rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Replace @nda directive with resolver helper

Browse Source 
Export and request-access already know visibility and
auth; a shared requireCompletedNDA call keeps NDA
enforcement there and drops GraphQL PUBLIC probing.

Signed-off-by: Émile Ré <emile@probo.com>
This commit is contained in:
Émile Ré
2026-07-30 16:56:55 +02:00
parent 93818d8292
commit 34fa2356e1
6 changed files with 110 additions and 253 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
pkg/server/api/complianceportal/v1/compliance_portal_resolvers.go
View File

@@ -794,6 +794,10 @@ func (r *mutationResolver) ExportDocumentPDF(ctx context.Context, input types.Ex
return nil, gqlutils.Unauthenticated(ctx, errors.New("unauthenticated"))
}
if err := r.requireCompletedNDA(ctx); err != nil {
return nil, err
}
documentAccess, err := visitorService.GetPortalDocumentAccess(
ctx, scope,
compliancePortal.ID,
@@ -848,6 +852,10 @@ func (r *mutationResolver) ExportReportPDF(ctx context.Context, input types.Expo
return nil, gqlutils.Unauthenticatedf(ctx, "unauthenticated")
}
if err := r.requireCompletedNDA(ctx); err != nil {
return nil, err
}
reportAccess, err := visitorService.GetPortalReportFileAccess(
ctx, scope,
compliancePortal.ID,
@@ -907,6 +915,10 @@ func (r *mutationResolver) ExportCompliancePortalFile(ctx context.Context, input
return nil, gqlutils.Unauthenticatedf(ctx, "unauthenticated")
}
if err := r.requireCompletedNDA(ctx); err != nil {
return nil, err
}
fileAccess, err := visitorService.GetPortalFileAccess(ctx, scope,
compliancePortal.ID,
identity.ID,
@@ -964,6 +976,10 @@ func (r *mutationResolver) RequestDocumentAccess(ctx context.Context, input type
return nil, gqlutils.Unauthenticatedf(ctx, "authentication is required to request access")
}
if err := r.requireCompletedNDA(ctx); err != nil {
return nil, err
}
if _, err := visitorService.RequestPortalAccess(
ctx, scope,
&visitor.PortalAccessRequest{
@@ -1013,6 +1029,10 @@ func (r *mutationResolver) RequestReportAccess(ctx context.Context, input types.
return nil, gqlutils.Unauthenticatedf(ctx, "authentication is required to request access")
}
if err := r.requireCompletedNDA(ctx); err != nil {
return nil, err
}
if _, err := visitorService.RequestPortalAccess(
ctx, scope,
&visitor.PortalAccessRequest{
@@ -1062,6 +1082,10 @@ func (r *mutationResolver) RequestCompliancePortalFileAccess(ctx context.Context
return nil, gqlutils.Unauthenticatedf(ctx, "authentication is required to request access")
}
if err := r.requireCompletedNDA(ctx); err != nil {
return nil, err
}
if _, err := visitorService.RequestPortalAccess(
ctx, scope,
&visitor.PortalAccessRequest{
@@ -1093,6 +1117,10 @@ func (r *mutationResolver) RequestAccesses(ctx context.Context, input types.Requ
return nil, gqlutils.Unauthenticatedf(ctx, "authentication is required to request access")
}
if err := r.requireCompletedNDA(ctx); err != nil {
return nil, err
}
if len(input.DocumentIds) == 0 && len(input.ReportIds) == 0 && len(input.CompliancePortalFileIds) == 0 {
return nil, gqlutils.Invalidf(ctx, "at least one document, report, or file id is required")
}

2
pkg/server/api/complianceportal/v1/graphql/base.graphql
View File

@@ -11,8 +11,6 @@ directive @goModel(
directive @goEnum(value: String) on ENUM_VALUE
directive @nda on FIELD_DEFINITION | OBJECT
scalar BigInt
scalar CursorKey
scalar Datetime

14
pkg/server/api/complianceportal/v1/graphql/compliance_portal.graphql
View File

@@ -467,30 +467,30 @@ type DocumentAccess implements Node {
extend type Mutation {
exportDocumentPDF(input: ExportDocumentPDFInput!): ExportDocumentPDFPayload!
@authentication(required: OPTIONAL) @nda
@authentication(required: OPTIONAL)
exportReportPDF(input: ExportReportPDFInput!): ExportReportPDFPayload!
@authentication(required: OPTIONAL) @nda
@authentication(required: OPTIONAL)
exportCompliancePortalFile(
input: ExportCompliancePortalFileInput!
): ExportCompliancePortalFilePayload! @authentication(required: OPTIONAL) @nda
): ExportCompliancePortalFilePayload! @authentication(required: OPTIONAL)
requestDocumentAccess(
input: RequestDocumentAccessInput!
): RequestDocumentAccessPayload! @authentication(required: PRESENT) @nda
): RequestDocumentAccessPayload! @authentication(required: PRESENT)
requestReportAccess(
input: RequestReportAccessInput!
): RequestReportAccessPayload! @authentication(required: PRESENT) @nda
): RequestReportAccessPayload! @authentication(required: PRESENT)
requestCompliancePortalFileAccess(
input: RequestCompliancePortalFileAccessInput!
): RequestFileAccessPayload! @authentication(required: PRESENT) @nda
): RequestFileAccessPayload! @authentication(required: PRESENT)
requestAccesses(
input: RequestAccessesInput!
): RequestAccessesResultPayload! @authentication(required: PRESENT) @nda
): RequestAccessesResultPayload! @authentication(required: PRESENT)
}
type RequestDocumentAccessPayload {

