From 4d1a98ffdb6c5ecdd96dc44f01481032cadb4547 Mon Sep 17 00:00:00 2001 From: Bryan Frimin Date: Wed, 20 May 2026 18:11:25 -0700 Subject: [PATCH] Create scope in Authorize Signed-off-by: Bryan Frimin --- contrib/claude/authorization.md | 13 +- contrib/claude/mcp.md | 9 +- pkg/iam/authorizer.go | 48 +- pkg/server/api/authz/authorization.go | 17 +- pkg/server/api/connect/v1/base_resolvers.go | 2 +- .../api/connect/v1/identity_resolvers.go | 8 +- .../api/connect/v1/invitation_resolvers.go | 2 +- .../api/connect/v1/membership_resolvers.go | 6 +- .../api/connect/v1/organization_resolvers.go | 18 +- .../connect/v1/personal_api_key_resolvers.go | 8 +- .../api/connect/v1/profile_resolvers.go | 16 +- pkg/server/api/connect/v1/resolver.go | 3 +- pkg/server/api/connect/v1/saml_resolvers.go | 6 +- pkg/server/api/connect/v1/scim_resolvers.go | 20 +- .../api/connect/v1/session_resolvers.go | 4 +- .../v1/access_review_campaign_resolvers.go | 144 +-- pkg/server/api/console/v1/asset_resolvers.go | 61 +- pkg/server/api/console/v1/audit_resolvers.go | 94 +- pkg/server/api/console/v1/base_resolvers.go | 2 +- .../api/console/v1/connector_initiate.go | 6 +- .../api/console/v1/connector_resolvers.go | 19 +- .../api/console/v1/control_resolvers.go | 125 +- .../api/console/v1/cookie_banner_resolvers.go | 149 +-- .../v1/cookie_consent_record_resolvers.go | 12 +- ..._protection_impact_assessment_resolvers.go | 60 +- .../api/console/v1/document_resolvers.go | 188 ++- .../api/console/v1/evidence_resolvers.go | 21 +- pkg/server/api/console/v1/file_resolvers.go | 5 +- .../api/console/v1/framework_resolvers.go | 41 +- .../api/console/v1/mailing_list_resolvers.go | 22 +- .../api/console/v1/measure_resolvers.go | 51 +- .../api/console/v1/obligation_resolvers.go | 27 +- .../api/console/v1/organization_resolvers.go | 180 ++- .../v1/processing_activity_resolvers.go | 39 +- pkg/server/api/console/v1/resolver.go | 3 +- .../console/v1/rights_request_resolvers.go | 23 +- .../console/v1/risk_assessment_resolvers.go | 177 ++- pkg/server/api/console/v1/risk_resolvers.go | 72 +- pkg/server/api/console/v1/task_resolvers.go | 29 +- .../api/console/v1/third_party_resolvers.go | 166 ++- .../api/console/v1/trust_center_resolvers.go | 186 ++- pkg/server/api/console/v1/viewer_resolvers.go | 16 +- .../api/console/v1/webhook_resolvers.go | 33 +- pkg/server/api/mcp/v1/resolver.go | 14 +- pkg/server/api/mcp/v1/schema.resolvers.go | 1089 +++++++---------- 45 files changed, 1480 insertions(+), 1754 deletions(-) diff --git a/contrib/claude/authorization.md b/contrib/claude/authorization.md index fe7ecaac8..56d3d1c5d 100644 --- a/contrib/claude/authorization.md +++ b/contrib/claude/authorization.md @@ -37,7 +37,7 @@ The evaluator processes all statements against a request: `Authorizer` is the main orchestrator in `pkg/iam/authorizer.go`: ```go -err := iamService.Authorizer.Authorize(ctx, iam.AuthorizeParams{ +scope, err := iamService.Authorizer.Authorize(ctx, iam.AuthorizeParams{ Principal: identityID, // who Resource: thirdPartyID, // what Action: probo.ActionThirdPartyGet, // which action @@ -51,7 +51,8 @@ The flow: 3. Load resource attributes via `AuthorizationAttributes()` on the entity 4. Build policies: identity-scoped + role-specific 5. Evaluate all policies -6. Return `ErrInsufficientPermissions` if no allow match +6. Return an authorization scope (`*coredata.Scope`) for downstream data access +7. Return `ErrInsufficientPermissions` if no allow match ## PolicySet @@ -126,14 +127,16 @@ var ( **GraphQL resolvers** use `AuthorizeFunc` from `pkg/server/api/authz/`: ```go -if err := authorize(ctx, thirdPartyID, probo.ActionThirdPartyGet); err != nil { +scope, err := authorize(ctx, thirdPartyID, probo.ActionThirdPartyGet) +if err != nil { return nil, err } ``` **MCP resolvers** use `Authorize` and return early on error: ```go -if err := r.Authorize(ctx, input.ID, probo.ActionThirdPartyGet); err != nil { +scope, err := r.Authorize(ctx, input.ID, probo.ActionThirdPartyGet) +if err != nil { return nil, types.GetThirdPartyOutput{}, err } ``` @@ -183,7 +186,7 @@ When adding a new entity that needs authorization: 2. **Role policies** — wire actions into the appropriate role policies in `pkg/probo/policies.go` (`OwnerPolicy`, `AdminPolicy`, `ViewerPolicy`, etc.) with `organization_id` condition 3. **`AuthorizationAttributes`** — implement on the `coredata` entity struct, returning at minimum `{"organization_id": ...}` (use the denormalized `OrganizationID` field — see coredata doc) 4. **Entity type registry** — register in `pkg/coredata/entity_type_reg.go` and `NewEntityFromID` so the authorizer can construct the entity from its GID -5. **Resolver calls** — add `r.authorize(ctx, id, probo.ActionEntityGet)` in GraphQL resolvers and `if err := r.Authorize(ctx, id, probo.ActionEntityGet); err != nil { return nil, types.GetEntityOutput{}, err }` in MCP resolvers +5. **Resolver calls** — add `scope, err := r.authorize(ctx, id, probo.ActionEntityGet)` in GraphQL resolvers and `scope, err := r.Authorize(ctx, id, probo.ActionEntityGet)` in MCP resolvers, then pass `scope` to services ## Key patterns diff --git a/contrib/claude/mcp.md b/contrib/claude/mcp.md index 69ce18486..0a4bba437 100644 --- a/contrib/claude/mcp.md +++ b/contrib/claude/mcp.md @@ -65,7 +65,8 @@ First return is always `nil`. Authorization errors are returned and handled like Use `Authorize` with an early return: ```go -if err := r.Authorize(ctx, input.OrganizationID, probo.ActionThirdPartyList); err != nil { +scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionThirdPartyList) +if err != nil { return nil, types.ListThirdPartiesOutput{}, err } ``` @@ -75,7 +76,7 @@ if err := r.Authorize(ctx, input.OrganizationID, probo.ActionThirdPartyList); er **List with pagination:** ```go func (r *Resolver) ListThirdPartiesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListThirdPartiesInput) (*mcp.CallToolResult, types.ListThirdPartiesOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionThirdPartyList); err != nil { + if _, err := r.Authorize(ctx, input.OrganizationID, probo.ActionThirdPartyList); err != nil { return nil, types.ListThirdPartiesOutput{}, err } @@ -106,7 +107,7 @@ func (r *Resolver) ListThirdPartiesTool(ctx context.Context, req *mcp.CallToolRe **Get single resource:** ```go func (r *Resolver) GetRiskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetRiskInput) (*mcp.CallToolResult, types.GetRiskOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionRiskGet); err != nil { + if _, err := r.Authorize(ctx, input.ID, probo.ActionRiskGet); err != nil { return nil, types.GetRiskOutput{}, err } @@ -124,7 +125,7 @@ func (r *Resolver) GetRiskTool(ctx context.Context, req *mcp.CallToolRequest, in **Create:** ```go func (r *Resolver) AddRiskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddRiskInput) (*mcp.CallToolResult, types.AddRiskOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionRiskCreate); err != nil { + if _, err := r.Authorize(ctx, input.OrganizationID, probo.ActionRiskCreate); err != nil { return nil, types.AddRiskOutput{}, err } diff --git a/pkg/iam/authorizer.go b/pkg/iam/authorizer.go index 911211de6..23392402d 100644 --- a/pkg/iam/authorizer.go +++ b/pkg/iam/authorizer.go @@ -71,18 +71,32 @@ func (a *Authorizer) RegisterPolicySet(ps *PolicySet) { } // Authorize checks if the principal is allowed to perform the action on the resource. -func (a *Authorizer) Authorize(ctx context.Context, params AuthorizeParams) error { +func (a *Authorizer) Authorize(ctx context.Context, params AuthorizeParams) (*coredata.Scope, error) { if params.Principal.EntityType() != coredata.IdentityEntityType { - return NewUnsupportedPrincipalTypeError(params.Principal.EntityType()) + return nil, NewUnsupportedPrincipalTypeError(params.Principal.EntityType()) } - return a.pg.WithTx(ctx, func(ctx context.Context, tx pg.Tx) error { return a.authorize(ctx, tx, params) }) + var scope *coredata.Scope + + if err := a.pg.WithTx(ctx, func(ctx context.Context, tx pg.Tx) error { + authorizedScope, err := a.authorize(ctx, tx, params) + if err != nil { + return err + } + + scope = authorizedScope + return nil + }); err != nil { + return nil, err + } + + return scope, nil } -func (a *Authorizer) authorize(ctx context.Context, tx pg.Tx, params AuthorizeParams) error { +func (a *Authorizer) authorize(ctx context.Context, tx pg.Tx, params AuthorizeParams) (*coredata.Scope, error) { resourceAttrs, err := a.buildResourceAttributes(ctx, tx, params) if err != nil { - return fmt.Errorf("cannot build resource attributes: %w", err) + return nil, fmt.Errorf("cannot build resource attributes: %w", err) } resourceOrgID := resourceAttrs["organization_id"] @@ -90,7 +104,7 @@ func (a *Authorizer) authorize(ctx context.Context, tx pg.Tx, params AuthorizePa // Find role for resource's organization membership, err := a.loadMembership(ctx, tx, params.Principal, resourceOrgID) if err != nil { - return fmt.Errorf("cannot load memberships for principal: %w", err) + return nil, fmt.Errorf("cannot load memberships for principal: %w", err) } // Check whether the viewer is currently assuming the org of the accessed resource @@ -102,14 +116,14 @@ func (a *Authorizer) authorize(ctx context.Context, tx pg.Tx, params AuthorizePa membership.ID, ); err != nil { if _, ok := errors.AsType[*ErrSessionNotFound](err); ok { - return NewAssumptionRequiredError(params.Principal, membership.ID) + return nil, NewAssumptionRequiredError(params.Principal, membership.ID) } if _, ok := errors.AsType[*ErrSessionExpired](err); ok { - return NewAssumptionRequiredError(params.Principal, membership.ID) + return nil, NewAssumptionRequiredError(params.Principal, membership.ID) } - return fmt.Errorf("cannot get active child session for membership: %w", err) + return nil, fmt.Errorf("cannot get active child session for membership: %w", err) } } @@ -129,7 +143,7 @@ func (a *Authorizer) authorize(ctx context.Context, tx pg.Tx, params AuthorizePa principalAttrs, err := a.buildPrincipalAttributes(ctx, tx, params.Principal, scopedPrincipalAttrs) if err != nil { - return fmt.Errorf("cannot build principal attributes: %w", err) + return nil, fmt.Errorf("cannot build principal attributes: %w", err) } if params.Session != nil { @@ -149,11 +163,21 @@ func (a *Authorizer) authorize(ctx context.Context, tx pg.Tx, params AuthorizePa } if a.evaluator.Evaluate(req, policies).IsAllowed() { + scope := coredata.NewScopeFromObjectID(params.Resource) + if resourceOrgID != "" { + orgID, err := gid.ParseGID(resourceOrgID) + if err != nil { + return nil, fmt.Errorf("cannot parse organization id from resource attributes: %w", err) + } + + scope = coredata.NewScope(orgID.TenantID()) + } + a.recordAuditLog(ctx, tx, params, resourceAttrs) - return nil + return scope, nil } - return NewInsufficientPermissionsError(params.Principal, params.Resource, params.Action) + return nil, NewInsufficientPermissionsError(params.Principal, params.Resource, params.Action) } func (a *Authorizer) loadMembership( diff --git a/pkg/server/api/authz/authorization.go b/pkg/server/api/authz/authorization.go index 2b696e682..2b1a73f9d 100644 --- a/pkg/server/api/authz/authorization.go +++ b/pkg/server/api/authz/authorization.go @@ -28,7 +28,7 @@ import ( type ( AuthorizeFuncOption func(*iam.AuthorizeParams) - AuthorizeFunc func(context.Context, gid.GID, string, ...AuthorizeFuncOption) error + AuthorizeFunc func(context.Context, gid.GID, string, ...AuthorizeFuncOption) (*coredata.Scope, error) ) func WithAttr(key, value string) AuthorizeFuncOption { @@ -60,7 +60,7 @@ func NewAuthorizeFunc( objectID gid.GID, action string, options ...AuthorizeFuncOption, - ) error { + ) (*coredata.Scope, error) { identity := authn.IdentityFromContext(ctx) session := authn.SessionFromContext(ctx) @@ -78,24 +78,25 @@ func NewAuthorizeFunc( option(¶ms) } - if err := svc.Authorizer.Authorize(ctx, params); err != nil { + scope, err := svc.Authorizer.Authorize(ctx, params) + if err != nil { if _, ok := errors.AsType[*iam.ErrAssumptionRequired](err); ok { - return gqlutils.AssumptionRequired(ctx, err) + return nil, gqlutils.AssumptionRequired(ctx, err) } if _, ok := errors.AsType[*iam.ErrInsufficientPermissions](err); ok { - return gqlutils.Forbidden(ctx, err) + return nil, gqlutils.Forbidden(ctx, err) } if errors.Is(err, coredata.ErrResourceNotFound) { - return gqlutils.NotFoundf(ctx, "resource not found") + return nil, gqlutils.NotFoundf(ctx, "resource not found") } logger.ErrorCtx(ctx, "cannot authorize", log.Error(err)) - return gqlutils.Internal(ctx) + return nil, gqlutils.Internal(ctx) } - return nil + return scope, nil } } diff --git a/pkg/server/api/connect/v1/base_resolvers.go b/pkg/server/api/connect/v1/base_resolvers.go index 041a3e4cf..0e467f7ea 100644 --- a/pkg/server/api/connect/v1/base_resolvers.go +++ b/pkg/server/api/connect/v1/base_resolvers.go @@ -146,7 +146,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error return nil, fmt.Errorf("unsupported entity type: %d", id.EntityType()) } - if err := r.authorize(ctx, id, action); err != nil { + if _, err := r.authorize(ctx, id, action); err != nil { return nil, err } diff --git a/pkg/server/api/connect/v1/identity_resolvers.go b/pkg/server/api/connect/v1/identity_resolvers.go index d7c7e2c55..911b8aae2 100644 --- a/pkg/server/api/connect/v1/identity_resolvers.go +++ b/pkg/server/api/connect/v1/identity_resolvers.go @@ -24,7 +24,7 @@ import ( // Profiles is the resolver for the profiles field. func (r *identityResolver) Profiles(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ProfileOrderBy, filter *types.ProfileFilter) (*types.ProfileConnection, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileList, authz.WithSkipAssumptionCheck()); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileList, authz.WithSkipAssumptionCheck()); err != nil { return nil, err } @@ -68,7 +68,7 @@ func (r *identityResolver) Profiles(ctx context.Context, obj *types.Identity, fi // Sessions is the resolver for the sessions field. func (r *identityResolver) Sessions(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.SessionOrder) (*types.SessionConnection, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionSessionList); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionSessionList); err != nil { return nil, err } @@ -103,7 +103,7 @@ func (r *identityResolver) Sessions(ctx context.Context, obj *types.Identity, fi // PersonalAPIKeys is the resolver for the personalAPIKeys field. func (r *identityResolver) PersonalAPIKeys(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.PersonalAPIKeyConnection, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionPersonalAPIKeyList); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionPersonalAPIKeyList); err != nil { return nil, err } @@ -132,7 +132,7 @@ func (r *identityResolver) PersonalAPIKeys(ctx context.Context, obj *types.Ident // SsoLoginURL is the resolver for the ssoLoginURL field. func (r *identityResolver) SsoLoginURL(ctx context.Context, obj *types.Identity) (*string, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionIdentityGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionIdentityGet); err != nil { return nil, err } diff --git a/pkg/server/api/connect/v1/invitation_resolvers.go b/pkg/server/api/connect/v1/invitation_resolvers.go index 8dd04d76a..0272adf67 100644 --- a/pkg/server/api/connect/v1/invitation_resolvers.go +++ b/pkg/server/api/connect/v1/invitation_resolvers.go @@ -24,7 +24,7 @@ func (r *invitationResolver) Permission(ctx context.Context, obj *types.Invitati // InviteUser is the resolver for the inviteUser field. func (r *mutationResolver) InviteUser(ctx context.Context, input types.InviteUserInput) (*types.InviteUserPayload, error) { - if err := r.authorize(ctx, input.ProfileID, iam.ActionInvitationCreate); err != nil { + if _, err := r.authorize(ctx, input.ProfileID, iam.ActionInvitationCreate); err != nil { return nil, err } diff --git a/pkg/server/api/connect/v1/membership_resolvers.go b/pkg/server/api/connect/v1/membership_resolvers.go index 32c0e553f..d42c58a77 100644 --- a/pkg/server/api/connect/v1/membership_resolvers.go +++ b/pkg/server/api/connect/v1/membership_resolvers.go @@ -21,7 +21,7 @@ import ( // LastSession is the resolver for the lastSession field. func (r *membershipResolver) LastSession(ctx context.Context, obj *types.Membership) (*types.Session, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionMembershipGet, authz.WithSkipAssumptionCheck()); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipGet, authz.WithSkipAssumptionCheck()); err != nil { return nil, err } @@ -51,12 +51,12 @@ func (r *membershipResolver) Permission(ctx context.Context, obj *types.Membersh // UpdateMembership is the resolver for the updateMembership field. func (r *mutationResolver) UpdateMembership(ctx context.Context, input types.UpdateMembershipInput) (*types.UpdateMembershipPayload, error) { - if err := r.authorize(ctx, input.MembershipID, iam.ActionMembershipUpdate); err != nil { + if _, err := r.authorize(ctx, input.MembershipID, iam.ActionMembershipUpdate); err != nil { return nil, err } if input.Role == coredata.MembershipRoleOwner { - if err := r.authorize(ctx, input.MembershipID, iam.ActionMembershipRoleSetOwner); err != nil { + if _, err := r.authorize(ctx, input.MembershipID, iam.ActionMembershipRoleSetOwner); err != nil { return nil, err } } diff --git a/pkg/server/api/connect/v1/organization_resolvers.go b/pkg/server/api/connect/v1/organization_resolvers.go index 10712e87b..7fe6cb632 100644 --- a/pkg/server/api/connect/v1/organization_resolvers.go +++ b/pkg/server/api/connect/v1/organization_resolvers.go @@ -84,7 +84,7 @@ func (r *mutationResolver) CreateOrganization(ctx context.Context, input types.C // UpdateOrganization is the resolver for the updateOrganization field. func (r *mutationResolver) UpdateOrganization(ctx context.Context, input types.UpdateOrganizationInput) (*types.UpdateOrganizationPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, iam.ActionOrganizationUpdate); err != nil { + if _, err := r.authorize(ctx, input.OrganizationID, iam.ActionOrganizationUpdate); err != nil { return nil, err } @@ -140,7 +140,7 @@ func (r *mutationResolver) UpdateOrganization(ctx context.Context, input types.U // DeleteOrganization is the resolver for the deleteOrganization field. func (r *mutationResolver) DeleteOrganization(ctx context.Context, input types.DeleteOrganizationInput) (*types.DeleteOrganizationPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, iam.ActionOrganizationDelete); err != nil { + if _, err := r.authorize(ctx, input.OrganizationID, iam.ActionOrganizationDelete); err != nil { return nil, err } @@ -160,7 +160,7 @@ func (r *mutationResolver) DeleteOrganizationHorizontalLogo(ctx context.Context, // LogoURL is the resolver for the logoUrl field. func (r *organizationResolver) LogoURL(ctx context.Context, obj *types.Organization) (*string, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionOrganizationGet, authz.WithSkipAssumptionCheck()); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionOrganizationGet, authz.WithSkipAssumptionCheck()); err != nil { return nil, err } @@ -175,7 +175,7 @@ func (r *organizationResolver) LogoURL(ctx context.Context, obj *types.Organizat // HorizontalLogoURL is the resolver for the horizontalLogoUrl field. func (r *organizationResolver) HorizontalLogoURL(ctx context.Context, obj *types.Organization) (*string, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionOrganizationGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionOrganizationGet); err != nil { return nil, err } @@ -190,7 +190,7 @@ func (r *organizationResolver) HorizontalLogoURL(ctx context.Context, obj *types // Profiles is the resolver for the profiles field. func (r *organizationResolver) Profiles(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ProfileOrderBy) (*types.ProfileConnection, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileList); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileList); err != nil { return nil, err } @@ -228,7 +228,7 @@ func (r *organizationResolver) Profiles(ctx context.Context, obj *types.Organiza // SamlConfigurations is the resolver for the samlConfigurations field. func (r *organizationResolver) SamlConfigurations(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.SAMLConfigurationConnection, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionSAMLConfigurationList); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionSAMLConfigurationList); err != nil { return nil, err } @@ -257,7 +257,7 @@ func (r *organizationResolver) SamlConfigurations(ctx context.Context, obj *type // ScimConfiguration is the resolver for the scimConfiguration field. func (r *organizationResolver) ScimConfiguration(ctx context.Context, obj *types.Organization) (*types.SCIMConfiguration, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionSCIMConfigurationGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionSCIMConfigurationGet); err != nil { return nil, err } @@ -291,7 +291,7 @@ func (r *organizationResolver) ScimBridgeTypes(ctx context.Context, obj *types.O // AuditLogEntries is the resolver for the auditLogEntries field. func (r *organizationResolver) AuditLogEntries(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AuditLogEntryOrderBy, filter *types.AuditLogEntryFilter) (*types.AuditLogEntryConnection, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionAuditLogEntryList); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionAuditLogEntryList); err != nil { return nil, err } @@ -339,7 +339,7 @@ func (r *organizationResolver) AuditLogEntries(ctx context.Context, obj *types.O // Viewer is the resolver for the viewer field. func (r *organizationResolver) Viewer(ctx context.Context, obj *types.Organization) (*types.Profile, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } diff --git a/pkg/server/api/connect/v1/personal_api_key_resolvers.go b/pkg/server/api/connect/v1/personal_api_key_resolvers.go index 87c878f96..096ab444d 100644 --- a/pkg/server/api/connect/v1/personal_api_key_resolvers.go +++ b/pkg/server/api/connect/v1/personal_api_key_resolvers.go @@ -21,7 +21,7 @@ import ( func (r *mutationResolver) CreatePersonalAPIKey(ctx context.Context, input types.CreatePersonalAPIKeyInput) (*types.CreatePersonalAPIKeyPayload, error) { identity := authn.IdentityFromContext(ctx) - if err := r.authorize(ctx, identity.ID, iam.ActionPersonalAPIKeyCreate); err != nil { + if _, err := r.authorize(ctx, identity.ID, iam.ActionPersonalAPIKeyCreate); err != nil { return nil, err } @@ -44,7 +44,7 @@ func (r *mutationResolver) CreatePersonalAPIKey(ctx context.Context, input types // RevokePersonalAPIKey is the resolver for the revokePersonalAPIKey field. func (r *mutationResolver) RevokePersonalAPIKey(ctx context.Context, input types.RevokePersonalAPIKeyInput) (*types.RevokePersonalAPIKeyPayload, error) { - if err := r.authorize(ctx, input.PersonalAPIKeyID, iam.ActionPersonalAPIKeyDelete); err != nil { + if _, err := r.authorize(ctx, input.PersonalAPIKeyID, iam.ActionPersonalAPIKeyDelete); err != nil { return nil, err } @@ -61,7 +61,7 @@ func (r *mutationResolver) RevokePersonalAPIKey(ctx context.Context, input types // Token is the resolver for the token field. func (r *personalAPIKeyResolver) Token(ctx context.Context, obj *types.PersonalAPIKey) (*string, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionPersonalAPIKeyGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionPersonalAPIKeyGet); err != nil { return nil, err } @@ -85,7 +85,7 @@ func (r *personalAPIKeyResolver) Permission(ctx context.Context, obj *types.Pers func (r *personalAPIKeyConnectionResolver) TotalCount(ctx context.Context, obj *types.PersonalAPIKeyConnection) (*int, error) { switch obj.Resolver.