Enforce IAM authorization on every console resolver

Audited pkg/server/api/console/v1 for resolvers that touched tenant
data without calling r.authorize, batchAuthorize, or Permission. Closed
every gap so every data-bearing field goes through IAM (and produces an
audit log entry when an organization_id is present).

* High-severity reads now authorize: accessSourceResolver.Connector and
  ConnectionStatus, controlResolver.Regulatory/Contractual/RiskAssessment,
  electronicSignatureResolver.CertificateFileURL/Events,
  commonThirdPartyResolver.LogoURL, and the proper
  accessSourceResolver/accessReviewCampaignResolver/auditLogEntryResolver
  Organization resolvers (authorize + dataloader load, fixing the latent
  empty-name bug from the previous force-resolver no-op implementations).
* TotalCount/DetectedCount aggregates now authorize the matching list
  action across access review, audit log, statement of applicability,
  detected tracker, tracker pattern, and tracker resource connections.
* queryResolver.CommonThirdParties authorizes against the principal's
  identity via the new identity-scoped CommonThirdPartyCatalogPolicy.
* Add ActionCommonThirdPartyGet/List, ActionElectronicSignatureGet probo
  action constants; wire ActionElectronicSignatureGet into ViewerPolicy
  and AuditorPolicy.
* Implement AuthorizationAttributes on CommonThirdParty (no org) and
  ElectronicSignature (organization_id) so the authorizer can resolve
  attributes for the new actions.
* Delete the dead "type AccessReview" GraphQL type (no Go constructor,
  no frontend reference) and drop its orphan resolver bundle.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/coredata/common_third_party.go

@@ -24,6 +24,7 @@ import (
 	"github.com/jackc/pgx/v5"
 	"go.gearno.de/kit/pg"
 	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/iam/policy"
 )
 
 type (
@@ -54,6 +55,18 @@ type (
 	CommonThirdParties []*CommonThirdParty
 )
 
+// AuthorizationAttributes is a no-op resource-attribute loader: the
+// common third-party catalog is global (shared across every tenant) and
+// has no organization_id. Authorization for these rows is granted by an
+// identity-scoped policy that has no condition.
+func (t *CommonThirdParty) AuthorizationAttributes(
+	ctx context.Context,
+	conn pg.Querier,
+	resourceIDs []gid.GID,
+) (policy.AttributesByID, error) {
+	return map[gid.GID]policy.Attributes{}, nil
+}
+
 func (t *CommonThirdParty) LoadByID(
 	ctx context.Context,
 	conn pg.Querier,

pkg/coredata/electronic_signature.go

@@ -27,6 +27,7 @@ import (
 	"go.gearno.de/x/ref"
 	"go.probo.inc/probo/pkg/crypto/hash"
 	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/iam/policy"
 )
 
 type ElectronicSignature struct {
@@ -59,6 +60,42 @@ type ElectronicSignature struct {
 	UpdatedAt                      time.Time                       `db:"updated_at"`
 }
 
+func (es *ElectronicSignature) AuthorizationAttributes(
+	ctx context.Context,
+	conn pg.Querier,
+	resourceIDs []gid.GID,
+) (policy.AttributesByID, error) {
+	q := `SELECT id, organization_id FROM electronic_signatures WHERE id = ANY(@resource_ids::text[])`
+
+	args := pgx.StrictNamedArgs{
+		"resource_ids": resourceIDs,
+	}
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return nil, fmt.Errorf("cannot query electronic signature authorization attributes: %w", err)
+	}
+	defer rows.Close()
+
+	attrsByID := make(policy.AttributesByID)
+	for rows.Next() {
+		var id, organizationID gid.GID
+		if err := rows.Scan(&id, &organizationID); err != nil {
+			return nil, fmt.Errorf("cannot scan electronic signature authorization attributes: %w", err)
+		}
+
+		attrsByID[id] = policy.Attributes{
+			"organization_id": organizationID.String(),
+		}
+	}
+
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("cannot iterate electronic signature authorization attributes: %w", err)
+	}
+
+	return attrsByID, nil
+}
+
 func (es *ElectronicSignature) NewEvent(
 	eventType ElectronicSignatureEventType,
 	eventSource ElectronicSignatureEventSource,

