rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Split employee document policy from core document actions

Browse Source 
Introduce dedicated employee-scoped IAM actions and update all
resolvers and frontend mutations accordingly.

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
This commit is contained in:
Sacha Al Himdani
2026-04-01 11:33:40 +02:00
parent bcfc693366
commit 1b811011eb
12 changed files with 1331 additions and 177 deletions
Download Patch File Download Diff File Expand all files Collapse all files

72
pkg/coredata/document_filter.go
View File

@@ -17,7 +17,6 @@ package coredata
import (
"github.com/jackc/pgx/v5"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/mail"
)
type (
@@ -25,8 +24,8 @@ type (
query *string
trustCenterVisibilities []TrustCenterVisibility
published *bool
userEmail *mail.Addr
approverIdentityID *gid.GID
employeeIdentityID *gid.GID
employeeFilterModes []EmployeeFilterMode
documentTypes []DocumentType
classifications []DocumentClassification
status []DocumentStatus
@@ -56,13 +55,9 @@ func (f *DocumentFilter) WithPublished(published *bool) *DocumentFilter {
return f
}
func (f *DocumentFilter) WithUserEmail(userEmail *mail.Addr) *DocumentFilter {
f.userEmail = userEmail
return f
}
func (f *DocumentFilter) WithApproverIdentityID(identityID *gid.GID) *DocumentFilter {
f.approverIdentityID = identityID
func (f *DocumentFilter) WithEmployeeIdentityID(identityID *gid.GID, modes ...EmployeeFilterMode) *DocumentFilter {
f.employeeIdentityID = identityID
f.employeeFilterModes = modes
return f
}
@@ -114,12 +109,17 @@ func (f *DocumentFilter) SQLArguments() pgx.NamedArgs {
}
}
var employeeFilterModes []string
for _, m := range f.employeeFilterModes {
employeeFilterModes = append(employeeFilterModes, string(m))
}
return pgx.NamedArgs{
"query": f.query,
"trust_center_visibilities": visibilities,
"published": f.published,
"user_email": f.userEmail,
"approver_identity_id": f.approverIdentityID,
"employee_identity_id": f.employeeIdentityID,
"employee_filter_modes": employeeFilterModes,
"document_types": documentTypes,
"classifications": classifications,
"document_status": status,
@@ -151,30 +151,30 @@ func (f *DocumentFilter) SQLFragment() string {
END
AND
CASE
WHEN @user_email::text IS NULL THEN TRUE
ELSE EXISTS (
SELECT 1
FROM document_versions dv
INNER JOIN document_version_signatures dvs ON dv.id = dvs.document_version_id
INNER JOIN iam_membership_profiles p ON dvs.signed_by_profile_id = p.id
INNER JOIN identities i ON p.identity_id = i.id
WHERE dv.document_id = documents.id
AND dv.status = 'PUBLISHED'
AND i.email_address = @user_email::CITEXT
AND dvs.state IN ('REQUESTED', 'SIGNED')
)
END
AND
CASE
WHEN @approver_identity_id::text IS NULL THEN TRUE
ELSE EXISTS (
SELECT 1
FROM document_versions dv
INNER JOIN document_version_approval_quorums dvaq ON dvaq.version_id = dv.id
INNER JOIN document_version_approval_decisions dvad ON dvad.quorum_id = dvaq.id
INNER JOIN iam_membership_profiles p ON dvad.approver_id = p.id
WHERE dv.document_id = documents.id
AND p.identity_id = @approver_identity_id::text
WHEN @employee_identity_id::text IS NULL THEN TRUE
ELSE (
(
'signature' = ANY(@employee_filter_modes::text[]) AND EXISTS (
SELECT 1
FROM document_versions dv
INNER JOIN document_version_signatures dvs ON dv.id = dvs.document_version_id
INNER JOIN iam_membership_profiles p ON dvs.signed_by_profile_id = p.id
WHERE dv.document_id = documents.id
AND p.identity_id = @employee_identity_id::text
AND dvs.state IN ('REQUESTED', 'SIGNED')
)
)
OR (
'approval' = ANY(@employee_filter_modes::text[]) AND EXISTS (
SELECT 1
FROM document_versions dv
INNER JOIN document_version_approval_quorums dvaq ON dvaq.version_id = dv.id
INNER JOIN document_version_approval_decisions dvad ON dvad.quorum_id = dvaq.id
INNER JOIN iam_membership_profiles p ON dvad.approver_id = p.id
WHERE dv.document_id = documents.id
AND p.identity_id = @employee_identity_id::text
)
)
)
END
AND

