From 2c56bfd89e14cbce6355b9ce7059523244935298 Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan.eitzinger@fau.de>
Date: Thu, 29 Jun 2023 15:16:21 +0200
Subject: [PATCH 01/62] Update README.md

---
 README.md | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 6bd3c07..81bc017 100644
--- a/README.md
+++ b/README.md
@@ -57,10 +57,23 @@ git clone https://github.com/ClusterCockpit/cc-backend.git
 cd ./cc-backend
 ./startDemo.sh
 ```
+
+You can also try the demo using the lates release binary.
+Create a folder and put the release binary `cc-backend` into this folder.
+Execute the following steps:
+```
+$ ./cc-backend -init
+$ vim config.json (Add a second cluster entry and name the clusters alex and fritz)
+$ wget https://hpc-mover.rrze.uni-erlangen.de/HPC-Data/0x7b58aefb/eig7ahyo6fo2bais0ephuf2aitohv1ai/job-archive-demo.tar
+$ tar xf job-archive-demo.tar
+$ ./cc-backend -init-db -add-user demo:admin:demo -loglevel info
+$ ./cc-backend -server -dev -loglevel info
+```
+
 You can access the web interface at http://localhost:8080.
 Credentials for login are `demo:demo`.
 Please note that some views do not work without a metric backend (e.g., the
-Systems and Status views).
+Analysis, Systems and Status views).
 
 ## Howto build and run
 

From 55943cacbfba53a9bdb07e2df75e25ec9003ca7d Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Mon, 17 Jul 2023 12:19:49 +0200
Subject: [PATCH 02/62] Fix frontend render for users with api role

---
 internal/auth/auth.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/internal/auth/auth.go b/internal/auth/auth.go
index ea6c9f2..c4b0898 100644
--- a/internal/auth/auth.go
+++ b/internal/auth/auth.go
@@ -166,10 +166,10 @@ func GetValidRoles(user *User) ([]string, error) {
 	return vals, fmt.Errorf("%s: only admins are allowed to fetch a list of roles", user.Username)
 }
 
-// Called by routerConfig web.page setup in backend: Only requires known user and/or not API user
+// Called by routerConfig web.page setup in backend: Only requires known user
 func GetValidRolesMap(user *User) (map[string]Role, error) {
 	named := make(map[string]Role)
-	if user.HasNotRoles([]Role{RoleApi, RoleAnonymous}) {
+	if user.HasNotRoles([]Role{RoleAnonymous}) {
 		for i := RoleApi; i < RoleError; i++ {
 			named[GetRoleString(i)] = i
 		}

From 58c7b0d1b4ade79d1d139eeff23cec41438c97b0 Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Mon, 17 Jul 2023 14:26:24 +0200
Subject: [PATCH 03/62] fix: check if acc metrics are acc scope by default

- Fixes #180
---
 web/frontend/src/Job.root.svelte | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/web/frontend/src/Job.root.svelte b/web/frontend/src/Job.root.svelte
index 2ec1ade..21f0c7f 100644
--- a/web/frontend/src/Job.root.svelte
+++ b/web/frontend/src/Job.root.svelte
@@ -48,7 +48,8 @@
     `);
 
     const ccconfig = getContext("cc-config"),
-        clusters = getContext("clusters");
+          clusters = getContext("clusters"),
+          metrics  = getContext("metrics")
 
     let isMetricsSelectionOpen = false,
         selectedMetrics = [],
@@ -74,16 +75,26 @@
                 ccconfig[`job_view_nodestats_selectedMetrics`]),
         ]);
 
-        // Select default Scopes to load
-        if (job.numAcc === 0) {
-            // No Accels
+        // Select default Scopes to load: Check before if accelerator metrics are not on accelerator scope by default
+        const accMetrics = ['acc_utilization', 'acc_mem_used', 'acc_power', 'nv_mem_util', 'nv_sm_clock', 'nv_temp'] 
+        const accNodeOnly = [...toFetch].some(function(m) {
+            if (accMetrics.includes(m)) {
+                const mc = metrics(job.cluster, m)
+                return mc.scope !== 'accelerator'
+            } else {
+                return false
+            }
+        })
+
+        if (job.numAcc === 0 || accNodeOnly === true) {
+            // No Accels or Accels on Node Scope
             startFetching(
                 job,
                 [...toFetch],
                 job.numNodes > 2 ? ["node"] : ["node", "core"]
             );
         } else {
-            // Accels
+            // Accels and not on node scope
             startFetching(
                 job,
                 [...toFetch],

From eed8bb2d442444f63bafc7efdc99ba93d65ad132 Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Mon, 17 Jul 2023 15:45:40 +0200
Subject: [PATCH 04/62] fix: add scrambling to user names and projectIds

---
 web/frontend/src/List.root.svelte       | 12 ++++++------
 web/frontend/src/joblist/JobInfo.svelte |  5 ++++-
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/web/frontend/src/List.root.svelte b/web/frontend/src/List.root.svelte
index 57cd291..c004736 100644
--- a/web/frontend/src/List.root.svelte
+++ b/web/frontend/src/List.root.svelte
@@ -119,10 +119,10 @@
     <thead>
         <tr>
             <th scope="col">
-                <!-- {({ -->
-                <!--     USER: "Username", -->
-                <!--     PROJECT: "Project Name", -->
-                <!-- })[type]} -->
+                {({
+                    USER: "Username",
+                    PROJECT: "Project Name",
+                })[type]}
                 <Button
                     color={sorting.field == "id" ? "primary" : "light"}
                     size="sm"
@@ -216,14 +216,14 @@
                             >
                         {:else if type == "PROJECT"}
                             <a href="/monitoring/jobs/?project={row.id}"
-                                >{row.id}</a
+                                >{scrambleNames ? scramble(row.id) : row.id}</a
                             >
                         {:else}
                             {row.id}
                         {/if}
                     </td>
                     {#if type == "USER"}
-                        <td>{row?.name ? row.name : ""}</td>
+                        <td>{scrambleNames ? scramble(row?.name?row.name:"-") : row?.name?row.name:"-"}</td>
                     {/if}
                     <td>{row.totalJobs}</td>
                     <td>{row.totalWalltime}</td>
diff --git a/web/frontend/src/joblist/JobInfo.svelte b/web/frontend/src/joblist/JobInfo.svelte
index 171d199..83841c6 100644
--- a/web/frontend/src/joblist/JobInfo.svelte
+++ b/web/frontend/src/joblist/JobInfo.svelte
@@ -7,7 +7,10 @@
  -->
 <script context="module">
     export const scrambleNames = window.localStorage.getItem("cc-scramble-names")
-    export const scramble = (str) => [...str].reduce((x, c, i) => x * 7 + c.charCodeAt(0) * i * 21, 5).toString(32)
+    export const scramble = function(str) {
+        if (str === '-') return str
+        else return [...str].reduce((x, c, i) => x * 7 + c.charCodeAt(0) * i * 21, 5).toString(32).substr(0, 6)
+    }
 </script>
 <script>
     import Tag from '../Tag.svelte';

From 2674f2a769c5fa1d186f558bbcaaeca5c654cca6 Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan@moebiusband.org>
Date: Wed, 19 Jul 2023 07:51:04 +0200
Subject: [PATCH 05/62] Add message banner to template

---
 web/templates/home.tmpl | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/web/templates/home.tmpl b/web/templates/home.tmpl
index fbe1237..c0ad661 100644
--- a/web/templates/home.tmpl
+++ b/web/templates/home.tmpl
@@ -1,4 +1,14 @@
 {{define "content"}}
+{{if .Message }}
+<div class="row justify-content-center">
+    <div class="col-4">
+        <div class="alert alert-info p-3 text-center fs-3" role="alert">
+            <i class="bi-info-circle-fill me-3"></i>
+            {{.Message}}
+        </div>
+    </div>
+</div>
+{{end}}
 <div class="row">
     <div class="col">
         <h2>Clusters</h2>

From c6a0d442cc1449a4c0db07ca4d4cf4236206d888 Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan@moebiusband.org>
Date: Wed, 19 Jul 2023 08:25:14 +0200
Subject: [PATCH 06/62] feat: Add optional notification banner on homepage

Fixes #185
---
 internal/routerConfig/routes.go | 12 ++++++++++++
 web/templates/home.tmpl         |  4 ++--
 web/web.go                      |  8 ++++----
 3 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/internal/routerConfig/routes.go b/internal/routerConfig/routes.go
index 351941a..d58c3ed 100644
--- a/internal/routerConfig/routes.go
+++ b/internal/routerConfig/routes.go
@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
+	"os"
 	"strconv"
 	"strings"
 	"time"
@@ -15,6 +16,7 @@ import (
 	"github.com/ClusterCockpit/cc-backend/internal/auth"
 	"github.com/ClusterCockpit/cc-backend/internal/graph/model"
 	"github.com/ClusterCockpit/cc-backend/internal/repository"
+	"github.com/ClusterCockpit/cc-backend/internal/util"
 	"github.com/ClusterCockpit/cc-backend/pkg/log"
 	"github.com/ClusterCockpit/cc-backend/web"
 	"github.com/gorilla/mux"
@@ -60,6 +62,16 @@ func setupHomeRoute(i InfoType, r *http.Request) InfoType {
 	}
 
 	i["clusters"] = stats
+
+	if util.CheckFileExists("./var/notice.txt") {
+		msg, err := os.ReadFile("./var/notice.txt")
+		if err != nil {
+			log.Warnf("failed to read notice.txt file: %s", err.Error())
+		} else {
+			i["message"] = string(msg)
+		}
+	}
+
 	return i
 }
 
diff --git a/web/templates/home.tmpl b/web/templates/home.tmpl
index c0ad661..090cd1c 100644
--- a/web/templates/home.tmpl
+++ b/web/templates/home.tmpl
@@ -1,10 +1,10 @@
 {{define "content"}}
-{{if .Message }}
+{{if .Infos.message }}
 <div class="row justify-content-center">
     <div class="col-4">
         <div class="alert alert-info p-3 text-center fs-3" role="alert">
             <i class="bi-info-circle-fill me-3"></i>
-            {{.Message}}
+            {{.Infos.message}}
         </div>
     </div>
 </div>
diff --git a/web/web.go b/web/web.go
index bba6c8d..c94c2b1 100644
--- a/web/web.go
+++ b/web/web.go
@@ -9,11 +9,11 @@ import (
 	"html/template"
 	"io/fs"
 	"net/http"
-	"os"
 	"strings"
 
 	"github.com/ClusterCockpit/cc-backend/internal/auth"
 	"github.com/ClusterCockpit/cc-backend/internal/config"
+	"github.com/ClusterCockpit/cc-backend/internal/util"
 	"github.com/ClusterCockpit/cc-backend/pkg/log"
 	"github.com/ClusterCockpit/cc-backend/pkg/schema"
 )
@@ -48,7 +48,7 @@ func init() {
 		}
 
 		if path == "templates/login.tmpl" {
-			if _, err := os.Stat("./var/login.tmpl"); err == nil {
+			if util.CheckFileExists("./var/login.tmpl") {
 				log.Info("overwrite login.tmpl with local file")
 				templates[strings.TrimPrefix(path, "templates/")] =
 					template.Must(template.Must(base.Clone()).ParseFiles("./var/login.tmpl"))
@@ -56,7 +56,7 @@ func init() {
 			}
 		}
 		if path == "templates/imprint.tmpl" {
-			if _, err := os.Stat("./var/imprint.tmpl"); err == nil {
+			if util.CheckFileExists("./var/imprint.tmpl") {
 				log.Info("overwrite imprint.tmpl with local file")
 				templates[strings.TrimPrefix(path, "templates/")] =
 					template.Must(template.Must(base.Clone()).ParseFiles("./var/imprint.tmpl"))
@@ -64,7 +64,7 @@ func init() {
 			}
 		}
 		if path == "templates/privacy.tmpl" {
-			if _, err := os.Stat("./var/privacy.tmpl"); err == nil {
+			if util.CheckFileExists("./var/privacy.tmpl") {
 				log.Info("overwrite privacy.tmpl with local file")
 				templates[strings.TrimPrefix(path, "templates/")] =
 					template.Must(template.Must(base.Clone()).ParseFiles("./var/privacy.tmpl"))

From aab50775d80868348cd4e0a4bc505c2807837b6a Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan@moebiusband.org>
Date: Wed, 19 Jul 2023 08:47:42 +0200
Subject: [PATCH 07/62] Improve message layout and styling

---
 web/templates/home.tmpl | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/web/templates/home.tmpl b/web/templates/home.tmpl
index 090cd1c..0705d56 100644
--- a/web/templates/home.tmpl
+++ b/web/templates/home.tmpl
@@ -1,10 +1,16 @@
 {{define "content"}}
 {{if .Infos.message }}
 <div class="row justify-content-center">
-    <div class="col-4">
-        <div class="alert alert-info p-3 text-center fs-3" role="alert">
-            <i class="bi-info-circle-fill me-3"></i>
-            {{.Infos.message}}
+    <div class="col-6">
+        <div class="alert alert-info p-3" role="alert">
+            <div class="row  align-items-center">
+                <div class="col-2">
+                    <h2><i class="bi-info-circle-fill m-3"></i></h2>
+                </div>
+                <div class="col-10">
+                {{.Infos.message}}
+                </div>
+            </div>
         </div>
     </div>
 </div>

From 650bcae6be466ba0a4c722f7c22f92d65d0ad3b4 Mon Sep 17 00:00:00 2001
From: Joachim Meyer <jmeyer@cs.uni-saarland.de>
Date: Fri, 14 Jul 2023 16:42:49 +0200
Subject: [PATCH 08/62] Add arrayJobId searchbar option.

---
 internal/routerConfig/routes.go | 2 ++
 web/frontend/src/Header.svelte  | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/internal/routerConfig/routes.go b/internal/routerConfig/routes.go
index d58c3ed..5fad301 100644
--- a/internal/routerConfig/routes.go
+++ b/internal/routerConfig/routes.go
@@ -306,6 +306,8 @@ func HandleSearchBar(rw http.ResponseWriter, r *http.Request, buildInfo web.Buil
 				http.Redirect(rw, r, "/monitoring/jobs/?jobName="+url.QueryEscape(strings.Trim(splitSearch[1], " ")), http.StatusFound) // All Users: Redirect to Tablequery
 			case "projectId":
 				http.Redirect(rw, r, "/monitoring/jobs/?projectMatch=eq&project="+url.QueryEscape(strings.Trim(splitSearch[1], " ")), http.StatusFound) // All Users: Redirect to Tablequery
+			case "arrayJobId":
+				http.Redirect(rw, r, "/monitoring/jobs/?arrayJobId="+url.QueryEscape(strings.Trim(splitSearch[1], " ")), http.StatusFound) // All Users: Redirect to Tablequery
 			case "username":
 				if user.HasAnyRole([]auth.Role{auth.RoleAdmin, auth.RoleSupport, auth.RoleManager}) {
 					http.Redirect(rw, r, "/monitoring/users/?user="+url.QueryEscape(strings.Trim(splitSearch[1], " ")), http.StatusFound)
diff --git a/web/frontend/src/Header.svelte b/web/frontend/src/Header.svelte
index b291f22..164a592 100644
--- a/web/frontend/src/Header.svelte
+++ b/web/frontend/src/Header.svelte
@@ -93,7 +93,7 @@
             <InputGroup>
                 <Input type="text" placeholder="Search 'type:<query>' ..." name="searchId"/>
                 <Button outline type="submit"><Icon name="search"/></Button>
-                <InputGroupText style="cursor:help;" title={(authlevel >= roles.support) ? "Example: 'projectId:a100cd', Types are: jobId | jobName | projectId | username | name" : "Example: 'jobName:myjob', Types are jobId | jobName | projectId"}><Icon name="info-circle"/></InputGroupText>
+                <InputGroupText style="cursor:help;" title={(authlevel >= roles.support) ? "Example: 'projectId:a100cd', Types are: jobId | jobName | projectId | arrayJobId | username | name" : "Example: 'jobName:myjob', Types are jobId | jobName | projectId | arrayJobId "}><Icon name="info-circle"/></InputGroupText>
             </InputGroup>
         </form>
         {#if username}

From 2655bda64416431b7ce05b36553d9685ab85f21b Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Mon, 24 Jul 2023 11:12:22 +0200
Subject: [PATCH 09/62] feat: enable uplot XY-Zoom for metrics

- Disable jobView manual zoom
---
 web/frontend/src/Job.root.svelte         | 4 ++--
 web/frontend/src/plots/MetricPlot.svelte | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/web/frontend/src/Job.root.svelte b/web/frontend/src/Job.root.svelte
index 2ec1ade..6f78196 100644
--- a/web/frontend/src/Job.root.svelte
+++ b/web/frontend/src/Job.root.svelte
@@ -279,9 +279,9 @@
             </Button>
         {/if}
     </Col>
-    <Col xs="auto">
+<!--     <Col xs="auto">
         <Zoom timeseriesPlots={plots} />
-    </Col>
+    </Col> -->
 </Row>
 <br />
 <Row>
diff --git a/web/frontend/src/plots/MetricPlot.svelte b/web/frontend/src/plots/MetricPlot.svelte
index c0440fd..6b45c70 100644
--- a/web/frontend/src/plots/MetricPlot.svelte
+++ b/web/frontend/src/plots/MetricPlot.svelte
@@ -177,7 +177,7 @@
             x: { time: false },
             y: maxY ? { range: [0., maxY * 1.1] } : {}
         },
-        cursor: { show: false },
+        cursor: { drag: { x: true, y: true } },
         legend: { show: false, live: false }
     }
 

From 742c2e399e9db818eb80f7b735014970f03e6e53 Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Wed, 26 Jul 2023 13:44:06 +0200
Subject: [PATCH 10/62] feat: Add uplot histogram, implemented in userview

- For testing
- add conversion function to utils
---
 web/frontend/src/User.root.svelte            |  57 ++-----
 web/frontend/src/plots/Histogramuplot.svelte | 168 +++++++++++++++++++
 web/frontend/src/plots/MetricPlot.svelte     |   3 +-
 web/frontend/src/units.js                    |  12 +-
 web/frontend/src/utils.js                    |  10 ++
 5 files changed, 205 insertions(+), 45 deletions(-)
 create mode 100644 web/frontend/src/plots/Histogramuplot.svelte

diff --git a/web/frontend/src/User.root.svelte b/web/frontend/src/User.root.svelte
index 9c94eca..55aacc1 100644
--- a/web/frontend/src/User.root.svelte
+++ b/web/frontend/src/User.root.svelte
@@ -1,13 +1,13 @@
 <script>
     import { onMount, getContext } from 'svelte'
-    import { init } from './utils.js'
+    import { init, convert2uplot } from './utils.js'
     import { Table, Row, Col, Button, Icon, Card, Spinner, Input } from 'sveltestrap'
     import { queryStore, gql, getContextClient } from '@urql/svelte'
     import Filters from './filters/Filters.svelte'
     import JobList from './joblist/JobList.svelte'
     import Sorting from './joblist/SortSelection.svelte'
     import Refresher from './joblist/Refresher.svelte'
-    import Histogram from './plots/Histogram.svelte'
+    import Histogramuplot from './plots/Histogramuplot.svelte'
     import MetricSelection from './MetricSelection.svelte'
     import { scramble, scrambleNames } from './joblist/JobInfo.svelte'
 
@@ -25,13 +25,6 @@
     let metrics = ccconfig.plot_list_selectedMetrics, isMetricsSelectionOpen = false
     let w1, w2, histogramHeight = 250
     let selectedCluster = filterPresets?.cluster ? filterPresets.cluster : null
-    let resize = false 
-    /* Resize Context 
-    *  A) Each viewport change triggers histogram rerender due to variable dimensions clearing canvas if not rerendered
-    *  B) Opening filters (and some other things) triggers small change in viewport dimensions (Fix here?)
-    *  A+B) Histogram rerenders if filters opened, high performance impact if dataload heavy
-    *  Solution: Default to fixed histogram dimensions, allow user to enable automatic resizing
-    */
 
     const client = getContextClient();
     $: stats = queryStore({
@@ -137,47 +130,31 @@
                         <th scope="row">Total Core Hours</th>
                         <td>{$stats.data.jobsStatistics[0].totalCoreHours}</td>
                     </tr>
-<!--                     <tr>
-                        <th scope="row">Toggle Histogram Resizing</th>
-                        <td><Input id="c3" value={resize} type="switch" on:change={() => (resize = !resize)}/></td>
-                    </tr> -->
                 </tbody>
             </Table>
         </Col>
-        <div class="col-4" style="text-align: center;" bind:clientWidth={w1}>
+        <div class="col-4 text-center" bind:clientWidth={w1}>
             <b>Duration Distribution</b>
             {#key $stats.data.jobsStatistics[0].histDuration}
-                {#if resize == true}
-                <Histogram
-                    data={$stats.data.jobsStatistics[0].histDuration}
-                    width={w1 - 25} height={histogramHeight}
-                    xlabel="Current Runtimes [h]" 
-                    ylabel="Number of Jobs"/>
-                {:else}
-                <Histogram
-                    data={$stats.data.jobsStatistics[0].histDuration}
-                    width={400} height={250}
-                    xlabel="Current Runtimes [h]" 
-                    ylabel="Number of Jobs"/>
-                {/if}
+                <Histogramuplot
+                    data={convert2uplot($stats.data.jobsStatistics[0].histDuration)}
+                    width={w2 - 25} height={histogramHeight}
+                    xlabel="Current Runtimes"
+                    xunit="Hours" 
+                    ylabel="Number of Jobs"
+                    yunit="Jobs"/>
             {/key}
         </div>
-        <div class="col-4" style="text-align: center;" bind:clientWidth={w2}>
+        <div class="col-4 text-center" bind:clientWidth={w2}>
             <b>Number of Nodes Distribution</b>
             {#key $stats.data.jobsStatistics[0].histNumNodes}
-                {#if resize == true}
-                <Histogram
-                    data={$stats.data.jobsStatistics[0].histNumNodes}
+                <Histogramuplot
+                    data={convert2uplot($stats.data.jobsStatistics[0].histNumNodes)}
                     width={w2 - 25} height={histogramHeight}
-                    xlabel="Allocated Nodes [#]"
-                    ylabel="Number of Jobs" />
-                {:else}
-                <Histogram
-                    data={$stats.data.jobsStatistics[0].histNumNodes}
-                    width={400} height={250}
-                    xlabel="Allocated Nodes [#]"
-                    ylabel="Number of Jobs" />
-                {/if}
+                    xlabel="Allocated Nodes"
+                    xunit="Nodes"
+                    ylabel="Number of Jobs"
+                    yunit="Jobs"/>
             {/key}
         </div>
     {/if}
diff --git a/web/frontend/src/plots/Histogramuplot.svelte b/web/frontend/src/plots/Histogramuplot.svelte
new file mode 100644
index 0000000..b652578
--- /dev/null
+++ b/web/frontend/src/plots/Histogramuplot.svelte
@@ -0,0 +1,168 @@
+<!--
+    @component
+    Properties:
+    - Todo
+ -->
+
+<script>
+    import uPlot from 'uplot'
+    import { formatNumber } from '../units.js'
+    import { onMount, onDestroy } from 'svelte'
+    import { Card } from 'sveltestrap'
+
+    export let data
+    export let width = 500
+    export let height = 300
+    export let xlabel = ''
+    export let xunit = 'X'
+    export let ylabel = ''
+    export let yunit = 'Y'
+
+    const { bars } = uPlot.paths
+
+    const drawStyles = {
+        bars:      1,
+        points:    2,
+    };
+
+    function paths(u, seriesIdx, idx0, idx1, extendGap, buildClip) {
+        let s = u.series[seriesIdx];
+        let style = s.drawStyle;
+
+        let renderer = (
+            style == drawStyles.bars ? (
+                bars({size: [0.75, 100]})
+            ) :
+            () => null
+        )
+
+        return renderer(u, seriesIdx, idx0, idx1, extendGap, buildClip);
+    }
+
+    let plotWrapper = null
+    let legendWrapper = null
+    let uplot = null
+    let timeoutId = null
+    
+    function render() {
+        let opts = {
+            width: width,
+            height: height,
+            cursor: {
+                points: {
+                    size:   (u, seriesIdx)       => u.series[seriesIdx].points.size * 2.5,
+                    width:  (u, seriesIdx, size) => size / 4,
+                    stroke: (u, seriesIdx)       => u.series[seriesIdx].points.stroke(u, seriesIdx) + '90',
+                    fill:   (u, seriesIdx)       => "#fff",
+                }
+            },
+            scales: {
+                x: {
+                    time: false
+                },
+            },
+            axes: [
+                {
+                    stroke: "#000000",
+                    // scale: 'x',
+                    label: xlabel,
+                    labelGap: 10,
+                    size: 25,
+                    incrs: [1, 2, 5, 6, 10, 12, 50, 100, 500, 1000, 5000, 10000],
+                    border: { 
+                        show: true,
+                        stroke: "#000000",
+                    },
+                    ticks: {
+                        width: 1 / devicePixelRatio,
+                        size: 5 / devicePixelRatio,
+                        stroke: "#000000",
+                    },
+                    values: (_, t) => t.map(v => formatNumber(v)),
+                },
+                {
+                    stroke: "#000000",
+                    // scale: 'y',
+                    label: ylabel,
+                    labelGap: 10,
+                    size: 35,
+                    border: { 
+                        show: true,
+                        stroke: "#000000",
+                    },
+                    ticks: {
+                        width: 1 / devicePixelRatio,
+                        size: 5 / devicePixelRatio,
+                        stroke: "#000000",
+                    },
+                    values: (_, t) => t.map(v => formatNumber(v)),
+                },
+            ],
+            legend : {
+                mount: (self, legend) => {
+                    legendWrapper.appendChild(legend)
+                },
+                markers: {
+                    show: false,
+                    stroke: "#000000"
+                }
+            },
+            series: [
+                {
+                    label: xunit,
+                },
+                Object.assign({
+                    label: yunit,
+                    width: 1 / devicePixelRatio,
+                    drawStyle: drawStyles.points,
+                    lineInterpolation: null,
+                    paths,
+                }, {
+                    drawStyle: drawStyles.bars,
+                    lineInterpolation: null,
+                    stroke: "#85abce",
+                    fill: "#85abce", //  + "1A", // Transparent Fill
+                }),
+            ]
+        };
+
+		uplot = new uPlot(opts, data, plotWrapper)
+	}
+
+    onMount(() => {
+        render()
+    })
+
+    onDestroy(() => {
+        if (uplot)
+            uplot.destroy()
+
+        if (timeoutId != null)
+            clearTimeout(timeoutId)
+    })
+
+    function sizeChanged() {
+        if (timeoutId != null)
+            clearTimeout(timeoutId)
+
+        timeoutId = setTimeout(() => {
+            timeoutId = null
+            if (uplot)
+                uplot.destroy()
+
+            render()
+        }, 200)
+    }
+
+    $: sizeChanged(width, height)
+</script>
+
+{#if data.length > 0}
+    <div bind:this={plotWrapper}>
+        <div bind:this={legendWrapper}/>
+    </div>
+{:else}
+    <Card class="mx-4" body color="warning">Cannot render histogram: No data!</Card>
+{/if}
+
+
diff --git a/web/frontend/src/plots/MetricPlot.svelte b/web/frontend/src/plots/MetricPlot.svelte
index 6b45c70..a20b307 100644
--- a/web/frontend/src/plots/MetricPlot.svelte
+++ b/web/frontend/src/plots/MetricPlot.svelte
@@ -323,8 +323,9 @@
 {#if series[0].data.length > 0}
     <div bind:this={plotWrapper} class="cc-plot"></div>
 {:else}
-    <Card style="margin-left: 2rem;margin-right: 2rem;" body color="warning">Cannot render plot: No series data returned for <code>{metric}</code></Card>
+    <Card class="mx-4" body color="warning">Cannot render plot: No series data returned for <code>{metric}</code></Card>
 {/if}
+
 <style>
     .cc-plot {
         border-radius: 5px;
diff --git a/web/frontend/src/units.js b/web/frontend/src/units.js
index 0d321ad..d306e73 100644
--- a/web/frontend/src/units.js
+++ b/web/frontend/src/units.js
@@ -6,11 +6,15 @@ const power  = [1, 1e3, 1e6, 1e9, 1e12, 1e15, 1e18, 1e21]
 const prefix = ['', 'K', 'M', 'G', 'T', 'P', 'E']
 
 export function formatNumber(x) {
-    for (let i = 0; i < prefix.length; i++)
-        if (power[i] <= x && x < power[i+1])
-            return `${Math.round((x / power[i]) * 100) / 100} ${prefix[i]}`
+    if ( isNaN(x) ) {
+        return x // Return if String , used in Histograms
+    } else {
+        for (let i = 0; i < prefix.length; i++)
+            if (power[i] <= x && x < power[i+1])
+                return `${Math.round((x / power[i]) * 100) / 100} ${prefix[i]}`
 
-    return Math.abs(x) >= 1000 ? x.toExponential() : x.toString()
+        return Math.abs(x) >= 1000 ? x.toExponential() : x.toString()
+    }
 }
 
 export function scaleNumbers(x, y , p = '') {
diff --git a/web/frontend/src/utils.js b/web/frontend/src/utils.js
index 296b587..37b9426 100644
--- a/web/frontend/src/utils.js
+++ b/web/frontend/src/utils.js
@@ -313,3 +313,13 @@ export function checkMetricDisabled(m, c, s) { //[m]etric, [c]luster, [s]ubclust
     }
     return false;
 }
+
+export function convert2uplot(canvasData) {
+    // initial use: Canvas Histogram Data to Uplot
+    let uplotData = [[],[]] // [X, Y1, Y2, ...]
+    canvasData.forEach( pair => {
+        uplotData[0].push(pair.value)
+        uplotData[1].push(pair.count)
+    })
+    return uplotData
+}

From 36abed2093f76105cc3226f17ff191e192628be0 Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Tue, 1 Aug 2023 15:30:21 +0200
Subject: [PATCH 11/62] feat: add auto-reloading to system and node views

---
 web/frontend/src/Node.root.svelte             | 8 ++++++++
 web/frontend/src/Systems.root.svelte          | 8 ++++++++
 web/frontend/src/filters/TimeSelection.svelte | 1 +
 3 files changed, 17 insertions(+)

diff --git a/web/frontend/src/Node.root.svelte b/web/frontend/src/Node.root.svelte
index daa12c5..3cd6d04 100644
--- a/web/frontend/src/Node.root.svelte
+++ b/web/frontend/src/Node.root.svelte
@@ -11,6 +11,7 @@
     } from "sveltestrap";
     import { queryStore, gql, getContextClient } from "@urql/svelte";
     import TimeSelection from "./filters/TimeSelection.svelte";
+    import Refresher from './joblist/Refresher.svelte';
     import PlotTable from "./PlotTable.svelte";
     import MetricPlot from "./plots/MetricPlot.svelte";
     import { getContext } from "svelte";
@@ -160,6 +161,13 @@
                 No currently running jobs.
             {/if}
         </Col>
+        <Col>
+            <Refresher on:reload={() => {
+                const diff = Date.now() - to
+                from = new Date(from.getTime() + diff)
+                to = new Date(to.getTime() + diff)
+            }} />
+        </Col>
         <Col>
             <TimeSelection bind:from bind:to />
         </Col>
diff --git a/web/frontend/src/Systems.root.svelte b/web/frontend/src/Systems.root.svelte
index fcca95e..bda1763 100644
--- a/web/frontend/src/Systems.root.svelte
+++ b/web/frontend/src/Systems.root.svelte
@@ -1,5 +1,6 @@
 <script>
     import { init, checkMetricDisabled } from './utils.js'
+    import Refresher from './joblist/Refresher.svelte'
     import { Row, Col, Input, InputGroup, InputGroupText, Icon, Spinner, Card } from 'sveltestrap'
     import { queryStore, gql, getContextClient } from '@urql/svelte'
     import TimeSelection from './filters/TimeSelection.svelte'
@@ -78,6 +79,13 @@
     {:else if $initq.fetching}
         <Spinner/>
     {:else}
+        <Col>
+            <Refresher on:reload={() => {
+                const diff = Date.now() - to
+                from = new Date(from.getTime() + diff)
+                to = new Date(to.getTime() + diff)
+            }} />
+        </Col>
         <Col>
             <TimeSelection
                 bind:from={from}
diff --git a/web/frontend/src/filters/TimeSelection.svelte b/web/frontend/src/filters/TimeSelection.svelte
index 7d7cca4..c715b9c 100644
--- a/web/frontend/src/filters/TimeSelection.svelte
+++ b/web/frontend/src/filters/TimeSelection.svelte
@@ -7,6 +7,7 @@
     export let customEnabled = true
     export let anyEnabled = false
     export let options = {
+        'Last quarter hour': 15*60,
         'Last half hour': 30*60,
         'Last hour': 60*60,
         'Last 2hrs': 2*60*60,

From 284a7079d6c6c1c3a376817d1ee385232a51043a Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Tue, 1 Aug 2023 18:37:50 +0200
Subject: [PATCH 12/62] Invert time x-axis for node view metric plots

---
 web/frontend/src/Node.root.svelte        |  1 +
 web/frontend/src/Systems.root.svelte     |  3 ++-
 web/frontend/src/plots/MetricPlot.svelte | 11 ++++++-----
 3 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/web/frontend/src/Node.root.svelte b/web/frontend/src/Node.root.svelte
index 3cd6d04..9a5cb1d 100644
--- a/web/frontend/src/Node.root.svelte
+++ b/web/frontend/src/Node.root.svelte
@@ -211,6 +211,7 @@
                         subCluster={$nodeMetricsData.data.nodeMetrics[0]
                             .subCluster}
                         series={item.metric.series}
+                        forNode={true}
                     />
                 {:else if item.disabled === true && item.metric}
                     <Card
diff --git a/web/frontend/src/Systems.root.svelte b/web/frontend/src/Systems.root.svelte
index bda1763..6201995 100644
--- a/web/frontend/src/Systems.root.svelte
+++ b/web/frontend/src/Systems.root.svelte
@@ -144,7 +144,8 @@
                             series={item.data.metric.series}
                             metric={item.data.name}
                             cluster={clusters.find(c => c.name == cluster)}
-                            subCluster={item.subCluster} />
+                            subCluster={item.subCluster}
+                            forNode={true} />
                     {:else if item.disabled === true && item.data}
                         <Card style="margin-left: 2rem;margin-right: 2rem;" body color="info">Metric disabled for subcluster <code>{selectedMetric}:{item.subCluster}</code></Card>
                     {:else}
diff --git a/web/frontend/src/plots/MetricPlot.svelte b/web/frontend/src/plots/MetricPlot.svelte
index c0440fd..4e1446e 100644
--- a/web/frontend/src/plots/MetricPlot.svelte
+++ b/web/frontend/src/plots/MetricPlot.svelte
@@ -37,6 +37,7 @@
     export let useStatsSeries = null
     export let scope = 'node'
     export let isShared = false
+    export let forNode = false
 
     if (useStatsSeries == null)
         useStatsSeries = statisticsSeries != null
@@ -130,7 +131,7 @@
                 scale: 'x',
                 space: 35,
                 incrs: timeIncrs(timestep, maxX),
-                values: (_, vals) => vals.map(v => formatTime(v))
+                values: (_, vals) => forNode ? vals.reverse().map(v => formatTime(v, forNode)) : vals.map(v => formatTime(v))
             },
             {
                 scale: 'y',
@@ -250,15 +251,15 @@
 </script>
 <script context="module">
 
-    export function formatTime(t) {
+    export function formatTime(t, forNode = false) {
         let h = Math.floor(t / 3600)
         let m = Math.floor((t % 3600) / 60)
         if (h == 0)
-            return `${m}m`
+            return forNode ? `-${m}m` : `${m}m`
         else if (m == 0)
-            return `${h}h`
+            return forNode ? `-${h}h` : `${h}h`
         else
-            return `${h}:${m}h`
+            return forNode ? `-${h}:${m}h` : `${h}:${m}h`
     }
 
     export function timeIncrs(timestep, maxX) {

From 1921be661ba56e209823befde6cb3ec8dd081f83 Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Wed, 2 Aug 2023 14:20:39 +0200
Subject: [PATCH 13/62] Fix x-axis order for relative timestamps

- WIP: Will change to full times, as tick location is incorrect
---
 web/frontend/src/plots/MetricPlot.svelte | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/web/frontend/src/plots/MetricPlot.svelte b/web/frontend/src/plots/MetricPlot.svelte
index 4e1446e..fdf56ed 100644
--- a/web/frontend/src/plots/MetricPlot.svelte
+++ b/web/frontend/src/plots/MetricPlot.svelte
@@ -131,7 +131,13 @@
                 scale: 'x',
                 space: 35,
                 incrs: timeIncrs(timestep, maxX),
-                values: (_, vals) => forNode ? vals.reverse().map(v => formatTime(v, forNode)) : vals.map(v => formatTime(v))
+                values: (_, vals) => {
+                    if (forNode === true) {
+                        return vals.map(v => formatTime(v, forNode)).reverse()
+                    } else {
+                        return vals.map(v => formatTime(v))
+                    }
+                }
             },
             {
                 scale: 'y',

From 6e0c13df896feabe514f7621c859a8d1fc9127d6 Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Thu, 3 Aug 2023 12:27:03 +0200
Subject: [PATCH 14/62] Correct negative relative timestamps for node view

---
 web/frontend/src/plots/MetricPlot.svelte | 53 ++++++++++++++++--------
 1 file changed, 35 insertions(+), 18 deletions(-)

diff --git a/web/frontend/src/plots/MetricPlot.svelte b/web/frontend/src/plots/MetricPlot.svelte
index fdf56ed..2aea35b 100644
--- a/web/frontend/src/plots/MetricPlot.svelte
+++ b/web/frontend/src/plots/MetricPlot.svelte
@@ -96,14 +96,28 @@
         : null
     const plotSeries = [{}]
     const plotData = [new Array(longestSeries)]
-    for (let i = 0; i < longestSeries; i++) // TODO: Cache/Reuse this array?
-        plotData[0][i] = i * timestep
+
+    if (forNode === true) {
+        // Negative Timestamp Buildup
+        for (let i = 0; i <= longestSeries; i++) {
+            plotData[0][i] = (longestSeries - i) * timestep * -1
+        }
+    } else {
+        // Positive Timestamp Buildup
+        for (let j = 0; j < longestSeries; j++) // TODO: Cache/Reuse this array?
+            plotData[0][j] = j * timestep
+    }
 
     let plotBands = undefined
     if (useStatsSeries) {
         plotData.push(statisticsSeries.min)
         plotData.push(statisticsSeries.max)
         plotData.push(statisticsSeries.mean)
+        if (forNode === true) { // timestamp 0 with null value for reversed time axis
+            if (plotData[1].length != 0) plotData[1].push(null)
+            if (plotData[2].length != 0) plotData[2].push(null)
+            if (plotData[3].length != 0) plotData[3].push(null)
+        }
         plotSeries.push({ scale: 'y', width: lineWidth, stroke: 'red' })
         plotSeries.push({ scale: 'y', width: lineWidth, stroke: 'green' })
         plotSeries.push({ scale: 'y', width: lineWidth, stroke: 'black' })
@@ -114,6 +128,7 @@
     } else {
         for (let i = 0; i < series.length; i++) {
             plotData.push(series[i].data)
+            if (forNode === true && plotData[1].length != 0) plotData[1].push(null) // timestamp 0 with null value for reversed time axis
             plotSeries.push({
                 scale: 'y',
                 width: lineWidth,
@@ -122,6 +137,10 @@
         }
     }
 
+
+    // console.log("Input Series: ", metric, series)
+    // console.log("Data: ", plotData)
+
     const opts = {
         width,
         height,
@@ -130,14 +149,8 @@
             {
                 scale: 'x',
                 space: 35,
-                incrs: timeIncrs(timestep, maxX),
-                values: (_, vals) => {
-                    if (forNode === true) {
-                        return vals.map(v => formatTime(v, forNode)).reverse()
-                    } else {
-                        return vals.map(v => formatTime(v))
-                    }
-                }
+                incrs: timeIncrs(timestep, maxX, forNode),
+                values: (_, vals) => vals.map(v => formatTime(v))
             },
             {
                 scale: 'y',
@@ -261,19 +274,23 @@
         let h = Math.floor(t / 3600)
         let m = Math.floor((t % 3600) / 60)
         if (h == 0)
-            return forNode ? `-${m}m` : `${m}m`
+            return `${m}m`
         else if (m == 0)
-            return forNode ? `-${h}h` : `${h}h`
+            return `${h}h`
         else
-            return forNode ? `-${h}:${m}h` : `${h}:${m}h`
+            return `${h}:${m}h`
     }
 
-    export function timeIncrs(timestep, maxX) {
-        let incrs = []
-        for (let t = timestep; t < maxX; t *= 10)
-            incrs.push(t, t * 2, t * 3, t * 5)
+    export function timeIncrs(timestep, maxX, forNode) {
+        if (forNode === true) {
+            return [60, 300, 900, 1800, 3600, 7200, 14400, 21600] // forNode fixed increments
+        } else {
+            let incrs = []
+            for (let t = timestep; t < maxX; t *= 10)
+                incrs.push(t, t * 2, t * 3, t * 5)
 
-        return incrs
+            return incrs
+        }
     }
 
     export function findThresholds(metricConfig, scope, subCluster) {

From 4244a37440e5671a1c352603d2cc7908120ff89e Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Thu, 3 Aug 2023 12:38:00 +0200
Subject: [PATCH 15/62] fix: correct timestamp logic in node-view

---
 web/frontend/src/plots/MetricPlot.svelte | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/web/frontend/src/plots/MetricPlot.svelte b/web/frontend/src/plots/MetricPlot.svelte
index 2aea35b..1565cde 100644
--- a/web/frontend/src/plots/MetricPlot.svelte
+++ b/web/frontend/src/plots/MetricPlot.svelte
@@ -137,10 +137,6 @@
         }
     }
 
-
-    // console.log("Input Series: ", metric, series)
-    // console.log("Data: ", plotData)
-
     const opts = {
         width,
         height,

From 6393035e5554d95f388104f33f2e1fb8f6d1fdb9 Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Thu, 3 Aug 2023 17:47:09 +0200
Subject: [PATCH 16/62] first iteraton of implementing ip-secured enpoint

---
 internal/api/rest.go | 79 ++++++++++++++++++++++++++++++++++++++++++++
 pkg/schema/config.go |  3 ++
 2 files changed, 82 insertions(+)

diff --git a/internal/api/rest.go b/internal/api/rest.go
index c199bc2..c1f6fd1 100644
--- a/internal/api/rest.go
+++ b/internal/api/rest.go
@@ -20,6 +20,7 @@ import (
 	"time"
 
 	"github.com/ClusterCockpit/cc-backend/internal/auth"
+	"github.com/ClusterCockpit/cc-backend/internal/config"
 	"github.com/ClusterCockpit/cc-backend/internal/graph"
 	"github.com/ClusterCockpit/cc-backend/internal/graph/model"
 	"github.com/ClusterCockpit/cc-backend/internal/importer"
@@ -75,6 +76,8 @@ func (api *RestApi) MountRoutes(r *mux.Router) {
 	r.HandleFunc("/jobs/delete_job/", api.deleteJobByRequest).Methods(http.MethodDelete)
 	r.HandleFunc("/jobs/delete_job/{id}", api.deleteJobById).Methods(http.MethodDelete)
 	r.HandleFunc("/jobs/delete_job_before/{ts}", api.deleteJobBefore).Methods(http.MethodDelete)
+	r.HandleFunc("/secured/addProject/{id}/{project}", api.secureUpdateUser).Methods(http.MethodPost)
+	r.HandleFunc("/secured/addRole/{id}/{role}", api.secureUpdateUser).Methods(http.MethodPost)
 
 	if api.Authentication != nil {
 		r.HandleFunc("/jwt/", api.getJWT).Methods(http.MethodGet)
@@ -103,6 +106,11 @@ type DeleteJobApiResponse struct {
 	Message string `json:"msg"`
 }
 
+// UpdateUserApiResponse model
+type UpdateUserApiResponse struct {
+	Message string `json:"msg"`
+}
+
 // StopJobApiRequest model
 type StopJobApiRequest struct {
 	// Stop Time of job as epoch
@@ -1043,6 +1051,77 @@ func (api *RestApi) updateUser(rw http.ResponseWriter, r *http.Request) {
 	}
 }
 
+func (api *RestApi) secureUpdateUser(rw http.ResponseWriter, r *http.Request) {
+	if user := auth.GetUser(r.Context()); user != nil && !user.HasRole(auth.RoleApi) {
+		handleError(fmt.Errorf("missing role: %v", auth.GetRoleString(auth.RoleApi)), http.StatusForbidden, rw)
+		return
+	}
+
+	// If nothing declared in config: deny all request to this endpint
+	if config.Keys.ApiAllowedAddrs == nil || len(config.Keys.ApiAllowedAddrs) == 0 {
+		handleError(fmt.Errorf("denied by default policy!"), http.StatusForbidden, rw)
+		return
+	}
+
+	// IP CHECK HERE (WIP)
+	// Probably better as private routine
+	IPAddress := r.Header.Get("X-Real-Ip")
+	if IPAddress == "" {
+		IPAddress = r.Header.Get("X-Forwarded-For")
+	}
+	if IPAddress == "" {
+		IPAddress = r.RemoteAddr
+	}
+
+	// Also This
+	ipOk := false
+	for _, a := range config.Keys.ApiAllowedAddrs {
+		if a == IPAddress {
+			ipOk = true
+		}
+	}
+
+	if IPAddress == "" || ipOk == false {
+		handleError(fmt.Errorf("unknown ip: %v", IPAddress), http.StatusForbidden, rw)
+		return
+	}
+	// IP CHECK END
+
+	// Get Values
+	id := mux.Vars(r)["id"]
+	newproj := mux.Vars(r)["project"]
+	newrole := mux.Vars(r)["role"]
+
+	// TODO: Handle anything but roles...
+	if newrole != "" {
+		if err := api.Authentication.AddRole(r.Context(), id, newrole); err != nil {
+			handleError(errors.New(err.Error()), http.StatusUnprocessableEntity, rw)
+			return
+		}
+
+		rw.Header().Add("Content-Type", "application/json")
+		rw.WriteHeader(http.StatusOK)
+		json.NewEncoder(rw).Encode(UpdateUserApiResponse{
+			Message: fmt.Sprintf("Successfully added role %s to %s", newrole, id),
+		})
+
+	} else if newproj != "" {
+		if err := api.Authentication.AddProject(r.Context(), id, newproj); err != nil {
+			handleError(errors.New(err.Error()), http.StatusUnprocessableEntity, rw)
+			return
+		}
+
+		rw.Header().Add("Content-Type", "application/json")
+		rw.WriteHeader(http.StatusOK)
+		json.NewEncoder(rw).Encode(UpdateUserApiResponse{
+			Message: fmt.Sprintf("Successfully added project %s to %s", newproj, id),
+		})
+
+	} else {
+		handleError(errors.New("Not Add [role|project]?"), http.StatusBadRequest, rw)
+	}
+}
+
 func (api *RestApi) updateConfiguration(rw http.ResponseWriter, r *http.Request) {
 	rw.Header().Set("Content-Type", "text/plain")
 	key, value := r.FormValue("key"), r.FormValue("value")
diff --git a/pkg/schema/config.go b/pkg/schema/config.go
index 9a88ea2..30515dd 100644
--- a/pkg/schema/config.go
+++ b/pkg/schema/config.go
@@ -69,6 +69,9 @@ type ProgramConfig struct {
 	// Address where the http (or https) server will listen on (for example: 'localhost:80').
 	Addr string `json:"addr"`
 
+	// Addresses from which the /secured/* API endpoints can be reached
+	ApiAllowedAddrs []string `json:"apiAllowedAddrs"`
+
 	// Drop root permissions once .env was read and the port was taken.
 	User  string `json:"user"`
 	Group string `json:"group"`

From 8a473de793278e3133ca038fff28c967c7601577 Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Thu, 3 Aug 2023 19:09:15 +0200
Subject: [PATCH 17/62] fix: core/accelerator scope in statstable on load

---
 web/frontend/src/Job.root.svelte   | 4 +++-
 web/frontend/src/StatsTable.svelte | 5 ++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/web/frontend/src/Job.root.svelte b/web/frontend/src/Job.root.svelte
index 21f0c7f..0806768 100644
--- a/web/frontend/src/Job.root.svelte
+++ b/web/frontend/src/Job.root.svelte
@@ -33,6 +33,8 @@
     export let authlevel;
     export let roles;
 
+    const accMetrics = ['acc_utilization', 'acc_mem_used', 'acc_power', 'nv_mem_util', 'nv_sm_clock', 'nv_temp'];
+
     const { query: initq } = init(`
         job(id: "${dbid}") {
             id, jobId, user, project, cluster, startTime,
@@ -76,7 +78,6 @@
         ]);
 
         // Select default Scopes to load: Check before if accelerator metrics are not on accelerator scope by default
-        const accMetrics = ['acc_utilization', 'acc_mem_used', 'acc_power', 'nv_mem_util', 'nv_sm_clock', 'nv_temp'] 
         const accNodeOnly = [...toFetch].some(function(m) {
             if (accMetrics.includes(m)) {
                 const mc = metrics(job.cluster, m)
@@ -396,6 +397,7 @@
                                 bind:this={statsTable}
                                 job={$initq.data.job}
                                 jobMetrics={$jobMetrics.data.jobMetrics}
+                                accMetrics={accMetrics}
                             />
                         {/key}
                     {/if}
diff --git a/web/frontend/src/StatsTable.svelte b/web/frontend/src/StatsTable.svelte
index f40c204..ae15437 100644
--- a/web/frontend/src/StatsTable.svelte
+++ b/web/frontend/src/StatsTable.svelte
@@ -7,6 +7,7 @@
 
     export let job
     export let jobMetrics
+    export let accMetrics
 
     const allMetrics = [...new Set(jobMetrics.map(m => m.name))].sort(),
           scopesForMetric = (metric) => jobMetrics
@@ -21,7 +22,9 @@
             || getContext('cc-config')['job_view_nodestats_selectedMetrics']
 
     for (let metric of allMetrics) {
-        selectedScopes[metric] = maxScope(scopesForMetric(metric))
+        selectedScopes[metric] = (job.exclusive != 1 || job.numNodes == 1) ? 
+            (job.numAccs != 0 && accMetrics.includes(metric)) ? 'accelerator' : 'core' 
+            : maxScope(scopesForMetric(metric))
         sorting[metric] = {
             min: { dir: 'up', active: false },
             avg: { dir: 'up', active: false },

From 298051c33489f3224a28b3a9915608cb9a4ec154 Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Fri, 4 Aug 2023 10:54:18 +0200
Subject: [PATCH 18/62] add fallback for acc metrics only on node level

---
 web/frontend/src/Job.root.svelte   |  4 +++-
 web/frontend/src/StatsTable.svelte | 17 +++++++++++++----
 2 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/web/frontend/src/Job.root.svelte b/web/frontend/src/Job.root.svelte
index 0806768..9017144 100644
--- a/web/frontend/src/Job.root.svelte
+++ b/web/frontend/src/Job.root.svelte
@@ -34,6 +34,7 @@
     export let roles;
 
     const accMetrics = ['acc_utilization', 'acc_mem_used', 'acc_power', 'nv_mem_util', 'nv_sm_clock', 'nv_temp'];
+    let accNodeOnly
 
     const { query: initq } = init(`
         job(id: "${dbid}") {
@@ -78,7 +79,7 @@
         ]);
 
         // Select default Scopes to load: Check before if accelerator metrics are not on accelerator scope by default
-        const accNodeOnly = [...toFetch].some(function(m) {
+        accNodeOnly = [...toFetch].some(function(m) {
             if (accMetrics.includes(m)) {
                 const mc = metrics(job.cluster, m)
                 return mc.scope !== 'accelerator'
@@ -398,6 +399,7 @@
                                 job={$initq.data.job}
                                 jobMetrics={$jobMetrics.data.jobMetrics}
                                 accMetrics={accMetrics}
+                                accNodeOnly={accNodeOnly}
                             />
                         {/key}
                     {/if}
diff --git a/web/frontend/src/StatsTable.svelte b/web/frontend/src/StatsTable.svelte
index ae15437..e85e835 100644
--- a/web/frontend/src/StatsTable.svelte
+++ b/web/frontend/src/StatsTable.svelte
@@ -8,6 +8,7 @@
     export let job
     export let jobMetrics
     export let accMetrics
+    export let accNodeOnly
 
     const allMetrics = [...new Set(jobMetrics.map(m => m.name))].sort(),
           scopesForMetric = (metric) => jobMetrics
@@ -20,11 +21,19 @@
         isMetricSelectionOpen = false,
         selectedMetrics = getContext('cc-config')[`job_view_nodestats_selectedMetrics:${job.cluster}`]
             || getContext('cc-config')['job_view_nodestats_selectedMetrics']
-
+            
     for (let metric of allMetrics) {
-        selectedScopes[metric] = (job.exclusive != 1 || job.numNodes == 1) ? 
-            (job.numAccs != 0 && accMetrics.includes(metric)) ? 'accelerator' : 'core' 
-            : maxScope(scopesForMetric(metric))
+        // Not Exclusive or Single Node: Get maxScope()
+        // No Accelerators in Job and not Acc-Metric: Use 'core'
+        // Accelerator Metric available on accelerator scope: Use 'accelerator'
+        // Accelerator Metric only on node scope: Fallback to 'node'
+        selectedScopes[metric] = (job.exclusive != 1 || job.numNodes == 1) ?
+                                   (job.numAccs != 0 && accMetrics.includes(metric)) ?
+                                     accNodeOnly ?
+                                       'node'
+                                     : 'accelerator' 
+                                   : 'core'
+                                 : maxScope(scopesForMetric(metric))
         sorting[metric] = {
             min: { dir: 'up', active: false },
             avg: { dir: 'up', active: false },

From d929bdc9a11ba093210f3595108cbc654fbba17a Mon Sep 17 00:00:00 2001
From: Pay Giesselmann <giesselmann@dkrz.de>
Date: Tue, 8 Aug 2023 10:17:30 +0200
Subject: [PATCH 19/62] omit metrics with empty series

---
 internal/metricdata/prometheus.go | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/internal/metricdata/prometheus.go b/internal/metricdata/prometheus.go
index d93a3c5..0d3848f 100644
--- a/internal/metricdata/prometheus.go
+++ b/internal/metricdata/prometheus.go
@@ -326,7 +326,6 @@ func (pdb *PrometheusDataRepository) LoadData(
 					Timestep: metricConfig.Timestep,
 					Series:   make([]schema.Series, 0),
 				}
-				jobData[metric][scope] = jobMetric
 			}
 			step := int64(metricConfig.Timestep)
 			steps := int64(to.Sub(from).Seconds()) / step
@@ -335,6 +334,10 @@ func (pdb *PrometheusDataRepository) LoadData(
 				jobMetric.Series = append(jobMetric.Series,
 					pdb.RowToSeries(from, step, steps, row))
 			}
+			// only add metric if at least one host returned data
+			if !ok && len(jobMetric.Series) > 0{
+				jobData[metric][scope] = jobMetric
+			}
 			// sort by hostname to get uniform coloring
 			sort.Slice(jobMetric.Series, func(i, j int) bool {
 				return (jobMetric.Series[i].Hostname < jobMetric.Series[j].Hostname)

From 423e800d9e1cfcd5d3886d8ee2c8d0b017d8ea9a Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Tue, 8 Aug 2023 13:27:01 +0200
Subject: [PATCH 20/62] feat: add hover-legend to histograms & metricplots

---
 web/frontend/src/Job.root.svelte             |   1 +
 web/frontend/src/Metric.svelte               |   3 +-
 web/frontend/src/Node.root.svelte            |   1 +
 web/frontend/src/Systems.root.svelte         |   3 +-
 web/frontend/src/joblist/Row.svelte          |   1 +
 web/frontend/src/plots/Histogramuplot.svelte |  72 ++++++++++---
 web/frontend/src/plots/MetricPlot.svelte     | 103 +++++++++++++++----
 7 files changed, 151 insertions(+), 33 deletions(-)

diff --git a/web/frontend/src/Job.root.svelte b/web/frontend/src/Job.root.svelte
index 6f78196..31ecdc5 100644
--- a/web/frontend/src/Job.root.svelte
+++ b/web/frontend/src/Job.root.svelte
@@ -318,6 +318,7 @@
                         scopes={item.data.map((x) => x.scope)}
                         {width}
                         isShared={$initq.data.job.exclusive != 1}
+                        resources={$initq.data.job.resources}
                     />
                 {:else}
                     <Card body color="warning"
diff --git a/web/frontend/src/Metric.svelte b/web/frontend/src/Metric.svelte
index 40ad236..8ff0a58 100644
--- a/web/frontend/src/Metric.svelte
+++ b/web/frontend/src/Metric.svelte
@@ -89,6 +89,7 @@
             timestep={data.timestep}
             scope={selectedScope} metric={metricName}
             series={series}
-            isShared={isShared} />
+            isShared={isShared}
+            resources={job.resources} />
     {/if}
 {/key}
diff --git a/web/frontend/src/Node.root.svelte b/web/frontend/src/Node.root.svelte
index daa12c5..1d001e9 100644
--- a/web/frontend/src/Node.root.svelte
+++ b/web/frontend/src/Node.root.svelte
@@ -203,6 +203,7 @@
                         subCluster={$nodeMetricsData.data.nodeMetrics[0]
                             .subCluster}
                         series={item.metric.series}
+                        resources={[{hostname: hostname}]}
                     />
                 {:else if item.disabled === true && item.metric}
                     <Card
diff --git a/web/frontend/src/Systems.root.svelte b/web/frontend/src/Systems.root.svelte
index fcca95e..eda7368 100644
--- a/web/frontend/src/Systems.root.svelte
+++ b/web/frontend/src/Systems.root.svelte
@@ -136,7 +136,8 @@
                             series={item.data.metric.series}
                             metric={item.data.name}
                             cluster={clusters.find(c => c.name == cluster)}
-                            subCluster={item.subCluster} />
+                            subCluster={item.subCluster} 
+                            resources={[{hostname: item.host}]}/>
                     {:else if item.disabled === true && item.data}
                         <Card style="margin-left: 2rem;margin-right: 2rem;" body color="info">Metric disabled for subcluster <code>{selectedMetric}:{item.subCluster}</code></Card>
                     {:else}
diff --git a/web/frontend/src/joblist/Row.svelte b/web/frontend/src/joblist/Row.svelte
index 35910bc..2117b91 100644
--- a/web/frontend/src/joblist/Row.svelte
+++ b/web/frontend/src/joblist/Row.svelte
@@ -136,6 +136,7 @@
                         {cluster}
                         subCluster={job.subCluster}
                         isShared={(job.exclusive != 1)}
+                        resources={job.resources}
                     />
                 {:else if metric.disabled == true && metric.data}
                     <Card body color="info">Metric disabled for subcluster <code>{metric.data.name}:{job.subCluster}</code></Card>
diff --git a/web/frontend/src/plots/Histogramuplot.svelte b/web/frontend/src/plots/Histogramuplot.svelte
index b652578..89e5527 100644
--- a/web/frontend/src/plots/Histogramuplot.svelte
+++ b/web/frontend/src/plots/Histogramuplot.svelte
@@ -39,8 +39,62 @@
         return renderer(u, seriesIdx, idx0, idx1, extendGap, buildClip);
     }
 
+    // converts the legend into a simple tooltip
+    function legendAsTooltipPlugin({ className, style = { backgroundColor:"rgba(255, 249, 196, 0.92)", color: "black" } } = {}) {
+        let legendEl;
+
+        function init(u, opts) {
+            legendEl = u.root.querySelector(".u-legend");
+
+            legendEl.classList.remove("u-inline");
+            className && legendEl.classList.add(className);
+
+            uPlot.assign(legendEl.style, {
+                textAlign: "left",
+                pointerEvents: "none",
+                display: "none",
+                position: "absolute",
+                left: 0,
+                top: 0,
+                zIndex: 100,
+                boxShadow: "2px 2px 10px rgba(0,0,0,0.5)",
+                ...style
+            });
+
+            // hide series color markers
+            const idents = legendEl.querySelectorAll(".u-marker");
+
+            for (let i = 0; i < idents.length; i++)
+                idents[i].style.display = "none";
+
+            const overEl = u.over;
+            overEl.style.overflow = "visible";
+
+            // move legend into plot bounds
+            overEl.appendChild(legendEl);
+
+            // show/hide tooltip on enter/exit
+            overEl.addEventListener("mouseenter", () => {legendEl.style.display = null;});
+            overEl.addEventListener("mouseleave", () => {legendEl.style.display = "none";});
+
+            // let tooltip exit plot
+        //	overEl.style.overflow = "visible";
+        }
+
+        function update(u) {
+            const { left, top } = u.cursor;
+            legendEl.style.transform = "translate(" + (left + 15) + "px, " + (top + 15) + "px)";
+        }
+
+        return {
+            hooks: {
+                init: init,
+                setCursor: update,
+            }
+        };
+    }
+
     let plotWrapper = null
-    let legendWrapper = null
     let uplot = null
     let timeoutId = null
     
@@ -48,6 +102,9 @@
         let opts = {
             width: width,
             height: height,
+            plugins: [
+				legendAsTooltipPlugin()
+			],
             cursor: {
                 points: {
                     size:   (u, seriesIdx)       => u.series[seriesIdx].points.size * 2.5,
@@ -98,15 +155,6 @@
                     values: (_, t) => t.map(v => formatNumber(v)),
                 },
             ],
-            legend : {
-                mount: (self, legend) => {
-                    legendWrapper.appendChild(legend)
-                },
-                markers: {
-                    show: false,
-                    stroke: "#000000"
-                }
-            },
             series: [
                 {
                     label: xunit,
@@ -158,9 +206,7 @@
 </script>
 
 {#if data.length > 0}
-    <div bind:this={plotWrapper}>
-        <div bind:this={legendWrapper}/>
-    </div>
+    <div bind:this={plotWrapper}/>
 {:else}
     <Card class="mx-4" body color="warning">Cannot render histogram: No data!</Card>
 {/if}
diff --git a/web/frontend/src/plots/MetricPlot.svelte b/web/frontend/src/plots/MetricPlot.svelte
index a20b307..39c99d1 100644
--- a/web/frontend/src/plots/MetricPlot.svelte
+++ b/web/frontend/src/plots/MetricPlot.svelte
@@ -26,16 +26,17 @@
     import { getContext, onMount, onDestroy } from 'svelte'
     import { Card } from 'sveltestrap'
 
+    export let metric
+    export let scope = 'node'
+    export let resources = []
     export let width
     export let height
     export let timestep
     export let series
+    export let useStatsSeries = null
     export let statisticsSeries = null
     export let cluster
     export let subCluster
-    export let metric
-    export let useStatsSeries = null
-    export let scope = 'node'
     export let isShared = false
 
     if (useStatsSeries == null)
@@ -53,6 +54,62 @@
     const backgroundColors = { normal:  'rgba(255, 255, 255, 1.0)', caution: 'rgba(255, 128, 0, 0.3)', alert: 'rgba(255, 0, 0, 0.3)' }
     const thresholds = findThresholds(metricConfig, scope, typeof subCluster == 'string' ? cluster.subClusters.find(sc => sc.name == subCluster) : subCluster)
 
+    // converts the legend into a simple tooltip
+    function legendAsTooltipPlugin({ className, style = { backgroundColor:"rgba(255, 249, 196, 0.92)", color: "black" } } = {}) {
+        let legendEl;
+
+        function init(u, opts) {
+            legendEl = u.root.querySelector(".u-legend");
+
+            legendEl.classList.remove("u-inline");
+            className && legendEl.classList.add(className);
+
+            uPlot.assign(legendEl.style, {
+                textAlign: "left",
+                pointerEvents: "none",
+                display: "none",
+                position: "absolute",
+                left: 0,
+                top: 0,
+                zIndex: 100,
+                boxShadow: "2px 2px 10px rgba(0,0,0,0.5)",
+                ...style
+            });
+
+            // hide series color markers
+            const idents = legendEl.querySelectorAll(".u-marker");
+
+            for (let i = 0; i < idents.length; i++)
+                idents[i].style.display = "none";
+
+            const overEl = u.over;
+            overEl.style.overflow = "visible";
+
+            // move legend into plot bounds
+            overEl.appendChild(legendEl);
+
+            // show/hide tooltip on enter/exit
+            overEl.addEventListener("mouseenter", () => {legendEl.style.display = null;});
+            overEl.addEventListener("mouseleave", () => {legendEl.style.display = "none";});
+
+            // let tooltip exit plot
+        //	overEl.style.overflow = "visible";
+        }
+
+        function update(u) {
+            const { left, top } = u.cursor;
+            const width = u.over.querySelector(".u-legend").offsetWidth;
+            legendEl.style.transform = "translate(" + (left - width - 15) + "px, " + (top + 15) + "px)";
+        }
+
+        return {
+            hooks: {
+                init: init,
+                setCursor: update,
+            }
+        };
+    }
+
     function backgroundColor() {
         if (clusterCockpitConfig.plot_general_colorBackground == false
             || !thresholds
@@ -93,7 +150,7 @@
             ? (statisticsSeries.max.reduce((max, x) => Math.max(max, x), thresholds.normal) || thresholds.normal)
             : (series.reduce((max, series) => Math.max(max, series.statistics?.max), thresholds.normal) || thresholds.normal)
         : null
-    const plotSeries = [{}]
+    const plotSeries = [{label: 'Runtime', value: (u, ts, sidx, didx) => didx == null ? null : formatTime(ts)}]
     const plotData = [new Array(longestSeries)]
     for (let i = 0; i < longestSeries; i++) // TODO: Cache/Reuse this array?
         plotData[0][i] = i * timestep
@@ -103,9 +160,9 @@
         plotData.push(statisticsSeries.min)
         plotData.push(statisticsSeries.max)
         plotData.push(statisticsSeries.mean)
-        plotSeries.push({ scale: 'y', width: lineWidth, stroke: 'red' })
-        plotSeries.push({ scale: 'y', width: lineWidth, stroke: 'green' })
-        plotSeries.push({ scale: 'y', width: lineWidth, stroke: 'black' })
+        plotSeries.push({ label: 'min', scale: 'y', width: lineWidth, stroke: 'red' })
+        plotSeries.push({ label: 'max', scale: 'y', width: lineWidth, stroke: 'green' })
+        plotSeries.push({ label: 'mean', scale: 'y', width: lineWidth, stroke: 'black' })
         plotBands = [
             { series: [2,3], fill: 'rgba(0,255,0,0.1)' },
             { series: [3,1], fill: 'rgba(255,0,0,0.1)' }
@@ -114,6 +171,9 @@
         for (let i = 0; i < series.length; i++) {
             plotData.push(series[i].data)
             plotSeries.push({
+                label: scope === 'node' ? resources[i].hostname : 
+                       // scope === 'accelerator' ? resources[0].accelerators[i] : 
+                       scope + ' #' + (i+1),
                 scale: 'y',
                 width: lineWidth,
                 stroke: lineColor(i, series.length)
@@ -124,6 +184,9 @@
     const opts = {
         width,
         height,
+        plugins: [
+				legendAsTooltipPlugin()
+		],
         series: plotSeries,
         axes: [
             {
@@ -177,8 +240,7 @@
             x: { time: false },
             y: maxY ? { range: [0., maxY * 1.1] } : {}
         },
-        cursor: { drag: { x: true, y: true } },
-        legend: { show: false, live: false }
+        cursor: { drag: { x: true, y: true } }
     }
 
     // console.log(opts)
@@ -249,16 +311,21 @@
     }
 </script>
 <script context="module">
-
     export function formatTime(t) {
-        let h = Math.floor(t / 3600)
-        let m = Math.floor((t % 3600) / 60)
-        if (h == 0)
-            return `${m}m`
-        else if (m == 0)
-            return `${h}h`
-        else
-            return `${h}:${m}h`
+        if (t !== null) {
+            if (isNaN(t)) {
+                return t
+            } else {
+                let h = Math.floor(t / 3600)
+                let m = Math.floor((t % 3600) / 60)
+                if (h == 0)
+                    return `${m}m`
+                else if (m == 0)
+                    return `${h}h`
+                else
+                    return `${h}:${m}h`
+            }
+        }
     }
 
     export function timeIncrs(timestep, maxX) {

From e32042204b3fceee3650b34fc2f28543ce70bdd3 Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Wed, 9 Aug 2023 12:42:25 +0200
Subject: [PATCH 21/62] Change histograms to uplot where x-axis is number

---
 web/frontend/src/Analysis.root.svelte        | 42 +++++++++++---------
 web/frontend/src/Status.root.svelte          | 30 ++++++++------
 web/frontend/src/User.root.svelte            |  4 +-
 web/frontend/src/plots/Histogramuplot.svelte |  8 ++--
 4 files changed, 49 insertions(+), 35 deletions(-)

diff --git a/web/frontend/src/Analysis.root.svelte b/web/frontend/src/Analysis.root.svelte
index 2e6f5b5..1cfadc9 100644
--- a/web/frontend/src/Analysis.root.svelte
+++ b/web/frontend/src/Analysis.root.svelte
@@ -1,10 +1,11 @@
 <script>
-    import { init } from './utils.js'
+    import { init, convert2uplot } from './utils.js'
     import { getContext, onMount } from 'svelte'
     import { queryStore, gql, getContextClient  } from '@urql/svelte'
     import { Row, Col, Spinner, Card, Table } from 'sveltestrap'
     import Filters from './filters/Filters.svelte'
     import PlotSelection from './PlotSelection.svelte'
+    import Histogramuplot from './plots/Histogramuplot.svelte'
     import Histogram, { binsFromFootprint } from './plots/Histogram.svelte'
     import ScatterPlot from './plots/Scatter.svelte'
     import PlotTable from './PlotTable.svelte'
@@ -169,22 +170,26 @@
         </div>
         <div class="col-3">
             {#key $statsQuery.data.stats[0].histDuration}
-                <h4>Duration Distribution</h4>
-                <Histogram
+                <Histogramuplot
+                    data={convert2uplot($statsQuery.data.stats[0].histDuration)}
                     width={colWidth - 25}
