rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update business logic

Browse Source 
Signed-off-by: Émile Ré <emile@getprobo.com>
This commit is contained in:
Émile Ré
2026-03-04 18:47:12 +04:00
parent 909beeb606
commit 323cd602a1
13 changed files with 264 additions and 320 deletions
Download Patch File Download Diff File Expand all files Collapse all files

75
pkg/server/api/compliancepage/membership_middleware.go
View File

@@ -1,75 +0,0 @@
// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package compliancepage
import (
"context"
"errors"
"net/http"
"github.com/99designs/gqlgen/graphql"
"github.com/vektah/gqlparser/v2/gqlerror"
"go.gearno.de/kit/httpserver"
"go.gearno.de/kit/log"
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/server/api/authn"
"go.probo.inc/probo/pkg/server/gqlutils"
"go.probo.inc/probo/pkg/trust"
)
func NewMembershipMiddleware(trustSvc *trust.Service, logger *log.Logger) func(next http.Handler) http.Handler {
return func(next http.Handler) http.Handler {
return http.HandlerFunc(
func(w http.ResponseWriter, r *http.Request) {
ctx := r.Context()
identity := authn.IdentityFromContext(r.Context())
if identity == nil {
next.ServeHTTP(w, r)
return
}
compliancePage := CompliancePageFromContext(ctx)
membership, err := trustSvc.GetMembershipByCompliancePageIDAndEmail(ctx, compliancePage.ID, identity.EmailAddress)
if err != nil {
if errors.Is(err, trust.ErrMembershipNotFound) {
next.ServeHTTP(w, r)
return
}
logger.ErrorCtx(ctx, "cannot get membership by page id and email", log.Error(err))
httpserver.RenderJSON(
w,
http.StatusInternalServerError,
&graphql.Response{
Errors: gqlerror.List{
gqlutils.Internal(ctx),
},
},
)
return
}
if membership.State == coredata.TrustCenterAccessStateActive {
ctx = context.WithValue(ctx, complianceMembershipKey, membership)
next.ServeHTTP(w, r.WithContext(ctx))
return
}
next.ServeHTTP(w, r)
},
)
}
}

10
pkg/server/api/console/v1/types/trust_center_access.go
View File

@@ -45,12 +45,8 @@ func NewTrustCenterAccessEdge(tca *coredata.TrustCenterAccess, orderBy coredata.
func NewTrustCenterAccess(tca *coredata.TrustCenterAccess) *TrustCenterAccess {
return &TrustCenterAccess{
ID: tca.ID,
Email: tca.Email,
Name: tca.Name,
State: tca.State,
HasAcceptedNonDisclosureAgreement: tca.HasAcceptedNonDisclosureAgreement,
CreatedAt: tca.CreatedAt,
UpdatedAt: tca.UpdatedAt,
ID: tca.ID,
CreatedAt: tca.CreatedAt,
UpdatedAt: tca.UpdatedAt,
}
}

5
pkg/server/api/console/v1/v1_resolver.go
View File

@@ -1940,8 +1940,7 @@ func (r *mutationResolver) CreateTrustCenterAccess(ctx context.Context, input ty
ctx,
&probo.CreateTrustCenterAccessRequest{
TrustCenterID: input.TrustCenterID,
Email: identity.EmailAddress,
FullName: identity.FullName,
IdentityID: identity.ID,
},
)
if err != nil {
@@ -1991,8 +1990,6 @@ func (r *mutationResolver) UpdateTrustCenterAccess(ctx context.Context, input ty
ctx,
&probo.UpdateTrustCenterAccessRequest{
ID: input.ID,
Name: input.Name,
State: input.State,
DocumentAccesses: documentAccesses,
ReportAccesses: reportAccesses,
TrustCenterFileAccesses: fileAccesses,

2
pkg/server/api/trust/v1/graphql_handler.go
View File

@@ -40,7 +40,7 @@ func NewGraphQLHandler(iamSvc *iam.Service, trustSvc *trust.Service, esignSvc *e
sessionCookie: authn.NewCookie(&cookieConfig),
},
Directives: schema.DirectiveRoot{
Nda: newNDADirective(logger, esignSvc),
Nda: newNDADirective(logger, trustSvc, esignSvc),
Session: session.Directive,
},
}

