fix(graphql)!: standardize pagination on a single-level shape

internal/graph/schema.graphqls

@@ -966,10 +966,6 @@ input PaginationRequest {
   page: Int64
 }
 
-input PaginatedRequest {
-  pagination: PaginationRequest
-}
-
 # ListUsersRequest is the admin _users query input. query is an optional
 # case-insensitive substring filter matched against email, given_name,
 # family_name and nickname. Empty/absent means no filter (full list).
@@ -1075,7 +1071,7 @@ input ClientRequest {
 }
 
 input ListClientsRequest {
-  pagination: PaginatedRequest
+  pagination: PaginationRequest
 }
 
 input AddTrustedIssuerRequest {
@@ -1128,7 +1124,7 @@ input TrustedIssuerRequest {
 
 input ListTrustedIssuersRequest {
   service_account_id: String
-  pagination: PaginatedRequest
+  pagination: PaginationRequest
 }
 
 input CreateOrgOIDCConnectionRequest {
@@ -1242,7 +1238,7 @@ input SAMLServiceProviderRequest {
 
 input ListSAMLServiceProvidersRequest {
   org_id: String!
-  pagination: PaginatedRequest
+  pagination: PaginationRequest
 }
 
 # --- SAML IdP: signing key rotation & SP-metadata import ---
@@ -1282,7 +1278,7 @@ input OrganizationRequest {
 }
 
 input ListOrganizationsRequest {
-  pagination: PaginatedRequest
+  pagination: PaginationRequest
 }
 
 # All SCIM endpoint admin ops are keyed by org_id — one endpoint per org.
@@ -1314,7 +1310,7 @@ input AddVerifiedOrgDomainRequest {
 
 input ListOrgDomainsRequest {
   org_id: String!
-  pagination: PaginatedRequest
+  pagination: PaginationRequest
 }
 
 input DeleteOrgDomainRequest {
@@ -1335,7 +1331,7 @@ input RemoveOrgMemberRequest {
 
 input ListOrgMembersRequest {
   org_id: String!
-  pagination: PaginatedRequest
+  pagination: PaginationRequest
 }
 
 input TestEndpointRequest {
@@ -1667,15 +1663,15 @@ type Query {
   # the roles held in each. Super-admin only. Called lazily by the dashboard
   # user detail view — not exposed on the User type to keep user lists cheap.
   _user_organizations(params: UserOrganizationsRequest!): UserOrganizations!
-  _verification_requests(params: PaginatedRequest): VerificationRequests!
+  _verification_requests(params: PaginationRequest): VerificationRequests!
   _admin_session: Response!
   # Admin-only configuration metadata (e.g. configured roles). Non-deprecated
   # replacement for the bits of _env the dashboard needs.
   _admin_meta: AdminMeta!
   # Deprecated from v2.0.0
   _env: Env!
   _webhook(params: WebhookRequest!): Webhook!
-  _webhooks(params: PaginatedRequest): Webhooks!
+  _webhooks(params: PaginationRequest): Webhooks!
   _webhook_logs(params: ListWebhookLogRequest): WebhookLogs!
   # Service accounts (machine/workload identity)
   _client(params: ClientRequest!): Client!
@@ -1697,7 +1693,7 @@ type Query {
   _scim_endpoint(params: ScimEndpointRequest!): ScimEndpoint!
   # An org's verified domains (org-admin gated; never leaks another org's rows).
   _org_domains(params: ListOrgDomainsRequest!): OrgDomains!
-  _email_templates(params: PaginatedRequest): EmailTemplates!
+  _email_templates(params: PaginationRequest): EmailTemplates!
   _audit_logs(params: ListAuditLogRequest): AuditLogs!
   # FGA admin queries (super-admin only)
   _fga_get_model: FgaModel!

internal/graphql/email_templates.go

@@ -13,7 +13,7 @@ import (
 // a thin transport adapter.
 //
 // Permissions: authorizer:admin
-func (g *graphqlProvider) EmailTemplates(ctx context.Context, params *model.PaginatedRequest) (*model.EmailTemplates, error) {
+func (g *graphqlProvider) EmailTemplates(ctx context.Context, params *model.PaginationRequest) (*model.EmailTemplates, error) {
 	gc, err := utils.GinContextFromContext(ctx)
 	if err != nil {
 		g.Log.Debug().Err(err).Msg("failed to get gin context")