-                    data={$statsQuery.data.stats[0].histDuration} 
-                    xlabel="Current Runtimes [h]" 
-                    ylabel="Number of Jobs"/>
+                    title="Duration Distribution"
+                    xlabel="Current Runtimes"
+                    xunit="Hours" 
+                    ylabel="Number of Jobs"
+                    yunit="Jobs"/>
             {/key}
         </div>
         <div class="col-3">
             {#key $statsQuery.data.stats[0].histNumNodes}
-                <h4>Number of Nodes Distribution</h4>
-                <Histogram
+                <Histogramuplot
+                    data={convert2uplot($statsQuery.data.stats[0].histNumNodes)}
                     width={colWidth - 25}
-                    data={$statsQuery.data.stats[0].histNumNodes} 
-                    xlabel="Allocated Nodes [#]"
-                    ylabel="Number of Jobs" />
+                    title="Number of Nodes Distribution"
+                    xlabel="Allocated Nodes"
+                    xunit="Nodes"
+                    ylabel="Number of Jobs"
+                    yunit="Jobs"/>
             {/key}
         </div>
         <div class="col-3">
@@ -233,15 +238,16 @@
                     $footprintsQuery.data.footprints.metrics.find(f => f.metric == metric).data, numBins) }))}
                 itemsPerRow={ccconfig.plot_view_plotsPerRow}>
 
-                <h4>Average Distribution of '{item.metric}'</h4>
-                <Histogram
+                <Histogramuplot
+                    data={convert2uplot(item.bins)}
                     width={width} height={250}
-                    min={item.min} max={item.max}
-                    data={item.bins} 
-                    label={item.label}
-                    xlabel={`${item.metric} Average [${(metricConfig(cluster.name, item.metric)?.unit?.prefix ? metricConfig(cluster.name, item.metric)?.unit?.prefix : '') +
+                    title="Average Distribution of '{item.metric}'"
+                    xlabel={`${item.metric} average [${(metricConfig(cluster.name, item.metric)?.unit?.prefix ? metricConfig(cluster.name, item.metric)?.unit?.prefix : '') +
                                                        (metricConfig(cluster.name, item.metric)?.unit?.base   ? metricConfig(cluster.name, item.metric)?.unit?.base   : '')}]`}
-                    ylabel="Node Hours [h]" />
+                    xunit={`${(metricConfig(cluster.name, item.metric)?.unit?.prefix ? metricConfig(cluster.name, item.metric)?.unit?.prefix : '') +
+                              (metricConfig(cluster.name, item.metric)?.unit?.base   ? metricConfig(cluster.name, item.metric)?.unit?.base   : '')}`}
+                    ylabel="Node Hours"
+                    yunit="Hours"/>
             </PlotTable>
         </Col>
     </Row>
diff --git a/web/frontend/src/Status.root.svelte b/web/frontend/src/Status.root.svelte
index 41615a1..c979ac5 100644
--- a/web/frontend/src/Status.root.svelte
+++ b/web/frontend/src/Status.root.svelte
@@ -2,8 +2,9 @@
     import Refresher from './joblist/Refresher.svelte'
     import Roofline, { transformPerNodeData } from './plots/Roofline.svelte'
     import Histogram from './plots/Histogram.svelte'
+    import Histogramuplot from './plots/Histogramuplot.svelte'
     import { Row, Col, Spinner, Card, CardHeader, CardTitle, CardBody, Table, Progress, Icon } from 'sveltestrap'
-    import { init } from './utils.js'
+    import { init, convert2uplot } from './utils.js'
     import { scaleNumbers } from './units.js'
     import { queryStore, gql, getContextClient  } from '@urql/svelte'
 
@@ -202,27 +203,32 @@
             </Table>
         </Col>
     </Row>
-    <Row cols={2} class="mt-3">
+    <hr class="my-2"/>
+    <Row cols={2}>
         <Col class="p-2">
             <div bind:clientWidth={colWidth2}>
-                <h4 class="mb-3 text-center">Duration Distribution</h4>
                 {#key $mainQuery.data.stats}
-                    <Histogram
+                    <Histogramuplot
+                        data={convert2uplot($mainQuery.data.stats[0].histDuration)}
                         width={colWidth2 - 25}
-                        data={$mainQuery.data.stats[0].histDuration}
-                        xlabel="Current Runtimes [h]" 
-                        ylabel="Number of Jobs" />
+                        title="Duration Distribution"
+                        xlabel="Current Runtimes"
+                        xunit="Hours" 
+                        ylabel="Number of Jobs"
+                        yunit="Jobs"/>
                 {/key}
             </div>
         </Col>
         <Col class="p-2">
-            <h4 class="mb-3 text-center">Number of Nodes Distribution</h4>
             {#key $mainQuery.data.stats}
-                <Histogram
+                <Histogramuplot
+                    data={convert2uplot($mainQuery.data.stats[0].histNumNodes)}
                     width={colWidth2 - 25}
-                    data={$mainQuery.data.stats[0].histNumNodes}
-                    xlabel="Allocated Nodes [#]"
-                    ylabel="Number of Jobs" />
+                    title="Number of Nodes Distribution"
+                    xlabel="Allocated Nodes"
+                    xunit="Nodes" 
+                    ylabel="Number of Jobs"
+                    yunit="Jobs"/>
             {/key}
         </Col>
     </Row>
diff --git a/web/frontend/src/User.root.svelte b/web/frontend/src/User.root.svelte
index 55aacc1..7744884 100644
--- a/web/frontend/src/User.root.svelte
+++ b/web/frontend/src/User.root.svelte
@@ -134,11 +134,11 @@
             </Table>
         </Col>
         <div class="col-4 text-center" bind:clientWidth={w1}>
-            <b>Duration Distribution</b>
             {#key $stats.data.jobsStatistics[0].histDuration}
                 <Histogramuplot
                     data={convert2uplot($stats.data.jobsStatistics[0].histDuration)}
                     width={w2 - 25} height={histogramHeight}
+                    title="Duration Distribution"
                     xlabel="Current Runtimes"
                     xunit="Hours" 
                     ylabel="Number of Jobs"
@@ -146,11 +146,11 @@
             {/key}
         </div>
         <div class="col-4 text-center" bind:clientWidth={w2}>
-            <b>Number of Nodes Distribution</b>
             {#key $stats.data.jobsStatistics[0].histNumNodes}
                 <Histogramuplot
                     data={convert2uplot($stats.data.jobsStatistics[0].histNumNodes)}
                     width={w2 - 25} height={histogramHeight}
+                    title="Number of Nodes Distribution"
                     xlabel="Allocated Nodes"
                     xunit="Nodes"
                     ylabel="Number of Jobs"
diff --git a/web/frontend/src/plots/Histogramuplot.svelte b/web/frontend/src/plots/Histogramuplot.svelte
index 89e5527..d3e1aaa 100644
--- a/web/frontend/src/plots/Histogramuplot.svelte
+++ b/web/frontend/src/plots/Histogramuplot.svelte
@@ -13,6 +13,7 @@
     export let data
     export let width = 500
     export let height = 300
+    export let title = ''
     export let xlabel = ''
     export let xunit = 'X'
     export let ylabel = ''
@@ -29,7 +30,7 @@
         let s = u.series[seriesIdx];
         let style = s.drawStyle;
 
-        let renderer = (
+        let renderer = ( // If bars to wide, change here
             style == drawStyles.bars ? (
                 bars({size: [0.75, 100]})
             ) :
@@ -102,6 +103,7 @@
         let opts = {
             width: width,
             height: height,
+            title: title,
             plugins: [
 				legendAsTooltipPlugin()
 			],
@@ -157,10 +159,10 @@
             ],
             series: [
                 {
-                    label: xunit,
+                    label: xunit !== '' ? xunit : null,
                 },
                 Object.assign({
-                    label: yunit,
+                    label:  yunit !== '' ? yunit : null,
                     width: 1 / devicePixelRatio,
                     drawStyle: drawStyles.points,
                     lineInterpolation: null,

From f286872a3304fb0d69bff9b46dc27f9dbd6ce47b Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Wed, 9 Aug 2023 12:43:58 +0200
Subject: [PATCH 22/62] fix: hover legend display now depends on datasize

---
 web/frontend/src/plots/MetricPlot.svelte | 34 ++++++++++++++++--------
 1 file changed, 23 insertions(+), 11 deletions(-)

diff --git a/web/frontend/src/plots/MetricPlot.svelte b/web/frontend/src/plots/MetricPlot.svelte
index 39c99d1..509672c 100644
--- a/web/frontend/src/plots/MetricPlot.svelte
+++ b/web/frontend/src/plots/MetricPlot.svelte
@@ -57,6 +57,7 @@
     // converts the legend into a simple tooltip
     function legendAsTooltipPlugin({ className, style = { backgroundColor:"rgba(255, 249, 196, 0.92)", color: "black" } } = {}) {
         let legendEl;
+        const dataSize = series.length
 
         function init(u, opts) {
             legendEl = u.root.querySelector(".u-legend");
@@ -76,11 +77,14 @@
                 ...style
             });
 
-            // hide series color markers
-            const idents = legendEl.querySelectorAll(".u-marker");
-
-            for (let i = 0; i < idents.length; i++)
-                idents[i].style.display = "none";
+            // conditional hide series color markers:
+            if (useStatsSeries === true || // Min/Max/Avg Self-Explanatory
+                dataSize === 1          || // Only one Y-Dataseries
+                dataSize > 6            ){ // More than 6 Y-Dataseries
+                const idents = legendEl.querySelectorAll(".u-marker");
+                for (let i = 0; i < idents.length; i++)
+                    idents[i].style.display = "none";
+            }
 
             const overEl = u.over;
             overEl.style.overflow = "visible";
@@ -93,7 +97,7 @@
             overEl.addEventListener("mouseleave", () => {legendEl.style.display = "none";});
 
             // let tooltip exit plot
-        //	overEl.style.overflow = "visible";
+            // overEl.style.overflow = "visible";
         }
 
         function update(u) {
@@ -102,12 +106,16 @@
             legendEl.style.transform = "translate(" + (left - width - 15) + "px, " + (top + 15) + "px)";
         }
 
-        return {
-            hooks: {
-                init: init,
-                setCursor: update,
+        if (dataSize <= 12 || useStatsSeries === true) {
+            return {
+                hooks: {
+                    init: init,
+                    setCursor: update,
+                }
             }
-        };
+        } else { // Setting legend-opts show/live as object with false here will not work ...
+            return {}
+        }
     }
 
     function backgroundColor() {
@@ -240,6 +248,10 @@
             x: { time: false },
             y: maxY ? { range: [0., maxY * 1.1] } : {}
         },
+        legend : { // Display legend until max 12 Y-dataseries
+            show: (series.length <= 12 || useStatsSeries === true) ? true : false,
+            live: (series.length <= 12 || useStatsSeries === true) ? true : false
+        },
         cursor: { drag: { x: true, y: true } }
     }
 

From 163462b29c5874f24cf915b42b7b1d7cebe70c1c Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Wed, 9 Aug 2023 16:34:00 +0200
Subject: [PATCH 23/62] pre-sort numerical ids in statstable

- sorting still fixed if not nodescope
---
 web/frontend/src/StatsTableEntry.svelte | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/web/frontend/src/StatsTableEntry.svelte b/web/frontend/src/StatsTableEntry.svelte
index 6e96c1f..8871681 100644
--- a/web/frontend/src/StatsTableEntry.svelte
+++ b/web/frontend/src/StatsTableEntry.svelte
@@ -4,9 +4,14 @@
     export let scope
     export let jobMetrics
 
+    function compareIds(a, b) {
+        return a.id - b.id;
+    }
+
     $: series = jobMetrics
         .find(jm => jm.name == metric && jm.scope == scope)
         ?.metric.series.filter(s => s.hostname == host && s.statistics != null)
+        ?.sort(compareIds)
 </script>
 
 {#if series == null || series.length == 0}

From ed056b065e49f4ecd6fa65f8b33938e94ac7886e Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Wed, 9 Aug 2023 17:24:01 +0200
Subject: [PATCH 24/62] feat: add sorting in sub-node scopes in statsTable

---
 web/frontend/src/StatsTableEntry.svelte | 44 +++++++++++++++++++++++--
 1 file changed, 42 insertions(+), 2 deletions(-)

diff --git a/web/frontend/src/StatsTableEntry.svelte b/web/frontend/src/StatsTableEntry.svelte
index 8871681..5e497d4 100644
--- a/web/frontend/src/StatsTableEntry.svelte
+++ b/web/frontend/src/StatsTableEntry.svelte
@@ -1,17 +1,49 @@
 <script>
+    import { Icon } from 'sveltestrap'
+    
     export let host
     export let metric
     export let scope
     export let jobMetrics
 
-    function compareIds(a, b) {
+    function compareNumbers(a, b) {
         return a.id - b.id;
     }
 
+    function sortByField(field) {
+        let s = sorting[field]
+        if (s.active) {
+            s.dir = s.dir == 'up' ? 'down' : 'up'
+        } else {
+            for (let field in sorting)
+                sorting[field].active = false
+            s.active = true
+        }
+
+        sorting = {...sorting}
+        series = series.sort((a, b) => {
+            if (a == null || b == null)
+                return -1
+
+            if (field === 'id') {
+                return s.dir != 'up' ? a[field] - b[field] : b[field] - a[field]
+            } else {
+                return s.dir != 'up' ? a.statistics[field] - b.statistics[field] : b.statistics[field] - a.statistics[field]
+            }
+        })    
+    }
+
+    let sorting = {
+            id:  { dir: 'down', active: true },
+            min: { dir: 'up', active: false },
+            avg: { dir: 'up', active: false },
+            max: { dir: 'up', active: false },
+    }
+
     $: series = jobMetrics
         .find(jm => jm.name == metric && jm.scope == scope)
         ?.metric.series.filter(s => s.hostname == host && s.statistics != null)
-        ?.sort(compareIds)
+        ?.sort(compareNumbers)
 </script>
 
 {#if series == null || series.length == 0}
@@ -29,6 +61,14 @@
 {:else}
     <td colspan="4">
         <table style="width: 100%;">
+            <tr>
+                {#each ['id', 'min', 'avg', 'max'] as field}
+                    <th on:click={() => sortByField(field)}>
+                        Sort
+                        <Icon name="caret-{sorting[field].dir}{sorting[field].active ? '-fill' : ''}" />
+                    </th>
+                {/each}
+            </tr>
             {#each series as s, i}
                 <tr>
                     <th>{s.id ?? i}</th>

From b42a11d30e05eec1d09e7885080e7088d8b42c3e Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Thu, 10 Aug 2023 12:05:02 +0200
Subject: [PATCH 25/62] feat: Use chart.js for polarplot n jobview

---
 web/frontend/src/Job.root.svelte    |   7 +-
 web/frontend/src/plots/Polar.svelte | 199 ++++++++--------------------
 2 files changed, 55 insertions(+), 151 deletions(-)

diff --git a/web/frontend/src/Job.root.svelte b/web/frontend/src/Job.root.svelte
index 31ecdc5..ebfdeae 100644
--- a/web/frontend/src/Job.root.svelte
+++ b/web/frontend/src/Job.root.svelte
@@ -20,12 +20,11 @@
     } from "sveltestrap";
     import PlotTable from "./PlotTable.svelte";
     import Metric from "./Metric.svelte";
-    import PolarPlot from "./plots/Polar.svelte";
+    import Polar from "./plots/Polar.svelte";
     import Roofline from "./plots/Roofline.svelte";
     import JobInfo from "./joblist/JobInfo.svelte";
     import TagManagement from "./TagManagement.svelte";
     import MetricSelection from "./MetricSelection.svelte";
-    import Zoom from "./Zoom.svelte";
     import StatsTable from "./StatsTable.svelte";
     import { getContext } from "svelte";
 
@@ -233,7 +232,7 @@
             {/if}
         {/if}
         <Col>
-            <PolarPlot
+            <Polar
                 width={polarPlotSize}
                 height={polarPlotSize}
                 metrics={ccconfig[
@@ -246,7 +245,7 @@
         <Col>
             <Roofline
                 width={fullWidth / 3 - 10}
-                height={polarPlotSize}
+                height={polarPlotSize + 20}
                 cluster={clusters
                     .find((c) => c.name == $initq.data.job.cluster)
                     .subClusters.find(
diff --git a/web/frontend/src/plots/Polar.svelte b/web/frontend/src/plots/Polar.svelte
index 6a013dc..cb99ba7 100644
--- a/web/frontend/src/plots/Polar.svelte
+++ b/web/frontend/src/plots/Polar.svelte
@@ -1,22 +1,35 @@
-<div>
-    <canvas bind:this={canvasElement} width="{width}" height="{height}"></canvas>
-</div>
-
 <script>
-    import { onMount, getContext } from 'svelte'
+    import { getContext } from 'svelte'
+    import { Radar } from 'svelte-chartjs';
+    import {
+        Chart as ChartJS,
+        Title,
+        Tooltip,
+        Legend,
+        Filler,
+        PointElement,
+        RadialLinearScale,
+        LineElement
+    } from 'chart.js';
+
+    ChartJS.register(
+        Title,
+        Tooltip,
+        Legend,
+        Filler,
+        PointElement,
+        RadialLinearScale,
+        LineElement
+    );
 
-    export let metrics
     export let width
     export let height
+    export let metrics
     export let cluster
     export let jobMetrics
 
-    const fontSize = 12
-    const fontFamily = 'system-ui, -apple-system, "Segoe UI", Roboto, "Helvetica Neue", Arial, "Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji"'
     const metricConfig = getContext('metrics')
 
-    let ctx, canvasElement
-
     const labels = metrics.filter(name => {
         if (!jobMetrics.find(m => m.name == name && m.scope == "node")) {
             console.warn(`PolarPlot: No metric data for '${name}'`)
@@ -46,145 +59,37 @@
         return avg / metric.series.length
     }
 
-    const data = [
-        {
-            name: 'Max',
-            values: getValuesForStat(getMax),
-            color: 'rgb(0, 102, 255)',
-            areaColor: 'rgba(0, 102, 255, 0.25)'
-        },
-        {
-            name: 'Avg',
-            values: getValuesForStat(getAvg),
-            color: 'rgb(255, 153, 0)',
-            areaColor: 'rgba(255, 153, 0, 0.25)'
-        }
-    ]
-
-    function render() {
-        if (!width || Number.isNaN(width))
-            return
-
-        const centerX = width / 2
-        const centerY = height / 2 - 15
-        const radius = (Math.min(width, height) / 2) - 50
-
-        // Draw circles
-        ctx.lineWidth = 1
-        ctx.strokeStyle = '#999999'
-        ctx.beginPath()
-        ctx.arc(centerX, centerY, radius * 1.0, 0, Math.PI * 2, false)
-        ctx.stroke()
-        ctx.beginPath()
-        ctx.arc(centerX, centerY, radius * 0.666, 0, Math.PI * 2, false)
-        ctx.stroke()
-        ctx.beginPath()
-        ctx.arc(centerX, centerY, radius * 0.333, 0, Math.PI * 2, false)
-        ctx.stroke()
-
-        // Axis
-        ctx.font = `${fontSize}px ${fontFamily}`
-        ctx.textAlign = 'center'
-        ctx.fillText('1/3',
-            Math.floor(centerX + radius * 0.333),
-            Math.floor(centerY + 15))
-        ctx.fillText('2/3',
-            Math.floor(centerX + radius * 0.666),
-            Math.floor(centerY + 15))
-        ctx.fillText('1.0',
-            Math.floor(centerX + radius * 1.0),
-            Math.floor(centerY + 15))
-
-        // Label text and straight lines from center
-        for (let i = 0; i < labels.length; i++) {
-            const angle = 2 * Math.PI * ((i + 1) / labels.length)
-            const dx = Math.cos(angle) * radius
-            const dy = Math.sin(angle) * radius
-            ctx.fillText(labels[i],
-                Math.floor(centerX + dx * 1.1),
-                Math.floor(centerY + dy * 1.1))
-
-            ctx.beginPath()
-            ctx.moveTo(centerX, centerY)
-            ctx.lineTo(centerX + dx, centerY + dy)
-            ctx.stroke()
-        }
-
-        for (let dataset of data) {
-            console.assert(dataset.values.length === labels.length, 'this will look confusing')
-            ctx.fillStyle = dataset.color
-            ctx.strokeStyle = dataset.color
-            const points = []
-            for (let i = 0; i < dataset.values.length; i++) {
-                const value = dataset.values[i]
-                const angle = 2 * Math.PI * ((i + 1) / labels.length)
-                const x = centerX + Math.cos(angle) * radius * value
-                const y = centerY + Math.sin(angle) * radius * value
-
-                ctx.beginPath()
-                ctx.arc(x, y, 3, 0, Math.PI * 2, false)
-                ctx.fill()
-
-                points.push({ x, y })
+    const data = {
+        labels: labels,
+        datasets: [
+            {
+                label: 'Max',
+                data: getValuesForStat(getMax),
+                fill: 1,
+                backgroundColor: 'rgba(0, 102, 255, 0.25)',
+                borderColor: 'rgb(0, 102, 255)',
+                pointBackgroundColor: 'rgb(0, 102, 255)',
+                pointBorderColor: '#fff',
+                pointHoverBackgroundColor: '#fff',
+                pointHoverBorderColor: 'rgb(0, 102, 255)'
+            },
+            {
+                label: 'Avg',
+                data: getValuesForStat(getAvg),
+                fill: true,
+                backgroundColor: 'rgba(255, 153, 0, 0.25)',
+                borderColor: 'rgb(255, 153, 0)',
+                pointBackgroundColor: 'rgb(255, 153, 0)',
+                pointBorderColor: '#fff',
+                pointHoverBackgroundColor: '#fff',
+                pointHoverBorderColor: 'rgb(255, 153, 0)'
             }
-
-            // "Fill" the shape this dataset has
-            ctx.fillStyle = dataset.areaColor
-            ctx.beginPath()
-            ctx.moveTo(points[0].x, points[0].y)
-            for (let p of points)
-                ctx.lineTo(p.x, p.y)
-            ctx.lineTo(points[0].x, points[0].y)
-            ctx.stroke()
-            ctx.fill()
-        }
-
-        // Legend at the bottom left corner
-        ctx.textAlign = 'left'
-        let paddingLeft = 0
-        for (let dataset of data) {
-            const text = `${dataset.name}: `
-            const textWidth = ctx.measureText(text).width
-            ctx.fillStyle = 'black'
-            ctx.fillText(text, paddingLeft, height - 20)
-
-            ctx.fillStyle = dataset.color
-            ctx.beginPath()
-            ctx.arc(paddingLeft + textWidth + 5, height - 25, 5, 0, Math.PI * 2, false)
-            ctx.fill()
-
-            paddingLeft += textWidth + 15
-        }
-        ctx.fillStyle = 'black'
-        ctx.fillText(`Values relative to respective peak.`, 0, height - 7)
+        ]
     }
 
-    let mounted = false
-    onMount(() => {
-        canvasElement.width = width
-        canvasElement.height = height
-        ctx = canvasElement.getContext('2d')
-        render(ctx, data, width, height)
-        mounted = true
-    })
+    // No custom defined options but keep for clarity 
+    const options = {}
 
-    let timeoutId = null
-    function sizeChanged() {
-        if (!mounted)
-            return;
-
-        if (timeoutId != null)
-            clearTimeout(timeoutId)
-
-        timeoutId = setTimeout(() => {
-            timeoutId = null
-
-            canvasElement.width = width
-            canvasElement.height = height
-            ctx = canvasElement.getContext('2d')
-            render(ctx, data, width, height)
-        }, 250)
-    }
-
-    $: sizeChanged(width, height)
 </script>
+
+<Radar {data} {options} {width} {height}/>

From bbd8637ca6770050e80c88bc19b2298c1ba56d7e Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Thu, 10 Aug 2023 15:10:06 +0200
Subject: [PATCH 26/62] Fix Polar sizing

- Note: Not adaptive to viewport size, but will snap to grid
---
 web/frontend/src/Job.root.svelte    |  6 ++----
 web/frontend/src/plots/Polar.svelte | 18 ++++++++++++++----
 2 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/web/frontend/src/Job.root.svelte b/web/frontend/src/Job.root.svelte
index ebfdeae..09d3fac 100644
--- a/web/frontend/src/Job.root.svelte
+++ b/web/frontend/src/Job.root.svelte
@@ -120,7 +120,6 @@
         jobTags,
         fullWidth,
         statsTable;
-    $: polarPlotSize = Math.min(fullWidth / 3 - 10, 300);
     $: document.title = $initq.fetching
         ? "Loading..."
         : $initq.error
@@ -233,8 +232,7 @@
         {/if}
         <Col>
             <Polar
-                width={polarPlotSize}
-                height={polarPlotSize}
+                size={fullWidth / 4.1}
                 metrics={ccconfig[
                     `job_view_polarPlotMetrics:${$initq.data.job.cluster}`
                 ] || ccconfig[`job_view_polarPlotMetrics`]}
@@ -245,7 +243,7 @@
         <Col>
             <Roofline
                 width={fullWidth / 3 - 10}
-                height={polarPlotSize + 20}
+                height={fullWidth / 5}
                 cluster={clusters
                     .find((c) => c.name == $initq.data.job.cluster)
                     .subClusters.find(
diff --git a/web/frontend/src/plots/Polar.svelte b/web/frontend/src/plots/Polar.svelte
index cb99ba7..bf4385f 100644
--- a/web/frontend/src/plots/Polar.svelte
+++ b/web/frontend/src/plots/Polar.svelte
@@ -22,8 +22,7 @@
         LineElement
     );
 
-    export let width
-    export let height
+    export let size
     export let metrics
     export let cluster
     export let jobMetrics
@@ -88,8 +87,19 @@
     }
 
     // No custom defined options but keep for clarity 
-    const options = {}
+    const options = {
+        maintainAspectRatio: false,
+    }
 
 </script>
 
-<Radar {data} {options} {width} {height}/>
+<div class="chart-container">
+    <Radar {data} {options} width={size} height={size}/>
+</div>
+
+<style>
+    .chart-container {
+        margin: auto;
+        position: relative;
+    }
+</style>
\ No newline at end of file

From da8cefe15378ce7bb2dfe0505ab3b8fb90ed9ca3 Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Thu, 10 Aug 2023 18:05:16 +0200
Subject: [PATCH 27/62] feat: Change histogram to piechart in status view

---
 web/frontend/src/Status.root.svelte | 29 ++++++-----
 web/frontend/src/User.root.svelte   |  2 +-
 web/frontend/src/plots/Pie.svelte   | 78 +++++++++++++++++++++++++++++
 3 files changed, 95 insertions(+), 14 deletions(-)
 create mode 100644 web/frontend/src/plots/Pie.svelte

diff --git a/web/frontend/src/Status.root.svelte b/web/frontend/src/Status.root.svelte
index c979ac5..5d96995 100644
--- a/web/frontend/src/Status.root.svelte
+++ b/web/frontend/src/Status.root.svelte
@@ -1,7 +1,7 @@
 <script>
     import Refresher from './joblist/Refresher.svelte'
     import Roofline, { transformPerNodeData } from './plots/Roofline.svelte'
-    import Histogram from './plots/Histogram.svelte'
+    import Pie from './plots/Pie.svelte'
     import Histogramuplot from './plots/Histogramuplot.svelte'
     import { Row, Col, Spinner, Card, CardHeader, CardTitle, CardBody, Table, Progress, Icon } from 'sveltestrap'
     import { init, convert2uplot } from './utils.js'
@@ -160,13 +160,15 @@
     <Row cols={4}>
         <Col class="p-2">
             <div bind:clientWidth={colWidth1}>
-                <h4 class="mb-3 text-center">Top Users</h4>
+                <h4 class="text-center">Top Users</h4>
                 {#key $mainQuery.data}
-                    <Histogram
-                        width={colWidth1 - 25}
-                        data={$mainQuery.data.topUsers.sort((a, b) => b.count - a.count).map(({ count }, idx) => ({ count, value: idx }))}
-                        label={(x) => x < $mainQuery.data.topUsers.length ? $mainQuery.data.topUsers[Math.floor(x)].name : '0'}
-                        xlabel="User Name" ylabel="Number of Jobs" />
+                    <Pie
+                        size={colWidth1}
+                        sliceLabel='Jobs'
+                        quantities={$mainQuery.data.topUsers.sort((a, b) => b.count - a.count).map((tu) => tu.count)}
+                        entities={$mainQuery.data.topUsers.sort((a, b) => b.count - a.count).map((tu) => tu.name)}
+                        
+                    />
                 {/key}
             </div>
         </Col>
@@ -182,13 +184,14 @@
             </Table>
         </Col>
         <Col class="p-2">
-            <h4 class="mb-3 text-center">Top Projects</h4>
+            <h4 class="text-center">Top Projects</h4>
             {#key $mainQuery.data}
-                <Histogram
-                    width={colWidth1 - 25}
-                    data={$mainQuery.data.topProjects.sort((a, b) => b.count - a.count).map(({ count }, idx) => ({ count, value: idx }))}
-                    label={(x) => x < $mainQuery.data.topProjects.length ? $mainQuery.data.topProjects[Math.floor(x)].name : '0'}
-                    xlabel="Project Code" ylabel="Number of Jobs" />
+                <Pie
+                    size={colWidth1}
+                    sliceLabel='Jobs'
+                    quantities={$mainQuery.data.topProjects.sort((a, b) => b.count - a.count).map((tp) => tp.count)}
+                    entities={$mainQuery.data.topProjects.sort((a, b) => b.count - a.count).map((tp) => tp.name)}
+                />
             {/key}
         </Col>
         <Col class="px-4 py-2">
diff --git a/web/frontend/src/User.root.svelte b/web/frontend/src/User.root.svelte
index 7744884..c874105 100644
--- a/web/frontend/src/User.root.svelte
+++ b/web/frontend/src/User.root.svelte
@@ -137,7 +137,7 @@
             {#key $stats.data.jobsStatistics[0].histDuration}
                 <Histogramuplot
                     data={convert2uplot($stats.data.jobsStatistics[0].histDuration)}
-                    width={w2 - 25} height={histogramHeight}
+                    width={w1 - 25} height={histogramHeight}
                     title="Duration Distribution"
                     xlabel="Current Runtimes"
                     xunit="Hours" 
diff --git a/web/frontend/src/plots/Pie.svelte b/web/frontend/src/plots/Pie.svelte
new file mode 100644
index 0000000..1bdc2ec
--- /dev/null
+++ b/web/frontend/src/plots/Pie.svelte
@@ -0,0 +1,78 @@
+<script>
+    // import { getContext } from 'svelte'
+    import { Pie } from 'svelte-chartjs';
+    import {
+        Chart as ChartJS,
+        Title,
+        Tooltip,
+        Legend,
+        ArcElement,
+        CategoryScale
+    } from 'chart.js';
+
+    ChartJS.register(
+        Title,
+        Tooltip,
+        Legend,
+        ArcElement,
+        CategoryScale
+    );
+
+    export let size
+    export let sliceLabel
+    export let quantities
+    export let entities
+    export let displayLegend = false
+
+    // http://tsitsul.in/blog/coloropt/ : 12 colors normal
+    const colors = [
+        'rgb(235,172,35)',
+        'rgb(184,0,88)',
+        'rgb(0,140,249)',
+        'rgb(0,110,0)',
+        'rgb(0,187,173)',
+        'rgb(209,99,230)',
+        'rgb(178,69,2)',
+        'rgb(255,146,135)',
+        'rgb(89,84,214)',
+        'rgb(0,198,248)',
+        'rgb(135,133,0)',
+        'rgb(0,167,108)',
+        'rgb(189,189,189)'
+    ]
+
+    const data = {
+        labels: entities,
+        datasets: [
+            {
+                label: sliceLabel,
+                data: quantities,
+                fill: 1,
+                backgroundColor: colors.slice(0, quantities.length),            
+            }
+        ]
+    }
+
+    const options = { 
+        maintainAspectRatio: false,
+        plugins: {
+            legend: {
+                display: displayLegend
+            }
+        }
+    }
+
+</script>
+
+<div class="chart-container" style="--container-width: {size}; --container-height: {size}">
+    <Pie {data} {options}/>
+</div>
+
+<style>
+    .chart-container {
+        position: relative;
+        margin: auto;
+        height: var(--container-height);
+        width: var(--container-width);
+    }
+</style>

From e80ce7a4742f4cfe19efb6170ade0d7f53b847ca Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Thu, 10 Aug 2023 18:06:19 +0200
Subject: [PATCH 28/62] feat: Rework analysis view top to contain piechart

---
 web/frontend/src/Analysis.root.svelte | 134 +++++++++++++++-----------
 1 file changed, 78 insertions(+), 56 deletions(-)

diff --git a/web/frontend/src/Analysis.root.svelte b/web/frontend/src/Analysis.root.svelte
index 1cfadc9..ba04e05 100644
--- a/web/frontend/src/Analysis.root.svelte
+++ b/web/frontend/src/Analysis.root.svelte
@@ -6,7 +6,8 @@
     import Filters from './filters/Filters.svelte'
     import PlotSelection from './PlotSelection.svelte'
     import Histogramuplot from './plots/Histogramuplot.svelte'
-    import Histogram, { binsFromFootprint } from './plots/Histogram.svelte'
+    import Pie from './plots/Pie.svelte'
+    import { binsFromFootprint } from './plots/Histogram.svelte'
     import ScatterPlot from './plots/Scatter.svelte'
     import PlotTable from './PlotTable.svelte'
     import Roofline from './plots/Roofline.svelte'
@@ -30,7 +31,7 @@
     let filterComponent; // see why here: https://stackoverflow.com/questions/58287729/how-can-i-export-a-function-from-a-svelte-component-that-changes-a-value-in-the
     let jobFilters = [];
     let rooflineMaxY;
-    let colWidth;
+    let colWidth1, colWidth2, colWidth3, colWidth4;
     let numBins = 50;
     let maxY = -1;
     const ccconfig = getContext('cc-config')
@@ -135,82 +136,103 @@
         </Col>
     </Row>
 {:else if $statsQuery.data}
-    <Row>
-        <div class="col-3" bind:clientWidth={colWidth}>
-            <div style="height: 40%">
-                <Table>
-                    <tr>
-                        <th scope="col">Total Jobs</th>
-                        <td>{$statsQuery.data.stats[0].totalJobs}</td>
-                    </tr>
-                    <tr>
-                        <th scope="col">Short Jobs</th>
-                        <td>{$statsQuery.data.stats[0].shortJobs}</td>
-                    </tr>
-                    <tr>
-                        <th scope="col">Total Walltime</th>
-                        <td>{$statsQuery.data.stats[0].totalWalltime}</td>
-                    </tr>
-                    <tr>
-                        <th scope="col">Total Core Hours</th>
-                        <td>{$statsQuery.data.stats[0].totalCoreHours}</td>
-                    </tr>
-                </Table>
+    <Row cols={3} class="mb-4">
+        <Col>
+            <Table>
+                <tr>
+                    <th scope="col">Total Jobs</th>
+                    <td>{$statsQuery.data.stats[0].totalJobs}</td>
+                </tr>
+                <tr>
+                    <th scope="col">Short Jobs</th>
+                    <td>{$statsQuery.data.stats[0].shortJobs}</td>
+                </tr>
+                <tr>
+                    <th scope="col">Total Walltime</th>
+                    <td>{$statsQuery.data.stats[0].totalWalltime}</td>
+                </tr>
+                <tr>
+                    <th scope="col">Total Core Hours</th>
+                    <td>{$statsQuery.data.stats[0].totalCoreHours}</td>
+                </tr>
+            </Table>
+        </Col>
+        <Col>
+            <div bind:clientWidth={colWidth1}>
+            <h5>Top Users</h5>
+            {#key $statsQuery.data.topUsers}
+            <Pie
+                size={colWidth1}
+                sliceLabel='Hours'
+                quantities={$statsQuery.data.topUsers.sort((a, b) => b.count - a.count).map((tu) => tu.count)}
+                entities={$statsQuery.data.topUsers.sort((a, b) => b.count - a.count).map((tu) => tu.name)}
+            />
+            {/key}
             </div>
-            <div style="height: 60%;">
-                {#key $statsQuery.data.topUsers}
-                    <h4>Top Users (by node hours)</h4>
-                    <Histogram
-                        width={colWidth - 25} height={300 * 0.5} small={true}
-                        data={$statsQuery.data.topUsers.sort((a, b) => b.count - a.count).map(({ count }, idx) => ({ count, value: idx }))}
-                        label={(x) => x < $statsQuery.data.topUsers.length ? $statsQuery.data.topUsers[Math.floor(x)].name : 'No Users'} 
-                        ylabel="Node Hours [h]"/>
+        </Col>
+        <Col>
+            <Table>
+                <tr class="mb-2"><th>User Name</th><th>Node Hours</th></tr>
+                {#each $statsQuery.data.topUsers.sort((a, b) => b.count - a.count) as { name, count }}
+                    <tr>
+                        <th scope="col"><a href="/monitoring/user/{name}?cluster={cluster.name}">{name}</a></th>
+                        <td>{count}</td>
+                    </tr>
+                {/each}
+            </Table>
+        </Col>
+    </Row>
+    <Row cols={3} class="mb-2">
+        <Col>
+            {#if $rooflineQuery.fetching}
+                <Spinner />
+            {:else if $rooflineQuery.error}
+                <Card body color="danger">{$rooflineQuery.error.message}</Card>
+            {:else if $rooflineQuery.data && cluster}
+                <div bind:clientWidth={colWidth2}>
+                {#key $rooflineQuery.data}
+                    <Roofline
+                        width={colWidth2} height={300}
+                        tiles={$rooflineQuery.data.rooflineHeatmap}
+                        cluster={cluster.subClusters.length == 1 ? cluster.subClusters[0] : null}
+                        maxY={rooflineMaxY} />
                 {/key}
-            </div>
-        </div>
-        <div class="col-3">
+                </div>
+            {/if}
+        </Col>
+        <Col>
+            <div bind:clientWidth={colWidth3}>
             {#key $statsQuery.data.stats[0].histDuration}
                 <Histogramuplot
+                    width={colWidth3} height={300}
                     data={convert2uplot($statsQuery.data.stats[0].histDuration)}
-                    width={colWidth - 25}
                     title="Duration Distribution"
                     xlabel="Current Runtimes"
                     xunit="Hours" 
                     ylabel="Number of Jobs"
                     yunit="Jobs"/>
             {/key}
-        </div>
-        <div class="col-3">
+            </div>
+        </Col>
+        <Col>
+            <div bind:clientWidth={colWidth4}>
             {#key $statsQuery.data.stats[0].histNumNodes}
                 <Histogramuplot
+                    width={colWidth4} height={300}
                     data={convert2uplot($statsQuery.data.stats[0].histNumNodes)}
-                    width={colWidth - 25}
                     title="Number of Nodes Distribution"
                     xlabel="Allocated Nodes"
                     xunit="Nodes"
                     ylabel="Number of Jobs"
                     yunit="Jobs"/>
             {/key}
-        </div>
-        <div class="col-3">
-            {#if $rooflineQuery.fetching}
-                <Spinner />
-            {:else if $rooflineQuery.error}
-                <Card body color="danger">{$rooflineQuery.error.message}</Card>
-            {:else if $rooflineQuery.data && cluster}
-                {#key $rooflineQuery.data}
-                    <Roofline
-                        width={colWidth - 25}
-                        tiles={$rooflineQuery.data.rooflineHeatmap}
-                        cluster={cluster.subClusters.length == 1 ? cluster.subClusters[0] : null}
-                        maxY={rooflineMaxY} />
-                {/key}
-            {/if}
-        </div>
+            </div>
+        </Col>
     </Row>
 {/if}
 
-<br/>
+<hr class="my-6"/>
+
 {#if $footprintsQuery.error}
     <Row>
         <Col>
@@ -284,7 +306,7 @@
 {/if}
 
 <style>
-    h4 {
+    h5 {
         text-align: center;
     }
 </style>

From e91cdf6b793a4217852c7385dd088f739f22838e Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Fri, 11 Aug 2023 09:15:43 +0200
Subject: [PATCH 29/62] Add dependencies

---
 web/frontend/package-lock.json | 217 ++++++++++++++++++---------------
 web/frontend/package.json      |   2 +
 2 files changed, 124 insertions(+), 95 deletions(-)

diff --git a/web/frontend/package-lock.json b/web/frontend/package-lock.json
index b00380d..0d1e68d 100644
--- a/web/frontend/package-lock.json
+++ b/web/frontend/package-lock.json
@@ -11,7 +11,9 @@
       "dependencies": {
         "@rollup/plugin-replace": "^5.0.2",
         "@urql/svelte": "^4.0.1",
+        "chart.js": "^4.3.3",
         "graphql": "^16.6.0",
+        "svelte-chartjs": "^3.1.2",
         "sveltestrap": "^5.10.0",
         "uplot": "^1.6.24",
         "wonka": "^6.3.2"
@@ -27,9 +29,9 @@
       }
     },
     "node_modules/@0no-co/graphql.web": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@0no-co/graphql.web/-/graphql.web-1.0.1.tgz",
-      "integrity": "sha512-6Yaxyv6rOwRkLIvFaL0NrLDgfNqC/Ng9QOPmTmlqW4mORXMEKmh5NYGkIvvt5Yw8fZesnMAqkj8cIqTj8f40cQ==",
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/@0no-co/graphql.web/-/graphql.web-1.0.4.tgz",
+      "integrity": "sha512-W3ezhHGfO0MS1PtGloaTpg0PbaT8aZSmmaerL7idtU5F7oCI+uu25k+MsMS31BVFlp4aMkHSrNRxiD72IlK8TA==",
       "peerDependencies": {
         "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0"
       },
@@ -40,9 +42,9 @@
       }
     },
     "node_modules/@jridgewell/gen-mapping": {
-      "version": "0.3.2",
-      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.2.tgz",
-      "integrity": "sha512-mh65xKQAzI6iBcFzwv28KVWSmCkdRBWoOh+bYQGW3+6OZvbbN3TqMGo5hqYxQniRcH9F2VZIoJCm4pa3BPDK/A==",
+      "version": "0.3.3",
+      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.3.tgz",
+      "integrity": "sha512-HLhSWOLRi875zjjMG/r+Nv0oCW8umGb0BgEhyX3dDX3egwZtB8PqLnjz3yedt8R5StBrzcg4aBpnh8UA9D1BoQ==",
       "dev": true,
       "dependencies": {
         "@jridgewell/set-array": "^1.0.1",
@@ -54,9 +56,9 @@
       }
     },
     "node_modules/@jridgewell/resolve-uri": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.0.tgz",
-      "integrity": "sha512-F2msla3tad+Mfht5cJq7LSXcdudKTWCVYUgw6pLFOOHSTtZlj6SWNYAp+AhuqLmWdBO2X5hPrLcu8cVP8fy28w==",
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.1.tgz",
+      "integrity": "sha512-dSYZh7HhCDtCKm4QakX0xFpsRDqjjtZf/kjI/v3T3Nwt5r8/qz/M19F9ySyOqU94SXBmeG9ttTul+YnR4LOxFA==",
       "dev": true,
       "engines": {
         "node": ">=6.0.0"
@@ -72,9 +74,9 @@
       }
     },
     "node_modules/@jridgewell/source-map": {
-      "version": "0.3.2",
-      "resolved": "https://registry.npmjs.org/@jridgewell/source-map/-/source-map-0.3.2.tgz",
-      "integrity": "sha512-m7O9o2uR8k2ObDysZYzdfhb08VuEml5oWGiosa1VdaPZ/A6QyPkAJuwN0Q1lhULOf6B7MtQmHENS743hWtCrgw==",
+      "version": "0.3.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/source-map/-/source-map-0.3.5.tgz",
+      "integrity": "sha512-UTYAUj/wviwdsMfzoSJspJxbkH5o1snzwX0//0ENX1u/55kkZZkcTZP6u9bwKGkv+dkk9at4m1Cpt0uY80kcpQ==",
       "dev": true,
       "dependencies": {
         "@jridgewell/gen-mapping": "^0.3.0",
@@ -82,24 +84,29 @@
       }
     },
     "node_modules/@jridgewell/sourcemap-codec": {
-      "version": "1.4.14",
-      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.4.14.tgz",
-      "integrity": "sha512-XPSJHWmi394fuUuzDnGz1wiKqWfo1yXecHQMRf2l6hztTO+nPru658AyDngaBe7isIxEkRsPR3FZh+s7iVa4Uw=="
+      "version": "1.4.15",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.4.15.tgz",
+      "integrity": "sha512-eF2rxCRulEKXHTRiDrDy6erMYWqNw4LPdQ8UQA4huuxaQsVeRPFl2oM8oDGxMFhJUWZf9McpLtJasDDZb/Bpeg=="
     },
     "node_modules/@jridgewell/trace-mapping": {
-      "version": "0.3.14",
-      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.14.tgz",
-      "integrity": "sha512-bJWEfQ9lPTvm3SneWwRFVLzrh6nhjwqw7TUFFBEMzwvg7t7PCDenf2lDwqo4NQXzdpgBXyFgDWnQA+2vkruksQ==",
+      "version": "0.3.19",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.19.tgz",
+      "integrity": "sha512-kf37QtfW+Hwx/buWGMPcR60iF9ziHa6r/CZJIHbmcm4+0qrXiVdxegAH0F6yddEVQ7zdkjcGCgCzUu+BcbhQxw==",
       "dev": true,
       "dependencies": {
-        "@jridgewell/resolve-uri": "^3.0.3",
-        "@jridgewell/sourcemap-codec": "^1.4.10"
+        "@jridgewell/resolve-uri": "^3.1.0",
+        "@jridgewell/sourcemap-codec": "^1.4.14"
       }
     },
+    "node_modules/@kurkle/color": {
+      "version": "0.3.2",
+      "resolved": "https://registry.npmjs.org/@kurkle/color/-/color-0.3.2.tgz",
+      "integrity": "sha512-fuscdXJ9G1qb7W8VdHi+IwRqij3lBkosAm4ydQtEmbY58OzHXqQhvlxqEkoz0yssNVn38bcpRWgA9PP+OGoisw=="
+    },
     "node_modules/@popperjs/core": {
-      "version": "2.11.0",
-      "resolved": "https://registry.npmjs.org/@popperjs/core/-/core-2.11.0.tgz",
-      "integrity": "sha512-zrsUxjLOKAzdewIDRWy9nsV1GQsKBCWaGwsZQlCgr6/q+vjyZhFgqedLfFBuI9anTPEUT4APq9Mu0SZBTzIcGQ==",
+      "version": "2.11.8",
+      "resolved": "https://registry.npmjs.org/@popperjs/core/-/core-2.11.8.tgz",
+      "integrity": "sha512-P1st0aksCrn9sGZhp8GMYwBnQsbvAWsZAX44oXNNvLHGqAOcoVxmjZiohstwQ7SqKnbR47akdNi+uleWD8+g6A==",
       "funding": {
         "type": "opencollective",
         "url": "https://opencollective.com/popperjs"
@@ -131,9 +138,9 @@
       }
     },
     "node_modules/@rollup/plugin-node-resolve": {
-      "version": "15.0.2",
-      "resolved": "https://registry.npmjs.org/@rollup/plugin-node-resolve/-/plugin-node-resolve-15.0.2.tgz",
-      "integrity": "sha512-Y35fRGUjC3FaurG722uhUuG8YHOJRJQbI6/CkbRkdPotSpDj9NtIN85z1zrcyDcCQIW4qp5mgG72U+gJ0TAFEg==",
+      "version": "15.1.0",
+      "resolved": "https://registry.npmjs.org/@rollup/plugin-node-resolve/-/plugin-node-resolve-15.1.0.tgz",
+      "integrity": "sha512-xeZHCgsiZ9pzYVgAo9580eCGqwh/XCEUM9q6iQfGNocjgkufHAqC3exA+45URvhiYV8sBF9RlBai650eNs7AsA==",
       "dev": true,
       "dependencies": {
         "@rollup/pluginutils": "^5.0.1",
@@ -176,14 +183,14 @@
       }
     },
     "node_modules/@rollup/plugin-terser": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/@rollup/plugin-terser/-/plugin-terser-0.4.1.tgz",
-      "integrity": "sha512-aKS32sw5a7hy+fEXVy+5T95aDIwjpGHCTv833HXVtyKMDoVS7pBr5K3L9hEQoNqbJFjfANPrNpIXlTQ7is00eA==",
+      "version": "0.4.3",
+      "resolved": "https://registry.npmjs.org/@rollup/plugin-terser/-/plugin-terser-0.4.3.tgz",
+      "integrity": "sha512-EF0oejTMtkyhrkwCdg0HJ0IpkcaVg1MMSf2olHb2Jp+1mnLM04OhjpJWGma4HobiDTF0WCyViWuvadyE9ch2XA==",
       "dev": true,
       "dependencies": {
-        "serialize-javascript": "^6.0.0",
-        "smob": "^0.0.6",
-        "terser": "^5.15.1"
+        "serialize-javascript": "^6.0.1",
+        "smob": "^1.0.0",
+        "terser": "^5.17.4"
       },
       "engines": {
         "node": ">=14.0.0"
@@ -197,15 +204,6 @@
         }
       }
     },
-    "node_modules/@rollup/plugin-terser/node_modules/serialize-javascript": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-6.0.1.tgz",
-      "integrity": "sha512-owoXEFjWRllis8/M1Q+Cw5k8ZH40e3zhp/ovX+Xr/vi1qj6QesbyXXViFbpNvWvPNAD62SutwEXavefrLJWj7w==",
-      "dev": true,
-      "dependencies": {
-        "randombytes": "^2.1.0"
-      }
-    },
     "node_modules/@rollup/pluginutils": {
       "version": "5.0.2",
       "resolved": "https://registry.npmjs.org/@rollup/pluginutils/-/pluginutils-5.0.2.tgz",
@@ -239,30 +237,30 @@
       "dev": true
     },
     "node_modules/@urql/core": {
-      "version": "4.0.7",
-      "resolved": "https://registry.npmjs.org/@urql/core/-/core-4.0.7.tgz",
-      "integrity": "sha512-UtZ9oSbSFODXzFydgLCXpAQz26KGT1d6uEfcylKphiRWNXSWZi8k7vhJXNceNm/Dn0MiZ+kaaJHKcnGY1jvHRQ==",
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/@urql/core/-/core-4.1.1.tgz",
+      "integrity": "sha512-iIoAy6BY+BUZZ7KIpnMT7C9q+ULf5ZCVxGe3/i7WZSJBrQa2h1QkIMhL+8fAKmOn9gt83jSIv5drWWnhZ9izEA==",
       "dependencies": {
         "@0no-co/graphql.web": "^1.0.1",
         "wonka": "^6.3.2"
       }
     },
     "node_modules/@urql/svelte": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/@urql/svelte/-/svelte-4.0.1.tgz",
-      "integrity": "sha512-WbsVjuK7IUNlJlvXAgevjQunoso0T+AngFlb0zafDvay6HN47Zc3CSVbAlP8KjETjERUMJLuiqknmPFFm2GEFQ==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/@urql/svelte/-/svelte-4.0.4.tgz",
+      "integrity": "sha512-HYz9dHdqEcs9d82WWczQ3XG+zuup3TS01H+txaij/QfQ+KHjrlrn0EkOHQQd1S+H8+nFjFU2x9+HE3+3fuwL1A==",
       "dependencies": {
-        "@urql/core": "^4.0.0",
+        "@urql/core": "^4.1.0",
         "wonka": "^6.3.2"
       },
       "peerDependencies": {
-        "svelte": "^3.0.0"
+        "svelte": "^3.0.0 || ^4.0.0"
       }
     },
     "node_modules/acorn": {
-      "version": "8.8.0",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.8.0.tgz",
-      "integrity": "sha512-QOxyigPVrpZ2GXT+PFyZTl6TtOFc5egxHIP9IlQ+RbupQuX4RkT/Bee4/kQuC02Xkzg84JcT7oLYtDIQxp+v7w==",
+      "version": "8.10.0",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.10.0.tgz",
+      "integrity": "sha512-F0SAmZ8iUtS//m8DmCTA0jlh6TDKkHQyK6xc6V4KDTyZKA9dnvX9/3sRTVQrWm79glUAZbnmmNcdYwUIHWVybw==",
       "dev": true,
       "bin": {
         "acorn": "bin/acorn"
@@ -304,6 +302,17 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/chart.js": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/chart.js/-/chart.js-4.3.3.tgz",
+      "integrity": "sha512-aTk7pBw+x6sQYhon/NR3ikfUJuym/LdgpTlgZRe2PaEhjUMKBKyNaFCMVRAyTEWYFNO7qRu7iQVqOw/OqzxZxQ==",
+      "dependencies": {
+        "@kurkle/color": "^0.3.0"
+      },
+      "engines": {
+        "pnpm": ">=7"
+      }
+    },
     "node_modules/commander": {
       "version": "2.20.3",
       "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz",
@@ -313,13 +322,13 @@
     "node_modules/commondir": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/commondir/-/commondir-1.0.1.tgz",
-      "integrity": "sha1-3dgA2gxmEnOTzKWVDqloo6rxJTs= sha512-W9pAhw0ja1Edb5GVdIF1mjZw/ASI0AlShXM83UUGe2DVr5TdAPEA1OA8m/g8zWp9x6On7gqufY+FatDbC3MDQg==",
+      "integrity": "sha512-W9pAhw0ja1Edb5GVdIF1mjZw/ASI0AlShXM83UUGe2DVr5TdAPEA1OA8m/g8zWp9x6On7gqufY+FatDbC3MDQg==",
       "dev": true
     },
     "node_modules/deepmerge": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.2.2.tgz",
-      "integrity": "sha512-FJ3UgI4gIl+PHZm53knsuSFpE+nESMr7M4v9QcgB7S63Kj/6WqMiFQJpBBYz1Pt+66bZpP3Q7Lye0Oo9MPKEdg==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.3.1.tgz",
+      "integrity": "sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==",
       "dev": true,
       "engines": {
         "node": ">=0.10.0"
@@ -376,9 +385,9 @@
       }
     },
     "node_modules/graphql": {
-      "version": "16.6.0",
-      "resolved": "https://registry.npmjs.org/graphql/-/graphql-16.6.0.tgz",
-      "integrity": "sha512-KPIBPDlW7NxrbT/eh4qPXz5FiFdL5UbaA0XUNz2Rp3Z3hqBSkbj0GVjwFDztsWVauZUWsbKHgMg++sk8UX0bkw==",
+      "version": "16.7.1",
+      "resolved": "https://registry.npmjs.org/graphql/-/graphql-16.7.1.tgz",
+      "integrity": "sha512-DRYR9tf+UGU0KOsMcKAlXeFfX89UiiIZ0dRU3mR0yJfu6OjZqUcp68NnFLnqQU5RexygFoDy1EW+ccOYcPfmHg==",
       "engines": {
         "node": "^12.22.0 || ^14.16.0 || ^16.0.0 || >=17.0.0"
       }
@@ -427,9 +436,9 @@
       }
     },
     "node_modules/is-core-module": {
-      "version": "2.12.0",
-      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.12.0.tgz",
-      "integrity": "sha512-RECHCBCd/viahWmwj6enj19sKbHfJrddi/6cBDsNTKbNq0f7VeaUkBo60BqzvPqo/W54ChS62Z5qyun7cfOMqQ==",
+      "version": "2.13.0",
+      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.13.0.tgz",
+      "integrity": "sha512-Z7dk6Qo8pOCp3l4tsX2C5ZVas4V+UxwQodwZhLopL91TX8UyyHEXafPcyoeeWuLrwzHcr3igO78wNLwHJHsMCQ==",
       "dev": true,
       "dependencies": {
         "has": "^1.0.3"
@@ -441,7 +450,7 @@
     "node_modules/is-module": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/is-module/-/is-module-1.0.0.tgz",
-      "integrity": "sha1-Mlj7afeMFNW4FdZkM2tM/7ZEFZE= sha512-51ypPSPCoTEIN9dy5Oy+h4pShgJmPCygKfyRCISBI+JoWT/2oJvK8QPxmwv7b/p239jXrm9M1mlQbyKJ5A152g==",
+      "integrity": "sha512-51ypPSPCoTEIN9dy5Oy+h4pShgJmPCygKfyRCISBI+JoWT/2oJvK8QPxmwv7b/p239jXrm9M1mlQbyKJ5A152g==",
       "dev": true
     },
     "node_modules/is-reference": {
@@ -512,12 +521,12 @@
       }
     },
     "node_modules/resolve": {
-      "version": "1.22.2",
-      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.2.tgz",
-      "integrity": "sha512-Sb+mjNHOULsBv818T40qSPeRiuWLyaGMa5ewydRLFimneixmVy2zdivRl+AF6jaYPC8ERxGDmFSiqui6SfPd+g==",
+      "version": "1.22.4",
+      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.4.tgz",
+      "integrity": "sha512-PXNdCiPqDqeUou+w1C2eTQbNfxKSuMxqTCuvlmmMsk1NWHL5fRrhY6Pl0qEYYc6+QqGClco1Qj8XnjPego4wfg==",
       "dev": true,
       "dependencies": {
-        "is-core-module": "^2.11.0",
+        "is-core-module": "^2.13.0",
         "path-parse": "^1.0.7",
         "supports-preserve-symlinks-flag": "^1.0.0"
       },
@@ -538,9 +547,9 @@
       }
     },
     "node_modules/rollup": {
-      "version": "3.21.0",
-      "resolved": "https://registry.npmjs.org/rollup/-/rollup-3.21.0.tgz",
-      "integrity": "sha512-ANPhVcyeHvYdQMUyCbczy33nbLzI7RzrBje4uvNiTDJGIMtlKoOStmympwr9OtS1LZxiDmE2wvxHyVhoLtf1KQ==",
+      "version": "3.28.0",
+      "resolved": "https://registry.npmjs.org/rollup/-/rollup-3.28.0.tgz",
+      "integrity": "sha512-d7zhvo1OUY2SXSM6pfNjgD5+d0Nz87CUp4mt8l/GgVP3oBsPwzNvSzyu1me6BSG9JIgWNTVcafIXBIyM8yQ3yw==",
       "devOptional": true,
       "bin": {
         "rollup": "dist/bin/rollup"
@@ -569,9 +578,9 @@
       }
     },
     "node_modules/rollup-plugin-svelte": {
-      "version": "7.1.4",
-      "resolved": "https://registry.npmjs.org/rollup-plugin-svelte/-/rollup-plugin-svelte-7.1.4.tgz",
-      "integrity": "sha512-Jm0FCydR7k8bBGe7wimXAes8x2zEK10Ew3f3lEZwYor/Zya3X0AZVeSAPRH7yiXB9hWQVzJu597EUeNwGDTdjQ==",
+      "version": "7.1.6",
+      "resolved": "https://registry.npmjs.org/rollup-plugin-svelte/-/rollup-plugin-svelte-7.1.6.tgz",
+      "integrity": "sha512-nVFRBpGWI2qUY1OcSiEEA/kjCY2+vAjO9BI8SzA7NRrh2GTunLd6w2EYmnMt/atgdg8GvcNjLsmZmbQs/u4SQA==",
       "dev": true,
       "dependencies": {
         "@rollup/pluginutils": "^4.1.0",
@@ -618,10 +627,19 @@
         }
       ]
     },
+    "node_modules/serialize-javascript": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-6.0.1.tgz",
+      "integrity": "sha512-owoXEFjWRllis8/M1Q+Cw5k8ZH40e3zhp/ovX+Xr/vi1qj6QesbyXXViFbpNvWvPNAD62SutwEXavefrLJWj7w==",
+      "dev": true,
+      "dependencies": {
+        "randombytes": "^2.1.0"
+      }
+    },
     "node_modules/smob": {
-      "version": "0.0.6",
-      "resolved": "https://registry.npmjs.org/smob/-/smob-0.0.6.tgz",
-      "integrity": "sha512-V21+XeNni+tTyiST1MHsa84AQhT1aFZipzPpOFAVB8DkHzwJyjjAmt9bgwnuZiZWnIbMo2duE29wybxv/7HWUw==",
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/smob/-/smob-1.4.0.tgz",
+      "integrity": "sha512-MqR3fVulhjWuRNSMydnTlweu38UhQ0HXM4buStD/S3mc/BzX3CuM9OmhyQpmtYCvoYdl5ris6TI0ZqH355Ymqg==",
       "dev": true
     },
     "node_modules/source-map": {
@@ -656,32 +674,41 @@
       }
     },
     "node_modules/svelte": {
-      "version": "3.58.0",
-      "resolved": "https://registry.npmjs.org/svelte/-/svelte-3.58.0.tgz",
-      "integrity": "sha512-brIBNNB76mXFmU/Kerm4wFnkskBbluBDCjx/8TcpYRb298Yh2dztS2kQ6bhtjMcvUhd5ynClfwpz5h2gnzdQ1A==",
+      "version": "3.59.2",
+      "resolved": "https://registry.npmjs.org/svelte/-/svelte-3.59.2.tgz",
+      "integrity": "sha512-vzSyuGr3eEoAtT/A6bmajosJZIUWySzY2CzB3w2pgPvnkUjGqlDnsNnA0PMO+mMAhuyMul6C2uuZzY6ELSkzyA==",
       "engines": {
         "node": ">= 8"
       }
     },
+    "node_modules/svelte-chartjs": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/svelte-chartjs/-/svelte-chartjs-3.1.2.tgz",
+      "integrity": "sha512-3+6gY2IJ9Ua8R9pk3iS1ypa7Z9OoXCJb9oPwIfTp7caJM+X+RrWnH2CTkGAq7FeSxc2nnmW08tYN88Q8Y+5M+w==",
+      "peerDependencies": {
+        "chart.js": "^3.5.0 || ^4.0.0",
+        "svelte": "^3.45.0"
+      }
+    },
     "node_modules/sveltestrap": {
-      "version": "5.10.0",
-      "resolved": "https://registry.npmjs.org/sveltestrap/-/sveltestrap-5.10.0.tgz",
-      "integrity": "sha512-k6Ob+6G2AMYvBidXHBKM9W28fJqFHbmosqCe/NC8pv6TV7K+v47Yw+zmnLWkjqCzzmjkSLkL48SrHZrlWc9mYQ==",
+      "version": "5.11.1",
+      "resolved": "https://registry.npmjs.org/sveltestrap/-/sveltestrap-5.11.1.tgz",
+      "integrity": "sha512-FIvPIEU1VolqMN1wi2XrC8aehWVbIJEST7zPfPbOUUfPimyx9giN4nA3We5wkXrBUaifXA8CSIwuHFvf3CmYQw==",
       "dependencies": {
-        "@popperjs/core": "^2.9.2"
+        "@popperjs/core": "^2.11.8"
       },
       "peerDependencies": {
-        "svelte": "^3.29.0"
+        "svelte": "^3.53.1"
       }
     },
     "node_modules/terser": {
-      "version": "5.17.1",
-      "resolved": "https://registry.npmjs.org/terser/-/terser-5.17.1.tgz",
-      "integrity": "sha512-hVl35zClmpisy6oaoKALOpS0rDYLxRFLHhRuDlEGTKey9qHjS1w9GMORjuwIMt70Wan4lwsLYyWDVnWgF+KUEw==",
+      "version": "5.19.2",
+      "resolved": "https://registry.npmjs.org/terser/-/terser-5.19.2.tgz",
+      "integrity": "sha512-qC5+dmecKJA4cpYxRa5aVkKehYsQKc+AHeKl0Oe62aYjBL8ZA33tTljktDHJSaxxMnbI5ZYw+o/S2DxxLu8OfA==",
       "dev": true,
       "dependencies": {
-        "@jridgewell/source-map": "^0.3.2",
-        "acorn": "^8.5.0",
+        "@jridgewell/source-map": "^0.3.3",
+        "acorn": "^8.8.2",
         "commander": "^2.20.0",
         "source-map-support": "~0.5.20"
       },
@@ -693,14 +720,14 @@
       }
     },
     "node_modules/uplot": {
-      "version": "1.6.24",
-      "resolved": "https://registry.npmjs.org/uplot/-/uplot-1.6.24.tgz",
-      "integrity": "sha512-WpH2BsrFrqxkMu+4XBvc0eCDsRBhzoq9crttYeSI0bfxpzR5YoSVzZXOKFVWcVC7sp/aDXrdDPbDZGCtck2PVg=="
+      "version": "1.6.25",
+      "resolved": "https://registry.npmjs.org/uplot/-/uplot-1.6.25.tgz",
+      "integrity": "sha512-eWLAhEaGtIcVBiS67mC2UC0yV+G6eYLS2rU67N4F2JVWjt7uBMg4xKXUYGW0dEz9G+m7fNatjCVXHts4gjyuMQ=="
     },
     "node_modules/wonka": {
-      "version": "6.3.2",
-      "resolved": "https://registry.npmjs.org/wonka/-/wonka-6.3.2.tgz",
-      "integrity": "sha512-2xXbQ1LnwNS7egVm1HPhW2FyKrekolzhpM3mCwXdQr55gO+tAiY76rhb32OL9kKsW8taj++iP7C6hxlVzbnvrw=="
+      "version": "6.3.4",
+      "resolved": "https://registry.npmjs.org/wonka/-/wonka-6.3.4.tgz",
+      "integrity": "sha512-CjpbqNtBGNAeyNS/9W6q3kSkKE52+FjIj7AkFlLr11s/VWGUu6a2CdYSdGxocIhIVjaW/zchesBQUKPVU69Cqg=="
     },
     "node_modules/wrappy": {
       "version": "1.0.2",
diff --git a/web/frontend/package.json b/web/frontend/package.json
index 0b8baaa..4ef7314 100644
--- a/web/frontend/package.json
+++ b/web/frontend/package.json
@@ -18,7 +18,9 @@
   "dependencies": {
     "@rollup/plugin-replace": "^5.0.2",
     "@urql/svelte": "^4.0.1",
+    "chart.js": "^4.3.3",
     "graphql": "^16.6.0",
+    "svelte-chartjs": "^3.1.2",
     "sveltestrap": "^5.10.0",
     "uplot": "^1.6.24",
     "wonka": "^6.3.2"

From 32420fb5313778cd40f14a4100c7bbd6d6013fac Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Fri, 11 Aug 2023 09:41:39 +0200
Subject: [PATCH 30/62] Add pie color legend to Top-Tables

---
 web/frontend/src/Analysis.root.svelte |  9 ++++---
 web/frontend/src/Status.root.svelte   | 24 ++++++++++++++----
 web/frontend/src/plots/Pie.svelte     | 36 +++++++++++++--------------
 3 files changed, 42 insertions(+), 27 deletions(-)

diff --git a/web/frontend/src/Analysis.root.svelte b/web/frontend/src/Analysis.root.svelte
index ba04e05..e7fe720 100644
--- a/web/frontend/src/Analysis.root.svelte
+++ b/web/frontend/src/Analysis.root.svelte
@@ -2,11 +2,11 @@
     import { init, convert2uplot } from './utils.js'
     import { getContext, onMount } from 'svelte'
     import { queryStore, gql, getContextClient  } from '@urql/svelte'
-    import { Row, Col, Spinner, Card, Table } from 'sveltestrap'
+    import { Row, Col, Spinner, Card, Table, Icon } from 'sveltestrap'
     import Filters from './filters/Filters.svelte'
     import PlotSelection from './PlotSelection.svelte'
     import Histogramuplot from './plots/Histogramuplot.svelte'
-    import Pie from './plots/Pie.svelte'
+    import Pie, { colors } from './plots/Pie.svelte'
     import { binsFromFootprint } from './plots/Histogram.svelte'
     import ScatterPlot from './plots/Scatter.svelte'
     import PlotTable from './PlotTable.svelte'
@@ -172,9 +172,10 @@
         </Col>
         <Col>
             <Table>
-                <tr class="mb-2"><th>User Name</th><th>Node Hours</th></tr>
-                {#each $statsQuery.data.topUsers.sort((a, b) => b.count - a.count) as { name, count }}
+                <tr class="mb-2"><th>Legend</th><th>User Name</th><th>Node Hours</th></tr>
+                {#each $statsQuery.data.topUsers.sort((a, b) => b.count - a.count) as { name, count }, i}
                     <tr>
+                        <td><Icon name="circle-fill" style="color: {colors[i]};"/></td>
                         <th scope="col"><a href="/monitoring/user/{name}?cluster={cluster.name}">{name}</a></th>
                         <td>{count}</td>
                     </tr>
diff --git a/web/frontend/src/Status.root.svelte b/web/frontend/src/Status.root.svelte
index 5d96995..11aa255 100644
--- a/web/frontend/src/Status.root.svelte
+++ b/web/frontend/src/Status.root.svelte
@@ -1,7 +1,7 @@
 <script>
     import Refresher from './joblist/Refresher.svelte'
     import Roofline, { transformPerNodeData } from './plots/Roofline.svelte'
-    import Pie from './plots/Pie.svelte'
+    import Pie, { colors } from './plots/Pie.svelte'
     import Histogramuplot from './plots/Histogramuplot.svelte'
     import { Row, Col, Spinner, Card, CardHeader, CardTitle, CardBody, Table, Progress, Icon } from 'sveltestrap'
     import { init, convert2uplot } from './utils.js'
@@ -174,9 +174,10 @@
         </Col>
         <Col class="px-4 py-2">
             <Table>
-                <tr class="mb-2"><th>User Name</th><th>Number of Nodes</th></tr>
-                {#each $mainQuery.data.topUsers.sort((a, b) => b.count - a.count) as { name, count }}
+                <tr class="mb-2"><th>Legend</th><th>User Name</th><th>Number of Nodes</th></tr>
+                {#each $mainQuery.data.topUsers.sort((a, b) => b.count - a.count) as { name, count }, i}
                     <tr>
+                        <td><Icon name="circle-fill" style="color: {colors[i]};"/></td>
                         <th scope="col"><a href="/monitoring/user/{name}?cluster={cluster}&state=running">{name}</a></th>
                         <td>{count}</td>
                     </tr>
@@ -196,9 +197,10 @@
         </Col>
         <Col class="px-4 py-2">
             <Table>
-                <tr class="mb-2"><th>Project Code</th><th>Number of Nodes</th></tr>
-                {#each $mainQuery.data.topProjects.sort((a, b) => b.count - a.count) as { name, count }}
+                <tr class="mb-2"><th>Legend</th><th>Project Code</th><th>Number of Nodes</th></tr>
+                {#each $mainQuery.data.topProjects.sort((a, b) => b.count - a.count) as { name, count }, i}
                     <tr>
+                        <td><Icon name="circle-fill" style="color: {colors[i]};"/></td>
                         <th scope="col"><a href="/monitoring/jobs/?cluster={cluster}&state=running&project={name}&projectMatch=eq">{name}</a></th>
                         <td>{count}</td>
                     </tr>
@@ -236,3 +238,15 @@
         </Col>
     </Row>
 {/if}
+
+<style>
+    .colorBoxWrapper {
+        display: flex;
+    }
+
+    .colorBox {
+        width: 20px;
+        height: 20px;
+        border: 1px solid rgba(0, 0, 0, .2);
+    }
+</style>
\ No newline at end of file
diff --git a/web/frontend/src/plots/Pie.svelte b/web/frontend/src/plots/Pie.svelte
index 1bdc2ec..326c062 100644
--- a/web/frontend/src/plots/Pie.svelte
+++ b/web/frontend/src/plots/Pie.svelte
@@ -1,5 +1,22 @@
+<script context="module">
+    // http://tsitsul.in/blog/coloropt/ : 12 colors normal
+    export const colors = [
+        'rgb(235,172,35)',
+        'rgb(184,0,88)',
+        'rgb(0,140,249)',
+        'rgb(0,110,0)',
+        'rgb(0,187,173)',
+        'rgb(209,99,230)',
+        'rgb(178,69,2)',
+        'rgb(255,146,135)',
+        'rgb(89,84,214)',
+        'rgb(0,198,248)',
+        'rgb(135,133,0)',
+        'rgb(0,167,108)',
+        'rgb(189,189,189)'
+    ]
+</script>
 <script>
-    // import { getContext } from 'svelte'
     import { Pie } from 'svelte-chartjs';
     import {
         Chart as ChartJS,
@@ -24,23 +41,6 @@
     export let entities
     export let displayLegend = false
 
-    // http://tsitsul.in/blog/coloropt/ : 12 colors normal
-    const colors = [
-        'rgb(235,172,35)',
-        'rgb(184,0,88)',
-        'rgb(0,140,249)',
-        'rgb(0,110,0)',
-        'rgb(0,187,173)',
-        'rgb(209,99,230)',
-        'rgb(178,69,2)',
-        'rgb(255,146,135)',
-        'rgb(89,84,214)',
-        'rgb(0,198,248)',
-        'rgb(135,133,0)',
-        'rgb(0,167,108)',
-        'rgb(189,189,189)'
-    ]
-
     const data = {
         labels: entities,
         datasets: [

From b8273a9b0265e4ff3a0fa65a557215dd161606c1 Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan@moebiusband.org>
Date: Fri, 11 Aug 2023 10:00:23 +0200
Subject: [PATCH 31/62] refactor auth module

Restructure module
Separate JWT auth variants
Cleanup code
Fixes #189
---
 docs/dev-authentication.md          |  53 +++--
 internal/auth/auth.go               | 308 +++++++++-------------------
 internal/auth/jwt.go                | 212 +------------------
 internal/auth/jwtCookieSession.go   | 224 ++++++++++++++++++++
 internal/auth/jwtSession.go         | 103 ++++++++++
 internal/auth/ldap.go               |   9 +-
 internal/auth/local.go              |   7 -
 internal/auth/roles.go              | 165 +++++++++++++++
 internal/repository/testdata/job.db | Bin 110592 -> 114688 bytes
 9 files changed, 630 insertions(+), 451 deletions(-)
 create mode 100644 internal/auth/jwtCookieSession.go
 create mode 100644 internal/auth/jwtSession.go
 create mode 100644 internal/auth/roles.go

diff --git a/docs/dev-authentication.md b/docs/dev-authentication.md
index 4237a6a..d40bdb0 100644
--- a/docs/dev-authentication.md
+++ b/docs/dev-authentication.md
@@ -1,13 +1,15 @@
 # Overview
 
-The implementation of authentication is not easy to understand by just looking
-at the code. The authentication is implemented in `internal/auth/`. In `auth.go`
+The authentication is implemented in `internal/auth/`. In `auth.go`
 an interface is defined that any authentication provider must fulfill. It also
 acts as a dispatcher to delegate the calls to the available authentication
 providers.
 
-The most important routine are:
-* `CanLogin()` Check if the authentication method is supported for login attempt
+Two authentication types are available:
+* JWT authentication for the REST API that does not create a session cookie
+* Session based authentication using a session cookie
+
+The most important routines in auth are:
 * `Login()` Handle POST request to login user and start a new session
 * `Auth()`  Authenticate user and put User Object in context of the request
 
@@ -30,10 +32,9 @@ secured.Use(func(next http.Handler) http.Handler {
 })
 ```
 
-For non API routes a JWT token can be used to initiate an authenticated user
+A JWT token can be used to initiate an authenticated user
 session. This can either happen by calling the login route with a token
-provided in a header or query URL or via the `Auth()` method on first access
-to a secured URL via a special cookie containing the JWT token.
+provided in a header or via a special cookie containing the JWT token.
 For API routes the access is authenticated on every request using the JWT token
 and no session is initiated.
 