(type) { case *identityResolver: - if err := r.authorize(ctx, obj.ParentID, iam.ActionPersonalAPIKeyList); err != nil { + if _, err := r.authorize(ctx, obj.ParentID, iam.ActionPersonalAPIKeyList); err != nil { return nil, err } diff --git a/pkg/server/api/connect/v1/profile_resolvers.go b/pkg/server/api/connect/v1/profile_resolvers.go index 13eae79d0..26fe2caa7 100644 --- a/pkg/server/api/connect/v1/profile_resolvers.go +++ b/pkg/server/api/connect/v1/profile_resolvers.go @@ -22,7 +22,7 @@ import ( // CreateUser is the resolver for the createUser field. func (r *mutationResolver) CreateUser(ctx context.Context, input types.CreateUserInput) (*types.CreateUserPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, iam.ActionMembershipProfileCreate); err != nil { + if _, err := r.authorize(ctx, input.OrganizationID, iam.ActionMembershipProfileCreate); err != nil { return nil, err } @@ -57,7 +57,7 @@ func (r *mutationResolver) CreateUser(ctx context.Context, input types.CreateUse // DeactivateUser is the resolver for the deactivateUser field. func (r *mutationResolver) DeactivateUser(ctx context.Context, input types.DeactivateUserInput) (*types.DeactivateUserPayload, error) { - if err := r.authorize(ctx, input.ProfileID, iam.ActionMembershipProfileDeactivate); err != nil { + if _, err := r.authorize(ctx, input.ProfileID, iam.ActionMembershipProfileDeactivate); err != nil { return nil, err } @@ -78,7 +78,7 @@ func (r *mutationResolver) DeactivateUser(ctx context.Context, input types.Deact // UpdateUser is the resolver for the updateUser field. func (r *mutationResolver) UpdateUser(ctx context.Context, input types.UpdateUserInput) (*types.UpdateUserPayload, error) { - if err := r.authorize(ctx, input.ID, iam.ActionMembershipProfileUpdate); err != nil { + if _, err := r.authorize(ctx, input.ID, iam.ActionMembershipProfileUpdate); err != nil { return nil, err } @@ -106,7 +106,7 @@ func (r *mutationResolver) UpdateUser(ctx context.Context, input types.UpdateUse // RemoveUser is the resolver for the removeUser field. func (r *mutationResolver) RemoveUser(ctx context.Context, input types.RemoveUserInput) (*types.RemoveUserPayload, error) { - if err := r.authorize(ctx, input.ProfileID, iam.ActionMembershipProfileDelete); err != nil { + if _, err := r.authorize(ctx, input.ProfileID, iam.ActionMembershipProfileDelete); err != nil { return nil, err } @@ -134,7 +134,7 @@ func (r *mutationResolver) RemoveUser(ctx context.Context, input types.RemoveUse // Identity is the resolver for the identity field. func (r *profileResolver) Identity(ctx context.Context, obj *types.Profile) (*types.Identity, error) { - if err := r.authorize( + if _, err := r.authorize( ctx, obj.ID, iam.ActionMembershipProfileGet, @@ -159,7 +159,7 @@ func (r *profileResolver) Identity(ctx context.Context, obj *types.Profile) (*ty // Organization is the resolver for the organization field. func (r *profileResolver) Organization(ctx context.Context, obj *types.Profile) (*types.Organization, error) { - if err := r.authorize(ctx, obj.Organization.ID, iam.ActionOrganizationGet, authz.WithSkipAssumptionCheck()); err != nil { + if _, err := r.authorize(ctx, obj.Organization.ID, iam.ActionOrganizationGet, authz.WithSkipAssumptionCheck()); err != nil { return nil, err } @@ -179,7 +179,7 @@ func (r *profileResolver) Organization(ctx context.Context, obj *types.Profile) // Membership is the resolver for the membership field. func (r *profileResolver) Membership(ctx context.Context, obj *types.Profile) (*types.Membership, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionMembershipGet, authz.WithSkipAssumptionCheck()); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipGet, authz.WithSkipAssumptionCheck()); err != nil { return nil, err } @@ -199,7 +199,7 @@ func (r *profileResolver) Membership(ctx context.Context, obj *types.Profile) (* // PendingInvitations is the resolver for the pendingInvitations field. func (r *profileResolver) PendingInvitations(ctx context.Context, obj *types.Profile, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.InvitationOrderBy) (*types.InvitationConnection, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionInvitationList); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionInvitationList); err != nil { return nil, err } diff --git a/pkg/server/api/connect/v1/resolver.go b/pkg/server/api/connect/v1/resolver.go index 9905d83ed..288c6f9e8 100644 --- a/pkg/server/api/connect/v1/resolver.go +++ b/pkg/server/api/connect/v1/resolver.go @@ -116,7 +116,8 @@ func NewMux( } func (r *Resolver) Permission(ctx context.Context, obj types.Node, action string) (bool, error) { - return r.authorize(ctx, obj.GetID(), action, authz.WithDryRun()) == nil, nil + _, err := r.authorize(ctx, obj.GetID(), action, authz.WithDryRun()) + return err == nil, nil } func (r *Resolver) SSOLoginURL(samlConfigID gid.GID) string { diff --git a/pkg/server/api/connect/v1/saml_resolvers.go b/pkg/server/api/connect/v1/saml_resolvers.go index 37afdbd20..319849d8a 100644 --- a/pkg/server/api/connect/v1/saml_resolvers.go +++ b/pkg/server/api/connect/v1/saml_resolvers.go @@ -19,7 +19,7 @@ import ( // CreateSAMLConfiguration is the resolver for the createSAMLConfiguration field. func (r *mutationResolver) CreateSAMLConfiguration(ctx context.Context, input types.CreateSAMLConfigurationInput) (*types.CreateSAMLConfigurationPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, iam.ActionSAMLConfigurationCreate); err != nil { + if _, err := r.authorize(ctx, input.OrganizationID, iam.ActionSAMLConfigurationCreate); err != nil { return nil, err } @@ -63,7 +63,7 @@ func (r *mutationResolver) CreateSAMLConfiguration(ctx context.Context, input ty // UpdateSAMLConfiguration is the resolver for the updateSAMLConfiguration field. func (r *mutationResolver) UpdateSAMLConfiguration(ctx context.Context, input types.UpdateSAMLConfigurationInput) (*types.UpdateSAMLConfigurationPayload, error) { - if err := r.authorize(ctx, input.SamlConfigurationID, iam.ActionSAMLConfigurationUpdate); err != nil { + if _, err := r.authorize(ctx, input.SamlConfigurationID, iam.ActionSAMLConfigurationUpdate); err != nil { return nil, err } @@ -100,7 +100,7 @@ func (r *mutationResolver) UpdateSAMLConfiguration(ctx context.Context, input ty // DeleteSAMLConfiguration is the resolver for the deleteSAMLConfiguration field. func (r *mutationResolver) DeleteSAMLConfiguration(ctx context.Context, input types.DeleteSAMLConfigurationInput) (*types.DeleteSAMLConfigurationPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, iam.ActionSAMLConfigurationDelete); err != nil { + if _, err := r.authorize(ctx, input.OrganizationID, iam.ActionSAMLConfigurationDelete); err != nil { return nil, err } diff --git a/pkg/server/api/connect/v1/scim_resolvers.go b/pkg/server/api/connect/v1/scim_resolvers.go index 6be36667b..e4d78ed1d 100644 --- a/pkg/server/api/connect/v1/scim_resolvers.go +++ b/pkg/server/api/connect/v1/scim_resolvers.go @@ -26,7 +26,7 @@ func (r *connectorResolver) Permission(ctx context.Context, obj *types.Connector // CreateSCIMConfiguration is the resolver for the createSCIMConfiguration field. func (r *mutationResolver) CreateSCIMConfiguration(ctx context.Context, input types.CreateSCIMConfigurationInput) (*types.CreateSCIMConfigurationPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, iam.ActionSCIMConfigurationCreate); err != nil { + if _, err := r.authorize(ctx, input.OrganizationID, iam.ActionSCIMConfigurationCreate); err != nil { return nil, err } @@ -59,7 +59,7 @@ func (r *mutationResolver) CreateSCIMConfiguration(ctx context.Context, input ty // DeleteSCIMConfiguration is the resolver for the deleteSCIMConfiguration field. func (r *mutationResolver) DeleteSCIMConfiguration(ctx context.Context, input types.DeleteSCIMConfigurationInput) (*types.DeleteSCIMConfigurationPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, iam.ActionSCIMConfigurationDelete); err != nil { + if _, err := r.authorize(ctx, input.OrganizationID, iam.ActionSCIMConfigurationDelete); err != nil { return nil, err } @@ -74,7 +74,7 @@ func (r *mutationResolver) DeleteSCIMConfiguration(ctx context.Context, input ty // RegenerateSCIMToken is the resolver for the regenerateSCIMToken field. func (r *mutationResolver) RegenerateSCIMToken(ctx context.Context, input types.RegenerateSCIMTokenInput) (*types.RegenerateSCIMTokenPayload, error) { - if err := r.authorize(ctx, input.ScimConfigurationID, iam.ActionSCIMConfigurationUpdate); err != nil { + if _, err := r.authorize(ctx, input.ScimConfigurationID, iam.ActionSCIMConfigurationUpdate); err != nil { return nil, err } @@ -92,7 +92,7 @@ func (r *mutationResolver) RegenerateSCIMToken(ctx context.Context, input types. // UpdateSCIMBridge is the resolver for the updateSCIMBridge field. func (r *mutationResolver) UpdateSCIMBridge(ctx context.Context, input types.UpdateSCIMBridgeInput) (*types.UpdateSCIMBridgePayload, error) { - if err := r.authorize(ctx, input.ScimBridgeID, iam.ActionSCIMBridgeUpdate); err != nil { + if _, err := r.authorize(ctx, input.ScimBridgeID, iam.ActionSCIMBridgeUpdate); err != nil { return nil, err } @@ -109,7 +109,7 @@ func (r *mutationResolver) UpdateSCIMBridge(ctx context.Context, input types.Upd // ScimConfiguration is the resolver for the scimConfiguration field. func (r *sCIMBridgeResolver) ScimConfiguration(ctx context.Context, obj *types.SCIMBridge) (*types.SCIMConfiguration, error) { - if err := r.authorize(ctx, obj.ScimConfiguration.ID, iam.ActionSCIMConfigurationGet); err != nil { + if _, err := r.authorize(ctx, obj.ScimConfiguration.ID, iam.ActionSCIMConfigurationGet); err != nil { return nil, err } @@ -138,7 +138,7 @@ func (r *sCIMBridgeResolver) Connector(ctx context.Context, obj *types.SCIMBridg } // Authorize based on the SCIM configuration (connector accessed via bridge is a sub-resource) - if err := r.authorize(ctx, obj.ScimConfiguration.ID, iam.ActionSCIMConfigurationGet); err != nil { + if _, err := r.authorize(ctx, obj.ScimConfiguration.ID, iam.ActionSCIMConfigurationGet); err != nil { return nil, err } @@ -170,7 +170,7 @@ func (r *sCIMConfigurationResolver) EndpointURL(ctx context.Context, obj *types. // Organization is the resolver for the organization field. func (r *sCIMConfigurationResolver) Organization(ctx context.Context, obj *types.SCIMConfiguration) (*types.Organization, error) { - if err := r.authorize(ctx, obj.Organization.ID, iam.ActionOrganizationGet); err != nil { + if _, err := r.authorize(ctx, obj.Organization.ID, iam.ActionOrganizationGet); err != nil { return nil, err } @@ -200,7 +200,7 @@ func (r *sCIMConfigurationResolver) Bridge(ctx context.Context, obj *types.SCIMC return nil, nil } - if err := r.authorize(ctx, obj.ID, iam.ActionSCIMConfigurationGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionSCIMConfigurationGet); err != nil { return nil, err } @@ -220,7 +220,7 @@ func (r *sCIMConfigurationResolver) Bridge(ctx context.Context, obj *types.SCIMC // Events is the resolver for the events field. func (r *sCIMConfigurationResolver) Events(ctx context.Context, obj *types.SCIMConfiguration, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.SCIMEventOrderBy) (*types.SCIMEventConnection, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionSCIMEventList); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionSCIMEventList); err != nil { return nil, err } @@ -256,7 +256,7 @@ func (r *sCIMEventResolver) Permission(ctx context.Context, obj *types.SCIMEvent // TotalCount is the resolver for the totalCount field. func (r *sCIMEventConnectionResolver) TotalCount(ctx context.Context, obj *types.SCIMEventConnection) (*int, error) { - if err := r.authorize(ctx, obj.ParentID, iam.ActionSCIMEventList); err != nil { + if _, err := r.authorize(ctx, obj.ParentID, iam.ActionSCIMEventList); err != nil { return nil, err } diff --git a/pkg/server/api/connect/v1/session_resolvers.go b/pkg/server/api/connect/v1/session_resolvers.go index ebc4ccb33..23c1986eb 100644 --- a/pkg/server/api/connect/v1/session_resolvers.go +++ b/pkg/server/api/connect/v1/session_resolvers.go @@ -416,7 +416,7 @@ func (r *mutationResolver) AssumeOrganizationSession(ctx context.Context, input // RevokeSession is the resolver for the revokeSession field. func (r *mutationResolver) RevokeSession(ctx context.Context, input types.RevokeSessionInput) (*types.RevokeSessionPayload, error) { - if err := r.authorize(ctx, input.SessionID, iam.ActionSessionRevoke); err != nil { + if _, err := r.authorize(ctx, input.SessionID, iam.ActionSessionRevoke); err != nil { return nil, err } @@ -438,7 +438,7 @@ func (r *mutationResolver) RevokeSession(ctx context.Context, input types.Revoke // RevokeAllSessions is the resolver for the revokeAllSessions field. func (r *mutationResolver) RevokeAllSessions(ctx context.Context) (*types.RevokeAllSessionsPayload, error) { - if err := r.authorize(ctx, authn.SessionFromContext(ctx).ID, iam.ActionSessionRevokeAll); err != nil { + if _, err := r.authorize(ctx, authn.SessionFromContext(ctx).ID, iam.ActionSessionRevokeAll); err != nil { return nil, err } diff --git a/pkg/server/api/console/v1/access_review_campaign_resolvers.go b/pkg/server/api/console/v1/access_review_campaign_resolvers.go index 61f8916c9..137780db7 100644 --- a/pkg/server/api/console/v1/access_review_campaign_resolvers.go +++ b/pkg/server/api/console/v1/access_review_campaign_resolvers.go @@ -23,12 +23,11 @@ import ( // Campaign is the resolver for the campaign field. func (r *accessEntryResolver) Campaign(ctx context.Context, obj *types.AccessEntry) (*types.AccessReviewCampaign, error) { - if err := r.authorize(ctx, obj.Campaign.ID, probo.ActionAccessReviewCampaignGet); err != nil { + scope, err := r.authorize(ctx, obj.Campaign.ID, probo.ActionAccessReviewCampaignGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.Campaign.ID) - campaign, err := r.accessReview.Campaigns(scope).Get(ctx, obj.Campaign.ID) if err != nil { if errors.Is(err, coredata.ErrResourceNotFound) { @@ -43,12 +42,11 @@ func (r *accessEntryResolver) Campaign(ctx context.Context, obj *types.AccessEnt // AccessSource is the resolver for the accessSource field. func (r *accessEntryResolver) AccessSource(ctx context.Context, obj *types.AccessEntry) (*types.AccessSource, error) { - if err := r.authorize(ctx, obj.AccessSource.ID, probo.ActionAccessSourceGet); err != nil { + scope, err := r.authorize(ctx, obj.AccessSource.ID, probo.ActionAccessSourceGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.AccessSource.ID) - source, err := r.accessReview.Sources(scope).Get(ctx, obj.AccessSource.ID) if err != nil { if errors.Is(err, coredata.ErrResourceNotFound) { @@ -63,12 +61,11 @@ func (r *accessEntryResolver) AccessSource(ctx context.Context, obj *types.Acces // DecisionHistory is the resolver for the decisionHistory field. func (r *accessEntryResolver) DecisionHistory(ctx context.Context, obj *types.AccessEntry) ([]*types.AccessEntryDecisionHistoryEntry, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionAccessEntryGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessEntryGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) - histories, err := r.accessReview.Entries(scope).DecisionHistory(ctx, obj.ID) if err != nil { panic(fmt.Errorf("cannot get decision history: %w", err)) @@ -125,12 +122,11 @@ func (r *accessReviewResolver) IdentitySource(ctx context.Context, obj *types.Ac // AccessSources is the resolver for the accessSources field. func (r *accessReviewResolver) AccessSources(ctx context.Context, obj *types.AccessReview, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AccessSourceOrder) (*types.AccessSourceConnection, error) { - if err := r.authorize(ctx, obj.Organization.ID, probo.ActionAccessSourceList); err != nil { + scope, err := r.authorize(ctx, obj.Organization.ID, probo.ActionAccessSourceList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.Organization.ID) - pageOrderBy := page.OrderBy[coredata.AccessSourceOrderField]{ Field: coredata.AccessSourceOrderFieldCreatedAt, Direction: page.OrderDirectionDesc, @@ -154,12 +150,11 @@ func (r *accessReviewResolver) AccessSources(ctx context.Context, obj *types.Acc // Campaigns is the resolver for the campaigns field. func (r *accessReviewResolver) Campaigns(ctx context.Context, obj *types.AccessReview, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AccessReviewCampaignOrder) (*types.AccessReviewCampaignConnection, error) { - if err := r.authorize(ctx, obj.Organization.ID, probo.ActionAccessReviewCampaignList); err != nil { + scope, err := r.authorize(ctx, obj.Organization.ID, probo.ActionAccessReviewCampaignList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.Organization.ID) - pageOrderBy := page.OrderBy[coredata.AccessReviewCampaignOrderField]{ Field: coredata.AccessReviewCampaignOrderFieldCreatedAt, Direction: page.OrderDirectionDesc, @@ -193,12 +188,11 @@ func (r *accessReviewCampaignResolver) Organization(ctx context.Context, obj *ty // ScopeSources is the resolver for the scopeSources field. func (r *accessReviewCampaignResolver) ScopeSources(ctx context.Context, obj *types.AccessReviewCampaign) ([]*types.AccessReviewCampaignScopeSource, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) - sources, err := r.accessReview.Sources(scope).ListScopeSourcesForCampaignID(ctx, obj.ID) if err != nil { panic(fmt.Errorf("cannot list scope sources: %w", err)) @@ -224,12 +218,11 @@ func (r *accessReviewCampaignResolver) ScopeSources(ctx context.Context, obj *ty // Entries is the resolver for the entries field. func (r *accessReviewCampaignResolver) Entries(ctx context.Context, obj *types.AccessReviewCampaign, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AccessEntryOrder, accessSourceID *gid.GID, filter *coredata.AccessEntryFilter) (*types.AccessEntryConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionAccessEntryList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessEntryList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) - pageOrderBy := page.OrderBy[coredata.AccessEntryOrderField]{ Field: coredata.AccessEntryOrderFieldCreatedAt, Direction: page.OrderDirectionDesc, @@ -244,8 +237,7 @@ func (r *accessReviewCampaignResolver) Entries(ctx context.Context, obj *types.A cursor := types.NewCursor(first, after, last, before, pageOrderBy) var ( - p *page.Page[*coredata.AccessEntry, coredata.AccessEntryOrderField] - err error + p *page.Page[*coredata.AccessEntry, coredata.AccessEntryOrderField] ) if accessSourceID != nil { @@ -263,12 +255,11 @@ func (r *accessReviewCampaignResolver) Entries(ctx context.Context, obj *types.A // PendingEntryCount is the resolver for the pendingEntryCount field. func (r *accessReviewCampaignResolver) PendingEntryCount(ctx context.Context, obj *types.AccessReviewCampaign) (int, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionAccessEntryList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessEntryList) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ID) - count, err := r.accessReview.Entries(scope).CountPendingForCampaignID(ctx, obj.ID) if err != nil { panic(fmt.Errorf("cannot count pending access entries: %w", err)) @@ -279,12 +270,11 @@ func (r *accessReviewCampaignResolver) PendingEntryCount(ctx context.Context, ob // Statistics is the resolver for the statistics field. func (r *accessReviewCampaignResolver) Statistics(ctx context.Context, obj *types.AccessReviewCampaign) (*types.AccessReviewCampaignStatistics, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionAccessEntryList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessEntryList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) - stats, err := r.accessReview.Entries(scope).Statistics(ctx, obj.ID) if err != nil { panic(fmt.Errorf("cannot get campaign statistics: %w", err)) @@ -317,12 +307,11 @@ func (r *accessReviewCampaignConnectionResolver) TotalCount(ctx context.Context, // Entries is the resolver for the entries field. func (r *accessReviewCampaignScopeSourceResolver) Entries(ctx context.Context, obj *types.AccessReviewCampaignScopeSource, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AccessEntryOrder, filter *coredata.AccessEntryFilter) (*types.AccessEntryConnection, error) { - if err := r.authorize(ctx, obj.CampaignID, probo.ActionAccessEntryList); err != nil { + scope, err := r.authorize(ctx, obj.CampaignID, probo.ActionAccessEntryList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.CampaignID) - pageOrderBy := page.OrderBy[coredata.AccessEntryOrderField]{ Field: coredata.AccessEntryOrderFieldCreatedAt, Direction: page.OrderDirectionDesc, @@ -348,12 +337,11 @@ func (r *accessReviewCampaignScopeSourceResolver) Entries(ctx context.Context, o // Statistics is the resolver for the statistics field. func (r *accessReviewCampaignScopeSourceResolver) Statistics(ctx context.Context, obj *types.AccessReviewCampaignScopeSource) (*types.AccessReviewCampaignStatistics, error) { - if err := r.authorize(ctx, obj.CampaignID, probo.ActionAccessEntryList); err != nil { + scope, err := r.authorize(ctx, obj.CampaignID, probo.ActionAccessEntryList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.CampaignID) - stats, err := r.accessReview.Entries(scope).StatisticsForSource(ctx, obj.CampaignID, obj.ID) if err != nil { panic(fmt.Errorf("cannot get source statistics: %w", err)) @@ -390,7 +378,8 @@ func (r *accessSourceResolver) Connector(ctx context.Context, obj *types.AccessS // ProviderOrganizations is the resolver for the providerOrganizations field. func (r *accessSourceResolver) ProviderOrganizations(ctx context.Context, obj *types.AccessSource) ([]*types.ProviderOrganization, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceGet) + if err != nil { return nil, err } @@ -398,8 +387,6 @@ func (r *accessSourceResolver) ProviderOrganizations(ctx context.Context, obj *t return []*types.ProviderOrganization{}, nil } - scope := coredata.NewScopeFromObjectID(obj.ID) - httpClient, dbConnector, err := r.accessReview.Sources(scope).ConnectorHTTPClient(ctx, *obj.ConnectorID) if err != nil { if errors.Is(err, coredata.ErrResourceNotFound) { @@ -434,7 +421,8 @@ func (r *accessSourceResolver) ProviderOrganizations(ctx context.Context, obj *t // return false: the identifier is captured during the OAuth callback, // not via a follow-up configure mutation. func (r *accessSourceResolver) NeedsConfiguration(ctx context.Context, obj *types.AccessSource) (bool, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceGet) + if err != nil { return false, err } @@ -442,7 +430,6 @@ func (r *accessSourceResolver) NeedsConfiguration(ctx context.Context, obj *type return false, nil } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo dbConnector, err := prb.Connectors.Get(ctx, scope, *obj.ConnectorID) @@ -496,7 +483,8 @@ func (r *accessSourceResolver) ConnectionStatus(ctx context.Context, obj *types. // SelectedOrganization is the resolver for the selectedOrganization field. func (r *accessSourceResolver) SelectedOrganization(ctx context.Context, obj *types.AccessSource) (*string, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceGet) + if err != nil { return nil, err } @@ -504,7 +492,6 @@ func (r *accessSourceResolver) SelectedOrganization(ctx context.Context, obj *ty return nil, nil } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo dbConnector, err := prb.Connectors.Get(ctx, scope, *obj.ConnectorID) @@ -553,12 +540,11 @@ func (r *accessSourceConnectionResolver) TotalCount(ctx context.Context, obj *ty // CreateAccessSource is the resolver for the createAccessSource field. func (r *mutationResolver) CreateAccessSource(ctx context.Context, input types.CreateAccessSourceInput) (*types.CreateAccessSourcePayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionAccessSourceCreate); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionAccessSourceCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) - source, err := r.accessReview.Sources(scope).Create(ctx, accessreview.CreateAccessSourceRequest{ OrganizationID: input.OrganizationID, ConnectorID: input.ConnectorID, @@ -577,12 +563,11 @@ func (r *mutationResolver) CreateAccessSource(ctx context.Context, input types.C // UpdateAccessSource is the resolver for the updateAccessSource field. func (r *mutationResolver) UpdateAccessSource(ctx context.Context, input types.UpdateAccessSourceInput) (*types.UpdateAccessSourcePayload, error) { - if err := r.authorize(ctx, input.AccessSourceID, probo.ActionAccessSourceUpdate); err != nil { + scope, err := r.authorize(ctx, input.AccessSourceID, probo.ActionAccessSourceUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.AccessSourceID) - req := accessreview.UpdateAccessSourceRequest{ AccessSourceID: input.AccessSourceID, } @@ -614,12 +599,11 @@ func (r *mutationResolver) UpdateAccessSource(ctx context.Context, input types.U // DeleteAccessSource is the resolver for the deleteAccessSource field. func (r *mutationResolver) DeleteAccessSource(ctx context.Context, input types.DeleteAccessSourceInput) (*types.DeleteAccessSourcePayload, error) { - if err := r.authorize(ctx, input.AccessSourceID, probo.ActionAccessSourceDelete); err != nil { + scope, err := r.authorize(ctx, input.AccessSourceID, probo.ActionAccessSourceDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.AccessSourceID) - if err := r.accessReview.Sources(scope).Delete(ctx, input.AccessSourceID); err != nil { if errors.Is(err, coredata.ErrResourceNotFound) { return nil, gqlutils.NotFound(ctx, err) @@ -635,12 +619,11 @@ func (r *mutationResolver) DeleteAccessSource(ctx context.Context, input types.D // ConfigureAccessSource is the resolver for the configureAccessSource field. func (r *mutationResolver) ConfigureAccessSource(ctx context.Context, input types.ConfigureAccessSourceInput) (*types.ConfigureAccessSourcePayload, error) { - if err := r.authorize(ctx, input.AccessSourceID, probo.ActionAccessSourceUpdate); err != nil { + scope, err := r.authorize(ctx, input.AccessSourceID, probo.ActionAccessSourceUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.AccessSourceID) - source, err := r.accessReview.Sources(scope).ConfigureAccessSource( ctx, accessreview.ConfigureAccessSourceRequest{ @@ -663,12 +646,11 @@ func (r *mutationResolver) ConfigureAccessSource(ctx context.Context, input type // CreateAccessReviewCampaign is the resolver for the createAccessReviewCampaign field. func (r *mutationResolver) CreateAccessReviewCampaign(ctx context.Context, input types.CreateAccessReviewCampaignInput) (*types.CreateAccessReviewCampaignPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionAccessReviewCampaignCreate); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionAccessReviewCampaignCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) - var description string if input.Description != nil { description = *input.Description @@ -692,12 +674,11 @@ func (r *mutationResolver) CreateAccessReviewCampaign(ctx context.Context, input // UpdateAccessReviewCampaign is the resolver for the updateAccessReviewCampaign field. func (r *mutationResolver) UpdateAccessReviewCampaign(ctx context.Context, input types.UpdateAccessReviewCampaignInput) (*types.UpdateAccessReviewCampaignPayload, error) { - if err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignUpdate); err != nil { + scope, err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.AccessReviewCampaignID) - req := accessreview.UpdateAccessReviewCampaignRequest{ CampaignID: input.AccessReviewCampaignID, } @@ -730,12 +711,11 @@ func (r *mutationResolver) UpdateAccessReviewCampaign(ctx context.Context, input // DeleteAccessReviewCampaign is the resolver for the deleteAccessReviewCampaign field. func (r *mutationResolver) DeleteAccessReviewCampaign(ctx context.Context, input types.DeleteAccessReviewCampaignInput) (*types.DeleteAccessReviewCampaignPayload, error) { - if err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignDelete); err != nil { + scope, err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.AccessReviewCampaignID) - if err := r.accessReview.Campaigns(scope).Delete(ctx, input.AccessReviewCampaignID); err != nil { if errors.Is(err, coredata.ErrResourceNotFound) { return nil, gqlutils.NotFound(ctx, err) @@ -751,12 +731,11 @@ func (r *mutationResolver) DeleteAccessReviewCampaign(ctx context.Context, input // StartAccessReviewCampaign is the resolver for the startAccessReviewCampaign field. func (r *mutationResolver) StartAccessReviewCampaign(ctx context.Context, input types.StartAccessReviewCampaignInput) (*types.StartAccessReviewCampaignPayload, error) { - if err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignStart); err != nil { + scope, err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignStart) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.AccessReviewCampaignID) - campaign, err := r.accessReview.Campaigns(scope).Start(ctx, input.AccessReviewCampaignID) if err != nil { panic(fmt.Errorf("cannot start access review campaign: %w", err)) @@ -769,12 +748,11 @@ func (r *mutationResolver) StartAccessReviewCampaign(ctx context.Context, input // CloseAccessReviewCampaign is the resolver for the closeAccessReviewCampaign field. func (r *mutationResolver) CloseAccessReviewCampaign(ctx context.Context, input types.CloseAccessReviewCampaignInput) (*types.CloseAccessReviewCampaignPayload, error) { - if err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignClose); err != nil { + scope, err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignClose) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.AccessReviewCampaignID) - campaign, err := r.accessReview.Campaigns(scope).Close(ctx, input.AccessReviewCampaignID) if err != nil { panic(fmt.Errorf("cannot close access review campaign: %w", err)) @@ -787,12 +765,11 @@ func (r *mutationResolver) CloseAccessReviewCampaign(ctx context.Context, input // CancelAccessReviewCampaign is the resolver for the cancelAccessReviewCampaign field. func (r *mutationResolver) CancelAccessReviewCampaign(ctx context.Context, input types.CancelAccessReviewCampaignInput) (*types.CancelAccessReviewCampaignPayload, error) { - if err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignCancel); err != nil { + scope, err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignCancel) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.AccessReviewCampaignID) - campaign, err := r.accessReview.Campaigns(scope).Cancel(ctx, input.AccessReviewCampaignID) if err != nil { panic(fmt.Errorf("cannot cancel access review campaign: %w", err)) @@ -805,12 +782,11 @@ func (r *mutationResolver) CancelAccessReviewCampaign(ctx context.Context, input // AddAccessReviewCampaignScopeSource is the resolver for the addAccessReviewCampaignScopeSource field. func (r *mutationResolver) AddAccessReviewCampaignScopeSource(ctx context.Context, input types.AddAccessReviewCampaignScopeSourceInput) (*types.AddAccessReviewCampaignScopeSourcePayload, error) { - if err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignAddScopeSource); err != nil { + scope, err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignAddScopeSource) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.AccessReviewCampaignID) - campaign, err := r.accessReview.Campaigns(scope).AddScopeSource(ctx, accessreview.AddCampaignScopeSourceRequest{ CampaignID: input.AccessReviewCampaignID, AccessSourceID: input.AccessSourceID, @@ -826,12 +802,11 @@ func (r *mutationResolver) AddAccessReviewCampaignScopeSource(ctx context.Contex // RemoveAccessReviewCampaignScopeSource is the resolver for the removeAccessReviewCampaignScopeSource field. func (r *mutationResolver) RemoveAccessReviewCampaignScopeSource(ctx context.Context, input types.RemoveAccessReviewCampaignScopeSourceInput) (*types.RemoveAccessReviewCampaignScopeSourcePayload, error) { - if err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignRemoveScopeSource); err != nil { + scope, err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignRemoveScopeSource) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.AccessReviewCampaignID) - campaign, err := r.accessReview.Campaigns(scope).RemoveScopeSource(ctx, accessreview.RemoveCampaignScopeSourceRequest{ CampaignID: input.AccessReviewCampaignID, AccessSourceID: input.AccessSourceID, @@ -847,12 +822,11 @@ func (r *mutationResolver) RemoveAccessReviewCampaignScopeSource(ctx context.Con // RecordAccessEntryDecision is the resolver for the recordAccessEntryDecision field. func (r *mutationResolver) RecordAccessEntryDecision(ctx context.Context, input types.RecordAccessEntryDecisionInput) (*types.RecordAccessEntryDecisionPayload, error) { - if err := r.authorize(ctx, input.AccessEntryID, probo.ActionAccessEntryDecide); err != nil { + scope, err := r.authorize(ctx, input.AccessEntryID, probo.ActionAccessEntryDecide) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.AccessEntryID) - // Resolve the profile ID from the session's identity. // The profile may not exist for every identity, in which // case decided_by will be left nil. @@ -904,7 +878,8 @@ func (r *mutationResolver) RecordAccessEntryDecisions(ctx context.Context, input // Authorize each entry individually to prevent cross-org bypass. for _, d := range input.Decisions { - if err := r.authorize(ctx, d.AccessEntryID, probo.ActionAccessEntryDecide); err != nil { + _, err := r.authorize(ctx, d.AccessEntryID, probo.ActionAccessEntryDecide) + if err != nil { return nil, err } } @@ -968,12 +943,11 @@ func (r *mutationResolver) RecordAccessEntryDecisions(ctx context.Context, input // FlagAccessEntry is the resolver for the flagAccessEntry field. func (r *mutationResolver) FlagAccessEntry(ctx context.Context, input types.FlagAccessEntryInput) (*types.FlagAccessEntryPayload, error) { - if err := r.authorize(ctx, input.AccessEntryID, probo.ActionAccessEntryFlag); err != nil { + scope, err := r.authorize(ctx, input.AccessEntryID, probo.ActionAccessEntryFlag) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.AccessEntryID) - entry, err := r.accessReview.Entries(scope).FlagEntry(ctx, accessreview.FlagAccessEntryRequest{ EntryID: input.AccessEntryID, Flags: input.Flags, diff --git a/pkg/server/api/console/v1/asset_resolvers.go b/pkg/server/api/console/v1/asset_resolvers.go index 48641a562..0a1b986ce 100644 --- a/pkg/server/api/console/v1/asset_resolvers.go +++ b/pkg/server/api/console/v1/asset_resolvers.go @@ -25,7 +25,7 @@ import ( // Owner is the resolver for the owner field. func (r *assetResolver) Owner(ctx context.Context, obj *types.Asset) (*types.Profile, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } @@ -47,11 +47,11 @@ func (r *assetResolver) Owner(ctx context.Context, obj *types.Asset) (*types.Pro // ThirdParties is the resolver for the thirdParties field. func (r *assetResolver) ThirdParties(ctx context.Context, obj *types.Asset, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ThirdPartyOrderBy) (*types.ThirdPartyConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.ThirdPartyOrderField]{ @@ -78,11 +78,11 @@ func (r *assetResolver) ThirdParties(ctx context.Context, obj *types.Asset, firs // Organization is the resolver for the organization field. func (r *assetResolver) Organization(ctx context.Context, obj *types.Asset) (*types.Organization, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo asset, err := prb.Assets.Get(ctx, scope, obj.ID) @@ -112,11 +112,11 @@ func (r *assetResolver) Permission(ctx context.Context, obj *types.Asset, action // TotalCount is the resolver for the totalCount field. func (r *assetConnectionResolver) TotalCount(ctx context.Context, obj *types.AssetConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionAssetList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionAssetList) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) prb := r.probo switch obj.Resolver.(type) { @@ -137,7 +137,7 @@ func (r *assetConnectionResolver) TotalCount(ctx context.Context, obj *types.Ass // Owner is the resolver for the owner field. func (r *datumResolver) Owner(ctx context.Context, obj *types.Datum) (*types.Profile, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } @@ -157,11 +157,11 @@ func (r *datumResolver) Owner(ctx context.Context, obj *types.Datum) (*types.Pro // ThirdParties is the resolver for the thirdParties field. func (r *datumResolver) ThirdParties(ctx context.Context, obj *types.Datum, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ThirdPartyOrderBy) (*types.ThirdPartyConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.ThirdPartyOrderField]{ @@ -188,7 +188,7 @@ func (r *datumResolver) ThirdParties(ctx context.Context, obj *types.Datum, firs // Organization is the resolver for the organization field. func (r *datumResolver) Organization(ctx context.Context, obj *types.Datum) (*types.Organization, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { return nil, err } @@ -215,11 +215,11 @@ func (r *datumResolver) Permission(ctx context.Context, obj *types.Datum, action // TotalCount is the resolver for the totalCount field. func (r *datumConnectionResolver) TotalCount(ctx context.Context, obj *types.DatumConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionDatumList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionDatumList) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) prb := r.probo switch obj.Resolver.(type) { @@ -240,11 +240,11 @@ func (r *datumConnectionResolver) TotalCount(ctx context.Context, obj *types.Dat // CreateAsset is the resolver for the createAsset field. func (r *mutationResolver) CreateAsset(ctx context.Context, input types.CreateAssetInput) (*types.CreateAssetPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionAssetCreate); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionAssetCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo asset, err := prb.Assets.Create( @@ -276,11 +276,11 @@ func (r *mutationResolver) CreateAsset(ctx context.Context, input types.CreateAs // UpdateAsset is the resolver for the updateAsset field. func (r *mutationResolver) UpdateAsset(ctx context.Context, input types.UpdateAssetInput) (*types.UpdateAssetPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionAssetUpdate); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionAssetUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo asset, err := prb.Assets.Update( @@ -312,15 +312,14 @@ func (r *mutationResolver) UpdateAsset(ctx context.Context, input types.UpdateAs // DeleteAsset is the resolver for the deleteAsset field. func (r *mutationResolver) DeleteAsset(ctx context.Context, input types.DeleteAssetInput) (*types.DeleteAssetPayload, error) { - if err := r.authorize(ctx, input.AssetID, probo.ActionAssetDelete); err != nil { + scope, err := r.authorize(ctx, input.AssetID, probo.ActionAssetDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.AssetID) prb := r.probo - err := prb.Assets.Delete(ctx, scope, input.AssetID) - if err != nil { + if err := prb.Assets.Delete(ctx, scope, input.AssetID); err != nil { r.logger.ErrorCtx(ctx, "cannot delete asset", log.Error(err)) return nil, gqlutils.Internal(ctx) } @@ -332,11 +331,11 @@ func (r *mutationResolver) DeleteAsset(ctx context.Context, input types.DeleteAs // CreateDatum is the resolver for the createDatum field. func (r *mutationResolver) CreateDatum(ctx context.Context, input types.CreateDatumInput) (*types.CreateDatumPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionDatumCreate); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionDatumCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo data, err := prb.Data.Create( @@ -366,11 +365,11 @@ func (r *mutationResolver) CreateDatum(ctx context.Context, input types.CreateDa // UpdateDatum is the resolver for the updateDatum field. func (r *mutationResolver) UpdateDatum(ctx context.Context, input types.UpdateDatumInput) (*types.UpdateDatumPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionDatumUpdate); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionDatumUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo datum, err := prb.Data.Update( @@ -400,11 +399,11 @@ func (r *mutationResolver) UpdateDatum(ctx context.Context, input types.UpdateDa // DeleteDatum is the resolver for the deleteDatum field. func (r *mutationResolver) DeleteDatum(ctx context.Context, input types.DeleteDatumInput) (*types.DeleteDatumPayload, error) { - if err := r.authorize(ctx, input.DatumID, probo.ActionDatumDelete); err != nil { + scope, err := r.authorize(ctx, input.DatumID, probo.ActionDatumDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.DatumID) prb := r.probo if err := prb.Data.Delete(ctx, scope, input.DatumID); err != nil { @@ -419,11 +418,11 @@ func (r *mutationResolver) DeleteDatum(ctx context.Context, input types.DeleteDa // PublishDataList is the resolver for the publishDataList field. func (r *mutationResolver) PublishDataList(ctx context.Context, input types.PublishDataListInput) (*types.PublishDataListPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionDatumPublish); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionDatumPublish) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo document, documentVersion, err := prb.GeneratedDocuments.PublishDataList(ctx, scope, input.OrganizationID, input.ApproverIds, input.Minor) @@ -449,11 +448,11 @@ func (r *mutationResolver) PublishDataList(ctx context.Context, input types.Publ // PublishAssetList is the resolver for the publishAssetList field. func (r *mutationResolver) PublishAssetList(ctx context.Context, input types.PublishAssetListInput) (*types.PublishAssetListPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionAssetPublish); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionAssetPublish) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo document, documentVersion, err := prb.GeneratedDocuments.PublishAssetList(ctx, scope, input.OrganizationID, input.ApproverIds, input.Minor) diff --git a/pkg/server/api/console/v1/audit_resolvers.go b/pkg/server/api/console/v1/audit_resolvers.go index 9ae1816fe..c58172f6c 100644 --- a/pkg/server/api/console/v1/audit_resolvers.go +++ b/pkg/server/api/console/v1/audit_resolvers.go @@ -26,7 +26,7 @@ import ( // Organization is the resolver for the organization field. func (r *auditResolver) Organization(ctx context.Context, obj *types.Audit) (*types.Organization, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { return nil, err } @@ -48,7 +48,7 @@ func (r *auditResolver) Organization(ctx context.Context, obj *types.Audit) (*ty // Framework is the resolver for the framework field. func (r *auditResolver) Framework(ctx context.Context, obj *types.Audit) (*types.Framework, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionFrameworkGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionFrameworkGet); err != nil { return nil, err } @@ -70,7 +70,7 @@ func (r *auditResolver) Framework(ctx context.Context, obj *types.Audit) (*types // Report is the resolver for the report field. func (r *auditResolver) Report(ctx context.Context, obj *types.Audit) (*types.Report, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionReportGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionReportGet); err != nil { return nil, err } @@ -96,7 +96,8 @@ func (r *auditResolver) Report(ctx context.Context, obj *types.Audit) (*types.Re // ReportURL is the resolver for the reportUrl field. func (r *auditResolver) ReportURL(ctx context.Context, obj *types.Audit) (*string, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionReportGetReportUrl); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionReportGetReportUrl) + if err != nil { return nil, err } @@ -104,7 +105,6 @@ func (r *auditResolver) ReportURL(ctx context.Context, obj *types.Audit) (*strin return nil, nil } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo url, err := prb.Audits.GenerateReportURL(ctx, scope, obj.ID, 15*time.Minute) @@ -118,11 +118,11 @@ func (r *auditResolver) ReportURL(ctx context.Context, obj *types.Audit) (*strin // Controls is the resolver for the controls field. func (r *auditResolver) Controls(ctx context.Context, obj *types.Audit, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy, filter *types.ControlFilter) (*types.ControlConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionControlList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionControlList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.ControlOrderField]{ @@ -154,11 +154,11 @@ func (r *auditResolver) Controls(ctx context.Context, obj *types.Audit, first *i // Findings is the resolver for the findings field. func (r *auditResolver) Findings(ctx context.Context, obj *types.Audit, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.FindingOrder, filter *types.FindingFilter) (*types.FindingConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionFindingList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionFindingList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.FindingOrderField]{ @@ -205,11 +205,11 @@ func (r *auditResolver) Permission(ctx context.Context, obj *types.Audit, action // TotalCount is the resolver for the totalCount field. func (r *auditConnectionResolver) TotalCount(ctx context.Context, obj *types.AuditConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionAuditList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionAuditList) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) prb := r.probo switch obj.Resolver.