IAM module

[gearnode]

Summary by cubic

Unifies auth and authz into a single IAM module and introduces the Connect v1 GraphQL API with split Relay environments. Refreshes IAM Organizations with session switching and SAML domain verification, and replugged Custom Domain settings and employee document signing pages.

• New Features

  • IAM service for sign-in/signup (password/invitation), password reset, email management, organization/membership, permissions, sessions (including assume organization session), and API keys.
  • New IAM Sign-In page and Memberships experience with dropdown/session controls; session dropdown added for profile/sign-out.
  • Personal API Keys page to create, reveal, and revoke tokens via IAM GraphQL.
  • Session model extended with expire_reason, user_agent, ip_address, tenant_id, parent_session, plus new order fields; membership exposes lastSession and activeSession.
  • Connect v1 GraphQL API with session middleware and API key auth; console/MCP/trust endpoints now use IAM.
  • SAML services moved under IAM with domain verification and test login; handlers updated.
  • Relay package for GraphQL fetch with auth error mapping; console uses a multi-project Relay config (core, iam) with separate environments and new Core/IAM Relay providers.
  • Permission field exposed on core schema nodes; UI gates create/update/delete/publish and signature actions across core pages (documents, assets, audits, data, continual improvements, meetings, frameworks, custom domains).

• Migration

  • Apply DB migrations adding session columns and the expire_reason enum, plus expire_reason on auth_user_api_keys.
  • Prefix related tables with iam_.
  • Update application config with the new IAM settings and cookie details.
  • Replace auth/authz usages with iam.Service and iam.Permissions in server code.

^{Written for commit c91f470. Summary will update on new commits.}