@@ -43,12 +44,13 @@ The Login function (located in `auth.go`):
 * Extracts the user name and gets the user from the user database table. In case the
   user is not found the user object is set to nil.
 * Iterates over all authenticators and:
-  - Calls the `CanLogin` function which checks if the authentication method is
-    supported for this user and the user object is valid.
-  - Calls the `Login` function to authenticate the user. On success a valid user
+  - Calls its `CanLogin` function which checks if the authentication method is
+    supported for this user.
+  - Calls its `Login` function to authenticate the user. On success a valid user
     object is returned.
   - Creates a new session object, stores the user attributes in the session and
     saves the session.
+  - If the user does not yet exist in the database try to add the user
   - Starts the `onSuccess` http handler
 
 ## Local authenticator
@@ -82,17 +84,13 @@ if err := l.Bind(userDn, r.FormValue("password")); err != nil {
 }
 ```
 
-## JWT authenticator
+## JWT Session authenticator
 
 Login via JWT token will create a session without password.
-For login the `X-Auth-Token` header is not supported.
-This authenticator is applied if either user is not nil and auth source is
-`AuthViaToken` or the Authorization header is present or the URL query key
-login-token is present:
+For login the `X-Auth-Token` header is not supported. This authenticator is
+applied if the Authorization header is present:
 ```
-return (user != nil && user.AuthSource == AuthViaToken) ||
-        r.Header.Get("Authorization") != "" ||
-        r.URL.Query().Get("login-token") != ""
+	return r.Header.Get("Authorization") != ""
 ```
 
 The Login function:
@@ -108,6 +106,25 @@ The Login function:
    - In case user is not yet present add user to user database table with `AuthViaToken` AuthSource.
 * Return valid user object
 
+## JWT Cookie Session authenticator
+
+Login via JWT cookie token will create a session without password.
+It is first checked if the required configuration keys are set:
+* `publicKeyCrossLogin`
+* `TrustedExternalIssuer`
+* `CookieName`
+
+ This authenticator is applied if the configured cookie is present:
+```
+	jwtCookie, err := r.Cookie(cookieName)
+
+	if err == nil && jwtCookie.Value != "" {
+		return true
+	}
+```
+
+The Login function:
+
 # Auth
 
 The Auth function (located in `auth.go`):
diff --git a/internal/auth/auth.go b/internal/auth/auth.go
index 9ac75be..8c1dca7 100644
--- a/internal/auth/auth.go
+++ b/internal/auth/auth.go
@@ -1,4 +1,4 @@
-// Copyright (C) 2022 NHR@FAU, University Erlangen-Nuremberg.
+// Copyright (C) 2023 NHR@FAU, University Erlangen-Nuremberg.
 // All rights reserved.
 // Use of this source code is governed by a MIT-style
 // license that can be found in the LICENSE file.
@@ -7,12 +7,11 @@ package auth
 import (
 	"context"
 	"crypto/rand"
+	"database/sql"
 	"encoding/base64"
 	"errors"
-	"fmt"
 	"net/http"
 	"os"
-	"strings"
 	"time"
 
 	"github.com/ClusterCockpit/cc-backend/pkg/log"
@@ -28,172 +27,25 @@ const (
 	AuthViaToken
 )
 
+type AuthType int
+
+const (
+	AuthToken AuthType = iota
+	AuthSession
+)
+
 type User struct {
 	Username   string     `json:"username"`
 	Password   string     `json:"-"`
 	Name       string     `json:"name"`
 	Roles      []string   `json:"roles"`
-	AuthSource AuthSource `json:"via"`
+	AuthType   AuthType   `json:"authType"`
+	AuthSource AuthSource `json:"authSource"`
 	Email      string     `json:"email"`
 	Projects   []string   `json:"projects"`
 	Expiration time.Time
 }
 
-type Role int
-
-const (
-	RoleAnonymous Role = iota
-	RoleApi
-	RoleUser
-	RoleManager
-	RoleSupport
-	RoleAdmin
-	RoleError
-)
-
-func GetRoleString(roleInt Role) string {
-	return [6]string{"anonymous", "api", "user", "manager", "support", "admin"}[roleInt]
-}
-
-func getRoleEnum(roleStr string) Role {
-	switch strings.ToLower(roleStr) {
-	case "admin":
-		return RoleAdmin
-	case "support":
-		return RoleSupport
-	case "manager":
-		return RoleManager
-	case "user":
-		return RoleUser
-	case "api":
-		return RoleApi
-	case "anonymous":
-		return RoleAnonymous
-	default:
-		return RoleError
-	}
-}
-
-func isValidRole(role string) bool {
-	return getRoleEnum(role) != RoleError
-}
-
-func (u *User) HasValidRole(role string) (hasRole bool, isValid bool) {
-	if isValidRole(role) {
-		for _, r := range u.Roles {
-			if r == role {
-				return true, true
-			}
-		}
-		return false, true
-	}
-	return false, false
-}
-
-func (u *User) HasRole(role Role) bool {
-	for _, r := range u.Roles {
-		if r == GetRoleString(role) {
-			return true
-		}
-	}
-	return false
-}
-
-// Role-Arrays are short: performance not impacted by nested loop
-func (u *User) HasAnyRole(queryroles []Role) bool {
-	for _, ur := range u.Roles {
-		for _, qr := range queryroles {
-			if ur == GetRoleString(qr) {
-				return true
-			}
-		}
-	}
-	return false
-}
-
-// Role-Arrays are short: performance not impacted by nested loop
-func (u *User) HasAllRoles(queryroles []Role) bool {
-	target := len(queryroles)
-	matches := 0
-	for _, ur := range u.Roles {
-		for _, qr := range queryroles {
-			if ur == GetRoleString(qr) {
-				matches += 1
-				break
-			}
-		}
-	}
-
-	if matches == target {
-		return true
-	} else {
-		return false
-	}
-}
-
-// Role-Arrays are short: performance not impacted by nested loop
-func (u *User) HasNotRoles(queryroles []Role) bool {
-	matches := 0
-	for _, ur := range u.Roles {
-		for _, qr := range queryroles {
-			if ur == GetRoleString(qr) {
-				matches += 1
-				break
-			}
-		}
-	}
-
-	if matches == 0 {
-		return true
-	} else {
-		return false
-	}
-}
-
-// Called by API endpoint '/roles/' from frontend: Only required for admin config -> Check Admin Role
-func GetValidRoles(user *User) ([]string, error) {
-	var vals []string
-	if user.HasRole(RoleAdmin) {
-		for i := RoleApi; i < RoleError; i++ {
-			vals = append(vals, GetRoleString(i))
-		}
-		return vals, nil
-	}
-
-	return vals, fmt.Errorf("%s: only admins are allowed to fetch a list of roles", user.Username)
-}
-
-// Called by routerConfig web.page setup in backend: Only requires known user
-func GetValidRolesMap(user *User) (map[string]Role, error) {
-	named := make(map[string]Role)
-	if user.HasNotRoles([]Role{RoleAnonymous}) {
-		for i := RoleApi; i < RoleError; i++ {
-			named[GetRoleString(i)] = i
-		}
-		return named, nil
-	}
-	return named, fmt.Errorf("only known users are allowed to fetch a list of roles")
-}
-
-// Find highest role
-func (u *User) GetAuthLevel() Role {
-	if u.HasRole(RoleAdmin) {
-		return RoleAdmin
-	} else if u.HasRole(RoleSupport) {
-		return RoleSupport
-	} else if u.HasRole(RoleManager) {
-		return RoleManager
-	} else if u.HasRole(RoleUser) {
-		return RoleUser
-	} else if u.HasRole(RoleApi) {
-		return RoleApi
-	} else if u.HasRole(RoleAnonymous) {
-		return RoleAnonymous
-	} else {
-		return RoleError
-	}
-}
-
 func (u *User) HasProject(project string) bool {
 	for _, p := range u.Projects {
 		if p == project {
@@ -216,7 +68,6 @@ type Authenticator interface {
 	Init(auth *Authentication, config interface{}) error
 	CanLogin(user *User, rw http.ResponseWriter, r *http.Request) bool
 	Login(user *User, rw http.ResponseWriter, r *http.Request) (*User, error)
-	Auth(rw http.ResponseWriter, r *http.Request) (*User, error)
 }
 
 type ContextKey string
@@ -234,6 +85,47 @@ type Authentication struct {
 	LocalAuth      *LocalAuthenticator
 }
 
+func (auth *Authentication) AuthViaSession(
+	rw http.ResponseWriter,
+	r *http.Request) (*User, error) {
+	session, err := auth.sessionStore.Get(r, "session")
+	if err != nil {
+		log.Error("Error while getting session store")
+		return nil, err
+	}
+
+	if session.IsNew {
+		return nil, nil
+	}
+
+	var username string
+	var projects, roles []string
+
+	if val, ok := session.Values["username"]; ok {
+		username, _ = val.(string)
+	} else {
+		return nil, errors.New("No key username in session")
+	}
+	if val, ok := session.Values["projects"]; ok {
+		projects, _ = val.([]string)
+	} else {
+		return nil, errors.New("No key projects in session")
+	}
+	if val, ok := session.Values["projects"]; ok {
+		roles, _ = val.([]string)
+	} else {
+		return nil, errors.New("No key roles in session")
+	}
+
+	return &User{
+		Username:   username,
+		Projects:   projects,
+		Roles:      roles,
+		AuthType:   AuthSession,
+		AuthSource: -1,
+	}, nil
+}
+
 func Init(db *sqlx.DB,
 	configs map[string]interface{}) (*Authentication, error) {
 	auth := &Authentication{}
@@ -257,19 +149,11 @@ func Init(db *sqlx.DB,
 		auth.sessionStore = sessions.NewCookieStore(bytes)
 	}
 
-	auth.LocalAuth = &LocalAuthenticator{}
-	if err := auth.LocalAuth.Init(auth, nil); err != nil {
-		log.Error("Error while initializing authentication -> localAuth init failed")
-		return nil, err
-	}
-	auth.authenticators = append(auth.authenticators, auth.LocalAuth)
-
 	auth.JwtAuth = &JWTAuthenticator{}
 	if err := auth.JwtAuth.Init(auth, configs["jwt"]); err != nil {
 		log.Error("Error while initializing authentication -> jwtAuth init failed")
 		return nil, err
 	}
-	auth.authenticators = append(auth.authenticators, auth.JwtAuth)
 
 	if config, ok := configs["ldap"]; ok {
 		auth.LdapAuth = &LdapAuthenticator{}
@@ -280,36 +164,30 @@ func Init(db *sqlx.DB,
 		auth.authenticators = append(auth.authenticators, auth.LdapAuth)
 	}
 
+	jwtSessionAuth := &JWTSessionAuthenticator{}
+	if err := jwtSessionAuth.Init(auth, configs["jwt"]); err != nil {
+		log.Warn("Error while initializing authentication -> jwtSessionAuth init failed")
+	} else {
+		auth.authenticators = append(auth.authenticators, jwtSessionAuth)
+	}
+
+	jwtCookieSessionAuth := &JWTCookieSessionAuthenticator{}
+	if err := jwtSessionAuth.Init(auth, configs["jwt"]); err != nil {
+		log.Warn("Error while initializing authentication -> jwtCookieSessionAuth init failed")
+	} else {
+		auth.authenticators = append(auth.authenticators, jwtCookieSessionAuth)
+	}
+
+	auth.LocalAuth = &LocalAuthenticator{}
+	if err := auth.LocalAuth.Init(auth, nil); err != nil {
+		log.Error("Error while initializing authentication -> localAuth init failed")
+		return nil, err
+	}
+	auth.authenticators = append(auth.authenticators, auth.LocalAuth)
+
 	return auth, nil
 }
 
-func (auth *Authentication) AuthViaSession(
-	rw http.ResponseWriter,
-	r *http.Request) (*User, error) {
-
-	session, err := auth.sessionStore.Get(r, "session")
-	if err != nil {
-		log.Error("Error while getting session store")
-		return nil, err
-	}
-
-	if session.IsNew {
-		return nil, nil
-	}
-
-	// TODO Check if keys are present in session?
-	username, _ := session.Values["username"].(string)
-	projects, _ := session.Values["projects"].([]string)
-	roles, _ := session.Values["roles"].([]string)
-	return &User{
-		Username:   username,
-		Projects:   projects,
-		Roles:      roles,
-		AuthSource: -1,
-	}, nil
-}
-
-// Handle a POST request that should log the user in, starting a new session.
 func (auth *Authentication) Login(
 	onsuccess http.Handler,
 	onfailure func(rw http.ResponseWriter, r *http.Request, loginErr error)) http.Handler {
@@ -317,18 +195,21 @@ func (auth *Authentication) Login(
 	return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 		err := errors.New("no authenticator applied")
 		username := r.FormValue("username")
-		user := (*User)(nil)
+		dbUser := (*User)(nil)
 
 		if username != "" {
-			user, _ = auth.GetUser(username)
+			dbUser, err = auth.GetUser(username)
+			if err != nil && err != sql.ErrNoRows {
+				log.Errorf("Error while loading user '%v'", username)
+			}
 		}
 
 		for _, authenticator := range auth.authenticators {
-			if !authenticator.CanLogin(user, rw, r) {
+			if !authenticator.CanLogin(dbUser, rw, r) {
 				continue
 			}
 
-			user, err = authenticator.Login(user, rw, r)
+			user, err := authenticator.Login(dbUser, rw, r)
 			if err != nil {
 				log.Warnf("user login failed: %s", err.Error())
 				onfailure(rw, r, err)
@@ -354,6 +235,14 @@ func (auth *Authentication) Login(
 				return
 			}
 
+			if dbUser == nil {
+				if err := auth.AddUser(user); err != nil {
+					// TODO Add AuthSource
+					log.Errorf("Error while adding user '%v' to auth from XX",
+						user.Username)
+				}
+			}
+
 			log.Infof("login successfull: user: %#v (roles: %v, projects: %v)", user.Username, user.Roles, user.Projects)
 			ctx := context.WithValue(r.Context(), ContextUserKey, user)
 			onsuccess.ServeHTTP(rw, r.WithContext(ctx))
@@ -365,39 +254,34 @@ func (auth *Authentication) Login(
 	})
 }
 
-// Authenticate the user and put a User object in the
-// context of the request. If authentication fails,
-// do not continue but send client to the login screen.
 func (auth *Authentication) Auth(
 	onsuccess http.Handler,
 	onfailure func(rw http.ResponseWriter, r *http.Request, authErr error)) http.Handler {
 
 	return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
-		for _, authenticator := range auth.authenticators {
-			user, err := authenticator.Auth(rw, r)
+
+		user, err := auth.JwtAuth.AuthViaJWT(rw, r)
+		if user == nil {
+			user, err = auth.AuthViaSession(rw, r)
 			if err != nil {
 				log.Infof("authentication failed: %s", err.Error())
 				http.Error(rw, err.Error(), http.StatusUnauthorized)
 				return
 			}
-			if user == nil {
-				continue
-			}
+		}
 
+		if user != nil {
 			ctx := context.WithValue(r.Context(), ContextUserKey, user)
 			onsuccess.ServeHTTP(rw, r.WithContext(ctx))
 			return
 		}
 
-		log.Debugf("authentication failed: %s", "no authenticator applied")
-		// http.Error(rw, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
-		onfailure(rw, r, errors.New("unauthorized (login first or use a token)"))
+		log.Debug("authentication failed: no authenticator applied")
+		onfailure(rw, r, errors.New("unauthorized (please login first)"))
 	})
 }
 
-// Clears the session cookie
 func (auth *Authentication) Logout(onsuccess http.Handler) http.Handler {
-
 	return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 		session, err := auth.sessionStore.Get(r, "session")
 		if err != nil {
diff --git a/internal/auth/jwt.go b/internal/auth/jwt.go
index 8df7017..75a69b8 100644
--- a/internal/auth/jwt.go
+++ b/internal/auth/jwt.go
@@ -6,10 +6,8 @@ package auth
 
 import (
 	"crypto/ed25519"
-	"database/sql"
 	"encoding/base64"
 	"errors"
-	"fmt"
 	"net/http"
 	"os"
 	"strings"
@@ -23,17 +21,11 @@ import (
 type JWTAuthenticator struct {
 	auth *Authentication
 
-	publicKey           ed25519.PublicKey
-	privateKey          ed25519.PrivateKey
-	publicKeyCrossLogin ed25519.PublicKey // For accepting externally generated JWTs
-
-	loginTokenKey []byte // HS256 key
-
-	config *schema.JWTAuthConfig
+	publicKey  ed25519.PublicKey
+	privateKey ed25519.PrivateKey
+	config     *schema.JWTAuthConfig
 }
 
-var _ Authenticator = (*JWTAuthenticator)(nil)
-
 func (ja *JWTAuthenticator) Init(auth *Authentication, conf interface{}) error {
 
 	ja.auth = auth
@@ -57,128 +49,10 @@ func (ja *JWTAuthenticator) Init(auth *Authentication, conf interface{}) error {
 		ja.privateKey = ed25519.PrivateKey(bytes)
 	}
 
-	if pubKey = os.Getenv("CROSS_LOGIN_JWT_HS512_KEY"); pubKey != "" {
-		bytes, err := base64.StdEncoding.DecodeString(pubKey)
-		if err != nil {
-			log.Warn("Could not decode cross login JWT HS512 key")
-			return err
-		}
-		ja.loginTokenKey = bytes
-	}
-
-	// Look for external public keys
-	pubKeyCrossLogin, keyFound := os.LookupEnv("CROSS_LOGIN_JWT_PUBLIC_KEY")
-	if keyFound && pubKeyCrossLogin != "" {
-		bytes, err := base64.StdEncoding.DecodeString(pubKeyCrossLogin)
-		if err != nil {
-			log.Warn("Could not decode cross login JWT public key")
-			return err
-		}
-		ja.publicKeyCrossLogin = ed25519.PublicKey(bytes)
-
-		// Warn if other necessary settings are not configured
-		if ja.config != nil {
-			if ja.config.CookieName == "" {
-				log.Warn("cookieName for JWTs not configured (cross login via JWT cookie will fail)")
-			}
-			if !ja.config.ForceJWTValidationViaDatabase {
-				log.Warn("forceJWTValidationViaDatabase not set to true: CC will accept users and roles defined in JWTs regardless of its own database!")
-			}
-			if ja.config.TrustedExternalIssuer == "" {
-				log.Warn("trustedExternalIssuer for JWTs not configured (cross login via JWT cookie will fail)")
-			}
-		} else {
-			log.Warn("cookieName and trustedExternalIssuer for JWTs not configured (cross login via JWT cookie will fail)")
-		}
-	} else {
-		ja.publicKeyCrossLogin = nil
-		log.Debug("environment variable 'CROSS_LOGIN_JWT_PUBLIC_KEY' not set (cross login token based authentication will not work)")
-	}
-
 	return nil
 }
 
-func (ja *JWTAuthenticator) CanLogin(
-	user *User,
-	rw http.ResponseWriter,
-	r *http.Request) bool {
-
-	return (user != nil && user.AuthSource == AuthViaToken) ||
-		r.Header.Get("Authorization") != "" ||
-		r.URL.Query().Get("login-token") != ""
-}
-
-func (ja *JWTAuthenticator) Login(
-	user *User,
-	rw http.ResponseWriter,
-	r *http.Request) (*User, error) {
-
-	rawtoken := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
-	if rawtoken == "" {
-		rawtoken = r.URL.Query().Get("login-token")
-	}
-
-	token, err := jwt.Parse(rawtoken, func(t *jwt.Token) (interface{}, error) {
-		if t.Method == jwt.SigningMethodEdDSA {
-			return ja.publicKey, nil
-		}
-		if t.Method == jwt.SigningMethodHS256 || t.Method == jwt.SigningMethodHS512 {
-			return ja.loginTokenKey, nil
-		}
-		return nil, fmt.Errorf("AUTH/JWT > unkown signing method for login token: %s (known: HS256, HS512, EdDSA)", t.Method.Alg())
-	})
-	if err != nil {
-		log.Warn("Error while parsing jwt token")
-		return nil, err
-	}
-
-	if err = token.Claims.Valid(); err != nil {
-		log.Warn("jwt token claims are not valid")
-		return nil, err
-	}
-
-	claims := token.Claims.(jwt.MapClaims)
-	sub, _ := claims["sub"].(string)
-	exp, _ := claims["exp"].(float64)
-	var roles []string
-	if rawroles, ok := claims["roles"].([]interface{}); ok {
-		for _, rr := range rawroles {
-			if r, ok := rr.(string); ok {
-				if isValidRole(r) {
-					roles = append(roles, r)
-				}
-			}
-		}
-	}
-	if rawrole, ok := claims["roles"].(string); ok {
-		if isValidRole(rawrole) {
-			roles = append(roles, rawrole)
-		}
-	}
-
-	if user == nil {
-		user, err = ja.auth.GetUser(sub)
-		if err != nil && err != sql.ErrNoRows {
-			log.Errorf("Error while loading user '%v'", sub)
-			return nil, err
-		} else if user == nil {
-			user = &User{
-				Username:   sub,
-				Roles:      roles,
-				AuthSource: AuthViaToken,
-			}
-			if err := ja.auth.AddUser(user); err != nil {
-				log.Errorf("Error while adding user '%v' to auth from token", user.Username)
-				return nil, err
-			}
-		}
-	}
-
-	user.Expiration = time.Unix(int64(exp), 0)
-	return user, nil
-}
-
-func (ja *JWTAuthenticator) Auth(
+func (ja *JWTAuthenticator) AuthViaJWT(
 	rw http.ResponseWriter,
 	r *http.Request) (*User, error) {
 
@@ -188,59 +62,17 @@ func (ja *JWTAuthenticator) Auth(
 		rawtoken = strings.TrimPrefix(rawtoken, "Bearer ")
 	}
 
-	// If no auth header was found, check for a certain cookie containing a JWT
-	cookieName := ""
-	cookieFound := false
-	if ja.config != nil && ja.config.CookieName != "" {
-		cookieName = ja.config.CookieName
-	}
-
-	// Try to read the JWT cookie
-	if rawtoken == "" && cookieName != "" {
-		jwtCookie, err := r.Cookie(cookieName)
-
-		if err == nil && jwtCookie.Value != "" {
-			rawtoken = jwtCookie.Value
-			cookieFound = true
-		}
-	}
-
-	// Because a user can also log in via a token, the
-	// session cookie must be checked here as well:
-	if rawtoken == "" {
-		return ja.auth.AuthViaSession(rw, r)
-	}
-
-	// Try to parse JWT
 	token, err := jwt.Parse(rawtoken, func(t *jwt.Token) (interface{}, error) {
 		if t.Method != jwt.SigningMethodEdDSA {
 			return nil, errors.New("only Ed25519/EdDSA supported")
 		}
 
-		// Is there more than one public key?
-		if ja.publicKeyCrossLogin != nil &&
-			ja.config != nil &&
-			ja.config.TrustedExternalIssuer != "" {
-
-			// Determine whether to use the external public key
-			unvalidatedIssuer, success := t.Claims.(jwt.MapClaims)["iss"].(string)
-			if success && unvalidatedIssuer == ja.config.TrustedExternalIssuer {
-				// The (unvalidated) issuer seems to be the expected one,
-				// use public cross login key from config
-				return ja.publicKeyCrossLogin, nil
-			}
-		}
-
-		// No cross login key configured or issuer not expected
-		// Try own key
 		return ja.publicKey, nil
 	})
 	if err != nil {
-		log.Warn("Error while parsing token")
+		log.Warn("Error while parsing JWT token")
 		return nil, err
 	}
-
-	// Check token validity
 	if err := token.Claims.Valid(); err != nil {
 		log.Warn("jwt token claims are not valid")
 		return nil, err
@@ -261,7 +93,6 @@ func (ja *JWTAuthenticator) Auth(
 			log.Warn("Could not find user from JWT in internal database.")
 			return nil, errors.New("unknown user")
 		}
-
 		// Take user roles from database instead of trusting the JWT
 		roles = user.Roles
 	} else {
@@ -275,41 +106,10 @@ func (ja *JWTAuthenticator) Auth(
 		}
 	}
 
-	if cookieFound {
-		// Create a session so that we no longer need the JTW Cookie
-		session, err := ja.auth.sessionStore.New(r, "session")
-		if err != nil {
-			log.Errorf("session creation failed: %s", err.Error())
-			http.Error(rw, err.Error(), http.StatusInternalServerError)
-			return nil, err
-		}
-
-		if ja.auth.SessionMaxAge != 0 {
-			session.Options.MaxAge = int(ja.auth.SessionMaxAge.Seconds())
-		}
-		session.Values["username"] = sub
-		session.Values["roles"] = roles
-
-		if err := ja.auth.sessionStore.Save(r, rw, session); err != nil {
-			log.Warnf("session save failed: %s", err.Error())
-			http.Error(rw, err.Error(), http.StatusInternalServerError)
-			return nil, err
-		}
-
-		// (Ask browser to) Delete JWT cookie
-		deletedCookie := &http.Cookie{
-			Name:     cookieName,
-			Value:    "",
-			Path:     "/",
-			MaxAge:   -1,
-			HttpOnly: true,
-		}
-		http.SetCookie(rw, deletedCookie)
-	}
-
 	return &User{
 		Username:   sub,
 		Roles:      roles,
+		AuthType:   AuthSession,
 		AuthSource: AuthViaToken,
 	}, nil
 }
diff --git a/internal/auth/jwtCookieSession.go b/internal/auth/jwtCookieSession.go
new file mode 100644
index 0000000..1ae3a5b
--- /dev/null
+++ b/internal/auth/jwtCookieSession.go
@@ -0,0 +1,224 @@
+// Copyright (C) 2023 NHR@FAU, University Erlangen-Nuremberg.
+// All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+package auth
+
+import (
+	"crypto/ed25519"
+	"encoding/base64"
+	"errors"
+	"net/http"
+	"os"
+	"time"
+
+	"github.com/ClusterCockpit/cc-backend/pkg/log"
+	"github.com/ClusterCockpit/cc-backend/pkg/schema"
+	"github.com/golang-jwt/jwt/v4"
+)
+
+type JWTCookieSessionAuthenticator struct {
+	auth *Authentication
+
+	publicKey           ed25519.PublicKey
+	privateKey          ed25519.PrivateKey
+	publicKeyCrossLogin ed25519.PublicKey // For accepting externally generated JWTs
+
+	loginTokenKey []byte // HS256 key
+
+	config *schema.JWTAuthConfig
+}
+
+var _ Authenticator = (*JWTCookieSessionAuthenticator)(nil)
+
+func (ja *JWTCookieSessionAuthenticator) Init(auth *Authentication, conf interface{}) error {
+
+	ja.auth = auth
+	ja.config = conf.(*schema.JWTAuthConfig)
+
+	pubKey, privKey := os.Getenv("JWT_PUBLIC_KEY"), os.Getenv("JWT_PRIVATE_KEY")
+	if pubKey == "" || privKey == "" {
+		log.Warn("environment variables 'JWT_PUBLIC_KEY' or 'JWT_PRIVATE_KEY' not set (token based authentication will not work)")
+		return errors.New("environment variables 'JWT_PUBLIC_KEY' or 'JWT_PRIVATE_KEY' not set (token based authentication will not work)")
+	} else {
+		bytes, err := base64.StdEncoding.DecodeString(pubKey)
+		if err != nil {
+			log.Warn("Could not decode JWT public key")
+			return err
+		}
+		ja.publicKey = ed25519.PublicKey(bytes)
+		bytes, err = base64.StdEncoding.DecodeString(privKey)
+		if err != nil {
+			log.Warn("Could not decode JWT private key")
+			return err
+		}
+		ja.privateKey = ed25519.PrivateKey(bytes)
+	}
+
+	if pubKey = os.Getenv("CROSS_LOGIN_JWT_HS512_KEY"); pubKey != "" {
+		bytes, err := base64.StdEncoding.DecodeString(pubKey)
+		if err != nil {
+			log.Warn("Could not decode cross login JWT HS512 key")
+			return err
+		}
+		ja.loginTokenKey = bytes
+	}
+
+	// Look for external public keys
+	pubKeyCrossLogin, keyFound := os.LookupEnv("CROSS_LOGIN_JWT_PUBLIC_KEY")
+	if keyFound && pubKeyCrossLogin != "" {
+		bytes, err := base64.StdEncoding.DecodeString(pubKeyCrossLogin)
+		if err != nil {
+			log.Warn("Could not decode cross login JWT public key")
+			return err
+		}
+		ja.publicKeyCrossLogin = ed25519.PublicKey(bytes)
+	} else {
+		ja.publicKeyCrossLogin = nil
+		log.Debug("environment variable 'CROSS_LOGIN_JWT_PUBLIC_KEY' not set (cross login token based authentication will not work)")
+		return errors.New("environment variable 'CROSS_LOGIN_JWT_PUBLIC_KEY' not set (cross login token based authentication will not work)")
+	}
+
+	// Warn if other necessary settings are not configured
+	if ja.config != nil {
+		if ja.config.CookieName == "" {
+			log.Warn("cookieName for JWTs not configured (cross login via JWT cookie will fail)")
+			return errors.New("cookieName for JWTs not configured (cross login via JWT cookie will fail)")
+		}
+		if !ja.config.ForceJWTValidationViaDatabase {
+			log.Warn("forceJWTValidationViaDatabase not set to true: CC will accept users and roles defined in JWTs regardless of its own database!")
+		}
+		if ja.config.TrustedExternalIssuer == "" {
+			log.Warn("trustedExternalIssuer for JWTs not configured (cross login via JWT cookie will fail)")
+			return errors.New("trustedExternalIssuer for JWTs not configured (cross login via JWT cookie will fail)")
+		}
+	} else {
+		log.Warn("config for JWTs not configured (cross login via JWT cookie will fail)")
+		return errors.New("config for JWTs not configured (cross login via JWT cookie will fail)")
+	}
+
+	return nil
+}
+
+func (ja *JWTCookieSessionAuthenticator) CanLogin(
+	user *User,
+	rw http.ResponseWriter,
+	r *http.Request) bool {
+
+	if ja.publicKeyCrossLogin == nil ||
+		ja.config == nil ||
+		ja.config.TrustedExternalIssuer == "" {
+
+		return false
+	}
+
+	cookieName := ""
+	if ja.config != nil && ja.config.CookieName != "" {
+		cookieName = ja.config.CookieName
+	}
+
+	// Try to read the JWT cookie
+	if cookieName != "" {
+		jwtCookie, err := r.Cookie(cookieName)
+
+		if err == nil && jwtCookie.Value != "" {
+			return true
+		}
+	}
+
+	return false
+}
+
+func (ja *JWTCookieSessionAuthenticator) Login(
+	user *User,
+	rw http.ResponseWriter,
+	r *http.Request) (*User, error) {
+
+	jwtCookie, err := r.Cookie(ja.config.CookieName)
+	var rawtoken string
+
+	if err == nil && jwtCookie.Value != "" {
+		rawtoken = jwtCookie.Value
+	}
+
+	token, err := jwt.Parse(rawtoken, func(t *jwt.Token) (interface{}, error) {
+		if t.Method != jwt.SigningMethodEdDSA {
+			return nil, errors.New("only Ed25519/EdDSA supported")
+		}
+
+		unvalidatedIssuer, success := t.Claims.(jwt.MapClaims)["iss"].(string)
+		if success && unvalidatedIssuer == ja.config.TrustedExternalIssuer {
+			// The (unvalidated) issuer seems to be the expected one,
+			// use public cross login key from config
+			return ja.publicKeyCrossLogin, nil
+		}
+
+		// No cross login key configured or issuer not expected
+		// Try own key
+		return ja.publicKey, nil
+	})
+	if err != nil {
+		log.Warn("Error while parsing token")
+		return nil, err
+	}
+
+	// Check token validity and extract paypload
+	if err := token.Claims.Valid(); err != nil {
+		log.Warn("jwt token claims are not valid")
+		return nil, err
+	}
+
+	claims := token.Claims.(jwt.MapClaims)
+	sub, _ := claims["sub"].(string)
+	exp, _ := claims["exp"].(float64)
+
+	var name string
+	if val, ok := claims["name"]; ok {
+		name, _ = val.(string)
+	}
+
+	var roles []string
+
+	if ja.config.ForceJWTValidationViaDatabase {
+		// Deny any logins for unknown usernames
+		if user == nil {
+			log.Warn("Could not find user from JWT in internal database.")
+			return nil, errors.New("unknown user")
+		}
+
+		// Take user roles from database instead of trusting the JWT
+		roles = user.Roles
+	} else {
+		// Extract roles from JWT (if present)
+		if rawroles, ok := claims["roles"].([]interface{}); ok {
+			for _, rr := range rawroles {
+				if r, ok := rr.(string); ok {
+					roles = append(roles, r)
+				}
+			}
+		}
+	}
+
+	// (Ask browser to) Delete JWT cookie
+	deletedCookie := &http.Cookie{
+		Name:     ja.config.CookieName,
+		Value:    "",
+		Path:     "/",
+		MaxAge:   -1,
+		HttpOnly: true,
+	}
+	http.SetCookie(rw, deletedCookie)
+
+	if user == nil {
+		user = &User{
+			Username:   sub,
+			Name:       name,
+			Roles:      roles,
+			AuthType:   AuthSession,
+			AuthSource: AuthViaToken,
+		}
+	}
+
+	user.Expiration = time.Unix(int64(exp), 0)
+	return user, nil
+}
diff --git a/internal/auth/jwtSession.go b/internal/auth/jwtSession.go
new file mode 100644
index 0000000..7c4f6f0
--- /dev/null
+++ b/internal/auth/jwtSession.go
@@ -0,0 +1,103 @@
+// Copyright (C) 2022 NHR@FAU, University Erlangen-Nuremberg.
+// All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+package auth
+
+import (
+	"encoding/base64"
+	"fmt"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/ClusterCockpit/cc-backend/pkg/log"
+	"github.com/golang-jwt/jwt/v4"
+)
+
+type JWTSessionAuthenticator struct {
+	auth *Authentication
+
+	loginTokenKey []byte // HS256 key
+}
+
+var _ Authenticator = (*JWTSessionAuthenticator)(nil)
+
+func (ja *JWTSessionAuthenticator) Init(auth *Authentication, conf interface{}) error {
+
+	ja.auth = auth
+
+	if pubKey := os.Getenv("CROSS_LOGIN_JWT_HS512_KEY"); pubKey != "" {
+		bytes, err := base64.StdEncoding.DecodeString(pubKey)
+		if err != nil {
+			log.Warn("Could not decode cross login JWT HS512 key")
+			return err
+		}
+		ja.loginTokenKey = bytes
+	}
+
+	return nil
+}
+
+func (ja *JWTSessionAuthenticator) CanLogin(
+	user *User,
+	rw http.ResponseWriter,
+	r *http.Request) bool {
+
+	return r.Header.Get("Authorization") != ""
+}
+
+func (ja *JWTSessionAuthenticator) Login(
+	user *User,
+	rw http.ResponseWriter,
+	r *http.Request) (*User, error) {
+
+	rawtoken := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+	token, err := jwt.Parse(rawtoken, func(t *jwt.Token) (interface{}, error) {
+		if t.Method == jwt.SigningMethodHS256 || t.Method == jwt.SigningMethodHS512 {
+			return ja.loginTokenKey, nil
+		}
+		return nil, fmt.Errorf("AUTH/JWT > unkown signing method for login token: %s (known: HS256, HS512, EdDSA)", t.Method.Alg())
+	})
+	if err != nil {
+		log.Warn("Error while parsing jwt token")
+		return nil, err
+	}
+
+	if err = token.Claims.Valid(); err != nil {
+		log.Warn("jwt token claims are not valid")
+		return nil, err
+	}
+
+	claims := token.Claims.(jwt.MapClaims)
+	sub, _ := claims["sub"].(string)
+	exp, _ := claims["exp"].(float64)
+
+	var name string
+	if val, ok := claims["name"]; ok {
+		name, _ = val.(string)
+	}
+
+	var roles []string
+	if rawroles, ok := claims["roles"]; ok {
+		for _, r := range rawroles.([]string) {
+			if isValidRole(r) {
+				roles = append(roles, r)
+			}
+		}
+	}
+
+	if user == nil {
+		user = &User{
+			Username:   sub,
+			Name:       name,
+			Roles:      roles,
+			AuthType:   AuthSession,
+			AuthSource: AuthViaToken,
+		}
+	}
+
+	user.Expiration = time.Unix(int64(exp), 0)
+	return user, nil
+}
diff --git a/internal/auth/ldap.go b/internal/auth/ldap.go
index 81b0d93..fc9753d 100644
--- a/internal/auth/ldap.go
+++ b/internal/auth/ldap.go
@@ -1,4 +1,4 @@
-// Copyright (C) 2022 NHR@FAU, University Erlangen-Nuremberg.
+// Copyright (C) 2023 NHR@FAU, University Erlangen-Nuremberg.
 // All rights reserved.
 // Use of this source code is governed by a MIT-style
 // license that can be found in the LICENSE file.
@@ -93,13 +93,6 @@ func (la *LdapAuthenticator) Login(
 	return user, nil
 }
 
-func (la *LdapAuthenticator) Auth(
-	rw http.ResponseWriter,
-	r *http.Request) (*User, error) {
-
-	return la.auth.AuthViaSession(rw, r)
-}
-
 func (la *LdapAuthenticator) Sync() error {
 
 	const IN_DB int = 1
diff --git a/internal/auth/local.go b/internal/auth/local.go
index 29996a4..8854aff 100644
--- a/internal/auth/local.go
+++ b/internal/auth/local.go
@@ -46,10 +46,3 @@ func (la *LocalAuthenticator) Login(
 
 	return user, nil
 }
-
-func (la *LocalAuthenticator) Auth(
-	rw http.ResponseWriter,
-	r *http.Request) (*User, error) {
-
-	return la.auth.AuthViaSession(rw, r)
-}
diff --git a/internal/auth/roles.go b/internal/auth/roles.go
new file mode 100644
index 0000000..e352df1
--- /dev/null
+++ b/internal/auth/roles.go
@@ -0,0 +1,165 @@
+// Copyright (C) 2023 NHR@FAU, University Erlangen-Nuremberg.
+// All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+package auth
+
+import (
+	"fmt"
+	"strings"
+)
+
+type Role int
+
+const (
+	RoleAnonymous Role = iota
+	RoleApi
+	RoleUser
+	RoleManager
+	RoleSupport
+	RoleAdmin
+	RoleError
+)
+
+func GetRoleString(roleInt Role) string {
+	return [6]string{"anonymous", "api", "user", "manager", "support", "admin"}[roleInt]
+}
+
+func getRoleEnum(roleStr string) Role {
+	switch strings.ToLower(roleStr) {
+	case "admin":
+		return RoleAdmin
+	case "support":
+		return RoleSupport
+	case "manager":
+		return RoleManager
+	case "user":
+		return RoleUser
+	case "api":
+		return RoleApi
+	case "anonymous":
+		return RoleAnonymous
+	default:
+		return RoleError
+	}
+}
+
+func isValidRole(role string) bool {
+	return getRoleEnum(role) != RoleError
+}
+
+func (u *User) HasValidRole(role string) (hasRole bool, isValid bool) {
+	if isValidRole(role) {
+		for _, r := range u.Roles {
+			if r == role {
+				return true, true
+			}
+		}
+		return false, true
+	}
+	return false, false
+}
+
+func (u *User) HasRole(role Role) bool {
+	for _, r := range u.Roles {
+		if r == GetRoleString(role) {
+			return true
+		}
+	}
+	return false
+}
+
+// Role-Arrays are short: performance not impacted by nested loop
+func (u *User) HasAnyRole(queryroles []Role) bool {
+	for _, ur := range u.Roles {
+		for _, qr := range queryroles {
+			if ur == GetRoleString(qr) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// Role-Arrays are short: performance not impacted by nested loop
+func (u *User) HasAllRoles(queryroles []Role) bool {
+	target := len(queryroles)
+	matches := 0
+	for _, ur := range u.Roles {
+		for _, qr := range queryroles {
+			if ur == GetRoleString(qr) {
+				matches += 1
+				break
+			}
+		}
+	}
+
+	if matches == target {
+		return true
+	} else {
+		return false
+	}
+}
+
+// Role-Arrays are short: performance not impacted by nested loop
+func (u *User) HasNotRoles(queryroles []Role) bool {
+	matches := 0
+	for _, ur := range u.Roles {
+		for _, qr := range queryroles {
+			if ur == GetRoleString(qr) {
+				matches += 1
+				break
+			}
+		}
+	}
+
+	if matches == 0 {
+		return true
+	} else {
+		return false
+	}
+}
+
+// Called by API endpoint '/roles/' from frontend: Only required for admin config -> Check Admin Role
+func GetValidRoles(user *User) ([]string, error) {
+	var vals []string
+	if user.HasRole(RoleAdmin) {
+		for i := RoleApi; i < RoleError; i++ {
+			vals = append(vals, GetRoleString(i))
+		}
+		return vals, nil
+	}
+
+	return vals, fmt.Errorf("%s: only admins are allowed to fetch a list of roles", user.Username)
+}
+
+// Called by routerConfig web.page setup in backend: Only requires known user
+func GetValidRolesMap(user *User) (map[string]Role, error) {
+	named := make(map[string]Role)
+	if user.HasNotRoles([]Role{RoleAnonymous}) {
+		for i := RoleApi; i < RoleError; i++ {
+			named[GetRoleString(i)] = i
+		}
+		return named, nil
+	}
+	return named, fmt.Errorf("only known users are allowed to fetch a list of roles")
+}
+
+// Find highest role
+func (u *User) GetAuthLevel() Role {
+	if u.HasRole(RoleAdmin) {
+		return RoleAdmin
+	} else if u.HasRole(RoleSupport) {
+		return RoleSupport
+	} else if u.HasRole(RoleManager) {
+		return RoleManager
+	} else if u.HasRole(RoleUser) {
+		return RoleUser
+	} else if u.HasRole(RoleApi) {
+		return RoleApi
+	} else if u.HasRole(RoleAnonymous) {
+		return RoleAnonymous
+	} else {
+		return RoleError
+	}
+}
diff --git a/internal/repository/testdata/job.db b/internal/repository/testdata/job.db
index 9b37f8418f890cccde8d9ad665b8b75878a72e65..4b00aa55f041b70f717177bc7baef9eb69d1a226 100644
GIT binary patch
delta 850
zcmZp8z}C>fK0#Vggn@xU28g+Um<fnwC+ZkmiZJNK%di4@jQqcWB!dk9Z@&MG+I*LI
zPw@6~|K`5Lrpw00x|TJKRfJ_TOCk$1^EzfHh6fA}CNA_~bCh8d57nQ1fm=;8FSR`0
zFgZUjEi=8eD6u3nKQA6ABmp#$17vKI5*xd?q$FdD{A4#?e@%tVyyDcNlK7Hhg%H<>
z5Cs=kH^)$)5C!MZpdeSjkoXW!U)SIeN8f<SQ+OA1HRiLhiwg@gHoH#F;Oihk^Lsw?
z&Gn3Xx!F`%*~Be{few}6EJ;j{Hv|%FlhydIf;=uFxJlqYKO@^F1u$vACctu&f&b=a
zL4ou9>Z**a45ISJr6rj;Nr`zW<(VlZ8Ab+1#<~U;x`u`d2If|#mR3dvivk=b2C%a-
z0*&L`EZFd#e_{aZq6HI7c!6QX$*9f1Kb2pNDF70%&_LBCDquw>cUX9_0ZsA7AI?A(
z0~^jPyuD1XH#al7bFl!^lI!Gi+~yz#*Je&0V@6!ze`}iqBa6afmIj6GEDel*^yPSg
z0m#jLlZpQ(e*?cI-*dh;J`>(+yp6n~JR;nnC|SqN4-5%LhRnQ_)QaN597~zWXSgl6
zB^qm_*~Qh>8Jo=~^Yh3nh&u<lI)=C^gg83+xGE^2q)R0Q4X)`4b&R4KI$R)$?9@sH
xg|ft=<c!234I@)iO&zYX#GKMp1t2I%ttipqnmm<9aq@Pa2qr&GU~+oR1OS9N=tckl

delta 837
zcmZo@U~hQ9HbGiYn1O*o8i+-Jm>GyACh8cQ3Nz@%%kY9k8S5GNr}C@u#qpW*+VJx8
zuyUW`vf$!p$zpM4e#N|)IgsfC(>x{z#@CGXlLZA@CjaJ6-!8hB@io(CUA9XcT#XfM
z?BbG=jLqJYO&R?suVY*^`9GgJSEDNnyST70V^iVeD5j3dJj`a()$AE>Z4&s;&&aY#
z0ZbaO39!6n;D5VWP~b7YuplD~gQ$FINoGz`VqQvlW=cuMq5y|&1&k~Ln^_k8={Ep6
z76h1pSOSQ}p%}y#1Y!Xo<_BUvAO?AiWxK%w#tZ!092i*?)C8H9WA!EHHqLxbS&mB_
ztxVULmIED9%fzND#3t@2J^lWEMj89O)be=4to)>SAVaKMN041yTAFd1eo10dPAXIw
zN{KoLxjKfpDug&X`M4@T1viJX)v`)@3$Tf+3Nz+r=B1=ofMk*?<BLlYOH!wQ+{-Ac
z4&y0+fWIF|uYv|h8CZ>`CqJ9Gx-et<^!|N}qKpF5m+oWKVb%=boBnbiqulf*K*8xU
z`x)gJd8b?NXOx_5!YVpFb3da5BhTdZtP;~h_A?4iU$dW4ck?A~U1kzv3!Ff>*cLJH
mALTRV<Ko@Oo5d@^bC#!p?IPPEU|_Ye4d1}}#<;A3(EtEois%CX


From c04344bfde2101642994eba0e7d0e082c626da35 Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Fri, 11 Aug 2023 10:25:35 +0200
Subject: [PATCH 32/62] Remove unused css styles

---
 web/frontend/src/Status.root.svelte | 14 +-------------
 1 file changed, 1 insertion(+), 13 deletions(-)

diff --git a/web/frontend/src/Status.root.svelte b/web/frontend/src/Status.root.svelte
index 11aa255..d402c08 100644
--- a/web/frontend/src/Status.root.svelte
+++ b/web/frontend/src/Status.root.svelte
@@ -237,16 +237,4 @@
             {/key}
         </Col>
     </Row>
-{/if}
-
-<style>
-    .colorBoxWrapper {
-        display: flex;
-    }
-
-    .colorBox {
-        width: 20px;
-        height: 20px;
-        border: 1px solid rgba(0, 0, 0, .2);
-    }
-</style>
\ No newline at end of file
+{/if}
\ No newline at end of file

From f758e52ccd0d0904a13781347be70f1fe58f072f Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Fri, 11 Aug 2023 11:42:30 +0200
Subject: [PATCH 33/62] Disable chart.js animations

---
 web/frontend/src/plots/Pie.svelte   | 1 +
 web/frontend/src/plots/Polar.svelte | 1 +
 2 files changed, 2 insertions(+)

diff --git a/web/frontend/src/plots/Pie.svelte b/web/frontend/src/plots/Pie.svelte
index 326c062..0db451f 100644
--- a/web/frontend/src/plots/Pie.svelte
+++ b/web/frontend/src/plots/Pie.svelte
@@ -55,6 +55,7 @@
 
     const options = { 
         maintainAspectRatio: false,
+        animation: false,
         plugins: {
             legend: {
                 display: displayLegend
diff --git a/web/frontend/src/plots/Polar.svelte b/web/frontend/src/plots/Polar.svelte
index bf4385f..e556cc2 100644
--- a/web/frontend/src/plots/Polar.svelte
+++ b/web/frontend/src/plots/Polar.svelte
@@ -89,6 +89,7 @@
     // No custom defined options but keep for clarity 
     const options = {
         maintainAspectRatio: false,
+        animation: false
     }
 
 </script>

From 05b43c0f21c87b746fc0ca155d36cc3460440a5b Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Fri, 11 Aug 2023 13:34:30 +0200
Subject: [PATCH 34/62] Cleanup and fixes on new plots

---
 web/frontend/src/Analysis.root.svelte        |  11 +-
 web/frontend/src/Status.root.svelte          |   6 +-
 web/frontend/src/User.root.svelte            |   6 +-
 web/frontend/src/plots/Histogram.svelte      | 361 +++++++++----------
 web/frontend/src/plots/Histogramuplot.svelte | 216 -----------
 web/frontend/src/plots/Pie.svelte            |   2 +
 web/frontend/src/utils.js                    |  43 +++
 7 files changed, 231 insertions(+), 414 deletions(-)
 delete mode 100644 web/frontend/src/plots/Histogramuplot.svelte

diff --git a/web/frontend/src/Analysis.root.svelte b/web/frontend/src/Analysis.root.svelte
index e7fe720..63751b4 100644
--- a/web/frontend/src/Analysis.root.svelte
+++ b/web/frontend/src/Analysis.root.svelte
@@ -5,9 +5,9 @@
     import { Row, Col, Spinner, Card, Table, Icon } from 'sveltestrap'
     import Filters from './filters/Filters.svelte'
     import PlotSelection from './PlotSelection.svelte'
-    import Histogramuplot from './plots/Histogramuplot.svelte'
+    import Histogram from './plots/Histogram.svelte'
     import Pie, { colors } from './plots/Pie.svelte'
-    import { binsFromFootprint } from './plots/Histogram.svelte'
+    import { binsFromFootprint } from './utils.js'
     import ScatterPlot from './plots/Scatter.svelte'
     import PlotTable from './PlotTable.svelte'
     import Roofline from './plots/Roofline.svelte'
@@ -204,7 +204,7 @@
         <Col>
             <div bind:clientWidth={colWidth3}>
             {#key $statsQuery.data.stats[0].histDuration}
-                <Histogramuplot
+                <Histogram
                     width={colWidth3} height={300}
                     data={convert2uplot($statsQuery.data.stats[0].histDuration)}
                     title="Duration Distribution"
@@ -218,7 +218,7 @@
         <Col>
             <div bind:clientWidth={colWidth4}>
             {#key $statsQuery.data.stats[0].histNumNodes}
-                <Histogramuplot
+                <Histogram
                     width={colWidth4} height={300}
                     data={convert2uplot($statsQuery.data.stats[0].histNumNodes)}
                     title="Number of Nodes Distribution"
@@ -261,7 +261,7 @@
                     $footprintsQuery.data.footprints.metrics.find(f => f.metric == metric).data, numBins) }))}
                 itemsPerRow={ccconfig.plot_view_plotsPerRow}>
 
-                <Histogramuplot
+                <Histogram
                     data={convert2uplot(item.bins)}
                     width={width} height={250}
                     title="Average Distribution of '{item.metric}'"
@@ -289,6 +289,7 @@
             <PlotTable
                 let:item
                 let:width
+                renderFor="analysis"
                 items={metricsInScatterplots.map(([m1, m2]) => ({
                     m1, f1: $footprintsQuery.data.footprints.metrics.find(f => f.metric == m1).data,
                     m2, f2: $footprintsQuery.data.footprints.metrics.find(f => f.metric == m2).data }))}
diff --git a/web/frontend/src/Status.root.svelte b/web/frontend/src/Status.root.svelte
index d402c08..244862c 100644
--- a/web/frontend/src/Status.root.svelte
+++ b/web/frontend/src/Status.root.svelte
@@ -2,7 +2,7 @@
     import Refresher from './joblist/Refresher.svelte'
     import Roofline, { transformPerNodeData } from './plots/Roofline.svelte'
     import Pie, { colors } from './plots/Pie.svelte'
-    import Histogramuplot from './plots/Histogramuplot.svelte'
+    import Histogram from './plots/Histogram.svelte'
     import { Row, Col, Spinner, Card, CardHeader, CardTitle, CardBody, Table, Progress, Icon } from 'sveltestrap'
     import { init, convert2uplot } from './utils.js'
     import { scaleNumbers } from './units.js'
@@ -213,7 +213,7 @@
         <Col class="p-2">
             <div bind:clientWidth={colWidth2}>
                 {#key $mainQuery.data.stats}
-                    <Histogramuplot
+                    <Histogram
                         data={convert2uplot($mainQuery.data.stats[0].histDuration)}
                         width={colWidth2 - 25}
                         title="Duration Distribution"
@@ -226,7 +226,7 @@
         </Col>
         <Col class="p-2">
             {#key $mainQuery.data.stats}
-                <Histogramuplot
+                <Histogram
                     data={convert2uplot($mainQuery.data.stats[0].histNumNodes)}
                     width={colWidth2 - 25}
                     title="Number of Nodes Distribution"
diff --git a/web/frontend/src/User.root.svelte b/web/frontend/src/User.root.svelte
index c874105..3871f60 100644
--- a/web/frontend/src/User.root.svelte
+++ b/web/frontend/src/User.root.svelte
@@ -7,7 +7,7 @@
     import JobList from './joblist/JobList.svelte'
     import Sorting from './joblist/SortSelection.svelte'
     import Refresher from './joblist/Refresher.svelte'
-    import Histogramuplot from './plots/Histogramuplot.svelte'
+    import Histogram from './plots/Histogram.svelte'
     import MetricSelection from './MetricSelection.svelte'
     import { scramble, scrambleNames } from './joblist/JobInfo.svelte'
 
@@ -135,7 +135,7 @@
         </Col>
         <div class="col-4 text-center" bind:clientWidth={w1}>
             {#key $stats.data.jobsStatistics[0].histDuration}
-                <Histogramuplot
+                <Histogram
                     data={convert2uplot($stats.data.jobsStatistics[0].histDuration)}
                     width={w1 - 25} height={histogramHeight}
                     title="Duration Distribution"
@@ -147,7 +147,7 @@
         </div>
         <div class="col-4 text-center" bind:clientWidth={w2}>
             {#key $stats.data.jobsStatistics[0].histNumNodes}
-                <Histogramuplot
+                <Histogram
                     data={convert2uplot($stats.data.jobsStatistics[0].histNumNodes)}
                     width={w2 - 25} height={histogramHeight}
                     title="Number of Nodes Distribution"
diff --git a/web/frontend/src/plots/Histogram.svelte b/web/frontend/src/plots/Histogram.svelte
index 12d9fc2..d3e1aaa 100644
--- a/web/frontend/src/plots/Histogram.svelte
+++ b/web/frontend/src/plots/Histogram.svelte
@@ -1,229 +1,216 @@
 <!--
     @component
     Properties:
-    - width, height: Number
-    - min, max: Number
-    - label: (x-Value) => String
-    - data: [{ value: Number, count: Number }]
+    - Todo
  -->
 
-<div
-    on:mousemove={mousemove}
-    on:mouseleave={() => (infoText = '')}>
-    <span style="left: {paddingLeft + 5}px;">{infoText}</span>
-    <canvas bind:this={canvasElement} width="{width}" height="{height}"></canvas>
-</div>
-
 <script>
-    import { onMount } from 'svelte'
+    import uPlot from 'uplot'
+    import { formatNumber } from '../units.js'
+    import { onMount, onDestroy } from 'svelte'
+    import { Card } from 'sveltestrap'
 
     export let data
     export let width = 500
     export let height = 300
+    export let title = ''
     export let xlabel = ''
+    export let xunit = 'X'
     export let ylabel = ''
-    export let min = null
-    export let max = null
-    export let small = false
-    export let label = formatNumber
+    export let yunit = 'Y'
 
-    const fontSize = 12
-    const fontFamily = 'system-ui, -apple-system, "Segoe UI", Roboto, "Helvetica Neue", Arial, "Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji"'
-    const paddingLeft = 50, paddingRight = 20, paddingTop = 20, paddingBottom = 20
+    const { bars } = uPlot.paths
 
-    let ctx, canvasElement
+    const drawStyles = {
+        bars:      1,
+        points:    2,
+    };
 
-    const maxCount = data.reduce((max, point) => Math.max(max, point.count), 0),
-          maxValue = data.reduce((max, point) => Math.max(max, point.value), 0.1)
+    function paths(u, seriesIdx, idx0, idx1, extendGap, buildClip) {
+        let s = u.series[seriesIdx];
+        let style = s.drawStyle;
 
-    function getStepSize(valueRange, pixelRange, minSpace) {
-        const proposition = valueRange / (pixelRange / minSpace)
-        const getStepSize = n => Math.pow(10, Math.floor(n / 3)) *
-            (n < 0 ? [1., 5., 2.][-n % 3] : [1., 2., 5.][n % 3])
+        let renderer = ( // If bars to wide, change here
+            style == drawStyles.bars ? (
+                bars({size: [0.75, 100]})
+            ) :
+            () => null
+        )
 
-        let n = 0
-        let stepsize = getStepSize(n)
-        while (true) {
-            let bigger = getStepSize(n + 1)
-            if (proposition > bigger) {
-                n += 1
-                stepsize = bigger
-            } else {
-                return stepsize
+        return renderer(u, seriesIdx, idx0, idx1, extendGap, buildClip);
+    }
+
+    // converts the legend into a simple tooltip
+    function legendAsTooltipPlugin({ className, style = { backgroundColor:"rgba(255, 249, 196, 0.92)", color: "black" } } = {}) {
+        let legendEl;
+
+        function init(u, opts) {
+            legendEl = u.root.querySelector(".u-legend");
+
+            legendEl.classList.remove("u-inline");
+            className && legendEl.classList.add(className);
+
+            uPlot.assign(legendEl.style, {
+                textAlign: "left",
+                pointerEvents: "none",
+                display: "none",
+                position: "absolute",
+                left: 0,
+                top: 0,
+                zIndex: 100,
+                boxShadow: "2px 2px 10px rgba(0,0,0,0.5)",
+                ...style
+            });
+
+            // hide series color markers
+            const idents = legendEl.querySelectorAll(".u-marker");
+
+            for (let i = 0; i < idents.length; i++)
+                idents[i].style.display = "none";
+
+            const overEl = u.over;
+            overEl.style.overflow = "visible";
+
+            // move legend into plot bounds
+            overEl.appendChild(legendEl);
+
+            // show/hide tooltip on enter/exit
+            overEl.addEventListener("mouseenter", () => {legendEl.style.display = null;});
+            overEl.addEventListener("mouseleave", () => {legendEl.style.display = "none";});
+
+            // let tooltip exit plot
+        //	overEl.style.overflow = "visible";
+        }
+
+        function update(u) {
+            const { left, top } = u.cursor;
+            legendEl.style.transform = "translate(" + (left + 15) + "px, " + (top + 15) + "px)";
+        }
+
+        return {
+            hooks: {
+                init: init,
+                setCursor: update,
             }
-        }
-    }
-
-    let infoText = ''
-    function mousemove(event) {
-        let rect = event.target.getBoundingClientRect()
-        let x = event.clientX - rect.left
-        if (x < paddingLeft || x > width - paddingRight) {
-            infoText = ''
-            return
-        }
-
-        const w = width - paddingLeft - paddingRight
-        const barWidth = Math.round(w / (maxValue + 1))
-        x = Math.floor((x - paddingLeft) / (w - barWidth) * maxValue)
-        let point = data.find(point => point.value == x)
-
-        if (point)
-            infoText = `count: ${point.count} (value: ${label(x)})`
-        else
-            infoText = ''
+        };
     }
 
+    let plotWrapper = null
+    let uplot = null
+    let timeoutId = null
+    
     function render() {
-        const labelOffset =  Math.floor(height * 0.1)
-        const h = height - paddingTop - paddingBottom - labelOffset
-        const w = width - paddingLeft - paddingRight
-        const barGap = 5
-        const barWidth = Math.ceil(w / (maxValue + 1)) - barGap
+        let opts = {
+            width: width,
+            height: height,
+            title: title,
+            plugins: [
+				legendAsTooltipPlugin()
+			],
+            cursor: {
+                points: {
+                    size:   (u, seriesIdx)       => u.series[seriesIdx].points.size * 2.5,
+                    width:  (u, seriesIdx, size) => size / 4,
+                    stroke: (u, seriesIdx)       => u.series[seriesIdx].points.stroke(u, seriesIdx) + '90',
+                    fill:   (u, seriesIdx)       => "#fff",
+                }
+            },
+            scales: {
+                x: {
+                    time: false
+                },
+            },
+            axes: [
+                {
+                    stroke: "#000000",
+                    // scale: 'x',
+                    label: xlabel,
+                    labelGap: 10,
+                    size: 25,
+                    incrs: [1, 2, 5, 6, 10, 12, 50, 100, 500, 1000, 5000, 10000],
+                    border: { 
+                        show: true,
+                        stroke: "#000000",
+                    },
+                    ticks: {
+                        width: 1 / devicePixelRatio,
+                        size: 5 / devicePixelRatio,
+                        stroke: "#000000",
+                    },
+                    values: (_, t) => t.map(v => formatNumber(v)),
+                },
+                {
+                    stroke: "#000000",
+                    // scale: 'y',
+                    label: ylabel,
+                    labelGap: 10,
+                    size: 35,
+                    border: { 
+                        show: true,
+                        stroke: "#000000",
+                    },
+                    ticks: {
+                        width: 1 / devicePixelRatio,
+                        size: 5 / devicePixelRatio,
+                        stroke: "#000000",
+                    },
+                    values: (_, t) => t.map(v => formatNumber(v)),
+                },
+            ],
+            series: [
+                {
+                    label: xunit !== '' ? xunit : null,
+                },
+                Object.assign({
+                    label:  yunit !== '' ? yunit : null,
+                    width: 1 / devicePixelRatio,
+                    drawStyle: drawStyles.points,
+                    lineInterpolation: null,
+                    paths,
+                }, {
+                    drawStyle: drawStyles.bars,
+                    lineInterpolation: null,
+                    stroke: "#85abce",
+                    fill: "#85abce", //  + "1A", // Transparent Fill
+                }),
+            ]
+        };
 
-        if (Number.isNaN(barWidth))
-            return
+		uplot = new uPlot(opts, data, plotWrapper)
+	}
 
-        const getCanvasX = (value) => (value / maxValue) * (w - barWidth) + paddingLeft + (barWidth / 2.)
-        const getCanvasY = (count) => (h - (count / maxCount) * h) + paddingTop
-
-        // X Axis
-        ctx.font = `bold ${fontSize}px ${fontFamily}`
-        ctx.fillStyle = 'black'
-        if (xlabel != '') {
-            let textWidth = ctx.measureText(xlabel).width
-            ctx.fillText(xlabel, Math.floor((width / 2) - (textWidth / 2) + barGap), height - Math.floor(labelOffset / 2))
-        }
-        ctx.textAlign = 'center'
-        ctx.font = `${fontSize}px ${fontFamily}`
-        if (min != null && max != null) {
-            const stepsizeX = getStepSize(max - min, w, 75)
-            let startX = 0
-            while (startX < min)
-                startX += stepsizeX
-
-            for (let x = startX; x < max; x += stepsizeX) {
-                let px = ((x - min) / (max - min)) * (w - barWidth) + paddingLeft + (barWidth / 2.)
-                ctx.fillText(`${formatNumber(x)}`, px, height - paddingBottom - Math.floor(labelOffset / 2))
-            }
-        } else {
-            const stepsizeX = getStepSize(maxValue, w, 120)
-            for (let x = 0; x <= maxValue; x += stepsizeX) {
-                ctx.fillText(label(x), getCanvasX(x), height - paddingBottom - Math.floor(labelOffset / (small ? 8 : 2)))
-            }
-        }
-
-        // Y Axis
-        ctx.fillStyle = 'black'
-        ctx.strokeStyle = '#bbbbbb'
-        ctx.font = `bold ${fontSize}px ${fontFamily}`
-        if (ylabel != '') {
-            ctx.save()
-            ctx.translate(15, Math.floor(h / 2))
-            ctx.rotate(-Math.PI / 2)
-            ctx.fillText(ylabel, 0, 0)
-            ctx.restore()
-        }
-        ctx.textAlign = 'right'
-        ctx.font = `${fontSize}px ${fontFamily}`
-        ctx.beginPath()
-        const stepsizeY = getStepSize(maxCount, h, 50)
-        for (let y = stepsizeY; y <= maxCount; y += stepsizeY) {
-            const py = Math.floor(getCanvasY(y))
-            ctx.fillText(`${formatNumber(y)}`, paddingLeft - 5, py)
-            ctx.moveTo(paddingLeft, py)
-            ctx.lineTo(width, py)
-        }
-        ctx.stroke()
-
-        // Draw bars
-        ctx.fillStyle = '#85abce'
-        for (let p of data) {
-            ctx.fillRect(
-                getCanvasX(p.value) - (barWidth / 2.),
-                getCanvasY(p.count),
-                barWidth,
-                (p.count / maxCount) * h)
-        }
-
-        // Fat lines left and below plotting area
-        ctx.strokeStyle = 'black'
-        ctx.beginPath()
-        ctx.moveTo(0, height - paddingBottom - labelOffset)
-        ctx.lineTo(width, height - paddingBottom - labelOffset)
-        ctx.moveTo(paddingLeft, 0)
-        ctx.lineTo(paddingLeft, height - Math.floor(labelOffset / 2))
-        ctx.stroke()
-    }
-
-    let mounted = false
     onMount(() => {
-        mounted = true
-        canvasElement.width = width
-        canvasElement.height = height
-        ctx = canvasElement.getContext('2d')
         render()
     })
 
-    let timeoutId = null;
+    onDestroy(() => {
+        if (uplot)
+            uplot.destroy()
+
+        if (timeoutId != null)
+            clearTimeout(timeoutId)
+    })
+
     function sizeChanged() {
         if (timeoutId != null)
             clearTimeout(timeoutId)
 
         timeoutId = setTimeout(() => {
             timeoutId = null
-            if (!canvasElement)
-                return
+            if (uplot)
+                uplot.destroy()
 
-            canvasElement.width = width
-            canvasElement.height = height
-            ctx = canvasElement.getContext('2d')
             render()
-        }, 250)
+        }, 200)
     }
 
     $: sizeChanged(width, height)
 </script>
 
-<style>
-    div {
-        position: relative;
-    }
-    div > span {
-        position: absolute;
-        top: 0px;
-    }
-</style>
+{#if data.length > 0}
+    <div bind:this={plotWrapper}/>
+{:else}
+    <Card class="mx-4" body color="warning">Cannot render histogram: No data!</Card>
+{/if}
 
-<script context="module">
-    import { formatNumber } from '../units.js'
 
-    export function binsFromFootprint(weights, values, numBins) {
-        let min = 0, max = 0
-        if (values.length != 0) {
-            for (let x of values) {
-                min = Math.min(min, x)
-                max = Math.max(max, x)
-            }
-            max += 1 // So that we have an exclusive range.
-        }
-
-        if (numBins == null || numBins < 3)
-            numBins = 3
-
-        const bins = new Array(numBins).fill(0)
-        for (let i = 0; i < values.length; i++)
-            bins[Math.floor(((values[i] - min) / (max - min)) * numBins)] += weights ? weights[i] : 1
-
-        return {
-            label: idx => {
-                let start = min + (idx / numBins) * (max - min)
-                let stop = min + ((idx + 1) / numBins) * (max - min)
-                return `${formatNumber(start)} - ${formatNumber(stop)}`
-            },
-            bins: bins.map((count, idx) => ({ value: idx, count: count })),
-            min: min,
-            max: max
-        }
-    }
-</script>
diff --git a/web/frontend/src/plots/Histogramuplot.svelte b/web/frontend/src/plots/Histogramuplot.svelte
deleted file mode 100644
index d3e1aaa..0000000
--- a/web/frontend/src/plots/Histogramuplot.svelte
+++ /dev/null
@@ -1,216 +0,0 @@
-<!--
-    @component
-    Properties:
-    - Todo
- -->
-
-<script>
-    import uPlot from 'uplot'
-    import { formatNumber } from '../units.js'
-    import { onMount, onDestroy } from 'svelte'
-    import { Card } from 'sveltestrap'
-
-    export let data
-    export let width = 500
-    export let height = 300
-    export let title = ''
-    export let xlabel = ''
-    export let xunit = 'X'
-    export let ylabel = ''
-    export let yunit = 'Y'
-
-    const { bars } = uPlot.paths
-
-    const drawStyles = {
-        bars:      1,
-        points:    2,
-    };
-
-    function paths(u, seriesIdx, idx0, idx1, extendGap, buildClip) {
-        let s = u.series[seriesIdx];
-        let style = s.drawStyle;
-
-        let renderer = ( // If bars to wide, change here
-            style == drawStyles.bars ? (
-                bars({size: [0.75, 100]})
-            ) :
-            () => null
-        )
-
-        return renderer(u, seriesIdx, idx0, idx1, extendGap, buildClip);
-    }
-
-    // converts the legend into a simple tooltip
-    function legendAsTooltipPlugin({ className, style = { backgroundColor:"rgba(255, 249, 196, 0.92)", color: "black" } } = {}) {
-        let legendEl;
-
-        function init(u, opts) {
-            legendEl = u.root.querySelector(".u-legend");
-
-            legendEl.classList.remove("u-inline");
-            className && legendEl.classList.add(className);
-
-            uPlot.assign(legendEl.style, {
-                textAlign: "left",
-                pointerEvents: "none",
-                display: "none",
-                position: "absolute",
-                left: 0,
-                top: 0,
-                zIndex: 100,
-                boxShadow: "2px 2px 10px rgba(0,0,0,0.5)",
-                ...style
-            });
-
-            // hide series color markers
-            const idents = legendEl.querySelectorAll(".u-marker");
-
-            for (let i = 0; i < idents.length; i++)
-                idents[i].style.display = "none";
-
-            const overEl = u.over;
-            overEl.style.overflow = "visible";
-
-            // move legend into plot bounds
-            overEl.appendChild(legendEl);
-
-            // show/hide tooltip on enter/exit
-            overEl.addEventListener("mouseenter", () => {legendEl.style.display = null;});
-            overEl.addEventListener("mouseleave", () => {legendEl.style.display = "none";});
-
-            // let tooltip exit plot
-        //	overEl.style.overflow = "visible";
-        }
-
-        function update(u) {
-            const { left, top } = u.cursor;
-            legendEl.style.transform = "translate(" + (left + 15) + "px, " + (top + 15) + "px)";
-        }
-
-        return {
-            hooks: {
-                init: init,
-                setCursor: update,
-            }
-        };
-    }
-
-    let plotWrapper = null
-    let uplot = null
-    let timeoutId = null
-    
-    function render() {
-        let opts = {
-            width: width,
-            height: height,
-            title: title,
-            plugins: [
-				legendAsTooltipPlugin()
-			],
-            cursor: {
-                points: {
-                    size:   (u, seriesIdx)       => u.series[seriesIdx].points.size * 2.5,
-                    width:  (u, seriesIdx, size) => size / 4,
-                    stroke: (u, seriesIdx)       => u.series[seriesIdx].points.stroke(u, seriesIdx) + '90',
-                    fill:   (u, seriesIdx)       => "#fff",
-                }
-            },
-            scales: {
-                x: {
-                    time: false
-                },
-            },
-            axes: [
-                {
-                    stroke: "#000000",
-                    // scale: 'x',
-                    label: xlabel,
-                    labelGap: 10,
-                    size: 25,
-                    incrs: [1, 2, 5, 6, 10, 12, 50, 100, 500, 1000, 5000, 10000],
-                    border: { 
-                        show: true,
-                        stroke: "#000000",
-                    },
-                    ticks: {
-                        width: 1 / devicePixelRatio,
-                        size: 5 / devicePixelRatio,
-                        stroke: "#000000",
-                    },
-                    values: (_, t) => t.map(v => formatNumber(v)),
-                },
-                {
-                    stroke: "#000000",
-                    // scale: 'y',
-                    label: ylabel,
-                    labelGap: 10,
-                    size: 35,
-                    border: { 
-                        show: true,
-                        stroke: "#000000",
-                    },
-                    ticks: {
-                        width: 1 / devicePixelRatio,
-                        size: 5 / devicePixelRatio,
-                        stroke: "#000000",
-                    },
-                    values: (_, t) => t.map(v => formatNumber(v)),
-                },
-            ],
-            series: [
-                {
-                    label: xunit !== '' ? xunit : null,
-                },
-                Object.assign({
-                    label:  yunit !== '' ? yunit : null,
-                    width: 1 / devicePixelRatio,
-                    drawStyle: drawStyles.points,
-                    lineInterpolation: null,
-                    paths,
-                }, {
-                    drawStyle: drawStyles.bars,
-                    lineInterpolation: null,
-                    stroke: "#85abce",
-                    fill: "#85abce", //  + "1A", // Transparent Fill
-                }),
-            ]
-        };
-
-		uplot = new uPlot(opts, data, plotWrapper)
-	}
-
-    onMount(() => {
-        render()
-    })
-
-    onDestroy(() => {
-        if (uplot)
-            uplot.destroy()
-
-        if (timeoutId != null)
-            clearTimeout(timeoutId)
-    })
-
-    function sizeChanged() {
-        if (timeoutId != null)
-            clearTimeout(timeoutId)
-
-        timeoutId = setTimeout(() => {
-            timeoutId = null
-            if (uplot)
-                uplot.destroy()
-
-            render()
-        }, 200)
-    }
-
-    $: sizeChanged(width, height)
-</script>
-
-{#if data.length > 0}
-    <div bind:this={plotWrapper}/>
-{:else}
-    <Card class="mx-4" body color="warning">Cannot render histogram: No data!</Card>
-{/if}
-
-
diff --git a/web/frontend/src/plots/Pie.svelte b/web/frontend/src/plots/Pie.svelte
index 0db451f..6355f09 100644
--- a/web/frontend/src/plots/Pie.svelte
+++ b/web/frontend/src/plots/Pie.svelte
@@ -23,6 +23,7 @@
         Title,
         Tooltip,
         Legend,
+        Filler,
         ArcElement,
         CategoryScale
     } from 'chart.js';
@@ -31,6 +32,7 @@
         Title,
         Tooltip,
         Legend,
+        Filler,
         ArcElement,
         CategoryScale
     );
diff --git a/web/frontend/src/utils.js b/web/frontend/src/utils.js
index 37b9426..f68fec4 100644
--- a/web/frontend/src/utils.js
+++ b/web/frontend/src/utils.js
@@ -6,6 +6,7 @@ import {
 } from "@urql/svelte";
 import { setContext, getContext, hasContext, onDestroy, tick } from "svelte";
 import { readable } from "svelte/store";
+import { formatNumber } from './units.js'
 
 /*
  * Call this function only at component initialization time!
@@ -323,3 +324,45 @@ export function convert2uplot(canvasData) {
     })
     return uplotData
 }
+
+export function binsFromFootprint(weights, values, numBins) {
+    let min = 0, max = 0
+    if (values.length != 0) {
+        for (let x of values) {
+            min = Math.min(min, x)
+            max = Math.max(max, x)
+        }
+        max += 1 // So that we have an exclusive range.
+    }
+
+    if (numBins == null || numBins < 3)
+        numBins = 3
+
+    const bins = new Array(numBins).fill(0)
+    for (let i = 0; i < values.length; i++)
+        bins[Math.floor(((values[i] - min) / (max - min)) * numBins)] += weights ? weights[i] : 1
+
+    // return {
+    //     label: idx => {
+    //         let start = min + (idx / numBins) * (max - min)
+    //         let stop = min + ((idx + 1) / numBins) * (max - min)
+    //         return `${formatNumber(start)} - ${formatNumber(stop)}`
+    //     },
+    //     bins: bins.map((count, idx) => ({ value: idx, count: count })),
+    //     min: min,
+    //     max: max
+    // }
+
+    return {
+        bins: bins.map((count, idx) => ({ 
+            value: idx => { // Get rounded down next integer to bins' Start-Stop Mean Value
+                let start = min + (idx / numBins) * (max - min)
+                let stop = min + ((idx + 1) / numBins) * (max - min)
+                return `${formatNumber(Math.floor((start+stop)/2))}`
+            }, 
+            count: count 
+        })),
+        min: min,
+        max: max
+    }
+}

From 19d645f65cdda318724800c4af205cbec02ba279 Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan@moebiusband.org>
Date: Sat, 12 Aug 2023 09:02:41 +0200
Subject: [PATCH 35/62] Readd URL token and cleanup

Fix session values.
---
 docs/JWT-Handling.md              | 44 ++++++++++++++++++--------
 internal/auth/auth.go             | 51 ++++++++++++++++++-------------
 internal/auth/jwt.go              | 14 +++++++--
 internal/auth/jwtCookieSession.go | 18 -----------
 internal/auth/jwtSession.go       |  6 +++-
 internal/auth/local.go            |  3 +-
 pkg/schema/config.go              |  6 ++--
 7 files changed, 83 insertions(+), 59 deletions(-)

diff --git a/docs/JWT-Handling.md b/docs/JWT-Handling.md
index 8b03246..d3a6335 100644
--- a/docs/JWT-Handling.md
+++ b/docs/JWT-Handling.md
@@ -1,11 +1,13 @@
 ## Introduction
 
-ClusterCockpit uses JSON Web Tokens (JWT) for authorization of its APIs.
-JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object.
-This information can be verified and trusted because it is digitally signed.
-In ClusterCockpit JWTs are signed using a public/private key pair using ECDSA.
-Because tokens are signed using public/private key pairs, the signature also certifies that only the party holding the private key is the one that signed it.
-Currently JWT tokens in ClusterCockpit not yet expire.
+ClusterCockpit uses JSON Web Tokens (JWT) for authorization of its APIs. JSON
+Web Token (JWT) is an open standard (RFC 7519) that defines a compact and
+self-contained way for securely transmitting information between parties as a
+JSON object. This information can be verified and trusted because it is
+digitally signed. In ClusterCockpit JWTs are signed using a public/private key
+pair using ECDSA. Because tokens are signed using public/private key pairs, the
+signature also certifies that only the party holding the private key is the one
+that signed it. Token expiration is set to the configuration option MaxAge.
 
 ## JWT Payload
 
@@ -25,8 +27,15 @@ $ ./gen-keypair
 2. Add keypair in your `.env` file. A template can be found in `./configs`.
 
 There are two usage scenarios:
-* The APIs are used during a browser session. In this case on login a JWT token is issued on login, that is used by the web frontend to authorize against the GraphQL and REST APIs.
-* The REST API is used outside a browser session, e.g. by scripts. In this case you have to issue a token manually. This possible from within the configuration view or on the command line. It is recommended to issue a JWT token in this case for a special user that only has the `api` role. By using different users for different purposes a fine grained access control and access revocation management is possible.
+* The APIs are used during a browser session. In this case on login a JWT token
+  is issued on login, that is used by the web frontend to authorize against the
+  GraphQL and REST APIs.
+* The REST API is used outside a browser session, e.g. by scripts. In this case
+  you have to issue a token manually. This possible from within the
+  configuration view or on the command line. It is recommended to issue a JWT
+  token in this case for a special user that only has the `api` role. By using
+  different users for different purposes a fine grained access control and
+  access revocation management is possible.
 
 The token is commonly specified in the Authorization HTTP header using the Bearer schema.
 
@@ -46,16 +55,24 @@ $ curl -X GET "<API ENDPOINT>" -H "accept: application/json"  -H "Content-Type:
 ```
 
