Generated file — do not edit by hand. Produced by
tooling/gen-graphql-ref.pyfrom the OSYRA edge GraphQL SDL.
Scalars
3 scalar(s).
DateTime
Osyra Edge Gateway GraphQL Schema Root schema with Query and Mutation types
JSON
Audit log GraphQL Schema — AP00005 audit-svc projection (ENG-2045 / EPIC ENG-2034).
RE-POINTED (ENG-2045): the /audit viewer now projects AP00005's centralized,
signed, hash-chained audit-of-record (audit.v1.AuditService) — NOT the legacy
ENG-775 edge-Kafka shape. Supersedes the old AuditEventNode (allow/deny/cached/
signed status + actor/action/model). The new node mirrors AP00005's
AuditEventView (the cheap indexed METADATA view, ADR-123 D3): GCP-taxonomy
category + outcome, resolved actor/resource ORNs, the consumer-assigned
chain position (seq / chainKey), and the chain-link contentHash.
Source-of-truth: docs/architecture/AP00005-AUDIT-SERVICE-DESIGN.md §4.1 + ADR-123. Wire contract: AP00005-audit-svc/api/proto/audit/v1/audit.proto (vendored at the edge as api/proto/audit/v1/audit.proto for the bridge).
────────────────────────────────────────────────────────────────────────── Tenant isolation (load-bearing): the workspace is ALWAYS derived from the JWT (ctxkeys.WorkspaceID), NEVER from query/mutation input — defense-in-depth per ENG-777 SEC-H1; mirrors verifiedMemoryReceipts / receipts / auditEvents. The AuditFilter has NO workspaceId field by construction. AP00005 ADDITIONALLY binds the workspace from the OS-Workspace-ID transport header into its RLS GUC and cross-checks the request Scope (mismatch ⇒ OSY-AUDIT-7264) — the edge UI gate is never the only boundary.
Admin gating: auditExport (audit:export) + the litigation-hold mutations (audit:legal-hold) are admin-class. The edge resolver fail-closes on the JWT permission BEFORE the RPC, and AP00005 re-checks the scope + (for cross-tenant / legal-hold) an AP00009 admin assertion server-side. NEVER rely on the UI gate.
Until AUDIT_SERVICE_ADDR is configured the resolver returns OSY-AUDIT-NOT-WIRED via UnwiredAuditService (fail-closed; NO STUBS — never fabricated rows). Free-form JSON scalar reserved for forward-compatible metadata. gqlgen binds it to graphql.Map (map[string]interface{}).
Long
Epoch-SECONDS scalar for the Art-12 window bounds (the AP00005 overflow discipline — a JS number holds an epoch-seconds value without precision loss, but the FE authors it as a string, and gqlgen's Int64 binding accepts BOTH a JSON string and a number). The edge multiplies by 1000 to the proto epoch-ms GetArt12RecordRequest bounds. Distinct from DateTime (which is an ISO instant for OTHER surfaces).