rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enforce IAM authorization on every console resolver

Browse Source 
Audited pkg/server/api/console/v1 for resolvers that touched tenant
data without calling r.authorize, batchAuthorize, or Permission. Closed
every gap so every data-bearing field goes through IAM (and produces an
audit log entry when an organization_id is present).

* High-severity reads now authorize: accessSourceResolver.Connector and
  ConnectionStatus, controlResolver.Regulatory/Contractual/RiskAssessment,
  electronicSignatureResolver.CertificateFileURL/Events,
  commonThirdPartyResolver.LogoURL, and the proper
  accessSourceResolver/accessReviewCampaignResolver/auditLogEntryResolver
  Organization resolvers (authorize + dataloader load, fixing the latent
  empty-name bug from the previous force-resolver no-op implementations).
* TotalCount/DetectedCount aggregates now authorize the matching list
  action across access review, audit log, statement of applicability,
  detected tracker, tracker pattern, and tracker resource connections.
* queryResolver.CommonThirdParties authorizes against the principal's
  identity via the new identity-scoped CommonThirdPartyCatalogPolicy.
* Add ActionCommonThirdPartyGet/List, ActionElectronicSignatureGet probo
  action constants; wire ActionElectronicSignatureGet into ViewerPolicy
  and AuditorPolicy.
* Implement AuthorizationAttributes on CommonThirdParty (no org) and
  ElectronicSignature (organization_id) so the authorizer can resolve
  attributes for the new actions.
* Delete the dead "type AccessReview" GraphQL type (no Go constructor,
  no frontend reference) and drop its orphan resolver bundle.

Signed-off-by: Bryan Frimin <bryan@probo.com>
This commit is contained in:
Bryan Frimin
2026-05-23 13:28:13 -07:00
parent de325af4d9
commit 392f81bd74
14 changed files with 219 additions and 146 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
pkg/server/api/console/v1/cookie_banner_resolvers.go
View File

@@ -432,7 +432,10 @@ func (r *cookieCategoryConnectionResolver) TotalCount(ctx context.Context, obj *
// TotalCount is the resolver for the totalCount field.
func (r *detectedTrackerConnectionResolver) TotalCount(ctx context.Context, obj *types.DetectedTrackerConnection) (int, error) {
scope := coredata.NewScopeFromObjectID(obj.ParentID)
scope, err := r.authorize(ctx, obj.ParentID, probo.ActionTrackerPatternGet)
if err != nil {
return 0, err
}
count, err := r.cookieBanner.CountDetectedTrackersByPatternID(ctx, scope, obj.ParentID)
if err != nil {
@@ -1256,7 +1259,10 @@ func (r *trackerPatternResolver) CookieCategory(ctx context.Context, obj *types.
// DetectedCount is the resolver for the detectedCount field.
func (r *trackerPatternResolver) DetectedCount(ctx context.Context, obj *types.TrackerPattern) (int, error) {
scope := coredata.NewScopeFromObjectID(obj.ID)
scope, err := r.authorize(ctx, obj.ID, probo.ActionTrackerPatternGet)
if err != nil {
return 0, err
}
count, err := r.cookieBanner.CountDetectedTrackersByPatternID(ctx, scope, obj.ID)
if err != nil {
@@ -1269,7 +1275,8 @@ func (r *trackerPatternResolver) DetectedCount(ctx context.Context, obj *types.T
// DetectedTrackers is the resolver for the detectedTrackers field.
func (r *trackerPatternResolver) DetectedTrackers(ctx context.Context, obj *types.TrackerPattern, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DetectedTrackerOrderBy) (*types.DetectedTrackerConnection, error) {
if err := r.authorize(ctx, obj.ID, probo.ActionTrackerPatternGet); err != nil {
scope, err := r.authorize(ctx, obj.ID, probo.ActionTrackerPatternGet)
if err != nil {
return nil, err
}
@@ -1285,7 +1292,6 @@ func (r *trackerPatternResolver) DetectedTrackers(ctx context.Context, obj *type
}
cursor := types.NewCursor(first, after, last, before, pageOrderBy)
scope := coredata.NewScopeFromObjectID(obj.ID)
trackers, err := r.cookieBanner.ListDetectedTrackersForPattern(ctx, scope, obj.ID, cursor)
if err != nil {
@@ -1305,12 +1311,12 @@ func (r *trackerPatternResolver) Permission(ctx context.Context, obj *types.Trac
// TotalCount is the resolver for the totalCount field.
func (r *trackerPatternConnectionResolver) TotalCount(ctx context.Context, obj *types.TrackerPatternConnection) (int, error) {
scope := coredata.NewScopeFromObjectID(obj.ParentID)
scope, err := r.authorize(ctx, obj.ParentID, probo.ActionTrackerPatternList)
if err != nil {
return 0, err
}
var (
count int
err error
)
var count int
switch obj.Resolver.(type) {
case *cookieCategoryResolver:
@@ -1362,12 +1368,12 @@ func (r *trackerResourceResolver) Permission(ctx context.Context, obj *types.Tra
// TotalCount is the resolver for the totalCount field.
func (r *trackerResourceConnectionResolver) TotalCount(ctx context.Context, obj *types.TrackerResourceConnection) (int, error) {
scope := coredata.NewScopeFromObjectID(obj.ParentID)
scope, err := r.authorize(ctx, obj.ParentID, probo.ActionTrackerResourceList)
if err != nil {
return 0, err
}
var (
count int
err error
)
var count int
switch obj.Resolver.(type) {
case *cookieCategoryResolver: