fix(deps): update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.225

Remove the conflicts entry for the unbound-schemas formula in the 
homebrew-taps configuration to simplify the integration process. This 
change enhances compatibility and streamlines the build setup.

.gitignore

@@ -5,3 +5,5 @@ coverage.html
 /exported
 /release
 /schemactl
+CHANGES.md
+VERSION

.gitlab-ci.yml

@@ -1,22 +1,32 @@
 include:
 - template: 'Workflows/MergeRequest-Pipelines.gitlab-ci.yml'
+- project: unboundsoftware/ci-templates
+  file: Defaults.gitlab-ci.yml
+- project: unboundsoftware/ci-templates
+  file: Release.gitlab-ci.yml
+- project: unboundsoftware/ci-templates
+  file: Pre-Commit-Go.gitlab-ci.yml
 
 stages:
 - build
+- test
 - deploy-prod
 - release
 
 variables:
-  DOCKER_HOST: tcp://docker:2376
-  DOCKER_TLS_CERTDIR: "/certs"
-  DOCKER_TLS_VERIFY: 1
-  DOCKER_CERT_PATH: "$DOCKER_TLS_CERTDIR/client"
-  DOCKER_DRIVER: overlay2
+  UNBOUND_RELEASE_TAG_ONLY: true
 
 .buildtools:
   image: buildtool/build-tools:${BUILDTOOLS_VERSION}
-  services:
-  - docker:dind
+
+check:
+  stage: .pre
+  image: amd64/golang:1.25.1@sha256:53f7808857782118f3a062261f721507dfa36e5c545e5d39c2dcf9916e3f0b1b
+  script:
+  - go install mvdan.cc/gofumpt@latest
+  - go install golang.org/x/tools/cmd/goimports@latest
+  - go generate ./...
+  - git diff --stat  --exit-code
 
 build:
   extends: .buildtools
@@ -30,7 +40,7 @@ build:
 
 vulnerabilities:
   stage: build
-  image: golang:1.19.2
+  image: amd64/golang:1.25.1@sha256:53f7808857782118f3a062261f721507dfa36e5c545e5d39c2dcf9916e3f0b1b
   script:
   - go install golang.org/x/vuln/cmd/govulncheck@latest
   - govulncheck ./...
@@ -46,31 +56,34 @@ deploy-prod:
   - if: $CI_COMMIT_BRANCH == "main"
   environment:
     name: prod
+  resource_group: prod
+
+check_release:
+  stage: test
+  image:
+    name: goreleaser/goreleaser:v2.12.0@sha256:3d43fbf51d57caa2c8a80ac7586127a4f9381d9235356dbb0132c6ab50705fb2
+    entrypoint: [ '' ]
+  variables:
+    GOTOOLCHAIN: auto
+  script: |
+    goreleaser check
+    goreleaser release --snapshot --clean
 
 release:
   stage: release
-  image: docker:stable
-  services:
-  - docker:dind
-
+  needs:
+  - unbound_release_prepare_release
+  image:
+    name: goreleaser/goreleaser:v2.12.0@sha256:3d43fbf51d57caa2c8a80ac7586127a4f9381d9235356dbb0132c6ab50705fb2
+    entrypoint: [ '' ]
   variables:
-    GORELEASER_IMAGE: goreleaser/goreleaser:v1.11.5-amd64
     # Disable shallow cloning so that goreleaser can diff between tags to
     # generate a changelog.
     GIT_DEPTH: 0
-
+    GITLAB_TOKEN: $GITLAB_CI_TOKEN
+    GOTOOLCHAIN: auto
   # Only run this release job for tags, not every commit (for example).
   rules:
   - if: $CI_COMMIT_TAG
-
   script: |
-    docker pull $GORELEASER_IMAGE
-
-    # GITLAB_TOKEN is needed to create GitLab releases.
-    # DOCKER_* are needed to push Docker images.
-    docker run --rm --privileged \
-      -v $PWD:/src \
-      -w /src \
-      -v /var/run/docker.sock:/var/run/docker.sock \
-      -e GITLAB_TOKEN \
-      $GORELEASER_IMAGE release --rm-dist
+    goreleaser release --clean --release-notes=CHANGES.md

.golangci.yml

@@ -0,0 +1,22 @@
+version: "2"
+run:
+  allow-parallel-runners: true
+linters:
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

.goreleaser.yml

@@ -1,4 +1,5 @@
 project_name: unbound-schemas
+version: 2
 
 env:
 - CGO_ENABLED=0
@@ -15,33 +16,31 @@ builds:
   - amd64
   - arm64
 
-brews:
+homebrew_casks:
 - name: unbound-schemas
-  tap:
+  repository:
     owner: unboundsoftware
     name: homebrew-taps
-  folder: Formula
-  install: |
-    bin.install "schemactl"
+  binary: schemactl
+  directory: Casks
   commit_author:
     name: "Joakim Olsson"
     email: joakim@unbound.se
   homepage: "https://schemas.unbound.se/"
+  hooks:
+    post:
+      install: |
+        # replace foo with the actual binary name
+        system_command "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "#{staged_path}/schemactl"]
 
 archives:
 - id: unbound-schemas
-  replacements:
-    darwin: Darwin
-    linux: Linux
-    windows: Windows
-    386: i386
-    amd64: x86_64
 
 checksum:
   name_template: 'checksums.txt'
 
 snapshot:
-  name_template: "{{ .Tag }}-next"
+  version_template: "{{ .Tag }}-next"
 
 changelog:
   sort: asc

.pre-commit-config.yaml

@@ -2,7 +2,7 @@
 # See https://pre-commit.com/hooks.html for more hooks
 repos:
 - repo: https://github.com/pre-commit/pre-commit-hooks
-  rev: v4.3.0
+  rev: v6.0.0
   hooks:
   - id: trailing-whitespace
   - id: end-of-file-fixer
@@ -10,27 +10,38 @@ repos:
     args:
     - --allow-multiple-documents
   - id: check-added-large-files
-- repo: https://github.com/jumanjihouse/pre-commit-hooks
-  rev: 3.0.0
-  hooks:
-  - id: markdownlint
 - repo: https://gitlab.com/devopshq/gitlab-ci-linter
-  rev: v1.0.3
+  rev: v1.0.6
   hooks:
   - id: gitlab-ci-linter
+    args:
+    - --project
+    - unboundsoftware/schemas
 - repo: https://github.com/alessandrojcm/commitlint-pre-commit-hook
-  rev: v9.1.0
+  rev: v9.22.0
   hooks:
   - id: commitlint
     stages: [ commit-msg ]
     additional_dependencies: [ '@commitlint/config-conventional' ]
-- repo: https://github.com/lietu/go-pre-commit
-  rev: v0.0.1
+- repo: https://github.com/dnephin/pre-commit-golang
+  rev: v0.5.1
+  hooks:
+  - id: go-mod-tidy
+  - id: go-imports
+    args:
+    - -local
+    - gitlab.com/unboundsoftware/schemas
+- repo: https://github.com/lietu/go-pre-commit
+  rev: v0.1.0
   hooks:
-  - id: errcheck
-  - id: go-fmt-goimports
   - id: go-test
-  - id: go-vet
-  - id: golangci-lint
   - id: gofumpt
-  - id: staticcheck
+- repo: https://github.com/golangci/golangci-lint
+  rev: v2.4.0
+  hooks:
+  - id: golangci-lint-full
+- repo: https://github.com/gitleaks/gitleaks
+  rev: v8.28.0
+  hooks:
+  - id: gitleaks
+exclude: '^ctl/generated.go|graph/generated/.*$|^graph/model/models_gen.go|^tools/.*$$'

CHANGELOG.md

@@ -0,0 +1,393 @@
+## [0.6.2] - 2025-08-22
+
+### ⚙️ Miscellaneous Tasks
+
+- Remove conflicts entry from homebrew-taps config
+## [0.6.1] - 2025-08-22
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.195
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.196
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.197
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.198
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.199
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.200
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.202
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.203
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.204
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.207
+- *(deps)* Update module github.com/golang-jwt/jwt/v5 to v5.2.3
+- *(deps)* Update module github.com/alecthomas/kong to v1.12.1
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.208
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.210
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.78
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.212
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.213
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.215
+- *(deps)* Update module github.com/golang-jwt/jwt/v5 to v5.3.0
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.216
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.217
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.218
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.219
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.220
+- *(deps)* Update module github.com/sparetimecoders/goamqp to v0.3.3
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.221
+## [0.6.0] - 2025-06-29
+
+### 🚀 Features
+
+- *(k8s)* Add OpenTelemetry exporter endpoint to deploy.yaml
+- Add build version injection via CI_COMMIT argument
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.190
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.28
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.75
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.192
+- *(deps)* Update module github.com/alecthomas/kong to v1.12.0
+- *(deps)* Update opentelemetry-go monorepo
+- *(deps)* Update module go.opentelemetry.io/contrib/bridges/otelslog to v0.12.0
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.29
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.194
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.30
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.76
+## [0.5.3] - 2025-06-13
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.187
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.188
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.189
+
+### 🚜 Refactor
+
+- Remove Sentry integration and replace with OpenTelemetry
+## [0.5.2] - 2025-06-09
+
+### 🐛 Bug Fixes
+
+- *(goreleaser)* Specify binary name in configuration
+## [0.5.1] - 2025-06-09
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update module github.com/alecthomas/kong to v1.11.0
+- *(deps)* Update module github.com/getsentry/sentry-go to v0.33.0
+- *(deps)* Update module github.com/khan/genqlient to v0.8.1
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.179
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.180
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.181
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.182
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.183
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.74
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.184
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.185
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.186
+## [0.5.0] - 2025-05-15
+
+### 🚀 Features
+
+- *(k8s)* Add PodDisruptionBudget for schemas service
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.26
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.173
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.174
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.175
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.176
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.73
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.177
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.178
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.24.3
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.27
+- *(k8s)* Update apiVersion for external secrets
+
+### ⚙️ Miscellaneous Tasks
+
+- *(ci)* Update GitLab CI configuration for templates
+## [0.4.1] - 2025-04-24
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.25
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.170
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.71
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.72
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.171
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.172
+## [0.4.0] - 2025-04-12
+
+### 🚀 Features
+
+- *(service)* Implement graceful shutdown for HTTP server
+
+### 🐛 Bug Fixes
+
+- *(secrets)* Remove namespace from ExternalSecret definition
+- *(deps)* Update module github.com/sparetimecoders/goamqp to v0.3.2
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.24
+- *(deps)* Update module github.com/getsentry/sentry-go to v0.32.0
+- *(k8s)* Increase CPU request for better performance
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/amqp to v1.8.1
+
+### 🚜 Refactor
+
+- *(deploy)* Remove cpu and memory limits for schemas
+## [0.3.0] - 2025-04-08
+
+### 🚀 Features
+
+- *(k8s)* Add RabbitMQ configurations and update secrets
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.161
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.162
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.163
+- *(deps)* Update module github.com/auth0/go-jwt-middleware/v2 to v2.3.0
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/eventsourced to v1.18.0
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/eventsourced to v1.18.1
+- *(deps)* Update module github.com/alecthomas/kong to v1.9.0
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.164
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.165
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.68
+- *(deps)* Update module github.com/golang-jwt/jwt/v5 to v5.2.2
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.166
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/eventsourced to v1.19.0
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.69
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.70
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.167
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/eventsourced to v1.19.1
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.24.2
+- *(deps)* Update module github.com/alecthomas/kong to v1.10.0
+- *(deps)* Update eventsourced
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.168
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.0.0-rc.169
+## [0.2.0] - 2025-02-28
+
+### 🚀 Features
+
+- *(dependencies)* Add Eventsourced package group for updates
+- *(sdlmerge)* Add shared types for GraphQL schema handling
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.64
+- *(deps)* Update module github.com/alecthomas/kong to v1.7.0
+- *(deps)* Update module github.com/khan/genqlient to v0.8.0
+- *(deps)* Update module github.com/alecthomas/kong to v1.8.0
+- *(ci)* Update golang image to improve compatibility
+- *(ci)* Add resource group to production deployment configuration
+- *(deps)* Update module github.com/alecthomas/kong to v1.8.1
+- *(deps)* Update dependencies to latest versions
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.65
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.66
+- *(deps)* Update eventsourced
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.23
+
+### ⚙️ Miscellaneous Tasks
+
+- *(go)* Update go version to 1.23.6 and remove toolchain
+- *(docker)* Update base image architecture to amd64
+## [0.1.1] - 2025-01-24
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update module github.com/getsentry/sentry-go to v0.31.0
+- *(deps)* Update module github.com/getsentry/sentry-go to v0.31.1
+- *(deps)* Update module github.com/alecthomas/kong to v1.6.1
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.24.1
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.63
+- *(k8s)* Standardize app label to app.kubernetes.io/name
+## [0.1.0] - 2025-01-01
+
+### 🚀 Features
+
+- Add timeout configuration to golangci-lint
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update module github.com/alecthomas/kong to v1.3.0
+- No digest pinning of own image
+- *(deps)* Update module github.com/alecthomas/kong to v1.4.0
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.19
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.56
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.23.0
+- *(deps)* Update module github.com/stretchr/testify to v1.10.0
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.57
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.20
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/eventsourced to v1.16.0
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/amqp to v1.7.0
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/pg to v1.15.0
+- *(deps)* Update module github.com/alecthomas/kong to v1.5.0
+- *(deps)* Update module github.com/alecthomas/kong to v1.5.1
+- *(deps)* Update module github.com/getsentry/sentry-go to v0.30.0
+- *(deps)* Update module github.com/alecthomas/kong to v1.6.0
+- *(k8s)* Adjust CPU requests for better resource allocation
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.58
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.59
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.60
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.23.1
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.24.0
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.61
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.21
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.62
+
+### 🚜 Refactor
+
+- Use common pre-commit job
+
+### ⚙️ Miscellaneous Tasks
+
+- Remove unnecessary Docker variables from configuration
+- *(ci)* Remove unused docker service from buildtools
+## [0.0.7] - 2024-10-22
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.20.0
+- *(deps)* Update module github.com/jmoiron/sqlx to v1.4.0
+- *(deps)* Update module github.com/rs/cors to v1.11.0
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.46
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.12
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.47
+- *(deps)* Update module github.com/getsentry/sentry-go to v0.28.0
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.48
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.16
+- *(deps)* Update module github.com/getsentry/sentry-go to v0.28.1
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools to v1.67.3
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.49
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.21.0
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.21.1
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools to v1.67.4
+- *(deps)* Update module github.com/sparetimecoders/goamqp to v0.3.1
+- *(deps)* Update module github.com/auth0/go-jwt-middleware/v2 to v2.2.2
+- *(deps)* Update module github.com/rs/cors to v1.11.1
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.22.0
+- *(deps)* Update module github.com/getsentry/sentry-go to v0.29.0
+- *(deps)* Update module github.com/alecthomas/kong to v1
+- *(deps)* Update module github.com/alecthomas/kong to v1.2.1
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.50
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.51
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.52
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.22.1
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.53
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.54
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.17
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.55
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/amqp to v1.6.5
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/eventsourced to v1.15.0
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/pg to v1.14.4
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/amqp to v1.6.6
+- *(deps)* Update module github.com/getsentry/sentry-go to v0.29.1
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.18
+
+### ⚙️ Miscellaneous Tasks
+
+- Update golangci-lint hook identifier in pre-commit config
+- Update goreleaser image to v2.3.1
+- Add generate check
+- Add release notes for goreleaser command in .gitlab-ci.yml
+## [0.0.6] - 2024-04-04
+
+### 🐛 Bug Fixes
+
+- Don't set fixed global_sequence_no
+
+### ⚙️ Miscellaneous Tasks
+
+- Add step for checking release
+## [0.0.5] - 2024-04-03
+
+### 🚀 Features
+
+- Add full SDL to SupGraph response
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update module github.com/stretchr/testify to v1.9.0
+- *(deps)* Update module github.com/golang-jwt/jwt/v4 to v5
+- Update default migrations
+- *(deps)* Update module github.com/golang-jwt/jwt/v5 to v5.2.1
+- *(deps)* Update module github.com/khan/genqlient to v0.7.0
+- *(deps)* Update module github.com/alecthomas/kong to v0.9.0
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.19.1
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.45
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.19.2
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/pg to v1.14.0
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/pg to v1.14.3
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools to v1.67.2
+
+### ⚙️ Miscellaneous Tasks
+
+- Update golangci-lint
+- Update Go version for vulnerabilities
+- Update to Go 1.20.7
+- Update to Golang 1.21.0 for vulnerabilities
+- Update pre-commit versions
+- Update to Go 1.21.1 for vulnerabilities
+- Use OrbStack for local dev
+- Add gitleaks to pre-commit setup
+- Update resources
+- Run release on medium instance
+- Back to small and upgrade goreleaser
+- Remove deprecated replacements
+## [0.0.4] - 2023-05-29
+
+### 🐛 Bug Fixes
+
+- Explicitly set dialect to make goose use correct version table
+
+### ⚙️ Miscellaneous Tasks
+
+- Update Go version for vulnerabilities
+- Update pre-commit and fix golangci-lint
+- Actually validate API key privileges and refs
+## [0.0.3] - 2023-04-27
+
+### 🚀 Features
+
+- Add Sentry setup
+- Add Sentry setup
+- Organizations and API keys
+
+### 🐛 Bug Fixes
+
+- Use correct healthcheck path
+
+### ⚙️ Miscellaneous Tasks
+
+- Update schema if URLs have changed
+- Add pre-commit and remove those checks from Dockerfile
+- Add context and error handling
+- Move to default ingress group
+- Decrease trace sample rate
+- Improve docker caching
+- Add local module to pre-commit config
+- Only ignore generated files with do not edit
+- Default ingress group
+- Use Docker DinD version from variable
+- Switch to manual rebases for Dependabot
+- Update to golang 1.20.1
+- Update Go verion for vulnerabilities scan
+- Reduce sample rate
+- Update to Go 1.20.3
+- Fix Gitlab CI lint
+## [0.0.2] - 2022-10-14
+
+### ⚙️ Miscellaneous Tasks
+
+- Add docker ignore
+- Handle push of unchanged schema
+## [0.0.1] - 2022-10-09
+
+### 🚀 Features
+
+- Initial commit
+
+### 🐛 Bug Fixes
+
+- Remove GITLAB_TOKEN

Dockerfile

@@ -1,12 +1,15 @@
-FROM golang:1.19.2 as build
+FROM amd64/golang:1.25.1@sha256:53f7808857782118f3a062261f721507dfa36e5c545e5d39c2dcf9916e3f0b1b as modules
+WORKDIR /build
+ADD go.* /build
+RUN go mod download
+
+FROM modules as build
+ARG CI_COMMIT
 WORKDIR /build
 ENV CGO_ENABLED=0
 ADD . /build
-RUN if [ $(go mod tidy -v 2>&1 | grep -c unused) != 0 ]; then echo "Unused modules, please run 'go mod tidy'"; exit 1; fi
-RUN go fmt ./...
-RUN go vet ./...
 RUN CGO_ENABLED=1 go test -mod=readonly -race -coverprofile=coverage.txt.tmp -covermode=atomic -coverpkg=$(go list ./... | tr '\n' , | sed 's/,$//') ./...
-RUN ["/bin/bash", "-c", "cat coverage.txt.tmp | grep -v testing.go | grep -v -f <(find . -type f | xargs grep -l 'Code generated') > coverage.txt"]
+RUN ["/bin/bash", "-c", "cat coverage.txt.tmp | grep -v testing.go | grep -v -f <(find . -type f | xargs grep -l 'Code generated by github.com/99designs/gqlgen, DO NOT EDIT') > coverage.txt"]
 RUN go tool cover -html=coverage.txt -o coverage.html
 RUN go tool cover -func=coverage.txt
 RUN rm coverage.txt.tmp
@@ -15,7 +18,7 @@ RUN GOOS=linux GOARCH=amd64 go build \
         -a -installsuffix cgo \
         -mod=readonly \
         -o /release/service \
-         -ldflags '-w -s' \
+        -ldflags "-w -s -X main.buildVersion=${CI_COMMIT}" \
          ./cmd/service/service.go
 
 FROM scratch as export

cache/cache.go

@@ -2,64 +2,144 @@ package cache
 
 import (
 	"fmt"
+	"log/slog"
 	"time"
 
-	"github.com/apex/log"
 	"github.com/sparetimecoders/goamqp"
 
 	"gitlab.com/unboundsoftware/schemas/domain"
+	"gitlab.com/unboundsoftware/schemas/hash"
 )
 
-const subGraphKey = "%s<->%s"
-
 type Cache struct {
-	services   map[string]map[string]struct{}
+	organizations map[string]domain.Organization
+	users         map[string][]string
+	apiKeys       map[string]domain.APIKey
+	services      map[string]map[string]map[string]struct{}
 	subGraphs     map[string]string
 	lastUpdate    map[string]string
-	logger     log.Interface
+	logger        *slog.Logger
 }
 
-func (c *Cache) Services(ref, lastUpdate string) ([]string, string) {
+func (c *Cache) OrganizationByAPIKey(apiKey string) *domain.Organization {
+	key, exists := c.apiKeys[apiKey]
+	if !exists {
+		return nil
+	}
+	org, exists := c.organizations[key.OrganizationId]
+	if !exists {
+		return nil
+	}
+	return &org
+}
+
+func (c *Cache) OrganizationsByUser(sub string) []domain.Organization {
+	orgIds := c.users[sub]
+	orgs := make([]domain.Organization, len(orgIds))
+	for i, id := range orgIds {
+		orgs[i] = c.organizations[id]
+	}
+	return orgs
+}
+
+func (c *Cache) ApiKeyByKey(key string) *domain.APIKey {
+	k, exists := c.apiKeys[hash.String(key)]
+	if !exists {
+		return nil
+	}
+	return &k
+}
+
+func (c *Cache) Services(orgId, ref, lastUpdate string) ([]string, string) {
+	key := refKey(orgId, ref)
 	var services []string
-	if lastUpdate == "" || c.lastUpdate[ref] > lastUpdate {
-		for k := range c.services[ref] {
+	if lastUpdate == "" || c.lastUpdate[key] > lastUpdate {
+		for k := range c.services[orgId][ref] {
 			services = append(services, k)
 		}
 	}
-	return services, c.lastUpdate[ref]
+	return services, c.lastUpdate[key]
 }
 
