Fix document pages permissions handling

Signed-off-by: Émile Ré <nemile.re@gmail.com>

apps/console/src/__generated__/core/CreateDocumentDialogMutation.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<8f842e1d6a4c314a9bfba43097ac2795>>
+ * @generated SignedSource<<8a75dcc06cfe213df84407b8855d73c9>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -188,6 +188,19 @@ return {
                     "name": "updatedAt",
                     "storageKey": null
                   },
+                  {
+                    "alias": "canDelete",
+                    "args": [
+                      {
+                        "kind": "Literal",
+                        "name": "action",
+                        "value": "core:document:delete"
+                      }
+                    ],
+                    "kind": "ScalarField",
+                    "name": "permission",
+                    "storageKey": "permission(action:\"core:document:delete\")"
+                  },
                   {
                     "alias": null,
                     "args": null,
@@ -336,12 +349,12 @@ return {
     ]
   },
   "params": {
-    "cacheID": "319502472cd9600df506f084a7648571",
+    "cacheID": "8f0e8730a2b85c51592d45cbf4ad8b1e",
     "id": null,
     "metadata": {},
     "name": "CreateDocumentDialogMutation",
     "operationKind": "mutation",
-    "text": "mutation CreateDocumentDialogMutation(\n  $input: CreateDocumentInput!\n) {\n  createDocument(input: $input) {\n    documentEdge {\n      node {\n        id\n        ...DocumentsPageRowFragment\n      }\n    }\n  }\n}\n\nfragment DocumentsPageRowFragment on Document {\n  id\n  title\n  description\n  documentType\n  classification\n  updatedAt\n  owner {\n    id\n    fullName\n  }\n  versions(first: 1) {\n    edges {\n      node {\n        id\n        status\n        version\n        signatures(first: 1000) {\n          edges {\n            node {\n              id\n              state\n            }\n          }\n        }\n      }\n    }\n  }\n}\n"
+    "text": "mutation CreateDocumentDialogMutation(\n  $input: CreateDocumentInput!\n) {\n  createDocument(input: $input) {\n    documentEdge {\n      node {\n        id\n        ...DocumentsPageRowFragment\n      }\n    }\n  }\n}\n\nfragment DocumentsPageRowFragment on Document {\n  id\n  title\n  description\n  documentType\n  classification\n  updatedAt\n  canDelete: permission(action: \"core:document:delete\")\n  owner {\n    id\n    fullName\n  }\n  versions(first: 1) {\n    edges {\n      node {\n        id\n        status\n        version\n        signatures(first: 1000) {\n          edges {\n            node {\n              id\n              state\n            }\n          }\n        }\n      }\n    }\n  }\n}\n"
   }
 };
 })();

apps/console/src/__generated__/core/DocumentDetailPageDocumentFragment.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<3ba79250c6ba07fa44aca6eff28b3d9d>>
+ * @generated SignedSource<<66ab14196c29af984b08f90039037dee>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -15,6 +15,9 @@ export type DocumentType = "ISMS" | "OTHER" | "POLICY" | "PROCEDURE";
 export type DocumentVersionSignatureState = "REQUESTED" | "SIGNED";
 import { FragmentRefs } from "relay-runtime";
 export type DocumentDetailPageDocumentFragment$data = {
+  readonly canDelete: boolean;
+  readonly canPublish: boolean;
+  readonly canUpdate: boolean;
   readonly classification: DocumentClassification;
   readonly controlsInfo: {
     readonly totalCount: number;
@@ -30,6 +33,7 @@ export type DocumentDetailPageDocumentFragment$data = {
     readonly __id: string;
     readonly edges: ReadonlyArray<{
       readonly node: {
+        readonly canDeleteDraft: boolean;
         readonly classification: DocumentClassification;
         readonly content: string;
         readonly id: string;
@@ -191,6 +195,45 @@ return {
     },
     (v1/*: any*/),
     (v2/*: any*/),
+    {
+      "alias": "canUpdate",
+      "args": [
+        {
+          "kind": "Literal",
+          "name": "action",
+          "value": "core:document:update"
+        }
+      ],
+      "kind": "ScalarField",
+      "name": "permission",
+      "storageKey": "permission(action:\"core:document:update\")"
+    },
+    {
+      "alias": "canDelete",
+      "args": [
+        {
+          "kind": "Literal",
+          "name": "action",
+          "value": "core:document:delete"
+        }
+      ],
+      "kind": "ScalarField",
+      "name": "permission",
+      "storageKey": "permission(action:\"core:document:delete\")"
+    },
+    {
+      "alias": "canPublish",
+      "args": [
+        {
+          "kind": "Literal",
+          "name": "action",
+          "value": "core:document-version:publish"
+        }
+      ],
+      "kind": "ScalarField",
+      "name": "permission",
+      "storageKey": "permission(action:\"core:document-version:publish\")"
+    },
     {
       "args": null,
       "kind": "FragmentSpread",
@@ -282,6 +325,19 @@ return {
                 },
                 (v1/*: any*/),
                 (v2/*: any*/),
+                {
+                  "alias": "canDeleteDraft",
+                  "args": [
+                    {
+                      "kind": "Literal",
+                      "name": "action",
+                      "value": "core:document-version:delete-draft"
+                    }
+                  ],
+                  "kind": "ScalarField",
+                  "name": "permission",
+                  "storageKey": "permission(action:\"core:document-version:delete-draft\")"
+                },
                 {
                   "args": null,
                   "kind": "FragmentSpread",
@@ -368,6 +424,6 @@ return {
 };
 })();
 
-(node as any).hash = "e1418d5efeade64db32e9939132c03de";
+(node as any).hash = "5ed2f764b1587dd945b0a10c33cee729";
 
 export default node;

