Add trust center files

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/server/api/trust/v1/schema.graphql

@@ -476,6 +476,24 @@ type TrustCenterReferenceEdge {
   node: TrustCenterReference!
 }
 
+type TrustCenterFile implements Node {
+  id: ID!
+  name: String!
+  category: String!
+  isUserAuthorized: Boolean! @goField(forceResolver: true)
+  hasUserRequestedAccess: Boolean! @goField(forceResolver: true)
+}
+
+type TrustCenterFileConnection {
+  edges: [TrustCenterFileEdge!]!
+  pageInfo: PageInfo!
+}
+
+type TrustCenterFileEdge {
+  cursor: CursorKey!
+  node: TrustCenterFile!
+}
+
 type TrustCenter implements Node {
   id: ID!
   active: Boolean!
@@ -513,6 +531,13 @@ type TrustCenter implements Node {
     last: Int
     before: CursorKey
   ): TrustCenterReferenceConnection! @goField(forceResolver: true)
+
+  trustCenterFiles(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+  ): TrustCenterFileConnection! @goField(forceResolver: true)
 }
 
 type TrustCenterAccess implements Node {
@@ -559,6 +584,17 @@ input RequestReportAccessInput {
   name: String
 }
 
+input RequestTrustCenterFileAccessInput {
+  trustCenterId: ID!
+  trustCenterFileId: ID!
+  email: String
+  name: String
+}
+
+input ExportTrustCenterFileInput {
+  trustCenterFileId: ID!
+}
+
 type ExportDocumentPDFPayload {
   data: String!
 }
@@ -567,6 +603,10 @@ type ExportReportPDFPayload {
   data: String!
 }
 
+type ExportTrustCenterFilePayload {
+  data: String!
+}
+
 type AcceptNonDisclosureAgreementPayload {
   success: Boolean!
 }
@@ -598,4 +638,12 @@ type Mutation {
   requestReportAccess(
     input: RequestReportAccessInput!
   ): RequestAccessesPayload! @mustBeAuthenticated(role: NONE)
+
+  requestTrustCenterFileAccess(
+    input: RequestTrustCenterFileAccessInput!
+  ): RequestAccessesPayload! @mustBeAuthenticated(role: NONE)
+
+  exportTrustCenterFile(
+    input: ExportTrustCenterFileInput!
+  ): ExportTrustCenterFilePayload! @mustBeAuthenticated(role: NONE)
 }

pkg/server/api/trust/v1/slack_handler.go

@@ -148,6 +148,7 @@ func slackHandler(trustSvc *trust.Service, slackSigningSecret string, logger *lo
 
 		var documentIDs []gid.GID
 		var reportIDs []gid.GID
+		var fileIDs []gid.GID
 
 		switch action.ActionID {
 		case "accept_all":
@@ -157,9 +158,9 @@ func slackHandler(trustSvc *trust.Service, slackSigningSecret string, logger *lo
 				return
 			}
 
-			documentIDs, reportIDs, err = tenantSvc.SlackMessages.GetSlackMessageMetadataByID(ctx, currentMessageId)
+			documentIDs, reportIDs, fileIDs, err = tenantSvc.SlackMessages.GetSlackMessageDocumentIDs(ctx, currentMessageId)
 			if err != nil {
-				logger.ErrorCtx(ctx, "cannot load slack message metadata by ID", log.Error(err))
+				logger.ErrorCtx(ctx, "cannot load slack message document ids", log.Error(err))
 				httpserver.RenderJSON(w, http.StatusInternalServerError, SlackInteractiveResponse{Success: false, Message: "internal server error"})
 				return
 			}
@@ -180,6 +181,14 @@ func slackHandler(trustSvc *trust.Service, slackSigningSecret string, logger *lo
 			}
 			reportIDs = []gid.GID{repID}
 