-func (c *Cache) SubGraphId(ref, service string) string {
-	return c.subGraphs[fmt.Sprintf(subGraphKey, ref, service)]
+func (c *Cache) SubGraphId(orgId, ref, service string) string {
+	return c.subGraphs[subGraphKey(orgId, ref, service)]
 }
 
 func (c *Cache) Update(msg any, _ goamqp.Headers) (any, error) {
 	switch m := msg.(type) {
+	case *domain.OrganizationAdded:
+		o := domain.Organization{}
+		m.UpdateOrganization(&o)
+		c.organizations[m.ID.String()] = o
+		c.addUser(m.Initiator, o)
+	case *domain.APIKeyAdded:
+		key := domain.APIKey{
+			Name:           m.Name,
+			OrganizationId: m.OrganizationId,
+			Key:            m.Key,
+			Refs:           m.Refs,
+			Read:           m.Read,
+			Publish:        m.Publish,
+			CreatedBy:      m.Initiator,
+			CreatedAt:      m.When(),
+		}
+		c.apiKeys[m.Key] = key
+		org := c.organizations[m.OrganizationId]
+		org.APIKeys = append(org.APIKeys, key)
+		c.organizations[m.OrganizationId] = org
 	case *domain.SubGraphUpdated:
-		if _, exists := c.services[m.Ref]; !exists {
-			c.services[m.Ref] = make(map[string]struct{})
+		c.updateSubGraph(m.OrganizationId, m.Ref, m.ID.String(), m.Service, m.Time)
+	case *domain.Organization:
+		c.organizations[m.ID.String()] = *m
+		c.addUser(m.CreatedBy, *m)
+		for _, k := range m.APIKeys {
+			c.apiKeys[k.Key] = k
 		}
-		c.services[m.Ref][m.ID.String()] = struct{}{}
-		c.subGraphs[fmt.Sprintf(subGraphKey, m.Ref, m.Service)] = m.ID.String()
-		c.lastUpdate[m.Ref] = m.Time.Format(time.RFC3339Nano)
 	case *domain.SubGraph:
-		if _, exists := c.services[m.Ref]; !exists {
-			c.services[m.Ref] = make(map[string]struct{})
-		}
-		c.services[m.Ref][m.ID.String()] = struct{}{}
-		c.subGraphs[fmt.Sprintf(subGraphKey, m.Ref, m.Service)] = m.ID.String()
-		c.lastUpdate[m.Ref] = m.ChangedAt.Format(time.RFC3339Nano)
+		c.updateSubGraph(m.OrganizationId, m.Ref, m.ID.String(), m.Service, m.ChangedAt)
 	default:
-		c.logger.Warnf("unexpected message received: %+v", msg)
+		c.logger.With("msg", msg).Warn("unexpected message received")
 	}
 	return nil, nil
 }
 
-func New(logger log.Interface) *Cache {
+func (c *Cache) updateSubGraph(orgId string, ref string, subGraphId string, service string, updated time.Time) {
+	if _, exists := c.services[orgId]; !exists {
+		c.services[orgId] = make(map[string]map[string]struct{})
+	}
+	if _, exists := c.services[orgId][ref]; !exists {
+		c.services[orgId][ref] = make(map[string]struct{})
+	}
+	c.services[orgId][ref][subGraphId] = struct{}{}
+	c.subGraphs[subGraphKey(orgId, ref, service)] = subGraphId
+	c.lastUpdate[refKey(orgId, ref)] = updated.Format(time.RFC3339Nano)
+}
+
+func (c *Cache) addUser(sub string, organization domain.Organization) {
+	user, exists := c.users[sub]
+	if !exists {
+		c.users[sub] = []string{organization.ID.String()}
+	} else {
+		c.users[sub] = append(user, organization.ID.String())
+	}
+}
+
+func New(logger *slog.Logger) *Cache {
 	return &Cache{
+		organizations: make(map[string]domain.Organization),
+		users:         make(map[string][]string),
+		apiKeys:       make(map[string]domain.APIKey),
+		services:      make(map[string]map[string]map[string]struct{}),
 		subGraphs:     make(map[string]string),
-		services:   make(map[string]map[string]struct{}),
 		lastUpdate:    make(map[string]string),
 		logger:        logger,
 	}
 }
+
+func refKey(orgId string, ref string) string {
+	return fmt.Sprintf("%s<->%s", orgId, ref)
+}
+
+func subGraphKey(orgId string, ref string, service string) string {
+	return fmt.Sprintf("%s<->%s<->%s", orgId, ref, service)
+}

cmd/service/service.go

@@ -2,22 +2,26 @@ package main
 
 import (
 	"context"
+	"errors"
 	"fmt"
+	"log/slog"
 	"net/http"
 	"os"
 	"os/signal"
 	"reflect"
 	"sync"
 	"syscall"
+	"time"
 
 	"github.com/99designs/gqlgen/graphql/handler"
+	"github.com/99designs/gqlgen/graphql/handler/extension"
+	"github.com/99designs/gqlgen/graphql/handler/lru"
+	"github.com/99designs/gqlgen/graphql/handler/transport"
 	"github.com/99designs/gqlgen/graphql/playground"
 	"github.com/alecthomas/kong"
-	"github.com/apex/log"
-	"github.com/apex/log/handlers/json"
-	sentryhttp "github.com/getsentry/sentry-go/http"
 	"github.com/rs/cors"
 	"github.com/sparetimecoders/goamqp"
+	"github.com/vektah/gqlparser/v2/ast"
 	"gitlab.com/unboundsoftware/eventsourced/amqp"
 	"gitlab.com/unboundsoftware/eventsourced/eventsourced"
 	"gitlab.com/unboundsoftware/eventsourced/pg"
@@ -26,93 +30,108 @@ import (
 	"gitlab.com/unboundsoftware/schemas/domain"
 	"gitlab.com/unboundsoftware/schemas/graph"
 	"gitlab.com/unboundsoftware/schemas/graph/generated"
+	"gitlab.com/unboundsoftware/schemas/logging"
 	"gitlab.com/unboundsoftware/schemas/middleware"
+	"gitlab.com/unboundsoftware/schemas/monitoring"
 	"gitlab.com/unboundsoftware/schemas/store"
 )
 
-var CLI struct {
-	AmqpURL            string `name:"amqp-url" env:"AMQP_URL" help:"URL to use to connect to RabbitMQ" default:"amqp://user:password@localhost:5672/"`
+type CLI struct {
+	AmqpURL            string `name:"amqp-url" env:"AMQP_URL" help:"URL to use to connect to RabbitMQ" default:"amqp://user:password@unbound-control-plane.orb.local:5672/"`
 	Port               int    `name:"port" env:"PORT" help:"Listen-port for GraphQL API" default:"8080"`
-	APIKey             string `name:"api-key" env:"API_KEY" help:"The API-key that is required"`
 	LogLevel           string `name:"log-level" env:"LOG_LEVEL" help:"The level of logging to use (debug, info, warn, error, fatal)" default:"info"`
-	DatabaseURL        string `name:"postgres-url" env:"POSTGRES_URL" help:"URL to use to connect to Postgres" default:"postgres://postgres:postgres@:5432/schemas?sslmode=disable"`
+	LogFormat          string `name:"log-format" env:"LOG_FORMAT" help:"The format of logs" default:"text" enum:"otel,json,text"`
+	DatabaseURL        string `name:"postgres-url" env:"POSTGRES_URL" help:"URL to use to connect to Postgres" default:"postgres://postgres:postgres@unbound-control-plane.orb.local:5432/schemas?sslmode=disable"`
 	DatabaseDriverName string `name:"db-driver" env:"DB_DRIVER" help:"Driver to use to connect to db" default:"postgres"`
+	Issuer             string `name:"issuer" env:"ISSUER" help:"The JWT token issuer to use" default:"unbound.eu.auth0.com"`
+	StrictSSL          bool   `name:"strict-ssl" env:"STRICT_SSL" help:"Should strict SSL handling be enabled" default:"true"`
+	Environment        string `name:"environment" env:"ENVIRONMENT" help:"The environment we are running in" default:"development" enum:"development,staging,production"`
 }
 
+var buildVersion = "none"
+
 const serviceName = "schemas"
 
 func main() {
-	_ = kong.Parse(&CLI)
-	log.SetHandler(json.New(os.Stdout))
-	log.SetLevelFromString(CLI.LogLevel)
-	logger := log.WithField("service", serviceName)
+	var cli CLI
+	_ = kong.Parse(&cli)
+	logger := logging.SetupLogger(cli.LogLevel, cli.LogFormat, serviceName, buildVersion)
 	closeEvents := make(chan error)
 
 	if err := start(
 		closeEvents,
 		logger,
 		ConnectAMQP,
+		cli,
 	); err != nil {
-		logger.WithError(err).Error("process error")
+		logger.With("error", err).Error("process error")
 	}
 }
 
-func start(closeEvents chan error, logger *log.Entry, connectToAmqpFunc func(url string) (Connection, error)) error {
+func start(closeEvents chan error, logger *slog.Logger, connectToAmqpFunc func(url string) (Connection, error), cli CLI) error {
 	rootCtx, rootCancel := context.WithCancel(context.Background())
 	defer rootCancel()
 
-	db, err := store.SetupDB(CLI.DatabaseDriverName, CLI.DatabaseURL)
+	shutdownFn, err := monitoring.SetupOTelSDK(rootCtx, cli.LogFormat == "otel", serviceName, buildVersion, cli.Environment)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		_ = errors.Join(shutdownFn(context.Background()))
+	}()
+
+	db, err := store.SetupDB(cli.DatabaseDriverName, cli.DatabaseURL)
 	if err != nil {
 		return fmt.Errorf("failed to setup DB: %v", err)
 	}
 
 	eventStore, err := pg.New(
+		rootCtx,
 		db.DB,
 		pg.WithEventTypes(
 			&domain.SubGraphUpdated{},
+			&domain.OrganizationAdded{},
+			&domain.APIKeyAdded{},
 		),
 	)
 	if err != nil {
 		return fmt.Errorf("failed to create eventstore: %v", err)
 	}
-	eventPublisher, err := goamqp.NewPublisher(
-		goamqp.Route{
-			Type: domain.SubGraphUpdated{},
-			Key:  "SubGraph.Updated",
-		},
-	)
+
+	if err := store.RunEventStoreMigrations(db); err != nil {
+		return fmt.Errorf("event migrations: %w", err)
+	}
+
+	publisher := goamqp.NewPublisher()
+	eventPublisher, err := amqp.New(publisher)
 	if err != nil {
 		return fmt.Errorf("failed to create event publisher: %v", err)
 	}
-	amqp.New(eventPublisher)
-	conn, err := connectToAmqpFunc(CLI.AmqpURL)
+	conn, err := connectToAmqpFunc(cli.AmqpURL)
 	if err != nil {
 		return fmt.Errorf("failed to connect to AMQP: %v", err)
 	}
 
 	serviceCache := cache.New(logger)
-	roots, err := eventStore.GetAggregateRoots(reflect.TypeOf(domain.SubGraph{}))
-	if err != nil {
-		return err
-	}
-	for _, root := range roots {
-		subGraph := &domain.SubGraph{BaseAggregate: eventsourced.BaseAggregateFromString(root.String())}
-		if _, err := eventsourced.NewHandler(subGraph, eventStore); err != nil {
-			return err
-		}
-		_, err := serviceCache.Update(subGraph, nil)
-		if err != nil {
-			return err
+	if err := loadOrganizations(rootCtx, eventStore, serviceCache); err != nil {
+		return fmt.Errorf("caching organizations: %w", err)
 	}
+	if err := loadSubGraphs(rootCtx, eventStore, serviceCache); err != nil {
+		return fmt.Errorf("caching subgraphs: %w", err)
 	}
 	setups := []goamqp.Setup{
-		goamqp.UseLogger(logger.Errorf),
+		goamqp.UseLogger(func(s string) { logger.Error(s) }),
 		goamqp.CloseListener(closeEvents),
 		goamqp.WithPrefetchLimit(20),
-		goamqp.EventStreamPublisher(eventPublisher),
+		goamqp.EventStreamPublisher(publisher),
 		goamqp.TransientEventStreamConsumer("SubGraph.Updated", serviceCache.Update, domain.SubGraphUpdated{}),
+		goamqp.TransientEventStreamConsumer("Organization.Added", serviceCache.Update, domain.OrganizationAdded{}),
+		goamqp.TransientEventStreamConsumer("Organization.APIKeyAdded", serviceCache.Update, domain.APIKeyAdded{}),
+		goamqp.WithTypeMapping("SubGraph.Updated", domain.SubGraphUpdated{}),
+		goamqp.WithTypeMapping("Organization.Added", domain.OrganizationAdded{}),
+		goamqp.WithTypeMapping("Organization.APIKeyAdded", domain.APIKeyAdded{}),
 	}
-	if err := conn.Start(setups...); err != nil {
+	if err := conn.Start(rootCtx, setups...); err != nil {
 		return fmt.Errorf("failed to setup AMQP: %v", err)
 	}
 
@@ -121,7 +140,7 @@ func start(closeEvents chan error, logger *log.Entry, connectToAmqpFunc func(url
 	logger.Info("Started")
 
 	mux := http.NewServeMux()
-	httpSrv := &http.Server{Addr: fmt.Sprintf(":%d", CLI.Port), Handler: mux}
+	httpSrv := &http.Server{Addr: fmt.Sprintf(":%d", cli.Port), Handler: mux}
 
 	wg := sync.WaitGroup{}
 
@@ -147,7 +166,7 @@ func start(closeEvents chan error, logger *log.Entry, connectToAmqpFunc func(url
 		defer wg.Done()
 		err := <-closeEvents
 		if err != nil {
-			logger.WithError(err).Error("received close from AMQP")
+			logger.With("error", err).Error("received close from AMQP")
 			rootCancel()
 		}
 	}()
@@ -157,8 +176,11 @@ func start(closeEvents chan error, logger *log.Entry, connectToAmqpFunc func(url
 		defer wg.Done()
 		<-rootCtx.Done()
 
-		if err := httpSrv.Close(); err != nil {
-			logger.WithError(err).Error("close http server")
+		shutdownCtx, shutdownRelease := context.WithTimeout(context.Background(), 10*time.Second)
+		defer shutdownRelease()
+
+		if err := httpSrv.Shutdown(shutdownCtx); err != nil {
+			logger.With("error", err).Error("close http server")
 		}
 		close(sigint)
 		close(closeEvents)
@@ -170,7 +192,7 @@ func start(closeEvents chan error, logger *log.Entry, connectToAmqpFunc func(url
 
 		resolver := &graph.Resolver{
 			EventStore: eventStore,
-			Publisher:  amqp.New(eventPublisher),
+			Publisher:  eventPublisher,
 			Logger:     logger,
 			Cache:      serviceCache,
 		}
@@ -179,21 +201,43 @@ func start(closeEvents chan error, logger *log.Entry, connectToAmqpFunc func(url
 			Resolvers:  resolver,
 			Complexity: generated.ComplexityRoot{},
 		}
-		apiKeyMiddleware := middleware.NewApiKey(CLI.APIKey, logger)
-		config.Directives.HasApiKey = apiKeyMiddleware.Directive
-		srv := handler.NewDefaultServer(generated.NewExecutableSchema(
-			config,
+		apiKeyMiddleware := middleware.NewApiKey()
+		mw := middleware.NewAuth0("https://schemas.unbound.se", cli.Issuer, cli.StrictSSL)
+		authMiddleware := middleware.NewAuth(serviceCache)
+		config.Directives.Auth = authMiddleware.Directive
+		srv := handler.New(generated.NewExecutableSchema(config))
+
+		srv.AddTransport(transport.Websocket{
+			KeepAlivePingInterval: 10 * time.Second,
+		})
+		srv.AddTransport(transport.Options{})
+		srv.AddTransport(transport.GET{})
+		srv.AddTransport(transport.POST{})
+		srv.AddTransport(transport.MultipartForm{})
+
+		srv.SetQueryCache(lru.New[*ast.QueryDocument](1000))
+
+		srv.Use(extension.Introspection{})
+		srv.Use(extension.AutomaticPersistedQuery{
+			Cache: lru.New[string](100),
+		})
+
+		mux.Handle("/", monitoring.Handler(playground.Handler("GraphQL playground", "/query")))
+		mux.Handle("/health", http.HandlerFunc(healthFunc))
+		mux.Handle("/query", cors.AllowAll().Handler(
+			monitoring.Handler(
+				mw.Middleware().CheckJWT(
+					apiKeyMiddleware.Handler(
+						authMiddleware.Handler(srv),
+					),
+				),
+			),
 		))
 
-		sentryHandler := sentryhttp.New(sentryhttp.Options{Repanic: true})
-		mux.Handle("/", sentryHandler.HandleFunc(playground.Handler("GraphQL playground", "/query")))
-		mux.Handle("/health", sentryHandler.HandleFunc(healthFunc))
-		mux.Handle("/query", cors.AllowAll().Handler(sentryHandler.Handle(apiKeyMiddleware.Handler(srv))))
+		logger.Info(fmt.Sprintf("connect to http://localhost:%d/ for GraphQL playground", cli.Port))
 
-		logger.Infof("connect to http://localhost:%d/ for GraphQL playground", CLI.Port)
-
-		if err := httpSrv.ListenAndServe(); err != nil {
-			logger.WithError(err).Error("listen http")
+		if err := httpSrv.ListenAndServe(); !errors.Is(err, http.ErrServerClosed) {
+			logger.With("error", err).Error("listen http")
 		}
 	}()
 
@@ -202,6 +246,42 @@ func start(closeEvents chan error, logger *log.Entry, connectToAmqpFunc func(url
 	return nil
 }
 
+func loadOrganizations(ctx context.Context, eventStore eventsourced.EventStore, serviceCache *cache.Cache) error {
+	roots, err := eventStore.GetAggregateRoots(ctx, reflect.TypeOf(domain.Organization{}))
+	if err != nil {
+		return err
+	}
+	for _, root := range roots {
+		organization := &domain.Organization{BaseAggregate: eventsourced.BaseAggregateFromString(root.String())}
+		if _, err := eventsourced.NewHandler(ctx, organization, eventStore); err != nil {
+			return err
+		}
+		_, err := serviceCache.Update(organization, nil)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func loadSubGraphs(ctx context.Context, eventStore eventsourced.EventStore, serviceCache *cache.Cache) error {
+	roots, err := eventStore.GetAggregateRoots(ctx, reflect.TypeOf(domain.SubGraph{}))
+	if err != nil {
+		return err
+	}
+	for _, root := range roots {
+		subGraph := &domain.SubGraph{BaseAggregate: eventsourced.BaseAggregateFromString(root.String())}
+		if _, err := eventsourced.NewHandler(ctx, subGraph, eventStore); err != nil {
+			return err
+		}
+		_, err := serviceCache.Update(subGraph, nil)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 func healthFunc(w http.ResponseWriter, _ *http.Request) {
 	_, _ = w.Write([]byte("OK"))
 }
@@ -211,6 +291,6 @@ func ConnectAMQP(url string) (Connection, error) {
 }
 
 type Connection interface {
-	Start(opts ...goamqp.Setup) error
+	Start(ctx context.Context, opts ...goamqp.Setup) error
 	Close() error
 }

ctl/generated.go

@@ -43,6 +43,7 @@ type SubGraphsResponse struct {
 func (v *SubGraphsResponse) GetSupergraph() SubGraphsSupergraph { return v.Supergraph }
 
 func (v *SubGraphsResponse) UnmarshalJSON(b []byte) error {
+
 	if string(b) == "null" {
 		return nil
 	}
@@ -148,6 +149,7 @@ func __unmarshalSubGraphsSupergraph(b []byte, v *SubGraphsSupergraph) error {
 }
 
 func __marshalSubGraphsSupergraph(v *SubGraphsSupergraph) ([]byte, error) {
+
 	var typename string
 	switch v := (*v).(type) {
 	case *SubGraphsSupergraphSubGraphs:
@@ -270,14 +272,8 @@ type __UpdateSubGraphInput struct {
 // GetInput returns __UpdateSubGraphInput.Input, and is useful for accessing the field via an interface.
 func (v *__UpdateSubGraphInput) GetInput() *InputSubGraph { return v.Input }
 
-func SubGraphs(
-	ctx context.Context,
-	client graphql.Client,
-	ref string,
-) (*SubGraphsResponse, error) {
-	req := &graphql.Request{
-		OpName: "SubGraphs",
-		Query: `
+// The query executed by SubGraphs.
+const SubGraphs_Operation = `
 query SubGraphs ($ref: String!) {
 	supergraph(ref: $ref) {
 		__typename
@@ -292,33 +288,35 @@ query SubGraphs ($ref: String!) {
 		}
 	}
 }
-`,
+`
+
+func SubGraphs(
+	ctx_ context.Context,
+	client_ graphql.Client,
+	ref string,
+) (data_ *SubGraphsResponse, err_ error) {
+	req_ := &graphql.Request{
+		OpName: "SubGraphs",
+		Query:  SubGraphs_Operation,
 		Variables: &__SubGraphsInput{
 			Ref: ref,
 		},
 	}
-	var err error
 
-	var data SubGraphsResponse
-	resp := &graphql.Response{Data: &data}
+	data_ = &SubGraphsResponse{}
+	resp_ := &graphql.Response{Data: data_}
 
-	err = client.MakeRequest(
-		ctx,
-		req,
-		resp,
+	err_ = client_.MakeRequest(
+		ctx_,
+		req_,
+		resp_,
 	)
 
-	return &data, err
+	return data_, err_
 }
 
-func UpdateSubGraph(
-	ctx context.Context,
-	client graphql.Client,
-	input *InputSubGraph,
-) (*UpdateSubGraphResponse, error) {
-	req := &graphql.Request{
-		OpName: "UpdateSubGraph",
-		Query: `
+// The mutation executed by UpdateSubGraph.
+const UpdateSubGraph_Operation = `
 mutation UpdateSubGraph ($input: InputSubGraph!) {
 	updateSubGraph(input: $input) {
 		service
@@ -328,21 +326,29 @@ mutation UpdateSubGraph ($input: InputSubGraph!) {
 		changedAt
 	}
 }
-`,
+`
+
+func UpdateSubGraph(
+	ctx_ context.Context,
+	client_ graphql.Client,
+	input *InputSubGraph,
+) (data_ *UpdateSubGraphResponse, err_ error) {
+	req_ := &graphql.Request{
+		OpName: "UpdateSubGraph",
+		Query:  UpdateSubGraph_Operation,
 		Variables: &__UpdateSubGraphInput{
 			Input: input,
 		},
 	}
-	var err error
 
-	var data UpdateSubGraphResponse
-	resp := &graphql.Response{Data: &data}
+	data_ = &UpdateSubGraphResponse{}
+	resp_ := &graphql.Response{Data: data_}
 
-	err = client.MakeRequest(
-		ctx,
-		req,
-		resp,
+	err_ = client_.MakeRequest(
+		ctx_,
+		req_,
+		resp_,
 	)
 
-	return &data, err
+	return data_, err_
 }

domain/aggregates.go

@@ -8,8 +8,56 @@ import (
 	"gitlab.com/unboundsoftware/eventsourced/eventsourced"
 )
 
+type Organization struct {
+	eventsourced.BaseAggregate
+	Name      string
+	Users     []string
+	APIKeys   []APIKey
+	CreatedBy string
+	CreatedAt time.Time
+	ChangedBy string
+	ChangedAt time.Time
+}
+
+func (o *Organization) Apply(event eventsourced.Event) error {
+	switch e := event.(type) {
+	case *OrganizationAdded:
+		e.UpdateOrganization(o)
+	case *APIKeyAdded:
+		o.APIKeys = append(o.APIKeys, APIKey{
+			Name:           e.Name,
+			OrganizationId: o.ID.String(),
+			Key:            e.Key,
+			Refs:           e.Refs,
+			Read:           e.Read,
+			Publish:        e.Publish,
+			CreatedBy:      e.Initiator,
+			CreatedAt:      e.When(),
+		})
+		o.ChangedBy = e.Initiator
+		o.ChangedAt = e.When()
+	default:
+		return fmt.Errorf("unexpected event type: %+v", event)
+	}
+	return nil
+}
+
+var _ eventsourced.Aggregate = &Organization{}
+
+type APIKey struct {
+	Name           string
+	OrganizationId string
+	Key            string
+	Refs           []string
+	Read           bool
+	Publish        bool
+	CreatedBy      string
+	CreatedAt      time.Time
+}
+
 type SubGraph struct {
 	eventsourced.BaseAggregate
+	OrganizationId string
 	Ref            string
 	Service        string
 	Url            *string
@@ -28,6 +76,9 @@ func (s *SubGraph) Apply(event eventsourced.Event) error {
 			s.CreatedBy = e.Initiator
 			s.CreatedAt = e.When()
 		}
+		if s.OrganizationId == "" {
+			s.OrganizationId = e.OrganizationId
+		}
 		s.ChangedBy = e.Initiator
 		s.ChangedAt = e.When()
 		s.Ref = e.Ref

domain/commands.go

@@ -6,9 +6,70 @@ import (
 	"strings"
 
