rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enforce IAM authorization on every console resolver

Browse Source 
Audited pkg/server/api/console/v1 for resolvers that touched tenant
data without calling r.authorize, batchAuthorize, or Permission. Closed
every gap so every data-bearing field goes through IAM (and produces an
audit log entry when an organization_id is present).

* High-severity reads now authorize: accessSourceResolver.Connector and
  ConnectionStatus, controlResolver.Regulatory/Contractual/RiskAssessment,
  electronicSignatureResolver.CertificateFileURL/Events,
  commonThirdPartyResolver.LogoURL, and the proper
  accessSourceResolver/accessReviewCampaignResolver/auditLogEntryResolver
  Organization resolvers (authorize + dataloader load, fixing the latent
  empty-name bug from the previous force-resolver no-op implementations).
* TotalCount/DetectedCount aggregates now authorize the matching list
  action across access review, audit log, statement of applicability,
  detected tracker, tracker pattern, and tracker resource connections.
* queryResolver.CommonThirdParties authorizes against the principal's
  identity via the new identity-scoped CommonThirdPartyCatalogPolicy.
* Add ActionCommonThirdPartyGet/List, ActionElectronicSignatureGet probo
  action constants; wire ActionElectronicSignatureGet into ViewerPolicy
  and AuditorPolicy.
* Implement AuthorizationAttributes on CommonThirdParty (no org) and
  ElectronicSignature (organization_id) so the authorizer can resolve
  attributes for the new actions.
* Delete the dead "type AccessReview" GraphQL type (no Go constructor,
  no frontend reference) and drop its orphan resolver bundle.

Signed-off-by: Bryan Frimin <bryan@probo.com>
This commit is contained in:
Bryan Frimin
2026-05-23 13:28:13 -07:00
parent de325af4d9
commit 392f81bd74
14 changed files with 219 additions and 146 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
pkg/coredata/common_third_party.go
View File

@@ -24,6 +24,7 @@ import (
"github.com/jackc/pgx/v5"
"go.gearno.de/kit/pg"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/iam/policy"
)
type (
@@ -54,6 +55,18 @@ type (
CommonThirdParties []*CommonThirdParty
)
// AuthorizationAttributes is a no-op resource-attribute loader: the
// common third-party catalog is global (shared across every tenant) and
// has no organization_id. Authorization for these rows is granted by an
// identity-scoped policy that has no condition.
func (t *CommonThirdParty) AuthorizationAttributes(
ctx context.Context,
conn pg.Querier,
resourceIDs []gid.GID,
) (policy.AttributesByID, error) {
return map[gid.GID]policy.Attributes{}, nil
}
func (t *CommonThirdParty) LoadByID(
ctx context.Context,
conn pg.Querier,