(#150) Add PlatformService.GetConfig and refactor ConfigValues proto

Problem:
The use of google.protobuf.Any was making it awkward to work with the
data provided by the user.  The structure of the form data is defined by
the platform engineer, so the intent of Any was to wrap the data in a
way we can pass over the network and persist in the database.

The escaped JSON encoding was problematic and error prone to decode on
the other end.

Solution:
Define the Platform values as a two level map with string keys, but with
protobuf message fields "sections" and "fields" respectively.  Use
google.protobuf.Value from the struct package to encode the actual
value.

Result:
In TypeScript, google.protobuf.Value encodes and decodes easily to a
JSON value.  On the go side, connect correctly handles the value as
well.

No more ugly error prone escaping:

```
❯ grpcurl -H "x-oidc-id-token: $(holos token)" -d '{"platform_id":"'${platformId}'"}' $host holos.v1alpha1.PlatformService.GetConfig
{
  "sections": {
    "org": {
      "fields": {
        "contactEmail": "jeff@openinfrastructure.co",
        "displayName": "Open Infrastructure Services LLC",
        "domain": "ois.run",
        "name": "ois"
      }
    }
  }
}
```

This return value is intended to be directly usable in the CUE code, so
we may further nest the values into a platform.spec key.

Tiltfile

@@ -99,6 +99,7 @@ docker_build_with_restart(
         '--listen-port={}'.format(listen_port),
         '--oidc-issuer=https://login.ois.run',
         '--oidc-audience=262096764402729854@holos_platform',
+        '--log-level=debug',
         '--metrics-port={}'.format(metrics_port),
     ],
     dockerfile='./hack/tilt/Dockerfile',
@@ -190,7 +191,7 @@ k8s_resource(
     ],
     resource_deps=[compile_id],
     links=[
-        link('https://{}.holos.dev.k2.ois.run/app/'.format(developer), "Holos Web UI")
+        link('https://{}.app.dev.k2.holos.run/ui/'.format(developer), "Holos Web UI")
     ],
 )
 
@@ -200,11 +201,6 @@ k8s_resource(
     new_name=auth_id,
     objects=[
       '{}:virtualservice'.format(holos_server),
-      '{}-allow-groups:authorizationpolicy'.format(holos_server),
-      '{}-allow-nothing:authorizationpolicy'.format(holos_server),
-      '{}-allow-well-known-paths:authorizationpolicy'.format(holos_server),
-      '{}-auth:authorizationpolicy'.format(holos_server),
-      '{}:requestauthentication'.format(holos_server),
     ],
 )
 

api/v1alpha1/buildplan.go

@@ -9,8 +9,9 @@ import (
 type BuildPlan struct {
 	TypeMeta `json:",inline" yaml:",inline"`
 	// Metadata represents the holos component name
-	Metadata ObjectMeta    `json:"metadata,omitempty" yaml:"metadata,omitempty"`
-	Spec     BuildPlanSpec `json:"spec,omitempty" yaml:"spec,omitempty"`
+	Metadata ObjectMeta     `json:"metadata,omitempty" yaml:"metadata,omitempty"`
+	Spec     BuildPlanSpec  `json:"spec,omitempty" yaml:"spec,omitempty"`
+	Platform map[string]any `json:"platform,omitempty" yaml:"platform,omitempty"`
 }
 
 type BuildPlanSpec struct {

buf.gen.yaml

@@ -11,14 +11,14 @@ plugins:
     out: service/gen
     opt: paths=source_relative
   - plugin: es
-    out: internal/frontend/holos/gen
+    out: internal/frontend/holos/src/app/gen
     opt:
       - target=ts
   - plugin: connect-es
-    out: internal/frontend/holos/gen
+    out: internal/frontend/holos/src/app/gen
     opt:
       - target=ts
   - plugin: connect-query
-    out: internal/frontend/holos/gen
+    out: internal/frontend/holos/src/app/gen
     opt:
       - target=ts

docs/examples/authpolicy.cue

@@ -2,7 +2,10 @@ package holos
 
 import ap "security.istio.io/authorizationpolicy/v1"
 
-// #AuthPolicyRules represents AuthorizationPolicy rules for hosts that need specialized treatment.  Entries in this struct are exclused from the blank ingressauth AuthorizationPolicy governing the ingressgateway and included in a spcialized policy
+// #AuthPolicyRules represents AuthorizationPolicy rules for hosts that need
+// specialized treatment.  Entries in this struct are excluded from
+// AuthorizationPolicy/authproxy-custom in the istio-ingress namespace.  Entries
+// are added to their own AuthorizationPolicy.
 #AuthPolicyRules: {
 	// AuthProxySpec represents the identity provider configuration
 	AuthProxySpec: #AuthProxySpec & #Platform.authproxy
@@ -14,6 +17,9 @@ import ap "security.istio.io/authorizationpolicy/v1"
 			name: Name
 			// slug is the resource name prefix
 			slug: string
+			// NoAuthorizationPolicy disables an AuthorizationPolicy for the host
+			NoAuthorizationPolicy: true | *false
+
 			// Refer to https://istio.io/latest/docs/reference/config/security/authorization-policy/#Rule
 			spec: ap.#AuthorizationPolicySpec & {
 				action: "CUSTOM"
@@ -25,11 +31,13 @@ import ap "security.istio.io/authorizationpolicy/v1"
 
 	objects: #APIObjects & {
 		for Host in hosts {
-			apiObjects: {
-				AuthorizationPolicy: "\(Host.slug)-custom": {
-					metadata: namespace: "istio-ingress"
-					metadata: name:      "\(Host.slug)-custom"
-					spec: Host.spec
+			if Host.NoAuthorizationPolicy == false {
+				apiObjects: {
+					AuthorizationPolicy: "\(Host.slug)-custom": {
+						metadata: namespace: "istio-ingress"
+						metadata: name:      "\(Host.slug)-custom"
+						spec: Host.spec
+					}
 				}
 			}
 		}

docs/examples/platforms/holos-saas/clusters/provisioner/choria/broker/broker.cue

@@ -1,13 +1,13 @@
 package holos
 
 let Namespace = "jeff-holos"
-let Broker = "broker"
+let Broker = "choria-broker"
 
 spec: components: KubernetesObjectsList: [
 	#KubernetesObjects & {
 		_dependsOn: "prod-platform-issuer": _
 
-		metadata: name: "\(Namespace)-broker"
+		metadata: name: "\(Namespace)-\(Broker)"
 		apiObjectMap: OBJECTS.apiObjectMap
 	},
 ]
@@ -31,9 +31,6 @@ let OBJECTS = #APIObjects & {
 					Broker,
 					"\(Broker).\(Namespace).svc",
 					"\(Broker).\(Namespace).svc.cluster.local",
-					"provision-\(Broker)",
-					"provision-\(Broker).\(Namespace).svc",
-					"provision-\(Broker).\(Namespace).svc.cluster.local",
 					"*.\(Broker)",
 					"*.\(Broker).\(Namespace).svc",
 					"*.\(Broker).\(Namespace).svc.cluster.local",

docs/examples/platforms/holos-saas/clusters/provisioner/choria/provisioner/provsioner.cue

@@ -0,0 +1,45 @@
+package holos
+
+let Namespace = "jeff-holos"
+let Provisioner = "choria-provisioner"
+
+spec: components: KubernetesObjectsList: [
+	#KubernetesObjects & {
+		_dependsOn: "prod-platform-issuer": _
+
+		metadata: name: "\(Namespace)-\(Provisioner)"
+		apiObjectMap: OBJECTS.apiObjectMap
+	},
+]
+
+let SelectorLabels = {
+	"app.kubernetes.io/instance": Provisioner
+	"app.kubernetes.io/name":     Provisioner
+}
+
+let OBJECTS = #APIObjects & {
+	apiObjects: {
+		Certificate: "\(Provisioner)-tls": #Certificate & {
+			metadata: {
+				name:      "\(Provisioner)-tls"
+				namespace: Namespace
+				labels:    SelectorLabels
+			}
+			spec: {
+				commonName: "\(Provisioner).\(Namespace).svc.cluster.local"
+				dnsNames: [
+					Provisioner,
+					"\(Provisioner).\(Namespace).svc",
+					"\(Provisioner).\(Namespace).svc.cluster.local",
+					"*.\(Provisioner)",
+					"*.\(Provisioner).\(Namespace).svc",
+					"*.\(Provisioner).\(Namespace).svc.cluster.local",
+				]
+				issuerRef: kind: "ClusterIssuer"
+				issuerRef: name: "platform-issuer"
+				secretName: metadata.name
+				usages: ["signing", "key encipherment", "server auth", "client auth"]
+			}
+		}
+	}
+}

docs/examples/platforms/holos-saas/clusters/workload/choria/broker/broker.cue

@@ -1,20 +1,20 @@
 package holos
 
 let Namespace = "jeff-holos"
-let Broker = "broker"
+let Broker = "choria-broker"
 
 spec: components: KubernetesObjectsList: [
 	#KubernetesObjects & {
 		_dependsOn: "prod-secrets-stores": _
 
-		metadata: name: "\(Namespace)-broker"
+		metadata: name: "\(Namespace)-\(Broker)"
 		apiObjectMap: OBJECTS.apiObjectMap
 	},
 ]
 
 let SelectorLabels = {
-	"app.kubernetes.io/instance": Broker
-	"app.kubernetes.io/name":     Broker
+	"app.kubernetes.io/part-of": "choria"
+	"app.kubernetes.io/name":    Broker
 }
 
 let Metadata = {
@@ -29,8 +29,8 @@ let OBJECTS = #APIObjects & {
 			metadata: name:      "\(Broker)-tls"
 			metadata: namespace: Namespace
 		}
-		ExternalSecret: "choria-\(Broker)": #ExternalSecret & {
-			metadata: name:      "choria-\(Broker)"
+		ExternalSecret: "\(Broker)": #ExternalSecret & {
+			metadata: name:      Broker
 			metadata: namespace: Namespace
 		}
 		StatefulSet: "\(Broker)": {
@@ -92,7 +92,7 @@ let OBJECTS = #APIObjects & {
 					volumes: [
 						{
 							name: Broker
-							secret: secretName: "choria-\(Broker)"
+							secret: secretName: Broker
 						},
 						{
 							name: "\(Broker)-tls"
@@ -137,11 +137,20 @@ let OBJECTS = #APIObjects & {
 			}
 		}
 		DestinationRule: "\(Broker)-wss": #DestinationRule & {
-			metadata: Metadata
+			_decriptions: "Configures Istio to connect to Choria using a cert issued by the Platform Issuer"
+			metadata:     Metadata
 			spec: host: "\(Broker).\(Namespace).svc.cluster.local"
 			spec: trafficPolicy: tls: {
 				credentialName: "istio-ingress-mtls-cert"
 				mode:           "MUTUAL"
+				// subjectAltNames is important, otherwise istio will fail to verify the
+				// choria broker upstream server.  make sure this matches a value
+				// present in the choria broker's cert.
+				//
+				//  kubectl get secret choria-broker-tls -o json | jq --exit-status
+				//  '.data | map_values(@base64d)' | jq .\"tls.crt\" -r | openssl x509
+				//  -text -noout -in -
+				subjectAltNames: [spec.host]
 			}
 		}
 		VirtualService: "\(Broker)-wss": #VirtualService & {

docs/examples/platforms/holos-saas/clusters/workload/choria/broker/reference.yaml

@@ -1,220 +0,0 @@
-# build output from https://github.com/holos-run/holos-infra/blob/main/experiments/components/holos-saas/broker/build
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  labels:
-    app.kubernetes.io/instance: broker
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: broker
-    app.kubernetes.io/version: 0.1.0
-    helm.sh/chart: broker-0.1.0
-  name: broker
----
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app.kubernetes.io/instance: broker
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: broker
-    app.kubernetes.io/version: 0.1.0
-    helm.sh/chart: broker-0.1.0
-  name: broker
-spec:
-  clusterIP: None
-  ports:
-  - appProtocol: tcp
-    name: tcp-nats
-    port: 4222
-    protocol: TCP
-    targetPort: tcp-nats
-  - appProtocol: tcp
-    name: tcp-cluster
-    port: 5222
-    protocol: TCP
-    targetPort: tcp-cluster
-  - appProtocol: https
-    name: https-wss
-    port: 443
-    protocol: TCP
-    targetPort: https-wss
-  selector:
-    app.kubernetes.io/instance: broker
-    app.kubernetes.io/name: broker
-  type: ClusterIP
----
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app.kubernetes.io/instance: broker
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: broker
-    app.kubernetes.io/version: 0.1.0
-    helm.sh/chart: broker-0.1.0
-  name: broker-lb
-spec:
-  externalTrafficPolicy: Local
-  loadBalancerIP: 1.2.3.4
-  ports:
-  - appProtocol: tcp
-    name: tcp-nats
-    port: 4222
-    protocol: TCP
-    targetPort: tcp-nats
-  - appProtocol: https
-    name: https-wss
-    port: 443
-    protocol: TCP
-    targetPort: https-wss
-  selector:
-    app.kubernetes.io/instance: broker
-    app.kubernetes.io/name: broker
-  type: LoadBalancer
----
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  labels:
-    app.kubernetes.io/instance: broker
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: broker
-    app.kubernetes.io/version: 0.1.0
-    helm.sh/chart: broker-0.1.0
-  name: broker
-spec:
-  replicas: 3
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: broker
-      app.kubernetes.io/name: broker
-  serviceName: broker
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: broker
-        app.kubernetes.io/name: broker
-    spec:
-      containers:
-      - command:
-        - choria
-        - broker
-        - run
-        - --config
-        - /etc/choria/broker.conf
-        image: registry.choria.io/choria/choria:latest
-        imagePullPolicy: Always
-        livenessProbe:
-          httpGet:
-            path: /healthz
-            port: http-stats
-        name: broker
-        ports:
-        - containerPort: 4222
-          name: tcp-nats
-          protocol: TCP
-        - containerPort: 4333
-          name: https-wss
-          protocol: TCP
-        - containerPort: 5222
-          name: tcp-cluster
-          protocol: TCP
-        - containerPort: 8222
-          name: http-stats
-          protocol: TCP
-        readinessProbe:
-          httpGet:
-            path: /healthz
-            port: http-stats
-        resources: {}
-        securityContext: {}
-        volumeMounts:
-        - mountPath: /etc/choria
-          name: broker
-        - mountPath: /etc/choria-tls
-          name: broker-tls
-      securityContext: {}
-      serviceAccountName: broker
-      volumes:
-      - name: broker
-        secret:
-          secretName: broker
-      - name: broker-tls
-        secret:
-          secretName: broker-tls
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: broker-tls
-  namespace: holos-dev
-spec:
-  commonName: broker.holos-dev.svc.cluster.local
-  dnsNames:
-  - broker
-  - broker.holos-dev.svc
-  - broker.holos-dev.svc.cluster.local
-  - provision-broker
-  - provision-broker.holos-dev.svc
-  - provision-broker.holos-dev.svc.cluster.local
-  - '*.broker'
-  - '*.broker.holos-dev.svc'
-  - '*.broker.holos-dev.svc.cluster.local'
-  issuerRef:
-    kind: ClusterIssuer
-    name: cluster-issuer
-  secretName: broker-tls
-  usages:
-  - signing
-  - key encipherment
-  - server auth
-  - client auth
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: broker
-spec:
-  dataFrom:
-  - extract:
-      key: kv//kube-namespace/holos-dev/broker
-  refreshInterval: 1h
-  secretStoreRef:
-    kind: SecretStore
-    name: core-vault
-  target:
-    creationPolicy: Owner
-    name: broker
----
-apiVersion: networking.istio.io/v1alpha3
-kind: DestinationRule
-metadata:
-  name: broker-wss
-  namespace: holos-dev
-spec:
-  host: broker.holos-dev.svc.cluster.local
-  trafficPolicy:
-    tls:
-      credentialName: istio-ingress-mtls-cert
-      mode: MUTUAL
----
-apiVersion: networking.istio.io/v1alpha3
-kind: VirtualService
-metadata:
-  name: broker-wss
-  namespace: holos-dev
-spec:
-  gateways:
-  - istio-ingress/wildcard-pub-gw
-  hosts:
-  - provision.pub.k2.holos.run
-  http:
-  - route:
-    - destination:
-        host: broker.holos-dev.svc.cluster.local
-        port:
-          number: 443
-        tls:
-          mode: SIMPLE
-

docs/examples/platforms/holos-saas/clusters/workload/choria/provisioner/Dockerfile

@@ -0,0 +1,18 @@
+FROM registry.choria.io/choria/provisioner:latest
+
+RUN curl -Lo nsc.zip https://github.com/nats-io/nsc/releases/download/v2.8.6/nsc-linux-amd64.zip &&\
+  unzip nsc.zip && \
+  mv nsc /usr/local/bin/nsc && \
+  chmod 755 /usr/local/bin/nsc && \
+  rm -f nsc.zip
+
+# TODO: Add jwt executable
+# TODO: Add helper executable
+
+USER choria
+ENV USER=choria
+
+ENTRYPOINT ["/usr/sbin/choria-provisioner"]
+
+# These two files are expected to be in the provisioner secret.
+CMD ["--config=/etc/provisioner/provisioner.yaml", "--choria-config=/etc/provisioner/choria.cfg"]

docs/examples/platforms/holos-saas/clusters/workload/choria/provisioner/provisioner.cue

@@ -0,0 +1,82 @@
+package holos
+
+let Namespace = "jeff-holos"
+let Provisioner = "choria-provisioner"
+
+spec: components: KubernetesObjectsList: [
+	#KubernetesObjects & {
+		_dependsOn: "prod-secrets-stores": _
+
+		metadata: name: "\(Namespace)-\(Provisioner)"
+		apiObjectMap: OBJECTS.apiObjectMap
+	},
+]
+
+let SelectorLabels = {
+	"app.kubernetes.io/instance": Provisioner
+	"app.kubernetes.io/name":     Provisioner
+}
+
+let Metadata = {
+	name:      Provisioner
+	namespace: Namespace
+	labels:    SelectorLabels
+}
+
+let OBJECTS = #APIObjects & {
+	apiObjects: {
+		ExternalSecret: "\(Provisioner)-tls": #ExternalSecret & {
+			metadata: name:      "\(Provisioner)-tls"
+			metadata: namespace: Namespace
+		}
+		ExternalSecret: "\(Provisioner)": #ExternalSecret & {
+			metadata: name:      Provisioner
+			metadata: namespace: Namespace
+		}
+		ServiceAccount: "\(Provisioner)": #ServiceAccount & {
+			metadata: Metadata
+		}
+		Deployment: "\(Provisioner)": {
+			metadata: Metadata
+			spec: {
+				selector: matchLabels: SelectorLabels
+				template: metadata: labels: SelectorLabels
+				template: spec: {
+					containers: [
+						{
+							name: Provisioner
+							command: ["bash", "/etc/provisioner/entrypoint"]
+							// skopeo inspect docker://registry.choria.io/choria/provisioner | jq .RepoTags
+							image:           "registry.choria.io/choria/provisioner:0.15.1"
+							imagePullPolicy: "IfNotPresent"
+							resources: {}
+							securityContext: {}
+							volumeMounts: [
+								{
+									mountPath: "/etc/provisioner"
+									name:      Provisioner
+								},
+								{
+									mountPath: "/etc/provisioner-tls"
+									name:      "\(Provisioner)-tls"
+								},
+							]
+						},
+					]
+					securityContext: {}
+					serviceAccountName: Provisioner
+					volumes: [
+						{
+							name: Provisioner
+							secret: secretName: name
+						},
+						{
+							name: "\(Provisioner)-tls"
+							secret: secretName: name
+						},
+					]
+				}
+			}
+		}
+	}
+}

docs/examples/platforms/reference/clusters/foundation/cloud/argocd/argocd.cue

@@ -71,14 +71,15 @@ let IstioInject = [{op: "add", path: "/spec/template/metadata/labels/sidecar.ist
 	}
 }
 
-// Probably shouldn't use the authproxy struct and should instead define an identity provider struct.
-let AuthProxySpec = #AuthProxySpec & #Platform.authproxy
+let OAuthClient = #Platform.oauthClients.argocd.spec
 
 let OIDCConfig = {
-	name:     "Holos Platform"
-	issuer:   AuthProxySpec.issuer
-	clientID: #Platform.argocd.clientID
-	requestedIDTokenClaims: groups: essential: true
-	requestedScopes: ["openid", "profile", "email", "groups", "urn:zitadel:iam:org:domain:primary:\(AuthProxySpec.orgDomain)"]
+	name:            "Holos Platform"
+	issuer:          OAuthClient.issuer
+	clientID:        OAuthClient.clientID
+	requestedScopes: OAuthClient.scopesList
+	// Set redirect uri to https://argocd.example.com/pkce/verify
 	enablePKCEAuthentication: true
+
+	requestedIDTokenClaims: groups: essential: true
 }

docs/examples/platforms/reference/clusters/foundation/cloud/mesh/mesh.cue

@@ -18,6 +18,10 @@ _IngressAuthProxy: {
 	Domains: (#Platform.org.domain):                    _
 	Domains: "\(#ClusterName).\(#Platform.org.domain)": _
 
+	// TODO: This should be generated from ProjectHosts
+	Domains: "holos.run":                 _
+	Domains: "\(#ClusterName).holos.run": _
+
 	let Metadata = {
 		name:      string
 		namespace: Namespace
@@ -271,11 +275,14 @@ _IngressAuthProxy: {
 					rules: [
 						{
 							to: [{
+								// Refer to https://istio.io/latest/docs/ops/best-practices/security/#writing-host-match-policies
 								operation: notHosts: [
 									// Never send requests for the login service through the authorizer, would block login.
 									AuthProxySpec.issuerHost,
+									"\(AuthProxySpec.issuerHost):*",
 									// Exclude hosts with specialized rules from the catch-all.
 									for x in _AuthPolicyRules.hosts {x.name},
+									for x in _AuthPolicyRules.hosts {"\(x.name):*"},
 								]
 							}]
 							when: [
@@ -298,7 +305,7 @@ _IngressAuthProxy: {
 _AuthPolicyRules: #AuthPolicyRules & {
 	hosts: {
 		let Vault = "vault.core.ois.run"
-		(Vault): {
+		"\(Vault)": {
 			slug: "vault"
 			// Rules for when to route requests through the auth proxy
 			spec: rules: [
@@ -321,3 +328,20 @@ _AuthPolicyRules: #AuthPolicyRules & {
 		}
 	}
 }
+
+// Exclude project hosts from the auth proxy if configured to do so.  The
+// intended effect is to exclude the host from the blanket `authproxy-custom`
+// AuthorizationPolicy rule _without_ adding a specialized AuthorizationPolicy
+// for the same host.  This has the effect of completely excluding the host from
+// authorization policy.
+for Project in _Projects {
+	let ProjectHosts = (#ProjectHosts & {project: Project}).Hosts
+
+	for FQDN, Host in ProjectHosts {
+		if Host.NoAuthorizationPolicy {
+			if Host.clusters[#ClusterName] != _|_ {
+				_AuthPolicyRules: hosts: "\(Host.fqdn)": NoAuthorizationPolicy: true
+			}
+		}
+	}
+}

docs/examples/platforms/reference/clusters/platform-projects.cue

@@ -43,9 +43,9 @@ _Projects: #Projects & {
 		// app is the holos web app and grpc api.
 		hosts: app: _
 		// provision is the choria broker provisioning system.
-		hosts: provision: _
+		hosts: provision: NoAuthorizationPolicy: true
 		// nats is the nats service holos controller machine room agents connect after provisioning.
-		hosts: nats: _
+		hosts: nats: NoAuthorizationPolicy: true
 	}
 
 	iam: {

docs/examples/platforms/reference/clusters/provisioner/platform-issuer/platform-issuer.cue

@@ -29,6 +29,7 @@ let OBJECTS = #APIObjects & {
 				metadata: name:      PlatformIssuer
 				metadata: namespace: Namespace
 				spec: {
+					duration:   "999999h"
 					isCA:       true
 					commonName: PlatformIssuer
 					secretName: PlatformIssuer

docs/examples/project-hosts.cue

@@ -104,6 +104,8 @@ import "strings"
 			// Host is valid on all project clusters.
 			clusters: clusterMap
 		}
+
+		NoAuthorizationPolicy: host.NoAuthorizationPolicy
 	}
 }
 
@@ -126,6 +128,10 @@ import "strings"
 	clusters: #ClusterMap
 	// hosts are always valid on the provisioner cluster
 	clusters: provisioner: _
+
+	// NoAuthorizationPolicy excludes the host from the auth proxy integrated with
+	// the default ingress Gateway.
+	NoAuthorizationPolicy: true | *false
 }
 
 #ClusterMap: [Name=string]: #Cluster & {name: Name}

docs/examples/project-template.cue

@@ -27,6 +27,9 @@ import (
 	project: #Project
 	let Project = project
 
+	// ProjectHosts represents all of the hosts associated with a project indexed
+	// by FQDN with #CertInfo values.  Slice and dice this struct as needed to
+	// work with hosts in the platform.
 	ProjectHosts: (#ProjectHosts & {project: Project}).Hosts
 
 	// GatewayServers maps Gateway spec.servers #GatewayServer values indexed by stage then name.

docs/examples/project_types.cue

@@ -68,8 +68,13 @@ _Projects: #Projects
 // #Cluster defines a cluster
 #Cluster: name: string
 
-// #Host defines a short hostname
-#Host: name: string
+#Host: {
+	// #Host defines a short hostname
+	name: string
+	// NoAuthorizationPolicy excludes the host from the auth proxy integrated with
+	// the default ingress Gateway.
+	NoAuthorizationPolicy: true | *false
+}
 
 #Environment: {
 	// name uniquely identifies the environment within the scope of the project.

go.mod

@@ -5,6 +5,7 @@ go 1.21.5
 require (
 	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.33.0-20240401165935-b983156c5e99.1
 	connectrpc.com/connect v1.16.0
+	connectrpc.com/grpcreflect v1.2.0
 	connectrpc.com/validate v0.1.0
 	cuelang.org/go v0.8.0
 	entgo.io/ent v0.13.1

go.sum

@@ -40,6 +40,8 @@ cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RX
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
 connectrpc.com/connect v1.16.0 h1:rdtfQjZ0OyFkWPTegBNcH7cwquGAN1WzyJy80oFNibg=
 connectrpc.com/connect v1.16.0/go.mod h1:XpZAduBQUySsb4/KO5JffORVkDI4B6/EYPi7N8xpNZw=
+connectrpc.com/grpcreflect v1.2.0 h1:Q6og1S7HinmtbEuBvARLNwYmTbhEGRpHDhqrPNlmK+U=
+connectrpc.com/grpcreflect v1.2.0/go.mod h1:nwSOKmE8nU5u/CidgHtPYk1PFI3U9ignz7iDMxOYkSY=
 connectrpc.com/otelconnect v0.7.0 h1:ZH55ZZtcJOTKWWLy3qmL4Pam4RzRWBJFOqTPyAqCXkY=
 connectrpc.com/otelconnect v0.7.0/go.mod h1:Bt2ivBymHZHqxvo4HkJ0EwHuUzQN6k2l0oH+mp/8nwc=
 connectrpc.com/validate v0.1.0 h1:r55jirxMK7HO/xZwVHj3w2XkVFarsUM77ZDy367NtH4=

hack/choria/initialize/README.md

@@ -1,5 +1,17 @@
 Initialize machine room provisioning credentials
 
+When you want the holos controller to provision while operating in the current
+working directory, run:
+
+ 1. `init-choria-provisioner-creds` to populate secrets in the Holos
+    Provisioner Cluster (not to be confused with the Choria Provisioner).
+ 2. `make-provisioning-jwt` to issue a `provisioning.jwt` file for `holos
+    controller` to use.
+ 3. `holos controller --config=agent.cfg` to read `provisioning.jwt` and write
+    the provisioned config file and credentials to the current directory.
+
+Expect the controller to provision.
+
 Setup Notes:
 
 The holos server flag `--provisioner-seed` must match the issuer.seed value.

hack/choria/initialize/init-choria-provisioner-creds

@@ -6,6 +6,9 @@ export PROVISIONER_TOKEN="$(LC_ALL=C tr -dc "[:alpha:]" </dev/random | tr '[:upp
 
 set -xeuo pipefail
 
+# Make sure gomplate is available
+gomplate --version
+
 PARENT="$(cd $(dirname "$0") && pwd)"
 TOPLEVEL="$(cd "${PARENT}" && git rev-parse --show-toplevel)"
 : "${NAMESPACE:=jeff-holos}"
@@ -33,7 +36,7 @@ echo -n "${PROVISIONER_TOKEN}" > ./provisioner/token
 # Provisioner signer
 choria jwt keys ./provisioner/signer.seed ./provisioner/signer.public
 choria jwt client ./provisioner/signer.jwt provisioner_signer ./issuer/issuer.seed \
-  --public-key "$(<provisioner/signer.public)" --server-provisioner --validity $((999*365))d --issuer
+  --public-key "$(<provisioner/signer.public)" --server-provisioner --validity $((100*365))d --issuer
 
 # Provisioner Secret
 mkdir -p provisioner/secret
@@ -57,5 +60,5 @@ choria jwt keys ./agents/signer.seed ./agents/signer.public
 # Now save the secrets
 holos create secret --append-hash=false --namespace $NAMESPACE choria-issuer --from-file=issuer
 holos create secret --append-hash=false --namespace $NAMESPACE choria-broker --from-file=broker
-holos create secret --append-hash=false --namespace $NAMESPACE choria-provisioner --from-file=provisioner
+holos create secret --append-hash=false --namespace $NAMESPACE choria-provisioner --from-file=provisioner/secret
 holos create secret --append-hash=false --namespace $NAMESPACE choria-agents --from-file=agents

hack/choria/initialize/make-provisioning-jwt

@@ -0,0 +1,50 @@
+#! /bin/bash
+#
+# Make a provisioner.jwt and put it in the current directory.
+#
+# Use the provisioner.jwt with `holos controller --config=controller.cfg` which
+# will read the jwt from the same directory as the config file.
+#
+# Refer to Arri's
+# [setup.sh](https://github.com/ripienaar/machine-room-mvp/blob/main/example/setup/setup.sh#L41)
+# And our own nites at https://github.com/holos-run/holos/issues/142
+
+PARENT="$(cd $(dirname "$0") && pwd)"
+OUTDIR="$(pwd)"
+
+: "${NAMESPACE:=jeff-holos}"
+
+tmpdir="$(mktemp -d)"
+finish() {
+  [[ -d "$tmpdir" ]] && rm -rvf "$tmpdir"
+}
+trap finish EXIT
+cd "$tmpdir"
+
+set -xeuo pipefail
+
+# e.g. jeff.provision.dev.k2.holos.run
+#
+kubectl -n $NAMESPACE get virtualservice choria-broker-wss -o json > vs.json
+jq --exit-status -r '.spec.hosts[0]' vs.json > host
+
+# Get the issuer.seed
+holos -n $NAMESPACE get secret choria-issuer --to-file issuer.seed
+
+# Get the provisioner token to embed in the provisioning.jwt file.
+holos -n $NAMESPACE get secret choria-provisioner --to-file token
+
+# The --token flag value must be the same value set in the token field of provisioner.yaml
+# Refer to https://github.com/ripienaar/machine-room-mvp/blob/main/example/setup/setup.sh#L41
+# Refer to https://github.com/ripienaar/machine-room-mvp/blob/main/example/setup/templates/provisioner/provisioner.yaml#L6
+choria jwt prov provisioning.jwt "issuer.seed" \
+  --token "$(<token)" \
+  --urls wss://$(<host):443 \
+  --default \
+  --protocol-v2 \
+  --insecure \
+  --update \
+  --validity 30d \
+  --extensions '{}'
+
+cp provisioning.jwt "${OUTDIR}/"

hack/choria/initialize/reset-choria-config

@@ -0,0 +1,23 @@
+#! /bin/bash
+#
+# This script resets the choria config for a Namespace
+
+PARENT="$(cd $(dirname "$0") && pwd)"
+: "${NAMESPACE:=jeff-holos}"
+export NAMESPACE
+
+set -xeuo pipefail
+
+KUBECONFIG=$HOME/.holos/kubeconfig.provisioner kubectl delete secret -n jeff-holos choria-agents choria-broker choria-provisioner choria-issuer
+
+"${PARENT}/init-choria-provisioner-creds"
+
+stamp="$(date)"
+
+kubectl -n $NAMESPACE annotate externalsecret choria-broker secret.holos.run/refresh="$stamp" --overwrite
+kubectl -n $NAMESPACE annotate externalsecret choria-provisioner secret.holos.run/refresh="$stamp" --overwrite
+
+kubectl -n $NAMESPACE wait --for='jsonpath={.status.conditions[?(@.type=="Ready")].status}=True' externalsecret choria-provisioner choria-broker
+
+kubectl -n $NAMESPACE rollout restart statefulset choria-broker
+kubectl -n $NAMESPACE rollout restart deployment choria-provisioner

hack/choria/initialize/templates/broker/broker.conf

@@ -6,11 +6,13 @@ plugin.choria.network.client_port = 4222
 plugin.choria.network.peer_port = 5222
 plugin.choria.network.system.user = system
 plugin.choria.network.system.password = system
-plugin.choria.network.peers = nats://broker-0.broker:5222,nats://broker-1.broker:5222,nats://broker-2.broker:5222
+plugin.choria.network.peers = nats://choria-broker-0.choria-broker:5222,nats://choria-broker-1.choria-broker:5222,nats://choria-broker-2.choria-broker:5222
 plugin.choria.use_srv = false
 plugin.choria.network.websocket_port = 4333
 
 plugin.security.provider = choria
+# NOTE: plugin.security.choria.ca must not be set or provisioning will fail
+# with a unhandled choria_provisioning purpose token error
 plugin.security.choria.certificate = /etc/choria-tls/tls.crt
 plugin.security.choria.key = /etc/choria-tls/tls.key
 plugin.security.choria.token_file = /etc/choria/broker.jwt

hack/choria/initialize/templates/provisioner/choria.cfg

@@ -4,4 +4,4 @@ plugin.security.choria.seed_file = /etc/provisioner/signer.seed
 
 identity = provisioner_signer
 
-plugin.choria.middleware_hosts = broker-0.broker:4222,broker-1.broker:4222,broker-2.broker:4222
+plugin.choria.middleware_hosts = choria-broker-0.choria-broker:4222,choria-broker-1.choria-broker:4222,choria-broker-2.choria-broker:4222

hack/choria/initialize/templates/provisioner/entrypoint

@@ -0,0 +1,9 @@
+#! /bin/bash
+#
+
+set -xeuo pipefail
+
+mkdir -p /home/choria/bin
+install -m 0755 /etc/provisioner/helper.rb /home/choria/bin/helper.rb
+
+exec /usr/sbin/choria-provisioner --config=/etc/provisioner/provisioner.yaml --choria-config=/etc/provisioner/choria.cfg

hack/choria/initialize/templates/provisioner/helper.rb

@@ -0,0 +1,134 @@
+#!/usr/bin/ruby
+
+require "json"
+require "yaml"
+require "base64"
+require "net/http"
+require "openssl"
+
+def parse_input
+  input = STDIN.read
+
+  begin
+    File.open("/tmp/request.json", "w") {|f| f.write(input)}
+  rescue Exception
+  end
+
+  request = JSON.parse(input)
+  request["inventory"] = JSON.parse(request["inventory"])
+
+  request
+end
+
+def validate!(request, reply)
+  if request["identity"] && request["identity"].length == 0
+    reply["msg"] = "No identity received in request"
+    reply["defer"] = true
+    return false
+  end
+
+  unless request["ed25519_pubkey"]
+    reply["msg"] = "No ed15519 public key received"
+    reply["defer"] = true
+    return false
+  end
+
+  unless request["ed25519_pubkey"]
+    reply["msg"] = "No ed15519 directory received"
+    reply["defer"] = true
+    return false
+  end
+
+  if request["ed25519_pubkey"]["directory"].length == 0
+    reply["msg"] = "No ed15519 directory received"
+    reply["defer"] = true
+    return false
+  end
+
+  true
+end
+
+def publish_reply(reply)
+  begin
+    File.open("/tmp/reply.json", "w") {|f| f.write(reply.to_json)}
+  rescue Exception
+  end
+
+  puts reply.to_json
+end
+
+def publish_reply!(reply)
+  publish_reply(reply)
+  exit
+end
+
+def set_config!(request, reply)
+  # stub data the helper will fetch from the saas
+  customers = {
+        "one" => {
+            :brokers => "nats://managed.example.net:9222", # whoever is the leader for this site
+            :site => "customer_one",
+            :source => {
+                :host => "nats://cust_one:s3cret@saas-nats.choria.local",
+            }
+        }
+    }
+
+
+  customer = request["jwt"]["extensions"]["customer"]
+  brokers = customers[customer][:brokers]
+  source = customers[customer][:source]
+
+  reply["configuration"].merge!(
+    "identity" => request["identity"],
+    "loglevel" => "warn",
+    "plugin.choria.server.provision" => "false",
+    "plugin.choria.middleware_hosts" => brokers,
+    "plugin.security.issuer.names" => "choria",
+    "plugin.security.issuer.choria.public" => "{{ .Env.ISSUER }}",
+    "plugin.security.provider" => "choria",
+    "plugin.security.choria.token_file" => File.join(request["ed25519_pubkey"]["directory"], "server.jwt"),
+    "plugin.security.choria.seed_file" => File.join(request["ed25519_pubkey"]["directory"], "server.seed"),
+    "machine_room.role" => "leader",
+    "machine_room.site" => customers[customer][:site],
+    "machine_room.source.host" => source[:host],
+  )
+
+  reply["server_claims"].merge!(
+    "exp" => 5*60*60*24*365,
+    "pub_subjects" => [">"],
+    "permissions" => {
+      "streams" => true,
+      "submission" => true,
+      "service_host" => true,
+    }
+  )
+end
+
+reply = {
+  "defer" => false,
+  "msg" => "",
+  "certificate" => "",
+  "ca" => "",
+  "configuration" => {},
+  "server_claims" => {}
+}
+
+begin
+  request = parse_input
+
+  reply["msg"] = "Validating"
+  unless validate!(request, reply)
+    publish_reply!(reply)
+  end
+
+  set_config!(request, reply)
+
+  reply["msg"] = "Done"
+  publish_reply!(reply)
+rescue SystemExit
+rescue Exception
+  reply["msg"] = "Unexpected failure during provisioning: %s: %s" % [$!.class, $!.to_s]
+  reply["defer"] = true
+  publish_reply!(reply)
+end

hack/choria/initialize/templates/provisioner/provisioner.yaml

@@ -2,7 +2,8 @@ workers: 4
 interval: 1m
 logfile: /dev/stdout
 loglevel: info
-helper: /app/.venv/bin/helper
+# The entrypoint script installs this helper script.
+helper: /home/choria/bin/helper.rb
 token: "{{ .Env.PROVISIONER_TOKEN }}"
 choria_insecure: false
 site: holos

hack/choria/initialize/templates/provisioner/token

@@ -0,0 +1 @@
+{{ .Env.PROVISIONER_TOKEN -}}

hack/setup/bare

@@ -0,0 +1,16 @@
+#! /bin/bash
+
+set -euo pipefail
+TOPLEVEL="$(cd $(dirname "$0") && git rev-parse --show-toplevel)"
+
+host="jeff.app.dev.k2.holos.run:443"
+
+read -p "Reset all data in $host? " choice
+case "$choice" in
+  y|Y) echo "proceeding...";;
+  *) exit 1;;
+esac
+
+
+grpcurl -H "x-oidc-id-token: $(holos token)" $host holos.v1alpha1.SystemService.DropTables
+grpcurl -H "x-oidc-id-token: $(holos token)" $host holos.v1alpha1.SystemService.SeedDatabase

hack/tilt/k8s.yaml

@@ -101,15 +101,44 @@ spec:
   gateways:
     - istio-ingress/default
   hosts:
-    - '{developer}.holos.dev.k2.ois.run'
+    - '{developer}.app.dev.k2.holos.run'
   http:
-    - route:
+    - name: "coffee-ui"
+      match:
+      - uri:
+          prefix: "/ui"
+      route:
+      - destination:
+          host: coffee
+          port:
+            number: 4200
+    - name: "holos-api"
+      route:
         - destination:
             host: '{name}'
             port:
               number: {listen_port}
 ---
 apiVersion: v1
+kind: Service
+metadata:
+  name: coffee
+spec:
+  ports:
+  - protocol: TCP
+    port: 4200
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: coffee
+subsets:
+  - addresses:
+    - ip: 192.168.2.21
+    ports:
+    - port: 4200
+---
+apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: holos
@@ -120,117 +149,6 @@ metadata:
 imagePullSecrets:
   - name: kube-system-ecr-image-pull-creds
 ---
-apiVersion: security.istio.io/v1beta1
-kind: AuthorizationPolicy
-metadata:
-  labels:
-    app: '{name}'
-    holos.run/developer: '{developer}'
-  name: '{name}-allow-groups'
-  namespace: '{namespace}'
-spec:
-  action: ALLOW
-  rules:
-    - when:
-        - key: request.auth.claims[groups]
-          values:
-            - holos-developer
-            - holos-developer@openinfrastructure.co
-  selector:
-    matchLabels:
-      holos.run/authz: dev-holos-sso
----
-apiVersion: security.istio.io/v1beta1
-kind: AuthorizationPolicy
-metadata:
-  name: '{name}-allow-nothing'
-  namespace: '{namespace}'
-  labels:
-    app: '{name}'
-    holos.run/developer: '{developer}'
-spec:
-  action: ALLOW
-  selector:
-    matchLabels:
-      holos.run/authz: dev-holos-sso
----
-apiVersion: security.istio.io/v1beta1
-kind: AuthorizationPolicy
-metadata:
-  name: '{name}-allow-well-known-paths'
-  namespace: '{namespace}'
-  labels:
-    app: '{name}'
-    holos.run/developer: '{developer}'
-spec:
-  action: ALLOW
-  rules:
-    - to:
-        - operation:
-            paths:
-              - /healthz
-              - /metrics
-              - /callbacks/github
-  selector:
-    matchLabels:
-      holos.run/authz: dev-holos-sso
----
-apiVersion: security.istio.io/v1beta1
-kind: AuthorizationPolicy
-metadata:
-  name: '{name}-auth'
-  namespace: '{namespace}'
-  labels:
-    app: '{name}'
-    holos.run/developer: '{developer}'
-spec:
-  action: CUSTOM
-  provider:
-    name: dev-holos-sso
-  rules:
-    - to:
-        - operation:
-            notPaths:
-              - /healthz
-              - /metrics
-              - /callbacks/github
-      when:
-        - key: request.headers[Authorization]
-          notValues:
-            - Bearer *
-  selector:
-    matchLabels:
-      holos.run/authz: dev-holos-sso
----
-apiVersion: security.istio.io/v1beta1
-kind: RequestAuthentication
-metadata:
-  name: '{name}'
-  namespace: '{namespace}'
-  labels:
-    app: '{name}'
-    holos.run/developer: '{developer}'
-spec:
-  jwtRules:
-    - audiences:
-        - https://sso.dev.holos.run
-      forwardOriginalToken: true
-      fromHeaders:
-        - name: x-auth-request-access-token
-      issuer: https://idex.core.ois.run
-      jwksUri: https://idex.core.ois.run/keys
-    - audiences:
-        - holos-cli
-      forwardOriginalToken: true
-      fromHeaders:
-        - name: authorization
-          prefix: 'Bearer '
-      issuer: https://idex.core.ois.run
-      jwksUri: https://idex.core.ois.run/keys
-  selector:
-    matchLabels:
-      holos.run/authz: dev-holos-sso
----
 apiVersion: postgres-operator.crunchydata.com/v1beta1
 kind: PGAdmin
 metadata:

internal/cli/login/login.go

@@ -15,6 +15,7 @@ import (
 // New returns a new login command.
 func New(cfg *holos.Config) *cobra.Command {
 	cmd := command.New("login")
+	cmd.Short = "log in by caching credentials"
 	var printClaims bool
 
 	config := token.NewConfig()

internal/cli/logout/logout.go

@@ -13,6 +13,7 @@ import (
 
 func New(cfg *holos.Config) *cobra.Command {
 	cmd := command.New("logout")
+	cmd.Short = "log out by deleting cached credentials"
 	cmd.RunE = func(c *cobra.Command, args []string) error {
 		if err := os.RemoveAll(token.CacheDir); err != nil {
 			return errors.Wrap(fmt.Errorf("could not logout: %w", err))

internal/cli/render/render.go

@@ -1,6 +1,7 @@
 package render
 
 import (
+	"flag"
 	"fmt"
 