20
pkg/server/api/trust/v1/nda_directive.go
View File

@@ -16,6 +16,7 @@ package trust_v1
import (
"context"
"errors"
"github.com/99designs/gqlgen/graphql"
"go.gearno.de/kit/log"
@@ -24,10 +25,12 @@ import (
"go.probo.inc/probo/pkg/server/api/authn"
"go.probo.inc/probo/pkg/server/api/compliancepage"
"go.probo.inc/probo/pkg/server/gqlutils"
"go.probo.inc/probo/pkg/trust"
)
func newNDADirective(
logger *log.Logger,
trustSvc *trust.Service,
esignSvc *esign.Service,
) func(ctx context.Context, obj any, next graphql.Resolver) (any, error) {
return func(ctx context.Context, obj any, next graphql.Resolver) (any, error) {
@@ -36,9 +39,20 @@ func newNDADirective(
return next(ctx)
}
membership := compliancepage.ComplianceMembershipFromContext(ctx)
if membership == nil {
return nil, gqlutils.Unauthenticatedf(ctx, "authentication needed")
compliancePage := compliancepage.CompliancePageFromContext(ctx)
if compliancePage == nil {
logger.ErrorCtx(ctx, "cannot get compliance page from context")
return nil, gqlutils.Internal(ctx)
}
membership, err := trustSvc.GetMembershipByCompliancePageIDAndIdentityID(ctx, compliancePage.ID, identity.ID)
if err != nil {
if errors.Is(err, trust.ErrMembershipNotFound) {
return nil, gqlutils.Unauthenticatedf(ctx, "authentication needed")
}
logger.ErrorCtx(ctx, "cannot get compliance page membership", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
if membership.ElectronicSignatureID == nil {

1
pkg/server/api/trust/v1/resolver.go
View File

@@ -85,7 +85,6 @@ func NewMux(
r.Use(compliancepage.NewCompliancePagePresenceMiddleware())
r.Use(authn.NewSessionMiddleware(iamSvc, cookieConfig))
r.Use(compliancepage.NewMembershipMiddleware(trustSvc, logger))
graphqlHandler := NewGraphQLHandler(iamSvc, trustSvc, esignSvc, logger, baseURL, cookieConfig)

