feat: add GraphQL API with Absinthe at /api/v1/graphql

Wire up a full GraphQL endpoint covering all queries and mutations from
the existing blueprint schema. Includes Absinthe types, resolvers, auth
scope middleware, and tests for queries, mutations, scoping, and errors.

Author: raffaelschneider

lib/sentinel_cp_web/graphql/context.ex

@@ -0,0 +1,15 @@
+defmodule SentinelCpWeb.GraphQL.Context do
+  @moduledoc """
+  Plug that transfers conn assigns into the Absinthe context.
+  """
+  @behaviour Plug
+
+  @impl true
+  def init(opts), do: opts
+
+  @impl true
+  def call(conn, _opts) do
+    context = %{current_api_key: conn.assigns[:current_api_key]}
+    Absinthe.Plug.put_options(conn, context: context)
+  end
+end

lib/sentinel_cp_web/graphql/middleware/auth_scope.ex

@@ -0,0 +1,52 @@
+defmodule SentinelCpWeb.GraphQL.Middleware.AuthScope do
+  @moduledoc """
+  Absinthe middleware that enforces API key scope checks on GraphQL fields.
+  """
+  @behaviour Absinthe.Middleware
+
+  @scope_map %{
+    # Queries
+    project: "services:read",
+    projects: "services:read",
+    services: "services:read",
+    alert_rules: "services:read",
+    slos: "services:read",
+    policies: "services:read",
+    nodes: "nodes:read",
+    bundles: "bundles:read",
+    rollouts: "rollouts:read",
+    # Mutations
+    create_bundle: "bundles:write",
+    create_rollout: "rollouts:write",
+    pause_rollout: "rollouts:write",
+    resume_rollout: "rollouts:write"
+  }
+
+  @impl true
+  def call(%{context: context} = resolution, _config) do
+    api_key = context[:current_api_key]
+    field = resolution.definition.schema_node.identifier
+
+    required_scope = Map.get(@scope_map, field)
+
+    cond do
+      # No scope mapping means no restriction
+      is_nil(required_scope) ->
+        resolution
+
+      # Legacy keys with empty scopes get full access
+      api_key && api_key.scopes == [] ->
+        resolution
+
+      # Check if the key has the required scope
+      api_key && required_scope in api_key.scopes ->
+        resolution
+
+      true ->
+        Absinthe.Resolution.put_result(
+          resolution,
+          {:error, "Insufficient scope. Required: #{required_scope}"}
+        )
+    end
+  end
+end

lib/sentinel_cp_web/graphql/resolvers/bundles.ex

@@ -0,0 +1,43 @@
+defmodule SentinelCpWeb.GraphQL.Resolvers.Bundles do
+  @moduledoc false
+  alias SentinelCp.Audit
+  alias SentinelCp.Bundles
+
+  def list(_parent, %{project_id: project_id} = args, _resolution) do
+    opts = if args[:limit], do: [limit: args[:limit]], else: []
+    {:ok, Bundles.list_bundles(project_id, opts)}
+  end
+
+  def list_for_project(project, args, _resolution) do
+    opts = if args[:limit], do: [limit: args[:limit]], else: []
+    {:ok, Bundles.list_bundles(project.id, opts)}
+  end
+
+  def create(_parent, %{input: input}, %{context: context}) do
+    case Bundles.create_bundle(input) do
+      {:ok, bundle} ->
+        if api_key = context[:current_api_key] do
+          Audit.log_api_key_action(api_key, "create", "bundle", bundle.id,
+            project_id: bundle.project_id
+          )
+        end
+
+        {:ok, bundle}
+
+      {:error, %Ecto.Changeset{} = changeset} ->
+        {:error, format_errors(changeset)}
+
+      {:error, reason} ->
+        {:error, to_string(reason)}
+    end
+  end
+
+  defp format_errors(changeset) do
+    Ecto.Changeset.traverse_errors(changeset, fn {msg, opts} ->
+      Regex.replace(~r"%{(\w+)}", msg, fn _, key ->
+        opts |> Keyword.get(String.to_existing_atom(key), key) |> to_string()
+      end)
+    end)
+    |> Enum.map_join("; ", fn {field, errors} -> "#{field}: #{Enum.join(errors, ", ")}" end)
+  end
+end