pkg/probo/actions.go

@@ -469,4 +469,12 @@ const (
 
 	// CookieConsentRecord actions
 	ActionCookieConsentRecordList = "core:cookie-consent-record:list"
+
+	// CommonThirdParty actions (global catalog, no organization scope).
+	ActionCommonThirdPartyGet  = "core:common-third-party:get"
+	ActionCommonThirdPartyList = "core:common-third-party:list"
+
+	// ElectronicSignature actions (tenant-scoped via the related document
+	// version signature / trust center access).
+	ActionElectronicSignatureGet = "core:electronic-signature:get"
 )

pkg/probo/policies.go

@@ -64,6 +64,7 @@ var ViewerPolicy = policy.NewPolicy(
 		ActionDocumentVersionGet, ActionDocumentVersionList,
 		ActionDocumentVersionSignatureGet, ActionDocumentVersionSignatureList,
 		ActionDocumentVersionApprovalList,
+		ActionElectronicSignatureGet,
 		ActionRiskGet, ActionRiskList,
 		ActionAssetGet, ActionAssetList,
 		ActionDatumGet, ActionDatumList,
@@ -147,6 +148,7 @@ var AuditorPolicy = policy.NewPolicy(
 		ActionDocumentVersionGet, ActionDocumentVersionList,
 		ActionDocumentVersionSignatureGet, ActionDocumentVersionSignatureList,
 		ActionDocumentVersionApprovalList,
+		ActionElectronicSignatureGet,
 		ActionRiskGet, ActionRiskList,
 		ActionAssetGet, ActionAssetList,
 		ActionDatumGet, ActionDatumList,
@@ -178,6 +180,19 @@ var AuditorPolicy = policy.NewPolicy(
 	).WithSID("employee-document-access").When(organizationCondition),
 ).WithDescription("Read-only probo access for auditors (excludes internal/employee content)")
 
+// CommonThirdPartyCatalogPolicy grants every authenticated identity
+// read access to the global common third-party catalog. The catalog is
+// shared across all tenants and has no organization scoping, so the
+// allow has no condition.
+var CommonThirdPartyCatalogPolicy = policy.NewPolicy(
+	"probo:common-third-party-catalog",
+	"Probo Common Third-Party Catalog",
+	policy.Allow(
+		ActionCommonThirdPartyGet,
+		ActionCommonThirdPartyList,
+	).WithSID("read-common-third-party-catalog"),
+).WithDescription("Allows every authenticated user to read the global common third-party catalog")
+
 // EmployeePolicy defines permissions for employee role.
 var EmployeePolicy = policy.NewPolicy(
 	"probo:employee",
@@ -210,5 +225,6 @@ func ProboPolicySet() *iam.PolicySet {
 		AddRolePolicy("ADMIN", AdminPolicy).
 		AddRolePolicy("VIEWER", ViewerPolicy).
 		AddRolePolicy("AUDITOR", AuditorPolicy).
-		AddRolePolicy("EMPLOYEE", EmployeePolicy)
+		AddRolePolicy("EMPLOYEE", EmployeePolicy).
+		AddIdentityScopedPolicy(CommonThirdPartyCatalogPolicy)
 }

pkg/server/api/console/v1/access_review_campaign_resolvers.go

@@ -10,12 +10,15 @@ import (
 	"errors"
 	"fmt"
 
+	"github.com/vikstrous/dataloadgen"
+	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/accessreview"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/gid"
 	"go.probo.inc/probo/pkg/page"
 	"go.probo.inc/probo/pkg/probo"
 	"go.probo.inc/probo/pkg/server/api/authn"
+	"go.probo.inc/probo/pkg/server/api/console/v1/dataloader"
 	"go.probo.inc/probo/pkg/server/api/console/v1/schema"
 	"go.probo.inc/probo/pkg/server/api/console/v1/types"
 	"go.probo.inc/probo/pkg/server/gqlutils"
@@ -86,7 +89,10 @@ func (r *accessEntryResolver) Permission(ctx context.Context, obj *types.AccessE
 