(type) { @@ -245,7 +245,7 @@ func (r *auditConnectionResolver) TotalCount(ctx context.Context, obj *types.Aud // Organization is the resolver for the organization field. func (r *findingResolver) Organization(ctx context.Context, obj *types.Finding) (*types.Organization, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { return nil, err } @@ -267,11 +267,11 @@ func (r *findingResolver) Organization(ctx context.Context, obj *types.Finding) // Audits is the resolver for the audits field. func (r *findingResolver) Audits(ctx context.Context, obj *types.Finding, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AuditOrderBy) (*types.AuditConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionAuditList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionAuditList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.AuditOrderField]{ @@ -302,7 +302,7 @@ func (r *findingResolver) Owner(ctx context.Context, obj *types.Finding) (*types return nil, nil } - if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } @@ -328,7 +328,7 @@ func (r *findingResolver) Risk(ctx context.Context, obj *types.Finding) (*types. return nil, nil } - if err := r.authorize(ctx, obj.ID, probo.ActionRiskGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionRiskGet); err != nil { return nil, err } @@ -355,11 +355,11 @@ func (r *findingResolver) Permission(ctx context.Context, obj *types.Finding, ac // TotalCount is the resolver for the totalCount field. func (r *findingConnectionResolver) TotalCount(ctx context.Context, obj *types.FindingConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionFindingList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionFindingList) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) prb := r.probo var ( @@ -403,11 +403,11 @@ func (r *findingConnectionResolver) TotalCount(ctx context.Context, obj *types.F // CreateAudit is the resolver for the createAudit field. func (r *mutationResolver) CreateAudit(ctx context.Context, input types.CreateAuditInput) (*types.CreateAuditPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionAuditCreate); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionAuditCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo req := probo.CreateAuditRequest{ @@ -461,11 +461,11 @@ func (r *mutationResolver) CreateAudit(ctx context.Context, input types.CreateAu // UpdateAudit is the resolver for the updateAudit field. func (r *mutationResolver) UpdateAudit(ctx context.Context, input types.UpdateAuditInput) (*types.UpdateAuditPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionAuditUpdate); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionAuditUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo req := probo.UpdateAuditRequest{ @@ -495,15 +495,14 @@ func (r *mutationResolver) UpdateAudit(ctx context.Context, input types.UpdateAu // DeleteAudit is the resolver for the deleteAudit field. func (r *mutationResolver) DeleteAudit(ctx context.Context, input types.DeleteAuditInput) (*types.DeleteAuditPayload, error) { - if err := r.authorize(ctx, input.AuditID, probo.ActionAuditDelete); err != nil { + scope, err := r.authorize(ctx, input.AuditID, probo.ActionAuditDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.AuditID) prb := r.probo - err := prb.Audits.Delete(ctx, scope, input.AuditID) - if err != nil { + if err := prb.Audits.Delete(ctx, scope, input.AuditID); err != nil { r.logger.ErrorCtx(ctx, "cannot delete audit", log.Error(err)) return nil, gqlutils.Internal(ctx) } @@ -515,11 +514,11 @@ func (r *mutationResolver) DeleteAudit(ctx context.Context, input types.DeleteAu // UploadAuditReport is the resolver for the uploadAuditReport field. func (r *mutationResolver) UploadAuditReport(ctx context.Context, input types.UploadAuditReportInput) (*types.UploadAuditReportPayload, error) { - if err := r.authorize(ctx, input.AuditID, probo.ActionAuditReportUpload); err != nil { + scope, err := r.authorize(ctx, input.AuditID, probo.ActionAuditReportUpload) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.AuditID) prb := r.probo req := probo.UploadAuditReportRequest{ @@ -550,11 +549,11 @@ func (r *mutationResolver) UploadAuditReport(ctx context.Context, input types.Up // DeleteAuditReport is the resolver for the deleteAuditReport field. func (r *mutationResolver) DeleteAuditReport(ctx context.Context, input types.DeleteAuditReportInput) (*types.DeleteAuditReportPayload, error) { - if err := r.authorize(ctx, input.AuditID, probo.ActionAuditReportDelete); err != nil { + scope, err := r.authorize(ctx, input.AuditID, probo.ActionAuditReportDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.AuditID) prb := r.probo audit, err := prb.Audits.DeleteReport(ctx, scope, input.AuditID) @@ -570,11 +569,11 @@ func (r *mutationResolver) DeleteAuditReport(ctx context.Context, input types.De // CreateFinding is the resolver for the createFinding field. func (r *mutationResolver) CreateFinding(ctx context.Context, input types.CreateFindingInput) (*types.CreateFindingPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionFindingCreate); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionFindingCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo req := probo.CreateFindingRequest{ @@ -611,11 +610,11 @@ func (r *mutationResolver) CreateFinding(ctx context.Context, input types.Create // UpdateFinding is the resolver for the updateFinding field. func (r *mutationResolver) UpdateFinding(ctx context.Context, input types.UpdateFindingInput) (*types.UpdateFindingPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionFindingUpdate); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionFindingUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo req := probo.UpdateFindingRequest{ @@ -651,15 +650,14 @@ func (r *mutationResolver) UpdateFinding(ctx context.Context, input types.Update // DeleteFinding is the resolver for the deleteFinding field. func (r *mutationResolver) DeleteFinding(ctx context.Context, input types.DeleteFindingInput) (*types.DeleteFindingPayload, error) { - if err := r.authorize(ctx, input.FindingID, probo.ActionFindingDelete); err != nil { + scope, err := r.authorize(ctx, input.FindingID, probo.ActionFindingDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.FindingID) prb := r.probo - err := prb.Findings.Delete(ctx, scope, input.FindingID) - if err != nil { + if err := prb.Findings.Delete(ctx, scope, input.FindingID); err != nil { r.logger.ErrorCtx(ctx, "cannot delete finding", log.Error(err)) return nil, gqlutils.Internal(ctx) } @@ -671,11 +669,11 @@ func (r *mutationResolver) DeleteFinding(ctx context.Context, input types.Delete // CreateFindingAuditMapping is the resolver for the createFindingAuditMapping field. func (r *mutationResolver) CreateFindingAuditMapping(ctx context.Context, input types.CreateFindingAuditMappingInput) (*types.CreateFindingAuditMappingPayload, error) { - if err := r.authorize(ctx, input.FindingID, probo.ActionFindingAuditMappingCreate); err != nil { + scope, err := r.authorize(ctx, input.FindingID, probo.ActionFindingAuditMappingCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.FindingID) prb := r.probo finding, audit, err := prb.Findings.CreateAuditMapping(ctx, scope, input.FindingID, input.AuditID, input.ReferenceID) @@ -692,11 +690,11 @@ func (r *mutationResolver) CreateFindingAuditMapping(ctx context.Context, input // DeleteFindingAuditMapping is the resolver for the deleteFindingAuditMapping field. func (r *mutationResolver) DeleteFindingAuditMapping(ctx context.Context, input types.DeleteFindingAuditMappingInput) (*types.DeleteFindingAuditMappingPayload, error) { - if err := r.authorize(ctx, input.FindingID, probo.ActionFindingAuditMappingDelete); err != nil { + scope, err := r.authorize(ctx, input.FindingID, probo.ActionFindingAuditMappingDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.FindingID) prb := r.probo finding, audit, err := prb.Findings.DeleteAuditMapping(ctx, scope, input.FindingID, input.AuditID) @@ -713,11 +711,11 @@ func (r *mutationResolver) DeleteFindingAuditMapping(ctx context.Context, input // PublishFindingList is the resolver for the publishFindingList field. func (r *mutationResolver) PublishFindingList(ctx context.Context, input types.PublishFindingListInput) (*types.PublishFindingListPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionFindingPublish); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionFindingPublish) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo document, documentVersion, err := prb.GeneratedDocuments.PublishFindingList(ctx, scope, input.OrganizationID, input.ApproverIds, input.Minor) @@ -743,11 +741,11 @@ func (r *mutationResolver) PublishFindingList(ctx context.Context, input types.P // DownloadURL is the resolver for the downloadUrl field. func (r *reportResolver) DownloadURL(ctx context.Context, obj *types.Report) (*string, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionReportDownloadUrlGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionReportDownloadUrlGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo url, err := prb.Reports.GenerateDownloadURL(ctx, scope, obj.ID, 15*time.Minute) @@ -761,11 +759,11 @@ func (r *reportResolver) DownloadURL(ctx context.Context, obj *types.Report) (*s // Audit is the resolver for the audit field. func (r *reportResolver) Audit(ctx context.Context, obj *types.Report) (*types.Audit, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionAuditGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionAuditGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo audit, err := prb.Audits.GetByReportID(ctx, scope, obj.ID) diff --git a/pkg/server/api/console/v1/base_resolvers.go b/pkg/server/api/console/v1/base_resolvers.go index de8552ca0..41915fe55 100644 --- a/pkg/server/api/console/v1/base_resolvers.go +++ b/pkg/server/api/console/v1/base_resolvers.go @@ -498,7 +498,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error default: } - if err := r.authorize(ctx, id, action); err != nil { + if _, err := r.authorize(ctx, id, action); err != nil { return nil, err } diff --git a/pkg/server/api/console/v1/connector_initiate.go b/pkg/server/api/console/v1/connector_initiate.go index 8864d4bdb..d618f7483 100644 --- a/pkg/server/api/console/v1/connector_initiate.go +++ b/pkg/server/api/console/v1/connector_initiate.go @@ -72,18 +72,18 @@ func handleConnectorInitiate( return } - if err := iamSvc.Authorizer.Authorize(r.Context(), iam.AuthorizeParams{ + scope, err := iamSvc.Authorizer.Authorize(r.Context(), iam.AuthorizeParams{ Principal: identity.ID, Resource: organizationID, Session: &session.ID, Action: probo.ActionConnectorInitiate, - }); err != nil { + }) + if err != nil { httpserver.RenderError(w, http.StatusForbidden, err) return } requestedScopes := r.URL.Query()["scope"] - scope := coredata.NewScopeFromObjectID(organizationID) prb := proboSvc // Look up any existing connector so we can union its stored scopes diff --git a/pkg/server/api/console/v1/connector_resolvers.go b/pkg/server/api/console/v1/connector_resolvers.go index e71059568..31717711b 100644 --- a/pkg/server/api/console/v1/connector_resolvers.go +++ b/pkg/server/api/console/v1/connector_resolvers.go @@ -32,11 +32,11 @@ func (r *connectorResolver) Oauth2Scopes(ctx context.Context, obj *types.Connect // CreateAPIKeyConnector is the resolver for the createAPIKeyConnector field. func (r *mutationResolver) CreateAPIKeyConnector(ctx context.Context, input types.CreateAPIKeyConnectorInput) (*types.CreateAPIKeyConnectorPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionConnectorCreate); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionConnectorCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo req := probo.CreateConnectorRequest{ @@ -92,11 +92,11 @@ func (r *mutationResolver) CreateAPIKeyConnector(ctx context.Context, input type // CreateClientCredentialsConnector is the resolver for the createClientCredentialsConnector field. func (r *mutationResolver) CreateClientCredentialsConnector(ctx context.Context, input types.CreateClientCredentialsConnectorInput) (*types.CreateClientCredentialsConnectorPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionConnectorCreate); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionConnectorCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo oauth2Conn := &connector.OAuth2Connection{ @@ -139,11 +139,11 @@ func (r *mutationResolver) CreateClientCredentialsConnector(ctx context.Context, // DeleteConnector is the resolver for the deleteConnector field. func (r *mutationResolver) DeleteConnector(ctx context.Context, input types.DeleteConnectorInput) (*types.DeleteConnectorPayload, error) { - if err := r.authorize(ctx, input.ConnectorID, probo.ActionConnectorDelete); err != nil { + scope, err := r.authorize(ctx, input.ConnectorID, probo.ActionConnectorDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ConnectorID) prb := r.probo if err := prb.Connectors.Delete(ctx, scope, input.ConnectorID); err != nil { @@ -157,15 +157,14 @@ func (r *mutationResolver) DeleteConnector(ctx context.Context, input types.Dele // DeleteSlackConnection is the resolver for the deleteSlackConnection field. func (r *mutationResolver) DeleteSlackConnection(ctx context.Context, input types.DeleteSlackConnectionInput) (*types.DeleteSlackConnectionPayload, error) { - if err := r.authorize(ctx, input.SlackConnectionID, probo.ActionConnectorDelete); err != nil { + scope, err := r.authorize(ctx, input.SlackConnectionID, probo.ActionConnectorDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.SlackConnectionID) prb := r.probo - err := prb.Connectors.Delete(ctx, scope, input.SlackConnectionID) - if err != nil { + if err := prb.Connectors.Delete(ctx, scope, input.SlackConnectionID); err != nil { r.logger.ErrorCtx(ctx, "cannot delete slack connection", log.Error(err)) return nil, gqlutils.Internal(ctx) } diff --git a/pkg/server/api/console/v1/control_resolvers.go b/pkg/server/api/console/v1/control_resolvers.go index a3c99a0cf..d0e54169b 100644 --- a/pkg/server/api/console/v1/control_resolvers.go +++ b/pkg/server/api/console/v1/control_resolvers.go @@ -24,11 +24,11 @@ import ( // StatementOfApplicability is the resolver for the statementOfApplicability field. func (r *applicabilityStatementResolver) StatementOfApplicability(ctx context.Context, obj *types.ApplicabilityStatement) (*types.StatementOfApplicability, error) { - if err := r.authorize(ctx, obj.StatementOfApplicability.ID, probo.ActionStatementOfApplicabilityGet); err != nil { + scope, err := r.authorize(ctx, obj.StatementOfApplicability.ID, probo.ActionStatementOfApplicabilityGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.StatementOfApplicability.ID) prb := r.probo soa, err := prb.StatementsOfApplicability.Get(ctx, scope, obj.StatementOfApplicability.ID) @@ -42,7 +42,7 @@ func (r *applicabilityStatementResolver) StatementOfApplicability(ctx context.Co // Control is the resolver for the control field. func (r *applicabilityStatementResolver) Control(ctx context.Context, obj *types.ApplicabilityStatement) (*types.Control, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionControlGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionControlGet); err != nil { return nil, err } @@ -69,11 +69,11 @@ func (r *applicabilityStatementResolver) Permission(ctx context.Context, obj *ty // TotalCount is the resolver for the totalCount field. func (r *applicabilityStatementConnectionResolver) TotalCount(ctx context.Context, obj *types.ApplicabilityStatementConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionApplicabilityStatementList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionApplicabilityStatementList) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) prb := r.probo switch obj.Resolver.(type) { @@ -94,7 +94,7 @@ func (r *applicabilityStatementConnectionResolver) TotalCount(ctx context.Contex // Organization is the resolver for the organization field. func (r *controlResolver) Organization(ctx context.Context, obj *types.Control) (*types.Organization, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { return nil, err } @@ -158,7 +158,7 @@ func (r *controlResolver) RiskAssessment(ctx context.Context, obj *types.Control // Framework is the resolver for the framework field. func (r *controlResolver) Framework(ctx context.Context, obj *types.Control) (*types.Framework, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionFrameworkGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionFrameworkGet); err != nil { return nil, err } @@ -180,11 +180,11 @@ func (r *controlResolver) Framework(ctx context.Context, obj *types.Control) (*t // Measures is the resolver for the measures field. func (r *controlResolver) Measures(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.MeasureOrderBy, filter *types.MeasureFilter) (*types.MeasureConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionMeasureList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionMeasureList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.MeasureOrderField]{ @@ -216,11 +216,11 @@ func (r *controlResolver) Measures(ctx context.Context, obj *types.Control, firs // Documents is the resolver for the documents field. func (r *controlResolver) Documents(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentOrderBy, filter *types.DocumentFilter) (*types.DocumentConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionDocumentList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.DocumentOrderField]{ @@ -255,11 +255,11 @@ func (r *controlResolver) Documents(ctx context.Context, obj *types.Control, fir // Audits is the resolver for the audits field. func (r *controlResolver) Audits(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AuditOrderBy) (*types.AuditConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionAuditList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionAuditList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.AuditOrderField]{ @@ -286,11 +286,11 @@ func (r *controlResolver) Audits(ctx context.Context, obj *types.Control, first // Obligations is the resolver for the obligations field. func (r *controlResolver) Obligations(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ObligationOrderBy) (*types.ObligationConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionObligationList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionObligationList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.ObligationOrderField]{ @@ -322,11 +322,11 @@ func (r *controlResolver) Permission(ctx context.Context, obj *types.Control, ac // TotalCount is the resolver for the totalCount field. func (r *controlConnectionResolver) TotalCount(ctx context.Context, obj *types.ControlConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionControlList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionControlList) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) prb := r.probo switch obj.Resolver.