apps/console/src/__generated__/core/DocumentDetailPagePublishMutation.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<cbecbaa326b9bff1adb82a94123a2ee2>>
+ * @generated SignedSource<<e3ebdf9d0caacde97761e1e28ac09105>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -133,13 +133,20 @@ v12 = {
   ]
 },
 v13 = [
+  {
+    "kind": "Literal",
+    "name": "action",
+    "value": "core:document-version:request-signature"
+  }
+],
+v14 = [
   {
     "kind": "Literal",
     "name": "first",
     "value": 1000
   }
 ],
-v14 = {
+v15 = {
   "alias": null,
   "args": null,
   "concreteType": "PageInfo",
@@ -229,6 +236,45 @@ return {
               },
               (v3/*: any*/),
               (v5/*: any*/),
+              {
+                "alias": "canUpdate",
+                "args": [
+                  {
+                    "kind": "Literal",
+                    "name": "action",
+                    "value": "core:document:update"
+                  }
+                ],
+                "kind": "ScalarField",
+                "name": "permission",
+                "storageKey": "permission(action:\"core:document:update\")"
+              },
+              {
+                "alias": "canDelete",
+                "args": [
+                  {
+                    "kind": "Literal",
+                    "name": "action",
+                    "value": "core:document:delete"
+                  }
+                ],
+                "kind": "ScalarField",
+                "name": "permission",
+                "storageKey": "permission(action:\"core:document:delete\")"
+              },
+              {
+                "alias": "canPublish",
+                "args": [
+                  {
+                    "kind": "Literal",
+                    "name": "action",
+                    "value": "core:document-version:publish"
+                  }
+                ],
+                "kind": "ScalarField",
+                "name": "permission",
+                "storageKey": "permission(action:\"core:document-version:publish\")"
+              },
               {
                 "alias": null,
                 "args": (v6/*: any*/),
@@ -413,8 +459,28 @@ return {
                           (v3/*: any*/),
                           (v5/*: any*/),
                           {
-                            "alias": null,
+                            "alias": "canDeleteDraft",
+                            "args": [
+                              {
+                                "kind": "Literal",
+                                "name": "action",
+                                "value": "core:document-version:delete-draft"
+                              }
+                            ],
+                            "kind": "ScalarField",
+                            "name": "permission",
+                            "storageKey": "permission(action:\"core:document-version:delete-draft\")"
+                          },
+                          {
+                            "alias": "canRequestSignature",
                             "args": (v13/*: any*/),
+                            "kind": "ScalarField",
+                            "name": "permission",
+                            "storageKey": "permission(action:\"core:document-version:request-signature\")"
+                          },
+                          {
+                            "alias": null,
+                            "args": (v14/*: any*/),
                             "concreteType": "DocumentVersionSignatureConnection",
                             "kind": "LinkedField",
                             "name": "signatures",
@@ -478,6 +544,13 @@ return {
                                         "name": "requestedAt",
                                         "storageKey": null
                                       },
+                                      {
+                                        "alias": "canCancel",
+                                        "args": (v13/*: any*/),
+                                        "kind": "ScalarField",
+                                        "name": "permission",
+                                        "storageKey": "permission(action:\"core:document-version:request-signature\")"
+                                      },
                                       (v8/*: any*/)
                                     ],
                                     "storageKey": null
@@ -486,14 +559,14 @@ return {
                                 ],
                                 "storageKey": null
                               },
-                              (v14/*: any*/),
+                              (v15/*: any*/),
                               (v12/*: any*/)
                             ],
                             "storageKey": "signatures(first:1000)"
                           },
                           {
                             "alias": null,
-                            "args": (v13/*: any*/),
+                            "args": (v14/*: any*/),
                             "filters": [
                               "filter"
                             ],
@@ -504,7 +577,7 @@ return {
                           },
                           {
                             "alias": null,
-                            "args": (v13/*: any*/),
+                            "args": (v14/*: any*/),
                             "filters": [],
                             "handle": "connection",
                             "key": "DocumentDetailPage_signatures",
@@ -519,7 +592,7 @@ return {
                     ],
                     "storageKey": null
                   },
-                  (v14/*: any*/),
+                  (v15/*: any*/),
                   (v12/*: any*/)
                 ],
                 "storageKey": "versions(first:20)"
@@ -542,12 +615,12 @@ return {
     ]
   },
   "params": {
-    "cacheID": "b9140949eb57389fe8c50588c695973b",
+    "cacheID": "91d0c14af00c2a67732d781e41770a81",
     "id": null,
     "metadata": {},
     "name": "DocumentDetailPagePublishMutation",
     "operationKind": "mutation",
-    "text": "mutation DocumentDetailPagePublishMutation(\n  $input: PublishDocumentVersionInput!\n) {\n  publishDocumentVersion(input: $input) {\n    document {\n      ...DocumentDetailPageDocumentFragment\n      id\n    }\n  }\n}\n\nfragment DocumentControlsTabFragment on Document {\n  id\n  controls(first: 20) {\n    edges {\n      node {\n        id\n        ...LinkedControlsCardFragment\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n}\n\nfragment DocumentDetailPageDocumentFragment on Document {\n  id\n  title\n  documentType\n  classification\n  owner {\n    id\n    fullName\n  }\n  ...DocumentControlsTabFragment\n  controlsInfo: controls(first: 0) {\n    totalCount\n  }\n  versions(first: 20) {\n    edges {\n      node {\n        id\n        content\n        status\n        publishedAt\n        version\n        updatedAt\n        classification\n        owner {\n          id\n          fullName\n        }\n        ...DocumentSignaturesTab_version\n        signatures(first: 1000) {\n          edges {\n            node {\n              id\n              state\n              signedBy {\n                id\n              }\n              ...DocumentSignaturesTab_signature\n              __typename\n            }\n            cursor\n          }\n          pageInfo {\n            endCursor\n            hasNextPage\n          }\n        }\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n    }\n  }\n}\n\nfragment DocumentSignaturesTab_signature on DocumentVersionSignature {\n  id\n  state\n  signedAt\n  requestedAt\n  signedBy {\n    fullName\n    primaryEmailAddress\n    id\n  }\n}\n\nfragment DocumentSignaturesTab_version on DocumentVersion {\n  id\n  status\n  signatures(first: 1000) {\n    edges {\n      node {\n        id\n        state\n        signedBy {\n          id\n          fullName\n          primaryEmailAddress\n        }\n        ...DocumentSignaturesTab_signature\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n    }\n  }\n}\n\nfragment LinkedControlsCardFragment on Control {\n  id\n  name\n  sectionTitle\n  framework {\n    id\n    name\n  }\n}\n"
+    "text": "mutation DocumentDetailPagePublishMutation(\n  $input: PublishDocumentVersionInput!\n) {\n  publishDocumentVersion(input: $input) {\n    document {\n      ...DocumentDetailPageDocumentFragment\n      id\n    }\n  }\n}\n\nfragment DocumentControlsTabFragment on Document {\n  id\n  controls(first: 20) {\n    edges {\n      node {\n        id\n        ...LinkedControlsCardFragment\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n}\n\nfragment DocumentDetailPageDocumentFragment on Document {\n  id\n  title\n  documentType\n  classification\n  owner {\n    id\n    fullName\n  }\n  canUpdate: permission(action: \"core:document:update\")\n  canDelete: permission(action: \"core:document:delete\")\n  canPublish: permission(action: \"core:document-version:publish\")\n  ...DocumentControlsTabFragment\n  controlsInfo: controls(first: 0) {\n    totalCount\n  }\n  versions(first: 20) {\n    edges {\n      node {\n        id\n        content\n        status\n        publishedAt\n        version\n        updatedAt\n        classification\n        owner {\n          id\n          fullName\n        }\n        canDeleteDraft: permission(action: \"core:document-version:delete-draft\")\n        ...DocumentSignaturesTab_version\n        signatures(first: 1000) {\n          edges {\n            node {\n              id\n              state\n              signedBy {\n                id\n              }\n              ...DocumentSignaturesTab_signature\n              __typename\n            }\n            cursor\n          }\n          pageInfo {\n            endCursor\n            hasNextPage\n          }\n        }\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n    }\n  }\n}\n\nfragment DocumentSignaturesTab_signature on DocumentVersionSignature {\n  id\n  state\n  signedAt\n  requestedAt\n  signedBy {\n    fullName\n    primaryEmailAddress\n    id\n  }\n  canCancel: permission(action: \"core:document-version:request-signature\")\n}\n\nfragment DocumentSignaturesTab_version on DocumentVersion {\n  id\n  status\n  canRequestSignature: permission(action: \"core:document-version:request-signature\")\n  signatures(first: 1000) {\n    edges {\n      node {\n        id\n        state\n        signedBy {\n          id\n          fullName\n          primaryEmailAddress\n        }\n        ...DocumentSignaturesTab_signature\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n    }\n  }\n}\n\nfragment LinkedControlsCardFragment on Control {\n  id\n  name\n  sectionTitle\n  framework {\n    id\n    name\n  }\n}\n"
   }
 };
 })();

apps/console/src/__generated__/core/DocumentGraphListQuery.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<42c3f270cfade27e94b4d0895a0641f5>>
+ * @generated SignedSource<<8982230c048c28cb211d5368b1ab43a0>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -15,6 +15,7 @@ export type DocumentGraphListQuery$variables = {
 };
 export type DocumentGraphListQuery$data = {
   readonly organization: {
+    readonly canCreateDocument?: boolean;
     readonly id: string;
     readonly " $fragmentSpreads": FragmentRefs<"DocumentsPageListFragment">;
   };
@@ -47,13 +48,26 @@ v2 = {
   "storageKey": null
 },
 v3 = {
+  "alias": "canCreateDocument",
+  "args": [
+    {
+      "kind": "Literal",
+      "name": "action",
+      "value": "core:document:create"
+    }
+  ],
+  "kind": "ScalarField",
+  "name": "permission",
+  "storageKey": "permission(action:\"core:document:create\")"
+},
+v4 = {
   "alias": null,
   "args": null,
   "kind": "ScalarField",
   "name": "__typename",
   "storageKey": null
 },
-v4 = [
+v5 = [
   {
     "kind": "Literal",
     "name": "first",
@@ -85,9 +99,17 @@ return {
         "selections": [
           (v2/*: any*/),
           {
-            "args": null,
+            "kind": "InlineFragment",
-            "kind": "FragmentSpread",
+            "selections": [
-            "name": "DocumentsPageListFragment"
+              (v3/*: any*/),
+              {
+                "args": null,
+                "kind": "FragmentSpread",
+                "name": "DocumentsPageListFragment"
+              }
+            ],
+            "type": "Organization",
+            "abstractKey": null
           }
         ],
         "storageKey": null
@@ -110,14 +132,15 @@ return {
         "name": "node",
         "plural": false,
         "selections": [
-          (v3/*: any*/),
+          (v4/*: any*/),
           (v2/*: any*/),
           {
             "kind": "InlineFragment",
             "selections": [
+              (v3/*: any*/),
               {
                 "alias": null,
-                "args": (v4/*: any*/),
+                "args": (v5/*: any*/),
                 "concreteType": "DocumentConnection",
                 "kind": "LinkedField",
                 "name": "documents",
@@ -140,6 +163,58 @@ return {
                         "plural": false,
                         "selections": [
                           (v2/*: any*/),
+                          {
+                            "alias": "canUpdate",
+                            "args": [
+                              {
+                                "kind": "Literal",
+                                "name": "action",
+                                "value": "core:document:update"
+                              }
+                            ],
+                            "kind": "ScalarField",
+                            "name": "permission",
+                            "storageKey": "permission(action:\"core:document:update\")"
+                          },
+                          {
+                            "alias": "canDelete",
+                            "args": [
+                              {
+                                "kind": "Literal",
+                                "name": "action",
+                                "value": "core:document:delete"
+                              }
+                            ],
+                            "kind": "ScalarField",
+                            "name": "permission",
+                            "storageKey": "permission(action:\"core:document:delete\")"
+                          },
+                          {
+                            "alias": "canSendSigningNotifications",
+                            "args": [
+                              {
+                                "kind": "Literal",
+                                "name": "action",
+                                "value": "core:document:send-signing-notifications"
+                              }
+                            ],
+                            "kind": "ScalarField",
+                            "name": "permission",
+                            "storageKey": "permission(action:\"core:document:send-signing-notifications\")"
+                          },
+                          {
+                            "alias": "canRequestSignatures",
+                            "args": [
+                              {
+                                "kind": "Literal",
+                                "name": "action",
+                                "value": "core:document-version:request-signature"
+                              }
+                            ],
+                            "kind": "ScalarField",
+                            "name": "permission",
+                            "storageKey": "permission(action:\"core:document-version:request-signature\")"
+                          },
                           {
                             "alias": null,
                             "args": null,
@@ -295,7 +370,7 @@ return {
                             ],
                             "storageKey": "versions(first:1)"
                           },
-                          (v3/*: any*/)
+                          (v4/*: any*/)
                         ],
                         "storageKey": null
                       },
@@ -365,7 +440,7 @@ return {
               },
               {
                 "alias": null,
-                "args": (v4/*: any*/),
+                "args": (v5/*: any*/),
                 "filters": [
                   "orderBy"
                 ],
@@ -384,16 +459,16 @@ return {
     ]
   },
   "params": {
-    "cacheID": "74570a2b122efea617c7e2559fb51053",
+    "cacheID": "7c027bc02697b43718813a5bd024985a",
     "id": null,
     "metadata": {},
     "name": "DocumentGraphListQuery",
     "operationKind": "query",
-    "text": "query DocumentGraphListQuery(\n  $organizationId: ID!\n) {\n  organization: node(id: $organizationId) {\n    __typename\n    id\n    ...DocumentsPageListFragment\n  }\n}\n\nfragment DocumentsPageListFragment on Organization {\n  documents(first: 50, orderBy: {field: TITLE, direction: ASC}) {\n    edges {\n      node {\n        id\n        ...DocumentsPageRowFragment\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n\nfragment DocumentsPageRowFragment on Document {\n  id\n  title\n  description\n  documentType\n  classification\n  updatedAt\n  owner {\n    id\n    fullName\n  }\n  versions(first: 1) {\n    edges {\n      node {\n        id\n        status\n        version\n        signatures(first: 1000) {\n          edges {\n            node {\n              id\n              state\n            }\n          }\n        }\n      }\n    }\n  }\n}\n"
+    "text": "query DocumentGraphListQuery(\n  $organizationId: ID!\n) {\n  organization: node(id: $organizationId) {\n    __typename\n    id\n    ... on Organization {\n      canCreateDocument: permission(action: \"core:document:create\")\n      ...DocumentsPageListFragment\n    }\n  }\n}\n\nfragment DocumentsPageListFragment on Organization {\n  documents(first: 50, orderBy: {field: TITLE, direction: ASC}) {\n    edges {\n      node {\n        id\n        canUpdate: permission(action: \"core:document:update\")\n        canDelete: permission(action: \"core:document:delete\")\n        canSendSigningNotifications: permission(action: \"core:document:send-signing-notifications\")\n        canRequestSignatures: permission(action: \"core:document-version:request-signature\")\n        ...DocumentsPageRowFragment\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n\nfragment DocumentsPageRowFragment on Document {\n  id\n  title\n  description\n  documentType\n  classification\n  updatedAt\n  canDelete: permission(action: \"core:document:delete\")\n  owner {\n    id\n    fullName\n  }\n  versions(first: 1) {\n    edges {\n      node {\n        id\n        status\n        version\n        signatures(first: 1000) {\n          edges {\n            node {\n              id\n              state\n            }\n          }\n        }\n      }\n    }\n  }\n}\n"
   }
 };
 })();
 