 // TotalCount is the resolver for the totalCount field.
 func (r *accessEntryConnectionResolver) TotalCount(ctx context.Context, obj *types.AccessEntryConnection) (int, error) {
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionAccessEntryList)
+	if err != nil {
+		return 0, err
+	}
 
 	switch obj.Resolver.(type) {
 	case *accessReviewCampaignResolver:
@@ -110,82 +116,26 @@ func (r *accessEntryConnectionResolver) TotalCount(ctx context.Context, obj *typ
 	panic(fmt.Errorf("unsupported resolver: %T", obj.Resolver))
 }
 
-// Organization is the resolver for the organization field.
-func (r *accessReviewResolver) Organization(ctx context.Context, obj *types.AccessReview) (*types.Organization, error) {
-	return obj.Organization, nil
-}
-
-// IdentitySource is the resolver for the identitySource field.
-func (r *accessReviewResolver) IdentitySource(ctx context.Context, obj *types.AccessReview) (*types.AccessSource, error) {
-	return obj.IdentitySource, nil
-}
-
-// AccessSources is the resolver for the accessSources field.
-func (r *accessReviewResolver) AccessSources(ctx context.Context, obj *types.AccessReview, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AccessSourceOrder) (*types.AccessSourceConnection, error) {
-	scope, err := r.authorize(ctx, obj.Organization.ID, probo.ActionAccessSourceList)
-	if err != nil {
-		return nil, err
-	}
-
-	pageOrderBy := page.OrderBy[coredata.AccessSourceOrderField]{
-		Field:     coredata.AccessSourceOrderFieldCreatedAt,
-		Direction: page.OrderDirectionDesc,
-	}
-
-	if orderBy != nil {
-		pageOrderBy = page.OrderBy[coredata.AccessSourceOrderField]{
-			Field:     orderBy.Field,
-			Direction: orderBy.Direction,
-		}
-	}
-
-	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
-
-	p, err := r.accessReview.Sources(scope).ListForOrganizationID(ctx, obj.Organization.ID, cursor)
-	if err != nil {
-		panic(fmt.Errorf("cannot list access sources: %w", err))
-	}
-
-	return types.NewAccessSourceConnection(p, r, obj.Organization.ID), nil
-}
-
-// Campaigns is the resolver for the campaigns field.
-func (r *accessReviewResolver) Campaigns(ctx context.Context, obj *types.AccessReview, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AccessReviewCampaignOrder) (*types.AccessReviewCampaignConnection, error) {
-	scope, err := r.authorize(ctx, obj.Organization.ID, probo.ActionAccessReviewCampaignList)
-	if err != nil {
-		return nil, err
-	}
-
-	pageOrderBy := page.OrderBy[coredata.AccessReviewCampaignOrderField]{
-		Field:     coredata.AccessReviewCampaignOrderFieldCreatedAt,
-		Direction: page.OrderDirectionDesc,
-	}
-
-	if orderBy != nil {
-		pageOrderBy = page.OrderBy[coredata.AccessReviewCampaignOrderField]{
-			Field:     orderBy.Field,
-			Direction: orderBy.Direction,
-		}
-	}
-
-	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
-
-	p, err := r.accessReview.Campaigns(scope).ListForOrganizationID(ctx, obj.Organization.ID, cursor)
-	if err != nil {
-		panic(fmt.Errorf("cannot list access review campaigns: %w", err))
-	}
-
-	return types.NewAccessReviewCampaignConnection(p, r, obj.Organization.ID), nil
-}
-
-// Permission is the resolver for the permission field.
-func (r *accessReviewResolver) Permission(ctx context.Context, obj *types.AccessReview, action string) (bool, error) {
-	return r.Resolver.Permission(ctx, obj, action)
-}
-
 // Organization is the resolver for the organization field.
 func (r *accessReviewCampaignResolver) Organization(ctx context.Context, obj *types.AccessReviewCampaign) (*types.Organization, error) {
-	return obj.Organization, nil
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
+		return nil, err
+	}
+
+	loaders := dataloader.FromContext(ctx)
+
+	organization, err := loaders.Organization.Load(ctx, obj.Organization.ID)
+	if err != nil {
+		if errors.Is(err, coredata.ErrResourceNotFound) || errors.Is(err, dataloadgen.ErrNotFound) {
+			return nil, gqlutils.NotFound(ctx, err)
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot load organization", log.Error(err))
+
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewOrganization(organization), nil
 }
 