internal/graphql/provider.go

@@ -131,7 +131,7 @@ type Provider interface {
 	DeleteWebhook(ctx context.Context, params *model.WebhookRequest) (*model.Response, error)
 	// EmailTemplates is the method to list email templates.
 	// Permissions: authorizer:admin
-	EmailTemplates(ctx context.Context, in *model.PaginatedRequest) (*model.EmailTemplates, error)
+	EmailTemplates(ctx context.Context, in *model.PaginationRequest) (*model.EmailTemplates, error)
 	// EnableAccess is the method to enable access.
 	// Permissions: authorizer:admin
 	EnableAccess(ctx context.Context, params *model.UpdateAccessRequest) (*model.Response, error)
@@ -218,7 +218,7 @@ type Provider interface {
 	ValidateSession(ctx context.Context, params *model.ValidateSessionRequest) (*model.ValidateSessionResponse, error)
 	// VerificationRequests is the method to list verification requests.
 	// Permissions: authorizer:admin
-	VerificationRequests(ctx context.Context, in *model.PaginatedRequest) (*model.VerificationRequests, error)
+	VerificationRequests(ctx context.Context, in *model.PaginationRequest) (*model.VerificationRequests, error)
 	// VerifyEmail is the method to verify email.
 	// Permissions: none
 	VerifyEmail(ctx context.Context, params *model.VerifyEmailRequest) (*model.AuthResponse, error)
@@ -254,7 +254,7 @@ type Provider interface {
 	Webhook(ctx context.Context, params *model.WebhookRequest) (*model.Webhook, error)
 	// Webhooks is the method to list webhooks.
 	// Permissions: authorizer:admin
-	Webhooks(ctx context.Context, in *model.PaginatedRequest) (*model.Webhooks, error)
+	Webhooks(ctx context.Context, in *model.PaginationRequest) (*model.Webhooks, error)
 	// CreateClient creates a machine/workload service account.
 	// Permissions: authorizer:admin
 	CreateClient(ctx context.Context, params *model.CreateClientRequest) (*model.CreateClientResponse, error)

internal/graphql/verification_requests.go

@@ -13,7 +13,7 @@ import (
 // Resolver is a thin transport adapter.
 //
 // Permissions: authorizer:admin
-func (g *graphqlProvider) VerificationRequests(ctx context.Context, params *model.PaginatedRequest) (*model.VerificationRequests, error) {
+func (g *graphqlProvider) VerificationRequests(ctx context.Context, params *model.PaginationRequest) (*model.VerificationRequests, error) {
 	gc, err := utils.GinContextFromContext(ctx)
 	if err != nil {
 		g.Log.Debug().Err(err).Msg("failed to get gin context")

internal/graphql/webhooks.go

@@ -13,7 +13,7 @@ import (
 // transport adapter.
 //
 // Permission: authorizer:admin
-func (g *graphqlProvider) Webhooks(ctx context.Context, params *model.PaginatedRequest) (*model.Webhooks, error) {
+func (g *graphqlProvider) Webhooks(ctx context.Context, params *model.PaginationRequest) (*model.Webhooks, error) {
 	gc, err := utils.GinContextFromContext(ctx)
 	if err != nil {
 		g.Log.Debug().Err(err).Msg("failed to get gin context")

