rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Split employee document policy from core document actions

Browse Source 
Introduce dedicated employee-scoped IAM actions and update all
resolvers and frontend mutations accordingly.

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
This commit is contained in:
Sacha Al Himdani
2026-04-01 11:33:40 +02:00
parent bcfc693366
commit 1b811011eb
12 changed files with 1331 additions and 177 deletions
Download Patch File Download Diff File Expand all files Collapse all files

72
pkg/coredata/document_filter.go
View File

@@ -17,7 +17,6 @@ package coredata
import (
"github.com/jackc/pgx/v5"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/mail"
)
type (
@@ -25,8 +24,8 @@ type (
query *string
trustCenterVisibilities []TrustCenterVisibility
published *bool
userEmail *mail.Addr
approverIdentityID *gid.GID
employeeIdentityID *gid.GID
employeeFilterModes []EmployeeFilterMode
documentTypes []DocumentType
classifications []DocumentClassification
status []DocumentStatus
@@ -56,13 +55,9 @@ func (f *DocumentFilter) WithPublished(published *bool) *DocumentFilter {
return f
}
func (f *DocumentFilter) WithUserEmail(userEmail *mail.Addr) *DocumentFilter {
f.userEmail = userEmail
return f
}
func (f *DocumentFilter) WithApproverIdentityID(identityID *gid.GID) *DocumentFilter {
f.approverIdentityID = identityID
func (f *DocumentFilter) WithEmployeeIdentityID(identityID *gid.GID, modes ...EmployeeFilterMode) *DocumentFilter {
f.employeeIdentityID = identityID
f.employeeFilterModes = modes
return f
}
@@ -114,12 +109,17 @@ func (f *DocumentFilter) SQLArguments() pgx.NamedArgs {
}
}
var employeeFilterModes []string
for _, m := range f.employeeFilterModes {
employeeFilterModes = append(employeeFilterModes, string(m))
}
return pgx.NamedArgs{
"query": f.query,
"trust_center_visibilities": visibilities,
"published": f.published,
"user_email": f.userEmail,
"approver_identity_id": f.approverIdentityID,
"employee_identity_id": f.employeeIdentityID,
"employee_filter_modes": employeeFilterModes,
"document_types": documentTypes,
"classifications": classifications,
"document_status": status,
@@ -151,30 +151,30 @@ func (f *DocumentFilter) SQLFragment() string {
END
AND
CASE
WHEN @user_email::text IS NULL THEN TRUE
ELSE EXISTS (
SELECT 1
FROM document_versions dv
INNER JOIN document_version_signatures dvs ON dv.id = dvs.document_version_id
INNER JOIN iam_membership_profiles p ON dvs.signed_by_profile_id = p.id
INNER JOIN identities i ON p.identity_id = i.id
WHERE dv.document_id = documents.id
AND dv.status = 'PUBLISHED'
AND i.email_address = @user_email::CITEXT
AND dvs.state IN ('REQUESTED', 'SIGNED')
)
END
AND
CASE
WHEN @approver_identity_id::text IS NULL THEN TRUE
ELSE EXISTS (
SELECT 1
FROM document_versions dv
INNER JOIN document_version_approval_quorums dvaq ON dvaq.version_id = dv.id
INNER JOIN document_version_approval_decisions dvad ON dvad.quorum_id = dvaq.id
INNER JOIN iam_membership_profiles p ON dvad.approver_id = p.id
WHERE dv.document_id = documents.id
AND p.identity_id = @approver_identity_id::text
WHEN @employee_identity_id::text IS NULL THEN TRUE
ELSE (
(
'signature' = ANY(@employee_filter_modes::text[]) AND EXISTS (
SELECT 1
FROM document_versions dv
INNER JOIN document_version_signatures dvs ON dv.id = dvs.document_version_id
INNER JOIN iam_membership_profiles p ON dvs.signed_by_profile_id = p.id
WHERE dv.document_id = documents.id
AND p.identity_id = @employee_identity_id::text
AND dvs.state IN ('REQUESTED', 'SIGNED')
)
)
OR (
'approval' = ANY(@employee_filter_modes::text[]) AND EXISTS (
SELECT 1
FROM document_versions dv
INNER JOIN document_version_approval_quorums dvaq ON dvaq.version_id = dv.id
INNER JOIN document_version_approval_decisions dvad ON dvad.quorum_id = dvaq.id
INNER JOIN iam_membership_profiles p ON dvad.approver_id = p.id
WHERE dv.document_id = documents.id
AND p.identity_id = @employee_identity_id::text
)
)
)
END
AND

