From 392f81bd7444ce8c9dc73671261312bb03ba9a11 Mon Sep 17 00:00:00 2001 From: Bryan Frimin Date: Sat, 23 May 2026 13:28:13 -0700 Subject: [PATCH] Enforce IAM authorization on every console resolver Audited pkg/server/api/console/v1 for resolvers that touched tenant data without calling r.authorize, batchAuthorize, or Permission. Closed every gap so every data-bearing field goes through IAM (and produces an audit log entry when an organization_id is present). * High-severity reads now authorize: accessSourceResolver.Connector and ConnectionStatus, controlResolver.Regulatory/Contractual/RiskAssessment, electronicSignatureResolver.CertificateFileURL/Events, commonThirdPartyResolver.LogoURL, and the proper accessSourceResolver/accessReviewCampaignResolver/auditLogEntryResolver Organization resolvers (authorize + dataloader load, fixing the latent empty-name bug from the previous force-resolver no-op implementations). * TotalCount/DetectedCount aggregates now authorize the matching list action across access review, audit log, statement of applicability, detected tracker, tracker pattern, and tracker resource connections. * queryResolver.CommonThirdParties authorizes against the principal's identity via the new identity-scoped CommonThirdPartyCatalogPolicy. * Add ActionCommonThirdPartyGet/List, ActionElectronicSignatureGet probo action constants; wire ActionElectronicSignatureGet into ViewerPolicy and AuditorPolicy. * Implement AuthorizationAttributes on CommonThirdParty (no org) and ElectronicSignature (organization_id) so the authorizer can resolve attributes for the new actions. * Delete the dead "type AccessReview" GraphQL type (no Go constructor, no frontend reference) and drop its orphan resolver bundle. Signed-off-by: Bryan Frimin --- pkg/coredata/common_third_party.go | 13 ++ pkg/coredata/electronic_signature.go | 37 +++++ pkg/probo/actions.go | 8 + pkg/probo/policies.go | 18 ++- .../v1/access_review_campaign_resolvers.go | 143 ++++++++---------- .../api/console/v1/audit_log_resolvers.go | 28 +++- pkg/server/api/console/v1/base_resolvers.go | 10 +- .../v1/common_third_party_resolvers.go | 5 + .../api/console/v1/control_resolvers.go | 21 ++- .../api/console/v1/cookie_banner_resolvers.go | 34 +++-- .../v1/electronic_signature_resolvers.go | 9 ++ .../v1/graphql/access_review_campaign.graphql | 26 ---- .../console/v1/graphql/organization.graphql | 8 - .../api/console/v1/organization_resolvers.go | 5 - 14 files changed, 219 insertions(+), 146 deletions(-) diff --git a/pkg/coredata/common_third_party.go b/pkg/coredata/common_third_party.go index 387ab6f4a..32c16d16e 100644 --- a/pkg/coredata/common_third_party.go +++ b/pkg/coredata/common_third_party.go @@ -24,6 +24,7 @@ import ( "github.com/jackc/pgx/v5" "go.gearno.de/kit/pg" "go.probo.inc/probo/pkg/gid" + "go.probo.inc/probo/pkg/iam/policy" ) type ( @@ -54,6 +55,18 @@ type ( CommonThirdParties []*CommonThirdParty ) +// AuthorizationAttributes is a no-op resource-attribute loader: the +// common third-party catalog is global (shared across every tenant) and +// has no organization_id. Authorization for these rows is granted by an +// identity-scoped policy that has no condition. +func (t *CommonThirdParty) AuthorizationAttributes( + ctx context.Context, + conn pg.Querier, + resourceIDs []gid.GID, +) (policy.AttributesByID, error) { + return map[gid.GID]policy.Attributes{}, nil +} + func (t *CommonThirdParty) LoadByID( ctx context.Context, conn pg.Querier, diff --git a/pkg/coredata/electronic_signature.go b/pkg/coredata/electronic_signature.go index 71697a3d9..fce6364f2 100644 --- a/pkg/coredata/electronic_signature.go +++ b/pkg/coredata/electronic_signature.go @@ -27,6 +27,7 @@ import ( "go.gearno.de/x/ref" "go.probo.inc/probo/pkg/crypto/hash" "go.probo.inc/probo/pkg/gid" + "go.probo.inc/probo/pkg/iam/policy" ) type ElectronicSignature