89
pkg/server/api/trust/v1/v1_resolver.go
View File

@@ -107,17 +107,14 @@ func (r *documentResolver) IsUserAuthorized(ctx context.Context, obj *types.Docu
documentAccess, err := trustService.TrustCenterAccesses.GetDocumentAccess(
ctx,
trustCenter.ID,
identity.EmailAddress,
identity.ID,
obj.ID,
)
if err != nil {
if errors.Is(err, trust.ErrMembershipNotFound) {
return false, nil
}
if errors.Is(err, trust.ErrMembershipInactive) {
return false, nil
}
if errors.Is(err, trust.ErrDocumentAccessNotFound) {
if errors.Is(err, trust.ErrMembershipNotFound) ||
errors.Is(err, trust.ErrUserNotFound) ||
errors.Is(err, trust.ErrUserInactive) ||
errors.Is(err, trust.ErrDocumentAccessNotFound) {
return false, nil
}
@@ -141,15 +138,17 @@ func (r *documentResolver) Access(ctx context.Context, obj *types.Document) (*ty
access, err := trustService.TrustCenterAccesses.GetDocumentAccess(
ctx,
trustCenter.ID,
identity.EmailAddress,
identity.ID,
obj.ID,
)
if err != nil {
if errors.Is(err, trust.ErrMembershipNotFound) || errors.Is(err, trust.ErrDocumentAccessNotFound) {
if errors.Is(err, trust.ErrMembershipNotFound) ||
errors.Is(err, trust.ErrUserNotFound) ||
errors.Is(err, trust.ErrDocumentAccessNotFound) {
return nil, nil
}
if errors.Is(err, trust.ErrMembershipInactive) {
if errors.Is(err, trust.ErrUserInactive) {
return nil, gqlutils.Forbidden(ctx, err)
}
@@ -262,7 +261,7 @@ func (r *mutationResolver) VerifyMagicLink(ctx context.Context, input types.Veri
trustCenter := compliancepage.CompliancePageFromContext(ctx)
trustService := r.TrustService(ctx, trustCenter.ID.TenantID())
if _, err := trustService.TrustCenterAccesses.EnsureAccess(ctx, trustCenter.ID, identity.EmailAddress, identity.FullName); err != nil {
if _, err := trustService.TrustCenterAccesses.EnsureAccess(ctx, trustCenter.ID, identity.ID); err != nil {
r.logger.ErrorCtx(ctx, "cannot ensure trust center access", log.Error(err))
}
@@ -288,8 +287,7 @@ func (r *mutationResolver) RequestAllAccesses(ctx context.Context) (*types.Reque
ctx,
&trust.TrustCenterAccessRequest{
TrustCenterID: trustCenter.ID,
Email: identity.EmailAddress,
FullName: identity.FullName,
IdentityID: identity.ID,
DocumentIDs: nil,
ReportIDs: nil,
},
@@ -302,8 +300,6 @@ func (r *mutationResolver) RequestAllAccesses(ctx context.Context) (*types.Reque
return &types.RequestAccessesPayload{
TrustCenterAccess: &types.TrustCenterAccess{
ID: access.ID,
Email: access.Email,
Name: access.Name,
CreatedAt: access.CreatedAt,
UpdatedAt: access.UpdatedAt,
},
@@ -341,7 +337,7 @@ func (r *mutationResolver) ExportDocumentPDF(ctx context.Context, input types.Ex
documentAccess, err := trustService.TrustCenterAccesses.GetDocumentAccess(
ctx,
trustCenter.ID,
identity.EmailAddress,
identity.ID,
input.DocumentID,
)
if err != nil {
@@ -395,7 +391,7 @@ func (r *mutationResolver) ExportReportPDF(ctx context.Context, input types.Expo
reportAccess, err := trustService.TrustCenterAccesses.GetReportAccess(
ctx,
trustCenter.ID,
identity.EmailAddress,
identity.ID,
input.ReportID,
)
if err != nil {
@@ -447,7 +443,7 @@ func (r *mutationResolver) ExportTrustCenterFile(ctx context.Context, input type
fileAccess, err := trustService.TrustCenterAccesses.GetTrustCenterFileAccess(ctx,
trustCenter.ID,
identity.EmailAddress,
identity.ID,
input.TrustCenterFileID,
)
if err != nil {
@@ -495,8 +491,7 @@ func (r *mutationResolver) RequestDocumentAccess(ctx context.Context, input type
ctx,
&trust.TrustCenterAccessRequest{
TrustCenterID: trustCenter.ID,
Email: identity.EmailAddress,
FullName: identity.FullName,
IdentityID: identity.ID,
DocumentIDs: []gid.GID{input.DocumentID},
ReportIDs: []gid.GID{},
TrustCenterFileIDs: []gid.GID{},
@@ -538,8 +533,7 @@ func (r *mutationResolver) RequestReportAccess(ctx context.Context, input types.
ctx,
&trust.TrustCenterAccessRequest{
TrustCenterID: trustCenter.ID,
Email: identity.EmailAddress,
FullName: identity.FullName,
IdentityID: identity.ID,
DocumentIDs: []gid.GID{},
ReportIDs: []gid.GID{input.ReportID},
TrustCenterFileIDs: []gid.GID{},
