+	e.Walker = walker
+	walker.RegisterEnterDocumentVisitor(e)
+	walker.RegisterEnterScalarTypeExtensionVisitor(e)
+}
+
+func (e *extendScalarTypeDefinitionVisitor) EnterDocument(operation, _ *ast.Document) {
+	e.document = operation
+}
+
+func (e *extendScalarTypeDefinitionVisitor) EnterScalarTypeExtension(ref int) {
+	nodes, exists := e.document.Index.NodesByNameBytes(e.document.ScalarTypeExtensionNameBytes(ref))
+	if !exists {
+		return
+	}
+
+	hasExtended := false
+	for i := range nodes {
+		if nodes[i].Kind != ast.NodeKindScalarTypeDefinition {
+			continue
+		}
+		if hasExtended {
+			e.StopWithExternalErr(operationreport.ErrSharedTypesMustNotBeExtended(e.document.ScalarTypeExtensionNameString(ref)))
+			return
+		}
+		e.document.ExtendScalarTypeDefinitionByScalarTypeExtension(nodes[i].Ref, ref)
+		hasExtended = true
+	}
+	if !hasExtended {
+		e.StopWithExternalErr(operationreport.ErrExtensionOrphansMustResolveInSupergraph(e.document.ScalarTypeExtensionNameBytes(ref)))
+	}
+}

sdlmerge/sdlmerge.go

@@ -0,0 +1,205 @@
+package sdlmerge
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/asttransform"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvalidation"
+
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astnormalization"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astparser"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astprinter"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/operationreport"
+)
+
+const (
+	rootOperationTypeDefinitions = `
+		type Query {}
+		type Mutation {}
+		type Subscription {}
+	`
+
+	parseDocumentError = "parse graphql document string: %w"
+)
+
+type Visitor interface {
+	Register(walker *astvisitor.Walker)
+}
+
+func MergeAST(ast *ast.Document) error {
+	normalizer := normalizer{}
+	normalizer.setupWalkers()
+
+	return normalizer.normalize(ast)
+}
+
+func MergeSDLs(SDLs ...string) (string, error) {
+	rawDocs := make([]string, 0, len(SDLs)+1)
+	rawDocs = append(rawDocs, rootOperationTypeDefinitions)
+	rawDocs = append(rawDocs, SDLs...)
+	if validationError := validateSubgraphs(rawDocs[1:]); validationError != nil {
+		return "", validationError
+	}
+	if normalizationError := normalizeSubgraphs(rawDocs[1:]); normalizationError != nil {
+		return "", normalizationError
+	}
+
+	doc, report := astparser.ParseGraphqlDocumentString(strings.Join(rawDocs, "\n"))
+	if report.HasErrors() {
+		return "", fmt.Errorf("parse graphql document string: %w", report)
+	}
+
+	astnormalization.NormalizeSubgraphSDL(&doc, &report)
+	if report.HasErrors() {
+		return "", fmt.Errorf("merge ast: %w", report)
+	}
+
+	if err := MergeAST(&doc); err != nil {
+		return "", fmt.Errorf("merge ast: %w", err)
+	}
+
+	out, err := astprinter.PrintString(&doc)
+	if err != nil {
+		return "", fmt.Errorf("stringify schema: %w", err)
+	}
+
+	return out, nil
+}
+
+func validateSubgraphs(subgraphs []string) error {
+	validator := astvalidation.NewDefinitionValidator(
+		astvalidation.PopulatedTypeBodies(), astvalidation.KnownTypeNames(),
+	)
+	for _, subgraph := range subgraphs {
+		doc, report := astparser.ParseGraphqlDocumentString(subgraph)
+		if err := asttransform.MergeDefinitionWithBaseSchema(&doc); err != nil {
+			return err
+		}
+		if report.HasErrors() {
+			return fmt.Errorf(parseDocumentError, report)
+		}
+		validator.Validate(&doc, &report)
+		if report.HasErrors() {
+			return fmt.Errorf("validate schema: %w", report)
+		}
+	}
+	return nil
+}
+
+func normalizeSubgraphs(subgraphs []string) error {
+	subgraphNormalizer := astnormalization.NewSubgraphDefinitionNormalizer()
+	for i, subgraph := range subgraphs {
+		doc, report := astparser.ParseGraphqlDocumentString(subgraph)
+		if report.HasErrors() {
+			return fmt.Errorf(parseDocumentError, report)
+		}
+		subgraphNormalizer.NormalizeDefinition(&doc, &report)
+		if report.HasErrors() {
+			return fmt.Errorf("normalize schema: %w", report)
+		}
+		out, err := astprinter.PrintString(&doc)
+		if err != nil {
+			return fmt.Errorf("stringify schema: %w", err)
+		}
+		subgraphs[i] = out
+	}
+	return nil
+}
+
+type normalizer struct {
+	walkers []*astvisitor.Walker
+}
+
+type entitySet map[string]struct{}
+
+func (m *normalizer) setupWalkers() {
+	collectedEntities := make(entitySet)
+	visitorGroups := [][]Visitor{
+		{
+			newCollectEntitiesVisitor(collectedEntities),
+		},
+		{
+			newExtendEnumTypeDefinition(),
+			newExtendInputObjectTypeDefinition(),
+			newExtendInterfaceTypeDefinition(collectedEntities),
+			newExtendScalarTypeDefinition(),
+			newExtendUnionTypeDefinition(),
+			newExtendObjectTypeDefinition(collectedEntities),
+			newRemoveEmptyObjectTypeDefinition(),
+			newRemoveMergedTypeExtensions(),
+		},
+		// visitors for cleaning up federated duplicated fields and directives
+		{
+			newRemoveFieldDefinitions("external"),
+			newRemoveDuplicateFieldedSharedTypesVisitor(),
+			newRemoveDuplicateFieldlessSharedTypesVisitor(),
+			newMergeDuplicatedFieldsVisitor(),
+			newRemoveInterfaceDefinitionDirective("key"),
+			newRemoveObjectTypeDefinitionDirective("key"),
+			newRemoveFieldDefinitionDirective("provides", "requires"),
+		},
+	}
+
+	for _, visitorGroup := range visitorGroups {
+		walker := astvisitor.NewWalker(48)
+		for _, visitor := range visitorGroup {
+			visitor.Register(&walker)
+			m.walkers = append(m.walkers, &walker)
+		}
+	}
+}
+
+func (m *normalizer) normalize(operation *ast.Document) error {
+	report := operationreport.Report{}
+
+	for _, walker := range m.walkers {
+		walker.Walk(operation, nil, &report)
+		if report.HasErrors() {
+			return fmt.Errorf("walk: %w", report)
+		}
+	}
+
+	return nil
+}
+
+func (e entitySet) isExtensionForEntity(nameBytes []byte, directiveRefs []int, document *ast.Document) (bool, *operationreport.ExternalError) {
+	name := string(nameBytes)
+	hasDirectives := len(directiveRefs) > 0
+	if _, exists := e[name]; !exists {
+		if !hasDirectives || !isEntityExtension(directiveRefs, document) {
+			return false, nil
+		}
+		err := operationreport.ErrExtensionWithKeyDirectiveMustExtendEntity(name)
+		return false, &err
+	}
+	if !hasDirectives {
+		err := operationreport.ErrEntityExtensionMustHaveKeyDirective(name)
+		return false, &err
+	}
+	if isEntityExtension(directiveRefs, document) {
+		return true, nil
+	}
+	err := operationreport.ErrEntityExtensionMustHaveKeyDirective(name)
+	return false, &err
+}
+
+func isEntityExtension(directiveRefs []int, document *ast.Document) bool {
+	for _, directiveRef := range directiveRefs {
+		if document.DirectiveNameString(directiveRef) == "key" {
+			return true
+		}
+	}
+	return false
+}
+
+func multipleExtensionError(isEntity bool, nameBytes []byte) *operationreport.ExternalError {
+	if isEntity {
+		err := operationreport.ErrEntitiesMustNotBeDuplicated(string(nameBytes))
+		return &err
+	}
+	err := operationreport.ErrSharedTypesMustNotBeExtended(string(nameBytes))
+	return &err
+}

sdlmerge/shared_types.go

@@ -0,0 +1,167 @@
+package sdlmerge
+
+import "github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+
+type fieldlessSharedType interface {
+	areValuesIdentical(valueRefsToCompare []int) bool
+	valueRefs() []int
+	valueName(ref int) string
+}
+
+func createValueSet(f fieldlessSharedType) map[string]bool {
+	valueSet := make(map[string]bool)
+	for _, valueRef := range f.valueRefs() {
+		valueSet[f.valueName(valueRef)] = true
+	}
+	return valueSet
+}
+
+type fieldedSharedType struct {
+	document  *ast.Document
+	fieldKind ast.NodeKind
+	fieldRefs []int
+	fieldSet  map[string]int
+}
+
+func newFieldedSharedType(document *ast.Document, fieldKind ast.NodeKind, fieldRefs []int) fieldedSharedType {
+	f := fieldedSharedType{
+		document,
+		fieldKind,
+		fieldRefs,
+		nil,
+	}
+	f.createFieldSet()
+	return f
+}
+
+func (f fieldedSharedType) areFieldsIdentical(fieldRefsToCompare []int) bool {
+	if len(f.fieldRefs) != len(fieldRefsToCompare) {
+		return false
+	}
+	for _, fieldRef := range fieldRefsToCompare {
+		actualFieldName := f.fieldName(fieldRef)
+		expectedTypeRef, exists := f.fieldSet[actualFieldName]
+		if !exists {
+			return false
+		}
+		actualTypeRef := f.fieldTypeRef(fieldRef)
+		if !f.document.TypesAreCompatibleDeep(expectedTypeRef, actualTypeRef) {
+			return false
+		}
+	}
+	return true
+}
+
+func (f *fieldedSharedType) createFieldSet() {
+	fieldSet := make(map[string]int)
+	for _, fieldRef := range f.fieldRefs {
+		fieldSet[f.fieldName(fieldRef)] = f.fieldTypeRef(fieldRef)
+	}
+	f.fieldSet = fieldSet
+}
+
+func (f fieldedSharedType) fieldName(ref int) string {
+	switch f.fieldKind {
+	case ast.NodeKindInputValueDefinition:
+		return f.document.InputValueDefinitionNameString(ref)
+	default:
+		return f.document.FieldDefinitionNameString(ref)
+	}
+}
+
+func (f fieldedSharedType) fieldTypeRef(ref int) int {
+	switch f.fieldKind {
+	case ast.NodeKindInputValueDefinition:
+		return f.document.InputValueDefinitions[ref].Type
+	default:
+		return f.document.FieldDefinitions[ref].Type
+	}
+}
+
+type enumSharedType struct {
+	*ast.EnumTypeDefinition
+	document *ast.Document
+	valueSet map[string]bool
+}
+
+func newEnumSharedType(document *ast.Document, ref int) enumSharedType {
+	e := enumSharedType{
+		&document.EnumTypeDefinitions[ref],
+		document,
+		nil,
+	}
+	e.valueSet = createValueSet(e)
+	return e
+}
+
+func (e enumSharedType) areValuesIdentical(valueRefsToCompare []int) bool {
+	if len(e.valueRefs()) != len(valueRefsToCompare) {
+		return false
+	}
+	for _, valueRefToCompare := range valueRefsToCompare {
+		name := e.valueName(valueRefToCompare)
+		if !e.valueSet[name] {
+			return false
+		}
+	}
+	return true
+}
+
+func (e enumSharedType) valueRefs() []int {
+	return e.EnumValuesDefinition.Refs
+}
+
+func (e enumSharedType) valueName(ref int) string {
+	return e.document.EnumValueDefinitionNameString(ref)
+}
+
+type unionSharedType struct {
+	*ast.UnionTypeDefinition
+	document *ast.Document
+	valueSet map[string]bool
+}
+
+func newUnionSharedType(document *ast.Document, ref int) unionSharedType {
+	u := unionSharedType{
+		&document.UnionTypeDefinitions[ref],
+		document,
+		nil,
+	}
+	u.valueSet = createValueSet(u)
+	return u
+}
+
+func (u unionSharedType) areValuesIdentical(valueRefsToCompare []int) bool {
+	if len(u.valueRefs()) != len(valueRefsToCompare) {
+		return false
+	}
+	for _, refToCompare := range valueRefsToCompare {
+		name := u.valueName(refToCompare)
+		if !u.valueSet[name] {
+			return false
+		}
+	}
+	return true
+}
+
+func (u unionSharedType) valueRefs() []int {
+	return u.UnionMemberTypes.Refs
+}
+
+func (u unionSharedType) valueName(ref int) string {
+	return u.document.TypeNameString(ref)
+}
+
+type scalarSharedType struct{}
+
+func (scalarSharedType) areValuesIdentical(_ []int) bool {
+	return true
+}
+
+func (scalarSharedType) valueRefs() []int {
+	return nil
+}
+
+func (scalarSharedType) valueName(_ int) string {
+	return ""
+}