74
pkg/coredata/document_version_filter.go
View File

@@ -17,14 +17,20 @@ package coredata
import (
"github.com/jackc/pgx/v5"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/mail"
)
type EmployeeFilterMode string
const (
EmployeeFilterModeSignature EmployeeFilterMode = "signature"
EmployeeFilterModeApproval EmployeeFilterMode = "approval"
)
type (
DocumentVersionFilter struct {
statuses []DocumentVersionStatus
userEmail *mail.Addr
approverIdentityID *gid.GID
statuses []DocumentVersionStatus
employeeIdentityID *gid.GID
employeeFilterModes []EmployeeFilterMode
}
)
@@ -37,13 +43,9 @@ func (f *DocumentVersionFilter) WithStatuses(statuses ...DocumentVersionStatus)
return f
}
func (f *DocumentVersionFilter) WithUserEmail(userEmail *mail.Addr) *DocumentVersionFilter {
f.userEmail = userEmail
return f
}
func (f *DocumentVersionFilter) WithApproverIdentityID(identityID *gid.GID) *DocumentVersionFilter {
f.approverIdentityID = identityID
func (f *DocumentVersionFilter) WithEmployeeIdentityID(identityID *gid.GID, modes ...EmployeeFilterMode) *DocumentVersionFilter {
f.employeeIdentityID = identityID
f.employeeFilterModes = modes
return f
}
@@ -53,10 +55,15 @@ func (f *DocumentVersionFilter) SQLArguments() pgx.StrictNamedArgs {
filterStatuses = append(filterStatuses, s.String())
}
var employeeFilterModes []string
for _, m := range f.employeeFilterModes {
employeeFilterModes = append(employeeFilterModes, string(m))
}
return pgx.StrictNamedArgs{
"filter_statuses": filterStatuses,
"user_email": f.userEmail,
"approver_identity_id": f.approverIdentityID,
"filter_statuses": filterStatuses,
"employee_identity_id": f.employeeIdentityID,
"employee_filter_modes": employeeFilterModes,
}
}
@@ -69,27 +76,26 @@ func (f *DocumentVersionFilter) SQLFragment() string {
)
AND
(
@user_email::text IS NULL
OR EXISTS (
SELECT 1
FROM document_version_signatures dvs
INNER JOIN iam_membership_profiles p ON dvs.signed_by_profile_id = p.id
INNER JOIN identities i ON p.identity_id = i.id
WHERE dvs.document_version_id = document_versions.id
AND i.email_address = @user_email::CITEXT
AND dvs.state IN ('REQUESTED', 'SIGNED')
@employee_identity_id::text IS NULL
OR (
'signature' = ANY(@employee_filter_modes::text[]) AND EXISTS (
SELECT 1
FROM document_version_signatures dvs
INNER JOIN iam_membership_profiles p ON dvs.signed_by_profile_id = p.id
WHERE dvs.document_version_id = document_versions.id
AND p.identity_id = @employee_identity_id::text
AND dvs.state IN ('REQUESTED', 'SIGNED')
)
)
)
AND
(
@approver_identity_id::text IS NULL
OR EXISTS (
SELECT 1
FROM document_version_approval_quorums dvaq
INNER JOIN document_version_approval_decisions dvad ON dvad.quorum_id = dvaq.id
INNER JOIN iam_membership_profiles p ON dvad.approver_id = p.id
WHERE dvaq.version_id = document_versions.id
AND p.identity_id = @approver_identity_id::text
OR (
'approval' = ANY(@employee_filter_modes::text[]) AND EXISTS (
SELECT 1
FROM document_version_approval_quorums dvaq
INNER JOIN document_version_approval_decisions dvad ON dvad.quorum_id = dvaq.id
INNER JOIN iam_membership_profiles p ON dvad.approver_id = p.id
WHERE dvaq.version_id = document_versions.id
AND p.identity_id = @employee_identity_id::text
)
)
)
)`