1
pkg/server/api/complianceportal/v1/graphql_handler.go
View File

@@ -65,7 +65,6 @@ func NewGraphQLHandler(
sessionCookie: authn.NewCookie(&cookieConfig),
},
Directives: schema.DirectiveRoot{
Nda: newNDADirective(logger, visitorSvc, esignSvc),
Authentication: authentication.Directive,
SessionOnly: session.Directive,
},

75
pkg/server/api/complianceportal/v1/nda.go Normal file
View File

@@ -0,0 +1,75 @@
// Copyright (c) 2026 Probo Inc <hello@probo.com>.
//
// Permission is hereby granted, free of charge, to any person obtaining a copy
// of this software and associated documentation files (the "Software"), to deal
// in the Software without restriction, including without limitation the rights
// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
// copies of the Software, and to permit persons to whom the Software is
// furnished to do so, subject to the following conditions:
//
// The above copyright notice and this permission notice shall be included in
// all copies or substantial portions of the Software.
//
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
// SOFTWARE.
package complianceportal_v1
import (
"context"
"go.gearno.de/kit/log"
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/server/api/authn"
"go.probo.inc/probo/pkg/server/api/complianceportal"
"go.probo.inc/probo/pkg/server/gqlutils"
)
// requireCompletedNDA enforces portal NDA completion for the signed-in identity.
// No-ops when there is no viewer or the portal membership has no NDA signature.
// Callers own authentication and PUBLIC-resource skips.
func (r *Resolver) requireCompletedNDA(ctx context.Context) error {
identity := authn.IdentityFromContext(ctx)
if identity == nil {
return nil
}
compliancePage := complianceportal.CompliancePortalFromContext(ctx)
if compliancePage == nil {
r.logger.ErrorCtx(ctx, "cannot get compliance page from context")
return gqlutils.Internal(ctx)
}
membership, err := r.visitor.GetPortalMembership(ctx, compliancePage.ID, identity.ID)
if err != nil {
r.logger.ErrorCtx(ctx, "cannot get compliance page membership", log.Error(err))
return gqlutils.Internal(ctx)
}
if membership.ElectronicSignatureID == nil {
return nil
}
scope := coredata.NewScopeFromObjectID(compliancePage.OrganizationID)
sig, err := r.esign.GetSignatureByID(ctx, scope, *membership.ElectronicSignatureID)
if err != nil {
r.logger.ErrorCtx(ctx, "cannot get NDA signature", log.Error(err))
return gqlutils.Internal(ctx)
}
if identity.FullName == "" {
return gqlutils.FullNameRequiredf(ctx, "full name is required")
}
if sig.Status != coredata.ElectronicSignatureStatusCompleted {
return gqlutils.NDASignatureRequiredf(ctx, "NDA signature required")
}
return nil
}