struct { @@ -59,6 +60,42 @@ type ElectronicSignature struct { UpdatedAt time.Time `db:"updated_at"` } +func (es *ElectronicSignature) AuthorizationAttributes( + ctx context.Context, + conn pg.Querier, + resourceIDs []gid.GID, +) (policy.AttributesByID, error) { + q := `SELECT id, organization_id FROM electronic_signatures WHERE id = ANY(@resource_ids::text[])` + + args := pgx.StrictNamedArgs{ + "resource_ids": resourceIDs, + } + + rows, err := conn.Query(ctx, q, args) + if err != nil { + return nil, fmt.Errorf("cannot query electronic signature authorization attributes: %w", err) + } + defer rows.Close() + + attrsByID := make(policy.AttributesByID) + for rows.Next() { + var id, organizationID gid.GID + if err := rows.Scan(&id, &organizationID); err != nil { + return nil, fmt.Errorf("cannot scan electronic signature authorization attributes: %w", err) + } + + attrsByID[id] = policy.Attributes{ + "organization_id": organizationID.String(), + } + } + + if err := rows.Err(); err != nil { + return nil, fmt.Errorf("cannot iterate electronic signature authorization attributes: %w", err) + } + + return attrsByID, nil +} + func (es *ElectronicSignature) NewEvent( eventType ElectronicSignatureEventType, eventSource ElectronicSignatureEventSource, diff --git a/pkg/probo/actions.go b/pkg/probo/actions.go index ba3e2b4ab..f770276d9 100644 --- a/pkg/probo/actions.go +++ b/pkg/probo/actions.go @@ -469,4 +469,12 @@ const ( // CookieConsentRecord actions ActionCookieConsentRecordList = "core:cookie-consent-record:list" + + // CommonThirdParty actions (global catalog, no organization scope). + ActionCommonThirdPartyGet = "core:common-third-party:get" + ActionCommonThirdPartyList = "core:common-third-party:list" + + // ElectronicSignature actions (tenant-scoped via the related document + // version signature / trust center access). + ActionElectronicSignatureGet = "core:electronic-signature:get" ) diff --git a/pkg/probo/policies.go b/pkg/probo/policies.go index 58627878f..7ef61738d 100644 --- a/pkg/probo/policies.go +++ b/pkg/probo/policies.go @@ -64,6 +64,7 @@ var ViewerPolicy = policy.NewPolicy( ActionDocumentVersionGet, ActionDocumentVersionList, ActionDocumentVersionSignatureGet, ActionDocumentVersionSignatureList, ActionDocumentVersionApprovalList, + ActionElectronicSignatureGet, ActionRiskGet, ActionRiskList, ActionAssetGet, ActionAssetList, ActionDatumGet, ActionDatumList, @@ -147,6 +148,7 @@ var AuditorPolicy = policy.NewPolicy( ActionDocumentVersionGet, ActionDocumentVersionList, ActionDocumentVersionSignatureGet, ActionDocumentVersionSignatureList, ActionDocumentVersionApprovalList, + ActionElectronicSignatureGet, ActionRiskGet, ActionRiskList, ActionAssetGet, ActionAssetList, ActionDatumGet, ActionDatumList, @@ -178,6 +180,19 @@ var AuditorPolicy = policy.NewPolicy( ).WithSID("employee-document-access").When(organizationCondition), ).WithDescription("Read-only probo access for auditors (excludes internal/employee content)") +// CommonThirdPartyCatalogPolicy grants every authenticated identity +// read access to the global common third-party catalog. The catalog is +// shared across all tenants and has no organization scoping, so the +// allow has no condition. +var CommonThirdPartyCatalogPolicy = policy.NewPolicy( + "probo:common-third-party-catalog", + "Probo Common Third-Party Catalog", + policy.Allow( + ActionCommonThirdPartyGet, + ActionCommonThirdPartyList, + ).WithSID("read-common-third-party-catalog"), +).WithDescription("Allows every authenticated user to read the global common third-party catalog") + // EmployeePolicy defines permissions for employee role. var EmployeePolicy = policy.NewPolicy( "probo:employee", @@ -210,5 +225,6 @@ func ProboPolicySet() *iam.PolicySet { AddRolePolicy("ADMIN", AdminPolicy). AddRolePolicy("VIEWER", ViewerPolicy). AddRolePolicy("AUDITOR", AuditorPolicy). - AddRolePolicy("EMPLOYEE", EmployeePolicy) + AddRolePolicy("EMPLOYEE", EmployeePolicy). + AddIdentityScopedPolicy(CommonThirdPartyCatalogPolicy) } diff --git a/pkg/server/api/console/v1/access_review_campaign_resolvers.go b/pkg/server/api/console/v1/access_review_campaign_resolvers.go index 16450f7c3..8416e4e85 100644 --- a/pkg/server/api/console/v1/access_review_campaign_resolvers.go +++ b/pkg/server/api/console/v1/access_review_campaign_resolvers.go @@ -10,12 +10,15 @@ import ( "errors" "fmt" + "github.com/vikstrous/dataloadgen" + "go.gearno.de/kit/log" "go.probo.inc/probo/pkg/accessreview" "go.probo.inc/probo/pkg/coredata" "go.probo.inc/probo/pkg/gid" "go.probo.inc/probo/pkg/page" "go.probo.inc/probo/pkg/probo" "go.probo.inc/probo/pkg/server/api/authn" + "go.probo.inc/probo/pkg/server/api/console/v1/dataloader" "go.probo.inc/probo/pkg/server/api/console/v1/schema" "go.probo.inc/probo/pkg/server/api/console/v1/types" "go.probo.inc/probo/pkg/server/gqlutils" @@ -86,7 +89,10 @@ func (r *accessEntryResolver) Permission(ctx context.Context, obj *types.AccessE // TotalCount is the resolver for the totalCount field. func (r *accessEntryConnectionResolver) TotalCount(ctx context.Context, obj *types.AccessEntryConnection) (int, error) { - scope := coredata.NewScopeFromObjectID(obj.ParentID) + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionAccessEntryList) + if err != nil { + return 0, err + } switch obj.Resolver.(type) { case *accessReviewCampaignResolver: @@ -110,82 +116,26 @@ func (r *accessEntryConnectionResolver) TotalCount(ctx context.Context, obj *typ panic(fmt.Errorf("unsupported resolver: %T", obj.Resolver)) } -// Organization is the resolver for the organization field. -func (r *accessReviewResolver) Organization(ctx context.Context, obj *types.AccessReview) (*types.Organization, error) { - return obj.Organization, nil -} - -// IdentitySource is the resolver for the identitySource field. -func (r *accessReviewResolver) IdentitySource(ctx context.Context, obj *types.AccessReview) (*types.AccessSource, error) { - return obj.IdentitySource, nil -} - -// AccessSources is the resolver for the accessSources field. -func (r *accessReviewResolver) AccessSources(ctx context.Context, obj *types.AccessReview, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AccessSourceOrder) (*types.AccessSourceConnection, error) { - scope, err := r.authorize(ctx, obj.Organization.ID, probo.ActionAccessSourceList) - if err != nil { - return nil, err - } - - pageOrderBy := page.OrderBy[coredata.AccessSourceOrderField]{ - Field: coredata.AccessSourceOrderFieldCreatedAt, - Direction: page.OrderDirectionDesc, - } - - if orderBy != nil { - pageOrderBy = page.OrderBy[coredata.AccessSourceOrderField]{ - Field: orderBy.Field, - Direction: orderBy.Direction, - } - } - - cursor := types.NewCursor(first, after, last, before, pageOrderBy) - - p, err := r.accessReview.Sources(scope).ListForOrganizationID(ctx, obj.Organization.ID, cursor) - if err != nil { - panic(fmt.Errorf("cannot list access sources: %w", err)) - } - - return types.NewAccessSourceConnection(p, r, obj.Organization.ID), nil -} - -// Campaigns is the resolver for the campaigns field. -func (r *accessReviewResolver) Campaigns(ctx context.Context, obj *types.AccessReview, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AccessReviewCampaignOrder) (*types.AccessReviewCampaignConnection, error) { - scope, err := r.authorize(ctx, obj.Organization.ID, probo.ActionAccessReviewCampaignList) - if err != nil { - return nil, err - } - - pageOrderBy := page.OrderBy[coredata.AccessReviewCampaignOrderField]{ - Field: coredata.AccessReviewCampaignOrderFieldCreatedAt, - Direction: page.OrderDirectionDesc, - } - - if orderBy != nil { - pageOrderBy = page.OrderBy[coredata.AccessReviewCampaignOrderField]{ - Field: orderBy.Field, - Direction: orderBy.Direction, - } - } - - cursor := types.NewCursor(first, after, last, before, pageOrderBy) - - p, err := r.accessReview.Campaigns(scope).ListForOrganizationID(ctx, obj.Organization.ID, cursor) - if err != nil { - panic(fmt.Errorf("cannot list access review campaigns: %w", err)) - } - - return types.NewAccessReviewCampaignConnection(p, r, obj.Organization.ID), nil -} - -// Permission is the resolver for the permission field. -func (r *accessReviewResolver) Permission(ctx context.Context, obj *types.AccessReview, action string) (bool, error) { - return r.Resolver.Permission(ctx, obj, action) -} - // Organization is the resolver for the organization field. func (r *accessReviewCampaignResolver) Organization(ctx context.Context, obj *types.AccessReviewCampaign) (*types.Organization, error) { - return obj.Organization, nil + if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { + return nil, err + } + + loaders := dataloader.FromContext(ctx) + + organization, err := loaders.Organization.Load(ctx, obj.Organization.ID) + if err != nil { + if errors.Is(err, coredata.ErrResourceNotFound) || errors.Is(err, dataloadgen.ErrNotFound) { + return nil, gqlutils.NotFound(ctx, err) + } + + r.logger.ErrorCtx(ctx, "cannot load organization", log.Error(err)) + + return nil, gqlutils.Internal(ctx) + } + + return types.NewOrganization(organization), nil } // ScopeSources is the resolver for the scopeSources field. @@ -293,7 +243,10 @@ func (r *accessReviewCampaignResolver) Permission(ctx context.Context, obj *type // TotalCount is the resolver for the totalCount field. func (r *accessReviewCampaignConnectionResolver) TotalCount(ctx context.Context, obj *types.AccessReviewCampaignConnection) (int, error) { - scope := coredata.NewScopeFromObjectID(obj.ParentID) + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionAccessReviewCampaignList) + if err != nil { + return 0, err + } switch obj.Resolver.(type) { case *organizationResolver: @@ -356,7 +309,24 @@ func (r *accessReviewCampaignScopeSourceResolver) Statistics(ctx context.Context // Organization is the resolver for the organization field. func (r *accessSourceResolver) Organization(ctx context.Context, obj *types.AccessSource) (*types.Organization, error) { - return obj.Organization, nil + if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { + return nil, err + } + + loaders := dataloader.FromContext(ctx) + + organization, err := loaders.Organization.Load(ctx, obj.Organization.ID) + if err != nil { + if errors.Is(err, coredata.ErrResourceNotFound) || errors.Is(err, dataloadgen.ErrNotFound) { + return nil, gqlutils.NotFound(ctx, err) + } + + r.logger.ErrorCtx(ctx, "cannot load organization", log.Error(err)) + + return nil, gqlutils.Internal(ctx) + } + + return types.NewOrganization(organization), nil } // Connector is the resolver for the connector field. @@ -365,7 +335,10 @@ func (r *accessSourceResolver) Connector(ctx context.Context, obj *types.AccessS return nil, nil } - scope := coredata.NewScopeFromObjectID(obj.ID) + scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceGet) + if err != nil { + return nil, err + } connector, err := r.probo.Connectors.Get(ctx, scope, *obj.ConnectorID) if err != nil { @@ -456,7 +429,10 @@ func (r *accessSourceResolver) ConnectionStatus(ctx context.Context, obj *types. return types.AccessSourceConnectionStatusNotApplicable, nil } - scope := coredata.NewScopeFromObjectID(obj.ID) + scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceGet) + if err != nil { + return types.AccessSourceConnectionStatusNotApplicable, err + } httpClient, dbConnector, err := r.accessReview.Sources(scope).ConnectorHTTPClient(ctx, *obj.ConnectorID) if err != nil { @@ -522,7 +498,10 @@ func (r *accessSourceResolver) Permission(ctx context.Context, obj *types.Access // TotalCount is the resolver for the totalCount field. func (r *accessSourceConnectionResolver) TotalCount(ctx context.Context, obj *types.AccessSourceConnection) (int, error) { - scope := coredata.NewScopeFromObjectID(obj.ParentID) + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionAccessSourceList) + if err != nil { + return 0, err + } switch obj.Resolver.