rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update business logic

Browse Source 
Signed-off-by: Émile Ré <emile@getprobo.com>
This commit is contained in:
Émile Ré
2026-03-04 18:47:12 +04:00
parent 909beeb606
commit 323cd602a1
13 changed files with 264 additions and 320 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
pkg/trust/errors.go
View File

@@ -20,7 +20,8 @@ var (
ErrCustomDomainNotFound = errors.New("custom domain not found")
ErrPageNotFound = errors.New("page not found")
ErrMembershipNotFound = errors.New("membership not found")
ErrMembershipInactive = errors.New("membership inactive")
ErrUserNotFound = errors.New("user not found")
ErrUserInactive = errors.New("user inactive")
ErrDocumentAccessNotFound = errors.New("document access not found")
ErrNDAFileNotFound = errors.New("NDA file not found")
)

7
pkg/trust/service.go
View File

@@ -30,7 +30,6 @@ import (
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/html2pdf"
"go.probo.inc/probo/pkg/iam"
"go.probo.inc/probo/pkg/mail"
"go.probo.inc/probo/pkg/probo"
"go.probo.inc/probo/pkg/slack"
)
@@ -277,18 +276,18 @@ func (s *Service) EmailPresenterConfigByOrganizationID(ctx context.Context, orgI
return s.WithTenant(orgID.TenantID()).TrustCenters.EmailPresenterConfig(ctx, trustCenter.ID)
}
func (s *Service) GetMembershipByCompliancePageIDAndEmail(ctx context.Context, compliancePageID gid.GID, email mail.Addr) (*coredata.TrustCenterAccess, error) {
func (s *Service) GetMembershipByCompliancePageIDAndIdentityID(ctx context.Context, compliancePageID gid.GID, identityID gid.GID) (*coredata.TrustCenterAccess, error) {
membership := &coredata.TrustCenterAccess{}
err := s.pg.WithConn(
ctx,
func(conn pg.Conn) error {
return membership.LoadByTrustCenterIDAndEmail(
return membership.LoadByTrustCenterIDAndIdentityID(
ctx,
conn,
coredata.NewScopeFromObjectID(compliancePageID),
compliancePageID,
email,
identityID,
)
},
)

165
pkg/trust/trust_center_access_service.go
View File

@@ -28,7 +28,6 @@ import (
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/iam"
"go.probo.inc/probo/pkg/mail"
"go.probo.inc/probo/pkg/validator"
)
type (
@@ -40,8 +39,7 @@ type (
TrustCenterAccessRequest struct {
TrustCenterID gid.GID
Email mail.Addr
FullName string
IdentityID gid.GID
DocumentIDs []gid.GID
ReportIDs []gid.GID
TrustCenterFileIDs []gid.GID
@@ -52,20 +50,11 @@ const (
TrustCenterAccessURLFormat = "https://%s/organizations/%s/trust-center/access"
)
func (tcar *TrustCenterAccessRequest) Validate() error {
v := validator.New()
v.Check(tcar.Email.Domain(), "email", validator.NotBlacklisted())
return v.Error()
}
func (s TrustCenterAccessService) ensureAccessInTx(
ctx context.Context,
tx pg.Conn,
trustCenterID gid.GID,
email mail.Addr,
fullName string,
identityID gid.GID,
) (*coredata.TrustCenterAccess, *coredata.TrustCenter, error) {
now := time.Now()
@@ -74,8 +63,13 @@ func (s TrustCenterAccessService) ensureAccessInTx(
return nil, nil, fmt.Errorf("cannot load trust center: %w", err)
}
identity := &coredata.Identity{}
if err := identity.LoadByID(ctx, tx, identityID); err != nil {
return nil, nil, fmt.Errorf("cannot load identity: %w", err)
}
existingAccess := &coredata.TrustCenterAccess{}
