Use electronic signature for compliage page NDA

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/server/api/console/v1/v1_resolver.go

@@ -1243,7 +1243,7 @@ func (r *documentVersionSignatureConnectionResolver) TotalCount(ctx context.Cont
 
 // CertificateFileURL is the resolver for the certificateFileUrl field.
 func (r *electronicSignatureResolver) CertificateFileURL(ctx context.Context, obj *types.ElectronicSignature) (*string, error) {
-	sig, err := r.esign.LoadSignatureByID(ctx, obj.ID)
+	sig, err := r.esign.GetSignatureByID(ctx, obj.ID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot load signature: %w", err)
 	}
@@ -1262,7 +1262,7 @@ func (r *electronicSignatureResolver) CertificateFileURL(ctx context.Context, ob
 
 // Events is the resolver for the events field.
 func (r *electronicSignatureResolver) Events(ctx context.Context, obj *types.ElectronicSignature) ([]*types.ElectronicSignatureEvent, error) {
-	events, err := r.esign.LoadEventsBySignatureID(ctx, obj.ID)
+	events, err := r.esign.GetEventsBySignatureID(ctx, obj.ID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot load signature events: %w", err)
 	}
@@ -6394,13 +6394,13 @@ func (r *organizationResolver) TrustCenter(ctx context.Context, obj *types.Organ
 
 	prb := r.ProboService(ctx, obj.ID.TenantID())
 
-	trustCenter, file, err := prb.TrustCenters.GetByOrganizationID(ctx, obj.ID)
+	trustCenter, err := prb.TrustCenters.GetByOrganizationID(ctx, obj.ID)
 	if err != nil {
 		// TODO no panic use gqlutils.InternalError
 		panic(fmt.Errorf("cannot get trust center: %w", err))
 	}
 
-	return types.NewTrustCenter(trustCenter, file), nil
+	return types.NewTrustCenter(trustCenter, nil), nil
 }
 
 // CustomDomain is the resolver for the customDomain field.
@@ -6874,11 +6874,11 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 	case coredata.TrustCenterEntityType:
 		action = probo.ActionTrustCenterGet
 		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			trustCenter, file, err := prb.TrustCenters.Get(ctx, id)
+			trustCenter, err := prb.TrustCenters.Get(ctx, id)
 			if err != nil {
 				return nil, err
 			}
-			return types.NewTrustCenter(trustCenter, file), nil
+			return types.NewTrustCenter(trustCenter, nil), nil
 		}
 	case coredata.TrustCenterAccessEntityType:
 		action = probo.ActionTrustCenterAccessGet
@@ -7739,7 +7739,7 @@ func (r *trustCenterResolver) Organization(ctx context.Context, obj *types.Trust
 
 	prb := r.ProboService(ctx, obj.ID.TenantID())
 
-	trustCenter, _, err := prb.TrustCenters.Get(ctx, obj.ID)
+	trustCenter, err := prb.TrustCenters.Get(ctx, obj.ID)
 	if err != nil {
 		panic(fmt.Errorf("cannot get trust center: %w", err))
 	}
@@ -7832,24 +7832,13 @@ func (r *trustCenterAccessResolver) NdaSignature(ctx context.Context, obj *types
 		return nil, fmt.Errorf("cannot load trust center access: %w", err)
 	}
 
-	trustCenter, _, err := prb.TrustCenters.Get(ctx, access.TrustCenterID)
-	if err != nil {
-		return nil, fmt.Errorf("cannot load trust center: %w", err)
-	}
-
-	if trustCenter.NonDisclosureAgreementFileID == nil {
+	if access.ElectronicSignatureID == nil {
 		return nil, nil
 	}
 
-	sig, err := r.esign.LoadSignatureByOrgEmailAndDocType(
-		ctx,
-		access.OrganizationID,
-		string(access.Email),
-		coredata.ElectronicSignatureDocumentTypeNDA,
-		*trustCenter.NonDisclosureAgreementFileID,
-	)
+	sig, err := r.esign.GetSignatureByID(ctx, *access.ElectronicSignatureID)
 	if err != nil {
-		return nil, nil // No signature row — pre-existing access
+		return nil, nil
 	}
 