 	"github.com/holos-run/holos/internal/cli/command"
@@ -11,8 +12,21 @@ import (
 	"github.com/spf13/cobra"
 )
 
-func makeRenderRunFunc(cfg *holos.Config) command.RunFunc {
-	return func(cmd *cobra.Command, args []string) error {
+// New returns the render subcommand for the root command
+func New(cfg *holos.Config) *cobra.Command {
+	cmd := command.New("render [directory...]")
+	cmd.Args = cobra.MinimumNArgs(1)
+	cmd.Short = "write kubernetes api objects to the filesystem"
+	cmd.Flags().SortFlags = false
+	cmd.Flags().AddGoFlagSet(cfg.WriteFlagSet())
+	cmd.Flags().AddGoFlagSet(cfg.ClusterFlagSet())
+
+	var printInstances bool
+	flagSet := flag.NewFlagSet("", flag.ContinueOnError)
+	flagSet.BoolVar(&printInstances, "print-instances", false, "expand /... paths for xargs")
+	cmd.Flags().AddGoFlagSet(flagSet)
+
+	cmd.RunE = func(cmd *cobra.Command, args []string) error {
 		if cfg.ClusterName() == "" {
 			return errors.Wrap(fmt.Errorf("missing cluster name"))
 		}
@@ -20,6 +34,18 @@ func makeRenderRunFunc(cfg *holos.Config) command.RunFunc {
 		ctx := cmd.Context()
 		log := logger.FromContext(ctx).With("cluster", cfg.ClusterName())
 		build := builder.New(builder.Entrypoints(args), builder.Cluster(cfg.ClusterName()))
+
+		if printInstances {
+			instances, err := build.Instances(ctx)
+			if err != nil {
+				return errors.Wrap(err)
+			}
+			for _, instance := range instances {
+				fmt.Fprintln(cmd.OutOrStdout(), instance.Dir)
+			}
+			return nil
+		}
+
 		results, err := build.Run(cmd.Context())
 		if err != nil {
 			return errors.Wrap(err)
@@ -45,16 +71,5 @@ func makeRenderRunFunc(cfg *holos.Config) command.RunFunc {
 		}
 		return nil
 	}
-}
-
-// New returns the render subcommand for the root command
-func New(cfg *holos.Config) *cobra.Command {
-	cmd := command.New("render [directory...]")
-	cmd.Args = cobra.MinimumNArgs(1)
-	cmd.Short = "write kubernetes api objects to the filesystem"
-	cmd.Flags().SortFlags = false
-	cmd.Flags().AddGoFlagSet(cfg.WriteFlagSet())
-	cmd.Flags().AddGoFlagSet(cfg.ClusterFlagSet())
-	cmd.RunE = makeRenderRunFunc(cfg)
 	return cmd
 }

internal/cli/root.go

@@ -16,6 +16,7 @@ import (
 	"github.com/holos-run/holos/internal/cli/logout"
 	"github.com/holos-run/holos/internal/cli/preflight"
 	"github.com/holos-run/holos/internal/cli/render"
+	"github.com/holos-run/holos/internal/cli/token"
 	"github.com/holos-run/holos/internal/cli/txtar"
 	"github.com/holos-run/holos/internal/holos"
 	"github.com/holos-run/holos/internal/logger"
@@ -61,6 +62,7 @@ func New(cfg *holos.Config) *cobra.Command {
 	rootCmd.AddCommand(preflight.New(cfg))
 	rootCmd.AddCommand(login.New(cfg))
 	rootCmd.AddCommand(logout.New(cfg))
+	rootCmd.AddCommand(token.New(cfg))
 
 	// Maybe not needed?
 	rootCmd.AddCommand(txtar.New(cfg))

internal/cli/token/token.go

@@ -0,0 +1,44 @@
+package token
+
+import (
+	"context"
+	"flag"
+	"fmt"
+	"log/slog"
+
+	"github.com/holos-run/holos/internal/cli/command"
+	"github.com/holos-run/holos/internal/holos"
+	"github.com/holos-run/holos/internal/token"
+	"github.com/spf13/cobra"
+)
+
+// New returns a new login command.
+func New(cfg *holos.Config) *cobra.Command {
+	cmd := command.New("token")
+	cmd.Short = "write id token to stdout"
+	cmd.Long = "Useful with curl / grpcurl -H $(holos token)"
+
+	config := token.NewConfig()
+	cmd.Flags().AddGoFlagSet(config.FlagSet())
+
+	fs := &flag.FlagSet{}
+	cmd.Flags().AddGoFlagSet(fs)
+
+	cmd.RunE = func(c *cobra.Command, args []string) error {
+		ctx := c.Context()
+		if ctx == nil {
+			ctx = context.Background()
+		}
+		token, err := token.Get(ctx, cfg.Logger(), config)
+		if err != nil {
+			slog.Error("could not get token", "err", err)
+			return fmt.Errorf("could not get token: %w", err)
+		}
+
+		fmt.Fprintf(cmd.OutOrStdout(), token.Bearer)
+
+		return nil
+	}
+
+	return cmd
+}

internal/ent/client.go

@@ -15,7 +15,9 @@ import (
 	"entgo.io/ent"
 	"entgo.io/ent/dialect"
 	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
 	"github.com/holos-run/holos/internal/ent/organization"
+	"github.com/holos-run/holos/internal/ent/platform"
 	"github.com/holos-run/holos/internal/ent/user"
 )
 
@@ -26,6 +28,8 @@ type Client struct {
 	Schema *migrate.Schema
 	// Organization is the client for interacting with the Organization builders.
 	Organization *OrganizationClient
+	// Platform is the client for interacting with the Platform builders.
+	Platform *PlatformClient
 	// User is the client for interacting with the User builders.
 	User *UserClient
 }
@@ -40,6 +44,7 @@ func NewClient(opts ...Option) *Client {
 func (c *Client) init() {
 	c.Schema = migrate.NewSchema(c.driver)
 	c.Organization = NewOrganizationClient(c.config)
+	c.Platform = NewPlatformClient(c.config)
 	c.User = NewUserClient(c.config)
 }
 
@@ -134,6 +139,7 @@ func (c *Client) Tx(ctx context.Context) (*Tx, error) {
 		ctx:          ctx,
 		config:       cfg,
 		Organization: NewOrganizationClient(cfg),
+		Platform:     NewPlatformClient(cfg),
 		User:         NewUserClient(cfg),
 	}, nil
 }
@@ -155,6 +161,7 @@ func (c *Client) BeginTx(ctx context.Context, opts *sql.TxOptions) (*Tx, error)
 		ctx:          ctx,
 		config:       cfg,
 		Organization: NewOrganizationClient(cfg),
+		Platform:     NewPlatformClient(cfg),
 		User:         NewUserClient(cfg),
 	}, nil
 }
@@ -185,6 +192,7 @@ func (c *Client) Close() error {
 // In order to add hooks to a specific client, call: `client.Node.Use(...)`.
 func (c *Client) Use(hooks ...Hook) {
 	c.Organization.Use(hooks...)
+	c.Platform.Use(hooks...)
 	c.User.Use(hooks...)
 }
 
@@ -192,6 +200,7 @@ func (c *Client) Use(hooks ...Hook) {
 // In order to add interceptors to a specific client, call: `client.Node.Intercept(...)`.
 func (c *Client) Intercept(interceptors ...Interceptor) {
 	c.Organization.Intercept(interceptors...)
+	c.Platform.Intercept(interceptors...)
 	c.User.Intercept(interceptors...)
 }
 
@@ -200,6 +209,8 @@ func (c *Client) Mutate(ctx context.Context, m Mutation) (Value, error) {
 	switch m := m.(type) {
 	case *OrganizationMutation:
 		return c.Organization.mutate(ctx, m)
+	case *PlatformMutation:
+		return c.Platform.mutate(ctx, m)
 	case *UserMutation:
 		return c.User.mutate(ctx, m)
 	default:
@@ -315,6 +326,54 @@ func (c *OrganizationClient) GetX(ctx context.Context, id uuid.UUID) *Organizati
 	return obj
 }
 
+// QueryCreator queries the creator edge of a Organization.
+func (c *OrganizationClient) QueryCreator(o *Organization) *UserQuery {
+	query := (&UserClient{config: c.config}).Query()
+	query.path = func(context.Context) (fromV *sql.Selector, _ error) {
+		id := o.ID
+		step := sqlgraph.NewStep(
+			sqlgraph.From(organization.Table, organization.FieldID, id),
+			sqlgraph.To(user.Table, user.FieldID),
+			sqlgraph.Edge(sqlgraph.M2O, false, organization.CreatorTable, organization.CreatorColumn),
+		)
+		fromV = sqlgraph.Neighbors(o.driver.Dialect(), step)
+		return fromV, nil
+	}
+	return query
+}
+
+// QueryUsers queries the users edge of a Organization.
+func (c *OrganizationClient) QueryUsers(o *Organization) *UserQuery {
+	query := (&UserClient{config: c.config}).Query()
+	query.path = func(context.Context) (fromV *sql.Selector, _ error) {
+		id := o.ID
+		step := sqlgraph.NewStep(
+			sqlgraph.From(organization.Table, organization.FieldID, id),
+			sqlgraph.To(user.Table, user.FieldID),
+			sqlgraph.Edge(sqlgraph.M2M, false, organization.UsersTable, organization.UsersPrimaryKey...),
+		)
+		fromV = sqlgraph.Neighbors(o.driver.Dialect(), step)
+		return fromV, nil
+	}
+	return query
+}
+
+// QueryPlatforms queries the platforms edge of a Organization.
+func (c *OrganizationClient) QueryPlatforms(o *Organization) *PlatformQuery {
+	query := (&PlatformClient{config: c.config}).Query()
+	query.path = func(context.Context) (fromV *sql.Selector, _ error) {
+		id := o.ID
+		step := sqlgraph.NewStep(
+			sqlgraph.From(organization.Table, organization.FieldID, id),
+			sqlgraph.To(platform.Table, platform.FieldID),
+			sqlgraph.Edge(sqlgraph.O2M, true, organization.PlatformsTable, organization.PlatformsColumn),
+		)
+		fromV = sqlgraph.Neighbors(o.driver.Dialect(), step)
+		return fromV, nil
+	}
+	return query
+}
+
 // Hooks returns the client hooks.
 func (c *OrganizationClient) Hooks() []Hook {
 	return c.hooks.Organization
@@ -340,6 +399,171 @@ func (c *OrganizationClient) mutate(ctx context.Context, m *OrganizationMutation
 	}
 }
 
+// PlatformClient is a client for the Platform schema.
+type PlatformClient struct {
+	config
+}
+
+// NewPlatformClient returns a client for the Platform from the given config.
+func NewPlatformClient(c config) *PlatformClient {
+	return &PlatformClient{config: c}
+}
+
+// Use adds a list of mutation hooks to the hooks stack.
+// A call to `Use(f, g, h)` equals to `platform.Hooks(f(g(h())))`.
+func (c *PlatformClient) Use(hooks ...Hook) {
+	c.hooks.Platform = append(c.hooks.Platform, hooks...)
+}
+
+// Intercept adds a list of query interceptors to the interceptors stack.
+// A call to `Intercept(f, g, h)` equals to `platform.Intercept(f(g(h())))`.
+func (c *PlatformClient) Intercept(interceptors ...Interceptor) {
+	c.inters.Platform = append(c.inters.Platform, interceptors...)
+}
+
+// Create returns a builder for creating a Platform entity.
+func (c *PlatformClient) Create() *PlatformCreate {
+	mutation := newPlatformMutation(c.config, OpCreate)
+	return &PlatformCreate{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// CreateBulk returns a builder for creating a bulk of Platform entities.
+func (c *PlatformClient) CreateBulk(builders ...*PlatformCreate) *PlatformCreateBulk {
+	return &PlatformCreateBulk{config: c.config, builders: builders}
+}
+
+// MapCreateBulk creates a bulk creation builder from the given slice. For each item in the slice, the function creates
+// a builder and applies setFunc on it.
+func (c *PlatformClient) MapCreateBulk(slice any, setFunc func(*PlatformCreate, int)) *PlatformCreateBulk {
+	rv := reflect.ValueOf(slice)
+	if rv.Kind() != reflect.Slice {
+		return &PlatformCreateBulk{err: fmt.Errorf("calling to PlatformClient.MapCreateBulk with wrong type %T, need slice", slice)}
+	}
+	builders := make([]*PlatformCreate, rv.Len())
+	for i := 0; i < rv.Len(); i++ {
+		builders[i] = c.Create()
+		setFunc(builders[i], i)
+	}
+	return &PlatformCreateBulk{config: c.config, builders: builders}
+}
+
+// Update returns an update builder for Platform.
+func (c *PlatformClient) Update() *PlatformUpdate {
+	mutation := newPlatformMutation(c.config, OpUpdate)
+	return &PlatformUpdate{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// UpdateOne returns an update builder for the given entity.
+func (c *PlatformClient) UpdateOne(pl *Platform) *PlatformUpdateOne {
+	mutation := newPlatformMutation(c.config, OpUpdateOne, withPlatform(pl))
+	return &PlatformUpdateOne{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// UpdateOneID returns an update builder for the given id.
+func (c *PlatformClient) UpdateOneID(id uuid.UUID) *PlatformUpdateOne {
+	mutation := newPlatformMutation(c.config, OpUpdateOne, withPlatformID(id))
+	return &PlatformUpdateOne{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// Delete returns a delete builder for Platform.
+func (c *PlatformClient) Delete() *PlatformDelete {
+	mutation := newPlatformMutation(c.config, OpDelete)
+	return &PlatformDelete{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// DeleteOne returns a builder for deleting the given entity.
+func (c *PlatformClient) DeleteOne(pl *Platform) *PlatformDeleteOne {
+	return c.DeleteOneID(pl.ID)
+}
+
+// DeleteOneID returns a builder for deleting the given entity by its id.
+func (c *PlatformClient) DeleteOneID(id uuid.UUID) *PlatformDeleteOne {
+	builder := c.Delete().Where(platform.ID(id))
+	builder.mutation.id = &id
+	builder.mutation.op = OpDeleteOne
+	return &PlatformDeleteOne{builder}
+}
+
+// Query returns a query builder for Platform.
+func (c *PlatformClient) Query() *PlatformQuery {
+	return &PlatformQuery{
+		config: c.config,
+		ctx:    &QueryContext{Type: TypePlatform},
+		inters: c.Interceptors(),
+	}
+}
+
+// Get returns a Platform entity by its id.
+func (c *PlatformClient) Get(ctx context.Context, id uuid.UUID) (*Platform, error) {
+	return c.Query().Where(platform.ID(id)).Only(ctx)
+}
+
+// GetX is like Get, but panics if an error occurs.
+func (c *PlatformClient) GetX(ctx context.Context, id uuid.UUID) *Platform {
+	obj, err := c.Get(ctx, id)
+	if err != nil {
+		panic(err)
+	}
+	return obj
+}
+
+// QueryCreator queries the creator edge of a Platform.
+func (c *PlatformClient) QueryCreator(pl *Platform) *UserQuery {
+	query := (&UserClient{config: c.config}).Query()
+	query.path = func(context.Context) (fromV *sql.Selector, _ error) {
+		id := pl.ID
+		step := sqlgraph.NewStep(
+			sqlgraph.From(platform.Table, platform.FieldID, id),
+			sqlgraph.To(user.Table, user.FieldID),
+			sqlgraph.Edge(sqlgraph.M2O, false, platform.CreatorTable, platform.CreatorColumn),
+		)
+		fromV = sqlgraph.Neighbors(pl.driver.Dialect(), step)
+		return fromV, nil
+	}
+	return query
+}
+
+// QueryOrganization queries the organization edge of a Platform.
+func (c *PlatformClient) QueryOrganization(pl *Platform) *OrganizationQuery {
+	query := (&OrganizationClient{config: c.config}).Query()
+	query.path = func(context.Context) (fromV *sql.Selector, _ error) {
+		id := pl.ID
+		step := sqlgraph.NewStep(
+			sqlgraph.From(platform.Table, platform.FieldID, id),
+			sqlgraph.To(organization.Table, organization.FieldID),
+			sqlgraph.Edge(sqlgraph.M2O, false, platform.OrganizationTable, platform.OrganizationColumn),
+		)
+		fromV = sqlgraph.Neighbors(pl.driver.Dialect(), step)
+		return fromV, nil
+	}
+	return query
+}
+
+// Hooks returns the client hooks.
+func (c *PlatformClient) Hooks() []Hook {
+	return c.hooks.Platform
+}
+
+// Interceptors returns the client interceptors.
+func (c *PlatformClient) Interceptors() []Interceptor {
+	return c.inters.Platform
+}
+
+func (c *PlatformClient) mutate(ctx context.Context, m *PlatformMutation) (Value, error) {
+	switch m.Op() {
+	case OpCreate:
+		return (&PlatformCreate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdate:
+		return (&PlatformUpdate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdateOne:
+		return (&PlatformUpdateOne{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpDelete, OpDeleteOne:
+		return (&PlatformDelete{config: c.config, hooks: c.Hooks(), mutation: m}).Exec(ctx)
+	default:
+		return nil, fmt.Errorf("ent: unknown Platform mutation op: %q", m.Op())
+	}
+}
+
 // UserClient is a client for the User schema.
 type UserClient struct {
 	config
@@ -448,6 +672,22 @@ func (c *UserClient) GetX(ctx context.Context, id uuid.UUID) *User {
 	return obj
 }
 
+// QueryOrganizations queries the organizations edge of a User.
+func (c *UserClient) QueryOrganizations(u *User) *OrganizationQuery {
+	query := (&OrganizationClient{config: c.config}).Query()
+	query.path = func(context.Context) (fromV *sql.Selector, _ error) {
+		id := u.ID
+		step := sqlgraph.NewStep(
+			sqlgraph.From(user.Table, user.FieldID, id),
+			sqlgraph.To(organization.Table, organization.FieldID),
+			sqlgraph.Edge(sqlgraph.M2M, true, user.OrganizationsTable, user.OrganizationsPrimaryKey...),
+		)
+		fromV = sqlgraph.Neighbors(u.driver.Dialect(), step)
+		return fromV, nil
+	}
+	return query
+}
+
 // Hooks returns the client hooks.
 func (c *UserClient) Hooks() []Hook {
 	return c.hooks.User
@@ -476,9 +716,9 @@ func (c *UserClient) mutate(ctx context.Context, m *UserMutation) (Value, error)
 // hooks and interceptors per client, for fast access.
 type (
 	hooks struct {
-		Organization, User []ent.Hook
+		Organization, Platform, User []ent.Hook
 	}
 	inters struct {
-		Organization, User []ent.Interceptor
+		Organization, Platform, User []ent.Interceptor
 	}
 )

internal/ent/ent.go

@@ -13,6 +13,7 @@ import (
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
 	"github.com/holos-run/holos/internal/ent/organization"
+	"github.com/holos-run/holos/internal/ent/platform"
 	"github.com/holos-run/holos/internal/ent/user"
 )
 
@@ -75,6 +76,7 @@ func checkColumn(table, column string) error {
 	initCheck.Do(func() {
 		columnCheck = sql.NewColumnCheck(map[string]func(string) bool{
 			organization.Table: organization.ValidColumn,
+			platform.Table:     platform.ValidColumn,
 			user.Table:         user.ValidColumn,
 		})
 	})

internal/ent/hook/hook.go

@@ -21,6 +21,18 @@ func (f OrganizationFunc) Mutate(ctx context.Context, m ent.Mutation) (ent.Value
 	return nil, fmt.Errorf("unexpected mutation type %T. expect *ent.OrganizationMutation", m)
 }
 
+// The PlatformFunc type is an adapter to allow the use of ordinary
+// function as Platform mutator.
+type PlatformFunc func(context.Context, *ent.PlatformMutation) (ent.Value, error)
+
+// Mutate calls f(ctx, m).
+func (f PlatformFunc) Mutate(ctx context.Context, m ent.Mutation) (ent.Value, error) {
+	if mv, ok := m.(*ent.PlatformMutation); ok {
+		return f(ctx, mv)
+	}
+	return nil, fmt.Errorf("unexpected mutation type %T. expect *ent.PlatformMutation", m)
+}
+
 // The UserFunc type is an adapter to allow the use of ordinary
 // function as User mutator.
 type UserFunc func(context.Context, *ent.UserMutation) (ent.Value, error)

internal/ent/migrate/schema.go

@@ -15,12 +15,62 @@ var (
 		{Name: "updated_at", Type: field.TypeTime},
 		{Name: "name", Type: field.TypeString, Unique: true},
 		{Name: "display_name", Type: field.TypeString},
+		{Name: "creator_id", Type: field.TypeUUID},
 	}
 	// OrganizationsTable holds the schema information for the "organizations" table.
 	OrganizationsTable = &schema.Table{
 		Name:       "organizations",
 		Columns:    OrganizationsColumns,
 		PrimaryKey: []*schema.Column{OrganizationsColumns[0]},
+		ForeignKeys: []*schema.ForeignKey{
+			{
+				Symbol:     "organizations_users_creator",
+				Columns:    []*schema.Column{OrganizationsColumns[5]},
+				RefColumns: []*schema.Column{UsersColumns[0]},
+				OnDelete:   schema.NoAction,
+			},
+		},
+	}
+	// PlatformsColumns holds the columns for the "platforms" table.
+	PlatformsColumns = []*schema.Column{
+		{Name: "id", Type: field.TypeUUID},
+		{Name: "created_at", Type: field.TypeTime},
+		{Name: "updated_at", Type: field.TypeTime},
+		{Name: "name", Type: field.TypeString},
+		{Name: "display_name", Type: field.TypeString},
+		{Name: "config_form", Type: field.TypeJSON, Nullable: true},
+		{Name: "config_values", Type: field.TypeJSON, Nullable: true},
+		{Name: "config_cue", Type: field.TypeBytes, Nullable: true},
+		{Name: "config_definition", Type: field.TypeString, Nullable: true},
+		{Name: "creator_id", Type: field.TypeUUID},
+		{Name: "org_id", Type: field.TypeUUID},
+	}
+	// PlatformsTable holds the schema information for the "platforms" table.
+	PlatformsTable = &schema.Table{
+		Name:       "platforms",
+		Columns:    PlatformsColumns,
+		PrimaryKey: []*schema.Column{PlatformsColumns[0]},
+		ForeignKeys: []*schema.ForeignKey{
+			{
+				Symbol:     "platforms_users_creator",
+				Columns:    []*schema.Column{PlatformsColumns[9]},
+				RefColumns: []*schema.Column{UsersColumns[0]},
+				OnDelete:   schema.NoAction,
+			},
+			{
+				Symbol:     "platforms_organizations_organization",
+				Columns:    []*schema.Column{PlatformsColumns[10]},
+				RefColumns: []*schema.Column{OrganizationsColumns[0]},
+				OnDelete:   schema.NoAction,
+			},
+		},
+		Indexes: []*schema.Index{
+			{
+				Name:    "platform_org_id_name",
+				Unique:  true,
+				Columns: []*schema.Column{PlatformsColumns[10], PlatformsColumns[3]},
+			},
+		},
 	}
 	// UsersColumns holds the columns for the "users" table.
 	UsersColumns = []*schema.Column{
@@ -37,13 +87,52 @@ var (
 		Name:       "users",
 		Columns:    UsersColumns,
 		PrimaryKey: []*schema.Column{UsersColumns[0]},
+		Indexes: []*schema.Index{
+			{
+				Name:    "user_iss_sub",
+				Unique:  true,
+				Columns: []*schema.Column{UsersColumns[4], UsersColumns[5]},
+			},
+		},
+	}
+	// OrganizationUsersColumns holds the columns for the "organization_users" table.
+	OrganizationUsersColumns = []*schema.Column{
+		{Name: "organization_id", Type: field.TypeUUID},
+		{Name: "user_id", Type: field.TypeUUID},
+	}
+	// OrganizationUsersTable holds the schema information for the "organization_users" table.
+	OrganizationUsersTable = &schema.Table{
+		Name:       "organization_users",
+		Columns:    OrganizationUsersColumns,
+		PrimaryKey: []*schema.Column{OrganizationUsersColumns[0], OrganizationUsersColumns[1]},
+		ForeignKeys: []*schema.ForeignKey{
+			{
+				Symbol:     "organization_users_organization_id",
+				Columns:    []*schema.Column{OrganizationUsersColumns[0]},
+				RefColumns: []*schema.Column{OrganizationsColumns[0]},
+				OnDelete:   schema.Cascade,
+			},
+			{
+				Symbol:     "organization_users_user_id",
+				Columns:    []*schema.Column{OrganizationUsersColumns[1]},
+				RefColumns: []*schema.Column{UsersColumns[0]},
+				OnDelete:   schema.Cascade,
+			},
+		},
 	}
 	// Tables holds all the tables in the schema.
 	Tables = []*schema.Table{
 		OrganizationsTable,
+		PlatformsTable,
 		UsersTable,
+		OrganizationUsersTable,
 	}
 )
 
 func init() {
+	OrganizationsTable.ForeignKeys[0].RefTable = UsersTable
+	PlatformsTable.ForeignKeys[0].RefTable = UsersTable
+	PlatformsTable.ForeignKeys[1].RefTable = OrganizationsTable
+	OrganizationUsersTable.ForeignKeys[0].RefTable = OrganizationsTable
+	OrganizationUsersTable.ForeignKeys[1].RefTable = UsersTable
 }

internal/ent/organization.go

@@ -11,6 +11,7 @@ import (
 	"entgo.io/ent/dialect/sql"
 	"github.com/gofrs/uuid"
 	"github.com/holos-run/holos/internal/ent/organization"
+	"github.com/holos-run/holos/internal/ent/user"
 )
 
 // Organization is the model entity for the Organization schema.
@@ -25,10 +26,57 @@ type Organization struct {
 	// Name holds the value of the "name" field.
 	Name string `json:"name,omitempty"`
 	// DisplayName holds the value of the "display_name" field.
-	DisplayName  string `json:"display_name,omitempty"`
+	DisplayName string `json:"display_name,omitempty"`
+	// CreatorID holds the value of the "creator_id" field.
+	CreatorID uuid.UUID `json:"creator_id,omitempty"`
+	// Edges holds the relations/edges for other nodes in the graph.
+	// The values are being populated by the OrganizationQuery when eager-loading is set.
+	Edges        OrganizationEdges `json:"edges"`
 	selectValues sql.SelectValues
 }
 
+// OrganizationEdges holds the relations/edges for other nodes in the graph.
+type OrganizationEdges struct {
+	// Creator holds the value of the creator edge.
+	Creator *User `json:"creator,omitempty"`
+	// Users holds the value of the users edge.
+	Users []*User `json:"users,omitempty"`
+	// Platforms holds the value of the platforms edge.
+	Platforms []*Platform `json:"platforms,omitempty"`
+	// loadedTypes holds the information for reporting if a
+	// type was loaded (or requested) in eager-loading or not.
+	loadedTypes [3]bool
+}
+
+// CreatorOrErr returns the Creator value or an error if the edge
+// was not loaded in eager-loading, or loaded but was not found.
+func (e OrganizationEdges) CreatorOrErr() (*User, error) {
+	if e.Creator != nil {
+		return e.Creator, nil
+	} else if e.loadedTypes[0] {
+		return nil, &NotFoundError{label: user.Label}
+	}
+	return nil, &NotLoadedError{edge: "creator"}
+}
+
+// UsersOrErr returns the Users value or an error if the edge
+// was not loaded in eager-loading.
+func (e OrganizationEdges) UsersOrErr() ([]*User, error) {
+	if e.loadedTypes[1] {
+		return e.Users, nil
+	}
+	return nil, &NotLoadedError{edge: "users"}
+}
+
+// PlatformsOrErr returns the Platforms value or an error if the edge
+// was not loaded in eager-loading.
+func (e OrganizationEdges) PlatformsOrErr() ([]*Platform, error) {
+	if e.loadedTypes[2] {
+		return e.Platforms, nil
+	}
+	return nil, &NotLoadedError{edge: "platforms"}
+}
+
 // scanValues returns the types for scanning values from sql.Rows.
 func (*Organization) scanValues(columns []string) ([]any, error) {
 	values := make([]any, len(columns))
@@ -38,7 +86,7 @@ func (*Organization) scanValues(columns []string) ([]any, error) {
 			values[i] = new(sql.NullString)
 		case organization.FieldCreatedAt, organization.FieldUpdatedAt:
 			values[i] = new(sql.NullTime)
-		case organization.FieldID:
+		case organization.FieldID, organization.FieldCreatorID:
 			values[i] = new(uuid.UUID)
 		default:
 			values[i] = new(sql.UnknownType)
@@ -85,6 +133,12 @@ func (o *Organization) assignValues(columns []string, values []any) error {
 			} else if value.Valid {
 				o.DisplayName = value.String
 			}
+		case organization.FieldCreatorID:
+			if value, ok := values[i].(*uuid.UUID); !ok {
+				return fmt.Errorf("unexpected type %T for field creator_id", values[i])
+			} else if value != nil {
+				o.CreatorID = *value
+			}
 		default:
 			o.selectValues.Set(columns[i], values[i])
 		}
@@ -98,6 +152,21 @@ func (o *Organization) Value(name string) (ent.Value, error) {
 	return o.selectValues.Get(name)
 }
 
+// QueryCreator queries the "creator" edge of the Organization entity.
+func (o *Organization) QueryCreator() *UserQuery {
+	return NewOrganizationClient(o.config).QueryCreator(o)
+}
+
+// QueryUsers queries the "users" edge of the Organization entity.
+func (o *Organization) QueryUsers() *UserQuery {
+	return NewOrganizationClient(o.config).QueryUsers(o)
+}
+
+// QueryPlatforms queries the "platforms" edge of the Organization entity.
+func (o *Organization) QueryPlatforms() *PlatformQuery {
+	return NewOrganizationClient(o.config).QueryPlatforms(o)
+}
+
 // Update returns a builder for updating this Organization.
 // Note that you need to call Organization.Unwrap() before calling this method if this Organization
 // was returned from a transaction, and the transaction was committed or rolled back.
@@ -132,6 +201,9 @@ func (o *Organization) String() string {
 	builder.WriteString(", ")
 	builder.WriteString("display_name=")
 	builder.WriteString(o.DisplayName)
+	builder.WriteString(", ")
+	builder.WriteString("creator_id=")
+	builder.WriteString(fmt.Sprintf("%v", o.CreatorID))
 	builder.WriteByte(')')
 	return builder.String()
 }

internal/ent/organization/organization.go

@@ -6,6 +6,7 @@ import (
 	"time"
 
 	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
 	"github.com/gofrs/uuid"
 )
 
@@ -22,8 +23,35 @@ const (
 	FieldName = "name"
 	// FieldDisplayName holds the string denoting the display_name field in the database.
 	FieldDisplayName = "display_name"
+	// FieldCreatorID holds the string denoting the creator_id field in the database.
+	FieldCreatorID = "creator_id"
+	// EdgeCreator holds the string denoting the creator edge name in mutations.
+	EdgeCreator = "creator"
+	// EdgeUsers holds the string denoting the users edge name in mutations.
+	EdgeUsers = "users"
+	// EdgePlatforms holds the string denoting the platforms edge name in mutations.
+	EdgePlatforms = "platforms"
 	// Table holds the table name of the organization in the database.
 	Table = "organizations"
+	// CreatorTable is the table that holds the creator relation/edge.
+	CreatorTable = "organizations"
+	// CreatorInverseTable is the table name for the User entity.
+	// It exists in this package in order to avoid circular dependency with the "user" package.
+	CreatorInverseTable = "users"
+	// CreatorColumn is the table column denoting the creator relation/edge.
+	CreatorColumn = "creator_id"
+	// UsersTable is the table that holds the users relation/edge. The primary key declared below.
+	UsersTable = "organization_users"
+	// UsersInverseTable is the table name for the User entity.
+	// It exists in this package in order to avoid circular dependency with the "user" package.
+	UsersInverseTable = "users"
+	// PlatformsTable is the table that holds the platforms relation/edge.
+	PlatformsTable = "platforms"
+	// PlatformsInverseTable is the table name for the Platform entity.
+	// It exists in this package in order to avoid circular dependency with the "platform" package.
+	PlatformsInverseTable = "platforms"
+	// PlatformsColumn is the table column denoting the platforms relation/edge.
+	PlatformsColumn = "org_id"
 )
 
 // Columns holds all SQL columns for organization fields.
@@ -33,8 +61,15 @@ var Columns = []string{
 	FieldUpdatedAt,
 	FieldName,
 	FieldDisplayName,
+	FieldCreatorID,
 }
 
+var (
+	// UsersPrimaryKey and UsersColumn2 are the table columns denoting the
+	// primary key for the users relation (M2M).
+	UsersPrimaryKey = []string{"organization_id", "user_id"}
+)
+
 // ValidColumn reports if the column name is valid (part of the table columns).
 func ValidColumn(column string) bool {
 	for i := range Columns {
@@ -85,3 +120,64 @@ func ByName(opts ...sql.OrderTermOption) OrderOption {
 func ByDisplayName(opts ...sql.OrderTermOption) OrderOption {
 	return sql.OrderByField(FieldDisplayName, opts...).ToFunc()
 }
+
+// ByCreatorID orders the results by the creator_id field.
+func ByCreatorID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldCreatorID, opts...).ToFunc()
+}
+
+// ByCreatorField orders the results by creator field.
+func ByCreatorField(field string, opts ...sql.OrderTermOption) OrderOption {
+	return func(s *sql.Selector) {
+		sqlgraph.OrderByNeighborTerms(s, newCreatorStep(), sql.OrderByField(field, opts...))
+	}
+}
+
+// ByUsersCount orders the results by users count.
+func ByUsersCount(opts ...sql.OrderTermOption) OrderOption {
+	return func(s *sql.Selector) {
+		sqlgraph.OrderByNeighborsCount(s, newUsersStep(), opts...)
+	}
+}
+
+// ByUsers orders the results by users terms.
+func ByUsers(term sql.OrderTerm, terms ...sql.OrderTerm) OrderOption {
+	return func(s *sql.Selector) {
+		sqlgraph.OrderByNeighborTerms(s, newUsersStep(), append([]sql.OrderTerm{term}, terms...)...)
+	}
+}
+
+// ByPlatformsCount orders the results by platforms count.
+func ByPlatformsCount(opts ...sql.OrderTermOption) OrderOption {
+	return func(s *sql.Selector) {
+		sqlgraph.OrderByNeighborsCount(s, newPlatformsStep(), opts...)
+	}
+}
+
+// ByPlatforms orders the results by platforms terms.
+func ByPlatforms(term sql.OrderTerm, terms ...sql.OrderTerm) OrderOption {
+	return func(s *sql.Selector) {
+		sqlgraph.OrderByNeighborTerms(s, newPlatformsStep(), append([]sql.OrderTerm{term}, terms...)...)
+	}
+}
+func newCreatorStep() *sqlgraph.Step {
+	return sqlgraph.NewStep(
+		sqlgraph.From(Table, FieldID),
+		sqlgraph.To(CreatorInverseTable, FieldID),
+		sqlgraph.Edge(sqlgraph.M2O, false, CreatorTable, CreatorColumn),
+	)
+}
+func newUsersStep() *sqlgraph.Step {
+	return sqlgraph.NewStep(
+		sqlgraph.From(Table, FieldID),
+		sqlgraph.To(UsersInverseTable, FieldID),
+		sqlgraph.Edge(sqlgraph.M2M, false, UsersTable, UsersPrimaryKey...),
+	)
+}
+func newPlatformsStep() *sqlgraph.Step {
+	return sqlgraph.NewStep(
+		sqlgraph.From(Table, FieldID),
+		sqlgraph.To(PlatformsInverseTable, FieldID),
+		sqlgraph.Edge(sqlgraph.O2M, true, PlatformsTable, PlatformsColumn),
+	)
+}

internal/ent/organization/where.go

@@ -6,6 +6,7 @@ import (
 	"time"
 
 	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
 	"github.com/gofrs/uuid"
 	"github.com/holos-run/holos/internal/ent/predicate"
 )
@@ -75,6 +76,11 @@ func DisplayName(v string) predicate.Organization {
 	return predicate.Organization(sql.FieldEQ(FieldDisplayName, v))
 }
 
+// CreatorID applies equality check predicate on the "creator_id" field. It's identical to CreatorIDEQ.
+func CreatorID(v uuid.UUID) predicate.Organization {
+	return predicate.Organization(sql.FieldEQ(FieldCreatorID, v))
+}
+
 // CreatedAtEQ applies the EQ predicate on the "created_at" field.
 func CreatedAtEQ(v time.Time) predicate.Organization {
 	return predicate.Organization(sql.FieldEQ(FieldCreatedAt, v))
@@ -285,6 +291,95 @@ func DisplayNameContainsFold(v string) predicate.Organization {
 	return predicate.Organization(sql.FieldContainsFold(FieldDisplayName, v))
 }
 
+// CreatorIDEQ applies the EQ predicate on the "creator_id" field.
+func CreatorIDEQ(v uuid.UUID) predicate.Organization {
+	return predicate.Organization(sql.FieldEQ(FieldCreatorID, v))
+}
+
+// CreatorIDNEQ applies the NEQ predicate on the "creator_id" field.
+func CreatorIDNEQ(v uuid.UUID) predicate.Organization {
+	return predicate.Organization(sql.FieldNEQ(FieldCreatorID, v))
+}
+
+// CreatorIDIn applies the In predicate on the "creator_id" field.
+func CreatorIDIn(vs ...uuid.UUID) predicate.Organization {
+	return predicate.Organization(sql.FieldIn(FieldCreatorID, vs...))
+}
+
+// CreatorIDNotIn applies the NotIn predicate on the "creator_id" field.
+func CreatorIDNotIn(vs ...uuid.UUID) predicate.Organization {
+	return predicate.Organization(sql.FieldNotIn(FieldCreatorID, vs...))
+}
+
+// HasCreator applies the HasEdge predicate on the "creator" edge.
+func HasCreator() predicate.Organization {
+	return predicate.Organization(func(s *sql.Selector) {
+		step := sqlgraph.NewStep(
+			sqlgraph.From(Table, FieldID),
+			sqlgraph.Edge(sqlgraph.M2O, false, CreatorTable, CreatorColumn),
+		)
+		sqlgraph.HasNeighbors(s, step)
+	})
+}
+
+// HasCreatorWith applies the HasEdge predicate on the "creator" edge with a given conditions (other predicates).
+func HasCreatorWith(preds ...predicate.User) predicate.Organization {
+	return predicate.Organization(func(s *sql.Selector) {
+		step := newCreatorStep()
+		sqlgraph.HasNeighborsWith(s, step, func(s *sql.Selector) {
+			for _, p := range preds {
+				p(s)
+			}
+		})
+	})
+}
+
+// HasUsers applies the HasEdge predicate on the "users" edge.
+func HasUsers() predicate.Organization {
+	return predicate.Organization(func(s *sql.Selector) {
+		step := sqlgraph.NewStep(
+			sqlgraph.From(Table, FieldID),
+			sqlgraph.Edge(sqlgraph.M2M, false, UsersTable, UsersPrimaryKey...),
+		)
+		sqlgraph.HasNeighbors(s, step)
+	})
+}
+
+// HasUsersWith applies the HasEdge predicate on the "users" edge with a given conditions (other predicates).
+func HasUsersWith(preds ...predicate.User) predicate.Organization {
+	return predicate.Organization(func(s *sql.Selector) {
+		step := newUsersStep()
+		sqlgraph.HasNeighborsWith(s, step, func(s *sql.Selector) {
+			for _, p := range preds {
+				p(s)
+			}
+		})
+	})
+}
+
+// HasPlatforms applies the HasEdge predicate on the "platforms" edge.
+func HasPlatforms() predicate.Organization {
+	return predicate.Organization(func(s *sql.Selector) {
+		step := sqlgraph.NewStep(
+			sqlgraph.From(Table, FieldID),
+			sqlgraph.Edge(sqlgraph.O2M, true, PlatformsTable, PlatformsColumn),
+		)
+		sqlgraph.HasNeighbors(s, step)
+	})
+}
+
+// HasPlatformsWith applies the HasEdge predicate on the "platforms" edge with a given conditions (other predicates).
+func HasPlatformsWith(preds ...predicate.Platform) predicate.Organization {
+	return predicate.Organization(func(s *sql.Selector) {
+		step := newPlatformsStep()
+		sqlgraph.HasNeighborsWith(s, step, func(s *sql.Selector) {
+			for _, p := range preds {
+				p(s)
+			}
+		})
+	})
+}
+
 // And groups predicates with the AND operator between them.
 func And(predicates ...predicate.Organization) predicate.Organization {
 	return predicate.Organization(sql.AndPredicates(predicates...))