+		case "accept_file":
+			fileID, err := gid.ParseGID(action.Value)
+			if err != nil {
+				httpserver.RenderJSON(w, http.StatusBadRequest, SlackInteractiveResponse{Success: false, Message: "invalid file ID"})
+				return
+			}
+			fileIDs = []gid.GID{fileID}
+
 		default:
 			httpserver.RenderJSON(w, http.StatusBadRequest, SlackInteractiveResponse{Success: false, Message: fmt.Sprintf("unknown action: %s", action.ActionID)})
 			return
@@ -191,6 +200,7 @@ func slackHandler(trustSvc *trust.Service, slackSigningSecret string, logger *lo
 			requesterEmail,
 			documentIDs,
 			reportIDs,
+			fileIDs,
 		); err != nil {
 			logger.ErrorCtx(ctx, "failed to grant access", log.Error(err))
 			httpserver.RenderJSON(w, http.StatusInternalServerError, SlackInteractiveResponse{Success: false, Message: "internal server error"})

pkg/server/api/trust/v1/types/trust_center_file.go

@@ -0,0 +1,49 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"github.com/getprobo/probo/pkg/coredata"
+	"github.com/getprobo/probo/pkg/page"
+)
+
+func NewTrustCenterFileConnection(
+	p *page.Page[*coredata.TrustCenterFile, coredata.TrustCenterFileOrderField],
+) *TrustCenterFileConnection {
+	edges := make([]*TrustCenterFileEdge, len(p.Data))
+	for i, trustCenterFile := range p.Data {
+		edges[i] = NewTrustCenterFileEdge(trustCenterFile, p.Cursor.OrderBy.Field)
+	}
+
+	return &TrustCenterFileConnection{
+		Edges:    edges,
+		PageInfo: NewPageInfo(p),
+	}
+}
+
+func NewTrustCenterFile(f *coredata.TrustCenterFile) *TrustCenterFile {
+	return &TrustCenterFile{
+		ID:       f.ID,
+		Name:     f.Name,
+		Category: f.Category,
+	}
+}
+
+func NewTrustCenterFileEdge(f *coredata.TrustCenterFile, orderField coredata.TrustCenterFileOrderField) *TrustCenterFileEdge {
+	return &TrustCenterFileEdge{
+		Node:   NewTrustCenterFile(f),
+		Cursor: f.CursorKey(orderField),
+	}
+}

pkg/server/api/trust/v1/types/types.go

@@ -83,6 +83,14 @@ type ExportReportPDFPayload struct {
 	Data string `json:"data"`
 }
 
+type ExportTrustCenterFileInput struct {
+	TrustCenterFileID gid.GID `json:"trustCenterFileId"`
+}
+
+type ExportTrustCenterFilePayload struct {
+	Data string `json:"data"`
+}
+
 type Framework struct {
 	ID   gid.GID `json:"id"`
 	Name string  `json:"name"`
@@ -151,6 +159,13 @@ type RequestReportAccessInput struct {
 	Name          *string `json:"name,omitempty"`
 }
 
+type RequestTrustCenterFileAccessInput struct {
+	TrustCenterID     gid.GID `json:"trustCenterId"`
+	TrustCenterFileID gid.GID `json:"trustCenterFileId"`
+	Email             *string `json:"email,omitempty"`
+	Name              *string `json:"name,omitempty"`
+}
+
 type TrustCenter struct {
 	ID                                gid.GID                         `json:"id"`
 	Active                            bool                            `json:"active"`
@@ -164,6 +179,7 @@ type TrustCenter struct {
 	Audits                            *AuditConnection                `json:"audits"`
 	Vendors                           *VendorConnection               `json:"vendors"`
 	References                        *TrustCenterReferenceConnection `json:"references"`
+	TrustCenterFiles                  *TrustCenterFileConnection      `json:"trustCenterFiles"`
 }
 
 func (TrustCenter) IsNode()             {}
@@ -180,6 +196,27 @@ type TrustCenterAccess struct {
 func (TrustCenterAccess) IsNode()             {}
 func (this TrustCenterAccess) GetID() gid.GID { return this.ID }
 