sdlmerge/union_type_extending.go

@@ -0,0 +1,50 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/operationreport"
+)
+
+func newExtendUnionTypeDefinition() *extendUnionTypeDefinitionVisitor {
+	return &extendUnionTypeDefinitionVisitor{}
+}
+
+type extendUnionTypeDefinitionVisitor struct {
+	*astvisitor.Walker
+	document *ast.Document
+}
+
+func (e *extendUnionTypeDefinitionVisitor) Register(walker *astvisitor.Walker) {
+	e.Walker = walker
+	walker.RegisterEnterDocumentVisitor(e)
+	walker.RegisterEnterUnionTypeExtensionVisitor(e)
+}
+
+func (e *extendUnionTypeDefinitionVisitor) EnterDocument(operation, _ *ast.Document) {
+	e.document = operation
+}
+
+func (e *extendUnionTypeDefinitionVisitor) EnterUnionTypeExtension(ref int) {
+	nodes, exists := e.document.Index.NodesByNameBytes(e.document.UnionTypeExtensionNameBytes(ref))
+	if !exists {
+		return
+	}
+
+	hasExtended := false
+	for i := range nodes {
+		if nodes[i].Kind != ast.NodeKindUnionTypeDefinition {
+			continue
+		}
+		if hasExtended {
+			e.StopWithExternalErr(operationreport.ErrSharedTypesMustNotBeExtended(e.document.UnionTypeExtensionNameString(ref)))
+			return
+		}
+		e.document.ExtendUnionTypeDefinitionByUnionTypeExtension(nodes[i].Ref, ref)
+		hasExtended = true
+	}
+
+	if !hasExtended {
+		e.StopWithExternalErr(operationreport.ErrExtensionOrphansMustResolveInSupergraph(e.document.UnionTypeExtensionNameBytes(ref)))
+	}
+}