 	return types.NewElectronicSignature(sig), nil

pkg/server/api/trust/v1/schema.graphql

@@ -488,18 +488,23 @@ type TrustCenterFileEdge {
   node: TrustCenterFile!
 }
 
+type NonDisclosureAgreement {
+  fileName: String!
+  fileUrl: String! @goField(forceResolver: true)
+  viewerSignature: ElectronicSignature @goField(forceResolver: true)
+}
+
 type TrustCenter implements Node {
   id: ID!
   active: Boolean!
   slug: String!
   logoFileUrl: String @goField(forceResolver: true)
   darkLogoFileUrl: String @goField(forceResolver: true)
-  ndaFileName: String
-  ndaFileUrl: String @goField(forceResolver: true)
-  ndaSignature: ElectronicSignature @goField(forceResolver: true)
-  organization: Organization! @goField(forceResolver: true)
+
+  nonDisclosureAgreement: NonDisclosureAgreement @goField(forceResolver: true)
+
   isViewerMember: Boolean! @goField(forceResolver: true)
-  hasAcceptedNonDisclosureAgreement: Boolean! @goField(forceResolver: true)
+  organization: Organization! @goField(forceResolver: true)
 
   documents(
     first: Int
@@ -601,14 +606,6 @@ type ExportTrustCenterFilePayload {
   data: String!
 }
 
-input AcceptNonDisclosureAgreementInput {
-  fullName: String!
-}
-
-type AcceptNonDisclosureAgreementPayload {
-  success: Boolean!
-}
-
 # Electronic Signature
 
 enum ElectronicSignatureStatus
@@ -770,11 +767,7 @@ type Mutation {
     input: ExportTrustCenterFileInput!
   ): ExportTrustCenterFilePayload! @session(required: OPTIONAL)
 
-  acceptNonDisclosureAgreement(
-    input: AcceptNonDisclosureAgreementInput!
-  ): AcceptNonDisclosureAgreementPayload @session(required: PRESENT)
-
-  requestDocumentAccess(
+    requestDocumentAccess(
     input: RequestDocumentAccessInput!
   ): RequestAccessesPayload! @session(required: PRESENT)
 

pkg/server/api/trust/v1/types/trust_center.go

@@ -18,16 +18,16 @@ import (
 	"go.probo.inc/probo/pkg/coredata"
 )
 
-func NewTrustCenter(tc *coredata.TrustCenter, file *coredata.File) *TrustCenter {
-	var ndaFileName *string
-	if file != nil {
-		ndaFileName = &file.FileName
-	}
-
+func NewTrustCenter(tc *coredata.TrustCenter) *TrustCenter {
 	return &TrustCenter{
-		ID:          tc.ID,
-		Active:      tc.Active,
-		Slug:        tc.Slug,
-		NdaFileName: ndaFileName,
+		ID:     tc.ID,
+		Active: tc.Active,
+		Slug:   tc.Slug,
+	}
+}
+
+func NewNonDisclosureAgreement(file *coredata.File) *NonDisclosureAgreement {
+	return &NonDisclosureAgreement{
+		FileName: file.FileName,
 	}
 }

pkg/server/api/trust/v1/types/types.go

@@ -25,14 +25,6 @@ type AcceptElectronicSignaturePayload struct {
 	Signature *ElectronicSignature `json:"signature"`
 }
 
-type AcceptNonDisclosureAgreementInput struct {
-	FullName string `json:"fullName"`
-}
-
-type AcceptNonDisclosureAgreementPayload struct {
-	Success bool `json:"success"`
-}
-
 type Audit struct {
 	ID        gid.GID    `json:"id"`
 	Framework *Framework `json:"framework"`
@@ -136,6 +128,12 @@ func (this Identity) GetID() gid.GID { return this.ID }
 type Mutation struct {
 }
 
+type NonDisclosureAgreement struct {
+	FileName        string               `json:"fileName"`
+	FileURL         string               `json:"fileUrl"`
+	ViewerSignature *ElectronicSignature `json:"viewerSignature,omitempty"`
+}
+
 type Organization struct {
 	ID                 gid.GID `json:"id"`
 	Name               string  `json:"name"`
@@ -203,22 +201,19 @@ type SendMagicLinkPayload struct {
 }
 