internal/ent/organization_create.go

@@ -14,6 +14,8 @@ import (
 	"entgo.io/ent/schema/field"
 	"github.com/gofrs/uuid"
 	"github.com/holos-run/holos/internal/ent/organization"
+	"github.com/holos-run/holos/internal/ent/platform"
+	"github.com/holos-run/holos/internal/ent/user"
 )
 
 // OrganizationCreate is the builder for creating a Organization entity.
@@ -64,6 +66,12 @@ func (oc *OrganizationCreate) SetDisplayName(s string) *OrganizationCreate {
 	return oc
 }
 
+// SetCreatorID sets the "creator_id" field.
+func (oc *OrganizationCreate) SetCreatorID(u uuid.UUID) *OrganizationCreate {
+	oc.mutation.SetCreatorID(u)
+	return oc
+}
+
 // SetID sets the "id" field.
 func (oc *OrganizationCreate) SetID(u uuid.UUID) *OrganizationCreate {
 	oc.mutation.SetID(u)
@@ -78,6 +86,41 @@ func (oc *OrganizationCreate) SetNillableID(u *uuid.UUID) *OrganizationCreate {
 	return oc
 }
 
+// SetCreator sets the "creator" edge to the User entity.
+func (oc *OrganizationCreate) SetCreator(u *User) *OrganizationCreate {
+	return oc.SetCreatorID(u.ID)
+}
+
+// AddUserIDs adds the "users" edge to the User entity by IDs.
+func (oc *OrganizationCreate) AddUserIDs(ids ...uuid.UUID) *OrganizationCreate {
+	oc.mutation.AddUserIDs(ids...)
+	return oc
+}
+
+// AddUsers adds the "users" edges to the User entity.
+func (oc *OrganizationCreate) AddUsers(u ...*User) *OrganizationCreate {
+	ids := make([]uuid.UUID, len(u))
+	for i := range u {
+		ids[i] = u[i].ID
+	}
+	return oc.AddUserIDs(ids...)
+}
+
+// AddPlatformIDs adds the "platforms" edge to the Platform entity by IDs.
+func (oc *OrganizationCreate) AddPlatformIDs(ids ...uuid.UUID) *OrganizationCreate {
+	oc.mutation.AddPlatformIDs(ids...)
+	return oc
+}
+
+// AddPlatforms adds the "platforms" edges to the Platform entity.
+func (oc *OrganizationCreate) AddPlatforms(p ...*Platform) *OrganizationCreate {
+	ids := make([]uuid.UUID, len(p))
+	for i := range p {
+		ids[i] = p[i].ID
+	}
+	return oc.AddPlatformIDs(ids...)
+}
+
 // Mutation returns the OrganizationMutation object of the builder.
 func (oc *OrganizationCreate) Mutation() *OrganizationMutation {
 	return oc.mutation
@@ -146,6 +189,12 @@ func (oc *OrganizationCreate) check() error {
 	if _, ok := oc.mutation.DisplayName(); !ok {
 		return &ValidationError{Name: "display_name", err: errors.New(`ent: missing required field "Organization.display_name"`)}
 	}
+	if _, ok := oc.mutation.CreatorID(); !ok {
+		return &ValidationError{Name: "creator_id", err: errors.New(`ent: missing required field "Organization.creator_id"`)}
+	}
+	if _, ok := oc.mutation.CreatorID(); !ok {
+		return &ValidationError{Name: "creator", err: errors.New(`ent: missing required edge "Organization.creator"`)}
+	}
 	return nil
 }
 
@@ -198,6 +247,55 @@ func (oc *OrganizationCreate) createSpec() (*Organization, *sqlgraph.CreateSpec)
 		_spec.SetField(organization.FieldDisplayName, field.TypeString, value)
 		_node.DisplayName = value
 	}
+	if nodes := oc.mutation.CreatorIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: false,
+			Table:   organization.CreatorTable,
+			Columns: []string{organization.CreatorColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(user.FieldID, field.TypeUUID),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_node.CreatorID = nodes[0]
+		_spec.Edges = append(_spec.Edges, edge)
+	}
+	if nodes := oc.mutation.UsersIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2M,
+			Inverse: false,
+			Table:   organization.UsersTable,
+			Columns: organization.UsersPrimaryKey,
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(user.FieldID, field.TypeUUID),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges = append(_spec.Edges, edge)
+	}
+	if nodes := oc.mutation.PlatformsIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.O2M,
+			Inverse: true,
+			Table:   organization.PlatformsTable,
+			Columns: []string{organization.PlatformsColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(platform.FieldID, field.TypeUUID),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges = append(_spec.Edges, edge)
+	}
 	return _node, _spec
 }
 
@@ -286,6 +384,18 @@ func (u *OrganizationUpsert) UpdateDisplayName() *OrganizationUpsert {
 	return u
 }
 
+// SetCreatorID sets the "creator_id" field.
+func (u *OrganizationUpsert) SetCreatorID(v uuid.UUID) *OrganizationUpsert {
+	u.Set(organization.FieldCreatorID, v)
+	return u
+}
+
+// UpdateCreatorID sets the "creator_id" field to the value that was provided on create.
+func (u *OrganizationUpsert) UpdateCreatorID() *OrganizationUpsert {
+	u.SetExcluded(organization.FieldCreatorID)
+	return u
+}
+
 // UpdateNewValues updates the mutable fields using the new values that were set on create except the ID field.
 // Using this option is equivalent to using:
 //
@@ -379,6 +489,20 @@ func (u *OrganizationUpsertOne) UpdateDisplayName() *OrganizationUpsertOne {
 	})
 }
 
+// SetCreatorID sets the "creator_id" field.
+func (u *OrganizationUpsertOne) SetCreatorID(v uuid.UUID) *OrganizationUpsertOne {
+	return u.Update(func(s *OrganizationUpsert) {
+		s.SetCreatorID(v)
+	})
+}
+
+// UpdateCreatorID sets the "creator_id" field to the value that was provided on create.
+func (u *OrganizationUpsertOne) UpdateCreatorID() *OrganizationUpsertOne {
+	return u.Update(func(s *OrganizationUpsert) {
+		s.UpdateCreatorID()
+	})
+}
+
 // Exec executes the query.
 func (u *OrganizationUpsertOne) Exec(ctx context.Context) error {
 	if len(u.create.conflict) == 0 {
@@ -639,6 +763,20 @@ func (u *OrganizationUpsertBulk) UpdateDisplayName() *OrganizationUpsertBulk {
 	})
 }
 
+// SetCreatorID sets the "creator_id" field.
+func (u *OrganizationUpsertBulk) SetCreatorID(v uuid.UUID) *OrganizationUpsertBulk {
+	return u.Update(func(s *OrganizationUpsert) {
+		s.SetCreatorID(v)
+	})
+}
+
+// UpdateCreatorID sets the "creator_id" field to the value that was provided on create.
+func (u *OrganizationUpsertBulk) UpdateCreatorID() *OrganizationUpsertBulk {
+	return u.Update(func(s *OrganizationUpsert) {
+		s.UpdateCreatorID()
+	})
+}
+
 // Exec executes the query.
 func (u *OrganizationUpsertBulk) Exec(ctx context.Context) error {
 	if u.create.err != nil {

internal/ent/organization_query.go

@@ -4,6 +4,7 @@ package ent
 
 import (
 	"context"
+	"database/sql/driver"
 	"fmt"
 	"math"
 
@@ -12,16 +13,21 @@ import (
 	"entgo.io/ent/schema/field"
 	"github.com/gofrs/uuid"
 	"github.com/holos-run/holos/internal/ent/organization"
+	"github.com/holos-run/holos/internal/ent/platform"
 	"github.com/holos-run/holos/internal/ent/predicate"
+	"github.com/holos-run/holos/internal/ent/user"
 )
 
 // OrganizationQuery is the builder for querying Organization entities.
 type OrganizationQuery struct {
 	config
-	ctx        *QueryContext
-	order      []organization.OrderOption
-	inters     []Interceptor
-	predicates []predicate.Organization
+	ctx           *QueryContext
+	order         []organization.OrderOption
+	inters        []Interceptor
+	predicates    []predicate.Organization
+	withCreator   *UserQuery
+	withUsers     *UserQuery
+	withPlatforms *PlatformQuery
 	// intermediate query (i.e. traversal path).
 	sql  *sql.Selector
 	path func(context.Context) (*sql.Selector, error)
@@ -58,6 +64,72 @@ func (oq *OrganizationQuery) Order(o ...organization.OrderOption) *OrganizationQ
 	return oq
 }
 
+// QueryCreator chains the current query on the "creator" edge.
+func (oq *OrganizationQuery) QueryCreator() *UserQuery {
+	query := (&UserClient{config: oq.config}).Query()
+	query.path = func(ctx context.Context) (fromU *sql.Selector, err error) {
+		if err := oq.prepareQuery(ctx); err != nil {
+			return nil, err
+		}
+		selector := oq.sqlQuery(ctx)
+		if err := selector.Err(); err != nil {
+			return nil, err
+		}
+		step := sqlgraph.NewStep(
+			sqlgraph.From(organization.Table, organization.FieldID, selector),
+			sqlgraph.To(user.Table, user.FieldID),
+			sqlgraph.Edge(sqlgraph.M2O, false, organization.CreatorTable, organization.CreatorColumn),
+		)
+		fromU = sqlgraph.SetNeighbors(oq.driver.Dialect(), step)
+		return fromU, nil
+	}
+	return query
+}
+
+// QueryUsers chains the current query on the "users" edge.
+func (oq *OrganizationQuery) QueryUsers() *UserQuery {
+	query := (&UserClient{config: oq.config}).Query()
+	query.path = func(ctx context.Context) (fromU *sql.Selector, err error) {
+		if err := oq.prepareQuery(ctx); err != nil {
+			return nil, err
+		}
+		selector := oq.sqlQuery(ctx)
+		if err := selector.Err(); err != nil {
+			return nil, err
+		}
+		step := sqlgraph.NewStep(
+			sqlgraph.From(organization.Table, organization.FieldID, selector),
+			sqlgraph.To(user.Table, user.FieldID),
+			sqlgraph.Edge(sqlgraph.M2M, false, organization.UsersTable, organization.UsersPrimaryKey...),
+		)
+		fromU = sqlgraph.SetNeighbors(oq.driver.Dialect(), step)
+		return fromU, nil
+	}
+	return query
+}
+
+// QueryPlatforms chains the current query on the "platforms" edge.
+func (oq *OrganizationQuery) QueryPlatforms() *PlatformQuery {
+	query := (&PlatformClient{config: oq.config}).Query()
+	query.path = func(ctx context.Context) (fromU *sql.Selector, err error) {
+		if err := oq.prepareQuery(ctx); err != nil {
+			return nil, err
+		}
+		selector := oq.sqlQuery(ctx)
+		if err := selector.Err(); err != nil {
+			return nil, err
+		}
+		step := sqlgraph.NewStep(
+			sqlgraph.From(organization.Table, organization.FieldID, selector),
+			sqlgraph.To(platform.Table, platform.FieldID),
+			sqlgraph.Edge(sqlgraph.O2M, true, organization.PlatformsTable, organization.PlatformsColumn),
+		)
+		fromU = sqlgraph.SetNeighbors(oq.driver.Dialect(), step)
+		return fromU, nil
+	}
+	return query
+}
+
 // First returns the first Organization entity from the query.
 // Returns a *NotFoundError when no Organization was found.
 func (oq *OrganizationQuery) First(ctx context.Context) (*Organization, error) {
@@ -245,17 +317,53 @@ func (oq *OrganizationQuery) Clone() *OrganizationQuery {
 		return nil
 	}
 	return &OrganizationQuery{
-		config:     oq.config,
-		ctx:        oq.ctx.Clone(),
-		order:      append([]organization.OrderOption{}, oq.order...),
-		inters:     append([]Interceptor{}, oq.inters...),
-		predicates: append([]predicate.Organization{}, oq.predicates...),
+		config:        oq.config,
+		ctx:           oq.ctx.Clone(),
+		order:         append([]organization.OrderOption{}, oq.order...),
+		inters:        append([]Interceptor{}, oq.inters...),
+		predicates:    append([]predicate.Organization{}, oq.predicates...),
+		withCreator:   oq.withCreator.Clone(),
+		withUsers:     oq.withUsers.Clone(),
+		withPlatforms: oq.withPlatforms.Clone(),
 		// clone intermediate query.
 		sql:  oq.sql.Clone(),
 		path: oq.path,
 	}
 }
 
+// WithCreator tells the query-builder to eager-load the nodes that are connected to
+// the "creator" edge. The optional arguments are used to configure the query builder of the edge.
+func (oq *OrganizationQuery) WithCreator(opts ...func(*UserQuery)) *OrganizationQuery {
+	query := (&UserClient{config: oq.config}).Query()
+	for _, opt := range opts {
+		opt(query)
+	}
+	oq.withCreator = query
+	return oq
+}
+
+// WithUsers tells the query-builder to eager-load the nodes that are connected to
+// the "users" edge. The optional arguments are used to configure the query builder of the edge.
+func (oq *OrganizationQuery) WithUsers(opts ...func(*UserQuery)) *OrganizationQuery {
+	query := (&UserClient{config: oq.config}).Query()
+	for _, opt := range opts {
+		opt(query)
+	}
+	oq.withUsers = query
+	return oq
+}
+
+// WithPlatforms tells the query-builder to eager-load the nodes that are connected to
+// the "platforms" edge. The optional arguments are used to configure the query builder of the edge.
+func (oq *OrganizationQuery) WithPlatforms(opts ...func(*PlatformQuery)) *OrganizationQuery {
+	query := (&PlatformClient{config: oq.config}).Query()
+	for _, opt := range opts {
+		opt(query)
+	}
+	oq.withPlatforms = query
+	return oq
+}
+
 // GroupBy is used to group vertices by one or more fields/columns.
 // It is often used with aggregate functions, like: count, max, mean, min, sum.
 //
@@ -332,8 +440,13 @@ func (oq *OrganizationQuery) prepareQuery(ctx context.Context) error {
 
 func (oq *OrganizationQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*Organization, error) {
 	var (
-		nodes = []*Organization{}
-		_spec = oq.querySpec()
+		nodes       = []*Organization{}
+		_spec       = oq.querySpec()
+		loadedTypes = [3]bool{
+			oq.withCreator != nil,
+			oq.withUsers != nil,
+			oq.withPlatforms != nil,
+		}
 	)
 	_spec.ScanValues = func(columns []string) ([]any, error) {
 		return (*Organization).scanValues(nil, columns)
@@ -341,6 +454,7 @@ func (oq *OrganizationQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]
 	_spec.Assign = func(columns []string, values []any) error {
 		node := &Organization{config: oq.config}
 		nodes = append(nodes, node)
+		node.Edges.loadedTypes = loadedTypes
 		return node.assignValues(columns, values)
 	}
 	for i := range hooks {
@@ -352,9 +466,150 @@ func (oq *OrganizationQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]
 	if len(nodes) == 0 {
 		return nodes, nil
 	}
+	if query := oq.withCreator; query != nil {
+		if err := oq.loadCreator(ctx, query, nodes, nil,
+			func(n *Organization, e *User) { n.Edges.Creator = e }); err != nil {
+			return nil, err
+		}
+	}
+	if query := oq.withUsers; query != nil {
+		if err := oq.loadUsers(ctx, query, nodes,
+			func(n *Organization) { n.Edges.Users = []*User{} },
+			func(n *Organization, e *User) { n.Edges.Users = append(n.Edges.Users, e) }); err != nil {
+			return nil, err
+		}
+	}
+	if query := oq.withPlatforms; query != nil {
+		if err := oq.loadPlatforms(ctx, query, nodes,
+			func(n *Organization) { n.Edges.Platforms = []*Platform{} },
+			func(n *Organization, e *Platform) { n.Edges.Platforms = append(n.Edges.Platforms, e) }); err != nil {
+			return nil, err
+		}
+	}
 	return nodes, nil
 }
 
+func (oq *OrganizationQuery) loadCreator(ctx context.Context, query *UserQuery, nodes []*Organization, init func(*Organization), assign func(*Organization, *User)) error {
+	ids := make([]uuid.UUID, 0, len(nodes))
+	nodeids := make(map[uuid.UUID][]*Organization)
+	for i := range nodes {
+		fk := nodes[i].CreatorID
+		if _, ok := nodeids[fk]; !ok {
+			ids = append(ids, fk)
+		}
+		nodeids[fk] = append(nodeids[fk], nodes[i])
+	}
+	if len(ids) == 0 {
+		return nil
+	}
+	query.Where(user.IDIn(ids...))
+	neighbors, err := query.All(ctx)
+	if err != nil {
+		return err
+	}
+	for _, n := range neighbors {
+		nodes, ok := nodeids[n.ID]
+		if !ok {
+			return fmt.Errorf(`unexpected foreign-key "creator_id" returned %v`, n.ID)
+		}
+		for i := range nodes {
+			assign(nodes[i], n)
+		}
+	}
+	return nil
+}
+func (oq *OrganizationQuery) loadUsers(ctx context.Context, query *UserQuery, nodes []*Organization, init func(*Organization), assign func(*Organization, *User)) error {
+	edgeIDs := make([]driver.Value, len(nodes))
+	byID := make(map[uuid.UUID]*Organization)
+	nids := make(map[uuid.UUID]map[*Organization]struct{})
+	for i, node := range nodes {
+		edgeIDs[i] = node.ID
+		byID[node.ID] = node
+		if init != nil {
+			init(node)
+		}
+	}
+	query.Where(func(s *sql.Selector) {
+		joinT := sql.Table(organization.UsersTable)
+		s.Join(joinT).On(s.C(user.FieldID), joinT.C(organization.UsersPrimaryKey[1]))
+		s.Where(sql.InValues(joinT.C(organization.UsersPrimaryKey[0]), edgeIDs...))
+		columns := s.SelectedColumns()
+		s.Select(joinT.C(organization.UsersPrimaryKey[0]))
+		s.AppendSelect(columns...)
+		s.SetDistinct(false)
+	})
+	if err := query.prepareQuery(ctx); err != nil {
+		return err
+	}
+	qr := QuerierFunc(func(ctx context.Context, q Query) (Value, error) {
+		return query.sqlAll(ctx, func(_ context.Context, spec *sqlgraph.QuerySpec) {
+			assign := spec.Assign
+			values := spec.ScanValues
+			spec.ScanValues = func(columns []string) ([]any, error) {
+				values, err := values(columns[1:])
+				if err != nil {
+					return nil, err
+				}
+				return append([]any{new(uuid.UUID)}, values...), nil
+			}
+			spec.Assign = func(columns []string, values []any) error {
+				outValue := *values[0].(*uuid.UUID)
+				inValue := *values[1].(*uuid.UUID)
+				if nids[inValue] == nil {
+					nids[inValue] = map[*Organization]struct{}{byID[outValue]: {}}
+					return assign(columns[1:], values[1:])
+				}
+				nids[inValue][byID[outValue]] = struct{}{}
+				return nil
+			}
+		})
+	})
+	neighbors, err := withInterceptors[[]*User](ctx, query, qr, query.inters)
+	if err != nil {
+		return err
+	}
+	for _, n := range neighbors {
+		nodes, ok := nids[n.ID]
+		if !ok {
+			return fmt.Errorf(`unexpected "users" node returned %v`, n.ID)
+		}
+		for kn := range nodes {
+			assign(kn, n)
+		}
+	}
+	return nil
+}
+func (oq *OrganizationQuery) loadPlatforms(ctx context.Context, query *PlatformQuery, nodes []*Organization, init func(*Organization), assign func(*Organization, *Platform)) error {
+	fks := make([]driver.Value, 0, len(nodes))
+	nodeids := make(map[uuid.UUID]*Organization)
+	for i := range nodes {
+		fks = append(fks, nodes[i].ID)
+		nodeids[nodes[i].ID] = nodes[i]
+		if init != nil {
+			init(nodes[i])
+		}
+	}
+	if len(query.ctx.Fields) > 0 {
+		query.ctx.AppendFieldOnce(platform.FieldOrgID)
+	}
+	query.Where(predicate.Platform(func(s *sql.Selector) {
+		s.Where(sql.InValues(s.C(organization.PlatformsColumn), fks...))
+	}))
+	neighbors, err := query.All(ctx)
+	if err != nil {
+		return err
+	}
+	for _, n := range neighbors {
+		fk := n.OrgID
+		node, ok := nodeids[fk]
+		if !ok {
+			return fmt.Errorf(`unexpected referenced foreign-key "org_id" returned %v for node %v`, fk, n.ID)
+		}
+		assign(node, n)
+	}
+	return nil
+}
+
 func (oq *OrganizationQuery) sqlCount(ctx context.Context) (int, error) {
 	_spec := oq.querySpec()
 	_spec.Node.Columns = oq.ctx.Fields
@@ -380,6 +635,9 @@ func (oq *OrganizationQuery) querySpec() *sqlgraph.QuerySpec {
 				_spec.Node.Columns = append(_spec.Node.Columns, fields[i])
 			}
 		}
+		if oq.withCreator != nil {
+			_spec.Node.AddColumnOnce(organization.FieldCreatorID)
+		}
 	}
 	if ps := oq.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {

internal/ent/organization_update.go

@@ -11,8 +11,11 @@ import (
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
 	"entgo.io/ent/schema/field"
+	"github.com/gofrs/uuid"
 	"github.com/holos-run/holos/internal/ent/organization"
+	"github.com/holos-run/holos/internal/ent/platform"
 	"github.com/holos-run/holos/internal/ent/predicate"
+	"github.com/holos-run/holos/internal/ent/user"
 )
 
 // OrganizationUpdate is the builder for updating Organization entities.
@@ -62,11 +65,108 @@ func (ou *OrganizationUpdate) SetNillableDisplayName(s *string) *OrganizationUpd
 	return ou
 }
 
+// SetCreatorID sets the "creator_id" field.
+func (ou *OrganizationUpdate) SetCreatorID(u uuid.UUID) *OrganizationUpdate {
+	ou.mutation.SetCreatorID(u)
+	return ou
+}
+
+// SetNillableCreatorID sets the "creator_id" field if the given value is not nil.
+func (ou *OrganizationUpdate) SetNillableCreatorID(u *uuid.UUID) *OrganizationUpdate {
+	if u != nil {
+		ou.SetCreatorID(*u)
+	}
+	return ou
+}
+
+// SetCreator sets the "creator" edge to the User entity.
+func (ou *OrganizationUpdate) SetCreator(u *User) *OrganizationUpdate {
+	return ou.SetCreatorID(u.ID)
+}
+
+// AddUserIDs adds the "users" edge to the User entity by IDs.
+func (ou *OrganizationUpdate) AddUserIDs(ids ...uuid.UUID) *OrganizationUpdate {
+	ou.mutation.AddUserIDs(ids...)
+	return ou
+}
+
+// AddUsers adds the "users" edges to the User entity.
+func (ou *OrganizationUpdate) AddUsers(u ...*User) *OrganizationUpdate {
+	ids := make([]uuid.UUID, len(u))
+	for i := range u {
+		ids[i] = u[i].ID
+	}
+	return ou.AddUserIDs(ids...)
+}
+
+// AddPlatformIDs adds the "platforms" edge to the Platform entity by IDs.
+func (ou *OrganizationUpdate) AddPlatformIDs(ids ...uuid.UUID) *OrganizationUpdate {
+	ou.mutation.AddPlatformIDs(ids...)
+	return ou
+}
+
+// AddPlatforms adds the "platforms" edges to the Platform entity.
+func (ou *OrganizationUpdate) AddPlatforms(p ...*Platform) *OrganizationUpdate {
+	ids := make([]uuid.UUID, len(p))
+	for i := range p {
+		ids[i] = p[i].ID
+	}
+	return ou.AddPlatformIDs(ids...)
+}
+
 // Mutation returns the OrganizationMutation object of the builder.
 func (ou *OrganizationUpdate) Mutation() *OrganizationMutation {
 	return ou.mutation
 }
 
+// ClearCreator clears the "creator" edge to the User entity.
+func (ou *OrganizationUpdate) ClearCreator() *OrganizationUpdate {
+	ou.mutation.ClearCreator()
+	return ou
+}
+
+// ClearUsers clears all "users" edges to the User entity.
+func (ou *OrganizationUpdate) ClearUsers() *OrganizationUpdate {
+	ou.mutation.ClearUsers()
+	return ou
+}
+
+// RemoveUserIDs removes the "users" edge to User entities by IDs.
+func (ou *OrganizationUpdate) RemoveUserIDs(ids ...uuid.UUID) *OrganizationUpdate {
+	ou.mutation.RemoveUserIDs(ids...)
+	return ou
+}
+
+// RemoveUsers removes "users" edges to User entities.
+func (ou *OrganizationUpdate) RemoveUsers(u ...*User) *OrganizationUpdate {
+	ids := make([]uuid.UUID, len(u))
+	for i := range u {
+		ids[i] = u[i].ID
+	}
+	return ou.RemoveUserIDs(ids...)
+}
+
+// ClearPlatforms clears all "platforms" edges to the Platform entity.
+func (ou *OrganizationUpdate) ClearPlatforms() *OrganizationUpdate {
+	ou.mutation.ClearPlatforms()
+	return ou
+}
+
+// RemovePlatformIDs removes the "platforms" edge to Platform entities by IDs.
+func (ou *OrganizationUpdate) RemovePlatformIDs(ids ...uuid.UUID) *OrganizationUpdate {
+	ou.mutation.RemovePlatformIDs(ids...)
+	return ou
+}
+
+// RemovePlatforms removes "platforms" edges to Platform entities.
+func (ou *OrganizationUpdate) RemovePlatforms(p ...*Platform) *OrganizationUpdate {
+	ids := make([]uuid.UUID, len(p))
+	for i := range p {
+		ids[i] = p[i].ID
+	}
+	return ou.RemovePlatformIDs(ids...)
+}
+
 // Save executes the query and returns the number of nodes affected by the update operation.
 func (ou *OrganizationUpdate) Save(ctx context.Context) (int, error) {
 	ou.defaults()
@@ -110,6 +210,9 @@ func (ou *OrganizationUpdate) check() error {
 			return &ValidationError{Name: "name", err: fmt.Errorf(`ent: validator failed for field "Organization.name": %w`, err)}
 		}
 	}
+	if _, ok := ou.mutation.CreatorID(); ou.mutation.CreatorCleared() && !ok {
+		return errors.New(`ent: clearing a required unique edge "Organization.creator"`)
+	}
 	return nil
 }
 
@@ -134,6 +237,125 @@ func (ou *OrganizationUpdate) sqlSave(ctx context.Context) (n int, err error) {
 	if value, ok := ou.mutation.DisplayName(); ok {
 		_spec.SetField(organization.FieldDisplayName, field.TypeString, value)
 	}
+	if ou.mutation.CreatorCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: false,
+			Table:   organization.CreatorTable,
+			Columns: []string{organization.CreatorColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(user.FieldID, field.TypeUUID),
+			},
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := ou.mutation.CreatorIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: false,
+			Table:   organization.CreatorTable,
+			Columns: []string{organization.CreatorColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(user.FieldID, field.TypeUUID),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Add = append(_spec.Edges.Add, edge)
+	}
+	if ou.mutation.UsersCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2M,
+			Inverse: false,
+			Table:   organization.UsersTable,
+			Columns: organization.UsersPrimaryKey,
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(user.FieldID, field.TypeUUID),
+			},
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := ou.mutation.RemovedUsersIDs(); len(nodes) > 0 && !ou.mutation.UsersCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2M,
+			Inverse: false,
+			Table:   organization.UsersTable,
+			Columns: organization.UsersPrimaryKey,
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(user.FieldID, field.TypeUUID),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := ou.mutation.UsersIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2M,
+			Inverse: false,
+			Table:   organization.UsersTable,
+			Columns: organization.UsersPrimaryKey,
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(user.FieldID, field.TypeUUID),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Add = append(_spec.Edges.Add, edge)
+	}
+	if ou.mutation.PlatformsCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.O2M,
+			Inverse: true,
+			Table:   organization.PlatformsTable,
+			Columns: []string{organization.PlatformsColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(platform.FieldID, field.TypeUUID),
+			},
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := ou.mutation.RemovedPlatformsIDs(); len(nodes) > 0 && !ou.mutation.PlatformsCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.O2M,
+			Inverse: true,
+			Table:   organization.PlatformsTable,
+			Columns: []string{organization.PlatformsColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(platform.FieldID, field.TypeUUID),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := ou.mutation.PlatformsIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.O2M,
+			Inverse: true,
+			Table:   organization.PlatformsTable,
+			Columns: []string{organization.PlatformsColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(platform.FieldID, field.TypeUUID),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Add = append(_spec.Edges.Add, edge)
+	}
 	if n, err = sqlgraph.UpdateNodes(ctx, ou.driver, _spec); err != nil {
 		if _, ok := err.(*sqlgraph.NotFoundError); ok {
 			err = &NotFoundError{organization.Label}
@@ -188,11 +410,108 @@ func (ouo *OrganizationUpdateOne) SetNillableDisplayName(s *string) *Organizatio
 	return ouo
 }
 
+// SetCreatorID sets the "creator_id" field.
+func (ouo *OrganizationUpdateOne) SetCreatorID(u uuid.UUID) *OrganizationUpdateOne {
+	ouo.mutation.SetCreatorID(u)
+	return ouo
+}
+
+// SetNillableCreatorID sets the "creator_id" field if the given value is not nil.
+func (ouo *OrganizationUpdateOne) SetNillableCreatorID(u *uuid.UUID) *OrganizationUpdateOne {
+	if u != nil {
+		ouo.SetCreatorID(*u)
+	}
+	return ouo
+}
+
+// SetCreator sets the "creator" edge to the User entity.
+func (ouo *OrganizationUpdateOne) SetCreator(u *User) *OrganizationUpdateOne {
+	return ouo.SetCreatorID(u.ID)
+}
+
+// AddUserIDs adds the "users" edge to the User entity by IDs.
+func (ouo *OrganizationUpdateOne) AddUserIDs(ids ...uuid.UUID) *OrganizationUpdateOne {
+	ouo.mutation.AddUserIDs(ids...)
+	return ouo
+}
+
+// AddUsers adds the "users" edges to the User entity.
+func (ouo *OrganizationUpdateOne) AddUsers(u ...*User) *OrganizationUpdateOne {
+	ids := make([]uuid.UUID, len(u))
+	for i := range u {
+		ids[i] = u[i].ID
+	}
+	return ouo.AddUserIDs(ids...)
+}
+
+// AddPlatformIDs adds the "platforms" edge to the Platform entity by IDs.
+func (ouo *OrganizationUpdateOne) AddPlatformIDs(ids ...uuid.UUID) *OrganizationUpdateOne {
+	ouo.mutation.AddPlatformIDs(ids...)
+	return ouo
+}
+
+// AddPlatforms adds the "platforms" edges to the Platform entity.
+func (ouo *OrganizationUpdateOne) AddPlatforms(p ...*Platform) *OrganizationUpdateOne {
+	ids := make([]uuid.UUID, len(p))
+	for i := range p {
+		ids[i] = p[i].ID
+	}
+	return ouo.AddPlatformIDs(ids...)
+}
+
 // Mutation returns the OrganizationMutation object of the builder.
 func (ouo *OrganizationUpdateOne) Mutation() *OrganizationMutation {
 	return ouo.mutation
 }
 
+// ClearCreator clears the "creator" edge to the User entity.
+func (ouo *OrganizationUpdateOne) ClearCreator() *OrganizationUpdateOne {
+	ouo.mutation.ClearCreator()
+	return ouo
+}
+
+// ClearUsers clears all "users" edges to the User entity.
+func (ouo *OrganizationUpdateOne) ClearUsers() *OrganizationUpdateOne {
+	ouo.mutation.ClearUsers()
+	return ouo
+}
+
+// RemoveUserIDs removes the "users" edge to User entities by IDs.
+func (ouo *OrganizationUpdateOne) RemoveUserIDs(ids ...uuid.UUID) *OrganizationUpdateOne {
+	ouo.mutation.RemoveUserIDs(ids...)
+	return ouo
+}
+
+// RemoveUsers removes "users" edges to User entities.
+func (ouo *OrganizationUpdateOne) RemoveUsers(u ...*User) *OrganizationUpdateOne {
+	ids := make([]uuid.UUID, len(u))
+	for i := range u {
+		ids[i] = u[i].ID
+	}
+	return ouo.RemoveUserIDs(ids...)
+}
+
+// ClearPlatforms clears all "platforms" edges to the Platform entity.
+func (ouo *OrganizationUpdateOne) ClearPlatforms() *OrganizationUpdateOne {
+	ouo.mutation.ClearPlatforms()
+	return ouo
+}
+
+// RemovePlatformIDs removes the "platforms" edge to Platform entities by IDs.
+func (ouo *OrganizationUpdateOne) RemovePlatformIDs(ids ...uuid.UUID) *OrganizationUpdateOne {
+	ouo.mutation.RemovePlatformIDs(ids...)
+	return ouo
+}
+
+// RemovePlatforms removes "platforms" edges to Platform entities.
+func (ouo *OrganizationUpdateOne) RemovePlatforms(p ...*Platform) *OrganizationUpdateOne {
+	ids := make([]uuid.UUID, len(p))
+	for i := range p {
+		ids[i] = p[i].ID
+	}
+	return ouo.RemovePlatformIDs(ids...)
+}
+
 // Where appends a list predicates to the OrganizationUpdate builder.
 func (ouo *OrganizationUpdateOne) Where(ps ...predicate.Organization) *OrganizationUpdateOne {
 	ouo.mutation.Where(ps...)
@@ -249,6 +568,9 @@ func (ouo *OrganizationUpdateOne) check() error {
 			return &ValidationError{Name: "name", err: fmt.Errorf(`ent: validator failed for field "Organization.name": %w`, err)}
 		}
 	}
+	if _, ok := ouo.mutation.CreatorID(); ouo.mutation.CreatorCleared() && !ok {
+		return errors.New(`ent: clearing a required unique edge "Organization.creator"`)
+	}
 	return nil
 }
 
@@ -290,6 +612,125 @@ func (ouo *OrganizationUpdateOne) sqlSave(ctx context.Context) (_node *Organizat
 	if value, ok := ouo.mutation.DisplayName(); ok {
 		_spec.SetField(organization.FieldDisplayName, field.TypeString, value)
 	}
+	if ouo.mutation.CreatorCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: false,
+			Table:   organization.CreatorTable,
+			Columns: []string{organization.CreatorColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(user.FieldID, field.TypeUUID),
+			},
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := ouo.mutation.CreatorIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: false,
+			Table:   organization.CreatorTable,
+			Columns: []string{organization.CreatorColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(user.FieldID, field.TypeUUID),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Add = append(_spec.Edges.Add, edge)
+	}
+	if ouo.mutation.UsersCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2M,
+			Inverse: false,
+			Table:   organization.UsersTable,
+			Columns: organization.UsersPrimaryKey,
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(user.FieldID, field.TypeUUID),
+			},
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := ouo.mutation.RemovedUsersIDs(); len(nodes) > 0 && !ouo.mutation.UsersCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2M,
+			Inverse: false,
+			Table:   organization.UsersTable,
+			Columns: organization.UsersPrimaryKey,
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(user.FieldID, field.TypeUUID),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := ouo.mutation.UsersIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2M,
+			Inverse: false,
+			Table:   organization.UsersTable,
+			Columns: organization.UsersPrimaryKey,
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(user.FieldID, field.TypeUUID),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Add = append(_spec.Edges.Add, edge)
+	}
+	if ouo.mutation.PlatformsCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.O2M,
+			Inverse: true,
+			Table:   organization.PlatformsTable,
+			Columns: []string{organization.PlatformsColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(platform.FieldID, field.TypeUUID),
+			},
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := ouo.mutation.RemovedPlatformsIDs(); len(nodes) > 0 && !ouo.mutation.PlatformsCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.O2M,
+			Inverse: true,
+			Table:   organization.PlatformsTable,
+			Columns: []string{organization.PlatformsColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(platform.FieldID, field.TypeUUID),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := ouo.mutation.PlatformsIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.O2M,
+			Inverse: true,
+			Table:   organization.PlatformsTable,
+			Columns: []string{organization.PlatformsColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(platform.FieldID, field.TypeUUID),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Add = append(_spec.Edges.Add, edge)
+	}
 	_node = &Organization{config: ouo.config}
 	_spec.Assign = _node.assignValues
 	_spec.ScanValues = _node.scanValues