-(node as any).hash = "63de39eb2c87fc45b83eeee047ddd36c";
+(node as any).hash = "26c7d375cb354649741ce4794612b3e1";
 
 export default node;

apps/console/src/__generated__/core/DocumentGraphNodeQuery.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<a39062565d1126fbcbee36865fa8c0fb>>
+ * @generated SignedSource<<c94bc39a3cdb0b46948d5116c3df2764>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -127,13 +127,20 @@ v12 = {
   ]
 },
 v13 = [
+  {
+    "kind": "Literal",
+    "name": "action",
+    "value": "core:document-version:request-signature"
+  }
+],
+v14 = [
   {
     "kind": "Literal",
     "name": "first",
     "value": 1000
   }
 ],
-v14 = {
+v15 = {
   "alias": null,
   "args": null,
   "concreteType": "PageInfo",
@@ -215,6 +222,45 @@ return {
               },
               (v4/*: any*/),
               (v6/*: any*/),
+              {
+                "alias": "canUpdate",
+                "args": [
+                  {
+                    "kind": "Literal",
+                    "name": "action",
+                    "value": "core:document:update"
+                  }
+                ],
+                "kind": "ScalarField",
+                "name": "permission",
+                "storageKey": "permission(action:\"core:document:update\")"
+              },
+              {
+                "alias": "canDelete",
+                "args": [
+                  {
+                    "kind": "Literal",
+                    "name": "action",
+                    "value": "core:document:delete"
+                  }
+                ],
+                "kind": "ScalarField",
+                "name": "permission",
+                "storageKey": "permission(action:\"core:document:delete\")"
+              },
+              {
+                "alias": "canPublish",
+                "args": [
+                  {
+                    "kind": "Literal",
+                    "name": "action",
+                    "value": "core:document-version:publish"
+                  }
+                ],
+                "kind": "ScalarField",
+                "name": "permission",
+                "storageKey": "permission(action:\"core:document-version:publish\")"
+              },
               {
                 "alias": null,
                 "args": (v7/*: any*/),
@@ -399,8 +445,28 @@ return {
                           (v4/*: any*/),
                           (v6/*: any*/),
                           {
-                            "alias": null,
+                            "alias": "canDeleteDraft",
+                            "args": [
+                              {
+                                "kind": "Literal",
+                                "name": "action",
+                                "value": "core:document-version:delete-draft"
+                              }
+                            ],
+                            "kind": "ScalarField",
+                            "name": "permission",
+                            "storageKey": "permission(action:\"core:document-version:delete-draft\")"
+                          },
+                          {
+                            "alias": "canRequestSignature",
                             "args": (v13/*: any*/),
+                            "kind": "ScalarField",
+                            "name": "permission",
+                            "storageKey": "permission(action:\"core:document-version:request-signature\")"
+                          },
+                          {
+                            "alias": null,
+                            "args": (v14/*: any*/),
                             "concreteType": "DocumentVersionSignatureConnection",
                             "kind": "LinkedField",
                             "name": "signatures",
@@ -464,6 +530,13 @@ return {
                                         "name": "requestedAt",
                                         "storageKey": null
                                       },
+                                      {
+                                        "alias": "canCancel",
+                                        "args": (v13/*: any*/),
+                                        "kind": "ScalarField",
+                                        "name": "permission",
+                                        "storageKey": "permission(action:\"core:document-version:request-signature\")"
+                                      },
                                       (v2/*: any*/)
                                     ],
                                     "storageKey": null
@@ -472,14 +545,14 @@ return {
                                 ],
                                 "storageKey": null
                               },
-                              (v14/*: any*/),
+                              (v15/*: any*/),
                               (v12/*: any*/)
                             ],
                             "storageKey": "signatures(first:1000)"
                           },
                           {
                             "alias": null,
-                            "args": (v13/*: any*/),
+                            "args": (v14/*: any*/),
                             "filters": [
                               "filter"
                             ],
@@ -490,7 +563,7 @@ return {
                           },
                           {
                             "alias": null,
-                            "args": (v13/*: any*/),
+                            "args": (v14/*: any*/),
                             "filters": [],
                             "handle": "connection",
                             "key": "DocumentDetailPage_signatures",
@@ -505,7 +578,7 @@ return {
                     ],
                     "storageKey": null
                   },
-                  (v14/*: any*/),
+                  (v15/*: any*/),
                   (v12/*: any*/)
                 ],
                 "storageKey": "versions(first:20)"
@@ -529,12 +602,12 @@ return {
     ]
   },
   "params": {
-    "cacheID": "72db9b5c4f2a4cd076ebf4e45f0eb662",
+    "cacheID": "1fe5b5e75ab7a7aa4b5859ec1c5560c7",
     "id": null,
     "metadata": {},
     "name": "DocumentGraphNodeQuery",
     "operationKind": "query",
-    "text": "query DocumentGraphNodeQuery(\n  $documentId: ID!\n) {\n  node(id: $documentId) {\n    __typename\n    ... on Document {\n      ...DocumentDetailPageDocumentFragment\n    }\n    id\n  }\n}\n\nfragment DocumentControlsTabFragment on Document {\n  id\n  controls(first: 20) {\n    edges {\n      node {\n        id\n        ...LinkedControlsCardFragment\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n}\n\nfragment DocumentDetailPageDocumentFragment on Document {\n  id\n  title\n  documentType\n  classification\n  owner {\n    id\n    fullName\n  }\n  ...DocumentControlsTabFragment\n  controlsInfo: controls(first: 0) {\n    totalCount\n  }\n  versions(first: 20) {\n    edges {\n      node {\n        id\n        content\n        status\n        publishedAt\n        version\n        updatedAt\n        classification\n        owner {\n          id\n          fullName\n        }\n        ...DocumentSignaturesTab_version\n        signatures(first: 1000) {\n          edges {\n            node {\n              id\n              state\n              signedBy {\n                id\n              }\n              ...DocumentSignaturesTab_signature\n              __typename\n            }\n            cursor\n          }\n          pageInfo {\n            endCursor\n            hasNextPage\n          }\n        }\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n    }\n  }\n}\n\nfragment DocumentSignaturesTab_signature on DocumentVersionSignature {\n  id\n  state\n  signedAt\n  requestedAt\n  signedBy {\n    fullName\n    primaryEmailAddress\n    id\n  }\n}\n\nfragment DocumentSignaturesTab_version on DocumentVersion {\n  id\n  status\n  signatures(first: 1000) {\n    edges {\n      node {\n        id\n        state\n        signedBy {\n          id\n          fullName\n          primaryEmailAddress\n        }\n        ...DocumentSignaturesTab_signature\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n    }\n  }\n}\n\nfragment LinkedControlsCardFragment on Control {\n  id\n  name\n  sectionTitle\n  framework {\n    id\n    name\n  }\n}\n"
+    "text": "query DocumentGraphNodeQuery(\n  $documentId: ID!\n) {\n  node(id: $documentId) {\n    __typename\n    ... on Document {\n      ...DocumentDetailPageDocumentFragment\n    }\n    id\n  }\n}\n\nfragment DocumentControlsTabFragment on Document {\n  id\n  controls(first: 20) {\n    edges {\n      node {\n        id\n        ...LinkedControlsCardFragment\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n}\n\nfragment DocumentDetailPageDocumentFragment on Document {\n  id\n  title\n  documentType\n  classification\n  owner {\n    id\n    fullName\n  }\n  canUpdate: permission(action: \"core:document:update\")\n  canDelete: permission(action: \"core:document:delete\")\n  canPublish: permission(action: \"core:document-version:publish\")\n  ...DocumentControlsTabFragment\n  controlsInfo: controls(first: 0) {\n    totalCount\n  }\n  versions(first: 20) {\n    edges {\n      node {\n        id\n        content\n        status\n        publishedAt\n        version\n        updatedAt\n        classification\n        owner {\n          id\n          fullName\n        }\n        canDeleteDraft: permission(action: \"core:document-version:delete-draft\")\n        ...DocumentSignaturesTab_version\n        signatures(first: 1000) {\n          edges {\n            node {\n              id\n              state\n              signedBy {\n                id\n              }\n              ...DocumentSignaturesTab_signature\n              __typename\n            }\n            cursor\n          }\n          pageInfo {\n            endCursor\n            hasNextPage\n          }\n        }\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n    }\n  }\n}\n\nfragment DocumentSignaturesTab_signature on DocumentVersionSignature {\n  id\n  state\n  signedAt\n  requestedAt\n  signedBy {\n    fullName\n    primaryEmailAddress\n    id\n  }\n  canCancel: permission(action: \"core:document-version:request-signature\")\n}\n\nfragment DocumentSignaturesTab_version on DocumentVersion {\n  id\n  status\n  canRequestSignature: permission(action: \"core:document-version:request-signature\")\n  signatures(first: 1000) {\n    edges {\n      node {\n        id\n        state\n        signedBy {\n          id\n          fullName\n          primaryEmailAddress\n        }\n        ...DocumentSignaturesTab_signature\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n    }\n  }\n}\n\nfragment LinkedControlsCardFragment on Control {\n  id\n  name\n  sectionTitle\n  framework {\n    id\n    name\n  }\n}\n"
   }
 };
 })();

