# bex-api's workspace members & roles surface (backend/internal/members —
# w4/m12; docs/ADR012-auth.md role matrix). The Team page lists a workspace's members
# and their roles, invites teammates by email, changes roles, and removes
# members. Roles are Render's UPPERCASE enum on the wire
# (VIEWER/CONTRIBUTOR/DEVELOPER/ADMIN/BILLING). The caller's workspace list
# (the switcher / current-workspace source) is the `Workspaces` query owned by
# features/workspaces/api/workspaces.graphql — one operation name, one document.

query WorkspaceMembers($workspaceId: String!) {
  workspaceMembers(workspaceId: $workspaceId) {
    subject
    userId
    email
    role
    createdAt
  }
}

query WorkspaceInvites($workspaceId: String!) {
  workspaceInvites(workspaceId: $workspaceId) {
    id
    email
    role
    expiresAt
    createdAt
  }
}

mutation InviteWorkspaceMember(
  $workspaceId: String!
  $email: String!
  $role: String!
) {
  inviteWorkspaceMember(workspaceId: $workspaceId, email: $email, role: $role) {
    id
    email
    role
    expiresAt
    createdAt
  }
}

mutation ChangeWorkspaceMemberRole(
  $workspaceId: String!
  $subject: String!
  $role: String!
) {
  changeWorkspaceMemberRole(
    workspaceId: $workspaceId
    subject: $subject
    role: $role
  ) {
    subject
    role
    createdAt
  }
}

mutation RemoveWorkspaceMember($workspaceId: String!, $subject: String!) {
  removeWorkspaceMember(workspaceId: $workspaceId, subject: $subject)
}

mutation RevokeWorkspaceInvite($workspaceId: String!, $inviteId: String!) {
  revokeWorkspaceInvite(workspaceId: $workspaceId, inviteId: $inviteId)
}