internal/ent/platform.go

@@ -0,0 +1,262 @@
+// Code generated by ent, DO NOT EDIT.
+
+package ent
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+	"time"
+
+	"entgo.io/ent"
+	"entgo.io/ent/dialect/sql"
+	"github.com/gofrs/uuid"
+	"github.com/holos-run/holos/internal/ent/organization"
+	"github.com/holos-run/holos/internal/ent/platform"
+	"github.com/holos-run/holos/internal/ent/user"
+	holos "github.com/holos-run/holos/service/gen/holos/v1alpha1"
+)
+
+// Platform is the model entity for the Platform schema.
+type Platform struct {
+	config `json:"-"`
+	// ID of the ent.
+	ID uuid.UUID `json:"id,omitempty"`
+	// CreatedAt holds the value of the "created_at" field.
+	CreatedAt time.Time `json:"created_at,omitempty"`
+	// UpdatedAt holds the value of the "updated_at" field.
+	UpdatedAt time.Time `json:"updated_at,omitempty"`
+	// OrgID holds the value of the "org_id" field.
+	OrgID uuid.UUID `json:"org_id,omitempty"`
+	// Name holds the value of the "name" field.
+	Name string `json:"name,omitempty"`
+	// DisplayName holds the value of the "display_name" field.
+	DisplayName string `json:"display_name,omitempty"`
+	// CreatorID holds the value of the "creator_id" field.
+	CreatorID uuid.UUID `json:"creator_id,omitempty"`
+	// JSON holos.PlatformForm representing the platform data entry form.
+	ConfigForm *holos.PlatformForm `json:"config_form,omitempty"`
+	// JSON holos.ConfigValues representing the platform config values.
+	ConfigValues *holos.ConfigValues `json:"config_values,omitempty"`
+	// Opaque bytes representing the CUE definition of the config struct.
+	ConfigCue []byte `json:"config_cue,omitempty"`
+	// The definition name to vet config_values against config_cue e.g. '#PlatformSpec'
+	ConfigDefinition string `json:"config_definition,omitempty"`
+	// Edges holds the relations/edges for other nodes in the graph.
+	// The values are being populated by the PlatformQuery when eager-loading is set.
+	Edges        PlatformEdges `json:"edges"`
+	selectValues sql.SelectValues
+}
+
+// PlatformEdges holds the relations/edges for other nodes in the graph.
+type PlatformEdges struct {
+	// Creator holds the value of the creator edge.
+	Creator *User `json:"creator,omitempty"`
+	// Organization holds the value of the organization edge.
+	Organization *Organization `json:"organization,omitempty"`
+	// loadedTypes holds the information for reporting if a
+	// type was loaded (or requested) in eager-loading or not.
+	loadedTypes [2]bool
+}
+
+// CreatorOrErr returns the Creator value or an error if the edge
+// was not loaded in eager-loading, or loaded but was not found.
+func (e PlatformEdges) CreatorOrErr() (*User, error) {
+	if e.Creator != nil {
+		return e.Creator, nil
+	} else if e.loadedTypes[0] {
+		return nil, &NotFoundError{label: user.Label}
+	}
+	return nil, &NotLoadedError{edge: "creator"}
+}
+
+// OrganizationOrErr returns the Organization value or an error if the edge
+// was not loaded in eager-loading, or loaded but was not found.
+func (e PlatformEdges) OrganizationOrErr() (*Organization, error) {
+	if e.Organization != nil {
+		return e.Organization, nil
+	} else if e.loadedTypes[1] {
+		return nil, &NotFoundError{label: organization.Label}
+	}
+	return nil, &NotLoadedError{edge: "organization"}
+}
+
+// scanValues returns the types for scanning values from sql.Rows.
+func (*Platform) scanValues(columns []string) ([]any, error) {
+	values := make([]any, len(columns))
+	for i := range columns {
+		switch columns[i] {
+		case platform.FieldConfigForm, platform.FieldConfigValues, platform.FieldConfigCue:
+			values[i] = new([]byte)
+		case platform.FieldName, platform.FieldDisplayName, platform.FieldConfigDefinition:
+			values[i] = new(sql.NullString)
+		case platform.FieldCreatedAt, platform.FieldUpdatedAt:
+			values[i] = new(sql.NullTime)
+		case platform.FieldID, platform.FieldOrgID, platform.FieldCreatorID:
+			values[i] = new(uuid.UUID)
+		default:
+			values[i] = new(sql.UnknownType)
+		}
+	}
+	return values, nil
+}
+
+// assignValues assigns the values that were returned from sql.Rows (after scanning)
+// to the Platform fields.
+func (pl *Platform) assignValues(columns []string, values []any) error {
+	if m, n := len(values), len(columns); m < n {
+		return fmt.Errorf("mismatch number of scan values: %d != %d", m, n)
+	}
+	for i := range columns {
+		switch columns[i] {
+		case platform.FieldID:
+			if value, ok := values[i].(*uuid.UUID); !ok {
+				return fmt.Errorf("unexpected type %T for field id", values[i])
+			} else if value != nil {
+				pl.ID = *value
+			}
+		case platform.FieldCreatedAt:
+			if value, ok := values[i].(*sql.NullTime); !ok {
+				return fmt.Errorf("unexpected type %T for field created_at", values[i])
+			} else if value.Valid {
+				pl.CreatedAt = value.Time
+			}
+		case platform.FieldUpdatedAt:
+			if value, ok := values[i].(*sql.NullTime); !ok {
+				return fmt.Errorf("unexpected type %T for field updated_at", values[i])
+			} else if value.Valid {
+				pl.UpdatedAt = value.Time
+			}
+		case platform.FieldOrgID:
+			if value, ok := values[i].(*uuid.UUID); !ok {
+				return fmt.Errorf("unexpected type %T for field org_id", values[i])
+			} else if value != nil {
+				pl.OrgID = *value
+			}
+		case platform.FieldName:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field name", values[i])
+			} else if value.Valid {
+				pl.Name = value.String
+			}
+		case platform.FieldDisplayName:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field display_name", values[i])
+			} else if value.Valid {
+				pl.DisplayName = value.String
+			}
+		case platform.FieldCreatorID:
+			if value, ok := values[i].(*uuid.UUID); !ok {
+				return fmt.Errorf("unexpected type %T for field creator_id", values[i])
+			} else if value != nil {
+				pl.CreatorID = *value
+			}
+		case platform.FieldConfigForm:
+			if value, ok := values[i].(*[]byte); !ok {
+				return fmt.Errorf("unexpected type %T for field config_form", values[i])
+			} else if value != nil && len(*value) > 0 {
+				if err := json.Unmarshal(*value, &pl.ConfigForm); err != nil {
+					return fmt.Errorf("unmarshal field config_form: %w", err)
+				}
+			}
+		case platform.FieldConfigValues:
+			if value, ok := values[i].(*[]byte); !ok {
+				return fmt.Errorf("unexpected type %T for field config_values", values[i])
+			} else if value != nil && len(*value) > 0 {
+				if err := json.Unmarshal(*value, &pl.ConfigValues); err != nil {
+					return fmt.Errorf("unmarshal field config_values: %w", err)
+				}
+			}
+		case platform.FieldConfigCue:
+			if value, ok := values[i].(*[]byte); !ok {
+				return fmt.Errorf("unexpected type %T for field config_cue", values[i])
+			} else if value != nil {
+				pl.ConfigCue = *value
+			}
+		case platform.FieldConfigDefinition:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field config_definition", values[i])
+			} else if value.Valid {
+				pl.ConfigDefinition = value.String
+			}
+		default:
+			pl.selectValues.Set(columns[i], values[i])
+		}
+	}
+	return nil
+}
+
+// Value returns the ent.Value that was dynamically selected and assigned to the Platform.
+// This includes values selected through modifiers, order, etc.
+func (pl *Platform) Value(name string) (ent.Value, error) {
+	return pl.selectValues.Get(name)
+}
+
+// QueryCreator queries the "creator" edge of the Platform entity.
+func (pl *Platform) QueryCreator() *UserQuery {
+	return NewPlatformClient(pl.config).QueryCreator(pl)
+}
+
+// QueryOrganization queries the "organization" edge of the Platform entity.
+func (pl *Platform) QueryOrganization() *OrganizationQuery {
+	return NewPlatformClient(pl.config).QueryOrganization(pl)
+}
+
+// Update returns a builder for updating this Platform.
+// Note that you need to call Platform.Unwrap() before calling this method if this Platform
+// was returned from a transaction, and the transaction was committed or rolled back.
+func (pl *Platform) Update() *PlatformUpdateOne {
+	return NewPlatformClient(pl.config).UpdateOne(pl)
+}
+
+// Unwrap unwraps the Platform entity that was returned from a transaction after it was closed,
+// so that all future queries will be executed through the driver which created the transaction.
+func (pl *Platform) Unwrap() *Platform {
+	_tx, ok := pl.config.driver.(*txDriver)
+	if !ok {
+		panic("ent: Platform is not a transactional entity")
+	}
+	pl.config.driver = _tx.drv
+	return pl
+}
+
+// String implements the fmt.Stringer.
+func (pl *Platform) String() string {
+	var builder strings.Builder
+	builder.WriteString("Platform(")
+	builder.WriteString(fmt.Sprintf("id=%v, ", pl.ID))
+	builder.WriteString("created_at=")
+	builder.WriteString(pl.CreatedAt.Format(time.ANSIC))
+	builder.WriteString(", ")
+	builder.WriteString("updated_at=")
+	builder.WriteString(pl.UpdatedAt.Format(time.ANSIC))
+	builder.WriteString(", ")
+	builder.WriteString("org_id=")
+	builder.WriteString(fmt.Sprintf("%v", pl.OrgID))
+	builder.WriteString(", ")
+	builder.WriteString("name=")
+	builder.WriteString(pl.Name)
+	builder.WriteString(", ")
+	builder.WriteString("display_name=")
+	builder.WriteString(pl.DisplayName)
+	builder.WriteString(", ")
+	builder.WriteString("creator_id=")
+	builder.WriteString(fmt.Sprintf("%v", pl.CreatorID))
+	builder.WriteString(", ")
+	builder.WriteString("config_form=")
+	builder.WriteString(fmt.Sprintf("%v", pl.ConfigForm))
+	builder.WriteString(", ")
+	builder.WriteString("config_values=")
+	builder.WriteString(fmt.Sprintf("%v", pl.ConfigValues))
+	builder.WriteString(", ")
+	builder.WriteString("config_cue=")
+	builder.WriteString(fmt.Sprintf("%v", pl.ConfigCue))
+	builder.WriteString(", ")
+	builder.WriteString("config_definition=")
+	builder.WriteString(pl.ConfigDefinition)
+	builder.WriteByte(')')
+	return builder.String()
+}
+
+// Platforms is a parsable slice of Platform.
+type Platforms []*Platform

internal/ent/platform/platform.go

@@ -0,0 +1,167 @@
+// Code generated by ent, DO NOT EDIT.
+
+package platform
+
+import (
+	"time"
+
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"github.com/gofrs/uuid"
+)
+
+const (
+	// Label holds the string label denoting the platform type in the database.
+	Label = "platform"
+	// FieldID holds the string denoting the id field in the database.
+	FieldID = "id"
+	// FieldCreatedAt holds the string denoting the created_at field in the database.
+	FieldCreatedAt = "created_at"
+	// FieldUpdatedAt holds the string denoting the updated_at field in the database.
+	FieldUpdatedAt = "updated_at"
+	// FieldOrgID holds the string denoting the org_id field in the database.
+	FieldOrgID = "org_id"
+	// FieldName holds the string denoting the name field in the database.
+	FieldName = "name"
+	// FieldDisplayName holds the string denoting the display_name field in the database.
+	FieldDisplayName = "display_name"
+	// FieldCreatorID holds the string denoting the creator_id field in the database.
+	FieldCreatorID = "creator_id"
+	// FieldConfigForm holds the string denoting the config_form field in the database.
+	FieldConfigForm = "config_form"
+	// FieldConfigValues holds the string denoting the config_values field in the database.
+	FieldConfigValues = "config_values"
+	// FieldConfigCue holds the string denoting the config_cue field in the database.
+	FieldConfigCue = "config_cue"
+	// FieldConfigDefinition holds the string denoting the config_definition field in the database.
+	FieldConfigDefinition = "config_definition"
+	// EdgeCreator holds the string denoting the creator edge name in mutations.
+	EdgeCreator = "creator"
+	// EdgeOrganization holds the string denoting the organization edge name in mutations.
+	EdgeOrganization = "organization"
+	// Table holds the table name of the platform in the database.
+	Table = "platforms"
+	// CreatorTable is the table that holds the creator relation/edge.
+	CreatorTable = "platforms"
+	// CreatorInverseTable is the table name for the User entity.
+	// It exists in this package in order to avoid circular dependency with the "user" package.
+	CreatorInverseTable = "users"
+	// CreatorColumn is the table column denoting the creator relation/edge.
+	CreatorColumn = "creator_id"
+	// OrganizationTable is the table that holds the organization relation/edge.
+	OrganizationTable = "platforms"
+	// OrganizationInverseTable is the table name for the Organization entity.
+	// It exists in this package in order to avoid circular dependency with the "organization" package.
+	OrganizationInverseTable = "organizations"
+	// OrganizationColumn is the table column denoting the organization relation/edge.
+	OrganizationColumn = "org_id"
+)
+
+// Columns holds all SQL columns for platform fields.
+var Columns = []string{
+	FieldID,
+	FieldCreatedAt,
+	FieldUpdatedAt,
+	FieldOrgID,
+	FieldName,
+	FieldDisplayName,
+	FieldCreatorID,
+	FieldConfigForm,
+	FieldConfigValues,
+	FieldConfigCue,
+	FieldConfigDefinition,
+}
+
+// ValidColumn reports if the column name is valid (part of the table columns).
+func ValidColumn(column string) bool {
+	for i := range Columns {
+		if column == Columns[i] {
+			return true
+		}
+	}
+	return false
+}
+
+var (
+	// DefaultCreatedAt holds the default value on creation for the "created_at" field.
+	DefaultCreatedAt func() time.Time
+	// DefaultUpdatedAt holds the default value on creation for the "updated_at" field.
+	DefaultUpdatedAt func() time.Time
+	// UpdateDefaultUpdatedAt holds the default value on update for the "updated_at" field.
+	UpdateDefaultUpdatedAt func() time.Time
+	// NameValidator is a validator for the "name" field. It is called by the builders before save.
+	NameValidator func(string) error
+	// DefaultID holds the default value on creation for the "id" field.
+	DefaultID func() uuid.UUID
+)
+
+// OrderOption defines the ordering options for the Platform queries.
+type OrderOption func(*sql.Selector)
+
+// ByID orders the results by the id field.
+func ByID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldID, opts...).ToFunc()
+}
+
+// ByCreatedAt orders the results by the created_at field.
+func ByCreatedAt(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldCreatedAt, opts...).ToFunc()
+}
+
+// ByUpdatedAt orders the results by the updated_at field.
+func ByUpdatedAt(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldUpdatedAt, opts...).ToFunc()
+}
+
+// ByOrgID orders the results by the org_id field.
+func ByOrgID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldOrgID, opts...).ToFunc()
+}
+
+// ByName orders the results by the name field.
+func ByName(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldName, opts...).ToFunc()
+}
+
+// ByDisplayName orders the results by the display_name field.
+func ByDisplayName(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldDisplayName, opts...).ToFunc()
+}
+
+// ByCreatorID orders the results by the creator_id field.
+func ByCreatorID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldCreatorID, opts...).ToFunc()
+}
+
+// ByConfigDefinition orders the results by the config_definition field.
+func ByConfigDefinition(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldConfigDefinition, opts...).ToFunc()
+}
+
+// ByCreatorField orders the results by creator field.
+func ByCreatorField(field string, opts ...sql.OrderTermOption) OrderOption {
+	return func(s *sql.Selector) {
+		sqlgraph.OrderByNeighborTerms(s, newCreatorStep(), sql.OrderByField(field, opts...))
+	}
+}
+
+// ByOrganizationField orders the results by organization field.
+func ByOrganizationField(field string, opts ...sql.OrderTermOption) OrderOption {
+	return func(s *sql.Selector) {
+		sqlgraph.OrderByNeighborTerms(s, newOrganizationStep(), sql.OrderByField(field, opts...))
+	}
+}
+func newCreatorStep() *sqlgraph.Step {
+	return sqlgraph.NewStep(
+		sqlgraph.From(Table, FieldID),
+		sqlgraph.To(CreatorInverseTable, FieldID),
+		sqlgraph.Edge(sqlgraph.M2O, false, CreatorTable, CreatorColumn),
+	)
+}
+func newOrganizationStep() *sqlgraph.Step {
+	return sqlgraph.NewStep(
+		sqlgraph.From(Table, FieldID),
+		sqlgraph.To(OrganizationInverseTable, FieldID),
+		sqlgraph.Edge(sqlgraph.M2O, false, OrganizationTable, OrganizationColumn),
+	)
+}

internal/ent/platform/where.go

@@ -0,0 +1,553 @@
+// Code generated by ent, DO NOT EDIT.
+
+package platform
+
+import (
+	"time"
+
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"github.com/gofrs/uuid"
+	"github.com/holos-run/holos/internal/ent/predicate"
+)
+
+// ID filters vertices based on their ID field.
+func ID(id uuid.UUID) predicate.Platform {
+	return predicate.Platform(sql.FieldEQ(FieldID, id))
+}
+
+// IDEQ applies the EQ predicate on the ID field.
+func IDEQ(id uuid.UUID) predicate.Platform {
+	return predicate.Platform(sql.FieldEQ(FieldID, id))
+}
+
+// IDNEQ applies the NEQ predicate on the ID field.
+func IDNEQ(id uuid.UUID) predicate.Platform {
+	return predicate.Platform(sql.FieldNEQ(FieldID, id))
+}
+
+// IDIn applies the In predicate on the ID field.
+func IDIn(ids ...uuid.UUID) predicate.Platform {
+	return predicate.Platform(sql.FieldIn(FieldID, ids...))
+}
+
+// IDNotIn applies the NotIn predicate on the ID field.
+func IDNotIn(ids ...uuid.UUID) predicate.Platform {
+	return predicate.Platform(sql.FieldNotIn(FieldID, ids...))
+}
+
+// IDGT applies the GT predicate on the ID field.
+func IDGT(id uuid.UUID) predicate.Platform {
+	return predicate.Platform(sql.FieldGT(FieldID, id))
+}
+
+// IDGTE applies the GTE predicate on the ID field.
+func IDGTE(id uuid.UUID) predicate.Platform {
+	return predicate.Platform(sql.FieldGTE(FieldID, id))
+}
+
+// IDLT applies the LT predicate on the ID field.
+func IDLT(id uuid.UUID) predicate.Platform {
+	return predicate.Platform(sql.FieldLT(FieldID, id))
+}
+
+// IDLTE applies the LTE predicate on the ID field.
+func IDLTE(id uuid.UUID) predicate.Platform {
+	return predicate.Platform(sql.FieldLTE(FieldID, id))
+}
+
+// CreatedAt applies equality check predicate on the "created_at" field. It's identical to CreatedAtEQ.
+func CreatedAt(v time.Time) predicate.Platform {
+	return predicate.Platform(sql.FieldEQ(FieldCreatedAt, v))
+}
+
+// UpdatedAt applies equality check predicate on the "updated_at" field. It's identical to UpdatedAtEQ.
+func UpdatedAt(v time.Time) predicate.Platform {
+	return predicate.Platform(sql.FieldEQ(FieldUpdatedAt, v))
+}
+
+// OrgID applies equality check predicate on the "org_id" field. It's identical to OrgIDEQ.
+func OrgID(v uuid.UUID) predicate.Platform {
+	return predicate.Platform(sql.FieldEQ(FieldOrgID, v))
+}
+
+// Name applies equality check predicate on the "name" field. It's identical to NameEQ.
+func Name(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldEQ(FieldName, v))
+}
+
+// DisplayName applies equality check predicate on the "display_name" field. It's identical to DisplayNameEQ.
+func DisplayName(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldEQ(FieldDisplayName, v))
+}
+
+// CreatorID applies equality check predicate on the "creator_id" field. It's identical to CreatorIDEQ.
+func CreatorID(v uuid.UUID) predicate.Platform {
+	return predicate.Platform(sql.FieldEQ(FieldCreatorID, v))
+}
+
+// ConfigCue applies equality check predicate on the "config_cue" field. It's identical to ConfigCueEQ.
+func ConfigCue(v []byte) predicate.Platform {
+	return predicate.Platform(sql.FieldEQ(FieldConfigCue, v))
+}
+
+// ConfigDefinition applies equality check predicate on the "config_definition" field. It's identical to ConfigDefinitionEQ.
+func ConfigDefinition(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldEQ(FieldConfigDefinition, v))
+}
+
+// CreatedAtEQ applies the EQ predicate on the "created_at" field.
+func CreatedAtEQ(v time.Time) predicate.Platform {
+	return predicate.Platform(sql.FieldEQ(FieldCreatedAt, v))
+}
+
+// CreatedAtNEQ applies the NEQ predicate on the "created_at" field.
+func CreatedAtNEQ(v time.Time) predicate.Platform {
+	return predicate.Platform(sql.FieldNEQ(FieldCreatedAt, v))
+}
+
+// CreatedAtIn applies the In predicate on the "created_at" field.
+func CreatedAtIn(vs ...time.Time) predicate.Platform {
+	return predicate.Platform(sql.FieldIn(FieldCreatedAt, vs...))
+}
+
+// CreatedAtNotIn applies the NotIn predicate on the "created_at" field.
+func CreatedAtNotIn(vs ...time.Time) predicate.Platform {
+	return predicate.Platform(sql.FieldNotIn(FieldCreatedAt, vs...))
+}
+
+// CreatedAtGT applies the GT predicate on the "created_at" field.
+func CreatedAtGT(v time.Time) predicate.Platform {
+	return predicate.Platform(sql.FieldGT(FieldCreatedAt, v))
+}
+
+// CreatedAtGTE applies the GTE predicate on the "created_at" field.
+func CreatedAtGTE(v time.Time) predicate.Platform {
+	return predicate.Platform(sql.FieldGTE(FieldCreatedAt, v))
+}
+
+// CreatedAtLT applies the LT predicate on the "created_at" field.
+func CreatedAtLT(v time.Time) predicate.Platform {
+	return predicate.Platform(sql.FieldLT(FieldCreatedAt, v))
+}
+
+// CreatedAtLTE applies the LTE predicate on the "created_at" field.
+func CreatedAtLTE(v time.Time) predicate.Platform {
+	return predicate.Platform(sql.FieldLTE(FieldCreatedAt, v))
+}
+
+// UpdatedAtEQ applies the EQ predicate on the "updated_at" field.
+func UpdatedAtEQ(v time.Time) predicate.Platform {
+	return predicate.Platform(sql.FieldEQ(FieldUpdatedAt, v))
+}
+
+// UpdatedAtNEQ applies the NEQ predicate on the "updated_at" field.
+func UpdatedAtNEQ(v time.Time) predicate.Platform {
+	return predicate.Platform(sql.FieldNEQ(FieldUpdatedAt, v))
+}
+
+// UpdatedAtIn applies the In predicate on the "updated_at" field.
+func UpdatedAtIn(vs ...time.Time) predicate.Platform {
+	return predicate.Platform(sql.FieldIn(FieldUpdatedAt, vs...))
+}
+
+// UpdatedAtNotIn applies the NotIn predicate on the "updated_at" field.
+func UpdatedAtNotIn(vs ...time.Time) predicate.Platform {
+	return predicate.Platform(sql.FieldNotIn(FieldUpdatedAt, vs...))
+}
+
+// UpdatedAtGT applies the GT predicate on the "updated_at" field.
+func UpdatedAtGT(v time.Time) predicate.Platform {
+	return predicate.Platform(sql.FieldGT(FieldUpdatedAt, v))
+}
+
+// UpdatedAtGTE applies the GTE predicate on the "updated_at" field.
+func UpdatedAtGTE(v time.Time) predicate.Platform {
+	return predicate.Platform(sql.FieldGTE(FieldUpdatedAt, v))
+}
+
+// UpdatedAtLT applies the LT predicate on the "updated_at" field.
+func UpdatedAtLT(v time.Time) predicate.Platform {
+	return predicate.Platform(sql.FieldLT(FieldUpdatedAt, v))
+}
+
+// UpdatedAtLTE applies the LTE predicate on the "updated_at" field.
+func UpdatedAtLTE(v time.Time) predicate.Platform {
+	return predicate.Platform(sql.FieldLTE(FieldUpdatedAt, v))
+}
+
+// OrgIDEQ applies the EQ predicate on the "org_id" field.
+func OrgIDEQ(v uuid.UUID) predicate.Platform {
+	return predicate.Platform(sql.FieldEQ(FieldOrgID, v))
+}
+
+// OrgIDNEQ applies the NEQ predicate on the "org_id" field.
+func OrgIDNEQ(v uuid.UUID) predicate.Platform {
+	return predicate.Platform(sql.FieldNEQ(FieldOrgID, v))
+}
+
+// OrgIDIn applies the In predicate on the "org_id" field.
+func OrgIDIn(vs ...uuid.UUID) predicate.Platform {
+	return predicate.Platform(sql.FieldIn(FieldOrgID, vs...))
+}
+
+// OrgIDNotIn applies the NotIn predicate on the "org_id" field.
+func OrgIDNotIn(vs ...uuid.UUID) predicate.Platform {
+	return predicate.Platform(sql.FieldNotIn(FieldOrgID, vs...))
+}
+
+// NameEQ applies the EQ predicate on the "name" field.
+func NameEQ(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldEQ(FieldName, v))
+}
+
+// NameNEQ applies the NEQ predicate on the "name" field.
+func NameNEQ(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldNEQ(FieldName, v))
+}
+
+// NameIn applies the In predicate on the "name" field.
+func NameIn(vs ...string) predicate.Platform {
+	return predicate.Platform(sql.FieldIn(FieldName, vs...))
+}
+
+// NameNotIn applies the NotIn predicate on the "name" field.
+func NameNotIn(vs ...string) predicate.Platform {
+	return predicate.Platform(sql.FieldNotIn(FieldName, vs...))
+}
+
+// NameGT applies the GT predicate on the "name" field.
+func NameGT(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldGT(FieldName, v))
+}
+
+// NameGTE applies the GTE predicate on the "name" field.
+func NameGTE(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldGTE(FieldName, v))
+}
+
+// NameLT applies the LT predicate on the "name" field.
+func NameLT(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldLT(FieldName, v))
+}
+
+// NameLTE applies the LTE predicate on the "name" field.
+func NameLTE(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldLTE(FieldName, v))
+}
+
+// NameContains applies the Contains predicate on the "name" field.
+func NameContains(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldContains(FieldName, v))
+}
+
+// NameHasPrefix applies the HasPrefix predicate on the "name" field.
+func NameHasPrefix(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldHasPrefix(FieldName, v))
+}
+
+// NameHasSuffix applies the HasSuffix predicate on the "name" field.
+func NameHasSuffix(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldHasSuffix(FieldName, v))
+}
+
+// NameEqualFold applies the EqualFold predicate on the "name" field.
+func NameEqualFold(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldEqualFold(FieldName, v))
+}
+
+// NameContainsFold applies the ContainsFold predicate on the "name" field.
+func NameContainsFold(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldContainsFold(FieldName, v))
+}
+
+// DisplayNameEQ applies the EQ predicate on the "display_name" field.
+func DisplayNameEQ(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldEQ(FieldDisplayName, v))
+}
+
+// DisplayNameNEQ applies the NEQ predicate on the "display_name" field.
+func DisplayNameNEQ(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldNEQ(FieldDisplayName, v))
+}
+
+// DisplayNameIn applies the In predicate on the "display_name" field.
+func DisplayNameIn(vs ...string) predicate.Platform {
+	return predicate.Platform(sql.FieldIn(FieldDisplayName, vs...))
+}
+
+// DisplayNameNotIn applies the NotIn predicate on the "display_name" field.
+func DisplayNameNotIn(vs ...string) predicate.Platform {
+	return predicate.Platform(sql.FieldNotIn(FieldDisplayName, vs...))
+}
+
+// DisplayNameGT applies the GT predicate on the "display_name" field.
+func DisplayNameGT(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldGT(FieldDisplayName, v))
+}
+
+// DisplayNameGTE applies the GTE predicate on the "display_name" field.
+func DisplayNameGTE(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldGTE(FieldDisplayName, v))
+}
+
+// DisplayNameLT applies the LT predicate on the "display_name" field.
+func DisplayNameLT(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldLT(FieldDisplayName, v))
+}
+
+// DisplayNameLTE applies the LTE predicate on the "display_name" field.
+func DisplayNameLTE(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldLTE(FieldDisplayName, v))
+}
+
+// DisplayNameContains applies the Contains predicate on the "display_name" field.
+func DisplayNameContains(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldContains(FieldDisplayName, v))
+}
+
+// DisplayNameHasPrefix applies the HasPrefix predicate on the "display_name" field.
+func DisplayNameHasPrefix(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldHasPrefix(FieldDisplayName, v))
+}
+
+// DisplayNameHasSuffix applies the HasSuffix predicate on the "display_name" field.
+func DisplayNameHasSuffix(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldHasSuffix(FieldDisplayName, v))
+}
+
+// DisplayNameEqualFold applies the EqualFold predicate on the "display_name" field.
+func DisplayNameEqualFold(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldEqualFold(FieldDisplayName, v))
+}
+
+// DisplayNameContainsFold applies the ContainsFold predicate on the "display_name" field.
+func DisplayNameContainsFold(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldContainsFold(FieldDisplayName, v))
+}
+
+// CreatorIDEQ applies the EQ predicate on the "creator_id" field.
+func CreatorIDEQ(v uuid.UUID) predicate.Platform {
+	return predicate.Platform(sql.FieldEQ(FieldCreatorID, v))
+}
+
+// CreatorIDNEQ applies the NEQ predicate on the "creator_id" field.
+func CreatorIDNEQ(v uuid.UUID) predicate.Platform {
+	return predicate.Platform(sql.FieldNEQ(FieldCreatorID, v))
+}
+
+// CreatorIDIn applies the In predicate on the "creator_id" field.
+func CreatorIDIn(vs ...uuid.UUID) predicate.Platform {
+	return predicate.Platform(sql.FieldIn(FieldCreatorID, vs...))
+}
+
+// CreatorIDNotIn applies the NotIn predicate on the "creator_id" field.
+func CreatorIDNotIn(vs ...uuid.UUID) predicate.Platform {
+	return predicate.Platform(sql.FieldNotIn(FieldCreatorID, vs...))
+}
+
+// ConfigFormIsNil applies the IsNil predicate on the "config_form" field.
+func ConfigFormIsNil() predicate.Platform {
+	return predicate.Platform(sql.FieldIsNull(FieldConfigForm))
+}
+
+// ConfigFormNotNil applies the NotNil predicate on the "config_form" field.
+func ConfigFormNotNil() predicate.Platform {
+	return predicate.Platform(sql.FieldNotNull(FieldConfigForm))
+}
+
+// ConfigValuesIsNil applies the IsNil predicate on the "config_values" field.
+func ConfigValuesIsNil() predicate.Platform {
+	return predicate.Platform(sql.FieldIsNull(FieldConfigValues))
+}
+
+// ConfigValuesNotNil applies the NotNil predicate on the "config_values" field.
+func ConfigValuesNotNil() predicate.Platform {
+	return predicate.Platform(sql.FieldNotNull(FieldConfigValues))
+}
+
+// ConfigCueEQ applies the EQ predicate on the "config_cue" field.
+func ConfigCueEQ(v []byte) predicate.Platform {
+	return predicate.Platform(sql.FieldEQ(FieldConfigCue, v))
+}
+
+// ConfigCueNEQ applies the NEQ predicate on the "config_cue" field.
+func ConfigCueNEQ(v []byte) predicate.Platform {
+	return predicate.Platform(sql.FieldNEQ(FieldConfigCue, v))
+}
+
+// ConfigCueIn applies the In predicate on the "config_cue" field.
+func ConfigCueIn(vs ...[]byte) predicate.Platform {
+	return predicate.Platform(sql.FieldIn(FieldConfigCue, vs...))
+}
+
+// ConfigCueNotIn applies the NotIn predicate on the "config_cue" field.
+func ConfigCueNotIn(vs ...[]byte) predicate.Platform {
+	return predicate.Platform(sql.FieldNotIn(FieldConfigCue, vs...))
+}
+
+// ConfigCueGT applies the GT predicate on the "config_cue" field.
+func ConfigCueGT(v []byte) predicate.Platform {
+	return predicate.Platform(sql.FieldGT(FieldConfigCue, v))
+}
+
+// ConfigCueGTE applies the GTE predicate on the "config_cue" field.
+func ConfigCueGTE(v []byte) predicate.Platform {
+	return predicate.Platform(sql.FieldGTE(FieldConfigCue, v))
+}
+
+// ConfigCueLT applies the LT predicate on the "config_cue" field.
+func ConfigCueLT(v []byte) predicate.Platform {
+	return predicate.Platform(sql.FieldLT(FieldConfigCue, v))
+}
+
+// ConfigCueLTE applies the LTE predicate on the "config_cue" field.
+func ConfigCueLTE(v []byte) predicate.Platform {
+	return predicate.Platform(sql.FieldLTE(FieldConfigCue, v))
+}
+
+// ConfigCueIsNil applies the IsNil predicate on the "config_cue" field.
+func ConfigCueIsNil() predicate.Platform {
+	return predicate.Platform(sql.FieldIsNull(FieldConfigCue))
+}
+
+// ConfigCueNotNil applies the NotNil predicate on the "config_cue" field.
+func ConfigCueNotNil() predicate.Platform {
+	return predicate.Platform(sql.FieldNotNull(FieldConfigCue))
+}
+
+// ConfigDefinitionEQ applies the EQ predicate on the "config_definition" field.
+func ConfigDefinitionEQ(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldEQ(FieldConfigDefinition, v))
+}
+
+// ConfigDefinitionNEQ applies the NEQ predicate on the "config_definition" field.
+func ConfigDefinitionNEQ(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldNEQ(FieldConfigDefinition, v))
+}
+
+// ConfigDefinitionIn applies the In predicate on the "config_definition" field.
+func ConfigDefinitionIn(vs ...string) predicate.Platform {
+	return predicate.Platform(sql.FieldIn(FieldConfigDefinition, vs...))
+}
+
+// ConfigDefinitionNotIn applies the NotIn predicate on the "config_definition" field.
+func ConfigDefinitionNotIn(vs ...string) predicate.Platform {
+	return predicate.Platform(sql.FieldNotIn(FieldConfigDefinition, vs...))
+}
+
+// ConfigDefinitionGT applies the GT predicate on the "config_definition" field.
+func ConfigDefinitionGT(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldGT(FieldConfigDefinition, v))
+}
+
+// ConfigDefinitionGTE applies the GTE predicate on the "config_definition" field.
+func ConfigDefinitionGTE(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldGTE(FieldConfigDefinition, v))
+}
+
+// ConfigDefinitionLT applies the LT predicate on the "config_definition" field.
+func ConfigDefinitionLT(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldLT(FieldConfigDefinition, v))
+}
+
+// ConfigDefinitionLTE applies the LTE predicate on the "config_definition" field.
+func ConfigDefinitionLTE(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldLTE(FieldConfigDefinition, v))
+}
+
+// ConfigDefinitionContains applies the Contains predicate on the "config_definition" field.
+func ConfigDefinitionContains(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldContains(FieldConfigDefinition, v))
+}
+
+// ConfigDefinitionHasPrefix applies the HasPrefix predicate on the "config_definition" field.
+func ConfigDefinitionHasPrefix(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldHasPrefix(FieldConfigDefinition, v))
+}
+
+// ConfigDefinitionHasSuffix applies the HasSuffix predicate on the "config_definition" field.
+func ConfigDefinitionHasSuffix(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldHasSuffix(FieldConfigDefinition, v))
+}
+
+// ConfigDefinitionIsNil applies the IsNil predicate on the "config_definition" field.
+func ConfigDefinitionIsNil() predicate.Platform {
+	return predicate.Platform(sql.FieldIsNull(FieldConfigDefinition))
+}
+
+// ConfigDefinitionNotNil applies the NotNil predicate on the "config_definition" field.
+func ConfigDefinitionNotNil() predicate.Platform {
+	return predicate.Platform(sql.FieldNotNull(FieldConfigDefinition))
+}
+
+// ConfigDefinitionEqualFold applies the EqualFold predicate on the "config_definition" field.
+func ConfigDefinitionEqualFold(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldEqualFold(FieldConfigDefinition, v))
+}
+
+// ConfigDefinitionContainsFold applies the ContainsFold predicate on the "config_definition" field.
+func ConfigDefinitionContainsFold(v string) predicate.Platform {
+	return predicate.Platform(sql.FieldContainsFold(FieldConfigDefinition, v))
+}
+
+// HasCreator applies the HasEdge predicate on the "creator" edge.
+func HasCreator() predicate.Platform {
+	return predicate.Platform(func(s *sql.Selector) {
+		step := sqlgraph.NewStep(
+			sqlgraph.From(Table, FieldID),
+			sqlgraph.Edge(sqlgraph.M2O, false, CreatorTable, CreatorColumn),
+		)
+		sqlgraph.HasNeighbors(s, step)
+	})
+}
+
+// HasCreatorWith applies the HasEdge predicate on the "creator" edge with a given conditions (other predicates).
+func HasCreatorWith(preds ...predicate.User) predicate.Platform {
+	return predicate.Platform(func(s *sql.Selector) {
+		step := newCreatorStep()
+		sqlgraph.HasNeighborsWith(s, step, func(s *sql.Selector) {
+			for _, p := range preds {
+				p(s)
+			}
+		})
+	})
+}
+
+// HasOrganization applies the HasEdge predicate on the "organization" edge.
+func HasOrganization() predicate.Platform {
+	return predicate.Platform(func(s *sql.Selector) {
+		step := sqlgraph.NewStep(
+			sqlgraph.From(Table, FieldID),
+			sqlgraph.Edge(sqlgraph.M2O, false, OrganizationTable, OrganizationColumn),
+		)
+		sqlgraph.HasNeighbors(s, step)
+	})
+}
+
+// HasOrganizationWith applies the HasEdge predicate on the "organization" edge with a given conditions (other predicates).
+func HasOrganizationWith(preds ...predicate.Organization) predicate.Platform {
+	return predicate.Platform(func(s *sql.Selector) {
+		step := newOrganizationStep()
+		sqlgraph.HasNeighborsWith(s, step, func(s *sql.Selector) {
+			for _, p := range preds {
+				p(s)
+			}
+		})
+	})
+}
+
+// And groups predicates with the AND operator between them.
+func And(predicates ...predicate.Platform) predicate.Platform {
+	return predicate.Platform(sql.AndPredicates(predicates...))
+}
+
+// Or groups predicates with the OR operator between them.
+func Or(predicates ...predicate.Platform) predicate.Platform {
+	return predicate.Platform(sql.OrPredicates(predicates...))
+}
+
+// Not applies the not operator on the given predicate.
+func Not(p predicate.Platform) predicate.Platform {
+	return predicate.Platform(sql.NotPredicates(p))
+}

internal/ent/platform_delete.go

@@ -0,0 +1,88 @@
+// Code generated by ent, DO NOT EDIT.
+
+package ent
+
+import (
+	"context"
+
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
+	"github.com/holos-run/holos/internal/ent/platform"
+	"github.com/holos-run/holos/internal/ent/predicate"
+)
+
+// PlatformDelete is the builder for deleting a Platform entity.
+type PlatformDelete struct {
+	config
+	hooks    []Hook
+	mutation *PlatformMutation
+}
+
+// Where appends a list predicates to the PlatformDelete builder.
+func (pd *PlatformDelete) Where(ps ...predicate.Platform) *PlatformDelete {
+	pd.mutation.Where(ps...)
+	return pd
+}
+
+// Exec executes the deletion query and returns how many vertices were deleted.
+func (pd *PlatformDelete) Exec(ctx context.Context) (int, error) {
+	return withHooks(ctx, pd.sqlExec, pd.mutation, pd.hooks)
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (pd *PlatformDelete) ExecX(ctx context.Context) int {
+	n, err := pd.Exec(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return n
+}
+
+func (pd *PlatformDelete) sqlExec(ctx context.Context) (int, error) {
+	_spec := sqlgraph.NewDeleteSpec(platform.Table, sqlgraph.NewFieldSpec(platform.FieldID, field.TypeUUID))
+	if ps := pd.mutation.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
+	affected, err := sqlgraph.DeleteNodes(ctx, pd.driver, _spec)
+	if err != nil && sqlgraph.IsConstraintError(err) {
+		err = &ConstraintError{msg: err.Error(), wrap: err}
+	}
+	pd.mutation.done = true
+	return affected, err
+}
+
+// PlatformDeleteOne is the builder for deleting a single Platform entity.
+type PlatformDeleteOne struct {
+	pd *PlatformDelete
+}
+
+// Where appends a list predicates to the PlatformDelete builder.
+func (pdo *PlatformDeleteOne) Where(ps ...predicate.Platform) *PlatformDeleteOne {
+	pdo.pd.mutation.Where(ps...)
+	return pdo
+}
+
+// Exec executes the deletion query.
+func (pdo *PlatformDeleteOne) Exec(ctx context.Context) error {
+	n, err := pdo.pd.Exec(ctx)
+	switch {
+	case err != nil:
+		return err
+	case n == 0:
+		return &NotFoundError{platform.Label}
+	default:
+		return nil
+	}
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (pdo *PlatformDeleteOne) ExecX(ctx context.Context) {
+	if err := pdo.Exec(ctx); err != nil {
+		panic(err)
+	}
+}

