rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow access requests before NDA signing

Browse Source 
ENG-646: requesting private resources must not hit the
NDA gate; keep requireCompletedNDA on protected exports
only.

Signed-off-by: Émile Ré <emile@probo.com>
This commit is contained in:
Émile Ré
2026-07-30 17:20:08 +02:00
parent 34fa2356e1
commit 3c14f9aa53
2 changed files with 2 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
pkg/server/api/complianceportal/v1/compliance_portal_resolvers.go
View File

@@ -976,10 +976,6 @@ func (r *mutationResolver) RequestDocumentAccess(ctx context.Context, input type
return nil, gqlutils.Unauthenticatedf(ctx, "authentication is required to request access")
}
if err := r.requireCompletedNDA(ctx); err != nil {
return nil, err
}
if _, err := visitorService.RequestPortalAccess(
ctx, scope,
&visitor.PortalAccessRequest{
@@ -1029,10 +1025,6 @@ func (r *mutationResolver) RequestReportAccess(ctx context.Context, input types.
return nil, gqlutils.Unauthenticatedf(ctx, "authentication is required to request access")
}
if err := r.requireCompletedNDA(ctx); err != nil {
return nil, err
}
if _, err := visitorService.RequestPortalAccess(
ctx, scope,
&visitor.PortalAccessRequest{
@@ -1082,10 +1074,6 @@ func (r *mutationResolver) RequestCompliancePortalFileAccess(ctx context.Context
return nil, gqlutils.Unauthenticatedf(ctx, "authentication is required to request access")
}
if err := r.requireCompletedNDA(ctx); err != nil {
return nil, err
}
if _, err := visitorService.RequestPortalAccess(
ctx, scope,
&visitor.PortalAccessRequest{
@@ -1117,10 +1105,6 @@ func (r *mutationResolver) RequestAccesses(ctx context.Context, input types.Requ
return nil, gqlutils.Unauthenticatedf(ctx, "authentication is required to request access")
}
if err := r.requireCompletedNDA(ctx); err != nil {
return nil, err
}
if len(input.DocumentIds) == 0 && len(input.ReportIds) == 0 && len(input.CompliancePortalFileIds) == 0 {
return nil, gqlutils.Invalidf(ctx, "at least one document, report, or file id is required")
}

3
pkg/server/api/complianceportal/v1/nda.go
View File

@@ -32,7 +32,8 @@ import (
// requireCompletedNDA enforces portal NDA completion for the signed-in identity.
// No-ops when there is no viewer or the portal membership has no NDA signature.
// Callers own authentication and PUBLIC-resource skips.
// Call from protected (non-PUBLIC) export resolvers after authentication.
// Access-request mutations must not call this — requesting is allowed before signing.
func (r *Resolver) requireCompletedNDA(ctx context.Context) error {
identity := authn.IdentityFromContext(ctx)
if identity == nil {