err := existingAccess.LoadByTrustCenterIDAndEmail(ctx, tx, s.svc.scope, trustCenterID, email)
err := existingAccess.LoadByTrustCenterIDAndIdentityID(ctx, tx, s.svc.scope, trustCenterID, identityID)
if err == nil {
return existingAccess, trustCenter, nil
}
@@ -85,16 +79,12 @@ func (s TrustCenterAccessService) ensureAccessInTx(
}
access := &coredata.TrustCenterAccess{
ID: gid.New(s.svc.scope.GetTenantID(), coredata.TrustCenterAccessEntityType),
OrganizationID: trustCenter.OrganizationID,
TenantID: s.svc.scope.GetTenantID(),
TrustCenterID: trustCenterID,
Email: email,
Name: fullName,
State: coredata.TrustCenterAccessStateActive,
HasAcceptedNonDisclosureAgreement: false,
CreatedAt: now,
UpdatedAt: now,
ID: gid.New(s.svc.scope.GetTenantID(), coredata.TrustCenterAccessEntityType),
OrganizationID: trustCenter.OrganizationID,
TenantID: s.svc.scope.GetTenantID(),
TrustCenterID: trustCenterID,
CreatedAt: now,
UpdatedAt: now,
}
if trustCenter.NonDisclosureAgreementFileID != nil && s.svc.esign != nil {
@@ -105,7 +95,7 @@ func (s TrustCenterAccessService) ensureAccessInTx(
OrganizationID: access.OrganizationID,
DocumentType: coredata.ElectronicSignatureDocumentTypeNDA,
FileID: *trustCenter.NonDisclosureAgreementFileID,
SignerEmail: access.Email,
SignerEmail: identity.EmailAddress,
},
)
if err != nil {
@@ -124,8 +114,7 @@ func (s TrustCenterAccessService) ensureAccessInTx(
func (s TrustCenterAccessService) EnsureAccess(
ctx context.Context,
trustCenterID gid.GID,
email mail.Addr,
fullName string,
identityID gid.GID,
) (*coredata.TrustCenterAccess, error) {
var access *coredata.TrustCenterAccess
@@ -133,7 +122,7 @@ func (s TrustCenterAccessService) EnsureAccess(
ctx,
func(tx pg.Conn) error {
var err error
access, _, err = s.ensureAccessInTx(ctx, tx, trustCenterID, email, fullName)
access, _, err = s.ensureAccessInTx(ctx, tx, trustCenterID, identityID)
return err
},
)
@@ -145,10 +134,6 @@ func (s TrustCenterAccessService) Request(
ctx context.Context,
req *TrustCenterAccessRequest,
) (*coredata.TrustCenterAccess, error) {
if err := req.Validate(); err != nil {
return nil, fmt.Errorf("invalid request arguments: %w", err)
}
var (
now = time.Now()
access *coredata.TrustCenterAccess
@@ -160,7 +145,7 @@ func (s TrustCenterAccessService) Request(
var trustCenter *coredata.TrustCenter
var err error
access, trustCenter, err = s.ensureAccessInTx(ctx, tx, req.TrustCenterID, req.Email, req.FullName)
access, trustCenter, err = s.ensureAccessInTx(ctx, tx, req.TrustCenterID, req.IdentityID)
if err != nil {
return err
}
@@ -272,7 +257,7 @@ func (s TrustCenterAccessService) Request(
return nil, err
}
if err := s.svc.SlackMessages.QueueSlackNotification(ctx, access.Email, req.TrustCenterID); err != nil {
if err := s.svc.SlackMessages.QueueSlackNotification(ctx, req.IdentityID, req.TrustCenterID); err != nil {
s.logger.ErrorCtx(ctx, "cannot queue slack notification", log.Error(err))
}
@@ -282,12 +267,12 @@ func (s TrustCenterAccessService) Request(
func (s TrustCenterAccessService) GetAccess(
ctx context.Context,
trustCenterID gid.GID,
email mail.Addr,
identityID gid.GID,
) (coredata.TrustCenterAccess, error) {
var access coredata.TrustCenterAccess