 type TrustCenter struct {
-	ID                                gid.GID                         `json:"id"`
-	Active                            bool                            `json:"active"`
-	Slug                              string                          `json:"slug"`
-	LogoFileURL                       *string                         `json:"logoFileUrl,omitempty"`
-	DarkLogoFileURL                   *string                         `json:"darkLogoFileUrl,omitempty"`
-	NdaFileName                       *string                         `json:"ndaFileName,omitempty"`
-	NdaFileURL                        *string                         `json:"ndaFileUrl,omitempty"`
-	NdaSignature                      *ElectronicSignature            `json:"ndaSignature,omitempty"`
-	Organization                      *Organization                   `json:"organization"`
-	IsViewerMember                    bool                            `json:"isViewerMember"`
-	HasAcceptedNonDisclosureAgreement bool                            `json:"hasAcceptedNonDisclosureAgreement"`
-	Documents                         *DocumentConnection             `json:"documents"`
-	Audits                            *AuditConnection                `json:"audits"`
-	Vendors                           *VendorConnection               `json:"vendors"`
-	References                        *TrustCenterReferenceConnection `json:"references"`
-	TrustCenterFiles                  *TrustCenterFileConnection      `json:"trustCenterFiles"`
+	ID                     gid.GID                         `json:"id"`
+	Active                 bool                            `json:"active"`
+	Slug                   string                          `json:"slug"`
+	LogoFileURL            *string                         `json:"logoFileUrl,omitempty"`
+	DarkLogoFileURL        *string                         `json:"darkLogoFileUrl,omitempty"`
+	NonDisclosureAgreement *NonDisclosureAgreement         `json:"nonDisclosureAgreement,omitempty"`
+	IsViewerMember         bool                            `json:"isViewerMember"`
+	Organization           *Organization                   `json:"organization"`
+	Documents              *DocumentConnection             `json:"documents"`
+	Audits                 *AuditConnection                `json:"audits"`
+	Vendors                *VendorConnection               `json:"vendors"`
+	References             *TrustCenterReferenceConnection `json:"references"`
+	TrustCenterFiles       *TrustCenterFileConnection      `json:"trustCenterFiles"`
 }
 
 func (TrustCenter) IsNode()             {}

pkg/server/api/trust/v1/v1_resolver.go

@@ -88,7 +88,7 @@ func (r *documentResolver) IsUserAuthorized(ctx context.Context, obj *types.Docu
 		return false, nil
 	}
 
-	documentAccess, err := trustService.TrustCenterAccesses.LoadDocumentAccess(
+	documentAccess, err := trustService.TrustCenterAccesses.GetDocumentAccess(
 		ctx,
 		trustCenter.ID,
 		identity.EmailAddress,
@@ -123,7 +123,7 @@ func (r *documentResolver) HasUserRequestedAccess(ctx context.Context, obj *type
 	}
 
 	// Try to load document access - if it exists (regardless of active status), user has requested it
-	_, err := trustService.TrustCenterAccesses.LoadDocumentAccess(
+	_, err := trustService.TrustCenterAccesses.GetDocumentAccess(
 		ctx,
 		trustCenter.ID,
 		identity.EmailAddress,
@@ -228,6 +228,41 @@ func (r *mutationResolver) RequestAllAccesses(ctx context.Context) (*types.Reque
 	}, nil
 }
 
+func (r *mutationResolver) checkNDASignature(
+	ctx context.Context,
+	trustCenter *coredata.TrustCenter,
+	identity *coredata.Identity,
+) error {
+	if trustCenter.NonDisclosureAgreementFileID == nil {
+		return nil
+	}
+
+	trustService := r.TrustService(ctx, trustCenter.ID.TenantID())
+
+	access, err := trustService.TrustCenterAccesses.GetAccess(ctx, trustCenter.ID, identity.EmailAddress)
+	if err != nil {
+		return gqlutils.Forbiddenf(ctx, "user has not signed the NDA")
+	}
+
+	if access.ElectronicSignatureID == nil {
+		return gqlutils.Forbiddenf(ctx, "user has not signed the NDA")
+	}
+
+	sig, err := r.esign.GetSignatureByID(ctx, *access.ElectronicSignatureID)
+	if err != nil {
+		return gqlutils.Forbiddenf(ctx, "user has not signed the NDA")
+	}
+
+	switch sig.Status {
+	case coredata.ElectronicSignatureStatusAccepted,
+		coredata.ElectronicSignatureStatusProcessing,
+		coredata.ElectronicSignatureStatusCompleted:
+		return nil
+	default:
+		return gqlutils.Forbiddenf(ctx, "user has not signed the NDA")
+	}
+}
+
 // ExportDocumentPDF is the resolver for the exportDocumentPDF field.
 func (r *mutationResolver) ExportDocumentPDF(ctx context.Context, input types.ExportDocumentPDFInput) (*types.ExportDocumentPDFPayload, error) {
 	trustService := r.TrustService(ctx, input.DocumentID.TenantID())
@@ -256,35 +291,13 @@ func (r *mutationResolver) ExportDocumentPDF(ctx context.Context, input types.Ex
 		return nil, gqlutils.Unauthenticated(ctx, errors.New("unauthenticated"))
 	}
 
-	ndaExists := true
-	hasAcceptedNDA := false
-
-	if trustCenter.NonDisclosureAgreementFileID == nil {
-		ndaExists = false
-	}
-
-	if ndaExists {
-		hasAcceptedNDA, err = trustService.TrustCenterAccesses.HasAcceptedNonDisclosureAgreement(
-			ctx,
-			trustCenter.ID,
-			identity.EmailAddress,
-		)
-		if err != nil {
-			r.logger.ErrorCtx(ctx, "cannot check if user has accepted NDA", log.Error(err))
-			return nil, gqlutils.Internal(ctx)
-		}
-	}
-
-	documentAccess, err := trustService.TrustCenterAccesses.LoadDocumentAccess(
+	documentAccess, err := trustService.TrustCenterAccesses.GetDocumentAccess(
 		ctx,
 		trustCenter.ID,
 		identity.EmailAddress,
 		input.DocumentID,
 	)
 	if err != nil {
-		// FIXME check for not found and return without error in this case
-		// r.logger.ErrorCtx(ctx, "cannot check document access", log.Error(err))
-		// return false, gqlutils.Internal(ctx)
 		return nil, nil
 	}
 
@@ -292,8 +305,8 @@ func (r *mutationResolver) ExportDocumentPDF(ctx context.Context, input types.Ex
 		return nil, gqlutils.Forbiddenf(ctx, "access denied: no permission to access this document")
 	}
 
-	if ndaExists && !hasAcceptedNDA {
-		return nil, gqlutils.Forbiddenf(ctx, "user has not accepted NDA")
+	if err := r.checkNDASignature(ctx, trustCenter, identity); err != nil {
+		return nil, err
 	}
 
 	pdf, err := trustService.Documents.ExportPDF(ctx, input.DocumentID, identity.EmailAddress)
@@ -336,35 +349,13 @@ func (r *mutationResolver) ExportReportPDF(ctx context.Context, input types.Expo
 		return nil, gqlutils.Unauthenticatedf(ctx, "unauthenticated")
 	}
 
-	ndaExists := true
-	hasAcceptedNDA := false
-
-	if trustCenter.NonDisclosureAgreementFileID == nil {
-		ndaExists = false
-	}
-
-	if ndaExists {
-		hasAcceptedNDA, err = trustService.TrustCenterAccesses.HasAcceptedNonDisclosureAgreement(
-			ctx,
-			trustCenter.ID,
-			identity.EmailAddress,
-		)
-		if err != nil {
-			r.logger.ErrorCtx(ctx, "cannot check if user has accepted NDA", log.Error(err))
-			return nil, gqlutils.Internal(ctx)
-		}
-	}
-
-	reportAccess, err := trustService.TrustCenterAccesses.LoadReportAccess(
+	reportAccess, err := trustService.TrustCenterAccesses.GetReportAccess(
 		ctx,
 		trustCenter.ID,
 		identity.EmailAddress,
 		input.ReportID,
 	)
 	if err != nil {
-		// FIXME check for not found and return without error in this case
-		// r.logger.ErrorCtx(ctx, "cannot check report access", log.Error(err))
-		// return false, gqlutils.Internal(ctx)
 		return nil, nil
 	}
 
@@ -372,8 +363,8 @@ func (r *mutationResolver) ExportReportPDF(ctx context.Context, input types.Expo
 		return nil, gqlutils.Forbiddenf(ctx, "access denied: no permission to access this report")
 	}
 
-	if ndaExists && !hasAcceptedNDA {
-		return nil, gqlutils.Forbiddenf(ctx, "user has not accepted NDA")
+	if err := r.checkNDASignature(ctx, trustCenter, identity); err != nil {
+		return nil, err
 	}
 
 	pdf, err := trustService.Reports.ExportPDF(ctx, input.ReportID, identity.EmailAddress)
@@ -415,33 +406,12 @@ func (r *mutationResolver) ExportTrustCenterFile(ctx context.Context, input type
 		return nil, gqlutils.Unauthenticatedf(ctx, "unauthenticated")
 	}
 