243
pkg/server/api/complianceportal/v1/nda_directive.go
View File

@@ -1,243 +0,0 @@
// Copyright (c) 2026 Probo Inc <hello@probo.com>.
//
// Permission is hereby granted, free of charge, to any person obtaining a copy
// of this software and associated documentation files (the "Software"), to deal
// in the Software without restriction, including without limitation the rights
// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
// copies of the Software, and to permit persons to whom the Software is
// furnished to do so, subject to the following conditions:
//
// The above copyright notice and this permission notice shall be included in
// all copies or substantial portions of the Software.
//
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
// SOFTWARE.
package complianceportal_v1
import (
"context"
"errors"
"fmt"
"github.com/99designs/gqlgen/graphql"
"go.gearno.de/kit/log"
"go.probo.inc/probo/pkg/complianceportal/visitor"
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/esign"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/server/api/authn"
"go.probo.inc/probo/pkg/server/api/complianceportal"
"go.probo.inc/probo/pkg/server/api/complianceportal/v1/types"
"go.probo.inc/probo/pkg/server/gqlutils"
)
func newNDADirective(
logger *log.Logger,
visitorSvc *visitor.Service,
esignSvc *esign.Service,
) func(ctx context.Context, obj any, next graphql.Resolver) (any, error) {
return func(ctx context.Context, obj any, next graphql.Resolver) (any, error) {
identity := authn.IdentityFromContext(ctx)
if identity == nil {
return next(ctx)
}
compliancePage := complianceportal.CompliancePortalFromContext(ctx)
if compliancePage == nil {
logger.ErrorCtx(ctx, "cannot get compliance page from context")
return nil, gqlutils.Internal(ctx)
}
scope := coredata.NewScopeFromObjectID(compliancePage.OrganizationID)
skip, err := shouldSkipNDAForPublic(
ctx,
visitorSvc,
scope,
compliancePage.OrganizationID,
)
if err != nil {
logger.ErrorCtx(ctx, "cannot check target visibility for NDA gate", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
if skip {
return next(ctx)
}
membership, err := visitorSvc.GetPortalMembership(ctx, compliancePage.ID, identity.ID)
if err != nil {
logger.ErrorCtx(ctx, "cannot get compliance page membership", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
if membership.ElectronicSignatureID == nil {
return next(ctx)
}
sig, err := esignSvc.GetSignatureByID(ctx, scope, *membership.ElectronicSignatureID)
if err != nil {
logger.ErrorCtx(ctx, "cannot get NDA signature", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
// We need full name before user signs NDA
if identity.FullName == "" {
return nil, gqlutils.FullNameRequiredf(ctx, "full name is required")
}
if sig.Status != coredata.ElectronicSignatureStatusCompleted {
return nil, gqlutils.NDASignatureRequiredf(ctx, "NDA signature required")
}
return next(ctx)
}
}
// shouldSkipNDAForPublic reports whether the @nda field targets a single PUBLIC
// document / report / file and can therefore skip the signature gate. Bulk
// requestAccesses always returns false. Not-found / not-visible targets also
// skip so the resolver can return its usual NotFound/Invalid.
func shouldSkipNDAForPublic(
ctx context.Context,
visitorSvc *visitor.Service,
scope coredata.Scoper,
organizationID gid.GID,
) (bool, error) {
fc := graphql.GetFieldContext(ctx)
if fc == nil {
return false, nil
}
switch fc.Field.Name {
case "requestAccesses":
return false, nil
case "exportDocumentPDF":
input, ok := fc.Args["input"].(types.ExportDocumentPDFInput)
if !ok {
return false, nil
}
return isPublicDocument(ctx, visitorSvc, scope, organizationID, input.DocumentID)
case "requestDocumentAccess":
input, ok := fc.Args["input"].(types.RequestDocumentAccessInput)
if !ok {
return false, nil
}
return isPublicDocument(ctx, visitorSvc, scope, organizationID, input.DocumentID)
case "exportReportPDF":
input, ok := fc.Args["input"].(types.ExportReportPDFInput)
if !ok {
return false, nil
}
return isPublicReport(ctx, visitorSvc, scope, input.ReportID)
case "requestReportAccess":
input, ok := fc.Args["input"].(types.RequestReportAccessInput)
if !ok {
return false, nil
}
return isPublicReport(ctx, visitorSvc, scope, input.ReportID)
case "exportCompliancePortalFile":
input, ok := fc.Args["input"].(types.ExportCompliancePortalFileInput)
if !ok {
return false, nil
}
return isPublicPortalFile(ctx, visitorSvc, scope, organizationID, input.CompliancePortalFileID)
case "requestCompliancePortalFileAccess":
input, ok := fc.Args["input"].(types.RequestCompliancePortalFileAccessInput)
if !ok {
return false, nil
}
return isPublicPortalFile(ctx, visitorSvc, scope, organizationID, input.CompliancePortalFileID)
default:
return false, nil
}
}
func isPublicDocument(
ctx context.Context,
visitorSvc *visitor.Service,
scope coredata.Scoper,
organizationID gid.GID,
documentID gid.GID,
) (bool, error) {
document, err := visitorSvc.GetDocument(ctx, scope, organizationID, documentID)
if err != nil {
if isMissingDocument(err) {
return true, nil
}
return false, fmt.Errorf("cannot load document: %w", err)
}
return document.CompliancePortalVisibility == coredata.CompliancePortalVisibilityPublic, nil
}
func isPublicReport(
ctx context.Context,
visitorSvc *visitor.Service,
scope coredata.Scoper,
reportID gid.GID,
) (bool, error) {
audit, err := visitorSvc.GetAuditByReportFileID(ctx, scope, reportID)
if err != nil {
if errors.Is(err, coredata.ErrResourceNotFound) {
return true, nil
}
return false, fmt.Errorf("cannot load audit: %w", err)
}
return audit.CompliancePortalVisibility == coredata.CompliancePortalVisibilityPublic, nil
}
func isPublicPortalFile(
ctx context.Context,
visitorSvc *visitor.Service,
scope coredata.Scoper,
organizationID gid.GID,
fileID gid.GID,
) (bool, error) {
file, err := visitorSvc.GetPortalFile(ctx, scope, organizationID, fileID)
if err != nil {
if errors.Is(err, visitor.ErrPortalFileNotFound) ||
errors.Is(err, visitor.ErrPortalFileNotVisible) ||
errors.Is(err, coredata.ErrResourceNotFound) {
return true, nil
}
return false, fmt.Errorf("cannot load portal file: %w", err)
}
return file.CompliancePortalVisibility == coredata.CompliancePortalVisibilityPublic, nil
}
func isMissingDocument(err error) bool {
if errors.Is(err, visitor.ErrDocumentNotFound) ||
errors.Is(err, visitor.ErrDocumentNotVisible) ||
errors.Is(err, coredata.ErrResourceNotFound) {
return true
}
_, ok := errors.AsType[*visitor.ErrDocumentArchived](err)
return ok
}