apps/console/src/__generated__/core/DocumentSignaturesTabRefetchQuery.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<daaba0a12d115e8691984612356d4234>>
+ * @generated SignedSource<<b7fddd28abbffd86c8de3f8ecd3d794b>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -73,6 +73,13 @@ v6 = {
   "storageKey": null
 },
 v7 = [
+  {
+    "kind": "Literal",
+    "name": "action",
+    "value": "core:document-version:request-signature"
+  }
+],
+v8 = [
   {
     "kind": "Variable",
     "name": "after",
@@ -169,8 +176,15 @@ return {
                 "storageKey": null
               },
               {
-                "alias": null,
+                "alias": "canRequestSignature",
                 "args": (v7/*: any*/),
+                "kind": "ScalarField",
+                "name": "permission",
+                "storageKey": "permission(action:\"core:document-version:request-signature\")"
+              },
+              {
+                "alias": null,
+                "args": (v8/*: any*/),
                 "concreteType": "DocumentVersionSignatureConnection",
                 "kind": "LinkedField",
                 "name": "signatures",
@@ -240,6 +254,13 @@ return {
                             "name": "requestedAt",
                             "storageKey": null
                           },
+                          {
+                            "alias": "canCancel",
+                            "args": (v7/*: any*/),
+                            "kind": "ScalarField",
+                            "name": "permission",
+                            "storageKey": "permission(action:\"core:document-version:request-signature\")"
+                          },
                           (v5/*: any*/)
                         ],
                         "storageKey": null
@@ -296,7 +317,7 @@ return {
               },
               {
                 "alias": null,
-                "args": (v7/*: any*/),
+                "args": (v8/*: any*/),
                 "filters": [
                   "filter"
                 ],
@@ -315,16 +336,16 @@ return {
     ]
   },
   "params": {
-    "cacheID": "d7b2a5ca29001eca591507471d4178cc",
+    "cacheID": "5f4d3d9043d744d2e35c7c5b3e209a37",
     "id": null,
     "metadata": {},
     "name": "DocumentSignaturesTabRefetchQuery",
     "operationKind": "query",
-    "text": "query DocumentSignaturesTabRefetchQuery(\n  $count: Int = 1000\n  $cursor: CursorKey\n  $signatureFilter: DocumentVersionSignatureFilter\n  $id: ID!\n) {\n  node(id: $id) {\n    __typename\n    ...DocumentSignaturesTab_version_1vp7QE\n    id\n  }\n}\n\nfragment DocumentSignaturesTab_signature on DocumentVersionSignature {\n  id\n  state\n  signedAt\n  requestedAt\n  signedBy {\n    fullName\n    primaryEmailAddress\n    id\n  }\n}\n\nfragment DocumentSignaturesTab_version_1vp7QE on DocumentVersion {\n  id\n  status\n  signatures(first: $count, after: $cursor, filter: $signatureFilter) {\n    edges {\n      node {\n        id\n        state\n        signedBy {\n          id\n          fullName\n          primaryEmailAddress\n        }\n        ...DocumentSignaturesTab_signature\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n    }\n  }\n}\n"
+    "text": "query DocumentSignaturesTabRefetchQuery(\n  $count: Int = 1000\n  $cursor: CursorKey\n  $signatureFilter: DocumentVersionSignatureFilter\n  $id: ID!\n) {\n  node(id: $id) {\n    __typename\n    ...DocumentSignaturesTab_version_1vp7QE\n    id\n  }\n}\n\nfragment DocumentSignaturesTab_signature on DocumentVersionSignature {\n  id\n  state\n  signedAt\n  requestedAt\n  signedBy {\n    fullName\n    primaryEmailAddress\n    id\n  }\n  canCancel: permission(action: \"core:document-version:request-signature\")\n}\n\nfragment DocumentSignaturesTab_version_1vp7QE on DocumentVersion {\n  id\n  status\n  canRequestSignature: permission(action: \"core:document-version:request-signature\")\n  signatures(first: $count, after: $cursor, filter: $signatureFilter) {\n    edges {\n      node {\n        id\n        state\n        signedBy {\n          id\n          fullName\n          primaryEmailAddress\n        }\n        ...DocumentSignaturesTab_signature\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n    }\n  }\n}\n"
   }
 };
 })();
 
-(node as any).hash = "497571b827200e09a848436820668d10";
+(node as any).hash = "9282fd9e9a1aa10a36535863b896283c";
 
 export default node;

apps/console/src/__generated__/core/DocumentSignaturesTab_requestSignatureMutation.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<de274a51c1b339789540a969b0ebe507>>
+ * @generated SignedSource<<2988f1319b1ad6110c328a00f644f26d>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -210,6 +210,19 @@ return {
                     "kind": "ScalarField",
                     "name": "requestedAt",
                     "storageKey": null
+                  },
+                  {
+                    "alias": "canCancel",
+                    "args": [
+                      {
+                        "kind": "Literal",
+                        "name": "action",
+                        "value": "core:document-version:request-signature"
+                      }
+                    ],
+                    "kind": "ScalarField",
+                    "name": "permission",
+                    "storageKey": "permission(action:\"core:document-version:request-signature\")"
                   }
                 ],
                 "storageKey": null
@@ -239,12 +252,12 @@ return {
     ]
   },
   "params": {
-    "cacheID": "e582b90bdad831d64741b45de17f45b5",
+    "cacheID": "5a9c28a2a8a3234f953f7a609da7d02e",
     "id": null,
     "metadata": {},
     "name": "DocumentSignaturesTab_requestSignatureMutation",
     "operationKind": "mutation",
-    "text": "mutation DocumentSignaturesTab_requestSignatureMutation(\n  $input: RequestSignatureInput!\n) {\n  requestSignature(input: $input) {\n    documentVersionSignatureEdge {\n      node {\n        id\n        state\n        signedBy {\n          id\n        }\n        ...DocumentSignaturesTab_signature\n      }\n    }\n  }\n}\n\nfragment DocumentSignaturesTab_signature on DocumentVersionSignature {\n  id\n  state\n  signedAt\n  requestedAt\n  signedBy {\n    fullName\n    primaryEmailAddress\n    id\n  }\n}\n"
+    "text": "mutation DocumentSignaturesTab_requestSignatureMutation(\n  $input: RequestSignatureInput!\n) {\n  requestSignature(input: $input) {\n    documentVersionSignatureEdge {\n      node {\n        id\n        state\n        signedBy {\n          id\n        }\n        ...DocumentSignaturesTab_signature\n      }\n    }\n  }\n}\n\nfragment DocumentSignaturesTab_signature on DocumentVersionSignature {\n  id\n  state\n  signedAt\n  requestedAt\n  signedBy {\n    fullName\n    primaryEmailAddress\n    id\n  }\n  canCancel: permission(action: \"core:document-version:request-signature\")\n}\n"
   }
 };
 })();

apps/console/src/__generated__/core/DocumentSignaturesTab_signature.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<7d45f232043aa77c8e1e4ae7f8f330db>>
+ * @generated SignedSource<<02f9338b7a451ae446c87d09ea71a71d>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -12,6 +12,7 @@ import { ReaderFragment } from 'relay-runtime';
 export type DocumentVersionSignatureState = "REQUESTED" | "SIGNED";
 import { FragmentRefs } from "relay-runtime";
 export type DocumentSignaturesTab_signature$data = {
+  readonly canCancel: boolean;
   readonly id: string;
   readonly requestedAt: any;
   readonly signedAt: any | null | undefined;
@@ -85,12 +86,25 @@ const node: ReaderFragment = {
         }
       ],
       "storageKey": null
+    },
+    {
+      "alias": "canCancel",
+      "args": [
+        {
+          "kind": "Literal",
+          "name": "action",
+          "value": "core:document-version:request-signature"
+        }
+      ],
+      "kind": "ScalarField",
+      "name": "permission",
+      "storageKey": "permission(action:\"core:document-version:request-signature\")"
     }
   ],
   "type": "DocumentVersionSignature",
   "abstractKey": null
 };
 
-(node as any).hash = "b07437b34548744fef4ed78d4f1f0a62";
+(node as any).hash = "bbfdd78015e97032862da41aad6beeae";
 
 export default node;

apps/console/src/__generated__/core/DocumentSignaturesTab_version.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<807a8f8c5c320dadd6b9672ef48583f2>>
+ * @generated SignedSource<<ccb4ac21f5e94f16c4fa5ccff5898f99>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -13,6 +13,7 @@ export type DocumentStatus = "DRAFT" | "PUBLISHED";
 export type DocumentVersionSignatureState = "REQUESTED" | "SIGNED";
 import { FragmentRefs } from "relay-runtime";
 export type DocumentSignaturesTab_version$data = {
+  readonly canRequestSignature: boolean;
   readonly id: string;
   readonly signatures: {
     readonly __id: string;
@@ -107,6 +108,19 @@ return {
       "name": "status",
       "storageKey": null
     },
+    {
+      "alias": "canRequestSignature",
+      "args": [
+        {
+          "kind": "Literal",
+          "name": "action",
+          "value": "core:document-version:request-signature"
+        }
+      ],
+      "kind": "ScalarField",
+      "name": "permission",
+      "storageKey": "permission(action:\"core:document-version:request-signature\")"
+    },
     {
       "alias": "signatures",
       "args": [
@@ -242,6 +256,6 @@ return {
 };
 })();
 
-(node as any).hash = "497571b827200e09a848436820668d10";
+(node as any).hash = "9282fd9e9a1aa10a36535863b896283c";
 
 export default node;

apps/console/src/__generated__/core/DocumentsListQuery.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<83dad18be7a9249bb99048ba14b6de41>>
+ * @generated SignedSource<<2d64b7b84c435d26d97748081e1bb38e>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -215,6 +215,58 @@ return {
                         "plural": false,
                         "selections": [
                           (v12/*: any*/),
+                          {
+                            "alias": "canUpdate",
+                            "args": [
+                              {
+                                "kind": "Literal",
+                                "name": "action",
+                                "value": "core:document:update"
+                              }
+                            ],
+                            "kind": "ScalarField",
+                            "name": "permission",
+                            "storageKey": "permission(action:\"core:document:update\")"
+                          },
+                          {
+                            "alias": "canDelete",
+                            "args": [
+                              {
+                                "kind": "Literal",
+                                "name": "action",
+                                "value": "core:document:delete"
+                              }
+                            ],
+                            "kind": "ScalarField",
+                            "name": "permission",
+                            "storageKey": "permission(action:\"core:document:delete\")"
+                          },
+                          {
+                            "alias": "canSendSigningNotifications",
+                            "args": [
+                              {
+                                "kind": "Literal",
+                                "name": "action",
+                                "value": "core:document:send-signing-notifications"
+                              }
+                            ],
+                            "kind": "ScalarField",
+                            "name": "permission",
+                            "storageKey": "permission(action:\"core:document:send-signing-notifications\")"
+                          },
+                          {
+                            "alias": "canRequestSignatures",
+                            "args": [
+                              {
+                                "kind": "Literal",
+                                "name": "action",
+                                "value": "core:document-version:request-signature"
+                              }
+                            ],
+                            "kind": "ScalarField",
+                            "name": "permission",
+                            "storageKey": "permission(action:\"core:document-version:request-signature\")"
+                          },
                           {
                             "alias": null,
                             "args": null,
@@ -459,16 +511,16 @@ return {
     ]
   },
   "params": {
-    "cacheID": "2f5cd9919b919f4e9d80354cb26d3e9d",
+    "cacheID": "c7b8d86af8a704ba0a6451bd3877746f",
     "id": null,
     "metadata": {},
     "name": "DocumentsListQuery",
     "operationKind": "query",
-    "text": "query DocumentsListQuery(\n  $after: CursorKey = null\n  $before: CursorKey = null\n  $first: Int = 50\n  $last: Int = null\n  $order: DocumentOrder = {field: TITLE, direction: ASC}\n  $id: ID!\n) {\n  node(id: $id) {\n    __typename\n    ...DocumentsPageListFragment_16fISc\n    id\n  }\n}\n\nfragment DocumentsPageListFragment_16fISc on Organization {\n  documents(first: $first, after: $after, last: $last, before: $before, orderBy: $order) {\n    edges {\n      node {\n        id\n        ...DocumentsPageRowFragment\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n\nfragment DocumentsPageRowFragment on Document {\n  id\n  title\n  description\n  documentType\n  classification\n  updatedAt\n  owner {\n    id\n    fullName\n  }\n  versions(first: 1) {\n    edges {\n      node {\n        id\n        status\n        version\n        signatures(first: 1000) {\n          edges {\n            node {\n              id\n              state\n            }\n          }\n        }\n      }\n    }\n  }\n}\n"
+    "text": "query DocumentsListQuery(\n  $after: CursorKey = null\n  $before: CursorKey = null\n  $first: Int = 50\n  $last: Int = null\n  $order: DocumentOrder = {field: TITLE, direction: ASC}\n  $id: ID!\n) {\n  node(id: $id) {\n    __typename\n    ...DocumentsPageListFragment_16fISc\n    id\n  }\n}\n\nfragment DocumentsPageListFragment_16fISc on Organization {\n  documents(first: $first, after: $after, last: $last, before: $before, orderBy: $order) {\n    edges {\n      node {\n        id\n        canUpdate: permission(action: \"core:document:update\")\n        canDelete: permission(action: \"core:document:delete\")\n        canSendSigningNotifications: permission(action: \"core:document:send-signing-notifications\")\n        canRequestSignatures: permission(action: \"core:document-version:request-signature\")\n        ...DocumentsPageRowFragment\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n\nfragment DocumentsPageRowFragment on Document {\n  id\n  title\n  description\n  documentType\n  classification\n  updatedAt\n  canDelete: permission(action: \"core:document:delete\")\n  owner {\n    id\n    fullName\n  }\n  versions(first: 1) {\n    edges {\n      node {\n        id\n        status\n        version\n        signatures(first: 1000) {\n          edges {\n            node {\n              id\n              state\n            }\n          }\n        }\n      }\n    }\n  }\n}\n"
   }
 };
 })();
 
-(node as any).hash = "8cda24b1d10caa3f4b83dbb82035365b";
+(node as any).hash = "0f00d125fc711db9e65d54dcc884a72e";
 
 export default node;

apps/console/src/__generated__/core/DocumentsPageListFragment.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<0abee66a5b3a949907293acd4981f05e>>
+ * @generated SignedSource<<4531c90194c8da0c1cbd00e5e169ff00>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -15,6 +15,10 @@ export type DocumentsPageListFragment$data = {
     readonly __id: string;
     readonly edges: ReadonlyArray<{
       readonly node: {
+        readonly canDelete: boolean;
+        readonly canRequestSignatures: boolean;
+        readonly canSendSigningNotifications: boolean;
+        readonly canUpdate: boolean;
         readonly id: string;
         readonly " $fragmentSpreads": FragmentRefs<"DocumentsPageRowFragment">;
       };
@@ -137,6 +141,58 @@ return {
               "plural": false,
               "selections": [
                 (v1/*: any*/),
+                {
+                  "alias": "canUpdate",
+                  "args": [
+                    {
+                      "kind": "Literal",
+                      "name": "action",
+                      "value": "core:document:update"
+                    }
+                  ],
+                  "kind": "ScalarField",
+                  "name": "permission",
+                  "storageKey": "permission(action:\"core:document:update\")"
+                },
+                {
+                  "alias": "canDelete",
+                  "args": [
+                    {
+                      "kind": "Literal",
+                      "name": "action",
+                      "value": "core:document:delete"
+                    }
+                  ],
+                  "kind": "ScalarField",
+                  "name": "permission",
+                  "storageKey": "permission(action:\"core:document:delete\")"
+                },
+                {
+                  "alias": "canSendSigningNotifications",
+                  "args": [
+                    {
+                      "kind": "Literal",
+                      "name": "action",
+                      "value": "core:document:send-signing-notifications"
+                    }
+                  ],
+                  "kind": "ScalarField",
+                  "name": "permission",
+                  "storageKey": "permission(action:\"core:document:send-signing-notifications\")"
+                },
+                {
+                  "alias": "canRequestSignatures",
+                  "args": [
+                    {
+                      "kind": "Literal",
+                      "name": "action",
+                      "value": "core:document-version:request-signature"
+                    }
+                  ],
+                  "kind": "ScalarField",
+                  "name": "permission",
+                  "storageKey": "permission(action:\"core:document-version:request-signature\")"
+                },
                 {
                   "args": null,
                   "kind": "FragmentSpread",
@@ -223,6 +279,6 @@ return {
 };
 })();
 