-	ndaExists := true
-	hasAcceptedNDA := false
-
-	if trustCenter.NonDisclosureAgreementFileID == nil {
-		ndaExists = false
-	}
-
-	if ndaExists {
-		hasAcceptedNDA, err = trustService.TrustCenterAccesses.HasAcceptedNonDisclosureAgreement(ctx,
-			trustCenter.ID,
-			identity.EmailAddress,
-		)
-		if err != nil {
-			r.logger.ErrorCtx(ctx, "cannot check if user has accepted NDA", log.Error(err))
-			return nil, gqlutils.Internal(ctx)
-		}
-	}
-
-	fileAccess, err := trustService.TrustCenterAccesses.LoadTrustCenterFileAccess(ctx,
+	fileAccess, err := trustService.TrustCenterAccesses.GetTrustCenterFileAccess(ctx,
 		trustCenter.ID,
 		identity.EmailAddress,
 		input.TrustCenterFileID,
 	)
 	if err != nil {
-		// FIXME check for not found and return without error in this case
-		// r.logger.ErrorCtx(ctx, "cannot check trust center file access", log.Error(err))
-		// return false, gqlutils.Internal(ctx)
 		return nil, nil
 	}
 
@@ -449,8 +419,8 @@ func (r *mutationResolver) ExportTrustCenterFile(ctx context.Context, input type
 		return nil, gqlutils.Forbiddenf(ctx, "access denied: no permission to access this file")
 	}
 
-	if ndaExists && !hasAcceptedNDA {
-		return nil, gqlutils.Forbiddenf(ctx, "user has not accepted NDA")
+	if err := r.checkNDASignature(ctx, trustCenter, identity); err != nil {
+		return nil, err
 	}
 
 	fileData, err := trustService.TrustCenterFiles.ExportFile(ctx, input.TrustCenterFileID, identity.EmailAddress)
@@ -464,42 +434,6 @@ func (r *mutationResolver) ExportTrustCenterFile(ctx context.Context, input type
 	}, nil
 }
 
-// AcceptNonDisclosureAgreement is the resolver for the acceptNonDisclosureAgreement field.
-func (r *mutationResolver) AcceptNonDisclosureAgreement(ctx context.Context, input types.AcceptNonDisclosureAgreementInput) (*types.AcceptNonDisclosureAgreementPayload, error) {
-	identity := authn.IdentityFromContext(ctx)
-	if identity == nil {
-		return nil, gqlutils.Unauthenticatedf(ctx, "unauthenticated")
-	}
-	trustCenter := compliancepage.CompliancePageFromContext(ctx)
-	trustService := r.TrustService(ctx, trustCenter.ID.TenantID())
-
-	httpReq := gqlutils.HTTPRequestFromContext(ctx)
-
-	if _, err := r.iam.AuthService.UpdateIdentity(ctx, identity.ID, input.FullName); err != nil {
-		var errNotFound *iam.ErrIdentityNotFound
-		if errors.As(err, &errNotFound) {
-			return nil, gqlutils.NotFound(ctx, err)
-		}
-
-		r.logger.ErrorCtx(ctx, "cannot update identity", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	if err := trustService.TrustCenterAccesses.AcceptNonDisclosureAgreement(
-		ctx,
-		&trust.AcceptNDARequest{
-			TrustCenterID: trustCenter.ID,
-			Email:         identity.EmailAddress,
-			IPAddr:        httpReq.RemoteAddr,
-		},
-	); err != nil {
-		r.logger.ErrorCtx(ctx, "cannot accept NDA", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	return &types.AcceptNonDisclosureAgreementPayload{Success: true}, nil
-}
-
 // RequestDocumentAccess is the resolver for the requestDocumentAccess field.
 func (r *mutationResolver) RequestDocumentAccess(ctx context.Context, input types.RequestDocumentAccessInput) (*types.RequestAccessesPayload, error) {
 	trustCenter := compliancepage.CompliancePageFromContext(ctx)
@@ -651,12 +585,10 @@ func (r *mutationResolver) RequestTrustCenterFileAccess(ctx context.Context, inp
 
 // AcceptElectronicSignature is the resolver for the acceptElectronicSignature field.
 func (r *mutationResolver) AcceptElectronicSignature(ctx context.Context, input types.AcceptElectronicSignatureInput) (*types.AcceptElectronicSignaturePayload, error) {
-	identity := authn.IdentityFromContext(ctx)
-	if identity == nil {
-		return nil, gqlutils.Unauthenticatedf(ctx, "unauthenticated")
-	}
-
-	httpReq := gqlutils.HTTPRequestFromContext(ctx)
+	var (
+		identity = authn.IdentityFromContext(ctx)
+		httpReq  = gqlutils.HTTPRequestFromContext(ctx)
+	)
 
 	if _, err := r.iam.AuthService.UpdateIdentity(ctx, identity.ID, input.FullName); err != nil {
 		var errNotFound *iam.ErrIdentityNotFound
@@ -668,45 +600,44 @@ func (r *mutationResolver) AcceptElectronicSignature(ctx context.Context, input
 		return nil, gqlutils.Internal(ctx)
 	}
 