 	"gitlab.com/unboundsoftware/eventsourced/eventsourced"
+
+	"gitlab.com/unboundsoftware/schemas/hash"
 )
 
+type AddOrganization struct {
+	Name      string
+	Initiator string
+}
+
+func (a AddOrganization) Validate(_ context.Context, aggregate eventsourced.Aggregate) error {
+	if aggregate.Identity() != nil {
+		return fmt.Errorf("organization already exists")
+	}
+	if len(a.Name) == 0 {
+		return fmt.Errorf("name is required")
+	}
+	return nil
+}
+
+func (a AddOrganization) Event(context.Context) eventsourced.Event {
+	return &OrganizationAdded{
+		Name:      a.Name,
+		Initiator: a.Initiator,
+	}
+}
+
+var _ eventsourced.Command = AddOrganization{}
+
+type AddAPIKey struct {
+	Name      string
+	Key       string
+	Refs      []string
+	Read      bool
+	Publish   bool
+	Initiator string
+}
+
+func (a AddAPIKey) Validate(_ context.Context, aggregate eventsourced.Aggregate) error {
+	if aggregate.Identity() == nil {
+		return fmt.Errorf("organization does not exist")
+	}
+	for _, k := range aggregate.(*Organization).APIKeys {
+		if k.Name == a.Name {
+			return fmt.Errorf("a key named '%s' already exist", a.Name)
+		}
+	}
+	return nil
+}
+
+func (a AddAPIKey) Event(context.Context) eventsourced.Event {
+	return &APIKeyAdded{
+		Name:      a.Name,
+		Key:       hash.String(a.Key),
+		Refs:      a.Refs,
+		Read:      a.Read,
+		Publish:   a.Publish,
+		Initiator: a.Initiator,
+	}
+}
+
+var _ eventsourced.Command = AddAPIKey{}
+
 type UpdateSubGraph struct {
+	OrganizationId string
 	Ref            string
 	Service        string
 	Url            *string
@@ -40,6 +101,7 @@ func (u UpdateSubGraph) Validate(_ context.Context, aggregate eventsourced.Aggre
 
 func (u UpdateSubGraph) Event(context.Context) eventsourced.Event {
 	return &SubGraphUpdated{
+		OrganizationId: u.OrganizationId,
 		Ref:            u.Ref,
 		Service:        u.Service,
 		Url:            u.Url,

domain/commands_test.go

@@ -0,0 +1,63 @@
+package domain
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"gitlab.com/unboundsoftware/eventsourced/eventsourced"
+)
+
+func TestAddAPIKey_Event(t *testing.T) {
+	type fields struct {
+		Name      string
+		Key       string
+		Refs      []string
+		Read      bool
+		Publish   bool
+		Initiator string
+	}
+	type args struct {
+		in0 context.Context
+	}
+	tests := []struct {
+		name   string
+		fields fields
+		args   args
+		want   eventsourced.Event
+	}{
+		{
+			name: "event",
+			fields: fields{
+				Name:      "test",
+				Key:       "us_ak_1234567890123456",
+				Refs:      []string{"Example@dev"},
+				Read:      true,
+				Publish:   true,
+				Initiator: "jim@example.org",
+			},
+			args: args{},
+			want: &APIKeyAdded{
+				Name:      "test",
+				Key:       "dXNfYWtfMTIzNDU2Nzg5MDEyMzQ1NuOwxEKY/BwUmvv0yJlvuSQnrkHkZJuTTKSVmRt4UrhV",
+				Refs:      []string{"Example@dev"},
+				Read:      true,
+				Publish:   true,
+				Initiator: "jim@example.org",
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			a := AddAPIKey{
+				Name:      tt.fields.Name,
+				Key:       tt.fields.Key,
+				Refs:      tt.fields.Refs,
+				Read:      tt.fields.Read,
+				Publish:   tt.fields.Publish,
+				Initiator: tt.fields.Initiator,
+			}
+			assert.Equalf(t, tt.want, a.Event(tt.args.in0), "Event(%v)", tt.args.in0)
+		})
+	}
+}

domain/events.go

@@ -2,13 +2,45 @@ package domain
 
 import "gitlab.com/unboundsoftware/eventsourced/eventsourced"
 
-type SubGraphUpdated struct {
-	eventsourced.EventAggregateId
-	eventsourced.EventTime
-	Ref       string
-	Service   string
-	Url       *string
-	WSUrl     *string
-	Sdl       string
-	Initiator string
+type OrganizationAdded struct {
+	eventsourced.BaseEvent
+	Name      string `json:"name"`
+	Initiator string `json:"initiator"`
+}
+
+func (a *OrganizationAdded) UpdateOrganization(o *Organization) {
+	o.Name = a.Name
+	o.Users = []string{a.Initiator}
+	o.CreatedBy = a.Initiator
+	o.CreatedAt = a.When()
+	o.ChangedBy = a.Initiator
+	o.ChangedAt = a.When()
+}
+
+type APIKeyAdded struct {
+	eventsourced.BaseEvent
+	OrganizationId string   `json:"organizationId"`
+	Name           string   `json:"name"`
+	Key            string   `json:"key"`
+	Refs           []string `json:"refs"`
+	Read           bool     `json:"read"`
+	Publish        bool     `json:"publish"`
+	Initiator      string   `json:"initiator"`
+}
+
+func (a *APIKeyAdded) EnrichFromAggregate(aggregate eventsourced.Aggregate) {
+	a.OrganizationId = aggregate.Identity().String()
+}
+
+var _ eventsourced.EnrichableEvent = &APIKeyAdded{}
+
+type SubGraphUpdated struct {
+	eventsourced.BaseEvent
+	OrganizationId string  `json:"organizationId"`
+	Ref            string  `json:"ref"`
+	Service        string  `json:"service"`
+	Url            *string `json:"url"`
+	WSUrl          *string `json:"wsUrl"`
+	Sdl            string  `json:"sdl"`
+	Initiator      string  `json:"initiator"`
 }

go.mod

@@ -1,53 +1,79 @@
 module gitlab.com/unboundsoftware/schemas
 
-go 1.19
+go 1.25
 
 require (
-	github.com/99designs/gqlgen v0.17.20
-	github.com/Khan/genqlient v0.5.0
-	github.com/alecthomas/kong v0.6.1
+	github.com/99designs/gqlgen v0.17.78
+	github.com/Khan/genqlient v0.8.1
+	github.com/alecthomas/kong v1.12.1
 	github.com/apex/log v1.9.0
-	github.com/getsentry/sentry-go v0.14.0
-	github.com/jmoiron/sqlx v1.3.5
-	github.com/rs/cors v1.8.2
-	github.com/sparetimecoders/goamqp v0.1.1
-	github.com/stretchr/testify v1.8.0
-	github.com/vektah/gqlparser/v2 v2.5.1
-	github.com/wundergraph/graphql-go-tools v1.57.2-0.20221005155749-a4fdba38990b
-	gitlab.com/unboundsoftware/eventsourced/amqp v1.5.0
-	gitlab.com/unboundsoftware/eventsourced/eventsourced v1.9.3
-	gitlab.com/unboundsoftware/eventsourced/pg v1.9.0
+	github.com/auth0/go-jwt-middleware/v2 v2.3.0
+	github.com/golang-jwt/jwt/v5 v5.3.0
+	github.com/jmoiron/sqlx v1.4.0
+	github.com/pkg/errors v0.9.1
+	github.com/pressly/goose/v3 v3.25.0
+	github.com/rs/cors v1.11.1
+	github.com/sparetimecoders/goamqp v0.3.3
+	github.com/stretchr/testify v1.11.1
+	github.com/vektah/gqlparser/v2 v2.5.30
+	github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.225
+	gitlab.com/unboundsoftware/eventsourced/amqp v1.8.1
+	gitlab.com/unboundsoftware/eventsourced/eventsourced v1.19.2
+	gitlab.com/unboundsoftware/eventsourced/pg v1.17.0
+	go.opentelemetry.io/contrib/bridges/otelslog v0.13.0
+	go.opentelemetry.io/otel v1.38.0
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.38.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.38.0
+	go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.14.0
+	go.opentelemetry.io/otel/log v0.14.0
+	go.opentelemetry.io/otel/sdk v1.38.0
+	go.opentelemetry.io/otel/sdk/log v0.14.0
+	go.opentelemetry.io/otel/sdk/metric v1.38.0
+	go.opentelemetry.io/otel/trace v1.38.0
 )
 