 // ScopeSources is the resolver for the scopeSources field.
@@ -293,7 +243,10 @@ func (r *accessReviewCampaignResolver) Permission(ctx context.Context, obj *type
 
 // TotalCount is the resolver for the totalCount field.
 func (r *accessReviewCampaignConnectionResolver) TotalCount(ctx context.Context, obj *types.AccessReviewCampaignConnection) (int, error) {
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionAccessReviewCampaignList)
+	if err != nil {
+		return 0, err
+	}
 
 	switch obj.Resolver.(type) {
 	case *organizationResolver:
@@ -356,7 +309,24 @@ func (r *accessReviewCampaignScopeSourceResolver) Statistics(ctx context.Context
 
 // Organization is the resolver for the organization field.
 func (r *accessSourceResolver) Organization(ctx context.Context, obj *types.AccessSource) (*types.Organization, error) {
-	return obj.Organization, nil
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
+		return nil, err
+	}
+
+	loaders := dataloader.FromContext(ctx)
+
+	organization, err := loaders.Organization.Load(ctx, obj.Organization.ID)
+	if err != nil {
+		if errors.Is(err, coredata.ErrResourceNotFound) || errors.Is(err, dataloadgen.ErrNotFound) {
+			return nil, gqlutils.NotFound(ctx, err)
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot load organization", log.Error(err))
+
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewOrganization(organization), nil
 }
 
 // Connector is the resolver for the connector field.
@@ -365,7 +335,10 @@ func (r *accessSourceResolver) Connector(ctx context.Context, obj *types.AccessS
 		return nil, nil
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceGet)
+	if err != nil {
+		return nil, err
+	}
 
 	connector, err := r.probo.Connectors.Get(ctx, scope, *obj.ConnectorID)
 	if err != nil {
@@ -456,7 +429,10 @@ func (r *accessSourceResolver) ConnectionStatus(ctx context.Context, obj *types.
 		return types.AccessSourceConnectionStatusNotApplicable, nil
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceGet)
+	if err != nil {
+		return types.AccessSourceConnectionStatusNotApplicable, err
+	}
 
 	httpClient, dbConnector, err := r.accessReview.Sources(scope).ConnectorHTTPClient(ctx, *obj.ConnectorID)
 	if err != nil {
@@ -522,7 +498,10 @@ func (r *accessSourceResolver) Permission(ctx context.Context, obj *types.Access
 
 // TotalCount is the resolver for the totalCount field.
 func (r *accessSourceConnectionResolver) TotalCount(ctx context.Context, obj *types.AccessSourceConnection) (int, error) {
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionAccessSourceList)
+	if err != nil {
+		return 0, err
+	}
 
 	switch obj.Resolver.(type) {
 	case *organizationResolver:
@@ -975,9 +954,6 @@ func (r *Resolver) AccessEntryConnection() schema.AccessEntryConnectionResolver
 	return &accessEntryConnectionResolver{r}
 }
 
-// AccessReview returns schema.AccessReviewResolver implementation.
-func (r *Resolver) AccessReview() schema.AccessReviewResolver { return &accessReviewResolver{r} }
-
 // AccessReviewCampaign returns schema.AccessReviewCampaignResolver implementation.
 func (r *Resolver) AccessReviewCampaign() schema.AccessReviewCampaignResolver {
 	return &accessReviewCampaignResolver{r}
@@ -1003,7 +979,6 @@ func (r *Resolver) AccessSourceConnection() schema.AccessSourceConnectionResolve
 
 type accessEntryResolver struct{ *Resolver }
 type accessEntryConnectionResolver struct{ *Resolver }
-type accessReviewResolver struct{ *Resolver }
 type accessReviewCampaignResolver struct{ *Resolver }
 type accessReviewCampaignConnectionResolver struct{ *Resolver }
 type accessReviewCampaignScopeSourceResolver struct{ *Resolver }

pkg/server/api/console/v1/audit_log_resolvers.go

@@ -7,9 +7,14 @@ package console_v1
 
 import (
 	"context"
+	"errors"
 
+	"github.com/vikstrous/dataloadgen"
 	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/iam"
+	"go.probo.inc/probo/pkg/probo"
+	"go.probo.inc/probo/pkg/server/api/console/v1/dataloader"
 	"go.probo.inc/probo/pkg/server/api/console/v1/schema"
 	"go.probo.inc/probo/pkg/server/api/console/v1/types"
 	"go.probo.inc/probo/pkg/server/gqlutils"
@@ -17,7 +22,24 @@ import (
 