 ## Accept externally generated JWTs provided via cookie
-If there is an external service like an AuthAPI that can generate JWTs and hand them over to ClusterCockpit via cookies, CC can be configured to accept them:
+If there is an external service like an AuthAPI that can generate JWTs and hand
+them over to ClusterCockpit via cookies, CC can be configured to accept them:
 
-1. `.env`: CC needs a public ed25519 key to verify foreign JWT signatures. Public keys in PEM format can be converted with the instructions in [/tools/convert-pem-pubkey-for-cc](../tools/convert-pem-pubkey-for-cc/Readme.md) .
+1. `.env`: CC needs a public ed25519 key to verify foreign JWT signatures.
+   Public keys in PEM format can be converted with the instructions in
+   [/tools/convert-pem-pubkey-for-cc](../tools/convert-pem-pubkey-for-cc/Readme.md)
+   .
 
 ```
 CROSS_LOGIN_JWT_PUBLIC_KEY="+51iXX8BdLFocrppRxIw52xCOf8xFSH/eNilN5IHVGc="
 ```
 
-2. `config.json`: Insert a name for the cookie (set by the external service) containing the JWT so that CC knows where to look at. Define a trusted issuer (JWT claim 'iss'), otherwise it will be rejected.
-If you want usernames and user roles from JWTs ('sub' and 'roles' claim) to be validated against CC's internal database, you need to enable it here. Unknown users will then be rejected and roles set via JWT will be ignored.
+2. `config.json`: Insert a name for the cookie (set by the external service)
+   containing the JWT so that CC knows where to look at. Define a trusted issuer
+   (JWT claim 'iss'), otherwise it will be rejected. If you want usernames and
+   user roles from JWTs ('sub' and 'roles' claim) to be validated against CC's
+   internal database, you need to enable it here. Unknown users will then be
+   rejected and roles set via JWT will be ignored.
 
 ```json
 "jwts": {
@@ -65,7 +82,8 @@ If you want usernames and user roles from JWTs ('sub' and 'roles' claim) to be v
 }
 ```
 
-3. Make sure your external service includes the same issuer (`iss`) in its JWTs. Example JWT payload:
+3. Make sure your external service includes the same issuer (`iss`) in its JWTs.
+   Example JWT payload:
 
 ```json
 {
diff --git a/internal/auth/auth.go b/internal/auth/auth.go
index 8c1dca7..3d40500 100644
--- a/internal/auth/auth.go
+++ b/internal/auth/auth.go
@@ -97,26 +97,29 @@ func (auth *Authentication) AuthViaSession(
 	if session.IsNew {
 		return nil, nil
 	}
-
-	var username string
-	var projects, roles []string
-
-	if val, ok := session.Values["username"]; ok {
-		username, _ = val.(string)
-	} else {
-		return nil, errors.New("No key username in session")
-	}
-	if val, ok := session.Values["projects"]; ok {
-		projects, _ = val.([]string)
-	} else {
-		return nil, errors.New("No key projects in session")
-	}
-	if val, ok := session.Values["projects"]; ok {
-		roles, _ = val.([]string)
-	} else {
-		return nil, errors.New("No key roles in session")
-	}
-
+	//
+	// var username string
+	// var projects, roles []string
+	//
+	// if val, ok := session.Values["username"]; ok {
+	// 	username, _ = val.(string)
+	// } else {
+	// 	return nil, errors.New("no key username in session")
+	// }
+	// if val, ok := session.Values["projects"]; ok {
+	// 	projects, _ = val.([]string)
+	// } else {
+	// 	return nil, errors.New("no key projects in session")
+	// }
+	// if val, ok := session.Values["projects"]; ok {
+	// 	roles, _ = val.([]string)
+	// } else {
+	// 	return nil, errors.New("no key roles in session")
+	// }
+	//
+	username, _ := session.Values["username"].(string)
+	projects, _ := session.Values["projects"].([]string)
+	roles, _ := session.Values["roles"].([]string)
 	return &User{
 		Username:   username,
 		Projects:   projects,
@@ -261,6 +264,12 @@ func (auth *Authentication) Auth(
 	return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 
 		user, err := auth.JwtAuth.AuthViaJWT(rw, r)
+		if err != nil {
+			log.Infof("authentication failed: %s", err.Error())
+			http.Error(rw, err.Error(), http.StatusUnauthorized)
+			return
+		}
+
 		if user == nil {
 			user, err = auth.AuthViaSession(rw, r)
 			if err != nil {
@@ -276,7 +285,7 @@ func (auth *Authentication) Auth(
 			return
 		}
 
-		log.Debug("authentication failed: no authenticator applied")
+		log.Debug("authentication failed")
 		onfailure(rw, r, errors.New("unauthorized (please login first)"))
 	})
 }
diff --git a/internal/auth/jwt.go b/internal/auth/jwt.go
index 75a69b8..0ac446e 100644
--- a/internal/auth/jwt.go
+++ b/internal/auth/jwt.go
@@ -62,6 +62,11 @@ func (ja *JWTAuthenticator) AuthViaJWT(
 		rawtoken = strings.TrimPrefix(rawtoken, "Bearer ")
 	}
 
+	// there is no token
+	if rawtoken == "" {
+		return nil, nil
+	}
+
 	token, err := jwt.Parse(rawtoken, func(t *jwt.Token) (interface{}, error) {
 		if t.Method != jwt.SigningMethodEdDSA {
 			return nil, errors.New("only Ed25519/EdDSA supported")
@@ -81,6 +86,11 @@ func (ja *JWTAuthenticator) AuthViaJWT(
 	// Token is valid, extract payload
 	claims := token.Claims.(jwt.MapClaims)
 	sub, _ := claims["sub"].(string)
+	exp, _ := claims["exp"].(float64)
+
+	if exp < float64(time.Now().Unix()) {
+		return nil, errors.New("token is expired")
+	}
 
 	var roles []string
 
@@ -109,8 +119,8 @@ func (ja *JWTAuthenticator) AuthViaJWT(
 	return &User{
 		Username:   sub,
 		Roles:      roles,
-		AuthType:   AuthSession,
-		AuthSource: AuthViaToken,
+		AuthType:   AuthToken,
+		AuthSource: -1,
 	}, nil
 }
 
diff --git a/internal/auth/jwtCookieSession.go b/internal/auth/jwtCookieSession.go
index 1ae3a5b..af7fb64 100644
--- a/internal/auth/jwtCookieSession.go
+++ b/internal/auth/jwtCookieSession.go
@@ -24,8 +24,6 @@ type JWTCookieSessionAuthenticator struct {
 	privateKey          ed25519.PrivateKey
 	publicKeyCrossLogin ed25519.PublicKey // For accepting externally generated JWTs
 
-	loginTokenKey []byte // HS256 key
-
 	config *schema.JWTAuthConfig
 }
 
@@ -55,15 +53,6 @@ func (ja *JWTCookieSessionAuthenticator) Init(auth *Authentication, conf interfa
 		ja.privateKey = ed25519.PrivateKey(bytes)
 	}
 
-	if pubKey = os.Getenv("CROSS_LOGIN_JWT_HS512_KEY"); pubKey != "" {
-		bytes, err := base64.StdEncoding.DecodeString(pubKey)
-		if err != nil {
-			log.Warn("Could not decode cross login JWT HS512 key")
-			return err
-		}
-		ja.loginTokenKey = bytes
-	}
-
 	// Look for external public keys
 	pubKeyCrossLogin, keyFound := os.LookupEnv("CROSS_LOGIN_JWT_PUBLIC_KEY")
 	if keyFound && pubKeyCrossLogin != "" {
@@ -105,13 +94,6 @@ func (ja *JWTCookieSessionAuthenticator) CanLogin(
 	rw http.ResponseWriter,
 	r *http.Request) bool {
 
-	if ja.publicKeyCrossLogin == nil ||
-		ja.config == nil ||
-		ja.config.TrustedExternalIssuer == "" {
-
-		return false
-	}
-
 	cookieName := ""
 	if ja.config != nil && ja.config.CookieName != "" {
 		cookieName = ja.config.CookieName
diff --git a/internal/auth/jwtSession.go b/internal/auth/jwtSession.go
index 7c4f6f0..7ee45e7 100644
--- a/internal/auth/jwtSession.go
+++ b/internal/auth/jwtSession.go
@@ -45,7 +45,7 @@ func (ja *JWTSessionAuthenticator) CanLogin(
 	rw http.ResponseWriter,
 	r *http.Request) bool {
 
-	return r.Header.Get("Authorization") != ""
+	return r.Header.Get("Authorization") != "" || r.URL.Query().Get("login-token") != ""
 }
 
 func (ja *JWTSessionAuthenticator) Login(
@@ -54,6 +54,10 @@ func (ja *JWTSessionAuthenticator) Login(
 	r *http.Request) (*User, error) {
 
 	rawtoken := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+	if rawtoken == "" {
+		rawtoken = r.URL.Query().Get("login-token")
+	}
+
 	token, err := jwt.Parse(rawtoken, func(t *jwt.Token) (interface{}, error) {
 		if t.Method == jwt.SigningMethodHS256 || t.Method == jwt.SigningMethodHS512 {
 			return ja.loginTokenKey, nil
diff --git a/internal/auth/local.go b/internal/auth/local.go
index 8854aff..dd41a25 100644
--- a/internal/auth/local.go
+++ b/internal/auth/local.go
@@ -39,7 +39,8 @@ func (la *LocalAuthenticator) Login(
 	rw http.ResponseWriter,
 	r *http.Request) (*User, error) {
 
-	if e := bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(r.FormValue("password"))); e != nil {
+	if e := bcrypt.CompareHashAndPassword([]byte(user.Password),
+		[]byte(r.FormValue("password"))); e != nil {
 		log.Errorf("AUTH/LOCAL > Authentication for user %s failed!", user.Username)
 		return nil, fmt.Errorf("AUTH/LOCAL > Authentication failed")
 	}
diff --git a/pkg/schema/config.go b/pkg/schema/config.go
index 9a88ea2..190ee03 100644
--- a/pkg/schema/config.go
+++ b/pkg/schema/config.go
@@ -20,7 +20,7 @@ type LdapConfig struct {
 }
 
 type JWTAuthConfig struct {
-	// Specifies for how long a session or JWT shall be valid
+	// Specifies for how long a JWT token shall be valid
 	// as a string parsable by time.ParseDuration().
 	MaxAge int64 `json:"max-age"`
 
@@ -102,7 +102,7 @@ type ProgramConfig struct {
 	LdapConfig *LdapConfig    `json:"ldap"`
 	JwtConfig  *JWTAuthConfig `json:"jwts"`
 
-	// If 0 or empty, the session/token does not expire!
+	// If 0 or empty, the session does not expire!
 	SessionMaxAge string `json:"session-max-age"`
 
 	// If both those options are not empty, use HTTPS using those certificates.
@@ -113,7 +113,7 @@ type ProgramConfig struct {
 	// redirect every request incoming at port 80 to that url.
 	RedirectHttpTo string `json:"redirect-http-to"`
 
-	// If overwriten, at least all the options in the defaults below must
+	// If overwritten, at least all the options in the defaults below must
 	// be provided! Most options here can be overwritten by the user.
 	UiDefaults map[string]interface{} `json:"ui-defaults"`
 

From 9e3ba41746b91365e94ff9205625e350c74ceab8 Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan@moebiusband.org>
Date: Sat, 12 Aug 2023 09:30:33 +0200
Subject: [PATCH 36/62] Correct jwt docs

---
 docs/JWT-Handling.md | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/docs/JWT-Handling.md b/docs/JWT-Handling.md
index d3a6335..8b8d000 100644
--- a/docs/JWT-Handling.md
+++ b/docs/JWT-Handling.md
@@ -27,9 +27,8 @@ $ ./gen-keypair
 2. Add keypair in your `.env` file. A template can be found in `./configs`.
 
 There are two usage scenarios:
-* The APIs are used during a browser session. In this case on login a JWT token
-  is issued on login, that is used by the web frontend to authorize against the
-  GraphQL and REST APIs.
+* The APIs are used during a browser session. API accesses are authorized with
+  the active session.
 * The REST API is used outside a browser session, e.g. by scripts. In this case
   you have to issue a token manually. This possible from within the
   configuration view or on the command line. It is recommended to issue a JWT

From 4a2afc7a5a7ad0ac165125396fc5c4d9a661d634 Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan@moebiusband.org>
Date: Mon, 14 Aug 2023 12:40:21 +0200
Subject: [PATCH 37/62] Add LDAPSyncOnLogin option

Cleanup
Extend docs
Remove obsolete Expiration attribute
---
 docs/dev-authentication.md        | 69 ++++++++++++++-----------------
 internal/auth/auth.go             |  5 +--
 internal/auth/jwt.go              |  5 ---
 internal/auth/jwtCookieSession.go |  6 +--
 internal/auth/jwtSession.go       |  4 +-
 internal/auth/ldap.go             | 49 ++++++++++++++++++++--
 internal/auth/local.go            |  1 +
 pkg/schema/config.go              |  1 +
 8 files changed, 84 insertions(+), 56 deletions(-)

diff --git a/docs/dev-authentication.md b/docs/dev-authentication.md
index d40bdb0..9b84c4b 100644
--- a/docs/dev-authentication.md
+++ b/docs/dev-authentication.md
@@ -124,42 +124,8 @@ It is first checked if the required configuration keys are set:
 ```
 
 The Login function:
-
-# Auth
-
-The Auth function (located in `auth.go`):
-* Returns a new http handler function that is defined right away
-* This handler iterates over all authenticators
-* Calls `Auth()` on every authenticator
-* If err is not nil and the user object is valid it puts the user object in the
-  request context and starts the onSuccess http handler
-* Otherwise it calls the onFailure handler
-
-## Local
-
-Calls the `AuthViaSession()` function in `auth.go`. This will extract username,
-projects and roles from the session and initialize a user object with those
-values.
-
-## LDAP
-
-Calls the `AuthViaSession()` function in `auth.go`. This will extract username,
-projects and roles from the session and initialize a user object with those
-values.
-
-# JWT
-
-Check for JWT token:
-* Is token passed in the `X-Auth-Token` or `Authorization` header
-* If no token is found in a header it tries to read the token from a configured
-cookie.
-
-Finally it calls AuthViaSession in `auth.go` if a valid session exists. This is
-true if a JWT token was previously used to initiate a session. In this case the
-user object initialized with the session is returned right away.
-
-In case a token was found extract and parse the token:
-* Check if signing method is Ed25519/EdDSA 
+* Extracts and parses the token
+* Checks if signing method is Ed25519/EdDSA 
 * In case publicKeyCrossLogin is configured:
    - Check if `iss` issuer claim matched trusted issuer from configuration
    - Return public cross login key
@@ -167,7 +133,34 @@ In case a token was found extract and parse the token:
 * Check if claims are valid
 * Depending on the option `ForceJWTValidationViaDatabase ` the roles are
   extracted from JWT token or taken from user object fetched from database
-* In case the token was extracted from cookie create a new session and ask the
-  browser to delete the JWT cookie
+* Ask browser to delete the JWT cookie
 * Return valid user object
 
+# Auth
+
+The Auth function (located in `auth.go`):
+* Returns a new http handler function that is defined right away
+* This handler tries two methods to authenticate a user:
+   - Via a JWT API token in `AuthViaJWT()`
+   - Via a valid session in `AuthViaSession()`
+* If err is not nil and the user object is valid it puts the user object in the
+  request context and starts the onSuccess http handler
+* Otherwise it calls the onFailure handler
+
+## AuthViaJWT
+
+Implemented in JWTAuthenticator:
+* Extract token either from header `X-Auth-Token` or `Authorization` with Bearer
+  prefix
+* Parse token and check if it is valid. The Parse routine will also check if the
+  token is expired.
+* If the option `ForceJWTValidationViaDatabase` is set it will ensure the
+  user object exists in the database and takes the roles from the database user
+* Otherwise the roles are extracted from the roles claim
+* Returns a valid user object with AuthType set to AuthToken
+
+## AuthViaSession
+
+* Extracts session
+* Get values username, projects, and roles from session
+* Returns a valid user object with AuthType set to AuthSession
diff --git a/internal/auth/auth.go b/internal/auth/auth.go
index 3d40500..8149bc1 100644
--- a/internal/auth/auth.go
+++ b/internal/auth/auth.go
@@ -43,7 +43,6 @@ type User struct {
 	AuthSource AuthSource `json:"authSource"`
 	Email      string     `json:"email"`
 	Projects   []string   `json:"projects"`
-	Expiration time.Time
 }
 
 func (u *User) HasProject(project string) bool {
@@ -66,7 +65,7 @@ func GetUser(ctx context.Context) *User {
 
 type Authenticator interface {
 	Init(auth *Authentication, config interface{}) error
-	CanLogin(user *User, rw http.ResponseWriter, r *http.Request) bool
+	CanLogin(user *User, username string, rw http.ResponseWriter, r *http.Request) bool
 	Login(user *User, rw http.ResponseWriter, r *http.Request) (*User, error)
 }
 
@@ -208,7 +207,7 @@ func (auth *Authentication) Login(
 		}
 
 		for _, authenticator := range auth.authenticators {
-			if !authenticator.CanLogin(dbUser, rw, r) {
+			if !authenticator.CanLogin(dbUser, username, rw, r) {
 				continue
 			}
 
diff --git a/internal/auth/jwt.go b/internal/auth/jwt.go
index 0ac446e..6a77fc4 100644
--- a/internal/auth/jwt.go
+++ b/internal/auth/jwt.go
@@ -86,11 +86,6 @@ func (ja *JWTAuthenticator) AuthViaJWT(
 	// Token is valid, extract payload
 	claims := token.Claims.(jwt.MapClaims)
 	sub, _ := claims["sub"].(string)
-	exp, _ := claims["exp"].(float64)
-
-	if exp < float64(time.Now().Unix()) {
-		return nil, errors.New("token is expired")
-	}
 
 	var roles []string
 
diff --git a/internal/auth/jwtCookieSession.go b/internal/auth/jwtCookieSession.go
index af7fb64..8f31335 100644
--- a/internal/auth/jwtCookieSession.go
+++ b/internal/auth/jwtCookieSession.go
@@ -10,7 +10,6 @@ import (
 	"errors"
 	"net/http"
 	"os"
-	"time"
 
 	"github.com/ClusterCockpit/cc-backend/pkg/log"
 	"github.com/ClusterCockpit/cc-backend/pkg/schema"
@@ -91,6 +90,7 @@ func (ja *JWTCookieSessionAuthenticator) Init(auth *Authentication, conf interfa
 
 func (ja *JWTCookieSessionAuthenticator) CanLogin(
 	user *User,
+	username string,
 	rw http.ResponseWriter,
 	r *http.Request) bool {
 
@@ -140,7 +140,7 @@ func (ja *JWTCookieSessionAuthenticator) Login(
 		return ja.publicKey, nil
 	})
 	if err != nil {
-		log.Warn("Error while parsing token")
+		log.Warn("error while parsing token")
 		return nil, err
 	}
 
@@ -152,7 +152,6 @@ func (ja *JWTCookieSessionAuthenticator) Login(
 
 	claims := token.Claims.(jwt.MapClaims)
 	sub, _ := claims["sub"].(string)
-	exp, _ := claims["exp"].(float64)
 
 	var name string
 	if val, ok := claims["name"]; ok {
@@ -201,6 +200,5 @@ func (ja *JWTCookieSessionAuthenticator) Login(
 		}
 	}
 
-	user.Expiration = time.Unix(int64(exp), 0)
 	return user, nil
 }
diff --git a/internal/auth/jwtSession.go b/internal/auth/jwtSession.go
index 7ee45e7..e0f2f8b 100644
--- a/internal/auth/jwtSession.go
+++ b/internal/auth/jwtSession.go
@@ -10,7 +10,6 @@ import (
 	"net/http"
 	"os"
 	"strings"
-	"time"
 
 	"github.com/ClusterCockpit/cc-backend/pkg/log"
 	"github.com/golang-jwt/jwt/v4"
@@ -42,6 +41,7 @@ func (ja *JWTSessionAuthenticator) Init(auth *Authentication, conf interface{})
 
 func (ja *JWTSessionAuthenticator) CanLogin(
 	user *User,
+	username string,
 	rw http.ResponseWriter,
 	r *http.Request) bool {
 
@@ -76,7 +76,6 @@ func (ja *JWTSessionAuthenticator) Login(
 
 	claims := token.Claims.(jwt.MapClaims)
 	sub, _ := claims["sub"].(string)
-	exp, _ := claims["exp"].(float64)
 
 	var name string
 	if val, ok := claims["name"]; ok {
@@ -102,6 +101,5 @@ func (ja *JWTSessionAuthenticator) Login(
 		}
 	}
 
-	user.Expiration = time.Unix(int64(exp), 0)
 	return user, nil
 }
diff --git a/internal/auth/ldap.go b/internal/auth/ldap.go
index fc9753d..17b5c0c 100644
--- a/internal/auth/ldap.go
+++ b/internal/auth/ldap.go
@@ -66,10 +66,51 @@ func (la *LdapAuthenticator) Init(
 
 func (la *LdapAuthenticator) CanLogin(
 	user *User,
+	username string,
 	rw http.ResponseWriter,
 	r *http.Request) bool {
 
-	return user != nil && user.AuthSource == AuthViaLDAP
+	if user != nil && user.AuthSource == AuthViaLDAP {
+		return true
+	} else {
+		if la.config.SyncUserOnLogin {
+			l, err := la.getLdapConnection(true)
+			if err != nil {
+				log.Error("LDAP connection error")
+			}
+
+			// Search for the given username
+			searchRequest := ldap.NewSearchRequest(
+				la.config.UserBase,
+				ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
+				fmt.Sprintf("(%s(uid=%s))", la.config.UserFilter, username),
+				[]string{"dn", "uid", "gecos"}, nil)
+
+			sr, err := l.Search(searchRequest)
+			if err != nil {
+				log.Warn(err)
+				return false
+			}
+
+			if len(sr.Entries) != 1 {
+				log.Warn("User does not exist or too many entries returned")
+				return false
+			}
+
+			entry := sr.Entries[0]
+			name := entry.GetAttributeValue("gecos")
+
+			if _, err := la.auth.db.Exec(`INSERT INTO user (username, ldap, name, roles) VALUES (?, ?, ?, ?)`,
+				username, 1, name, "[\""+GetRoleString(RoleUser)+"\"]"); err != nil {
+				log.Errorf("User '%s' new in LDAP: Insert into DB failed", username)
+				return false
+			}
+
+			return true
+		}
+	}
+
+	return false
 }
 
 func (la *LdapAuthenticator) Login(
@@ -124,8 +165,10 @@ func (la *LdapAuthenticator) Sync() error {
 	defer l.Close()
 
 	ldapResults, err := l.Search(ldap.NewSearchRequest(
-		la.config.UserBase, ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
-		la.config.UserFilter, []string{"dn", "uid", "gecos"}, nil))
+		la.config.UserBase,
+		ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
+		fmt.Sprintf("(%s(uid=%s))", la.config.UserFilter, "*"),
+		[]string{"dn", "uid", "gecos"}, nil))
 	if err != nil {
 		log.Warn("LDAP search error")
 		return err
diff --git a/internal/auth/local.go b/internal/auth/local.go
index dd41a25..700db3a 100644
--- a/internal/auth/local.go
+++ b/internal/auth/local.go
@@ -28,6 +28,7 @@ func (la *LocalAuthenticator) Init(
 
 func (la *LocalAuthenticator) CanLogin(
 	user *User,
+	username string,
 	rw http.ResponseWriter,
 	r *http.Request) bool {
 
diff --git a/pkg/schema/config.go b/pkg/schema/config.go
index 190ee03..2a4047c 100644
--- a/pkg/schema/config.go
+++ b/pkg/schema/config.go
@@ -17,6 +17,7 @@ type LdapConfig struct {
 	UserFilter      string `json:"user_filter"`
 	SyncInterval    string `json:"sync_interval"` // Parsed using time.ParseDuration.
 	SyncDelOldUsers bool   `json:"sync_del_old_users"`
+	SyncUserOnLogin bool   `json:"syncUserOnLogin"`
 }
 
 type JWTAuthConfig struct {

From e69f2c425333289d8f34e5aebc845ae20e33cb5f Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan@moebiusband.org>
Date: Mon, 14 Aug 2023 13:35:32 +0200
Subject: [PATCH 38/62] Update Release notes

---
 ReleaseNotes.md | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/ReleaseNotes.md b/ReleaseNotes.md
index 127d4a8..d66a27f 100644
--- a/ReleaseNotes.md
+++ b/ReleaseNotes.md
@@ -1,11 +1,16 @@
-# `cc-backend` version 1.1.0
+# `cc-backend` version 1.2.0
 
 Supports job archive version 1 and database version 6.
 
 This is a minor release of `cc-backend`, the API backend and frontend
 implementation of ClusterCockpit.
 
-** Breaking changes v1 **
+** Breaking changes **
+
+The LDAP configuration option user_filter was changed and now should not include
+the wildcard. Example:
+* Old: `"user_filter": "(&(objectclass=posixAccount)(uid=*))"`
+* New: `"user_filter": "&(objectclass=posixAccount)"`
 
 The aggregate job statistic core hours is now computed using the job table
 column `num_hwthreads`. In a future release this column will be renamed to

From e550e57ac0a7da7072256236c41e0cb8e87e2461 Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Mon, 14 Aug 2023 13:52:26 +0200
Subject: [PATCH 39/62] Fix Java/Grails issued token parsing

- Tested locally until successfull login
- Initialize empty projects array
---
 internal/auth/jwtSession.go | 33 +++++++++++++++++++++++++++++++--
 1 file changed, 31 insertions(+), 2 deletions(-)

diff --git a/internal/auth/jwtSession.go b/internal/auth/jwtSession.go
index 7ee45e7..90725d4 100644
--- a/internal/auth/jwtSession.go
+++ b/internal/auth/jwtSession.go
@@ -79,12 +79,26 @@ func (ja *JWTSessionAuthenticator) Login(
 	exp, _ := claims["exp"].(float64)
 
 	var name string
-	if val, ok := claims["name"]; ok {
+	// Java/Grails Issued Token
+	if wrap, ok := claims["name"].(map[string]interface{}); ok {
+		if vals, ok := wrap["values"].([]interface{}); ok {
+			name = fmt.Sprintf("%v %v", vals[0], vals[1])
+		}
+	} else if val, ok := claims["name"]; ok {
 		name, _ = val.(string)
 	}
 
 	var roles []string
-	if rawroles, ok := claims["roles"]; ok {
+	// Java/Grails Issued Token
+	if rawroles, ok := claims["roles"].([]interface{}); ok {
+		for _, rr := range rawroles {
+			if r, ok := rr.(string); ok {
+				if isValidRole(r) {
+					roles = append(roles, r)
+				}
+			}
+		}
+	} else if rawroles, ok := claims["roles"]; ok {
 		for _, r := range rawroles.([]string) {
 			if isValidRole(r) {
 				roles = append(roles, r)
@@ -92,11 +106,26 @@ func (ja *JWTSessionAuthenticator) Login(
 		}
 	}
 
+	projects := make([]string, 0)
+	// Java/Grails Issued Token
+	// if rawprojs, ok := claims["projects"].([]interface{}); ok {
+	// 	for _, pp := range rawprojs {
+	// 		if p, ok := pp.(string); ok {
+	// 			projects = append(projects, p)
+	// 		}
+	// 	}
+	// } else if rawprojs, ok := claims["projects"]; ok {
+	// 	for _, p := range rawprojs.([]string) {
+	// 		projects = append(projects, p)
+	// 	}
+	// }
+
 	if user == nil {
 		user = &User{
 			Username:   sub,
 			Name:       name,
 			Roles:      roles,
+			Projects:   projects,
 			AuthType:   AuthSession,
 			AuthSource: AuthViaToken,
 		}

From 90bdfcfbb62d88dd5eba5ef06fa70e1a8c38ecf2 Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan@moebiusband.org>
Date: Mon, 14 Aug 2023 14:33:05 +0200
Subject: [PATCH 40/62] Add secured subrouter for REST API

Rename IP filter option
Add array helper in util
---
 internal/api/rest.go   | 201 ++++++++++++++++++++++++-----------------
 internal/util/array.go |  14 +++
 pkg/schema/config.go   |   4 +-
 3 files changed, 135 insertions(+), 84 deletions(-)
 create mode 100644 internal/util/array.go

diff --git a/internal/api/rest.go b/internal/api/rest.go
index c1f6fd1..1e758a2 100644
--- a/internal/api/rest.go
+++ b/internal/api/rest.go
@@ -26,6 +26,7 @@ import (
 	"github.com/ClusterCockpit/cc-backend/internal/importer"
 	"github.com/ClusterCockpit/cc-backend/internal/metricdata"
 	"github.com/ClusterCockpit/cc-backend/internal/repository"
+	"github.com/ClusterCockpit/cc-backend/internal/util"
 	"github.com/ClusterCockpit/cc-backend/pkg/archive"
 	"github.com/ClusterCockpit/cc-backend/pkg/log"
 	"github.com/ClusterCockpit/cc-backend/pkg/schema"
@@ -76,23 +77,65 @@ func (api *RestApi) MountRoutes(r *mux.Router) {
 	r.HandleFunc("/jobs/delete_job/", api.deleteJobByRequest).Methods(http.MethodDelete)
 	r.HandleFunc("/jobs/delete_job/{id}", api.deleteJobById).Methods(http.MethodDelete)
 	r.HandleFunc("/jobs/delete_job_before/{ts}", api.deleteJobBefore).Methods(http.MethodDelete)
-	r.HandleFunc("/secured/addProject/{id}/{project}", api.secureUpdateUser).Methods(http.MethodPost)
-	r.HandleFunc("/secured/addRole/{id}/{role}", api.secureUpdateUser).Methods(http.MethodPost)
-
-	if api.Authentication != nil {
-		r.HandleFunc("/jwt/", api.getJWT).Methods(http.MethodGet)
-		r.HandleFunc("/roles/", api.getRoles).Methods(http.MethodGet)
-		r.HandleFunc("/users/", api.createUser).Methods(http.MethodPost, http.MethodPut)
-		r.HandleFunc("/users/", api.getUsers).Methods(http.MethodGet)
-		r.HandleFunc("/users/", api.deleteUser).Methods(http.MethodDelete)
-		r.HandleFunc("/user/{id}", api.updateUser).Methods(http.MethodPost)
-		r.HandleFunc("/configuration/", api.updateConfiguration).Methods(http.MethodPost)
-	}
+	// r.HandleFunc("/secured/addProject/{id}/{project}", api.secureUpdateUser).Methods(http.MethodPost)
+	// r.HandleFunc("/secured/addRole/{id}/{role}", api.secureUpdateUser).Methods(http.MethodPost)
 
 	if api.MachineStateDir != "" {
 		r.HandleFunc("/machine_state/{cluster}/{host}", api.getMachineState).Methods(http.MethodGet)
 		r.HandleFunc("/machine_state/{cluster}/{host}", api.putMachineState).Methods(http.MethodPut, http.MethodPost)
 	}
+
+	if api.Authentication != nil {
+		rw := r.MatcherFunc(
+			func(rq *http.Request, rm *mux.RouteMatch) bool {
+				user := auth.GetUser(rq.Context())
+				return user.AuthType == auth.AuthSession
+			}).Subrouter()
+		rw.HandleFunc("/jwt/", api.getJWT).Methods(http.MethodGet)
+		rw.HandleFunc("/roles/", api.getRoles).Methods(http.MethodGet)
+		rw.HandleFunc("/users/", api.createUser).Methods(http.MethodPost, http.MethodPut)
+		rw.HandleFunc("/users/", api.getUsers).Methods(http.MethodGet)
+		rw.HandleFunc("/users/", api.deleteUser).Methods(http.MethodDelete)
+		rw.HandleFunc("/user/{id}", api.updateUser).Methods(http.MethodPost)
+		rw.HandleFunc("/configuration/", api.updateConfiguration).Methods(http.MethodPost)
+
+		rs := r.PathPrefix("/secured").MatcherFunc(
+			func(rq *http.Request, rm *mux.RouteMatch) bool {
+				user := auth.GetUser(rq.Context())
+				// this only applies for token based authorization
+				if user.AuthType != auth.AuthToken {
+					return false
+				}
+
+				// If nothing declared in config: deny all request to this endpoint
+				if config.Keys.ApiAllowedIPs == nil || len(config.Keys.ApiAllowedIPs) == 0 {
+					return false
+				}
+
+				// extract IP address
+				IPAddress := rq.Header.Get("X-Real-Ip")
+				if IPAddress == "" {
+					IPAddress = rq.Header.Get("X-Forwarded-For")
+				}
+				if IPAddress == "" {
+					IPAddress = rq.RemoteAddr
+				}
+
+				// check if IP is allowed
+				if !util.Contains(config.Keys.ApiAllowedIPs, IPAddress) {
+					return false
+				}
+
+				return true
+			}).Subrouter()
+		rs.HandleFunc("/jwt/", api.getJWT).Methods(http.MethodGet)
+		rs.HandleFunc("/roles/", api.getRoles).Methods(http.MethodGet)
+		rs.HandleFunc("/users/", api.createUser).Methods(http.MethodPost, http.MethodPut)
+		rs.HandleFunc("/users/", api.getUsers).Methods(http.MethodGet)
+		rs.HandleFunc("/users/", api.deleteUser).Methods(http.MethodDelete)
+		rs.HandleFunc("/user/{id}", api.updateUser).Methods(http.MethodPost)
+		rs.HandleFunc("/configuration/", api.updateConfiguration).Methods(http.MethodPost)
+	}
 }
 
 // StartJobApiResponse model
@@ -1051,76 +1094,70 @@ func (api *RestApi) updateUser(rw http.ResponseWriter, r *http.Request) {
 	}
 }
 
-func (api *RestApi) secureUpdateUser(rw http.ResponseWriter, r *http.Request) {
-	if user := auth.GetUser(r.Context()); user != nil && !user.HasRole(auth.RoleApi) {
-		handleError(fmt.Errorf("missing role: %v", auth.GetRoleString(auth.RoleApi)), http.StatusForbidden, rw)
-		return
-	}
-
-	// If nothing declared in config: deny all request to this endpint
-	if config.Keys.ApiAllowedAddrs == nil || len(config.Keys.ApiAllowedAddrs) == 0 {
-		handleError(fmt.Errorf("denied by default policy!"), http.StatusForbidden, rw)
-		return
-	}
-
-	// IP CHECK HERE (WIP)
-	// Probably better as private routine
-	IPAddress := r.Header.Get("X-Real-Ip")
-	if IPAddress == "" {
-		IPAddress = r.Header.Get("X-Forwarded-For")
-	}
-	if IPAddress == "" {
-		IPAddress = r.RemoteAddr
-	}
-
-	// Also This
-	ipOk := false
-	for _, a := range config.Keys.ApiAllowedAddrs {
-		if a == IPAddress {
-			ipOk = true
-		}
-	}
-
-	if IPAddress == "" || ipOk == false {
-		handleError(fmt.Errorf("unknown ip: %v", IPAddress), http.StatusForbidden, rw)
-		return
-	}
-	// IP CHECK END
-
-	// Get Values
-	id := mux.Vars(r)["id"]
-	newproj := mux.Vars(r)["project"]
-	newrole := mux.Vars(r)["role"]
-
-	// TODO: Handle anything but roles...
-	if newrole != "" {
-		if err := api.Authentication.AddRole(r.Context(), id, newrole); err != nil {
-			handleError(errors.New(err.Error()), http.StatusUnprocessableEntity, rw)
-			return
-		}
-
-		rw.Header().Add("Content-Type", "application/json")
-		rw.WriteHeader(http.StatusOK)
-		json.NewEncoder(rw).Encode(UpdateUserApiResponse{
-			Message: fmt.Sprintf("Successfully added role %s to %s", newrole, id),
-		})
-
-	} else if newproj != "" {
-		if err := api.Authentication.AddProject(r.Context(), id, newproj); err != nil {
-			handleError(errors.New(err.Error()), http.StatusUnprocessableEntity, rw)
-			return
-		}
-
-		rw.Header().Add("Content-Type", "application/json")
-		rw.WriteHeader(http.StatusOK)
-		json.NewEncoder(rw).Encode(UpdateUserApiResponse{
-			Message: fmt.Sprintf("Successfully added project %s to %s", newproj, id),
-		})
-
-	} else {
-		handleError(errors.New("Not Add [role|project]?"), http.StatusBadRequest, rw)
-	}
-}
+// func (api *RestApi) secureUpdateUser(rw http.ResponseWriter, r *http.Request) {
+// 	if user := auth.GetUser(r.Context()); user != nil && !user.HasRole(auth.RoleApi) {
+// 		handleError(fmt.Errorf("missing role: %v", auth.GetRoleString(auth.RoleApi)), http.StatusForbidden, rw)
+// 		return
+// 	}
+//
+// 	// IP CHECK HERE (WIP)
+// 	// Probably better as private routine
+// 	IPAddress := r.Header.Get("X-Real-Ip")
+// 	if IPAddress == "" {
+// 		IPAddress = r.Header.Get("X-Forwarded-For")
+// 	}
+// 	if IPAddress == "" {
+// 		IPAddress = r.RemoteAddr
+// 	}
+//
+// 	// Also This
+// 	ipOk := false
+// 	for _, a := range config.Keys.ApiAllowedAddrs {
+// 		if a == IPAddress {
+// 			ipOk = true
+// 		}
+// 	}
+//
+// 	if IPAddress == "" || ipOk == false {
+// 		handleError(fmt.Errorf("unknown ip: %v", IPAddress), http.StatusForbidden, rw)
+// 		return
+// 	}
+// 	// IP CHECK END
+//
+// 	// Get Values
+// 	id := mux.Vars(r)["id"]
+// 	newproj := mux.Vars(r)["project"]
+// 	newrole := mux.Vars(r)["role"]
+//
+// 	// TODO: Handle anything but roles...
+// 	if newrole != "" {
+// 		if err := api.Authentication.AddRole(r.Context(), id, newrole); err != nil {
+// 			handleError(errors.New(err.Error()), http.StatusUnprocessableEntity, rw)
+// 			return
+// 		}
+//
+// 		rw.Header().Add("Content-Type", "application/json")
+// 		rw.WriteHeader(http.StatusOK)
+// 		json.NewEncoder(rw).Encode(UpdateUserApiResponse{
+// 			Message: fmt.Sprintf("Successfully added role %s to %s", newrole, id),
+// 		})
+//
+// 	} else if newproj != "" {
+// 		if err := api.Authentication.AddProject(r.Context(), id, newproj); err != nil {
+// 			handleError(errors.New(err.Error()), http.StatusUnprocessableEntity, rw)
+// 			return
+// 		}
+//
+// 		rw.Header().Add("Content-Type", "application/json")
+// 		rw.WriteHeader(http.StatusOK)
+// 		json.NewEncoder(rw).Encode(UpdateUserApiResponse{
+// 			Message: fmt.Sprintf("Successfully added project %s to %s", newproj, id),
+// 		})
+//
+// 	} else {
+// 		handleError(errors.New("Not Add [role|project]?"), http.StatusBadRequest, rw)
+// 	}
+// }
 
 func (api *RestApi) updateConfiguration(rw http.ResponseWriter, r *http.Request) {
 	rw.Header().Set("Content-Type", "text/plain")
diff --git a/internal/util/array.go b/internal/util/array.go
new file mode 100644
index 0000000..bc7ed04
--- /dev/null
+++ b/internal/util/array.go
@@ -0,0 +1,14 @@
+// Copyright (C) 2023 NHR@FAU, University Erlangen-Nuremberg.
+// All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+package util
+
+func Contains[T comparable](items []T, item T) bool {
+	for _, v := range items {
+		if v == item {
+			return true
+		}
+	}
+	return false
+}
diff --git a/pkg/schema/config.go b/pkg/schema/config.go
index b59feb3..95cc641 100644
--- a/pkg/schema/config.go
+++ b/pkg/schema/config.go
@@ -70,8 +70,8 @@ type ProgramConfig struct {
 	// Address where the http (or https) server will listen on (for example: 'localhost:80').
 	Addr string `json:"addr"`
 
-	// Addresses from which the /secured/* API endpoints can be reached
-	ApiAllowedAddrs []string `json:"apiAllowedAddrs"`
+	// Addresses from which the /api/secured/* API endpoints can be reached
+	ApiAllowedIPs []string `json:"apiAllowedIPs"`
 
 	// Drop root permissions once .env was read and the port was taken.
 	User  string `json:"user"`

From 202521cbfd3d13e7935e52e04c6482bd5b5f7c3c Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan@moebiusband.org>
Date: Mon, 14 Aug 2023 18:38:30 +0200
Subject: [PATCH 41/62] Restructure routing and security check

---
 internal/api/rest.go | 129 +++++++++++++++++++++++++------------------
 1 file changed, 76 insertions(+), 53 deletions(-)

diff --git a/internal/api/rest.go b/internal/api/rest.go
index 1e758a2..501cf3b 100644
--- a/internal/api/rest.go
+++ b/internal/api/rest.go
@@ -1,4 +1,4 @@
-// Copyright (C) 2022 NHR@FAU, University Erlangen-Nuremberg.
+// Copyright (C) 2023 NHR@FAU, University Erlangen-Nuremberg.
 // All rights reserved.
 // Use of this source code is governed by a MIT-style
 // license that can be found in the LICENSE file.
@@ -86,55 +86,13 @@ func (api *RestApi) MountRoutes(r *mux.Router) {
 	}
 
 	if api.Authentication != nil {
-		rw := r.MatcherFunc(
-			func(rq *http.Request, rm *mux.RouteMatch) bool {
-				user := auth.GetUser(rq.Context())
-				return user.AuthType == auth.AuthSession
-			}).Subrouter()
-		rw.HandleFunc("/jwt/", api.getJWT).Methods(http.MethodGet)
-		rw.HandleFunc("/roles/", api.getRoles).Methods(http.MethodGet)
-		rw.HandleFunc("/users/", api.createUser).Methods(http.MethodPost, http.MethodPut)
-		rw.HandleFunc("/users/", api.getUsers).Methods(http.MethodGet)
-		rw.HandleFunc("/users/", api.deleteUser).Methods(http.MethodDelete)
-		rw.HandleFunc("/user/{id}", api.updateUser).Methods(http.MethodPost)
-		rw.HandleFunc("/configuration/", api.updateConfiguration).Methods(http.MethodPost)
-
-		rs := r.PathPrefix("/secured").MatcherFunc(
-			func(rq *http.Request, rm *mux.RouteMatch) bool {
-				user := auth.GetUser(rq.Context())
-				// this only applies for token based authorization
-				if user.AuthType != auth.AuthToken {
-					return false
-				}
-
-				// If nothing declared in config: deny all request to this endpoint
-				if config.Keys.ApiAllowedIPs == nil || len(config.Keys.ApiAllowedIPs) == 0 {
-					return false
-				}
-
-				// extract IP address
-				IPAddress := rq.Header.Get("X-Real-Ip")
-				if IPAddress == "" {
-					IPAddress = rq.Header.Get("X-Forwarded-For")
-				}
-				if IPAddress == "" {
-					IPAddress = rq.RemoteAddr
-				}
-
-				// check if IP is allowed
-				if !util.Contains(config.Keys.ApiAllowedIPs, IPAddress) {
-					return false
-				}
-
-				return true
-			}).Subrouter()
-		rs.HandleFunc("/jwt/", api.getJWT).Methods(http.MethodGet)
-		rs.HandleFunc("/roles/", api.getRoles).Methods(http.MethodGet)
-		rs.HandleFunc("/users/", api.createUser).Methods(http.MethodPost, http.MethodPut)
-		rs.HandleFunc("/users/", api.getUsers).Methods(http.MethodGet)
-		rs.HandleFunc("/users/", api.deleteUser).Methods(http.MethodDelete)
-		rs.HandleFunc("/user/{id}", api.updateUser).Methods(http.MethodPost)
-		rs.HandleFunc("/configuration/", api.updateConfiguration).Methods(http.MethodPost)
+		r.HandleFunc("/jwt/", api.getJWT).Methods(http.MethodGet)
+		r.HandleFunc("/roles/", api.getRoles).Methods(http.MethodGet)
+		r.HandleFunc("/users/", api.createUser).Methods(http.MethodPost, http.MethodPut)
+		r.HandleFunc("/users/", api.getUsers).Methods(http.MethodGet)
+		r.HandleFunc("/users/", api.deleteUser).Methods(http.MethodDelete)
+		r.HandleFunc("/user/{id}", api.updateUser).Methods(http.MethodPost)
+		r.HandleFunc("/configuration/", api.updateConfiguration).Methods(http.MethodPost)
 	}
 }
 
@@ -223,6 +181,36 @@ func decode(r io.Reader, val interface{}) error {
 	return dec.Decode(val)
 }
 
+func securedCheck(r *http.Request) error {
+	user := auth.GetUser(r.Context())
+	if user == nil {
+		return fmt.Errorf("no user in context")
+	}
+
+	if user.AuthType == auth.AuthToken {
+		// If nothing declared in config: deny all request to this endpoint
+		if config.Keys.ApiAllowedIPs == nil || len(config.Keys.ApiAllowedIPs) == 0 {
+			return fmt.Errorf("missing configuration key ApiAllowedIPs")
+		}
+
+		// extract IP address
+		IPAddress := r.Header.Get("X-Real-Ip")
+		if IPAddress == "" {
+			IPAddress = r.Header.Get("X-Forwarded-For")
+		}
+		if IPAddress == "" {
+			IPAddress = r.RemoteAddr
+		}
+
+		// check if IP is allowed
+		if !util.Contains(config.Keys.ApiAllowedIPs, IPAddress) {
+			return fmt.Errorf("unknown ip: %v", IPAddress)
+		}
+	}
+
+	return nil
+}
+
 // getJobs godoc
 // @summary     Lists all jobs
 // @tags query
@@ -943,6 +931,11 @@ func (api *RestApi) getJobMetrics(rw http.ResponseWriter, r *http.Request) {
 }
 
 func (api *RestApi) getJWT(rw http.ResponseWriter, r *http.Request) {
+	err := securedCheck(r)
+	if err != nil {
+		http.Error(rw, err.Error(), http.StatusForbidden)
+	}
+
 	rw.Header().Set("Content-Type", "text/plain")
 	username := r.FormValue("username")
 	me := auth.GetUser(r.Context())
@@ -971,6 +964,11 @@ func (api *RestApi) getJWT(rw http.ResponseWriter, r *http.Request) {
 }
 
 func (api *RestApi) createUser(rw http.ResponseWriter, r *http.Request) {
+	err := securedCheck(r)
+	if err != nil {
+		http.Error(rw, err.Error(), http.StatusForbidden)
+	}
+
 	rw.Header().Set("Content-Type", "text/plain")
 	me := auth.GetUser(r.Context())
 	if !me.HasRole(auth.RoleAdmin) {
@@ -978,17 +976,22 @@ func (api *RestApi) createUser(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	username, password, role, name, email, project := r.FormValue("username"), r.FormValue("password"), r.FormValue("role"), r.FormValue("name"), r.FormValue("email"), r.FormValue("project")
+	username, password, role, name, email, project := r.FormValue("username"),
+		r.FormValue("password"), r.FormValue("role"), r.FormValue("name"),
+		r.FormValue("email"), r.FormValue("project")
+
 	if len(password) == 0 && role != auth.GetRoleString(auth.RoleApi) {
 		http.Error(rw, "Only API users are allowed to have a blank password (login will be impossible)", http.StatusBadRequest)
 		return
 	}
 
 	if len(project) != 0 && role != auth.GetRoleString(auth.RoleManager) {
-		http.Error(rw, "only managers require a project (can be changed later)", http.StatusBadRequest)
+		http.Error(rw, "only managers require a project (can be changed later)",
+			http.StatusBadRequest)
 		return
 	} else if len(project) == 0 && role == auth.GetRoleString(auth.RoleManager) {
-		http.Error(rw, "managers require a project to manage (can be changed later)", http.StatusBadRequest)
+		http.Error(rw, "managers require a project to manage (can be changed later)",
+			http.StatusBadRequest)
 		return
 	}
 
@@ -1007,6 +1010,11 @@ func (api *RestApi) createUser(rw http.ResponseWriter, r *http.Request) {
 }
 
 func (api *RestApi) deleteUser(rw http.ResponseWriter, r *http.Request) {
+	err := securedCheck(r)
+	if err != nil {
+		http.Error(rw, err.Error(), http.StatusForbidden)
+	}
+
 	if user := auth.GetUser(r.Context()); !user.HasRole(auth.RoleAdmin) {
 		http.Error(rw, "Only admins are allowed to delete a user", http.StatusForbidden)
 		return
@@ -1022,6 +1030,11 @@ func (api *RestApi) deleteUser(rw http.ResponseWriter, r *http.Request) {
 }
 
 func (api *RestApi) getUsers(rw http.ResponseWriter, r *http.Request) {
+	err := securedCheck(r)
+	if err != nil {
+		http.Error(rw, err.Error(), http.StatusForbidden)
+	}
+
 	if user := auth.GetUser(r.Context()); !user.HasRole(auth.RoleAdmin) {
 		http.Error(rw, "Only admins are allowed to fetch a list of users", http.StatusForbidden)
 		return
@@ -1037,6 +1050,11 @@ func (api *RestApi) getUsers(rw http.ResponseWriter, r *http.Request) {
 }
 
 func (api *RestApi) getRoles(rw http.ResponseWriter, r *http.Request) {
+	err := securedCheck(r)
+	if err != nil {
+		http.Error(rw, err.Error(), http.StatusForbidden)
+	}
+
 	user := auth.GetUser(r.Context())
 	if !user.HasRole(auth.RoleAdmin) {
 		http.Error(rw, "only admins are allowed to fetch a list of roles", http.StatusForbidden)
@@ -1053,6 +1071,11 @@ func (api *RestApi) getRoles(rw http.ResponseWriter, r *http.Request) {
 }
 
 func (api *RestApi) updateUser(rw http.ResponseWriter, r *http.Request) {
+	err := securedCheck(r)
+	if err != nil {
+		http.Error(rw, err.Error(), http.StatusForbidden)
+	}
+
 	if user := auth.GetUser(r.Context()); !user.HasRole(auth.RoleAdmin) {
 		http.Error(rw, "Only admins are allowed to update a user", http.StatusForbidden)
 		return

From 4f6d1fec68f53a9dee3f1727f2abfb1b95dfd738 Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan@moebiusband.org>
Date: Wed, 16 Aug 2023 09:19:41 +0200
Subject: [PATCH 42/62] Fix errors in ldap auth

---
 internal/auth/auth.go | 13 +++++++------
 internal/auth/ldap.go |  4 +++-
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/internal/auth/auth.go b/internal/auth/auth.go
index 8149bc1..500ef1a 100644
--- a/internal/auth/auth.go
+++ b/internal/auth/auth.go
@@ -158,12 +158,13 @@ func Init(db *sqlx.DB,
 	}
 
 	if config, ok := configs["ldap"]; ok {
-		auth.LdapAuth = &LdapAuthenticator{}
-		if err := auth.LdapAuth.Init(auth, config); err != nil {
-			log.Error("Error while initializing authentication -> ldapAuth init failed")
-			return nil, err
+		ldapAuth := &LdapAuthenticator{}
+		if err := ldapAuth.Init(auth, config); err != nil {
+			log.Warn("Error while initializing authentication -> ldapAuth init failed")
+		} else {
+			auth.LdapAuth = ldapAuth
+			auth.authenticators = append(auth.authenticators, auth.LdapAuth)
 		}
-		auth.authenticators = append(auth.authenticators, auth.LdapAuth)
 	}
 
 	jwtSessionAuth := &JWTSessionAuthenticator{}
@@ -174,7 +175,7 @@ func Init(db *sqlx.DB,
 	}
 
 	jwtCookieSessionAuth := &JWTCookieSessionAuthenticator{}
-	if err := jwtSessionAuth.Init(auth, configs["jwt"]); err != nil {
+	if err := jwtCookieSessionAuth.Init(auth, configs["jwt"]); err != nil {
 		log.Warn("Error while initializing authentication -> jwtCookieSessionAuth init failed")
 	} else {
 		auth.authenticators = append(auth.authenticators, jwtCookieSessionAuth)
diff --git a/internal/auth/ldap.go b/internal/auth/ldap.go
index 17b5c0c..9feebc1 100644
--- a/internal/auth/ldap.go
+++ b/internal/auth/ldap.go
@@ -59,6 +59,8 @@ func (la *LdapAuthenticator) Init(
 				log.Print("sync done")
 			}
 		}()
+	} else {
+		return fmt.Errorf("missing LDAP configuration")
 	}
 
 	return nil
@@ -73,7 +75,7 @@ func (la *LdapAuthenticator) CanLogin(
 	if user != nil && user.AuthSource == AuthViaLDAP {
 		return true
 	} else {
-		if la.config.SyncUserOnLogin {
+		if la.config != nil && la.config.SyncUserOnLogin {
 			l, err := la.getLdapConnection(true)
 			if err != nil {
 				log.Error("LDAP connection error")

From 80aed874157cd797f39a39bad06142cd4452c25d Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan@moebiusband.org>
Date: Wed, 16 Aug 2023 17:21:12 +0200
Subject: [PATCH 43/62] Retry fetching user after CanLogin

---
 internal/auth/auth.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/internal/auth/auth.go b/internal/auth/auth.go
index 500ef1a..57bf3c4 100644
--- a/internal/auth/auth.go
+++ b/internal/auth/auth.go
@@ -211,6 +211,10 @@ func (auth *Authentication) Login(
 			if !authenticator.CanLogin(dbUser, username, rw, r) {
 				continue
 			}
+			dbUser, err = auth.GetUser(username)
+			if err != nil && err != sql.ErrNoRows {
+				log.Errorf("Error while loading user '%v'", username)
+			}
 
 			user, err := authenticator.Login(dbUser, rw, r)
 			if err != nil {

From 87ce4f63d48a331cf44ea1450224967363a48d9c Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan@moebiusband.org>
Date: Thu, 17 Aug 2023 10:29:00 +0200
Subject: [PATCH 44/62] Refactor auth module

Separate parts
Add user repository
Add user schema
---
 cmd/cc-backend/main.go                        |  23 +-
 internal/api/rest.go                          |  97 +++--
 internal/auth/auth.go                         |  73 +---
 internal/auth/jwt.go                          |  18 +-
 internal/auth/jwtCookieSession.go             |  20 +-
 internal/auth/jwtSession.go                   |  22 +-
 internal/auth/ldap.go                         |  12 +-
 internal/auth/local.go                        |   9 +-
 internal/auth/users.go                        | 289 -------------
 internal/graph/schema.resolvers.go            |  15 +-
 internal/repository/job.go                    |  11 +-
 internal/repository/query.go                  |   9 +-
 internal/repository/stats.go                  |   3 +-
 internal/repository/tags.go                   |   7 +-
 internal/repository/user.go                   | 392 +++++++++++++-----
 internal/repository/userConfig.go             | 137 ++++++
 .../{user_test.go => userConfig_test.go}      |   4 +-
 internal/routerConfig/routes.go               |  35 +-
 pkg/schema/config.go                          |  11 +-
 internal/auth/roles.go => pkg/schema/user.go  |  41 +-
 .../auth_test.go => pkg/schema/user_test.go   |   2 +-
 web/web.go                                    |   7 +-
 22 files changed, 637 insertions(+), 600 deletions(-)
 delete mode 100644 internal/auth/users.go
 create mode 100644 internal/repository/userConfig.go
 rename internal/repository/{user_test.go => userConfig_test.go} (94%)
 rename internal/auth/roles.go => pkg/schema/user.go (82%)
 rename internal/auth/auth_test.go => pkg/schema/user_test.go (99%)

diff --git a/cmd/cc-backend/main.go b/cmd/cc-backend/main.go
index 8164792..60c5edd 100644
--- a/cmd/cc-backend/main.go
+++ b/cmd/cc-backend/main.go
@@ -228,14 +228,16 @@ func main() {
 				log.Fatal("invalid argument format for user creation")
 			}
 
-			if err := authentication.AddUser(&auth.User{
+			ur := repository.GetUserRepository()
+			if err := ur.AddUser(&schema.User{
 				Username: parts[0], Projects: make([]string, 0), Password: parts[2], Roles: strings.Split(parts[1], ","),
 			}); err != nil {
 				log.Fatalf("adding '%s' user authentication failed: %v", parts[0], err)
 			}
 		}
 		if flagDelUser != "" {
-			if err := authentication.DelUser(flagDelUser); err != nil {
+			ur := repository.GetUserRepository()
+			if err := ur.DelUser(flagDelUser); err != nil {
 				log.Fatalf("deleting user failed: %v", err)
 			}
 		}
@@ -252,12 +254,13 @@ func main() {
 		}
 
 		if flagGenJWT != "" {
-			user, err := authentication.GetUser(flagGenJWT)
+			ur := repository.GetUserRepository()
+			user, err := ur.GetUser(flagGenJWT)
 			if err != nil {
 				log.Fatalf("could not get user from JWT: %v", err)
 			}
 
-			if !user.HasRole(auth.RoleApi) {
+			if !user.HasRole(schema.RoleApi) {
 				log.Warnf("user '%s' does not have the API role", user.Username)
 			}
 
@@ -327,15 +330,15 @@ func main() {
 
 	r.HandleFunc("/login", func(rw http.ResponseWriter, r *http.Request) {
 		rw.Header().Add("Content-Type", "text/html; charset=utf-8")
-		web.RenderTemplate(rw, r, "login.tmpl", &web.Page{Title: "Login", Build: buildInfo})
+		web.RenderTemplate(rw, "login.tmpl", &web.Page{Title: "Login", Build: buildInfo})
 	}).Methods(http.MethodGet)
 	r.HandleFunc("/imprint", func(rw http.ResponseWriter, r *http.Request) {
 		rw.Header().Add("Content-Type", "text/html; charset=utf-8")
-		web.RenderTemplate(rw, r, "imprint.tmpl", &web.Page{Title: "Imprint", Build: buildInfo})
+		web.RenderTemplate(rw, "imprint.tmpl", &web.Page{Title: "Imprint", Build: buildInfo})
 	})
 	r.HandleFunc("/privacy", func(rw http.ResponseWriter, r *http.Request) {
 		rw.Header().Add("Content-Type", "text/html; charset=utf-8")
-		web.RenderTemplate(rw, r, "privacy.tmpl", &web.Page{Title: "Privacy", Build: buildInfo})
+		web.RenderTemplate(rw, "privacy.tmpl", &web.Page{Title: "Privacy", Build: buildInfo})
 	})
 
 	// Some routes, such as /login or /query, should only be accessible to a user that is logged in.
@@ -351,7 +354,7 @@ func main() {
 			func(rw http.ResponseWriter, r *http.Request, err error) {
 				rw.Header().Add("Content-Type", "text/html; charset=utf-8")
 				rw.WriteHeader(http.StatusUnauthorized)
-				web.RenderTemplate(rw, r, "login.tmpl", &web.Page{
+				web.RenderTemplate(rw, "login.tmpl", &web.Page{
 					Title:   "Login failed - ClusterCockpit",
 					MsgType: "alert-warning",
 					Message: err.Error(),
@@ -362,7 +365,7 @@ func main() {
 		r.Handle("/logout", authentication.Logout(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 			rw.Header().Add("Content-Type", "text/html; charset=utf-8")
 			rw.WriteHeader(http.StatusOK)
-			web.RenderTemplate(rw, r, "login.tmpl", &web.Page{
+			web.RenderTemplate(rw, "login.tmpl", &web.Page{
 				Title:   "Bye - ClusterCockpit",
 				MsgType: "alert-info",
 				Message: "Logout successful",
@@ -378,7 +381,7 @@ func main() {
 				// On failure:
 				func(rw http.ResponseWriter, r *http.Request, err error) {
 					rw.WriteHeader(http.StatusUnauthorized)
-					web.RenderTemplate(rw, r, "login.tmpl", &web.Page{
+					web.RenderTemplate(rw, "login.tmpl", &web.Page{
 						Title:   "Authentication failed - ClusterCockpit",
 						MsgType: "alert-danger",
 						Message: err.Error(),
diff --git a/internal/api/rest.go b/internal/api/rest.go
index 501cf3b..0716514 100644
--- a/internal/api/rest.go
+++ b/internal/api/rest.go
@@ -182,12 +182,12 @@ func decode(r io.Reader, val interface{}) error {
 }
 
 func securedCheck(r *http.Request) error {
-	user := auth.GetUser(r.Context())
+	user := repository.GetUserFromContext(r.Context())
 	if user == nil {
 		return fmt.Errorf("no user in context")
 	}
 
-	if user.AuthType == auth.AuthToken {
+	if user.AuthType == schema.AuthToken {
 		// If nothing declared in config: deny all request to this endpoint
 		if config.Keys.ApiAllowedIPs == nil || len(config.Keys.ApiAllowedIPs) == 0 {
 			return fmt.Errorf("missing configuration key ApiAllowedIPs")
@@ -232,8 +232,10 @@ func securedCheck(r *http.Request) error {
 // @router      /jobs/ [get]
 func (api *RestApi) getJobs(rw http.ResponseWriter, r *http.Request) {
 
-	if user := auth.GetUser(r.Context()); user != nil && !user.HasRole(auth.RoleApi) {
-		handleError(fmt.Errorf("missing role: %v", auth.GetRoleString(auth.RoleApi)), http.StatusForbidden, rw)
+	if user := repository.GetUserFromContext(r.Context()); user != nil &&
+		!user.HasRole(schema.RoleApi) {
+
+		handleError(fmt.Errorf("missing role: %v", schema.GetRoleString(schema.RoleApi)), http.StatusForbidden, rw)
 		return
 	}
 
@@ -374,9 +376,11 @@ func (api *RestApi) getJobs(rw http.ResponseWriter, r *http.Request) {
 // @security    ApiKeyAuth
 // @router      /jobs/{id} [post]
 func (api *RestApi) getJobById(rw http.ResponseWriter, r *http.Request) {
-	if user := auth.GetUser(r.Context()); user != nil && !user.HasRole(auth.RoleApi) {
+	if user := repository.GetUserFromContext(r.Context()); user != nil &&
+		!user.HasRole(schema.RoleApi) {
+
 		handleError(fmt.Errorf("missing role: %v",
-			auth.GetRoleString(auth.RoleApi)), http.StatusForbidden, rw)
+			schema.GetRoleString(schema.RoleApi)), http.StatusForbidden, rw)
 		return
 	}
 
@@ -465,8 +469,10 @@ func (api *RestApi) getJobById(rw http.ResponseWriter, r *http.Request) {
 // @security    ApiKeyAuth
 // @router      /jobs/tag_job/{id} [post]
 func (api *RestApi) tagJob(rw http.ResponseWriter, r *http.Request) {
-	if user := auth.GetUser(r.Context()); user != nil && !user.HasRole(auth.RoleApi) {
-		handleError(fmt.Errorf("missing role: %v", auth.GetRoleString(auth.RoleApi)), http.StatusForbidden, rw)
+	if user := repository.GetUserFromContext(r.Context()); user != nil &&
+		!user.HasRole(schema.RoleApi) {
+
+		handleError(fmt.Errorf("missing role: %v", schema.GetRoleString(schema.RoleApi)), http.StatusForbidden, rw)
 		return
 	}
 
@@ -530,8 +536,10 @@ func (api *RestApi) tagJob(rw http.ResponseWriter, r *http.Request) {
 // @security    ApiKeyAuth
 // @router      /jobs/start_job/ [post]
 func (api *RestApi) startJob(rw http.ResponseWriter, r *http.Request) {
-	if user := auth.GetUser(r.Context()); user != nil && !user.HasRole(auth.RoleApi) {
-		handleError(fmt.Errorf("missing role: %v", auth.GetRoleString(auth.RoleApi)), http.StatusForbidden, rw)
+	if user := repository.GetUserFromContext(r.Context()); user != nil &&
+		!user.HasRole(schema.RoleApi) {
+
+		handleError(fmt.Errorf("missing role: %v", schema.GetRoleString(schema.RoleApi)), http.StatusForbidden, rw)
 		return
 	}
 
@@ -611,8 +619,10 @@ func (api *RestApi) startJob(rw http.ResponseWriter, r *http.Request) {
 // @security    ApiKeyAuth
 // @router      /jobs/stop_job/{id} [post]
 func (api *RestApi) stopJobById(rw http.ResponseWriter, r *http.Request) {
-	if user := auth.GetUser(r.Context()); user != nil && !user.HasRole(auth.RoleApi) {
-		handleError(fmt.Errorf("missing role: %v", auth.GetRoleString(auth.RoleApi)), http.StatusForbidden, rw)
+	if user := repository.GetUserFromContext(r.Context()); user != nil &&
+		!user.HasRole(schema.RoleApi) {
+
+		handleError(fmt.Errorf("missing role: %v", schema.GetRoleString(schema.RoleApi)), http.StatusForbidden, rw)
 		return
 	}
 
@@ -664,8 +674,10 @@ func (api *RestApi) stopJobById(rw http.ResponseWriter, r *http.Request) {
 // @security    ApiKeyAuth
 // @router      /jobs/stop_job/ [post]
 func (api *RestApi) stopJobByRequest(rw http.ResponseWriter, r *http.Request) {
-	if user := auth.GetUser(r.Context()); user != nil && !user.HasRole(auth.RoleApi) {
-		handleError(fmt.Errorf("missing role: %v", auth.GetRoleString(auth.RoleApi)), http.StatusForbidden, rw)
+	if user := repository.GetUserFromContext(r.Context()); user != nil &&
+		!user.HasRole(schema.RoleApi) {
+
+		handleError(fmt.Errorf("missing role: %v", schema.GetRoleString(schema.RoleApi)), http.StatusForbidden, rw)
 		return
 	}
 
@@ -710,8 +722,8 @@ func (api *RestApi) stopJobByRequest(rw http.ResponseWriter, r *http.Request) {
 // @security    ApiKeyAuth
 // @router      /jobs/delete_job/{id} [delete]
 func (api *RestApi) deleteJobById(rw http.ResponseWriter, r *http.Request) {
-	if user := auth.GetUser(r.Context()); user != nil && !user.HasRole(auth.RoleApi) {
-		handleError(fmt.Errorf("missing role: %v", auth.GetRoleString(auth.RoleApi)), http.StatusForbidden, rw)
+	if user := repository.GetUserFromContext(r.Context()); user != nil && !user.HasRole(schema.RoleApi) {
+		handleError(fmt.Errorf("missing role: %v", schema.GetRoleString(schema.RoleApi)), http.StatusForbidden, rw)
 		return
 	}
 
@@ -758,8 +770,9 @@ func (api *RestApi) deleteJobById(rw http.ResponseWriter, r *http.Request) {
 // @security    ApiKeyAuth
 // @router      /jobs/delete_job/ [delete]
 func (api *RestApi) deleteJobByRequest(rw http.ResponseWriter, r *http.Request) {
-	if user := auth.GetUser(r.Context()); user != nil && !user.HasRole(auth.RoleApi) {
-		handleError(fmt.Errorf("missing role: %v", auth.GetRoleString(auth.RoleApi)), http.StatusForbidden, rw)
+	if user := repository.GetUserFromContext(r.Context()); user != nil &&
+		!user.HasRole(schema.RoleApi) {
+		handleError(fmt.Errorf("missing role: %v", schema.GetRoleString(schema.RoleApi)), http.StatusForbidden, rw)
 		return
 	}
 
@@ -814,8 +827,8 @@ func (api *RestApi) deleteJobByRequest(rw http.ResponseWriter, r *http.Request)
 // @security    ApiKeyAuth
 // @router      /jobs/delete_job_before/{ts} [delete]
 func (api *RestApi) deleteJobBefore(rw http.ResponseWriter, r *http.Request) {
-	if user := auth.GetUser(r.Context()); user != nil && !user.HasRole(auth.RoleApi) {
-		handleError(fmt.Errorf("missing role: %v", auth.GetRoleString(auth.RoleApi)), http.StatusForbidden, rw)
+	if user := repository.GetUserFromContext(r.Context()); user != nil && !user.HasRole(schema.RoleApi) {
+		handleError(fmt.Errorf("missing role: %v", schema.GetRoleString(schema.RoleApi)), http.StatusForbidden, rw)
 		return
 	}
 
@@ -938,8 +951,8 @@ func (api *RestApi) getJWT(rw http.ResponseWriter, r *http.Request) {
 
 	rw.Header().Set("Content-Type", "text/plain")
 	username := r.FormValue("username")
-	me := auth.GetUser(r.Context())
-	if !me.HasRole(auth.RoleAdmin) {
+	me := repository.GetUserFromContext(r.Context())
+	if !me.HasRole(schema.RoleAdmin) {
 		if username != me.Username {
 			http.Error(rw, "Only admins are allowed to sign JWTs not for themselves",
 				http.StatusForbidden)
@@ -947,7 +960,7 @@ func (api *RestApi) getJWT(rw http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	user, err := api.Authentication.GetUser(username)
+	user, err := repository.GetUserRepository().GetUser(username)
 	if err != nil {
 		http.Error(rw, err.Error(), http.StatusUnprocessableEntity)
 		return
@@ -970,8 +983,8 @@ func (api *RestApi) createUser(rw http.ResponseWriter, r *http.Request) {
 	}
 
 	rw.Header().Set("Content-Type", "text/plain")
-	me := auth.GetUser(r.Context())
-	if !me.HasRole(auth.RoleAdmin) {
+	me := repository.GetUserFromContext(r.Context())
+	if !me.HasRole(schema.RoleAdmin) {
 		http.Error(rw, "Only admins are allowed to create new users", http.StatusForbidden)
 		return
 	}
@@ -980,22 +993,22 @@ func (api *RestApi) createUser(rw http.ResponseWriter, r *http.Request) {
 		r.FormValue("password"), r.FormValue("role"), r.FormValue("name"),
 		r.FormValue("email"), r.FormValue("project")
 
-	if len(password) == 0 && role != auth.GetRoleString(auth.RoleApi) {
+	if len(password) == 0 && role != schema.GetRoleString(schema.RoleApi) {
 		http.Error(rw, "Only API users are allowed to have a blank password (login will be impossible)", http.StatusBadRequest)
 		return
 	}
 
-	if len(project) != 0 && role != auth.GetRoleString(auth.RoleManager) {
+	if len(project) != 0 && role != schema.GetRoleString(schema.RoleManager) {
 		http.Error(rw, "only managers require a project (can be changed later)",
 			http.StatusBadRequest)
 		return
-	} else if len(project) == 0 && role == auth.GetRoleString(auth.RoleManager) {
+	} else if len(project) == 0 && role == schema.GetRoleString(schema.RoleManager) {
 		http.Error(rw, "managers require a project to manage (can be changed later)",
 			http.StatusBadRequest)
 		return
 	}
 
-	if err := api.Authentication.AddUser(&auth.User{
+	if err := repository.GetUserRepository().AddUser(&schema.User{
 		Username: username,
 		Name:     name,
 		Password: password,
@@ -1015,13 +1028,13 @@ func (api *RestApi) deleteUser(rw http.ResponseWriter, r *http.Request) {
 		http.Error(rw, err.Error(), http.StatusForbidden)
 	}
 
-	if user := auth.GetUser(r.Context()); !user.HasRole(auth.RoleAdmin) {
+	if user := repository.GetUserFromContext(r.Context()); !user.HasRole(schema.RoleAdmin) {
 		http.Error(rw, "Only admins are allowed to delete a user", http.StatusForbidden)
 		return
 	}
 
 	username := r.FormValue("username")
-	if err := api.Authentication.DelUser(username); err != nil {
+	if err := repository.GetUserRepository().DelUser(username); err != nil {
 		http.Error(rw, err.Error(), http.StatusUnprocessableEntity)
 		return
 	}
@@ -1035,12 +1048,12 @@ func (api *RestApi) getUsers(rw http.ResponseWriter, r *http.Request) {
 		http.Error(rw, err.Error(), http.StatusForbidden)
 	}
 
-	if user := auth.GetUser(r.Context()); !user.HasRole(auth.RoleAdmin) {
+	if user := repository.GetUserFromContext(r.Context()); !user.HasRole(schema.RoleAdmin) {
 		http.Error(rw, "Only admins are allowed to fetch a list of users", http.StatusForbidden)
 		return
 	}
 
-	users, err := api.Authentication.ListUsers(r.URL.Query().Get("not-just-user") == "true")
+	users, err := repository.GetUserRepository().ListUsers(r.URL.Query().Get("not-just-user") == "true")
 	if err != nil {
 		http.Error(rw, err.Error(), http.StatusInternalServerError)
 		return
@@ -1055,13 +1068,13 @@ func (api *RestApi) getRoles(rw http.ResponseWriter, r *http.Request) {
 		http.Error(rw, err.Error(), http.StatusForbidden)
 	}
 
-	user := auth.GetUser(r.Context())
-	if !user.HasRole(auth.RoleAdmin) {
+	user := repository.GetUserFromContext(r.Context())
+	if !user.HasRole(schema.RoleAdmin) {
 		http.Error(rw, "only admins are allowed to fetch a list of roles", http.StatusForbidden)
 		return
 	}
 
-	roles, err := auth.GetValidRoles(user)
+	roles, err := schema.GetValidRoles(user)
 	if err != nil {
 		http.Error(rw, err.Error(), http.StatusInternalServerError)
 		return
@@ -1076,7 +1089,7 @@ func (api *RestApi) updateUser(rw http.ResponseWriter, r *http.Request) {
 		http.Error(rw, err.Error(), http.StatusForbidden)
 	}
 
-	if user := auth.GetUser(r.Context()); !user.HasRole(auth.RoleAdmin) {
+	if user := repository.GetUserFromContext(r.Context()); !user.HasRole(schema.RoleAdmin) {
 		http.Error(rw, "Only admins are allowed to update a user", http.StatusForbidden)
 		return
 	}
@@ -1089,25 +1102,25 @@ func (api *RestApi) updateUser(rw http.ResponseWriter, r *http.Request) {
 
 	// TODO: Handle anything but roles...
 	if newrole != "" {
-		if err := api.Authentication.AddRole(r.Context(), mux.Vars(r)["id"], newrole); err != nil {
+		if err := repository.GetUserRepository().AddRole(r.Context(), mux.Vars(r)["id"], newrole); err != nil {
 			http.Error(rw, err.Error(), http.StatusUnprocessableEntity)
 			return
 		}
 		rw.Write([]byte("Add Role Success"))
 	} else if delrole != "" {
-		if err := api.Authentication.RemoveRole(r.Context(), mux.Vars(r)["id"], delrole); err != nil {
+		if err := repository.GetUserRepository().RemoveRole(r.Context(), mux.Vars(r)["id"], delrole); err != nil {
 			http.Error(rw, err.Error(), http.StatusUnprocessableEntity)
 			return
 		}
 		rw.Write([]byte("Remove Role Success"))
 	} else if newproj != "" {
-		if err := api.Authentication.AddProject(r.Context(), mux.Vars(r)["id"], newproj); err != nil {
+		if err := repository.GetUserRepository().AddProject(r.Context(), mux.Vars(r)["id"], newproj); err != nil {
 			http.Error(rw, err.Error(), http.StatusUnprocessableEntity)
 			return
 		}
 		rw.Write([]byte("Add Project Success"))
 	} else if delproj != "" {
-		if err := api.Authentication.RemoveProject(r.Context(), mux.Vars(r)["id"], delproj); err != nil {
+		if err := repository.GetUserRepository().RemoveProject(r.Context(), mux.Vars(r)["id"], delproj); err != nil {
 			http.Error(rw, err.Error(), http.StatusUnprocessableEntity)
 			return
 		}
@@ -1188,7 +1201,7 @@ func (api *RestApi) updateConfiguration(rw http.ResponseWriter, r *http.Request)
 
 	fmt.Printf("REST > KEY: %#v\nVALUE: %#v\n", key, value)
 
-	if err := repository.GetUserCfgRepo().UpdateConfig(key, value, auth.GetUser(r.Context())); err != nil {
+	if err := repository.GetUserCfgRepo().UpdateConfig(key, value, repository.GetUserFromContext(r.Context())); err != nil {
 		http.Error(rw, err.Error(), http.StatusUnprocessableEntity)
 		return
 	}
diff --git a/internal/auth/auth.go b/internal/auth/auth.go
index 57bf3c4..d79f28b 100644
--- a/internal/auth/auth.go
+++ b/internal/auth/auth.go
@@ -14,65 +14,19 @@ import (
 	"os"
 	"time"
 
+	"github.com/ClusterCockpit/cc-backend/internal/repository"
 	"github.com/ClusterCockpit/cc-backend/pkg/log"
+	"github.com/ClusterCockpit/cc-backend/pkg/schema"
 	"github.com/gorilla/sessions"
 	"github.com/jmoiron/sqlx"
 )
 
-type AuthSource int
-
-const (
-	AuthViaLocalPassword AuthSource = iota
-	AuthViaLDAP
-	AuthViaToken
-)
-
-type AuthType int
-
-const (
-	AuthToken AuthType = iota
-	AuthSession
-)
-
-type User struct {
-	Username   string     `json:"username"`
-	Password   string     `json:"-"`
-	Name       string     `json:"name"`
-	Roles      []string   `json:"roles"`
-	AuthType   AuthType   `json:"authType"`
-	AuthSource AuthSource `json:"authSource"`
-	Email      string     `json:"email"`
-	Projects   []string   `json:"projects"`
-}
-
-func (u *User) HasProject(project string) bool {
-	for _, p := range u.Projects {
-		if p == project {
-			return true
-		}
-	}
-	return false
-}
-
-func GetUser(ctx context.Context) *User {
-	x := ctx.Value(ContextUserKey)
-	if x == nil {
-		return nil
-	}
-
-	return x.(*User)
-}
-
 type Authenticator interface {
 	Init(auth *Authentication, config interface{}) error
-	CanLogin(user *User, username string, rw http.ResponseWriter, r *http.Request) bool
-	Login(user *User, rw http.ResponseWriter, r *http.Request) (*User, error)
+	CanLogin(user *schema.User, username string, rw http.ResponseWriter, r *http.Request) bool
+	Login(user *schema.User, rw http.ResponseWriter, r *http.Request) (*schema.User, error)
 }
 
-type ContextKey string
-
-const ContextUserKey ContextKey = "user"
-
 type Authentication struct {
 	db            *sqlx.DB
 	sessionStore  *sessions.CookieStore
@@ -86,7 +40,7 @@ type Authentication struct {
 
 func (auth *Authentication) AuthViaSession(
 	rw http.ResponseWriter,
-	r *http.Request) (*User, error) {
+	r *http.Request) (*schema.User, error) {
 	session, err := auth.sessionStore.Get(r, "session")
 	if err != nil {
 		log.Error("Error while getting session store")
@@ -119,11 +73,11 @@ func (auth *Authentication) AuthViaSession(
 	username, _ := session.Values["username"].(string)
 	projects, _ := session.Values["projects"].([]string)
 	roles, _ := session.Values["roles"].([]string)
-	return &User{
+	return &schema.User{
 		Username:   username,
 		Projects:   projects,
 		Roles:      roles,
-		AuthType:   AuthSession,
+		AuthType:   schema.AuthSession,
 		AuthSource: -1,
 	}, nil
 }
@@ -196,12 +150,13 @@ func (auth *Authentication) Login(
 	onfailure func(rw http.ResponseWriter, r *http.Request, loginErr error)) http.Handler {
 
 	return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+		ur := repository.GetUserRepository()
 		err := errors.New("no authenticator applied")
 		username := r.FormValue("username")
-		dbUser := (*User)(nil)
+		dbUser := (*schema.User)(nil)
 
 		if username != "" {
-			dbUser, err = auth.GetUser(username)
+			dbUser, err = ur.GetUser(username)
 			if err != nil && err != sql.ErrNoRows {
 				log.Errorf("Error while loading user '%v'", username)
 			}
@@ -211,7 +166,7 @@ func (auth *Authentication) Login(
 			if !authenticator.CanLogin(dbUser, username, rw, r) {
 				continue
 			}
-			dbUser, err = auth.GetUser(username)
+			dbUser, err = ur.GetUser(username)
 			if err != nil && err != sql.ErrNoRows {
 				log.Errorf("Error while loading user '%v'", username)
 			}
@@ -243,7 +198,7 @@ func (auth *Authentication) Login(
 			}
 
 			if dbUser == nil {
-				if err := auth.AddUser(user); err != nil {
+				if err := ur.AddUser(user); err != nil {
 					// TODO Add AuthSource
 					log.Errorf("Error while adding user '%v' to auth from XX",
 						user.Username)
@@ -251,7 +206,7 @@ func (auth *Authentication) Login(
 			}
 
 			log.Infof("login successfull: user: %#v (roles: %v, projects: %v)", user.Username, user.Roles, user.Projects)
-			ctx := context.WithValue(r.Context(), ContextUserKey, user)
+			ctx := context.WithValue(r.Context(), repository.ContextUserKey, user)
 			onsuccess.ServeHTTP(rw, r.WithContext(ctx))
 			return
 		}
@@ -284,7 +239,7 @@ func (auth *Authentication) Auth(
 		}
 
 		if user != nil {
-			ctx := context.WithValue(r.Context(), ContextUserKey, user)
+			ctx := context.WithValue(r.Context(), repository.ContextUserKey, user)
 			onsuccess.ServeHTTP(rw, r.WithContext(ctx))
 			return
 		}
diff --git a/internal/auth/jwt.go b/internal/auth/jwt.go
index 6a77fc4..0690b9b 100644
--- a/internal/auth/jwt.go
+++ b/internal/auth/jwt.go
@@ -13,22 +13,19 @@ import (
 	"strings"
 	"time"
 
+	"github.com/ClusterCockpit/cc-backend/internal/repository"
 	"github.com/ClusterCockpit/cc-backend/pkg/log"
 	"github.com/ClusterCockpit/cc-backend/pkg/schema"
 	"github.com/golang-jwt/jwt/v4"
 )
 
 type JWTAuthenticator struct {
-	auth *Authentication
-
 	publicKey  ed25519.PublicKey
 	privateKey ed25519.PrivateKey
 	config     *schema.JWTAuthConfig
 }
 
 func (ja *JWTAuthenticator) Init(auth *Authentication, conf interface{}) error {
-
-	ja.auth = auth
 	ja.config = conf.(*schema.JWTAuthConfig)
 
 	pubKey, privKey := os.Getenv("JWT_PUBLIC_KEY"), os.Getenv("JWT_PRIVATE_KEY")
@@ -54,7 +51,7 @@ func (ja *JWTAuthenticator) Init(auth *Authentication, conf interface{}) error {
 
 func (ja *JWTAuthenticator) AuthViaJWT(
 	rw http.ResponseWriter,
-	r *http.Request) (*User, error) {
+	r *http.Request) (*schema.User, error) {
 
 	rawtoken := r.Header.Get("X-Auth-Token")
 	if rawtoken == "" {
@@ -90,8 +87,9 @@ func (ja *JWTAuthenticator) AuthViaJWT(
 	var roles []string
 
 	// Validate user + roles from JWT against database?
-	if ja.config != nil && ja.config.ForceJWTValidationViaDatabase {
-		user, err := ja.auth.GetUser(sub)
+	if ja.config != nil && ja.config.ValidateUser {
+		ur := repository.GetUserRepository()
+		user, err := ur.GetUser(sub)
 
 		// Deny any logins for unknown usernames
 		if err != nil {
@@ -111,16 +109,16 @@ func (ja *JWTAuthenticator) AuthViaJWT(
 		}
 	}
 
-	return &User{
+	return &schema.User{
 		Username:   sub,
 		Roles:      roles,
-		AuthType:   AuthToken,
+		AuthType:   schema.AuthToken,
 		AuthSource: -1,
 	}, nil
 }
 
 // Generate a new JWT that can be used for authentication
-func (ja *JWTAuthenticator) ProvideJWT(user *User) (string, error) {
+func (ja *JWTAuthenticator) ProvideJWT(user *schema.User) (string, error) {
 
 	if ja.privateKey == nil {
 		return "", errors.New("environment variable 'JWT_PRIVATE_KEY' not set")
diff --git a/internal/auth/jwtCookieSession.go b/internal/auth/jwtCookieSession.go
index 8f31335..4787107 100644
--- a/internal/auth/jwtCookieSession.go
+++ b/internal/auth/jwtCookieSession.go
@@ -73,10 +73,10 @@ func (ja *JWTCookieSessionAuthenticator) Init(auth *Authentication, conf interfa
 			log.Warn("cookieName for JWTs not configured (cross login via JWT cookie will fail)")
 			return errors.New("cookieName for JWTs not configured (cross login via JWT cookie will fail)")
 		}
-		if !ja.config.ForceJWTValidationViaDatabase {
+		if !ja.config.ValidateUser {
 			log.Warn("forceJWTValidationViaDatabase not set to true: CC will accept users and roles defined in JWTs regardless of its own database!")
 		}
-		if ja.config.TrustedExternalIssuer == "" {
+		if ja.config.TrustedIssuer == "" {
 			log.Warn("trustedExternalIssuer for JWTs not configured (cross login via JWT cookie will fail)")
 			return errors.New("trustedExternalIssuer for JWTs not configured (cross login via JWT cookie will fail)")
 		}
@@ -89,7 +89,7 @@ func (ja *JWTCookieSessionAuthenticator) Init(auth *Authentication, conf interfa
 }
 
 func (ja *JWTCookieSessionAuthenticator) CanLogin(
-	user *User,
+	user *schema.User,
 	username string,
 	rw http.ResponseWriter,
 	r *http.Request) bool {
@@ -112,9 +112,9 @@ func (ja *JWTCookieSessionAuthenticator) CanLogin(
 }
 
 func (ja *JWTCookieSessionAuthenticator) Login(
-	user *User,
+	user *schema.User,
 	rw http.ResponseWriter,
-	r *http.Request) (*User, error) {
+	r *http.Request) (*schema.User, error) {
 
 	jwtCookie, err := r.Cookie(ja.config.CookieName)
 	var rawtoken string
@@ -129,7 +129,7 @@ func (ja *JWTCookieSessionAuthenticator) Login(
 		}
 
 		unvalidatedIssuer, success := t.Claims.(jwt.MapClaims)["iss"].(string)
-		if success && unvalidatedIssuer == ja.config.TrustedExternalIssuer {
+		if success && unvalidatedIssuer == ja.config.TrustedIssuer {
 			// The (unvalidated) issuer seems to be the expected one,
 			// use public cross login key from config
 			return ja.publicKeyCrossLogin, nil
@@ -160,7 +160,7 @@ func (ja *JWTCookieSessionAuthenticator) Login(
 
 	var roles []string
 
-	if ja.config.ForceJWTValidationViaDatabase {
+	if ja.config.ValidateUser {
 		// Deny any logins for unknown usernames
 		if user == nil {
 			log.Warn("Could not find user from JWT in internal database.")
@@ -191,12 +191,12 @@ func (ja *JWTCookieSessionAuthenticator) Login(
 	http.SetCookie(rw, deletedCookie)
 
 	if user == nil {
-		user = &User{
+		user = &schema.User{
 			Username:   sub,
 			Name:       name,
 			Roles:      roles,
-			AuthType:   AuthSession,
-			AuthSource: AuthViaToken,
+			AuthType:   schema.AuthSession,
+			AuthSource: schema.AuthViaToken,
 		}
 	}
 
diff --git a/internal/auth/jwtSession.go b/internal/auth/jwtSession.go
index 13af7c1..59250ac 100644
--- a/internal/auth/jwtSession.go
+++ b/internal/auth/jwtSession.go
@@ -12,21 +12,17 @@ import (
 	"strings"
 
 	"github.com/ClusterCockpit/cc-backend/pkg/log"
+	"github.com/ClusterCockpit/cc-backend/pkg/schema"
 	"github.com/golang-jwt/jwt/v4"
 )
 
 type JWTSessionAuthenticator struct {
-	auth *Authentication
-
 	loginTokenKey []byte // HS256 key
 }
 
 var _ Authenticator = (*JWTSessionAuthenticator)(nil)
 
 func (ja *JWTSessionAuthenticator) Init(auth *Authentication, conf interface{}) error {
-
-	ja.auth = auth
-
 	if pubKey := os.Getenv("CROSS_LOGIN_JWT_HS512_KEY"); pubKey != "" {
 		bytes, err := base64.StdEncoding.DecodeString(pubKey)
 		if err != nil {
@@ -40,7 +36,7 @@ func (ja *JWTSessionAuthenticator) Init(auth *Authentication, conf interface{})
 }
 
 func (ja *JWTSessionAuthenticator) CanLogin(
-	user *User,
+	user *schema.User,
 	username string,
 	rw http.ResponseWriter,
 	r *http.Request) bool {
@@ -49,9 +45,9 @@ func (ja *JWTSessionAuthenticator) CanLogin(
 }
 
 func (ja *JWTSessionAuthenticator) Login(
-	user *User,
+	user *schema.User,
 	rw http.ResponseWriter,
-	r *http.Request) (*User, error) {
+	r *http.Request) (*schema.User, error) {
 
 	rawtoken := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
 	if rawtoken == "" {
@@ -92,14 +88,14 @@ func (ja *JWTSessionAuthenticator) Login(
 	if rawroles, ok := claims["roles"].([]interface{}); ok {
 		for _, rr := range rawroles {
 			if r, ok := rr.(string); ok {
-				if isValidRole(r) {
+				if schema.IsValidRole(r) {
 					roles = append(roles, r)
 				}
 			}
 		}
 	} else if rawroles, ok := claims["roles"]; ok {
 		for _, r := range rawroles.([]string) {
-			if isValidRole(r) {
+			if schema.IsValidRole(r) {
 				roles = append(roles, r)
 			}
 		}
@@ -120,13 +116,13 @@ func (ja *JWTSessionAuthenticator) Login(
 	// }
 
 	if user == nil {
-		user = &User{
+		user = &schema.User{
 			Username:   sub,
 			Name:       name,
 			Roles:      roles,
 			Projects:   projects,
-			AuthType:   AuthSession,
-			AuthSource: AuthViaToken,
+			AuthType:   schema.AuthSession,
+			AuthSource: schema.AuthViaToken,
 		}
 	}
 
diff --git a/internal/auth/ldap.go b/internal/auth/ldap.go
index 9feebc1..925e967 100644
--- a/internal/auth/ldap.go
+++ b/internal/auth/ldap.go
@@ -67,12 +67,12 @@ func (la *LdapAuthenticator) Init(
 }
 
 func (la *LdapAuthenticator) CanLogin(
-	user *User,
+	user *schema.User,
 	username string,
 	rw http.ResponseWriter,
 	r *http.Request) bool {
 
-	if user != nil && user.AuthSource == AuthViaLDAP {
+	if user != nil && user.AuthSource == schema.AuthViaLDAP {
 		return true
 	} else {
 		if la.config != nil && la.config.SyncUserOnLogin {
@@ -103,7 +103,7 @@ func (la *LdapAuthenticator) CanLogin(
 			name := entry.GetAttributeValue("gecos")
 
 			if _, err := la.auth.db.Exec(`INSERT INTO user (username, ldap, name, roles) VALUES (?, ?, ?, ?)`,
-				username, 1, name, "[\""+GetRoleString(RoleUser)+"\"]"); err != nil {
+				username, 1, name, "[\""+schema.GetRoleString(schema.RoleUser)+"\"]"); err != nil {
 				log.Errorf("User '%s' new in LDAP: Insert into DB failed", username)
 				return false
 			}
@@ -116,9 +116,9 @@ func (la *LdapAuthenticator) CanLogin(
 }
 
 func (la *LdapAuthenticator) Login(
-	user *User,
+	user *schema.User,
 	rw http.ResponseWriter,
-	r *http.Request) (*User, error) {
+	r *http.Request) (*schema.User, error) {
 
 	l, err := la.getLdapConnection(false)
 	if err != nil {
@@ -203,7 +203,7 @@ func (la *LdapAuthenticator) Sync() error {
 			name := newnames[username]
 			log.Debugf("sync: add %v (name: %v, roles: [user], ldap: true)", username, name)
 			if _, err := la.auth.db.Exec(`INSERT INTO user (username, ldap, name, roles) VALUES (?, ?, ?, ?)`,
-				username, 1, name, "[\""+GetRoleString(RoleUser)+"\"]"); err != nil {
+				username, 1, name, "[\""+schema.GetRoleString(schema.RoleUser)+"\"]"); err != nil {
 				log.Errorf("User '%s' new in LDAP: Insert into DB failed", username)
 				return err
 			}
diff --git a/internal/auth/local.go b/internal/auth/local.go
index 700db3a..fb1ba0f 100644
--- a/internal/auth/local.go
+++ b/internal/auth/local.go
@@ -9,6 +9,7 @@ import (
 	"net/http"
 
 	"github.com/ClusterCockpit/cc-backend/pkg/log"
+	"github.com/ClusterCockpit/cc-backend/pkg/schema"
 	"golang.org/x/crypto/bcrypt"
 )
 
@@ -27,18 +28,18 @@ func (la *LocalAuthenticator) Init(
 }
 
 func (la *LocalAuthenticator) CanLogin(
-	user *User,
+	user *schema.User,
 	username string,
 	rw http.ResponseWriter,
 	r *http.Request) bool {
 
-	return user != nil && user.AuthSource == AuthViaLocalPassword
+	return user != nil && user.AuthSource == schema.AuthViaLocalPassword
 }
 
 func (la *LocalAuthenticator) Login(
-	user *User,
+	user *schema.User,
 	rw http.ResponseWriter,
-	r *http.Request) (*User, error) {
+	r *http.Request) (*schema.User, error) {
 
 	if e := bcrypt.CompareHashAndPassword([]byte(user.Password),
 		[]byte(r.FormValue("password"))); e != nil {
diff --git a/internal/auth/users.go b/internal/auth/users.go
deleted file mode 100644
index b69533b..0000000
--- a/internal/auth/users.go
+++ /dev/null
@@ -1,289 +0,0 @@
-// Copyright (C) 2022 NHR@FAU, University Erlangen-Nuremberg.
-// All rights reserved.
-// Use of this source code is governed by a MIT-style
-// license that can be found in the LICENSE file.
-package auth
-
-import (
-	"context"
-	"database/sql"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"strings"
-
-	"github.com/ClusterCockpit/cc-backend/internal/graph/model"
-	"github.com/ClusterCockpit/cc-backend/pkg/log"
-	sq "github.com/Masterminds/squirrel"
-	"github.com/jmoiron/sqlx"
-	"golang.org/x/crypto/bcrypt"
-)
-
-func (auth *Authentication) GetUser(username string) (*User, error) {
-
-	user := &User{Username: username}
-	var hashedPassword, name, rawRoles, email, rawProjects sql.NullString
-	if err := sq.Select("password", "ldap", "name", "roles", "email", "projects").From("user").
-		Where("user.username = ?", username).RunWith(auth.db).
-		QueryRow().Scan(&hashedPassword, &user.AuthSource, &name, &rawRoles, &email, &rawProjects); err != nil {
-		log.Warnf("Error while querying user '%v' from database", username)
-		return nil, err
-	}
-
-	user.Password = hashedPassword.String
-	user.Name = name.String
-	user.Email = email.String
-	if rawRoles.Valid {
-		if err := json.Unmarshal([]byte(rawRoles.String), &user.Roles); err != nil {
-			log.Warn("Error while unmarshaling raw roles from DB")
-			return nil, err
-		}
-	}
-	if rawProjects.Valid {
-		if err := json.Unmarshal([]byte(rawProjects.String), &user.Projects); err != nil {
-			return nil, err
-		}
-	}
-
-	return user, nil
-}
-
-func (auth *Authentication) AddUser(user *User) error {
-
-	rolesJson, _ := json.Marshal(user.Roles)
-	projectsJson, _ := json.Marshal(user.Projects)
-
-	cols := []string{"username", "roles", "projects"}
-	vals := []interface{}{user.Username, string(rolesJson), string(projectsJson)}
-
-	if user.Name != "" {
-		cols = append(cols, "name")
-		vals = append(vals, user.Name)
-	}
-	if user.Email != "" {
-		cols = append(cols, "email")
-		vals = append(vals, user.Email)
-	}
-	if user.Password != "" {
-		password, err := bcrypt.GenerateFromPassword([]byte(user.Password), bcrypt.DefaultCost)
-		if err != nil {
-			log.Error("Error while encrypting new user password")
-			return err
-		}
-		cols = append(cols, "password")
-		vals = append(vals, string(password))
-	}
-
-	if _, err := sq.Insert("user").Columns(cols...).Values(vals...).RunWith(auth.db).Exec(); err != nil {
-		log.Errorf("Error while inserting new user '%v' into DB", user.Username)
-		return err
-	}
-
-	log.Infof("new user %#v created (roles: %s, auth-source: %d, projects: %s)", user.Username, rolesJson, user.AuthSource, projectsJson)
-	return nil
-}
-
-func (auth *Authentication) DelUser(username string) error {
-
-	_, err := auth.db.Exec(`DELETE FROM user WHERE user.username = ?`, username)
-	log.Errorf("Error while deleting user '%s' from DB", username)
-	return err
-}
-
-func (auth *Authentication) ListUsers(specialsOnly bool) ([]*User, error) {
-
-	q := sq.Select("username", "name", "email", "roles", "projects").From("user")
-	if specialsOnly {
-		q = q.Where("(roles != '[\"user\"]' AND roles != '[]')")
-	}
-
-	rows, err := q.RunWith(auth.db).Query()
-	if err != nil {
-		log.Warn("Error while querying user list")
-		return nil, err
-	}
-
-	users := make([]*User, 0)
-	defer rows.Close()
-	for rows.Next() {
-		rawroles := ""
-		rawprojects := ""
-		user := &User{}
-		var name, email sql.NullString
-		if err := rows.Scan(&user.Username, &name, &email, &rawroles, &rawprojects); err != nil {
-			log.Warn("Error while scanning user list")
-			return nil, err
-		}
-
-		if err := json.Unmarshal([]byte(rawroles), &user.Roles); err != nil {
-			log.Warn("Error while unmarshaling raw role list")
-			return nil, err
-		}
-
-		if err := json.Unmarshal([]byte(rawprojects), &user.Projects); err != nil {
-			return nil, err
-		}
-
-		user.Name = name.String
-		user.Email = email.String
-		users = append(users, user)
-	}
-	return users, nil
-}
-
-func (auth *Authentication) AddRole(
-	ctx context.Context,
-	username string,
-	queryrole string) error {
-
-	newRole := strings.ToLower(queryrole)
-	user, err := auth.GetUser(username)
-	if err != nil {
-		log.Warnf("Could not load user '%s'", username)
-		return err
-	}
-
-	exists, valid := user.HasValidRole(newRole)
-
-	if !valid {
-		return fmt.Errorf("Supplied role is no valid option : %v", newRole)
-	}
-	if exists {
-		return fmt.Errorf("User %v already has role %v", username, newRole)
-	}
-
-	roles, _ := json.Marshal(append(user.Roles, newRole))
-	if _, err := sq.Update("user").Set("roles", roles).Where("user.username = ?", username).RunWith(auth.db).Exec(); err != nil {
-		log.Errorf("Error while adding new role for user '%s'", user.Username)
-		return err
-	}
-	return nil
-}
-
-func (auth *Authentication) RemoveRole(ctx context.Context, username string, queryrole string) error {
-	oldRole := strings.ToLower(queryrole)
-	user, err := auth.GetUser(username)
-	if err != nil {
-		log.Warnf("Could not load user '%s'", username)
-		return err
-	}
-
-	exists, valid := user.HasValidRole(oldRole)
-
-	if !valid {
-		return fmt.Errorf("Supplied role is no valid option : %v", oldRole)
-	}
-	if !exists {
-		return fmt.Errorf("Role already deleted for user '%v': %v", username, oldRole)
-	}
-
-	if oldRole == GetRoleString(RoleManager) && len(user.Projects) != 0 {
-		return fmt.Errorf("Cannot remove role 'manager' while user %s still has assigned project(s) : %v", username, user.Projects)
-	}
-
-	var newroles []string
-	for _, r := range user.Roles {
-		if r != oldRole {
-			newroles = append(newroles, r) // Append all roles not matching requested to be deleted role
-		}
-	}
-
-	var mroles, _ = json.Marshal(newroles)
-	if _, err := sq.Update("user").Set("roles", mroles).Where("user.username = ?", username).RunWith(auth.db).Exec(); err != nil {
-		log.Errorf("Error while removing role for user '%s'", user.Username)
-		return err
-	}
-	return nil
-}
-
-func (auth *Authentication) AddProject(
-	ctx context.Context,
-	username string,
-	project string) error {
-
-	user, err := auth.GetUser(username)
-	if err != nil {
-		return err
-	}
-
-	if !user.HasRole(RoleManager) {
-		return fmt.Errorf("user '%s' is not a manager!", username)
-	}
-
-	if user.HasProject(project) {
-		return fmt.Errorf("user '%s' already manages project '%s'", username, project)
-	}
-
-	projects, _ := json.Marshal(append(user.Projects, project))
-	if _, err := sq.Update("user").Set("projects", projects).Where("user.username = ?", username).RunWith(auth.db).Exec(); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (auth *Authentication) RemoveProject(ctx context.Context, username string, project string) error {
-	user, err := auth.GetUser(username)
-	if err != nil {
-		return err
-	}
-
-	if !user.HasRole(RoleManager) {
-		return fmt.Errorf("user '%#v' is not a manager!", username)
-	}
-
-	if !user.HasProject(project) {
-		return fmt.Errorf("user '%#v': Cannot remove project '%#v' - Does not match!", username, project)
-	}
-
-	var exists bool
-	var newprojects []string
-	for _, p := range user.Projects {
-		if p != project {
-			newprojects = append(newprojects, p) // Append all projects not matching requested to be deleted project
-		} else {
-			exists = true
-		}
-	}
-
-	if exists == true {
-		var result interface{}
-		if len(newprojects) == 0 {
-			result = "[]"
-		} else {
-			result, _ = json.Marshal(newprojects)
-		}
-		if _, err := sq.Update("user").Set("projects", result).Where("user.username = ?", username).RunWith(auth.db).Exec(); err != nil {
-			return err
-		}
-		return nil
-	} else {
-		return fmt.Errorf("user %s already does not manage project %s", username, project)
-	}
-}
-
-func FetchUser(ctx context.Context, db *sqlx.DB, username string) (*model.User, error) {
-	me := GetUser(ctx)
-	if me != nil && me.Username != username && me.HasNotRoles([]Role{RoleAdmin, RoleSupport, RoleManager}) {
-		return nil, errors.New("forbidden")
-	}
-
-	user := &model.User{Username: username}
-	var name, email sql.NullString
-	if err := sq.Select("name", "email").From("user").Where("user.username = ?", username).
-		RunWith(db).QueryRow().Scan(&name, &email); err != nil {
-		if err == sql.ErrNoRows {
-			/* This warning will be logged *often* for non-local users, i.e. users mentioned only in job-table or archive, */
-			/* since FetchUser will be called to retrieve full name and mail for every job in query/list									 */
-			// log.Warnf("User '%s' Not found in DB", username)
-			return nil, nil
-		}
-
-		log.Warnf("Error while fetching user '%s'", username)
-		return nil, err
-	}
-
-	user.Name = name.String
-	user.Email = email.String
-	return user, nil
-}
diff --git a/internal/graph/schema.resolvers.go b/internal/graph/schema.resolvers.go
index cd24a2a..1be455c 100644
--- a/internal/graph/schema.resolvers.go
+++ b/internal/graph/schema.resolvers.go
@@ -11,7 +11,6 @@ import (
 	"strconv"
 	"time"
 
-	"github.com/ClusterCockpit/cc-backend/internal/auth"
 	"github.com/ClusterCockpit/cc-backend/internal/graph/generated"
 	"github.com/ClusterCockpit/cc-backend/internal/graph/model"
 	"github.com/ClusterCockpit/cc-backend/internal/metricdata"
@@ -51,7 +50,7 @@ func (r *jobResolver) MetaData(ctx context.Context, obj *schema.Job) (interface{
 
 // UserData is the resolver for the userData field.
 func (r *jobResolver) UserData(ctx context.Context, obj *schema.Job) (*model.User, error) {
-	return auth.FetchUser(ctx, r.DB, obj.User)
+	return repository.GetUserRepository().FetchUserInCtx(ctx, obj.User)
 }
 
 // CreateTag is the resolver for the createTag field.
@@ -122,7 +121,7 @@ func (r *mutationResolver) RemoveTagsFromJob(ctx context.Context, job string, ta
 
 // UpdateConfiguration is the resolver for the updateConfiguration field.
 func (r *mutationResolver) UpdateConfiguration(ctx context.Context, name string, value string) (*string, error) {
-	if err := repository.GetUserCfgRepo().UpdateConfig(name, value, auth.GetUser(ctx)); err != nil {
+	if err := repository.GetUserCfgRepo().UpdateConfig(name, value, repository.GetUserFromContext(ctx)); err != nil {
 		log.Warn("Error while updating user config")
 		return nil, err
 	}
@@ -142,7 +141,7 @@ func (r *queryResolver) Tags(ctx context.Context) ([]*schema.Tag, error) {
 
 // User is the resolver for the user field.
 func (r *queryResolver) User(ctx context.Context, username string) (*model.User, error) {
-	return auth.FetchUser(ctx, r.DB, username)
+	return repository.GetUserRepository().FetchUserInCtx(ctx, username)
 }
 
 // AllocatedNodes is the resolver for the allocatedNodes field.
@@ -178,7 +177,9 @@ func (r *queryResolver) Job(ctx context.Context, id string) (*schema.Job, error)
 		return nil, err
 	}
 
-	if user := auth.GetUser(ctx); user != nil && job.User != user.Username && user.HasNotRoles([]auth.Role{auth.RoleAdmin, auth.RoleSupport, auth.RoleManager}) {
+	if user := repository.GetUserFromContext(ctx); user != nil &&
+		job.User != user.Username &&
+		user.HasNotRoles([]schema.Role{schema.RoleAdmin, schema.RoleSupport, schema.RoleManager}) {
 		return nil, errors.New("you are not allowed to see this job")
 	}
 
@@ -318,8 +319,8 @@ func (r *queryResolver) RooflineHeatmap(ctx context.Context, filter []*model.Job
 
 // NodeMetrics is the resolver for the nodeMetrics field.
 func (r *queryResolver) NodeMetrics(ctx context.Context, cluster string, nodes []string, scopes []schema.MetricScope, metrics []string, from time.Time, to time.Time) ([]*model.NodeMetrics, error) {
-	user := auth.GetUser(ctx)
-	if user != nil && !user.HasRole(auth.RoleAdmin) {
+	user := repository.GetUserFromContext(ctx)
+	if user != nil && !user.HasRole(schema.RoleAdmin) {
 		return nil, errors.New("you need to be an administrator for this query")
 	}
 
diff --git a/internal/repository/job.go b/internal/repository/job.go
index b712a86..449c267 100644
--- a/internal/repository/job.go
+++ b/internal/repository/job.go
@@ -14,7 +14,6 @@ import (
 	"sync"
 	"time"
 
-	"github.com/ClusterCockpit/cc-backend/internal/auth"
 	"github.com/ClusterCockpit/cc-backend/internal/graph/model"
 	"github.com/ClusterCockpit/cc-backend/internal/metricdata"
 	"github.com/ClusterCockpit/cc-backend/pkg/log"
@@ -615,7 +614,7 @@ func (r *JobRepository) WaitForArchiving() {
 	r.archivePending.Wait()
 }
 
-func (r *JobRepository) FindUserOrProjectOrJobname(user *auth.User, searchterm string) (jobid string, username string, project string, jobname string) {
+func (r *JobRepository) FindUserOrProjectOrJobname(user *schema.User, searchterm string) (jobid string, username string, project string, jobname string) {
 	if _, err := strconv.Atoi(searchterm); err == nil { // Return empty on successful conversion: parent method will redirect for integer jobId
 		return searchterm, "", "", ""
 	} else { // Has to have letters and logged-in user for other guesses
@@ -644,14 +643,14 @@ func (r *JobRepository) FindUserOrProjectOrJobname(user *auth.User, searchterm s
 var ErrNotFound = errors.New("no such jobname, project or user")
 var ErrForbidden = errors.New("not authorized")
 
-func (r *JobRepository) FindColumnValue(user *auth.User, searchterm string, table string, selectColumn string, whereColumn string, isLike bool) (result string, err error) {
+func (r *JobRepository) FindColumnValue(user *schema.User, searchterm string, table string, selectColumn string, whereColumn string, isLike bool) (result string, err error) {
 	compareStr := " = ?"
 	query := searchterm
 	if isLike {
 		compareStr = " LIKE ?"
 		query = "%" + searchterm + "%"
 	}
-	if user.HasAnyRole([]auth.Role{auth.RoleAdmin, auth.RoleSupport, auth.RoleManager}) {
+	if user.HasAnyRole([]schema.Role{schema.RoleAdmin, schema.RoleSupport, schema.RoleManager}) {
 		theQuery := sq.Select(table+"."+selectColumn).Distinct().From(table).
 			Where(table+"."+whereColumn+compareStr, query)
 
@@ -676,9 +675,9 @@ func (r *JobRepository) FindColumnValue(user *auth.User, searchterm string, tabl
 	}
 }
 
-func (r *JobRepository) FindColumnValues(user *auth.User, query string, table string, selectColumn string, whereColumn string) (results []string, err error) {
+func (r *JobRepository) FindColumnValues(user *schema.User, query string, table string, selectColumn string, whereColumn string) (results []string, err error) {
 	emptyResult := make([]string, 0)
-	if user.HasAnyRole([]auth.Role{auth.RoleAdmin, auth.RoleSupport, auth.RoleManager}) {
+	if user.HasAnyRole([]schema.Role{schema.RoleAdmin, schema.RoleSupport, schema.RoleManager}) {
 		rows, err := sq.Select(table+"."+selectColumn).Distinct().From(table).
 			Where(table+"."+whereColumn+" LIKE ?", fmt.Sprint("%", query, "%")).
 			RunWith(r.stmtCache).Query()
diff --git a/internal/repository/query.go b/internal/repository/query.go
index 02e5304..0501fe1 100644
--- a/internal/repository/query.go
+++ b/internal/repository/query.go
@@ -12,7 +12,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/ClusterCockpit/cc-backend/internal/auth"
 	"github.com/ClusterCockpit/cc-backend/internal/graph/model"
 	"github.com/ClusterCockpit/cc-backend/pkg/log"
 	"github.com/ClusterCockpit/cc-backend/pkg/schema"
@@ -130,20 +129,20 @@ func (r *JobRepository) CountJobs(
 }
 
 func SecurityCheck(ctx context.Context, query sq.SelectBuilder) (sq.SelectBuilder, error) {
-	user := auth.GetUser(ctx)
+	user := GetUserFromContext(ctx)
 	if user == nil {
 		var qnil sq.SelectBuilder
 		return qnil, fmt.Errorf("user context is nil!")
-	} else if user.HasAnyRole([]auth.Role{auth.RoleAdmin, auth.RoleSupport, auth.RoleApi}) { // Admin & Co. : All jobs
+	} else if user.HasAnyRole([]schema.Role{schema.RoleAdmin, schema.RoleSupport, schema.RoleApi}) { // Admin & Co. : All jobs
 		return query, nil
-	} else if user.HasRole(auth.RoleManager) { // Manager : Add filter for managed projects' jobs only + personal jobs
+	} else if user.HasRole(schema.RoleManager) { // Manager : Add filter for managed projects' jobs only + personal jobs
 		if len(user.Projects) != 0 {
 			return query.Where(sq.Or{sq.Eq{"job.project": user.Projects}, sq.Eq{"job.user": user.Username}}), nil
 		} else {
 			log.Debugf("Manager-User '%s' has no defined projects to lookup! Query only personal jobs ...", user.Username)
 			return query.Where("job.user = ?", user.Username), nil
 		}
-	} else if user.HasRole(auth.RoleUser) { // User : Only personal jobs
+	} else if user.HasRole(schema.RoleUser) { // User : Only personal jobs
 		return query.Where("job.user = ?", user.Username), nil
 	} else {
 		// Shortterm compatibility: Return User-Query if no roles:
diff --git a/internal/repository/stats.go b/internal/repository/stats.go
index 158d34a..8a74008 100644
--- a/internal/repository/stats.go
+++ b/internal/repository/stats.go
@@ -10,7 +10,6 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/ClusterCockpit/cc-backend/internal/auth"
 	"github.com/ClusterCockpit/cc-backend/internal/config"
 	"github.com/ClusterCockpit/cc-backend/internal/graph/model"
 	"github.com/ClusterCockpit/cc-backend/pkg/log"
@@ -86,7 +85,7 @@ func (r *JobRepository) buildStatsQuery(
 }
 
 func (r *JobRepository) getUserName(ctx context.Context, id string) string {
-	user := auth.GetUser(ctx)
+	user := GetUserFromContext(ctx)
 	name, _ := r.FindColumnValue(user, id, "user", "name", "username", false)
 	if name != "" {
 		return name
diff --git a/internal/repository/tags.go b/internal/repository/tags.go
index 6c46352..52bc836 100644
--- a/internal/repository/tags.go
+++ b/internal/repository/tags.go
@@ -7,7 +7,6 @@ package repository
 import (
 	"strings"
 
-	"github.com/ClusterCockpit/cc-backend/internal/auth"
 	"github.com/ClusterCockpit/cc-backend/pkg/archive"
 	"github.com/ClusterCockpit/cc-backend/pkg/log"
 	"github.com/ClusterCockpit/cc-backend/pkg/schema"
@@ -68,7 +67,7 @@ func (r *JobRepository) CreateTag(tagType string, tagName string) (tagId int64,
 	return res.LastInsertId()
 }
 
-func (r *JobRepository) CountTags(user *auth.User) (tags []schema.Tag, counts map[string]int, err error) {
+func (r *JobRepository) CountTags(user *schema.User) (tags []schema.Tag, counts map[string]int, err error) {
 	tags = make([]schema.Tag, 0, 100)
 	xrows, err := r.DB.Queryx("SELECT id, tag_type, tag_name FROM tag")
 	if err != nil {
@@ -88,10 +87,10 @@ func (r *JobRepository) CountTags(user *auth.User) (tags []schema.Tag, counts ma
 		LeftJoin("jobtag jt ON t.id = jt.tag_id").
 		GroupBy("t.tag_name")
 
-	if user != nil && user.HasAnyRole([]auth.Role{auth.RoleAdmin, auth.RoleSupport}) { // ADMIN || SUPPORT: Count all jobs
+	if user != nil && user.HasAnyRole([]schema.Role{schema.RoleAdmin, schema.RoleSupport}) { // ADMIN || SUPPORT: Count all jobs
 		log.Debug("CountTags: User Admin or Support -> Count all Jobs for Tags")
 		// Unchanged: Needs to be own case still, due to UserRole/NoRole compatibility handling in else case
-	} else if user != nil && user.HasRole(auth.RoleManager) { // MANAGER: Count own jobs plus project's jobs
+	} else if user != nil && user.HasRole(schema.RoleManager) { // MANAGER: Count own jobs plus project's jobs
 		// Build ("project1", "project2", ...) list of variable length directly in SQL string
 		q = q.Where("jt.job_id IN (SELECT id FROM job WHERE job.user = ? OR job.project IN (\""+strings.Join(user.Projects, "\",\"")+"\"))", user.Username)
 	} else if user != nil { // USER OR NO ROLE (Compatibility): Only count own jobs
diff --git a/internal/repository/user.go b/internal/repository/user.go
index 6a6fe62..3db7e4d 100644
--- a/internal/repository/user.go
+++ b/internal/repository/user.go
@@ -1,137 +1,325 @@
-// Copyright (C) 2022 NHR@FAU, University Erlangen-Nuremberg.
+// Copyright (C) 2023 NHR@FAU, University Erlangen-Nuremberg.
 // All rights reserved.
 // Use of this source code is governed by a MIT-style
 // license that can be found in the LICENSE file.
 package repository
 
 import (
+	"context"
+	"database/sql"
 	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
 	"sync"
-	"time"
 
-	"github.com/ClusterCockpit/cc-backend/internal/auth"
-	"github.com/ClusterCockpit/cc-backend/internal/config"
+	"github.com/ClusterCockpit/cc-backend/internal/graph/model"
 	"github.com/ClusterCockpit/cc-backend/pkg/log"
-	"github.com/ClusterCockpit/cc-backend/pkg/lrucache"
+	"github.com/ClusterCockpit/cc-backend/pkg/schema"
+	sq "github.com/Masterminds/squirrel"
 	"github.com/jmoiron/sqlx"
+	"golang.org/x/crypto/bcrypt"
 )
 
 var (
-	userCfgRepoOnce     sync.Once
-	userCfgRepoInstance *UserCfgRepo
+	userRepoOnce     sync.Once
+	userRepoInstance *UserRepository
 )
 
-type UserCfgRepo struct {
-	DB         *sqlx.DB
-	Lookup     *sqlx.Stmt
-	lock       sync.RWMutex
-	uiDefaults map[string]interface{}
-	cache      *lrucache.Cache
+type UserRepository struct {
+	DB     *sqlx.DB
+	driver string
 }
 
-func GetUserCfgRepo() *UserCfgRepo {
-	userCfgRepoOnce.Do(func() {
+func GetUserRepository() *UserRepository {
+	userRepoOnce.Do(func() {
 		db := GetConnection()
 
-		lookupConfigStmt, err := db.DB.Preparex(`SELECT confkey, value FROM configuration WHERE configuration.username = ?`)
-		if err != nil {
-			log.Fatalf("db.DB.Preparex() error: %v", err)
-		}
-
-		userCfgRepoInstance = &UserCfgRepo{
-			DB:         db.DB,
-			Lookup:     lookupConfigStmt,
-			uiDefaults: config.Keys.UiDefaults,
-			cache:      lrucache.New(1024),
+		userRepoInstance = &UserRepository{
+			DB:     db.DB,
+			driver: db.Driver,
 		}
 	})
-
-	return userCfgRepoInstance
+	return userRepoInstance
 }
 
-// Return the personalised UI config for the currently authenticated
-// user or return the plain default config.
-func (uCfg *UserCfgRepo) GetUIConfig(user *auth.User) (map[string]interface{}, error) {
-	if user == nil {
-		uCfg.lock.RLock()
-		copy := make(map[string]interface{}, len(uCfg.uiDefaults))
-		for k, v := range uCfg.uiDefaults {
-			copy[k] = v
-		}
-		uCfg.lock.RUnlock()
-		return copy, nil
-	}
-
-	data := uCfg.cache.Get(user.Username, func() (interface{}, time.Duration, int) {
-		uiconfig := make(map[string]interface{}, len(uCfg.uiDefaults))
-		for k, v := range uCfg.uiDefaults {
-			uiconfig[k] = v
-		}
-
-		rows, err := uCfg.Lookup.Query(user.Username)
-		if err != nil {
-			log.Warnf("Error while looking up user uiconfig for user '%v'", user.Username)
-			return err, 0, 0
-		}
-
-		size := 0
-		defer rows.Close()
-		for rows.Next() {
-			var key, rawval string
-			if err := rows.Scan(&key, &rawval); err != nil {
-				log.Warn("Error while scanning user uiconfig values")
-				return err, 0, 0
-			}
-
-			var val interface{}
-			if err := json.Unmarshal([]byte(rawval), &val); err != nil {
-				log.Warn("Error while unmarshaling raw user uiconfig json")
-				return err, 0, 0
-			}
-
-			size += len(key)
-			size += len(rawval)
-			uiconfig[key] = val
-		}
-
-		// Add global ShortRunningJobsDuration setting as plot_list_hideShortRunningJobs
-		uiconfig["plot_list_hideShortRunningJobs"] = config.Keys.ShortRunningJobsDuration
-
-		return uiconfig, 24 * time.Hour, size
-	})
-	if err, ok := data.(error); ok {
-		log.Error("Error in returned dataset")
+func (r *UserRepository) GetUser(username string) (*schema.User, error) {
+	user := &schema.User{Username: username}
+	var hashedPassword, name, rawRoles, email, rawProjects sql.NullString
+	if err := sq.Select("password", "ldap", "name", "roles", "email", "projects").From("user").
+		Where("user.username = ?", username).RunWith(r.DB).
+		QueryRow().Scan(&hashedPassword, &user.AuthSource, &name, &rawRoles, &email, &rawProjects); err != nil {
+		log.Warnf("Error while querying user '%v' from database", username)
 		return nil, err
 	}
 
-	return data.(map[string]interface{}), nil
-}
-
-// If the context does not have a user, update the global ui configuration
-// without persisting it!  If there is a (authenticated) user, update only his
-// configuration.
-func (uCfg *UserCfgRepo) UpdateConfig(
-	key, value string,
-	user *auth.User) error {
-
-	if user == nil {
-		var val interface{}
-		if err := json.Unmarshal([]byte(value), &val); err != nil {
-			log.Warn("Error while unmarshaling raw user config json")
-			return err
+	user.Password = hashedPassword.String
+	user.Name = name.String
+	user.Email = email.String
+	if rawRoles.Valid {
+		if err := json.Unmarshal([]byte(rawRoles.String), &user.Roles); err != nil {
+			log.Warn("Error while unmarshaling raw roles from DB")
+			return nil, err
+		}
+	}
+	if rawProjects.Valid {
+		if err := json.Unmarshal([]byte(rawProjects.String), &user.Projects); err != nil {
+			return nil, err
 		}
-
-		uCfg.lock.Lock()
-		defer uCfg.lock.Unlock()
-		uCfg.uiDefaults[key] = val
-		return nil
 	}
 
-	if _, err := uCfg.DB.Exec(`REPLACE INTO configuration (username, confkey, value) VALUES (?, ?, ?)`, user.Username, key, value); err != nil {
-		log.Warnf("Error while replacing user config in DB for user '%v'", user.Username)
+	return user, nil
+}
+
+func (r *UserRepository) AddUser(user *schema.User) error {
+	rolesJson, _ := json.Marshal(user.Roles)
+	projectsJson, _ := json.Marshal(user.Projects)
+
+	cols := []string{"username", "roles", "projects"}
+	vals := []interface{}{user.Username, string(rolesJson), string(projectsJson)}
+
+	if user.Name != "" {
+		cols = append(cols, "name")
+		vals = append(vals, user.Name)
+	}
+	if user.Email != "" {
+		cols = append(cols, "email")
+		vals = append(vals, user.Email)
+	}
+	if user.Password != "" {
+		password, err := bcrypt.GenerateFromPassword([]byte(user.Password), bcrypt.DefaultCost)
+		if err != nil {
+			log.Error("Error while encrypting new user password")
+			return err
+		}
+		cols = append(cols, "password")
+		vals = append(vals, string(password))
+	}
+
+	if _, err := sq.Insert("user").Columns(cols...).Values(vals...).RunWith(r.DB).Exec(); err != nil {
+		log.Errorf("Error while inserting new user '%v' into DB", user.Username)
 		return err
 	}
 
