From 302175617feb4194b9a9e5fe85c606dac48f245b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=89mile=20R=C3=A9?= Date: Mon, 27 Jul 2026 18:00:23 +0200 Subject: [PATCH] Drop report org checks and noisy comments MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Report access loads are already tenant-scoped; reject the extra organization guard. Also remove the PortalAccessRequest doc comment called out in review. Signed-off-by: Émile Ré --- .../visitor/portal_access_service.go | 3 --- .../v1/compliance_portal_resolvers.go | 14 -------------- 2 files changed, 17 deletions(-) diff --git a/pkg/complianceportal/visitor/portal_access_service.go b/pkg/complianceportal/visitor/portal_access_service.go index fb51d9c26..4f5b705e3 100644 --- a/pkg/complianceportal/visitor/portal_access_service.go +++ b/pkg/complianceportal/visitor/portal_access_service.go @@ -35,9 +35,6 @@ import ( "go.probo.inc/probo/pkg/page" ) -// PortalAccessRequest carries the explicit resource IDs to request access for. -// Callers must supply at least one ID across the three slices; nil and empty -// both mean "none of that type" (there is no "request all" expansion). type PortalAccessRequest struct { CompliancePortalID gid.GID IdentityID gid.GID diff --git a/pkg/server/api/complianceportal/v1/compliance_portal_resolvers.go b/pkg/server/api/complianceportal/v1/compliance_portal_resolvers.go index fecec4373..50bb16ce2 100644 --- a/pkg/server/api/complianceportal/v1/compliance_portal_resolvers.go +++ b/pkg/server/api/complianceportal/v1/compliance_portal_resolvers.go @@ -1001,13 +1001,6 @@ func (r *mutationResolver) RequestReportAccess(ctx context.Context, input types. return nil, gqlutils.Internal(ctx) } - // GetAuditByReportFileID is only tenant-scoped, so a report belonging to - // another organization in the same tenant would otherwise be reachable. - // Reject it as not found before an access row can be written. - if audit.OrganizationID != compliancePortal.OrganizationID { - return nil, gqlutils.NotFoundf(ctx, "report %q not found", input.ReportID) - } - if audit.CompliancePortalVisibility == coredata.CompliancePortalVisibilityPublic { return nil, gqlutils.Invalidf( ctx, @@ -1156,13 +1149,6 @@ func (r *mutationResolver) RequestAccesses(ctx context.Context, input types.Requ return nil, gqlutils.Internal(ctx) } - // GetAuditByReportFileID is only tenant-scoped, so a report belonging to - // another organization in the same tenant would otherwise be reachable. - // Reject it as not found before an access row can be written. - if audit.OrganizationID != compliancePortal.OrganizationID { - return nil, gqlutils.NotFoundf(ctx, "report %q not found", reportID) - } - if audit.CompliancePortalVisibility == coredata.CompliancePortalVisibilityPublic { continue }