(type) { @@ -387,11 +387,11 @@ func (r *controlConnectionResolver) TotalCount(ctx context.Context, obj *types.C // CreateControl is the resolver for the createControl field. func (r *mutationResolver) CreateControl(ctx context.Context, input types.CreateControlInput) (*types.CreateControlPayload, error) { - if err := r.authorize(ctx, input.FrameworkID, probo.ActionControlCreate); err != nil { + scope, err := r.authorize(ctx, input.FrameworkID, probo.ActionControlCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.FrameworkID) prb := r.probo control, err := prb.Controls.Create( @@ -427,11 +427,11 @@ func (r *mutationResolver) CreateControl(ctx context.Context, input types.Create // UpdateControl is the resolver for the updateControl field. func (r *mutationResolver) UpdateControl(ctx context.Context, input types.UpdateControlInput) (*types.UpdateControlPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionControlUpdate); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionControlUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo control, err := prb.Controls.Update( @@ -467,15 +467,14 @@ func (r *mutationResolver) UpdateControl(ctx context.Context, input types.Update // DeleteControl is the resolver for the deleteControl field. func (r *mutationResolver) DeleteControl(ctx context.Context, input types.DeleteControlInput) (*types.DeleteControlPayload, error) { - if err := r.authorize(ctx, input.ControlID, probo.ActionControlDelete); err != nil { + scope, err := r.authorize(ctx, input.ControlID, probo.ActionControlDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ControlID) prb := r.probo - err := prb.Controls.Delete(ctx, scope, input.ControlID) - if err != nil { + if err := prb.Controls.Delete(ctx, scope, input.ControlID); err != nil { r.logger.ErrorCtx(ctx, "cannot delete control", log.Error(err)) return nil, gqlutils.Internal(ctx) } @@ -487,11 +486,11 @@ func (r *mutationResolver) DeleteControl(ctx context.Context, input types.Delete // CreateControlMeasureMapping is the resolver for the createControlMeasureMapping field. func (r *mutationResolver) CreateControlMeasureMapping(ctx context.Context, input types.CreateControlMeasureMappingInput) (*types.CreateControlMeasureMappingPayload, error) { - if err := r.authorize(ctx, input.ControlID, probo.ActionControlMeasureMappingCreate); err != nil { + scope, err := r.authorize(ctx, input.ControlID, probo.ActionControlMeasureMappingCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.MeasureID) prb := r.probo control, measure, err := prb.Controls.CreateMeasureMapping(ctx, scope, input.ControlID, input.MeasureID) @@ -508,11 +507,11 @@ func (r *mutationResolver) CreateControlMeasureMapping(ctx context.Context, inpu // CreateControlDocumentMapping is the resolver for the createControlDocumentMapping field. func (r *mutationResolver) CreateControlDocumentMapping(ctx context.Context, input types.CreateControlDocumentMappingInput) (*types.CreateControlDocumentMappingPayload, error) { - if err := r.authorize(ctx, input.ControlID, probo.ActionControlDocumentMappingCreate); err != nil { + scope, err := r.authorize(ctx, input.ControlID, probo.ActionControlDocumentMappingCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.DocumentID) prb := r.probo control, document, err := prb.Controls.CreateDocumentMapping(ctx, scope, input.ControlID, input.DocumentID) @@ -534,11 +533,11 @@ func (r *mutationResolver) CreateControlDocumentMapping(ctx context.Context, inp // DeleteControlMeasureMapping is the resolver for the deleteControlMeasureMapping field. func (r *mutationResolver) DeleteControlMeasureMapping(ctx context.Context, input types.DeleteControlMeasureMappingInput) (*types.DeleteControlMeasureMappingPayload, error) { - if err := r.authorize(ctx, input.ControlID, probo.ActionControlMeasureMappingDelete); err != nil { + scope, err := r.authorize(ctx, input.ControlID, probo.ActionControlMeasureMappingDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.MeasureID) prb := r.probo control, measure, err := prb.Controls.DeleteMeasureMapping(ctx, scope, input.ControlID, input.MeasureID) @@ -555,11 +554,11 @@ func (r *mutationResolver) DeleteControlMeasureMapping(ctx context.Context, inpu // DeleteControlDocumentMapping is the resolver for the deleteControlDocumentMapping field. func (r *mutationResolver) DeleteControlDocumentMapping(ctx context.Context, input types.DeleteControlDocumentMappingInput) (*types.DeleteControlDocumentMappingPayload, error) { - if err := r.authorize(ctx, input.ControlID, probo.ActionControlDocumentMappingDelete); err != nil { + scope, err := r.authorize(ctx, input.ControlID, probo.ActionControlDocumentMappingDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.DocumentID) prb := r.probo control, document, err := prb.Controls.DeleteDocumentMapping(ctx, scope, input.ControlID, input.DocumentID) @@ -576,11 +575,11 @@ func (r *mutationResolver) DeleteControlDocumentMapping(ctx context.Context, inp // CreateApplicabilityStatement is the resolver for the createApplicabilityStatement field. func (r *mutationResolver) CreateApplicabilityStatement(ctx context.Context, input types.CreateApplicabilityStatementInput) (*types.CreateApplicabilityStatementPayload, error) { - if err := r.authorize(ctx, input.ControlID, probo.ActionApplicabilityStatementCreate); err != nil { + scope, err := r.authorize(ctx, input.ControlID, probo.ActionApplicabilityStatementCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.StatementOfApplicabilityID) prb := r.probo applicabilityStatement, err := prb.StatementsOfApplicability.CreateApplicabilityStatement(ctx, scope, input.StatementOfApplicabilityID, input.ControlID, input.Applicability, input.Justification) @@ -596,11 +595,11 @@ func (r *mutationResolver) CreateApplicabilityStatement(ctx context.Context, inp // UpdateApplicabilityStatement is the resolver for the updateApplicabilityStatement field. func (r *mutationResolver) UpdateApplicabilityStatement(ctx context.Context, input types.UpdateApplicabilityStatementInput) (*types.UpdateApplicabilityStatementPayload, error) { - if err := r.authorize(ctx, input.ApplicabilityStatementID, probo.ActionApplicabilityStatementUpdate); err != nil { + scope, err := r.authorize(ctx, input.ApplicabilityStatementID, probo.ActionApplicabilityStatementUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ApplicabilityStatementID) prb := r.probo applicabilityStatement, err := prb.StatementsOfApplicability.UpdateApplicabilityStatement(ctx, scope, input.ApplicabilityStatementID, input.Applicability, input.Justification) @@ -616,15 +615,14 @@ func (r *mutationResolver) UpdateApplicabilityStatement(ctx context.Context, inp // DeleteApplicabilityStatement is the resolver for the deleteApplicabilityStatement field. func (r *mutationResolver) DeleteApplicabilityStatement(ctx context.Context, input types.DeleteApplicabilityStatementInput) (*types.DeleteApplicabilityStatementPayload, error) { - if err := r.authorize(ctx, input.ApplicabilityStatementID, probo.ActionApplicabilityStatementDelete); err != nil { + scope, err := r.authorize(ctx, input.ApplicabilityStatementID, probo.ActionApplicabilityStatementDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ApplicabilityStatementID) prb := r.probo - err := prb.StatementsOfApplicability.DeleteApplicabilityStatement(ctx, scope, input.ApplicabilityStatementID) - if err != nil { + if err := prb.StatementsOfApplicability.DeleteApplicabilityStatement(ctx, scope, input.ApplicabilityStatementID); err != nil { r.logger.ErrorCtx(ctx, "cannot delete applicability statement", log.Error(err)) return nil, gqlutils.Internal(ctx) } @@ -636,11 +634,11 @@ func (r *mutationResolver) DeleteApplicabilityStatement(ctx context.Context, inp // CreateControlAuditMapping is the resolver for the createControlAuditMapping field. func (r *mutationResolver) CreateControlAuditMapping(ctx context.Context, input types.CreateControlAuditMappingInput) (*types.CreateControlAuditMappingPayload, error) { - if err := r.authorize(ctx, input.ControlID, probo.ActionControlAuditMappingCreate); err != nil { + scope, err := r.authorize(ctx, input.ControlID, probo.ActionControlAuditMappingCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.AuditID) prb := r.probo control, audit, err := prb.Controls.CreateAuditMapping(ctx, scope, input.ControlID, input.AuditID) @@ -657,11 +655,11 @@ func (r *mutationResolver) CreateControlAuditMapping(ctx context.Context, input // DeleteControlAuditMapping is the resolver for the deleteControlAuditMapping field. func (r *mutationResolver) DeleteControlAuditMapping(ctx context.Context, input types.DeleteControlAuditMappingInput) (*types.DeleteControlAuditMappingPayload, error) { - if err := r.authorize(ctx, input.ControlID, probo.ActionControlAuditMappingDelete); err != nil { + scope, err := r.authorize(ctx, input.ControlID, probo.ActionControlAuditMappingDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.AuditID) prb := r.probo control, audit, err := prb.Controls.DeleteAuditMapping(ctx, scope, input.ControlID, input.AuditID) @@ -678,11 +676,11 @@ func (r *mutationResolver) DeleteControlAuditMapping(ctx context.Context, input // CreateControlObligationMapping is the resolver for the createControlObligationMapping field. func (r *mutationResolver) CreateControlObligationMapping(ctx context.Context, input types.CreateControlObligationMappingInput) (*types.CreateControlObligationMappingPayload, error) { - if err := r.authorize(ctx, input.ControlID, probo.ActionControlObligationMappingCreate); err != nil { + scope, err := r.authorize(ctx, input.ControlID, probo.ActionControlObligationMappingCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ObligationID) prb := r.probo control, obligation, err := prb.Controls.CreateObligationMapping(ctx, scope, input.ControlID, input.ObligationID) @@ -699,11 +697,11 @@ func (r *mutationResolver) CreateControlObligationMapping(ctx context.Context, i // DeleteControlObligationMapping is the resolver for the deleteControlObligationMapping field. func (r *mutationResolver) DeleteControlObligationMapping(ctx context.Context, input types.DeleteControlObligationMappingInput) (*types.DeleteControlObligationMappingPayload, error) { - if err := r.authorize(ctx, input.ControlID, probo.ActionControlObligationMappingDelete); err != nil { + scope, err := r.authorize(ctx, input.ControlID, probo.ActionControlObligationMappingDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ObligationID) prb := r.probo control, obligation, err := prb.Controls.DeleteObligationMapping(ctx, scope, input.ControlID, input.ObligationID) @@ -720,11 +718,11 @@ func (r *mutationResolver) DeleteControlObligationMapping(ctx context.Context, i // CreateStatementOfApplicability is the resolver for the createStatementOfApplicability field. func (r *mutationResolver) CreateStatementOfApplicability(ctx context.Context, input types.CreateStatementOfApplicabilityInput) (*types.CreateStatementOfApplicabilityPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionStatementOfApplicabilityCreate); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionStatementOfApplicabilityCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo statementOfApplicability, err := prb.StatementsOfApplicability.Create( @@ -755,11 +753,11 @@ func (r *mutationResolver) CreateStatementOfApplicability(ctx context.Context, i // UpdateStatementOfApplicability is the resolver for the updateStatementOfApplicability field. func (r *mutationResolver) UpdateStatementOfApplicability(ctx context.Context, input types.UpdateStatementOfApplicabilityInput) (*types.UpdateStatementOfApplicabilityPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionStatementOfApplicabilityUpdate); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionStatementOfApplicabilityUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo var name *string @@ -795,15 +793,14 @@ func (r *mutationResolver) UpdateStatementOfApplicability(ctx context.Context, i // DeleteStatementOfApplicability is the resolver for the deleteStatementOfApplicability field. func (r *mutationResolver) DeleteStatementOfApplicability(ctx context.Context, input types.DeleteStatementOfApplicabilityInput) (*types.DeleteStatementOfApplicabilityPayload, error) { - if err := r.authorize(ctx, input.StatementOfApplicabilityID, probo.ActionStatementOfApplicabilityDelete); err != nil { + scope, err := r.authorize(ctx, input.StatementOfApplicabilityID, probo.ActionStatementOfApplicabilityDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.StatementOfApplicabilityID) prb := r.probo - err := prb.StatementsOfApplicability.Delete(ctx, scope, input.StatementOfApplicabilityID) - if err != nil { + if err := prb.StatementsOfApplicability.Delete(ctx, scope, input.StatementOfApplicabilityID); err != nil { r.logger.ErrorCtx(ctx, "cannot delete statement_of_applicability", log.Error(err)) return nil, gqlutils.Internal(ctx) } @@ -815,11 +812,11 @@ func (r *mutationResolver) DeleteStatementOfApplicability(ctx context.Context, i // PublishStatementOfApplicability is the resolver for the publishStatementOfApplicability field. func (r *mutationResolver) PublishStatementOfApplicability(ctx context.Context, input types.PublishStatementOfApplicabilityInput) (*types.PublishStatementOfApplicabilityPayload, error) { - if err := r.authorize(ctx, input.StatementOfApplicabilityID, probo.ActionStatementOfApplicabilityPublish); err != nil { + scope, err := r.authorize(ctx, input.StatementOfApplicabilityID, probo.ActionStatementOfApplicabilityPublish) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.StatementOfApplicabilityID) prb := r.probo document, documentVersion, err := prb.GeneratedDocuments.PublishStatementOfApplicability(ctx, scope, input.StatementOfApplicabilityID, input.ApproverIds, input.Minor) @@ -849,11 +846,11 @@ func (r *statementOfApplicabilityResolver) Document(ctx context.Context, obj *ty return nil, nil } - if err := r.authorize(ctx, obj.Document.ID, probo.ActionDocumentGet); err != nil { + scope, err := r.authorize(ctx, obj.Document.ID, probo.ActionDocumentGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.Document.ID) prb := r.probo document, err := prb.Documents.Get(ctx, scope, obj.Document.ID) @@ -872,7 +869,7 @@ func (r *statementOfApplicabilityResolver) Document(ctx context.Context, obj *ty // Organization is the resolver for the organization field. func (r *statementOfApplicabilityResolver) Organization(ctx context.Context, obj *types.StatementOfApplicability) (*types.Organization, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { return nil, err } @@ -894,11 +891,11 @@ func (r *statementOfApplicabilityResolver) Organization(ctx context.Context, obj // ApplicabilityStatements is the resolver for the applicabilityStatements field. func (r *statementOfApplicabilityResolver) ApplicabilityStatements(ctx context.Context, obj *types.StatementOfApplicability, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ApplicabilityStatementOrderBy) (*types.ApplicabilityStatementConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionApplicabilityStatementList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionApplicabilityStatementList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.ApplicabilityStatementOrderField]{ diff --git a/pkg/server/api/console/v1/cookie_banner_resolvers.go b/pkg/server/api/console/v1/cookie_banner_resolvers.go index 0b91a4afe..c54945905 100644 --- a/pkg/server/api/console/v1/cookie_banner_resolvers.go +++ b/pkg/server/api/console/v1/cookie_banner_resolvers.go @@ -25,7 +25,7 @@ import ( // Organization is the resolver for the organization field. func (r *cookieBannerResolver) Organization(ctx context.Context, obj *types.CookieBanner) (*types.Organization, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { return nil, err } @@ -47,7 +47,7 @@ func (r *cookieBannerResolver) Organization(ctx context.Context, obj *types.Cook // Categories is the resolver for the categories field. func (r *cookieBannerResolver) Categories(ctx context.Context, obj *types.CookieBanner, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.CookieCategoryOrderBy, filter *types.CookieCategoryFilter) (*types.CookieCategoryConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionCookieCategoryList); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionCookieCategoryList); err != nil { return nil, err } @@ -85,12 +85,11 @@ func (r *cookieBannerResolver) Categories(ctx context.Context, obj *types.Cookie // Translations is the resolver for the translations field. func (r *cookieBannerResolver) Translations(ctx context.Context, obj *types.CookieBanner) ([]*types.CookieBannerTranslation, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionCookieBannerGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionCookieBannerGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) - translations, err := r.cookieBanner.ListCookieBannerTranslations(ctx, scope, obj.ID) if err != nil { r.logger.ErrorCtx(ctx, "cannot list cookie banner translations", log.Error(err)) @@ -107,12 +106,11 @@ func (r *cookieBannerResolver) Translations(ctx context.Context, obj *types.Cook // LatestVersion is the resolver for the latestVersion field. func (r *cookieBannerResolver) LatestVersion(ctx context.Context, obj *types.CookieBanner) (*types.CookieBannerVersion, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionCookieBannerVersionList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionCookieBannerVersionList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) - cursor := &page.Cursor[coredata.CookieBannerVersionOrderField]{ Size: 1, Position: page.Head, @@ -145,7 +143,8 @@ func (r *cookieBannerResolver) LatestVersion(ctx context.Context, obj *types.Coo // ConsentRecords is the resolver for the consentRecords field. func (r *cookieBannerResolver) ConsentRecords(ctx context.Context, obj *types.CookieBanner, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.CookieConsentRecordOrderBy, filter *types.CookieConsentRecordFilter) (*types.CookieConsentRecordConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionCookieConsentRecordList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionCookieConsentRecordList) + if err != nil { return nil, err } @@ -161,7 +160,6 @@ func (r *cookieBannerResolver) ConsentRecords(ctx context.Context, obj *types.Co } cursor := types.NewCursor(first, after, last, before, pageOrderBy) - scope := coredata.NewScopeFromObjectID(obj.ID) var ( action *coredata.CookieConsentAction @@ -189,7 +187,7 @@ func (r *cookieBannerResolver) ConsentRecords(ctx context.Context, obj *types.Co // TrackerPatterns is the resolver for the trackerPatterns field. func (r *cookieBannerResolver) TrackerPatterns(ctx context.Context, obj *types.CookieBanner, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.TrackerPatternOrderBy, filter *types.TrackerPatternFilter) (*types.TrackerPatternConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionTrackerPatternList); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionTrackerPatternList); err != nil { return nil, err } @@ -226,7 +224,7 @@ func (r *cookieBannerResolver) TrackerPatterns(ctx context.Context, obj *types.C // UncategorisedTrackerResources is the resolver for the uncategorisedTrackerResources field. func (r *cookieBannerResolver) UncategorisedTrackerResources(ctx context.Context, obj *types.CookieBanner, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.TrackerResourceOrderBy, filter *types.TrackerResourceFilter) (*types.TrackerResourceConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionTrackerResourceList); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionTrackerResourceList); err != nil { return nil, err } @@ -267,12 +265,11 @@ func (r *cookieBannerResolver) Permission(ctx context.Context, obj *types.Cookie // TotalCount is the resolver for the totalCount field. func (r *cookieBannerConnectionResolver) TotalCount(ctx context.Context, obj *types.CookieBannerConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionCookieBannerList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionCookieBannerList) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) - count, err := r.cookieBanner.CountCookieBannersForOrganization(ctx, scope, obj.ParentID, coredata.NewCookieBannerFilter(nil)) if err != nil { r.logger.ErrorCtx(ctx, "cannot count cookie banners", log.Error(err)) @@ -284,12 +281,11 @@ func (r *cookieBannerConnectionResolver) TotalCount(ctx context.Context, obj *ty // Categories is the resolver for the categories field. func (r *cookieBannerVersionResolver) Categories(ctx context.Context, obj *types.CookieBannerVersion) ([]*types.CookieBannerVersionCategory, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionCookieBannerVersionGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionCookieBannerVersionGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) - version, err := r.cookieBanner.GetCookieBannerVersion(ctx, scope, obj.ID) if err != nil { r.logger.ErrorCtx(ctx, "cannot get cookie banner version", log.Error(err)) @@ -331,7 +327,7 @@ func (r *cookieCategoryResolver) CookieBanner(ctx context.Context, obj *types.Co return nil, nil } - if err := r.authorize(ctx, obj.CookieBanner.ID, probo.ActionCookieBannerGet); err != nil { + if _, err := r.authorize(ctx, obj.CookieBanner.ID, probo.ActionCookieBannerGet); err != nil { return nil, err } @@ -353,7 +349,7 @@ func (r *cookieCategoryResolver) CookieBanner(ctx context.Context, obj *types.Co // TrackerPatterns is the resolver for the trackerPatterns field. func (r *cookieCategoryResolver) TrackerPatterns(ctx context.Context, obj *types.CookieCategory, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.TrackerPatternOrderBy) (*types.TrackerPatternConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionTrackerPatternList); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionTrackerPatternList); err != nil { return nil, err } @@ -384,7 +380,7 @@ func (r *cookieCategoryResolver) TrackerPatterns(ctx context.Context, obj *types // TrackerResources is the resolver for the trackerResources field. func (r *cookieCategoryResolver) TrackerResources(ctx context.Context, obj *types.CookieCategory, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.TrackerResourceOrderBy) (*types.TrackerResourceConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionTrackerResourceList); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionTrackerResourceList); err != nil { return nil, err } @@ -420,12 +416,11 @@ func (r *cookieCategoryResolver) Permission(ctx context.Context, obj *types.Cook // TotalCount is the resolver for the totalCount field. func (r *cookieCategoryConnectionResolver) TotalCount(ctx context.Context, obj *types.CookieCategoryConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionCookieCategoryList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionCookieCategoryList) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) - count, err := r.cookieBanner.CountCategoriesForBanner(ctx, scope, obj.ParentID, obj.Filter) if err != nil { r.logger.ErrorCtx(ctx, "cannot count cookie categories", log.Error(err)) @@ -450,12 +445,11 @@ func (r *detectedTrackerConnectionResolver) TotalCount(ctx context.Context, obj // CreateCookieBanner is the resolver for the createCookieBanner field. func (r *mutationResolver) CreateCookieBanner(ctx context.Context, input types.CreateCookieBannerInput) (*types.CreateCookieBannerPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionCookieBannerCreate); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionCookieBannerCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) - banner, err := r.cookieBanner.CreateCookieBanner( ctx, scope, @@ -489,12 +483,11 @@ func (r *mutationResolver) CreateCookieBanner(ctx