-	if err := r.esign.AcceptSignature(ctx, &esign.AcceptSignatureRequest{
-		SignatureID:    input.SignatureID,
-		SignerFullName: input.FullName,
-		SignerEmail:    identity.EmailAddress,
-		SignerIPAddr:   httpReq.RemoteAddr,
-		SignerUA:       httpReq.UserAgent(),
-	}); err != nil {
+	signature, err := r.esign.AcceptSignature(
+		ctx,
+		&esign.AcceptSignatureRequest{
+			SignatureID:    input.SignatureID,
+			SignerFullName: input.FullName,
+			SignerEmail:    identity.EmailAddress,
+			SignerIPAddr:   httpReq.RemoteAddr,
+			SignerUA:       httpReq.UserAgent(),
+		},
+	)
+	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot accept electronic signature", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
 
-	sig, err := r.esign.LoadSignatureByID(ctx, input.SignatureID)
-	if err != nil {
-		r.logger.ErrorCtx(ctx, "cannot load electronic signature", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
 	return &types.AcceptElectronicSignaturePayload{
-		Signature: types.NewElectronicSignature(sig),
+		Signature: types.NewElectronicSignature(signature),
 	}, nil
 }
 
 // RecordSigningEvent is the resolver for the recordSigningEvent field.
 func (r *mutationResolver) RecordSigningEvent(ctx context.Context, input types.RecordSigningEventInput) (*types.RecordSigningEventPayload, error) {
-	identity := authn.IdentityFromContext(ctx)
-	if identity == nil {
-		return nil, gqlutils.Unauthenticatedf(ctx, "unauthenticated")
-	}
+	var (
+		identity = authn.IdentityFromContext(ctx)
+		httpReq  = gqlutils.HTTPRequestFromContext(ctx)
+	)
 
-	httpReq := gqlutils.HTTPRequestFromContext(ctx)
-
-	if err := r.esign.RecordEvent(ctx, &esign.RecordEventRequest{
-		SignatureID: input.SignatureID,
-		EventType:   input.EventType,
-		EventSource: coredata.ElectronicSignatureEventSourceClient,
-		ActorEmail:  identity.EmailAddress,
-		ActorIPAddr: httpReq.RemoteAddr,
-		ActorUA:     httpReq.UserAgent(),
-	}); err != nil {
+	if err := r.esign.RecordEvent(
+		ctx,
+		&esign.RecordEventRequest{
+			SignatureID: input.SignatureID,
+			EventType:   input.EventType,
+			EventSource: coredata.ElectronicSignatureEventSourceClient,
+			ActorEmail:  identity.EmailAddress,
+			ActorIPAddr: httpReq.RemoteAddr,
+			ActorUA:     httpReq.UserAgent(),
+		},
+	); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot record signing event", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -714,6 +645,46 @@ func (r *mutationResolver) RecordSigningEvent(ctx context.Context, input types.R
 	return &types.RecordSigningEventPayload{Success: true}, nil
 }
 
+// FileURL is the resolver for the fileUrl field.
+func (r *nonDisclosureAgreementResolver) FileURL(ctx context.Context, obj *types.NonDisclosureAgreement) (string, error) {
+	trustCenter := compliancepage.CompliancePageFromContext(ctx)
+	trustService := r.TrustService(ctx, trustCenter.ID.TenantID())
+
+	fileURL, err := trustService.TrustCenters.GenerateNDAFileURL(ctx, trustCenter.ID, 15*time.Minute)
+	if err != nil {
+		return "", gqlutils.Internal(ctx)
+	}
+
+	return fileURL, nil
+}
+
+// ViewerSignature is the resolver for the viewerSignature field.
+func (r *nonDisclosureAgreementResolver) ViewerSignature(ctx context.Context, obj *types.NonDisclosureAgreement) (*types.ElectronicSignature, error) {
+	identity := authn.IdentityFromContext(ctx)
+	if identity == nil {
+		return nil, nil
+	}
+
+	trustCenter := compliancepage.CompliancePageFromContext(ctx)
+	trustService := r.TrustService(ctx, trustCenter.ID.TenantID())
+
+	access, err := trustService.TrustCenterAccesses.GetAccess(ctx, trustCenter.ID, identity.EmailAddress)
+	if err != nil {
+		return nil, nil
+	}
+
+	if access.ElectronicSignatureID == nil {
+		return nil, nil
+	}
+
+	sig, err := r.esign.GetSignatureByID(ctx, *access.ElectronicSignatureID)
+	if err != nil {
+		return nil, nil
+	}
+
+	return types.NewElectronicSignature(sig), nil
+}
+
 // LogoURL is the resolver for the logoUrl field.
 func (r *organizationResolver) LogoURL(ctx context.Context, obj *types.Organization) (*string, error) {
 	trustService := r.TrustService(ctx, obj.ID.TenantID())
@@ -793,12 +764,12 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 		return types.NewVendor(vendor), nil
 