 require (
-	github.com/agnivade/levenshtein v1.1.1 // indirect
+	github.com/agnivade/levenshtein v1.2.1 // indirect
 	github.com/buger/jsonparser v1.1.1 // indirect
-	github.com/cespare/xxhash/v2 v2.1.2 // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/golang/mock v1.4.4 // indirect
-	github.com/google/uuid v1.3.0 // indirect
-	github.com/gorilla/websocket v1.5.0 // indirect
-	github.com/hashicorp/golang-lru v0.5.4 // indirect
-	github.com/kr/text v0.2.0 // indirect
-	github.com/lib/pq v1.10.6 // indirect
-	github.com/mitchellh/mapstructure v1.5.0 // indirect
-	github.com/pkg/errors v0.9.1 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/gorilla/websocket v1.5.1 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 // indirect
+	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
+	github.com/lib/pq v1.10.9 // indirect
+	github.com/mfridman/interpolate v0.0.2 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/qri-io/jsonpointer v0.1.1 // indirect
-	github.com/qri-io/jsonschema v0.2.1 // indirect
-	github.com/rabbitmq/amqp091-go v1.3.4 // indirect
+	github.com/rabbitmq/amqp091-go v1.10.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	github.com/tidwall/gjson v1.14.3 // indirect
+	github.com/sethvargo/go-retry v0.3.0 // indirect
+	github.com/sosodev/duration v1.3.1 // indirect
+	github.com/tidwall/gjson v1.17.0 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.1 // indirect
 	github.com/tidwall/sjson v1.2.5 // indirect
-	github.com/urfave/cli/v2 v2.8.1 // indirect
-	github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 // indirect
-	golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4 // indirect
-	golang.org/x/sys v0.0.0-20221006211917-84dc82d7e875 // indirect
-	golang.org/x/text v0.3.7 // indirect
-	golang.org/x/tools v0.1.12 // indirect
-	golang.org/x/xerrors v0.0.0-20220517211312-f3a8303e98df // indirect
+	github.com/urfave/cli/v2 v2.27.7 // indirect
+	github.com/wundergraph/astjson v0.0.0-20250106123708-be463c97e083 // indirect
+	github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 // indirect
+	go.opentelemetry.io/otel/metric v1.38.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.7.1 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	golang.org/x/mod v0.26.0 // indirect
+	golang.org/x/net v0.43.0 // indirect
+	golang.org/x/sync v0.16.0 // indirect
+	golang.org/x/sys v0.35.0 // indirect
+	golang.org/x/text v0.28.0 // indirect
+	golang.org/x/tools v0.35.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250825161204-c5933d9347a5 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250825161204-c5933d9347a5 // indirect
+	google.golang.org/grpc v1.75.0 // indirect
+	google.golang.org/protobuf v1.36.8 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -1,24 +1,25 @@
-github.com/99designs/gqlgen v0.17.2/go.mod h1:K5fzLKwtph+FFgh9j7nFbRUdBKvTcGnsta51fsMTn3o=
-github.com/99designs/gqlgen v0.17.20 h1:O7WzccIhKB1dm+7g6dhQcULINftfiLSBg2l/mwbpJMw=
-github.com/99designs/gqlgen v0.17.20/go.mod h1:Mja2HI23kWT1VRH09hvWshFgOzKswpO20o4ScpJIES4=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/toml v1.1.0/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
-github.com/DATA-DOG/go-sqlmock v1.5.0 h1:Shsta01QNfFxHCfpW6YH2STWB0MudeXXEWMr20OEh60=
-github.com/DATA-DOG/go-sqlmock v1.5.0/go.mod h1:f/Ixk793poVmq4qj/V1dPUg2JEAKC73Q5eFN3EC/SaM=
-github.com/Khan/genqlient v0.5.0 h1:TMZJ+tl/BpbmGyIBiXzKzUftDhw4ZWxQZ+1ydn0gyII=
-github.com/Khan/genqlient v0.5.0/go.mod h1:EpIvDVXYm01GP6AXzjA7dKriPTH6GmtpmvTAwUUqIX8=
-github.com/agnivade/levenshtein v1.0.1/go.mod h1:CURSv5d9Uaml+FovSIICkLbAUZ9S4RqaHDIsdSBg7lM=
-github.com/agnivade/levenshtein v1.1.0/go.mod h1:veldBMzWxcCG2ZvUTKD2kJNRdCk5hVbJomOvKkmgYbo=
-github.com/agnivade/levenshtein v1.1.1 h1:QY8M92nrzkmr798gCo3kmMyqXFzdQVpxLlGPRBij0P8=
-github.com/agnivade/levenshtein v1.1.1/go.mod h1:veldBMzWxcCG2ZvUTKD2kJNRdCk5hVbJomOvKkmgYbo=
-github.com/alecthomas/kong v0.6.1 h1:1kNhcFepkR+HmasQpbiKDLylIL8yh5B5y1zPp5bJimA=
-github.com/alecthomas/kong v0.6.1/go.mod h1:JfHWDzLmbh/puW6I3V7uWenoh56YNVONW+w8eKeUr9I=
-github.com/alecthomas/repr v0.0.0-20210801044451-80ca428c5142 h1:8Uy0oSf5co/NZXje7U1z8Mpep++QJOldL2hs/sBQf48=
-github.com/alecthomas/repr v0.0.0-20210801044451-80ca428c5142/go.mod h1:2kn6fqh/zIyPLmm3ugklbEi5hg5wS435eygvNfaDQL8=
-github.com/alexflint/go-arg v1.4.2/go.mod h1:9iRbDxne7LcR/GSvEr7ma++GLpdIU1zrghf2y2768kM=
-github.com/alexflint/go-scalar v1.0.0/go.mod h1:GpHzbCOZXEKMEcygYQ5n/aa4Aq84zbxjy3MxYW0gjYw=
+filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
+filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
+github.com/99designs/gqlgen v0.17.78 h1:bhIi7ynrc3js2O8wu1sMQj1YHPENDt3jQGyifoBvoVI=
+github.com/99designs/gqlgen v0.17.78/go.mod h1:yI/o31IauG2kX0IsskM4R894OCCG1jXJORhtLQqB7Oc=
+github.com/DATA-DOG/go-sqlmock v1.5.2 h1:OcvFkGmslmlZibjAjaHm3L//6LiuBgolP7OputlJIzU=
+github.com/DATA-DOG/go-sqlmock v1.5.2/go.mod h1:88MAG/4G7SMwSE3CeA0ZKzrT5CiOU3OJ+JlNzwDqpNU=
+github.com/Khan/genqlient v0.8.1 h1:wtOCc8N9rNynRLXN3k3CnfzheCUNKBcvXmVv5zt6WCs=
+github.com/Khan/genqlient v0.8.1/go.mod h1:R2G6DzjBvCbhjsEajfRjbWdVglSH/73kSivC9TLWVjU=
+github.com/PuerkitoBio/goquery v1.10.3 h1:pFYcNSqHxBD06Fpj/KsbStFRsgRATgnf3LeXiUkhzPo=
+github.com/PuerkitoBio/goquery v1.10.3/go.mod h1:tMUX0zDMHXYlAQk6p35XxQMqMweEKB7iK7iLNd4RH4Y=
+github.com/agnivade/levenshtein v1.2.1 h1:EHBY3UOn1gwdy/VbFwgo4cxecRznFk7fKWN1KOX7eoM=
+github.com/agnivade/levenshtein v1.2.1/go.mod h1:QVVI16kDrtSuwcpd0p1+xMC6Z/VfhtCyDIjcwga4/DU=
+github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
+github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
+github.com/alecthomas/kong v1.12.1 h1:iq6aMJDcFYP9uFrLdsiZQ2ZMmcshduyGv4Pek0MQPW0=
+github.com/alecthomas/kong v1.12.1/go.mod h1:p2vqieVMeTAnaC83txKtXe8FLke2X07aruPWXyMPQrU=
+github.com/alecthomas/repr v0.4.0 h1:GhI2A8MACjfegCPVq9f1FLvIBS+DrQ2KQBFZP1iFzXc=
+github.com/alecthomas/repr v0.4.0/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883 h1:bvNMNQO63//z+xNgfBlViaCIJKLlCJ6/fmUseuG0wVQ=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
+github.com/andybalholm/cascadia v1.3.3 h1:AG2YHrzJIm4BZ19iwJ/DAua6Btl3IwJX+VI4kktS1LM=
+github.com/andybalholm/cascadia v1.3.3/go.mod h1:xNd9bqTn98Ln4DwST8/nG+H0yuB8Hmgu1YHNnWw0GeA=
 github.com/apex/log v1.9.0 h1:FHtw/xuaM8AgmvDDTI9fiwoAL25Sq2cxojnZICUU8l0=
 github.com/apex/log v1.9.0/go.mod h1:m82fZlWIuiWzWP04XCTXmnX0xRkYYbCdYn8jbJeLBEA=
 github.com/apex/logs v1.0.0/go.mod h1:XzxuLZ5myVHDy9SAmYpamKKRNApGj54PfYLcFrXqDwo=
@@ -26,138 +27,131 @@ github.com/aphistic/golf v0.0.0-20180712155816-02c07f170c5a/go.mod h1:3NqKYiepwy
 github.com/aphistic/sweet v0.2.0/go.mod h1:fWDlIh/isSE9n6EPsRmC0det+whmX6dJid3stzu0Xys=
 github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0 h1:jfIu9sQUG6Ig+0+Ap1h4unLjW6YQJpKZVmUzxsD4E/Q=
 github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0/go.mod h1:t2tdKJDJF9BV14lnkjHmOQgcvEKgtqs5a1N3LNdJhGE=
+github.com/auth0/go-jwt-middleware/v2 v2.3.0 h1:4QREj6cS3d8dS05bEm443jhnqQF97FX9sMBeWqnNRzE=
+github.com/auth0/go-jwt-middleware/v2 v2.3.0/go.mod h1:dL4ObBs1/dj4/W4cYxd8rqAdDGXYyd5rqbpMIxcbVrU=
 github.com/aws/aws-sdk-go v1.20.6/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
 github.com/aybabtme/rgbterm v0.0.0-20170906152045-cc83f3b3ce59/go.mod h1:q/89r3U2H7sSsE2t6Kca0lfwTK8JdoNGS/yzM/4iH5I=
-github.com/bradleyjkemp/cupaloy/v2 v2.6.0/go.mod h1:bm7JXdkRd4BHJk9HpwqAI8BoAY1lps46Enkdqw6aRX0=
 github.com/buger/jsonparser v1.1.1 h1:2PnMjfWD7wBILjqQbt530v576A/cAbQvEW9gGIpYMUs=
 github.com/buger/jsonparser v1.1.1/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
-github.com/caarlos0/env v3.5.0+incompatible h1:Yy0UN8o9Wtr/jGHZDpCBLpNrzcFLLM2yixi/rBrKyJs=
-github.com/caarlos0/env v3.5.0+incompatible/go.mod h1:tdCsowwCzMLdkqRYDlHpZCp2UooDD3MspDBjZ2AD02Y=
-github.com/cespare/xxhash/v2 v2.1.2 h1:YRXhKfTDauu4ajMg1TPgFO5jnlC2HCbmLXMcTG5cbYE=
-github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
-github.com/cpuguy83/go-md2man/v2 v2.0.1/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
-github.com/cpuguy83/go-md2man/v2 v2.0.2 h1:p1EgwI/C7NhT0JmVkwCD2ZBK8j4aeHQX2pMHHBfMQ6w=
-github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/davecgh/go-spew v0.0.0-20161028175848-04cdfd42973b/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
+github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
+github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dgryski/trifles v0.0.0-20200323201526-dd97f9abfb48 h1:fRzb/w+pyskVMQ+UbP35JkH8yB7MYb4q/qhBarqZE6g=
-github.com/dgryski/trifles v0.0.0-20200323201526-dd97f9abfb48/go.mod h1:if7Fbed8SFyPtHLHbg49SI7NAdJiC5WIA09pe59rfAA=
-github.com/evanphx/json-patch/v5 v5.1.0 h1:B0aXl1o/1cP8NbviYiBMkcHBtUjIJ1/Ccg6b+SwCLQg=
+github.com/dgryski/trifles v0.0.0-20230903005119-f50d829f2e54 h1:SG7nF6SRlWhcT7cNTs5R6Hk4V2lcmLz2NsG2VnInyNo=
+github.com/dgryski/trifles v0.0.0-20230903005119-f50d829f2e54/go.mod h1:if7Fbed8SFyPtHLHbg49SI7NAdJiC5WIA09pe59rfAA=
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
-github.com/getsentry/sentry-go v0.14.0 h1:rlOBkuFZRKKdUnKO+0U3JclRDQKlRu5vVQtkWSQvC70=
-github.com/getsentry/sentry-go v0.14.0/go.mod h1:RZPJKSw+adu8PBNygiri/A98FqVr2HtRckJk9XVxJ9I=
-github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
-github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE=
-github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
-github.com/golang/mock v1.4.4 h1:l75CXGRSwbaYNpl/Z2X1XIIAMSCquvXgpVZDhwEIJsc=
-github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
+github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=
+github.com/go-sql-driver/mysql v1.9.3/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
+github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
+github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=
+github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
-github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWmnc=
-github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc=
-github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gorilla/websocket v1.5.1 h1:gmztn0JnHVt9JZquRuzLw3g4wouNVzKL15iLr/zn/QY=
+github.com/gorilla/websocket v1.5.1/go.mod h1:x3kM2JMyaluk02fnUJpQuwD2dCS5NDG2ZHL0uE0tcaY=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 h1:8Tjv8EJ+pM1xP8mK6egEbD1OgnVTyacbefKhmbLhIhU=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2/go.mod h1:pkJQ2tZHJ0aFOVEEot6oZmaVEZcRme73eIFmhiVuRWs=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
+github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
+github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/jensneuse/diffview v1.0.0 h1:4b6FQJ7y3295JUHU3tRko6euyEboL825ZsXeZZM47Z4=
+github.com/jensneuse/diffview v1.0.0/go.mod h1:i6IacuD8LnEaPuiyzMHA+Wfz5mAuycMOf3R/orUY9y4=
 github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
-github.com/jmoiron/sqlx v1.3.5 h1:vFFPA71p1o5gAeqtEAwLU4dnX2napprKtHr7PYIcN3g=
-github.com/jmoiron/sqlx v1.3.5/go.mod h1:nRVWtLre0KfCLJvgxzCsLVMogSvQ1zNJtpYr2Ccp0mQ=
+github.com/jmoiron/sqlx v1.4.0 h1:1PLqN7S1UYp5t4SrVVnt4nUVNemrDAtxlulVe+Qgm3o=
+github.com/jmoiron/sqlx v1.4.0/go.mod h1:ZrZ7UsYB/weZdl2Bxg6jCRO9c3YHl8r3ahlKmRT4JLY=
 github.com/jpillora/backoff v0.0.0-20180909062703-3050d21c67d7/go.mod h1:2iMrUgbbvHEiQClaW2NsSzMyGHqN+rDFqY705q49KG0=
-github.com/kevinmbeaulieu/eq-go v1.0.0/go.mod h1:G3S8ajA56gKBZm4UB9AOyoOS37JO3roToPzKNM8dtdM=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
-github.com/lib/pq v1.10.6 h1:jbk+ZieJ0D7EVGJYpL9QTz7/YW6UHbmdnZWYyK5cdBs=
-github.com/lib/pq v1.10.6/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/logrusorgru/aurora/v3 v3.0.0/go.mod h1:vsR12bk5grlLvLXAYrBsb5Oc/N+LxAlxggSjiwMnCUc=
-github.com/matryer/moq v0.2.3/go.mod h1:9RtPYjTnH1bSBIkpvtHkFN7nbWAnO7oRpdJkEIn6UtE=
-github.com/matryer/moq v0.2.7/go.mod h1:kITsx543GOENm48TUAQyJ9+SAvFSr7iGQXPoth/VUBk=
+github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
+github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ=
 github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
-github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
-github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-isatty v0.0.5/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
-github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-sqlite3 v1.14.6 h1:dNPt6NO46WmLVt2DLNpwczCmdV5boIZ6g/tlDrlRUbg=
-github.com/mattn/go-sqlite3 v1.14.6/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU=
+github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/mfridman/interpolate v0.0.2 h1:pnuTK7MQIxxFz1Gr+rjSIx9u7qVjf5VOoM/u6BbAxPY=
+github.com/mfridman/interpolate v0.0.2/go.mod h1:p+7uk6oE07mpE/Ik1b8EckO0O4ZXiGAfshKBWLUM9Xg=
 github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
-github.com/mitchellh/mapstructure v1.2.3/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/mitchellh/mapstructure v1.3.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
-github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
+github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
+github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/gomega v1.5.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
-github.com/pingcap/errors v0.11.4 h1:lFuQV/oaUMGcD2tqt+01ROSmJs75VG1ToEOkZIZ4nE4=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pmezard/go-difflib v0.0.0-20151028094244-d8ed2627bdf0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/qri-io/jsonpointer v0.1.1 h1:prVZBZLL6TW5vsSB9fFHFAMBLI4b0ri5vribQlTJiBA=
-github.com/qri-io/jsonpointer v0.1.1/go.mod h1:DnJPaYgiKu56EuDp8TU5wFLdZIcAnb/uH9v37ZaMV64=
-github.com/qri-io/jsonschema v0.2.1 h1:NNFoKms+kut6ABPf6xiKNM5214jzxAhDBrPHCJ97Wg0=
-github.com/qri-io/jsonschema v0.2.1/go.mod h1:g7DPkiOsK1xv6T/Ao5scXRkd+yTFygcANPBaaqW+VrI=
-github.com/rabbitmq/amqp091-go v1.3.4 h1:tXuIslN1nhDqs2t6Jrz3BAoqvt4qIZzxvdbdcxWtHYU=
-github.com/rabbitmq/amqp091-go v1.3.4/go.mod h1:ogQDLSOACsLPsIq0NpbtiifNZi2YOz0VTJ0kHRghqbM=
+github.com/pressly/goose/v3 v3.25.0 h1:6WeYhMWGRCzpyd89SpODFnCBCKz41KrVbRT58nVjGng=
+github.com/pressly/goose/v3 v3.25.0/go.mod h1:4hC1KrritdCxtuFsqgs1R4AU5bWtTAf+cnWvfhf2DNY=
+github.com/rabbitmq/amqp091-go v1.10.0 h1:STpn5XsHlHGcecLmMFCtg7mqq0RnD+zFr4uzukfVhBw=
+github.com/rabbitmq/amqp091-go v1.10.0/go.mod h1:Hy4jKW5kQART1u+JkDTF9YYOQUHXqMuhrgxOEeS7G4o=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rogpeppe/fastuuid v1.1.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
-github.com/rs/cors v1.8.2 h1:KCooALfAYGs415Cwu5ABvv9n9509fSiG5SQJn/AQo4U=
-github.com/rs/cors v1.8.2/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
-github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/rs/cors v1.11.1 h1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=
+github.com/rs/cors v1.11.1/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/sanity-io/litter v1.5.5 h1:iE+sBxPBzoK6uaEP5Lt3fHNgpKcHXc/A2HGETy0uJQo=
-github.com/sanity-io/litter v1.5.5/go.mod h1:9gzJgR2i4ZpjZHsKvUXIRQVk7P+yM3e+jAF7bU2UI5U=
-github.com/sebdah/goldie/v2 v2.5.3 h1:9ES/mNN+HNUbNWpVAlrzuZ7jE+Nrczbj8uFRjM7624Y=
+github.com/sanity-io/litter v1.5.8 h1:uM/2lKrWdGbRXDrIq08Lh9XtVYoeGtcQxk9rtQ7+rYg=
+github.com/sanity-io/litter v1.5.8/go.mod h1:9gzJgR2i4ZpjZHsKvUXIRQVk7P+yM3e+jAF7bU2UI5U=
+github.com/sebdah/goldie/v2 v2.7.1 h1:PkBHymaYdtvEkZV7TmyqKxdmn5/Vcj+8TpATWZjnG5E=
+github.com/sebdah/goldie/v2 v2.7.1/go.mod h1:oZ9fp0+se1eapSRjfYbsV/0Hqhbuu3bJVvKI/NNtssI=
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
-github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0=
-github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
-github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
+github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
+github.com/sergi/go-diff v1.3.1/go.mod h1:aMJSSKb2lpPvRNec0+w3fl7LP9IOFzdc9Pa4NFbPK1I=
+github.com/sethvargo/go-retry v0.3.0 h1:EEt31A35QhrcRZtrYFDTBg91cqZVnFL2navjDrah2SE=
+github.com/sethvargo/go-retry v0.3.0/go.mod h1:mNX17F0C/HguQMyMyJxcnU471gOZGxCLyYaFyAZraas=
 github.com/smartystreets/assertions v1.0.0/go.mod h1:kHHU4qYBaI3q23Pp3VPrmWhuIUrLW/7eUrw0BU5VaoM=
 github.com/smartystreets/go-aws-auth v0.0.0-20180515143844-0c1422d1fdb9/go.mod h1:SnhjPscd9TpLiy1LpzGSKh3bXCfxxXuqd9xmQJy3slM=
 github.com/smartystreets/gunit v1.0.0/go.mod h1:qwPWnhz6pn0NnRBP++URONOVyNkPyr4SauJk4cUOwJs=
-github.com/sparetimecoders/goamqp v0.1.1 h1:+TSwlrrnfJIyM+MKpnzk+4mnIvt6M8gdEFNRN4Q0wQA=
-github.com/sparetimecoders/goamqp v0.1.1/go.mod h1:JIydmIgCqETEHIiGYmN03gNSs2bghWBHEqnR/Lfmzb0=
+github.com/sosodev/duration v1.3.1 h1:qtHBDMQ6lvMQsL15g4aopM4HEfOaYuhWBw3NPTtlqq4=
+github.com/sosodev/duration v1.3.1/go.mod h1:RQIBBX0+fMLc/D9+Jb/fwvVmo0eZvDDEERAikUR6SDg=
+github.com/sparetimecoders/goamqp v0.3.3 h1:z/nfTPmrjeU/rIVuNOgsVLCimp3WFoNFvS3ZzXRJ6HE=
+github.com/sparetimecoders/goamqp v0.3.3/go.mod h1:W9NRCpWLE+Vruv2dcRSbszNil2O826d2Nv6kAkETW5o=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/testify v0.0.0-20161117074351-18a02ba4a312/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
-github.com/stretchr/testify v1.7.3/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
-github.com/tidwall/gjson v1.14.3 h1:9jvXn7olKEHU1S9vwoMGliaT8jq1vJ7IH/n9zD9Dnlw=
-github.com/tidwall/gjson v1.14.3/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/gjson v1.17.0 h1:/Jocvlh98kcTfpN2+JzGQWQcqrPQwDrVEMApx/M5ZwM=
+github.com/tidwall/gjson v1.17.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
 github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
 github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
 github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
@@ -172,105 +166,114 @@ github.com/tj/go-buffer v1.1.0/go.mod h1:iyiJpfFcR2B9sXu7KvjbT9fpM4mOelRSDTbntVj
 github.com/tj/go-elastic v0.0.0-20171221160941-36157cbbebc2/go.mod h1:WjeM0Oo1eNAjXGDx2yma7uG2XoyRZTq1uv3M/o7imD0=
 github.com/tj/go-kinesis v0.0.0-20171128231115-08b17f58cb1b/go.mod h1:/yhzCV0xPfx6jb1bBgRFjl5lytqVqZXEaeqWP8lTEao=
 github.com/tj/go-spin v1.1.0/go.mod h1:Mg1mzmePZm4dva8Qz60H2lHwmJ2loum4VIrLgVnKwh4=
-github.com/urfave/cli/v2 v2.3.0/go.mod h1:LJmUH05zAU44vOAcrfzZQKsZbVcdbOG8rtL3/XcUArI=
-github.com/urfave/cli/v2 v2.8.1 h1:CGuYNZF9IKZY/rfBe3lJpccSoIY1ytfvmgQT90cNOl4=
-github.com/urfave/cli/v2 v2.8.1/go.mod h1:Z41J9TPoffeoqP0Iza0YbAhGvymRdZAd2uPmZ5JxRdY=
-github.com/vektah/gqlparser/v2 v2.4.0/go.mod h1:flJWIR04IMQPGz+BXLrORkrARBxv/rtyIAFvd/MceW0=
-github.com/vektah/gqlparser/v2 v2.4.5/go.mod h1:flJWIR04IMQPGz+BXLrORkrARBxv/rtyIAFvd/MceW0=
-github.com/vektah/gqlparser/v2 v2.5.1 h1:ZGu+bquAY23jsxDRcYpWjttRZrUz07LbiY77gUOHcr4=
-github.com/vektah/gqlparser/v2 v2.5.1/go.mod h1:mPgqFBu/woKTVYWyNk8cO3kh4S/f4aRFZrvOnp3hmCs=
-github.com/wundergraph/graphql-go-tools v1.57.2-0.20221005155749-a4fdba38990b h1:ACY3sLD/diOLMB6uvtpZPB0EWtrlH498mT0N7T1bnm4=
-github.com/wundergraph/graphql-go-tools v1.57.2-0.20221005155749-a4fdba38990b/go.mod h1:gacwbFD8atVwDwzY5btN0/1QXvTprQ/gbT+XlZaQg4c=
-github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 h1:bAn7/zixMGCfxrRTfdpNzjtPYqr8smhKouy9mxVdGPU=
-github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673/go.mod h1:N3UwUGtsrSj3ccvlPHLoLsHnpR27oXr4ZE984MbSER8=
-github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
-github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-gitlab.com/unboundsoftware/eventsourced/amqp v1.5.0 h1:YJu6oD8vzxuSZZqPv2N3UyQzvWDWW0h/XTHiy0aiWSo=
-gitlab.com/unboundsoftware/eventsourced/amqp v1.5.0/go.mod h1:dDShzDLym/gM7Mad26Y0K2TTLUy97hO46XC69Zi91qQ=
-gitlab.com/unboundsoftware/eventsourced/eventsourced v1.9.0/go.mod h1:nm3W8Gr8shALbgBepOocFRqDenG/oZFBON8WLIlOvck=
-gitlab.com/unboundsoftware/eventsourced/eventsourced v1.9.2/go.mod h1:i1Woh2JHIgAK27nFxS7q6/fAceSqX4VR7PYTizY5EMI=
-gitlab.com/unboundsoftware/eventsourced/eventsourced v1.9.3 h1:Khls+eq34tovtDBnSPHpC4tKswUlNDCYHH9Vl5A+hTo=
-gitlab.com/unboundsoftware/eventsourced/eventsourced v1.9.3/go.mod h1:c4rRdyIFW2s49hnLv5c5HsfL3I144mLnvvIOb0JZdpk=
-gitlab.com/unboundsoftware/eventsourced/pg v1.9.0 h1:Hr8kgACHTFICDMV71waf/+CZVKkKJWzXqPGbomMUs70=
-gitlab.com/unboundsoftware/eventsourced/pg v1.9.0/go.mod h1:tfwAGkvmnCpJCAIr94hljJzZXm+W1aHAXjuYJXbXYiI=
+github.com/urfave/cli/v2 v2.27.7 h1:bH59vdhbjLv3LAvIu6gd0usJHgoTTPhCFib8qqOwXYU=
+github.com/urfave/cli/v2 v2.27.7/go.mod h1:CyNAG/xg+iAOg0N4MPGZqVmv2rCoP267496AOXUZjA4=
+github.com/vektah/gqlparser/v2 v2.5.30 h1:EqLwGAFLIzt1wpx1IPpY67DwUujF1OfzgEyDsLrN6kE=
+github.com/vektah/gqlparser/v2 v2.5.30/go.mod h1:D1/VCZtV3LPnQrcPBeR/q5jkSQIPti0uYCP/RI0gIeo=
+github.com/wundergraph/astjson v0.0.0-20250106123708-be463c97e083 h1:8/D7f8gKxTBjW+SZK4mhxTTBVpxcqeBgWF1Rfmltbfk=
+github.com/wundergraph/astjson v0.0.0-20250106123708-be463c97e083/go.mod h1:eOTL6acwctsN4F3b7YE+eE2t8zcJ/doLm9sZzsxxxrE=
+github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.225 h1:D7VbIl1P6/6Zj86HNiO7UmH05DDFnFLVA/ig31+Uy5c=
+github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.225/go.mod h1:g1IFIylu5Fd9pKjzq0mDvpaKhEB/vkwLAIbGdX2djXU=
+github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 h1:gEOO8jv9F4OT7lGCjxCBTO/36wtF6j2nSip77qHd4x4=
+github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1/go.mod h1:Ohn+xnUBiLI6FVj/9LpzZWtj1/D6lUovWYBkxHVV3aM=
+gitlab.com/unboundsoftware/eventsourced/amqp v1.8.1 h1:MGHH2Uxp68J9i4V3/3vApB6gjBUjn6RjiPHhbc8Wsno=
+gitlab.com/unboundsoftware/eventsourced/amqp v1.8.1/go.mod h1:clGBkdpFWb5/27aLOhJ6+DB15enJf+T4J5lR6X0lqAs=
+gitlab.com/unboundsoftware/eventsourced/eventsourced v1.19.2 h1:8sCnThNHEPB3BQomcJ7u6fmc2t043fAZSMmVPDDbQOs=
+gitlab.com/unboundsoftware/eventsourced/eventsourced v1.19.2/go.mod h1:KeLn3U67hxbdFLfeXd0c0LI/r1C5rijbWrfNdARWe98=
+gitlab.com/unboundsoftware/eventsourced/pg v1.17.0 h1:pUJzMpNPX0GVsffRZXlpKR1d7Ws96KTxJwbLFPpASSc=
+gitlab.com/unboundsoftware/eventsourced/pg v1.17.0/go.mod h1:WgPrZhyCbsZ3TG2tPUbh2MUjOEaANJjsWi/0hlIwRVU=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/contrib/bridges/otelslog v0.13.0 h1:bwnLpizECbPr1RrQ27waeY2SPIPeccCx/xLuoYADZ9s=
+go.opentelemetry.io/contrib/bridges/otelslog v0.13.0/go.mod h1:3nWlOiiqA9UtUnrcNk82mYasNxD8ehOspL0gOfEo6Y4=
+go.opentelemetry.io/otel v1.38.0 h1:RkfdswUDRimDg0m2Az18RKOsnI8UDzppJAtj01/Ymk8=
+go.opentelemetry.io/otel v1.38.0/go.mod h1:zcmtmQ1+YmQM9wrNsTGV/q/uyusom3P8RxwExxkZhjM=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.38.0 h1:Oe2z/BCg5q7k4iXC3cqJxKYg0ieRiOqF0cecFYdPTwk=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.38.0/go.mod h1:ZQM5lAJpOsKnYagGg/zV2krVqTtaVdYdDkhMoX6Oalg=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 h1:GqRJVj7UmLjCVyVJ3ZFLdPRmhDUp2zFmQe3RHIOsw24=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0/go.mod h1:ri3aaHSmCTVYu2AWv44YMauwAQc0aqI9gHKIcSbI1pU=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.38.0 h1:aTL7F04bJHUlztTsNGJ2l+6he8c+y/b//eR0jjjemT4=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.38.0/go.mod h1:kldtb7jDTeol0l3ewcmd8SDvx3EmIE7lyvqbasU3QC4=
+go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.14.0 h1:B/g+qde6Mkzxbry5ZZag0l7QrQBCtVm7lVjaLgmpje8=
+go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.14.0/go.mod h1:mOJK8eMmgW6ocDJn6Bn11CcZ05gi3P8GylBXEkZtbgA=
+go.opentelemetry.io/otel/log v0.14.0 h1:2rzJ+pOAZ8qmZ3DDHg73NEKzSZkhkGIua9gXtxNGgrM=
+go.opentelemetry.io/otel/log v0.14.0/go.mod h1:5jRG92fEAgx0SU/vFPxmJvhIuDU9E1SUnEQrMlJpOno=
+go.opentelemetry.io/otel/metric v1.38.0 h1:Kl6lzIYGAh5M159u9NgiRkmoMKjvbsKtYRwgfrA6WpA=
+go.opentelemetry.io/otel/metric v1.38.0/go.mod h1:kB5n/QoRM8YwmUahxvI3bO34eVtQf2i4utNVLr9gEmI=
+go.opentelemetry.io/otel/sdk v1.38.0 h1:l48sr5YbNf2hpCUj/FoGhW9yDkl+Ma+LrVl8qaM5b+E=
+go.opentelemetry.io/otel/sdk v1.38.0/go.mod h1:ghmNdGlVemJI3+ZB5iDEuk4bWA3GkTpW+DOoZMYBVVg=
+go.opentelemetry.io/otel/sdk/log v0.14.0 h1:JU/U3O7N6fsAXj0+CXz21Czg532dW2V4gG1HE/e8Zrg=
+go.opentelemetry.io/otel/sdk/log v0.14.0/go.mod h1:imQvII+0ZylXfKU7/wtOND8Hn4OpT3YUoIgqJVksUkM=
+go.opentelemetry.io/otel/sdk/log/logtest v0.14.0 h1:Ijbtz+JKXl8T2MngiwqBlPaHqc4YCaP/i13Qrow6gAM=
+go.opentelemetry.io/otel/sdk/log/logtest v0.14.0/go.mod h1:dCU8aEL6q+L9cYTqcVOk8rM9Tp8WdnHOPLiBgp0SGOA=
+go.opentelemetry.io/otel/sdk/metric v1.38.0 h1:aSH66iL0aZqo//xXzQLYozmWrXxyFkBJ6qT5wthqPoM=
+go.opentelemetry.io/otel/sdk/metric v1.38.0/go.mod h1:dg9PBnW9XdQ1Hd6ZnRz689CbtrUp0wMMs9iPcgT9EZA=
+go.opentelemetry.io/otel/trace v1.38.0 h1:Fxk5bKrDZJUH+AMyyIXGcFAPah0oRcT+LuNtJrmcNLE=
+go.opentelemetry.io/otel/trace v1.38.0/go.mod h1:j1P9ivuFsTceSWe1oY+EeW3sc+Pp42sO++GHkg4wwhs=
+go.opentelemetry.io/proto/otlp v1.7.1 h1:gTOMpGDb0WTBOP8JaO72iL3auEZhVmAQg4ipjOVAtj4=
+go.opentelemetry.io/proto/otlp v1.7.1/go.mod h1:b2rVh6rfI/s2pHWNlB7ILJcRALpcNDzKhACevjI+ZnE=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
+go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190426145343-a29dc8fdc734/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
-golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4 h1:6zppjxzCulZykYSLyVDYbneBfbaBIQPYMevg0bEwv2s=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
+golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
+golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b h1:M2rDM6z3Fhozi9O7NWsxAkg/yqS/lQJ6PmkyIV3YP+o=
+golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8=
+golang.org/x/mod v0.26.0 h1:EGMPT//Ezu+ylkCijjPc+f4Aih7sZvaAr+O3EHBxvZg=
+golang.org/x/mod v0.26.0/go.mod h1:/j6NAhSk8iQ723BGAUyoAcn7SlD7s15Dp9Nd/SfeaFQ=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
+golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
+golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220319134239-a9b59b0215f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20221006211917-84dc82d7e875 h1:AzgQNqF+FKwyQ5LbVrVqOcuuFB67N47F9+htZYH0wFM=
-golang.org/x/sys v0.0.0-20221006211917-84dc82d7e875/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
+golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7 h1:olpwvP2KacW1ZWvsR7uQhoyTYvKAupfQrRGBFM352Gk=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
+golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20200815165600-90abf76919f3/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.1.9/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU=
-golang.org/x/tools v0.1.10/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E=
-golang.org/x/tools v0.1.12 h1:VveCTK38A2rkS8ZqFY25HIDFscX5X9OoEhJd3quQmXU=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20220517211312-f3a8303e98df h1:5Pf6pFKu98ODmgnpvkJ3kFUOQGGLIzLIkbzUHp47618=
-golang.org/x/xerrors v0.0.0-20220517211312-f3a8303e98df/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+golang.org/x/tools v0.35.0 h1:mBffYraMEf7aa0sB+NuKnuCy8qI/9Bughn8dC2Gu5r0=
+golang.org/x/tools v0.35.0/go.mod h1:NKdj5HkL/73byiZSJjqJgKn3ep7KjFkBOkR/Hps3VPw=
+gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
+gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
+google.golang.org/genproto/googleapis/api v0.0.0-20250825161204-c5933d9347a5 h1:BIRfGDEjiHRrk0QKZe3Xv2ieMhtgRGeLcZQ0mIVn4EY=
+google.golang.org/genproto/googleapis/api v0.0.0-20250825161204-c5933d9347a5/go.mod h1:j3QtIyytwqGr1JUDtYXwtMXWPKsEa5LtzIFN1Wn5WvE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250825161204-c5933d9347a5 h1:eaY8u2EuxbRv7c3NiGK0/NedzVsCcV6hDuU5qPX5EGE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250825161204-c5933d9347a5/go.mod h1:M4/wBTSeyLxupu3W3tJtOgB14jILAS/XWPSSa3TAlJc=
+google.golang.org/grpc v1.75.0 h1:+TW+dqTd2Biwe6KKfhE5JpiYIBWq865PhKGSXiivqt4=
+google.golang.org/grpc v1.75.0/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
+google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
+google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU=
-gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
+gopkg.in/go-jose/go-jose.v2 v2.6.3 h1:nt80fvSDlhKWQgSWyHyy5CfmlQr+asih51R8PTWNKKs=
+gopkg.in/go-jose/go-jose.v2 v2.6.3/go.mod h1:zzZDPkNNw/c9IE7Z9jr11mBZQhKQTMzoEEIoEdZlFBI=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0-20200605160147-a5ece683394c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+modernc.org/libc v1.66.3 h1:cfCbjTUcdsKyyZZfEUKfoHcP3S0Wkvz3jgSzByEWVCQ=
+modernc.org/libc v1.66.3/go.mod h1:XD9zO8kt59cANKvHPXpx7yS2ELPheAey0vjIuZOhOU8=
+modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
+modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
+modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
+modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/sqlite v1.38.2 h1:Aclu7+tgjgcQVShZqim41Bbw9Cho0y/7WzYptXqkEek=
+modernc.org/sqlite v1.38.2/go.mod h1:cPTJYSlgg3Sfg046yBShXENNtPrWrDX8bsbAQBzgQ5E=

gqlgen.yml

@@ -39,6 +39,8 @@ resolver:
 # Optional: set to speed up generation time by not performing a final validation pass.
 # skip_validation: true
 