context.Context, input types.C // UpdateCookieBanner is the resolver for the updateCookieBanner field. func (r *mutationResolver) UpdateCookieBanner(ctx context.Context, input types.UpdateCookieBannerInput) (*types.UpdateCookieBannerPayload, error) { - if err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerUpdate); err != nil { + scope, err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.CookieBannerID) - banner, err := r.cookieBanner.UpdateCookieBanner( ctx, scope, @@ -528,14 +521,12 @@ func (r *mutationResolver) UpdateCookieBanner(ctx context.Context, input types.U // DeleteCookieBanner is the resolver for the deleteCookieBanner field. func (r *mutationResolver) DeleteCookieBanner(ctx context.Context, input types.DeleteCookieBannerInput) (*types.DeleteCookieBannerPayload, error) { - if err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerDelete); err != nil { + scope, err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.CookieBannerID) - - err := r.cookieBanner.DeleteCookieBanner(ctx, scope, input.CookieBannerID) - if err != nil { + if err := r.cookieBanner.DeleteCookieBanner(ctx, scope, input.CookieBannerID); err != nil { if errors.Is(err, cookiebanner.ErrBannerNotFound) { return nil, gqlutils.NotFound(ctx, err) } @@ -552,12 +543,11 @@ func (r *mutationResolver) DeleteCookieBanner(ctx context.Context, input types.D // ActivateCookieBanner is the resolver for the activateCookieBanner field. func (r *mutationResolver) ActivateCookieBanner(ctx context.Context, input types.ActivateCookieBannerInput) (*types.ActivateCookieBannerPayload, error) { - if err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerActivate); err != nil { + scope, err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerActivate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.CookieBannerID) - banner, err := r.cookieBanner.ActivateCookieBanner(ctx, scope, input.CookieBannerID) if err != nil { if errors.Is(err, cookiebanner.ErrBannerNotFound) { @@ -584,12 +574,11 @@ func (r *mutationResolver) ActivateCookieBanner(ctx context.Context, input types // DeactivateCookieBanner is the resolver for the deactivateCookieBanner field. func (r *mutationResolver) DeactivateCookieBanner(ctx context.Context, input types.DeactivateCookieBannerInput) (*types.DeactivateCookieBannerPayload, error) { - if err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerDeactivate); err != nil { + scope, err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerDeactivate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.CookieBannerID) - banner, err := r.cookieBanner.DeactivateCookieBanner(ctx, scope, input.CookieBannerID) if err != nil { if errors.Is(err, cookiebanner.ErrBannerNotFound) { @@ -612,12 +601,11 @@ func (r *mutationResolver) DeactivateCookieBanner(ctx context.Context, input typ // PublishCookieBannerVersion is the resolver for the publishCookieBannerVersion field. func (r *mutationResolver) PublishCookieBannerVersion(ctx context.Context, input types.PublishCookieBannerVersionInput) (*types.PublishCookieBannerVersionPayload, error) { - if err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerVersionPublish); err != nil { + scope, err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerVersionPublish) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.CookieBannerID) - version, err := r.cookieBanner.PublishCookieBannerVersion(ctx, scope, input.CookieBannerID) if err != nil { if errors.Is(err, cookiebanner.ErrNoDraftVersion) { @@ -649,12 +637,11 @@ func (r *mutationResolver) PublishCookieBannerVersion(ctx context.Context, input // CreateCookieCategory is the resolver for the createCookieCategory field. func (r *mutationResolver) CreateCookieCategory(ctx context.Context, input types.CreateCookieCategoryInput) (*types.CreateCookieCategoryPayload, error) { - if err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieCategoryCreate); err != nil { + scope, err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieCategoryCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.CookieBannerID) - category, err := r.cookieBanner.CreateCookieCategory( ctx, scope, @@ -698,12 +685,11 @@ func (r *mutationResolver) CreateCookieCategory(ctx context.Context, input types // UpdateCookieCategory is the resolver for the updateCookieCategory field. func (r *mutationResolver) UpdateCookieCategory(ctx context.Context, input types.UpdateCookieCategoryInput) (*types.UpdateCookieCategoryPayload, error) { - if err := r.authorize(ctx, input.CookieCategoryID, probo.ActionCookieCategoryUpdate); err != nil { + scope, err := r.authorize(ctx, input.CookieCategoryID, probo.ActionCookieCategoryUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.CookieCategoryID) - var gcmConsentTypes *[]string if input.GcmConsentTypes != nil { gcmConsentTypes = &input.GcmConsentTypes @@ -759,12 +745,11 @@ func (r *mutationResolver) UpdateCookieCategory(ctx context.Context, input types // DeleteCookieCategory is the resolver for the deleteCookieCategory field. func (r *mutationResolver) DeleteCookieCategory(ctx context.Context, input types.DeleteCookieCategoryInput) (*types.DeleteCookieCategoryPayload, error) { - if err := r.authorize(ctx, input.CookieCategoryID, probo.ActionCookieCategoryDelete); err != nil { + scope, err := r.authorize(ctx, input.CookieCategoryID, probo.ActionCookieCategoryDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.CookieCategoryID) - category, err := r.cookieBanner.GetCookieCategory(ctx, scope, input.CookieCategoryID) if err != nil { if errors.Is(err, cookiebanner.ErrCategoryNotFound) { @@ -809,12 +794,11 @@ func (r *mutationResolver) DeleteCookieCategory(ctx context.Context, input types // ReorderCookieCategory is the resolver for the reorderCookieCategory field. func (r *mutationResolver) ReorderCookieCategory(ctx context.Context, input types.ReorderCookieCategoryInput) (*types.ReorderCookieCategoryPayload, error) { - if err := r.authorize(ctx, input.CookieCategoryID, probo.ActionCookieCategoryUpdate); err != nil { + scope, err := r.authorize(ctx, input.CookieCategoryID, probo.ActionCookieCategoryUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.CookieCategoryID) - banner, err := r.cookieBanner.ReorderCookieCategory( ctx, scope, @@ -844,12 +828,11 @@ func (r *mutationResolver) ReorderCookieCategory(ctx context.Context, input type // UpsertCookieBannerTranslation is the resolver for the upsertCookieBannerTranslation field. func (r *mutationResolver) UpsertCookieBannerTranslation(ctx context.Context, input types.UpsertCookieBannerTranslationInput) (*types.UpsertCookieBannerTranslationPayload, error) { - if err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerUpdate); err != nil { + scope, err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.CookieBannerID) - translation, err := r.cookieBanner.UpsertCookieBannerTranslation( ctx, scope, @@ -887,12 +870,11 @@ func (r *mutationResolver) UpsertCookieBannerTranslation(ctx context.Context, in // CreateTrackerPattern is the resolver for the createTrackerPattern field. func (r *mutationResolver) CreateTrackerPattern(ctx context.Context, input types.CreateTrackerPatternInput) (*types.CreateTrackerPatternPayload, error) { - if err := r.authorize(ctx, input.CookieCategoryID, probo.ActionTrackerPatternCreate); err != nil { + scope, err := r.authorize(ctx, input.CookieCategoryID, probo.ActionTrackerPatternCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.CookieCategoryID) - trackerType := coredata.TrackerTypeCookie if input.TrackerType != nil { trackerType = *input.TrackerType @@ -946,12 +928,11 @@ func (r *mutationResolver) CreateTrackerPattern(ctx context.Context, input types // UpdateTrackerPattern is the resolver for the updateTrackerPattern field. func (r *mutationResolver) UpdateTrackerPattern(ctx context.Context, input types.UpdateTrackerPatternInput) (*types.UpdateTrackerPatternPayload, error) { - if err := r.authorize(ctx, input.TrackerPatternID, probo.ActionTrackerPatternUpdate); err != nil { + scope, err := r.authorize(ctx, input.TrackerPatternID, probo.ActionTrackerPatternUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.TrackerPatternID) - pattern, err := r.cookieBanner.UpdateTrackerPattern( ctx, scope, @@ -988,12 +969,11 @@ func (r *mutationResolver) UpdateTrackerPattern(ctx context.Context, input types // DeleteTrackerPattern is the resolver for the deleteTrackerPattern field. func (r *mutationResolver) DeleteTrackerPattern(ctx context.Context, input types.DeleteTrackerPatternInput) (*types.DeleteTrackerPatternPayload, error) { - if err := r.authorize(ctx, input.TrackerPatternID, probo.ActionTrackerPatternDelete); err != nil { + scope, err := r.authorize(ctx, input.TrackerPatternID, probo.ActionTrackerPatternDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.TrackerPatternID) - pattern, err := r.cookieBanner.GetTrackerPattern(ctx, scope, input.TrackerPatternID) if err != nil { if errors.Is(err, cookiebanner.ErrTrackerPatternNotFound) { @@ -1033,16 +1013,15 @@ func (r *mutationResolver) DeleteTrackerPattern(ctx context.Context, input types // MoveTrackerPatternToCategory is the resolver for the moveTrackerPatternToCategory field. func (r *mutationResolver) MoveTrackerPatternToCategory(ctx context.Context, input types.MoveTrackerPatternToCategoryInput) (*types.MoveTrackerPatternToCategoryPayload, error) { - if err := r.authorize(ctx, input.TrackerPatternID, probo.ActionTrackerPatternUpdate); err != nil { + scope, err := r.authorize(ctx, input.TrackerPatternID, probo.ActionTrackerPatternUpdate) + if err != nil { return nil, err } - if err := r.authorize(ctx, input.TargetCookieCategoryID, probo.ActionCookieCategoryUpdate); err != nil { + if _, err := r.authorize(ctx, input.TargetCookieCategoryID, probo.ActionCookieCategoryUpdate); err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.TrackerPatternID) - result, err := r.cookieBanner.MoveTrackerPatternToCategory( ctx, scope, @@ -1073,12 +1052,11 @@ func (r *mutationResolver) MoveTrackerPatternToCategory(ctx context.Context, inp // CreateTrackerResource is the resolver for the createTrackerResource field. func (r *mutationResolver) CreateTrackerResource(ctx context.Context, input types.CreateTrackerResourceInput) (*types.CreateTrackerResourcePayload, error) { - if err := r.authorize(ctx, input.CookieCategoryID, probo.ActionTrackerResourceCreate); err != nil { + scope, err := r.authorize(ctx, input.CookieCategoryID, probo.ActionTrackerResourceCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.CookieCategoryID) - var description string if input.Description != nil { description = *input.Description @@ -1126,12 +1104,11 @@ func (r *mutationResolver) CreateTrackerResource(ctx context.Context, input type // UpdateTrackerResource is the resolver for the updateTrackerResource field. func (r *mutationResolver) UpdateTrackerResource(ctx context.Context, input types.UpdateTrackerResourceInput) (*types.UpdateTrackerResourcePayload, error) { - if err := r.authorize(ctx, input.TrackerResourceID, probo.ActionTrackerResourceUpdate); err != nil { + scope, err := r.authorize(ctx, input.TrackerResourceID, probo.ActionTrackerResourceUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.TrackerResourceID) - resource, err := r.cookieBanner.UpdateTrackerResource( ctx, scope, @@ -1172,12 +1149,11 @@ func (r *mutationResolver) UpdateTrackerResource(ctx context.Context, input type // DeleteTrackerResource is the resolver for the deleteTrackerResource field. func (r *mutationResolver) DeleteTrackerResource(ctx context.Context, input types.DeleteTrackerResourceInput) (*types.DeleteTrackerResourcePayload, error) { - if err := r.authorize(ctx, input.TrackerResourceID, probo.ActionTrackerResourceDelete); err != nil { + scope, err := r.authorize(ctx, input.TrackerResourceID, probo.ActionTrackerResourceDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.TrackerResourceID) - resource, err := r.cookieBanner.GetTrackerResource(ctx, scope, input.TrackerResourceID) if err != nil { if errors.Is(err, cookiebanner.ErrTrackerResourceNotFound) { @@ -1217,16 +1193,15 @@ func (r *mutationResolver) DeleteTrackerResource(ctx context.Context, input type // MoveTrackerResourceToCategory is the resolver for the moveTrackerResourceToCategory field. func (r *mutationResolver) MoveTrackerResourceToCategory(ctx context.Context, input types.MoveTrackerResourceToCategoryInput) (*types.MoveTrackerResourceToCategoryPayload, error) { - if err := r.authorize(ctx, input.TrackerResourceID, probo.ActionTrackerResourceUpdate); err != nil { + scope, err := r.authorize(ctx, input.TrackerResourceID, probo.ActionTrackerResourceUpdate) + if err != nil { return nil, err } - if err := r.authorize(ctx, input.TargetCookieCategoryID, probo.ActionCookieCategoryUpdate); err != nil { + if _, err := r.authorize(ctx, input.TargetCookieCategoryID, probo.ActionCookieCategoryUpdate); err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.TrackerResourceID) - result, err := r.cookieBanner.MoveTrackerResourceToCategory( ctx, scope, @@ -1259,7 +1234,7 @@ func (r *mutationResolver) MoveTrackerResourceToCategory(ctx context.Context, in // CookieCategory is the resolver for the cookieCategory field. func (r *trackerPatternResolver) CookieCategory(ctx context.Context, obj *types.TrackerPattern) (*types.CookieCategory, error) { - if err := r.authorize(ctx, obj.CookieCategory.ID, probo.ActionCookieCategoryGet); err != nil { + if _, err := r.authorize(ctx, obj.CookieCategory.ID, probo.ActionCookieCategoryGet); err != nil { return nil, err } @@ -1360,7 +1335,7 @@ func (r *trackerPatternConnectionResolver) TotalCount(ctx context.Context, obj * // CookieCategory is the resolver for the cookieCategory field. func (r *trackerResourceResolver) CookieCategory(ctx context.Context, obj *types.TrackerResource) (*types.CookieCategory, error) { - if err := r.authorize(ctx, obj.CookieCategory.ID, probo.ActionCookieCategoryGet); err != nil { + if _, err := r.authorize(ctx, obj.CookieCategory.ID, probo.ActionCookieCategoryGet); err != nil { return nil, err } diff --git a/pkg/server/api/console/v1/cookie_consent_record_resolvers.go b/pkg/server/api/console/v1/cookie_consent_record_resolvers.go index e04c6840a..8703fc590 100644 --- a/pkg/server/api/console/v1/cookie_consent_record_resolvers.go +++ b/pkg/server/api/console/v1/cookie_consent_record_resolvers.go @@ -22,7 +22,7 @@ import ( // CookieBanner is the resolver for the cookieBanner field. func (r *cookieConsentRecordResolver) CookieBanner(ctx context.Context, obj *types.CookieConsentRecord) (*types.CookieBanner, error) { - if err := r.authorize(ctx, obj.CookieBanner.ID, probo.ActionCookieBannerGet); err != nil { + if _, err := r.authorize(ctx, obj.CookieBanner.ID, probo.ActionCookieBannerGet); err != nil { return nil, err } @@ -44,12 +44,11 @@ func (r *cookieConsentRecordResolver) CookieBanner(ctx context.Context, obj *typ // CookieBannerVersion is the resolver for the cookieBannerVersion field. func (r *cookieConsentRecordResolver) CookieBannerVersion(ctx context.Context, obj *types.CookieConsentRecord) (*types.CookieBannerVersion, error) { - if err := r.authorize(ctx, obj.CookieBannerVersion.ID, probo.ActionCookieBannerVersionGet); err != nil { + scope, err := r.authorize(ctx, obj.CookieBannerVersion.ID, probo.ActionCookieBannerVersionGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.CookieBannerVersion.ID) - version, err := r.cookieBanner.GetCookieBannerVersion(ctx, scope, obj.CookieBannerVersion.ID) if err != nil { if errors.Is(err, cookiebanner.ErrVersionNotFound) { @@ -72,12 +71,11 @@ func (r *cookieConsentRecordResolver) CookieBannerVersion(ctx context.Context, o // TotalCount is the resolver for the totalCount field. func (r *cookieConsentRecordConnectionResolver) TotalCount(ctx context.Context, obj *types.CookieConsentRecordConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionCookieConsentRecordList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionCookieConsentRecordList) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) - count, err := r.cookieBanner.CountCookieConsentRecordsForBanner(ctx, scope, obj.ParentID, obj.Filter) if err != nil { r.logger.ErrorCtx(ctx, "cannot count consent records", log.Error(err)) diff --git a/pkg/server/api/console/v1/data_protection_impact_assessment_resolvers.go b/pkg/server/api/console/v1/data_protection_impact_assessment_resolvers.go index 2aac13824..692d52299 100644 --- a/pkg/server/api/console/v1/data_protection_impact_assessment_resolvers.go +++ b/pkg/server/api/console/v1/data_protection_impact_assessment_resolvers.go @@ -22,11 +22,11 @@ import ( // ProcessingActivity is the resolver for the processingActivity field. func (r *dataProtectionImpactAssessmentResolver) ProcessingActivity(ctx context.Context, obj *types.DataProtectionImpactAssessment) (*types.ProcessingActivity, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionProcessingActivityList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionProcessingActivityList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo dpia, err := prb.DataProtectionImpactAssessments.Get(ctx, scope, obj.ID) @@ -46,11 +46,11 @@ func (r *dataProtectionImpactAssessmentResolver) ProcessingActivity(ctx context. // Organization is the resolver for the organization field. func (r *dataProtectionImpactAssessmentResolver) Organization(ctx context.Context, obj *types.DataProtectionImpactAssessment) (*types.Organization, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo dpia, err := prb.DataProtectionImpactAssessments.Get(ctx, scope, obj.ID) @@ -80,11 +80,11 @@ func (r *dataProtectionImpactAssessmentResolver) Permission(ctx context.Context, // TotalCount is the resolver for the totalCount field. func (r *dataProtectionImpactAssessmentConnectionResolver) TotalCount(ctx context.Context, obj *types.DataProtectionImpactAssessmentConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionDataProtectionImpactAssessmentList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionDataProtectionImpactAssessmentList) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) prb := r.probo switch obj.Resolver.(type) { @@ -105,11 +105,11 @@ func (r *dataProtectionImpactAssessmentConnectionResolver) TotalCount(ctx contex // CreateDataProtectionImpactAssessment is the resolver for the createDataProtectionImpactAssessment field. func (r *mutationResolver) CreateDataProtectionImpactAssessment(ctx context.Context, input types.CreateDataProtectionImpactAssessmentInput) (*types.CreateDataProtectionImpactAssessmentPayload, error) { - if err := r.authorize(ctx, input.ProcessingActivityID, probo.ActionDataProtectionImpactAssessmentCreate); err != nil { + scope, err := r.authorize(ctx, input.ProcessingActivityID, probo.ActionDataProtectionImpactAssessmentCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ProcessingActivityID) prb := r.probo req := probo.CreateDataProtectionImpactAssessmentRequest{ @@ -143,11 +143,11 @@ func (r *mutationResolver) CreateDataProtectionImpactAssessment(ctx context.Cont // UpdateDataProtectionImpactAssessment is the resolver for the updateDataProtectionImpactAssessment field. func (r *mutationResolver) UpdateDataProtectionImpactAssessment(ctx context.Context, input types.UpdateDataProtectionImpactAssessmentInput) (*types.UpdateDataProtectionImpactAssessmentPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionDataProtectionImpactAssessmentUpdate); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionDataProtectionImpactAssessmentUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo req := probo.UpdateDataProtectionImpactAssessmentRequest{ @@ -177,15 +177,14 @@ func (r *mutationResolver) UpdateDataProtectionImpactAssessment(ctx context.Cont // DeleteDataProtectionImpactAssessment is the resolver for the deleteDataProtectionImpactAssessment field. func (r *mutationResolver) DeleteDataProtectionImpactAssessment(ctx context.Context, input types.DeleteDataProtectionImpactAssessmentInput) (*types.DeleteDataProtectionImpactAssessmentPayload, error) { - if err := r.authorize(ctx, input.DataProtectionImpactAssessmentID, probo.ActionDataProtectionImpactAssessmentDelete); err != nil { + scope, err := r.authorize(ctx, input.DataProtectionImpactAssessmentID, probo.ActionDataProtectionImpactAssessmentDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.DataProtectionImpactAssessmentID) prb := r.probo - err := prb.DataProtectionImpactAssessments.Delete(ctx, scope, input.DataProtectionImpactAssessmentID) - if err != nil { + if err := prb.DataProtectionImpactAssessments.Delete(ctx, scope, input.DataProtectionImpactAssessmentID); err != nil { r.logger.ErrorCtx(ctx, "cannot delete data protection impact assessment", log.Error(err)) return nil, gqlutils.Internal(ctx) } @@ -197,11 +196,11 @@ func (r *mutationResolver) DeleteDataProtectionImpactAssessment(ctx context.Cont // CreateTransferImpactAssessment is the resolver for the createTransferImpactAssessment field. func (r *mutationResolver) CreateTransferImpactAssessment(ctx context.Context, input types.CreateTransferImpactAssessmentInput) (*types.CreateTransferImpactAssessmentPayload, error) { - if err := r.authorize(ctx, input.ProcessingActivityID, probo.ActionTransferImpactAssessmentCreate); err != nil { + scope, err := r.authorize(ctx, input.ProcessingActivityID, probo.ActionTransferImpactAssessmentCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ProcessingActivityID) prb := r.probo req := probo.CreateTransferImpactAssessmentRequest{ @@ -235,11 +234,11 @@ func (r *mutationResolver) CreateTransferImpactAssessment(ctx context.Context, i // UpdateTransferImpactAssessment is the resolver for the updateTransferImpactAssessment field. func (r *mutationResolver) UpdateTransferImpactAssessment(ctx context.Context, input types.UpdateTransferImpactAssessmentInput) (*types.UpdateTransferImpactAssessmentPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionTransferImpactAssessmentUpdate); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionTransferImpactAssessmentUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo req := probo.UpdateTransferImpactAssessmentRequest{ @@ -269,15 +268,14 @@ func (r *mutationResolver) UpdateTransferImpactAssessment(ctx context.Context, i // DeleteTransferImpactAssessment is the resolver for the deleteTransferImpactAssessment field. func (r *mutationResolver) DeleteTransferImpactAssessment(ctx