rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Introduce access-review source snapshot and normalize naming

Browse Source 
Decouple each campaign from the live access-review sources it was started
with by introducing a per-campaign source snapshot table
(access_review_campaign_sources). The snapshot captures the source name,
category, and connector at start time, so a review remains coherent even
after the underlying source is edited or deleted. Fetch tracking becomes
an append-only log (access_review_campaign_source_fetch_attempts) that
preserves every attempt with its own status and error rather than
overwriting a single row.

Rename the shared access-review tables and enums to use a consistent
access_review_ prefix throughout:

  access_entries          → access_review_entries
  access_sources          → access_review_sources
  access_source_category  → access_review_source_category
  access_entry_*          → access_review_entry_*

The same rename propagates to every coredata type, service, GraphQL
schema, MCP specification, CLI command, frontend component, and e2e test.
The accessreview package gains dedicated actions.go and policies.go files
for its own IAM policy set, mirroring the agentrun package pattern.

Signed-off-by: Bryan Frimin <bryan@probo.com>
This commit is contained in:
Bryan Frimin
2026-06-11 15:58:30 +02:00
parent 8a53e0ec1c
commit 4b64e59da4
146 changed files with 4795 additions and 4069 deletions
Download Patch File Download Diff File Expand all files Collapse all files

80
e2e/console/rbac_test.go
View File

@@ -204,32 +204,32 @@ const (
}
}`
createAccessSourceMutation = `
mutation CreateAccessSource($input: CreateAccessSourceInput!) {
createAccessSource(input: $input) {
accessSourceEdge { node { id } }
createAccessReviewSourceMutation = `
mutation CreateAccessReviewSource($input: CreateAccessReviewSourceInput!) {
createAccessReviewSource(input: $input) {
accessReviewSourceEdge { node { id } }
}
}`
updateAccessSourceMutation = `
mutation UpdateAccessSource($input: UpdateAccessSourceInput!) {
updateAccessSource(input: $input) {
accessSource { id }
updateAccessReviewSourceMutation = `
mutation UpdateAccessReviewSource($input: UpdateAccessReviewSourceInput!) {
updateAccessReviewSource(input: $input) {
accessReviewSource { id }
}
}`
deleteAccessSourceMutation = `
mutation DeleteAccessSource($input: DeleteAccessSourceInput!) {
deleteAccessSource(input: $input) {
deletedAccessSourceId
deleteAccessReviewSourceMutation = `
mutation DeleteAccessReviewSource($input: DeleteAccessReviewSourceInput!) {
deleteAccessReviewSource(input: $input) {
deletedAccessReviewSourceId
}
}`
listAccessSourcesQuery = `
query GetAccessSources($id: ID!) {
listAccessReviewSourcesQuery = `
query GetAccessReviewSources($id: ID!) {
node(id: $id) {
... on Organization {
accessSources(first: 10) { totalCount }
accessReviewSources(first: 10) { totalCount }
}
}
}`
@@ -305,7 +305,7 @@ func TestRBAC(t *testing.T) {
taskID := factory.NewTask(owner, measureID).WithName("RBAC Test Task").Create()
riskID := factory.NewRisk(owner).WithName("RBAC Test Risk").Create()
thirdPartyID := factory.NewThirdParty(owner).WithName("RBAC Test ThirdParty").Create()
accessSourceID := factory.NewAccessSource(owner, owner.GetOrganizationID().String()).WithName("RBAC Test Source").Create()
accessReviewSourceID := factory.NewAccessReviewSource(owner, owner.GetOrganizationID().String()).WithName("RBAC Test Source").Create()
accessReviewCampaignID := factory.NewAccessReviewCampaign(owner, owner.GetOrganizationID().String()).WithName("RBAC Test Campaign").Create()
tests := []struct {
@@ -1063,9 +1063,9 @@ func TestRBAC(t *testing.T) {
name: "owner can create access source",
role: "owner",
client: owner,
query: createAccessSourceMutation,
query: createAccessReviewSourceMutation,
variables: func() map[string]any {
return map[string]any{"input": map[string]any{"organizationId": owner.GetOrganizationID().String(), "name": factory.SafeName("AccessSource")}}
return map[string]any{"input": map[string]any{"organizationId": owner.GetOrganizationID().String(), "name": factory.SafeName("AccessReviewSource")}}
},
shouldAllow: true,
},
@@ -1073,9 +1073,9 @@ func TestRBAC(t *testing.T) {
name: "admin can create access source",
role: "admin",
client: admin,
query: createAccessSourceMutation,
query: createAccessReviewSourceMutation,
variables: func() map[string]any {
return map[string]any{"input": map[string]any{"organizationId": owner.GetOrganizationID().String(), "name": factory.SafeName("AccessSource")}}
return map[string]any{"input": map[string]any{"organizationId": owner.GetOrganizationID().String(), "name": factory.SafeName("AccessReviewSource")}}
},
shouldAllow: true,
},
@@ -1083,9 +1083,9 @@ func TestRBAC(t *testing.T) {
name: "viewer cannot create access source",
role: "viewer",
client: viewer,