+omit_gqlgen_version_in_file_notice: true
+
 # gqlgen will search for any type names in the schema in these go packages
 # if they match it will use them, otherwise it will generate them.
 autobind:

graph/converter.go

@@ -0,0 +1,49 @@
+package graph
+
+import (
+	"gitlab.com/unboundsoftware/schemas/domain"
+	"gitlab.com/unboundsoftware/schemas/graph/model"
+)
+
+func ToGqlOrganizations(orgs []domain.Organization) []*model.Organization {
+	result := make([]*model.Organization, len(orgs))
+	for i, o := range orgs {
+		result[i] = ToGqlOrganization(o)
+	}
+	return result
+}
+
+func ToGqlOrganization(o domain.Organization) *model.Organization {
+	users := ToGqlUsers(o.Users)
+	apiKeys := ToGqlAPIKeys(o.APIKeys)
+	return &model.Organization{
+		ID:      o.ID.String(),
+		Name:    o.Name,
+		Users:   users,
+		APIKeys: apiKeys,
+	}
+}
+
+func ToGqlUsers(users []string) []*model.User {
+	result := make([]*model.User, len(users))
+	for i, u := range users {
+		result[i] = &model.User{ID: u}
+	}
+	return result
+}
+
+func ToGqlAPIKeys(keys []domain.APIKey) []*model.APIKey {
+	result := make([]*model.APIKey, len(keys))
+	for i, k := range keys {
+		result[i] = &model.APIKey{
+			ID:           apiKeyId(k.OrganizationId, k.Name),
+			Name:         k.Name,
+			Key:          &k.Key,
+			Organization: nil,
+			Refs:         k.Refs,
+			Read:         k.Read,
+			Publish:      k.Publish,
+		}
+	}
+	return result
+}

graph/model/models_gen.go

@@ -10,19 +10,50 @@ type Supergraph interface {
 	IsSupergraph()
 }
 
+type APIKey struct {
+	ID           string        `json:"id"`
+	Name         string        `json:"name"`
+	Key          *string       `json:"key,omitempty"`
+	Organization *Organization `json:"organization"`
+	Refs         []string      `json:"refs"`
+	Read         bool          `json:"read"`
+	Publish      bool          `json:"publish"`
+}
+
+type InputAPIKey struct {
+	Name           string   `json:"name"`
+	OrganizationID string   `json:"organizationId"`
+	Refs           []string `json:"refs"`
+	Read           bool     `json:"read"`
+	Publish        bool     `json:"publish"`
+}
+
 type InputSubGraph struct {
 	Ref     string  `json:"ref"`
 	Service string  `json:"service"`
-	URL     *string `json:"url"`
-	WsURL   *string `json:"wsUrl"`
+	URL     *string `json:"url,omitempty"`
+	WsURL   *string `json:"wsUrl,omitempty"`
 	Sdl     string  `json:"sdl"`
 }
 
+type Mutation struct {
+}
+
+type Organization struct {
+	ID      string    `json:"id"`
+	Name    string    `json:"name"`
+	Users   []*User   `json:"users"`
+	APIKeys []*APIKey `json:"apiKeys"`
+}
+
+type Query struct {
+}
+
 type SubGraph struct {
 	ID        string    `json:"id"`
 	Service   string    `json:"service"`
-	URL       *string   `json:"url"`
-	WsURL     *string   `json:"wsUrl"`
+	URL       *string   `json:"url,omitempty"`
+	WsURL     *string   `json:"wsUrl,omitempty"`
 	Sdl       string    `json:"sdl"`
 	ChangedBy string    `json:"changedBy"`
 	ChangedAt time.Time `json:"changedAt"`
@@ -31,6 +62,7 @@ type SubGraph struct {
 type SubGraphs struct {
 	ID              string      `json:"id"`
 	MinDelaySeconds int         `json:"minDelaySeconds"`
+	Sdl             string      `json:"sdl"`
 	SubGraphs       []*SubGraph `json:"subGraphs"`
 }
 
@@ -42,3 +74,7 @@ type Unchanged struct {
 }
 
 func (Unchanged) IsSupergraph() {}
+
+type User struct {
+	ID string `json:"id"`
+}

graph/resolver.go

@@ -1,30 +1,59 @@
 package graph
 
 import (
-	"github.com/apex/log"
+	"context"
+	"fmt"
+	"log/slog"
+
 	"gitlab.com/unboundsoftware/eventsourced/eventsourced"
 
 	"gitlab.com/unboundsoftware/schemas/cache"
+	"gitlab.com/unboundsoftware/schemas/middleware"
 )
 
 //go:generate go run github.com/99designs/gqlgen
+//go:generate gofumpt -w .
+//go:generate goimports -w -local gitlab.com/unboundsoftware/schemas .
 
 // This file will not be regenerated automatically.
 //
 // It serves as dependency injection for your app, add any dependencies you require here.
 
 type Publisher interface {
-	Publish(event eventsourced.Event) error
-	Stop() error
+	Publish(ctx context.Context, event eventsourced.Event) error
 }
 
 type Resolver struct {
 	EventStore eventsourced.EventStore
 	Publisher  Publisher
-	Logger     log.Interface
+	Logger     *slog.Logger
 	Cache      *cache.Cache
 }
 
-func (r *Resolver) handler(aggregate eventsourced.Aggregate) (eventsourced.CommandHandler, error) {
-	return eventsourced.NewHandler(aggregate, r.EventStore, eventsourced.WithEventPublisher(r.Publisher))
+func (r *Resolver) apiKeyCanAccessRef(ctx context.Context, ref string, publish bool) (string, error) {
+	key, err := middleware.ApiKeyFromContext(ctx)
+	if err != nil {
+		return "", err
+	}
+	apiKey := r.Cache.ApiKeyByKey(key)
+	if publish && !apiKey.Publish {
+		return "", fmt.Errorf("provided API-key doesn't have publish privilege")
+	}
+	if !publish && !apiKey.Read {
+		return "", fmt.Errorf("provided API-key doesn't have read privilege")
+	}
+	for _, rr := range apiKey.Refs {
+		if rr == ref {
+			return apiKey.Name, nil
+		}
+	}
+	return "", fmt.Errorf("provided API-key doesn't have the required privilege on the requested Schema Ref")
+}
+
+func (r *Resolver) handler(ctx context.Context, aggregate eventsourced.Aggregate) (eventsourced.CommandHandler, error) {
+	return eventsourced.NewHandler(ctx, aggregate, r.EventStore, eventsourced.WithEventPublisher(r.Publisher))
+}
+
+func apiKeyId(orgId, name string) string {
+	return fmt.Sprintf("%s-%s", orgId, name)
 }

graph/schema.graphqls

@@ -1,10 +1,33 @@
 type Query {
-  subGraphs(ref: String!): [SubGraph!]! @hasApiKey @deprecated(reason: "Use supergraph instead")
-  supergraph(ref: String!, isAfter: String): Supergraph! @hasApiKey
+  organizations: [Organization!]! @auth(user: true)
+  supergraph(ref: String!, isAfter: String): Supergraph! @auth(organization: true)
 }
 
 type Mutation {
-  updateSubGraph(input: InputSubGraph!): SubGraph! @hasApiKey
+  addOrganization(name: String!): Organization! @auth(user: true)
+  addAPIKey(input: InputAPIKey): APIKey! @auth(user: true)
+  updateSubGraph(input: InputSubGraph!): SubGraph! @auth(organization: true)
+}
+
+type Organization {
+  id: ID!
+  name: String!
+  users: [User!]!
+  apiKeys: [APIKey!]!
+}
+
+type User {
+  id: String!
+}
+
+type APIKey {
+  id: ID!
+  name: String!
+  key: String
+  organization: Organization!
+  refs: [String!]!
+  read: Boolean!
+  publish: Boolean!
 }
 
 union Supergraph = Unchanged | SubGraphs
@@ -17,6 +40,7 @@ type Unchanged {
 type SubGraphs {
   id: ID!
   minDelaySeconds: Int!
+  sdl: String!
   subGraphs: [SubGraph!]!
 }
 
@@ -30,6 +54,14 @@ type SubGraph {
   changedAt: Time!
 }
 
+input InputAPIKey {
+  name: String!
+  organizationId: ID!
+  refs: [String!]!
+  read: Boolean!
+  publish: Boolean!
+}
+
 input InputSubGraph {
   ref: String!
   service: String!
@@ -40,4 +72,4 @@ input InputSubGraph {
 
 scalar Time
 
-directive @hasApiKey on FIELD_DEFINITION
+directive @auth(user: Boolean, organization: Boolean) on FIELD_DEFINITION

graph/schema.helpers.go

@@ -1,15 +1,17 @@
 package graph
 
 import (
+	"context"
+
 	"gitlab.com/unboundsoftware/eventsourced/eventsourced"
 
 	"gitlab.com/unboundsoftware/schemas/domain"
 	"gitlab.com/unboundsoftware/schemas/graph/model"
 )
 
-func (r *Resolver) fetchSubGraph(subGraphId string) (*domain.SubGraph, error) {
+func (r *Resolver) fetchSubGraph(ctx context.Context, subGraphId string) (*domain.SubGraph, error) {
 	subGraph := &domain.SubGraph{BaseAggregate: eventsourced.BaseAggregateFromString(subGraphId)}
-	_, err := r.handler(subGraph)
+	_, err := r.handler(ctx, subGraph)
 	if err != nil {
 		return nil, err
 	}
@@ -27,3 +29,13 @@ func (r *Resolver) toGqlSubGraph(subGraph *domain.SubGraph) *model.SubGraph {
 		ChangedAt: subGraph.ChangedAt,
 	}
 }
+
+func (r *Resolver) stringEqual(s1, s2 *string) bool {
+	if s1 == nil && s2 == nil {
+		return true
+	}
+	if s1 != nil && s2 != nil && *s1 == *s2 {
+		return true
+	}
+	return false
+}

graph/schema.resolvers.go

@@ -2,38 +2,100 @@ package graph
 
 // This file will be automatically regenerated based on the schema, any resolver implementations
 // will be copied through when generating and any unknown code will be moved to the end.
+// Code generated by github.com/99designs/gqlgen
 
 import (
 	"context"
 	"fmt"
 	"strings"
 
-	"github.com/wundergraph/graphql-go-tools/pkg/federation/sdlmerge"
 	"gitlab.com/unboundsoftware/eventsourced/eventsourced"
 
 	"gitlab.com/unboundsoftware/schemas/domain"
 	"gitlab.com/unboundsoftware/schemas/graph/generated"
 	"gitlab.com/unboundsoftware/schemas/graph/model"
+	"gitlab.com/unboundsoftware/schemas/middleware"
+	"gitlab.com/unboundsoftware/schemas/rand"
+	"gitlab.com/unboundsoftware/schemas/sdlmerge"
 )
 
+// AddOrganization is the resolver for the addOrganization field.
+func (r *mutationResolver) AddOrganization(ctx context.Context, name string) (*model.Organization, error) {
+	sub := middleware.UserFromContext(ctx)
+	org := &domain.Organization{}
+	h, err := r.handler(ctx, org)
+	if err != nil {
+		return nil, err
+	}
+	_, err = h.Handle(ctx, &domain.AddOrganization{
+		Name:      name,
+		Initiator: sub,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return ToGqlOrganization(*org), nil
+}
+
+// AddAPIKey is the resolver for the addAPIKey field.
+func (r *mutationResolver) AddAPIKey(ctx context.Context, input *model.InputAPIKey) (*model.APIKey, error) {
+	sub := middleware.UserFromContext(ctx)
+	org := &domain.Organization{BaseAggregate: eventsourced.BaseAggregateFromString(input.OrganizationID)}
+	h, err := r.handler(ctx, org)
+	if err != nil {
+		return nil, err
+	}
+	key := fmt.Sprintf("us_ak_%s", rand.String(16))
+	_, err = h.Handle(ctx, &domain.AddAPIKey{
+		Name:      input.Name,
+		Key:       key,
+		Refs:      input.Refs,
+		Read:      input.Read,
+		Publish:   input.Publish,
+		Initiator: sub,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return &model.APIKey{
+		ID:   apiKeyId(input.OrganizationID, input.Name),
+		Name: input.Name,
+		Key:  &key,
+		Organization: &model.Organization{
+			ID:   input.OrganizationID,
+			Name: org.Name,
+		},
+		Refs:    input.Refs,
+		Read:    input.Read,
+		Publish: input.Publish,
+	}, nil
+}
+
 // UpdateSubGraph is the resolver for the updateSubGraph field.
 func (r *mutationResolver) UpdateSubGraph(ctx context.Context, input model.InputSubGraph) (*model.SubGraph, error) {
-	subGraphId := r.Cache.SubGraphId(input.Ref, input.Service)
+	orgId := middleware.OrganizationFromContext(ctx)
+	name, err := r.apiKeyCanAccessRef(ctx, input.Ref, true)
+	if err != nil {
+		return nil, err
+	}
+	subGraphId := r.Cache.SubGraphId(orgId, input.Ref, input.Service)
 	subGraph := &domain.SubGraph{}
 	if subGraphId != "" {
 		subGraph.BaseAggregate = eventsourced.BaseAggregateFromString(subGraphId)
 	}
-	handler, err := r.handler(subGraph)
+	handler, err := r.handler(ctx, subGraph)
 	if err != nil {
 		return nil, err
 	}
-	if strings.TrimSpace(input.Sdl) == strings.TrimSpace(subGraph.Sdl) {
+	if strings.TrimSpace(input.Sdl) == strings.TrimSpace(subGraph.Sdl) &&
+		r.stringEqual(input.URL, subGraph.Url) &&
+		r.stringEqual(input.WsURL, subGraph.WSUrl) {
 		return r.toGqlSubGraph(subGraph), nil
 	}
 	serviceSDLs := []string{input.Sdl}
-	services, _ := r.Cache.Services(input.Ref, "")
+	services, _ := r.Cache.Services(orgId, input.Ref, "")
 	for _, id := range services {
-		sg, err := r.fetchSubGraph(id)
+		sg, err := r.fetchSubGraph(ctx, id)
 		if err != nil {
 			return nil, err
 		}
@@ -45,13 +107,14 @@ func (r *mutationResolver) UpdateSubGraph(ctx context.Context, input model.Input
 	if err != nil {
 		return nil, err
 	}
-	_, err = handler.Handle(domain.UpdateSubGraph{
+	_, err = handler.Handle(ctx, domain.UpdateSubGraph{
+		OrganizationId: orgId,
 		Ref:            input.Ref,
 		Service:        input.Service,
 		Url:            input.URL,
 		WSUrl:          input.WsURL,
 		Sdl:            input.Sdl,
-		Initiator: "Fetch name from API-key?",
+		Initiator:      name,
 	})
 	if err != nil {
 		return nil, err
@@ -59,25 +122,25 @@ func (r *mutationResolver) UpdateSubGraph(ctx context.Context, input model.Input
 	return r.toGqlSubGraph(subGraph), nil
 }
 
-// SubGraphs is the resolver for the subGraphs field.
-func (r *queryResolver) SubGraphs(ctx context.Context, ref string) ([]*model.SubGraph, error) {
-	res, err := r.Supergraph(ctx, ref, nil)
-	if err != nil {
-		return nil, err
-	}
-	if s, ok := res.(*model.SubGraphs); ok {
-		return s.SubGraphs, nil
-	}
-	return nil, fmt.Errorf("unexpected response")
+// Organizations is the resolver for the organizations field.
+func (r *queryResolver) Organizations(ctx context.Context) ([]*model.Organization, error) {
+	sub := middleware.UserFromContext(ctx)
+	orgs := r.Cache.OrganizationsByUser(sub)
+	return ToGqlOrganizations(orgs), nil
 }
 
 // Supergraph is the resolver for the supergraph field.
 func (r *queryResolver) Supergraph(ctx context.Context, ref string, isAfter *string) (model.Supergraph, error) {
+	orgId := middleware.OrganizationFromContext(ctx)
+	_, err := r.apiKeyCanAccessRef(ctx, ref, false)
+	if err != nil {
+		return nil, err
+	}
 	after := ""
 	if isAfter != nil {
 		after = *isAfter
 	}
-	services, lastUpdate := r.Cache.Services(ref, after)
+	services, lastUpdate := r.Cache.Services(orgId, ref, after)
 	if after == lastUpdate {
 		return &model.Unchanged{
 			ID:              lastUpdate,
@@ -86,7 +149,7 @@ func (r *queryResolver) Supergraph(ctx context.Context, ref string, isAfter *str
 	}
 	subGraphs := make([]*model.SubGraph, len(services))
 	for i, id := range services {
-		sg, err := r.fetchSubGraph(id)
+		sg, err := r.fetchSubGraph(ctx, id)
 		if err != nil {
 			return nil, err
 		}
@@ -100,9 +163,23 @@ func (r *queryResolver) Supergraph(ctx context.Context, ref string, isAfter *str
 			ChangedAt: sg.ChangedAt,
 		}
 	}
+
+	var serviceSDLs []string
+	for _, id := range services {
+		sg, err := r.fetchSubGraph(ctx, id)
+		if err != nil {
+			return nil, err
+		}
+		serviceSDLs = append(serviceSDLs, sg.Sdl)
+	}
+	sdl, err := sdlmerge.MergeSDLs(serviceSDLs...)
+	if err != nil {
+		return nil, err
+	}
 	return &model.SubGraphs{
 		ID:              lastUpdate,
 		SubGraphs:       subGraphs,
+		Sdl:             sdl,
 		MinDelaySeconds: 10,
 	}, nil
 }

hash/hash.go

@@ -0,0 +1,11 @@
+package hash
+
+import (
+	"crypto/sha256"
+	"encoding/base64"
+)
+
+func String(s string) string {
+	encoded := sha256.New().Sum([]byte(s))
+	return base64.StdEncoding.EncodeToString(encoded)
+}

k8s/autoscale.yaml

@@ -2,7 +2,7 @@ apiVersion: autoscaling/v2
 kind: HorizontalPodAutoscaler
 metadata:
   labels:
-    app: schemas
+    app.kubernetes.io/name: schemas
   name: schemas
 spec:
   scaleTargetRef:

k8s/config-prod.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: schemas
+data:
+  LOG_FORMAT: "otel"
+  ENVIRONMENT: "production"

k8s/config.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: schemas
+data:
+  ENVIRONMENT: "development"

k8s/deploy.yaml

@@ -7,7 +7,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   labels:
-    app: schemas
+    app.kubernetes.io/name: schemas
   name: schemas
   annotations:
     kubernetes.io/change-cause: "${TIMESTAMP} Deployed commit id: ${COMMIT}"
@@ -15,7 +15,7 @@ spec:
   replicas: 1
   selector:
     matchLabels:
-      app: schemas
+      app.kubernetes.io/name: schemas
   strategy:
     rollingUpdate:
       maxSurge: 1
@@ -24,7 +24,7 @@ spec:
   template:
     metadata:
       labels:
-        app: schemas
+        app.kubernetes.io/name: schemas
     spec:
       affinity:
         podAntiAffinity:
@@ -33,7 +33,7 @@ spec:
             podAffinityTerm:
               labelSelector:
                 matchExpressions:
-                - key: "app"
+                - key: "app.kubernetes.io/name"
                   operator: In
                   values:
                   - schemas
@@ -41,10 +41,9 @@ spec:
       containers:
       - name: schemas
         resources:
-          limits:
-            memory: "100Mi"
           requests:
-            memory: "100Mi"
+            cpu: "20m"
+            memory: "20Mi"
         readinessProbe:
           httpGet:
             path: /health
@@ -57,11 +56,14 @@ spec:
         ports:
         - name: api
           containerPort: 8080
+        env:
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: http://k8s-monitoring-alloy-receiver.monitoring.svc.cluster.local:4318
         envFrom:
-        - secretRef:
+        - configMapRef:
             name: schemas
         - secretRef:
-            name: rabbitmq
+            name: schemas
       restartPolicy: Always
       serviceAccountName: schemas
 ---
@@ -77,5 +79,5 @@ spec:
     protocol: TCP
     targetPort: 8080
   selector:
-    app: schemas
+    app.kubernetes.io/name: schemas
   type: NodePort

k8s/ingress-prod.yaml

@@ -4,11 +4,12 @@ metadata:
   name: schemas-ingress
   annotations:
     kubernetes.io/ingress.class: "alb"
-    alb.ingress.kubernetes.io/group.name: "unbound"
+    alb.ingress.kubernetes.io/group.name: "default"
     alb.ingress.kubernetes.io/scheme: internet-facing
     alb.ingress.kubernetes.io/target-type: instance
     alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80},{"HTTPS": 443}]'
     alb.ingress.kubernetes.io/ssl-redirect: "443"
+    alb.ingress.kubernetes.io/healthcheck-path: '/health'
 spec:
   rules:
   - host: "schemas.unbound.se"

k8s/pdb-prod.yaml

@@ -0,0 +1,9 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: schemas-pdb
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: schemas

k8s/secrets-local.yaml

@@ -5,3 +5,4 @@ metadata:
 stringData:
   API_KEY: supersecret123!
   POSTGRES_URL: "postgres://postgres:postgres@postgres:5432/schemas?sslmode=disable"
+  AMQP_URL: "amqp://user:password@rabbitmq:5672/"

k8s/secrets.yaml

@@ -1,8 +1,7 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: schemas
-  namespace: default
 spec:
   refreshInterval: 1h
   secretStoreRef:
@@ -11,6 +10,8 @@ spec:
   target:
     creationPolicy: Owner
     template:
+      mergePolicy: Merge
+      engineVersion: 'v2'
       data:
         POSTGRES_URL: "postgres://{{ .DB_USERNAME }}:{{ .DB_PASSWORD }}@{{ .DB_HOST }}:{{ .DB_PORT }}/schemas?sslmode=disable"
         API_KEY: "{{ .API_KEY }}"
@@ -19,3 +20,5 @@ spec:
       key: services/schemas
   - extract:
       key: rds/postgres/prod-psql
+  - extract:
+      key: mq/rabbit/prod

logging/log.go

@@ -0,0 +1,65 @@
+package logging
+
+import (
+	"context"
+	"log/slog"
+	"os"
+
+	"go.opentelemetry.io/contrib/bridges/otelslog"
+)
+
+type Logger interface {
+	Info(msg string, args ...any)
+	Warn(msg string, args ...any)
+	Error(msg string, args ...any)
+}
+
+var defaultLogger *slog.Logger
+
+type contextKey string
+
+const loggerKey = contextKey("logger")
+
+func SetupLogger(logLevel, logFormat, serviceName, buildVersion string) *slog.Logger {
+	var leveler slog.LevelVar
+
+	err := leveler.UnmarshalText([]byte(logLevel))
+
+	handlerOpts := &slog.HandlerOptions{
+		AddSource:   false,
+		Level:       leveler.Level(),
+		ReplaceAttr: nil,
+	}
+
+	var handler slog.Handler
+	switch logFormat {
+	case "json":
+		handler = slog.NewJSONHandler(os.Stdout, handlerOpts)
+	case "text":
+		handler = slog.NewTextHandler(os.Stdout, handlerOpts)
+	case "otel":
+		handler = otelslog.NewHandler(serviceName,
+			otelslog.WithVersion(buildVersion))
+	}
+	defaultLogger = slog.New(handler).With("service", serviceName).With("version", buildVersion)
+	if err != nil {
+		defaultLogger.With("err", err).Error("Failed to parse log level")
+		os.Exit(1)
+	}
+	slog.SetDefault(defaultLogger)
+	return defaultLogger
+}
+
+// ContextWithLogger returns a new Context with the logger attached
+func ContextWithLogger(ctx context.Context, logger *slog.Logger) context.Context {
+	return context.WithValue(ctx, loggerKey, logger)
+}
+
+// LoggerFromContext returns a logger from the passed context or the default logger
+func LoggerFromContext(ctx context.Context) *slog.Logger {
+	logger := ctx.Value(loggerKey)
+	if l, ok := logger.(*slog.Logger); ok {
+		return l
+	}
+	return defaultLogger
+}

logging/mocklogger.go

@@ -0,0 +1,48 @@
+package logging
+
+import (
+	"bytes"
+	"log/slog"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func NewMockLogger() *MockLogger {
+	logged := &bytes.Buffer{}
+
+	return &MockLogger{
+		logged: logged,
+		logger: slog.New(slog.NewTextHandler(logged, &slog.HandlerOptions{
+			ReplaceAttr: func(groups []string, a slog.Attr) slog.Attr {
+				if a.Key == "time" {
+					return slog.Attr{}
+				}
+				return a
+			},
+		})),
+	}
+}
+
+type MockLogger struct {
+	logger *slog.Logger
+	logged *bytes.Buffer
+}
+
+func (m *MockLogger) Logger() *slog.Logger {
+	return m.logger
+}
+
+func (m *MockLogger) Check(t testing.TB, wantLogged []string) {
+	var gotLogged []string
+	if m.logged.String() != "" {
+		gotLogged = strings.Split(m.logged.String(), "\n")
+		gotLogged = gotLogged[:len(gotLogged)-1]
+	}
+	if len(wantLogged) == 0 {
+		assert.Empty(t, gotLogged)
+		return
+	}
+	assert.Equal(t, wantLogged, gotLogged)
+}

middleware/apikey.go

@@ -4,26 +4,17 @@ import (
 	"context"
 	"fmt"
 	"net/http"
-
-	"github.com/99designs/gqlgen/graphql"
-	"github.com/apex/log"
 )
 