(type) { case *organizationResolver: @@ -975,9 +954,6 @@ func (r *Resolver) AccessEntryConnection() schema.AccessEntryConnectionResolver return &accessEntryConnectionResolver{r} } -// AccessReview returns schema.AccessReviewResolver implementation. -func (r *Resolver) AccessReview() schema.AccessReviewResolver { return &accessReviewResolver{r} } - // AccessReviewCampaign returns schema.AccessReviewCampaignResolver implementation. func (r *Resolver) AccessReviewCampaign() schema.AccessReviewCampaignResolver { return &accessReviewCampaignResolver{r} @@ -1003,7 +979,6 @@ func (r *Resolver) AccessSourceConnection() schema.AccessSourceConnectionResolve type accessEntryResolver struct{ *Resolver } type accessEntryConnectionResolver struct{ *Resolver } -type accessReviewResolver struct{ *Resolver } type accessReviewCampaignResolver struct{ *Resolver } type accessReviewCampaignConnectionResolver struct{ *Resolver } type accessReviewCampaignScopeSourceResolver struct{ *Resolver } diff --git a/pkg/server/api/console/v1/audit_log_resolvers.go b/pkg/server/api/console/v1/audit_log_resolvers.go index 1b2fa2cc6..b67fc274f 100644 --- a/pkg/server/api/console/v1/audit_log_resolvers.go +++ b/pkg/server/api/console/v1/audit_log_resolvers.go @@ -7,9 +7,14 @@ package console_v1 import ( "context" + "errors" + "github.com/vikstrous/dataloadgen" "go.gearno.de/kit/log" "go.probo.inc/probo/pkg/coredata" + "go.probo.inc/probo/pkg/iam" + "go.probo.inc/probo/pkg/probo" + "go.probo.inc/probo/pkg/server/api/console/v1/dataloader" "go.probo.inc/probo/pkg/server/api/console/v1/schema" "go.probo.inc/probo/pkg/server/api/console/v1/types" "go.probo.inc/probo/pkg/server/gqlutils" @@ -17,7 +22,24 @@ import ( // Organization is the resolver for the organization field. func (r *auditLogEntryResolver) Organization(ctx context.Context, obj *types.AuditLogEntry) (*types.Organization, error) { - return obj.Organization, nil + if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { + return nil, err + } + + loaders := dataloader.FromContext(ctx) + + organization, err := loaders.Organization.Load(ctx, obj.Organization.ID) + if err != nil { + if errors.Is(err, coredata.ErrResourceNotFound) || errors.Is(err, dataloadgen.ErrNotFound) { + return nil, gqlutils.NotFound(ctx, err) + } + + r.logger.ErrorCtx(ctx, "cannot load organization", log.Error(err)) + + return nil, gqlutils.Internal(ctx) + } + + return types.NewOrganization(organization), nil } // Permission is the resolver for the permission field. @@ -27,6 +49,10 @@ func (r *auditLogEntryResolver) Permission(ctx context.Context, obj *types.Audit // TotalCount is the resolver for the totalCount field. func (r *auditLogEntryConnectionResolver) TotalCount(ctx context.Context, obj *types.AuditLogEntryConnection) (int, error) { + if _, err := r.authorize(ctx, obj.ParentID, iam.ActionAuditLogEntryList); err != nil { + return 0, err + } + filter := coredata.NewAuditLogEntryFilter() if obj.Filter != nil { filter = obj.Filter diff --git a/pkg/server/api/console/v1/base_resolvers.go b/pkg/server/api/console/v1/base_resolvers.go index 756186619..1e94ce399 100644 --- a/pkg/server/api/console/v1/base_resolvers.go +++ b/pkg/server/api/console/v1/base_resolvers.go @@ -441,9 +441,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.TrackerPatternEntityType: action = probo.ActionTrackerPatternGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { - scope := coredata.NewScopeFromObjectID(id) - + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { pattern, err := r.cookieBanner.GetTrackerPattern(ctx, scope, id) if err != nil { return nil, err @@ -510,6 +508,12 @@ func (r *queryResolver) Viewer(ctx context.Context) (*types.Viewer, error) { // CommonThirdParties is the resolver for the commonThirdParties field. func (r *queryResolver) CommonThirdParties(ctx context.Context, name string) ([]*types.CommonThirdParty, error) { + identity := authn.IdentityFromContext(ctx) + + if _, err := r.authorize(ctx, identity.ID, probo.ActionCommonThirdPartyList); err != nil { + return nil, err + } + parties, err := r.thirdParty.Search(ctx, name) if err != nil { r.logger.ErrorCtx(ctx, "cannot search common third parties", log.Error(err)) diff --git a/pkg/server/api/console/v1/common_third_party_resolvers.go b/pkg/server/api/console/v1/common_third_party_resolvers.go index 5da1efa4e..89c46a363 100644 --- a/pkg/server/api/console/v1/common_third_party_resolvers.go +++ b/pkg/server/api/console/v1/common_third_party_resolvers.go @@ -10,6 +10,7 @@ import ( "time" "go.gearno.de/kit/log" + "go.probo.inc/probo/pkg/probo" "go.probo.inc/probo/pkg/server/api/console/v1/schema" "go.probo.inc/probo/pkg/server/api/console/v1/types" "go.probo.inc/probo/pkg/server/gqlutils" @@ -17,6 +18,10 @@ import ( // LogoURL is the resolver for the logoUrl field. func (r *commonThirdPartyResolver) LogoURL(ctx context.Context, obj *types.CommonThirdParty) (*string, error) { + if _, err := r.authorize(ctx, obj.ID, probo.ActionCommonThirdPartyGet); err != nil { + return nil, err + } + if obj.LogoFileID == nil { return nil, nil } diff --git a/pkg/server/api/console/v1/control_resolvers.go b/pkg/server/api/console/v1/control_resolvers.go index b0581a072..e9adb6996 100644 --- a/pkg/server/api/console/v1/control_resolvers.go +++ b/pkg/server/api/console/v1/control_resolvers.go @@ -112,7 +112,10 @@ func (r *controlResolver) Organization(ctx context.Context, obj *types.Control) // Regulatory is the resolver for the regulatory field. func (r *controlResolver) Regulatory(ctx context.Context, obj *types.Control) (bool, error) { - scope := coredata.NewScopeFromObjectID(obj.ID) + scope, err := r.authorize(ctx, obj.ID, probo.ActionControlGet) + if err != nil { + return false, err + } hasRegulatory, err := r.probo.Controls.HasRegulatoryObligation(ctx, scope, obj.ID) if err != nil { @@ -125,7 +128,10 @@ func (r *controlResolver) Regulatory(ctx context.Context, obj *types.Control) (b // Contractual is the resolver for the contractual field. func (r *controlResolver) Contractual(ctx context.Context, obj *types.Control) (bool, error) { - scope := coredata.NewScopeFromObjectID(obj.ID) + scope, err := r.authorize(ctx, obj.ID, probo.ActionControlGet) + if err != nil { + return false, err + } hasContractual, err := r.probo.Controls.HasContractualObligation(ctx, scope, obj.ID) if err != nil { @@ -138,7 +144,10 @@ func (r *controlResolver) Contractual(ctx context.Context, obj *types.Control) ( // RiskAssessment is the resolver for the riskAssessment field. func (r *controlResolver) RiskAssessment(ctx context.Context, obj *types.Control) (bool, error) { - scope := coredata.NewScopeFromObjectID(obj.ID) + scope, err := r.authorize(ctx, obj.ID, probo.ActionControlGet) + if err != nil { + return false, err + } hasRisk, err := r.probo.Controls.HasRiskAssessment(ctx, scope, obj.ID) if err != nil { @@ -875,7 +884,11 @@ func (r *statementOfApplicabilityResolver) Permission(ctx context.Context, obj * // TotalCount is the resolver for the totalCount field. func (r *statementOfApplicabilityConnectionResolver) TotalCount(ctx context.Context, obj *types.StatementOfApplicabilityConnection) (int, error) { - scope := coredata.NewScopeFromObjectID(obj.ParentID) + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionStatementOfApplicabilityList) + if err != nil { + return 0, err + } + switch obj.Resolver.