"""
Mutation allows to insert new data or modify the existing data on the server-side related to users and their identities.
All SettingsV2 mutations require an Authorization header with a valid JWT.
"""
type Mutation {
    activateUser(identityId: String!): Identity
    """
    This mutation is used to add a new user and can take PP roles. It is used by SettingsV1.
    It adds roles to many tenants.
    """
    addUserIdentity(
        identity: IdentityInput!
        resourceAccess: [ResourceAccessInput!]!
        overwriteExistingAccess: Boolean! = true
            @deprecated(
                reason: "Platform-3861: Used for bulk operations, not needed anymore"
            )
        tenantRoles: [IdentityTenantRolesCreateInput!]! = []
        userMetadataFlags: [UserMetadataFlag!]! = []
        masterContact: Boolean = false
        createAuth0User: Boolean = true
    ): Identity!
    """
    createIdentity is the mutation used by the SettingsV2.
    It creates a new identity and assigns roles for a single tenant.
    It will support PP roles soon: https://theorchard.atlassian.net/browse/PLATFORM-4299
    """
    createIdentity(
        identity: IdentityInput!
        masterContact: Boolean = false
        sendInvite: Boolean = true
        tenantProfileRoles: TenantProfileRolesCreateInput!
    ): Identity!
    """
    Used by SEAT to create an internal identity (employee).
    """
    createInternalIdentity(
        identity: IdentityInput!
        """
        defaultBrand should be included if tenant type is parent company, but not account.
        """
        defaultBrand: String
        tenantProfileRoles: TenantProfileRolesCreateInput!
    ): CreateInternalIdentityResult! @tag(name: "internal")
    """
    This mutation is used to deactivate a user. It is used by the SettingsV1.
    It depends on the overlap of access between the identity and the admin.
    """
    deactivateUser(identityId: String!): Identity
    """
    This mutation is used to edit a user. It is used by the SettingsV1.
    It supports multiple tenants and can revoke access to some tenants while adding access to others.
    """
    editUserIdentity(
        identityId: String!
        resourceAccess: [ResourceAccessInput!]!
        """
        Defaulting to true here maintains the expectation that frontend consumers
        of this endpoint must provide an identity's _entire_ resourceAccess.
        This is in contrast to any service consuming the /edit-resources-profiles
        endpoint directly, which defaults overwriteExistingAccess to false.
        This is in line with the expectation that the edit endpoint should allow
        modifications to the identity's resourceAccess without necessarily wiping
        everything first.
        """
        overwriteExistingAccess: Boolean! = true
            @deprecated(
                reason: "Platform-3861: Used for bulk operations, not needed anymore"
            )
    ): Identity!
    notifyNrDeliveryOrderCompleted(orderId: ID!): Boolean!
    notifyNrDeliveryOrderFailed(orderId: ID!): Boolean!
    notifyNrOwnershipDeliveryOrderCompleted(orderId: ID!): Boolean!
    notifyNrOwnershipDeliveryOrderFailed(orderId: ID!): Boolean!
    notifyPhysicalDeliveryOrderCompleted(orderId: ID!): Boolean!
    notifyPhysicalDeliveryOrderFailed(orderId: ID!): Boolean!
    recordCountryFilter(input: RecordCountryFilterInput!): CountryFilter!
    resendInvitation(identity: InvitationInput!): Boolean!
    resendVerifyEmail(auth0Id: String!): Boolean!
    resetMFADevices(auth0Id: String!): Boolean
    """
    resetPassword sends a reset password email for an art-relation's user to change it later in an Auth0 form
    """
    resetPassword(email: String!): Boolean
    """
    revokeAllTenantAccess removes all roles for all tenants that the admin and the user have shared access to.
    Used by SettingsV2, and requires only the admin's Authorization token. This mutation orchestrates calls to
    ows-permissions (PLATFORM-4237) and PP (PP-840).
    """
    revokeAllTenantAccess(identityId: UUIDv4!): Identity!
    """
    revokeInternalAllTenantAccess removes all roles for all tenants of an internal identity.
    Used by SEAT.
    """
    revokeInternalAllTenantAccess(
        identityId: UUIDv4!
    ): RevokeInternalAllTenantAccessResult!
    """
    revokeTenantAccess removes all roles for a single identity-tenant pair. Used by SettingsV2.
    It is integrated with PP.
    """
    revokeTenantAccess(
        identityId: UUIDv4!
        tenantType: TenantType!
        tenantUuid: UUID!
    ): Identity!
    """
    setIdentityTenantRoles attaches and detaches roles for a single identity-tenant pair.
    This mutation is WIP!