-type ContextKey string
-
 const (
 	ApiKey = ContextKey("apikey")
 )
 
-func NewApiKey(apiKey string, logger log.Interface) *ApiKeyMiddleware {
-	return &ApiKeyMiddleware{
-		apiKey: apiKey,
-	}
+func NewApiKey() *ApiKeyMiddleware {
+	return &ApiKeyMiddleware{}
 }
 
-type ApiKeyMiddleware struct {
-	apiKey string
-}
+type ApiKeyMiddleware struct{}
 
 func (m *ApiKeyMiddleware) Handler(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -37,23 +28,12 @@ func (m *ApiKeyMiddleware) Handler(next http.Handler) http.Handler {
 	})
 }
 
-func (m *ApiKeyMiddleware) Directive(ctx context.Context, obj interface{}, next graphql.Resolver) (res interface{}, err error) {
-	key, err := m.fromContext(ctx)
-	if err != nil {
-		return nil, err
-	}
-	if key != m.apiKey {
-		return nil, fmt.Errorf("invalid API-key")
-	}
-	return next(ctx)
-}
-
-func (m *ApiKeyMiddleware) fromContext(ctx context.Context) (string, error) {
+func ApiKeyFromContext(ctx context.Context) (string, error) {
 	if value := ctx.Value(ApiKey); value != nil {
 		if u, ok := value.(string); ok {
 			return u, nil
 		}
 		return "", fmt.Errorf("current API-key is in wrong format")
 	}
-	return "", fmt.Errorf("no API-key found")
+	return "", nil
 }

middleware/auth.go

@@ -0,0 +1,90 @@
+package middleware
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+
+	"github.com/99designs/gqlgen/graphql"
+	"github.com/golang-jwt/jwt/v5"
+
+	"gitlab.com/unboundsoftware/schemas/domain"
+	"gitlab.com/unboundsoftware/schemas/hash"
+)
+
+const (
+	UserKey         = ContextKey("user")
+	OrganizationKey = ContextKey("organization")
+)
+
+type Cache interface {
+	OrganizationByAPIKey(apiKey string) *domain.Organization
+}
+
+func NewAuth(cache Cache) *AuthMiddleware {
+	return &AuthMiddleware{
+		cache: cache,
+	}
+}
+
+type AuthMiddleware struct {
+	cache Cache
+}
+
+func (m *AuthMiddleware) Handler(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		ctx := r.Context()
+		token, err := TokenFromContext(r.Context())
+		if err != nil {
+			w.WriteHeader(http.StatusInternalServerError)
+			_, _ = w.Write([]byte("Invalid JWT token format"))
+			return
+		}
+		if token != nil {
+			ctx = context.WithValue(ctx, UserKey, token.Claims.(jwt.MapClaims)["sub"])
+		}
+		apiKey, err := ApiKeyFromContext(r.Context())
+		if err != nil {
+			w.WriteHeader(http.StatusInternalServerError)
+			_, _ = w.Write([]byte("Invalid API Key format"))
+			return
+		}
+		if organization := m.cache.OrganizationByAPIKey(hash.String(apiKey)); organization != nil {
+			ctx = context.WithValue(ctx, OrganizationKey, *organization)
+		}
+
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
+
+func UserFromContext(ctx context.Context) string {
+	if value := ctx.Value(UserKey); value != nil {
+		if u, ok := value.(string); ok {
+			return u
+		}
+	}
+	return ""
+}
+
+func OrganizationFromContext(ctx context.Context) string {
+	if value := ctx.Value(OrganizationKey); value != nil {
+		if u, ok := value.(domain.Organization); ok {
+			return u.ID.String()
+		}
+	}
+	return ""
+}
+
+func (m *AuthMiddleware) Directive(ctx context.Context, _ interface{}, next graphql.Resolver, user *bool, organization *bool) (res interface{}, err error) {
+	if user != nil && *user {
+		if u := UserFromContext(ctx); u == "" {
+			return nil, fmt.Errorf("no user available in request")
+		}
+	}
+	if organization != nil && *organization {
+		if orgId := OrganizationFromContext(ctx); orgId == "" {
+			return nil, fmt.Errorf("no organization available in request")
+		}
+	}
+	return next(ctx)
+}

middleware/auth0.go

@@ -0,0 +1,174 @@
+package middleware
+
+import (
+	"context"
+	"crypto/tls"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	mw "github.com/auth0/go-jwt-middleware/v2"
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/pkg/errors"
+)
+
+type Auth0 struct {
+	domain   string
+	audience string
+	client   *http.Client
+	cache    JwksCache
+}
+
+func NewAuth0(audience, domain string, strictSsl bool) *Auth0 {
+	customTransport := http.DefaultTransport.(*http.Transport).Clone()
+	customTransport.TLSClientConfig = &tls.Config{InsecureSkipVerify: !strictSsl}
+	client := &http.Client{Transport: customTransport}
+
+	return &Auth0{
+		domain:   domain,
+		audience: audience,
+		client:   client,
+		cache: JwksCache{
+			RWMutex: &sync.RWMutex{},
+			cache:   make(map[string]cacheItem),
+		},
+	}
+}
+
+type Response struct {
+	Message string `json:"message"`
+}
+
+type Jwks struct {
+	Keys []JSONWebKeys `json:"keys"`
+}
+
+type JSONWebKeys struct {
+	Kty string   `json:"kty"`
+	Kid string   `json:"kid"`
+	Use string   `json:"use"`
+	N   string   `json:"n"`
+	E   string   `json:"e"`
+	X5c []string `json:"x5c"`
+}
+
+func (a *Auth0) ValidationKeyGetter() func(token *jwt.Token) (interface{}, error) {
+	return func(token *jwt.Token) (interface{}, error) {
+		// Verify 'aud' claim
+
+		cert, err := a.getPemCert(token)
+		if err != nil {
+			panic(err.Error())
+		}
+
+		result, _ := jwt.ParseRSAPublicKeyFromPEM([]byte(cert))
+		return result, nil
+	}
+}
+
+func (a *Auth0) Middleware() *mw.JWTMiddleware {
+	issuer := fmt.Sprintf("https://%s/", a.domain)
+	jwtMiddleware := mw.New(func(ctx context.Context, token string) (interface{}, error) {
+		jwtToken, err := jwt.Parse(token, a.ValidationKeyGetter(), jwt.WithAudience(a.audience), jwt.WithIssuer(issuer))
+		if err != nil {
+			return nil, err
+		}
+		if _, ok := jwtToken.Method.(*jwt.SigningMethodRSA); !ok {
+			return nil, fmt.Errorf("unexpected signing method: %v", jwtToken.Header["alg"])
+		}
+		return jwtToken, nil
+	},
+		mw.WithTokenExtractor(func(r *http.Request) (string, error) {
+			token := r.Header.Get("Authorization")
+			if strings.HasPrefix(token, "Bearer ") {
+				return token[7:], nil
+			}
+			return "", nil
+		}),
+		mw.WithCredentialsOptional(true),
+	)
+
+	return jwtMiddleware
+}
+
+func TokenFromContext(ctx context.Context) (*jwt.Token, error) {
+	if value := ctx.Value(mw.ContextKey{}); value != nil {
+		if u, ok := value.(*jwt.Token); ok {
+			return u, nil
+		}
+		return nil, fmt.Errorf("token is in wrong format")
+	}
+	return nil, nil
+}
+
+func (a *Auth0) cacheGetWellknown(url string) (*Jwks, error) {
+	if value := a.cache.get(url); value != nil {
+		return value, nil
+	}
+	jwks := &Jwks{}
+	resp, err := a.client.Get(url)
+	if err != nil {
+		return jwks, err
+	}
+	defer func() {
+		_ = resp.Body.Close()
+	}()
+	err = json.NewDecoder(resp.Body).Decode(jwks)
+	if err == nil && jwks != nil {
+		a.cache.put(url, jwks)
+	}
+	return jwks, err
+}
+
+func (a *Auth0) getPemCert(token *jwt.Token) (string, error) {
+	jwks, err := a.cacheGetWellknown(fmt.Sprintf("https://%s/.well-known/jwks.json", a.domain))
+	if err != nil {
+		return "", err
+	}
+	var cert string
+	for k := range jwks.Keys {
+		if token.Header["kid"] == jwks.Keys[k].Kid {
+			cert = "-----BEGIN CERTIFICATE-----\n" + jwks.Keys[k].X5c[0] + "\n-----END CERTIFICATE-----"
+		}
+	}
+
+	if cert == "" {
+		err := errors.New("Unable to find appropriate key.")
+		return cert, err
+	}
+
+	return cert, nil
+}
+
+type JwksCache struct {
+	*sync.RWMutex
+	cache map[string]cacheItem
+}
+type cacheItem struct {
+	data       *Jwks
+	expiration time.Time
+}
+
+func (c *JwksCache) get(url string) *Jwks {
+	c.RLock()
+	defer c.RUnlock()
+	if value, ok := c.cache[url]; ok {
+		if time.Now().After(value.expiration) {
+			return nil
+		}
+		return value.data
+	}
+	return nil
+}
+
+func (c *JwksCache) put(url string, jwks *Jwks) {
+	c.Lock()
+	defer c.Unlock()
+	c.cache[url] = cacheItem{
+		data:       jwks,
+		expiration: time.Now().Add(time.Minute * 60),
+	}
+}

middleware/context.go

@@ -0,0 +1,3 @@
+package middleware
+
+type ContextKey string

monitoring/graphql.go

@@ -0,0 +1,41 @@
+package monitoring
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/99designs/gqlgen/graphql"
+	"go.opentelemetry.io/otel/trace"
+)
+
+func AroundOperations(ctx context.Context, next graphql.OperationHandler) graphql.ResponseHandler {
+	op := graphql.GetOperationContext(ctx)
+	spanName := fmt.Sprintf("graphql:operation:%s", op.OperationName)
+	// Span always injected in the http handler above
+	sp := trace.SpanFromContext(ctx)
+	if sp != nil {
+		sp.SetName(spanName)
+	}
+	return next(ctx)
+}
+
+func AroundRootFields(ctx context.Context, next graphql.RootResolver) graphql.Marshaler {
+	oc := graphql.GetRootFieldContext(ctx)
+	spanCtx, span := StartSpan(ctx, fmt.Sprintf("graphql:rootfield:%s", oc.Field.Name))
+	defer span.Finish()
+	return next(spanCtx)
+}
+
+func AroundFields(ctx context.Context, next graphql.Resolver) (res any, err error) {
+	oc := graphql.GetFieldContext(ctx)
+	var span Span
+	if oc.IsResolver {
+		ctx, span = StartSpan(ctx, fmt.Sprintf("graphql:field:%s", oc.Field.Name))
+	}
+	defer func() {
+		if span != nil {
+			span.Finish()
+		}
+	}()
+	return next(ctx)
+}

monitoring/otel.go

@@ -0,0 +1,100 @@
+package monitoring
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"os"
+	"time"
+
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp"
+	"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp"
+	"go.opentelemetry.io/otel/exporters/stdout/stdoutlog"
+	"go.opentelemetry.io/otel/log/global"
+	"go.opentelemetry.io/otel/propagation"
+	"go.opentelemetry.io/otel/sdk/log"
+	"go.opentelemetry.io/otel/sdk/metric"
+	"go.opentelemetry.io/otel/sdk/trace"
+)
+
+// SetupOTelSDK bootstraps the OpenTelemetry pipeline.
+func SetupOTelSDK(ctx context.Context, enabled bool, serviceName, buildVersion, environment string) (func(context.Context) error, error) {
+	if os.Getenv("OTEL_RESOURCE_ATTRIBUTES") == "" {
+		if err := os.Setenv("OTEL_RESOURCE_ATTRIBUTES", fmt.Sprintf("service.name=%s,service.version=%s,service.environment=%s", serviceName, buildVersion, environment)); err != nil {
+			return func(context.Context) error {
+				return nil
+			}, err
+		}
+	}
+	var shutdownFuncs []func(context.Context) error
+	if !enabled {
+		return func(context.Context) error {
+			return nil
+		}, nil
+	}
+	shutdown := func(ctx context.Context) error {
+		var err error
+		for _, fn := range shutdownFuncs {
+			err = errors.Join(err, fn(ctx))
+		}
+		shutdownFuncs = nil
+		return err
+	}
+
+	// handleErr calls shutdown for cleanup and makes sure that all errors are returned.
+	handleErr := func(inErr error) (func(context.Context) error, error) {
+		return nil, errors.Join(inErr, shutdown(ctx))
+	}
+
+	// Set up the propagator.
+	prop := propagation.NewCompositeTextMapPropagator(
+		propagation.TraceContext{},
+		propagation.Baggage{},
+	)
+	otel.SetTextMapPropagator(prop)
+
+	traceExporter, err := otlptracehttp.New(ctx)
+	if err != nil {
+		return handleErr(err)
+	}
+	shutdownFuncs = append(shutdownFuncs, traceExporter.Shutdown)
+
+	tracerProvider := trace.NewTracerProvider(
+		trace.WithBatcher(traceExporter,
+			trace.WithBatchTimeout(5*time.Second)),
+	)
+	shutdownFuncs = append(shutdownFuncs, tracerProvider.Shutdown)
+	otel.SetTracerProvider(tracerProvider)
+
+	logExporter, err := stdoutlog.New()
+	if err != nil {
+		return handleErr(err)
+	}
+	processor := log.NewSimpleProcessor(logExporter)
+	logProvider := log.NewLoggerProvider(log.WithProcessor(processor))
+
+	global.SetLoggerProvider(logProvider)
+	shutdownFuncs = append(shutdownFuncs, logProvider.Shutdown)
+
+	exp, err := otlpmetrichttp.New(ctx)
+	if err != nil {
+		return handleErr(err)
+	}
+	meterProvider := metric.NewMeterProvider(metric.WithReader(metric.NewPeriodicReader(exp)))
+	shutdownFuncs = append(shutdownFuncs, meterProvider.Shutdown)
+
+	otel.SetMeterProvider(meterProvider)
+	return shutdown, err
+}
+
+func Handler(h http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		ctx := otel.GetTextMapPropagator().Extract(r.Context(), propagation.HeaderCarrier(r.Header))
+		spanCtx, s := StartSpan(ctx, "http")
+		defer s.Finish()
+
+		h.ServeHTTP(w, r.WithContext(spanCtx))
+	})
+}

monitoring/span.go

@@ -0,0 +1,46 @@
+package monitoring
+
+import (
+	"context"
+
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/trace"
+)
+
+type Span interface {
+	Context() context.Context
+	Finish()
+}
+
+type span struct {
+	otelSpan trace.Span
+	ctx      context.Context
+}
+
+func (s *span) Finish() {
+	s.otelSpan.End()
+}
+
+func (s *span) Context() context.Context {
+	return s.ctx
+}
+
+func StartSpan(ctx context.Context, name string, opts ...trace.SpanStartOption) (context.Context, Span) {
+	ctx, otelSpan := otel.Tracer("").Start(ctx, name, opts...)
+
+	return ctx, &span{
+		otelSpan: otelSpan,
+		ctx:      ctx,
+	}
+}
+
+type TraceHandlerFunc func(ctx context.Context, name string) (context.Context, func())
+
+func (t TraceHandlerFunc) Trace(tx context.Context, name string) (context.Context, func()) {
+	return t(tx, name)
+}
+
+func Trace(ctx context.Context, name string) (context.Context, func()) {
+	ctx, s := StartSpan(ctx, name)
+	return ctx, s.Finish
+}

rand/string.go

@@ -0,0 +1,24 @@
+package rand
+
+import (
+	"math/rand"
+	"time"
+)
+
+const charset = "abcdefghijklmnopqrstuvwxyz" +
+	"ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
+
+var seededRand *rand.Rand = rand.New(
+	rand.NewSource(time.Now().UnixNano()))
+
+func StringWithCharset(length int, charset string) string {
+	b := make([]byte, length)
+	for i := range b {
+		b[i] = charset[seededRand.Intn(len(charset))]
+	}
+	return string(b)
+}
+
+func String(length int) string {
+	return StringWithCharset(length, charset)
+}

renovate.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ],
+  "packageRules": [
+    {
+      "matchManagers": [
+        "kubernetes"
+      ],
+      "matchPackageNames": [
+        "registry.gitlab.com/unboundsoftware/schemas"
+      ],
+      "enabled": false
+    },
+    {
+      "groupName": "Eventsourced",
+      "matchPackageNames": [
+        "gitlab.com/unboundsoftware/eventsourced/**"
+      ]
+    }
+  ]
+}

sdlmerge/collect_entities.go

@@ -0,0 +1,61 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/operationreport"
+)
+
+type collectEntitiesVisitor struct {
+	*astvisitor.Walker
+	document          *ast.Document
+	collectedEntities entitySet
+}
+
+func newCollectEntitiesVisitor(collectedEntities entitySet) *collectEntitiesVisitor {
+	return &collectEntitiesVisitor{
+		collectedEntities: collectedEntities,
+	}
+}
+
+func (c *collectEntitiesVisitor) Register(walker *astvisitor.Walker) {
+	c.Walker = walker
+	walker.RegisterEnterDocumentVisitor(c)
+	walker.RegisterEnterInterfaceTypeDefinitionVisitor(c)
+	walker.RegisterEnterObjectTypeDefinitionVisitor(c)
+}
+
+func (c *collectEntitiesVisitor) EnterDocument(operation, _ *ast.Document) {
+	c.document = operation
+}
+
+func (c *collectEntitiesVisitor) EnterInterfaceTypeDefinition(ref int) {
+	interfaceType := c.document.InterfaceTypeDefinitions[ref]
+	name := c.document.InterfaceTypeDefinitionNameString(ref)
+	if err := c.resolvePotentialEntity(name, interfaceType.Directives.Refs); err != nil {
+		c.StopWithExternalErr(*err)
+	}
+}
+
+func (c *collectEntitiesVisitor) EnterObjectTypeDefinition(ref int) {
+	objectType := c.document.ObjectTypeDefinitions[ref]
+	name := c.document.ObjectTypeDefinitionNameString(ref)
+	if err := c.resolvePotentialEntity(name, objectType.Directives.Refs); err != nil {
+		c.StopWithExternalErr(*err)
+	}
+}
+
+func (c *collectEntitiesVisitor) resolvePotentialEntity(name string, directiveRefs []int) *operationreport.ExternalError {
+	if _, exists := c.collectedEntities[name]; exists {
+		err := operationreport.ErrEntitiesMustNotBeDuplicated(name)
+		return &err
+	}
+	for _, directiveRef := range directiveRefs {
+		if c.document.DirectiveNameString(directiveRef) != "key" {
+			continue
+		}
+		c.collectedEntities[name] = struct{}{}
+		return nil
+	}
+	return nil
+}

sdlmerge/enum_type_extending.go

@@ -0,0 +1,50 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/operationreport"
+)
+
+type extendEnumTypeDefinitionVisitor struct {
+	*astvisitor.Walker
+	document *ast.Document
+}
+
+func newExtendEnumTypeDefinition() *extendEnumTypeDefinitionVisitor {
+	return &extendEnumTypeDefinitionVisitor{}
+}
+
+func (e *extendEnumTypeDefinitionVisitor) Register(walker *astvisitor.Walker) {
+	e.Walker = walker
+	walker.RegisterEnterDocumentVisitor(e)
+	walker.RegisterEnterEnumTypeExtensionVisitor(e)
+}
+
+func (e *extendEnumTypeDefinitionVisitor) EnterDocument(operation, _ *ast.Document) {
+	e.document = operation
+}
+
+func (e *extendEnumTypeDefinitionVisitor) EnterEnumTypeExtension(ref int) {
+	nodes, exists := e.document.Index.NodesByNameBytes(e.document.EnumTypeExtensionNameBytes(ref))
+	if !exists {
+		return
+	}
+
+	hasExtended := false
+	for i := range nodes {
+		if nodes[i].Kind != ast.NodeKindEnumTypeDefinition {
+			continue
+		}
+		if hasExtended {
+			e.StopWithExternalErr(operationreport.ErrSharedTypesMustNotBeExtended(e.document.EnumTypeExtensionNameString(ref)))
+			return
+		}
+		e.document.ExtendEnumTypeDefinitionByEnumTypeExtension(nodes[i].Ref, ref)
+		hasExtended = true
+	}
+
+	if !hasExtended {
+		e.StopWithExternalErr(operationreport.ErrExtensionOrphansMustResolveInSupergraph(e.document.EnumTypeExtensionNameBytes(ref)))
+	}
+}