store/event_store_migrations/20230426145300_add_organization.sql

@@ -0,0 +1,52 @@
+-- +goose Up
+-- Add Unbound Software Development organization
+insert into aggregates (id, name)
+values ('d46ffcb0-19e8-4769-8697-590326ef7b51', 'domain.Organization');
+
+insert into events (name, aggregate_id, aggregate_sequence_no, payload, tstamp, aggregate_name)
+values ('domain.OrganizationAdded', 'd46ffcb0-19e8-4769-8697-590326ef7b51', 1, '{"id":"d46ffcb0-19e8-4769-8697-590326ef7b51","time":"2023-04-26T14:46:04.43462+02:00","name":"Unbound Software Development","initiator":"google-oauth2|101953650269257914934"}', '2023-04-26T14:46:04.43462+02:00', 'domain.Organization');
+
+-- Add API keys
+insert into events (name, aggregate_id, aggregate_sequence_no, payload, tstamp, aggregate_name)
+values ('domain.APIKeyAdded', 'd46ffcb0-19e8-4769-8697-590326ef7b51', 2,
+        '{"id":"d46ffcb0-19e8-4769-8697-590326ef7b51","time":"2023-04-26T15:46:54.181929+02:00","organizationId":"","name":"CI","key":"dXNfYWtfeUl2R3RRQUJQTmJzVEFrUeOwxEKY/BwUmvv0yJlvuSQnrkHkZJuTTKSVmRt4UrhV","refs":["Shiny@staging","Shiny@prod"],"read":false,"publish":true,"initiator":"google-oauth2|101953650269257914934"}',
+        '2023-04-26 15:46:54.181929 +02:00', 'domain.Organization');
+
+insert into events (name, aggregate_id, aggregate_sequence_no, payload, tstamp, aggregate_name)
+values ('domain.APIKeyAdded', 'd46ffcb0-19e8-4769-8697-590326ef7b51', 3,
+        '{"id":"d46ffcb0-19e8-4769-8697-590326ef7b51","time":"2023-04-26T15:52:55.955203+02:00","organizationId":"","name":"Gateway","key":"dXNfYWtfdnkzSkRseDNlSDNjcnZzOeOwxEKY/BwUmvv0yJlvuSQnrkHkZJuTTKSVmRt4UrhV","refs":["Shiny@staging","Shiny@prod"],"read":true,"publish":false,"initiator":"google-oauth2|101953650269257914934"}',
+        '2023-04-26 15:52:55.955203 +02:00', 'domain.Organization');
+
+insert into events (name, aggregate_id, aggregate_sequence_no, payload, tstamp, aggregate_name)
+values ('domain.APIKeyAdded', 'd46ffcb0-19e8-4769-8697-590326ef7b51', 4,
+        '{"id":"d46ffcb0-19e8-4769-8697-590326ef7b51","time":"2023-04-26T16:30:00.0011+02:00","organizationId":"","name":"Local dev","key":"dXNfYWtfM0kzaGZndmVaQllyQzdjVOOwxEKY/BwUmvv0yJlvuSQnrkHkZJuTTKSVmRt4UrhV","refs":["Shiny@dev"],"read":true,"publish":true,"initiator":"google-oauth2|101953650269257914934"}',
+        '2023-04-26 16:30:00.001100 +02:00', 'domain.Organization');
+
+insert into events (name, aggregate_id, aggregate_sequence_no, payload, tstamp, aggregate_name)
+values ('domain.APIKeyAdded', 'd46ffcb0-19e8-4769-8697-590326ef7b51', 5,
+        '{"id":"d46ffcb0-19e8-4769-8697-590326ef7b51","time":"2023-04-27T07:43:26.599544+02:00","organizationId":"","name":"Acctest","key":"dXNfYWtfdlVqMzdBMXVraklmaGtKSOOwxEKY/BwUmvv0yJlvuSQnrkHkZJuTTKSVmRt4UrhV","refs":["Shiny@test"],"read":true,"publish":true,"initiator":"google-oauth2|101953650269257914934"}',
+        '2023-04-27 07:43:26.599544 +02:00', 'domain.Organization');
+
+-- Update events since json-tags were added
+UPDATE events e
+SET payload = jsonb_build_object(
+  'id', payload::jsonb ->> 'id',
+  'time', payload::jsonb ->> 'time',
+  'ref', payload::jsonb ->> 'Ref',
+  'sdl', payload::jsonb ->> 'Sdl',
+  'url', payload::jsonb ->> 'Url',
+  'wsUrl', payload::jsonb ->> 'WSUrl',
+  'service', payload::jsonb ->> 'Service',
+  'initiator', 'CI'
+  )
+WHERE e.name = 'domain.SubGraphUpdated';
+
+-- Add organization id to all existing subgraphs
+update events e
+set payload = jsonb_set(payload::jsonb, '{organizationId}', '"d46ffcb0-19e8-4769-8697-590326ef7b51"', true)
+where e.name = 'domain.SubGraphUpdated';
+
+DELETE
+from snapshots;
+
+-- +goose Down

store/store.go

@@ -1,7 +1,10 @@
 package store
 
 import (
+	"embed"
+
 	"github.com/jmoiron/sqlx"
+	"github.com/pressly/goose/v3"
 )
 
 func SetupDB(driverName, url string) (*sqlx.DB, error) {
@@ -25,3 +28,15 @@ func SetupDB(driverName, url string) (*sqlx.DB, error) {
 //
 //	return goose.Up(db.DB, "migrations")
 //}
+
+//go:embed event_store_migrations/*.sql
+var embedEventStoreMigrations embed.FS
+
+func RunEventStoreMigrations(db *sqlx.DB) error {
+	goose.SetTableName("goose_db_version_event")
+	goose.SetBaseFS(embedEventStoreMigrations)
+	if err := goose.SetDialect("postgres"); err != nil {
+		return err
+	}
+	return goose.Up(db.DB, "event_store_migrations")
+}