extend type Query {
  """
  GetBanners gets all organizations associated with this account from BSP api.
  """
  banners: [Banner!]!
    @hasRole(
      roles: [
        EDGE_ORG_ADMIN
        EDGE_BANNER_ADMIN
        EDGE_BANNER_OPERATOR
        EDGE_BANNER_VIEWER
      ]
    )
  """
  banner not implemented
  """
  banner(
    """
    Banner is the id of the banner
    """
    bannerEdgeId: String! @hasBannerAccess(field: "bannerEdgeId")
  ): Banner!
    @hasRole(
      roles: [
        EDGE_ORG_ADMIN
        EDGE_BANNER_ADMIN
        EDGE_BANNER_OPERATOR
        EDGE_BANNER_VIEWER
      ]
    )
  """
  bannerStatus return the status of a banner
  """
  bannerStatus(
    """
    BannerID is the id of the banner
    """
    bannerEdgeId: String! @hasBannerAccess(field: "bannerEdgeId")
  ): BannerStatus!
    @hasRole(
      roles: [
        EDGE_ORG_ADMIN
        EDGE_BANNER_ADMIN
        EDGE_BANNER_OPERATOR
        EDGE_BANNER_VIEWER
      ]
    )
}

extend type Mutation {
  """
  CreateBanner creates an enterprise unit in BSP api representing an banner and a corresponding namespace in kubernetes.
  """
  createBanner(
    """
    Name is the name of the banner
    """
    name: String!
    """
    Description is the description of the banner in bsl
    """
    description: String
    """
    IsOrgBanner describes banner types: eu banner or org banner
    """
    isOrgBanner: Boolean
    """
    BSL ID is the optional bsl id for the banner
    """
    bslId: String
  ): EdgeResponsePayload! @hasRole(roles: [EDGE_ORG_ADMIN])

  """
  UpdateBanner update name or description of a banner. Updates in bsl and edge sql db
  """
  updateBanner(
    """
    edge id for the banner
    """
    bannerEdgeId: String! @hasBannerAccess(field: "bannerEdgeId")
    """
    Display Name is the name of the banner that will be shown in the ui
    """
    displayName: String
    """
    Description is the description of the banner in bsl
    """
    description: String
    """
    banner opt in security compliance setting
    """
    edgeSecurityCompliance: EdgeSecurityComplianceOptions
  ): EdgeResponsePayload! @hasRole(roles: [EDGE_ORG_ADMIN, EDGE_BANNER_ADMIN])

  """
  DeleteBanner deletes an enterprise unit in BSP api representing an Banner.
  """
  deleteBanner(
    """
    id is the edge id for the banner to be deleted
    """
    bannerEdgeId: String!
  ): EdgeResponsePayload! @hasRole(roles: [EDGE_ORG_ADMIN])

  """
  AssignUserToBanner assigns a user to an organization by first clearing previous organizations associated with this user.
  """
  assignUserToBanner(
    """
    Username is the user that will be assigned to the banners requested
    """
    username: String!
    """
    banner is the json array of the banner the user will be given access to
    """
    bannerEdgeIds: [String!]
  ): EdgeResponsePayload! @hasRole(roles: [EDGE_ORG_ADMIN])

  """
  AssignRoleToUser assigns a role for a username.
  """
  assignRoleToUser(
    """
    Username is the user the roles will be assigned to
    """
    username: String!
    """
    Role is the edge role that will be assigned to a user. Edge roles correspond to more bsl roles. Please see https://docs.edge-infra.dev/architecture/bsl/bsl-edge-apis/ for more info
    """
    role: String!
      @canAssignRole(
        abilityMap: {
          EDGE_ORG_ADMIN: [
            EDGE_ORG_ADMIN
            EDGE_BANNER_ADMIN
            EDGE_BANNER_OPERATOR
            EDGE_BANNER_VIEWER
            EDGE_OI_ADMIN
            EDGE_SUPER_USER
            EDGE_L1
            EDGE_L2
            EDGE_L3
            EDGE_L4
          ]
          EDGE_BANNER_ADMIN: [
            EDGE_BANNER_ADMIN
            EDGE_BANNER_OPERATOR 
            EDGE_BANNER_VIEWER
            EDGE_L1
            EDGE_L2
            EDGE_L3
            EDGE_L4
          ]
        }
      )
  ): EdgeResponsePayload! @hasRole(roles: [EDGE_ORG_ADMIN, EDGE_BANNER_ADMIN])

  """
  AssignRolesToUser assigns a role for a username.
  """
  assignRolesToUser(
    """
    Username is the user the roles will be assigned to
    """
    username: String!
    """
    Roles is the edge roles that will be assigned to a user. Edge roles correspond to more bsl roles. Please see https://docs.edge-infra.dev/architecture/bsl/bsl-edge-apis/ for more info
    """
    roles: [String!]
      @canAssignRole(
        abilityMap: {
          EDGE_ORG_ADMIN: [
            EDGE_ORG_ADMIN
            EDGE_BANNER_ADMIN
            EDGE_BANNER_OPERATOR
            EDGE_BANNER_VIEWER
            EDGE_OI_ADMIN
            EDGE_SUPER_USER
            EDGE_L1
            EDGE_L2
            EDGE_L3
            EDGE_L4
          ]
          EDGE_BANNER_ADMIN: [
            EDGE_BANNER_ADMIN
            EDGE_BANNER_OPERATOR
            EDGE_BANNER_VIEWER
            EDGE_L1
            EDGE_L2
            EDGE_L3
            EDGE_L4
          ]
        }
      )
  ): EdgeResponsePayload! @hasRole(roles: [EDGE_ORG_ADMIN, EDGE_BANNER_ADMIN])

  """
  ReplaceAdditionalPermissions replaces any additional roles previously granted with specified additional roles (example: Operator Intervention roles) for a username.
  """
  replaceAdditionalPermissions(
    """
    Username is the user the additional roles will be assigned to
    """
    username: String!
    """
    Roles is the edge roles that will be assigned to a user. Edge roles correspond to more bsl roles. Please see https://docs.edge-infra.dev/architecture/bsl/bsl-edge-apis/ for more info
    """
    roles: [String!]
      @canAssignRole(
        abilityMap: {
          EDGE_ORG_ADMIN: [
            EDGE_OI_ADMIN
            EDGE_SUPER_USER
            EDGE_L1
            EDGE_L2
            EDGE_L3
            EDGE_L4
          ]
          EDGE_BANNER_ADMIN: [
            EDGE_L1
            EDGE_L2
            EDGE_L3
            EDGE_L4
          ]
          EDGE_OI_ADMIN: [
            EDGE_SUPER_USER
            EDGE_L1
            EDGE_L2
            EDGE_L3
            EDGE_L4
          ]
        }
      )
  ): EdgeResponsePayload! @hasRole(roles: [EDGE_ORG_ADMIN, EDGE_BANNER_ADMIN, EDGE_OI_ADMIN])
}