6
pkg/probo/actions.go
View File

@@ -190,7 +190,6 @@ const (
ActionDocumentVersionGet = "core:document-version:get"
ActionDocumentVersionList = "core:document-version:list"
ActionDocumentVersionExportPDF = "core:document-version:export-pdf"
ActionDocumentVersionExportSignable = "core:document-version:export-signable-pdf"
ActionDocumentVersionSign = "core:document-version:sign"
ActionDocumentVersionUpdate = "core:document-version:update"
ActionDocumentVersionDeleteDraft = "core:document-version:delete-draft"
@@ -203,6 +202,11 @@ const (
ActionDocumentVersionPublish = "core:document-version:publish"
ActionDocumentVersionExport = "core:document-version:export"
// EmployeeDocument actions
ActionEmployeeDocumentGet = "core:employee-document:get"
ActionEmployeeDocumentList = "core:employee-document:list"
ActionEmployeeDocumentVersionExportPDF = "core:employee-document-version:export-pdf"
// DocumentVersionSignature actions
ActionDocumentVersionSignatureRequest = "core:document-version-signature:request"
ActionDocumentVersionCancelSignature = "core:document-version-signature:cancel"

23
pkg/probo/policies.go
View File

@@ -162,13 +162,18 @@ var ViewerPolicy = policy.NewPolicy(
policy.Allow(ActionCustomDomainGet).WithSID("custom-domain-read").When(organizationCondition),
policy.Allow(ActionOrganizationContextGet).WithSID("organization-context-read").When(organizationCondition),
policy.Allow(
ActionDocumentVersionExportPDF, ActionDocumentVersionExportSignable, ActionDocumentVersionSign,
ActionDocumentVersionExportPDF, ActionDocumentVersionSign,
).WithSID("document-signing").When(organizationCondition),
policy.Allow(
ActionDocumentVersionApprove, ActionDocumentVersionReject,
).WithSID("document-approval").When(organizationCondition),
policy.Allow(
ActionEmployeeDocumentGet, ActionEmployeeDocumentList,
ActionEmployeeDocumentVersionExportPDF,
).WithSID("employee-document-access").When(organizationCondition),
policy.Allow(
ActionProcessingActivityExport,
ActionDataProtectionImpactAssessmentExport,
@@ -219,9 +224,14 @@ var AuditorPolicy = policy.NewPolicy(
).WithSID("entity-read-access").When(organizationCondition),
policy.Allow(
ActionDocumentVersionExportPDF, ActionDocumentVersionExportSignable, ActionDocumentVersionSign,
ActionDocumentVersionExportPDF, ActionDocumentVersionSign,
).WithSID("document-signing").When(organizationCondition),
policy.Allow(
ActionEmployeeDocumentGet, ActionEmployeeDocumentList,
ActionEmployeeDocumentVersionExportPDF,
).WithSID("employee-document-access").When(organizationCondition),
policy.Allow(
ActionStateOfApplicabilityExport,
).WithSID("soa-export").When(organizationCondition),
@@ -238,20 +248,19 @@ var EmployeePolicy = policy.NewPolicy(
).WithSID("org-basic-access").When(organizationCondition),
policy.Allow(
ActionDocumentGet, ActionDocumentList,
).WithSID("document-signing-access").When(organizationCondition),
ActionEmployeeDocumentGet, ActionEmployeeDocumentList,
).WithSID("employee-document-access").When(organizationCondition),
policy.Allow(
ActionDocumentVersionGet, ActionDocumentVersionList,
ActionDocumentVersionSign,
ActionDocumentVersionExportSignable,
ActionEmployeeDocumentVersionExportPDF,
).WithSID("document-version-signing").When(organizationCondition),
policy.Allow(
ActionDocumentVersionApprovalList,
ActionDocumentVersionApprove,
ActionDocumentVersionReject,
ActionDocumentVersionExportPDF,
ActionEmployeeDocumentVersionExportPDF,
).WithSID("document-version-approval").When(organizationCondition),
).WithDescription("Employee access - can sign documents, approve documents, and view internal content")