 // Organization is the resolver for the organization field.
 func (r *auditLogEntryResolver) Organization(ctx context.Context, obj *types.AuditLogEntry) (*types.Organization, error) {
-	return obj.Organization, nil
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
+		return nil, err
+	}
+
+	loaders := dataloader.FromContext(ctx)
+
+	organization, err := loaders.Organization.Load(ctx, obj.Organization.ID)
+	if err != nil {
+		if errors.Is(err, coredata.ErrResourceNotFound) || errors.Is(err, dataloadgen.ErrNotFound) {
+			return nil, gqlutils.NotFound(ctx, err)
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot load organization", log.Error(err))
+
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewOrganization(organization), nil
 }
 
 // Permission is the resolver for the permission field.
@@ -27,6 +49,10 @@ func (r *auditLogEntryResolver) Permission(ctx context.Context, obj *types.Audit
 
 // TotalCount is the resolver for the totalCount field.
 func (r *auditLogEntryConnectionResolver) TotalCount(ctx context.Context, obj *types.AuditLogEntryConnection) (int, error) {
+	if _, err := r.authorize(ctx, obj.ParentID, iam.ActionAuditLogEntryList); err != nil {
+		return 0, err
+	}
+
 	filter := coredata.NewAuditLogEntryFilter()
 	if obj.Filter != nil {
 		filter = obj.Filter

pkg/server/api/console/v1/base_resolvers.go

@@ -441,9 +441,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 		}
 	case coredata.TrackerPatternEntityType:
 		action = probo.ActionTrackerPatternGet
-		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
+		loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) {
-			scope := coredata.NewScopeFromObjectID(id)
-
 			pattern, err := r.cookieBanner.GetTrackerPattern(ctx, scope, id)
 			if err != nil {
 				return nil, err
@@ -510,6 +508,12 @@ func (r *queryResolver) Viewer(ctx context.Context) (*types.Viewer, error) {
 
 // CommonThirdParties is the resolver for the commonThirdParties field.
 func (r *queryResolver) CommonThirdParties(ctx context.Context, name string) ([]*types.CommonThirdParty, error) {
+	identity := authn.IdentityFromContext(ctx)
+
+	if _, err := r.authorize(ctx, identity.ID, probo.ActionCommonThirdPartyList); err != nil {
+		return nil, err
+	}
+
 	parties, err := r.thirdParty.Search(ctx, name)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot search common third parties", log.Error(err))

pkg/server/api/console/v1/common_third_party_resolvers.go

@@ -10,6 +10,7 @@ import (
 	"time"
 
 	"go.gearno.de/kit/log"
+	"go.probo.inc/probo/pkg/probo"
 	"go.probo.inc/probo/pkg/server/api/console/v1/schema"
 	"go.probo.inc/probo/pkg/server/api/console/v1/types"
 	"go.probo.inc/probo/pkg/server/gqlutils"
@@ -17,6 +18,10 @@ import (
 
 // LogoURL is the resolver for the logoUrl field.
 func (r *commonThirdPartyResolver) LogoURL(ctx context.Context, obj *types.CommonThirdParty) (*string, error) {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionCommonThirdPartyGet); err != nil {
+		return nil, err
+	}
+
 	if obj.LogoFileID == nil {
 		return nil, nil
 	}

pkg/server/api/console/v1/control_resolvers.go

@@ -112,7 +112,10 @@ func (r *controlResolver) Organization(ctx context.Context, obj *types.Control)
 
 // Regulatory is the resolver for the regulatory field.
 func (r *controlResolver) Regulatory(ctx context.Context, obj *types.Control) (bool, error) {
-	scope := coredata.NewScopeFromObjectID(obj.ID)
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionControlGet)
+	if err != nil {
+		return false, err
+	}
 
 	hasRegulatory, err := r.probo.Controls.HasRegulatoryObligation(ctx, scope, obj.ID)
 	if err != nil {
@@ -125,7 +128,10 @@ func (r *controlResolver) Regulatory(ctx context.Context, obj *types.Control) (b
 