74
pkg/coredata/document_version_filter.go
View File

@@ -17,14 +17,20 @@ package coredata
import (
"github.com/jackc/pgx/v5"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/mail"
)
type EmployeeFilterMode string
const (
EmployeeFilterModeSignature EmployeeFilterMode = "signature"
EmployeeFilterModeApproval EmployeeFilterMode = "approval"
)
type (
DocumentVersionFilter struct {
statuses []DocumentVersionStatus
userEmail *mail.Addr
approverIdentityID *gid.GID
statuses []DocumentVersionStatus
employeeIdentityID *gid.GID
employeeFilterModes []EmployeeFilterMode
}
)
@@ -37,13 +43,9 @@ func (f *DocumentVersionFilter) WithStatuses(statuses ...DocumentVersionStatus)
return f
}
func (f *DocumentVersionFilter) WithUserEmail(userEmail *mail.Addr) *DocumentVersionFilter {
f.userEmail = userEmail
return f
}
func (f *DocumentVersionFilter) WithApproverIdentityID(identityID *gid.GID) *DocumentVersionFilter {
f.approverIdentityID = identityID
func (f *DocumentVersionFilter) WithEmployeeIdentityID(identityID *gid.GID, modes ...EmployeeFilterMode) *DocumentVersionFilter {
f.employeeIdentityID = identityID
f.employeeFilterModes = modes
return f
}
@@ -53,10 +55,15 @@ func (f *DocumentVersionFilter) SQLArguments() pgx.StrictNamedArgs {
filterStatuses = append(filterStatuses, s.String())
}
var employeeFilterModes []string
for _, m := range f.employeeFilterModes {
employeeFilterModes = append(employeeFilterModes, string(m))
}
return pgx.StrictNamedArgs{
"filter_statuses": filterStatuses,
"user_email": f.userEmail,
"approver_identity_id": f.approverIdentityID,
"filter_statuses": filterStatuses,
"employee_identity_id": f.employeeIdentityID,
"employee_filter_modes": employeeFilterModes,
}
}
@@ -69,27 +76,26 @@ func (f *DocumentVersionFilter) SQLFragment() string {
)
AND
(
@user_email::text IS NULL
OR EXISTS (
SELECT 1
FROM document_version_signatures dvs
INNER JOIN iam_membership_profiles p ON dvs.signed_by_profile_id = p.id
INNER JOIN identities i ON p.identity_id = i.id
WHERE dvs.document_version_id = document_versions.id
AND i.email_address = @user_email::CITEXT
AND dvs.state IN ('REQUESTED', 'SIGNED')
@employee_identity_id::text IS NULL
OR (
'signature' = ANY(@employee_filter_modes::text[]) AND EXISTS (
SELECT 1
FROM document_version_signatures dvs
INNER JOIN iam_membership_profiles p ON dvs.signed_by_profile_id = p.id
WHERE dvs.document_version_id = document_versions.id
AND p.identity_id = @employee_identity_id::text
AND dvs.state IN ('REQUESTED', 'SIGNED')
)
)
)
AND
(
@approver_identity_id::text IS NULL
OR EXISTS (
SELECT 1
FROM document_version_approval_quorums dvaq
INNER JOIN document_version_approval_decisions dvad ON dvad.quorum_id = dvaq.id
INNER JOIN iam_membership_profiles p ON dvad.approver_id = p.id
WHERE dvaq.version_id = document_versions.id
AND p.identity_id = @approver_identity_id::text
OR (
'approval' = ANY(@employee_filter_modes::text[]) AND EXISTS (
SELECT 1
FROM document_version_approval_quorums dvaq
INNER JOIN document_version_approval_decisions dvad ON dvad.quorum_id = dvaq.id
INNER JOIN iam_membership_profiles p ON dvad.approver_id = p.id
WHERE dvaq.version_id = document_versions.id
AND p.identity_id = @employee_identity_id::text
)
)
)
)`