-(node as any).hash = "8cda24b1d10caa3f4b83dbb82035365b";
+(node as any).hash = "0f00d125fc711db9e65d54dcc884a72e";
 
 export default node;

apps/console/src/__generated__/core/DocumentsPageRowFragment.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<f772c53b0007859aecc59a9484b5b791>>
+ * @generated SignedSource<<6aa146f2bf0d89cd8140da220a2c33d8>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -15,6 +15,7 @@ export type DocumentType = "ISMS" | "OTHER" | "POLICY" | "PROCEDURE";
 export type DocumentVersionSignatureState = "REQUESTED" | "SIGNED";
 import { FragmentRefs } from "relay-runtime";
 export type DocumentsPageRowFragment$data = {
+  readonly canDelete: boolean;
   readonly classification: DocumentClassification;
   readonly description: string | null | undefined;
   readonly documentType: DocumentType;
@@ -99,6 +100,19 @@ return {
       "name": "updatedAt",
       "storageKey": null
     },
+    {
+      "alias": "canDelete",
+      "args": [
+        {
+          "kind": "Literal",
+          "name": "action",
+          "value": "core:document:delete"
+        }
+      ],
+      "kind": "ScalarField",
+      "name": "permission",
+      "storageKey": "permission(action:\"core:document:delete\")"
+    },
     {
       "alias": null,
       "args": null,
@@ -225,6 +239,6 @@ return {
 };
 })();
 
-(node as any).hash = "cd6d6bebffb9ed17a251aeef4b86f753";
+(node as any).hash = "4164f76edc42d40eef1efc54194116ec";
 
 export default node;

apps/console/src/__generated__/core/PublishDocumentsDialogMutation.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<bf6b6a8a1f99fd0bfcc4eda44bbfe352>>
+ * @generated SignedSource<<032b44ec9c5c4d5fc0281269dad54098>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -170,6 +170,19 @@ return {
                     "name": "updatedAt",
                     "storageKey": null
                   },
+                  {
+                    "alias": "canDelete",
+                    "args": [
+                      {
+                        "kind": "Literal",
+                        "name": "action",
+                        "value": "core:document:delete"
+                      }
+                    ],
+                    "kind": "ScalarField",
+                    "name": "permission",
+                    "storageKey": "permission(action:\"core:document:delete\")"
+                  },
                   {
                     "alias": null,
                     "args": null,
@@ -302,12 +315,12 @@ return {
     ]
   },
   "params": {
-    "cacheID": "d3e85ba061ad3937ad4a3c6727eb76fa",
+    "cacheID": "56634e96a607e273bf269d4720cd75d9",
     "id": null,
     "metadata": {},
     "name": "PublishDocumentsDialogMutation",
     "operationKind": "mutation",
-    "text": "mutation PublishDocumentsDialogMutation(\n  $input: BulkPublishDocumentVersionsInput!\n) {\n  bulkPublishDocumentVersions(input: $input) {\n    documentEdges {\n      node {\n        id\n        ...DocumentsPageRowFragment\n      }\n    }\n  }\n}\n\nfragment DocumentsPageRowFragment on Document {\n  id\n  title\n  description\n  documentType\n  classification\n  updatedAt\n  owner {\n    id\n    fullName\n  }\n  versions(first: 1) {\n    edges {\n      node {\n        id\n        status\n        version\n        signatures(first: 1000) {\n          edges {\n            node {\n              id\n              state\n            }\n          }\n        }\n      }\n    }\n  }\n}\n"
+    "text": "mutation PublishDocumentsDialogMutation(\n  $input: BulkPublishDocumentVersionsInput!\n) {\n  bulkPublishDocumentVersions(input: $input) {\n    documentEdges {\n      node {\n        id\n        ...DocumentsPageRowFragment\n      }\n    }\n  }\n}\n\nfragment DocumentsPageRowFragment on Document {\n  id\n  title\n  description\n  documentType\n  classification\n  updatedAt\n  canDelete: permission(action: \"core:document:delete\")\n  owner {\n    id\n    fullName\n  }\n  versions(first: 1) {\n    edges {\n      node {\n        id\n        status\n        version\n        signatures(first: 1000) {\n          edges {\n            node {\n              id\n              state\n            }\n          }\n        }\n      }\n    }\n  }\n}\n"
   }
 };
 })();

apps/console/src/hooks/graph/DocumentGraph.ts

@@ -10,7 +10,10 @@ export const documentsQuery = graphql`
   query DocumentGraphListQuery($organizationId: ID!) {
     organization: node(id: $organizationId) {
       id
-      ...DocumentsPageListFragment
+      ... on Organization {
+        canCreateDocument: permission(action: "core:document:create")
+        ...DocumentsPageListFragment
+      }
     }
   }
 `;

apps/console/src/pages/organizations/documents/DocumentDetailPage.tsx

@@ -65,7 +65,7 @@ import {
   PdfDownloadDialog,
   type PdfDownloadDialogRef,
 } from "/components/documents/PdfDownloadDialog";
-import { use, useRef, useState } from "react";
+import { useRef, useState } from "react";
 import type { NodeOf } from "/types.ts";
 import clsx from "clsx";
 import { PeopleSelectField } from "/components/form/PeopleSelectField";
@@ -74,7 +74,6 @@ import { DocumentTypeOptions } from "/components/form/DocumentTypeOptions";
 import { DocumentClassificationOptions } from "/components/form/DocumentClassificationOptions";
 import { z } from "zod";
 import { useFormWithSchema } from "/hooks/useFormWithSchema";
-import { PermissionsContext } from "/providers/PermissionsContext";
 
 type Props = {
   queryRef: PreloadedQuery<DocumentGraphNodeQuery>;
@@ -90,6 +89,15 @@ const documentFragment = graphql`
       id
       fullName
     }
+    canUpdate: permission(action: "core:document:update")
+    canDelete: permission(action: "core:document:delete")
+    canPublish: permission(action: "core:document-version:publish")
+    # canSendSigningNotifications: permission(
+    #   action: "core:document:send-signing-notifications"
+    # )
+    # canRequestSignatures: permission(
+    #   action: "core:document-version:request-signature"
+    # )
     ...DocumentControlsTabFragment
     controlsInfo: controls(first: 0) {
       totalCount
@@ -109,6 +117,9 @@ const documentFragment = graphql`
             id
             fullName
           }
+          canDeleteDraft: permission(
+            action: "core:document-version:delete-draft"
+          )
           ...DocumentSignaturesTab_version
           signatures(first: 1000)
             @connection(key: "DocumentDetailPage_signatures", filters: []) {
@@ -176,6 +187,7 @@ const documentUpdateSchema = z.object({
   classification: z.enum(documentClassifications),
 });
 
+// FIXME
 // const UserEmailQuery = graphql`
 //   query DocumentDetailPageUserEmailQuery {
 //     viewer {
@@ -194,7 +206,6 @@ export default function DocumentDetailPage(props: Props) {
   const { __ } = useTranslate();
   const organizationId = useOrganizationId();
   const navigate = useNavigate();
-  const { isAuthorized } = use(PermissionsContext);
 
   const [isEditingTitle, setIsEditingTitle] = useState(false);
   const [isEditingOwner, setIsEditingOwner] = useState(false);
@@ -461,7 +472,7 @@ export default function DocumentDetailPage(props: Props) {
             ]}
           />
           <div className="flex gap-2">
-            {isDraft && isAuthorized("Document", "publishDocumentVersion") && (
+            {isDraft && document.canPublish && (
               <Button
                 onClick={handlePublish}
                 icon={IconCheckmark1}
@@ -491,7 +502,7 @@ export default function DocumentDetailPage(props: Props) {
             </Dropdown>
 
             <ActionDropdown variant="secondary">
-              {isAuthorized("Document", "updateDocument") && (
+              {document.canUpdate && (
                 <DropdownItem
                   onClick={() => updateDialogRef.current?.open()}
                   icon={IconPencil}
@@ -501,7 +512,7 @@ export default function DocumentDetailPage(props: Props) {
               )}
               {isDraft &&
                 versions.length > 1 &&
-                isAuthorized("Document", "deleteDraftDocumentVersion") && (
+                currentVersion.canDeleteDraft && (
                   <DropdownItem
                     onClick={handleDeleteDraft}
                     icon={IconTrashCan}
@@ -517,7 +528,7 @@ export default function DocumentDetailPage(props: Props) {
               >
                 {__("Download PDF")}
               </DropdownItem>
-              {isAuthorized("Document", "deleteDocument") && (
+              {document.canDelete && (
                 <DropdownItem
                   variant="danger"
                   icon={IconTrashCan}
@@ -567,7 +578,7 @@ export default function DocumentDetailPage(props: Props) {
             ) : (
               <div className="flex items-center gap-2">
                 <span>{document.title}</span>
-                {isAuthorized("Document", "updateDocument") && (
+                {document.canUpdate && (
                   <Button
                     variant="quaternary"
                     icon={IconPencil}
@@ -620,7 +631,7 @@ export default function DocumentDetailPage(props: Props) {
           ) : (
             <ReadOnlyPropertyContent
               onEdit={() => setIsEditingOwner(true)}
-              canEdit={isAuthorized("Document", "updateDocument")}
+              canEdit={document.canUpdate}
             >
               <Badge variant="highlight" size="md" className="gap-2">
                 <Avatar name={currentVersion.owner?.fullName ?? ""} />
@@ -650,7 +661,7 @@ export default function DocumentDetailPage(props: Props) {
           ) : (
             <ReadOnlyPropertyContent
               onEdit={() => setIsEditingType(true)}
-              canEdit={isAuthorized("Document", "updateDocument")}
+              canEdit={document.canUpdate}
             >
               <div className="text-sm text-txt-secondary">
                 {getDocumentTypeLabel(__, document.documentType)}
@@ -679,7 +690,7 @@ export default function DocumentDetailPage(props: Props) {
           ) : (
             <ReadOnlyPropertyContent
               onEdit={() => setIsEditingClassification(true)}
-              canEdit={isAuthorized("Document", "updateDocument")}
+              canEdit={document.canUpdate}
             >
               <div className="text-sm text-txt-secondary">
                 {getDocumentClassificationLabel(
@@ -792,7 +803,7 @@ function VersionItem({
       <div className="flex gap-3 w-full overflow-hidden">
         <div
           className={clsx(
-            "flex-shrink-0 flex items-center justify-center size-10",
+            "shrink-0 flex items-center justify-center size-10",
             active && "bg-active rounded",
           )}
         >