-	uCfg.cache.Del(user.Username)
+	log.Infof("new user %#v created (roles: %s, auth-source: %d, projects: %s)", user.Username, rolesJson, user.AuthSource, projectsJson)
 	return nil
 }
+
+func (r *UserRepository) DelUser(username string) error {
+
+	_, err := r.DB.Exec(`DELETE FROM user WHERE user.username = ?`, username)
+	log.Errorf("Error while deleting user '%s' from DB", username)
+	return err
+}
+
+func (r *UserRepository) ListUsers(specialsOnly bool) ([]*schema.User, error) {
+
+	q := sq.Select("username", "name", "email", "roles", "projects").From("user")
+	if specialsOnly {
+		q = q.Where("(roles != '[\"user\"]' AND roles != '[]')")
+	}
+
+	rows, err := q.RunWith(r.DB).Query()
+	if err != nil {
+		log.Warn("Error while querying user list")
+		return nil, err
+	}
+
+	users := make([]*schema.User, 0)
+	defer rows.Close()
+	for rows.Next() {
+		rawroles := ""
+		rawprojects := ""
+		user := &schema.User{}
+		var name, email sql.NullString
+		if err := rows.Scan(&user.Username, &name, &email, &rawroles, &rawprojects); err != nil {
+			log.Warn("Error while scanning user list")
+			return nil, err
+		}
+
+		if err := json.Unmarshal([]byte(rawroles), &user.Roles); err != nil {
+			log.Warn("Error while unmarshaling raw role list")
+			return nil, err
+		}
+
+		if err := json.Unmarshal([]byte(rawprojects), &user.Projects); err != nil {
+			return nil, err
+		}
+
+		user.Name = name.String
+		user.Email = email.String
+		users = append(users, user)
+	}
+	return users, nil
+}
+
+func (r *UserRepository) AddRole(
+	ctx context.Context,
+	username string,
+	queryrole string) error {
+
+	newRole := strings.ToLower(queryrole)
+	user, err := r.GetUser(username)
+	if err != nil {
+		log.Warnf("Could not load user '%s'", username)
+		return err
+	}
+
+	exists, valid := user.HasValidRole(newRole)
+
+	if !valid {
+		return fmt.Errorf("Supplied role is no valid option : %v", newRole)
+	}
+	if exists {
+		return fmt.Errorf("User %v already has role %v", username, newRole)
+	}
+
+	roles, _ := json.Marshal(append(user.Roles, newRole))
+	if _, err := sq.Update("user").Set("roles", roles).Where("user.username = ?", username).RunWith(r.DB).Exec(); err != nil {
+		log.Errorf("Error while adding new role for user '%s'", user.Username)
+		return err
+	}
+	return nil
+}
+
+func (r *UserRepository) RemoveRole(ctx context.Context, username string, queryrole string) error {
+	oldRole := strings.ToLower(queryrole)
+	user, err := r.GetUser(username)
+	if err != nil {
+		log.Warnf("Could not load user '%s'", username)
+		return err
+	}
+
+	exists, valid := user.HasValidRole(oldRole)
+
+	if !valid {
+		return fmt.Errorf("Supplied role is no valid option : %v", oldRole)
+	}
+	if !exists {
+		return fmt.Errorf("Role already deleted for user '%v': %v", username, oldRole)
+	}
+
+	if oldRole == schema.GetRoleString(schema.RoleManager) && len(user.Projects) != 0 {
+		return fmt.Errorf("Cannot remove role 'manager' while user %s still has assigned project(s) : %v", username, user.Projects)
+	}
+
+	var newroles []string
+	for _, r := range user.Roles {
+		if r != oldRole {
+			newroles = append(newroles, r) // Append all roles not matching requested to be deleted role
+		}
+	}
+
+	var mroles, _ = json.Marshal(newroles)
+	if _, err := sq.Update("user").Set("roles", mroles).Where("user.username = ?", username).RunWith(r.DB).Exec(); err != nil {
+		log.Errorf("Error while removing role for user '%s'", user.Username)
+		return err
+	}
+	return nil
+}
+
+func (r *UserRepository) AddProject(
+	ctx context.Context,
+	username string,
+	project string) error {
+
+	user, err := r.GetUser(username)
+	if err != nil {
+		return err
+	}
+
+	if !user.HasRole(schema.RoleManager) {
+		return fmt.Errorf("user '%s' is not a manager!", username)
+	}
+
+	if user.HasProject(project) {
+		return fmt.Errorf("user '%s' already manages project '%s'", username, project)
+	}
+
+	projects, _ := json.Marshal(append(user.Projects, project))
+	if _, err := sq.Update("user").Set("projects", projects).Where("user.username = ?", username).RunWith(r.DB).Exec(); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (r *UserRepository) RemoveProject(ctx context.Context, username string, project string) error {
+	user, err := r.GetUser(username)
+	if err != nil {
+		return err
+	}
+
+	if !user.HasRole(schema.RoleManager) {
+		return fmt.Errorf("user '%#v' is not a manager!", username)
+	}
+
+	if !user.HasProject(project) {
+		return fmt.Errorf("user '%#v': Cannot remove project '%#v' - Does not match!", username, project)
+	}
+
+	var exists bool
+	var newprojects []string
+	for _, p := range user.Projects {
+		if p != project {
+			newprojects = append(newprojects, p) // Append all projects not matching requested to be deleted project
+		} else {
+			exists = true
+		}
+	}
+
+	if exists == true {
+		var result interface{}
+		if len(newprojects) == 0 {
+			result = "[]"
+		} else {
+			result, _ = json.Marshal(newprojects)
+		}
+		if _, err := sq.Update("user").Set("projects", result).Where("user.username = ?", username).RunWith(r.DB).Exec(); err != nil {
+			return err
+		}
+		return nil
+	} else {
+		return fmt.Errorf("user %s already does not manage project %s", username, project)
+	}
+}
+
+type ContextKey string
+
+const ContextUserKey ContextKey = "user"
+
+func GetUserFromContext(ctx context.Context) *schema.User {
+	x := ctx.Value(ContextUserKey)
+	if x == nil {
+		return nil
+	}
+
+	return x.(*schema.User)
+}
+
+func (r *UserRepository) FetchUserInCtx(ctx context.Context, username string) (*model.User, error) {
+	me := GetUserFromContext(ctx)
+	if me != nil && me.Username != username &&
+		me.HasNotRoles([]schema.Role{schema.RoleAdmin, schema.RoleSupport, schema.RoleManager}) {
+		return nil, errors.New("forbidden")
+	}
+
+	user := &model.User{Username: username}
+	var name, email sql.NullString
+	if err := sq.Select("name", "email").From("user").Where("user.username = ?", username).
+		RunWith(r.DB).QueryRow().Scan(&name, &email); err != nil {
+		if err == sql.ErrNoRows {
+			/* This warning will be logged *often* for non-local users, i.e. users mentioned only in job-table or archive, */
+			/* since FetchUser will be called to retrieve full name and mail for every job in query/list									 */
+			// log.Warnf("User '%s' Not found in DB", username)
+			return nil, nil
+		}
+
+		log.Warnf("Error while fetching user '%s'", username)
+		return nil, err
+	}
+
+	user.Name = name.String
+	user.Email = email.String
+	return user, nil
+}
diff --git a/internal/repository/userConfig.go b/internal/repository/userConfig.go
new file mode 100644
index 0000000..fb8c3f5
--- /dev/null
+++ b/internal/repository/userConfig.go
@@ -0,0 +1,137 @@
+// Copyright (C) 2022 NHR@FAU, University Erlangen-Nuremberg.
+// All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+package repository
+
+import (
+	"encoding/json"
+	"sync"
+	"time"
+
+	"github.com/ClusterCockpit/cc-backend/internal/config"
+	"github.com/ClusterCockpit/cc-backend/pkg/log"
+	"github.com/ClusterCockpit/cc-backend/pkg/lrucache"
+	"github.com/ClusterCockpit/cc-backend/pkg/schema"
+	"github.com/jmoiron/sqlx"
+)
+
+var (
+	userCfgRepoOnce     sync.Once
+	userCfgRepoInstance *UserCfgRepo
+)
+
+type UserCfgRepo struct {
+	DB         *sqlx.DB
+	Lookup     *sqlx.Stmt
+	lock       sync.RWMutex
+	uiDefaults map[string]interface{}
+	cache      *lrucache.Cache
+}
+
+func GetUserCfgRepo() *UserCfgRepo {
+	userCfgRepoOnce.Do(func() {
+		db := GetConnection()
+
+		lookupConfigStmt, err := db.DB.Preparex(`SELECT confkey, value FROM configuration WHERE configuration.username = ?`)
+		if err != nil {
+			log.Fatalf("db.DB.Preparex() error: %v", err)
+		}
+
+		userCfgRepoInstance = &UserCfgRepo{
+			DB:         db.DB,
+			Lookup:     lookupConfigStmt,
+			uiDefaults: config.Keys.UiDefaults,
+			cache:      lrucache.New(1024),
+		}
+	})
+
+	return userCfgRepoInstance
+}
+
+// Return the personalised UI config for the currently authenticated
+// user or return the plain default config.
+func (uCfg *UserCfgRepo) GetUIConfig(user *schema.User) (map[string]interface{}, error) {
+	if user == nil {
+		uCfg.lock.RLock()
+		copy := make(map[string]interface{}, len(uCfg.uiDefaults))
+		for k, v := range uCfg.uiDefaults {
+			copy[k] = v
+		}
+		uCfg.lock.RUnlock()
+		return copy, nil
+	}
+
+	data := uCfg.cache.Get(user.Username, func() (interface{}, time.Duration, int) {
+		uiconfig := make(map[string]interface{}, len(uCfg.uiDefaults))
+		for k, v := range uCfg.uiDefaults {
+			uiconfig[k] = v
+		}
+
+		rows, err := uCfg.Lookup.Query(user.Username)
+		if err != nil {
+			log.Warnf("Error while looking up user uiconfig for user '%v'", user.Username)
+			return err, 0, 0
+		}
+
+		size := 0
+		defer rows.Close()
+		for rows.Next() {
+			var key, rawval string
+			if err := rows.Scan(&key, &rawval); err != nil {
+				log.Warn("Error while scanning user uiconfig values")
+				return err, 0, 0
+			}
+
+			var val interface{}
+			if err := json.Unmarshal([]byte(rawval), &val); err != nil {
+				log.Warn("Error while unmarshaling raw user uiconfig json")
+				return err, 0, 0
+			}
+
+			size += len(key)
+			size += len(rawval)
+			uiconfig[key] = val
+		}
+
+		// Add global ShortRunningJobsDuration setting as plot_list_hideShortRunningJobs
+		uiconfig["plot_list_hideShortRunningJobs"] = config.Keys.ShortRunningJobsDuration
+
+		return uiconfig, 24 * time.Hour, size
+	})
+	if err, ok := data.(error); ok {
+		log.Error("Error in returned dataset")
+		return nil, err
+	}
+
+	return data.(map[string]interface{}), nil
+}
+
+// If the context does not have a user, update the global ui configuration
+// without persisting it!  If there is a (authenticated) user, update only his
+// configuration.
+func (uCfg *UserCfgRepo) UpdateConfig(
+	key, value string,
+	user *schema.User) error {
+
+	if user == nil {
+		var val interface{}
+		if err := json.Unmarshal([]byte(value), &val); err != nil {
+			log.Warn("Error while unmarshaling raw user config json")
+			return err
+		}
+
+		uCfg.lock.Lock()
+		defer uCfg.lock.Unlock()
+		uCfg.uiDefaults[key] = val
+		return nil
+	}
+
+	if _, err := uCfg.DB.Exec(`REPLACE INTO configuration (username, confkey, value) VALUES (?, ?, ?)`, user.Username, key, value); err != nil {
+		log.Warnf("Error while replacing user config in DB for user '%v'", user.Username)
+		return err
+	}
+
+	uCfg.cache.Del(user.Username)
+	return nil
+}
diff --git a/internal/repository/user_test.go b/internal/repository/userConfig_test.go
similarity index 94%
rename from internal/repository/user_test.go
rename to internal/repository/userConfig_test.go
index ac3b0d5..0beec7b 100644
--- a/internal/repository/user_test.go
+++ b/internal/repository/userConfig_test.go
@@ -9,9 +9,9 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/ClusterCockpit/cc-backend/internal/auth"
 	"github.com/ClusterCockpit/cc-backend/internal/config"
 	"github.com/ClusterCockpit/cc-backend/pkg/log"
+	"github.com/ClusterCockpit/cc-backend/pkg/schema"
 	_ "github.com/mattn/go-sqlite3"
 )
 
@@ -53,7 +53,7 @@ func setupUserTest(t *testing.T) *UserCfgRepo {
 
 func TestGetUIConfig(t *testing.T) {
 	r := setupUserTest(t)
-	u := auth.User{Username: "demo"}
+	u := schema.User{Username: "demo"}
 
 	cfg, err := r.GetUIConfig(&u)
 	if err != nil {
diff --git a/internal/routerConfig/routes.go b/internal/routerConfig/routes.go
index 5fad301..322cbf3 100644
--- a/internal/routerConfig/routes.go
+++ b/internal/routerConfig/routes.go
@@ -13,11 +13,11 @@ import (
 	"strings"
 	"time"
 
-	"github.com/ClusterCockpit/cc-backend/internal/auth"
 	"github.com/ClusterCockpit/cc-backend/internal/graph/model"
 	"github.com/ClusterCockpit/cc-backend/internal/repository"
 	"github.com/ClusterCockpit/cc-backend/internal/util"
 	"github.com/ClusterCockpit/cc-backend/pkg/log"
+	"github.com/ClusterCockpit/cc-backend/pkg/schema"
 	"github.com/ClusterCockpit/cc-backend/web"
 	"github.com/gorilla/mux"
 )
@@ -81,12 +81,11 @@ func setupJobRoute(i InfoType, r *http.Request) InfoType {
 }
 
 func setupUserRoute(i InfoType, r *http.Request) InfoType {
-	jobRepo := repository.GetJobRepository()
 	username := mux.Vars(r)["id"]
 	i["id"] = username
 	i["username"] = username
 	// TODO: If forbidden (== err exists), redirect to error page
-	if user, _ := auth.FetchUser(r.Context(), jobRepo.DB, username); user != nil {
+	if user, _ := repository.GetUserRepository().FetchUserInCtx(r.Context(), username); user != nil {
 		i["name"] = user.Name
 		i["email"] = user.Email
 	}
@@ -125,7 +124,7 @@ func setupAnalysisRoute(i InfoType, r *http.Request) InfoType {
 
 func setupTaglistRoute(i InfoType, r *http.Request) InfoType {
 	jobRepo := repository.GetJobRepository()
-	user := auth.GetUser(r.Context())
+	user := repository.GetUserFromContext(r.Context())
 
 	tags, counts, err := jobRepo.CountTags(user)
 	tagMap := make(map[string][]map[string]interface{})
@@ -255,7 +254,7 @@ func SetupRoutes(router *mux.Router, buildInfo web.Build) {
 	for _, route := range routes {
 		route := route
 		router.HandleFunc(route.Route, func(rw http.ResponseWriter, r *http.Request) {
-			conf, err := userCfgRepo.GetUIConfig(auth.GetUser(r.Context()))
+			conf, err := userCfgRepo.GetUIConfig(repository.GetUserFromContext(r.Context()))
 			if err != nil {
 				http.Error(rw, err.Error(), http.StatusInternalServerError)
 				return
@@ -268,9 +267,9 @@ func SetupRoutes(router *mux.Router, buildInfo web.Build) {
 			}
 
 			// Get User -> What if NIL?
-			user := auth.GetUser(r.Context())
+			user := repository.GetUserFromContext(r.Context())
 			// Get Roles
-			availableRoles, _ := auth.GetValidRolesMap(user)
+			availableRoles, _ := schema.GetValidRolesMap(user)
 
 			page := web.Page{
 				Title:  title,
@@ -285,14 +284,14 @@ func SetupRoutes(router *mux.Router, buildInfo web.Build) {
 				page.FilterPresets = buildFilterPresets(r.URL.Query())
 			}
 
-			web.RenderTemplate(rw, r, route.Template, &page)
+			web.RenderTemplate(rw, route.Template, &page)
 		})
 	}
 }
 
 func HandleSearchBar(rw http.ResponseWriter, r *http.Request, buildInfo web.Build) {
-	user := auth.GetUser(r.Context())
-	availableRoles, _ := auth.GetValidRolesMap(user)
+	user := repository.GetUserFromContext(r.Context())
+	availableRoles, _ := schema.GetValidRolesMap(user)
 
 	if search := r.URL.Query().Get("searchId"); search != "" {
 		repo := repository.GetJobRepository()
@@ -309,10 +308,10 @@ func HandleSearchBar(rw http.ResponseWriter, r *http.Request, buildInfo web.Buil
 			case "arrayJobId":
 				http.Redirect(rw, r, "/monitoring/jobs/?arrayJobId="+url.QueryEscape(strings.Trim(splitSearch[1], " ")), http.StatusFound) // All Users: Redirect to Tablequery
 			case "username":
-				if user.HasAnyRole([]auth.Role{auth.RoleAdmin, auth.RoleSupport, auth.RoleManager}) {
+				if user.HasAnyRole([]schema.Role{schema.RoleAdmin, schema.RoleSupport, schema.RoleManager}) {
 					http.Redirect(rw, r, "/monitoring/users/?user="+url.QueryEscape(strings.Trim(splitSearch[1], " ")), http.StatusFound)
 				} else {
-					web.RenderTemplate(rw, r, "message.tmpl", &web.Page{Title: "Error", MsgType: "alert-danger", Message: "Missing Access Rights", User: *user, Roles: availableRoles, Build: buildInfo})
+					web.RenderTemplate(rw, "message.tmpl", &web.Page{Title: "Error", MsgType: "alert-danger", Message: "Missing Access Rights", User: *user, Roles: availableRoles, Build: buildInfo})
 				}
 			case "name":
 				usernames, _ := repo.FindColumnValues(user, strings.Trim(splitSearch[1], " "), "user", "username", "name")
@@ -320,14 +319,14 @@ func HandleSearchBar(rw http.ResponseWriter, r *http.Request, buildInfo web.Buil
 					joinedNames := strings.Join(usernames, "&user=")
 					http.Redirect(rw, r, "/monitoring/users/?user="+joinedNames, http.StatusFound)
 				} else {
-					if user.HasAnyRole([]auth.Role{auth.RoleAdmin, auth.RoleSupport, auth.RoleManager}) {
+					if user.HasAnyRole([]schema.Role{schema.RoleAdmin, schema.RoleSupport, schema.RoleManager}) {
 						http.Redirect(rw, r, "/monitoring/users/?user=NoUserNameFound", http.StatusPermanentRedirect)
 					} else {
-						web.RenderTemplate(rw, r, "message.tmpl", &web.Page{Title: "Error", MsgType: "alert-danger", Message: "Missing Access Rights", User: *user, Roles: availableRoles, Build: buildInfo})
+						web.RenderTemplate(rw, "message.tmpl", &web.Page{Title: "Error", MsgType: "alert-danger", Message: "Missing Access Rights", User: *user, Roles: availableRoles, Build: buildInfo})
 					}
 				}
 			default:
-				web.RenderTemplate(rw, r, "message.tmpl", &web.Page{Title: "Warning", MsgType: "alert-warning", Message: fmt.Sprintf("Unknown search type: %s", strings.Trim(splitSearch[0], " ")), User: *user, Roles: availableRoles, Build: buildInfo})
+				web.RenderTemplate(rw, "message.tmpl", &web.Page{Title: "Warning", MsgType: "alert-warning", Message: fmt.Sprintf("Unknown search type: %s", strings.Trim(splitSearch[0], " ")), User: *user, Roles: availableRoles, Build: buildInfo})
 			}
 		} else if len(splitSearch) == 1 {
 
@@ -342,13 +341,13 @@ func HandleSearchBar(rw http.ResponseWriter, r *http.Request, buildInfo web.Buil
 			} else if jobname != "" {
 				http.Redirect(rw, r, "/monitoring/jobs/?jobName="+url.QueryEscape(jobname), http.StatusFound) // JobName (contains)
 			} else {
-				web.RenderTemplate(rw, r, "message.tmpl", &web.Page{Title: "Info", MsgType: "alert-info", Message: "Search without result", User: *user, Roles: availableRoles, Build: buildInfo})
+				web.RenderTemplate(rw, "message.tmpl", &web.Page{Title: "Info", MsgType: "alert-info", Message: "Search without result", User: *user, Roles: availableRoles, Build: buildInfo})
 			}
 
 		} else {
-			web.RenderTemplate(rw, r, "message.tmpl", &web.Page{Title: "Error", MsgType: "alert-danger", Message: "Searchbar query parameters malformed", User: *user, Roles: availableRoles, Build: buildInfo})
+			web.RenderTemplate(rw, "message.tmpl", &web.Page{Title: "Error", MsgType: "alert-danger", Message: "Searchbar query parameters malformed", User: *user, Roles: availableRoles, Build: buildInfo})
 		}
 	} else {
-		web.RenderTemplate(rw, r, "message.tmpl", &web.Page{Title: "Warning", MsgType: "alert-warning", Message: "Empty search", User: *user, Roles: availableRoles, Build: buildInfo})
+		web.RenderTemplate(rw, "message.tmpl", &web.Page{Title: "Warning", MsgType: "alert-warning", Message: "Empty search", User: *user, Roles: availableRoles, Build: buildInfo})
 	}
 }
diff --git a/pkg/schema/config.go b/pkg/schema/config.go
index 95cc641..efcd6f9 100644
--- a/pkg/schema/config.go
+++ b/pkg/schema/config.go
@@ -17,7 +17,9 @@ type LdapConfig struct {
 	UserFilter      string `json:"user_filter"`
 	SyncInterval    string `json:"sync_interval"` // Parsed using time.ParseDuration.
 	SyncDelOldUsers bool   `json:"sync_del_old_users"`
-	SyncUserOnLogin bool   `json:"syncUserOnLogin"`
+
+	// Should an non-existent user be added to the DB if user exists in ldap directory
+	SyncUserOnLogin bool `json:"syncUserOnLogin"`
 }
 
 type JWTAuthConfig struct {
@@ -30,10 +32,13 @@ type JWTAuthConfig struct {
 
 	// Deny login for users not in database (but defined in JWT).
 	// Ignore user roles defined in JWTs ('roles' claim), get them from db.
-	ForceJWTValidationViaDatabase bool `json:"forceJWTValidationViaDatabase"`
+	ValidateUser bool `json:"validateUser"`
 
 	// Specifies which issuer should be accepted when validating external JWTs ('iss' claim)
-	TrustedExternalIssuer string `json:"trustedExternalIssuer"`
+	TrustedIssuer string `json:"trustedIssuer"`
+
+	// Should an non-existent user be added to the DB based on the information in the token
+	SyncUserOnLogin bool `json:"syncUserOnLogin"`
 }
 
 type IntRange struct {
diff --git a/internal/auth/roles.go b/pkg/schema/user.go
similarity index 82%
rename from internal/auth/roles.go
rename to pkg/schema/user.go
index e352df1..1547d3f 100644
--- a/internal/auth/roles.go
+++ b/pkg/schema/user.go
@@ -2,7 +2,7 @@
 // All rights reserved.
 // Use of this source code is governed by a MIT-style
 // license that can be found in the LICENSE file.
-package auth
+package schema
 
 import (
 	"fmt"
@@ -21,6 +21,41 @@ const (
 	RoleError
 )
 
+type AuthSource int
+
+const (
+	AuthViaLocalPassword AuthSource = iota
+	AuthViaLDAP
+	AuthViaToken
+)
+
+type AuthType int
+
+const (
+	AuthToken AuthType = iota
+	AuthSession
+)
+
+type User struct {
+	Username   string     `json:"username"`
+	Password   string     `json:"-"`
+	Name       string     `json:"name"`
+	Roles      []string   `json:"roles"`
+	AuthType   AuthType   `json:"authType"`
+	AuthSource AuthSource `json:"authSource"`
+	Email      string     `json:"email"`
+	Projects   []string   `json:"projects"`
+}
+
+func (u *User) HasProject(project string) bool {
+	for _, p := range u.Projects {
+		if p == project {
+			return true
+		}
+	}
+	return false
+}
+
 func GetRoleString(roleInt Role) string {
 	return [6]string{"anonymous", "api", "user", "manager", "support", "admin"}[roleInt]
 }
@@ -44,12 +79,12 @@ func getRoleEnum(roleStr string) Role {
 	}
 }
 
-func isValidRole(role string) bool {
+func IsValidRole(role string) bool {
 	return getRoleEnum(role) != RoleError
 }
 
 func (u *User) HasValidRole(role string) (hasRole bool, isValid bool) {
-	if isValidRole(role) {
+	if IsValidRole(role) {
 		for _, r := range u.Roles {
 			if r == role {
 				return true, true
diff --git a/internal/auth/auth_test.go b/pkg/schema/user_test.go
similarity index 99%
rename from internal/auth/auth_test.go
rename to pkg/schema/user_test.go
index 81aa4eb..cd054c3 100644
--- a/internal/auth/auth_test.go
+++ b/pkg/schema/user_test.go
@@ -2,7 +2,7 @@
 // All rights reserved.
 // Use of this source code is governed by a MIT-style
 // license that can be found in the LICENSE file.
-package auth
+package schema
 
 import (
 	"testing"
diff --git a/web/web.go b/web/web.go
index c94c2b1..8d4ce4b 100644
--- a/web/web.go
+++ b/web/web.go
@@ -11,7 +11,6 @@ import (
 	"net/http"
 	"strings"
 
-	"github.com/ClusterCockpit/cc-backend/internal/auth"
 	"github.com/ClusterCockpit/cc-backend/internal/config"
 	"github.com/ClusterCockpit/cc-backend/internal/util"
 	"github.com/ClusterCockpit/cc-backend/pkg/log"
@@ -92,8 +91,8 @@ type Page struct {
 	Title         string                 // Page title
 	MsgType       string                 // For generic use in message boxes
 	Message       string                 // For generic use in message boxes
-	User          auth.User              // Information about the currently logged in user (Full User Info)
-	Roles         map[string]auth.Role   // Available roles for frontend render checks
+	User          schema.User            // Information about the currently logged in user (Full User Info)
+	Roles         map[string]schema.Role // Available roles for frontend render checks
 	Build         Build                  // Latest information about the application
 	Clusters      []schema.ClusterConfig // List of all clusters for use in the Header
 	FilterPresets map[string]interface{} // For pages with the Filter component, this can be used to set initial filters.
@@ -101,7 +100,7 @@ type Page struct {
 	Config        map[string]interface{} // UI settings for the currently logged in user (e.g. line width, ...)
 }
 
-func RenderTemplate(rw http.ResponseWriter, r *http.Request, file string, page *Page) {
+func RenderTemplate(rw http.ResponseWriter, file string, page *Page) {
 	t, ok := templates[file]
 	if !ok {
 		log.Errorf("WEB/WEB > template '%s' not found", file)

From c7a04328d9c91151fb3a9b55a36c99c4f55a8bb7 Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan@moebiusband.org>
Date: Thu, 17 Aug 2023 10:35:16 +0200
Subject: [PATCH 45/62] Fix schema and tests

---
 configs/config.json                   | 4 ++--
 pkg/schema/schemas/config.schema.json | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/configs/config.json b/configs/config.json
index 1cc2550..6c4d4bd 100644
--- a/configs/config.json
+++ b/configs/config.json
@@ -42,9 +42,9 @@
     ],
     "jwts": {
         "cookieName": "",
-        "forceJWTValidationViaDatabase": false,
+        "validateUser": false,
         "max-age": 0,
-        "trustedExternalIssuer": ""
+        "trustedIssuer": ""
     },
     "short-running-jobs-duration": 300
 }
diff --git a/pkg/schema/schemas/config.schema.json b/pkg/schema/schemas/config.schema.json
index 6518281..7505c1c 100644
--- a/pkg/schema/schemas/config.schema.json
+++ b/pkg/schema/schemas/config.schema.json
@@ -107,10 +107,6 @@
             "description": "Specifies for how long a session shall be valid  as a string parsable by time.ParseDuration(). If 0 or empty, the session/token does not expire!",
             "type": "string"
         },
-        "jwt-max-age": {
-            "description": "Specifies for how long a JWT token shall be valid  as a string parsable by time.ParseDuration(). If 0 or empty, the session/token does not expire!",
-            "type": "string"
-        },
         "https-cert-file": {
             "description": "Filepath to SSL certificate. If also https-key-file is set use HTTPS using those certificates.",
             "type": "string"
@@ -166,6 +162,10 @@
                 "sync_del_old_users": {
                     "description": "Delete obsolete users in database.",
                     "type": "boolean"
+                },
+                "syncUserOnLogin": {
+                    "description": "Add non-existent user to DB at login attempt if user exists in Ldap directory",
+                    "type": "boolean"
                 }
             },
             "required": [

From 15231bc68358719deb48b4583999744ea38dc92d Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan@moebiusband.org>
Date: Thu, 17 Aug 2023 12:34:30 +0200
Subject: [PATCH 46/62] Cleanup and adapt to new structure

---
 cmd/cc-backend/main.go            |  2 +-
 internal/auth/auth.go             | 33 ++++------------
 internal/auth/jwt.go              |  2 +-
 internal/auth/jwtCookieSession.go |  6 +--
 internal/auth/jwtSession.go       | 11 +++++-
 internal/auth/ldap.go             | 66 +++++++++++++++++++------------
 internal/auth/local.go            |  2 -
 internal/repository/user.go       | 26 ++++++++++++
 pkg/schema/user.go                |  1 +
 9 files changed, 89 insertions(+), 60 deletions(-)

diff --git a/cmd/cc-backend/main.go b/cmd/cc-backend/main.go
index 60c5edd..dd00046 100644
--- a/cmd/cc-backend/main.go
+++ b/cmd/cc-backend/main.go
@@ -211,7 +211,7 @@ func main() {
 	var authentication *auth.Authentication
 	if !config.Keys.DisableAuthentication {
 		var err error
-		if authentication, err = auth.Init(db.DB, map[string]interface{}{
+		if authentication, err = auth.Init(map[string]interface{}{
 			"ldap": config.Keys.LdapConfig,
 			"jwt":  config.Keys.JwtConfig,
 		}); err != nil {
diff --git a/internal/auth/auth.go b/internal/auth/auth.go
index d79f28b..cc2bcb4 100644
--- a/internal/auth/auth.go
+++ b/internal/auth/auth.go
@@ -18,17 +18,15 @@ import (
 	"github.com/ClusterCockpit/cc-backend/pkg/log"
 	"github.com/ClusterCockpit/cc-backend/pkg/schema"
 	"github.com/gorilla/sessions"
-	"github.com/jmoiron/sqlx"
 )
 
 type Authenticator interface {
-	Init(auth *Authentication, config interface{}) error
+	Init(config interface{}) error
 	CanLogin(user *schema.User, username string, rw http.ResponseWriter, r *http.Request) bool
 	Login(user *schema.User, rw http.ResponseWriter, r *http.Request) (*schema.User, error)
 }
 
 type Authentication struct {
-	db            *sqlx.DB
 	sessionStore  *sessions.CookieStore
 	SessionMaxAge time.Duration
 
@@ -82,10 +80,8 @@ func (auth *Authentication) AuthViaSession(
 	}, nil
 }
 
-func Init(db *sqlx.DB,
-	configs map[string]interface{}) (*Authentication, error) {
+func Init(configs map[string]interface{}) (*Authentication, error) {
 	auth := &Authentication{}
-	auth.db = db
 
 	sessKey := os.Getenv("SESSION_KEY")
 	if sessKey == "" {
@@ -106,14 +102,14 @@ func Init(db *sqlx.DB,
 	}
 
 	auth.JwtAuth = &JWTAuthenticator{}
-	if err := auth.JwtAuth.Init(auth, configs["jwt"]); err != nil {
+	if err := auth.JwtAuth.Init(configs["jwt"]); err != nil {
 		log.Error("Error while initializing authentication -> jwtAuth init failed")
 		return nil, err
 	}
 
 	if config, ok := configs["ldap"]; ok {
 		ldapAuth := &LdapAuthenticator{}
-		if err := ldapAuth.Init(auth, config); err != nil {
+		if err := ldapAuth.Init(config); err != nil {
 			log.Warn("Error while initializing authentication -> ldapAuth init failed")
 		} else {
 			auth.LdapAuth = ldapAuth
@@ -122,21 +118,21 @@ func Init(db *sqlx.DB,
 	}
 
 	jwtSessionAuth := &JWTSessionAuthenticator{}
-	if err := jwtSessionAuth.Init(auth, configs["jwt"]); err != nil {
+	if err := jwtSessionAuth.Init(configs["jwt"]); err != nil {
 		log.Warn("Error while initializing authentication -> jwtSessionAuth init failed")
 	} else {
 		auth.authenticators = append(auth.authenticators, jwtSessionAuth)
 	}
 
 	jwtCookieSessionAuth := &JWTCookieSessionAuthenticator{}
-	if err := jwtCookieSessionAuth.Init(auth, configs["jwt"]); err != nil {
+	if err := jwtCookieSessionAuth.Init(configs["jwt"]); err != nil {
 		log.Warn("Error while initializing authentication -> jwtCookieSessionAuth init failed")
 	} else {
 		auth.authenticators = append(auth.authenticators, jwtCookieSessionAuth)
 	}
 
 	auth.LocalAuth = &LocalAuthenticator{}
-	if err := auth.LocalAuth.Init(auth, nil); err != nil {
+	if err := auth.LocalAuth.Init(nil); err != nil {
 		log.Error("Error while initializing authentication -> localAuth init failed")
 		return nil, err
 	}
@@ -150,13 +146,12 @@ func (auth *Authentication) Login(
 	onfailure func(rw http.ResponseWriter, r *http.Request, loginErr error)) http.Handler {
 
 	return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
-		ur := repository.GetUserRepository()
 		err := errors.New("no authenticator applied")
 		username := r.FormValue("username")
 		dbUser := (*schema.User)(nil)
 
 		if username != "" {
-			dbUser, err = ur.GetUser(username)
+			dbUser, err = repository.GetUserRepository().GetUser(username)
 			if err != nil && err != sql.ErrNoRows {
 				log.Errorf("Error while loading user '%v'", username)
 			}
@@ -166,10 +161,6 @@ func (auth *Authentication) Login(
 			if !authenticator.CanLogin(dbUser, username, rw, r) {
 				continue
 			}
-			dbUser, err = ur.GetUser(username)
-			if err != nil && err != sql.ErrNoRows {
-				log.Errorf("Error while loading user '%v'", username)
-			}
 
 			user, err := authenticator.Login(dbUser, rw, r)
 			if err != nil {
@@ -197,14 +188,6 @@ func (auth *Authentication) Login(
 				return
 			}
 
-			if dbUser == nil {
-				if err := ur.AddUser(user); err != nil {
-					// TODO Add AuthSource
-					log.Errorf("Error while adding user '%v' to auth from XX",
-						user.Username)
-				}
-			}
-
 			log.Infof("login successfull: user: %#v (roles: %v, projects: %v)", user.Username, user.Roles, user.Projects)
 			ctx := context.WithValue(r.Context(), repository.ContextUserKey, user)
 			onsuccess.ServeHTTP(rw, r.WithContext(ctx))
diff --git a/internal/auth/jwt.go b/internal/auth/jwt.go
index 0690b9b..9c0166d 100644
--- a/internal/auth/jwt.go
+++ b/internal/auth/jwt.go
@@ -25,7 +25,7 @@ type JWTAuthenticator struct {
 	config     *schema.JWTAuthConfig
 }
 
-func (ja *JWTAuthenticator) Init(auth *Authentication, conf interface{}) error {
+func (ja *JWTAuthenticator) Init(conf interface{}) error {
 	ja.config = conf.(*schema.JWTAuthConfig)
 
 	pubKey, privKey := os.Getenv("JWT_PUBLIC_KEY"), os.Getenv("JWT_PRIVATE_KEY")
diff --git a/internal/auth/jwtCookieSession.go b/internal/auth/jwtCookieSession.go
index 4787107..ad0b033 100644
--- a/internal/auth/jwtCookieSession.go
+++ b/internal/auth/jwtCookieSession.go
@@ -17,8 +17,6 @@ import (
 )
 
 type JWTCookieSessionAuthenticator struct {
-	auth *Authentication
-
 	publicKey           ed25519.PublicKey
 	privateKey          ed25519.PrivateKey
 	publicKeyCrossLogin ed25519.PublicKey // For accepting externally generated JWTs
@@ -28,9 +26,7 @@ type JWTCookieSessionAuthenticator struct {
 
 var _ Authenticator = (*JWTCookieSessionAuthenticator)(nil)
 
-func (ja *JWTCookieSessionAuthenticator) Init(auth *Authentication, conf interface{}) error {
-
-	ja.auth = auth
+func (ja *JWTCookieSessionAuthenticator) Init(conf interface{}) error {
 	ja.config = conf.(*schema.JWTAuthConfig)
 
 	pubKey, privKey := os.Getenv("JWT_PUBLIC_KEY"), os.Getenv("JWT_PRIVATE_KEY")
diff --git a/internal/auth/jwtSession.go b/internal/auth/jwtSession.go
index 59250ac..5a29360 100644
--- a/internal/auth/jwtSession.go
+++ b/internal/auth/jwtSession.go
@@ -11,6 +11,7 @@ import (
 	"os"
 	"strings"
 
+	"github.com/ClusterCockpit/cc-backend/internal/repository"
 	"github.com/ClusterCockpit/cc-backend/pkg/log"
 	"github.com/ClusterCockpit/cc-backend/pkg/schema"
 	"github.com/golang-jwt/jwt/v4"
@@ -18,11 +19,15 @@ import (
 
 type JWTSessionAuthenticator struct {
 	loginTokenKey []byte // HS256 key
+
+	config *schema.JWTAuthConfig
 }
 
 var _ Authenticator = (*JWTSessionAuthenticator)(nil)
 
-func (ja *JWTSessionAuthenticator) Init(auth *Authentication, conf interface{}) error {
+func (ja *JWTSessionAuthenticator) Init(conf interface{}) error {
+	ja.config = conf.(*schema.JWTAuthConfig)
+
 	if pubKey := os.Getenv("CROSS_LOGIN_JWT_HS512_KEY"); pubKey != "" {
 		bytes, err := base64.StdEncoding.DecodeString(pubKey)
 		if err != nil {
@@ -124,6 +129,10 @@ func (ja *JWTSessionAuthenticator) Login(
 			AuthType:   schema.AuthSession,
 			AuthSource: schema.AuthViaToken,
 		}
+
+		if err := repository.GetUserRepository().AddUser(user); err != nil {
+			log.Errorf("Error while adding user '%s' to DB", user.Username)
+		}
 	}
 
 	return user, nil
diff --git a/internal/auth/ldap.go b/internal/auth/ldap.go
index 925e967..c3bde4a 100644
--- a/internal/auth/ldap.go
+++ b/internal/auth/ldap.go
@@ -12,24 +12,21 @@ import (
 	"strings"
 	"time"
 
+	"github.com/ClusterCockpit/cc-backend/internal/repository"
 	"github.com/ClusterCockpit/cc-backend/pkg/log"
 	"github.com/ClusterCockpit/cc-backend/pkg/schema"
 	"github.com/go-ldap/ldap/v3"
 )
 
 type LdapAuthenticator struct {
-	auth         *Authentication
 	config       *schema.LdapConfig
 	syncPassword string
 }
 
 var _ Authenticator = (*LdapAuthenticator)(nil)
 
-func (la *LdapAuthenticator) Init(
-	auth *Authentication,
-	conf interface{}) error {
+func (la *LdapAuthenticator) Init(conf interface{}) error {
 
-	la.auth = auth
 	la.config = conf.(*schema.LdapConfig)
 
 	la.syncPassword = os.Getenv("LDAP_ADMIN_PASSWORD")
@@ -101,13 +98,30 @@ func (la *LdapAuthenticator) CanLogin(
 
 			entry := sr.Entries[0]
 			name := entry.GetAttributeValue("gecos")
+			var roles []string
+			roles = append(roles, schema.GetRoleString(schema.RoleUser))
+			projects := make([]string, 0)
 
-			if _, err := la.auth.db.Exec(`INSERT INTO user (username, ldap, name, roles) VALUES (?, ?, ?, ?)`,
-				username, 1, name, "[\""+schema.GetRoleString(schema.RoleUser)+"\"]"); err != nil {
-				log.Errorf("User '%s' new in LDAP: Insert into DB failed", username)
+			user = &schema.User{
+				Username:   username,
+				Name:       name,
+				Roles:      roles,
+				Projects:   projects,
+				AuthType:   schema.AuthSession,
+				AuthSource: schema.AuthViaLDAP,
+			}
+
+			if err := repository.GetUserRepository().AddUser(user); err != nil {
+				log.Errorf("User '%s' LDAP: Insert into DB failed", username)
 				return false
 			}
 
+			// if _, err := la.auth.db.Exec(`INSERT INTO user (username, ldap, name, roles) VALUES (?, ?, ?, ?)`,
+			// 	username, 1, name, "[\""+schema.GetRoleString(schema.RoleUser)+"\"]"); err != nil {
+			// 	log.Errorf("User '%s' new in LDAP: Insert into DB failed", username)
+			// 	return false
+			// }
+
 			return true
 		}
 	}
@@ -137,25 +151,18 @@ func (la *LdapAuthenticator) Login(
 }
 
 func (la *LdapAuthenticator) Sync() error {
-
 	const IN_DB int = 1
 	const IN_LDAP int = 2
 	const IN_BOTH int = 3
+	ur := repository.GetUserRepository()
 
 	users := map[string]int{}
-	rows, err := la.auth.db.Query(`SELECT username FROM user WHERE user.ldap = 1`)
+	usernames, err := ur.GetLdapUsernames()
 	if err != nil {
-		log.Warn("Error while querying LDAP users")
 		return err
 	}
 
-	for rows.Next() {
-		var username string
-		if err := rows.Scan(&username); err != nil {
-			log.Warnf("Error while scanning for user '%s'", username)
-			return err
-		}
-
+	for _, username := range usernames {
 		users[username] = IN_DB
 	}
 
@@ -194,17 +201,26 @@ func (la *LdapAuthenticator) Sync() error {
 
 	for username, where := range users {
 		if where == IN_DB && la.config.SyncDelOldUsers {
+			ur.DelUser(username)
 			log.Debugf("sync: remove %v (does not show up in LDAP anymore)", username)
-			if _, err := la.auth.db.Exec(`DELETE FROM user WHERE user.username = ?`, username); err != nil {
-				log.Errorf("User '%s' not in LDAP anymore: Delete from DB failed", username)
-				return err
-			}
 		} else if where == IN_LDAP {
 			name := newnames[username]
+
+			var roles []string
+			roles = append(roles, schema.GetRoleString(schema.RoleUser))
+			projects := make([]string, 0)
+
+			user := &schema.User{
+				Username:   username,
+				Name:       name,
+				Roles:      roles,
+				Projects:   projects,
+				AuthSource: schema.AuthViaLDAP,
+			}
+
 			log.Debugf("sync: add %v (name: %v, roles: [user], ldap: true)", username, name)
-			if _, err := la.auth.db.Exec(`INSERT INTO user (username, ldap, name, roles) VALUES (?, ?, ?, ?)`,
-				username, 1, name, "[\""+schema.GetRoleString(schema.RoleUser)+"\"]"); err != nil {
-				log.Errorf("User '%s' new in LDAP: Insert into DB failed", username)
+			if err := ur.AddUser(user); err != nil {
+				log.Errorf("User '%s' LDAP: Insert into DB failed", username)
 				return err
 			}
 		}
diff --git a/internal/auth/local.go b/internal/auth/local.go
index fb1ba0f..0c6303a 100644
--- a/internal/auth/local.go
+++ b/internal/auth/local.go
@@ -20,10 +20,8 @@ type LocalAuthenticator struct {
 var _ Authenticator = (*LocalAuthenticator)(nil)
 
 func (la *LocalAuthenticator) Init(
-	auth *Authentication,
 	_ interface{}) error {
 
-	la.auth = auth
 	return nil
 }
 
diff --git a/internal/repository/user.go b/internal/repository/user.go
index 3db7e4d..5439b6e 100644
--- a/internal/repository/user.go
+++ b/internal/repository/user.go
@@ -71,6 +71,28 @@ func (r *UserRepository) GetUser(username string) (*schema.User, error) {
 	return user, nil
 }
 
+func (r *UserRepository) GetLdapUsernames() ([]string, error) {
+
+	var users []string
+	rows, err := r.DB.Query(`SELECT username FROM user WHERE user.ldap = 1`)
+	if err != nil {
+		log.Warn("Error while querying usernames")
+		return nil, err
+	}
+
+	for rows.Next() {
+		var username string
+		if err := rows.Scan(&username); err != nil {
+			log.Warnf("Error while scanning for user '%s'", username)
+			return nil, err
+		}
+
+		users = append(users, username)
+	}
+
+	return users, nil
+}
+
 func (r *UserRepository) AddUser(user *schema.User) error {
 	rolesJson, _ := json.Marshal(user.Roles)
 	projectsJson, _ := json.Marshal(user.Projects)
@@ -95,6 +117,10 @@ func (r *UserRepository) AddUser(user *schema.User) error {
 		cols = append(cols, "password")
 		vals = append(vals, string(password))
 	}
+	if user.AuthSource != -1 {
+		cols = append(cols, "ldap")
+		vals = append(vals, int(user.AuthSource))
+	}
 
 	if _, err := sq.Insert("user").Columns(cols...).Values(vals...).RunWith(r.DB).Exec(); err != nil {
 		log.Errorf("Error while inserting new user '%v' into DB", user.Username)
diff --git a/pkg/schema/user.go b/pkg/schema/user.go
index 1547d3f..047f617 100644
--- a/pkg/schema/user.go
+++ b/pkg/schema/user.go
@@ -27,6 +27,7 @@ const (
 	AuthViaLocalPassword AuthSource = iota
 	AuthViaLDAP
 	AuthViaToken
+	AuthViaAll
 )
 
 type AuthType int

From 29552fadc3d15ec3136e207315b8a6d3cb65899d Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan@moebiusband.org>
Date: Thu, 17 Aug 2023 14:02:04 +0200
Subject: [PATCH 47/62] Cleanup SyncOnLogin Handling

---
 internal/auth/auth.go             | 10 ++++++----
 internal/auth/jwtCookieSession.go | 13 ++++++++++---
 internal/auth/jwtSession.go       | 10 ++++++----
 internal/auth/ldap.go             | 19 ++++++++++---------
 internal/auth/local.go            |  4 ++--
 5 files changed, 34 insertions(+), 22 deletions(-)

diff --git a/internal/auth/auth.go b/internal/auth/auth.go
index cc2bcb4..8da45da 100644
--- a/internal/auth/auth.go
+++ b/internal/auth/auth.go
@@ -22,7 +22,7 @@ import (
 
 type Authenticator interface {
 	Init(config interface{}) error
-	CanLogin(user *schema.User, username string, rw http.ResponseWriter, r *http.Request) bool
+	CanLogin(user *schema.User, username string, rw http.ResponseWriter, r *http.Request) (*schema.User, bool)
 	Login(user *schema.User, rw http.ResponseWriter, r *http.Request) (*schema.User, error)
 }
 
@@ -148,7 +148,7 @@ func (auth *Authentication) Login(
 	return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 		err := errors.New("no authenticator applied")
 		username := r.FormValue("username")
-		dbUser := (*schema.User)(nil)
+		var dbUser *schema.User
 
 		if username != "" {
 			dbUser, err = repository.GetUserRepository().GetUser(username)
@@ -158,11 +158,13 @@ func (auth *Authentication) Login(
 		}
 
 		for _, authenticator := range auth.authenticators {
-			if !authenticator.CanLogin(dbUser, username, rw, r) {
+			var ok bool
+			var user *schema.User
+			if user, ok = authenticator.CanLogin(dbUser, username, rw, r); !ok {
 				continue
 			}
 
-			user, err := authenticator.Login(dbUser, rw, r)
+			user, err = authenticator.Login(user, rw, r)
 			if err != nil {
 				log.Warnf("user login failed: %s", err.Error())
 				onfailure(rw, r, err)
diff --git a/internal/auth/jwtCookieSession.go b/internal/auth/jwtCookieSession.go
index ad0b033..42ebcd2 100644
--- a/internal/auth/jwtCookieSession.go
+++ b/internal/auth/jwtCookieSession.go
@@ -11,6 +11,7 @@ import (
 	"net/http"
 	"os"
 
+	"github.com/ClusterCockpit/cc-backend/internal/repository"
 	"github.com/ClusterCockpit/cc-backend/pkg/log"
 	"github.com/ClusterCockpit/cc-backend/pkg/schema"
 	"github.com/golang-jwt/jwt/v4"
@@ -88,7 +89,7 @@ func (ja *JWTCookieSessionAuthenticator) CanLogin(
 	user *schema.User,
 	username string,
 	rw http.ResponseWriter,
-	r *http.Request) bool {
+	r *http.Request) (*schema.User, bool) {
 
 	cookieName := ""
 	if ja.config != nil && ja.config.CookieName != "" {
@@ -100,11 +101,11 @@ func (ja *JWTCookieSessionAuthenticator) CanLogin(
 		jwtCookie, err := r.Cookie(cookieName)
 
 		if err == nil && jwtCookie.Value != "" {
-			return true
+			return user, true
 		}
 	}
 
-	return false
+	return nil, false
 }
 
 func (ja *JWTCookieSessionAuthenticator) Login(
@@ -194,6 +195,12 @@ func (ja *JWTCookieSessionAuthenticator) Login(
 			AuthType:   schema.AuthSession,
 			AuthSource: schema.AuthViaToken,
 		}
+
+		if ja.config.SyncUserOnLogin {
+			if err := repository.GetUserRepository().AddUser(user); err != nil {
+				log.Errorf("Error while adding user '%s' to DB", user.Username)
+			}
+		}
 	}
 
 	return user, nil
diff --git a/internal/auth/jwtSession.go b/internal/auth/jwtSession.go
index 5a29360..d9dce85 100644
--- a/internal/auth/jwtSession.go
+++ b/internal/auth/jwtSession.go
@@ -44,9 +44,9 @@ func (ja *JWTSessionAuthenticator) CanLogin(
 	user *schema.User,
 	username string,
 	rw http.ResponseWriter,
-	r *http.Request) bool {
+	r *http.Request) (*schema.User, bool) {
 
-	return r.Header.Get("Authorization") != "" || r.URL.Query().Get("login-token") != ""
+	return user, r.Header.Get("Authorization") != "" || r.URL.Query().Get("login-token") != ""
 }
 
 func (ja *JWTSessionAuthenticator) Login(
@@ -130,8 +130,10 @@ func (ja *JWTSessionAuthenticator) Login(
 			AuthSource: schema.AuthViaToken,
 		}
 
-		if err := repository.GetUserRepository().AddUser(user); err != nil {
-			log.Errorf("Error while adding user '%s' to DB", user.Username)
+		if ja.config.SyncUserOnLogin {
+			if err := repository.GetUserRepository().AddUser(user); err != nil {
+				log.Errorf("Error while adding user '%s' to DB", user.Username)
+			}
 		}
 	}
 
diff --git a/internal/auth/ldap.go b/internal/auth/ldap.go
index c3bde4a..a20e415 100644
--- a/internal/auth/ldap.go
+++ b/internal/auth/ldap.go
@@ -67,33 +67,34 @@ func (la *LdapAuthenticator) CanLogin(
 	user *schema.User,
 	username string,
 	rw http.ResponseWriter,
-	r *http.Request) bool {
+	r *http.Request) (*schema.User, bool) {
 
 	if user != nil && user.AuthSource == schema.AuthViaLDAP {
-		return true
+		return user, true
 	} else {
 		if la.config != nil && la.config.SyncUserOnLogin {
 			l, err := la.getLdapConnection(true)
 			if err != nil {
 				log.Error("LDAP connection error")
 			}
+			defer l.Close()
 
 			// Search for the given username
 			searchRequest := ldap.NewSearchRequest(
 				la.config.UserBase,
 				ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
-				fmt.Sprintf("(%s(uid=%s))", la.config.UserFilter, username),
+				fmt.Sprintf("(&%s(uid=%s))", la.config.UserFilter, username),
 				[]string{"dn", "uid", "gecos"}, nil)
 
 			sr, err := l.Search(searchRequest)
 			if err != nil {
 				log.Warn(err)
-				return false
+				return user, false
 			}
 
 			if len(sr.Entries) != 1 {
 				log.Warn("User does not exist or too many entries returned")
-				return false
+				return user, false
 			}
 
 			entry := sr.Entries[0]
@@ -113,7 +114,7 @@ func (la *LdapAuthenticator) CanLogin(
 
 			if err := repository.GetUserRepository().AddUser(user); err != nil {
 				log.Errorf("User '%s' LDAP: Insert into DB failed", username)
-				return false
+				return nil, false
 			}
 
 			// if _, err := la.auth.db.Exec(`INSERT INTO user (username, ldap, name, roles) VALUES (?, ?, ?, ?)`,
@@ -122,11 +123,11 @@ func (la *LdapAuthenticator) CanLogin(
 			// 	return false
 			// }
 
-			return true
+			return user, true
 		}
 	}
 
-	return false
+	return nil, false
 }
 
 func (la *LdapAuthenticator) Login(
@@ -176,7 +177,7 @@ func (la *LdapAuthenticator) Sync() error {
 	ldapResults, err := l.Search(ldap.NewSearchRequest(
 		la.config.UserBase,
 		ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
-		fmt.Sprintf("(%s(uid=%s))", la.config.UserFilter, "*"),
+		la.config.UserFilter,
 		[]string{"dn", "uid", "gecos"}, nil))
 	if err != nil {
 		log.Warn("LDAP search error")
diff --git a/internal/auth/local.go b/internal/auth/local.go
index 0c6303a..dd6ec2c 100644
--- a/internal/auth/local.go
+++ b/internal/auth/local.go
@@ -29,9 +29,9 @@ func (la *LocalAuthenticator) CanLogin(
 	user *schema.User,
 	username string,
 	rw http.ResponseWriter,
-	r *http.Request) bool {
+	r *http.Request) (*schema.User, bool) {
 
-	return user != nil && user.AuthSource == schema.AuthViaLocalPassword
+	return user, user != nil && user.AuthSource == schema.AuthViaLocalPassword
 }
 
 func (la *LocalAuthenticator) Login(

From d51be5c308420f95c66cae484c9f252b9c7e7c18 Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan@moebiusband.org>
Date: Fri, 18 Aug 2023 08:49:25 +0200
Subject: [PATCH 48/62] Formatting and minor fixes

---
 internal/auth/auth.go             | 28 +++++++++++-------
 internal/auth/jwt.go              |  5 +---
 internal/auth/jwtCookieSession.go | 18 ++++++++++--
 internal/auth/jwtSession.go       | 48 +++++++++++++++++++------------
 internal/auth/ldap.go             | 25 +++++++---------
 5 files changed, 74 insertions(+), 50 deletions(-)

diff --git a/internal/auth/auth.go b/internal/auth/auth.go
index 8da45da..b10c3bd 100644
--- a/internal/auth/auth.go
+++ b/internal/auth/auth.go
@@ -102,7 +102,7 @@ func Init(configs map[string]interface{}) (*Authentication, error) {
 	}
 
 	auth.JwtAuth = &JWTAuthenticator{}
-	if err := auth.JwtAuth.Init(configs["jwt"]); err != nil {
+	if err := auth.JwtAuth.Init(); err != nil {
 		log.Error("Error while initializing authentication -> jwtAuth init failed")
 		return nil, err
 	}
@@ -115,20 +115,26 @@ func Init(configs map[string]interface{}) (*Authentication, error) {
 			auth.LdapAuth = ldapAuth
 			auth.authenticators = append(auth.authenticators, auth.LdapAuth)
 		}
+	} else {
+		log.Info("Missing LDAP configuration: No LDAP support!")
 	}
 
-	jwtSessionAuth := &JWTSessionAuthenticator{}
-	if err := jwtSessionAuth.Init(configs["jwt"]); err != nil {
-		log.Warn("Error while initializing authentication -> jwtSessionAuth init failed")
-	} else {
-		auth.authenticators = append(auth.authenticators, jwtSessionAuth)
-	}
+	if config, ok := configs["jwt"]; ok {
+		jwtSessionAuth := &JWTSessionAuthenticator{}
+		if err := jwtSessionAuth.Init(config); err != nil {
+			log.Warn("Error while initializing authentication -> jwtSessionAuth init failed")
+		} else {
+			auth.authenticators = append(auth.authenticators, jwtSessionAuth)
+		}
 
-	jwtCookieSessionAuth := &JWTCookieSessionAuthenticator{}
-	if err := jwtCookieSessionAuth.Init(configs["jwt"]); err != nil {
-		log.Warn("Error while initializing authentication -> jwtCookieSessionAuth init failed")
+		jwtCookieSessionAuth := &JWTCookieSessionAuthenticator{}
+		if err := jwtCookieSessionAuth.Init(configs["jwt"]); err != nil {
+			log.Warn("Error while initializing authentication -> jwtCookieSessionAuth init failed")
+		} else {
+			auth.authenticators = append(auth.authenticators, jwtCookieSessionAuth)
+		}
 	} else {
-		auth.authenticators = append(auth.authenticators, jwtCookieSessionAuth)
+		log.Info("Missing JWT configuration: No JWT token login support!")
 	}
 
 	auth.LocalAuth = &LocalAuthenticator{}
diff --git a/internal/auth/jwt.go b/internal/auth/jwt.go
index 9c0166d..4a1e4b8 100644
--- a/internal/auth/jwt.go
+++ b/internal/auth/jwt.go
@@ -22,12 +22,9 @@ import (
 type JWTAuthenticator struct {
 	publicKey  ed25519.PublicKey
 	privateKey ed25519.PrivateKey
-	config     *schema.JWTAuthConfig
 }
 
-func (ja *JWTAuthenticator) Init(conf interface{}) error {
-	ja.config = conf.(*schema.JWTAuthConfig)
-
+func (ja *JWTAuthenticator) Init() error {
 	pubKey, privKey := os.Getenv("JWT_PUBLIC_KEY"), os.Getenv("JWT_PRIVATE_KEY")
 	if pubKey == "" || privKey == "" {
 		log.Warn("environment variables 'JWT_PUBLIC_KEY' or 'JWT_PRIVATE_KEY' not set (token based authentication will not work)")
diff --git a/internal/auth/jwtCookieSession.go b/internal/auth/jwtCookieSession.go
index 42ebcd2..9dcba57 100644
--- a/internal/auth/jwtCookieSession.go
+++ b/internal/auth/jwtCookieSession.go
@@ -8,6 +8,7 @@ import (
 	"crypto/ed25519"
 	"encoding/base64"
 	"errors"
+	"fmt"
 	"net/http"
 	"os"
 
@@ -82,6 +83,7 @@ func (ja *JWTCookieSessionAuthenticator) Init(conf interface{}) error {
 		return errors.New("config for JWTs not configured (cross login via JWT cookie will fail)")
 	}
 
+	log.Info("JWT Cookie Session authenticator successfully registered")
 	return nil
 }
 
@@ -137,7 +139,7 @@ func (ja *JWTCookieSessionAuthenticator) Login(
 		return ja.publicKey, nil
 	})
 	if err != nil {
-		log.Warn("error while parsing token")
+		log.Warn("JWT cookie session: error while parsing token")
 		return nil, err
 	}
 
@@ -151,8 +153,16 @@ func (ja *JWTCookieSessionAuthenticator) Login(
 	sub, _ := claims["sub"].(string)
 
 	var name string
-	if val, ok := claims["name"]; ok {
-		name, _ = val.(string)
+	if wrap, ok := claims["name"].(map[string]interface{}); ok {
+		if vals, ok := wrap["values"].([]interface{}); ok {
+			if len(vals) != 0 {
+				name = fmt.Sprintf("%v", vals[0])
+
+				for i := 1; i < len(vals); i++ {
+					name += fmt.Sprintf(" %v", vals[i])
+				}
+			}
+		}
 	}
 
 	var roles []string
@@ -188,10 +198,12 @@ func (ja *JWTCookieSessionAuthenticator) Login(
 	http.SetCookie(rw, deletedCookie)
 
 	if user == nil {
+		projects := make([]string, 0)
 		user = &schema.User{
 			Username:   sub,
 			Name:       name,
 			Roles:      roles,
+			Projects:   projects,
 			AuthType:   schema.AuthSession,
 			AuthSource: schema.AuthViaToken,
 		}
diff --git a/internal/auth/jwtSession.go b/internal/auth/jwtSession.go
index d9dce85..f68de90 100644
--- a/internal/auth/jwtSession.go
+++ b/internal/auth/jwtSession.go
@@ -6,6 +6,7 @@ package auth
 
 import (
 	"encoding/base64"
+	"errors"
 	"fmt"
 	"net/http"
 	"os"
@@ -37,6 +38,7 @@ func (ja *JWTSessionAuthenticator) Init(conf interface{}) error {
 		ja.loginTokenKey = bytes
 	}
 
+	log.Info("JWT Session authenticator successfully registered")
 	return nil
 }
 
@@ -46,7 +48,8 @@ func (ja *JWTSessionAuthenticator) CanLogin(
 	rw http.ResponseWriter,
 	r *http.Request) (*schema.User, bool) {
 
-	return user, r.Header.Get("Authorization") != "" || r.URL.Query().Get("login-token") != ""
+	return user, r.Header.Get("Authorization") != "" ||
+		r.URL.Query().Get("login-token") != ""
 }
 
 func (ja *JWTSessionAuthenticator) Login(
@@ -79,29 +82,38 @@ func (ja *JWTSessionAuthenticator) Login(
 	sub, _ := claims["sub"].(string)
 
 	var name string
-	// Java/Grails Issued Token
 	if wrap, ok := claims["name"].(map[string]interface{}); ok {
 		if vals, ok := wrap["values"].([]interface{}); ok {
-			name = fmt.Sprintf("%v %v", vals[0], vals[1])
-		}
-	} else if val, ok := claims["name"]; ok {
-		name, _ = val.(string)
-	}
+			if len(vals) != 0 {
+				name = fmt.Sprintf("%v", vals[0])
 
-	var roles []string
-	// Java/Grails Issued Token
-	if rawroles, ok := claims["roles"].([]interface{}); ok {
-		for _, rr := range rawroles {
-			if r, ok := rr.(string); ok {
-				if schema.IsValidRole(r) {
-					roles = append(roles, r)
+				for i := 1; i < len(vals); i++ {
+					name += fmt.Sprintf(" %v", vals[i])
 				}
 			}
 		}
-	} else if rawroles, ok := claims["roles"]; ok {
-		for _, r := range rawroles.([]string) {
-			if schema.IsValidRole(r) {
-				roles = append(roles, r)
+	}
+
+	var roles []string
+
+	if ja.config.ValidateUser {
+		// Deny any logins for unknown usernames
+		if user == nil {
+			log.Warn("Could not find user from JWT in internal database.")
+			return nil, errors.New("unknown user")
+		}
+
+		// Take user roles from database instead of trusting the JWT
+		roles = user.Roles
+	} else {
+		// Extract roles from JWT (if present)
+		if rawroles, ok := claims["roles"].([]interface{}); ok {
+			for _, rr := range rawroles {
+				if r, ok := rr.(string); ok {
+					if schema.IsValidRole(r) {
+						roles = append(roles, r)
+					}
+				}
 			}
 		}
 	}
diff --git a/internal/auth/ldap.go b/internal/auth/ldap.go
index a20e415..529179e 100644
--- a/internal/auth/ldap.go
+++ b/internal/auth/ldap.go
@@ -57,7 +57,7 @@ func (la *LdapAuthenticator) Init(conf interface{}) error {
 			}
 		}()
 	} else {
-		return fmt.Errorf("missing LDAP configuration")
+		log.Info("Missing LDAP configuration key sync_interval")
 	}
 
 	return nil
@@ -69,10 +69,12 @@ func (la *LdapAuthenticator) CanLogin(
 	rw http.ResponseWriter,
 	r *http.Request) (*schema.User, bool) {
 
-	if user != nil && user.AuthSource == schema.AuthViaLDAP {
-		return user, true
+	if user != nil {
+		if user.AuthSource == schema.AuthViaLDAP {
+			return user, true
+		}
 	} else {
-		if la.config != nil && la.config.SyncUserOnLogin {
+		if la.config.SyncUserOnLogin {
 			l, err := la.getLdapConnection(true)
 			if err != nil {
 				log.Error("LDAP connection error")
@@ -89,12 +91,12 @@ func (la *LdapAuthenticator) CanLogin(
 			sr, err := l.Search(searchRequest)
 			if err != nil {
 				log.Warn(err)
-				return user, false
+				return nil, false
 			}
 
 			if len(sr.Entries) != 1 {
-				log.Warn("User does not exist or too many entries returned")
-				return user, false
+				log.Warn("LDAP: User does not exist or too many entries returned")
+				return nil, false
 			}
 
 			entry := sr.Entries[0]
@@ -117,12 +119,6 @@ func (la *LdapAuthenticator) CanLogin(
 				return nil, false
 			}
 
-			// if _, err := la.auth.db.Exec(`INSERT INTO user (username, ldap, name, roles) VALUES (?, ?, ?, ?)`,
-			// 	username, 1, name, "[\""+schema.GetRoleString(schema.RoleUser)+"\"]"); err != nil {
-			// 	log.Errorf("User '%s' new in LDAP: Insert into DB failed", username)
-			// 	return false
-			// }
-
 			return user, true
 		}
 	}
@@ -144,7 +140,8 @@ func (la *LdapAuthenticator) Login(
 
 	userDn := strings.Replace(la.config.UserBind, "{username}", user.Username, -1)
 	if err := l.Bind(userDn, r.FormValue("password")); err != nil {
-		log.Errorf("AUTH/LOCAL > Authentication for user %s failed: %v", user.Username, err)
+		log.Errorf("AUTH/LOCAL > Authentication for user %s failed: %v",
+			user.Username, err)
 		return nil, fmt.Errorf("AUTH/LDAP > Authentication failed")
 	}
 

From cfcf939339c2af2cd84f4bac2f54ca83c951c03c Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan@moebiusband.org>
Date: Fri, 18 Aug 2023 08:57:56 +0200
Subject: [PATCH 49/62] Add config to jwt again

---
 internal/auth/auth.go | 12 ++++++------
 internal/auth/jwt.go  |  5 ++++-
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/internal/auth/auth.go b/internal/auth/auth.go
index b10c3bd..8c873ad 100644
--- a/internal/auth/auth.go
+++ b/internal/auth/auth.go
@@ -101,12 +101,6 @@ func Init(configs map[string]interface{}) (*Authentication, error) {
 		auth.sessionStore = sessions.NewCookieStore(bytes)
 	}
 
-	auth.JwtAuth = &JWTAuthenticator{}
-	if err := auth.JwtAuth.Init(); err != nil {
-		log.Error("Error while initializing authentication -> jwtAuth init failed")
-		return nil, err
-	}
-
 	if config, ok := configs["ldap"]; ok {
 		ldapAuth := &LdapAuthenticator{}
 		if err := ldapAuth.Init(config); err != nil {
@@ -120,6 +114,12 @@ func Init(configs map[string]interface{}) (*Authentication, error) {
 	}
 
 	if config, ok := configs["jwt"]; ok {
+		auth.JwtAuth = &JWTAuthenticator{}
+		if err := auth.JwtAuth.Init(config); err != nil {
+			log.Error("Error while initializing authentication -> jwtAuth init failed")
+			return nil, err
+		}
+
 		jwtSessionAuth := &JWTSessionAuthenticator{}
 		if err := jwtSessionAuth.Init(config); err != nil {
 			log.Warn("Error while initializing authentication -> jwtSessionAuth init failed")
diff --git a/internal/auth/jwt.go b/internal/auth/jwt.go
index 4a1e4b8..9c0166d 100644
--- a/internal/auth/jwt.go
+++ b/internal/auth/jwt.go
@@ -22,9 +22,12 @@ import (
 type JWTAuthenticator struct {
 	publicKey  ed25519.PublicKey
 	privateKey ed25519.PrivateKey
+	config     *schema.JWTAuthConfig
 }
 
-func (ja *JWTAuthenticator) Init() error {
+func (ja *JWTAuthenticator) Init(conf interface{}) error {
+	ja.config = conf.(*schema.JWTAuthConfig)
+
 	pubKey, privKey := os.Getenv("JWT_PUBLIC_KEY"), os.Getenv("JWT_PRIVATE_KEY")
 	if pubKey == "" || privKey == "" {
 		log.Warn("environment variables 'JWT_PUBLIC_KEY' or 'JWT_PRIVATE_KEY' not set (token based authentication will not work)")

From 56d559fdd712fc04d2b4f3cda7ffd2b08d6d3a18 Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan@moebiusband.org>
Date: Fri, 18 Aug 2023 09:19:30 +0200
Subject: [PATCH 50/62] Fix bug with jwt max-age option

---
 internal/auth/jwt.go | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/internal/auth/jwt.go b/internal/auth/jwt.go
index 9c0166d..3d87f68 100644
--- a/internal/auth/jwt.go
+++ b/internal/auth/jwt.go
@@ -130,8 +130,12 @@ func (ja *JWTAuthenticator) ProvideJWT(user *schema.User) (string, error) {
 		"roles": user.Roles,
 		"iat":   now.Unix(),
 	}
-	if ja.config != nil && ja.config.MaxAge != 0 {
-		claims["exp"] = now.Add(time.Duration(ja.config.MaxAge)).Unix()
+	if ja.config != nil && ja.config.MaxAge != "" {
+		d, err := time.ParseDuration(ja.config.MaxAge)
+		if err != nil {
+			return "", errors.New("cannot parse max-age config key")
+		}
+		claims["exp"] = now.Add(d).Unix()
 	}
 
 	return jwt.NewWithClaims(jwt.SigningMethodEdDSA, claims).SignedString(ja.privateKey)

From 6185635aa9622e367de3c236fa652c87d352fb3b Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan@moebiusband.org>
Date: Fri, 18 Aug 2023 09:19:55 +0200
Subject: [PATCH 51/62] Extend config schema

---
 pkg/schema/config.go                  |  2 +-
 pkg/schema/schemas/config.schema.json | 32 ++++++++++++++++++++++++---
 2 files changed, 30 insertions(+), 4 deletions(-)

diff --git a/pkg/schema/config.go b/pkg/schema/config.go
index efcd6f9..443fad7 100644
--- a/pkg/schema/config.go
+++ b/pkg/schema/config.go
@@ -25,7 +25,7 @@ type LdapConfig struct {
 type JWTAuthConfig struct {
 	// Specifies for how long a JWT token shall be valid
 	// as a string parsable by time.ParseDuration().
-	MaxAge int64 `json:"max-age"`
+	MaxAge string `json:"max-age"`
 
 	// Specifies which cookie should be checked for a JWT token (if no authorization header is present)
 	CookieName string `json:"cookieName"`
diff --git a/pkg/schema/schemas/config.schema.json b/pkg/schema/schemas/config.schema.json
index 7505c1c..84983ec 100644
--- a/pkg/schema/schemas/config.schema.json
+++ b/pkg/schema/schemas/config.schema.json
@@ -127,9 +127,34 @@
             "description": "Do not show running jobs shorter than X seconds.",
             "type": "integer"
         },
-        "": {
-            "description": "",
-            "type": "string"
+        "jwts": {
+            "description": "For JWT token authentication.",
+            "type": "object",
+            "properties": {
+                "max-age": {
+                    "description": "Configure how long a token is valid. As string parsable by time.ParseDuration()",
+                    "type": "string"
+                },
+                "cookieName": {
+                    "description": "Cookie that should be checked for a JWT token.",
+                    "type": "string"
+                },
+                "validateUser": {
+                    "description": "Deny login for users not in database (but defined in JWT). Overwrite roles in JWT with database roles.",
+                    "type": "boolean"
+                },
+                "trustedIssuer": {
+                    "description": "Issuer that should be accepted when validating external JWTs ",
+                    "type": "string"
+                },
+                "syncUserOnLogin": {
+                    "description": "Add non-existent user to DB at login attempt with values provided in JWT.",
+                    "type": "boolean"
+                }
+            },
+            "required": [
+                "max-age"
+            ]
         },
         "ldap": {
             "description": "For LDAP Authentication and user synchronisation.",
@@ -398,6 +423,7 @@
         }
     },
     "required": [
+        "jwts",
         "clusters"
     ]
 }

From 14c487c9e49fc4bb63de61c3f692a5726976a1d4 Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan@moebiusband.org>
Date: Fri, 18 Aug 2023 09:31:57 +0200
Subject: [PATCH 52/62] Update test inputs

---
 configs/config-demo.json               | 3 +++
 configs/config.json                    | 2 +-
 internal/api/api_test.go               | 3 +++
 internal/importer/importer_test.go     | 3 +++
 internal/repository/userConfig_test.go | 3 +++
 pkg/schema/validate_test.go            | 7 ++++---
 6 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/configs/config-demo.json b/configs/config-demo.json
index f48d224..578aa37 100644
--- a/configs/config-demo.json
+++ b/configs/config-demo.json
@@ -4,6 +4,9 @@
         "kind": "file",
         "path": "./var/job-archive"
     },
+    "jwts": {
+        "max-age": "2m"
+    },
     "clusters": [
         {
             "name": "fritz",
diff --git a/configs/config.json b/configs/config.json
index 6c4d4bd..3a2c64b 100644
--- a/configs/config.json
+++ b/configs/config.json
@@ -43,7 +43,7 @@
     "jwts": {
         "cookieName": "",
         "validateUser": false,
-        "max-age": 0,
+        "max-age": "2m",
         "trustedIssuer": ""
     },
     "short-running-jobs-duration": 300
diff --git a/internal/api/api_test.go b/internal/api/api_test.go
index 9e11383..ecffc82 100644
--- a/internal/api/api_test.go
+++ b/internal/api/api_test.go
@@ -39,6 +39,9 @@ func setup(t *testing.T) *api.RestApi {
 		"kind": "file",
 		"path": "./var/job-archive"
 	},
+    "jwts": {
+        "max-age": "2m"
+    },
 	"clusters": [
 	{
 	   "name": "testcluster",
diff --git a/internal/importer/importer_test.go b/internal/importer/importer_test.go
index 83ba5eb..01ac2f2 100644
--- a/internal/importer/importer_test.go
+++ b/internal/importer/importer_test.go
@@ -42,6 +42,9 @@ func setup(t *testing.T) *repository.JobRepository {
 		"kind": "file",
 		"path": "./var/job-archive"
 	},
+    "jwts": {
+        "max-age": "2m"
+    },
 	"clusters": [
 	{
 	   "name": "testcluster",
diff --git a/internal/repository/userConfig_test.go b/internal/repository/userConfig_test.go
index 0beec7b..3526919 100644
--- a/internal/repository/userConfig_test.go
+++ b/internal/repository/userConfig_test.go
@@ -22,6 +22,9 @@ func setupUserTest(t *testing.T) *UserCfgRepo {
 		"kind": "file",
 		"path": "./var/job-archive"
 	},
+    "jwts": {
+        "max-age": "2m"
+    },
 	"clusters": [
 	{
 	   "name": "testcluster",
diff --git a/pkg/schema/validate_test.go b/pkg/schema/validate_test.go
index 195e044..c3e918f 100644
--- a/pkg/schema/validate_test.go
+++ b/pkg/schema/validate_test.go
@@ -11,6 +11,9 @@ import (
 
 func TestValidateConfig(t *testing.T) {
 	json := []byte(`{
+    "jwts": {
+        "max-age": "2m"
+    },
 	"clusters": [
 	{
 	   "name": "testcluster",
@@ -21,9 +24,7 @@ func TestValidateConfig(t *testing.T) {
 		"numNodes": { "from": 1, "to": 64 },
 		"duration": { "from": 0, "to": 86400 },
 		"startTime": { "from": "2022-01-01T00:00:00Z", "to": null }
-	}
-	}
-	]
+	}}]
 }`)
 
 	if err := Validate(Config, bytes.NewReader(json)); err != nil {

From 129e6a69b8fe1e214e4981183a23f38a9ba649ff Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Fri, 18 Aug 2023 10:15:07 +0200
Subject: [PATCH 53/62] fix: metric y-range render limit for data outliers

