Split employee document policy from core document actions

Introduce dedicated employee-scoped IAM actions and update all
resolvers and frontend mutations accordingly.

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

e2e/console/document_version_test.go

@@ -23,47 +23,10 @@ import (
 	"go.probo.inc/probo/e2e/internal/testutil"
 )
 
-// getOwnerProfileID queries the organization profiles and returns the first one (the owner's).
 func getOwnerProfileID(t *testing.T, owner *testutil.Client) string {
 	t.Helper()
 
-	query := `
-		query GetProfiles($orgId: ID!) {
-			node(id: $orgId) {
-				... on Organization {
-					profiles(first: 1) {
-						edges {
-							node {
-								id
-							}
-						}
-					}
-				}
-			}
-		}
-	`
-
-	var result struct {
-		Node struct {
-			Profiles struct {
-				Edges []struct {
-					Node struct {
-						ID string `json:"id"`
-					} `json:"node"`
-				} `json:"edges"`
-			} `json:"profiles"`
-		} `json:"node"`
-	}
-
-	err := owner.Execute(
-		query,
-		map[string]any{"orgId": owner.GetOrganizationID().String()},
-		&result,
-	)
-	require.NoError(t, err)
-	require.NotEmpty(t, result.Node.Profiles.Edges)
-
-	return result.Node.Profiles.Edges[0].Node.ID
+	return owner.GetProfileID().String()
 }
 
 // createTestDocument creates a document and returns its ID and the document version ID

e2e/internal/testutil/client.go

@@ -38,9 +38,11 @@ func generateUniqueID() string {
 type TestRole string
 
 const (
-	RoleOwner  TestRole = "OWNER"
-	RoleAdmin  TestRole = "ADMIN"
-	RoleViewer TestRole = "VIEWER"
+	RoleOwner    TestRole = "OWNER"
+	RoleAdmin    TestRole = "ADMIN"
+	RoleViewer   TestRole = "VIEWER"
+	RoleEmployee TestRole = "EMPLOYEE"
+	RoleAuditor  TestRole = "AUDITOR"
 )
 
 type Client struct {
@@ -50,6 +52,7 @@ type Client struct {
 	mailpitBaseURL string
 	role           TestRole
 	userID         gid.GID
+	profileID      gid.GID
 	organizationID gid.GID
 }
 
@@ -129,6 +132,7 @@ func (c *Client) SetupTestUserInOrg(ownerClient *Client) {
 	// Owner invites user to organization
 	profileID, identityID := ownerClient.createUser(email, fullName, coredata.MembershipRole(c.role))
 	c.userID = identityID
+	c.profileID = profileID
 	ownerClient.inviteUser(profileID)
 	token := c.getActivationToken(email)
 	passwordToken := c.activateUser(token)
@@ -212,6 +216,9 @@ func (c *Client) createOrganization(name string) gid.GID {
 			Organization struct {
 				ID string `json:"id"`
 			} `json:"organization"`
+			Profile struct {
+				ID string `json:"id"`
+			} `json:"profile"`
 		} `json:"createOrganization"`
 	}
 
@@ -223,6 +230,11 @@ func (c *Client) createOrganization(name string) gid.GID {
 	orgID, err := gid.ParseGID(result.CreateOrganization.Organization.ID)
 	require.NoError(c.T, err, "cannot parse organization ID")
 
+	profileID, err := gid.ParseGID(result.CreateOrganization.Profile.ID)
+	require.NoError(c.T, err, "cannot parse profile ID")
+
+	c.profileID = profileID
+
 	return orgID
 }
 
@@ -483,6 +495,10 @@ func (c *Client) GetUserID() gid.GID {
 	return c.userID
 }
 
+func (c *Client) GetProfileID() gid.GID {
+	return c.profileID
+}
+
 func (c *Client) GetOrganizationID() gid.GID {
 	return c.organizationID
 }