From 2bd2c5c215f877646197ead71a8a76d547db0c1c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89mile=20R=C3=A9?= <emile@getprobo.com>
Date: Fri, 16 Jan 2026 10:18:59 +0400
Subject: [PATCH] Fix trust resolver IsUserAuthorized when doc is public
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Émile Ré <emile@getprobo.com>
---
 apps/trust/src/components/AuditRow.tsx        | 45 +++++++++----------
 apps/trust/src/components/DocumentRow.tsx     | 44 +++++++++---------
 .../src/components/TrustCenterFileRow.tsx     | 44 +++++++++---------
 pkg/server/api/trust/v1/v1_resolver.go        | 20 ++++-----
 4 files changed, 73 insertions(+), 80 deletions(-)

diff --git a/apps/trust/src/components/AuditRow.tsx b/apps/trust/src/components/AuditRow.tsx
index 251f8539c..bd7a13a16 100644
--- a/apps/trust/src/components/AuditRow.tsx
+++ b/apps/trust/src/components/AuditRow.tsx
@@ -129,7 +129,27 @@ export function AuditRow(props: { audit: AuditRowFragment$key }) {
         <IconMedal size={16} className="flex-none text-txt-tertiary" />
         {audit.framework.name}
       </div>
-      {!viewer && (
+      {audit.report && audit.report.isUserAuthorized ? (
+        <Button
+          className="w-full md:w-max"
+          variant="secondary"
+          disabled={downloading}
+          icon={downloading ? Spinner : IconArrowInbox}
+          onClick={handleDownload}
+        >
+          {__("Download")}
+        </Button>
+      ) : viewer ? (
+        <Button
+          disabled={hasRequested || isRequestingAccess}
+          className="w-full md:w-max"
+          variant="secondary"
+          icon={IconLock}
+          onClick={handleRequestAccess}
+        >
+          {hasRequested ? __("Access requested") : __("Request access")}
+        </Button>
+      ) : (
         <MagicLinkDialog>
           <Button
             className="w-full md:w-max"
@@ -140,29 +160,6 @@ export function AuditRow(props: { audit: AuditRowFragment$key }) {
           </Button>
         </MagicLinkDialog>
       )}
-      {viewer &&
-        audit.report &&
-        (audit.report.isUserAuthorized ? (
-          <Button
-            className="w-full md:w-max"
-            variant="secondary"
-            disabled={downloading}
-            icon={downloading ? Spinner : IconArrowInbox}
-            onClick={handleDownload}
-          >
-            {__("Download")}
-          </Button>
-        ) : (
-          <Button
-            disabled={hasRequested || isRequestingAccess}
-            className="w-full md:w-max"
-            variant="secondary"
-            icon={IconLock}
-            onClick={handleRequestAccess}
-          >
-            {hasRequested ? __("Access requested") : __("Request access")}
-          </Button>
-        ))}
     </div>
   );
 }
diff --git a/apps/trust/src/components/DocumentRow.tsx b/apps/trust/src/components/DocumentRow.tsx
index bb16e8030..f302c1fb3 100644
--- a/apps/trust/src/components/DocumentRow.tsx
+++ b/apps/trust/src/components/DocumentRow.tsx
@@ -114,7 +114,27 @@ export function DocumentRow(props: { document: DocumentRowFragment$key }) {
         <IconPageTextLine size={16} className=" flex-none text-txt-tertiary" />
         {document.title}
       </div>
-      {!viewer && (
+      {document.isUserAuthorized ? (
+        <Button
+          className="w-full md:w-max"
+          variant="secondary"
+          disabled={downloading}
+          icon={downloading ? Spinner : IconArrowInbox}
+          onClick={handleDownload}
+        >
+          {__("Download")}
+        </Button>
+      ) : viewer ? (
+        <Button
+          disabled={hasRequested || isRequestingAccess}
+          className="w-full md:w-max"
+          variant="secondary"
+          icon={IconLock}
+          onClick={handleRequestAccess}
+        >
+          {hasRequested ? __("Access requested") : __("Request access")}
+        </Button>
+      ) : (
         <MagicLinkDialog>
           <Button
             className="w-full md:w-max"
@@ -125,28 +145,6 @@ export function DocumentRow(props: { document: DocumentRowFragment$key }) {
           </Button>
         </MagicLinkDialog>
       )}
-      {viewer &&
-        (document.isUserAuthorized ? (
-          <Button
-            className="w-full md:w-max"
-            variant="secondary"
-            disabled={downloading}
-            icon={downloading ? Spinner : IconArrowInbox}
-            onClick={handleDownload}
-          >
-            {__("Download")}
-          </Button>
-        ) : (
-          <Button
-            disabled={hasRequested || isRequestingAccess}
-            className="w-full md:w-max"
-            variant="secondary"
-            icon={IconLock}
-            onClick={handleRequestAccess}
-          >
-            {hasRequested ? __("Access requested") : __("Request access")}
-          </Button>
-        ))}
     </div>
   );
 }
diff --git a/apps/trust/src/components/TrustCenterFileRow.tsx b/apps/trust/src/components/TrustCenterFileRow.tsx
index 9127be2b9..8fa5e69a8 100644
--- a/apps/trust/src/components/TrustCenterFileRow.tsx
+++ b/apps/trust/src/components/TrustCenterFileRow.tsx
@@ -118,7 +118,27 @@ export function TrustCenterFileRow(props: {
         <IconPageTextLine size={16} className=" flex-none text-txt-tertiary" />
         {file.name}
       </div>
-      {!viewer && (
+      {file.isUserAuthorized ? (
+        <Button
+          className="w-full md:w-max"
+          variant="secondary"
+          disabled={downloading}
+          icon={downloading ? Spinner : IconArrowInbox}
+          onClick={handleDownload}
+        >
+          {__("Download")}
+        </Button>
+      ) : viewer ? (
+        <Button
+          disabled={hasRequested || isRequestingAccess}
+          className="w-full md:w-max"
+          variant="secondary"
+          icon={IconLock}
+          onClick={handleRequestAccess}
+        >
+          {hasRequested ? __("Access requested") : __("Request access")}
+        </Button>
+      ) : (
         <MagicLinkDialog>
           <Button
             className="w-full md:w-max"
@@ -129,28 +149,6 @@ export function TrustCenterFileRow(props: {
           </Button>
         </MagicLinkDialog>
       )}
-      {viewer &&
-        (file.isUserAuthorized ? (
-          <Button
-            className="w-full md:w-max"
-            variant="secondary"
-            disabled={downloading}
-            icon={downloading ? Spinner : IconArrowInbox}
-            onClick={handleDownload}
-          >
-            {__("Download")}
-          </Button>
-        ) : (
-          <Button
-            disabled={hasRequested || isRequestingAccess}
-            className="w-full md:w-max"
-            variant="secondary"
-            icon={IconLock}
-            onClick={handleRequestAccess}
-          >
-            {hasRequested ? __("Access requested") : __("Request access")}
-          </Button>
-        ))}
     </div>
   );
 }
diff --git a/pkg/server/api/trust/v1/v1_resolver.go b/pkg/server/api/trust/v1/v1_resolver.go
index e4faadac9..f30349d03 100644
--- a/pkg/server/api/trust/v1/v1_resolver.go
+++ b/pkg/server/api/trust/v1/v1_resolver.go
@@ -796,11 +796,6 @@ func (r *queryResolver) CurrentTrustCenter(ctx context.Context) (*types.TrustCen
 