 	case coredata.TrustCenterEntityType:
-		trustCenter, file, err := trustService.TrustCenters.Get(ctx, id)
+		trustCenter, err := trustService.TrustCenters.Get(ctx, id)
 		if err != nil {
 			r.logger.ErrorCtx(ctx, "cannot get trust center", log.Error(err))
 			return nil, gqlutils.Internal(ctx)
 		}
-		return types.NewTrustCenter(trustCenter, file), nil
+		return types.NewTrustCenter(trustCenter), nil
 
 	case coredata.TrustCenterReferenceEntityType:
 		reference, err := trustService.TrustCenterReferences.Get(ctx, id)
@@ -824,12 +795,12 @@ func (r *queryResolver) CurrentTrustCenter(ctx context.Context) (*types.TrustCen
 		panic(fmt.Errorf("cannot get organization: %w", err))
 	}
 
-	trustCenter, file, err := trustService.TrustCenters.Get(ctx, trustCenter.ID)
+	trustCenter, err = trustService.TrustCenters.Get(ctx, trustCenter.ID)
 	if err != nil {
 		panic(fmt.Errorf("cannot get trust center: %w", err))
 	}
 
-	response := types.NewTrustCenter(trustCenter, file)
+	response := types.NewTrustCenter(trustCenter)
 	response.Organization = types.NewOrganization(org)
 
 	return response, nil
@@ -856,7 +827,7 @@ func (r *reportResolver) IsUserAuthorized(ctx context.Context, obj *types.Report
 		return false, nil
 	}
 
-	reportAccess, err := trustService.TrustCenterAccesses.LoadReportAccess(ctx,
+	reportAccess, err := trustService.TrustCenterAccesses.GetReportAccess(ctx,
 		trustCenter.ID,
 		identity.EmailAddress,
 		obj.ID,
@@ -890,7 +861,7 @@ func (r *reportResolver) HasUserRequestedAccess(ctx context.Context, obj *types.
 		return false, nil // User is not authenticated, so no access requested
 	}
 
-	_, err := trustService.TrustCenterAccesses.LoadReportAccess(ctx,
+	_, err := trustService.TrustCenterAccesses.GetReportAccess(ctx,
 		trustCenter.ID,
 		identity.EmailAddress,
 		obj.ID,
@@ -919,50 +890,25 @@ func (r *trustCenterResolver) DarkLogoFileURL(ctx context.Context, obj *types.Tr
 	return trustService.TrustCenters.GenerateDarkLogoURL(ctx, obj.ID, 1*time.Hour)
 }
 
-// NdaFileURL is the resolver for the ndaFileUrl field.
-func (r *trustCenterResolver) NdaFileURL(ctx context.Context, obj *types.TrustCenter) (*string, error) {
+// NonDisclosureAgreement is the resolver for the nonDisclosureAgreement field.
+func (r *trustCenterResolver) NonDisclosureAgreement(ctx context.Context, obj *types.TrustCenter) (*types.NonDisclosureAgreement, error) {
+	trustCenter := compliancepage.CompliancePageFromContext(ctx)
+	if trustCenter.NonDisclosureAgreementFileID == nil {
+		return nil, nil
+	}
+
 	trustService := r.TrustService(ctx, obj.ID.TenantID())
 
-	fileURL, err := trustService.TrustCenters.GenerateNDAFileURL(ctx, obj.ID, 15*time.Minute)
+	file, err := trustService.TrustCenters.GetNDAFile(ctx, obj.ID)
 	if err != nil {
-		// FIXME: add error not found check etc
-		// r.logger.ErrorCtx(ctx, "cannot generate NDA file URL", log.Error(err))
-		// return nil, gqlutils.Internal(ctx)
+		r.logger.ErrorCtx(ctx, "cannot load NDA file", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+	if file == nil {
 		return nil, nil
 	}
 