internal/grpcsrv/handlers/admin.go

@@ -138,7 +138,7 @@ func (h *AdminHandler) DeleteUser(ctx context.Context, req *authorizerv1.DeleteU
 // VerificationRequests delegates to service.VerificationRequests and projects
 // the paginated result. Requires super-admin auth.
 func (h *AdminHandler) VerificationRequests(ctx context.Context, req *authorizerv1.VerificationRequestsRequest) (*authorizerv1.VerificationRequestsResponse, error) {
-	res, _, err := h.Service.VerificationRequests(ctx, transport.MetaFromGRPC(ctx), modelPaginatedRequest(req.GetPagination()))
+	res, _, err := h.Service.VerificationRequests(ctx, transport.MetaFromGRPC(ctx), modelPaginationRequest(req.GetPagination()))
 	if err != nil {
 		return nil, err
 	}
@@ -239,7 +239,7 @@ func (h *AdminHandler) GetWebhook(ctx context.Context, req *authorizerv1.GetWebh
 // Webhooks delegates to service.Webhooks and projects the paginated result.
 // Requires super-admin auth.
 func (h *AdminHandler) Webhooks(ctx context.Context, req *authorizerv1.WebhooksRequest) (*authorizerv1.WebhooksResponse, error) {
-	res, _, err := h.Service.Webhooks(ctx, transport.MetaFromGRPC(ctx), modelPaginatedRequest(req.GetPagination()))
+	res, _, err := h.Service.Webhooks(ctx, transport.MetaFromGRPC(ctx), modelPaginationRequest(req.GetPagination()))
 	if err != nil {
 		return nil, err
 	}
@@ -320,7 +320,7 @@ func (h *AdminHandler) DeleteEmailTemplate(ctx context.Context, req *authorizerv
 // EmailTemplates delegates to service.EmailTemplates and projects the paginated
 // result. Requires super-admin auth.
 func (h *AdminHandler) EmailTemplates(ctx context.Context, req *authorizerv1.EmailTemplatesRequest) (*authorizerv1.EmailTemplatesResponse, error) {
-	res, _, err := h.Service.EmailTemplates(ctx, transport.MetaFromGRPC(ctx), modelPaginatedRequest(req.GetPagination()))
+	res, _, err := h.Service.EmailTemplates(ctx, transport.MetaFromGRPC(ctx), modelPaginationRequest(req.GetPagination()))
 	if err != nil {
 		return nil, err
 	}
@@ -524,7 +524,7 @@ func (h *AdminHandler) GetClient(ctx context.Context, req *authorizerv1.GetClien
 // paginated result. Client secrets are never surfaced. Requires super-admin auth.
 func (h *AdminHandler) Clients(ctx context.Context, req *authorizerv1.ClientsRequest) (*authorizerv1.ClientsResponse, error) {
 	res, _, err := h.Service.Clients(ctx, transport.MetaFromGRPC(ctx), &model.ListClientsRequest{
-		Pagination: modelPaginatedRequest(req.GetPagination()),
+		Pagination: modelPaginationRequest(req.GetPagination()),
 	})
 	if err != nil {
 		return nil, err
@@ -604,7 +604,7 @@ func (h *AdminHandler) GetTrustedIssuer(ctx context.Context, req *authorizerv1.G
 func (h *AdminHandler) TrustedIssuers(ctx context.Context, req *authorizerv1.TrustedIssuersRequest) (*authorizerv1.TrustedIssuersResponse, error) {
 	res, _, err := h.Service.TrustedIssuers(ctx, transport.MetaFromGRPC(ctx), &model.ListTrustedIssuersRequest{
 		ServiceAccountID: req.ServiceAccountId,
-		Pagination:       modelPaginatedRequest(req.GetPagination()),
+		Pagination:       modelPaginationRequest(req.GetPagination()),
 	})
 	if err != nil {
 		return nil, err
@@ -682,7 +682,7 @@ func (h *AdminHandler) GetSamlServiceProvider(ctx context.Context, req *authoriz
 func (h *AdminHandler) ListSamlServiceProviders(ctx context.Context, req *authorizerv1.ListSamlServiceProvidersRequest) (*authorizerv1.ListSamlServiceProvidersResponse, error) {
 	res, _, err := h.Service.ListSAMLServiceProviders(ctx, transport.MetaFromGRPC(ctx), &model.ListSAMLServiceProvidersRequest{
 		OrgID:      req.GetOrgId(),
-		Pagination: modelPaginatedRequest(req.GetPagination()),
+		Pagination: modelPaginationRequest(req.GetPagination()),
 	})
 	if err != nil {
 		return nil, err

internal/grpcsrv/handlers/admin_project.go

@@ -26,30 +26,10 @@ func projectAdminMeta(m *model.AdminMeta) *authorizerv1.AdminMeta {
 	}
 }
 
-// modelPaginatedRequest converts the proto PaginationRequest carried by admin
-// list RPCs into the GraphQL model.PaginatedRequest consumed by the service
-// layer. A nil proto pagination yields a nil request so service.GetPagination
-// applies its defaults (page 1, default limit).
-func modelPaginatedRequest(in *authorizerv1.PaginationRequest) *model.PaginatedRequest {
-	if in == nil {
-		return nil
-	}
-	out := &model.PaginatedRequest{Pagination: &model.PaginationRequest{}}
-	if in.Page != 0 {
-		page := in.Page
-		out.Pagination.Page = &page
-	}
-	if in.Limit != 0 {
-		limit := in.Limit
-		out.Pagination.Limit = &limit
-	}
-	return out
-}
-
-// modelPaginationRequest converts the proto PaginationRequest into the GraphQL
-// model.PaginationRequest (the inner pagination shape carried by
-// ListWebhookLogRequest, as opposed to the PaginatedRequest wrapper). A nil
-// proto pagination yields nil so service.GetPagination applies its defaults.
+// modelPaginationRequest converts the proto PaginationRequest carried by admin
+// list RPCs into the GraphQL model.PaginationRequest consumed by the service
+// layer. A nil proto pagination yields nil so service.GetPagination applies
+// its defaults (page 1, default limit).
 func modelPaginationRequest(in *authorizerv1.PaginationRequest) *model.PaginationRequest {
 	if in == nil {
 		return nil