10
pkg/server/api/console/v1/schema.graphql
View File

@@ -3860,9 +3860,9 @@ type Mutation {
exportDocumentVersionPDF(
input: ExportDocumentVersionPDFInput!
): ExportDocumentVersionPDFPayload!
exportSignableVersionDocumentPDF(
input: ExportSignableDocumentVersionPDFInput!
): ExportSignableDocumentVersionPDFPayload!
exportEmployeeDocumentVersionPDF(
input: ExportEmployeeDocumentVersionPDFInput!
): ExportEmployeeDocumentVersionPDFPayload!
exportProcessingActivitiesPDF(
input: ExportProcessingActivitiesPDFInput!
): ExportProcessingActivitiesPDFPayload!
@@ -4492,7 +4492,7 @@ input ExportDocumentVersionPDFInput {
withSignatures: Boolean!
}
input ExportSignableDocumentVersionPDFInput {
input ExportEmployeeDocumentVersionPDFInput {
documentVersionId: ID!
}
@@ -5222,7 +5222,7 @@ type ExportDocumentVersionPDFPayload {
data: String!
}
type ExportSignableDocumentVersionPDFPayload {
type ExportEmployeeDocumentVersionPDFPayload {
data: String!
}

7
pkg/server/api/console/v1/types/employee_document.go
View File

@@ -23,11 +23,11 @@ import (
"go.probo.inc/probo/pkg/page"
)
type EmployeeDocumentFilterMode int
type EmployeeDocumentFilterMode string
const (
EmployeeDocumentFilterModeSignature EmployeeDocumentFilterMode = iota
EmployeeDocumentFilterModeApproval
EmployeeDocumentFilterModeSignature EmployeeDocumentFilterMode = "SIGNATURE"
EmployeeDocumentFilterModeApproval EmployeeDocumentFilterMode = "APPROVAL"
)
type (
@@ -64,6 +64,7 @@ type (
EmployeeDocumentVersion struct {
ID gid.GID
DocumentID gid.GID
OrganizationID gid.GID
Major int
Minor int