lib/sentinel_cp_web/graphql/resolvers/nodes.ex

@@ -0,0 +1,12 @@
+defmodule SentinelCpWeb.GraphQL.Resolvers.Nodes do
+  @moduledoc false
+  alias SentinelCp.Nodes
+
+  def list(_parent, %{project_id: project_id}, _resolution) do
+    {:ok, Nodes.list_nodes(project_id)}
+  end
+
+  def list_for_project(project, _args, _resolution) do
+    {:ok, Nodes.list_nodes(project.id)}
+  end
+end

lib/sentinel_cp_web/graphql/resolvers/observability.ex

@@ -0,0 +1,12 @@
+defmodule SentinelCpWeb.GraphQL.Resolvers.Observability do
+  @moduledoc false
+  alias SentinelCp.Observability
+
+  def list_alert_rules(_parent, %{project_id: project_id}, _resolution) do
+    {:ok, Observability.list_alert_rules(project_id)}
+  end
+
+  def list_slos(_parent, %{project_id: project_id}, _resolution) do
+    {:ok, Observability.list_slos(project_id)}
+  end
+end

lib/sentinel_cp_web/graphql/resolvers/policies.ex

@@ -0,0 +1,8 @@
+defmodule SentinelCpWeb.GraphQL.Resolvers.Policies do
+  @moduledoc false
+  alias SentinelCp.Policies
+
+  def list(_parent, %{project_id: project_id}, _resolution) do
+    {:ok, Policies.list_policies(project_id)}
+  end
+end

lib/sentinel_cp_web/graphql/resolvers/projects.ex

@@ -0,0 +1,27 @@
+defmodule SentinelCpWeb.GraphQL.Resolvers.Projects do
+  @moduledoc false
+  alias SentinelCp.Projects
+
+  def get(_parent, %{id: id}, _resolution) do
+    case Projects.get_project(id) do
+      nil -> {:error, "Project not found"}
+      project -> {:ok, project}
+    end
+  end
+
+  def get(_parent, %{slug: slug}, _resolution) do
+    case Projects.get_project_by_slug(slug) do
+      nil -> {:error, "Project not found"}
+      project -> {:ok, project}
+    end
+  end
+
+  def get(_parent, _args, _resolution) do
+    {:error, "Either id or slug is required"}
+  end
+
+  def list(_parent, args, _resolution) do
+    opts = if args[:org_id], do: [org_id: args[:org_id]], else: []
+    {:ok, Projects.list_projects(opts)}
+  end
+end