(type) { case *organizationResolver: count, err := r.probo.StatementsOfApplicability.CountForOrganizationID(ctx, scope, obj.ParentID) diff --git a/pkg/server/api/console/v1/cookie_banner_resolvers.go b/pkg/server/api/console/v1/cookie_banner_resolvers.go index c54945905..d7cc59614 100644 --- a/pkg/server/api/console/v1/cookie_banner_resolvers.go +++ b/pkg/server/api/console/v1/cookie_banner_resolvers.go @@ -432,7 +432,10 @@ func (r *cookieCategoryConnectionResolver) TotalCount(ctx context.Context, obj * // TotalCount is the resolver for the totalCount field. func (r *detectedTrackerConnectionResolver) TotalCount(ctx context.Context, obj *types.DetectedTrackerConnection) (int, error) { - scope := coredata.NewScopeFromObjectID(obj.ParentID) + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionTrackerPatternGet) + if err != nil { + return 0, err + } count, err := r.cookieBanner.CountDetectedTrackersByPatternID(ctx, scope, obj.ParentID) if err != nil { @@ -1256,7 +1259,10 @@ func (r *trackerPatternResolver) CookieCategory(ctx context.Context, obj *types. // DetectedCount is the resolver for the detectedCount field. func (r *trackerPatternResolver) DetectedCount(ctx context.Context, obj *types.TrackerPattern) (int, error) { - scope := coredata.NewScopeFromObjectID(obj.ID) + scope, err := r.authorize(ctx, obj.ID, probo.ActionTrackerPatternGet) + if err != nil { + return 0, err + } count, err := r.cookieBanner.CountDetectedTrackersByPatternID(ctx, scope, obj.ID) if err != nil { @@ -1269,7 +1275,8 @@ func (r *trackerPatternResolver) DetectedCount(ctx context.Context, obj *types.T // DetectedTrackers is the resolver for the detectedTrackers field. func (r *trackerPatternResolver) DetectedTrackers(ctx context.Context, obj *types.TrackerPattern, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DetectedTrackerOrderBy) (*types.DetectedTrackerConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionTrackerPatternGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionTrackerPatternGet) + if err != nil { return nil, err } @@ -1285,7 +1292,6 @@ func (r *trackerPatternResolver) DetectedTrackers(ctx context.Context, obj *type } cursor := types.NewCursor(first, after, last, before, pageOrderBy) - scope := coredata.NewScopeFromObjectID(obj.ID) trackers, err := r.cookieBanner.ListDetectedTrackersForPattern(ctx, scope, obj.ID, cursor) if err != nil { @@ -1305,12 +1311,12 @@ func (r *trackerPatternResolver) Permission(ctx context.Context, obj *types.Trac // TotalCount is the resolver for the totalCount field. func (r *trackerPatternConnectionResolver) TotalCount(ctx context.Context, obj *types.TrackerPatternConnection) (int, error) { - scope := coredata.NewScopeFromObjectID(obj.ParentID) + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionTrackerPatternList) + if err != nil { + return 0, err + } - var ( - count int - err error - ) + var count int switch obj.Resolver.(type) { case *cookieCategoryResolver: @@ -1362,12 +1368,12 @@ func (r *trackerResourceResolver) Permission(ctx context.Context, obj *types.Tra // TotalCount is the resolver for the totalCount field. func (r *trackerResourceConnectionResolver) TotalCount(ctx context.Context, obj *types.TrackerResourceConnection) (int, error) { - scope := coredata.NewScopeFromObjectID(obj.ParentID) + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionTrackerResourceList) + if err != nil { + return 0, err + } - var ( - count int - err error - ) + var count int switch obj.Resolver.