57
pkg/server/api/console/v1/v1_resolver.go
View File

@@ -1564,7 +1564,7 @@ func (r *electronicSignatureResolver) Events(ctx context.Context, obj *types.Ele
// Signed is the resolver for the signed field.
func (r *employeeDocumentResolver) Signed(ctx context.Context, obj *types.EmployeeDocument) (*bool, error) {
if err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil {
if err := r.authorize(ctx, obj.ID, probo.ActionEmployeeDocumentGet); err != nil {
return nil, err
}
@@ -1586,7 +1586,7 @@ func (r *employeeDocumentResolver) Signed(ctx context.Context, obj *types.Employ
// ApprovalState is the resolver for the approvalState field.
func (r *employeeDocumentResolver) ApprovalState(ctx context.Context, obj *types.EmployeeDocument) (*coredata.DocumentVersionApprovalDecisionState, error) {
if err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil {
if err := r.authorize(ctx, obj.ID, probo.ActionEmployeeDocumentGet); err != nil {
return nil, err
}
@@ -1608,7 +1608,7 @@ func (r *employeeDocumentResolver) ApprovalState(ctx context.Context, obj *types
// Versions is the resolver for the versions field.
func (r *employeeDocumentResolver) Versions(ctx context.Context, obj *types.EmployeeDocument, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentVersionOrderBy) (*types.EmployeeDocumentVersionConnection, error) {
if err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionList); err != nil {
if err := r.authorize(ctx, obj.ID, probo.ActionEmployeeDocumentGet); err != nil {
return nil, err
}
@@ -1629,14 +1629,20 @@ func (r *employeeDocumentResolver) Versions(ctx context.Context, obj *types.Empl
identity := authn.IdentityFromContext(ctx)
versionFilter := coredata.NewDocumentVersionFilter()
var filterMode coredata.EmployeeFilterMode
switch obj.FilterMode {
case types.EmployeeDocumentFilterModeSignature:
versionFilter = versionFilter.WithUserEmail(&identity.EmailAddress)
filterMode = coredata.EmployeeFilterModeSignature
case types.EmployeeDocumentFilterModeApproval:
versionFilter = versionFilter.WithApproverIdentityID(&identity.ID)
filterMode = coredata.EmployeeFilterModeApproval
default:
r.logger.ErrorCtx(ctx, "unsupported employee document filter mode", log.String("filter_mode", string(obj.FilterMode)))
return nil, gqlutils.Internal(ctx)
}
versionFilter := coredata.NewDocumentVersionFilter().
WithEmployeeIdentityID(&identity.ID, filterMode)
versionsPage, err := prb.Documents.ListVersions(ctx, obj.ID, cursor, versionFilter)
if err != nil {
r.logger.ErrorCtx(ctx, "cannot list employee document versions", log.Error(err))
@@ -1647,6 +1653,7 @@ func (r *employeeDocumentResolver) Versions(ctx context.Context, obj *types.Empl
for i, v := range versionsPage.Data {
employeeVersions[i] = &types.EmployeeDocumentVersion{
ID: v.ID,
DocumentID: obj.ID,
OrganizationID: v.OrganizationID,
Major: v.Major,
Minor: v.Minor,
@@ -1665,7 +1672,7 @@ func (r *employeeDocumentResolver) Versions(ctx context.Context, obj *types.Empl
// Signed is the resolver for the signed field.
func (r *employeeDocumentVersionResolver) Signed(ctx context.Context, obj *types.EmployeeDocumentVersion) (bool, error) {
if err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionGet); err != nil {
if err := r.authorize(ctx, obj.DocumentID, probo.ActionEmployeeDocumentGet); err != nil {
return false, err
}
@@ -1684,7 +1691,7 @@ func (r *employeeDocumentVersionResolver) Signed(ctx context.Context, obj *types
// ApprovalDecision is the resolver for the approvalDecision field.
func (r *employeeDocumentVersionResolver) ApprovalDecision(ctx context.Context, obj *types.EmployeeDocumentVersion) (*types.DocumentVersionApprovalDecision, error) {
if err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionApprovalList); err != nil {
if err := r.authorize(ctx, obj.DocumentID, probo.ActionEmployeeDocumentGet); err != nil {
return nil, err
}
@@ -5708,9 +5715,9 @@ func (r *mutationResolver) ExportDocumentVersionPDF(ctx context.Context, input t
}, nil
}
// ExportSignableVersionDocumentPDF is the resolver for the exportSignableVersionDocumentPDF field.
func (r *mutationResolver) ExportSignableVersionDocumentPDF(ctx context.Context, input types.ExportSignableDocumentVersionPDFInput) (*types.ExportSignableDocumentVersionPDFPayload, error) {
if err := r.authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionExportSignable); err != nil {
// ExportEmployeeDocumentVersionPDF is the resolver for the exportEmployeeDocumentVersionPDF field.
func (r *mutationResolver) ExportEmployeeDocumentVersionPDF(ctx context.Context, input types.ExportEmployeeDocumentVersionPDFInput) (*types.ExportEmployeeDocumentVersionPDFPayload, error) {
if err := r.authorize(ctx, input.DocumentVersionID, probo.ActionEmployeeDocumentVersionExportPDF); err != nil {
return nil, err
}
@@ -5723,7 +5730,11 @@ func (r *mutationResolver) ExportSignableVersionDocumentPDF(ctx context.Context,
}
identity := authn.IdentityFromContext(ctx)
documentFilter := coredata.NewDocumentFilter(nil).WithUserEmail(&identity.EmailAddress)
documentFilter := coredata.NewDocumentFilter(nil).WithEmployeeIdentityID(
&identity.ID,
coredata.EmployeeFilterModeSignature,