 // Contractual is the resolver for the contractual field.
 func (r *controlResolver) Contractual(ctx context.Context, obj *types.Control) (bool, error) {
-	scope := coredata.NewScopeFromObjectID(obj.ID)
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionControlGet)
+	if err != nil {
+		return false, err
+	}
 
 	hasContractual, err := r.probo.Controls.HasContractualObligation(ctx, scope, obj.ID)
 	if err != nil {
@@ -138,7 +144,10 @@ func (r *controlResolver) Contractual(ctx context.Context, obj *types.Control) (
 
 // RiskAssessment is the resolver for the riskAssessment field.
 func (r *controlResolver) RiskAssessment(ctx context.Context, obj *types.Control) (bool, error) {
-	scope := coredata.NewScopeFromObjectID(obj.ID)
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionControlGet)
+	if err != nil {
+		return false, err
+	}
 
 	hasRisk, err := r.probo.Controls.HasRiskAssessment(ctx, scope, obj.ID)
 	if err != nil {
@@ -875,7 +884,11 @@ func (r *statementOfApplicabilityResolver) Permission(ctx context.Context, obj *
 
 // TotalCount is the resolver for the totalCount field.
 func (r *statementOfApplicabilityConnectionResolver) TotalCount(ctx context.Context, obj *types.StatementOfApplicabilityConnection) (int, error) {
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionStatementOfApplicabilityList)
+	if err != nil {
+		return 0, err
+	}
+
 	switch obj.Resolver.(type) {
 	case *organizationResolver:
 		count, err := r.probo.StatementsOfApplicability.CountForOrganizationID(ctx, scope, obj.ParentID)

pkg/server/api/console/v1/cookie_banner_resolvers.go

@@ -432,7 +432,10 @@ func (r *cookieCategoryConnectionResolver) TotalCount(ctx context.Context, obj *
 
 // TotalCount is the resolver for the totalCount field.
 func (r *detectedTrackerConnectionResolver) TotalCount(ctx context.Context, obj *types.DetectedTrackerConnection) (int, error) {
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionTrackerPatternGet)
+	if err != nil {
+		return 0, err
+	}
 
 	count, err := r.cookieBanner.CountDetectedTrackersByPatternID(ctx, scope, obj.ParentID)
 	if err != nil {
@@ -1256,7 +1259,10 @@ func (r *trackerPatternResolver) CookieCategory(ctx context.Context, obj *types.
 
 // DetectedCount is the resolver for the detectedCount field.
 func (r *trackerPatternResolver) DetectedCount(ctx context.Context, obj *types.TrackerPattern) (int, error) {
-	scope := coredata.NewScopeFromObjectID(obj.ID)
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionTrackerPatternGet)
+	if err != nil {
+		return 0, err
+	}
 
 	count, err := r.cookieBanner.CountDetectedTrackersByPatternID(ctx, scope, obj.ID)
 	if err != nil {
@@ -1269,7 +1275,8 @@ func (r *trackerPatternResolver) DetectedCount(ctx context.Context, obj *types.T
 
 // DetectedTrackers is the resolver for the detectedTrackers field.
 func (r *trackerPatternResolver) DetectedTrackers(ctx context.Context, obj *types.TrackerPattern, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DetectedTrackerOrderBy) (*types.DetectedTrackerConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionTrackerPatternGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionTrackerPatternGet)
+	if err != nil {
 		return nil, err
 	}
 
@@ -1285,7 +1292,6 @@ func (r *trackerPatternResolver) DetectedTrackers(ctx context.Context, obj *type
 	}
 
 	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 
 	trackers, err := r.cookieBanner.ListDetectedTrackersForPattern(ctx, scope, obj.ID, cursor)
 	if err != nil {
@@ -1305,12 +1311,12 @@ func (r *trackerPatternResolver) Permission(ctx context.Context, obj *types.Trac
 
 // TotalCount is the resolver for the totalCount field.
 func (r *trackerPatternConnectionResolver) TotalCount(ctx context.Context, obj *types.TrackerPatternConnection) (int, error) {
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionTrackerPatternList)
+	if err != nil {
+		return 0, err
+	}
 
