From 3c14f9aa536db1b56afafb294c71bb5243274a4b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=89mile=20R=C3=A9?= Date: Thu, 30 Jul 2026 17:20:08 +0200 Subject: [PATCH] Allow access requests before NDA signing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ENG-646: requesting private resources must not hit the NDA gate; keep requireCompletedNDA on protected exports only. Signed-off-by: Émile Ré --- .../v1/compliance_portal_resolvers.go | 16 ---------------- pkg/server/api/complianceportal/v1/nda.go | 3 ++- 2 files changed, 2 insertions(+), 17 deletions(-) diff --git a/pkg/server/api/complianceportal/v1/compliance_portal_resolvers.go b/pkg/server/api/complianceportal/v1/compliance_portal_resolvers.go index e0740a86e..b2621cc3e 100644 --- a/pkg/server/api/complianceportal/v1/compliance_portal_resolvers.go +++ b/pkg/server/api/complianceportal/v1/compliance_portal_resolvers.go @@ -976,10 +976,6 @@ func (r *mutationResolver) RequestDocumentAccess(ctx context.Context, input type return nil, gqlutils.Unauthenticatedf(ctx, "authentication is required to request access") } - if err := r.requireCompletedNDA(ctx); err != nil { - return nil, err - } - if _, err := visitorService.RequestPortalAccess( ctx, scope, &visitor.PortalAccessRequest{ @@ -1029,10 +1025,6 @@ func (r *mutationResolver) RequestReportAccess(ctx context.Context, input types. return nil, gqlutils.Unauthenticatedf(ctx, "authentication is required to request access") } - if err := r.requireCompletedNDA(ctx); err != nil { - return nil, err - } - if _, err := visitorService.RequestPortalAccess( ctx, scope, &visitor.PortalAccessRequest{ @@ -1082,10 +1074,6 @@ func (r *mutationResolver) RequestCompliancePortalFileAccess(ctx context.Context return nil, gqlutils.Unauthenticatedf(ctx, "authentication is required to request access") } - if err := r.requireCompletedNDA(ctx); err != nil { - return nil, err - } - if _, err := visitorService.RequestPortalAccess( ctx, scope, &visitor.PortalAccessRequest{ @@ -1117,10 +1105,6 @@ func (r *mutationResolver) RequestAccesses(ctx context.Context, input types.Requ return nil, gqlutils.Unauthenticatedf(ctx, "authentication is required to request access") } - if err := r.requireCompletedNDA(ctx); err != nil { - return nil, err - } - if len(input.DocumentIds) == 0 && len(input.ReportIds) == 0 && len(input.CompliancePortalFileIds) == 0 { return nil, gqlutils.Invalidf(ctx, "at least one document, report, or file id is required") } diff --git a/pkg/server/api/complianceportal/v1/nda.go b/pkg/server/api/complianceportal/v1/nda.go index c0fb4d553..9d8f455c5 100644 --- a/pkg/server/api/complianceportal/v1/nda.go +++ b/pkg/server/api/complianceportal/v1/nda.go @@ -32,7 +32,8 @@ import ( // requireCompletedNDA enforces portal NDA completion for the signed-in identity. // No-ops when there is no viewer or the portal membership has no NDA signature. -// Callers own authentication and PUBLIC-resource skips. +// Call from protected (non-PUBLIC) export resolvers after authentication. +// Access-request mutations must not call this — requesting is allowed before signing. func (r *Resolver) requireCompletedNDA(ctx context.Context) error { identity := authn.IdentityFromContext(ctx) if identity == nil {