 // IsUserAuthorized is the resolver for the isUserAuthorized field.
 func (r *reportResolver) IsUserAuthorized(ctx context.Context, obj *types.Report) (bool, error) {
-	identity := authn.IdentityFromContext(ctx)
-	if identity == nil {
-		return false, nil
-	}
-
 	trustService := r.TrustService(ctx, obj.ID.TenantID())
 
 	trustCenter := compliancepage.CompliancePageFromContext(ctx)
@@ -815,6 +810,11 @@ func (r *reportResolver) IsUserAuthorized(ctx context.Context, obj *types.Report
 		return true, nil
 	}
 
+	identity := authn.IdentityFromContext(ctx)
+	if identity == nil {
+		return false, nil
+	}
+
 	reportAccess, err := trustService.TrustCenterAccesses.LoadReportAccess(ctx,
 		trustCenter.ID,
 		identity.EmailAddress,
@@ -1004,11 +1004,6 @@ func (r *trustCenterResolver) TrustCenterFiles(ctx context.Context, obj *types.T
 
 // IsUserAuthorized is the resolver for the isUserAuthorized field.
 func (r *trustCenterFileResolver) IsUserAuthorized(ctx context.Context, obj *types.TrustCenterFile) (bool, error) {
-	identity := authn.IdentityFromContext(ctx)
-	if identity == nil {
-		return false, nil
-	}
-
 	trustService := r.TrustService(ctx, obj.ID.TenantID())
 
 	trustCenter := compliancepage.CompliancePageFromContext(ctx)
@@ -1023,6 +1018,11 @@ func (r *trustCenterFileResolver) IsUserAuthorized(ctx context.Context, obj *typ
 		return true, nil
 	}
 
+	identity := authn.IdentityFromContext(ctx)
+	if identity == nil {
+		return false, nil
+	}
+
 	fileAccess, err := trustService.TrustCenterAccesses.LoadTrustCenterFileAccess(ctx,
 		trustCenter.ID,
 		identity.EmailAddress,