err := s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
return access.LoadByTrustCenterIDAndEmail(ctx, conn, s.svc.scope, trustCenterID, email)
return access.LoadByTrustCenterIDAndIdentityID(ctx, conn, s.svc.scope, trustCenterID, identityID)
})
return access, err
@@ -296,14 +281,14 @@ func (s TrustCenterAccessService) GetAccess(
func (s TrustCenterAccessService) GetDocumentAccess(
ctx context.Context,
trustCenterID gid.GID,
email mail.Addr,
identityID gid.GID,
documentID gid.GID,
) (*coredata.TrustCenterDocumentAccess, error) {
var documentAccess *coredata.TrustCenterDocumentAccess
err := s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
access := &coredata.TrustCenterAccess{}
err := access.LoadByTrustCenterIDAndEmail(ctx, conn, s.svc.scope, trustCenterID, email)
err := access.LoadByTrustCenterIDAndIdentityID(ctx, conn, s.svc.scope, trustCenterID, identityID)
if err != nil {
if errors.Is(err, coredata.ErrResourceNotFound) {
return ErrMembershipNotFound
@@ -312,8 +297,15 @@ func (s TrustCenterAccessService) GetDocumentAccess(
return fmt.Errorf("cannot load trust center access: %w", err)
}
if access.State != coredata.TrustCenterAccessStateActive {
return ErrMembershipInactive
profile := &coredata.MembershipProfile{}
if err := profile.LoadByIdentityIDAndOrganizationID(ctx, conn, s.svc.scope, identityID, access.OrganizationID); err != nil {
if errors.Is(err, coredata.ErrResourceNotFound) {
return ErrUserNotFound
}
}
if profile.State != coredata.ProfileStateActive {
return ErrUserInactive
}
documentAccess = &coredata.TrustCenterDocumentAccess{}
@@ -339,14 +331,14 @@ func (s TrustCenterAccessService) GetDocumentAccess(
func (s TrustCenterAccessService) GetReportAccess(
ctx context.Context,
trustCenterID gid.GID,
email mail.Addr,
identityID gid.GID,
reportID gid.GID,
) (*coredata.TrustCenterDocumentAccess, error) {
var reportAccess *coredata.TrustCenterDocumentAccess
err := s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
access := &coredata.TrustCenterAccess{}
err := access.LoadByTrustCenterIDAndEmail(ctx, conn, s.svc.scope, trustCenterID, email)
err := access.LoadByTrustCenterIDAndIdentityID(ctx, conn, s.svc.scope, trustCenterID, identityID)
if err != nil {
if errors.Is(err, coredata.ErrResourceNotFound) {
return ErrMembershipNotFound
@@ -355,8 +347,15 @@ func (s TrustCenterAccessService) GetReportAccess(
return fmt.Errorf("cannot load trust center access: %w", err)
}
if access.State != coredata.TrustCenterAccessStateActive {
return ErrMembershipInactive
profile := &coredata.MembershipProfile{}
if err := profile.LoadByIdentityIDAndOrganizationID(ctx, conn, s.svc.scope, identityID, access.OrganizationID); err != nil {
if errors.Is(err, coredata.ErrResourceNotFound) {
return ErrUserNotFound
}
}
if profile.State != coredata.ProfileStateActive {
return ErrUserInactive
}
reportAccess = &coredata.TrustCenterDocumentAccess{}
@@ -382,14 +381,14 @@ func (s TrustCenterAccessService) GetReportAccess(
func (s TrustCenterAccessService) GetTrustCenterFileAccess(
ctx context.Context,
trustCenterID gid.GID,
email mail.Addr,
identityID gid.GID,
trustCenterFileID gid.GID,
) (*coredata.TrustCenterDocumentAccess, error) {