query: createAccessSourceMutation,
query: createAccessReviewSourceMutation,
variables: func() map[string]any {
return map[string]any{"input": map[string]any{"organizationId": owner.GetOrganizationID().String(), "name": factory.SafeName("AccessSource")}}
return map[string]any{"input": map[string]any{"organizationId": owner.GetOrganizationID().String(), "name": factory.SafeName("AccessReviewSource")}}
},
shouldAllow: false,
},
@@ -1094,9 +1094,9 @@ func TestRBAC(t *testing.T) {
name: "owner can update access source",
role: "owner",
client: owner,
query: updateAccessSourceMutation,
query: updateAccessReviewSourceMutation,
variables: func() map[string]any {
return map[string]any{"input": map[string]any{"accessSourceId": accessSourceID, "name": factory.SafeName("Updated Source")}}
return map[string]any{"input": map[string]any{"accessReviewSourceId": accessReviewSourceID, "name": factory.SafeName("Updated Source")}}
},
shouldAllow: true,
},
@@ -1104,9 +1104,9 @@ func TestRBAC(t *testing.T) {
name: "admin can update access source",
role: "admin",
client: admin,
query: updateAccessSourceMutation,
query: updateAccessReviewSourceMutation,
variables: func() map[string]any {
return map[string]any{"input": map[string]any{"accessSourceId": accessSourceID, "name": factory.SafeName("Updated Source")}}
return map[string]any{"input": map[string]any{"accessReviewSourceId": accessReviewSourceID, "name": factory.SafeName("Updated Source")}}
},
shouldAllow: true,
},
@@ -1114,9 +1114,9 @@ func TestRBAC(t *testing.T) {
name: "viewer cannot update access source",
role: "viewer",
client: viewer,
query: updateAccessSourceMutation,
query: updateAccessReviewSourceMutation,
variables: func() map[string]any {
return map[string]any{"input": map[string]any{"accessSourceId": accessSourceID, "name": factory.SafeName("Updated Source")}}
return map[string]any{"input": map[string]any{"accessReviewSourceId": accessReviewSourceID, "name": factory.SafeName("Updated Source")}}
},
shouldAllow: false,
},
@@ -1125,10 +1125,10 @@ func TestRBAC(t *testing.T) {
name: "owner can delete access source",
role: "owner",
client: owner,
query: deleteAccessSourceMutation,
query: deleteAccessReviewSourceMutation,
variables: func() map[string]any {
id := factory.NewAccessSource(owner, owner.GetOrganizationID().String()).WithName(factory.SafeName("ToDelete")).Create()
return map[string]any{"input": map[string]any{"accessSourceId": id}}
id := factory.NewAccessReviewSource(owner, owner.GetOrganizationID().String()).WithName(factory.SafeName("ToDelete")).Create()
return map[string]any{"input": map[string]any{"accessReviewSourceId": id}}
},
shouldAllow: true,
},
@@ -1136,10 +1136,10 @@ func TestRBAC(t *testing.T) {
name: "admin can delete access source",
role: "admin",
client: admin,
query: deleteAccessSourceMutation,
query: deleteAccessReviewSourceMutation,
variables: func() map[string]any {
id := factory.NewAccessSource(owner, owner.GetOrganizationID().String()).WithName(factory.SafeName("ToDelete")).Create()
return map[string]any{"input": map[string]any{"accessSourceId": id}}
id := factory.NewAccessReviewSource(owner, owner.GetOrganizationID().String()).WithName(factory.SafeName("ToDelete")).Create()
return map[string]any{"input": map[string]any{"accessReviewSourceId": id}}
},
shouldAllow: true,
},
@@ -1147,10 +1147,10 @@ func TestRBAC(t *testing.T) {
name: "viewer cannot delete access source",
role: "viewer",
client: viewer,
query: deleteAccessSourceMutation,
query: deleteAccessReviewSourceMutation,
variables: func() map[string]any {
id := factory.NewAccessSource(owner, owner.GetOrganizationID().String()).WithName(factory.SafeName("ToDelete")).Create()
return map[string]any{"input": map[string]any{"accessSourceId": id}}
id := factory.NewAccessReviewSource(owner, owner.GetOrganizationID().String()).WithName(factory.SafeName("ToDelete")).Create()
return map[string]any{"input": map[string]any{"accessReviewSourceId": id}}
},
shouldAllow: false,
},
@@ -1159,7 +1159,7 @@ func TestRBAC(t *testing.T) {
name: "owner can list access sources",
role: "owner",
client: owner,
query: listAccessSourcesQuery,
query: listAccessReviewSourcesQuery,
variables: func() map[string]any {
return map[string]any{"id": owner.GetOrganizationID().String()}
},
@@ -1169,7 +1169,7 @@ func TestRBAC(t *testing.T) {
name: "admin can list access sources",
role: "admin",
client: admin,
query: listAccessSourcesQuery,
query: listAccessReviewSourcesQuery,
variables: func() map[string]any {
return map[string]any{"id": owner.GetOrganizationID().String()}
},
@@ -1179,7 +1179,7 @@ func TestRBAC(t *testing.T) {
name: "viewer can list access sources",
role: "viewer",
client: viewer,
query: listAccessSourcesQuery,
query: listAccessReviewSourcesQuery,
variables: func() map[string]any {
return map[string]any{"id": owner.GetOrganizationID().String()}
},