diff --git a/pkg/probo/policies.go b/pkg/probo/policies.go index 146e32541..e81cdc390 100644 --- a/pkg/probo/policies.go +++ b/pkg/probo/policies.go @@ -133,6 +133,8 @@ var AuditorPolicy = policy.NewPolicy( ActionOrganizationGetHorizontalLogoUrl, ).WithSID("org-read-access").When(organizationCondition), + policy.Allow(ActionOrganizationContextGet).WithSID("organization-context-read").When(organizationCondition), + policy.Allow( ActionThirdPartyGet, ActionThirdPartyList, ActionThirdPartyContactGet, ActionThirdPartyContactList, diff --git a/pkg/probo/policies_test.go b/pkg/probo/policies_test.go index 5e85dacee..1d65f0f37 100644 --- a/pkg/probo/policies_test.go +++ b/pkg/probo/policies_test.go @@ -73,3 +73,30 @@ func TestAuditorPolicy_ProcessingActivityPageReadAccess(t *testing.T) { }) } } + +func TestAuditorPolicy_OrganizationContextReadAccess(t *testing.T) { + t.Parallel() + + organizationID := gid.New(gid.NewTenantID(), 1) + evaluator := policy.NewEvaluator() + conditionContext := policy.ConditionContext{ + Principal: map[string]string{ + "organization_id": organizationID.String(), + }, + Resource: map[string]string{ + "organization_id": organizationID.String(), + }, + } + + result := evaluator.Evaluate( + policy.AuthorizationRequest{ + Principal: organizationID, + Resource: organizationID, + Action: probo.ActionOrganizationContextGet, + ConditionContext: conditionContext, + }, + []*policy.Policy{probo.AuditorPolicy}, + ) + + assert.True(t, result.IsAllowed()) +}