@@ -581,8 +575,7 @@ func (r *mutationResolver) RequestTrustCenterFileAccess(ctx context.Context, inp
ctx,
&trust.TrustCenterAccessRequest{
TrustCenterID: trustCenter.ID,
Email: identity.EmailAddress,
FullName: identity.FullName,
IdentityID: identity.ID,
DocumentIDs: []gid.GID{},
ReportIDs: []gid.GID{},
TrustCenterFileIDs: []gid.GID{input.TrustCenterFileID},
@@ -676,7 +669,7 @@ func (r *nonDisclosureAgreementResolver) FileURL(ctx context.Context, obj *types
if identity := authn.IdentityFromContext(ctx); identity != nil && r.esign != nil {
trustService := r.TrustService(ctx, trustCenter.ID.TenantID())
access, err := trustService.TrustCenterAccesses.GetAccess(ctx, trustCenter.ID, identity.EmailAddress)
access, err := trustService.TrustCenterAccesses.GetAccess(ctx, trustCenter.ID, identity.ID)
if err == nil && access.ElectronicSignatureID != nil {
fileURL, err := r.esign.GenerateSignatureFileURL(ctx, *access.ElectronicSignatureID, 15*time.Minute)
if err == nil {
@@ -707,7 +700,7 @@ func (r *nonDisclosureAgreementResolver) ViewerSignature(ctx context.Context, ob
trustCenter := compliancepage.CompliancePageFromContext(ctx)
trustService := r.TrustService(ctx, trustCenter.ID.TenantID())
access, err := trustService.TrustCenterAccesses.GetAccess(ctx, trustCenter.ID, identity.EmailAddress)
access, err := trustService.TrustCenterAccesses.GetAccess(ctx, trustCenter.ID, identity.ID)
if err != nil {
return nil, nil
}
@@ -868,17 +861,14 @@ func (r *reportResolver) IsUserAuthorized(ctx context.Context, obj *types.Report
reportAccess, err := trustService.TrustCenterAccesses.GetReportAccess(ctx,
trustCenter.ID,
identity.EmailAddress,
identity.ID,
obj.ID,
)
if err != nil {
if errors.Is(err, trust.ErrMembershipNotFound) {
return false, nil
}
if errors.Is(err, trust.ErrMembershipInactive) {
return false, nil
}
if errors.Is(err, trust.ErrDocumentAccessNotFound) {
if errors.Is(err, trust.ErrMembershipNotFound) ||
errors.Is(err, trust.ErrUserNotFound) ||
errors.Is(err, trust.ErrUserInactive) ||
errors.Is(err, trust.ErrDocumentAccessNotFound) {
return false, nil
}
@@ -902,15 +892,17 @@ func (r *reportResolver) Access(ctx context.Context, obj *types.Report) (*types.
access, err := trustService.TrustCenterAccesses.GetReportAccess(
ctx,
trustCenter.ID,
identity.EmailAddress,
identity.ID,
obj.ID,
)
if err != nil {
if errors.Is(err, trust.ErrMembershipNotFound) || errors.Is(err, trust.ErrDocumentAccessNotFound) {
if errors.Is(err, trust.ErrMembershipNotFound) ||
errors.Is(err, trust.ErrUserNotFound) ||
errors.Is(err, trust.ErrDocumentAccessNotFound) {
return nil, nil
}
if errors.Is(err, trust.ErrMembershipInactive) {
if errors.Is(err, trust.ErrUserInactive) {
return nil, gqlutils.Forbidden(ctx, err)
}
@@ -1107,17 +1099,14 @@ func (r *trustCenterFileResolver) IsUserAuthorized(ctx context.Context, obj *typ
fileAccess, err := trustService.TrustCenterAccesses.GetTrustCenterFileAccess(ctx,
trustCenter.ID,
identity.EmailAddress,
identity.ID,
obj.ID,
)
if err != nil {
if errors.Is(err, trust.ErrMembershipNotFound) {
return false, nil
}
if errors.Is(err, trust.ErrMembershipInactive) {
return false, nil
}
if errors.Is(err, trust.ErrDocumentAccessNotFound) {
if errors.Is(err, trust.ErrMembershipNotFound) ||
errors.Is(err, trust.ErrUserNotFound) ||
errors.Is(err, trust.ErrUserInactive) ||
errors.Is(err, trust.ErrDocumentAccessNotFound) {
return false, nil
}
@@ -1141,15 +1130,17 @@ func (r *trustCenterFileResolver) Access(ctx context.Context, obj *types.TrustCe
access, err := trustService.TrustCenterAccesses.GetTrustCenterFileAccess(
ctx,
trustCenter.ID,
identity.EmailAddress,
identity.ID,
obj.ID,
)
if err != nil {
if errors.Is(err, trust.ErrMembershipNotFound) || errors.Is(err, trust.ErrDocumentAccessNotFound) {
if errors.Is(err, trust.ErrMembershipNotFound) ||
errors.Is(err, trust.ErrUserNotFound) ||
errors.Is(err, trust.ErrDocumentAccessNotFound) {
return nil, nil
}
if errors.Is(err, trust.ErrMembershipInactive) {
if errors.Is(err, trust.ErrUserInactive) {
return nil, gqlutils.Forbidden(ctx, err)
}