internal/ent/platform_query.go

@@ -0,0 +1,681 @@
+// Code generated by ent, DO NOT EDIT.
+
+package ent
+
+import (
+	"context"
+	"fmt"
+	"math"
+
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
+	"github.com/gofrs/uuid"
+	"github.com/holos-run/holos/internal/ent/organization"
+	"github.com/holos-run/holos/internal/ent/platform"
+	"github.com/holos-run/holos/internal/ent/predicate"
+	"github.com/holos-run/holos/internal/ent/user"
+)
+
+// PlatformQuery is the builder for querying Platform entities.
+type PlatformQuery struct {
+	config
+	ctx              *QueryContext
+	order            []platform.OrderOption
+	inters           []Interceptor
+	predicates       []predicate.Platform
+	withCreator      *UserQuery
+	withOrganization *OrganizationQuery
+	// intermediate query (i.e. traversal path).
+	sql  *sql.Selector
+	path func(context.Context) (*sql.Selector, error)
+}
+
+// Where adds a new predicate for the PlatformQuery builder.
+func (pq *PlatformQuery) Where(ps ...predicate.Platform) *PlatformQuery {
+	pq.predicates = append(pq.predicates, ps...)
+	return pq
+}
+
+// Limit the number of records to be returned by this query.
+func (pq *PlatformQuery) Limit(limit int) *PlatformQuery {
+	pq.ctx.Limit = &limit
+	return pq
+}
+
+// Offset to start from.
+func (pq *PlatformQuery) Offset(offset int) *PlatformQuery {
+	pq.ctx.Offset = &offset
+	return pq
+}
+
+// Unique configures the query builder to filter duplicate records on query.
+// By default, unique is set to true, and can be disabled using this method.
+func (pq *PlatformQuery) Unique(unique bool) *PlatformQuery {
+	pq.ctx.Unique = &unique
+	return pq
+}
+
+// Order specifies how the records should be ordered.
+func (pq *PlatformQuery) Order(o ...platform.OrderOption) *PlatformQuery {
+	pq.order = append(pq.order, o...)
+	return pq
+}
+
+// QueryCreator chains the current query on the "creator" edge.
+func (pq *PlatformQuery) QueryCreator() *UserQuery {
+	query := (&UserClient{config: pq.config}).Query()
+	query.path = func(ctx context.Context) (fromU *sql.Selector, err error) {
+		if err := pq.prepareQuery(ctx); err != nil {
+			return nil, err
+		}
+		selector := pq.sqlQuery(ctx)
+		if err := selector.Err(); err != nil {
+			return nil, err
+		}
+		step := sqlgraph.NewStep(
+			sqlgraph.From(platform.Table, platform.FieldID, selector),
+			sqlgraph.To(user.Table, user.FieldID),
+			sqlgraph.Edge(sqlgraph.M2O, false, platform.CreatorTable, platform.CreatorColumn),
+		)
+		fromU = sqlgraph.SetNeighbors(pq.driver.Dialect(), step)
+		return fromU, nil
+	}
+	return query
+}
+
+// QueryOrganization chains the current query on the "organization" edge.
+func (pq *PlatformQuery) QueryOrganization() *OrganizationQuery {
+	query := (&OrganizationClient{config: pq.config}).Query()
+	query.path = func(ctx context.Context) (fromU *sql.Selector, err error) {
+		if err := pq.prepareQuery(ctx); err != nil {
+			return nil, err
+		}
+		selector := pq.sqlQuery(ctx)
+		if err := selector.Err(); err != nil {
+			return nil, err
+		}
+		step := sqlgraph.NewStep(
+			sqlgraph.From(platform.Table, platform.FieldID, selector),
+			sqlgraph.To(organization.Table, organization.FieldID),
+			sqlgraph.Edge(sqlgraph.M2O, false, platform.OrganizationTable, platform.OrganizationColumn),
+		)
+		fromU = sqlgraph.SetNeighbors(pq.driver.Dialect(), step)
+		return fromU, nil
+	}
+	return query
+}
+
+// First returns the first Platform entity from the query.
+// Returns a *NotFoundError when no Platform was found.
+func (pq *PlatformQuery) First(ctx context.Context) (*Platform, error) {
+	nodes, err := pq.Limit(1).All(setContextOp(ctx, pq.ctx, "First"))
+	if err != nil {
+		return nil, err
+	}
+	if len(nodes) == 0 {
+		return nil, &NotFoundError{platform.Label}
+	}
+	return nodes[0], nil
+}
+
+// FirstX is like First, but panics if an error occurs.
+func (pq *PlatformQuery) FirstX(ctx context.Context) *Platform {
+	node, err := pq.First(ctx)
+	if err != nil && !IsNotFound(err) {
+		panic(err)
+	}
+	return node
+}
+
+// FirstID returns the first Platform ID from the query.
+// Returns a *NotFoundError when no Platform ID was found.
+func (pq *PlatformQuery) FirstID(ctx context.Context) (id uuid.UUID, err error) {
+	var ids []uuid.UUID
+	if ids, err = pq.Limit(1).IDs(setContextOp(ctx, pq.ctx, "FirstID")); err != nil {
+		return
+	}
+	if len(ids) == 0 {
+		err = &NotFoundError{platform.Label}
+		return
+	}
+	return ids[0], nil
+}
+
+// FirstIDX is like FirstID, but panics if an error occurs.
+func (pq *PlatformQuery) FirstIDX(ctx context.Context) uuid.UUID {
+	id, err := pq.FirstID(ctx)
+	if err != nil && !IsNotFound(err) {
+		panic(err)
+	}
+	return id
+}
+
+// Only returns a single Platform entity found by the query, ensuring it only returns one.
+// Returns a *NotSingularError when more than one Platform entity is found.
+// Returns a *NotFoundError when no Platform entities are found.
+func (pq *PlatformQuery) Only(ctx context.Context) (*Platform, error) {
+	nodes, err := pq.Limit(2).All(setContextOp(ctx, pq.ctx, "Only"))
+	if err != nil {
+		return nil, err
+	}
+	switch len(nodes) {
+	case 1:
+		return nodes[0], nil
+	case 0:
+		return nil, &NotFoundError{platform.Label}
+	default:
+		return nil, &NotSingularError{platform.Label}
+	}
+}
+
+// OnlyX is like Only, but panics if an error occurs.
+func (pq *PlatformQuery) OnlyX(ctx context.Context) *Platform {
+	node, err := pq.Only(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return node
+}
+
+// OnlyID is like Only, but returns the only Platform ID in the query.
+// Returns a *NotSingularError when more than one Platform ID is found.
+// Returns a *NotFoundError when no entities are found.
+func (pq *PlatformQuery) OnlyID(ctx context.Context) (id uuid.UUID, err error) {
+	var ids []uuid.UUID
+	if ids, err = pq.Limit(2).IDs(setContextOp(ctx, pq.ctx, "OnlyID")); err != nil {
+		return
+	}
+	switch len(ids) {
+	case 1:
+		id = ids[0]
+	case 0:
+		err = &NotFoundError{platform.Label}
+	default:
+		err = &NotSingularError{platform.Label}
+	}
+	return
+}
+
+// OnlyIDX is like OnlyID, but panics if an error occurs.
+func (pq *PlatformQuery) OnlyIDX(ctx context.Context) uuid.UUID {
+	id, err := pq.OnlyID(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return id
+}
+
+// All executes the query and returns a list of Platforms.
+func (pq *PlatformQuery) All(ctx context.Context) ([]*Platform, error) {
+	ctx = setContextOp(ctx, pq.ctx, "All")
+	if err := pq.prepareQuery(ctx); err != nil {
+		return nil, err
+	}
+	qr := querierAll[[]*Platform, *PlatformQuery]()
+	return withInterceptors[[]*Platform](ctx, pq, qr, pq.inters)
+}
+
+// AllX is like All, but panics if an error occurs.
+func (pq *PlatformQuery) AllX(ctx context.Context) []*Platform {
+	nodes, err := pq.All(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return nodes
+}
+
+// IDs executes the query and returns a list of Platform IDs.
+func (pq *PlatformQuery) IDs(ctx context.Context) (ids []uuid.UUID, err error) {
+	if pq.ctx.Unique == nil && pq.path != nil {
+		pq.Unique(true)
+	}
+	ctx = setContextOp(ctx, pq.ctx, "IDs")
+	if err = pq.Select(platform.FieldID).Scan(ctx, &ids); err != nil {
+		return nil, err
+	}
+	return ids, nil
+}
+
+// IDsX is like IDs, but panics if an error occurs.
+func (pq *PlatformQuery) IDsX(ctx context.Context) []uuid.UUID {
+	ids, err := pq.IDs(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return ids
+}
+
+// Count returns the count of the given query.
+func (pq *PlatformQuery) Count(ctx context.Context) (int, error) {
+	ctx = setContextOp(ctx, pq.ctx, "Count")
+	if err := pq.prepareQuery(ctx); err != nil {
+		return 0, err
+	}
+	return withInterceptors[int](ctx, pq, querierCount[*PlatformQuery](), pq.inters)
+}
+
+// CountX is like Count, but panics if an error occurs.
+func (pq *PlatformQuery) CountX(ctx context.Context) int {
+	count, err := pq.Count(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return count
+}
+
+// Exist returns true if the query has elements in the graph.
+func (pq *PlatformQuery) Exist(ctx context.Context) (bool, error) {
+	ctx = setContextOp(ctx, pq.ctx, "Exist")
+	switch _, err := pq.FirstID(ctx); {
+	case IsNotFound(err):
+		return false, nil
+	case err != nil:
+		return false, fmt.Errorf("ent: check existence: %w", err)
+	default:
+		return true, nil
+	}
+}
+
+// ExistX is like Exist, but panics if an error occurs.
+func (pq *PlatformQuery) ExistX(ctx context.Context) bool {
+	exist, err := pq.Exist(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return exist
+}
+
+// Clone returns a duplicate of the PlatformQuery builder, including all associated steps. It can be
+// used to prepare common query builders and use them differently after the clone is made.
+func (pq *PlatformQuery) Clone() *PlatformQuery {
+	if pq == nil {
+		return nil
+	}
+	return &PlatformQuery{
+		config:           pq.config,
+		ctx:              pq.ctx.Clone(),
+		order:            append([]platform.OrderOption{}, pq.order...),
+		inters:           append([]Interceptor{}, pq.inters...),
+		predicates:       append([]predicate.Platform{}, pq.predicates...),
+		withCreator:      pq.withCreator.Clone(),
+		withOrganization: pq.withOrganization.Clone(),
+		// clone intermediate query.
+		sql:  pq.sql.Clone(),
+		path: pq.path,
+	}
+}
+
+// WithCreator tells the query-builder to eager-load the nodes that are connected to
+// the "creator" edge. The optional arguments are used to configure the query builder of the edge.
+func (pq *PlatformQuery) WithCreator(opts ...func(*UserQuery)) *PlatformQuery {
+	query := (&UserClient{config: pq.config}).Query()
+	for _, opt := range opts {
+		opt(query)
+	}
+	pq.withCreator = query
+	return pq
+}
+
+// WithOrganization tells the query-builder to eager-load the nodes that are connected to
+// the "organization" edge. The optional arguments are used to configure the query builder of the edge.
+func (pq *PlatformQuery) WithOrganization(opts ...func(*OrganizationQuery)) *PlatformQuery {
+	query := (&OrganizationClient{config: pq.config}).Query()
+	for _, opt := range opts {
+		opt(query)
+	}
+	pq.withOrganization = query
+	return pq
+}
+
+// GroupBy is used to group vertices by one or more fields/columns.
+// It is often used with aggregate functions, like: count, max, mean, min, sum.
+//
+// Example:
+//
+//	var v []struct {
+//		CreatedAt time.Time `json:"created_at,omitempty"`
+//		Count int `json:"count,omitempty"`
+//	}
+//
+//	client.Platform.Query().
+//		GroupBy(platform.FieldCreatedAt).
+//		Aggregate(ent.Count()).
+//		Scan(ctx, &v)
+func (pq *PlatformQuery) GroupBy(field string, fields ...string) *PlatformGroupBy {
+	pq.ctx.Fields = append([]string{field}, fields...)
+	grbuild := &PlatformGroupBy{build: pq}
+	grbuild.flds = &pq.ctx.Fields
+	grbuild.label = platform.Label
+	grbuild.scan = grbuild.Scan
+	return grbuild
+}
+
+// Select allows the selection one or more fields/columns for the given query,
+// instead of selecting all fields in the entity.
+//
+// Example:
+//
+//	var v []struct {
+//		CreatedAt time.Time `json:"created_at,omitempty"`
+//	}
+//
+//	client.Platform.Query().
+//		Select(platform.FieldCreatedAt).
+//		Scan(ctx, &v)
+func (pq *PlatformQuery) Select(fields ...string) *PlatformSelect {
+	pq.ctx.Fields = append(pq.ctx.Fields, fields...)
+	sbuild := &PlatformSelect{PlatformQuery: pq}
+	sbuild.label = platform.Label
+	sbuild.flds, sbuild.scan = &pq.ctx.Fields, sbuild.Scan
+	return sbuild
+}
+
+// Aggregate returns a PlatformSelect configured with the given aggregations.
+func (pq *PlatformQuery) Aggregate(fns ...AggregateFunc) *PlatformSelect {
+	return pq.Select().Aggregate(fns...)
+}
+
+func (pq *PlatformQuery) prepareQuery(ctx context.Context) error {
+	for _, inter := range pq.inters {
+		if inter == nil {
+			return fmt.Errorf("ent: uninitialized interceptor (forgotten import ent/runtime?)")
+		}
+		if trv, ok := inter.(Traverser); ok {
+			if err := trv.Traverse(ctx, pq); err != nil {
+				return err
+			}
+		}
+	}
+	for _, f := range pq.ctx.Fields {
+		if !platform.ValidColumn(f) {
+			return &ValidationError{Name: f, err: fmt.Errorf("ent: invalid field %q for query", f)}
+		}
+	}
+	if pq.path != nil {
+		prev, err := pq.path(ctx)
+		if err != nil {
+			return err
+		}
+		pq.sql = prev
+	}
+	return nil
+}
+
+func (pq *PlatformQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*Platform, error) {
+	var (
+		nodes       = []*Platform{}
+		_spec       = pq.querySpec()
+		loadedTypes = [2]bool{
+			pq.withCreator != nil,
+			pq.withOrganization != nil,
+		}
+	)
+	_spec.ScanValues = func(columns []string) ([]any, error) {
+		return (*Platform).scanValues(nil, columns)
+	}
+	_spec.Assign = func(columns []string, values []any) error {
+		node := &Platform{config: pq.config}
+		nodes = append(nodes, node)
+		node.Edges.loadedTypes = loadedTypes
+		return node.assignValues(columns, values)
+	}
+	for i := range hooks {
+		hooks[i](ctx, _spec)
+	}
+	if err := sqlgraph.QueryNodes(ctx, pq.driver, _spec); err != nil {
+		return nil, err
+	}
+	if len(nodes) == 0 {
+		return nodes, nil
+	}
+	if query := pq.withCreator; query != nil {
+		if err := pq.loadCreator(ctx, query, nodes, nil,
+			func(n *Platform, e *User) { n.Edges.Creator = e }); err != nil {
+			return nil, err
+		}
+	}
+	if query := pq.withOrganization; query != nil {
+		if err := pq.loadOrganization(ctx, query, nodes, nil,
+			func(n *Platform, e *Organization) { n.Edges.Organization = e }); err != nil {
+			return nil, err
+		}
+	}
+	return nodes, nil
+}
+
+func (pq *PlatformQuery) loadCreator(ctx context.Context, query *UserQuery, nodes []*Platform, init func(*Platform), assign func(*Platform, *User)) error {
+	ids := make([]uuid.UUID, 0, len(nodes))
+	nodeids := make(map[uuid.UUID][]*Platform)
+	for i := range nodes {
+		fk := nodes[i].CreatorID
+		if _, ok := nodeids[fk]; !ok {
+			ids = append(ids, fk)
+		}
+		nodeids[fk] = append(nodeids[fk], nodes[i])
+	}
+	if len(ids) == 0 {
+		return nil
+	}
+	query.Where(user.IDIn(ids...))
+	neighbors, err := query.All(ctx)
+	if err != nil {
+		return err
+	}
+	for _, n := range neighbors {
+		nodes, ok := nodeids[n.ID]
+		if !ok {
+			return fmt.Errorf(`unexpected foreign-key "creator_id" returned %v`, n.ID)
+		}
+		for i := range nodes {
+			assign(nodes[i], n)
+		}
+	}
+	return nil
+}
+func (pq *PlatformQuery) loadOrganization(ctx context.Context, query *OrganizationQuery, nodes []*Platform, init func(*Platform), assign func(*Platform, *Organization)) error {
+	ids := make([]uuid.UUID, 0, len(nodes))
+	nodeids := make(map[uuid.UUID][]*Platform)
+	for i := range nodes {
+		fk := nodes[i].OrgID
+		if _, ok := nodeids[fk]; !ok {
+			ids = append(ids, fk)
+		}
+		nodeids[fk] = append(nodeids[fk], nodes[i])
+	}
+	if len(ids) == 0 {
+		return nil
+	}
+	query.Where(organization.IDIn(ids...))
+	neighbors, err := query.All(ctx)
+	if err != nil {
+		return err
+	}
+	for _, n := range neighbors {
+		nodes, ok := nodeids[n.ID]
+		if !ok {
+			return fmt.Errorf(`unexpected foreign-key "org_id" returned %v`, n.ID)
+		}
+		for i := range nodes {
+			assign(nodes[i], n)
+		}
+	}
+	return nil
+}
+
+func (pq *PlatformQuery) sqlCount(ctx context.Context) (int, error) {
+	_spec := pq.querySpec()
+	_spec.Node.Columns = pq.ctx.Fields
+	if len(pq.ctx.Fields) > 0 {
+		_spec.Unique = pq.ctx.Unique != nil && *pq.ctx.Unique
+	}
+	return sqlgraph.CountNodes(ctx, pq.driver, _spec)
+}
+
+func (pq *PlatformQuery) querySpec() *sqlgraph.QuerySpec {
+	_spec := sqlgraph.NewQuerySpec(platform.Table, platform.Columns, sqlgraph.NewFieldSpec(platform.FieldID, field.TypeUUID))
+	_spec.From = pq.sql
+	if unique := pq.ctx.Unique; unique != nil {
+		_spec.Unique = *unique
+	} else if pq.path != nil {
+		_spec.Unique = true
+	}
+	if fields := pq.ctx.Fields; len(fields) > 0 {
+		_spec.Node.Columns = make([]string, 0, len(fields))
+		_spec.Node.Columns = append(_spec.Node.Columns, platform.FieldID)
+		for i := range fields {
+			if fields[i] != platform.FieldID {
+				_spec.Node.Columns = append(_spec.Node.Columns, fields[i])
+			}
+		}
+		if pq.withCreator != nil {
+			_spec.Node.AddColumnOnce(platform.FieldCreatorID)
+		}
+		if pq.withOrganization != nil {
+			_spec.Node.AddColumnOnce(platform.FieldOrgID)
+		}
+	}
+	if ps := pq.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
+	if limit := pq.ctx.Limit; limit != nil {
+		_spec.Limit = *limit
+	}
+	if offset := pq.ctx.Offset; offset != nil {
+		_spec.Offset = *offset
+	}
+	if ps := pq.order; len(ps) > 0 {
+		_spec.Order = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
+	return _spec
+}
+
+func (pq *PlatformQuery) sqlQuery(ctx context.Context) *sql.Selector {
+	builder := sql.Dialect(pq.driver.Dialect())
+	t1 := builder.Table(platform.Table)
+	columns := pq.ctx.Fields
+	if len(columns) == 0 {
+		columns = platform.Columns
+	}
+	selector := builder.Select(t1.Columns(columns...)...).From(t1)
+	if pq.sql != nil {
+		selector = pq.sql
+		selector.Select(selector.Columns(columns...)...)
+	}
+	if pq.ctx.Unique != nil && *pq.ctx.Unique {
+		selector.Distinct()
+	}
+	for _, p := range pq.predicates {
+		p(selector)
+	}
+	for _, p := range pq.order {
+		p(selector)
+	}
+	if offset := pq.ctx.Offset; offset != nil {
+		// limit is mandatory for offset clause. We start
+		// with default value, and override it below if needed.
+		selector.Offset(*offset).Limit(math.MaxInt32)
+	}
+	if limit := pq.ctx.Limit; limit != nil {
+		selector.Limit(*limit)
+	}
+	return selector
+}
+
+// PlatformGroupBy is the group-by builder for Platform entities.
+type PlatformGroupBy struct {
+	selector
+	build *PlatformQuery
+}
+
+// Aggregate adds the given aggregation functions to the group-by query.
+func (pgb *PlatformGroupBy) Aggregate(fns ...AggregateFunc) *PlatformGroupBy {
+	pgb.fns = append(pgb.fns, fns...)
+	return pgb
+}
+
+// Scan applies the selector query and scans the result into the given value.
+func (pgb *PlatformGroupBy) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, pgb.build.ctx, "GroupBy")
+	if err := pgb.build.prepareQuery(ctx); err != nil {
+		return err
+	}
+	return scanWithInterceptors[*PlatformQuery, *PlatformGroupBy](ctx, pgb.build, pgb, pgb.build.inters, v)
+}
+
+func (pgb *PlatformGroupBy) sqlScan(ctx context.Context, root *PlatformQuery, v any) error {
+	selector := root.sqlQuery(ctx).Select()
+	aggregation := make([]string, 0, len(pgb.fns))
+	for _, fn := range pgb.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	if len(selector.SelectedColumns()) == 0 {
+		columns := make([]string, 0, len(*pgb.flds)+len(pgb.fns))
+		for _, f := range *pgb.flds {
+			columns = append(columns, selector.C(f))
+		}
+		columns = append(columns, aggregation...)
+		selector.Select(columns...)
+	}
+	selector.GroupBy(selector.Columns(*pgb.flds...)...)
+	if err := selector.Err(); err != nil {
+		return err
+	}
+	rows := &sql.Rows{}
+	query, args := selector.Query()
+	if err := pgb.build.driver.Query(ctx, query, args, rows); err != nil {
+		return err
+	}
+	defer rows.Close()
+	return sql.ScanSlice(rows, v)
+}
+
+// PlatformSelect is the builder for selecting fields of Platform entities.
+type PlatformSelect struct {
+	*PlatformQuery
+	selector
+}
+
+// Aggregate adds the given aggregation functions to the selector query.
+func (ps *PlatformSelect) Aggregate(fns ...AggregateFunc) *PlatformSelect {
+	ps.fns = append(ps.fns, fns...)
+	return ps
+}
+
+// Scan applies the selector query and scans the result into the given value.
+func (ps *PlatformSelect) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, ps.ctx, "Select")
+	if err := ps.prepareQuery(ctx); err != nil {
+		return err
+	}
+	return scanWithInterceptors[*PlatformQuery, *PlatformSelect](ctx, ps.PlatformQuery, ps, ps.inters, v)
+}
+
+func (ps *PlatformSelect) sqlScan(ctx context.Context, root *PlatformQuery, v any) error {
+	selector := root.sqlQuery(ctx)
+	aggregation := make([]string, 0, len(ps.fns))
+	for _, fn := range ps.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	switch n := len(*ps.selector.flds); {
+	case n == 0 && len(aggregation) > 0:
+		selector.Select(aggregation...)
+	case n != 0 && len(aggregation) > 0:
+		selector.AppendSelect(aggregation...)
+	}
+	rows := &sql.Rows{}
+	query, args := selector.Query()
+	if err := ps.driver.Query(ctx, query, args, rows); err != nil {
+		return err
+	}
+	defer rows.Close()
+	return sql.ScanSlice(rows, v)
+}

internal/ent/platform_update.go

@@ -0,0 +1,710 @@
+// Code generated by ent, DO NOT EDIT.
+
+package ent
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
+	"github.com/gofrs/uuid"
+	"github.com/holos-run/holos/internal/ent/organization"
+	"github.com/holos-run/holos/internal/ent/platform"
+	"github.com/holos-run/holos/internal/ent/predicate"
+	"github.com/holos-run/holos/internal/ent/user"
+	holos "github.com/holos-run/holos/service/gen/holos/v1alpha1"
+)
+
+// PlatformUpdate is the builder for updating Platform entities.
+type PlatformUpdate struct {
+	config
+	hooks    []Hook
+	mutation *PlatformMutation
+}
+
+// Where appends a list predicates to the PlatformUpdate builder.
+func (pu *PlatformUpdate) Where(ps ...predicate.Platform) *PlatformUpdate {
+	pu.mutation.Where(ps...)
+	return pu
+}
+
+// SetUpdatedAt sets the "updated_at" field.
+func (pu *PlatformUpdate) SetUpdatedAt(t time.Time) *PlatformUpdate {
+	pu.mutation.SetUpdatedAt(t)
+	return pu
+}
+
+// SetOrgID sets the "org_id" field.
+func (pu *PlatformUpdate) SetOrgID(u uuid.UUID) *PlatformUpdate {
+	pu.mutation.SetOrgID(u)
+	return pu
+}
+
+// SetNillableOrgID sets the "org_id" field if the given value is not nil.
+func (pu *PlatformUpdate) SetNillableOrgID(u *uuid.UUID) *PlatformUpdate {
+	if u != nil {
+		pu.SetOrgID(*u)
+	}
+	return pu
+}
+
+// SetName sets the "name" field.
+func (pu *PlatformUpdate) SetName(s string) *PlatformUpdate {
+	pu.mutation.SetName(s)
+	return pu
+}
+
+// SetNillableName sets the "name" field if the given value is not nil.
+func (pu *PlatformUpdate) SetNillableName(s *string) *PlatformUpdate {
+	if s != nil {
+		pu.SetName(*s)
+	}
+	return pu
+}
+
+// SetDisplayName sets the "display_name" field.
+func (pu *PlatformUpdate) SetDisplayName(s string) *PlatformUpdate {
+	pu.mutation.SetDisplayName(s)
+	return pu
+}
+
+// SetNillableDisplayName sets the "display_name" field if the given value is not nil.
+func (pu *PlatformUpdate) SetNillableDisplayName(s *string) *PlatformUpdate {
+	if s != nil {
+		pu.SetDisplayName(*s)
+	}
+	return pu
+}
+
+// SetCreatorID sets the "creator_id" field.
+func (pu *PlatformUpdate) SetCreatorID(u uuid.UUID) *PlatformUpdate {
+	pu.mutation.SetCreatorID(u)
+	return pu
+}
+
+// SetNillableCreatorID sets the "creator_id" field if the given value is not nil.
+func (pu *PlatformUpdate) SetNillableCreatorID(u *uuid.UUID) *PlatformUpdate {
+	if u != nil {
+		pu.SetCreatorID(*u)
+	}
+	return pu
+}
+
+// SetConfigForm sets the "config_form" field.
+func (pu *PlatformUpdate) SetConfigForm(hf *holos.PlatformForm) *PlatformUpdate {
+	pu.mutation.SetConfigForm(hf)
+	return pu
+}
+
+// ClearConfigForm clears the value of the "config_form" field.
+func (pu *PlatformUpdate) ClearConfigForm() *PlatformUpdate {
+	pu.mutation.ClearConfigForm()
+	return pu
+}
+
+// SetConfigValues sets the "config_values" field.
+func (pu *PlatformUpdate) SetConfigValues(hv *holos.ConfigValues) *PlatformUpdate {
+	pu.mutation.SetConfigValues(hv)
+	return pu
+}
+
+// ClearConfigValues clears the value of the "config_values" field.
+func (pu *PlatformUpdate) ClearConfigValues() *PlatformUpdate {
+	pu.mutation.ClearConfigValues()
+	return pu
+}
+
+// SetConfigCue sets the "config_cue" field.
+func (pu *PlatformUpdate) SetConfigCue(b []byte) *PlatformUpdate {
+	pu.mutation.SetConfigCue(b)
+	return pu
+}
+
+// ClearConfigCue clears the value of the "config_cue" field.
+func (pu *PlatformUpdate) ClearConfigCue() *PlatformUpdate {
+	pu.mutation.ClearConfigCue()
+	return pu
+}
+
+// SetConfigDefinition sets the "config_definition" field.
+func (pu *PlatformUpdate) SetConfigDefinition(s string) *PlatformUpdate {
+	pu.mutation.SetConfigDefinition(s)
+	return pu
+}
+
+// SetNillableConfigDefinition sets the "config_definition" field if the given value is not nil.
+func (pu *PlatformUpdate) SetNillableConfigDefinition(s *string) *PlatformUpdate {
+	if s != nil {
+		pu.SetConfigDefinition(*s)
+	}
+	return pu
+}
+
+// ClearConfigDefinition clears the value of the "config_definition" field.
+func (pu *PlatformUpdate) ClearConfigDefinition() *PlatformUpdate {
+	pu.mutation.ClearConfigDefinition()
+	return pu
+}
+
+// SetCreator sets the "creator" edge to the User entity.
+func (pu *PlatformUpdate) SetCreator(u *User) *PlatformUpdate {
+	return pu.SetCreatorID(u.ID)
+}
+
+// SetOrganizationID sets the "organization" edge to the Organization entity by ID.
+func (pu *PlatformUpdate) SetOrganizationID(id uuid.UUID) *PlatformUpdate {
+	pu.mutation.SetOrganizationID(id)
+	return pu
+}
+
+// SetOrganization sets the "organization" edge to the Organization entity.
+func (pu *PlatformUpdate) SetOrganization(o *Organization) *PlatformUpdate {
+	return pu.SetOrganizationID(o.ID)
+}
+
+// Mutation returns the PlatformMutation object of the builder.
+func (pu *PlatformUpdate) Mutation() *PlatformMutation {
+	return pu.mutation
+}
+
+// ClearCreator clears the "creator" edge to the User entity.
+func (pu *PlatformUpdate) ClearCreator() *PlatformUpdate {
+	pu.mutation.ClearCreator()
+	return pu
+}
+
+// ClearOrganization clears the "organization" edge to the Organization entity.
+func (pu *PlatformUpdate) ClearOrganization() *PlatformUpdate {
+	pu.mutation.ClearOrganization()
+	return pu
+}
+
+// Save executes the query and returns the number of nodes affected by the update operation.
+func (pu *PlatformUpdate) Save(ctx context.Context) (int, error) {
+	pu.defaults()
+	return withHooks(ctx, pu.sqlSave, pu.mutation, pu.hooks)
+}
+
+// SaveX is like Save, but panics if an error occurs.
+func (pu *PlatformUpdate) SaveX(ctx context.Context) int {
+	affected, err := pu.Save(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return affected
+}
+
+// Exec executes the query.
+func (pu *PlatformUpdate) Exec(ctx context.Context) error {
+	_, err := pu.Save(ctx)
+	return err
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (pu *PlatformUpdate) ExecX(ctx context.Context) {
+	if err := pu.Exec(ctx); err != nil {
+		panic(err)
+	}
+}
+
+// defaults sets the default values of the builder before save.
+func (pu *PlatformUpdate) defaults() {
+	if _, ok := pu.mutation.UpdatedAt(); !ok {
+		v := platform.UpdateDefaultUpdatedAt()
+		pu.mutation.SetUpdatedAt(v)
+	}
+}
+
+// check runs all checks and user-defined validators on the builder.
+func (pu *PlatformUpdate) check() error {
+	if v, ok := pu.mutation.Name(); ok {
+		if err := platform.NameValidator(v); err != nil {
+			return &ValidationError{Name: "name", err: fmt.Errorf(`ent: validator failed for field "Platform.name": %w`, err)}
+		}
+	}
+	if _, ok := pu.mutation.CreatorID(); pu.mutation.CreatorCleared() && !ok {
+		return errors.New(`ent: clearing a required unique edge "Platform.creator"`)
+	}
+	if _, ok := pu.mutation.OrganizationID(); pu.mutation.OrganizationCleared() && !ok {
+		return errors.New(`ent: clearing a required unique edge "Platform.organization"`)
+	}
+	return nil
+}
+
+func (pu *PlatformUpdate) sqlSave(ctx context.Context) (n int, err error) {
+	if err := pu.check(); err != nil {
+		return n, err
+	}
+	_spec := sqlgraph.NewUpdateSpec(platform.Table, platform.Columns, sqlgraph.NewFieldSpec(platform.FieldID, field.TypeUUID))
+	if ps := pu.mutation.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
+	if value, ok := pu.mutation.UpdatedAt(); ok {
+		_spec.SetField(platform.FieldUpdatedAt, field.TypeTime, value)
+	}
+	if value, ok := pu.mutation.Name(); ok {
+		_spec.SetField(platform.FieldName, field.TypeString, value)
+	}
+	if value, ok := pu.mutation.DisplayName(); ok {
+		_spec.SetField(platform.FieldDisplayName, field.TypeString, value)
+	}
+	if value, ok := pu.mutation.ConfigForm(); ok {
+		_spec.SetField(platform.FieldConfigForm, field.TypeJSON, value)
+	}
+	if pu.mutation.ConfigFormCleared() {
+		_spec.ClearField(platform.FieldConfigForm, field.TypeJSON)
+	}
+	if value, ok := pu.mutation.ConfigValues(); ok {
+		_spec.SetField(platform.FieldConfigValues, field.TypeJSON, value)
+	}
+	if pu.mutation.ConfigValuesCleared() {
+		_spec.ClearField(platform.FieldConfigValues, field.TypeJSON)
+	}
+	if value, ok := pu.mutation.ConfigCue(); ok {
+		_spec.SetField(platform.FieldConfigCue, field.TypeBytes, value)
+	}
+	if pu.mutation.ConfigCueCleared() {
+		_spec.ClearField(platform.FieldConfigCue, field.TypeBytes)
+	}
+	if value, ok := pu.mutation.ConfigDefinition(); ok {
+		_spec.SetField(platform.FieldConfigDefinition, field.TypeString, value)
+	}
+	if pu.mutation.ConfigDefinitionCleared() {
+		_spec.ClearField(platform.FieldConfigDefinition, field.TypeString)
+	}
+	if pu.mutation.CreatorCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: false,
+			Table:   platform.CreatorTable,
+			Columns: []string{platform.CreatorColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(user.FieldID, field.TypeUUID),
+			},
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := pu.mutation.CreatorIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: false,
+			Table:   platform.CreatorTable,
+			Columns: []string{platform.CreatorColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(user.FieldID, field.TypeUUID),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Add = append(_spec.Edges.Add, edge)
+	}
+	if pu.mutation.OrganizationCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: false,
+			Table:   platform.OrganizationTable,
+			Columns: []string{platform.OrganizationColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(organization.FieldID, field.TypeUUID),
+			},
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := pu.mutation.OrganizationIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: false,
+			Table:   platform.OrganizationTable,
+			Columns: []string{platform.OrganizationColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(organization.FieldID, field.TypeUUID),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Add = append(_spec.Edges.Add, edge)
+	}
+	if n, err = sqlgraph.UpdateNodes(ctx, pu.driver, _spec); err != nil {
+		if _, ok := err.(*sqlgraph.NotFoundError); ok {
+			err = &NotFoundError{platform.Label}
+		} else if sqlgraph.IsConstraintError(err) {
+			err = &ConstraintError{msg: err.Error(), wrap: err}
+		}
+		return 0, err
+	}
+	pu.mutation.done = true
+	return n, nil
+}
+
+// PlatformUpdateOne is the builder for updating a single Platform entity.
+type PlatformUpdateOne struct {
+	config
+	fields   []string
+	hooks    []Hook
+	mutation *PlatformMutation
+}
+
+// SetUpdatedAt sets the "updated_at" field.
+func (puo *PlatformUpdateOne) SetUpdatedAt(t time.Time) *PlatformUpdateOne {
+	puo.mutation.SetUpdatedAt(t)
+	return puo
+}
+
+// SetOrgID sets the "org_id" field.
+func (puo *PlatformUpdateOne) SetOrgID(u uuid.UUID) *PlatformUpdateOne {
+	puo.mutation.SetOrgID(u)
+	return puo
+}
+
+// SetNillableOrgID sets the "org_id" field if the given value is not nil.
+func (puo *PlatformUpdateOne) SetNillableOrgID(u *uuid.UUID) *PlatformUpdateOne {
+	if u != nil {
+		puo.SetOrgID(*u)
+	}
+	return puo
+}
+
+// SetName sets the "name" field.
+func (puo *PlatformUpdateOne) SetName(s string) *PlatformUpdateOne {
+	puo.mutation.SetName(s)
+	return puo
+}
+
+// SetNillableName sets the "name" field if the given value is not nil.
+func (puo *PlatformUpdateOne) SetNillableName(s *string) *PlatformUpdateOne {
+	if s != nil {
+		puo.SetName(*s)
+	}
+	return puo
+}
+
+// SetDisplayName sets the "display_name" field.
+func (puo *PlatformUpdateOne) SetDisplayName(s string) *PlatformUpdateOne {
+	puo.mutation.SetDisplayName(s)
+	return puo
+}
+
+// SetNillableDisplayName sets the "display_name" field if the given value is not nil.
+func (puo *PlatformUpdateOne) SetNillableDisplayName(s *string) *PlatformUpdateOne {
+	if s != nil {
+		puo.SetDisplayName(*s)
+	}
+	return puo
+}
+
+// SetCreatorID sets the "creator_id" field.
+func (puo *PlatformUpdateOne) SetCreatorID(u uuid.UUID) *PlatformUpdateOne {
+	puo.mutation.SetCreatorID(u)
+	return puo
+}
+
+// SetNillableCreatorID sets the "creator_id" field if the given value is not nil.
+func (puo *PlatformUpdateOne) SetNillableCreatorID(u *uuid.UUID) *PlatformUpdateOne {
+	if u != nil {
+		puo.SetCreatorID(*u)
+	}
+	return puo
+}
+
+// SetConfigForm sets the "config_form" field.
+func (puo *PlatformUpdateOne) SetConfigForm(hf *holos.PlatformForm) *PlatformUpdateOne {
+	puo.mutation.SetConfigForm(hf)
+	return puo
+}
+
+// ClearConfigForm clears the value of the "config_form" field.
+func (puo *PlatformUpdateOne) ClearConfigForm() *PlatformUpdateOne {
+	puo.mutation.ClearConfigForm()
+	return puo
+}
+
+// SetConfigValues sets the "config_values" field.
+func (puo *PlatformUpdateOne) SetConfigValues(hv *holos.ConfigValues) *PlatformUpdateOne {
+	puo.mutation.SetConfigValues(hv)
+	return puo
+}
+
+// ClearConfigValues clears the value of the "config_values" field.
+func (puo *PlatformUpdateOne) ClearConfigValues() *PlatformUpdateOne {
+	puo.mutation.ClearConfigValues()
+	return puo
+}
+
+// SetConfigCue sets the "config_cue" field.
+func (puo *PlatformUpdateOne) SetConfigCue(b []byte) *PlatformUpdateOne {
+	puo.mutation.SetConfigCue(b)
+	return puo
+}
+
+// ClearConfigCue clears the value of the "config_cue" field.
+func (puo *PlatformUpdateOne) ClearConfigCue() *PlatformUpdateOne {
+	puo.mutation.ClearConfigCue()
+	return puo
+}
+
+// SetConfigDefinition sets the "config_definition" field.
+func (puo *PlatformUpdateOne) SetConfigDefinition(s string) *PlatformUpdateOne {
+	puo.mutation.SetConfigDefinition(s)
+	return puo
+}
+
+// SetNillableConfigDefinition sets the "config_definition" field if the given value is not nil.
+func (puo *PlatformUpdateOne) SetNillableConfigDefinition(s *string) *PlatformUpdateOne {
+	if s != nil {
+		puo.SetConfigDefinition(*s)
+	}
+	return puo
+}
+
+// ClearConfigDefinition clears the value of the "config_definition" field.
+func (puo *PlatformUpdateOne) ClearConfigDefinition() *PlatformUpdateOne {
+	puo.mutation.ClearConfigDefinition()
+	return puo
+}
+
+// SetCreator sets the "creator" edge to the User entity.
+func (puo *PlatformUpdateOne) SetCreator(u *User) *PlatformUpdateOne {
+	return puo.SetCreatorID(u.ID)
+}
+
+// SetOrganizationID sets the "organization" edge to the Organization entity by ID.
+func (puo *PlatformUpdateOne) SetOrganizationID(id uuid.UUID) *PlatformUpdateOne {
+	puo.mutation.SetOrganizationID(id)
+	return puo
+}
+
+// SetOrganization sets the "organization" edge to the Organization entity.
+func (puo *PlatformUpdateOne) SetOrganization(o *Organization) *PlatformUpdateOne {
+	return puo.SetOrganizationID(o.ID)
+}
+
+// Mutation returns the PlatformMutation object of the builder.
+func (puo *PlatformUpdateOne) Mutation() *PlatformMutation {
+	return puo.mutation
+}
+
+// ClearCreator clears the "creator" edge to the User entity.
+func (puo *PlatformUpdateOne) ClearCreator() *PlatformUpdateOne {
+	puo.mutation.ClearCreator()
+	return puo
+}
+
+// ClearOrganization clears the "organization" edge to the Organization entity.
+func (puo *PlatformUpdateOne) ClearOrganization() *PlatformUpdateOne {
+	puo.mutation.ClearOrganization()
+	return puo
+}
+
+// Where appends a list predicates to the PlatformUpdate builder.
+func (puo *PlatformUpdateOne) Where(ps ...predicate.Platform) *PlatformUpdateOne {
+	puo.mutation.Where(ps...)
+	return puo
+}
+
+// Select allows selecting one or more fields (columns) of the returned entity.
+// The default is selecting all fields defined in the entity schema.
+func (puo *PlatformUpdateOne) Select(field string, fields ...string) *PlatformUpdateOne {
+	puo.fields = append([]string{field}, fields...)
+	return puo
+}
+
+// Save executes the query and returns the updated Platform entity.
+func (puo *PlatformUpdateOne) Save(ctx context.Context) (*Platform, error) {
+	puo.defaults()
+	return withHooks(ctx, puo.sqlSave, puo.mutation, puo.hooks)
+}
+
+// SaveX is like Save, but panics if an error occurs.
+func (puo *PlatformUpdateOne) SaveX(ctx context.Context) *Platform {
+	node, err := puo.Save(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return node
+}
+
+// Exec executes the query on the entity.
+func (puo *PlatformUpdateOne) Exec(ctx context.Context) error {
+	_, err := puo.Save(ctx)
+	return err
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (puo *PlatformUpdateOne) ExecX(ctx context.Context) {
+	if err := puo.Exec(ctx); err != nil {
+		panic(err)
+	}
+}
+
+// defaults sets the default values of the builder before save.
+func (puo *PlatformUpdateOne) defaults() {
+	if _, ok := puo.mutation.UpdatedAt(); !ok {
+		v := platform.UpdateDefaultUpdatedAt()
+		puo.mutation.SetUpdatedAt(v)
+	}
+}
+
+// check runs all checks and user-defined validators on the builder.
+func (puo *PlatformUpdateOne) check() error {
+	if v, ok := puo.mutation.Name(); ok {
+		if err := platform.NameValidator(v); err != nil {
+			return &ValidationError{Name: "name", err: fmt.Errorf(`ent: validator failed for field "Platform.name": %w`, err)}
+		}
+	}
+	if _, ok := puo.mutation.CreatorID(); puo.mutation.CreatorCleared() && !ok {
+		return errors.New(`ent: clearing a required unique edge "Platform.creator"`)
+	}
+	if _, ok := puo.mutation.OrganizationID(); puo.mutation.OrganizationCleared() && !ok {
+		return errors.New(`ent: clearing a required unique edge "Platform.organization"`)
+	}
+	return nil
+}
+
+func (puo *PlatformUpdateOne) sqlSave(ctx context.Context) (_node *Platform, err error) {
+	if err := puo.check(); err != nil {
+		return _node, err
+	}
+	_spec := sqlgraph.NewUpdateSpec(platform.Table, platform.Columns, sqlgraph.NewFieldSpec(platform.FieldID, field.TypeUUID))
+	id, ok := puo.mutation.ID()
+	if !ok {
+		return nil, &ValidationError{Name: "id", err: errors.New(`ent: missing "Platform.id" for update`)}
+	}
+	_spec.Node.ID.Value = id
+	if fields := puo.fields; len(fields) > 0 {
+		_spec.Node.Columns = make([]string, 0, len(fields))
+		_spec.Node.Columns = append(_spec.Node.Columns, platform.FieldID)
+		for _, f := range fields {
+			if !platform.ValidColumn(f) {
+				return nil, &ValidationError{Name: f, err: fmt.Errorf("ent: invalid field %q for query", f)}
+			}
+			if f != platform.FieldID {
+				_spec.Node.Columns = append(_spec.Node.Columns, f)
+			}
+		}
+	}
+	if ps := puo.mutation.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
+	if value, ok := puo.mutation.UpdatedAt(); ok {
+		_spec.SetField(platform.FieldUpdatedAt, field.TypeTime, value)
+	}
+	if value, ok := puo.mutation.Name(); ok {
+		_spec.SetField(platform.FieldName, field.TypeString, value)
+	}
+	if value, ok := puo.mutation.DisplayName(); ok {
+		_spec.SetField(platform.FieldDisplayName, field.TypeString, value)
+	}
+	if value, ok := puo.mutation.ConfigForm(); ok {
+		_spec.SetField(platform.FieldConfigForm, field.TypeJSON, value)
+	}
+	if puo.mutation.ConfigFormCleared() {
+		_spec.ClearField(platform.FieldConfigForm, field.TypeJSON)
+	}
+	if value, ok := puo.mutation.ConfigValues(); ok {
+		_spec.SetField(platform.FieldConfigValues, field.TypeJSON, value)
+	}
+	if puo.mutation.ConfigValuesCleared() {
+		_spec.ClearField(platform.FieldConfigValues, field.TypeJSON)
+	}
+	if value, ok := puo.mutation.ConfigCue(); ok {
+		_spec.SetField(platform.FieldConfigCue, field.TypeBytes, value)
+	}
+	if puo.mutation.ConfigCueCleared() {
+		_spec.ClearField(platform.FieldConfigCue, field.TypeBytes)
+	}
+	if value, ok := puo.mutation.ConfigDefinition(); ok {
+		_spec.SetField(platform.FieldConfigDefinition, field.TypeString, value)
+	}
+	if puo.mutation.ConfigDefinitionCleared() {
+		_spec.ClearField(platform.FieldConfigDefinition, field.TypeString)
+	}
+	if puo.mutation.CreatorCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: false,
+			Table:   platform.CreatorTable,
+			Columns: []string{platform.CreatorColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(user.FieldID, field.TypeUUID),
+			},
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := puo.mutation.CreatorIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: false,
+			Table:   platform.CreatorTable,
+			Columns: []string{platform.CreatorColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(user.FieldID, field.TypeUUID),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Add = append(_spec.Edges.Add, edge)
+	}
+	if puo.mutation.OrganizationCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: false,
+			Table:   platform.OrganizationTable,
+			Columns: []string{platform.OrganizationColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(organization.FieldID, field.TypeUUID),
+			},
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := puo.mutation.OrganizationIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: false,
+			Table:   platform.OrganizationTable,
+			Columns: []string{platform.OrganizationColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(organization.FieldID, field.TypeUUID),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Add = append(_spec.Edges.Add, edge)
+	}
+	_node = &Platform{config: puo.config}
+	_spec.Assign = _node.assignValues
+	_spec.ScanValues = _node.scanValues
+	if err = sqlgraph.UpdateNode(ctx, puo.driver, _spec); err != nil {
+		if _, ok := err.(*sqlgraph.NotFoundError); ok {
+			err = &NotFoundError{platform.Label}
+		} else if sqlgraph.IsConstraintError(err) {
+			err = &ConstraintError{msg: err.Error(), wrap: err}
+		}
+		return nil, err
+	}
+	puo.mutation.done = true
+	return _node, nil
+}

internal/ent/predicate/predicate.go

@@ -9,5 +9,8 @@ import (
 // Organization is the predicate function for organization builders.
 type Organization func(*sql.Selector)
 