    **Only use this mutation if your application is on-boarded to PP.**
    """
    setIdentityTenantRoles(
        input: IdentityTenantRolesInput!
    ): SetIdentityTenantRolesResult!
    """
    This mutation is used to update an identity. It is used by SettingsV2.
    It updates the roles on a single tenant and does not allow removing all roles and act like a revoke.
    It is integrated with PP.
    """
    updateIdentity(
        identityId: UUIDv4!
        tenantProfileRoles: TenantProfileRolesUpdateInput!
    ): Identity!
    updateIdentitySubscription(
        name: String!
        followAllResources: Boolean
        followResources: [String]
        # This explicitly passed identity ID is used to edit subscriptions on another user's behalf
        # if the requesting admin can administer it.
        identityId: ID
        overwrite: Boolean
    ): Boolean
    """
    Used by SEAT to update an internal identity (employee).
    """
    updateInternalIdentity(
        identityId: UUIDv4!
        tenantProfileRoles: TenantProfileRolesUpdateInput!
        """
        Optional defaultBrand param for reactivation cases.
        If the internal identity is not being reactivated, this param will be ignored.
        """
        defaultBrand: String
    ): UpdateInternalIdentityResult! @tag(name: "internal")
    updateUserDetails(
        email: String
        firstName: String
        lastName: String
        auth0UserId: String
        auth0Primary: Int
        localization: String
        numberFormat: String
        dateFormat: String
    ): Identity
}

"""
ResourceAccessInput describes resource access structure that should be added or updated for identity.
"""
input ResourceAccessInput {
    roles: [Role!]!
    type: String!
    updatedOn: DateTime
    uuid: ID!
}
"""
IdentityInput describes all basic that should be set for create an identity.
"""
input IdentityInput {
    email: String!
    firstName: String!
    lastName: String!
    localization: String
    name: String
}
"""
UserMetadataFlag includes the label for the user metadata flag that indicates whether or not the user has opted in
to receive email notifications about new resources, vendor_name and value as JSON.
"""
input UserMetadataFlag {
    label: UserMetadataLabel!
    value: JSON!
}
"""
InvitationInput describes all basic attributes that should be set for sent invitation: brand, email and vendContactId of user.
"""
input InvitationInput {
    defaultBrand: String!
    email: String!
    vendContactId: Int
}
"""
RecordCountryFilterInput manages available countries and max records for them.
"""
input RecordCountryFilterInput {
    countries: [String!]!
    maxRecords: Int!
}

enum UserMetadataLabel {
    """
    This is the label for the user metadata flag that indicates whether or not
    the user has opted in to receive email notifications about new resources
    """
    INVOKED_FROM_LAMBDA
    SHOULD_SEND_COLLABORATOR_ACCESS_EMAIL
    VENDOR_NAME
}

input TenantProfileRolesCreateInput {
    """
    roles contains the list of RoleV2 to add
    to the identity's roles for the tenant.
    """
    rolesToAttach: [ID!]!
    """
    Tenant's type for which roles should be added.
    """
    tenantType: TenantType!
    """
    Tenant's UUID for which roles should be added.
    """
    tenantUuid: UUID!
}

input TenantProfileRolesUpdateInput {
    """
    rolesToAttach contains the list of RoleV2 to add
    from the identity's roles on the tenant.
    """
    rolesToAttach: [ID!]!
    """
    rolesToDetach contains the list of RoleV2 to remove
    from the identity's roles on the tenant.
    """
    rolesToDetach: [ID!]!
    """
    Tenant's type for which roles should be added.
    """
    tenantType: TenantType!
    """
    Tenant's UUID for which roles should be added.
    """
    tenantUuid: UUID!
}

"""
Result type for createInternalIdentity mutation.
Returns the Identity if successfully created, or an error object if the request failed.
"""
union CreateInternalIdentityResult = Identity | CreateInternalIdentityError
"""
Result type of updateInternalIdentity mutation.
Returns the updated Identity if successfully updated, or an error object if the request failed.
"""
union UpdateInternalIdentityResult = Identity | UpdateInternalIdentityError
"""
Result type of revokeInternalAllTenantAccess mutation.
Returns the deleted Identity if successfully deleted, or an error object if the request failed.
"""
union RevokeInternalAllTenantAccessResult =
    | Identity
    | RevokeInternalAllTenantAccessError