context.Context, input types.DeleteTransferImpactAssessmentInput) (*types.DeleteTransferImpactAssessmentPayload, error) { - if err := r.authorize(ctx, input.TransferImpactAssessmentID, probo.ActionTransferImpactAssessmentDelete); err != nil { + scope, err := r.authorize(ctx, input.TransferImpactAssessmentID, probo.ActionTransferImpactAssessmentDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.TransferImpactAssessmentID) prb := r.probo - err := prb.TransferImpactAssessments.Delete(ctx, scope, input.TransferImpactAssessmentID) - if err != nil { + if err := prb.TransferImpactAssessments.Delete(ctx, scope, input.TransferImpactAssessmentID); err != nil { r.logger.ErrorCtx(ctx, "cannot delete transfer impact assessment", log.Error(err)) return nil, gqlutils.Internal(ctx) } @@ -289,11 +287,11 @@ func (r *mutationResolver) DeleteTransferImpactAssessment(ctx context.Context, i // PublishDataProtectionImpactAssessmentList is the resolver for the publishDataProtectionImpactAssessmentList field. func (r *mutationResolver) PublishDataProtectionImpactAssessmentList(ctx context.Context, input types.PublishDataProtectionImpactAssessmentListInput) (*types.PublishDataProtectionImpactAssessmentListPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionDataProtectionImpactAssessmentPublish); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionDataProtectionImpactAssessmentPublish) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo document, documentVersion, err := prb.GeneratedDocuments.PublishDataProtectionImpactAssessmentList(ctx, scope, input.OrganizationID, input.ApproverIds, input.Minor) @@ -319,11 +317,11 @@ func (r *mutationResolver) PublishDataProtectionImpactAssessmentList(ctx context // PublishTransferImpactAssessmentList is the resolver for the publishTransferImpactAssessmentList field. func (r *mutationResolver) PublishTransferImpactAssessmentList(ctx context.Context, input types.PublishTransferImpactAssessmentListInput) (*types.PublishTransferImpactAssessmentListPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionTransferImpactAssessmentPublish); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionTransferImpactAssessmentPublish) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo document, documentVersion, err := prb.GeneratedDocuments.PublishTransferImpactAssessmentList(ctx, scope, input.OrganizationID, input.ApproverIds, input.Minor) @@ -349,11 +347,11 @@ func (r *mutationResolver) PublishTransferImpactAssessmentList(ctx context.Conte // ProcessingActivity is the resolver for the processingActivity field. func (r *transferImpactAssessmentResolver) ProcessingActivity(ctx context.Context, obj *types.TransferImpactAssessment) (*types.ProcessingActivity, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionProcessingActivityGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionProcessingActivityGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo processingActivity, err := prb.ProcessingActivities.Get(ctx, scope, obj.ProcessingActivity.ID) @@ -367,7 +365,7 @@ func (r *transferImpactAssessmentResolver) ProcessingActivity(ctx context.Contex // Organization is the resolver for the organization field. func (r *transferImpactAssessmentResolver) Organization(ctx context.Context, obj *types.TransferImpactAssessment) (*types.Organization, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { return nil, err } @@ -394,11 +392,11 @@ func (r *transferImpactAssessmentResolver) Permission(ctx context.Context, obj * // TotalCount is the resolver for the totalCount field. func (r *transferImpactAssessmentConnectionResolver) TotalCount(ctx context.Context, obj *types.TransferImpactAssessmentConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionTransferImpactAssessmentList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionTransferImpactAssessmentList) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) prb := r.probo switch obj.Resolver.(type) { diff --git a/pkg/server/api/console/v1/document_resolvers.go b/pkg/server/api/console/v1/document_resolvers.go index f6b4e191c..10b80ddef 100644 --- a/pkg/server/api/console/v1/document_resolvers.go +++ b/pkg/server/api/console/v1/document_resolvers.go @@ -29,7 +29,7 @@ import ( // Organization is the resolver for the organization field. func (r *documentResolver) Organization(ctx context.Context, obj *types.Document) (*types.Organization, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { return nil, err } @@ -51,11 +51,11 @@ func (r *documentResolver) Organization(ctx context.Context, obj *types.Document // Versions is the resolver for the versions field. func (r *documentResolver) Versions(ctx context.Context, obj *types.Document, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentVersionOrderBy, filter *types.DocumentVersionFilter) (*types.DocumentVersionConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.DocumentVersionOrderField]{ @@ -87,11 +87,11 @@ func (r *documentResolver) Versions(ctx context.Context, obj *types.Document, fi // Controls is the resolver for the controls field. func (r *documentResolver) Controls(ctx context.Context, obj *types.Document, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy, filter *types.ControlFilter) (*types.ControlConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionControlList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionControlList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.ControlOrderField]{ @@ -123,11 +123,11 @@ func (r *documentResolver) Controls(ctx context.Context, obj *types.Document, fi // DefaultApprovers is the resolver for the defaultApprovers field. func (r *documentResolver) DefaultApprovers(ctx context.Context, obj *types.Document) ([]*types.Profile, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo profiles, err := prb.Documents.GetDefaultApprovers(ctx, scope, obj.ID) @@ -151,11 +151,11 @@ func (r *documentResolver) Permission(ctx context.Context, obj *types.Document, // TotalCount is the resolver for the totalCount field. func (r *documentConnectionResolver) TotalCount(ctx context.Context, obj *types.DocumentConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionDocumentList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionDocumentList) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) prb := r.probo switch obj.Resolver.(type) { @@ -200,7 +200,7 @@ func (r *documentConnectionResolver) TotalCount(ctx context.Context, obj *types. // Document is the resolver for the document field. func (r *documentVersionResolver) Document(ctx context.Context, obj *types.DocumentVersion) (*types.Document, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil { return nil, err } @@ -222,7 +222,8 @@ func (r *documentVersionResolver) Document(ctx context.Context, obj *types.Docum // Approvers is the resolver for the approvers field. func (r *documentVersionResolver) Approvers(ctx context.Context, obj *types.DocumentVersion, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ProfileOrderBy) (*types.ProfileConnection, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileList); err != nil { + scope, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileList) + if err != nil { return nil, err } @@ -233,7 +234,6 @@ func (r *documentVersionResolver) Approvers(ctx context.Context, obj *types.Docu }, nil } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.MembershipProfileOrderField]{ @@ -258,11 +258,11 @@ func (r *documentVersionResolver) Approvers(ctx context.Context, obj *types.Docu // Signatures is the resolver for the signatures field. func (r *documentVersionResolver) Signatures(ctx context.Context, obj *types.DocumentVersion, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentVersionSignatureOrder, filter *types.DocumentVersionSignatureFilter) (*types.DocumentVersionSignatureConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionSignatureList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionSignatureList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.DocumentVersionSignatureOrderField]{ @@ -311,11 +311,11 @@ func (r *documentVersionResolver) Signatures(ctx context.Context, obj *types.Doc // ApprovalQuorums is the resolver for the approvalQuorums field. func (r *documentVersionResolver) ApprovalQuorums(ctx context.Context, obj *types.DocumentVersion, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentVersionApprovalQuorumOrder) (*types.DocumentVersionApprovalQuorumConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionApprovalList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionApprovalList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.DocumentVersionApprovalQuorumOrderField]{ @@ -342,13 +342,12 @@ func (r *documentVersionResolver) ApprovalQuorums(ctx context.Context, obj *type // Signed is the resolver for the signed field. func (r *documentVersionResolver) Signed(ctx context.Context, obj *types.DocumentVersion) (bool, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionGet) + if err != nil { return false, err } identity := authn.IdentityFromContext(ctx) - - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo signed, err := prb.Documents.IsVersionSignedByUserEmail(ctx, scope, obj.ID, identity.EmailAddress) @@ -367,11 +366,11 @@ func (r *documentVersionResolver) Permission(ctx context.Context, obj *types.Doc // Quorum is the resolver for the quorum field. func (r *documentVersionApprovalDecisionResolver) Quorum(ctx context.Context, obj *types.DocumentVersionApprovalDecision) (*types.DocumentVersionApprovalQuorum, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionApprovalList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionApprovalList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo quorum, err := prb.DocumentApprovals.GetQuorum(ctx, scope, obj.Quorum.ID) @@ -390,11 +389,11 @@ func (r *documentVersionApprovalDecisionResolver) Quorum(ctx context.Context, ob // DocumentVersion is the resolver for the documentVersion field. func (r *documentVersionApprovalDecisionResolver) DocumentVersion(ctx context.Context, obj *types.DocumentVersionApprovalDecision) (*types.DocumentVersion, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo quorum, err := prb.DocumentApprovals.GetQuorum(ctx, scope, obj.Quorum.ID) @@ -424,7 +423,7 @@ func (r *documentVersionApprovalDecisionResolver) DocumentVersion(ctx context.Co // Approver is the resolver for the approver field. func (r *documentVersionApprovalDecisionResolver) Approver(ctx context.Context, obj *types.DocumentVersionApprovalDecision) (*types.Profile, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } @@ -471,11 +470,11 @@ func (r *documentVersionApprovalDecisionConnectionResolver) TotalCount(ctx conte return 0, nil } - if err := r.authorize(ctx, obj.ParentID, probo.ActionDocumentVersionApprovalList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionDocumentVersionApprovalList) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) prb := r.probo filter := coredata.NewDocumentVersionApprovalDecisionFilter(nil) @@ -494,11 +493,11 @@ func (r *documentVersionApprovalDecisionConnectionResolver) TotalCount(ctx conte // DocumentVersion is the resolver for the documentVersion field. func (r *documentVersionApprovalQuorumResolver) DocumentVersion(ctx context.Context, obj *types.DocumentVersionApprovalQuorum) (*types.DocumentVersion, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo documentVersion, err := prb.Documents.GetVersion(ctx, scope, obj.DocumentVersion.ID) @@ -517,11 +516,11 @@ func (r *documentVersionApprovalQuorumResolver) DocumentVersion(ctx context.Cont // Decisions is the resolver for the decisions field. func (r *documentVersionApprovalQuorumResolver) Decisions(ctx context.Context, obj *types.DocumentVersionApprovalQuorum, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentVersionApprovalDecisionOrder, filter *types.DocumentVersionApprovalDecisionFilter) (*types.DocumentVersionApprovalDecisionConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionApprovalList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionApprovalList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.DocumentVersionApprovalDecisionOrderField]{ @@ -560,11 +559,11 @@ func (r *documentVersionApprovalQuorumResolver) Permission(ctx context.Context, // TotalCount is the resolver for the totalCount field. func (r *documentVersionApprovalQuorumConnectionResolver) TotalCount(ctx context.Context, obj *types.DocumentVersionApprovalQuorumConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionDocumentVersionApprovalList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionDocumentVersionApprovalList) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) prb := r.probo count, err := prb.DocumentApprovals.CountQuorums(ctx, scope, obj.ParentID) @@ -578,11 +577,11 @@ func (r *documentVersionApprovalQuorumConnectionResolver) TotalCount(ctx context // TotalCount is the resolver for the totalCount field. func (r *documentVersionConnectionResolver) TotalCount(ctx context.Context, obj *types.DocumentVersionConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionDocumentVersionList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionDocumentVersionList) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) prb := r.probo switch obj.Resolver.(type) { @@ -608,11 +607,11 @@ func (r *documentVersionConnectionResolver) TotalCount(ctx context.Context, obj // DocumentVersion is the resolver for the documentVersion field. func (r *documentVersionSignatureResolver) DocumentVersion(ctx context.Context, obj *types.DocumentVersionSignature) (*types.DocumentVersion, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo documentVersion, err := prb.Documents.GetVersion(ctx, scope, obj.DocumentVersion.ID) @@ -631,7 +630,7 @@ func (r *documentVersionSignatureResolver) DocumentVersion(ctx context.Context, // SignedBy is the resolver for the signedBy field. func (r *documentVersionSignatureResolver) SignedBy(ctx context.Context, obj *types.DocumentVersionSignature) (*types.Profile, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } @@ -658,11 +657,11 @@ func (r *documentVersionSignatureResolver) Permission(ctx context.Context, obj * // TotalCount is the resolver for the totalCount field. func (r *documentVersionSignatureConnectionResolver) TotalCount(ctx context.Context, obj *types.DocumentVersionSignatureConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionDocumentVersionSignatureList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionDocumentVersionSignatureList) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) prb := r.probo switch obj.Resolver.(type) { @@ -688,13 +687,12 @@ func (r *documentVersionSignatureConnectionResolver) TotalCount(ctx context.Cont // Signed is the resolver for the signed field. func (r *employeeDocumentResolver) Signed(ctx context.Context, obj *types.EmployeeDocument) (*bool, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionEmployeeDocumentGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionEmployeeDocumentGet) + if err != nil { return nil, err } identity := authn.IdentityFromContext(ctx) - - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo signed, err := prb.Documents.IsSigned(ctx, scope, obj.ID, identity.EmailAddress) @@ -713,7 +711,7 @@ func (r *employeeDocumentResolver) Signed(ctx context.Context, obj *types.Employ // ApprovalState is the resolver for the approvalState field. func (r *employeeDocumentResolver) ApprovalState(ctx context.Context, obj *types.EmployeeDocument) (*coredata.DocumentVersionApprovalDecisionState, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionEmployeeDocumentGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionEmployeeDocumentGet); err != nil { return nil, err } @@ -738,11 +736,11 @@ func (r *employeeDocumentResolver) ApprovalState(ctx context.Context, obj *types // Versions is the resolver for the versions field. func (r *employeeDocumentResolver) Versions(ctx context.Context, obj *types.EmployeeDocument, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentVersionOrderBy) (*types.EmployeeDocumentVersionConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionEmployeeDocumentGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionEmployeeDocumentGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.DocumentVersionOrderField]{ @@ -805,13 +803,12 @@ func (r *employeeDocumentResolver) Versions(ctx context.Context, obj *types.Empl // Signed is the resolver for the signed field. func (r *employeeDocumentVersionResolver) Signed(ctx context.Context, obj *types.EmployeeDocumentVersion) (bool, error) { - if err := r.authorize(ctx, obj.DocumentID, probo.ActionEmployeeDocumentGet); err != nil { + scope, err := r.authorize(ctx, obj.DocumentID, probo.ActionEmployeeDocumentGet) + if err != nil { return false, err } identity := authn.IdentityFromContext(ctx) - - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo signed, err := prb.Documents.IsVersionSignedByUserEmail(ctx, scope, obj.ID, identity.EmailAddress) @@ -825,7 +822,7 @@ func (r *employeeDocumentVersionResolver) Signed(ctx context.Context, obj *types // ApprovalDecision is the resolver for the approvalDecision field. func (r *employeeDocumentVersionResolver) ApprovalDecision(ctx context.Context, obj *types.EmployeeDocumentVersion) (*types.DocumentVersionApprovalDecision, error) { - if err := r.authorize(ctx, obj.DocumentID, probo.ActionEmployeeDocumentGet); err != nil { + if _, err := r.authorize(ctx, obj.DocumentID, probo.ActionEmployeeDocumentGet); err != nil { return nil, err } @@ -849,11 +846,11 @@ func (r *employeeDocumentVersionResolver) ApprovalDecision(ctx context.Context, // CreateDocument is the resolver for the createDocument field. func (r *mutationResolver) CreateDocument(ctx context.Context, input types.CreateDocumentInput) (*types.CreateDocumentPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionDocumentCreate); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionDocumentCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo var content string @@ -895,11 +892,11 @@ func (r *mutationResolver) CreateDocument(ctx context.Context, input types.Creat // UpdateDocument is the resolver for the updateDocument field. func (r *mutationResolver) UpdateDocument(ctx context.Context, input types.UpdateDocumentInput) (*types.UpdateDocumentPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionDocumentUpdate); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionDocumentUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo var defaultApproverIDs *[]gid.GID @@ -961,11 +958,11 @@ func (r *mutationResolver) UpdateDocument(ctx context.Context, input types.Updat // DeleteDocumentDraft is the resolver for the deleteDocumentDraft field. func (r *mutationResolver) DeleteDocumentDraft(ctx context.Context, input types.DeleteDocumentDraftInput) (*types.DeleteDocumentDraftPayload, error) { - if err := r.authorize(ctx, input.DocumentID, probo.ActionDocumentDeleteDraft); err != nil { + scope, err := r.authorize(ctx, input.DocumentID, probo.ActionDocumentDeleteDraft) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.DocumentID) prb := r.probo document, err := prb.Documents.DeleteDraft(ctx, scope, input.DocumentID) @@ -994,11 +991,11 @@ func (r *mutationResolver) DeleteDocumentDraft(ctx context.Context, input types. // ArchiveDocument is the resolver for the archiveDocument field. func (r *mutationResolver) ArchiveDocument(ctx context.Context, input types.ArchiveDocumentInput) (*types.ArchiveDocumentPayload, error) { - if err := r.authorize(ctx, input.DocumentID, probo.ActionDocumentArchive); err != nil { + scope, err := r.authorize(ctx, input.DocumentID, probo.ActionDocumentArchive) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.DocumentID) prb := r.probo document, err := prb.Documents.Archive(ctx, scope, input.DocumentID) @@ -1019,11 +1016,11 @@ func (r *mutationResolver) ArchiveDocument(ctx context.Context, input types.Arch // UnarchiveDocument is the resolver for the unarchiveDocument field. func (r *mutationResolver) UnarchiveDocument(ctx context.Context, input types.UnarchiveDocumentInput) (*types.UnarchiveDocumentPayload, error) { - if err := r.authorize(ctx, input.DocumentID, probo.ActionDocumentUnarchive); err != nil { + scope, err := r.authorize(ctx, input.DocumentID, probo.ActionDocumentUnarchive) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.DocumentID) prb := r.probo document, err := prb.Documents.Unarchive(ctx, scope, input.DocumentID) @@ -1044,15 +1041,14 @@ func (r *mutationResolver) UnarchiveDocument(ctx context.Context, input types.Un // DeleteDocument is the resolver for the deleteDocument field. func (r *mutationResolver) DeleteDocument(ctx context.Context, input types.DeleteDocumentInput) (*types.DeleteDocumentPayload, error) { - if err := r.authorize(ctx, input.DocumentID, probo.ActionDocumentDelete); err != nil { + scope, err := r.authorize(ctx, input.DocumentID, probo.ActionDocumentDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.DocumentID) prb := r.probo - err := prb.Documents.SoftDelete(ctx, scope, input.DocumentID) - if err != nil { + if err := prb.Documents.SoftDelete(ctx, scope, input.DocumentID); err != nil { r.logger.ErrorCtx(ctx, "cannot soft delete document", log.Error(err)) return nil, gqlutils.Internal(ctx) } @@ -1069,11 +1065,11 @@ func (r *mutationResolver) PublishDocument(ctx context.Context, input types.Publ action = probo.ActionDocumentVersionRequestApproval } - if err := r.authorize(ctx, input.DocumentID, action); err != nil { + scope, err := r.authorize(ctx, input.DocumentID, action) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.DocumentID) prb := r.probo result, err := prb.Documents.PublishVersion(ctx, scope, probo.PublishDocumentRequest{ @@ -1133,7 +1129,7 @@ func (r *mutationResolver) BulkPublishDocuments(ctx context.Context, input types } for _, documentID := range input.DocumentIds { - if err := r.authorize(ctx, documentID, probo.ActionDocumentVersionPublish); err != nil { + if _, err := r.authorize(ctx, documentID, probo.ActionDocumentVersionPublish); err != nil { return nil, err } } @@ -1182,11 +1178,11 @@ func (r *mutationResolver) BulkPublishDocuments(ctx context.Context, input types // VoidDocumentVersionApproval is the resolver for the voidDocumentVersionApproval field. func (r *mutationResolver) VoidDocumentVersionApproval(ctx context.Context, input