apps/console/src/pages/organizations/documents/DocumentsPage.tsx

@@ -28,7 +28,7 @@ import {
   usePreloadedQuery,
   type PreloadedQuery,
 } from "react-relay";
-import { use, useRef } from "react";
+import { useRef } from "react";
 import { graphql } from "relay-runtime";
 import type { DocumentGraphListQuery } from "/__generated__/core/DocumentGraphListQuery.graphql";
 import {
@@ -55,7 +55,6 @@ import {
   BulkExportDialog,
   type BulkExportDialogRef,
 } from "/components/documents/BulkExportDialog";
-import { PermissionsContext } from "/providers/PermissionsContext";
 
 const documentsFragment = graphql`
   fragment DocumentsPageListFragment on Organization
@@ -81,6 +80,14 @@ const documentsFragment = graphql`
       edges {
         node {
           id
+          canUpdate: permission(action: "core:document:update")
+          canDelete: permission(action: "core:document:delete")
+          canSendSigningNotifications: permission(
+            action: "core:document:send-signing-notifications"
+          )
+          canRequestSignatures: permission(
+            action: "core:document-version:request-signature"
+          )
           ...DocumentsPageRowFragment
         }
       }
@@ -104,13 +111,13 @@ type Props = {
 
 export default function DocumentsPage(props: Props) {
   const { __ } = useTranslate();
-  const { isAuthorized } = use(PermissionsContext);
 
   const organization = usePreloadedQuery(
     documentsQuery,
     props.queryRef,
   ).organization;
 
+  // FIXME
   // const userEmailData = useLazyLoadQuery<DocumentsPageUserEmailQuery>(
   //   UserEmailQuery,
   //   {}
@@ -135,9 +142,15 @@ export default function DocumentsPage(props: Props) {
 
   usePageTitle(__("Documents"));
 
-  const hasAnyAction =
+  const canDeleteAny = documents.some(({ canDelete }) => canDelete);
-    isAuthorized("Document", "updateDocument") ||
+  const canUpdateAny = documents.some(({ canUpdate }) => canUpdate);
-    isAuthorized("Document", "deleteDocument");
+  const canSendAnySignatureNotifications = documents.some(
+    ({ canSendSigningNotifications }) => canSendSigningNotifications,
+  );
+  const canRequestAnySignatures = documents.some(
+    ({ canRequestSignatures }) => canRequestSignatures,
+  );
+  const hasAnyAction = canDeleteAny || canUpdateAny;
 
   const handleSendSigningNotifications = () => {
     sendSigningNotifications({
@@ -197,7 +210,7 @@ export default function DocumentsPage(props: Props) {
         description={__("Manage your organization's documents")}
       >
         <div className="flex gap-2">
-          {isAuthorized("Document", "sendSigningNotifications") && (
+          {canSendAnySignatureNotifications && (
             <Button
               icon={IconBell2}
               variant="secondary"
@@ -206,7 +219,7 @@ export default function DocumentsPage(props: Props) {
               {__("Send signing notifications")}
             </Button>
           )}
-          {isAuthorized("Organization", "createDocument") && (
+          {organization.canCreateDocument && (
             <CreateDocumentDialog
               connection={connectionId}
               trigger={
@@ -259,7 +272,7 @@ export default function DocumentsPage(props: Props) {
                       </button>
                     </div>
                     <div className="flex gap-2 items-center">
-                      {isAuthorized("Document", "updateDocument") && (
+                      {canUpdateAny && (
                         <PublishDocumentsDialog
                           documentIds={selection}
                           onSave={clear}
@@ -272,7 +285,7 @@ export default function DocumentsPage(props: Props) {
                           </Button>
                         </PublishDocumentsDialog>
                       )}
-                      {isAuthorized("Document", "bulkRequestSignatures") && (
+                      {canRequestAnySignatures && (
                         <SignatureDocumentsDialog
                           documentIds={selection}
                           onSave={clear}
@@ -301,7 +314,7 @@ export default function DocumentsPage(props: Props) {
                           {__("Export")}
                         </Button>
                       </BulkExportDialog>
-                      {isAuthorized("Document", "deleteDocument") && (
+                      {canDeleteAny && (
                         <Button
                           variant="danger"
                           icon={IconTrashCan}
@@ -355,6 +368,7 @@ const rowFragment = graphql`
     documentType
     classification
     updatedAt
+    canDelete: permission(action: "core:document:delete")
     owner {
       id
       fullName
@@ -393,7 +407,6 @@ function DocumentRow({
   onCheck: () => void;
   hasAnyAction: boolean;
 }) {
-  const { isAuthorized } = use(PermissionsContext);
   const document = useFragment<DocumentsPageRowFragment$key>(
     rowFragment,
     documentKey,
@@ -469,7 +482,7 @@ function DocumentRow({
       {hasAnyAction && (
         <Td noLink width={50} className="text-end w-18">
           <ActionDropdown>
-            {isAuthorized("Document", "deleteDocument") && (
+            {document.canDelete && (
               <DropdownItem
                 variant="danger"
                 icon={IconTrashCan}

apps/console/src/pages/organizations/documents/tabs/DocumentSignaturesTab.tsx

@@ -8,7 +8,7 @@ import {
   Spinner,
 } from "@probo/ui";
 import { useTranslate } from "@probo/i18n";
-import { Suspense, useState, useEffect, useRef, use } from "react";
+import { Suspense, useState, useEffect, useRef } from "react";
 import type { ItemOf, NodeOf } from "/types";
 import { graphql, useFragment, useRefetchableFragment } from "react-relay";
 import { usePeople } from "/hooks/graph/PeopleGraph.ts";
@@ -20,7 +20,6 @@ import { useOutletContext } from "react-router";
 import type { DocumentSignaturesTab_signature$key } from "/__generated__/core/DocumentSignaturesTab_signature.graphql.ts";
 import type { DocumentSignaturesTab_version$key } from "/__generated__/core/DocumentSignaturesTab_version.graphql.ts";
 import type { DocumentSignaturesTabRefetchQuery } from "/__generated__/core/DocumentSignaturesTabRefetchQuery.graphql";
-import { PermissionsContext } from "/providers/PermissionsContext";
 
 type Version = NodeOf<DocumentDetailPageDocumentFragment$data["versions"]>;
 
@@ -34,6 +33,9 @@ const versionFragment = graphql`
   ) {
     id
     status
+    canRequestSignature: permission(
+      action: "core:document-version:request-signature"
+    )
     signatures(first: $count, after: $cursor, filter: $signatureFilter)
       @connection(
         key: "DocumentSignaturesTab_signatures"
@@ -186,6 +188,7 @@ function SignatureList(props: {
           people={p}
           connectionId={version.signatures.__id}
           signable={signable}
+          canRequestSignature={version.canRequestSignature}
         />
       ))}
     </div>
@@ -202,6 +205,7 @@ const signatureFragment = graphql`
       fullName
       primaryEmailAddress
     }
+    canCancel: permission(action: "core:document-version:request-signature")
   }
 `;
 
@@ -244,10 +248,10 @@ function SignatureItem(props: {
   people: ItemOf<ReturnType<typeof usePeople>>;
   connectionId: string;
   signable: boolean;
+  canRequestSignature: boolean;
 }) {
   const signature = useFragment(signatureFragment, props.signature);
   const { __, dateTimeFormat } = useTranslate();
-  const { isAuthorized } = use(PermissionsContext);
   const [requestSignature, isSendingRequest] = useMutationWithToasts(
     requestSignatureMutation,
     {
@@ -276,7 +280,7 @@ function SignatureItem(props: {
             {props.people.primaryEmailAddress}
           </div>
         </div>
-        {props.signable && isAuthorized("Document", "requestSignature") && (
+        {props.signable && props.canRequestSignature && (
           <Button
             variant="secondary"
             className="ml-auto"
@@ -331,7 +335,7 @@ function SignatureItem(props: {
           {__("Signed")}
         </Badge>
       ) : (
-        isAuthorized("DocumentVersionSignature", "cancelSignatureRequest") && (
+        signature.canCancel && (
           <Button
             variant="danger"
             className="ml-auto"

pkg/probo/actions.go

@@ -164,21 +164,21 @@ const (
 	ActionDocumentSendSigningNotifications = "core:document:send-signing-notifications"
 