sdlmerge/input_type_extending.go

@@ -0,0 +1,50 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/operationreport"
+)
+
+func newExtendInputObjectTypeDefinition() *extendInputObjectTypeDefinitionVisitor {
+	return &extendInputObjectTypeDefinitionVisitor{}
+}
+
+type extendInputObjectTypeDefinitionVisitor struct {
+	*astvisitor.Walker
+	document *ast.Document
+}
+
+func (e *extendInputObjectTypeDefinitionVisitor) Register(walker *astvisitor.Walker) {
+	e.Walker = walker
+	walker.RegisterEnterDocumentVisitor(e)
+	walker.RegisterEnterInputObjectTypeExtensionVisitor(e)
+}
+
+func (e *extendInputObjectTypeDefinitionVisitor) EnterDocument(operation, _ *ast.Document) {
+	e.document = operation
+}
+
+func (e *extendInputObjectTypeDefinitionVisitor) EnterInputObjectTypeExtension(ref int) {
+	nodes, exists := e.document.Index.NodesByNameBytes(e.document.InputObjectTypeExtensionNameBytes(ref))
+	if !exists {
+		return
+	}
+
+	hasExtended := false
+	for i := range nodes {
+		if nodes[i].Kind != ast.NodeKindInputObjectTypeDefinition {
+			continue
+		}
+		if hasExtended {
+			e.StopWithExternalErr(operationreport.ErrSharedTypesMustNotBeExtended(e.document.InputObjectTypeExtensionNameString(ref)))
+			return
+		}
+		e.document.ExtendInputObjectTypeDefinitionByInputObjectTypeExtension(nodes[i].Ref, ref)
+		hasExtended = true
+	}
+
+	if !hasExtended {
+		e.StopWithExternalErr(operationreport.ErrExtensionOrphansMustResolveInSupergraph(e.document.InputObjectTypeExtensionNameBytes(ref)))
+	}
+}

sdlmerge/interface_type_extending.go

@@ -0,0 +1,63 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/operationreport"
+)
+
+func newExtendInterfaceTypeDefinition(collectedEntities entitySet) *extendInterfaceTypeDefinitionVisitor {
+	return &extendInterfaceTypeDefinitionVisitor{
+		collectedEntities: collectedEntities,
+	}
+}
+
+type extendInterfaceTypeDefinitionVisitor struct {
+	*astvisitor.Walker
+	document          *ast.Document
+	collectedEntities entitySet
+}
+
+func (e *extendInterfaceTypeDefinitionVisitor) Register(walker *astvisitor.Walker) {
+	e.Walker = walker
+	walker.RegisterEnterDocumentVisitor(e)
+	walker.RegisterEnterInterfaceTypeExtensionVisitor(e)
+}
+
+func (e *extendInterfaceTypeDefinitionVisitor) EnterDocument(operation, _ *ast.Document) {
+	e.document = operation
+}
+
+func (e *extendInterfaceTypeDefinitionVisitor) EnterInterfaceTypeExtension(ref int) {
+	nameBytes := e.document.InterfaceTypeExtensionNameBytes(ref)
+	nodes, exists := e.document.Index.NodesByNameBytes(nameBytes)
+	if !exists {
+		return
+	}
+
+	var nodeToExtend *ast.Node
+	isEntity := false
+	for i := range nodes {
+		if nodes[i].Kind != ast.NodeKindInterfaceTypeDefinition {
+			continue
+		}
+		if nodeToExtend != nil {
+			e.StopWithExternalErr(*multipleExtensionError(isEntity, nameBytes))
+			return
+		}
+		var err *operationreport.ExternalError
+		extension := e.document.InterfaceTypeExtensions[ref]
+		if isEntity, err = e.collectedEntities.isExtensionForEntity(nameBytes, extension.Directives.Refs, e.document); err != nil {
+			e.StopWithExternalErr(*err)
+			return
+		}
+		nodeToExtend = &nodes[i]
+	}
+
+	if nodeToExtend == nil {
+		e.StopWithExternalErr(operationreport.ErrExtensionOrphansMustResolveInSupergraph(e.document.InterfaceTypeExtensionNameBytes(ref)))
+		return
+	}
+
+	e.document.ExtendInterfaceTypeDefinitionByInterfaceTypeExtension(nodeToExtend.Ref, ref)
+}

sdlmerge/merge_duplicated_fields.go

@@ -0,0 +1,62 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/operationreport"
+)
+
+type mergeDuplicatedFieldsVisitor struct {
+	*astvisitor.Walker
+	document *ast.Document
+}
+
+func newMergeDuplicatedFieldsVisitor() *mergeDuplicatedFieldsVisitor {
+	return &mergeDuplicatedFieldsVisitor{
+		nil,
+		nil,
+	}
+}
+
+func (m *mergeDuplicatedFieldsVisitor) Register(walker *astvisitor.Walker) {
+	m.Walker = walker
+	walker.RegisterEnterDocumentVisitor(m)
+	walker.RegisterLeaveObjectTypeDefinitionVisitor(m)
+}
+
+func (m *mergeDuplicatedFieldsVisitor) EnterDocument(document, _ *ast.Document) {
+	m.document = document
+}
+
+func (m *mergeDuplicatedFieldsVisitor) LeaveObjectTypeDefinition(ref int) {
+	var refsForDeletion []int
+	fieldByTypeRefSet := make(map[string]int)
+	for _, fieldRef := range m.document.ObjectTypeDefinitions[ref].FieldsDefinition.Refs {
+		fieldName := m.document.FieldDefinitionNameString(fieldRef)
+		newTypeRef := m.document.FieldDefinitions[fieldRef].Type
+		if oldTypeRef, ok := fieldByTypeRefSet[fieldName]; ok {
+			if m.document.TypesAreEqualDeep(oldTypeRef, newTypeRef) {
+				refsForDeletion = append(refsForDeletion, fieldRef)
+				continue
+			}
+			oldFieldTypeNameBytes, err := m.document.PrintTypeBytes(oldTypeRef, nil)
+			if err != nil {
+				m.StopWithInternalErr(err)
+				return
+			}
+			newFieldTypeNameBytes, err := m.document.PrintTypeBytes(newTypeRef, nil)
+			if err != nil {
+				m.StopWithInternalErr(err)
+				return
+			}
+			m.StopWithExternalErr(operationreport.ErrDuplicateFieldsMustBeIdentical(
+				fieldName, m.document.ObjectTypeDefinitionNameString(ref), string(oldFieldTypeNameBytes), string(newFieldTypeNameBytes),
+			))
+			return
+		}
+
+		fieldByTypeRefSet[fieldName] = newTypeRef
+	}
+
+	m.document.RemoveFieldDefinitionsFromObjectTypeDefinition(refsForDeletion, ref)
+}

sdlmerge/object_type_extending.go

@@ -0,0 +1,66 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/operationreport"
+)
+
+func newExtendObjectTypeDefinition(collectedEntities entitySet) *extendObjectTypeDefinitionVisitor {
+	return &extendObjectTypeDefinitionVisitor{
+		collectedEntities: collectedEntities,
+	}
+}
+
+type extendObjectTypeDefinitionVisitor struct {
+	*astvisitor.Walker
+	document          *ast.Document
+	collectedEntities entitySet
+}
+
+func (e *extendObjectTypeDefinitionVisitor) Register(walker *astvisitor.Walker) {
+	e.Walker = walker
+	walker.RegisterEnterDocumentVisitor(e)
+	walker.RegisterEnterObjectTypeExtensionVisitor(e)
+}
+
+func (e *extendObjectTypeDefinitionVisitor) EnterDocument(operation, _ *ast.Document) {
+	e.document = operation
+}
+
+func (e *extendObjectTypeDefinitionVisitor) EnterObjectTypeExtension(ref int) {
+	nameBytes := e.document.ObjectTypeExtensionNameBytes(ref)
+	nodes, exists := e.document.Index.NodesByNameBytes(nameBytes)
+	if !exists {
+		return
+	}
+
+	var nodeToExtend *ast.Node
+	isEntity := false
+	for i := range nodes {
+		if nodes[i].Kind != ast.NodeKindObjectTypeDefinition {
+			continue
+		}
+		if nodeToExtend != nil {
+			e.StopWithExternalErr(*multipleExtensionError(isEntity, nameBytes))
+			return
+		}
+		var err *operationreport.ExternalError
+		extension := e.document.ObjectTypeExtensions[ref]
+		if isEntity, err = e.collectedEntities.isExtensionForEntity(nameBytes, extension.Directives.Refs, e.document); err != nil {
+			e.StopWithExternalErr(*err)
+			return
+		}
+		nodeToExtend = &nodes[i]
+		if ast.IsRootType(nameBytes) {
+			break
+		}
+	}
+
+	if nodeToExtend == nil {
+		e.StopWithExternalErr(operationreport.ErrExtensionOrphansMustResolveInSupergraph(nameBytes))
+		return
+	}
+
+	e.document.ExtendObjectTypeDefinitionByObjectTypeExtension(nodeToExtend.Ref, ref)
+}

sdlmerge/remove_duplicate_fielded_shared_types.go

@@ -0,0 +1,107 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/operationreport"
+)
+
+type removeDuplicateFieldedSharedTypesVisitor struct {
+	*astvisitor.Walker
+	document          *ast.Document
+	sharedTypeSet     map[string]fieldedSharedType
+	rootNodesToRemove []ast.Node
+	lastInputRef      int
+	lastInterfaceRef  int
+	lastObjectRef     int
+}
+
+func newRemoveDuplicateFieldedSharedTypesVisitor() *removeDuplicateFieldedSharedTypesVisitor {
+	return &removeDuplicateFieldedSharedTypesVisitor{
+		nil,
+		nil,
+		make(map[string]fieldedSharedType),
+		nil,
+		ast.InvalidRef,
+		ast.InvalidRef,
+		ast.InvalidRef,
+	}
+}
+
+func (r *removeDuplicateFieldedSharedTypesVisitor) Register(walker *astvisitor.Walker) {
+	r.Walker = walker
+	walker.RegisterEnterDocumentVisitor(r)
+	walker.RegisterEnterInputObjectTypeDefinitionVisitor(r)
+	walker.RegisterEnterInterfaceTypeDefinitionVisitor(r)
+	walker.RegisterEnterObjectTypeDefinitionVisitor(r)
+	walker.RegisterLeaveDocumentVisitor(r)
+}
+
+func (r *removeDuplicateFieldedSharedTypesVisitor) EnterDocument(operation, _ *ast.Document) {
+	r.document = operation
+}
+
+func (r *removeDuplicateFieldedSharedTypesVisitor) EnterInputObjectTypeDefinition(ref int) {
+	if ref <= r.lastInputRef {
+		return
+	}
+	name := r.document.InputObjectTypeDefinitionNameString(ref)
+	refs := r.document.InputObjectTypeDefinitions[ref].InputFieldsDefinition.Refs
+	input, exists := r.sharedTypeSet[name]
+	if exists {
+		if !input.areFieldsIdentical(refs) {
+			r.StopWithExternalErr(operationreport.ErrSharedTypesMustBeIdenticalToFederate(name))
+			return
+		}
+		r.rootNodesToRemove = append(r.rootNodesToRemove, ast.Node{Kind: ast.NodeKindInputObjectTypeDefinition, Ref: ref})
+	} else {
+		r.sharedTypeSet[name] = newFieldedSharedType(r.document, ast.NodeKindInputValueDefinition, refs)
+	}
+	r.lastInputRef = ref
+}
+
+func (r *removeDuplicateFieldedSharedTypesVisitor) EnterInterfaceTypeDefinition(ref int) {
+	if ref <= r.lastInterfaceRef {
+		return
+	}
+	name := r.document.InterfaceTypeDefinitionNameString(ref)
+	interfaceType := r.document.InterfaceTypeDefinitions[ref]
+	refs := interfaceType.FieldsDefinition.Refs
+	iFace, exists := r.sharedTypeSet[name]
+	if exists {
+		if !iFace.areFieldsIdentical(refs) {
+			r.StopWithExternalErr(operationreport.ErrSharedTypesMustBeIdenticalToFederate(name))
+			return
+		}
+		r.rootNodesToRemove = append(r.rootNodesToRemove, ast.Node{Kind: ast.NodeKindInterfaceTypeDefinition, Ref: ref})
+	} else {
+		r.sharedTypeSet[name] = newFieldedSharedType(r.document, ast.NodeKindFieldDefinition, refs)
+	}
+	r.lastInterfaceRef = ref
+}
+
+func (r *removeDuplicateFieldedSharedTypesVisitor) EnterObjectTypeDefinition(ref int) {
+	if ref <= r.lastObjectRef {
+		return
+	}
+	name := r.document.ObjectTypeDefinitionNameString(ref)
+	objectType := r.document.ObjectTypeDefinitions[ref]
+	refs := objectType.FieldsDefinition.Refs
+	object, exists := r.sharedTypeSet[name]
+	if exists {
+		if !object.areFieldsIdentical(refs) {
+			r.StopWithExternalErr(operationreport.ErrSharedTypesMustBeIdenticalToFederate(name))
+			return
+		}
+		r.rootNodesToRemove = append(r.rootNodesToRemove, ast.Node{Kind: ast.NodeKindObjectTypeDefinition, Ref: ref})
+	} else {
+		r.sharedTypeSet[name] = newFieldedSharedType(r.document, ast.NodeKindFieldDefinition, refs)
+	}
+	r.lastObjectRef = ref
+}
+
+func (r *removeDuplicateFieldedSharedTypesVisitor) LeaveDocument(_, _ *ast.Document) {
+	if r.rootNodesToRemove != nil {
+		r.document.DeleteRootNodes(r.rootNodesToRemove)
+	}
+}

sdlmerge/remove_duplicate_fieldless_shared_types.go

@@ -0,0 +1,98 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/operationreport"
+)
+
+type removeDuplicateFieldlessSharedTypesVisitor struct {
+	*astvisitor.Walker
+	document          *ast.Document
+	sharedTypeSet     map[string]fieldlessSharedType
+	rootNodesToRemove []ast.Node
+	lastEnumRef       int
+	lastUnionRef      int
+	lastScalarRef     int
+}
+
+func newRemoveDuplicateFieldlessSharedTypesVisitor() *removeDuplicateFieldlessSharedTypesVisitor {
+	return &removeDuplicateFieldlessSharedTypesVisitor{
+		nil,
+		nil,
+		make(map[string]fieldlessSharedType),
+		nil,
+		ast.InvalidRef,
+		ast.InvalidRef,
+		ast.InvalidRef,
+	}
+}
+
+func (r *removeDuplicateFieldlessSharedTypesVisitor) Register(walker *astvisitor.Walker) {
+	r.Walker = walker
+	walker.RegisterEnterDocumentVisitor(r)
+	walker.RegisterEnterEnumTypeDefinitionVisitor(r)
+	walker.RegisterEnterScalarTypeDefinitionVisitor(r)
+	walker.RegisterEnterUnionTypeDefinitionVisitor(r)
+	walker.RegisterLeaveDocumentVisitor(r)
+}
+
+func (r *removeDuplicateFieldlessSharedTypesVisitor) EnterDocument(operation, _ *ast.Document) {
+	r.document = operation
+}
+
+func (r *removeDuplicateFieldlessSharedTypesVisitor) EnterEnumTypeDefinition(ref int) {
+	if ref <= r.lastEnumRef {
+		return
+	}
+	name := r.document.EnumTypeDefinitionNameString(ref)
+	enum, exists := r.sharedTypeSet[name]
+	if exists {
+		if !enum.areValuesIdentical(r.document.EnumTypeDefinitions[ref].EnumValuesDefinition.Refs) {
+			r.StopWithExternalErr(operationreport.ErrSharedTypesMustBeIdenticalToFederate(name))
+			return
+		}
+		r.rootNodesToRemove = append(r.rootNodesToRemove, ast.Node{Kind: ast.NodeKindEnumTypeDefinition, Ref: ref})
+	} else {
+		r.sharedTypeSet[name] = newEnumSharedType(r.document, ref)
+	}
+	r.lastEnumRef = ref
+}
+
+func (r *removeDuplicateFieldlessSharedTypesVisitor) EnterScalarTypeDefinition(ref int) {
+	if ref <= r.lastScalarRef {
+		return
+	}
+	name := r.document.ScalarTypeDefinitionNameString(ref)
+	_, exists := r.sharedTypeSet[name]
+	if exists {
+		r.rootNodesToRemove = append(r.rootNodesToRemove, ast.Node{Kind: ast.NodeKindScalarTypeDefinition, Ref: ref})
+	} else {
+		r.sharedTypeSet[name] = scalarSharedType{}
+	}
+	r.lastScalarRef = ref
+}
+
+func (r *removeDuplicateFieldlessSharedTypesVisitor) EnterUnionTypeDefinition(ref int) {
+	if ref <= r.lastUnionRef {
+		return
+	}
+	name := r.document.UnionTypeDefinitionNameString(ref)
+	union, exists := r.sharedTypeSet[name]
+	if exists {
+		if !union.areValuesIdentical(r.document.UnionTypeDefinitions[ref].UnionMemberTypes.Refs) {
+			r.StopWithExternalErr(operationreport.ErrSharedTypesMustBeIdenticalToFederate(name))
+			return
+		}
+		r.rootNodesToRemove = append(r.rootNodesToRemove, ast.Node{Kind: ast.NodeKindUnionTypeDefinition, Ref: ref})
+	} else {
+		r.sharedTypeSet[name] = newUnionSharedType(r.document, ref)
+	}
+	r.lastUnionRef = ref
+}
+
+func (r *removeDuplicateFieldlessSharedTypesVisitor) LeaveDocument(_, _ *ast.Document) {
+	if r.rootNodesToRemove != nil {
+		r.document.DeleteRootNodes(r.rootNodesToRemove)
+	}
+}

sdlmerge/remove_empty_object_type_definition.go

@@ -0,0 +1,32 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+)
+
+func newRemoveEmptyObjectTypeDefinition() *removeEmptyObjectTypeDefinition {
+	return &removeEmptyObjectTypeDefinition{}
+}
+
+type removeEmptyObjectTypeDefinition struct{}
+
+func (r *removeEmptyObjectTypeDefinition) Register(walker *astvisitor.Walker) {
+	walker.RegisterLeaveDocumentVisitor(r)
+}
+
+func (r *removeEmptyObjectTypeDefinition) LeaveDocument(operation, _ *ast.Document) {
+	for ref := range operation.ObjectTypeDefinitions {
+		if operation.ObjectTypeDefinitions[ref].HasFieldDefinitions {
+			continue
+		}
+
+		name := operation.ObjectTypeDefinitionNameString(ref)
+		node, ok := operation.Index.FirstNodeByNameStr(name)
+		if !ok {
+			return
+		}
+
+		operation.RemoveRootNode(node)
+	}
+}

sdlmerge/remove_field_definition_by_directive.go

@@ -0,0 +1,46 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+)
+
+func newRemoveFieldDefinitions(directives ...string) *removeFieldDefinitionByDirective {
+	directivesSet := make(map[string]struct{}, len(directives))
+	for _, directive := range directives {
+		directivesSet[directive] = struct{}{}
+	}
+
+	return &removeFieldDefinitionByDirective{
+		directives: directivesSet,
+	}
+}
+
+type removeFieldDefinitionByDirective struct {
+	operation  *ast.Document
+	directives map[string]struct{}
+}
+
+func (r *removeFieldDefinitionByDirective) Register(walker *astvisitor.Walker) {
+	walker.RegisterEnterDocumentVisitor(r)
+	walker.RegisterLeaveObjectTypeDefinitionVisitor(r)
+}
+
+func (r *removeFieldDefinitionByDirective) EnterDocument(operation, _ *ast.Document) {
+	r.operation = operation
+}
+
+func (r *removeFieldDefinitionByDirective) LeaveObjectTypeDefinition(ref int) {
+	var refsForDeletion []int
+	// select fields for deletion
+	for _, fieldRef := range r.operation.ObjectTypeDefinitions[ref].FieldsDefinition.Refs {
+		for _, directiveRef := range r.operation.FieldDefinitions[fieldRef].Directives.Refs {
+			directiveName := r.operation.DirectiveNameString(directiveRef)
+			if _, ok := r.directives[directiveName]; ok {
+				refsForDeletion = append(refsForDeletion, fieldRef)
+			}
+		}
+	}
+	// delete fields
+	r.operation.RemoveFieldDefinitionsFromObjectTypeDefinition(refsForDeletion, ref)
+}

sdlmerge/remove_field_definition_directive.go

@@ -0,0 +1,44 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+)
+
+func newRemoveFieldDefinitionDirective(directives ...string) *removeFieldDefinitionDirective {
+	directivesSet := make(map[string]struct{}, len(directives))
+	for _, directive := range directives {
+		directivesSet[directive] = struct{}{}
+	}
+
+	return &removeFieldDefinitionDirective{
+		directives: directivesSet,
+	}
+}
+
+type removeFieldDefinitionDirective struct {
+	operation  *ast.Document
+	directives map[string]struct{}
+}
+
+func (r *removeFieldDefinitionDirective) Register(walker *astvisitor.Walker) {
+	walker.RegisterEnterDocumentVisitor(r)
+	walker.RegisterEnterFieldDefinitionVisitor(r)
+}
+
+func (r *removeFieldDefinitionDirective) EnterDocument(operation, _ *ast.Document) {
+	r.operation = operation
+}
+
+func (r *removeFieldDefinitionDirective) EnterFieldDefinition(ref int) {
+	var refsForDeletion []int
+	// select directives for deletion
+	for _, directiveRef := range r.operation.FieldDefinitions[ref].Directives.Refs {
+		directiveName := r.operation.DirectiveNameString(directiveRef)
+		if _, ok := r.directives[directiveName]; ok {
+			refsForDeletion = append(refsForDeletion, directiveRef)
+		}
+	}
+	// delete directives
+	r.operation.RemoveDirectivesFromNode(ast.Node{Kind: ast.NodeKindFieldDefinition, Ref: ref}, refsForDeletion)
+}

sdlmerge/remove_interface_definition_directive.go

@@ -0,0 +1,45 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+)
+
+func newRemoveInterfaceDefinitionDirective(directives ...string) *removeInterfaceDefinitionDirective {
+	directivesSet := make(map[string]struct{}, len(directives))
+	for _, directive := range directives {
+		directivesSet[directive] = struct{}{}
+	}
+
+	return &removeInterfaceDefinitionDirective{
+		directives: directivesSet,
+	}
+}
+
+type removeInterfaceDefinitionDirective struct {
+	*astvisitor.Walker
+	operation  *ast.Document
+	directives map[string]struct{}
+}
+
+func (r *removeInterfaceDefinitionDirective) Register(walker *astvisitor.Walker) {
+	walker.RegisterEnterDocumentVisitor(r)
+	walker.RegisterEnterInterfaceTypeDefinitionVisitor(r)
+}
+
+func (r *removeInterfaceDefinitionDirective) EnterDocument(operation, _ *ast.Document) {
+	r.operation = operation
+}
+
+func (r *removeInterfaceDefinitionDirective) EnterInterfaceTypeDefinition(ref int) {
+	var refsForDeletion []int
+	// select fields for deletion
+	for _, directiveRef := range r.operation.InterfaceTypeDefinitions[ref].Directives.Refs {
+		directiveName := r.operation.DirectiveNameString(directiveRef)
+		if _, ok := r.directives[directiveName]; ok {
+			refsForDeletion = append(refsForDeletion, directiveRef)
+		}
+	}
+	// delete directives
+	r.operation.RemoveDirectivesFromNode(ast.Node{Kind: ast.NodeKindInterfaceTypeDefinition, Ref: ref}, refsForDeletion)
+}