---
 web/frontend/src/plots/MetricPlot.svelte | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/web/frontend/src/plots/MetricPlot.svelte b/web/frontend/src/plots/MetricPlot.svelte
index 7915c68..094122e 100644
--- a/web/frontend/src/plots/MetricPlot.svelte
+++ b/web/frontend/src/plots/MetricPlot.svelte
@@ -154,11 +154,18 @@
         ? statisticsSeries.mean.length
         : series.reduce((n, series) => Math.max(n, series.data.length), 0)
     const maxX = longestSeries * timestep
-    const maxY = thresholds != null
-        ? useStatsSeries
+    let maxY = null
+    
+    if (thresholds !== null) {
+        maxY = useStatsSeries
             ? (statisticsSeries.max.reduce((max, x) => Math.max(max, x), thresholds.normal) || thresholds.normal)
             : (series.reduce((max, series) => Math.max(max, series.statistics?.max), thresholds.normal) || thresholds.normal)
-        : null
+
+        if (maxY >= (10 * thresholds.normal)) { // Hard y-range render limit if outliers in series data
+            maxY = (10 * thresholds.normal)
+        } 
+    }
+
     const plotSeries = [{label: 'Runtime', value: (u, ts, sidx, didx) => didx == null ? null : formatTime(ts)}]
     const plotData = [new Array(longestSeries)]
 

From 32b0c8bdd7cef2259caf647c06023fd2cb5fdeb5 Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan@moebiusband.org>
Date: Fri, 18 Aug 2023 10:43:06 +0200
Subject: [PATCH 54/62] Refactor and cleanup Auth configuration

---
 cmd/cc-backend/main.go            |  5 +---
 internal/auth/auth.go             | 24 +++++++++----------
 internal/auth/jwt.go              | 12 ++++------
 internal/auth/jwtCookieSession.go | 38 +++++++++++++++----------------
 internal/auth/jwtSession.go       | 11 ++++-----
 internal/auth/ldap.go             | 38 ++++++++++++++++---------------
 internal/auth/local.go            |  4 +---
 internal/config/config.go         |  1 -
 8 files changed, 62 insertions(+), 71 deletions(-)

diff --git a/cmd/cc-backend/main.go b/cmd/cc-backend/main.go
index dd00046..e165092 100644
--- a/cmd/cc-backend/main.go
+++ b/cmd/cc-backend/main.go
@@ -211,10 +211,7 @@ func main() {
 	var authentication *auth.Authentication
 	if !config.Keys.DisableAuthentication {
 		var err error
-		if authentication, err = auth.Init(map[string]interface{}{
-			"ldap": config.Keys.LdapConfig,
-			"jwt":  config.Keys.JwtConfig,
-		}); err != nil {
+		if authentication, err = auth.Init(); err != nil {
 			log.Fatalf("auth initialization failed: %v", err)
 		}
 
diff --git a/internal/auth/auth.go b/internal/auth/auth.go
index 8c873ad..8c9beef 100644
--- a/internal/auth/auth.go
+++ b/internal/auth/auth.go
@@ -14,6 +14,7 @@ import (
 	"os"
 	"time"
 
+	"github.com/ClusterCockpit/cc-backend/internal/config"
 	"github.com/ClusterCockpit/cc-backend/internal/repository"
 	"github.com/ClusterCockpit/cc-backend/pkg/log"
 	"github.com/ClusterCockpit/cc-backend/pkg/schema"
@@ -21,7 +22,6 @@ import (
 )
 
 type Authenticator interface {
-	Init(config interface{}) error
 	CanLogin(user *schema.User, username string, rw http.ResponseWriter, r *http.Request) (*schema.User, bool)
 	Login(user *schema.User, rw http.ResponseWriter, r *http.Request) (*schema.User, error)
 }
@@ -80,7 +80,7 @@ func (auth *Authentication) AuthViaSession(
 	}, nil
 }
 
-func Init(configs map[string]interface{}) (*Authentication, error) {
+func Init() (*Authentication, error) {
 	auth := &Authentication{}
 
 	sessKey := os.Getenv("SESSION_KEY")
@@ -101,9 +101,9 @@ func Init(configs map[string]interface{}) (*Authentication, error) {
 		auth.sessionStore = sessions.NewCookieStore(bytes)
 	}
 
-	if config, ok := configs["ldap"]; ok {
+	if config.Keys.LdapConfig != nil {
 		ldapAuth := &LdapAuthenticator{}
-		if err := ldapAuth.Init(config); err != nil {
+		if err := ldapAuth.Init(); err != nil {
 			log.Warn("Error while initializing authentication -> ldapAuth init failed")
 		} else {
 			auth.LdapAuth = ldapAuth
@@ -113,32 +113,32 @@ func Init(configs map[string]interface{}) (*Authentication, error) {
 		log.Info("Missing LDAP configuration: No LDAP support!")
 	}
 
-	if config, ok := configs["jwt"]; ok {
+	if config.Keys.JwtConfig != nil {
 		auth.JwtAuth = &JWTAuthenticator{}
-		if err := auth.JwtAuth.Init(config); err != nil {
+		if err := auth.JwtAuth.Init(); err != nil {
 			log.Error("Error while initializing authentication -> jwtAuth init failed")
 			return nil, err
 		}
 
 		jwtSessionAuth := &JWTSessionAuthenticator{}
-		if err := jwtSessionAuth.Init(config); err != nil {
-			log.Warn("Error while initializing authentication -> jwtSessionAuth init failed")
+		if err := jwtSessionAuth.Init(); err != nil {
+            log.Info("jwtSessionAuth init failed: No JWT login support!")
 		} else {
 			auth.authenticators = append(auth.authenticators, jwtSessionAuth)
 		}
 
 		jwtCookieSessionAuth := &JWTCookieSessionAuthenticator{}
-		if err := jwtCookieSessionAuth.Init(configs["jwt"]); err != nil {
-			log.Warn("Error while initializing authentication -> jwtCookieSessionAuth init failed")
+		if err := jwtCookieSessionAuth.Init(); err != nil {
+            log.Info("jwtCookieSessionAuth init failed: No JWT cookie login support!")
 		} else {
 			auth.authenticators = append(auth.authenticators, jwtCookieSessionAuth)
 		}
 	} else {
-		log.Info("Missing JWT configuration: No JWT token login support!")
+		log.Info("Missing JWT configuration: No JWT token support!")
 	}
 
 	auth.LocalAuth = &LocalAuthenticator{}
-	if err := auth.LocalAuth.Init(nil); err != nil {
+	if err := auth.LocalAuth.Init(); err != nil {
 		log.Error("Error while initializing authentication -> localAuth init failed")
 		return nil, err
 	}
diff --git a/internal/auth/jwt.go b/internal/auth/jwt.go
index 3d87f68..83bfee3 100644
--- a/internal/auth/jwt.go
+++ b/internal/auth/jwt.go
@@ -13,6 +13,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/ClusterCockpit/cc-backend/internal/config"
 	"github.com/ClusterCockpit/cc-backend/internal/repository"
 	"github.com/ClusterCockpit/cc-backend/pkg/log"
 	"github.com/ClusterCockpit/cc-backend/pkg/schema"
@@ -22,12 +23,9 @@ import (
 type JWTAuthenticator struct {
 	publicKey  ed25519.PublicKey
 	privateKey ed25519.PrivateKey
-	config     *schema.JWTAuthConfig
 }
 
-func (ja *JWTAuthenticator) Init(conf interface{}) error {
-	ja.config = conf.(*schema.JWTAuthConfig)
-
+func (ja *JWTAuthenticator) Init() error {
 	pubKey, privKey := os.Getenv("JWT_PUBLIC_KEY"), os.Getenv("JWT_PRIVATE_KEY")
 	if pubKey == "" || privKey == "" {
 		log.Warn("environment variables 'JWT_PUBLIC_KEY' or 'JWT_PRIVATE_KEY' not set (token based authentication will not work)")
@@ -87,7 +85,7 @@ func (ja *JWTAuthenticator) AuthViaJWT(
 	var roles []string
 
 	// Validate user + roles from JWT against database?
-	if ja.config != nil && ja.config.ValidateUser {
+	if config.Keys.JwtConfig.ValidateUser {
 		ur := repository.GetUserRepository()
 		user, err := ur.GetUser(sub)
 
@@ -130,8 +128,8 @@ func (ja *JWTAuthenticator) ProvideJWT(user *schema.User) (string, error) {
 		"roles": user.Roles,
 		"iat":   now.Unix(),
 	}
-	if ja.config != nil && ja.config.MaxAge != "" {
-		d, err := time.ParseDuration(ja.config.MaxAge)
+	if config.Keys.JwtConfig.MaxAge != "" {
+		d, err := time.ParseDuration(config.Keys.JwtConfig.MaxAge)
 		if err != nil {
 			return "", errors.New("cannot parse max-age config key")
 		}
diff --git a/internal/auth/jwtCookieSession.go b/internal/auth/jwtCookieSession.go
index 9dcba57..bff08f2 100644
--- a/internal/auth/jwtCookieSession.go
+++ b/internal/auth/jwtCookieSession.go
@@ -12,6 +12,7 @@ import (
 	"net/http"
 	"os"
 
+	"github.com/ClusterCockpit/cc-backend/internal/config"
 	"github.com/ClusterCockpit/cc-backend/internal/repository"
 	"github.com/ClusterCockpit/cc-backend/pkg/log"
 	"github.com/ClusterCockpit/cc-backend/pkg/schema"
@@ -22,15 +23,11 @@ type JWTCookieSessionAuthenticator struct {
 	publicKey           ed25519.PublicKey
 	privateKey          ed25519.PrivateKey
 	publicKeyCrossLogin ed25519.PublicKey // For accepting externally generated JWTs
-
-	config *schema.JWTAuthConfig
 }
 
 var _ Authenticator = (*JWTCookieSessionAuthenticator)(nil)
 
-func (ja *JWTCookieSessionAuthenticator) Init(conf interface{}) error {
-	ja.config = conf.(*schema.JWTAuthConfig)
-
+func (ja *JWTCookieSessionAuthenticator) Init() error {
 	pubKey, privKey := os.Getenv("JWT_PUBLIC_KEY"), os.Getenv("JWT_PRIVATE_KEY")
 	if pubKey == "" || privKey == "" {
 		log.Warn("environment variables 'JWT_PUBLIC_KEY' or 'JWT_PRIVATE_KEY' not set (token based authentication will not work)")
@@ -65,17 +62,18 @@ func (ja *JWTCookieSessionAuthenticator) Init(conf interface{}) error {
 		return errors.New("environment variable 'CROSS_LOGIN_JWT_PUBLIC_KEY' not set (cross login token based authentication will not work)")
 	}
 
+	jc := config.Keys.JwtConfig
 	// Warn if other necessary settings are not configured
-	if ja.config != nil {
-		if ja.config.CookieName == "" {
-			log.Warn("cookieName for JWTs not configured (cross login via JWT cookie will fail)")
+	if jc != nil {
+		if jc.CookieName == "" {
+			log.Info("cookieName for JWTs not configured (cross login via JWT cookie will fail)")
 			return errors.New("cookieName for JWTs not configured (cross login via JWT cookie will fail)")
 		}
-		if !ja.config.ValidateUser {
-			log.Warn("forceJWTValidationViaDatabase not set to true: CC will accept users and roles defined in JWTs regardless of its own database!")
+		if !jc.ValidateUser {
+			log.Info("forceJWTValidationViaDatabase not set to true: CC will accept users and roles defined in JWTs regardless of its own database!")
 		}
-		if ja.config.TrustedIssuer == "" {
-			log.Warn("trustedExternalIssuer for JWTs not configured (cross login via JWT cookie will fail)")
+		if jc.TrustedIssuer == "" {
+			log.Info("trustedExternalIssuer for JWTs not configured (cross login via JWT cookie will fail)")
 			return errors.New("trustedExternalIssuer for JWTs not configured (cross login via JWT cookie will fail)")
 		}
 	} else {
@@ -93,9 +91,10 @@ func (ja *JWTCookieSessionAuthenticator) CanLogin(
 	rw http.ResponseWriter,
 	r *http.Request) (*schema.User, bool) {
 
+	jc := config.Keys.JwtConfig
 	cookieName := ""
-	if ja.config != nil && ja.config.CookieName != "" {
-		cookieName = ja.config.CookieName
+	if jc.CookieName != "" {
+		cookieName = jc.CookieName
 	}
 
 	// Try to read the JWT cookie
@@ -115,7 +114,8 @@ func (ja *JWTCookieSessionAuthenticator) Login(
 	rw http.ResponseWriter,
 	r *http.Request) (*schema.User, error) {
 
-	jwtCookie, err := r.Cookie(ja.config.CookieName)
+	jc := config.Keys.JwtConfig
+	jwtCookie, err := r.Cookie(jc.CookieName)
 	var rawtoken string
 
 	if err == nil && jwtCookie.Value != "" {
@@ -128,7 +128,7 @@ func (ja *JWTCookieSessionAuthenticator) Login(
 		}
 
 		unvalidatedIssuer, success := t.Claims.(jwt.MapClaims)["iss"].(string)
-		if success && unvalidatedIssuer == ja.config.TrustedIssuer {
+		if success && unvalidatedIssuer == jc.TrustedIssuer {
 			// The (unvalidated) issuer seems to be the expected one,
 			// use public cross login key from config
 			return ja.publicKeyCrossLogin, nil
@@ -167,7 +167,7 @@ func (ja *JWTCookieSessionAuthenticator) Login(
 
 	var roles []string
 
-	if ja.config.ValidateUser {
+	if jc.ValidateUser {
 		// Deny any logins for unknown usernames
 		if user == nil {
 			log.Warn("Could not find user from JWT in internal database.")
@@ -189,7 +189,7 @@ func (ja *JWTCookieSessionAuthenticator) Login(
 
 	// (Ask browser to) Delete JWT cookie
 	deletedCookie := &http.Cookie{
-		Name:     ja.config.CookieName,
+		Name:     jc.CookieName,
 		Value:    "",
 		Path:     "/",
 		MaxAge:   -1,
@@ -208,7 +208,7 @@ func (ja *JWTCookieSessionAuthenticator) Login(
 			AuthSource: schema.AuthViaToken,
 		}
 
-		if ja.config.SyncUserOnLogin {
+		if jc.SyncUserOnLogin {
 			if err := repository.GetUserRepository().AddUser(user); err != nil {
 				log.Errorf("Error while adding user '%s' to DB", user.Username)
 			}
diff --git a/internal/auth/jwtSession.go b/internal/auth/jwtSession.go
index f68de90..2aa194d 100644
--- a/internal/auth/jwtSession.go
+++ b/internal/auth/jwtSession.go
@@ -12,6 +12,7 @@ import (
 	"os"
 	"strings"
 
+	"github.com/ClusterCockpit/cc-backend/internal/config"
 	"github.com/ClusterCockpit/cc-backend/internal/repository"
 	"github.com/ClusterCockpit/cc-backend/pkg/log"
 	"github.com/ClusterCockpit/cc-backend/pkg/schema"
@@ -20,15 +21,11 @@ import (
 
 type JWTSessionAuthenticator struct {
 	loginTokenKey []byte // HS256 key
-
-	config *schema.JWTAuthConfig
 }
 
 var _ Authenticator = (*JWTSessionAuthenticator)(nil)
 
-func (ja *JWTSessionAuthenticator) Init(conf interface{}) error {
-	ja.config = conf.(*schema.JWTAuthConfig)
-
+func (ja *JWTSessionAuthenticator) Init() error {
 	if pubKey := os.Getenv("CROSS_LOGIN_JWT_HS512_KEY"); pubKey != "" {
 		bytes, err := base64.StdEncoding.DecodeString(pubKey)
 		if err != nil {
@@ -96,7 +93,7 @@ func (ja *JWTSessionAuthenticator) Login(
 
 	var roles []string
 
-	if ja.config.ValidateUser {
+	if config.Keys.JwtConfig.ValidateUser {
 		// Deny any logins for unknown usernames
 		if user == nil {
 			log.Warn("Could not find user from JWT in internal database.")
@@ -142,7 +139,7 @@ func (ja *JWTSessionAuthenticator) Login(
 			AuthSource: schema.AuthViaToken,
 		}
 
-		if ja.config.SyncUserOnLogin {
+		if config.Keys.JwtConfig.SyncUserOnLogin {
 			if err := repository.GetUserRepository().AddUser(user); err != nil {
 				log.Errorf("Error while adding user '%s' to DB", user.Username)
 			}
diff --git a/internal/auth/ldap.go b/internal/auth/ldap.go
index 529179e..6a8c483 100644
--- a/internal/auth/ldap.go
+++ b/internal/auth/ldap.go
@@ -12,6 +12,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/ClusterCockpit/cc-backend/internal/config"
 	"github.com/ClusterCockpit/cc-backend/internal/repository"
 	"github.com/ClusterCockpit/cc-backend/pkg/log"
 	"github.com/ClusterCockpit/cc-backend/pkg/schema"
@@ -19,25 +20,22 @@ import (
 )
 
 type LdapAuthenticator struct {
-	config       *schema.LdapConfig
 	syncPassword string
 }
 
 var _ Authenticator = (*LdapAuthenticator)(nil)
 
-func (la *LdapAuthenticator) Init(conf interface{}) error {
-
-	la.config = conf.(*schema.LdapConfig)
-
+func (la *LdapAuthenticator) Init() error {
 	la.syncPassword = os.Getenv("LDAP_ADMIN_PASSWORD")
 	if la.syncPassword == "" {
 		log.Warn("environment variable 'LDAP_ADMIN_PASSWORD' not set (ldap sync will not work)")
 	}
 
-	if la.config != nil && la.config.SyncInterval != "" {
-		interval, err := time.ParseDuration(la.config.SyncInterval)
+	if config.Keys.LdapConfig.SyncInterval != "" {
+		interval, err := time.ParseDuration(config.Keys.LdapConfig.SyncInterval)
 		if err != nil {
-			log.Warnf("Could not parse duration for sync interval: %v", la.config.SyncInterval)
+			log.Warnf("Could not parse duration for sync interval: %v",
+				config.Keys.LdapConfig.SyncInterval)
 			return err
 		}
 
@@ -57,7 +55,7 @@ func (la *LdapAuthenticator) Init(conf interface{}) error {
 			}
 		}()
 	} else {
-		log.Info("Missing LDAP configuration key sync_interval")
+		log.Info("LDAP configuration key sync_interval invalid")
 	}
 
 	return nil
@@ -69,12 +67,14 @@ func (la *LdapAuthenticator) CanLogin(
 	rw http.ResponseWriter,
 	r *http.Request) (*schema.User, bool) {
 
+	lc := config.Keys.LdapConfig
+
 	if user != nil {
 		if user.AuthSource == schema.AuthViaLDAP {
 			return user, true
 		}
 	} else {
-		if la.config.SyncUserOnLogin {
+		if lc.SyncUserOnLogin {
 			l, err := la.getLdapConnection(true)
 			if err != nil {
 				log.Error("LDAP connection error")
@@ -83,9 +83,9 @@ func (la *LdapAuthenticator) CanLogin(
 
 			// Search for the given username
 			searchRequest := ldap.NewSearchRequest(
-				la.config.UserBase,
+				lc.UserBase,
 				ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
-				fmt.Sprintf("(&%s(uid=%s))", la.config.UserFilter, username),
+				fmt.Sprintf("(&%s(uid=%s))", lc.UserFilter, username),
 				[]string{"dn", "uid", "gecos"}, nil)
 
 			sr, err := l.Search(searchRequest)
@@ -138,7 +138,7 @@ func (la *LdapAuthenticator) Login(
 	}
 	defer l.Close()
 
-	userDn := strings.Replace(la.config.UserBind, "{username}", user.Username, -1)
+	userDn := strings.Replace(config.Keys.LdapConfig.UserBind, "{username}", user.Username, -1)
 	if err := l.Bind(userDn, r.FormValue("password")); err != nil {
 		log.Errorf("AUTH/LOCAL > Authentication for user %s failed: %v",
 			user.Username, err)
@@ -153,6 +153,7 @@ func (la *LdapAuthenticator) Sync() error {
 	const IN_LDAP int = 2
 	const IN_BOTH int = 3
 	ur := repository.GetUserRepository()
+	lc := config.Keys.LdapConfig
 
 	users := map[string]int{}
 	usernames, err := ur.GetLdapUsernames()
@@ -172,9 +173,9 @@ func (la *LdapAuthenticator) Sync() error {
 	defer l.Close()
 
 	ldapResults, err := l.Search(ldap.NewSearchRequest(
-		la.config.UserBase,
+		lc.UserBase,
 		ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
-		la.config.UserFilter,
+		lc.UserFilter,
 		[]string{"dn", "uid", "gecos"}, nil))
 	if err != nil {
 		log.Warn("LDAP search error")
@@ -198,7 +199,7 @@ func (la *LdapAuthenticator) Sync() error {
 	}
 
 	for username, where := range users {
-		if where == IN_DB && la.config.SyncDelOldUsers {
+		if where == IN_DB && lc.SyncDelOldUsers {
 			ur.DelUser(username)
 			log.Debugf("sync: remove %v (does not show up in LDAP anymore)", username)
 		} else if where == IN_LDAP {
@@ -231,14 +232,15 @@ func (la *LdapAuthenticator) Sync() error {
 // that so that connections can be reused/cached.
 func (la *LdapAuthenticator) getLdapConnection(admin bool) (*ldap.Conn, error) {
 
-	conn, err := ldap.DialURL(la.config.Url)
+	lc := config.Keys.LdapConfig
+	conn, err := ldap.DialURL(lc.Url)
 	if err != nil {
 		log.Warn("LDAP URL dial failed")
 		return nil, err
 	}
 
 	if admin {
-		if err := conn.Bind(la.config.SearchDN, la.syncPassword); err != nil {
+		if err := conn.Bind(lc.SearchDN, la.syncPassword); err != nil {
 			conn.Close()
 			log.Warn("LDAP connection bind failed")
 			return nil, err
diff --git a/internal/auth/local.go b/internal/auth/local.go
index dd6ec2c..002e676 100644
--- a/internal/auth/local.go
+++ b/internal/auth/local.go
@@ -19,9 +19,7 @@ type LocalAuthenticator struct {
 
 var _ Authenticator = (*LocalAuthenticator)(nil)
 
-func (la *LocalAuthenticator) Init(
-	_ interface{}) error {
-
+func (la *LocalAuthenticator) Init() error {
 	return nil
 }
 
diff --git a/internal/config/config.go b/internal/config/config.go
index 02a0ba6..08d01c6 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -22,7 +22,6 @@ var Keys schema.ProgramConfig = schema.ProgramConfig{
 	Archive:                   json.RawMessage(`{\"kind\":\"file\",\"path\":\"./var/job-archive\"}`),
 	DisableArchive:            false,
 	Validate:                  false,
-	LdapConfig:                nil,
 	SessionMaxAge:             "168h",
 	StopJobsExceedingWalltime: 0,
 	ShortRunningJobsDuration:  5 * 60,

From da551a0bb4544b3bc6eab7b784cd4339fa0f3879 Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan@moebiusband.org>
Date: Fri, 18 Aug 2023 11:00:13 +0200
Subject: [PATCH 55/62] Repair broken error handlng

---
 internal/auth/auth.go | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/internal/auth/auth.go b/internal/auth/auth.go
index 8c9beef..77f2165 100644
--- a/internal/auth/auth.go
+++ b/internal/auth/auth.go
@@ -122,14 +122,14 @@ func Init() (*Authentication, error) {
 
 		jwtSessionAuth := &JWTSessionAuthenticator{}
 		if err := jwtSessionAuth.Init(); err != nil {
-            log.Info("jwtSessionAuth init failed: No JWT login support!")
+			log.Info("jwtSessionAuth init failed: No JWT login support!")
 		} else {
 			auth.authenticators = append(auth.authenticators, jwtSessionAuth)
 		}
 
 		jwtCookieSessionAuth := &JWTCookieSessionAuthenticator{}
 		if err := jwtCookieSessionAuth.Init(); err != nil {
-            log.Info("jwtCookieSessionAuth init failed: No JWT cookie login support!")
+			log.Info("jwtCookieSessionAuth init failed: No JWT cookie login support!")
 		} else {
 			auth.authenticators = append(auth.authenticators, jwtCookieSessionAuth)
 		}
@@ -152,11 +152,11 @@ func (auth *Authentication) Login(
 	onfailure func(rw http.ResponseWriter, r *http.Request, loginErr error)) http.Handler {
 
 	return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
-		err := errors.New("no authenticator applied")
 		username := r.FormValue("username")
 		var dbUser *schema.User
 
 		if username != "" {
+			var err error
 			dbUser, err = repository.GetUserRepository().GetUser(username)
 			if err != nil && err != sql.ErrNoRows {
 				log.Errorf("Error while loading user '%v'", username)
@@ -170,7 +170,7 @@ func (auth *Authentication) Login(
 				continue
 			}
 
-			user, err = authenticator.Login(user, rw, r)
+			user, err := authenticator.Login(user, rw, r)
 			if err != nil {
 				log.Warnf("user login failed: %s", err.Error())
 				onfailure(rw, r, err)
@@ -203,7 +203,7 @@ func (auth *Authentication) Login(
 		}
 
 		log.Debugf("login failed: no authenticator applied")
-		onfailure(rw, r, err)
+		onfailure(rw, r, errors.New("no authenticator applied"))
 	})
 }
 

From 57bda635069b9b4ff605c305ebc680729034dd5e Mon Sep 17 00:00:00 2001
From: Christoph Kluge <christoph.kluge@fau.de>
Date: Fri, 18 Aug 2023 11:17:31 +0200
Subject: [PATCH 56/62] Cleanup some error strings

---
 docs/dev-authentication.md  | 6 +++---
 internal/auth/jwtSession.go | 2 +-
 internal/auth/ldap.go       | 4 ++--
 internal/auth/local.go      | 2 +-
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/docs/dev-authentication.md b/docs/dev-authentication.md
index 9b84c4b..4107d61 100644
--- a/docs/dev-authentication.md
+++ b/docs/dev-authentication.md
@@ -65,7 +65,7 @@ the user database table:
 ```
 if e := bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(r.FormValue("password"))); e != nil {
 	log.Errorf("AUTH/LOCAL > Authentication for user %s failed!", user.Username)
-	return nil, fmt.Errorf("AUTH/LOCAL > Authentication failed")
+	return nil, fmt.Errorf("Authentication failed")
 }
 ```
 
@@ -79,8 +79,8 @@ return user != nil && user.AuthSource == AuthViaLDAP
 Gets the LDAP connection and tries a bind with the provided credentials:
 ```
 if err := l.Bind(userDn, r.FormValue("password")); err != nil {
-	log.Errorf("AUTH/LOCAL > Authentication for user %s failed: %v", user.Username, err)
-	return nil, fmt.Errorf("AUTH/LDAP > Authentication failed")
+	log.Errorf("AUTH/LDAP > Authentication for user %s failed: %v", user.Username, err)
+	return nil, fmt.Errorf("Authentication failed")
 }
 ```
 
diff --git a/internal/auth/jwtSession.go b/internal/auth/jwtSession.go
index f68de90..10c5719 100644
--- a/internal/auth/jwtSession.go
+++ b/internal/auth/jwtSession.go
@@ -66,7 +66,7 @@ func (ja *JWTSessionAuthenticator) Login(
 		if t.Method == jwt.SigningMethodHS256 || t.Method == jwt.SigningMethodHS512 {
 			return ja.loginTokenKey, nil
 		}
-		return nil, fmt.Errorf("AUTH/JWT > unkown signing method for login token: %s (known: HS256, HS512, EdDSA)", t.Method.Alg())
+		return nil, fmt.Errorf("unkown signing method for login token: %s (known: HS256, HS512, EdDSA)", t.Method.Alg())
 	})
 	if err != nil {
 		log.Warn("Error while parsing jwt token")
diff --git a/internal/auth/ldap.go b/internal/auth/ldap.go
index 529179e..a55f6b7 100644
--- a/internal/auth/ldap.go
+++ b/internal/auth/ldap.go
@@ -140,9 +140,9 @@ func (la *LdapAuthenticator) Login(
 
 	userDn := strings.Replace(la.config.UserBind, "{username}", user.Username, -1)
 	if err := l.Bind(userDn, r.FormValue("password")); err != nil {
-		log.Errorf("AUTH/LOCAL > Authentication for user %s failed: %v",
+		log.Errorf("AUTH/LDAP > Authentication for user %s failed: %v",
 			user.Username, err)
-		return nil, fmt.Errorf("AUTH/LDAP > Authentication failed")
+		return nil, fmt.Errorf("Authentication failed")
 	}
 
 	return user, nil
diff --git a/internal/auth/local.go b/internal/auth/local.go
index dd6ec2c..06a9219 100644
--- a/internal/auth/local.go
+++ b/internal/auth/local.go
@@ -42,7 +42,7 @@ func (la *LocalAuthenticator) Login(
 	if e := bcrypt.CompareHashAndPassword([]byte(user.Password),
 		[]byte(r.FormValue("password"))); e != nil {
 		log.Errorf("AUTH/LOCAL > Authentication for user %s failed!", user.Username)
-		return nil, fmt.Errorf("AUTH/LOCAL > Authentication failed")
+		return nil, fmt.Errorf("Authentication failed")
 	}
 
 	return user, nil

From 3028f60807281e31609ba783fc1484598b1d825e Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan@moebiusband.org>
Date: Fri, 18 Aug 2023 11:59:16 +0200
Subject: [PATCH 57/62] Reformat and add debug output

---
 cmd/cc-backend/main.go | 22 ++++++++++++----------
 internal/auth/auth.go  |  2 ++
 2 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/cmd/cc-backend/main.go b/cmd/cc-backend/main.go
index e165092..e51791f 100644
--- a/cmd/cc-backend/main.go
+++ b/cmd/cc-backend/main.go
@@ -342,6 +342,7 @@ func main() {
 	// Those should be mounted to this subrouter. If authentication is enabled, a middleware will prevent
 	// any unauthenticated accesses.
 	secured := r.PathPrefix("/").Subrouter()
+
 	if !config.Keys.DisableAuthentication {
 		r.Handle("/login", authentication.Login(
 			// On success:
@@ -359,16 +360,17 @@ func main() {
 				})
 			})).Methods(http.MethodPost)
 
-		r.Handle("/logout", authentication.Logout(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
-			rw.Header().Add("Content-Type", "text/html; charset=utf-8")
-			rw.WriteHeader(http.StatusOK)
-			web.RenderTemplate(rw, "login.tmpl", &web.Page{
-				Title:   "Bye - ClusterCockpit",
-				MsgType: "alert-info",
-				Message: "Logout successful",
-				Build:   buildInfo,
-			})
-		}))).Methods(http.MethodPost)
+		r.Handle("/logout", authentication.Logout(
+			http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+				rw.Header().Add("Content-Type", "text/html; charset=utf-8")
+				rw.WriteHeader(http.StatusOK)
+				web.RenderTemplate(rw, "login.tmpl", &web.Page{
+					Title:   "Bye - ClusterCockpit",
+					MsgType: "alert-info",
+					Message: "Logout successful",
+					Build:   buildInfo,
+				})
+			}))).Methods(http.MethodPost)
 
 		secured.Use(func(next http.Handler) http.Handler {
 			return authentication.Auth(
diff --git a/internal/auth/auth.go b/internal/auth/auth.go
index 77f2165..92b777b 100644
--- a/internal/auth/auth.go
+++ b/internal/auth/auth.go
@@ -168,6 +168,8 @@ func (auth *Authentication) Login(
 			var user *schema.User
 			if user, ok = authenticator.CanLogin(dbUser, username, rw, r); !ok {
 				continue
+			} else {
+				log.Debugf("Can login with user %v", user)
 			}
 
 			user, err := authenticator.Login(user, rw, r)

From e99d1a1e90ec29c93796d55e7476b9746a80c57c Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan@moebiusband.org>
Date: Fri, 18 Aug 2023 14:02:21 +0200
Subject: [PATCH 58/62] Add endpoint for jwt session login

---
 cmd/cc-backend/main.go | 24 +++++++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/cmd/cc-backend/main.go b/cmd/cc-backend/main.go
index e51791f..5a50dce 100644
--- a/cmd/cc-backend/main.go
+++ b/cmd/cc-backend/main.go
@@ -109,6 +109,13 @@ var (
 	version string
 )
 
+// ErrorResponse model
+type ErrorResponse struct {
+	// Statustext of Errorcode
+	Status string `json:"status"`
+	Error  string `json:"error"` // Error Message
+}
+
 func initEnv() {
 	if util.CheckFileExists("var") {
 		fmt.Print("Directory ./var already exists. Exiting!\n")
@@ -338,9 +345,6 @@ func main() {
 		web.RenderTemplate(rw, "privacy.tmpl", &web.Page{Title: "Privacy", Build: buildInfo})
 	})
 
-	// Some routes, such as /login or /query, should only be accessible to a user that is logged in.
-	// Those should be mounted to this subrouter. If authentication is enabled, a middleware will prevent
-	// any unauthenticated accesses.
 	secured := r.PathPrefix("/").Subrouter()
 
 	if !config.Keys.DisableAuthentication {
@@ -360,6 +364,20 @@ func main() {
 				})
 			})).Methods(http.MethodPost)
 
+		r.Handle("/jwt-login", authentication.Login(
+			// On success:
+			http.RedirectHandler("/", http.StatusTemporaryRedirect),
+
+			// On failure:
+			func(rw http.ResponseWriter, r *http.Request, err error) {
+				rw.Header().Add("Content-Type", "application/json")
+				rw.WriteHeader(http.StatusForbidden)
+				json.NewEncoder(rw).Encode(ErrorResponse{
+					Status: http.StatusText(http.StatusForbidden),
+					Error:  err.Error(),
+				})
+			})).Methods(http.MethodGet)
+
 		r.Handle("/logout", authentication.Logout(
 			http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 				rw.Header().Add("Content-Type", "text/html; charset=utf-8")

From c87db1dfe6ed70e9834c9f7d4a9079d52b1d6d3c Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan@moebiusband.org>
Date: Fri, 18 Aug 2023 14:03:52 +0200
Subject: [PATCH 59/62] login for all Methods

---
 cmd/cc-backend/main.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cmd/cc-backend/main.go b/cmd/cc-backend/main.go
index 5a50dce..93786ca 100644
--- a/cmd/cc-backend/main.go
+++ b/cmd/cc-backend/main.go
@@ -376,7 +376,7 @@ func main() {
 					Status: http.StatusText(http.StatusForbidden),
 					Error:  err.Error(),
 				})
-			})).Methods(http.MethodGet)
+			}))
 
 		r.Handle("/logout", authentication.Logout(
 			http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {

From 9fec8a482234642f8aa2a01afb32bcd9165055d7 Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan@moebiusband.org>
Date: Fri, 18 Aug 2023 14:29:24 +0200
Subject: [PATCH 60/62] Change to html output for jwt-login

---
 cmd/cc-backend/main.go | 19 +++++++------------
 1 file changed, 7 insertions(+), 12 deletions(-)

diff --git a/cmd/cc-backend/main.go b/cmd/cc-backend/main.go
index 93786ca..e956503 100644
--- a/cmd/cc-backend/main.go
+++ b/cmd/cc-backend/main.go
@@ -109,13 +109,6 @@ var (
 	version string
 )
 
-// ErrorResponse model
-type ErrorResponse struct {
-	// Statustext of Errorcode
-	Status string `json:"status"`
-	Error  string `json:"error"` // Error Message
-}
-
 func initEnv() {
 	if util.CheckFileExists("var") {
 		fmt.Print("Directory ./var already exists. Exiting!\n")
@@ -370,11 +363,13 @@ func main() {
 
 			// On failure:
 			func(rw http.ResponseWriter, r *http.Request, err error) {
-				rw.Header().Add("Content-Type", "application/json")
-				rw.WriteHeader(http.StatusForbidden)
-				json.NewEncoder(rw).Encode(ErrorResponse{
-					Status: http.StatusText(http.StatusForbidden),
-					Error:  err.Error(),
+				rw.Header().Add("Content-Type", "text/html; charset=utf-8")
+				rw.WriteHeader(http.StatusUnauthorized)
+				web.RenderTemplate(rw, "login.tmpl", &web.Page{
+					Title:   "Login failed - ClusterCockpit",
+					MsgType: "alert-warning",
+					Message: err.Error(),
+					Build:   buildInfo,
 				})
 			}))
 

From ebcae32e2310dd4b08dce0070f8110de1e921f70 Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan@moebiusband.org>
Date: Fri, 18 Aug 2023 15:56:11 +0200
Subject: [PATCH 61/62] Update docs and cleanup

---
 docs/dev-authentication.md | 44 +++++++++++++++++++++++++-------------
 internal/auth/auth.go      | 22 ++-----------------
 internal/auth/ldap.go      |  2 --
 3 files changed, 31 insertions(+), 37 deletions(-)

diff --git a/docs/dev-authentication.md b/docs/dev-authentication.md
index 4107d61..4346e97 100644
--- a/docs/dev-authentication.md
+++ b/docs/dev-authentication.md
@@ -16,6 +16,9 @@ The most important routines in auth are:
 The http router calls auth in the following cases:
 * `r.Handle("/login", authentication.Login( ... )).Methods(http.MethodPost)`:
   The POST request on the `/login` route will call the Login callback.
+* `r.Handle("/jwt-login", authentication.Login( ... ))`:
+  Any request on the `/jwt-login` route will call the Login callback. Intended
+  for use for the JWT token based authenticators.
 * Any route in the secured subrouter will always call Auth(), on success it will
   call the next handler in the chain, on failure it will render the login
   template.
@@ -50,7 +53,6 @@ The Login function (located in `auth.go`):
     object is returned.
   - Creates a new session object, stores the user attributes in the session and
     saves the session.
-  - If the user does not yet exist in the database try to add the user
   - Starts the `onSuccess` http handler
 
 ## Local authenticator
@@ -71,11 +73,20 @@ if e := bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(r.FormValue(
 
 ## LDAP authenticator
 
-This authenticator is applied if 
+This authenticator is applied if the user was found in the database and its
+AuthSource is LDAP:
 ```
-return user != nil && user.AuthSource == AuthViaLDAP
+if user != nil {
+	if user.AuthSource == schema.AuthViaLDAP {
+		return user, true
+	}
+} 
 ```
 
+If the option `SyncUserOnLogin` is set it tried to sync the user from the LDAP
+directory. In case this succeeds the user is persisted to the database and can
+login.
+
 Gets the LDAP connection and tries a bind with the provided credentials:
 ```
 if err := l.Bind(userDn, r.FormValue("password")); err != nil {
@@ -88,33 +99,34 @@ if err := l.Bind(userDn, r.FormValue("password")); err != nil {
 
 Login via JWT token will create a session without password.
 For login the `X-Auth-Token` header is not supported. This authenticator is
-applied if the Authorization header is present:
+applied if the Authorization header or query parameter login-token is present:
 ```
-	return r.Header.Get("Authorization") != ""
+	return user, r.Header.Get("Authorization") != "" ||
+		r.URL.Query().Get("login-token") != ""
 ```
 
 The Login function:
-* Parses the token
+* Parses the token and checks if it is expired
 * Check if the signing method is EdDSA or HS256 or HS512
 * Check if claims are valid and extracts the claims
 * The following claims have to be present:
    - `sub`: The subject, in this case this is the username
    - `exp`: Expiration in Unix epoch time
    - `roles`: String array with roles of user
-* In case user is not yet set, which is usually the case:
-   - Try to fetch user from database
-   - In case user is not yet present add user to user database table with `AuthViaToken` AuthSource.
+* In case user does not exist in the database and the option `SyncUserOnLogin`
+  is set add user to user database table with `AuthViaToken` AuthSource.
 * Return valid user object
 
 ## JWT Cookie Session authenticator
 
 Login via JWT cookie token will create a session without password.
-It is first checked if the required configuration keys are set:
-* `publicKeyCrossLogin`
-* `TrustedExternalIssuer`
+It is first checked if the required configuration options are set:
+* `trustedIssuer`
 * `CookieName`
 
- This authenticator is applied if the configured cookie is present:
+and optionally the environment variable `CROSS_LOGIN_JWT_PUBLIC_KEY` is set.
+
+This authenticator is applied if the configured cookie is present:
 ```
 	jwtCookie, err := r.Cookie(cookieName)
 
@@ -131,9 +143,11 @@ The Login function:
    - Return public cross login key
    - Otherwise return standard public key
 * Check if claims are valid
-* Depending on the option `ForceJWTValidationViaDatabase ` the roles are
+* Depending on the option `validateUser` the roles are
   extracted from JWT token or taken from user object fetched from database
 * Ask browser to delete the JWT cookie
+* In case user does not exist in the database and the option `SyncUserOnLogin`
+  is set add user to user database table with `AuthViaToken` AuthSource.
 * Return valid user object
 
 # Auth
@@ -154,7 +168,7 @@ Implemented in JWTAuthenticator:
   prefix
 * Parse token and check if it is valid. The Parse routine will also check if the
   token is expired.
-* If the option `ForceJWTValidationViaDatabase` is set it will ensure the
+* If the option `validateUser` is set it will ensure the
   user object exists in the database and takes the roles from the database user
 * Otherwise the roles are extracted from the roles claim
 * Returns a valid user object with AuthType set to AuthToken
diff --git a/internal/auth/auth.go b/internal/auth/auth.go
index 92b777b..e8f0db4 100644
--- a/internal/auth/auth.go
+++ b/internal/auth/auth.go
@@ -48,26 +48,8 @@ func (auth *Authentication) AuthViaSession(
 	if session.IsNew {
 		return nil, nil
 	}
-	//
-	// var username string
-	// var projects, roles []string
-	//
-	// if val, ok := session.Values["username"]; ok {
-	// 	username, _ = val.(string)
-	// } else {
-	// 	return nil, errors.New("no key username in session")
-	// }
-	// if val, ok := session.Values["projects"]; ok {
-	// 	projects, _ = val.([]string)
-	// } else {
-	// 	return nil, errors.New("no key projects in session")
-	// }
-	// if val, ok := session.Values["projects"]; ok {
-	// 	roles, _ = val.([]string)
-	// } else {
-	// 	return nil, errors.New("no key roles in session")
-	// }
-	//
+
+	// TODO: Check if session keys exist
 	username, _ := session.Values["username"].(string)
 	projects, _ := session.Values["projects"].([]string)
 	roles, _ := session.Values["roles"].([]string)
diff --git a/internal/auth/ldap.go b/internal/auth/ldap.go
index be2aece..f89aede 100644
--- a/internal/auth/ldap.go
+++ b/internal/auth/ldap.go
@@ -228,8 +228,6 @@ func (la *LdapAuthenticator) Sync() error {
 	return nil
 }
 
-// TODO: Add a connection pool or something like
-// that so that connections can be reused/cached.
 func (la *LdapAuthenticator) getLdapConnection(admin bool) (*ldap.Conn, error) {
 
 	lc := config.Keys.LdapConfig

From dc67a1f1031ff8e88a0f0a8fe691424d0007f018 Mon Sep 17 00:00:00 2001
From: Jan Eitzinger <jan@moebiusband.org>
Date: Mon, 21 Aug 2023 08:49:42 +0200
Subject: [PATCH 62/62] Update frontend and backend dependencies

---
 go.mod                                |   32 +-
 go.sum                                |   88 +-
 internal/graph/generated/generated.go | 1758 +++++++++++++++----------
 internal/graph/model/models_gen.go    |   64 +-
 internal/graph/schema.resolvers.go    |    2 +-
 web/frontend/package-lock.json        |   18 +-
 6 files changed, 1154 insertions(+), 808 deletions(-)

diff --git a/go.mod b/go.mod
index 12fc2fd..b0ce960 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module github.com/ClusterCockpit/cc-backend
 go 1.18
 
 require (
-	github.com/99designs/gqlgen v0.17.24
+	github.com/99designs/gqlgen v0.17.36
 	github.com/ClusterCockpit/cc-units v0.4.0
 	github.com/Masterminds/squirrel v1.5.3
 	github.com/go-co-op/gocron v1.25.0
@@ -23,9 +23,9 @@ require (
 	github.com/qustavo/sqlhooks/v2 v2.1.0
 	github.com/santhosh-tekuri/jsonschema/v5 v5.2.0
 	github.com/swaggo/http-swagger v1.3.3
-	github.com/swaggo/swag v1.8.10
-	github.com/vektah/gqlparser/v2 v2.5.1
-	golang.org/x/crypto v0.6.0
+	github.com/swaggo/swag v1.16.1
+	github.com/vektah/gqlparser/v2 v2.5.8
+	golang.org/x/crypto v0.12.0
 	golang.org/x/exp v0.0.0-20230510235704-dd950f8aeaea
 )
 
@@ -40,19 +40,18 @@ require (
 	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
 	github.com/deepmap/oapi-codegen v1.12.4 // indirect
 	github.com/felixge/httpsnoop v1.0.3 // indirect
-	github.com/ghodss/yaml v1.0.0 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.4 // indirect
-	github.com/go-openapi/jsonpointer v0.19.6 // indirect
+	github.com/go-openapi/jsonpointer v0.20.0 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
-	github.com/go-openapi/spec v0.20.8 // indirect
-	github.com/go-openapi/swag v0.22.3 // indirect
+	github.com/go-openapi/spec v0.20.9 // indirect
+	github.com/go-openapi/swag v0.22.4 // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/google/uuid v1.3.0 // indirect
 	github.com/gorilla/securecookie v1.1.1 // indirect
 	github.com/gorilla/websocket v1.5.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/golang-lru v0.5.4 // indirect
+	github.com/hashicorp/golang-lru/v2 v2.0.3 // indirect
 	github.com/influxdata/line-protocol v0.0.0-20210922203350-b1ad95c89adf // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/jpillora/backoff v1.0.0 // indirect
@@ -72,17 +71,18 @@ require (
 	github.com/robfig/cron/v3 v3.0.1 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/swaggo/files v1.0.0 // indirect
-	github.com/urfave/cli/v2 v2.24.4 // indirect
+	github.com/urfave/cli/v2 v2.25.7 // indirect
 	github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 // indirect
 	go.uber.org/atomic v1.10.0 // indirect
-	golang.org/x/mod v0.8.0 // indirect
-	golang.org/x/net v0.7.0 // indirect
+	golang.org/x/mod v0.12.0 // indirect
+	golang.org/x/net v0.14.0 // indirect
 	golang.org/x/oauth2 v0.5.0 // indirect
-	golang.org/x/sys v0.5.0 // indirect
-	golang.org/x/text v0.7.0 // indirect
-	golang.org/x/tools v0.6.0 // indirect
+	golang.org/x/sys v0.11.0 // indirect
+	golang.org/x/text v0.12.0 // indirect
+	golang.org/x/tools v0.12.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/protobuf v1.28.1 // indirect
+	google.golang.org/protobuf v1.30.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
+	sigs.k8s.io/yaml v1.3.0 // indirect
 )
diff --git a/go.sum b/go.sum
index 691fef1..379bda7 100644
--- a/go.sum
+++ b/go.sum
@@ -50,8 +50,8 @@ cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RX
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
 gioui.org v0.0.0-20210308172011-57750fc8a0a6/go.mod h1:RSH6KIUZ0p2xy5zHDxgAM4zumjgTw83q2ge/PI+yyw8=
-github.com/99designs/gqlgen v0.17.24 h1:pcd/HFIoSdRvyADYQG2dHvQN2KZqX/nXzlVm6TMMq7E=
-github.com/99designs/gqlgen v0.17.24/go.mod h1:BMhYIhe4bp7OlCo5I2PnowSK/Wimpv/YlxfNkqZGwLo=
+github.com/99designs/gqlgen v0.17.36 h1:u/o/rv2SZ9s5280dyUOOrkpIIkr/7kITMXYD3rkJ9go=
+github.com/99designs/gqlgen v0.17.36/go.mod h1:6RdyY8puhCoWAQVr2qzF2OMVfudQzc8ACxzpzluoQm4=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20210715213245-6c3934b029d8/go.mod h1:CzsSbkDixRphAF5hS6wbMKq0eI6ccJRb7/A0M6JBnwg=
 github.com/Azure/azure-pipeline-go v0.2.3/go.mod h1:x841ezTBIMG6O3lAcl8ATHnsOPVl2bqk7S3ta6S6u4k=
 github.com/Azure/azure-sdk-for-go v16.2.1+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
@@ -78,7 +78,6 @@ github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e/go.mod h1:chxPXzS
 github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
 github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/toml v1.1.0/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/ClickHouse/clickhouse-go v1.4.3/go.mod h1:EaI/sW7Azgz9UATzd5ZdZHRUhHgv5+JMS9NSr2smCJI=
 github.com/ClusterCockpit/cc-units v0.4.0 h1:zP5DOu99GmErW0tCDf0gcLrlWt42RQ9dpoONEOh4cI0=
@@ -120,7 +119,6 @@ github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdko
 github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
 github.com/RaveNoX/go-jsoncommentstrip v1.0.0/go.mod h1:78ihd09MekBnJnxpICcwzCMzGrKSKYe4AqU6PDYYpjk=
 github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d/go.mod h1:HI8ITrYtUY+O+ZhtlqUnD8+KwNPOyugEhfP9fdUIaEQ=
-github.com/agnivade/levenshtein v1.0.1/go.mod h1:CURSv5d9Uaml+FovSIICkLbAUZ9S4RqaHDIsdSBg7lM=
 github.com/agnivade/levenshtein v1.1.1 h1:QY8M92nrzkmr798gCo3kmMyqXFzdQVpxLlGPRBij0P8=
 github.com/agnivade/levenshtein v1.1.1/go.mod h1:veldBMzWxcCG2ZvUTKD2kJNRdCk5hVbJomOvKkmgYbo=
 github.com/ajstarks/svgo v0.0.0-20180226025133-644b8db467af/go.mod h1:K08gAheRH3/J6wwsYMMT4xOr94bZjxIelGM0+d/wbFw=
@@ -355,7 +353,6 @@ github.com/coreos/pkg v0.0.0-20160727233714-3ac0863d7acf/go.mod h1:E3G3o1h8I7cfc
 github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
 github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
-github.com/cpuguy83/go-md2man/v2 v2.0.1/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/cpuguy83/go-md2man/v2 v2.0.2 h1:p1EgwI/C7NhT0JmVkwCD2ZBK8j4aeHQX2pMHHBfMQ6w=
 github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
@@ -442,7 +439,6 @@ github.com/gabriel-vasile/mimetype v1.4.0/go.mod h1:fA8fi6KUiG7MgQQ+mEWotXoEOvmx
 github.com/garyburd/redigo v0.0.0-20150301180006-535138d7bcd7/go.mod h1:NR3MbYisc3/PwhQ00EMzDiPmrwpPxAn5GI05/YaO1SY=
 github.com/getsentry/raven-go v0.2.0/go.mod h1:KungGk8q33+aIAZUIVWZDr2OfAEBsO49PX4NzFV5kcQ=
 github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/go-asn1-ber/asn1-ber v1.5.4 h1:vXT6d/FNDiELJnLb6hGNa309LMsrCoYFvpwHDF0+Y1A=
 github.com/go-asn1-ber/asn1-ber v1.5.4/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
@@ -477,8 +473,9 @@ github.com/go-openapi/jsonpointer v0.0.0-20160704185906-46af16f9f7b1/go.mod h1:+
 github.com/go-openapi/jsonpointer v0.19.2/go.mod h1:3akKfEdA7DF1sugOqz1dVQHBcuDBPKZGEoHC/NkiQRg=
 github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
 github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
-github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
 github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
+github.com/go-openapi/jsonpointer v0.20.0 h1:ESKJdU9ASRfaPNOPRx12IUyA1vn3R9GiE3KYD14BXdQ=
+github.com/go-openapi/jsonpointer v0.20.0/go.mod h1:6PGzBjjIIumbLYysB73Klnms1mwnU4G3YHOECG3CedA=
 github.com/go-openapi/jsonreference v0.0.0-20160704190145-13c6e3589ad9/go.mod h1:W3Z9FmVs9qj+KR4zFKmDPGiLdk1D9Rlm7cyMvf57TTg=
 github.com/go-openapi/jsonreference v0.19.2/go.mod h1:jMjeRr2HHw6nAVajTXJ4eiUwohSTlpa0o73RUL1owJc=
 github.com/go-openapi/jsonreference v0.19.3/go.mod h1:rjx6GuL8TTa9VaixXglHmQmIL98+wF9xc8zWvFonSJ8=
@@ -488,15 +485,16 @@ github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2Kv
 github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
 github.com/go-openapi/spec v0.0.0-20160808142527-6aced65f8501/go.mod h1:J8+jY1nAiCcj+friV/PDoE1/3eeccG9LYBs0tYvLOWc=
 github.com/go-openapi/spec v0.19.3/go.mod h1:FpwSN1ksY1eteniUU7X0N/BgJ7a4WvBFVA8Lj9mJglo=
-github.com/go-openapi/spec v0.20.8 h1:ubHmXNY3FCIOinT8RNrrPfGc9t7I1qhPtdOGoG2AxRU=
-github.com/go-openapi/spec v0.20.8/go.mod h1:2OpW+JddWPrpXSCIX8eOx7lZ5iyuWj3RYR6VaaBKcWA=
+github.com/go-openapi/spec v0.20.9 h1:xnlYNQAwKd2VQRRfwTEI0DcK+2cbuvI/0c7jx3gA8/8=
+github.com/go-openapi/spec v0.20.9/go.mod h1:2OpW+JddWPrpXSCIX8eOx7lZ5iyuWj3RYR6VaaBKcWA=
 github.com/go-openapi/swag v0.0.0-20160704191624-1d0bd113de87/go.mod h1:DXUve3Dpr1UfpPtxFw+EFuQ41HhCWZfha5jSVRG7C7I=
 github.com/go-openapi/swag v0.19.2/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
 github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
 github.com/go-openapi/swag v0.19.14/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
 github.com/go-openapi/swag v0.19.15/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
-github.com/go-openapi/swag v0.22.3 h1:yMBqmnQ0gyZvEb/+KzuWZOXgllrXT4SADYbvDaXHv/g=
 github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
+github.com/go-openapi/swag v0.22.4 h1:QLMzNJnMGPRNDCbySlcj1x01tzU8/9LTTL9hZZZogBU=
+github.com/go-openapi/swag v0.22.4/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
 github.com/go-sql-driver/mysql v1.4.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
@@ -702,8 +700,8 @@ github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/b
 github.com/hashicorp/go.net v0.0.1/go.mod h1:hjKkEWcCURg++eb33jQU7oqQcI9XDCnUzHA0oac0k90=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc=
-github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
+github.com/hashicorp/golang-lru/v2 v2.0.3 h1:kmRrRLlInXvng0SmLxmQpQkpbYAvcXm7NPDrgxJa9mE=
+github.com/hashicorp/golang-lru/v2 v2.0.3/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
 github.com/hashicorp/mdns v1.0.0/go.mod h1:tL+uN++7HEJ6SQLQ2/p+z2pH24WQKWjBPkE0mNTz8vQ=
@@ -808,7 +806,6 @@ github.com/kardianos/osext v0.0.0-20190222173326-2bc1f35cddc0/go.mod h1:1NbS8ALr
 github.com/karrick/godirwalk v1.8.0/go.mod h1:H5KPZjojv4lE+QYImBI8xVtrBRgYrIVsaRPx4tDPEn4=
 github.com/karrick/godirwalk v1.10.3/go.mod h1:RoGL9dQei4vP9ilrpETWE8CLOZ1kiN0LhBygSwrAsHA=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
-github.com/kevinmbeaulieu/eq-go v1.0.0/go.mod h1:G3S8ajA56gKBZm4UB9AOyoOS37JO3roToPzKNM8dtdM=
 github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
 github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
@@ -827,7 +824,7 @@ github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFB
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/pty v1.1.5/go.mod h1:9r2w37qlBe7rQ6e1fg1S/9xpWHSnaqNdHD3WcMdbPDA=
 github.com/kr/pty v1.1.8/go.mod h1:O1sed60cT9XZ5uDucP5qwvh+TE3NnUj51EiZO/lmSfw=
@@ -847,7 +844,6 @@ github.com/lib/pq v1.8.0/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/lib/pq v1.10.0 h1:Zx5DJFEYQXio93kgXnQ09fXNiUKsqv4OUEu2UtGcB1E=
 github.com/lib/pq v1.10.0/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/linuxkit/virtsock v0.0.0-20201010232012-f8cee7dfc7a3/go.mod h1:3r6x7q95whyfWQpmGZTu3gk3v2YkMi05HEzl7Tf7YEo=
-github.com/logrusorgru/aurora/v3 v3.0.0/go.mod h1:vsR12bk5grlLvLXAYrBsb5Oc/N+LxAlxggSjiwMnCUc=
 github.com/lyft/protoc-gen-star v0.5.3/go.mod h1:V0xaHgaf5oCCqmcxYcWiDfTiKsZsRc87/1qhoTACD8w=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
@@ -862,12 +858,10 @@ github.com/markbates/oncer v0.0.0-20181203154359-bf2de49a0be2/go.mod h1:Ld9puTsI
 github.com/markbates/pkger v0.15.1/go.mod h1:0JoVlrol20BSywW79rN3kdFFsE5xYM+rSCQDXbLhiuI=
 github.com/markbates/safe v1.0.1/go.mod h1:nAqgmRi7cY2nqMc92/bSEeQA+R4OheNU2T1kNSCBdG0=
 github.com/marstr/guid v1.1.0/go.mod h1:74gB1z2wpxxInTG6yaqA7KrtM0NZ+RbrcqDvYHefzho=
-github.com/matryer/moq v0.2.7/go.mod h1:kITsx543GOENm48TUAQyJ9+SAvFSr7iGQXPoth/VUBk=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
 github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ=
 github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
 github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
-github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-ieproxy v0.0.1/go.mod h1:pYabZ6IHcRpFh7vIaLfK7rdcWgFEb3SFJ6/gNWuh88E=
 github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
@@ -876,7 +870,6 @@ github.com/mattn/go-isatty v0.0.7/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hd
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.9/go.mod h1:YNRxwqDuOph6SZLI9vUUz6OYw3QyUt7WiY2yME+cCiQ=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
-github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/mattn/go-shellwords v1.0.3/go.mod h1:3xCvwCdWdlDJUrvuMn7Wuy9eWs4pE8vqg+NOMyg4B2o=
 github.com/mattn/go-shellwords v1.0.6/go.mod h1:3xCvwCdWdlDJUrvuMn7Wuy9eWs4pE8vqg+NOMyg4B2o=
@@ -1090,8 +1083,8 @@ github.com/sclevine/spec v1.2.0/go.mod h1:W4J29eT/Kzv7/b9IWLB055Z+qvVC9vt0Arko24
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
 github.com/seccomp/libseccomp-golang v0.9.1/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvWlF4P2Ca7zGrPiEpWo=
 github.com/seccomp/libseccomp-golang v0.9.2-0.20210429002308-3879420cc921/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg=
-github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0=
-github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
+github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
+github.com/sergi/go-diff v1.3.1/go.mod h1:aMJSSKb2lpPvRNec0+w3fl7LP9IOFzdc9Pa4NFbPK1I=
 github.com/shopspring/decimal v0.0.0-20180709203117-cd690d0c9e24/go.mod h1:M+9NzErvs504Cn4c5DxATwIqPbtswREoFCre64PpcG4=
 github.com/shopspring/decimal v0.0.0-20200227202807-02e2044944cc/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
 github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
@@ -1150,14 +1143,14 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8=
+github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/swaggo/files v1.0.0 h1:1gGXVIeUFCS/dta17rnP0iOpr6CXFwKD7EO5ID233e4=
 github.com/swaggo/files v1.0.0/go.mod h1:N59U6URJLyU1PQgFqPM7wXLMhJx7QAolnvfQkqO13kc=
 github.com/swaggo/http-swagger v1.3.3 h1:Hu5Z0L9ssyBLofaama21iYaF2VbWyA8jdohaaCGpHsc=
 github.com/swaggo/http-swagger v1.3.3/go.mod h1:sE+4PjD89IxMPm77FnkDz0sdO+p5lbXzrVWT6OTVVGo=
-github.com/swaggo/swag v1.8.10 h1:eExW4bFa52WOjqRzRD58bgWsWfdFJso50lpbeTcmTfo=
-github.com/swaggo/swag v1.8.10/go.mod h1:ezQVUUhly8dludpVk+/PuwJWvLLanB13ygV5Pr9enSk=
+github.com/swaggo/swag v1.16.1 h1:fTNRhKstPKxcnoKsytm4sahr8FaYzUcT7i1/3nd/fBg=
+github.com/swaggo/swag v1.16.1/go.mod h1:9/LMvHycG3NFHfR6LwvikHv5iFvmPADQ359cKikGxto=
 github.com/syndtr/gocapability v0.0.0-20170704070218-db04d3cc01c8/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
 github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
 github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
@@ -1172,11 +1165,10 @@ github.com/urfave/cli v0.0.0-20171014202726-7bc6a0acffa5/go.mod h1:70zkFmudgCuE/
 github.com/urfave/cli v1.20.0/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
 github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
 github.com/urfave/cli v1.22.2/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
-github.com/urfave/cli/v2 v2.8.1/go.mod h1:Z41J9TPoffeoqP0Iza0YbAhGvymRdZAd2uPmZ5JxRdY=
-github.com/urfave/cli/v2 v2.24.4 h1:0gyJJEBYtCV87zI/x2nZCPyDxD51K6xM8SkwjHFCNEU=
-github.com/urfave/cli/v2 v2.24.4/go.mod h1:GHupkWPMM0M/sj1a2b4wUrWBPzazNrIjouW6fmdJLxc=
-github.com/vektah/gqlparser/v2 v2.5.1 h1:ZGu+bquAY23jsxDRcYpWjttRZrUz07LbiY77gUOHcr4=
-github.com/vektah/gqlparser/v2 v2.5.1/go.mod h1:mPgqFBu/woKTVYWyNk8cO3kh4S/f4aRFZrvOnp3hmCs=
+github.com/urfave/cli/v2 v2.25.7 h1:VAzn5oq403l5pHjc4OhD54+XGO9cdKVL/7lDjF+iKUs=
+github.com/urfave/cli/v2 v2.25.7/go.mod h1:8qnjx1vcq5s2/wpsqoZFndg2CE5tNFyrTvS6SinrnYQ=
+github.com/vektah/gqlparser/v2 v2.5.8 h1:pm6WOnGdzFOCfcQo9L3+xzW51mKrlwTEg4Wr7AH1JW4=
+github.com/vektah/gqlparser/v2 v2.5.8/go.mod h1:z8xXUff237NntSuH8mLFijZ+1tjV1swDbpDqjJmk6ME=
 github.com/vishvananda/netlink v0.0.0-20181108222139-023a6dafdcdf/go.mod h1:+SR5DhBJrl6ZM7CoCKvpw5BKroDKQ+PJqOg65H/2ktk=
 github.com/vishvananda/netlink v1.1.0/go.mod h1:cTgwzPIzzgDAYoQrMm0EdrjRUBkTqKYppBueQtXaqoE=
 github.com/vishvananda/netlink v1.1.1-0.20201029203352-d40f9887b852/go.mod h1:twkDnbuQxJYemMlGd4JFIcuhgX83tXhKS2B/PRMpOho=
@@ -1204,7 +1196,6 @@ github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
-github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yvasiyarov/go-metrics v0.0.0-20140926110328-57bccd1ccd43/go.mod h1:aX5oPXxHm3bOH+xeAttToC8pqch2ScQN/JoXYupl6xs=
 github.com/yvasiyarov/gorelic v0.0.0-20141212073537-a9bba5b9ab50/go.mod h1:NUSPSUX/bi6SeDMUh6brw0nXpxHnc96TguQh0+r/ssA=
@@ -1293,8 +1284,8 @@ golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm
 golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.6.0 h1:qfktjS5LUO+fFKeJXZ+ikTRijMmljikvG68fpMMruSc=
-golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
+golang.org/x/crypto v0.12.0 h1:tFM/ta59kqch6LlvYnPa0yx5a83cL2nHflFhYKvv9Yk=
+golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98yw=
 golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -1344,10 +1335,9 @@ golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
-golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.8.0 h1:LUYupSeNrTNCGzR/hVBk2NHZO4hXcVaW1k4Qx7rjPx8=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc=
+golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20180218175443-cbe0f9307d01/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1410,7 +1400,6 @@ golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20210614182718-04defd469f4e/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210825183410-e898025ed96a/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211209124913-491a49abca63/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211216030914-fe4d6282115f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
@@ -1418,8 +1407,8 @@ golang.org/x/net v0.0.0-20220111093109-d55c255bac03/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
-golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g=
-golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.14.0 h1:BONx9s002vGdD9umnlX1Po8vOZmrgH34qlHcD1MfK14=
+golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
 golang.org/x/oauth2 v0.0.0-20180227000427-d7d64896b5ff/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181106182150-f42d05182288/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
@@ -1453,7 +1442,7 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
+golang.org/x/sync v0.3.0 h1:ftCYgMx6zT/asHUrPw8BLLscYtGznsLAnjq5RH9P66E=
 golang.org/x/sys v0.0.0-20180224232135-f6cff0780e54/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1567,7 +1556,6 @@ golang.org/x/sys v0.0.0-20210831042530-f4d43177bf5e/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20210903071746-97244b99971b/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210906170528-6f6e22806c34/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210908233432-aa78b53d3365/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211116061358-0a5406a5449c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -1577,10 +1565,9 @@ golang.org/x/sys v0.0.0-20220111092808-5a964db01320/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220317061510-51cd9980dadf/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.11.0 h1:eG7RXZHdqOJ1i+0lgLgCpSXAp6M3LYlAo6osgSi0xOM=
+golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
@@ -1596,10 +1583,9 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.7.0 h1:4BRB4x83lYWy72KwLD/qYDuTu7q9PjSagHvijDw7cLo=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.12.0 h1:k+n5B8goJNdU7hSvEtMUz3d1Q6D/XW4COJSJR6fN0mc=
+golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1687,10 +1673,9 @@ golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.10/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.6.0 h1:BOw41kyTf3PuCW1pVQf8+Cyg8pMlkYB1oo9iJ6D/lKM=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.12.0 h1:YW6HUoUmYBpwSgyaGaZq1fHjrBjX1rlpZ54T6mu2kss=
+golang.org/x/tools v0.12.0/go.mod h1:Sc0INKfu04TlqNoRA1hgpFZbhYXHPr4V5DzpSBTPqQM=
 golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1865,9 +1850,8 @@ google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlba
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
-google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng=
+google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/airbrake/gobrake.v2 v2.0.9/go.mod h1:/h5ZAUhDkGaJfjzjKLSjv6zCL6O0LLBxU4K+aSYdM/U=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -2002,3 +1986,5 @@ sigs.k8s.io/structured-merge-diff/v4 v4.0.3/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK
 sigs.k8s.io/structured-merge-diff/v4 v4.1.2/go.mod h1:j/nl6xW8vLS49O8YvXW1ocPhZawJtm+Yrr7PPRQ0Vg4=
 sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=
 sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
+sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
+sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=
diff --git a/internal/graph/generated/generated.go b/internal/graph/generated/generated.go
index 229c6b5..1cb8b74 100644
--- a/internal/graph/generated/generated.go
+++ b/internal/graph/generated/generated.go
@@ -332,7 +332,7 @@ func (e *executableSchema) Schema() *ast.Schema {
 }
 
 func (e *executableSchema) Complexity(typeName, field string, childComplexity int, rawArgs map[string]interface{}) (int, bool) {
-	ec := executionContext{nil, e}
+	ec := executionContext{nil, e, 0, 0, nil}
 	_ = ec
 	switch typeName + "." + field {
 