+// Platform is the predicate function for platform builders.
+type Platform func(*sql.Selector)
+
 // User is the predicate function for user builders.
 type User func(*sql.Selector)

internal/ent/runtime.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/gofrs/uuid"
 	"github.com/holos-run/holos/internal/ent/organization"
+	"github.com/holos-run/holos/internal/ent/platform"
 	"github.com/holos-run/holos/internal/ent/schema"
 	"github.com/holos-run/holos/internal/ent/user"
 )
@@ -40,6 +41,31 @@ func init() {
 	organizationDescID := organizationMixinFields0[0].Descriptor()
 	// organization.DefaultID holds the default value on creation for the id field.
 	organization.DefaultID = organizationDescID.Default.(func() uuid.UUID)
+	platformMixin := schema.Platform{}.Mixin()
+	platformMixinFields0 := platformMixin[0].Fields()
+	_ = platformMixinFields0
+	platformMixinFields1 := platformMixin[1].Fields()
+	_ = platformMixinFields1
+	platformFields := schema.Platform{}.Fields()
+	_ = platformFields
+	// platformDescCreatedAt is the schema descriptor for created_at field.
+	platformDescCreatedAt := platformMixinFields1[0].Descriptor()
+	// platform.DefaultCreatedAt holds the default value on creation for the created_at field.
+	platform.DefaultCreatedAt = platformDescCreatedAt.Default.(func() time.Time)
+	// platformDescUpdatedAt is the schema descriptor for updated_at field.
+	platformDescUpdatedAt := platformMixinFields1[1].Descriptor()
+	// platform.DefaultUpdatedAt holds the default value on creation for the updated_at field.
+	platform.DefaultUpdatedAt = platformDescUpdatedAt.Default.(func() time.Time)
+	// platform.UpdateDefaultUpdatedAt holds the default value on update for the updated_at field.
+	platform.UpdateDefaultUpdatedAt = platformDescUpdatedAt.UpdateDefault.(func() time.Time)
+	// platformDescName is the schema descriptor for name field.
+	platformDescName := platformFields[1].Descriptor()
+	// platform.NameValidator is a validator for the "name" field. It is called by the builders before save.
+	platform.NameValidator = platformDescName.Validators[0].(func(string) error)
+	// platformDescID is the schema descriptor for id field.
+	platformDescID := platformMixinFields0[0].Descriptor()
+	// platform.DefaultID holds the default value on creation for the id field.
+	platform.DefaultID = platformDescID.Default.(func() uuid.UUID)
 	userMixin := schema.User{}.Mixin()
 	userMixinFields0 := userMixin[0].Fields()
 	_ = userMixinFields0

internal/ent/schema/mixin.go

@@ -1,11 +1,12 @@
 package schema
 
 import (
+	"time"
+
 	"entgo.io/ent"
 	"entgo.io/ent/schema/field"
 	"entgo.io/ent/schema/mixin"
 	"github.com/gofrs/uuid"
-	"time"
 )
 
 func newUUID() uuid.UUID {
@@ -18,6 +19,7 @@ type BaseMixin struct {
 
 func (BaseMixin) Fields() []ent.Field {
 	return []ent.Field{
+		// id represents the identity of the entity.
 		field.UUID("id", uuid.UUID{}).Default(newUUID),
 	}
 }

internal/ent/schema/organization.go

@@ -2,26 +2,39 @@ package schema
 
 import (
 	"entgo.io/ent"
+	"entgo.io/ent/schema/edge"
 	"entgo.io/ent/schema/field"
+	"github.com/gofrs/uuid"
 )
 
-// User holds the schema definition for the User entity, the internal
-// representation and identity of a single human user. Users are scoped
-// globally.
+// Organization represents an organization account.
 type Organization struct {
 	ent.Schema
 }
 
-func (Organization) Fields() []ent.Field {
-	return []ent.Field{
-		field.String("name").NotEmpty().Unique(),
-		field.String("display_name"),
-	}
-}
-
 func (Organization) Mixin() []ent.Mixin {
 	return []ent.Mixin{
 		BaseMixin{},
 		TimeMixin{},
 	}
 }
+
+func (Organization) Fields() []ent.Field {
+	return []ent.Field{
+		field.String("name").NotEmpty().Unique(),
+		field.String("display_name"),
+		field.UUID("creator_id", uuid.UUID{}),
+	}
+}
+
+func (Organization) Edges() []ent.Edge {
+	return []ent.Edge{
+		edge.To("creator", User.Type).
+			Field("creator_id").
+			Unique().
+			Required(),
+		edge.To("users", User.Type),
+		edge.From("platforms", Platform.Type).
+			Ref("organization"),
+	}
+}

internal/ent/schema/platform.go

@@ -0,0 +1,62 @@
+package schema
+
+import (
+	"entgo.io/ent"
+	"entgo.io/ent/schema/edge"
+	"entgo.io/ent/schema/field"
+	"entgo.io/ent/schema/index"
+	"github.com/gofrs/uuid"
+	holos "github.com/holos-run/holos/service/gen/holos/v1alpha1"
+)
+
+type Platform struct {
+	ent.Schema
+}
+
+func (Platform) Mixin() []ent.Mixin {
+	return []ent.Mixin{
+		BaseMixin{},
+		TimeMixin{},
+	}
+}
+
+func (Platform) Fields() []ent.Field {
+	return []ent.Field{
+		field.UUID("org_id", uuid.UUID{}),
+		field.String("name").NotEmpty(),
+		field.String("display_name"),
+		field.UUID("creator_id", uuid.UUID{}),
+		field.JSON("config_form", &holos.PlatformForm{}).
+			Optional().
+			Comment("JSON holos.PlatformForm representing the platform data entry form."),
+		field.JSON("config_values", &holos.ConfigValues{}).
+			Optional().
+			Comment("JSON holos.ConfigValues representing the platform config values."),
+		field.Bytes("config_cue").
+			Optional().
+			Comment("Opaque bytes representing the CUE definition of the config struct."),
+		field.String("config_definition").
+			Optional().
+			Comment("The definition name to vet config_values against config_cue e.g. '#PlatformSpec'"),
+	}
+}
+
+func (Platform) Edges() []ent.Edge {
+	return []ent.Edge{
+		edge.To("creator", User.Type).
+			Field("creator_id").
+			Unique().
+			Required(),
+		edge.To("organization", Organization.Type).
+			Field("org_id").
+			Unique().
+			Required(),
+	}
+}
+
+func (Platform) Indexes() []ent.Index {
+	return []ent.Index{
+		// One org cannot have two platforms with the same name.
+		index.Fields("org_id", "name").Unique(),
+	}
+}

internal/ent/schema/user.go

@@ -2,7 +2,9 @@ package schema
 
 import (
 	"entgo.io/ent"
+	"entgo.io/ent/schema/edge"
 	"entgo.io/ent/schema/field"
+	"entgo.io/ent/schema/index"
 )
 
 // User holds the schema definition for the User entity, the internal
@@ -28,3 +30,16 @@ func (User) Fields() []ent.Field {
 		field.String("name"),
 	}
 }
+
+func (User) Edges() []ent.Edge {
+	return []ent.Edge{
+		edge.From("organizations", Organization.Type).
+			Ref("users"),
+	}
+}
+
+func (User) Indexes() []ent.Index {
+	return []ent.Index{
+		index.Fields("iss", "sub").Unique(),
+	}
+}

internal/ent/tx.go

@@ -14,6 +14,8 @@ type Tx struct {
 	config
 	// Organization is the client for interacting with the Organization builders.
 	Organization *OrganizationClient
+	// Platform is the client for interacting with the Platform builders.
+	Platform *PlatformClient
 	// User is the client for interacting with the User builders.
 	User *UserClient
 
@@ -148,6 +150,7 @@ func (tx *Tx) Client() *Client {
 
 func (tx *Tx) init() {
 	tx.Organization = NewOrganizationClient(tx.config)
+	tx.Platform = NewPlatformClient(tx.config)
 	tx.User = NewUserClient(tx.config)
 }
 

internal/ent/user.go

@@ -29,10 +29,31 @@ type User struct {
 	// Sub holds the value of the "sub" field.
 	Sub string `json:"sub,omitempty"`
 	// Name holds the value of the "name" field.
-	Name         string `json:"name,omitempty"`
+	Name string `json:"name,omitempty"`
+	// Edges holds the relations/edges for other nodes in the graph.
+	// The values are being populated by the UserQuery when eager-loading is set.
+	Edges        UserEdges `json:"edges"`
 	selectValues sql.SelectValues
 }
 
+// UserEdges holds the relations/edges for other nodes in the graph.
+type UserEdges struct {
+	// Organizations holds the value of the organizations edge.
+	Organizations []*Organization `json:"organizations,omitempty"`
+	// loadedTypes holds the information for reporting if a
+	// type was loaded (or requested) in eager-loading or not.
+	loadedTypes [1]bool
+}
+
+// OrganizationsOrErr returns the Organizations value or an error if the edge
+// was not loaded in eager-loading.
+func (e UserEdges) OrganizationsOrErr() ([]*Organization, error) {
+	if e.loadedTypes[0] {
+		return e.Organizations, nil
+	}
+	return nil, &NotLoadedError{edge: "organizations"}
+}
+
 // scanValues returns the types for scanning values from sql.Rows.
 func (*User) scanValues(columns []string) ([]any, error) {
 	values := make([]any, len(columns))
@@ -114,6 +135,11 @@ func (u *User) Value(name string) (ent.Value, error) {
 	return u.selectValues.Get(name)
 }
 
+// QueryOrganizations queries the "organizations" edge of the User entity.
+func (u *User) QueryOrganizations() *OrganizationQuery {
+	return NewUserClient(u.config).QueryOrganizations(u)
+}
+
 // Update returns a builder for updating this User.
 // Note that you need to call User.Unwrap() before calling this method if this User
 // was returned from a transaction, and the transaction was committed or rolled back.

internal/ent/user/user.go

@@ -6,6 +6,7 @@ import (
 	"time"
 
 	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
 	"github.com/gofrs/uuid"
 )
 
@@ -26,8 +27,15 @@ const (
 	FieldSub = "sub"
 	// FieldName holds the string denoting the name field in the database.
 	FieldName = "name"
+	// EdgeOrganizations holds the string denoting the organizations edge name in mutations.
+	EdgeOrganizations = "organizations"
 	// Table holds the table name of the user in the database.
 	Table = "users"
+	// OrganizationsTable is the table that holds the organizations relation/edge. The primary key declared below.
+	OrganizationsTable = "organization_users"
+	// OrganizationsInverseTable is the table name for the Organization entity.
+	// It exists in this package in order to avoid circular dependency with the "organization" package.
+	OrganizationsInverseTable = "organizations"
 )
 
 // Columns holds all SQL columns for user fields.
@@ -41,6 +49,12 @@ var Columns = []string{
 	FieldName,
 }
 
+var (
+	// OrganizationsPrimaryKey and OrganizationsColumn2 are the table columns denoting the
+	// primary key for the organizations relation (M2M).
+	OrganizationsPrimaryKey = []string{"organization_id", "user_id"}
+)
+
 // ValidColumn reports if the column name is valid (part of the table columns).
 func ValidColumn(column string) bool {
 	for i := range Columns {
@@ -101,3 +115,24 @@ func BySub(opts ...sql.OrderTermOption) OrderOption {
 func ByName(opts ...sql.OrderTermOption) OrderOption {
 	return sql.OrderByField(FieldName, opts...).ToFunc()
 }
+
+// ByOrganizationsCount orders the results by organizations count.
+func ByOrganizationsCount(opts ...sql.OrderTermOption) OrderOption {
+	return func(s *sql.Selector) {
+		sqlgraph.OrderByNeighborsCount(s, newOrganizationsStep(), opts...)
+	}
+}
+
+// ByOrganizations orders the results by organizations terms.
+func ByOrganizations(term sql.OrderTerm, terms ...sql.OrderTerm) OrderOption {
+	return func(s *sql.Selector) {
+		sqlgraph.OrderByNeighborTerms(s, newOrganizationsStep(), append([]sql.OrderTerm{term}, terms...)...)
+	}
+}
+func newOrganizationsStep() *sqlgraph.Step {
+	return sqlgraph.NewStep(
+		sqlgraph.From(Table, FieldID),
+		sqlgraph.To(OrganizationsInverseTable, FieldID),
+		sqlgraph.Edge(sqlgraph.M2M, true, OrganizationsTable, OrganizationsPrimaryKey...),
+	)
+}

internal/ent/user/where.go

@@ -6,6 +6,7 @@ import (
 	"time"
 
 	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
 	"github.com/gofrs/uuid"
 	"github.com/holos-run/holos/internal/ent/predicate"
 )
@@ -425,6 +426,29 @@ func NameContainsFold(v string) predicate.User {
 	return predicate.User(sql.FieldContainsFold(FieldName, v))
 }
 
+// HasOrganizations applies the HasEdge predicate on the "organizations" edge.
+func HasOrganizations() predicate.User {
+	return predicate.User(func(s *sql.Selector) {
+		step := sqlgraph.NewStep(
+			sqlgraph.From(Table, FieldID),
+			sqlgraph.Edge(sqlgraph.M2M, true, OrganizationsTable, OrganizationsPrimaryKey...),
+		)
+		sqlgraph.HasNeighbors(s, step)
+	})
+}
+
+// HasOrganizationsWith applies the HasEdge predicate on the "organizations" edge with a given conditions (other predicates).
+func HasOrganizationsWith(preds ...predicate.Organization) predicate.User {
+	return predicate.User(func(s *sql.Selector) {
+		step := newOrganizationsStep()
+		sqlgraph.HasNeighborsWith(s, step, func(s *sql.Selector) {
+			for _, p := range preds {
+				p(s)
+			}
+		})
+	})
+}
+
 // And groups predicates with the AND operator between them.
 func And(predicates ...predicate.User) predicate.User {
 	return predicate.User(sql.AndPredicates(predicates...))

internal/ent/user_create.go

@@ -13,6 +13,7 @@ import (
 	"entgo.io/ent/dialect/sql/sqlgraph"
 	"entgo.io/ent/schema/field"
 	"github.com/gofrs/uuid"
+	"github.com/holos-run/holos/internal/ent/organization"
 	"github.com/holos-run/holos/internal/ent/user"
 )
 
@@ -90,6 +91,21 @@ func (uc *UserCreate) SetNillableID(u *uuid.UUID) *UserCreate {
 	return uc
 }
 
+// AddOrganizationIDs adds the "organizations" edge to the Organization entity by IDs.
+func (uc *UserCreate) AddOrganizationIDs(ids ...uuid.UUID) *UserCreate {
+	uc.mutation.AddOrganizationIDs(ids...)
+	return uc
+}
+
+// AddOrganizations adds the "organizations" edges to the Organization entity.
+func (uc *UserCreate) AddOrganizations(o ...*Organization) *UserCreate {
+	ids := make([]uuid.UUID, len(o))
+	for i := range o {
+		ids[i] = o[i].ID
+	}
+	return uc.AddOrganizationIDs(ids...)
+}
+
 // Mutation returns the UserMutation object of the builder.
 func (uc *UserCreate) Mutation() *UserMutation {
 	return uc.mutation
@@ -224,6 +240,22 @@ func (uc *UserCreate) createSpec() (*User, *sqlgraph.CreateSpec) {
 		_spec.SetField(user.FieldName, field.TypeString, value)
 		_node.Name = value
 	}
+	if nodes := uc.mutation.OrganizationsIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2M,
+			Inverse: true,
+			Table:   user.OrganizationsTable,
+			Columns: user.OrganizationsPrimaryKey,
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(organization.FieldID, field.TypeUUID),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges = append(_spec.Edges, edge)
+	}
 	return _node, _spec
 }
 

internal/ent/user_query.go

@@ -4,6 +4,7 @@ package ent
 
 import (
 	"context"
+	"database/sql/driver"
 	"fmt"
 	"math"
 
@@ -11,6 +12,7 @@ import (
 	"entgo.io/ent/dialect/sql/sqlgraph"
 	"entgo.io/ent/schema/field"
 	"github.com/gofrs/uuid"
+	"github.com/holos-run/holos/internal/ent/organization"
 	"github.com/holos-run/holos/internal/ent/predicate"
 	"github.com/holos-run/holos/internal/ent/user"
 )
@@ -18,10 +20,11 @@ import (
 // UserQuery is the builder for querying User entities.
 type UserQuery struct {
 	config
-	ctx        *QueryContext
-	order      []user.OrderOption
-	inters     []Interceptor
-	predicates []predicate.User
+	ctx               *QueryContext
+	order             []user.OrderOption
+	inters            []Interceptor
+	predicates        []predicate.User
+	withOrganizations *OrganizationQuery
 	// intermediate query (i.e. traversal path).
 	sql  *sql.Selector
 	path func(context.Context) (*sql.Selector, error)
@@ -58,6 +61,28 @@ func (uq *UserQuery) Order(o ...user.OrderOption) *UserQuery {
 	return uq
 }
 
+// QueryOrganizations chains the current query on the "organizations" edge.
+func (uq *UserQuery) QueryOrganizations() *OrganizationQuery {
+	query := (&OrganizationClient{config: uq.config}).Query()
+	query.path = func(ctx context.Context) (fromU *sql.Selector, err error) {
+		if err := uq.prepareQuery(ctx); err != nil {
+			return nil, err
+		}
+		selector := uq.sqlQuery(ctx)
+		if err := selector.Err(); err != nil {
+			return nil, err
+		}
+		step := sqlgraph.NewStep(
+			sqlgraph.From(user.Table, user.FieldID, selector),
+			sqlgraph.To(organization.Table, organization.FieldID),
+			sqlgraph.Edge(sqlgraph.M2M, true, user.OrganizationsTable, user.OrganizationsPrimaryKey...),
+		)
+		fromU = sqlgraph.SetNeighbors(uq.driver.Dialect(), step)
+		return fromU, nil
+	}
+	return query
+}
+
 // First returns the first User entity from the query.
 // Returns a *NotFoundError when no User was found.
 func (uq *UserQuery) First(ctx context.Context) (*User, error) {
@@ -245,17 +270,29 @@ func (uq *UserQuery) Clone() *UserQuery {
 		return nil
 	}
 	return &UserQuery{
-		config:     uq.config,
-		ctx:        uq.ctx.Clone(),
-		order:      append([]user.OrderOption{}, uq.order...),
-		inters:     append([]Interceptor{}, uq.inters...),
-		predicates: append([]predicate.User{}, uq.predicates...),
+		config:            uq.config,
+		ctx:               uq.ctx.Clone(),
+		order:             append([]user.OrderOption{}, uq.order...),
+		inters:            append([]Interceptor{}, uq.inters...),
+		predicates:        append([]predicate.User{}, uq.predicates...),
+		withOrganizations: uq.withOrganizations.Clone(),
 		// clone intermediate query.
 		sql:  uq.sql.Clone(),
 		path: uq.path,
 	}
 }
 
+// WithOrganizations tells the query-builder to eager-load the nodes that are connected to
+// the "organizations" edge. The optional arguments are used to configure the query builder of the edge.
+func (uq *UserQuery) WithOrganizations(opts ...func(*OrganizationQuery)) *UserQuery {
+	query := (&OrganizationClient{config: uq.config}).Query()
+	for _, opt := range opts {
+		opt(query)
+	}
+	uq.withOrganizations = query
+	return uq
+}
+
 // GroupBy is used to group vertices by one or more fields/columns.
 // It is often used with aggregate functions, like: count, max, mean, min, sum.
 //
@@ -332,8 +369,11 @@ func (uq *UserQuery) prepareQuery(ctx context.Context) error {
 
 func (uq *UserQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*User, error) {
 	var (
-		nodes = []*User{}
-		_spec = uq.querySpec()
+		nodes       = []*User{}
+		_spec       = uq.querySpec()
+		loadedTypes = [1]bool{
+			uq.withOrganizations != nil,
+		}
 	)
 	_spec.ScanValues = func(columns []string) ([]any, error) {
 		return (*User).scanValues(nil, columns)
@@ -341,6 +381,7 @@ func (uq *UserQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*User, e
 	_spec.Assign = func(columns []string, values []any) error {
 		node := &User{config: uq.config}
 		nodes = append(nodes, node)
+		node.Edges.loadedTypes = loadedTypes
 		return node.assignValues(columns, values)
 	}
 	for i := range hooks {
@@ -352,9 +393,78 @@ func (uq *UserQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*User, e
 	if len(nodes) == 0 {
 		return nodes, nil
 	}
+	if query := uq.withOrganizations; query != nil {
+		if err := uq.loadOrganizations(ctx, query, nodes,
+			func(n *User) { n.Edges.Organizations = []*Organization{} },
+			func(n *User, e *Organization) { n.Edges.Organizations = append(n.Edges.Organizations, e) }); err != nil {
+			return nil, err
+		}
+	}
 	return nodes, nil
 }
 
+func (uq *UserQuery) loadOrganizations(ctx context.Context, query *OrganizationQuery, nodes []*User, init func(*User), assign func(*User, *Organization)) error {
+	edgeIDs := make([]driver.Value, len(nodes))
+	byID := make(map[uuid.UUID]*User)
+	nids := make(map[uuid.UUID]map[*User]struct{})
+	for i, node := range nodes {
+		edgeIDs[i] = node.ID
+		byID[node.ID] = node
+		if init != nil {
+			init(node)
+		}
+	}
+	query.Where(func(s *sql.Selector) {
+		joinT := sql.Table(user.OrganizationsTable)
+		s.Join(joinT).On(s.C(organization.FieldID), joinT.C(user.OrganizationsPrimaryKey[0]))
+		s.Where(sql.InValues(joinT.C(user.OrganizationsPrimaryKey[1]), edgeIDs...))
+		columns := s.SelectedColumns()
+		s.Select(joinT.C(user.OrganizationsPrimaryKey[1]))
+		s.AppendSelect(columns...)
+		s.SetDistinct(false)
+	})
+	if err := query.prepareQuery(ctx); err != nil {
+		return err
+	}
+	qr := QuerierFunc(func(ctx context.Context, q Query) (Value, error) {
+		return query.sqlAll(ctx, func(_ context.Context, spec *sqlgraph.QuerySpec) {
+			assign := spec.Assign
+			values := spec.ScanValues
+			spec.ScanValues = func(columns []string) ([]any, error) {
+				values, err := values(columns[1:])
+				if err != nil {
+					return nil, err
+				}
+				return append([]any{new(uuid.UUID)}, values...), nil
+			}
+			spec.Assign = func(columns []string, values []any) error {
+				outValue := *values[0].(*uuid.UUID)
+				inValue := *values[1].(*uuid.UUID)
+				if nids[inValue] == nil {
+					nids[inValue] = map[*User]struct{}{byID[outValue]: {}}
+					return assign(columns[1:], values[1:])
+				}
+				nids[inValue][byID[outValue]] = struct{}{}
+				return nil
+			}
+		})
+	})
+	neighbors, err := withInterceptors[[]*Organization](ctx, query, qr, query.inters)
+	if err != nil {
+		return err
+	}
+	for _, n := range neighbors {
+		nodes, ok := nids[n.ID]
+		if !ok {
+			return fmt.Errorf(`unexpected "organizations" node returned %v`, n.ID)
+		}
+		for kn := range nodes {
+			assign(kn, n)
+		}
+	}
+	return nil
+}
+
 func (uq *UserQuery) sqlCount(ctx context.Context) (int, error) {
 	_spec := uq.querySpec()
 	_spec.Node.Columns = uq.ctx.Fields

internal/ent/user_update.go

@@ -11,6 +11,8 @@ import (
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
 	"entgo.io/ent/schema/field"
+	"github.com/gofrs/uuid"
+	"github.com/holos-run/holos/internal/ent/organization"
 	"github.com/holos-run/holos/internal/ent/predicate"
 	"github.com/holos-run/holos/internal/ent/user"
 )
@@ -90,11 +92,47 @@ func (uu *UserUpdate) SetNillableName(s *string) *UserUpdate {
 	return uu
 }
 
+// AddOrganizationIDs adds the "organizations" edge to the Organization entity by IDs.
+func (uu *UserUpdate) AddOrganizationIDs(ids ...uuid.UUID) *UserUpdate {
+	uu.mutation.AddOrganizationIDs(ids...)
+	return uu
+}
+
+// AddOrganizations adds the "organizations" edges to the Organization entity.
+func (uu *UserUpdate) AddOrganizations(o ...*Organization) *UserUpdate {
+	ids := make([]uuid.UUID, len(o))
+	for i := range o {
+		ids[i] = o[i].ID
+	}
+	return uu.AddOrganizationIDs(ids...)
+}
+
 // Mutation returns the UserMutation object of the builder.
 func (uu *UserUpdate) Mutation() *UserMutation {
 	return uu.mutation
 }
 
+// ClearOrganizations clears all "organizations" edges to the Organization entity.
+func (uu *UserUpdate) ClearOrganizations() *UserUpdate {
+	uu.mutation.ClearOrganizations()
+	return uu
+}
+
+// RemoveOrganizationIDs removes the "organizations" edge to Organization entities by IDs.
+func (uu *UserUpdate) RemoveOrganizationIDs(ids ...uuid.UUID) *UserUpdate {
+	uu.mutation.RemoveOrganizationIDs(ids...)
+	return uu
+}
+
+// RemoveOrganizations removes "organizations" edges to Organization entities.
+func (uu *UserUpdate) RemoveOrganizations(o ...*Organization) *UserUpdate {
+	ids := make([]uuid.UUID, len(o))
+	for i := range o {
+		ids[i] = o[i].ID
+	}
+	return uu.RemoveOrganizationIDs(ids...)
+}
+
 // Save executes the query and returns the number of nodes affected by the update operation.
 func (uu *UserUpdate) Save(ctx context.Context) (int, error) {
 	uu.defaults()
@@ -168,6 +206,51 @@ func (uu *UserUpdate) sqlSave(ctx context.Context) (n int, err error) {
 	if value, ok := uu.mutation.Name(); ok {
 		_spec.SetField(user.FieldName, field.TypeString, value)
 	}
+	if uu.mutation.OrganizationsCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2M,
+			Inverse: true,
+			Table:   user.OrganizationsTable,
+			Columns: user.OrganizationsPrimaryKey,
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(organization.FieldID, field.TypeUUID),
+			},
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := uu.mutation.RemovedOrganizationsIDs(); len(nodes) > 0 && !uu.mutation.OrganizationsCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2M,
+			Inverse: true,
+			Table:   user.OrganizationsTable,
+			Columns: user.OrganizationsPrimaryKey,
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(organization.FieldID, field.TypeUUID),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := uu.mutation.OrganizationsIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2M,
+			Inverse: true,
+			Table:   user.OrganizationsTable,
+			Columns: user.OrganizationsPrimaryKey,
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(organization.FieldID, field.TypeUUID),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Add = append(_spec.Edges.Add, edge)
+	}
 	if n, err = sqlgraph.UpdateNodes(ctx, uu.driver, _spec); err != nil {
 		if _, ok := err.(*sqlgraph.NotFoundError); ok {
 			err = &NotFoundError{user.Label}
@@ -250,11 +333,47 @@ func (uuo *UserUpdateOne) SetNillableName(s *string) *UserUpdateOne {
 	return uuo
 }
 
+// AddOrganizationIDs adds the "organizations" edge to the Organization entity by IDs.
+func (uuo *UserUpdateOne) AddOrganizationIDs(ids ...uuid.UUID) *UserUpdateOne {
+	uuo.mutation.AddOrganizationIDs(ids...)
+	return uuo
+}
+
+// AddOrganizations adds the "organizations" edges to the Organization entity.
+func (uuo *UserUpdateOne) AddOrganizations(o ...*Organization) *UserUpdateOne {
+	ids := make([]uuid.UUID, len(o))
+	for i := range o {
+		ids[i] = o[i].ID
+	}
+	return uuo.AddOrganizationIDs(ids...)
+}
+
 // Mutation returns the UserMutation object of the builder.
 func (uuo *UserUpdateOne) Mutation() *UserMutation {
 	return uuo.mutation
 }
 
+// ClearOrganizations clears all "organizations" edges to the Organization entity.
+func (uuo *UserUpdateOne) ClearOrganizations() *UserUpdateOne {
+	uuo.mutation.ClearOrganizations()
+	return uuo
+}
+
+// RemoveOrganizationIDs removes the "organizations" edge to Organization entities by IDs.
+func (uuo *UserUpdateOne) RemoveOrganizationIDs(ids ...uuid.UUID) *UserUpdateOne {
+	uuo.mutation.RemoveOrganizationIDs(ids...)
+	return uuo
+}
+
+// RemoveOrganizations removes "organizations" edges to Organization entities.
+func (uuo *UserUpdateOne) RemoveOrganizations(o ...*Organization) *UserUpdateOne {
+	ids := make([]uuid.UUID, len(o))
+	for i := range o {
+		ids[i] = o[i].ID
+	}
+	return uuo.RemoveOrganizationIDs(ids...)
+}
+
 // Where appends a list predicates to the UserUpdate builder.
 func (uuo *UserUpdateOne) Where(ps ...predicate.User) *UserUpdateOne {
 	uuo.mutation.Where(ps...)
@@ -358,6 +477,51 @@ func (uuo *UserUpdateOne) sqlSave(ctx context.Context) (_node *User, err error)
 	if value, ok := uuo.mutation.Name(); ok {
 		_spec.SetField(user.FieldName, field.TypeString, value)
 	}
+	if uuo.mutation.OrganizationsCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2M,
+			Inverse: true,
+			Table:   user.OrganizationsTable,
+			Columns: user.OrganizationsPrimaryKey,
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(organization.FieldID, field.TypeUUID),
+			},
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := uuo.mutation.RemovedOrganizationsIDs(); len(nodes) > 0 && !uuo.mutation.OrganizationsCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2M,
+			Inverse: true,
+			Table:   user.OrganizationsTable,
+			Columns: user.OrganizationsPrimaryKey,
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(organization.FieldID, field.TypeUUID),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := uuo.mutation.OrganizationsIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2M,
+			Inverse: true,
+			Table:   user.OrganizationsTable,
+			Columns: user.OrganizationsPrimaryKey,
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(organization.FieldID, field.TypeUUID),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Add = append(_spec.Edges.Add, edge)
+	}
 	_node = &User{config: uuo.config}
 	_spec.Assign = _node.assignValues
 	_spec.ScanValues = _node.scanValues

internal/frontend/holos/angular.json

@@ -45,7 +45,7 @@
                 {
                   "type": "initial",
                   "maximumWarning": "500kb",
-                  "maximumError": "1mb"
+                  "maximumError": "5mb"
                 },
                 {
                   "type": "anyComponentStyle",

internal/frontend/holos/gen/holos/v1alpha1/holos-HolosService_connectquery.ts

@@ -1,35 +0,0 @@
-// @generated by protoc-gen-connect-query v1.3.1 with parameter "target=ts"
-// @generated from file holos/v1alpha1/holos.proto (package holos.v1alpha1, syntax proto3)
-/* eslint-disable */
-// @ts-nocheck
-
-import { MethodKind } from "@bufbuild/protobuf";
-import { GetUserClaimsRequest, GetUserClaimsResponse, RegisterUserRequest, RegisterUserResponse } from "./holos_pb.js";
-
-/**
- * @generated from rpc holos.v1alpha1.HolosService.GetUserClaims
- */
-export const getUserClaims = {
-  localName: "getUserClaims",
-  name: "GetUserClaims",
-  kind: MethodKind.Unary,
-  I: GetUserClaimsRequest,
-  O: GetUserClaimsResponse,
-  service: {
-    typeName: "holos.v1alpha1.HolosService"
-  }
-} as const;
-
-/**
- * @generated from rpc holos.v1alpha1.HolosService.RegisterUser
- */
-export const registerUser = {
-  localName: "registerUser",
-  name: "RegisterUser",
-  kind: MethodKind.Unary,
-  I: RegisterUserRequest,
-  O: RegisterUserResponse,
-  service: {
-    typeName: "holos.v1alpha1.HolosService"
-  }
-} as const;

internal/frontend/holos/gen/holos/v1alpha1/holos_connect.ts

@@ -1,35 +0,0 @@
-// @generated by protoc-gen-connect-es v1.4.0 with parameter "target=ts"
-// @generated from file holos/v1alpha1/holos.proto (package holos.v1alpha1, syntax proto3)
-/* eslint-disable */
-// @ts-nocheck
-
-import { GetUserClaimsRequest, GetUserClaimsResponse, RegisterUserRequest, RegisterUserResponse } from "./holos_pb.js";
-import { MethodKind } from "@bufbuild/protobuf";
-
-/**
- * @generated from service holos.v1alpha1.HolosService
- */
-export const HolosService = {
-  typeName: "holos.v1alpha1.HolosService",
-  methods: {
-    /**
-     * @generated from rpc holos.v1alpha1.HolosService.GetUserClaims
-     */
-    getUserClaims: {
-      name: "GetUserClaims",
-      I: GetUserClaimsRequest,
-      O: GetUserClaimsResponse,
-      kind: MethodKind.Unary,
-    },
-    /**
-     * @generated from rpc holos.v1alpha1.HolosService.RegisterUser
-     */
-    registerUser: {
-      name: "RegisterUser",
-      I: RegisterUserRequest,
-      O: RegisterUserResponse,
-      kind: MethodKind.Unary,
-    },
-  }
-} as const;
-

internal/frontend/holos/gen/holos/v1alpha1/holos_pb.ts

@@ -1,296 +0,0 @@
-// @generated by protoc-gen-es v1.8.0 with parameter "target=ts"
-// @generated from file holos/v1alpha1/holos.proto (package holos.v1alpha1, syntax proto3)
-/* eslint-disable */
-// @ts-nocheck
-
-import type { BinaryReadOptions, FieldList, JsonReadOptions, JsonValue, PartialMessage, PlainMessage } from "@bufbuild/protobuf";
-import { Message, proto3, Timestamp } from "@bufbuild/protobuf";
-
-/**
- * @generated from message holos.v1alpha1.Timestamps
- */
-export class Timestamps extends Message<Timestamps> {
-  /**
-   * Created at timestamp
-   *
-   * @generated from field: google.protobuf.Timestamp created_at = 1;
-   */
-  createdAt?: Timestamp;
-
-  /**
-   * Updated at timestamp
-   *
-   * @generated from field: google.protobuf.Timestamp updated_at = 2;
-   */
-  updatedAt?: Timestamp;
-
-  constructor(data?: PartialMessage<Timestamps>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.Timestamps";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "created_at", kind: "message", T: Timestamp },
-    { no: 2, name: "updated_at", kind: "message", T: Timestamp },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): Timestamps {
-    return new Timestamps().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): Timestamps {
-    return new Timestamps().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): Timestamps {
-    return new Timestamps().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: Timestamps | PlainMessage<Timestamps> | undefined, b: Timestamps | PlainMessage<Timestamps> | undefined): boolean {
-    return proto3.util.equals(Timestamps, a, b);
-  }
-}
-
-/**
- * Empty request, claims are pulled from the id token
- *
- * @generated from message holos.v1alpha1.GetUserClaimsRequest
- */
-export class GetUserClaimsRequest extends Message<GetUserClaimsRequest> {
-  constructor(data?: PartialMessage<GetUserClaimsRequest>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.GetUserClaimsRequest";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetUserClaimsRequest {
-    return new GetUserClaimsRequest().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetUserClaimsRequest {
-    return new GetUserClaimsRequest().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetUserClaimsRequest {
-    return new GetUserClaimsRequest().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: GetUserClaimsRequest | PlainMessage<GetUserClaimsRequest> | undefined, b: GetUserClaimsRequest | PlainMessage<GetUserClaimsRequest> | undefined): boolean {
-    return proto3.util.equals(GetUserClaimsRequest, a, b);
-  }
-}
-
-/**
- * UserClaims represents id token claims
- *
- * @generated from message holos.v1alpha1.GetUserClaimsResponse
- */
-export class GetUserClaimsResponse extends Message<GetUserClaimsResponse> {
-  /**
-   * @generated from field: string iss = 1;
-   */
-  iss = "";
-
-  /**
-   * @generated from field: string sub = 2;
-   */
-  sub = "";
-
-  /**
-   * @generated from field: string email = 3;
-   */
-  email = "";
-
-  /**
-   * @generated from field: bool email_verified = 4;
-   */
-  emailVerified = false;
-
-  /**
-   * @generated from field: string name = 5;
-   */
-  name = "";
-
-  constructor(data?: PartialMessage<GetUserClaimsResponse>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.GetUserClaimsResponse";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "iss", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 2, name: "sub", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 3, name: "email", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 4, name: "email_verified", kind: "scalar", T: 8 /* ScalarType.BOOL */ },
-    { no: 5, name: "name", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetUserClaimsResponse {
-    return new GetUserClaimsResponse().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetUserClaimsResponse {
-    return new GetUserClaimsResponse().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetUserClaimsResponse {
-    return new GetUserClaimsResponse().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: GetUserClaimsResponse | PlainMessage<GetUserClaimsResponse> | undefined, b: GetUserClaimsResponse | PlainMessage<GetUserClaimsResponse> | undefined): boolean {
-    return proto3.util.equals(GetUserClaimsResponse, a, b);
-  }
-}
-
-/**
- * User represents a human user in the system.  See db schema in ent/schema/user.go
- *
- * @generated from message holos.v1alpha1.User
- */
-export class User extends Message<User> {
-  /**
-   * Unique id assigned by the server.
-   *
-   * @generated from field: string id = 1;
-   */
-  id = "";
-
-  /**
-   * @generated from field: string email = 2;
-   */
-  email = "";
-
-  /**
-   * @generated from field: bool email_verified = 3;
-   */
-  emailVerified = false;
-
-  /**
-   * @generated from field: string name = 4;
-   */
-  name = "";
-
-  /**
-   * @generated from field: holos.v1alpha1.Timestamps timestamps = 5;
-   */
-  timestamps?: Timestamps;
-
-  constructor(data?: PartialMessage<User>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.User";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 2, name: "email", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 3, name: "email_verified", kind: "scalar", T: 8 /* ScalarType.BOOL */ },
-    { no: 4, name: "name", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 5, name: "timestamps", kind: "message", T: Timestamps },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): User {
-    return new User().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): User {
-    return new User().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): User {
-    return new User().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: User | PlainMessage<User> | undefined, b: User | PlainMessage<User> | undefined): boolean {
-    return proto3.util.equals(User, a, b);
-  }
-}
-
-/**
- * @generated from message holos.v1alpha1.RegisterUserRequest
- */
-export class RegisterUserRequest extends Message<RegisterUserRequest> {
-  /**
-   * @generated from field: optional string name = 1;
-   */
-  name?: string;
-
-  constructor(data?: PartialMessage<RegisterUserRequest>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.RegisterUserRequest";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "name", kind: "scalar", T: 9 /* ScalarType.STRING */, opt: true },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): RegisterUserRequest {
-    return new RegisterUserRequest().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): RegisterUserRequest {
-    return new RegisterUserRequest().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): RegisterUserRequest {
-    return new RegisterUserRequest().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: RegisterUserRequest | PlainMessage<RegisterUserRequest> | undefined, b: RegisterUserRequest | PlainMessage<RegisterUserRequest> | undefined): boolean {
-    return proto3.util.equals(RegisterUserRequest, a, b);
-  }
-}
-
-/**
- * @generated from message holos.v1alpha1.RegisterUserResponse
- */
-export class RegisterUserResponse extends Message<RegisterUserResponse> {
-  /**
-   * @generated from field: holos.v1alpha1.User user = 1;
-   */
-  user?: User;
-
-  /**
-   * @generated from field: bool already_exists = 2;
-   */
-  alreadyExists = false;
-
-  constructor(data?: PartialMessage<RegisterUserResponse>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.RegisterUserResponse";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "user", kind: "message", T: User },
-    { no: 2, name: "already_exists", kind: "scalar", T: 8 /* ScalarType.BOOL */ },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): RegisterUserResponse {
-    return new RegisterUserResponse().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): RegisterUserResponse {
-    return new RegisterUserResponse().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): RegisterUserResponse {
-    return new RegisterUserResponse().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: RegisterUserResponse | PlainMessage<RegisterUserResponse> | undefined, b: RegisterUserResponse | PlainMessage<RegisterUserResponse> | undefined): boolean {
-    return proto3.util.equals(RegisterUserResponse, a, b);
-  }
-}
-