var fileAccess *coredata.TrustCenterDocumentAccess
err := s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
access := &coredata.TrustCenterAccess{}
err := access.LoadByTrustCenterIDAndEmail(ctx, conn, s.svc.scope, trustCenterID, email)
err := access.LoadByTrustCenterIDAndIdentityID(ctx, conn, s.svc.scope, trustCenterID, identityID)
if err != nil {
if errors.Is(err, coredata.ErrResourceNotFound) {
return ErrMembershipNotFound
@@ -398,8 +397,15 @@ func (s TrustCenterAccessService) GetTrustCenterFileAccess(
return fmt.Errorf("cannot load trust center access: %w", err)
}
if access.State != coredata.TrustCenterAccessStateActive {
return ErrMembershipInactive
profile := &coredata.MembershipProfile{}
if err := profile.LoadByIdentityIDAndOrganizationID(ctx, conn, s.svc.scope, identityID, access.OrganizationID); err != nil {
if errors.Is(err, coredata.ErrResourceNotFound) {
return ErrUserNotFound
}
}
if profile.State != coredata.ProfileStateActive {
return ErrUserInactive
}
fileAccess = &coredata.TrustCenterDocumentAccess{}
@@ -436,12 +442,28 @@ func (s *TrustCenterAccessService) GrantByIDs(
return fmt.Errorf("cannot load trust center: %w", err)
}
identity := &coredata.Identity{}
if err := identity.LoadByEmail(ctx, tx, email); err != nil {
return fmt.Errorf("cannot load identity: %w", err)
}
access := &coredata.TrustCenterAccess{}
if err := access.LoadByTrustCenterIDAndEmail(ctx, tx, s.svc.scope, trustCenter.ID, email); err != nil {
if err := access.LoadByTrustCenterIDAndIdentityID(ctx, tx, s.svc.scope, trustCenter.ID, identity.ID); err != nil {
return fmt.Errorf("cannot load trust center access: %w", err)
}
shouldSendEmail := access.State != coredata.TrustCenterAccessStateActive
profile := &coredata.MembershipProfile{}
if err := profile.LoadByIdentityIDAndOrganizationID(ctx, tx, s.svc.scope, identity.ID, access.OrganizationID); err != nil {
if errors.Is(err, coredata.ErrResourceNotFound) {
return ErrUserNotFound
}
}
if profile.State != coredata.ProfileStateActive {
return ErrUserInactive
}
shouldSendEmail := profile.State != coredata.ProfileStateActive
now := time.Now()
if len(documentIDs) > 0 {
@@ -461,13 +483,13 @@ func (s *TrustCenterAccessService) GrantByIDs(
}
if shouldSendEmail {
access.State = coredata.TrustCenterAccessStateActive
access.UpdatedAt = now
if err := access.Update(ctx, tx, s.svc.scope); err != nil {
return fmt.Errorf("cannot update trust center access: %w", err)
profile.State = coredata.ProfileStateActive
profile.UpdatedAt = now
if err := profile.Update(ctx, tx, s.svc.scope); err != nil {
return fmt.Errorf("cannot update profile: %w", err)
}
if err := s.sendAccessEmail(ctx, tx, access); err != nil {
if err := s.sendAccessEmail(ctx, tx, access, profile); err != nil {
return fmt.Errorf("cannot send access email: %w", err)
}
}
@@ -476,7 +498,7 @@ func (s *TrustCenterAccessService) GrantByIDs(
})
}
func (s *TrustCenterAccessService) sendAccessEmail(ctx context.Context, tx pg.Conn, access *coredata.TrustCenterAccess) error {
func (s *TrustCenterAccessService) sendAccessEmail(ctx context.Context, tx pg.Conn, access *coredata.TrustCenterAccess, profile *coredata.MembershipProfile) error {