(type) { case *cookieCategoryResolver: diff --git a/pkg/server/api/console/v1/electronic_signature_resolvers.go b/pkg/server/api/console/v1/electronic_signature_resolvers.go index 408807e1d..21efc3b5b 100644 --- a/pkg/server/api/console/v1/electronic_signature_resolvers.go +++ b/pkg/server/api/console/v1/electronic_signature_resolvers.go @@ -10,12 +10,17 @@ import ( "fmt" "time" + "go.probo.inc/probo/pkg/probo" "go.probo.inc/probo/pkg/server/api/console/v1/schema" "go.probo.inc/probo/pkg/server/api/console/v1/types" ) // CertificateFileURL is the resolver for the certificateFileUrl field. func (r *electronicSignatureResolver) CertificateFileURL(ctx context.Context, obj *types.ElectronicSignature) (*string, error) { + if _, err := r.authorize(ctx, obj.ID, probo.ActionElectronicSignatureGet); err != nil { + return nil, err + } + signature, err := r.esign.GetSignatureByID(ctx, obj.ID) if err != nil { return nil, fmt.Errorf("cannot load signature: %w", err) @@ -35,6 +40,10 @@ func (r *electronicSignatureResolver) CertificateFileURL(ctx context.Context, ob // Events is the resolver for the events field. func (r *electronicSignatureResolver) Events(ctx context.Context, obj *types.ElectronicSignature) ([]*types.ElectronicSignatureEvent, error) { + if _, err := r.authorize(ctx, obj.ID, probo.ActionElectronicSignatureGet); err != nil { + return nil, err + } + events, err := r.esign.GetEventsBySignatureID(ctx, obj.ID) if err != nil { return nil, fmt.Errorf("cannot load signature events: %w", err) diff --git a/pkg/server/api/console/v1/graphql/access_review_campaign.graphql b/pkg/server/api/console/v1/graphql/access_review_campaign.graphql index 3229f89b1..9ddab09be 100644 --- a/pkg/server/api/console/v1/graphql/access_review_campaign.graphql +++ b/pkg/server/api/console/v1/graphql/access_review_campaign.graphql @@ -284,32 +284,6 @@ input AccessEntryFilter accountType: AccessEntryAccountType } -type AccessReview implements Node { - id: ID! - organization: Organization! @goField(forceResolver: true) - identitySource: AccessSource @goField(forceResolver: true) - createdAt: Datetime! - updatedAt: Datetime! - - accessSources( - first: Int - after: CursorKey - last: Int - before: CursorKey - orderBy: AccessSourceOrder - ): AccessSourceConnection! @goField(forceResolver: true) - - campaigns( - first: Int - after: CursorKey - last: Int - before: CursorKey - orderBy: AccessReviewCampaignOrder - ): AccessReviewCampaignConnection! @goField(forceResolver: true) - - permission(action: String!): Boolean! @goField(forceResolver: true) -} - type ProviderOrganization { slug: String! displayName: String! diff --git a/pkg/server/api/console/v1/graphql/organization.graphql b/pkg/server/api/console/v1/graphql/organization.graphql index c32df773b..8706ea258 100644 --- a/pkg/server/api/console/v1/graphql/organization.graphql +++ b/pkg/server/api/console/v1/graphql/organization.graphql @@ -227,14 +227,6 @@ type Organization implements Node { filter: DocumentFilter ): DocumentConnection! @goField(forceResolver: true) - evidences( - first: Int - after: CursorKey - last: Int - before: CursorKey - orderBy: EvidenceOrder - ): EvidenceConnection! @goField(forceResolver: true) - frameworks( first: Int after: CursorKey diff --git a/pkg/server/api/console/v1/organization_resolvers.go b/pkg/server/api/console/v1/organization_resolvers.go index f13c79dae..c2ed3c229 100644 --- a/pkg/server/api/console/v1/organization_resolvers.go +++ b/pkg/server/api/console/v1/organization_resolvers.go @@ -797,11 +797,6 @@ func (r *organizationResolver) Documents(ctx context.Context, obj *types.Organiz return types.NewDocumentConnection(page, r, obj.ID, documentFilter), nil } -// Evidences is the resolver for the evidences field. -func (r *organizationResolver) Evidences(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.EvidenceOrderBy) (*types.EvidenceConnection, error) { - panic(fmt.Errorf("not implemented: Evidences - evidences")) -} - // Frameworks is the resolver for the frameworks field. func (r *organizationResolver) Frameworks(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.FrameworkOrderBy) (*types.FrameworkConnection, error) { scope, err := r.authorize(ctx, obj.ID, probo.ActionFrameworkList)