internal/frontend/holos/package-lock.json

@@ -18,10 +18,12 @@
         "@angular/platform-browser": "^17.3.0",
         "@angular/platform-browser-dynamic": "^17.3.0",
         "@angular/router": "^17.3.0",
-        "@bufbuild/protobuf": "^1.8.0",
+        "@bufbuild/protobuf": "^1.9.0",
         "@connectrpc/connect": "^1.4.0",
         "@connectrpc/connect-query": "^1.3.1",
         "@connectrpc/connect-web": "^1.4.0",
+        "@ngx-formly/core": "^6.3.0",
+        "@ngx-formly/material": "^6.3.0",
         "rxjs": "~7.8.0",
         "tslib": "^2.3.0",
         "zone.js": "~0.14.3"
@@ -30,10 +32,11 @@
         "@angular-devkit/build-angular": "^17.3.4",
         "@angular/cli": "^17.3.4",
         "@angular/compiler-cli": "^17.3.0",
-        "@bufbuild/buf": "^1.30.1",
-        "@bufbuild/protoc-gen-es": "^1.8.0",
+        "@bufbuild/buf": "^1.31.0",
+        "@bufbuild/protoc-gen-es": "^1.9.0",
         "@connectrpc/protoc-gen-connect-es": "^1.4.0",
         "@connectrpc/protoc-gen-connect-query": "^1.3.1",
+        "@ngx-formly/schematics": "^6.3.0",
         "@types/jasmine": "~5.1.0",
         "jasmine-core": "~5.1.0",
         "karma": "~6.4.0",
@@ -2337,9 +2340,9 @@
       }
     },
     "node_modules/@bufbuild/buf": {
-      "version": "1.30.1",
-      "resolved": "https://registry.npmjs.org/@bufbuild/buf/-/buf-1.30.1.tgz",
-      "integrity": "sha512-9VVvrXBCWUiH8ToccqDfPRuTiPXSbHmSkL8XPlMpUhpJIlm01m4/Vzbc5FJL1yuk3e1rdBGCF6I9Obs9NsILzg==",
+      "version": "1.31.0",
+      "resolved": "https://registry.npmjs.org/@bufbuild/buf/-/buf-1.31.0.tgz",
+      "integrity": "sha512-kM/eueGkp0NDo8p8B6GXr1MdCzf4w8zEV1gbEiDlaLYDoyeHGLtlf5jF/hrb6MsvCccy3x7cc+cj4Wn/DmoR2g==",
       "dev": true,
       "hasInstallScript": true,
       "bin": {
@@ -2351,18 +2354,18 @@
         "node": ">=12"
       },
       "optionalDependencies": {
-        "@bufbuild/buf-darwin-arm64": "1.30.1",
-        "@bufbuild/buf-darwin-x64": "1.30.1",
-        "@bufbuild/buf-linux-aarch64": "1.30.1",
-        "@bufbuild/buf-linux-x64": "1.30.1",
-        "@bufbuild/buf-win32-arm64": "1.30.1",
-        "@bufbuild/buf-win32-x64": "1.30.1"
+        "@bufbuild/buf-darwin-arm64": "1.31.0",
+        "@bufbuild/buf-darwin-x64": "1.31.0",
+        "@bufbuild/buf-linux-aarch64": "1.31.0",
+        "@bufbuild/buf-linux-x64": "1.31.0",
+        "@bufbuild/buf-win32-arm64": "1.31.0",
+        "@bufbuild/buf-win32-x64": "1.31.0"
       }
     },
     "node_modules/@bufbuild/buf-darwin-arm64": {
-      "version": "1.30.1",
-      "resolved": "https://registry.npmjs.org/@bufbuild/buf-darwin-arm64/-/buf-darwin-arm64-1.30.1.tgz",
-      "integrity": "sha512-FRgf+x4V4s9Z1wH2xHdP8+1AYtil1GCmMjzKf/4AQ+eaUpoLfipSIsVYiBrnpcRxEPe9UMVzwNjKtPak/szwPw==",
+      "version": "1.31.0",
+      "resolved": "https://registry.npmjs.org/@bufbuild/buf-darwin-arm64/-/buf-darwin-arm64-1.31.0.tgz",
+      "integrity": "sha512-C0jArGS/SW0jfpBBmG6xEhUBWQTsGInnPr7y44WYWNS/U5OnnWPJtYQ7xbH0mzYDMx7sZVRV0FKvPO0FPKS+hA==",
       "cpu": [
         "arm64"
       ],
@@ -2376,9 +2379,9 @@
       }
     },
     "node_modules/@bufbuild/buf-darwin-x64": {
-      "version": "1.30.1",
-      "resolved": "https://registry.npmjs.org/@bufbuild/buf-darwin-x64/-/buf-darwin-x64-1.30.1.tgz",
-      "integrity": "sha512-kE0ne45zE7lSdv9WxPVhapwu627WMbWmWCzqSxzYr8sWDLqiAuw+XvO9/mHGdPWcMhV4lMX6tutitd9PPVxK8A==",
+      "version": "1.31.0",
+      "resolved": "https://registry.npmjs.org/@bufbuild/buf-darwin-x64/-/buf-darwin-x64-1.31.0.tgz",
+      "integrity": "sha512-oBTe1T4l2WSukAG+9YS7VHID4N1CuSvAxGBfuzpFQrjjiQZaaTfYuLqqVP6408MyCN7X/LOjfCekR1QToVweNw==",
       "cpu": [
         "x64"
       ],
@@ -2392,9 +2395,9 @@
       }
     },
     "node_modules/@bufbuild/buf-linux-aarch64": {
-      "version": "1.30.1",
-      "resolved": "https://registry.npmjs.org/@bufbuild/buf-linux-aarch64/-/buf-linux-aarch64-1.30.1.tgz",
-      "integrity": "sha512-kVV9Sl0GwZiQkMOXJiuwuU+gIHe6AWcYBMRMmuW55sY0ePZNXBmRGt4k5W4ijy98O6pnY3ao+n9ne0KwiD9MVA==",
+      "version": "1.31.0",
+      "resolved": "https://registry.npmjs.org/@bufbuild/buf-linux-aarch64/-/buf-linux-aarch64-1.31.0.tgz",
+      "integrity": "sha512-UN9KsTuO9YS5Vefj/CaqX1wO+hvc3AyGElxzOHMc7S3MWEuqSAFOhxu5I7CyOr2/yoZO2qZPPR29HuzmQsb2+w==",
       "cpu": [
         "arm64"
       ],
@@ -2408,9 +2411,9 @@
       }
     },
     "node_modules/@bufbuild/buf-linux-x64": {
-      "version": "1.30.1",
-      "resolved": "https://registry.npmjs.org/@bufbuild/buf-linux-x64/-/buf-linux-x64-1.30.1.tgz",
-      "integrity": "sha512-RacDbQJYNwqRlMESa/rLHprfUVa8Wu1/cmcqS29Fyt/cGzs0G8sNcQzQ87HYFIS9cSlSPl6vWL0x8JqQRp68lQ==",
+      "version": "1.31.0",
+      "resolved": "https://registry.npmjs.org/@bufbuild/buf-linux-x64/-/buf-linux-x64-1.31.0.tgz",
+      "integrity": "sha512-4uKq5Iu5tNEFE3Mz9a52KFCaywg5xLqwhN6Kf4kAk34kxWJgQ8D3WFe9ZpXHzH7Lj00u3Q+V/3vKCVATHR3tkw==",
       "cpu": [
         "x64"
       ],
@@ -2424,9 +2427,9 @@
       }
     },
     "node_modules/@bufbuild/buf-win32-arm64": {
-      "version": "1.30.1",
-      "resolved": "https://registry.npmjs.org/@bufbuild/buf-win32-arm64/-/buf-win32-arm64-1.30.1.tgz",
-      "integrity": "sha512-ndp/qb5M6yrSzcnMI0j4jjAuDKa7zHBFc187FwyDb3v63rvyQeYqncHb0leT5ZWqfNggJT4vXIH6QnH82PfDQw==",
+      "version": "1.31.0",
+      "resolved": "https://registry.npmjs.org/@bufbuild/buf-win32-arm64/-/buf-win32-arm64-1.31.0.tgz",
+      "integrity": "sha512-jz7GenlNsqwbC3qaHcBHBO35MycZ1gV8OUSRp/wTXGgZsEZzAyw335JA2NWL+5LaI8cF+CsYd6/uuWzKkdCKTQ==",
       "cpu": [
         "arm64"
       ],
@@ -2440,9 +2443,9 @@
       }
     },
     "node_modules/@bufbuild/buf-win32-x64": {
-      "version": "1.30.1",
-      "resolved": "https://registry.npmjs.org/@bufbuild/buf-win32-x64/-/buf-win32-x64-1.30.1.tgz",
-      "integrity": "sha512-1kmIY6oKLKZ4zIQVNG60GRDp+vKSZdaim7wRejOtgEDuWXhIuErlnGbpstypU8FO+OV3SeFUJNOJ8tLOYd3PvQ==",
+      "version": "1.31.0",
+      "resolved": "https://registry.npmjs.org/@bufbuild/buf-win32-x64/-/buf-win32-x64-1.31.0.tgz",
+      "integrity": "sha512-gw7p3PYam0g7hNwIhNphua5P8GBZczginoWNK3jk5sGVv0TzWOdHrjkVVhkc3DJbRZEg10ExGI3qRfCqiX1IHw==",
       "cpu": [
         "x64"
       ],
@@ -2456,18 +2459,18 @@
       }
     },
     "node_modules/@bufbuild/protobuf": {
-      "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/@bufbuild/protobuf/-/protobuf-1.8.0.tgz",
-      "integrity": "sha512-qR9FwI8QKIveDnUYutvfzbC21UZJJryYrLuZGjeZ/VGz+vXelUkK+xgkOHsvPEdYEdxtgUUq4313N8QtOehJ1Q=="
+      "version": "1.9.0",
+      "resolved": "https://registry.npmjs.org/@bufbuild/protobuf/-/protobuf-1.9.0.tgz",
+      "integrity": "sha512-W7gp8Q/v1NlCZLsv8pQ3Y0uCu/SHgXOVFK+eUluUKWXmsb6VHkpNx0apdOWWcDbB9sJoKeP8uPrjmehJz6xETQ=="
     },
     "node_modules/@bufbuild/protoc-gen-es": {
-      "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/@bufbuild/protoc-gen-es/-/protoc-gen-es-1.8.0.tgz",
-      "integrity": "sha512-jnvBKwHq3o/iOgfKxaxn5Za7ay4oAs8KWgoHiDc9Fsb0g+/d1z+mHlHvmevOiCPcVZsnH6V3LImOJvGStPONpA==",
+      "version": "1.9.0",
+      "resolved": "https://registry.npmjs.org/@bufbuild/protoc-gen-es/-/protoc-gen-es-1.9.0.tgz",
+      "integrity": "sha512-LJy1nC3Jsfdhs9v48P7qF6YXIqh+usFhXSVzJDTmw0yKjxQ3CKBNISRtaMql/g9hb1MLRU6unHCcFfdz4HSO/Q==",
       "dev": true,
       "dependencies": {
-        "@bufbuild/protobuf": "^1.8.0",
-        "@bufbuild/protoplugin": "1.8.0"
+        "@bufbuild/protobuf": "^1.9.0",
+        "@bufbuild/protoplugin": "1.9.0"
       },
       "bin": {
         "protoc-gen-es": "bin/protoc-gen-es"
@@ -2476,7 +2479,7 @@
         "node": ">=14"
       },
       "peerDependencies": {
-        "@bufbuild/protobuf": "1.8.0"
+        "@bufbuild/protobuf": "1.9.0"
       },
       "peerDependenciesMeta": {
         "@bufbuild/protobuf": {
@@ -2485,12 +2488,12 @@
       }
     },
     "node_modules/@bufbuild/protoplugin": {
-      "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/@bufbuild/protoplugin/-/protoplugin-1.8.0.tgz",
-      "integrity": "sha512-Pb89cTshW+I577qh27VvxGYvZEvQ3zJ8La1OfzPCKugP9d4A4P65WStkAY+aSCiDHk68m1/+mtBb6elfiLPuFg==",
+      "version": "1.9.0",
+      "resolved": "https://registry.npmjs.org/@bufbuild/protoplugin/-/protoplugin-1.9.0.tgz",
+      "integrity": "sha512-/mxMiGs5h78RUHT7v4+mv0Wt0gyRf/SOS5PLzKEg2sclEAlFPbXfZ8HjlvxJpXZP/YpP3HvsW/mil3E69G0mXg==",
       "dev": true,
       "dependencies": {
-        "@bufbuild/protobuf": "1.8.0",
+        "@bufbuild/protobuf": "1.9.0",
         "@typescript/vfs": "^1.4.0",
         "typescript": "4.5.2"
       }
@@ -3943,6 +3946,160 @@
         "webpack": "^5.54.0"
       }
     },
+    "node_modules/@ngx-formly/core": {
+      "version": "6.3.0",
+      "resolved": "https://registry.npmjs.org/@ngx-formly/core/-/core-6.3.0.tgz",
+      "integrity": "sha512-9qCoPdLLVShoruzXeJUjMdIhfIlHCI+TggA3Wc01ISHTK2vXx1gNIFLuS+hez3JEzu8nIDRuA/nWqj4j8fJCNg==",
+      "dependencies": {
+        "tslib": "^2.0.0"
+      },
+      "peerDependencies": {
+        "@angular/forms": ">=13.2.0",
+        "rxjs": "^6.5.3 || ^7.0.0"
+      }
+    },
+    "node_modules/@ngx-formly/material": {
+      "version": "6.3.0",
+      "resolved": "https://registry.npmjs.org/@ngx-formly/material/-/material-6.3.0.tgz",
+      "integrity": "sha512-kzNNXQhOtPf2Uc4l02CO7njwKNJsaP+dpLt6cvYQA04fVALrO/dEJNbgUW6rlVp0oQQmobiu83lN1qWKmqAcng==",
+      "dependencies": {
+        "tslib": "^2.0.0"
+      },
+      "peerDependencies": {
+        "@angular/material": ">=13.0.0",
+        "@ngx-formly/core": "6.3.0"
+      }
+    },
+    "node_modules/@ngx-formly/schematics": {
+      "version": "6.3.0",
+      "resolved": "https://registry.npmjs.org/@ngx-formly/schematics/-/schematics-6.3.0.tgz",
+      "integrity": "sha512-XSzOvrZ1NoUhmd733bcgUFkl+26pSw8eyXChi9LwrS26nEPweR8RA/JxN+lFvIb92MWzLShLd1DY2oBz/0r0ZQ==",
+      "dev": true,
+      "dependencies": {
+        "@angular-devkit/core": "^13.0.3",
+        "@angular-devkit/schematics": "^13.0.3",
+        "@schematics/angular": "^13.0.3"
+      }
+    },
+    "node_modules/@ngx-formly/schematics/node_modules/@angular-devkit/core": {
+      "version": "13.3.11",
+      "resolved": "https://registry.npmjs.org/@angular-devkit/core/-/core-13.3.11.tgz",
+      "integrity": "sha512-rfqoLMRYhlz0wzKlHx7FfyIyQq8dKTsmbCoIVU1cEIH0gyTMVY7PbVzwRRcO6xp5waY+0hA+0Brriujpuhkm4w==",
+      "dev": true,
+      "dependencies": {
+        "ajv": "8.9.0",
+        "ajv-formats": "2.1.1",
+        "fast-json-stable-stringify": "2.1.0",
+        "magic-string": "0.25.7",
+        "rxjs": "6.6.7",
+        "source-map": "0.7.3"
+      },
+      "engines": {
+        "node": "^12.20.0 || ^14.15.0 || >=16.10.0",
+        "npm": "^6.11.0 || ^7.5.6 || >=8.0.0",
+        "yarn": ">= 1.13.0"
+      },
+      "peerDependencies": {
+        "chokidar": "^3.5.2"
+      },
+      "peerDependenciesMeta": {
+        "chokidar": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@ngx-formly/schematics/node_modules/@angular-devkit/schematics": {
+      "version": "13.3.11",
+      "resolved": "https://registry.npmjs.org/@angular-devkit/schematics/-/schematics-13.3.11.tgz",
+      "integrity": "sha512-ben+EGXpCrClnIVAAnEQmhQdKmnnqFhMp5BqMxgOslSYBAmCutLA6rBu5vsc8kZcGian1wt+lueF7G1Uk5cGBg==",
+      "dev": true,
+      "dependencies": {
+        "@angular-devkit/core": "13.3.11",
+        "jsonc-parser": "3.0.0",
+        "magic-string": "0.25.7",
+        "ora": "5.4.1",
+        "rxjs": "6.6.7"
+      },
+      "engines": {
+        "node": "^12.20.0 || ^14.15.0 || >=16.10.0",
+        "npm": "^6.11.0 || ^7.5.6 || >=8.0.0",
+        "yarn": ">= 1.13.0"
+      }
+    },
+    "node_modules/@ngx-formly/schematics/node_modules/@schematics/angular": {
+      "version": "13.3.11",
+      "resolved": "https://registry.npmjs.org/@schematics/angular/-/angular-13.3.11.tgz",
+      "integrity": "sha512-imKBnKYEse0SBVELZO/753nkpt3eEgpjrYkB+AFWF9YfO/4RGnYXDHoH8CFkzxPH9QQCgNrmsVFNiYGS+P/S1A==",
+      "dev": true,
+      "dependencies": {
+        "@angular-devkit/core": "13.3.11",
+        "@angular-devkit/schematics": "13.3.11",
+        "jsonc-parser": "3.0.0"
+      },
+      "engines": {
+        "node": "^12.20.0 || ^14.15.0 || >=16.10.0",
+        "npm": "^6.11.0 || ^7.5.6 || >=8.0.0",
+        "yarn": ">= 1.13.0"
+      }
+    },
+    "node_modules/@ngx-formly/schematics/node_modules/ajv": {
+      "version": "8.9.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.9.0.tgz",
+      "integrity": "sha512-qOKJyNj/h+OWx7s5DePL6Zu1KeM9jPZhwBqs+7DzP6bGOvqzVCSf0xueYmVuaC/oQ/VtS2zLMLHdQFbkka+XDQ==",
+      "dev": true,
+      "dependencies": {
+        "fast-deep-equal": "^3.1.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2",
+        "uri-js": "^4.2.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/@ngx-formly/schematics/node_modules/jsonc-parser": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.0.0.tgz",
+      "integrity": "sha512-fQzRfAbIBnR0IQvftw9FJveWiHp72Fg20giDrHz6TdfB12UH/uue0D3hm57UB5KgAVuniLMCaS8P1IMj9NR7cA==",
+      "dev": true
+    },
+    "node_modules/@ngx-formly/schematics/node_modules/magic-string": {
+      "version": "0.25.7",
+      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.25.7.tgz",
+      "integrity": "sha512-4CrMT5DOHTDk4HYDlzmwu4FVCcIYI8gauveasrdCu2IKIFOJ3f0v/8MDGJCDL9oD2ppz/Av1b0Nj345H9M+XIA==",
+      "dev": true,
+      "dependencies": {
+        "sourcemap-codec": "^1.4.4"
+      }
+    },
+    "node_modules/@ngx-formly/schematics/node_modules/rxjs": {
+      "version": "6.6.7",
+      "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-6.6.7.tgz",
+      "integrity": "sha512-hTdwr+7yYNIT5n4AMYp85KA6yw2Va0FLa3Rguvbpa4W3I5xynaBZo41cM3XM+4Q6fRMj3sBYIR1VAmZMXYJvRQ==",
+      "dev": true,
+      "dependencies": {
+        "tslib": "^1.9.0"
+      },
+      "engines": {
+        "npm": ">=2.0.0"
+      }
+    },
+    "node_modules/@ngx-formly/schematics/node_modules/source-map": {
+      "version": "0.7.3",
+      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.7.3.tgz",
+      "integrity": "sha512-CkCj6giN3S+n9qrYiBTX5gystlENnRW5jZeNLHpe6aue+SrHcG5VYwujhW9s4dY31mEGsxBDrHR6oI69fTXsaQ==",
+      "dev": true,
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/@ngx-formly/schematics/node_modules/tslib": {
+      "version": "1.14.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.14.1.tgz",
+      "integrity": "sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==",
+      "dev": true
+    },
     "node_modules/@nodelib/fs.scandir": {
       "version": "2.1.5",
       "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
@@ -11874,6 +12031,13 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/sourcemap-codec": {
+      "version": "1.4.8",
+      "resolved": "https://registry.npmjs.org/sourcemap-codec/-/sourcemap-codec-1.4.8.tgz",
+      "integrity": "sha512-9NykojV5Uih4lgo5So5dtw+f0JgJX30KCNI8gwhz2J9A15wD0Ml6tjHKwf6fTSa6fAdVBdZeNOs9eJ71qCk8vA==",
+      "deprecated": "Please use @jridgewell/sourcemap-codec instead",
+      "dev": true
+    },
     "node_modules/spdx-correct": {
       "version": "3.2.0",
       "resolved": "https://registry.npmjs.org/spdx-correct/-/spdx-correct-3.2.0.tgz",

internal/frontend/holos/package.json

@@ -20,10 +20,12 @@
     "@angular/platform-browser": "^17.3.0",
     "@angular/platform-browser-dynamic": "^17.3.0",
     "@angular/router": "^17.3.0",
-    "@bufbuild/protobuf": "^1.8.0",
+    "@bufbuild/protobuf": "^1.9.0",
     "@connectrpc/connect": "^1.4.0",
     "@connectrpc/connect-query": "^1.3.1",
     "@connectrpc/connect-web": "^1.4.0",
+    "@ngx-formly/core": "^6.3.0",
+    "@ngx-formly/material": "^6.3.0",
     "rxjs": "~7.8.0",
     "tslib": "^2.3.0",
     "zone.js": "~0.14.3"
@@ -32,10 +34,11 @@
     "@angular-devkit/build-angular": "^17.3.4",
     "@angular/cli": "^17.3.4",
     "@angular/compiler-cli": "^17.3.0",
-    "@bufbuild/buf": "^1.30.1",
-    "@bufbuild/protoc-gen-es": "^1.8.0",
+    "@bufbuild/buf": "^1.31.0",
+    "@bufbuild/protoc-gen-es": "^1.9.0",
     "@connectrpc/protoc-gen-connect-es": "^1.4.0",
     "@connectrpc/protoc-gen-connect-query": "^1.3.1",
+    "@ngx-formly/schematics": "^6.3.0",
     "@types/jasmine": "~5.1.0",
     "jasmine-core": "~5.1.0",
     "karma": "~6.4.0",
@@ -45,4 +48,4 @@
     "karma-jasmine-html-reporter": "~2.1.0",
     "typescript": "~5.4.2"
   }
-}
+}

internal/frontend/holos/src/app/app.config.ts

@@ -1,9 +1,28 @@
-import { ApplicationConfig } from '@angular/core';
-import { provideRouter } from '@angular/router';
-
+import { ApplicationConfig, importProvidersFrom } from '@angular/core';
+import { provideRouter, withComponentInputBinding } from '@angular/router';
+import { FormlyModule } from '@ngx-formly/core';
+// import { provideHttpClient, withFetch } from '@angular/common/http';
 import { routes } from './app.routes';
 import { provideAnimationsAsync } from '@angular/platform-browser/animations/async';
+import { ConnectModule } from '../connect/connect.module';
+import { provideClient } from "../connect/client.provider";
+import { UserService } from './gen/holos/v1alpha1/user_connect';
+import { OrganizationService } from './gen/holos/v1alpha1/organization_connect';
+import { PlatformService } from './gen/holos/v1alpha1/platform_connect';
 
 export const appConfig: ApplicationConfig = {
-  providers: [provideRouter(routes), provideAnimationsAsync()]
+  providers: [
+    provideRouter(routes, withComponentInputBinding()),
+    provideAnimationsAsync(),
+    // provideHttpClient(withFetch()),
+    provideClient(UserService),
+    provideClient(OrganizationService),
+    provideClient(PlatformService),
+    importProvidersFrom(
+      ConnectModule.forRoot({
+        baseUrl: window.location.origin
+      }),
+      FormlyModule.forRoot(),
+    ),
+  ]
 };

internal/frontend/holos/src/app/app.routes.ts

@@ -1,11 +1,13 @@
 import { Routes } from '@angular/router';
 import { HomeComponent } from './home/home.component';
-import { ClusterListComponent } from './cluster-list/cluster-list.component';
 import { ErrorNotFoundComponent } from './error-not-found/error-not-found.component';
+import { PlatformsComponent } from './views/platforms/platforms.component'
+import { PlatformDetailComponent } from './views/platform-detail/platform-detail.component';
 
 export const routes: Routes = [
+  { path: 'platform/:id', component: PlatformDetailComponent },
+  { path: 'platforms', component: PlatformsComponent },
   { path: 'home', component: HomeComponent },
-  { path: 'clusters', component: ClusterListComponent },
-  { path: '', redirectTo: '/home', pathMatch: 'full' },
+  { path: '', redirectTo: '/platforms', pathMatch: 'full' },
   { path: '**', component: ErrorNotFoundComponent },
 ];

internal/frontend/holos/src/app/cluster-list/cluster-list.component.html

@@ -1,26 +0,0 @@
-<div class="grid-container">
-  <h1 class="mat-h1">Clusters</h1>
-  <mat-grid-list cols="2" rowHeight="350px">
-    @for (card of cards | async; track card) {
-      <mat-grid-tile [colspan]="card.cols" [rowspan]="card.rows">
-        <mat-card class="dashboard-card">
-          <mat-card-header>
-            <mat-card-title>
-              {{card.title}}
-              <button mat-icon-button class="more-button" [matMenuTriggerFor]="menu" aria-label="Toggle menu">
-                <mat-icon>more_vert</mat-icon>
-              </button>
-              <mat-menu #menu="matMenu" xPosition="before">
-                <button mat-menu-item>Expand</button>
-                <button mat-menu-item>Remove</button>
-              </mat-menu>
-            </mat-card-title>
-          </mat-card-header>
-          <mat-card-content class="dashboard-card-content">
-            <div>Card Content Here</div>
-          </mat-card-content>
-        </mat-card>
-      </mat-grid-tile>
-    }
-  </mat-grid-list>
-</div>

internal/frontend/holos/src/app/cluster-list/cluster-list.component.scss

@@ -1,21 +0,0 @@
-.grid-container {
-  margin: 20px;
-}
-
-.dashboard-card {
-  position: absolute;
-  top: 15px;
-  left: 15px;
-  right: 15px;
-  bottom: 15px;
-}
-
-.more-button {
-  position: absolute;
-  top: 5px;
-  right: 10px;
-}
-
-.dashboard-card-content {
-  text-align: center;
-}

internal/frontend/holos/src/app/cluster-list/cluster-list.component.spec.ts

@@ -1,25 +0,0 @@
-import { waitForAsync, ComponentFixture, TestBed } from '@angular/core/testing';
-import { NoopAnimationsModule } from '@angular/platform-browser/animations';
-
-import { ClusterListComponent } from './cluster-list.component';
-
-describe('ClusterListComponent', () => {
-  let component: ClusterListComponent;
-  let fixture: ComponentFixture<ClusterListComponent>;
-
-  beforeEach(waitForAsync(() => {
-    TestBed.configureTestingModule({
-      imports: [NoopAnimationsModule]
-    }).compileComponents();
-  }));
-
-  beforeEach(() => {
-    fixture = TestBed.createComponent(ClusterListComponent);
-    component = fixture.componentInstance;
-    fixture.detectChanges();
-  });
-
-  it('should compile', () => {
-    expect(component).toBeTruthy();
-  });
-});

internal/frontend/holos/src/app/cluster-list/cluster-list.component.ts

@@ -1,48 +0,0 @@
-import { Component, inject } from '@angular/core';
-import { Breakpoints, BreakpointObserver } from '@angular/cdk/layout';
-import { map } from 'rxjs/operators';
-import { AsyncPipe } from '@angular/common';
-import { MatGridListModule } from '@angular/material/grid-list';
-import { MatMenuModule } from '@angular/material/menu';
-import { MatIconModule } from '@angular/material/icon';
-import { MatButtonModule } from '@angular/material/button';
-import { MatCardModule } from '@angular/material/card';
-
-@Component({
-  selector: 'app-cluster-list',
-  templateUrl: './cluster-list.component.html',
-  styleUrl: './cluster-list.component.scss',
-  standalone: true,
-  imports: [
-    AsyncPipe,
-    MatGridListModule,
-    MatMenuModule,
-    MatIconModule,
-    MatButtonModule,
-    MatCardModule
-  ]
-})
-export class ClusterListComponent {
-  private breakpointObserver = inject(BreakpointObserver);
-
-  /** Based on the screen size, switch from standard to one column per row */
-  cards = this.breakpointObserver.observe(Breakpoints.Handset).pipe(
-    map(({ matches }) => {
-      if (matches) {
-        return [
-          { title: 'Card 1', cols: 1, rows: 1 },
-          { title: 'Card 2', cols: 1, rows: 1 },
-          { title: 'Card 3', cols: 1, rows: 1 },
-          { title: 'Card 4', cols: 1, rows: 1 }
-        ];
-      }
-
-      return [
-        { title: 'Card 1', cols: 2, rows: 1 },
-        { title: 'Card 2', cols: 1, rows: 1 },
-        { title: 'Card 3', cols: 1, rows: 2 },
-        { title: 'Card 4', cols: 1, rows: 1 }
-      ];
-    })
-  );
-}

internal/frontend/holos/src/app/gen/holos/v1alpha1/organization-OrganizationService_connectquery.ts

@@ -0,0 +1,35 @@
+// @generated by protoc-gen-connect-query v1.3.1 with parameter "target=ts"
+// @generated from file holos/v1alpha1/organization.proto (package holos.v1alpha1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import { MethodKind } from "@bufbuild/protobuf";
+import { CreateCallerOrganizationRequest, GetCallerOrganizationsRequest, GetCallerOrganizationsResponse } from "./organization_pb.js";
+
+/**
+ * @generated from rpc holos.v1alpha1.OrganizationService.GetCallerOrganizations
+ */
+export const getCallerOrganizations = {
+  localName: "getCallerOrganizations",
+  name: "GetCallerOrganizations",
+  kind: MethodKind.Unary,
+  I: GetCallerOrganizationsRequest,
+  O: GetCallerOrganizationsResponse,
+  service: {
+    typeName: "holos.v1alpha1.OrganizationService"
+  }
+} as const;
+
+/**
+ * @generated from rpc holos.v1alpha1.OrganizationService.CreateCallerOrganization
+ */
+export const createCallerOrganization = {
+  localName: "createCallerOrganization",
+  name: "CreateCallerOrganization",
+  kind: MethodKind.Unary,
+  I: CreateCallerOrganizationRequest,
+  O: GetCallerOrganizationsResponse,
+  service: {
+    typeName: "holos.v1alpha1.OrganizationService"
+  }
+} as const;

internal/frontend/holos/src/app/gen/holos/v1alpha1/organization_connect.ts

@@ -0,0 +1,35 @@
+// @generated by protoc-gen-connect-es v1.4.0 with parameter "target=ts"
+// @generated from file holos/v1alpha1/organization.proto (package holos.v1alpha1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import { CreateCallerOrganizationRequest, GetCallerOrganizationsRequest, GetCallerOrganizationsResponse } from "./organization_pb.js";
+import { MethodKind } from "@bufbuild/protobuf";
+
+/**
+ * @generated from service holos.v1alpha1.OrganizationService
+ */
+export const OrganizationService = {
+  typeName: "holos.v1alpha1.OrganizationService",
+  methods: {
+    /**
+     * @generated from rpc holos.v1alpha1.OrganizationService.GetCallerOrganizations
+     */
+    getCallerOrganizations: {
+      name: "GetCallerOrganizations",
+      I: GetCallerOrganizationsRequest,
+      O: GetCallerOrganizationsResponse,
+      kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc holos.v1alpha1.OrganizationService.CreateCallerOrganization
+     */
+    createCallerOrganization: {
+      name: "CreateCallerOrganization",
+      I: CreateCallerOrganizationRequest,
+      O: GetCallerOrganizationsResponse,
+      kind: MethodKind.Unary,
+    },
+  }
+} as const;
+

internal/frontend/holos/src/app/gen/holos/v1alpha1/organization_pb.ts

@@ -0,0 +1,178 @@
+// @generated by protoc-gen-es v1.9.0 with parameter "target=ts"
+// @generated from file holos/v1alpha1/organization.proto (package holos.v1alpha1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import type { BinaryReadOptions, FieldList, JsonReadOptions, JsonValue, PartialMessage, PlainMessage } from "@bufbuild/protobuf";
+import { Message, proto3 } from "@bufbuild/protobuf";
+import { Timestamps } from "./timestamps_pb.js";
+import { Creator, User } from "./user_pb.js";
+
+/**
+ * @generated from message holos.v1alpha1.Organization
+ */
+export class Organization extends Message<Organization> {
+  /**
+   * Unique id assigned by the server.
+   *
+   * @generated from field: string id = 1;
+   */
+  id = "";
+
+  /**
+   * @generated from field: string name = 2;
+   */
+  name = "";
+
+  /**
+   * @generated from field: string display_name = 3;
+   */
+  displayName = "";
+
+  /**
+   * @generated from field: holos.v1alpha1.Timestamps timestamps = 4;
+   */
+  timestamps?: Timestamps;
+
+  /**
+   * @generated from field: holos.v1alpha1.Creator creator = 5;
+   */
+  creator?: Creator;
+
+  constructor(data?: PartialMessage<Organization>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.Organization";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 2, name: "name", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 3, name: "display_name", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 4, name: "timestamps", kind: "message", T: Timestamps },
+    { no: 5, name: "creator", kind: "message", T: Creator },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): Organization {
+    return new Organization().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): Organization {
+    return new Organization().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): Organization {
+    return new Organization().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: Organization | PlainMessage<Organization> | undefined, b: Organization | PlainMessage<Organization> | undefined): boolean {
+    return proto3.util.equals(Organization, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.v1alpha1.GetCallerOrganizationsRequest
+ */
+export class GetCallerOrganizationsRequest extends Message<GetCallerOrganizationsRequest> {
+  constructor(data?: PartialMessage<GetCallerOrganizationsRequest>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.GetCallerOrganizationsRequest";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetCallerOrganizationsRequest {
+    return new GetCallerOrganizationsRequest().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetCallerOrganizationsRequest {
+    return new GetCallerOrganizationsRequest().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetCallerOrganizationsRequest {
+    return new GetCallerOrganizationsRequest().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: GetCallerOrganizationsRequest | PlainMessage<GetCallerOrganizationsRequest> | undefined, b: GetCallerOrganizationsRequest | PlainMessage<GetCallerOrganizationsRequest> | undefined): boolean {
+    return proto3.util.equals(GetCallerOrganizationsRequest, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.v1alpha1.GetCallerOrganizationsResponse
+ */
+export class GetCallerOrganizationsResponse extends Message<GetCallerOrganizationsResponse> {
+  /**
+   * @generated from field: holos.v1alpha1.User user = 1;
+   */
+  user?: User;
+
+  /**
+   * @generated from field: repeated holos.v1alpha1.Organization organizations = 2;
+   */
+  organizations: Organization[] = [];
+
+  constructor(data?: PartialMessage<GetCallerOrganizationsResponse>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.GetCallerOrganizationsResponse";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "user", kind: "message", T: User },
+    { no: 2, name: "organizations", kind: "message", T: Organization, repeated: true },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetCallerOrganizationsResponse {
+    return new GetCallerOrganizationsResponse().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetCallerOrganizationsResponse {
+    return new GetCallerOrganizationsResponse().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetCallerOrganizationsResponse {
+    return new GetCallerOrganizationsResponse().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: GetCallerOrganizationsResponse | PlainMessage<GetCallerOrganizationsResponse> | undefined, b: GetCallerOrganizationsResponse | PlainMessage<GetCallerOrganizationsResponse> | undefined): boolean {
+    return proto3.util.equals(GetCallerOrganizationsResponse, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.v1alpha1.CreateCallerOrganizationRequest
+ */
+export class CreateCallerOrganizationRequest extends Message<CreateCallerOrganizationRequest> {
+  constructor(data?: PartialMessage<CreateCallerOrganizationRequest>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.CreateCallerOrganizationRequest";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): CreateCallerOrganizationRequest {
+    return new CreateCallerOrganizationRequest().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): CreateCallerOrganizationRequest {
+    return new CreateCallerOrganizationRequest().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): CreateCallerOrganizationRequest {
+    return new CreateCallerOrganizationRequest().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: CreateCallerOrganizationRequest | PlainMessage<CreateCallerOrganizationRequest> | undefined, b: CreateCallerOrganizationRequest | PlainMessage<CreateCallerOrganizationRequest> | undefined): boolean {
+    return proto3.util.equals(CreateCallerOrganizationRequest, a, b);
+  }
+}
+

internal/frontend/holos/src/app/gen/holos/v1alpha1/platform-PlatformService_connectquery.ts

@@ -0,0 +1,79 @@
+// @generated by protoc-gen-connect-query v1.3.1 with parameter "target=ts"
+// @generated from file holos/v1alpha1/platform.proto (package holos.v1alpha1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import { MethodKind } from "@bufbuild/protobuf";
+import { AddPlatformRequest, ConfigValues, GetPlatformConfigRequest, GetPlatformRequest, GetPlatformResponse, GetPlatformsRequest, GetPlatformsResponse, PutPlatformConfigRequest } from "./platform_pb.js";
+
+/**
+ * @generated from rpc holos.v1alpha1.PlatformService.AddPlatform
+ */
+export const addPlatform = {
+  localName: "addPlatform",
+  name: "AddPlatform",
+  kind: MethodKind.Unary,
+  I: AddPlatformRequest,
+  O: GetPlatformsResponse,
+  service: {
+    typeName: "holos.v1alpha1.PlatformService"
+  }
+} as const;
+
+/**
+ * @generated from rpc holos.v1alpha1.PlatformService.GetPlatforms
+ */
+export const getPlatforms = {
+  localName: "getPlatforms",
+  name: "GetPlatforms",
+  kind: MethodKind.Unary,
+  I: GetPlatformsRequest,
+  O: GetPlatformsResponse,
+  service: {
+    typeName: "holos.v1alpha1.PlatformService"
+  }
+} as const;
+
+/**
+ * @generated from rpc holos.v1alpha1.PlatformService.GetPlatform
+ */
+export const getPlatform = {
+  localName: "getPlatform",
+  name: "GetPlatform",
+  kind: MethodKind.Unary,
+  I: GetPlatformRequest,
+  O: GetPlatformResponse,
+  service: {
+    typeName: "holos.v1alpha1.PlatformService"
+  }
+} as const;
+
+/**
+ * @generated from rpc holos.v1alpha1.PlatformService.PutPlatformConfig
+ */
+export const putPlatformConfig = {
+  localName: "putPlatformConfig",
+  name: "PutPlatformConfig",
+  kind: MethodKind.Unary,
+  I: PutPlatformConfigRequest,
+  O: GetPlatformResponse,
+  service: {
+    typeName: "holos.v1alpha1.PlatformService"
+  }
+} as const;
+
+/**
+ * GetConfig provides the unmarshalled config values for use with CUE
+ *
+ * @generated from rpc holos.v1alpha1.PlatformService.GetConfig
+ */
+export const getConfig = {
+  localName: "getConfig",
+  name: "GetConfig",
+  kind: MethodKind.Unary,
+  I: GetPlatformConfigRequest,
+  O: ConfigValues,
+  service: {
+    typeName: "holos.v1alpha1.PlatformService"
+  }
+} as const;

internal/frontend/holos/src/app/gen/holos/v1alpha1/platform_connect.ts

@@ -0,0 +1,64 @@
+// @generated by protoc-gen-connect-es v1.4.0 with parameter "target=ts"
+// @generated from file holos/v1alpha1/platform.proto (package holos.v1alpha1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import { AddPlatformRequest, ConfigValues, GetPlatformConfigRequest, GetPlatformRequest, GetPlatformResponse, GetPlatformsRequest, GetPlatformsResponse, PutPlatformConfigRequest } from "./platform_pb.js";
+import { MethodKind } from "@bufbuild/protobuf";
+
+/**
+ * @generated from service holos.v1alpha1.PlatformService
+ */
+export const PlatformService = {
+  typeName: "holos.v1alpha1.PlatformService",
+  methods: {
+    /**
+     * @generated from rpc holos.v1alpha1.PlatformService.AddPlatform
+     */
+    addPlatform: {
+      name: "AddPlatform",
+      I: AddPlatformRequest,
+      O: GetPlatformsResponse,
+      kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc holos.v1alpha1.PlatformService.GetPlatforms
+     */
+    getPlatforms: {
+      name: "GetPlatforms",
+      I: GetPlatformsRequest,
+      O: GetPlatformsResponse,
+      kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc holos.v1alpha1.PlatformService.GetPlatform
+     */
+    getPlatform: {
+      name: "GetPlatform",
+      I: GetPlatformRequest,
+      O: GetPlatformResponse,
+      kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc holos.v1alpha1.PlatformService.PutPlatformConfig
+     */
+    putPlatformConfig: {
+      name: "PutPlatformConfig",
+      I: PutPlatformConfigRequest,
+      O: GetPlatformResponse,
+      kind: MethodKind.Unary,
+    },
+    /**
+     * GetConfig provides the unmarshalled config values for use with CUE
+     *
+     * @generated from rpc holos.v1alpha1.PlatformService.GetConfig
+     */
+    getConfig: {
+      name: "GetConfig",
+      I: GetPlatformConfigRequest,
+      O: ConfigValues,
+      kind: MethodKind.Unary,
+    },
+  }
+} as const;
+