 	// DocumentVersion actions
-	ActionDocumentVersionGet              = "core:document-version:get"
+	ActionDocumentVersionGet            = "core:document-version:get"
-	ActionDocumentVersionList             = "core:document-version:list"
+	ActionDocumentVersionList           = "core:document-version:list"
-	ActionDocumentVersionExportPDF        = "core:document-version:export-pdf"
+	ActionDocumentVersionExportPDF      = "core:document-version:export-pdf"
-	ActionDocumentVersionExportSignable   = "core:document-version:export-signable-pdf"
+	ActionDocumentVersionExportSignable = "core:document-version:export-signable-pdf"
-	ActionDocumentVersionSign             = "core:document-version:sign"
+	ActionDocumentVersionSign           = "core:document-version:sign"
-	ActionDocumentVersionUpdate           = "core:document-version:update"
+	ActionDocumentVersionUpdate         = "core:document-version:update"
-	ActionDocumentVersionSignatureRequest = "core:document-version:request-signature"
+	ActionDocumentVersionDeleteDraft    = "core:document-version:delete-draft"
-	ActionDocumentVersionDeleteDraft      = "core:document-version:delete-draft"
+	ActionDocumentVersionPublish        = "core:document-version:publish"
-	ActionDocumentVersionPublish          = "core:document-version:publish"
+	ActionDocumentVersionExport         = "core:document-version:export"
-	ActionDocumentVersionCancelSignature  = "core:document-version:cancel-signature"
-	ActionDocumentVersionExport           = "core:document-version:export"
 
 	// DocumentVersionSignature actions
-	ActionDocumentVersionSignatureGet  = "core:document-version-signature:get"
+	ActionDocumentVersionSignatureRequest = "core:document-version-signature:request"
-	ActionDocumentVersionSignatureList = "core:document-version-signature:list"
+	ActionDocumentVersionCancelSignature  = "core:document-version-signature:cancel"
+	ActionDocumentVersionSignatureGet     = "core:document-version-signature:get"
+	ActionDocumentVersionSignatureList    = "core:document-version-signature:list"
 
 	// Risk actions
 	ActionRiskGet                     = "core:risk:get"

pkg/server/api/console/v1/schema.graphql

@@ -4681,6 +4681,8 @@ type DocumentVersion implements Node
   publishedAt: Datetime
   createdAt: Datetime!
   updatedAt: Datetime!
+
+  permission(action: String!): Boolean! @goField(forceResolver: true)
 }
 
 type DocumentVersionSignatureConnection {

pkg/server/api/console/v1/schema/schema.go

@@ -729,6 +729,7 @@ type ComplexityRoot struct {
 		Document       func(childComplexity int) int
 		ID             func(childComplexity int) int
 		Owner          func(childComplexity int) int
+		Permission     func(childComplexity int, action string) int
 		PublishedAt    func(childComplexity int) int
 		Signatures     func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentVersionSignatureOrder, filter *types.DocumentVersionSignatureFilter) int
 		Signed         func(childComplexity int) int
@@ -2029,6 +2030,8 @@ type DocumentVersionResolver interface {
 	Owner(ctx context.Context, obj *types.DocumentVersion) (*types.People, error)
 	Signatures(ctx context.Context, obj *types.DocumentVersion, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentVersionSignatureOrder, filter *types.DocumentVersionSignatureFilter) (*types.DocumentVersionSignatureConnection, error)
 	Signed(ctx context.Context, obj *types.DocumentVersion) (bool, error)
+
+	Permission(ctx context.Context, obj *types.DocumentVersion, action string) (bool, error)
 }
 type DocumentVersionSignatureResolver interface {
 	DocumentVersion(ctx context.Context, obj *types.DocumentVersionSignature) (*types.DocumentVersion, error)
@@ -4314,6 +4317,17 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 		}
 
 		return e.complexity.DocumentVersion.Owner(childComplexity), true
+	case "DocumentVersion.permission":
+		if e.complexity.DocumentVersion.Permission == nil {
+			break
+		}
+
+		args, err := ec.field_DocumentVersion_permission_args(ctx, rawArgs)
+		if err != nil {
+			return 0, false
+		}
+
+		return e.complexity.DocumentVersion.Permission(childComplexity, args["action"].(string)), true
 	case "DocumentVersion.publishedAt":
 		if e.complexity.DocumentVersion.PublishedAt == nil {
 			break
@@ -15037,6 +15051,8 @@ type DocumentVersion implements Node
   publishedAt: Datetime
   createdAt: Datetime!
   updatedAt: Datetime!
+
+  permission(action: String!): Boolean! @goField(forceResolver: true)
 }
 
 type DocumentVersionSignatureConnection {
@@ -15945,6 +15961,17 @@ func (ec *executionContext) field_DocumentVersionSignature_permission_args(ctx c
 	return args, nil
 }
 
+func (ec *executionContext) field_DocumentVersion_permission_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "action", ec.unmarshalNString2string)
+	if err != nil {
+		return nil, err
+	}
+	args["action"] = arg0
+	return args, nil
+}
+
 func (ec *executionContext) field_DocumentVersion_signatures_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
 	var err error
 	args := map[string]any{}
@@ -29520,6 +29547,47 @@ func (ec *executionContext) fieldContext_DocumentVersion_updatedAt(_ context.Con
 	return fc, nil
 }
 
+func (ec *executionContext) _DocumentVersion_permission(ctx context.Context, field graphql.CollectedField, obj *types.DocumentVersion) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_DocumentVersion_permission,
+		func(ctx context.Context) (any, error) {
+			fc := graphql.GetFieldContext(ctx)
+			return ec.resolvers.DocumentVersion().Permission(ctx, obj, fc.Args["action"].(string))
+		},
+		nil,
+		ec.marshalNBoolean2bool,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_DocumentVersion_permission(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "DocumentVersion",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Boolean does not have child fields")
+		},
+	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_DocumentVersion_permission_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _DocumentVersionConnection_edges(ctx context.Context, field graphql.CollectedField, obj *types.DocumentVersionConnection) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
@@ -29675,6 +29743,8 @@ func (ec *executionContext) fieldContext_DocumentVersionEdge_node(_ context.Cont
 				return ec.fieldContext_DocumentVersion_createdAt(ctx, field)
 			case "updatedAt":
 				return ec.fieldContext_DocumentVersion_updatedAt(ctx, field)
+			case "permission":
+				return ec.fieldContext_DocumentVersion_permission(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type DocumentVersion", field.Name)
 		},
@@ -29763,6 +29833,8 @@ func (ec *executionContext) fieldContext_DocumentVersionSignature_documentVersio
 				return ec.fieldContext_DocumentVersion_createdAt(ctx, field)
 			case "updatedAt":
 				return ec.fieldContext_DocumentVersion_updatedAt(ctx, field)
+			case "permission":
+				return ec.fieldContext_DocumentVersion_permission(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type DocumentVersion", field.Name)
 		},
@@ -44633,6 +44705,8 @@ func (ec *executionContext) fieldContext_PublishDocumentVersionPayload_documentV
 				return ec.fieldContext_DocumentVersion_createdAt(ctx, field)
 			case "updatedAt":
 				return ec.fieldContext_DocumentVersion_updatedAt(ctx, field)
+			case "permission":
+				return ec.fieldContext_DocumentVersion_permission(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type DocumentVersion", field.Name)
 		},
@@ -53584,6 +53658,8 @@ func (ec *executionContext) fieldContext_UpdateDocumentVersionPayload_documentVe
 				return ec.fieldContext_DocumentVersion_createdAt(ctx, field)
 			case "updatedAt":
 				return ec.fieldContext_DocumentVersion_updatedAt(ctx, field)
+			case "permission":
+				return ec.fieldContext_DocumentVersion_permission(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type DocumentVersion", field.Name)
 		},
@@ -75960,6 +76036,42 @@ func (ec *executionContext) _DocumentVersion(ctx context.Context, sel ast.Select
 			if out.Values[i] == graphql.Null {
 				atomic.AddUint32(&out.Invalids, 1)
 			}
+		case "permission":
+			field := field
+
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
+				defer func() {
+					if r := recover(); r != nil {
+						ec.Error(ctx, ec.Recover(ctx, r))
+					}
+				}()
+				res = ec._DocumentVersion_permission(ctx, field, obj)
+				if res == graphql.Null {
+					atomic.AddUint32(&fs.Invalids, 1)
+				}
+				return res
+			}
+
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
+
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}

pkg/server/api/console/v1/v1_resolver.go

@@ -961,6 +961,11 @@ func (r *documentVersionResolver) Signed(ctx context.Context, obj *types.Documen
 	return signed, nil
 }
 
+// Permission is the resolver for the permission field.
+func (r *documentVersionResolver) Permission(ctx context.Context, obj *types.DocumentVersion, action string) (bool, error) {
+	return r.Resolver.Permission(ctx, obj, action)
+}
+
 // DocumentVersion is the resolver for the documentVersion field.
 func (r *documentVersionSignatureResolver) DocumentVersion(ctx context.Context, obj *types.DocumentVersionSignature) (*types.DocumentVersion, error) {
 	r.MustAuthorize(ctx, obj.ID, probo.ActionDocumentVersionGet)