From 400800fd4153fb7247d1e3b94ff6c9563a02df9b Mon Sep 17 00:00:00 2001
From: Sacha Al Himdani <sacha@getprobo.com>
Date: Fri, 5 Jun 2026 16:48:26 +0200
Subject: [PATCH] Allow auditors to read the organization context

Auditors could not see the Context page in the console because
AuditorPolicy was missing core:organization-context:get. Grant the
read action (mirroring ViewerPolicy) so the sidebar item appears and
the context resolver succeeds for auditors.

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
---
 pkg/probo/policies.go      |  2 ++
 pkg/probo/policies_test.go | 27 +++++++++++++++++++++++++++
 2 files changed, 29 insertions(+)

diff --git a/pkg/probo/policies.go b/pkg/probo/policies.go
index 146e32541..e81cdc390 100644
--- a/pkg/probo/policies.go
+++ b/pkg/probo/policies.go
@@ -133,6 +133,8 @@ var AuditorPolicy = policy.NewPolicy(
 		ActionOrganizationGetHorizontalLogoUrl,
 	).WithSID("org-read-access").When(organizationCondition),
 
+	policy.Allow(ActionOrganizationContextGet).WithSID("organization-context-read").When(organizationCondition),
+
 	policy.Allow(
 		ActionThirdPartyGet, ActionThirdPartyList,
 		ActionThirdPartyContactGet, ActionThirdPartyContactList,
diff --git a/pkg/probo/policies_test.go b/pkg/probo/policies_test.go
index 5e85dacee..1d65f0f37 100644
--- a/pkg/probo/policies_test.go
+++ b/pkg/probo/policies_test.go
@@ -73,3 +73,30 @@ func TestAuditorPolicy_ProcessingActivityPageReadAccess(t *testing.T) {
 		})
 	}
 }
+
+func TestAuditorPolicy_OrganizationContextReadAccess(t *testing.T) {
+	t.Parallel()
+
+	organizationID := gid.New(gid.NewTenantID(), 1)
+	evaluator := policy.NewEvaluator()
+	conditionContext := policy.ConditionContext{
+		Principal: map[string]string{
+			"organization_id": organizationID.String(),
+		},
+		Resource: map[string]string{
+			"organization_id": organizationID.String(),
+		},
+	}
+
+	result := evaluator.Evaluate(
+		policy.AuthorizationRequest{
+			Principal:        organizationID,
+			Resource:         organizationID,
+			Action:           probo.ActionOrganizationContextGet,
+			ConditionContext: conditionContext,
+		},
+		[]*policy.Policy{probo.AuditorPolicy},
+	)
+
+	assert.True(t, result.IsAllowed())
+}