coredata.EmployeeFilterModeApproval,
)
_, err = prb.Documents.GetWithFilter(ctx, documentVersion.DocumentID, documentFilter)
if err != nil {
@@ -5731,7 +5742,7 @@ func (r *mutationResolver) ExportSignableVersionDocumentPDF(ctx context.Context,
return nil, gqlutils.NotFound(ctx, err)
}
r.logger.ErrorCtx(ctx, "cannot get signable document", log.Error(err))
r.logger.ErrorCtx(ctx, "cannot get employee document", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
@@ -5743,11 +5754,11 @@ func (r *mutationResolver) ExportSignableVersionDocumentPDF(ctx context.Context,
pdf, err := prb.Documents.ExportPDF(ctx, input.DocumentVersionID, options)
if err != nil {
r.logger.ErrorCtx(ctx, "cannot export signable document PDF", log.Error(err))
r.logger.ErrorCtx(ctx, "cannot export employee document PDF", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
return &types.ExportSignableDocumentVersionPDFPayload{
return &types.ExportEmployeeDocumentVersionPDFPayload{
Data: fmt.Sprintf("data:application/pdf;base64,%s", base64.StdEncoding.EncodeToString(pdf)),
}, nil
}
@@ -10201,7 +10212,7 @@ func (r *vendorServiceResolver) Permission(ctx context.Context, obj *types.Vendo
// SignableDocuments is the resolver for the signableDocuments field.
func (r *viewerResolver) SignableDocuments(ctx context.Context, obj *types.Viewer, organizationID gid.GID, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentOrderBy) (*types.EmployeeDocumentConnection, error) {
if err := r.authorize(ctx, organizationID, probo.ActionDocumentList); err != nil {
if err := r.authorize(ctx, organizationID, probo.ActionEmployeeDocumentList); err != nil {
return nil, err
}
@@ -10222,7 +10233,7 @@ func (r *viewerResolver) SignableDocuments(ctx context.Context, obj *types.Viewe
identity := authn.IdentityFromContext(ctx)
documentFilter := coredata.NewDocumentFilter(nil).WithUserEmail(&identity.EmailAddress)
documentFilter := coredata.NewDocumentFilter(nil).WithEmployeeIdentityID(&identity.ID, coredata.EmployeeFilterModeSignature)
documentsPage, err := prb.Documents.ListByOrganizationID(ctx, organizationID, cursor, documentFilter)
if err != nil {
@@ -10249,7 +10260,7 @@ func (r *viewerResolver) SignableDocuments(ctx context.Context, obj *types.Viewe
// SignableDocument is the resolver for the signableDocument field.
func (r *viewerResolver) SignableDocument(ctx context.Context, obj *types.Viewer, id gid.GID) (*types.EmployeeDocument, error) {
if err := r.authorize(ctx, id, probo.ActionDocumentGet); err != nil {
if err := r.authorize(ctx, id, probo.ActionEmployeeDocumentGet); err != nil {
return nil, err
}
@@ -10257,7 +10268,7 @@ func (r *viewerResolver) SignableDocument(ctx context.Context, obj *types.Viewer
identity := authn.IdentityFromContext(ctx)
documentFilter := coredata.NewDocumentFilter(nil).WithUserEmail(&identity.EmailAddress)
documentFilter := coredata.NewDocumentFilter(nil).WithEmployeeIdentityID(&identity.ID, coredata.EmployeeFilterModeSignature)
document, err := prb.Documents.GetWithFilter(ctx, id, documentFilter)
if err != nil {
if errors.Is(err, coredata.ErrResourceNotFound) {
@@ -10280,7 +10291,7 @@ func (r *viewerResolver) SignableDocument(ctx context.Context, obj *types.Viewer
// ApprovableDocuments is the resolver for the approvableDocuments field.
func (r *viewerResolver) ApprovableDocuments(ctx context.Context, obj *types.Viewer, organizationID gid.GID, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentOrderBy) (*types.EmployeeDocumentConnection, error) {
if err := r.authorize(ctx, organizationID, probo.ActionDocumentVersionApprovalList); err != nil {
if err := r.authorize(ctx, organizationID, probo.ActionEmployeeDocumentList); err != nil {
return nil, err
}
@@ -10301,7 +10312,7 @@ func (r *viewerResolver) ApprovableDocuments(ctx context.Context, obj *types.Vie
identity := authn.IdentityFromContext(ctx)
documentFilter := coredata.NewDocumentFilter(nil).WithApproverIdentityID(&identity.ID)
documentFilter := coredata.NewDocumentFilter(nil).WithEmployeeIdentityID(&identity.ID, coredata.EmployeeFilterModeApproval)
documentsPage, err := prb.Documents.ListByOrganizationID(ctx, organizationID, cursor, documentFilter)
if err != nil {
@@ -10328,7 +10339,7 @@ func (r *viewerResolver) ApprovableDocuments(ctx context.Context, obj *types.Vie
// ApprovableDocument is the resolver for the approvableDocument field.
func (r *viewerResolver) ApprovableDocument(ctx context.Context, obj *types.Viewer, id gid.GID) (*types.EmployeeDocument, error) {
if err := r.authorize(ctx, id, probo.ActionDocumentGet); err != nil {
if err := r.authorize(ctx, id, probo.ActionEmployeeDocumentGet); err != nil {
return nil, err
}
@@ -10336,7 +10347,7 @@ func (r *viewerResolver) ApprovableDocument(ctx context.Context, obj *types.View
identity := authn.IdentityFromContext(ctx)
documentFilter := coredata.NewDocumentFilter(nil).WithApproverIdentityID(&identity.ID)
documentFilter := coredata.NewDocumentFilter(nil).WithEmployeeIdentityID(&identity.ID, coredata.EmployeeFilterModeApproval)
document, err := prb.Documents.GetWithFilter(ctx, id, documentFilter)
if err != nil {
if errors.Is(err, coredata.ErrResourceNotFound) {