internal/integration_tests/email_templates_test.go

@@ -19,7 +19,7 @@ func TestEmailTemplates(t *testing.T) {
 
 	t.Run("should fail without admin auth", func(t *testing.T) {
 		req.Header.Set("Cookie", "")
-		res, err := ts.GraphQLProvider.EmailTemplates(ctx, &model.PaginatedRequest{})
+		res, err := ts.GraphQLProvider.EmailTemplates(ctx, &model.PaginationRequest{})
 		assert.Error(t, err)
 		assert.Nil(t, res)
 	})
@@ -29,7 +29,7 @@ func TestEmailTemplates(t *testing.T) {
 		require.NoError(t, err)
 		req.Header.Set("Cookie", fmt.Sprintf("%s=%s", constants.AdminCookieName, h))
 
-		res, err := ts.GraphQLProvider.EmailTemplates(ctx, &model.PaginatedRequest{})
+		res, err := ts.GraphQLProvider.EmailTemplates(ctx, &model.PaginationRequest{})
 		require.NoError(t, err)
 		assert.NotNil(t, res)
 		assert.NotNil(t, res.Pagination)
@@ -40,7 +40,7 @@ func TestEmailTemplates(t *testing.T) {
 		require.NoError(t, err)
 		req.Header.Set("Cookie", fmt.Sprintf("%s=%s", constants.AdminCookieName, h))
 
-		res, err := ts.GraphQLProvider.EmailTemplates(ctx, &model.PaginatedRequest{})
+		res, err := ts.GraphQLProvider.EmailTemplates(ctx, &model.PaginationRequest{})
 		require.NoError(t, err)
 		assert.NotNil(t, res)
 		for i, tmpl := range res.EmailTemplates {

internal/integration_tests/verification_requests_test.go

@@ -27,7 +27,7 @@ func TestVerificationRequests(t *testing.T) {
 
 	t.Run("should fail without admin auth", func(t *testing.T) {
 		req.Header.Set("Cookie", "")
-		res, err := ts.GraphQLProvider.VerificationRequests(ctx, &model.PaginatedRequest{})
+		res, err := ts.GraphQLProvider.VerificationRequests(ctx, &model.PaginationRequest{})
 		assert.Error(t, err)
 		assert.Nil(t, res)
 	})
@@ -37,7 +37,7 @@ func TestVerificationRequests(t *testing.T) {
 		require.NoError(t, err)
 		req.Header.Set("Cookie", fmt.Sprintf("%s=%s", constants.AdminCookieName, h))
 
-		res, err := ts.GraphQLProvider.VerificationRequests(ctx, &model.PaginatedRequest{})
+		res, err := ts.GraphQLProvider.VerificationRequests(ctx, &model.PaginationRequest{})
 		require.NoError(t, err)
 		assert.NotNil(t, res)
 		assert.NotNil(t, res.Pagination)

internal/integration_tests/webhooks_test.go

@@ -21,7 +21,7 @@ func TestWebhooks(t *testing.T) {
 
 	t.Run("should fail list webhooks without admin auth", func(t *testing.T) {
 		req.Header.Set("Cookie", "")
-		res, err := ts.GraphQLProvider.Webhooks(ctx, &model.PaginatedRequest{})
+		res, err := ts.GraphQLProvider.Webhooks(ctx, &model.PaginationRequest{})
 		assert.Error(t, err)
 		assert.Nil(t, res)
 	})
@@ -31,7 +31,7 @@ func TestWebhooks(t *testing.T) {
 		require.NoError(t, err)
 		req.Header.Set("Cookie", fmt.Sprintf("%s=%s", constants.AdminCookieName, h))
 
-		res, err := ts.GraphQLProvider.Webhooks(ctx, &model.PaginatedRequest{})
+		res, err := ts.GraphQLProvider.Webhooks(ctx, &model.PaginationRequest{})
 		require.NoError(t, err)
 		assert.NotNil(t, res)
 		assert.NotNil(t, res.Pagination)
@@ -53,7 +53,7 @@ func TestWebhooks(t *testing.T) {
 		assert.NotNil(t, addRes)
 
 		// List webhooks to get the ID
-		webhooks, err := ts.GraphQLProvider.Webhooks(ctx, &model.PaginatedRequest{})
+		webhooks, err := ts.GraphQLProvider.Webhooks(ctx, &model.PaginationRequest{})
 		require.NoError(t, err)
 		assert.GreaterOrEqual(t, len(webhooks.Webhooks), 1)