lib/sentinel_cp_web/graphql/resolvers/rollouts.ex

@@ -0,0 +1,81 @@
+defmodule SentinelCpWeb.GraphQL.Resolvers.Rollouts do
+  @moduledoc false
+  alias SentinelCp.Audit
+  alias SentinelCp.Rollouts
+
+  def list(_parent, %{project_id: project_id}, _resolution) do
+    {:ok, Rollouts.list_rollouts(project_id)}
+  end
+
+  def list_for_project(project, _args, _resolution) do
+    {:ok, Rollouts.list_rollouts(project.id)}
+  end
+
+  def create(_parent, %{input: input}, %{context: context}) do
+    case Rollouts.create_rollout(input) do
+      {:ok, rollout} ->
+        audit(context, "create", "rollout", rollout.id, rollout.project_id)
+        {:ok, rollout}
+
+      {:error, %Ecto.Changeset{} = changeset} ->
+        {:error, format_errors(changeset)}
+
+      {:error, reason} ->
+        {:error, to_string(reason)}
+    end
+  end
+
+  def pause(_parent, %{id: id}, %{context: context}) do
+    with_rollout(id, fn rollout ->
+      case Rollouts.pause_rollout(rollout) do
+        {:ok, updated} ->
+          audit(context, "pause", "rollout", id, rollout.project_id)
+          {:ok, updated}
+
+        {:error, reason} ->
+          {:error, to_string(reason)}
+      end
+    end)
+  end
+
+  def resume(_parent, %{id: id}, %{context: context}) do
+    with_rollout(id, fn rollout ->
+      case Rollouts.resume_rollout(rollout) do
+        {:ok, updated} ->
+          audit(context, "resume", "rollout", id, rollout.project_id)
+          {:ok, updated}
+
+        {:error, reason} ->
+          {:error, to_string(reason)}
+      end
+    end)
+  end
+
+  def resolve_progress(rollout, _args, _resolution) do
+    {:ok, Rollouts.get_rollout_progress(rollout.id)}
+  end
+
+  defp with_rollout(id, fun) do
+    case Rollouts.get_rollout(id) do
+      nil -> {:error, "Rollout not found"}
+      rollout -> fun.(rollout)
+    end
+  end
+
+  defp audit(context, action, resource_type, resource_id, project_id) do
+    if api_key = context[:current_api_key] do
+      Audit.log_api_key_action(api_key, action, resource_type, resource_id,
+        project_id: project_id
+      )
+    end
+  end
+
+  defp format_errors(changeset) do
+    Ecto.Changeset.traverse_errors(changeset, fn {msg, opts} ->
+      Regex.replace(~r"%{(\w+)}", msg, fn _, key ->
+        opts |> Keyword.get(String.to_existing_atom(key), key) |> to_string()
+      end)
+    end)
+    |> Enum.map_join("; ", fn {field, errors} -> "#{field}: #{Enum.join(errors, ", ")}" end)
+  end
+end

lib/sentinel_cp_web/graphql/resolvers/services.ex

@@ -0,0 +1,12 @@
+defmodule SentinelCpWeb.GraphQL.Resolvers.Services do
+  @moduledoc false
+  alias SentinelCp.Services
+
+  def list(_parent, %{project_id: project_id}, _resolution) do
+    {:ok, Services.list_services(project_id)}
+  end
+
+  def list_for_project(project, _args, _resolution) do
+    {:ok, Services.list_services(project.id)}
+  end
+end

lib/sentinel_cp_web/graphql/schema.ex

@@ -0,0 +1,35 @@
+defmodule SentinelCpWeb.GraphQL.Schema do
+  @moduledoc false
+  use Absinthe.Schema
+
+  import_types(SentinelCpWeb.GraphQL.Types.CustomScalars)
+  import_types(SentinelCpWeb.GraphQL.Types.Project)
+  import_types(SentinelCpWeb.GraphQL.Types.Service)
+  import_types(SentinelCpWeb.GraphQL.Types.Node)
+  import_types(SentinelCpWeb.GraphQL.Types.Bundle)
+  import_types(SentinelCpWeb.GraphQL.Types.Rollout)
+  import_types(SentinelCpWeb.GraphQL.Types.Observability)
+  import_types(SentinelCpWeb.GraphQL.Types.Policy)
+
+  query do
+    import_fields(:project_queries)
+    import_fields(:service_queries)
+    import_fields(:node_queries)
+    import_fields(:bundle_queries)
+    import_fields(:rollout_queries)
+    import_fields(:observability_queries)
+    import_fields(:policy_queries)
+  end
+
+  mutation do
+    import_fields(:bundle_mutations)
+    import_fields(:rollout_mutations)
+  end
+
+  def middleware(middleware, _field, %Absinthe.Type.Object{identifier: identifier})
+      when identifier in [:query, :mutation] do
+    [SentinelCpWeb.GraphQL.Middleware.AuthScope | middleware]
+  end
+
+  def middleware(middleware, _field, _object), do: middleware
+end