-	return &fileURL, nil
-}
-
-// NdaSignature is the resolver for the ndaSignature field.
-func (r *trustCenterResolver) NdaSignature(ctx context.Context, obj *types.TrustCenter) (*types.ElectronicSignature, error) {
-	identity := authn.IdentityFromContext(ctx)
-	if identity == nil {
-		return nil, nil
-	}
-
-	trustCenter := compliancepage.CompliancePageFromContext(ctx)
-	if trustCenter == nil || trustCenter.NonDisclosureAgreementFileID == nil {
-		return nil, nil
-	}
-
-	sig, err := r.esign.LoadSignatureByOrgEmailAndDocType(
-		ctx,
-		trustCenter.OrganizationID,
-		identity.EmailAddress.String(),
-		coredata.ElectronicSignatureDocumentTypeNDA,
-		*trustCenter.NonDisclosureAgreementFileID,
-	)
-	if err != nil {
-		return nil, nil
-	}
-
-	return types.NewElectronicSignature(sig), nil
-}
-
-// Organization is the resolver for the organization field.
-func (r *trustCenterResolver) Organization(ctx context.Context, obj *types.TrustCenter) (*types.Organization, error) {
-	return obj.Organization, nil
+	return types.NewNonDisclosureAgreement(file), nil
 }
 
 // IsViewerMember is the resolver for the isViewerMember field.
@@ -972,22 +918,9 @@ func (r *trustCenterResolver) IsViewerMember(ctx context.Context, obj *types.Tru
 	return membership != nil, nil
 }
 
-// HasAcceptedNonDisclosureAgreement is the resolver for the hasAcceptedNonDisclosureAgreement field.
-func (r *trustCenterResolver) HasAcceptedNonDisclosureAgreement(ctx context.Context, obj *types.TrustCenter) (bool, error) {
-	trustService := r.TrustService(ctx, obj.ID.TenantID())
-
-	identity := authn.IdentityFromContext(ctx)
-	if identity == nil {
-		return false, nil // User is not authenticated, so no NDA accepted
-	}
-
-	hasAcceptedNDA, err := trustService.TrustCenterAccesses.HasAcceptedNonDisclosureAgreement(ctx, obj.ID, identity.EmailAddress)
-	if err != nil {
-		r.logger.ErrorCtx(ctx, "cannot check if user has accepted NDA", log.Error(err))
-		return false, gqlutils.Internal(ctx)
-	}
-
-	return hasAcceptedNDA, nil
+// Organization is the resolver for the organization field.
+func (r *trustCenterResolver) Organization(ctx context.Context, obj *types.TrustCenter) (*types.Organization, error) {
+	return obj.Organization, nil
 }
 
 // Documents is the resolver for the documents field.
@@ -1112,7 +1045,7 @@ func (r *trustCenterFileResolver) IsUserAuthorized(ctx context.Context, obj *typ
 		return false, nil
 	}
 
-	fileAccess, err := trustService.TrustCenterAccesses.LoadTrustCenterFileAccess(ctx,
+	fileAccess, err := trustService.TrustCenterAccesses.GetTrustCenterFileAccess(ctx,
 		trustCenter.ID,
 		identity.EmailAddress,
 		obj.ID,
@@ -1146,7 +1079,7 @@ func (r *trustCenterFileResolver) HasUserRequestedAccess(ctx context.Context, ob
 		return false, nil // User is not authenticated, so no access requested
 	}
 
-	_, err := trustService.TrustCenterAccesses.LoadTrustCenterFileAccess(ctx,
+	_, err := trustService.TrustCenterAccesses.GetTrustCenterFileAccess(ctx,
 		trustCenter.ID,
 		identity.EmailAddress,
 		obj.ID,
@@ -1201,6 +1134,11 @@ func (r *Resolver) Framework() schema.FrameworkResolver { return &frameworkResol
 // Mutation returns schema.MutationResolver implementation.
 func (r *Resolver) Mutation() schema.MutationResolver { return &mutationResolver{r} }
 
+// NonDisclosureAgreement returns schema.NonDisclosureAgreementResolver implementation.
+func (r *Resolver) NonDisclosureAgreement() schema.NonDisclosureAgreementResolver {
+	return &nonDisclosureAgreementResolver{r}
+}
+
 // Organization returns schema.OrganizationResolver implementation.
 func (r *Resolver) Organization() schema.OrganizationResolver { return &organizationResolver{r} }
 
@@ -1232,6 +1170,7 @@ type auditResolver struct{ *Resolver }
 type documentResolver struct{ *Resolver }
 type frameworkResolver struct{ *Resolver }
 type mutationResolver struct{ *Resolver }
+type nonDisclosureAgreementResolver struct{ *Resolver }
 type organizationResolver struct{ *Resolver }
 type queryResolver struct{ *Resolver }
 type reportResolver struct{ *Resolver }