-	var (
+	var count int
-		count int
-		err   error
-	)
 
 	switch obj.Resolver.(type) {
 	case *cookieCategoryResolver:
@@ -1362,12 +1368,12 @@ func (r *trackerResourceResolver) Permission(ctx context.Context, obj *types.Tra
 
 // TotalCount is the resolver for the totalCount field.
 func (r *trackerResourceConnectionResolver) TotalCount(ctx context.Context, obj *types.TrackerResourceConnection) (int, error) {
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionTrackerResourceList)
+	if err != nil {
+		return 0, err
+	}
 
-	var (
+	var count int
-		count int
-		err   error
-	)
 
 	switch obj.Resolver.(type) {
 	case *cookieCategoryResolver:

pkg/server/api/console/v1/electronic_signature_resolvers.go

@@ -10,12 +10,17 @@ import (
 	"fmt"
 	"time"
 
+	"go.probo.inc/probo/pkg/probo"
 	"go.probo.inc/probo/pkg/server/api/console/v1/schema"
 	"go.probo.inc/probo/pkg/server/api/console/v1/types"
 )
 
 // CertificateFileURL is the resolver for the certificateFileUrl field.
 func (r *electronicSignatureResolver) CertificateFileURL(ctx context.Context, obj *types.ElectronicSignature) (*string, error) {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionElectronicSignatureGet); err != nil {
+		return nil, err
+	}
+
 	signature, err := r.esign.GetSignatureByID(ctx, obj.ID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot load signature: %w", err)
@@ -35,6 +40,10 @@ func (r *electronicSignatureResolver) CertificateFileURL(ctx context.Context, ob
 
 // Events is the resolver for the events field.
 func (r *electronicSignatureResolver) Events(ctx context.Context, obj *types.ElectronicSignature) ([]*types.ElectronicSignatureEvent, error) {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionElectronicSignatureGet); err != nil {
+		return nil, err
+	}
+
 	events, err := r.esign.GetEventsBySignatureID(ctx, obj.ID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot load signature events: %w", err)

pkg/server/api/console/v1/graphql/access_review_campaign.graphql

@@ -284,32 +284,6 @@ input AccessEntryFilter
     accountType: AccessEntryAccountType
 }
 
-type AccessReview implements Node {
-    id: ID!
-    organization: Organization! @goField(forceResolver: true)
-    identitySource: AccessSource @goField(forceResolver: true)
-    createdAt: Datetime!
-    updatedAt: Datetime!
-
-    accessSources(
-        first: Int
-        after: CursorKey
-        last: Int
-        before: CursorKey
-        orderBy: AccessSourceOrder
-    ): AccessSourceConnection! @goField(forceResolver: true)
-
-    campaigns(
-        first: Int
-        after: CursorKey
-        last: Int
-        before: CursorKey
-        orderBy: AccessReviewCampaignOrder
-    ): AccessReviewCampaignConnection! @goField(forceResolver: true)
-
-    permission(action: String!): Boolean! @goField(forceResolver: true)
-}
-
 type ProviderOrganization {
     slug: String!
     displayName: String!

pkg/server/api/console/v1/graphql/organization.graphql

@@ -227,14 +227,6 @@ type Organization implements Node {
         filter: DocumentFilter
     ): DocumentConnection! @goField(forceResolver: true)
 
-    evidences(
-        first: Int
-        after: CursorKey
-        last: Int
-        before: CursorKey
-        orderBy: EvidenceOrder
-    ): EvidenceConnection! @goField(forceResolver: true)
-
     frameworks(
         first: Int
         after: CursorKey

pkg/server/api/console/v1/organization_resolvers.go

@@ -797,11 +797,6 @@ func (r *organizationResolver) Documents(ctx context.Context, obj *types.Organiz
 	return types.NewDocumentConnection(page, r, obj.ID, documentFilter), nil
 }
 
-// Evidences is the resolver for the evidences field.
-func (r *organizationResolver) Evidences(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.EvidenceOrderBy) (*types.EvidenceConnection, error) {
-	panic(fmt.Errorf("not implemented: Evidences - evidences"))
-}
-
 // Frameworks is the resolver for the frameworks field.
 func (r *organizationResolver) Frameworks(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.FrameworkOrderBy) (*types.FrameworkConnection, error) {
 	scope, err := r.authorize(ctx, obj.ID, probo.ActionFrameworkList)