+type TrustCenterFile struct {
+	ID                     gid.GID `json:"id"`
+	Name                   string  `json:"name"`
+	Category               string  `json:"category"`
+	IsUserAuthorized       bool    `json:"isUserAuthorized"`
+	HasUserRequestedAccess bool    `json:"hasUserRequestedAccess"`
+}
+
+func (TrustCenterFile) IsNode()             {}
+func (this TrustCenterFile) GetID() gid.GID { return this.ID }
+
+type TrustCenterFileConnection struct {
+	Edges    []*TrustCenterFileEdge `json:"edges"`
+	PageInfo *PageInfo              `json:"pageInfo"`
+}
+
+type TrustCenterFileEdge struct {
+	Cursor page.CursorKey   `json:"cursor"`
+	Node   *TrustCenterFile `json:"node"`
+}
+
 type TrustCenterReference struct {
 	ID          gid.GID `json:"id"`
 	Name        string  `json:"name"`

pkg/server/api/trust/v1/v1_resolver.go

@@ -445,6 +445,138 @@ func (r *mutationResolver) RequestReportAccess(ctx context.Context, input types.
 	}, nil
 }
 
+// RequestTrustCenterFileAccess is the resolver for the requestTrustCenterFileAccess field.
+func (r *mutationResolver) RequestTrustCenterFileAccess(ctx context.Context, input types.RequestTrustCenterFileAccessInput) (*types.RequestAccessesPayload, error) {
+	publicTrustService := r.PublicTrustService(ctx, input.TrustCenterID.TenantID())
+
+	trustCenterFile, err := publicTrustService.TrustCenterFiles.Get(ctx, input.TrustCenterFileID)
+	if err != nil {
+		panic(fmt.Errorf("cannot load trust center file: %w", err))
+	}
+
+	if trustCenterFile.TrustCenterVisibility == coredata.TrustCenterVisibilityPublic {
+		return nil, fmt.Errorf("trust center file is publicly available and does not require access request")
+	}
+
+	userData := r.UserFromContext(ctx)
+	if userData != nil {
+		return nil, fmt.Errorf("session users cannot request trust center access")
+	}
+
+	email := input.Email
+	tokenData := TokenAccessFromContext(ctx)
+	if tokenData != nil {
+		if email != nil || input.Name != nil {
+			return nil, fmt.Errorf("email and name are not allowed for authenticated users")
+		}
+		emailValue := tokenData.GetEmail()
+		email = &emailValue
+	}
+	if email == nil {
+		return nil, fmt.Errorf("email is required for unauthenticated users")
+	}
+
+	access, err := publicTrustService.TrustCenterAccesses.Request(ctx, &trust.TrustCenterAccessRequest{
+		TrustCenterID:      input.TrustCenterID,
+		Email:              *email,
+		Name:               input.Name,
+		DocumentIDs:        []gid.GID{},
+		ReportIDs:          []gid.GID{},
+		TrustCenterFileIDs: []gid.GID{input.TrustCenterFileID},
+	})
+	if err != nil {
+		panic(fmt.Errorf("cannot request trust center file access: %w", err))
+	}
+
+	return &types.RequestAccessesPayload{
+		TrustCenterAccess: &types.TrustCenterAccess{
+			ID:        access.ID,
+			Email:     access.Email,
+			Name:      access.Name,
+			CreatedAt: access.CreatedAt,
+			UpdatedAt: access.UpdatedAt,
+		},
+	}, nil
+}
+
+// ExportTrustCenterFile is the resolver for the exportTrustCenterFile field.
+func (r *mutationResolver) ExportTrustCenterFile(ctx context.Context, input types.ExportTrustCenterFileInput) (*types.ExportTrustCenterFilePayload, error) {
+	publicTrustService := r.PublicTrustService(ctx, input.TrustCenterFileID.TenantID())
+
+	trustCenterFile, err := publicTrustService.TrustCenterFiles.Get(ctx, input.TrustCenterFileID)
+	if err != nil {
+		panic(fmt.Errorf("cannot load trust center file: %w", err))
+	}
+
+	if trustCenterFile.TrustCenterVisibility == coredata.TrustCenterVisibilityPublic {
+		fileData, err := publicTrustService.TrustCenterFiles.ExportFileWithoutWatermark(ctx, input.TrustCenterFileID)
+		if err != nil {
+			panic(fmt.Errorf("cannot export trust center file: %w", err))
+		}
+
+		return &types.ExportTrustCenterFilePayload{
+			Data: fmt.Sprintf("data:application/pdf;base64,%s", base64.StdEncoding.EncodeToString(fileData)),
+		}, nil
+	}
+
+	privateTrustService, err := r.PrivateTrustService(ctx, input.TrustCenterFileID.TenantID())
+	if err != nil {
+		return nil, fmt.Errorf("cannot export trust center file: %w", err)
+	}
+
+	tokenData := TokenAccessFromContext(ctx)
+	if tokenData != nil {
+		ndaExists := true
+		hasAcceptedNDA := false
+
+		trustCenter, _, err := privateTrustService.TrustCenters.Get(ctx, tokenData.TrustCenterID)
+		if err != nil {
+			panic(fmt.Errorf("cannot get trust center: %w", err))
+		}
+		if trustCenter.NonDisclosureAgreementFileID == nil {
+			ndaExists = false
+		}
+
+		if ndaExists {
+			hasAcceptedNDA, err = privateTrustService.TrustCenterAccesses.HasAcceptedNonDisclosureAgreement(ctx, tokenData.TrustCenterID, tokenData.GetEmail())
+			if err != nil {
+				panic(fmt.Errorf("cannot check if user has accepted NDA: %w", err))
+			}
+		}
+
+		fileAccess, err := privateTrustService.TrustCenterAccesses.LoadTrustCenterFileAccess(ctx, tokenData.TrustCenterID, tokenData.GetEmail(), input.TrustCenterFileID)
+		if err != nil {
+			panic(fmt.Errorf("cannot check trust center file access: %w", err))
+		}
+
+		if !fileAccess.Active {
+			return nil, fmt.Errorf("access denied: no permission to access this file")
+		}
+
+		if ndaExists && !hasAcceptedNDA {
+			return nil, fmt.Errorf("user has not accepted NDA")
+		}
+	}
+
+	userData := UserFromContext(ctx)
+	userEmail := ""
+	if userData != nil {
+		userEmail = userData.EmailAddress
+	}
+	if tokenData != nil {
+		userEmail = tokenData.GetEmail()
+	}
+
+	fileData, err := privateTrustService.TrustCenterFiles.ExportFile(ctx, input.TrustCenterFileID, userEmail)
+	if err != nil {
+		panic(fmt.Errorf("cannot export trust center file: %w", err))
+	}
+
+	return &types.ExportTrustCenterFilePayload{
+		Data: fmt.Sprintf("data:application/pdf;base64,%s", base64.StdEncoding.EncodeToString(fileData)),
+	}, nil
+}
+
 // LogoURL is the resolver for the logoUrl field.
 func (r *organizationResolver) LogoURL(ctx context.Context, obj *types.Organization) (*string, error) {
 	publicTrustService := r.PublicTrustService(ctx, obj.ID.TenantID())
@@ -772,6 +904,84 @@ func (r *trustCenterResolver) References(ctx context.Context, obj *types.TrustCe
 	return types.NewTrustCenterReferenceConnection(referencePage), nil
 }
 