@@ -1439,7 +1439,7 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 func (e *executableSchema) Exec(ctx context.Context) graphql.ResponseHandler {
 	rc := graphql.GetOperationContext(ctx)
-	ec := executionContext{rc, e}
+	ec := executionContext{rc, e, 0, 0, make(chan graphql.DeferredResult)}
 	inputUnmarshalMap := graphql.BuildUnmarshalerMap(
 		ec.unmarshalInputFloatRange,
 		ec.unmarshalInputIntRange,
@@ -1454,18 +1454,33 @@ func (e *executableSchema) Exec(ctx context.Context) graphql.ResponseHandler {
 	switch rc.Operation.Operation {
 	case ast.Query:
 		return func(ctx context.Context) *graphql.Response {
-			if !first {
-				return nil
+			var response graphql.Response
+			var data graphql.Marshaler
+			if first {
+				first = false
+				ctx = graphql.WithUnmarshalerMap(ctx, inputUnmarshalMap)
+				data = ec._Query(ctx, rc.Operation.SelectionSet)
+			} else {
+				if atomic.LoadInt32(&ec.pendingDeferred) > 0 {
+					result := <-ec.deferredResults
+					atomic.AddInt32(&ec.pendingDeferred, -1)
+					data = result.Result
+					response.Path = result.Path
+					response.Label = result.Label
+					response.Errors = result.Errors
+				} else {
+					return nil
+				}
 			}
-			first = false
-			ctx = graphql.WithUnmarshalerMap(ctx, inputUnmarshalMap)
-			data := ec._Query(ctx, rc.Operation.SelectionSet)
 			var buf bytes.Buffer
 			data.MarshalGQL(&buf)
-
-			return &graphql.Response{
-				Data: buf.Bytes(),
+			response.Data = buf.Bytes()
+			if atomic.LoadInt32(&ec.deferred) > 0 {
+				hasNext := atomic.LoadInt32(&ec.pendingDeferred) > 0
+				response.HasNext = &hasNext
 			}
+
+			return &response
 		}
 	case ast.Mutation:
 		return func(ctx context.Context) *graphql.Response {
@@ -1491,6 +1506,28 @@ func (e *executableSchema) Exec(ctx context.Context) graphql.ResponseHandler {
 type executionContext struct {
 	*graphql.OperationContext
 	*executableSchema
+	deferred        int32
+	pendingDeferred int32
+	deferredResults chan graphql.DeferredResult
+}
+
+func (ec *executionContext) processDeferredGroup(dg graphql.DeferredGroup) {
+	atomic.AddInt32(&ec.pendingDeferred, 1)
+	go func() {
+		ctx := graphql.WithFreshResponseContext(dg.Context)
+		dg.FieldSet.Dispatch(ctx)
+		ds := graphql.DeferredResult{
+			Path:   dg.Path,
+			Label:  dg.Label,
+			Result: dg.FieldSet,
+			Errors: graphql.GetErrors(ctx),
+		}
+		// null fields should bubble up
+		if dg.FieldSet.Invalids > 0 {
+			ds.Result = graphql.Null
+		}
+		ec.deferredResults <- ds
+	}()
 }
 
 func (ec *executionContext) introspectSchema() (*introspection.Schema, error) {
@@ -6113,6 +6150,7 @@ func (ec *executionContext) _Mutation_createTag(ctx context.Context, field graph
 	})
 	if err != nil {
 		ec.Error(ctx, err)
+		return graphql.Null
 	}
 	if resTmp == nil {
 		if !graphql.HasFieldError(ctx, fc) {
@@ -6152,7 +6190,7 @@ func (ec *executionContext) fieldContext_Mutation_createTag(ctx context.Context,
 	ctx = graphql.WithFieldContext(ctx, fc)
 	if fc.Args, err = ec.field_Mutation_createTag_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
 		ec.Error(ctx, err)
-		return
+		return fc, err
 	}
 	return fc, nil
 }
@@ -6175,6 +6213,7 @@ func (ec *executionContext) _Mutation_deleteTag(ctx context.Context, field graph
 	})
 	if err != nil {
 		ec.Error(ctx, err)
+		return graphql.Null
 	}
 	if resTmp == nil {
 		if !graphql.HasFieldError(ctx, fc) {
@@ -6206,7 +6245,7 @@ func (ec *executionContext) fieldContext_Mutation_deleteTag(ctx context.Context,
 	ctx = graphql.WithFieldContext(ctx, fc)
 	if fc.Args, err = ec.field_Mutation_deleteTag_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
 		ec.Error(ctx, err)
-		return
+		return fc, err
 	}
 	return fc, nil
 }
@@ -6229,6 +6268,7 @@ func (ec *executionContext) _Mutation_addTagsToJob(ctx context.Context, field gr
 	})
 	if err != nil {
 		ec.Error(ctx, err)
+		return graphql.Null
 	}
 	if resTmp == nil {
 		if !graphql.HasFieldError(ctx, fc) {
@@ -6268,7 +6308,7 @@ func (ec *executionContext) fieldContext_Mutation_addTagsToJob(ctx context.Conte
 	ctx = graphql.WithFieldContext(ctx, fc)
 	if fc.Args, err = ec.field_Mutation_addTagsToJob_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
 		ec.Error(ctx, err)
-		return
+		return fc, err
 	}
 	return fc, nil
 }
@@ -6291,6 +6331,7 @@ func (ec *executionContext) _Mutation_removeTagsFromJob(ctx context.Context, fie
 	})
 	if err != nil {
 		ec.Error(ctx, err)
+		return graphql.Null
 	}
 	if resTmp == nil {
 		if !graphql.HasFieldError(ctx, fc) {
@@ -6330,7 +6371,7 @@ func (ec *executionContext) fieldContext_Mutation_removeTagsFromJob(ctx context.
 	ctx = graphql.WithFieldContext(ctx, fc)
 	if fc.Args, err = ec.field_Mutation_removeTagsFromJob_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
 		ec.Error(ctx, err)
-		return
+		return fc, err
 	}
 	return fc, nil
 }
@@ -6353,6 +6394,7 @@ func (ec *executionContext) _Mutation_updateConfiguration(ctx context.Context, f
 	})
 	if err != nil {
 		ec.Error(ctx, err)
+		return graphql.Null
 	}
 	if resTmp == nil {
 		return graphql.Null
@@ -6381,7 +6423,7 @@ func (ec *executionContext) fieldContext_Mutation_updateConfiguration(ctx contex
 	ctx = graphql.WithFieldContext(ctx, fc)
 	if fc.Args, err = ec.field_Mutation_updateConfiguration_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
 		ec.Error(ctx, err)
-		return
+		return fc, err
 	}
 	return fc, nil
 }
@@ -6544,6 +6586,7 @@ func (ec *executionContext) _Query_clusters(ctx context.Context, field graphql.C
 	})
 	if err != nil {
 		ec.Error(ctx, err)
+		return graphql.Null
 	}
 	if resTmp == nil {
 		if !graphql.HasFieldError(ctx, fc) {
@@ -6597,6 +6640,7 @@ func (ec *executionContext) _Query_tags(ctx context.Context, field graphql.Colle
 	})
 	if err != nil {
 		ec.Error(ctx, err)
+		return graphql.Null
 	}
 	if resTmp == nil {
 		if !graphql.HasFieldError(ctx, fc) {
@@ -6648,6 +6692,7 @@ func (ec *executionContext) _Query_user(ctx context.Context, field graphql.Colle
 	})
 	if err != nil {
 		ec.Error(ctx, err)
+		return graphql.Null
 	}
 	if resTmp == nil {
 		return graphql.Null
@@ -6684,7 +6729,7 @@ func (ec *executionContext) fieldContext_Query_user(ctx context.Context, field g
 	ctx = graphql.WithFieldContext(ctx, fc)
 	if fc.Args, err = ec.field_Query_user_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
 		ec.Error(ctx, err)
-		return
+		return fc, err
 	}
 	return fc, nil
 }
@@ -6707,6 +6752,7 @@ func (ec *executionContext) _Query_allocatedNodes(ctx context.Context, field gra
 	})
 	if err != nil {
 		ec.Error(ctx, err)
+		return graphql.Null
 	}
 	if resTmp == nil {
 		if !graphql.HasFieldError(ctx, fc) {
@@ -6744,7 +6790,7 @@ func (ec *executionContext) fieldContext_Query_allocatedNodes(ctx context.Contex
 	ctx = graphql.WithFieldContext(ctx, fc)
 	if fc.Args, err = ec.field_Query_allocatedNodes_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
 		ec.Error(ctx, err)
-		return
+		return fc, err
 	}
 	return fc, nil
 }
@@ -6767,6 +6813,7 @@ func (ec *executionContext) _Query_job(ctx context.Context, field graphql.Collec
 	})
 	if err != nil {
 		ec.Error(ctx, err)
+		return graphql.Null
 	}
 	if resTmp == nil {
 		return graphql.Null
@@ -6843,7 +6890,7 @@ func (ec *executionContext) fieldContext_Query_job(ctx context.Context, field gr
 	ctx = graphql.WithFieldContext(ctx, fc)
 	if fc.Args, err = ec.field_Query_job_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
 		ec.Error(ctx, err)
-		return
+		return fc, err
 	}
 	return fc, nil
 }
@@ -6866,6 +6913,7 @@ func (ec *executionContext) _Query_jobMetrics(ctx context.Context, field graphql
 	})
 	if err != nil {
 		ec.Error(ctx, err)
+		return graphql.Null
 	}
 	if resTmp == nil {
 		if !graphql.HasFieldError(ctx, fc) {
@@ -6905,7 +6953,7 @@ func (ec *executionContext) fieldContext_Query_jobMetrics(ctx context.Context, f
 	ctx = graphql.WithFieldContext(ctx, fc)
 	if fc.Args, err = ec.field_Query_jobMetrics_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
 		ec.Error(ctx, err)
-		return
+		return fc, err
 	}
 	return fc, nil
 }
@@ -6928,6 +6976,7 @@ func (ec *executionContext) _Query_jobsFootprints(ctx context.Context, field gra
 	})
 	if err != nil {
 		ec.Error(ctx, err)
+		return graphql.Null
 	}
 	if resTmp == nil {
 		return graphql.Null
@@ -6962,7 +7011,7 @@ func (ec *executionContext) fieldContext_Query_jobsFootprints(ctx context.Contex
 	ctx = graphql.WithFieldContext(ctx, fc)
 	if fc.Args, err = ec.field_Query_jobsFootprints_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
 		ec.Error(ctx, err)
-		return
+		return fc, err
 	}
 	return fc, nil
 }
@@ -6985,6 +7034,7 @@ func (ec *executionContext) _Query_jobs(ctx context.Context, field graphql.Colle
 	})
 	if err != nil {
 		ec.Error(ctx, err)
+		return graphql.Null
 	}
 	if resTmp == nil {
 		if !graphql.HasFieldError(ctx, fc) {
@@ -7026,7 +7076,7 @@ func (ec *executionContext) fieldContext_Query_jobs(ctx context.Context, field g
 	ctx = graphql.WithFieldContext(ctx, fc)
 	if fc.Args, err = ec.field_Query_jobs_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
 		ec.Error(ctx, err)
-		return
+		return fc, err
 	}
 	return fc, nil
 }
@@ -7049,6 +7099,7 @@ func (ec *executionContext) _Query_jobsStatistics(ctx context.Context, field gra
 	})
 	if err != nil {
 		ec.Error(ctx, err)
+		return graphql.Null
 	}
 	if resTmp == nil {
 		if !graphql.HasFieldError(ctx, fc) {
@@ -7104,7 +7155,7 @@ func (ec *executionContext) fieldContext_Query_jobsStatistics(ctx context.Contex
 	ctx = graphql.WithFieldContext(ctx, fc)
 	if fc.Args, err = ec.field_Query_jobsStatistics_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
 		ec.Error(ctx, err)
-		return
+		return fc, err
 	}
 	return fc, nil
 }
@@ -7127,6 +7178,7 @@ func (ec *executionContext) _Query_jobsCount(ctx context.Context, field graphql.
 	})
 	if err != nil {
 		ec.Error(ctx, err)
+		return graphql.Null
 	}
 	if resTmp == nil {
 		if !graphql.HasFieldError(ctx, fc) {
@@ -7164,7 +7216,7 @@ func (ec *executionContext) fieldContext_Query_jobsCount(ctx context.Context, fi
 	ctx = graphql.WithFieldContext(ctx, fc)
 	if fc.Args, err = ec.field_Query_jobsCount_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
 		ec.Error(ctx, err)
-		return
+		return fc, err
 	}
 	return fc, nil
 }
@@ -7187,6 +7239,7 @@ func (ec *executionContext) _Query_rooflineHeatmap(ctx context.Context, field gr
 	})
 	if err != nil {
 		ec.Error(ctx, err)
+		return graphql.Null
 	}
 	if resTmp == nil {
 		if !graphql.HasFieldError(ctx, fc) {
@@ -7218,7 +7271,7 @@ func (ec *executionContext) fieldContext_Query_rooflineHeatmap(ctx context.Conte
 	ctx = graphql.WithFieldContext(ctx, fc)
 	if fc.Args, err = ec.field_Query_rooflineHeatmap_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
 		ec.Error(ctx, err)
-		return
+		return fc, err
 	}
 	return fc, nil
 }
@@ -7241,6 +7294,7 @@ func (ec *executionContext) _Query_nodeMetrics(ctx context.Context, field graphq
 	})
 	if err != nil {
 		ec.Error(ctx, err)
+		return graphql.Null
 	}
 	if resTmp == nil {
 		if !graphql.HasFieldError(ctx, fc) {
@@ -7280,7 +7334,7 @@ func (ec *executionContext) fieldContext_Query_nodeMetrics(ctx context.Context,
 	ctx = graphql.WithFieldContext(ctx, fc)
 	if fc.Args, err = ec.field_Query_nodeMetrics_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
 		ec.Error(ctx, err)
-		return
+		return fc, err
 	}
 	return fc, nil
 }
@@ -7303,6 +7357,7 @@ func (ec *executionContext) _Query___type(ctx context.Context, field graphql.Col
 	})
 	if err != nil {
 		ec.Error(ctx, err)
+		return graphql.Null
 	}
 	if resTmp == nil {
 		return graphql.Null
@@ -7353,7 +7408,7 @@ func (ec *executionContext) fieldContext_Query___type(ctx context.Context, field
 	ctx = graphql.WithFieldContext(ctx, fc)
 	if fc.Args, err = ec.field_Query___type_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
 		ec.Error(ctx, err)
-		return
+		return fc, err
 	}
 	return fc, nil
 }
@@ -7376,6 +7431,7 @@ func (ec *executionContext) _Query___schema(ctx context.Context, field graphql.C
 	})
 	if err != nil {
 		ec.Error(ctx, err)
+		return graphql.Null
 	}
 	if resTmp == nil {
 		return graphql.Null
@@ -10766,7 +10822,7 @@ func (ec *executionContext) fieldContext___Type_fields(ctx context.Context, fiel
 	ctx = graphql.WithFieldContext(ctx, fc)
 	if fc.Args, err = ec.field___Type_fields_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
 		ec.Error(ctx, err)
-		return
+		return fc, err
 	}
 	return fc, nil
 }
@@ -10954,7 +11010,7 @@ func (ec *executionContext) fieldContext___Type_enumValues(ctx context.Context,
 	ctx = graphql.WithFieldContext(ctx, fc)
 	if fc.Args, err = ec.field___Type_enumValues_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
 		ec.Error(ctx, err)
-		return
+		return fc, err
 	}
 	return fc, nil
 }
@@ -11136,18 +11192,20 @@ func (ec *executionContext) unmarshalInputFloatRange(ctx context.Context, obj in
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("from"))
-			it.From, err = ec.unmarshalNFloat2float64(ctx, v)
+			data, err := ec.unmarshalNFloat2float64(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.From = data
 		case "to":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("to"))
-			it.To, err = ec.unmarshalNFloat2float64(ctx, v)
+			data, err := ec.unmarshalNFloat2float64(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.To = data
 		}
 	}
 
@@ -11172,18 +11230,20 @@ func (ec *executionContext) unmarshalInputIntRange(ctx context.Context, obj inte
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("from"))
-			it.From, err = ec.unmarshalNInt2int(ctx, v)
+			data, err := ec.unmarshalNInt2int(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.From = data
 		case "to":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("to"))
-			it.To, err = ec.unmarshalNInt2int(ctx, v)
+			data, err := ec.unmarshalNInt2int(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.To = data
 		}
 	}
 
@@ -11208,170 +11268,191 @@ func (ec *executionContext) unmarshalInputJobFilter(ctx context.Context, obj int
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("tags"))
-			it.Tags, err = ec.unmarshalOID2ᚕstringᚄ(ctx, v)
+			data, err := ec.unmarshalOID2ᚕstringᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.Tags = data
 		case "jobId":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("jobId"))
-			it.JobID, err = ec.unmarshalOStringInput2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋinternalᚋgraphᚋmodelᚐStringInput(ctx, v)
+			data, err := ec.unmarshalOStringInput2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋinternalᚋgraphᚋmodelᚐStringInput(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.JobID = data
 		case "arrayJobId":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("arrayJobId"))
-			it.ArrayJobID, err = ec.unmarshalOInt2ᚖint(ctx, v)
+			data, err := ec.unmarshalOInt2ᚖint(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.ArrayJobID = data
 		case "user":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("user"))
-			it.User, err = ec.unmarshalOStringInput2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋinternalᚋgraphᚋmodelᚐStringInput(ctx, v)
+			data, err := ec.unmarshalOStringInput2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋinternalᚋgraphᚋmodelᚐStringInput(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.User = data
 		case "project":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("project"))
-			it.Project, err = ec.unmarshalOStringInput2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋinternalᚋgraphᚋmodelᚐStringInput(ctx, v)
+			data, err := ec.unmarshalOStringInput2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋinternalᚋgraphᚋmodelᚐStringInput(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.Project = data
 		case "jobName":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("jobName"))
-			it.JobName, err = ec.unmarshalOStringInput2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋinternalᚋgraphᚋmodelᚐStringInput(ctx, v)
+			data, err := ec.unmarshalOStringInput2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋinternalᚋgraphᚋmodelᚐStringInput(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.JobName = data
 		case "cluster":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("cluster"))
-			it.Cluster, err = ec.unmarshalOStringInput2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋinternalᚋgraphᚋmodelᚐStringInput(ctx, v)
+			data, err := ec.unmarshalOStringInput2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋinternalᚋgraphᚋmodelᚐStringInput(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.Cluster = data
 		case "partition":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("partition"))
-			it.Partition, err = ec.unmarshalOStringInput2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋinternalᚋgraphᚋmodelᚐStringInput(ctx, v)
+			data, err := ec.unmarshalOStringInput2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋinternalᚋgraphᚋmodelᚐStringInput(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.Partition = data
 		case "duration":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("duration"))
-			it.Duration, err = ec.unmarshalOIntRange2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋpkgᚋschemaᚐIntRange(ctx, v)
+			data, err := ec.unmarshalOIntRange2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋpkgᚋschemaᚐIntRange(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.Duration = data
 		case "minRunningFor":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("minRunningFor"))
-			it.MinRunningFor, err = ec.unmarshalOInt2ᚖint(ctx, v)
+			data, err := ec.unmarshalOInt2ᚖint(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.MinRunningFor = data
 		case "numNodes":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("numNodes"))
-			it.NumNodes, err = ec.unmarshalOIntRange2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋpkgᚋschemaᚐIntRange(ctx, v)
+			data, err := ec.unmarshalOIntRange2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋpkgᚋschemaᚐIntRange(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.NumNodes = data
 		case "numAccelerators":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("numAccelerators"))
-			it.NumAccelerators, err = ec.unmarshalOIntRange2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋpkgᚋschemaᚐIntRange(ctx, v)
+			data, err := ec.unmarshalOIntRange2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋpkgᚋschemaᚐIntRange(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.NumAccelerators = data
 		case "numHWThreads":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("numHWThreads"))
-			it.NumHWThreads, err = ec.unmarshalOIntRange2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋpkgᚋschemaᚐIntRange(ctx, v)
+			data, err := ec.unmarshalOIntRange2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋpkgᚋschemaᚐIntRange(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.NumHWThreads = data
 		case "startTime":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("startTime"))
-			it.StartTime, err = ec.unmarshalOTimeRange2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋpkgᚋschemaᚐTimeRange(ctx, v)
+			data, err := ec.unmarshalOTimeRange2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋpkgᚋschemaᚐTimeRange(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.StartTime = data
 		case "state":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("state"))
-			it.State, err = ec.unmarshalOJobState2ᚕgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋpkgᚋschemaᚐJobStateᚄ(ctx, v)
+			data, err := ec.unmarshalOJobState2ᚕgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋpkgᚋschemaᚐJobStateᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.State = data
 		case "flopsAnyAvg":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("flopsAnyAvg"))
-			it.FlopsAnyAvg, err = ec.unmarshalOFloatRange2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋinternalᚋgraphᚋmodelᚐFloatRange(ctx, v)
+			data, err := ec.unmarshalOFloatRange2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋinternalᚋgraphᚋmodelᚐFloatRange(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.FlopsAnyAvg = data
 		case "memBwAvg":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("memBwAvg"))
-			it.MemBwAvg, err = ec.unmarshalOFloatRange2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋinternalᚋgraphᚋmodelᚐFloatRange(ctx, v)
+			data, err := ec.unmarshalOFloatRange2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋinternalᚋgraphᚋmodelᚐFloatRange(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.MemBwAvg = data
 		case "loadAvg":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("loadAvg"))
-			it.LoadAvg, err = ec.unmarshalOFloatRange2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋinternalᚋgraphᚋmodelᚐFloatRange(ctx, v)
+			data, err := ec.unmarshalOFloatRange2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋinternalᚋgraphᚋmodelᚐFloatRange(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.LoadAvg = data
 		case "memUsedMax":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("memUsedMax"))
-			it.MemUsedMax, err = ec.unmarshalOFloatRange2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋinternalᚋgraphᚋmodelᚐFloatRange(ctx, v)
+			data, err := ec.unmarshalOFloatRange2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋinternalᚋgraphᚋmodelᚐFloatRange(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.MemUsedMax = data
 		case "exclusive":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("exclusive"))
-			it.Exclusive, err = ec.unmarshalOInt2ᚖint(ctx, v)
+			data, err := ec.unmarshalOInt2ᚖint(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.Exclusive = data
 		case "node":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("node"))
-			it.Node, err = ec.unmarshalOStringInput2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋinternalᚋgraphᚋmodelᚐStringInput(ctx, v)
+			data, err := ec.unmarshalOStringInput2ᚖgithubᚗcomᚋClusterCockpitᚋccᚑbackendᚋinternalᚋgraphᚋmodelᚐStringInput(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.Node = data
 		}
 	}
 
@@ -11400,18 +11481,20 @@ func (ec *executionContext) unmarshalInputOrderByInput(ctx context.Context, obj
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("field"))
-			it.Field, err = ec.unmarshalNString2string(ctx, v)
+			data, err := ec.unmarshalNString2string(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.Field = data
 		case "order":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("order"))
-			it.Order, err = ec.unmarshalNSortDirectionEnum2githubᚗcomᚋClusterCockpitᚋccᚑbackendᚋinternalᚋgraphᚋmodelᚐSortDirectionEnum(ctx, v)
+			data, err := ec.unmarshalNSortDirectionEnum2githubᚗcomᚋClusterCockpitᚋccᚑbackendᚋinternalᚋgraphᚋmodelᚐSortDirectionEnum(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.Order = data
 		}
 	}
 
@@ -11436,18 +11519,20 @@ func (ec *executionContext) unmarshalInputPageRequest(ctx context.Context, obj i
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("itemsPerPage"))
-			it.ItemsPerPage, err = ec.unmarshalNInt2int(ctx, v)
+			data, err := ec.unmarshalNInt2int(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.ItemsPerPage = data
 		case "page":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("page"))
-			it.Page, err = ec.unmarshalNInt2int(ctx, v)
+			data, err := ec.unmarshalNInt2int(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.Page = data
 		}
 	}
 
@@ -11472,50 +11557,56 @@ func (ec *executionContext) unmarshalInputStringInput(ctx context.Context, obj i
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("eq"))
-			it.Eq, err = ec.unmarshalOString2ᚖstring(ctx, v)
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.Eq = data
 		case "neq":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("neq"))
-			it.Neq, err = ec.unmarshalOString2ᚖstring(ctx, v)
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.Neq = data
 		case "contains":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("contains"))
-			it.Contains, err = ec.unmarshalOString2ᚖstring(ctx, v)
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.Contains = data
 		case "startsWith":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("startsWith"))
-			it.StartsWith, err = ec.unmarshalOString2ᚖstring(ctx, v)
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.StartsWith = data
 		case "endsWith":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("endsWith"))
-			it.EndsWith, err = ec.unmarshalOString2ᚖstring(ctx, v)
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.EndsWith = data
 		case "in":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("in"))
-			it.In, err = ec.unmarshalOString2ᚕstringᚄ(ctx, v)
+			data, err := ec.unmarshalOString2ᚕstringᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.In = data
 		}
 	}
 
@@ -11540,18 +11631,20 @@ func (ec *executionContext) unmarshalInputTimeRange(ctx context.Context, obj int
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("from"))
-			it.From, err = ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
+			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.From = data
 		case "to":
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("to"))
-			it.To, err = ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
+			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
 			if err != nil {
 				return it, err
 			}
+			it.To = data
 		}
 	}
 
@@ -11570,41 +11663,48 @@ var acceleratorImplementors = []string{"Accelerator"}
 
 func (ec *executionContext) _Accelerator(ctx context.Context, sel ast.SelectionSet, obj *schema.Accelerator) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, acceleratorImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("Accelerator")
 		case "id":
-
 			out.Values[i] = ec._Accelerator_id(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "type":
-
 			out.Values[i] = ec._Accelerator_type(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "model":
-
 			out.Values[i] = ec._Accelerator_model(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -11612,23 +11712,22 @@ var clusterImplementors = []string{"Cluster"}
 
 func (ec *executionContext) _Cluster(ctx context.Context, sel ast.SelectionSet, obj *schema.Cluster) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, clusterImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("Cluster")
 		case "name":
-
 			out.Values[i] = ec._Cluster_name(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "partitions":
 			field := field
 
-			innerFunc := func(ctx context.Context) (res graphql.Marshaler) {
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
 				defer func() {
 					if r := recover(); r != nil {
 						ec.Error(ctx, ec.Recover(ctx, r))
@@ -11636,37 +11735,61 @@ func (ec *executionContext) _Cluster(ctx context.Context, sel ast.SelectionSet,
 				}()
 				res = ec._Cluster_partitions(ctx, field, obj)
 				if res == graphql.Null {
-					atomic.AddUint32(&invalids, 1)
+					atomic.AddUint32(&fs.Invalids, 1)
 				}
 				return res
 			}
 
-			out.Concurrently(i, func() graphql.Marshaler {
-				return innerFunc(ctx)
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
 
-			})
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 		case "metricConfig":
-
 			out.Values[i] = ec._Cluster_metricConfig(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "subClusters":
-
 			out.Values[i] = ec._Cluster_subClusters(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -11674,34 +11797,43 @@ var countImplementors = []string{"Count"}
 
 func (ec *executionContext) _Count(ctx context.Context, sel ast.SelectionSet, obj *model.Count) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, countImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("Count")
 		case "name":
-
 			out.Values[i] = ec._Count_name(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "count":
-
 			out.Values[i] = ec._Count_count(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -11709,34 +11841,43 @@ var footprintsImplementors = []string{"Footprints"}
 
 func (ec *executionContext) _Footprints(ctx context.Context, sel ast.SelectionSet, obj *model.Footprints) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, footprintsImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("Footprints")
 		case "nodehours":
-
 			out.Values[i] = ec._Footprints_nodehours(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "metrics":
-
 			out.Values[i] = ec._Footprints_metrics(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -11744,34 +11885,43 @@ var histoPointImplementors = []string{"HistoPoint"}
 
 func (ec *executionContext) _HistoPoint(ctx context.Context, sel ast.SelectionSet, obj *model.HistoPoint) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, histoPointImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("HistoPoint")
 		case "count":
-
 			out.Values[i] = ec._HistoPoint_count(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "value":
-
 			out.Values[i] = ec._HistoPoint_value(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -11779,34 +11929,43 @@ var intRangeOutputImplementors = []string{"IntRangeOutput"}
 
 func (ec *executionContext) _IntRangeOutput(ctx context.Context, sel ast.SelectionSet, obj *model.IntRangeOutput) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, intRangeOutputImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("IntRangeOutput")
 		case "from":
-
 			out.Values[i] = ec._IntRangeOutput_from(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "to":
-
 			out.Values[i] = ec._IntRangeOutput_to(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -11814,142 +11973,107 @@ var jobImplementors = []string{"Job"}
 
 func (ec *executionContext) _Job(ctx context.Context, sel ast.SelectionSet, obj *schema.Job) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, jobImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("Job")
 		case "id":
-
 			out.Values[i] = ec._Job_id(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "jobId":
-
 			out.Values[i] = ec._Job_jobId(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "user":
-
 			out.Values[i] = ec._Job_user(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "project":
-
 			out.Values[i] = ec._Job_project(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "cluster":
-
 			out.Values[i] = ec._Job_cluster(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "subCluster":
-
 			out.Values[i] = ec._Job_subCluster(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "startTime":
-
 			out.Values[i] = ec._Job_startTime(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "duration":
-
 			out.Values[i] = ec._Job_duration(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "walltime":
-
 			out.Values[i] = ec._Job_walltime(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "numNodes":
-
 			out.Values[i] = ec._Job_numNodes(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "numHWThreads":
-
 			out.Values[i] = ec._Job_numHWThreads(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "numAcc":
-
 			out.Values[i] = ec._Job_numAcc(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "SMT":
-
 			out.Values[i] = ec._Job_SMT(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "exclusive":
-
 			out.Values[i] = ec._Job_exclusive(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "partition":
-
 			out.Values[i] = ec._Job_partition(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "arrayJobId":
-
 			out.Values[i] = ec._Job_arrayJobId(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "monitoringStatus":
-
 			out.Values[i] = ec._Job_monitoringStatus(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "state":
-
 			out.Values[i] = ec._Job_state(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "tags":
 			field := field
 
-			innerFunc := func(ctx context.Context) (res graphql.Marshaler) {
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
 				defer func() {
 					if r := recover(); r != nil {
 						ec.Error(ctx, ec.Recover(ctx, r))
@@ -11957,26 +12081,40 @@ func (ec *executionContext) _Job(ctx context.Context, sel ast.SelectionSet, obj
 				}()
 				res = ec._Job_tags(ctx, field, obj)
 				if res == graphql.Null {
-					atomic.AddUint32(&invalids, 1)
+					atomic.AddUint32(&fs.Invalids, 1)
 				}
 				return res
 			}
 
-			out.Concurrently(i, func() graphql.Marshaler {
-				return innerFunc(ctx)
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
 
-			})
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 		case "resources":
-
 			out.Values[i] = ec._Job_resources(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "concurrentJobs":
 			field := field
 
-			innerFunc := func(ctx context.Context) (res graphql.Marshaler) {
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
 				defer func() {
 					if r := recover(); r != nil {
 						ec.Error(ctx, ec.Recover(ctx, r))
@@ -11986,14 +12124,30 @@ func (ec *executionContext) _Job(ctx context.Context, sel ast.SelectionSet, obj
 				return res
 			}
 
-			out.Concurrently(i, func() graphql.Marshaler {
-				return innerFunc(ctx)
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
 
-			})
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 		case "metaData":
 			field := field
 
-			innerFunc := func(ctx context.Context) (res graphql.Marshaler) {
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
 				defer func() {
 					if r := recover(); r != nil {
 						ec.Error(ctx, ec.Recover(ctx, r))
@@ -12003,14 +12157,30 @@ func (ec *executionContext) _Job(ctx context.Context, sel ast.SelectionSet, obj
 				return res
 			}
 
-			out.Concurrently(i, func() graphql.Marshaler {
-				return innerFunc(ctx)
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
 
-			})
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 		case "userData":
 			field := field
 
-			innerFunc := func(ctx context.Context) (res graphql.Marshaler) {
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
 				defer func() {
 					if r := recover(); r != nil {
 						ec.Error(ctx, ec.Recover(ctx, r))
@@ -12020,18 +12190,46 @@ func (ec *executionContext) _Job(ctx context.Context, sel ast.SelectionSet, obj
 				return res
 			}
 
-			out.Concurrently(i, func() graphql.Marshaler {
-				return innerFunc(ctx)
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
 
-			})
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -12039,34 +12237,43 @@ var jobLinkImplementors = []string{"JobLink"}
 
 func (ec *executionContext) _JobLink(ctx context.Context, sel ast.SelectionSet, obj *model.JobLink) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, jobLinkImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("JobLink")
 		case "id":
-
 			out.Values[i] = ec._JobLink_id(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "jobId":
-
 			out.Values[i] = ec._JobLink_jobId(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -12074,35 +12281,42 @@ var jobLinkResultListImplementors = []string{"JobLinkResultList"}
 
 func (ec *executionContext) _JobLinkResultList(ctx context.Context, sel ast.SelectionSet, obj *model.JobLinkResultList) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, jobLinkResultListImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("JobLinkResultList")
 		case "listQuery":
-
 			out.Values[i] = ec._JobLinkResultList_listQuery(ctx, field, obj)
-
 		case "items":
-
 			out.Values[i] = ec._JobLinkResultList_items(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "count":
-
 			out.Values[i] = ec._JobLinkResultList_count(ctx, field, obj)
-
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -12110,39 +12324,44 @@ var jobMetricImplementors = []string{"JobMetric"}
 
 func (ec *executionContext) _JobMetric(ctx context.Context, sel ast.SelectionSet, obj *schema.JobMetric) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, jobMetricImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("JobMetric")
 		case "unit":
-
 			out.Values[i] = ec._JobMetric_unit(ctx, field, obj)
-
 		case "timestep":
-
 			out.Values[i] = ec._JobMetric_timestep(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "series":
-
 			out.Values[i] = ec._JobMetric_series(ctx, field, obj)
-
 		case "statisticsSeries":
-
 			out.Values[i] = ec._JobMetric_statisticsSeries(ctx, field, obj)
-
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -12150,41 +12369,48 @@ var jobMetricWithNameImplementors = []string{"JobMetricWithName"}
 
 func (ec *executionContext) _JobMetricWithName(ctx context.Context, sel ast.SelectionSet, obj *model.JobMetricWithName) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, jobMetricWithNameImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("JobMetricWithName")
 		case "name":
-
 			out.Values[i] = ec._JobMetricWithName_name(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "scope":
-
 			out.Values[i] = ec._JobMetricWithName_scope(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "metric":
-
 			out.Values[i] = ec._JobMetricWithName_metric(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -12192,39 +12418,44 @@ var jobResultListImplementors = []string{"JobResultList"}
 
 func (ec *executionContext) _JobResultList(ctx context.Context, sel ast.SelectionSet, obj *model.JobResultList) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, jobResultListImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("JobResultList")
 		case "items":
-
 			out.Values[i] = ec._JobResultList_items(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "offset":
-
 			out.Values[i] = ec._JobResultList_offset(ctx, field, obj)
-
 		case "limit":
-
 			out.Values[i] = ec._JobResultList_limit(ctx, field, obj)
-
 		case "count":
-
 			out.Values[i] = ec._JobResultList_count(ctx, field, obj)
-
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -12232,97 +12463,88 @@ var jobsStatisticsImplementors = []string{"JobsStatistics"}
 
 func (ec *executionContext) _JobsStatistics(ctx context.Context, sel ast.SelectionSet, obj *model.JobsStatistics) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, jobsStatisticsImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("JobsStatistics")
 		case "id":
-
 			out.Values[i] = ec._JobsStatistics_id(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "name":
-
 			out.Values[i] = ec._JobsStatistics_name(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "totalJobs":
-
 			out.Values[i] = ec._JobsStatistics_totalJobs(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "runningJobs":
-
 			out.Values[i] = ec._JobsStatistics_runningJobs(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "shortJobs":
-
 			out.Values[i] = ec._JobsStatistics_shortJobs(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "totalWalltime":
-
 			out.Values[i] = ec._JobsStatistics_totalWalltime(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "totalNodeHours":
-
 			out.Values[i] = ec._JobsStatistics_totalNodeHours(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "totalCoreHours":
-
 			out.Values[i] = ec._JobsStatistics_totalCoreHours(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "totalAccHours":
-
 			out.Values[i] = ec._JobsStatistics_totalAccHours(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "histDuration":
-
 			out.Values[i] = ec._JobsStatistics_histDuration(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "histNumNodes":
-
 			out.Values[i] = ec._JobsStatistics_histNumNodes(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -12330,87 +12552,80 @@ var metricConfigImplementors = []string{"MetricConfig"}
 
 func (ec *executionContext) _MetricConfig(ctx context.Context, sel ast.SelectionSet, obj *schema.MetricConfig) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, metricConfigImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("MetricConfig")
 		case "name":
-
 			out.Values[i] = ec._MetricConfig_name(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "unit":
-
 			out.Values[i] = ec._MetricConfig_unit(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "scope":
-
 			out.Values[i] = ec._MetricConfig_scope(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "aggregation":
-
 			out.Values[i] = ec._MetricConfig_aggregation(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "timestep":
-
 			out.Values[i] = ec._MetricConfig_timestep(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "peak":
-
 			out.Values[i] = ec._MetricConfig_peak(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "normal":
-
 			out.Values[i] = ec._MetricConfig_normal(ctx, field, obj)
-
 		case "caution":
-
 			out.Values[i] = ec._MetricConfig_caution(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "alert":
-
 			out.Values[i] = ec._MetricConfig_alert(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "subClusters":
-
 			out.Values[i] = ec._MetricConfig_subClusters(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -12418,34 +12633,43 @@ var metricFootprintsImplementors = []string{"MetricFootprints"}
 
 func (ec *executionContext) _MetricFootprints(ctx context.Context, sel ast.SelectionSet, obj *model.MetricFootprints) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, metricFootprintsImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("MetricFootprints")
 		case "metric":
-
 			out.Values[i] = ec._MetricFootprints_metric(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "data":
-
 			out.Values[i] = ec._MetricFootprints_data(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -12453,41 +12677,48 @@ var metricStatisticsImplementors = []string{"MetricStatistics"}
 
 func (ec *executionContext) _MetricStatistics(ctx context.Context, sel ast.SelectionSet, obj *schema.MetricStatistics) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, metricStatisticsImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("MetricStatistics")
 		case "avg":
-
 			out.Values[i] = ec._MetricStatistics_avg(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "min":
-
 			out.Values[i] = ec._MetricStatistics_min(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "max":
-
 			out.Values[i] = ec._MetricStatistics_max(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -12495,34 +12726,43 @@ var metricValueImplementors = []string{"MetricValue"}
 
 func (ec *executionContext) _MetricValue(ctx context.Context, sel ast.SelectionSet, obj *schema.MetricValue) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, metricValueImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("MetricValue")
 		case "unit":
-
 			out.Values[i] = ec._MetricValue_unit(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "value":
-
 			out.Values[i] = ec._MetricValue_value(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -12535,6 +12775,7 @@ func (ec *executionContext) _Mutation(ctx context.Context, sel ast.SelectionSet)
 	})
 
 	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		innerCtx := graphql.WithRootFieldContext(ctx, &graphql.RootFieldContext{
 			Object: field.Name,
@@ -12545,40 +12786,57 @@ func (ec *executionContext) _Mutation(ctx context.Context, sel ast.SelectionSet)
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("Mutation")
 		case "createTag":
-
 			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
 				return ec._Mutation_createTag(ctx, field)
 			})
-
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
 		case "deleteTag":
-
 			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
 				return ec._Mutation_deleteTag(ctx, field)
 			})
-
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
 		case "addTagsToJob":
-
 			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
 				return ec._Mutation_addTagsToJob(ctx, field)
 			})
-
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
 		case "removeTagsFromJob":
-
 			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
 				return ec._Mutation_removeTagsFromJob(ctx, field)
 			})
-
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
 		case "updateConfiguration":
-
 			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
 				return ec._Mutation_updateConfiguration(ctx, field)
 			})
-
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -12586,41 +12844,48 @@ var nodeMetricsImplementors = []string{"NodeMetrics"}
 
 func (ec *executionContext) _NodeMetrics(ctx context.Context, sel ast.SelectionSet, obj *model.NodeMetrics) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, nodeMetricsImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("NodeMetrics")
 		case "host":
-
 			out.Values[i] = ec._NodeMetrics_host(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "subCluster":
-
 			out.Values[i] = ec._NodeMetrics_subCluster(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "metrics":
-
 			out.Values[i] = ec._NodeMetrics_metrics(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -12633,6 +12898,7 @@ func (ec *executionContext) _Query(ctx context.Context, sel ast.SelectionSet) gr
 	})
 
 	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		innerCtx := graphql.WithRootFieldContext(ctx, &graphql.RootFieldContext{
 			Object: field.Name,
@@ -12645,47 +12911,51 @@ func (ec *executionContext) _Query(ctx context.Context, sel ast.SelectionSet) gr
 		case "clusters":
 			field := field
 
-			innerFunc := func(ctx context.Context) (res graphql.Marshaler) {
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
 				defer func() {
 					if r := recover(); r != nil {
 						ec.Error(ctx, ec.Recover(ctx, r))
 					}
 				}()
 				res = ec._Query_clusters(ctx, field)
+				if res == graphql.Null {
+					atomic.AddUint32(&fs.Invalids, 1)
+				}
 				return res
 			}
 
 			rrm := func(ctx context.Context) graphql.Marshaler {
-				return ec.OperationContext.RootResolverMiddleware(ctx, innerFunc)
+				return ec.OperationContext.RootResolverMiddleware(ctx,
+					func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 			}
 
-			out.Concurrently(i, func() graphql.Marshaler {
-				return rrm(innerCtx)
-			})
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return rrm(innerCtx) })
 		case "tags":
 			field := field
 
-			innerFunc := func(ctx context.Context) (res graphql.Marshaler) {
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
 				defer func() {
 					if r := recover(); r != nil {
 						ec.Error(ctx, ec.Recover(ctx, r))
 					}
 				}()
 				res = ec._Query_tags(ctx, field)
+				if res == graphql.Null {
+					atomic.AddUint32(&fs.Invalids, 1)
+				}
 				return res
 			}
 
 			rrm := func(ctx context.Context) graphql.Marshaler {
-				return ec.OperationContext.RootResolverMiddleware(ctx, innerFunc)
+				return ec.OperationContext.RootResolverMiddleware(ctx,
+					func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 			}
 
-			out.Concurrently(i, func() graphql.Marshaler {
-				return rrm(innerCtx)
-			})
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return rrm(innerCtx) })
 		case "user":
 			field := field
 
-			innerFunc := func(ctx context.Context) (res graphql.Marshaler) {
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
 				defer func() {
 					if r := recover(); r != nil {
 						ec.Error(ctx, ec.Recover(ctx, r))
@@ -12696,36 +12966,37 @@ func (ec *executionContext) _Query(ctx context.Context, sel ast.SelectionSet) gr
 			}
 
 			rrm := func(ctx context.Context) graphql.Marshaler {
-				return ec.OperationContext.RootResolverMiddleware(ctx, innerFunc)
+				return ec.OperationContext.RootResolverMiddleware(ctx,
+					func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 			}
 
-			out.Concurrently(i, func() graphql.Marshaler {
-				return rrm(innerCtx)
-			})
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return rrm(innerCtx) })
 		case "allocatedNodes":
 			field := field
 
-			innerFunc := func(ctx context.Context) (res graphql.Marshaler) {
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
 				defer func() {
 					if r := recover(); r != nil {
 						ec.Error(ctx, ec.Recover(ctx, r))
 					}
 				}()
 				res = ec._Query_allocatedNodes(ctx, field)
+				if res == graphql.Null {
+					atomic.AddUint32(&fs.Invalids, 1)
+				}
 				return res
 			}
 
 			rrm := func(ctx context.Context) graphql.Marshaler {
-				return ec.OperationContext.RootResolverMiddleware(ctx, innerFunc)
+				return ec.OperationContext.RootResolverMiddleware(ctx,
+					func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 			}
 
-			out.Concurrently(i, func() graphql.Marshaler {
-				return rrm(innerCtx)
-			})
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return rrm(innerCtx) })
 		case "job":
 			field := field
 
-			innerFunc := func(ctx context.Context) (res graphql.Marshaler) {
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
 				defer func() {
 					if r := recover(); r != nil {
 						ec.Error(ctx, ec.Recover(ctx, r))
@@ -12736,36 +13007,37 @@ func (ec *executionContext) _Query(ctx context.Context, sel ast.SelectionSet) gr
 			}
 
 			rrm := func(ctx context.Context) graphql.Marshaler {
-				return ec.OperationContext.RootResolverMiddleware(ctx, innerFunc)
+				return ec.OperationContext.RootResolverMiddleware(ctx,
+					func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 			}
 
-			out.Concurrently(i, func() graphql.Marshaler {
-				return rrm(innerCtx)
-			})
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return rrm(innerCtx) })
 		case "jobMetrics":
 			field := field
 
-			innerFunc := func(ctx context.Context) (res graphql.Marshaler) {
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
 				defer func() {
 					if r := recover(); r != nil {
 						ec.Error(ctx, ec.Recover(ctx, r))
 					}
 				}()
 				res = ec._Query_jobMetrics(ctx, field)
+				if res == graphql.Null {
+					atomic.AddUint32(&fs.Invalids, 1)
+				}
 				return res
 			}
 
 			rrm := func(ctx context.Context) graphql.Marshaler {
-				return ec.OperationContext.RootResolverMiddleware(ctx, innerFunc)
+				return ec.OperationContext.RootResolverMiddleware(ctx,
+					func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 			}
 
-			out.Concurrently(i, func() graphql.Marshaler {
-				return rrm(innerCtx)
-			})
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return rrm(innerCtx) })
 		case "jobsFootprints":
 			field := field
 
-			innerFunc := func(ctx context.Context) (res graphql.Marshaler) {
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
 				defer func() {
 					if r := recover(); r != nil {
 						ec.Error(ctx, ec.Recover(ctx, r))
@@ -12776,129 +13048,149 @@ func (ec *executionContext) _Query(ctx context.Context, sel ast.SelectionSet) gr
 			}
 
 			rrm := func(ctx context.Context) graphql.Marshaler {
-				return ec.OperationContext.RootResolverMiddleware(ctx, innerFunc)
+				return ec.OperationContext.RootResolverMiddleware(ctx,
+					func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 			}
 
-			out.Concurrently(i, func() graphql.Marshaler {
-				return rrm(innerCtx)
-			})
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return rrm(innerCtx) })
 		case "jobs":
 			field := field
 
-			innerFunc := func(ctx context.Context) (res graphql.Marshaler) {
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
 				defer func() {
 					if r := recover(); r != nil {
 						ec.Error(ctx, ec.Recover(ctx, r))
 					}
 				}()
 				res = ec._Query_jobs(ctx, field)
+				if res == graphql.Null {
+					atomic.AddUint32(&fs.Invalids, 1)
+				}
 				return res
 			}
 
 			rrm := func(ctx context.Context) graphql.Marshaler {
-				return ec.OperationContext.RootResolverMiddleware(ctx, innerFunc)
+				return ec.OperationContext.RootResolverMiddleware(ctx,
+					func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 			}
 
-			out.Concurrently(i, func() graphql.Marshaler {
-				return rrm(innerCtx)
-			})
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return rrm(innerCtx) })
 		case "jobsStatistics":
 			field := field
 
-			innerFunc := func(ctx context.Context) (res graphql.Marshaler) {
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
 				defer func() {
 					if r := recover(); r != nil {
 						ec.Error(ctx, ec.Recover(ctx, r))
 					}
 				}()
 				res = ec._Query_jobsStatistics(ctx, field)
+				if res == graphql.Null {
+					atomic.AddUint32(&fs.Invalids, 1)
+				}
 				return res
 			}
 
 			rrm := func(ctx context.Context) graphql.Marshaler {
-				return ec.OperationContext.RootResolverMiddleware(ctx, innerFunc)
+				return ec.OperationContext.RootResolverMiddleware(ctx,
+					func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 			}
 
-			out.Concurrently(i, func() graphql.Marshaler {
-				return rrm(innerCtx)
-			})
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return rrm(innerCtx) })
 		case "jobsCount":
 			field := field
 
-			innerFunc := func(ctx context.Context) (res graphql.Marshaler) {
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
 				defer func() {
 					if r := recover(); r != nil {
 						ec.Error(ctx, ec.Recover(ctx, r))
 					}
 				}()
 				res = ec._Query_jobsCount(ctx, field)
+				if res == graphql.Null {
+					atomic.AddUint32(&fs.Invalids, 1)
+				}
 				return res
 			}
 
 			rrm := func(ctx context.Context) graphql.Marshaler {
-				return ec.OperationContext.RootResolverMiddleware(ctx, innerFunc)
+				return ec.OperationContext.RootResolverMiddleware(ctx,
+					func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 			}
 
-			out.Concurrently(i, func() graphql.Marshaler {
-				return rrm(innerCtx)
-			})
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return rrm(innerCtx) })
 		case "rooflineHeatmap":
 			field := field
 
-			innerFunc := func(ctx context.Context) (res graphql.Marshaler) {
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
 				defer func() {
 					if r := recover(); r != nil {
 						ec.Error(ctx, ec.Recover(ctx, r))
 					}
 				}()
 				res = ec._Query_rooflineHeatmap(ctx, field)
+				if res == graphql.Null {
+					atomic.AddUint32(&fs.Invalids, 1)
+				}
 				return res
 			}
 
 			rrm := func(ctx context.Context) graphql.Marshaler {
-				return ec.OperationContext.RootResolverMiddleware(ctx, innerFunc)
+				return ec.OperationContext.RootResolverMiddleware(ctx,
+					func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 			}
 
-			out.Concurrently(i, func() graphql.Marshaler {
-				return rrm(innerCtx)
-			})
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return rrm(innerCtx) })
 		case "nodeMetrics":
 			field := field
 
-			innerFunc := func(ctx context.Context) (res graphql.Marshaler) {
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
 				defer func() {
 					if r := recover(); r != nil {
 						ec.Error(ctx, ec.Recover(ctx, r))
 					}
 				}()
 				res = ec._Query_nodeMetrics(ctx, field)
+				if res == graphql.Null {
+					atomic.AddUint32(&fs.Invalids, 1)
+				}
 				return res
 			}
 
 			rrm := func(ctx context.Context) graphql.Marshaler {
-				return ec.OperationContext.RootResolverMiddleware(ctx, innerFunc)
+				return ec.OperationContext.RootResolverMiddleware(ctx,
+					func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 			}
 
-			out.Concurrently(i, func() graphql.Marshaler {
-				return rrm(innerCtx)
-			})
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return rrm(innerCtx) })
 		case "__type":
-
 			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
 				return ec._Query___type(ctx, field)
 			})
-
 		case "__schema":
-
 			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
 				return ec._Query___schema(ctx, field)
 			})
-
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -12906,39 +13198,44 @@ var resourceImplementors = []string{"Resource"}
 
 func (ec *executionContext) _Resource(ctx context.Context, sel ast.SelectionSet, obj *schema.Resource) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, resourceImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("Resource")
 		case "hostname":
-
 			out.Values[i] = ec._Resource_hostname(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "hwthreads":
-
 			out.Values[i] = ec._Resource_hwthreads(ctx, field, obj)
-
 		case "accelerators":
-
 			out.Values[i] = ec._Resource_accelerators(ctx, field, obj)
-
 		case "configuration":
-
 			out.Values[i] = ec._Resource_configuration(ctx, field, obj)
-
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -12946,42 +13243,47 @@ var seriesImplementors = []string{"Series"}
 
 func (ec *executionContext) _Series(ctx context.Context, sel ast.SelectionSet, obj *schema.Series) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, seriesImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("Series")
 		case "hostname":
-
 			out.Values[i] = ec._Series_hostname(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "id":
-
 			out.Values[i] = ec._Series_id(ctx, field, obj)
-
 		case "statistics":
-
 			out.Values[i] = ec._Series_statistics(ctx, field, obj)
-
 		case "data":
-
 			out.Values[i] = ec._Series_data(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -12989,41 +13291,48 @@ var statsSeriesImplementors = []string{"StatsSeries"}
 
 func (ec *executionContext) _StatsSeries(ctx context.Context, sel ast.SelectionSet, obj *schema.StatsSeries) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, statsSeriesImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("StatsSeries")
 		case "mean":
-
 			out.Values[i] = ec._StatsSeries_mean(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "min":
-
 			out.Values[i] = ec._StatsSeries_min(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "max":
-
 			out.Values[i] = ec._StatsSeries_max(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -13031,30 +13340,27 @@ var subClusterImplementors = []string{"SubCluster"}
 
 func (ec *executionContext) _SubCluster(ctx context.Context, sel ast.SelectionSet, obj *schema.SubCluster) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, subClusterImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("SubCluster")
 		case "name":
-
 			out.Values[i] = ec._SubCluster_name(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "nodes":
-
 			out.Values[i] = ec._SubCluster_nodes(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "numberOfNodes":
 			field := field
 
-			innerFunc := func(ctx context.Context) (res graphql.Marshaler) {
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
 				defer func() {
 					if r := recover(); r != nil {
 						ec.Error(ctx, ec.Recover(ctx, r))
@@ -13062,79 +13368,91 @@ func (ec *executionContext) _SubCluster(ctx context.Context, sel ast.SelectionSe
 				}()
 				res = ec._SubCluster_numberOfNodes(ctx, field, obj)
 				if res == graphql.Null {
-					atomic.AddUint32(&invalids, 1)
+					atomic.AddUint32(&fs.Invalids, 1)
 				}
 				return res
 			}
 
-			out.Concurrently(i, func() graphql.Marshaler {
-				return innerFunc(ctx)
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
 
-			})
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 		case "processorType":
-
 			out.Values[i] = ec._SubCluster_processorType(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "socketsPerNode":
-
 			out.Values[i] = ec._SubCluster_socketsPerNode(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "coresPerSocket":
-
 			out.Values[i] = ec._SubCluster_coresPerSocket(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "threadsPerCore":
-
 			out.Values[i] = ec._SubCluster_threadsPerCore(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "flopRateScalar":
-
 			out.Values[i] = ec._SubCluster_flopRateScalar(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "flopRateSimd":
-
 			out.Values[i] = ec._SubCluster_flopRateSimd(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "memoryBandwidth":
-
 			out.Values[i] = ec._SubCluster_memoryBandwidth(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "topology":
-
 			out.Values[i] = ec._SubCluster_topology(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&invalids, 1)
+				atomic.AddUint32(&out.Invalids, 1)
 			}
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -13142,47 +13460,48 @@ var subClusterConfigImplementors = []string{"SubClusterConfig"}
 
 func (ec *executionContext) _SubClusterConfig(ctx context.Context, sel ast.SelectionSet, obj *schema.SubClusterConfig) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, subClusterConfigImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("SubClusterConfig")
 		case "name":
-
 			out.Values[i] = ec._SubClusterConfig_name(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "peak":
-
 			out.Values[i] = ec._SubClusterConfig_peak(ctx, field, obj)
-
 		case "normal":
-
 			out.Values[i] = ec._SubClusterConfig_normal(ctx, field, obj)
-
 		case "caution":
-
 			out.Values[i] = ec._SubClusterConfig_caution(ctx, field, obj)
-
 		case "alert":
-
 			out.Values[i] = ec._SubClusterConfig_alert(ctx, field, obj)
-
 		case "remove":
-
 			out.Values[i] = ec._SubClusterConfig_remove(ctx, field, obj)
-
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -13190,41 +13509,48 @@ var tagImplementors = []string{"Tag"}
 
 func (ec *executionContext) _Tag(ctx context.Context, sel ast.SelectionSet, obj *schema.Tag) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, tagImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("Tag")
 		case "id":
-
 			out.Values[i] = ec._Tag_id(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "type":
-
 			out.Values[i] = ec._Tag_type(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "name":
-
 			out.Values[i] = ec._Tag_name(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -13232,34 +13558,43 @@ var timeRangeOutputImplementors = []string{"TimeRangeOutput"}
 
 func (ec *executionContext) _TimeRangeOutput(ctx context.Context, sel ast.SelectionSet, obj *model.TimeRangeOutput) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, timeRangeOutputImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("TimeRangeOutput")
 		case "from":
-
 			out.Values[i] = ec._TimeRangeOutput_from(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "to":
-
 			out.Values[i] = ec._TimeRangeOutput_to(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -13267,44 +13602,45 @@ var topologyImplementors = []string{"Topology"}
 
 func (ec *executionContext) _Topology(ctx context.Context, sel ast.SelectionSet, obj *schema.Topology) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, topologyImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("Topology")
 		case "node":
-
 			out.Values[i] = ec._Topology_node(ctx, field, obj)
-
 		case "socket":
-
 			out.Values[i] = ec._Topology_socket(ctx, field, obj)
-
 		case "memoryDomain":
-
 			out.Values[i] = ec._Topology_memoryDomain(ctx, field, obj)
-
 		case "die":
-
 			out.Values[i] = ec._Topology_die(ctx, field, obj)
-
 		case "core":
-
 			out.Values[i] = ec._Topology_core(ctx, field, obj)
-
 		case "accelerators":
-
 			out.Values[i] = ec._Topology_accelerators(ctx, field, obj)
-
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -13312,31 +13648,40 @@ var unitImplementors = []string{"Unit"}
 
 func (ec *executionContext) _Unit(ctx context.Context, sel ast.SelectionSet, obj *schema.Unit) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, unitImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("Unit")
 		case "base":
-
 			out.Values[i] = ec._Unit_base(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "prefix":
-
 			out.Values[i] = ec._Unit_prefix(ctx, field, obj)
-
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -13344,41 +13689,48 @@ var userImplementors = []string{"User"}
 
 func (ec *executionContext) _User(ctx context.Context, sel ast.SelectionSet, obj *model.User) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, userImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("User")
 		case "username":
-
 			out.Values[i] = ec._User_username(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "name":
-
 			out.Values[i] = ec._User_name(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "email":
-
 			out.Values[i] = ec._User_email(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -13386,52 +13738,55 @@ var __DirectiveImplementors = []string{"__Directive"}
 
 func (ec *executionContext) ___Directive(ctx context.Context, sel ast.SelectionSet, obj *introspection.Directive) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, __DirectiveImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("__Directive")
 		case "name":
-
 			out.Values[i] = ec.___Directive_name(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "description":
-
 			out.Values[i] = ec.___Directive_description(ctx, field, obj)
-
 		case "locations":
-
 			out.Values[i] = ec.___Directive_locations(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "args":
-
 			out.Values[i] = ec.___Directive_args(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "isRepeatable":
-
 			out.Values[i] = ec.___Directive_isRepeatable(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -13439,42 +13794,47 @@ var __EnumValueImplementors = []string{"__EnumValue"}
 
 func (ec *executionContext) ___EnumValue(ctx context.Context, sel ast.SelectionSet, obj *introspection.EnumValue) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, __EnumValueImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("__EnumValue")
 		case "name":
-
 			out.Values[i] = ec.___EnumValue_name(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "description":
-
 			out.Values[i] = ec.___EnumValue_description(ctx, field, obj)
-
 		case "isDeprecated":
-
 			out.Values[i] = ec.___EnumValue_isDeprecated(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "deprecationReason":
-
 			out.Values[i] = ec.___EnumValue_deprecationReason(ctx, field, obj)
-
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -13482,56 +13842,57 @@ var __FieldImplementors = []string{"__Field"}
 
 func (ec *executionContext) ___Field(ctx context.Context, sel ast.SelectionSet, obj *introspection.Field) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, __FieldImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("__Field")
 		case "name":
-
 			out.Values[i] = ec.___Field_name(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "description":
-
 			out.Values[i] = ec.___Field_description(ctx, field, obj)
-
 		case "args":
-
 			out.Values[i] = ec.___Field_args(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "type":
-
 			out.Values[i] = ec.___Field_type(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "isDeprecated":
-
 			out.Values[i] = ec.___Field_isDeprecated(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "deprecationReason":
-
 			out.Values[i] = ec.___Field_deprecationReason(ctx, field, obj)
-
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -13539,42 +13900,47 @@ var __InputValueImplementors = []string{"__InputValue"}
 
 func (ec *executionContext) ___InputValue(ctx context.Context, sel ast.SelectionSet, obj *introspection.InputValue) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, __InputValueImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("__InputValue")
 		case "name":
-
 			out.Values[i] = ec.___InputValue_name(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "description":
-
 			out.Values[i] = ec.___InputValue_description(ctx, field, obj)
-
 		case "type":
-
 			out.Values[i] = ec.___InputValue_type(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "defaultValue":
-
 			out.Values[i] = ec.___InputValue_defaultValue(ctx, field, obj)
-
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -13582,53 +13948,54 @@ var __SchemaImplementors = []string{"__Schema"}
 
 func (ec *executionContext) ___Schema(ctx context.Context, sel ast.SelectionSet, obj *introspection.Schema) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, __SchemaImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("__Schema")
 		case "description":
-
 			out.Values[i] = ec.___Schema_description(ctx, field, obj)
-
 		case "types":
-
 			out.Values[i] = ec.___Schema_types(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "queryType":
-
 			out.Values[i] = ec.___Schema_queryType(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "mutationType":
-
 			out.Values[i] = ec.___Schema_mutationType(ctx, field, obj)
-
 		case "subscriptionType":
-
 			out.Values[i] = ec.___Schema_subscriptionType(ctx, field, obj)
-
 		case "directives":
-
 			out.Values[i] = ec.___Schema_directives(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
@@ -13636,63 +14003,56 @@ var __TypeImplementors = []string{"__Type"}
 
 func (ec *executionContext) ___Type(ctx context.Context, sel ast.SelectionSet, obj *introspection.Type) graphql.Marshaler {
 	fields := graphql.CollectFields(ec.OperationContext, sel, __TypeImplementors)
+
 	out := graphql.NewFieldSet(fields)
-	var invalids uint32
+	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("__Type")
 		case "kind":
-
 			out.Values[i] = ec.___Type_kind(ctx, field, obj)
-
 			if out.Values[i] == graphql.Null {
-				invalids++
+				out.Invalids++
 			}
 		case "name":
-
 			out.Values[i] = ec.___Type_name(ctx, field, obj)
-
 		case "description":
-
 			out.Values[i] = ec.___Type_description(ctx, field, obj)
-
 		case "fields":
-
 			out.Values[i] = ec.___Type_fields(ctx, field, obj)
-
 		case "interfaces":
-
 			out.Values[i] = ec.___Type_interfaces(ctx, field, obj)
-
 		case "possibleTypes":
-
 			out.Values[i] = ec.___Type_possibleTypes(ctx, field, obj)
-
 		case "enumValues":
-
 			out.Values[i] = ec.___Type_enumValues(ctx, field, obj)
-
 		case "inputFields":
-
 			out.Values[i] = ec.___Type_inputFields(ctx, field, obj)
-
 		case "ofType":
-
 			out.Values[i] = ec.___Type_ofType(ctx, field, obj)
-
 		case "specifiedByURL":
-
 			out.Values[i] = ec.___Type_specifiedByURL(ctx, field, obj)
-
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
 	}
-	out.Dispatch()
-	if invalids > 0 {
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
 		return graphql.Null
 	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
 	return out
 }
 
diff --git a/internal/graph/model/models_gen.go b/internal/graph/model/models_gen.go
index 8284051..44357d6 100644
--- a/internal/graph/model/models_gen.go
+++ b/internal/graph/model/models_gen.go
@@ -37,27 +37,27 @@ type IntRangeOutput struct {
 }
 
 type JobFilter struct {
-	Tags            []string          `json:"tags"`
-	JobID           *StringInput      `json:"jobId"`
-	ArrayJobID      *int              `json:"arrayJobId"`
-	User            *StringInput      `json:"user"`
-	Project         *StringInput      `json:"project"`
-	JobName         *StringInput      `json:"jobName"`
-	Cluster         *StringInput      `json:"cluster"`
-	Partition       *StringInput      `json:"partition"`
-	Duration        *schema.IntRange  `json:"duration"`
-	MinRunningFor   *int              `json:"minRunningFor"`
-	NumNodes        *schema.IntRange  `json:"numNodes"`
-	NumAccelerators *schema.IntRange  `json:"numAccelerators"`
-	NumHWThreads    *schema.IntRange  `json:"numHWThreads"`
-	StartTime       *schema.TimeRange `json:"startTime"`
-	State           []schema.JobState `json:"state"`
-	FlopsAnyAvg     *FloatRange       `json:"flopsAnyAvg"`
-	MemBwAvg        *FloatRange       `json:"memBwAvg"`
-	LoadAvg         *FloatRange       `json:"loadAvg"`
-	MemUsedMax      *FloatRange       `json:"memUsedMax"`
-	Exclusive       *int              `json:"exclusive"`
-	Node            *StringInput      `json:"node"`
+	Tags            []string          `json:"tags,omitempty"`
+	JobID           *StringInput      `json:"jobId,omitempty"`
+	ArrayJobID      *int              `json:"arrayJobId,omitempty"`
+	User            *StringInput      `json:"user,omitempty"`
+	Project         *StringInput      `json:"project,omitempty"`
+	JobName         *StringInput      `json:"jobName,omitempty"`
+	Cluster         *StringInput      `json:"cluster,omitempty"`
+	Partition       *StringInput      `json:"partition,omitempty"`
+	Duration        *schema.IntRange  `json:"duration,omitempty"`
+	MinRunningFor   *int              `json:"minRunningFor,omitempty"`
+	NumNodes        *schema.IntRange  `json:"numNodes,omitempty"`
+	NumAccelerators *schema.IntRange  `json:"numAccelerators,omitempty"`
+	NumHWThreads    *schema.IntRange  `json:"numHWThreads,omitempty"`
+	StartTime       *schema.TimeRange `json:"startTime,omitempty"`
+	State           []schema.JobState `json:"state,omitempty"`
+	FlopsAnyAvg     *FloatRange       `json:"flopsAnyAvg,omitempty"`
+	MemBwAvg        *FloatRange       `json:"memBwAvg,omitempty"`
+	LoadAvg         *FloatRange       `json:"loadAvg,omitempty"`
+	MemUsedMax      *FloatRange       `json:"memUsedMax,omitempty"`
+	Exclusive       *int              `json:"exclusive,omitempty"`
+	Node            *StringInput      `json:"node,omitempty"`
 }
 
 type JobLink struct {
@@ -66,9 +66,9 @@ type JobLink struct {
 }
 
 type JobLinkResultList struct {
-	ListQuery *string    `json:"listQuery"`
+	ListQuery *string    `json:"listQuery,omitempty"`
 	Items     []*JobLink `json:"items"`
-	Count     *int       `json:"count"`
+	Count     *int       `json:"count,omitempty"`
 }
 
 type JobMetricWithName struct {
@@ -79,9 +79,9 @@ type JobMetricWithName struct {
 
 type JobResultList struct {
 	Items  []*schema.Job `json:"items"`
-	Offset *int          `json:"offset"`
-	Limit  *int          `json:"limit"`
-	Count  *int          `json:"count"`
+	Offset *int          `json:"offset,omitempty"`
+	Limit  *int          `json:"limit,omitempty"`
+	Count  *int          `json:"count,omitempty"`
 }
 
 type JobsStatistics struct {
@@ -120,12 +120,12 @@ type PageRequest struct {
 }
 
 type StringInput struct {
-	Eq         *string  `json:"eq"`
-	Neq        *string  `json:"neq"`
-	Contains   *string  `json:"contains"`
-	StartsWith *string  `json:"startsWith"`
-	EndsWith   *string  `json:"endsWith"`
-	In         []string `json:"in"`
+	Eq         *string  `json:"eq,omitempty"`
+	Neq        *string  `json:"neq,omitempty"`
+	Contains   *string  `json:"contains,omitempty"`
+	StartsWith *string  `json:"startsWith,omitempty"`
+	EndsWith   *string  `json:"endsWith,omitempty"`
+	In         []string `json:"in,omitempty"`
 }
 
 type TimeRangeOutput struct {
diff --git a/internal/graph/schema.resolvers.go b/internal/graph/schema.resolvers.go
index 1be455c..8d34fb3 100644
--- a/internal/graph/schema.resolvers.go
+++ b/internal/graph/schema.resolvers.go
@@ -2,7 +2,7 @@ package graph
 
 // This file will be automatically regenerated based on the schema, any resolver implementations
 // will be copied through when generating and any unknown code will be moved to the end.
-// Code generated by github.com/99designs/gqlgen version v0.17.24
+// Code generated by github.com/99designs/gqlgen version v0.17.36
 
 import (
 	"context"
diff --git a/web/frontend/package-lock.json b/web/frontend/package-lock.json
index 0d1e68d..7997e2e 100644
--- a/web/frontend/package-lock.json
+++ b/web/frontend/package-lock.json
@@ -138,9 +138,9 @@
       }
     },
     "node_modules/@rollup/plugin-node-resolve": {
-      "version": "15.1.0",
-      "resolved": "https://registry.npmjs.org/@rollup/plugin-node-resolve/-/plugin-node-resolve-15.1.0.tgz",
-      "integrity": "sha512-xeZHCgsiZ9pzYVgAo9580eCGqwh/XCEUM9q6iQfGNocjgkufHAqC3exA+45URvhiYV8sBF9RlBai650eNs7AsA==",
+      "version": "15.2.0",
+      "resolved": "https://registry.npmjs.org/@rollup/plugin-node-resolve/-/plugin-node-resolve-15.2.0.tgz",
+      "integrity": "sha512-mKur03xNGT8O9ODO6FtT43ITGqHWZbKPdVJHZb+iV9QYcdlhUUB0wgknvA4KCUmC5oHJF6O2W1EgmyOQyVUI4Q==",
       "dev": true,
       "dependencies": {
         "@rollup/pluginutils": "^5.0.1",
@@ -205,9 +205,9 @@
       }
     },
     "node_modules/@rollup/pluginutils": {
-      "version": "5.0.2",
-      "resolved": "https://registry.npmjs.org/@rollup/pluginutils/-/pluginutils-5.0.2.tgz",
-      "integrity": "sha512-pTd9rIsP92h+B6wWwFbW8RkZv4hiR/xKsqre4SIuAOaOEQRxi0lqLke9k2/7WegC85GgUs9pjmOjCUi3In4vwA==",
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/@rollup/pluginutils/-/pluginutils-5.0.3.tgz",
+      "integrity": "sha512-hfllNN4a80rwNQ9QCxhxuHCGHMAvabXqxNdaChUSSadMre7t4iEUI6fFAhBOn/eIYTgYVhBv7vCLsAJ4u3lf3g==",
       "dependencies": {
         "@types/estree": "^1.0.0",
         "estree-walker": "^2.0.2",
@@ -385,9 +385,9 @@
       }
     },
     "node_modules/graphql": {
-      "version": "16.7.1",
-      "resolved": "https://registry.npmjs.org/graphql/-/graphql-16.7.1.tgz",
-      "integrity": "sha512-DRYR9tf+UGU0KOsMcKAlXeFfX89UiiIZ0dRU3mR0yJfu6OjZqUcp68NnFLnqQU5RexygFoDy1EW+ccOYcPfmHg==",
+      "version": "16.8.0",
+      "resolved": "https://registry.npmjs.org/graphql/-/graphql-16.8.0.tgz",
+      "integrity": "sha512-0oKGaR+y3qcS5mCu1vb7KG+a89vjn06C7Ihq/dDl3jA+A8B3TKomvi3CiEcVLJQGalbu8F52LxkOym7U5sSfbg==",
       "engines": {
         "node": "^12.22.0 || ^14.16.0 || ^16.0.0 || >=17.0.0"
       }