sdlmerge/remove_object_type_definition_directive.go

@@ -0,0 +1,44 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+)
+
+func newRemoveObjectTypeDefinitionDirective(directives ...string) *removeObjectTypeDefinitionDirective {
+	directivesSet := make(map[string]struct{}, len(directives))
+	for _, directive := range directives {
+		directivesSet[directive] = struct{}{}
+	}
+
+	return &removeObjectTypeDefinitionDirective{
+		directives: directivesSet,
+	}
+}
+
+type removeObjectTypeDefinitionDirective struct {
+	operation  *ast.Document
+	directives map[string]struct{}
+}
+
+func (r *removeObjectTypeDefinitionDirective) Register(walker *astvisitor.Walker) {
+	walker.RegisterEnterDocumentVisitor(r)
+	walker.RegisterEnterObjectTypeDefinitionVisitor(r)
+}
+
+func (r *removeObjectTypeDefinitionDirective) EnterDocument(operation, _ *ast.Document) {
+	r.operation = operation
+}
+
+func (r *removeObjectTypeDefinitionDirective) EnterObjectTypeDefinition(ref int) {
+	var refsForDeletion []int
+	// select fields for deletion
+	for _, directiveRef := range r.operation.ObjectTypeDefinitions[ref].Directives.Refs {
+		directiveName := r.operation.DirectiveNameString(directiveRef)
+		if _, ok := r.directives[directiveName]; ok {
+			refsForDeletion = append(refsForDeletion, directiveRef)
+		}
+	}
+	// delete directives
+	r.operation.RemoveDirectivesFromNode(ast.Node{Kind: ast.NodeKindObjectTypeDefinition, Ref: ref}, refsForDeletion)
+}

sdlmerge/remove_type_extensions.go

@@ -0,0 +1,20 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+)
+
+func newRemoveMergedTypeExtensions() *removeMergedTypeExtensionsVisitor {
+	return &removeMergedTypeExtensionsVisitor{}
+}
+
+type removeMergedTypeExtensionsVisitor struct{}
+
+func (r *removeMergedTypeExtensionsVisitor) Register(walker *astvisitor.Walker) {
+	walker.RegisterLeaveDocumentVisitor(r)
+}
+
+func (r *removeMergedTypeExtensionsVisitor) LeaveDocument(operation, definition *ast.Document) {
+	operation.RemoveMergedTypeExtensions()
+}

sdlmerge/scalar_type_extending.go

@@ -0,0 +1,49 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/operationreport"
+)
+
+func newExtendScalarTypeDefinition() *extendScalarTypeDefinitionVisitor {
+	return &extendScalarTypeDefinitionVisitor{}
+}
+
+type extendScalarTypeDefinitionVisitor struct {
+	*astvisitor.Walker
+	document *ast.Document
+}
+
+func (e *extendScalarTypeDefinitionVisitor) Register(walker *astvisitor.Walker) {
+	e.Walker = walker
+	walker.RegisterEnterDocumentVisitor(e)
+	walker.RegisterEnterScalarTypeExtensionVisitor(e)
+}
+
+func (e *extendScalarTypeDefinitionVisitor) EnterDocument(operation, _ *ast.Document) {
+	e.document = operation
+}
+
+func (e *extendScalarTypeDefinitionVisitor) EnterScalarTypeExtension(ref int) {
+	nodes, exists := e.document.Index.NodesByNameBytes(e.document.ScalarTypeExtensionNameBytes(ref))
+	if !exists {
+		return
+	}
+
+	hasExtended := false
+	for i := range nodes {
+		if nodes[i].Kind != ast.NodeKindScalarTypeDefinition {
+			continue
+		}
+		if hasExtended {
+			e.StopWithExternalErr(operationreport.ErrSharedTypesMustNotBeExtended(e.document.ScalarTypeExtensionNameString(ref)))
+			return
+		}
+		e.document.ExtendScalarTypeDefinitionByScalarTypeExtension(nodes[i].Ref, ref)
+		hasExtended = true
+	}
+	if !hasExtended {
+		e.StopWithExternalErr(operationreport.ErrExtensionOrphansMustResolveInSupergraph(e.document.ScalarTypeExtensionNameBytes(ref)))
+	}
+}

sdlmerge/sdlmerge.go

@@ -0,0 +1,205 @@
+package sdlmerge
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/asttransform"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvalidation"
+
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astnormalization"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astparser"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astprinter"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/operationreport"
+)
+
+const (
+	rootOperationTypeDefinitions = `
+		type Query {}
+		type Mutation {}
+		type Subscription {}
+	`
+
+	parseDocumentError = "parse graphql document string: %w"
+)
+
+type Visitor interface {
+	Register(walker *astvisitor.Walker)
+}
+
+func MergeAST(ast *ast.Document) error {
+	normalizer := normalizer{}
+	normalizer.setupWalkers()
+
+	return normalizer.normalize(ast)
+}
+
+func MergeSDLs(SDLs ...string) (string, error) {
+	rawDocs := make([]string, 0, len(SDLs)+1)
+	rawDocs = append(rawDocs, rootOperationTypeDefinitions)
+	rawDocs = append(rawDocs, SDLs...)
+	if validationError := validateSubgraphs(rawDocs[1:]); validationError != nil {
+		return "", validationError
+	}
+	if normalizationError := normalizeSubgraphs(rawDocs[1:]); normalizationError != nil {
+		return "", normalizationError
+	}
+
+	doc, report := astparser.ParseGraphqlDocumentString(strings.Join(rawDocs, "\n"))
+	if report.HasErrors() {
+		return "", fmt.Errorf("parse graphql document string: %w", report)
+	}
+
+	astnormalization.NormalizeSubgraphSDL(&doc, &report)
+	if report.HasErrors() {
+		return "", fmt.Errorf("merge ast: %w", report)
+	}
+
+	if err := MergeAST(&doc); err != nil {
+		return "", fmt.Errorf("merge ast: %w", err)
+	}
+
+	out, err := astprinter.PrintString(&doc)
+	if err != nil {
+		return "", fmt.Errorf("stringify schema: %w", err)
+	}
+
+	return out, nil
+}
+
+func validateSubgraphs(subgraphs []string) error {
+	validator := astvalidation.NewDefinitionValidator(
+		astvalidation.PopulatedTypeBodies(), astvalidation.KnownTypeNames(),
+	)
+	for _, subgraph := range subgraphs {
+		doc, report := astparser.ParseGraphqlDocumentString(subgraph)
+		if err := asttransform.MergeDefinitionWithBaseSchema(&doc); err != nil {
+			return err
+		}
+		if report.HasErrors() {
+			return fmt.Errorf(parseDocumentError, report)
+		}
+		validator.Validate(&doc, &report)
+		if report.HasErrors() {
+			return fmt.Errorf("validate schema: %w", report)
+		}
+	}
+	return nil
+}
+
+func normalizeSubgraphs(subgraphs []string) error {
+	subgraphNormalizer := astnormalization.NewSubgraphDefinitionNormalizer()
+	for i, subgraph := range subgraphs {
+		doc, report := astparser.ParseGraphqlDocumentString(subgraph)
+		if report.HasErrors() {
+			return fmt.Errorf(parseDocumentError, report)
+		}
+		subgraphNormalizer.NormalizeDefinition(&doc, &report)
+		if report.HasErrors() {
+			return fmt.Errorf("normalize schema: %w", report)
+		}
+		out, err := astprinter.PrintString(&doc)
+		if err != nil {
+			return fmt.Errorf("stringify schema: %w", err)
+		}
+		subgraphs[i] = out
+	}
+	return nil
+}
+
+type normalizer struct {
+	walkers []*astvisitor.Walker
+}
+
+type entitySet map[string]struct{}
+
+func (m *normalizer) setupWalkers() {
+	collectedEntities := make(entitySet)
+	visitorGroups := [][]Visitor{
+		{
+			newCollectEntitiesVisitor(collectedEntities),
+		},
+		{
+			newExtendEnumTypeDefinition(),
+			newExtendInputObjectTypeDefinition(),
+			newExtendInterfaceTypeDefinition(collectedEntities),
+			newExtendScalarTypeDefinition(),
+			newExtendUnionTypeDefinition(),
+			newExtendObjectTypeDefinition(collectedEntities),
+			newRemoveEmptyObjectTypeDefinition(),
+			newRemoveMergedTypeExtensions(),
+		},
+		// visitors for cleaning up federated duplicated fields and directives
+		{
+			newRemoveFieldDefinitions("external"),
+			newRemoveDuplicateFieldedSharedTypesVisitor(),
+			newRemoveDuplicateFieldlessSharedTypesVisitor(),
+			newMergeDuplicatedFieldsVisitor(),
+			newRemoveInterfaceDefinitionDirective("key"),
+			newRemoveObjectTypeDefinitionDirective("key"),
+			newRemoveFieldDefinitionDirective("provides", "requires"),
+		},
+	}
+
+	for _, visitorGroup := range visitorGroups {
+		walker := astvisitor.NewWalker(48)
+		for _, visitor := range visitorGroup {
+			visitor.Register(&walker)
+			m.walkers = append(m.walkers, &walker)
+		}
+	}
+}
+
+func (m *normalizer) normalize(operation *ast.Document) error {
+	report := operationreport.Report{}
+
+	for _, walker := range m.walkers {
+		walker.Walk(operation, nil, &report)
+		if report.HasErrors() {
+			return fmt.Errorf("walk: %w", report)
+		}
+	}
+
+	return nil
+}
+
+func (e entitySet) isExtensionForEntity(nameBytes []byte, directiveRefs []int, document *ast.Document) (bool, *operationreport.ExternalError) {
+	name := string(nameBytes)
+	hasDirectives := len(directiveRefs) > 0
+	if _, exists := e[name]; !exists {
+		if !hasDirectives || !isEntityExtension(directiveRefs, document) {
+			return false, nil
+		}
+		err := operationreport.ErrExtensionWithKeyDirectiveMustExtendEntity(name)
+		return false, &err
+	}
+	if !hasDirectives {
+		err := operationreport.ErrEntityExtensionMustHaveKeyDirective(name)
+		return false, &err
+	}
+	if isEntityExtension(directiveRefs, document) {
+		return true, nil
+	}
+	err := operationreport.ErrEntityExtensionMustHaveKeyDirective(name)
+	return false, &err
+}
+
+func isEntityExtension(directiveRefs []int, document *ast.Document) bool {
+	for _, directiveRef := range directiveRefs {
+		if document.DirectiveNameString(directiveRef) == "key" {
+			return true
+		}
+	}
+	return false
+}
+
+func multipleExtensionError(isEntity bool, nameBytes []byte) *operationreport.ExternalError {
+	if isEntity {
+		err := operationreport.ErrEntitiesMustNotBeDuplicated(string(nameBytes))
+		return &err
+	}
+	err := operationreport.ErrSharedTypesMustNotBeExtended(string(nameBytes))
+	return &err
+}

sdlmerge/shared_types.go

@@ -0,0 +1,167 @@
+package sdlmerge
+
+import "github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+
+type fieldlessSharedType interface {
+	areValuesIdentical(valueRefsToCompare []int) bool
+	valueRefs() []int
+	valueName(ref int) string
+}
+
+func createValueSet(f fieldlessSharedType) map[string]bool {
+	valueSet := make(map[string]bool)
+	for _, valueRef := range f.valueRefs() {
+		valueSet[f.valueName(valueRef)] = true
+	}
+	return valueSet
+}
+
+type fieldedSharedType struct {
+	document  *ast.Document
+	fieldKind ast.NodeKind
+	fieldRefs []int
+	fieldSet  map[string]int
+}
+
+func newFieldedSharedType(document *ast.Document, fieldKind ast.NodeKind, fieldRefs []int) fieldedSharedType {
+	f := fieldedSharedType{
+		document,
+		fieldKind,
+		fieldRefs,
+		nil,
+	}
+	f.createFieldSet()
+	return f
+}
+
+func (f fieldedSharedType) areFieldsIdentical(fieldRefsToCompare []int) bool {
+	if len(f.fieldRefs) != len(fieldRefsToCompare) {
+		return false
+	}
+	for _, fieldRef := range fieldRefsToCompare {
+		actualFieldName := f.fieldName(fieldRef)
+		expectedTypeRef, exists := f.fieldSet[actualFieldName]
+		if !exists {
+			return false
+		}
+		actualTypeRef := f.fieldTypeRef(fieldRef)
+		if !f.document.TypesAreCompatibleDeep(expectedTypeRef, actualTypeRef) {
+			return false
+		}
+	}
+	return true
+}
+
+func (f *fieldedSharedType) createFieldSet() {
+	fieldSet := make(map[string]int)
+	for _, fieldRef := range f.fieldRefs {
+		fieldSet[f.fieldName(fieldRef)] = f.fieldTypeRef(fieldRef)
+	}
+	f.fieldSet = fieldSet
+}
+
+func (f fieldedSharedType) fieldName(ref int) string {
+	switch f.fieldKind {
+	case ast.NodeKindInputValueDefinition:
+		return f.document.InputValueDefinitionNameString(ref)
+	default:
+		return f.document.FieldDefinitionNameString(ref)
+	}
+}
+
+func (f fieldedSharedType) fieldTypeRef(ref int) int {
+	switch f.fieldKind {
+	case ast.NodeKindInputValueDefinition:
+		return f.document.InputValueDefinitions[ref].Type
+	default:
+		return f.document.FieldDefinitions[ref].Type
+	}
+}
+
+type enumSharedType struct {
+	*ast.EnumTypeDefinition
+	document *ast.Document
+	valueSet map[string]bool
+}
+
+func newEnumSharedType(document *ast.Document, ref int) enumSharedType {
+	e := enumSharedType{
+		&document.EnumTypeDefinitions[ref],
+		document,
+		nil,
+	}
+	e.valueSet = createValueSet(e)
+	return e
+}
+
+func (e enumSharedType) areValuesIdentical(valueRefsToCompare []int) bool {
+	if len(e.valueRefs()) != len(valueRefsToCompare) {
+		return false
+	}
+	for _, valueRefToCompare := range valueRefsToCompare {
+		name := e.valueName(valueRefToCompare)
+		if !e.valueSet[name] {
+			return false
+		}
+	}
+	return true
+}
+
+func (e enumSharedType) valueRefs() []int {
+	return e.EnumValuesDefinition.Refs
+}
+
+func (e enumSharedType) valueName(ref int) string {
+	return e.document.EnumValueDefinitionNameString(ref)
+}
+
+type unionSharedType struct {
+	*ast.UnionTypeDefinition
+	document *ast.Document
+	valueSet map[string]bool
+}
+
+func newUnionSharedType(document *ast.Document, ref int) unionSharedType {
+	u := unionSharedType{
+		&document.UnionTypeDefinitions[ref],
+		document,
+		nil,
+	}
+	u.valueSet = createValueSet(u)
+	return u
+}
+
+func (u unionSharedType) areValuesIdentical(valueRefsToCompare []int) bool {
+	if len(u.valueRefs()) != len(valueRefsToCompare) {
+		return false
+	}
+	for _, refToCompare := range valueRefsToCompare {
+		name := u.valueName(refToCompare)
+		if !u.valueSet[name] {
+			return false
+		}
+	}
+	return true
+}
+
+func (u unionSharedType) valueRefs() []int {
+	return u.UnionMemberTypes.Refs
+}
+
+func (u unionSharedType) valueName(ref int) string {
+	return u.document.TypeNameString(ref)
+}
+
+type scalarSharedType struct{}
+
+func (scalarSharedType) areValuesIdentical(_ []int) bool {
+	return true
+}
+
+func (scalarSharedType) valueRefs() []int {
+	return nil
+}
+
+func (scalarSharedType) valueName(_ int) string {
+	return ""
+}

sdlmerge/union_type_extending.go

@@ -0,0 +1,50 @@
+package sdlmerge
+
+import (
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/ast"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/astvisitor"
+	"github.com/wundergraph/graphql-go-tools/v2/pkg/operationreport"
+)
+
+func newExtendUnionTypeDefinition() *extendUnionTypeDefinitionVisitor {
+	return &extendUnionTypeDefinitionVisitor{}
+}
+
+type extendUnionTypeDefinitionVisitor struct {
+	*astvisitor.Walker
+	document *ast.Document
+}
+
+func (e *extendUnionTypeDefinitionVisitor) Register(walker *astvisitor.Walker) {
+	e.Walker = walker
+	walker.RegisterEnterDocumentVisitor(e)
+	walker.RegisterEnterUnionTypeExtensionVisitor(e)
+}
+
+func (e *extendUnionTypeDefinitionVisitor) EnterDocument(operation, _ *ast.Document) {
+	e.document = operation
+}
+
+func (e *extendUnionTypeDefinitionVisitor) EnterUnionTypeExtension(ref int) {
+	nodes, exists := e.document.Index.NodesByNameBytes(e.document.UnionTypeExtensionNameBytes(ref))
+	if !exists {
+		return
+	}
+
+	hasExtended := false
+	for i := range nodes {
+		if nodes[i].Kind != ast.NodeKindUnionTypeDefinition {
+			continue
+		}
+		if hasExtended {
+			e.StopWithExternalErr(operationreport.ErrSharedTypesMustNotBeExtended(e.document.UnionTypeExtensionNameString(ref)))
+			return
+		}
+		e.document.ExtendUnionTypeDefinitionByUnionTypeExtension(nodes[i].Ref, ref)
+		hasExtended = true
+	}
+
+	if !hasExtended {
+		e.StopWithExternalErr(operationreport.ErrExtensionOrphansMustResolveInSupergraph(e.document.UnionTypeExtensionNameBytes(ref)))
+	}
+}

store/event_store_migrations/20230426145300_add_organization.sql

@@ -0,0 +1,52 @@
+-- +goose Up
+-- Add Unbound Software Development organization
+insert into aggregates (id, name)
+values ('d46ffcb0-19e8-4769-8697-590326ef7b51', 'domain.Organization');
+
+insert into events (name, aggregate_id, aggregate_sequence_no, payload, tstamp, aggregate_name)
+values ('domain.OrganizationAdded', 'd46ffcb0-19e8-4769-8697-590326ef7b51', 1, '{"id":"d46ffcb0-19e8-4769-8697-590326ef7b51","time":"2023-04-26T14:46:04.43462+02:00","name":"Unbound Software Development","initiator":"google-oauth2|101953650269257914934"}', '2023-04-26T14:46:04.43462+02:00', 'domain.Organization');
+
+-- Add API keys
+insert into events (name, aggregate_id, aggregate_sequence_no, payload, tstamp, aggregate_name)
+values ('domain.APIKeyAdded', 'd46ffcb0-19e8-4769-8697-590326ef7b51', 2,
+        '{"id":"d46ffcb0-19e8-4769-8697-590326ef7b51","time":"2023-04-26T15:46:54.181929+02:00","organizationId":"","name":"CI","key":"dXNfYWtfeUl2R3RRQUJQTmJzVEFrUeOwxEKY/BwUmvv0yJlvuSQnrkHkZJuTTKSVmRt4UrhV","refs":["Shiny@staging","Shiny@prod"],"read":false,"publish":true,"initiator":"google-oauth2|101953650269257914934"}',
+        '2023-04-26 15:46:54.181929 +02:00', 'domain.Organization');
+
+insert into events (name, aggregate_id, aggregate_sequence_no, payload, tstamp, aggregate_name)
+values ('domain.APIKeyAdded', 'd46ffcb0-19e8-4769-8697-590326ef7b51', 3,
+        '{"id":"d46ffcb0-19e8-4769-8697-590326ef7b51","time":"2023-04-26T15:52:55.955203+02:00","organizationId":"","name":"Gateway","key":"dXNfYWtfdnkzSkRseDNlSDNjcnZzOeOwxEKY/BwUmvv0yJlvuSQnrkHkZJuTTKSVmRt4UrhV","refs":["Shiny@staging","Shiny@prod"],"read":true,"publish":false,"initiator":"google-oauth2|101953650269257914934"}',
+        '2023-04-26 15:52:55.955203 +02:00', 'domain.Organization');
+
+insert into events (name, aggregate_id, aggregate_sequence_no, payload, tstamp, aggregate_name)
+values ('domain.APIKeyAdded', 'd46ffcb0-19e8-4769-8697-590326ef7b51', 4,
+        '{"id":"d46ffcb0-19e8-4769-8697-590326ef7b51","time":"2023-04-26T16:30:00.0011+02:00","organizationId":"","name":"Local dev","key":"dXNfYWtfM0kzaGZndmVaQllyQzdjVOOwxEKY/BwUmvv0yJlvuSQnrkHkZJuTTKSVmRt4UrhV","refs":["Shiny@dev"],"read":true,"publish":true,"initiator":"google-oauth2|101953650269257914934"}',
+        '2023-04-26 16:30:00.001100 +02:00', 'domain.Organization');
+
+insert into events (name, aggregate_id, aggregate_sequence_no, payload, tstamp, aggregate_name)
+values ('domain.APIKeyAdded', 'd46ffcb0-19e8-4769-8697-590326ef7b51', 5,
+        '{"id":"d46ffcb0-19e8-4769-8697-590326ef7b51","time":"2023-04-27T07:43:26.599544+02:00","organizationId":"","name":"Acctest","key":"dXNfYWtfdlVqMzdBMXVraklmaGtKSOOwxEKY/BwUmvv0yJlvuSQnrkHkZJuTTKSVmRt4UrhV","refs":["Shiny@test"],"read":true,"publish":true,"initiator":"google-oauth2|101953650269257914934"}',
+        '2023-04-27 07:43:26.599544 +02:00', 'domain.Organization');
+
+-- Update events since json-tags were added
+UPDATE events e
+SET payload = jsonb_build_object(
+  'id', payload::jsonb ->> 'id',
+  'time', payload::jsonb ->> 'time',
+  'ref', payload::jsonb ->> 'Ref',
+  'sdl', payload::jsonb ->> 'Sdl',
+  'url', payload::jsonb ->> 'Url',
+  'wsUrl', payload::jsonb ->> 'WSUrl',
+  'service', payload::jsonb ->> 'Service',
+  'initiator', 'CI'
+  )
+WHERE e.name = 'domain.SubGraphUpdated';
+
+-- Add organization id to all existing subgraphs
+update events e
+set payload = jsonb_set(payload::jsonb, '{organizationId}', '"d46ffcb0-19e8-4769-8697-590326ef7b51"', true)
+where e.name = 'domain.SubGraphUpdated';
+
+DELETE
+from snapshots;
+
+-- +goose Down

store/store.go

@@ -1,7 +1,10 @@
 package store
 
 import (
+	"embed"
+
 	"github.com/jmoiron/sqlx"
+	"github.com/pressly/goose/v3"
 )
 
 func SetupDB(driverName, url string) (*sqlx.DB, error) {
@@ -25,3 +28,15 @@ func SetupDB(driverName, url string) (*sqlx.DB, error) {
 //
 //	return goose.Up(db.DB, "migrations")
 //}
+
+//go:embed event_store_migrations/*.sql
+var embedEventStoreMigrations embed.FS
+
+func RunEventStoreMigrations(db *sqlx.DB) error {
+	goose.SetTableName("goose_db_version_event")
+	goose.SetBaseFS(embedEventStoreMigrations)
+	if err := goose.SetDialect("postgres"); err != nil {
+		return err
+	}
+	return goose.Up(db.DB, "event_store_migrations")
+}