+// TrustCenterFiles is the resolver for the trustCenterFiles field.
+func (r *trustCenterResolver) TrustCenterFiles(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.TrustCenterFileConnection, error) {
+	publicTrustService := r.PublicTrustService(ctx, obj.ID.TenantID())
+
+	pageOrderBy := page.OrderBy[coredata.TrustCenterFileOrderField]{
+		Field:     coredata.TrustCenterFileOrderFieldName,
+		Direction: page.OrderDirectionAsc,
+	}
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	trustCenterFilePage, err := publicTrustService.TrustCenterFiles.ListForOrganizationId(ctx, obj.Organization.ID, cursor)
+	if err != nil {
+		panic(fmt.Errorf("cannot list public trust center files: %w", err))
+	}
+
+	return types.NewTrustCenterFileConnection(trustCenterFilePage), nil
+}
+
+// IsUserAuthorized is the resolver for the isUserAuthorized field.
+func (r *trustCenterFileResolver) IsUserAuthorized(ctx context.Context, obj *types.TrustCenterFile) (bool, error) {
+	publicTrustService := r.PublicTrustService(ctx, obj.ID.TenantID())
+
+	trustCenterFile, err := publicTrustService.TrustCenterFiles.Get(ctx, obj.ID)
+	if err != nil {
+		panic(fmt.Errorf("cannot load trust center file: %w", err))
+	}
+
+	if trustCenterFile.TrustCenterVisibility == coredata.TrustCenterVisibilityPublic {
+		return true, nil
+	}
+
+	privateTrustService, err := r.PrivateTrustService(ctx, obj.ID.TenantID())
+	if err != nil {
+		return false, nil
+	}
+
+	userData := r.UserFromContext(ctx)
+	if userData != nil {
+		return true, nil
+	}
+
+	tokenData := TokenAccessFromContext(ctx)
+	if tokenData != nil {
+		fileAccess, err := privateTrustService.TrustCenterAccesses.LoadTrustCenterFileAccess(ctx, tokenData.TrustCenterID, tokenData.GetEmail(), obj.ID)
+		if err != nil {
+			return false, nil
+		}
+
+		return fileAccess.Active, nil
+	}
+
+	panic(fmt.Errorf("no user or token data found"))
+}
+
+// HasUserRequestedAccess is the resolver for the hasUserRequestedAccess field.
+func (r *trustCenterFileResolver) HasUserRequestedAccess(ctx context.Context, obj *types.TrustCenterFile) (bool, error) {
+	privateTrustService, err := r.PrivateTrustService(ctx, obj.ID.TenantID())
+	if err != nil {
+		return false, nil
+	}
+
+	userData := r.UserFromContext(ctx)
+	if userData != nil {
+		return false, nil
+	}
+
+	tokenData := TokenAccessFromContext(ctx)
+	if tokenData != nil {
+		_, err := privateTrustService.TrustCenterAccesses.LoadTrustCenterFileAccess(ctx, tokenData.TrustCenterID, tokenData.GetEmail(), obj.ID)
+		if err != nil {
+			return false, nil
+		}
+		return true, nil
+	}
+
+	return false, nil
+}
+
 // LogoURL is the resolver for the logoUrl field.
 func (r *trustCenterReferenceResolver) LogoURL(ctx context.Context, obj *types.TrustCenterReference) (string, error) {
 	publicTrustService := r.PublicTrustService(ctx, obj.ID.TenantID())
@@ -805,6 +1015,11 @@ func (r *Resolver) Report() schema.ReportResolver { return &reportResolver{r} }
 // TrustCenter returns schema.TrustCenterResolver implementation.
 func (r *Resolver) TrustCenter() schema.TrustCenterResolver { return &trustCenterResolver{r} }
 
+// TrustCenterFile returns schema.TrustCenterFileResolver implementation.
+func (r *Resolver) TrustCenterFile() schema.TrustCenterFileResolver {
+	return &trustCenterFileResolver{r}
+}
+
 // TrustCenterReference returns schema.TrustCenterReferenceResolver implementation.
 func (r *Resolver) TrustCenterReference() schema.TrustCenterReferenceResolver {
 	return &trustCenterReferenceResolver{r}
@@ -817,4 +1032,5 @@ type organizationResolver struct{ *Resolver }
 type queryResolver struct{ *Resolver }
 type reportResolver struct{ *Resolver }
 type trustCenterResolver struct{ *Resolver }
+type trustCenterFileResolver struct{ *Resolver }
 type trustCenterReferenceResolver struct{ *Resolver }