organization := &coredata.Organization{}
if err := organization.LoadByID(ctx, tx, s.svc.scope, access.OrganizationID); err != nil {
return fmt.Errorf("cannot load organization: %w", err)
@@ -494,7 +516,7 @@ func (s *TrustCenterAccessService) sendAccessEmail(ctx context.Context, tx pg.Co
return fmt.Errorf("cannot get compliance page email presenter config: %w", err)
}
emailPresenter := emails.NewPresenterFromConfig(s.svc.fileManager, emailPresenterCfg, access.Name)
emailPresenter := emails.NewPresenterFromConfig(s.svc.fileManager, emailPresenterCfg, profile.FullName)
subject, textBody, htmlBody, err := emailPresenter.RenderTrustCenterAccess(ctx, organization.Name)
if err != nil {
@@ -502,8 +524,8 @@ func (s *TrustCenterAccessService) sendAccessEmail(ctx context.Context, tx pg.Co
}
accessEmail := coredata.NewEmail(
access.Name,
access.Email,
profile.FullName,
profile.EmailAddress,
subject,
textBody,
htmlBody,
@@ -529,11 +551,21 @@ func (s *TrustCenterAccessService) RejectOrRevokeByIDs(
return fmt.Errorf("cannot load trust center: %w", err)
}
identity := &coredata.Identity{}
if err := identity.LoadByEmail(ctx, tx, email); err != nil {
return fmt.Errorf("cannot load identity: %w", err)
}
access := &coredata.TrustCenterAccess{}
if err := access.LoadByTrustCenterIDAndEmail(ctx, tx, s.svc.scope, trustCenter.ID, email); err != nil {
if err := access.LoadByTrustCenterIDAndIdentityID(ctx, tx, s.svc.scope, trustCenter.ID, identity.ID); err != nil {
return fmt.Errorf("cannot load trust center access: %w", err)
}
profile := &coredata.MembershipProfile{}
if err := profile.LoadByIdentityIDAndOrganizationID(ctx, tx, s.svc.scope, identity.ID, access.OrganizationID); err != nil {
return fmt.Errorf("cannot load profile: %w", err)
}
shouldSendEmail := false
now := time.Now()
@@ -557,7 +589,7 @@ func (s *TrustCenterAccessService) RejectOrRevokeByIDs(
}
if shouldSendEmail {
if err := s.sendDocumentAccessRejectedEmail(ctx, tx, access, documentIDs, reportIDs, fileIDs); err != nil {
if err := s.sendDocumentAccessRejectedEmail(ctx, tx, access, profile, documentIDs, reportIDs, fileIDs); err != nil {
return fmt.Errorf("cannot send access email: %w", err)
}
}
@@ -570,6 +602,7 @@ func (s *TrustCenterAccessService) sendDocumentAccessRejectedEmail(
ctx context.Context,
tx pg.Conn,
access *coredata.TrustCenterAccess,
profile *coredata.MembershipProfile,
documentIDs []gid.GID,
reportIDs []gid.GID,
fileIDs []gid.GID,
@@ -613,11 +646,7 @@ func (s *TrustCenterAccessService) sendDocumentAccessRejectedEmail(
return fmt.Errorf("cannot get compliance page email presenter config: %w", err)
}
fullName := access.Name
if fullName == "" {
fullName = access.Email.Username()
}
emailPresenter := emails.NewPresenterFromConfig(s.svc.fileManager, emailPresenterCfg, fullName)
emailPresenter := emails.NewPresenterFromConfig(s.svc.fileManager, emailPresenterCfg, profile.FullName)
subject, textBody, htmlBody, err := emailPresenter.RenderTrustCenterDocumentAccessRejected(
ctx,
@@ -629,8 +658,8 @@ func (s *TrustCenterAccessService) sendDocumentAccessRejectedEmail(
}
accessEmail := coredata.NewEmail(
access.Name,
access.Email,
profile.FullName,
profile.EmailAddress,
subject,
textBody,
htmlBody,