internal/frontend/holos/src/app/gen/holos/v1alpha1/platform_pb.ts

@@ -0,0 +1,830 @@
+// @generated by protoc-gen-es v1.9.0 with parameter "target=ts"
+// @generated from file holos/v1alpha1/platform.proto (package holos.v1alpha1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import type { BinaryReadOptions, FieldList, JsonReadOptions, JsonValue, PartialMessage, PlainMessage } from "@bufbuild/protobuf";
+import { Message, proto3, Value } from "@bufbuild/protobuf";
+import { Timestamps } from "./timestamps_pb.js";
+import { Creator } from "./user_pb.js";
+
+/**
+ * RawConfig represents the raw form configuration as opaque bytes.  Used for input.
+ *
+ * @generated from message holos.v1alpha1.RawConfig
+ */
+export class RawConfig extends Message<RawConfig> {
+  /**
+   * @generated from field: bytes form = 1;
+   */
+  form = new Uint8Array(0);
+
+  /**
+   * @generated from field: bytes values = 2;
+   */
+  values = new Uint8Array(0);
+
+  /**
+   * @generated from field: bytes cue = 3;
+   */
+  cue = new Uint8Array(0);
+
+  /**
+   * @generated from field: string definition = 4;
+   */
+  definition = "";
+
+  constructor(data?: PartialMessage<RawConfig>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.RawConfig";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "form", kind: "scalar", T: 12 /* ScalarType.BYTES */ },
+    { no: 2, name: "values", kind: "scalar", T: 12 /* ScalarType.BYTES */ },
+    { no: 3, name: "cue", kind: "scalar", T: 12 /* ScalarType.BYTES */ },
+    { no: 4, name: "definition", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): RawConfig {
+    return new RawConfig().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): RawConfig {
+    return new RawConfig().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): RawConfig {
+    return new RawConfig().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: RawConfig | PlainMessage<RawConfig> | undefined, b: RawConfig | PlainMessage<RawConfig> | undefined): boolean {
+    return proto3.util.equals(RawConfig, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.v1alpha1.Config
+ */
+export class Config extends Message<Config> {
+  /**
+   * @generated from field: holos.v1alpha1.PlatformForm form = 1;
+   */
+  form?: PlatformForm;
+
+  /**
+   * Values are the user supplied config values organized by section.
+   *
+   * @generated from field: holos.v1alpha1.ConfigValues values = 2;
+   */
+  values?: ConfigValues;
+
+  constructor(data?: PartialMessage<Config>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.Config";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "form", kind: "message", T: PlatformForm },
+    { no: 2, name: "values", kind: "message", T: ConfigValues },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): Config {
+    return new Config().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): Config {
+    return new Config().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): Config {
+    return new Config().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: Config | PlainMessage<Config> | undefined, b: Config | PlainMessage<Config> | undefined): boolean {
+    return proto3.util.equals(Config, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.v1alpha1.ConfigSection
+ */
+export class ConfigSection extends Message<ConfigSection> {
+  /**
+   * @generated from field: map<string, google.protobuf.Value> fields = 1;
+   */
+  fields: { [key: string]: Value } = {};
+
+  constructor(data?: PartialMessage<ConfigSection>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.ConfigSection";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "fields", kind: "map", K: 9 /* ScalarType.STRING */, V: {kind: "message", T: Value} },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): ConfigSection {
+    return new ConfigSection().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): ConfigSection {
+    return new ConfigSection().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): ConfigSection {
+    return new ConfigSection().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: ConfigSection | PlainMessage<ConfigSection> | undefined, b: ConfigSection | PlainMessage<ConfigSection> | undefined): boolean {
+    return proto3.util.equals(ConfigSection, a, b);
+  }
+}
+
+/**
+ * ConfigValues represents user defined configuration values.
+ *
+ * @generated from message holos.v1alpha1.ConfigValues
+ */
+export class ConfigValues extends Message<ConfigValues> {
+  /**
+   * @generated from field: map<string, holos.v1alpha1.ConfigSection> sections = 1;
+   */
+  sections: { [key: string]: ConfigSection } = {};
+
+  constructor(data?: PartialMessage<ConfigValues>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.ConfigValues";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "sections", kind: "map", K: 9 /* ScalarType.STRING */, V: {kind: "message", T: ConfigSection} },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): ConfigValues {
+    return new ConfigValues().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): ConfigValues {
+    return new ConfigValues().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): ConfigValues {
+    return new ConfigValues().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: ConfigValues | PlainMessage<ConfigValues> | undefined, b: ConfigValues | PlainMessage<ConfigValues> | undefined): boolean {
+    return proto3.util.equals(ConfigValues, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.v1alpha1.Platform
+ */
+export class Platform extends Message<Platform> {
+  /**
+   * Unique id assigned by the server.
+   *
+   * @generated from field: string id = 1;
+   */
+  id = "";
+
+  /**
+   * @generated from field: holos.v1alpha1.Timestamps timestamps = 2;
+   */
+  timestamps?: Timestamps;
+
+  /**
+   * Organization ID resource owner.
+   *
+   * @generated from field: string org_id = 3;
+   */
+  orgId = "";
+
+  /**
+   * name is the platform short name as a dns label.
+   *
+   * @generated from field: string name = 4;
+   */
+  name = "";
+
+  /**
+   * @generated from field: string display_name = 5;
+   */
+  displayName = "";
+
+  /**
+   * @generated from field: holos.v1alpha1.Creator creator = 6;
+   */
+  creator?: Creator;
+
+  /**
+   * config represents the platform config form and values.  Read only.
+   *
+   * @generated from field: holos.v1alpha1.Config config = 7;
+   */
+  config?: Config;
+
+  /**
+   * raw_config represents the platform config form and values.  Write only.
+   *
+   * @generated from field: holos.v1alpha1.RawConfig raw_config = 8;
+   */
+  rawConfig?: RawConfig;
+
+  constructor(data?: PartialMessage<Platform>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.Platform";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 2, name: "timestamps", kind: "message", T: Timestamps },
+    { no: 3, name: "org_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 4, name: "name", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 5, name: "display_name", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 6, name: "creator", kind: "message", T: Creator },
+    { no: 7, name: "config", kind: "message", T: Config },
+    { no: 8, name: "raw_config", kind: "message", T: RawConfig },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): Platform {
+    return new Platform().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): Platform {
+    return new Platform().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): Platform {
+    return new Platform().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: Platform | PlainMessage<Platform> | undefined, b: Platform | PlainMessage<Platform> | undefined): boolean {
+    return proto3.util.equals(Platform, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.v1alpha1.FieldConfigProps
+ */
+export class FieldConfigProps extends Message<FieldConfigProps> {
+  /**
+   * @generated from field: string label = 1;
+   */
+  label = "";
+
+  /**
+   * @generated from field: string placeholder = 2;
+   */
+  placeholder = "";
+
+  /**
+   * @generated from field: string description = 3;
+   */
+  description = "";
+
+  /**
+   * @generated from field: bool required = 4;
+   */
+  required = false;
+
+  constructor(data?: PartialMessage<FieldConfigProps>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.FieldConfigProps";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "label", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 2, name: "placeholder", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 3, name: "description", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 4, name: "required", kind: "scalar", T: 8 /* ScalarType.BOOL */ },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): FieldConfigProps {
+    return new FieldConfigProps().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): FieldConfigProps {
+    return new FieldConfigProps().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): FieldConfigProps {
+    return new FieldConfigProps().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: FieldConfigProps | PlainMessage<FieldConfigProps> | undefined, b: FieldConfigProps | PlainMessage<FieldConfigProps> | undefined): boolean {
+    return proto3.util.equals(FieldConfigProps, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.v1alpha1.FieldConfig
+ */
+export class FieldConfig extends Message<FieldConfig> {
+  /**
+   * @generated from field: string key = 1;
+   */
+  key = "";
+
+  /**
+   * @generated from field: string type = 2;
+   */
+  type = "";
+
+  /**
+   * @generated from field: holos.v1alpha1.FieldConfigProps props = 3;
+   */
+  props?: FieldConfigProps;
+
+  constructor(data?: PartialMessage<FieldConfig>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.FieldConfig";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "key", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 2, name: "type", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 3, name: "props", kind: "message", T: FieldConfigProps },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): FieldConfig {
+    return new FieldConfig().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): FieldConfig {
+    return new FieldConfig().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): FieldConfig {
+    return new FieldConfig().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: FieldConfig | PlainMessage<FieldConfig> | undefined, b: FieldConfig | PlainMessage<FieldConfig> | undefined): boolean {
+    return proto3.util.equals(FieldConfig, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.v1alpha1.ConfigFormSection
+ */
+export class ConfigFormSection extends Message<ConfigFormSection> {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name = "";
+
+  /**
+   * @generated from field: string displayName = 2;
+   */
+  displayName = "";
+
+  /**
+   * @generated from field: string description = 3;
+   */
+  description = "";
+
+  /**
+   * @generated from field: repeated holos.v1alpha1.FieldConfig fieldConfigs = 4;
+   */
+  fieldConfigs: FieldConfig[] = [];
+
+  constructor(data?: PartialMessage<ConfigFormSection>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.ConfigFormSection";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "name", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 2, name: "displayName", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 3, name: "description", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 4, name: "fieldConfigs", kind: "message", T: FieldConfig, repeated: true },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): ConfigFormSection {
+    return new ConfigFormSection().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): ConfigFormSection {
+    return new ConfigFormSection().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): ConfigFormSection {
+    return new ConfigFormSection().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: ConfigFormSection | PlainMessage<ConfigFormSection> | undefined, b: ConfigFormSection | PlainMessage<ConfigFormSection> | undefined): boolean {
+    return proto3.util.equals(ConfigFormSection, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.v1alpha1.PlatformFormSpec
+ */
+export class PlatformFormSpec extends Message<PlatformFormSpec> {
+  /**
+   * @generated from field: repeated holos.v1alpha1.ConfigFormSection sections = 1;
+   */
+  sections: ConfigFormSection[] = [];
+
+  constructor(data?: PartialMessage<PlatformFormSpec>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.PlatformFormSpec";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "sections", kind: "message", T: ConfigFormSection, repeated: true },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): PlatformFormSpec {
+    return new PlatformFormSpec().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): PlatformFormSpec {
+    return new PlatformFormSpec().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): PlatformFormSpec {
+    return new PlatformFormSpec().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: PlatformFormSpec | PlainMessage<PlatformFormSpec> | undefined, b: PlatformFormSpec | PlainMessage<PlatformFormSpec> | undefined): boolean {
+    return proto3.util.equals(PlatformFormSpec, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.v1alpha1.GetPlatformsRequest
+ */
+export class GetPlatformsRequest extends Message<GetPlatformsRequest> {
+  /**
+   * @generated from field: string org_id = 1;
+   */
+  orgId = "";
+
+  constructor(data?: PartialMessage<GetPlatformsRequest>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.GetPlatformsRequest";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "org_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetPlatformsRequest {
+    return new GetPlatformsRequest().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetPlatformsRequest {
+    return new GetPlatformsRequest().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetPlatformsRequest {
+    return new GetPlatformsRequest().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: GetPlatformsRequest | PlainMessage<GetPlatformsRequest> | undefined, b: GetPlatformsRequest | PlainMessage<GetPlatformsRequest> | undefined): boolean {
+    return proto3.util.equals(GetPlatformsRequest, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.v1alpha1.GetPlatformsResponse
+ */
+export class GetPlatformsResponse extends Message<GetPlatformsResponse> {
+  /**
+   * @generated from field: repeated holos.v1alpha1.Platform platforms = 1;
+   */
+  platforms: Platform[] = [];
+
+  constructor(data?: PartialMessage<GetPlatformsResponse>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.GetPlatformsResponse";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "platforms", kind: "message", T: Platform, repeated: true },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetPlatformsResponse {
+    return new GetPlatformsResponse().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetPlatformsResponse {
+    return new GetPlatformsResponse().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetPlatformsResponse {
+    return new GetPlatformsResponse().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: GetPlatformsResponse | PlainMessage<GetPlatformsResponse> | undefined, b: GetPlatformsResponse | PlainMessage<GetPlatformsResponse> | undefined): boolean {
+    return proto3.util.equals(GetPlatformsResponse, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.v1alpha1.GetPlatformResponse
+ */
+export class GetPlatformResponse extends Message<GetPlatformResponse> {
+  /**
+   * @generated from field: holos.v1alpha1.Platform platform = 1;
+   */
+  platform?: Platform;
+
+  constructor(data?: PartialMessage<GetPlatformResponse>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.GetPlatformResponse";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "platform", kind: "message", T: Platform },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetPlatformResponse {
+    return new GetPlatformResponse().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetPlatformResponse {
+    return new GetPlatformResponse().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetPlatformResponse {
+    return new GetPlatformResponse().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: GetPlatformResponse | PlainMessage<GetPlatformResponse> | undefined, b: GetPlatformResponse | PlainMessage<GetPlatformResponse> | undefined): boolean {
+    return proto3.util.equals(GetPlatformResponse, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.v1alpha1.AddPlatformRequest
+ */
+export class AddPlatformRequest extends Message<AddPlatformRequest> {
+  /**
+   * @generated from field: holos.v1alpha1.Platform platform = 1;
+   */
+  platform?: Platform;
+
+  constructor(data?: PartialMessage<AddPlatformRequest>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.AddPlatformRequest";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "platform", kind: "message", T: Platform },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): AddPlatformRequest {
+    return new AddPlatformRequest().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): AddPlatformRequest {
+    return new AddPlatformRequest().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): AddPlatformRequest {
+    return new AddPlatformRequest().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: AddPlatformRequest | PlainMessage<AddPlatformRequest> | undefined, b: AddPlatformRequest | PlainMessage<AddPlatformRequest> | undefined): boolean {
+    return proto3.util.equals(AddPlatformRequest, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.v1alpha1.GetPlatformRequest
+ */
+export class GetPlatformRequest extends Message<GetPlatformRequest> {
+  /**
+   * @generated from field: string platform_id = 1;
+   */
+  platformId = "";
+
+  constructor(data?: PartialMessage<GetPlatformRequest>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.GetPlatformRequest";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "platform_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetPlatformRequest {
+    return new GetPlatformRequest().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetPlatformRequest {
+    return new GetPlatformRequest().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetPlatformRequest {
+    return new GetPlatformRequest().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: GetPlatformRequest | PlainMessage<GetPlatformRequest> | undefined, b: GetPlatformRequest | PlainMessage<GetPlatformRequest> | undefined): boolean {
+    return proto3.util.equals(GetPlatformRequest, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.v1alpha1.MetadataName
+ */
+export class MetadataName extends Message<MetadataName> {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name = "";
+
+  constructor(data?: PartialMessage<MetadataName>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.MetadataName";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "name", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): MetadataName {
+    return new MetadataName().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): MetadataName {
+    return new MetadataName().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): MetadataName {
+    return new MetadataName().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: MetadataName | PlainMessage<MetadataName> | undefined, b: MetadataName | PlainMessage<MetadataName> | undefined): boolean {
+    return proto3.util.equals(MetadataName, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.v1alpha1.PlatformForm
+ */
+export class PlatformForm extends Message<PlatformForm> {
+  /**
+   * @generated from field: string apiVersion = 1;
+   */
+  apiVersion = "";
+
+  /**
+   * @generated from field: string kind = 2;
+   */
+  kind = "";
+
+  /**
+   * @generated from field: holos.v1alpha1.MetadataName metadata = 3;
+   */
+  metadata?: MetadataName;
+
+  /**
+   * @generated from field: holos.v1alpha1.PlatformFormSpec spec = 4;
+   */
+  spec?: PlatformFormSpec;
+
+  constructor(data?: PartialMessage<PlatformForm>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.PlatformForm";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "apiVersion", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 2, name: "kind", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 3, name: "metadata", kind: "message", T: MetadataName },
+    { no: 4, name: "spec", kind: "message", T: PlatformFormSpec },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): PlatformForm {
+    return new PlatformForm().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): PlatformForm {
+    return new PlatformForm().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): PlatformForm {
+    return new PlatformForm().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: PlatformForm | PlainMessage<PlatformForm> | undefined, b: PlatformForm | PlainMessage<PlatformForm> | undefined): boolean {
+    return proto3.util.equals(PlatformForm, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.v1alpha1.PutPlatformConfigRequest
+ */
+export class PutPlatformConfigRequest extends Message<PutPlatformConfigRequest> {
+  /**
+   * @generated from field: string platform_id = 1;
+   */
+  platformId = "";
+
+  /**
+   * @generated from field: holos.v1alpha1.ConfigValues values = 2;
+   */
+  values?: ConfigValues;
+
+  constructor(data?: PartialMessage<PutPlatformConfigRequest>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.PutPlatformConfigRequest";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "platform_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 2, name: "values", kind: "message", T: ConfigValues },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): PutPlatformConfigRequest {
+    return new PutPlatformConfigRequest().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): PutPlatformConfigRequest {
+    return new PutPlatformConfigRequest().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): PutPlatformConfigRequest {
+    return new PutPlatformConfigRequest().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: PutPlatformConfigRequest | PlainMessage<PutPlatformConfigRequest> | undefined, b: PutPlatformConfigRequest | PlainMessage<PutPlatformConfigRequest> | undefined): boolean {
+    return proto3.util.equals(PutPlatformConfigRequest, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.v1alpha1.GetPlatformConfigRequest
+ */
+export class GetPlatformConfigRequest extends Message<GetPlatformConfigRequest> {
+  /**
+   * @generated from field: string platform_id = 1;
+   */
+  platformId = "";
+
+  constructor(data?: PartialMessage<GetPlatformConfigRequest>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.GetPlatformConfigRequest";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "platform_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetPlatformConfigRequest {
+    return new GetPlatformConfigRequest().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetPlatformConfigRequest {
+    return new GetPlatformConfigRequest().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetPlatformConfigRequest {
+    return new GetPlatformConfigRequest().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: GetPlatformConfigRequest | PlainMessage<GetPlatformConfigRequest> | undefined, b: GetPlatformConfigRequest | PlainMessage<GetPlatformConfigRequest> | undefined): boolean {
+    return proto3.util.equals(GetPlatformConfigRequest, a, b);
+  }
+}
+

internal/frontend/holos/src/app/gen/holos/v1alpha1/system-SystemService_connectquery.ts

@@ -0,0 +1,35 @@
+// @generated by protoc-gen-connect-query v1.3.1 with parameter "target=ts"
+// @generated from file holos/v1alpha1/system.proto (package holos.v1alpha1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import { MethodKind } from "@bufbuild/protobuf";
+import { EmptyRequest, EmptyResponse } from "./system_pb.js";
+
+/**
+ * @generated from rpc holos.v1alpha1.SystemService.SeedDatabase
+ */
+export const seedDatabase = {
+  localName: "seedDatabase",
+  name: "SeedDatabase",
+  kind: MethodKind.Unary,
+  I: EmptyRequest,
+  O: EmptyResponse,
+  service: {
+    typeName: "holos.v1alpha1.SystemService"
+  }
+} as const;
+
+/**
+ * @generated from rpc holos.v1alpha1.SystemService.DropTables
+ */
+export const dropTables = {
+  localName: "dropTables",
+  name: "DropTables",
+  kind: MethodKind.Unary,
+  I: EmptyRequest,
+  O: EmptyResponse,
+  service: {
+    typeName: "holos.v1alpha1.SystemService"
+  }
+} as const;

internal/frontend/holos/src/app/gen/holos/v1alpha1/system_connect.ts

@@ -0,0 +1,35 @@
+// @generated by protoc-gen-connect-es v1.4.0 with parameter "target=ts"
+// @generated from file holos/v1alpha1/system.proto (package holos.v1alpha1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import { EmptyRequest, EmptyResponse } from "./system_pb.js";
+import { MethodKind } from "@bufbuild/protobuf";
+
+/**
+ * @generated from service holos.v1alpha1.SystemService
+ */
+export const SystemService = {
+  typeName: "holos.v1alpha1.SystemService",
+  methods: {
+    /**
+     * @generated from rpc holos.v1alpha1.SystemService.SeedDatabase
+     */
+    seedDatabase: {
+      name: "SeedDatabase",
+      I: EmptyRequest,
+      O: EmptyResponse,
+      kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc holos.v1alpha1.SystemService.DropTables
+     */
+    dropTables: {
+      name: "DropTables",
+      I: EmptyRequest,
+      O: EmptyResponse,
+      kind: MethodKind.Unary,
+    },
+  }
+} as const;
+

internal/frontend/holos/src/app/gen/holos/v1alpha1/system_pb.ts

@@ -0,0 +1,70 @@
+// @generated by protoc-gen-es v1.9.0 with parameter "target=ts"
+// @generated from file holos/v1alpha1/system.proto (package holos.v1alpha1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import type { BinaryReadOptions, FieldList, JsonReadOptions, JsonValue, PartialMessage, PlainMessage } from "@bufbuild/protobuf";
+import { Message, proto3 } from "@bufbuild/protobuf";
+
+/**
+ * @generated from message holos.v1alpha1.EmptyRequest
+ */
+export class EmptyRequest extends Message<EmptyRequest> {
+  constructor(data?: PartialMessage<EmptyRequest>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.EmptyRequest";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): EmptyRequest {
+    return new EmptyRequest().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): EmptyRequest {
+    return new EmptyRequest().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): EmptyRequest {
+    return new EmptyRequest().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: EmptyRequest | PlainMessage<EmptyRequest> | undefined, b: EmptyRequest | PlainMessage<EmptyRequest> | undefined): boolean {
+    return proto3.util.equals(EmptyRequest, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.v1alpha1.EmptyResponse
+ */
+export class EmptyResponse extends Message<EmptyResponse> {
+  constructor(data?: PartialMessage<EmptyResponse>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.EmptyResponse";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): EmptyResponse {
+    return new EmptyResponse().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): EmptyResponse {
+    return new EmptyResponse().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): EmptyResponse {
+    return new EmptyResponse().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: EmptyResponse | PlainMessage<EmptyResponse> | undefined, b: EmptyResponse | PlainMessage<EmptyResponse> | undefined): boolean {
+    return proto3.util.equals(EmptyResponse, a, b);
+  }
+}
+

internal/frontend/holos/src/app/gen/holos/v1alpha1/timestamps_pb.ts

@@ -0,0 +1,55 @@
+// @generated by protoc-gen-es v1.9.0 with parameter "target=ts"
+// @generated from file holos/v1alpha1/timestamps.proto (package holos.v1alpha1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import type { BinaryReadOptions, FieldList, JsonReadOptions, JsonValue, PartialMessage, PlainMessage } from "@bufbuild/protobuf";
+import { Message, proto3, Timestamp } from "@bufbuild/protobuf";
+
+/**
+ * @generated from message holos.v1alpha1.Timestamps
+ */
+export class Timestamps extends Message<Timestamps> {
+  /**
+   * Created at timestamp
+   *
+   * @generated from field: google.protobuf.Timestamp created_at = 1;
+   */
+  createdAt?: Timestamp;
+
+  /**
+   * Updated at timestamp
+   *
+   * @generated from field: google.protobuf.Timestamp updated_at = 2;
+   */
+  updatedAt?: Timestamp;
+
+  constructor(data?: PartialMessage<Timestamps>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.Timestamps";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "created_at", kind: "message", T: Timestamp },
+    { no: 2, name: "updated_at", kind: "message", T: Timestamp },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): Timestamps {
+    return new Timestamps().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): Timestamps {
+    return new Timestamps().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): Timestamps {
+    return new Timestamps().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: Timestamps | PlainMessage<Timestamps> | undefined, b: Timestamps | PlainMessage<Timestamps> | undefined): boolean {
+    return proto3.util.equals(Timestamps, a, b);
+  }
+}
+

internal/frontend/holos/src/app/gen/holos/v1alpha1/user-UserService_connectquery.ts

@@ -0,0 +1,49 @@
+// @generated by protoc-gen-connect-query v1.3.1 with parameter "target=ts"
+// @generated from file holos/v1alpha1/user.proto (package holos.v1alpha1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import { MethodKind } from "@bufbuild/protobuf";
+import { CreateCallerUserRequest, CreateCallerUserResponse, GetCallerClaimsRequest, GetCallerClaimsResponse, GetCallerUserRequest, GetCallerUserResponse } from "./user_pb.js";
+
+/**
+ * @generated from rpc holos.v1alpha1.UserService.GetCallerClaims
+ */
+export const getCallerClaims = {
+  localName: "getCallerClaims",
+  name: "GetCallerClaims",
+  kind: MethodKind.Unary,
+  I: GetCallerClaimsRequest,
+  O: GetCallerClaimsResponse,
+  service: {
+    typeName: "holos.v1alpha1.UserService"
+  }
+} as const;
+
+/**
+ * @generated from rpc holos.v1alpha1.UserService.GetCallerUser
+ */
+export const getCallerUser = {
+  localName: "getCallerUser",
+  name: "GetCallerUser",
+  kind: MethodKind.Unary,
+  I: GetCallerUserRequest,
+  O: GetCallerUserResponse,
+  service: {
+    typeName: "holos.v1alpha1.UserService"
+  }
+} as const;
+
+/**
+ * @generated from rpc holos.v1alpha1.UserService.CreateCallerUser
+ */
+export const createCallerUser = {
+  localName: "createCallerUser",
+  name: "CreateCallerUser",
+  kind: MethodKind.Unary,
+  I: CreateCallerUserRequest,
+  O: CreateCallerUserResponse,
+  service: {
+    typeName: "holos.v1alpha1.UserService"
+  }
+} as const;

internal/frontend/holos/src/app/gen/holos/v1alpha1/user_connect.ts

@@ -0,0 +1,44 @@
+// @generated by protoc-gen-connect-es v1.4.0 with parameter "target=ts"
+// @generated from file holos/v1alpha1/user.proto (package holos.v1alpha1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import { CreateCallerUserRequest, CreateCallerUserResponse, GetCallerClaimsRequest, GetCallerClaimsResponse, GetCallerUserRequest, GetCallerUserResponse } from "./user_pb.js";
+import { MethodKind } from "@bufbuild/protobuf";
+
+/**
+ * @generated from service holos.v1alpha1.UserService
+ */
+export const UserService = {
+  typeName: "holos.v1alpha1.UserService",
+  methods: {
+    /**
+     * @generated from rpc holos.v1alpha1.UserService.GetCallerClaims
+     */
+    getCallerClaims: {
+      name: "GetCallerClaims",
+      I: GetCallerClaimsRequest,
+      O: GetCallerClaimsResponse,
+      kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc holos.v1alpha1.UserService.GetCallerUser
+     */
+    getCallerUser: {
+      name: "GetCallerUser",
+      I: GetCallerUserRequest,
+      O: GetCallerUserResponse,
+      kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc holos.v1alpha1.UserService.CreateCallerUser
+     */
+    createCallerUser: {
+      name: "CreateCallerUser",
+      I: CreateCallerUserRequest,
+      O: CreateCallerUserResponse,
+      kind: MethodKind.Unary,
+    },
+  }
+} as const;
+

internal/frontend/holos/src/app/gen/holos/v1alpha1/user_pb.ts

@@ -0,0 +1,404 @@
+// @generated by protoc-gen-es v1.9.0 with parameter "target=ts"
+// @generated from file holos/v1alpha1/user.proto (package holos.v1alpha1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import type { BinaryReadOptions, FieldList, JsonReadOptions, JsonValue, PartialMessage, PlainMessage } from "@bufbuild/protobuf";
+import { Message, proto3 } from "@bufbuild/protobuf";
+import { Timestamps } from "./timestamps_pb.js";
+
+/**
+ * User represents a human user in the system.  See db schema in ent/schema/user.go
+ *
+ * @generated from message holos.v1alpha1.User
+ */
+export class User extends Message<User> {
+  /**
+   * Unique id assigned by the server.
+   *
+   * @generated from field: string id = 1;
+   */
+  id = "";
+
+  /**
+   * @generated from field: string email = 2;
+   */
+  email = "";
+
+  /**
+   * @generated from field: bool email_verified = 3;
+   */
+  emailVerified = false;
+
+  /**
+   * @generated from field: string name = 4;
+   */
+  name = "";
+
+  /**
+   * @generated from field: holos.v1alpha1.Timestamps timestamps = 5;
+   */
+  timestamps?: Timestamps;
+
+  constructor(data?: PartialMessage<User>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.User";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 2, name: "email", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 3, name: "email_verified", kind: "scalar", T: 8 /* ScalarType.BOOL */ },
+    { no: 4, name: "name", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 5, name: "timestamps", kind: "message", T: Timestamps },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): User {
+    return new User().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): User {
+    return new User().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): User {
+    return new User().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: User | PlainMessage<User> | undefined, b: User | PlainMessage<User> | undefined): boolean {
+    return proto3.util.equals(User, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.v1alpha1.CreateCallerUserRequest
+ */
+export class CreateCallerUserRequest extends Message<CreateCallerUserRequest> {
+  constructor(data?: PartialMessage<CreateCallerUserRequest>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.CreateCallerUserRequest";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): CreateCallerUserRequest {
+    return new CreateCallerUserRequest().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): CreateCallerUserRequest {
+    return new CreateCallerUserRequest().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): CreateCallerUserRequest {
+    return new CreateCallerUserRequest().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: CreateCallerUserRequest | PlainMessage<CreateCallerUserRequest> | undefined, b: CreateCallerUserRequest | PlainMessage<CreateCallerUserRequest> | undefined): boolean {
+    return proto3.util.equals(CreateCallerUserRequest, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.v1alpha1.CreateCallerUserResponse
+ */
+export class CreateCallerUserResponse extends Message<CreateCallerUserResponse> {
+  /**
+   * @generated from field: holos.v1alpha1.User user = 1;
+   */
+  user?: User;
+
+  constructor(data?: PartialMessage<CreateCallerUserResponse>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.CreateCallerUserResponse";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "user", kind: "message", T: User },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): CreateCallerUserResponse {
+    return new CreateCallerUserResponse().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): CreateCallerUserResponse {
+    return new CreateCallerUserResponse().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): CreateCallerUserResponse {
+    return new CreateCallerUserResponse().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: CreateCallerUserResponse | PlainMessage<CreateCallerUserResponse> | undefined, b: CreateCallerUserResponse | PlainMessage<CreateCallerUserResponse> | undefined): boolean {
+    return proto3.util.equals(CreateCallerUserResponse, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.v1alpha1.GetCallerClaimsRequest
+ */
+export class GetCallerClaimsRequest extends Message<GetCallerClaimsRequest> {
+  constructor(data?: PartialMessage<GetCallerClaimsRequest>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.GetCallerClaimsRequest";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetCallerClaimsRequest {
+    return new GetCallerClaimsRequest().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetCallerClaimsRequest {
+    return new GetCallerClaimsRequest().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetCallerClaimsRequest {
+    return new GetCallerClaimsRequest().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: GetCallerClaimsRequest | PlainMessage<GetCallerClaimsRequest> | undefined, b: GetCallerClaimsRequest | PlainMessage<GetCallerClaimsRequest> | undefined): boolean {
+    return proto3.util.equals(GetCallerClaimsRequest, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.v1alpha1.Claims
+ */
+export class Claims extends Message<Claims> {
+  /**
+   * @generated from field: string iss = 1;
+   */
+  iss = "";
+
+  /**
+   * @generated from field: string sub = 2;
+   */
+  sub = "";
+
+  /**
+   * @generated from field: string email = 3;
+   */
+  email = "";
+
+  /**
+   * @generated from field: bool email_verified = 4;
+   */
+  emailVerified = false;
+
+  /**
+   * @generated from field: string name = 5;
+   */
+  name = "";
+
+  /**
+   * @generated from field: repeated string groups = 6;
+   */
+  groups: string[] = [];
+
+  /**
+   * @generated from field: string given_name = 7;
+   */
+  givenName = "";
+
+  /**
+   * @generated from field: string family_name = 8;
+   */
+  familyName = "";
+
+  /**
+   * @generated from field: string picture = 9;
+   */
+  picture = "";
+
+  constructor(data?: PartialMessage<Claims>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.Claims";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "iss", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 2, name: "sub", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 3, name: "email", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 4, name: "email_verified", kind: "scalar", T: 8 /* ScalarType.BOOL */ },
+    { no: 5, name: "name", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 6, name: "groups", kind: "scalar", T: 9 /* ScalarType.STRING */, repeated: true },
+    { no: 7, name: "given_name", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 8, name: "family_name", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 9, name: "picture", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): Claims {
+    return new Claims().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): Claims {
+    return new Claims().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): Claims {
+    return new Claims().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: Claims | PlainMessage<Claims> | undefined, b: Claims | PlainMessage<Claims> | undefined): boolean {
+    return proto3.util.equals(Claims, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.v1alpha1.Creator
+ */
+export class Creator extends Message<Creator> {
+  /**
+   * @generated from field: string id = 1;
+   */
+  id = "";
+
+  constructor(data?: PartialMessage<Creator>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.Creator";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): Creator {
+    return new Creator().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): Creator {
+    return new Creator().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): Creator {
+    return new Creator().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: Creator | PlainMessage<Creator> | undefined, b: Creator | PlainMessage<Creator> | undefined): boolean {
+    return proto3.util.equals(Creator, a, b);
+  }
+}
+
+/**
+ * UserClaims represents id token claims
+ *
+ * @generated from message holos.v1alpha1.GetCallerClaimsResponse
+ */
+export class GetCallerClaimsResponse extends Message<GetCallerClaimsResponse> {
+  /**
+   * @generated from field: holos.v1alpha1.Claims claims = 1;
+   */
+  claims?: Claims;
+
+  constructor(data?: PartialMessage<GetCallerClaimsResponse>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.GetCallerClaimsResponse";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "claims", kind: "message", T: Claims },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetCallerClaimsResponse {
+    return new GetCallerClaimsResponse().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetCallerClaimsResponse {
+    return new GetCallerClaimsResponse().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetCallerClaimsResponse {
+    return new GetCallerClaimsResponse().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: GetCallerClaimsResponse | PlainMessage<GetCallerClaimsResponse> | undefined, b: GetCallerClaimsResponse | PlainMessage<GetCallerClaimsResponse> | undefined): boolean {
+    return proto3.util.equals(GetCallerClaimsResponse, a, b);
+  }
+}
+
+/**
+ * Empty request, claims are pulled from the id token
+ *
+ * @generated from message holos.v1alpha1.GetCallerUserRequest
+ */
+export class GetCallerUserRequest extends Message<GetCallerUserRequest> {
+  constructor(data?: PartialMessage<GetCallerUserRequest>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.GetCallerUserRequest";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetCallerUserRequest {
+    return new GetCallerUserRequest().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetCallerUserRequest {
+    return new GetCallerUserRequest().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetCallerUserRequest {
+    return new GetCallerUserRequest().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: GetCallerUserRequest | PlainMessage<GetCallerUserRequest> | undefined, b: GetCallerUserRequest | PlainMessage<GetCallerUserRequest> | undefined): boolean {
+    return proto3.util.equals(GetCallerUserRequest, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.v1alpha1.GetCallerUserResponse
+ */
+export class GetCallerUserResponse extends Message<GetCallerUserResponse> {
+  /**
+   * @generated from field: holos.v1alpha1.User user = 1;
+   */
+  user?: User;
+
+  constructor(data?: PartialMessage<GetCallerUserResponse>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.v1alpha1.GetCallerUserResponse";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "user", kind: "message", T: User },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetCallerUserResponse {
+    return new GetCallerUserResponse().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetCallerUserResponse {
+    return new GetCallerUserResponse().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetCallerUserResponse {
+    return new GetCallerUserResponse().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: GetCallerUserResponse | PlainMessage<GetCallerUserResponse> | undefined, b: GetCallerUserResponse | PlainMessage<GetCallerUserResponse> | undefined): boolean {
+    return proto3.util.equals(GetCallerUserResponse, a, b);
+  }
+}
+

internal/frontend/holos/src/app/nav/nav.component.html

@@ -3,10 +3,12 @@
       [attr.role]="(isHandset$ | async) ? 'dialog' : 'navigation'"
       [mode]="(isHandset$ | async) ? 'over' : 'side'"
       [opened]="(isHandset$ | async) === false">
-    <mat-toolbar>Menu</mat-toolbar>
+    <mat-toolbar>
+      <span>Menu</span>
+    </mat-toolbar>
     <mat-nav-list>
       <a mat-list-item routerLink="/home" routerLinkActive="active-link">Home</a>
-      <a mat-list-item routerLink="/clusters" routerLinkActive="active-link">Clusters</a>
+      <a mat-list-item routerLink="/platforms" routerLinkActive="active-link">Platforms</a>
     </mat-nav-list>
   </mat-sidenav>
   <mat-sidenav-content>
@@ -21,6 +23,15 @@
         </button>
       }
       <span>Holos</span>
+      <span class="toolbar-spacer"></span>
+      <span>
+        @if (org$ | async; as org) {
+          <button mat-button (click)="refreshOrg()">
+          {{ org.displayName }}
+          </button>
+        }
+      </span>
+      <app-profile-button [claims$]="claims$"></app-profile-button>
     </mat-toolbar>
     <!-- Add Content Here -->
     <router-outlet></router-outlet>

internal/frontend/holos/src/app/nav/nav.component.scss

@@ -15,3 +15,22 @@
   top: 0;
   z-index: 1;
 }
+
+.toolbar-spacer {
+  flex: 1 1 auto;
+}
+
+.avatar-container {
+  height: 100%;
+  width: 100%;
+  border-radius: 50%;
+}
+
+button {
+  &.image {
+    background-color: transparent;
+    background-repeat: no-repeat;
+    background-size: cover;
+    background-position: center center;
+  }
+}

internal/frontend/holos/src/app/nav/nav.component.ts

@@ -1,6 +1,6 @@
-import { Component, inject } from '@angular/core';
+import { Component, OnInit, inject } from '@angular/core';
 import { BreakpointObserver, Breakpoints } from '@angular/cdk/layout';
-import { AsyncPipe } from '@angular/common';
+import { AsyncPipe, NgIf } from '@angular/common';
 import { MatToolbarModule } from '@angular/material/toolbar';
 import { MatButtonModule } from '@angular/material/button';
 import { MatSidenavModule } from '@angular/material/sidenav';
@@ -9,6 +9,12 @@ import { MatIconModule } from '@angular/material/icon';
 import { Observable } from 'rxjs';
 import { map, shareReplay } from 'rxjs/operators';
 import { RouterLink, RouterLinkActive, RouterOutlet } from '@angular/router';
+import { MatCardModule } from '@angular/material/card';
+import { Claims } from '../gen/holos/v1alpha1/user_pb';
+import { ProfileButtonComponent } from '../profile-button/profile-button.component';
+import { UserService } from '../services/user.service';
+import { Organization } from '../gen/holos/v1alpha1/organization_pb';
+import { OrganizationService } from '../services/organization.service';
 
 @Component({
   selector: 'app-nav',
@@ -21,18 +27,35 @@ import { RouterLink, RouterLinkActive, RouterOutlet } from '@angular/router';
     MatSidenavModule,
     MatListModule,
     MatIconModule,
+    NgIf,
     AsyncPipe,
     RouterLink,
     RouterLinkActive,
     RouterOutlet,
+    MatCardModule,
+    ProfileButtonComponent,
   ]
 })
-export class NavComponent {
+export class NavComponent implements OnInit {
   private breakpointObserver = inject(BreakpointObserver);
+  private userService = inject(UserService);
+  private orgService = inject(OrganizationService);
+
+  claims$!: Observable<Claims | null>;
+  org$!: Observable<Organization | undefined>;
+
+  refreshOrg(): void {
+    this.orgService.refreshOrganizations()
+  }
 
   isHandset$: Observable<boolean> = this.breakpointObserver.observe(Breakpoints.Handset)
     .pipe(
       map(result => result.matches),
       shareReplay()
     );
+
+  ngOnInit(): void {
+    this.claims$ = this.userService.getClaims();
+    this.org$ = this.orgService.activeOrg();
+  }
 }

internal/frontend/holos/src/app/profile-button/profile-button.component.html

@@ -0,0 +1,28 @@
+@if (claims$ | async; as claims) {
+  <button mat-icon-button [matMenuTriggerFor]="menu">
+    @if (claims.picture) {
+      <img class="profile-picture" [src]="claims.picture" alt="Profile"/>
+    } @else {
+      <mat-icon>account_circle</mat-icon>
+    }
+  </button>
+
+  <mat-menu class="accounts-menu" #menu="matMenu">
+    <mat-card class="accounts-card">
+      <mat-card-header>
+        <div mat-card-avatar class="accounts-header-image" [ngStyle]="{'background-image': claims.picture ? 'url(' + claims.picture +')' : 'url(/ui/assets/img/account_circle.svg)'}">
+        </div>
+        <mat-card-title>{{ claims.name }}</mat-card-title>
+        <mat-card-subtitle>{{ claims.email }}</mat-card-subtitle>
+      </mat-card-header>
+      <mat-card-actions>
+        <a mat-menu-item href="{{claims.iss}}/ui/console/users/me?id=general">
+          Profile
+        </a>
+        <a mat-menu-item href="{{claims.iss}}/oidc/v1/end_session">
+          Logout
+        </a>
+      </mat-card-actions>
+    </mat-card>
+  </mat-menu>
+}

internal/frontend/holos/src/app/profile-button/profile-button.component.scss

@@ -0,0 +1,16 @@
+.profile-picture {
+  border-radius: 50%;
+}
+
+.accounts-card {
+  max-width: 400px;
+}
+
+.accounts-header-image {
+  background-image: url('/ui/assets/img/account_circle.svg');
+  background-size: cover;
+}
+
+::ng-deep .mat-mdc-menu-content {
+  padding: 0px !important;
+}

internal/frontend/holos/src/app/profile-button/profile-button.component.spec.ts

@@ -0,0 +1,23 @@
+import { ComponentFixture, TestBed } from '@angular/core/testing';
+
+import { ProfileButtonComponent } from './profile-button.component';
+
+describe('ProfileButtonComponent', () => {
+  let component: ProfileButtonComponent;
+  let fixture: ComponentFixture<ProfileButtonComponent>;
+
+  beforeEach(async () => {
+    await TestBed.configureTestingModule({
+      imports: [ProfileButtonComponent]
+    })
+    .compileComponents();
+    
+    fixture = TestBed.createComponent(ProfileButtonComponent);
+    component = fixture.componentInstance;
+    fixture.detectChanges();
+  });
+
+  it('should create', () => {
+    expect(component).toBeTruthy();
+  });
+});

internal/frontend/holos/src/app/profile-button/profile-button.component.ts

@@ -0,0 +1,27 @@
+import { Component, Input } from '@angular/core';
+import { Claims } from '../gen/holos/v1alpha1/user_pb';
+import { MatButtonModule } from '@angular/material/button';
+import { MatMenuModule } from '@angular/material/menu';
+import { Observable } from 'rxjs';
+import { AsyncPipe, NgIf, NgStyle } from '@angular/common';
+import { MatIconModule } from '@angular/material/icon';
+import { MatCardModule } from '@angular/material/card';
+
+@Component({
+  selector: 'app-profile-button',
+  standalone: true,
+  imports: [
+    MatButtonModule,
+    MatMenuModule,
+    MatIconModule,
+    MatCardModule,
+    AsyncPipe,
+    NgIf,
+    NgStyle,
+  ],
+  templateUrl: './profile-button.component.html',
+  styleUrl: './profile-button.component.scss'
+})
+export class ProfileButtonComponent {
+  @Input({ required: true }) claims$!: Observable<Claims | null>;
+}

internal/frontend/holos/src/app/services/organization.service.spec.ts

@@ -0,0 +1,16 @@
+import { TestBed } from '@angular/core/testing';
+
+import { OrganizationService } from './organization.service';
+
+describe('OrganizationService', () => {
+  let service: OrganizationService;
+
+  beforeEach(() => {
+    TestBed.configureTestingModule({});
+    service = TestBed.inject(OrganizationService);
+  });
+
+  it('should be created', () => {
+    expect(service).toBeTruthy();
+  });
+});