types.VoidDocumentVersionApprovalInput) (*types.VoidDocumentVersionApprovalPayload, error) { - if err := r.authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionVoidApproval); err != nil { + scope, err := r.authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionVoidApproval) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.DocumentVersionID) prb := r.probo quorum, documentVersion, err := prb.DocumentApprovals.VoidApproval(ctx, scope, input.DocumentVersionID) @@ -1223,7 +1219,7 @@ func (r *mutationResolver) BulkDeleteDocuments(ctx context.Context, input types. } for _, documentID := range input.DocumentIds { - if err := r.authorize(ctx, documentID, probo.ActionDocumentDelete); err != nil { + if _, err := r.authorize(ctx, documentID, probo.ActionDocumentDelete); err != nil { return nil, err } } @@ -1231,8 +1227,7 @@ func (r *mutationResolver) BulkDeleteDocuments(ctx context.Context, input types. scope := coredata.NewScopeFromObjectID(input.DocumentIds[0]) prb := r.probo - err := prb.Documents.BulkSoftDelete(ctx, scope, input.DocumentIds) - if err != nil { + if err := prb.Documents.BulkSoftDelete(ctx, scope, input.DocumentIds); err != nil { r.logger.ErrorCtx(ctx, "cannot bulk delete documents", log.Error(err)) return nil, gqlutils.Internal(ctx) } @@ -1251,7 +1246,7 @@ func (r *mutationResolver) BulkArchiveDocuments(ctx context.Context, input types } for _, documentID := range input.DocumentIds { - if err := r.authorize(ctx, documentID, probo.ActionDocumentArchive); err != nil { + if _, err := r.authorize(ctx, documentID, probo.ActionDocumentArchive); err != nil { return nil, err } } @@ -1278,7 +1273,7 @@ func (r *mutationResolver) BulkUnarchiveDocuments(ctx context.Context, input typ } for _, documentID := range input.DocumentIds { - if err := r.authorize(ctx, documentID, probo.ActionDocumentUnarchive); err != nil { + if _, err := r.authorize(ctx, documentID, probo.ActionDocumentUnarchive); err != nil { return nil, err } } @@ -1305,7 +1300,7 @@ func (r *mutationResolver) BulkExportDocuments(ctx context.Context, input types. // TODO have a way to batch authorize for resources for _, documentID := range input.DocumentIds { - if err := r.authorize(ctx, documentID, probo.ActionDocumentVersionExport); err != nil { + if _, err := r.authorize(ctx, documentID, probo.ActionDocumentVersionExport); err != nil { return nil, err } } @@ -1334,11 +1329,11 @@ func (r *mutationResolver) BulkExportDocuments(ctx context.Context, input types. // GenerateDocumentChangelog is the resolver for the generateDocumentChangelog field. func (r *mutationResolver) GenerateDocumentChangelog(ctx context.Context, input types.GenerateDocumentChangelogInput) (*types.GenerateDocumentChangelogPayload, error) { - if err := r.authorize(ctx, input.DocumentID, probo.ActionDocumentChangelogGenerate); err != nil { + scope, err := r.authorize(ctx, input.DocumentID, probo.ActionDocumentChangelogGenerate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.DocumentID) prb := r.probo changelog, err := prb.Documents.GenerateChangelog(ctx, scope, input.DocumentID) @@ -1359,11 +1354,11 @@ func (r *mutationResolver) GenerateDocumentChangelog(ctx context.Context, input // RequestSignature is the resolver for the requestSignature field. func (r *mutationResolver) RequestSignature(ctx context.Context, input types.RequestSignatureInput) (*types.RequestSignaturePayload, error) { - if err := r.authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionSignatureRequest); err != nil { + scope, err := r.authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionSignatureRequest) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.DocumentVersionID) prb := r.probo documentVersionSignature, err := prb.Documents.RequestSignature( @@ -1409,7 +1404,7 @@ func (r *mutationResolver) BulkRequestSignatures(ctx context.Context, input type } for _, documentID := range input.DocumentIds { - if err := r.authorize(ctx, documentID, probo.ActionDocumentVersionSignatureRequest); err != nil { + if _, err := r.authorize(ctx, documentID, probo.ActionDocumentVersionSignatureRequest); err != nil { return nil, err } } @@ -1449,15 +1444,14 @@ func (r *mutationResolver) BulkRequestSignatures(ctx context.Context, input type // SendSigningNotifications is the resolver for the sendSigningNotifications field. func (r *mutationResolver) SendSigningNotifications(ctx context.Context, input types.SendSigningNotificationsInput) (*types.SendSigningNotificationsPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionDocumentSendSigningNotifications); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionDocumentSendSigningNotifications) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo - err := prb.Documents.SendSigningNotifications(ctx, scope, input.OrganizationID) - if err != nil { + if err := prb.Documents.SendSigningNotifications(ctx, scope, input.OrganizationID); err != nil { r.logger.ErrorCtx(ctx, "cannot send signing notifications", log.Error(err)) return nil, gqlutils.Internal(ctx) } @@ -1469,15 +1463,14 @@ func (r *mutationResolver) SendSigningNotifications(ctx context.Context, input t // CancelSignatureRequest is the resolver for the cancelSignatureRequest field. func (r *mutationResolver) CancelSignatureRequest(ctx context.Context, input types.CancelSignatureRequestInput) (*types.CancelSignatureRequestPayload, error) { - if err := r.authorize(ctx, input.DocumentVersionSignatureID, probo.ActionDocumentVersionCancelSignature); err != nil { + scope, err := r.authorize(ctx, input.DocumentVersionSignatureID, probo.ActionDocumentVersionCancelSignature) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.DocumentVersionSignatureID) prb := r.probo - err := prb.Documents.CancelSignatureRequest(ctx, scope, input.DocumentVersionSignatureID) - if err != nil { + if err := prb.Documents.CancelSignatureRequest(ctx, scope, input.DocumentVersionSignatureID); err != nil { if errArchived, ok := errors.AsType[*probo.ErrDocumentArchived](err); ok { return nil, gqlutils.Conflict(ctx, errArchived) } @@ -1494,12 +1487,12 @@ func (r *mutationResolver) CancelSignatureRequest(ctx context.Context, input typ // SignDocument is the resolver for the signDocument field. func (r *mutationResolver) SignDocument(ctx context.Context, input types.SignDocumentInput) (*types.SignDocumentPayload, error) { - if err := r.authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionSign); err != nil { + scope, err := r.authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionSign) + if err != nil { return nil, err } identity := authn.IdentityFromContext(ctx) - scope := coredata.NewScopeFromObjectID(input.DocumentVersionID) prb := r.probo documentVersionSignature, err := prb.Documents.SignDocumentVersionByIdentity(ctx, scope, input.DocumentVersionID, identity.ID) @@ -1520,7 +1513,8 @@ func (r *mutationResolver) SignDocument(ctx context.Context, input types.SignDoc // ApproveDocumentVersion is the resolver for the approveDocumentVersion field. func (r *mutationResolver) ApproveDocumentVersion(ctx context.Context, input types.ApproveDocumentVersionInput) (*types.ApproveDocumentVersionPayload, error) { - if err := r.authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionApprove); err != nil { + scope, err := r.authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionApprove) + if err != nil { return nil, err } @@ -1532,7 +1526,6 @@ func (r *mutationResolver) ApproveDocumentVersion(ctx context.Context, input typ signerIP = httpReq.RemoteAddr } - scope := coredata.NewScopeFromObjectID(input.DocumentVersionID) prb := r.probo decision, err := prb.DocumentApprovals.Approve(ctx, scope, probo.ApproveDocumentVersionRequest{ @@ -1573,13 +1566,12 @@ func (r *mutationResolver) ApproveDocumentVersion(ctx context.Context, input typ // RejectDocumentVersion is the resolver for the rejectDocumentVersion field. func (r *mutationResolver) RejectDocumentVersion(ctx context.Context, input types.RejectDocumentVersionInput) (*types.RejectDocumentVersionPayload, error) { - if err := r.authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionReject); err != nil { + scope, err := r.authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionReject) + if err != nil { return nil, err } identity := authn.IdentityFromContext(ctx) - - scope := coredata.NewScopeFromObjectID(input.DocumentVersionID) prb := r.probo decision, err := prb.DocumentApprovals.Reject(ctx, scope, probo.RejectDocumentVersionRequest{ @@ -1616,11 +1608,11 @@ func (r *mutationResolver) RejectDocumentVersion(ctx context.Context, input type // ExportDocumentVersionPDF is the resolver for the exportDocumentVersionPDF field. func (r *mutationResolver) ExportDocumentVersionPDF(ctx context.Context, input types.ExportDocumentVersionPDFInput) (*types.ExportDocumentVersionPDFPayload, error) { - if err := r.authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionExportPDF); err != nil { + scope, err := r.authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionExportPDF) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.DocumentVersionID) prb := r.probo watermarkEmail := input.WatermarkEmail @@ -1648,11 +1640,11 @@ func (r *mutationResolver) ExportDocumentVersionPDF(ctx context.Context, input t // ExportEmployeeDocumentVersionPDF is the resolver for the exportEmployeeDocumentVersionPDF field. func (r *mutationResolver) ExportEmployeeDocumentVersionPDF(ctx context.Context, input types.ExportEmployeeDocumentVersionPDFInput) (*types.ExportEmployeeDocumentVersionPDFPayload, error) { - if err := r.authorize(ctx, input.DocumentVersionID, probo.ActionEmployeeDocumentVersionExportPDF); err != nil { + scope, err := r.authorize(ctx, input.DocumentVersionID, probo.ActionEmployeeDocumentVersionExportPDF) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.DocumentVersionID) prb := r.probo documentVersion, err := prb.Documents.GetVersion(ctx, scope, input.DocumentVersionID) diff --git a/pkg/server/api/console/v1/evidence_resolvers.go b/pkg/server/api/console/v1/evidence_resolvers.go index a40898451..4fee9b2a2 100644 --- a/pkg/server/api/console/v1/evidence_resolvers.go +++ b/pkg/server/api/console/v1/evidence_resolvers.go @@ -22,7 +22,7 @@ import ( // File is the resolver for the file field. func (r *evidenceResolver) File(ctx context.Context, obj *types.Evidence) (*types.File, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionFileGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionFileGet); err != nil { return nil, err } @@ -48,7 +48,7 @@ func (r *evidenceResolver) File(ctx context.Context, obj *types.Evidence) (*type // Task is the resolver for the task field. func (r *evidenceResolver) Task(ctx context.Context, obj *types.Evidence) (*types.Task, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionTaskGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionTaskGet); err != nil { return nil, err } @@ -75,7 +75,7 @@ func (r *evidenceResolver) Task(ctx context.Context, obj *types.Evidence) (*type // Measure is the resolver for the measure field. func (r *evidenceResolver) Measure(ctx context.Context, obj *types.Evidence) (*types.Measure, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionMeasureGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionMeasureGet); err != nil { return nil, err } @@ -102,11 +102,11 @@ func (r *evidenceResolver) Permission(ctx context.Context, obj *types.Evidence, // TotalCount is the resolver for the totalCount field. func (r *evidenceConnectionResolver) TotalCount(ctx context.Context, obj *types.EvidenceConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionEvidenceList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionEvidenceList) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) prb := r.probo switch obj.Resolver.(type) { @@ -135,15 +135,14 @@ func (r *evidenceConnectionResolver) TotalCount(ctx context.Context, obj *types. // DeleteEvidence is the resolver for the deleteEvidence field. func (r *mutationResolver) DeleteEvidence(ctx context.Context, input types.DeleteEvidenceInput) (*types.DeleteEvidencePayload, error) { - if err := r.authorize(ctx, input.EvidenceID, probo.ActionEvidenceDelete); err != nil { + scope, err := r.authorize(ctx, input.EvidenceID, probo.ActionEvidenceDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.EvidenceID) prb := r.probo - err := prb.Evidences.Delete(ctx, scope, input.EvidenceID) - if err != nil { + if err := prb.Evidences.Delete(ctx, scope, input.EvidenceID); err != nil { r.logger.ErrorCtx(ctx, "cannot delete evidence", log.Error(err)) return nil, gqlutils.Internal(ctx) } @@ -155,11 +154,11 @@ func (r *mutationResolver) DeleteEvidence(ctx context.Context, input types.Delet // UploadMeasureEvidence is the resolver for the uploadMeasureEvidence field. func (r *mutationResolver) UploadMeasureEvidence(ctx context.Context, input types.UploadMeasureEvidenceInput) (*types.UploadMeasureEvidencePayload, error) { - if err := r.authorize(ctx, input.MeasureID, probo.ActionMeasureEvidenceUpload); err != nil { + scope, err := r.authorize(ctx, input.MeasureID, probo.ActionMeasureEvidenceUpload) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.MeasureID) prb := r.probo evidence, err := prb.Evidences.UploadMeasureEvidence( diff --git a/pkg/server/api/console/v1/file_resolvers.go b/pkg/server/api/console/v1/file_resolvers.go index afb169eac..02757be62 100644 --- a/pkg/server/api/console/v1/file_resolvers.go +++ b/pkg/server/api/console/v1/file_resolvers.go @@ -10,7 +10,6 @@ import ( "time" "go.gearno.de/kit/log" - "go.probo.inc/probo/pkg/coredata" "go.probo.inc/probo/pkg/probo" "go.probo.inc/probo/pkg/server/api/console/v1/schema" "go.probo.inc/probo/pkg/server/api/console/v1/types" @@ -19,11 +18,11 @@ import ( // DownloadURL is the resolver for the downloadUrl field. func (r *fileResolver) DownloadURL(ctx context.Context, obj *types.File) (string, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionFileDownloadUrl); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionFileDownloadUrl) + if err != nil { return "", err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo downloadUrl, err := prb.Files.GenerateFileTempURL(ctx, scope, obj.ID, 60*time.Second) diff --git a/pkg/server/api/console/v1/framework_resolvers.go b/pkg/server/api/console/v1/framework_resolvers.go index c8d4a369f..251be4e30 100644 --- a/pkg/server/api/console/v1/framework_resolvers.go +++ b/pkg/server/api/console/v1/framework_resolvers.go @@ -26,7 +26,7 @@ import ( // Organization is the resolver for the organization field. func (r *frameworkResolver) Organization(ctx context.Context, obj *types.Framework) (*types.Organization, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { return nil, err } @@ -48,11 +48,11 @@ func (r *frameworkResolver) Organization(ctx context.Context, obj *types.Framewo // Controls is the resolver for the controls field. func (r *frameworkResolver) Controls(ctx context.Context, obj *types.Framework, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy, filter *types.ControlFilter) (*types.ControlConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionControlList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionControlList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.ControlOrderField]{ @@ -84,11 +84,11 @@ func (r *frameworkResolver) Controls(ctx context.Context, obj *types.Framework, // LightLogoURL is the resolver for the lightLogoURL field. func (r *frameworkResolver) LightLogoURL(ctx context.Context, obj *types.Framework) (*string, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionFrameworkGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionFrameworkGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo return prb.Frameworks.GenerateLightLogoURL(ctx, scope, obj.ID, 1*time.Hour) @@ -96,11 +96,11 @@ func (r *frameworkResolver) LightLogoURL(ctx context.Context, obj *types.Framewo // DarkLogoURL is the resolver for the darkLogoURL field. func (r *frameworkResolver) DarkLogoURL(ctx context.Context, obj *types.Framework) (*string, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionFrameworkGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionFrameworkGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo return prb.Frameworks.GenerateDarkLogoURL(ctx, scope, obj.ID, 1*time.Hour) @@ -113,13 +113,13 @@ func (r *frameworkResolver) Permission(ctx context.Context, obj *types.Framework // TotalCount is the resolver for the totalCount field. func (r *frameworkConnectionResolver) TotalCount(ctx context.Context, obj *types.FrameworkConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionFrameworkList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionFrameworkList) + if err != nil { return 0, err } switch obj.Resolver.(type) { case *organizationResolver: - scope := coredata.NewScopeFromObjectID(obj.ParentID) prb := r.probo count, err := prb.Frameworks.CountForOrganizationID(ctx, scope, obj.ParentID) @@ -138,11 +138,11 @@ func (r *frameworkConnectionResolver) TotalCount(ctx context.Context, obj *types // CreateFramework is the resolver for the createFramework field. func (r *mutationResolver) CreateFramework(ctx context.Context, input types.CreateFrameworkInput) (*types.CreateFrameworkPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionFrameworkCreate); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionFrameworkCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo framework, err := prb.Frameworks.Create( @@ -169,11 +169,11 @@ func (r *mutationResolver) CreateFramework(ctx context.Context, input types.Crea // UpdateFramework is the resolver for the updateFramework field. func (r *mutationResolver) UpdateFramework(ctx context.Context, input types.UpdateFrameworkInput) (*types.UpdateFrameworkPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionFrameworkUpdate); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionFrameworkUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo framework, err := prb.Frameworks.Update( @@ -201,11 +201,11 @@ func (r *mutationResolver) UpdateFramework(ctx context.Context, input types.Upda // ImportFramework is the resolver for the importFramework field. func (r *mutationResolver) ImportFramework(ctx context.Context, input types.ImportFrameworkInput) (*types.ImportFrameworkPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionFrameworkImport); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionFrameworkImport) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo req := probo.ImportFrameworkRequest{} @@ -232,15 +232,14 @@ func (r *mutationResolver) ImportFramework(ctx context.Context, input types.Impo // DeleteFramework is the resolver for the deleteFramework field. func (r *mutationResolver) DeleteFramework(ctx context.Context, input types.DeleteFrameworkInput) (*types.DeleteFrameworkPayload, error) { - if err := r.authorize(ctx, input.FrameworkID, probo.ActionFrameworkDelete); err != nil { + scope, err := r.authorize(ctx, input.FrameworkID, probo.ActionFrameworkDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.FrameworkID) prb := r.probo - err := prb.Frameworks.Delete(ctx, scope, input.FrameworkID) - if err != nil { + if err := prb.Frameworks.Delete(ctx, scope, input.FrameworkID); err != nil { r.logger.ErrorCtx(ctx, "cannot delete framework", log.Error(err)) return nil, gqlutils.Internal(ctx) } @@ -252,11 +251,11 @@ func (r *mutationResolver) DeleteFramework(ctx context.Context, input types.Dele // ExportFramework is the resolver for the exportFramework field. func (r *mutationResolver) ExportFramework(ctx context.Context, input types.ExportFrameworkInput) (*types.ExportFrameworkPayload, error) { - if err := r.authorize(ctx, input.FrameworkID, probo.ActionFrameworkExport); err != nil { + scope, err := r.authorize(ctx, input.FrameworkID, probo.ActionFrameworkExport) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.FrameworkID) prb := r.probo identity := authn.IdentityFromContext(ctx) diff --git a/pkg/server/api/console/v1/mailing_list_resolvers.go b/pkg/server/api/console/v1/mailing_list_resolvers.go index fe159dec7..30bfd76cd 100644 --- a/pkg/server/api/console/v1/mailing_list_resolvers.go +++ b/pkg/server/api/console/v1/mailing_list_resolvers.go @@ -23,7 +23,7 @@ import ( // Subscribers is the resolver for the subscribers field on MailingList. func (r *mailingListResolver) Subscribers(ctx context.Context, obj *types.MailingList, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.MailingListSubscriberConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionMailingListSubscriberList); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionMailingListSubscriberList); err != nil { return nil, err } @@ -45,7 +45,7 @@ func (r *mailingListResolver) Subscribers(ctx context.Context, obj *types.Mailin // Updates is the resolver for the updates field on MailingList. func (r *mailingListResolver) Updates(ctx context.Context, obj *types.MailingList, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.MailingListUpdateConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionMailingListUpdateList); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionMailingListUpdateList); err != nil { return nil, err } @@ -67,7 +67,7 @@ func (r *mailingListResolver) Updates(ctx context.Context, obj *types.MailingLis // TotalCount is the resolver for the totalCount field. func (r *mailingListSubscriberConnectionResolver) TotalCount(ctx context.Context, obj *types.MailingListSubscriberConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionMailingListSubscriberList); err != nil { + if _, err := r.authorize(ctx, obj.ParentID, probo.ActionMailingListSubscriberList); err != nil { return 0, err } @@ -89,7 +89,7 @@ func (r *mailingListSubscriberConnectionResolver) TotalCount(ctx context.Context // TotalCount is the resolver for the totalCount field on MailingListUpdateConnection. func (r *mailingListUpdateConnectionResolver) TotalCount(ctx context.Context, obj *types.MailingListUpdateConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionMailingListUpdateList); err != nil { + if _, err := r.authorize(ctx, obj.ParentID, probo.ActionMailingListUpdateList); err != nil { return 0, err } @@ -104,7 +104,7 @@ func (r *mailingListUpdateConnectionResolver) TotalCount(ctx context.Context, ob // CreateMailingListUpdate is the resolver for the createMailingListUpdate field. func (r *mutationResolver) CreateMailingListUpdate(ctx context.Context, input types.CreateMailingListUpdateInput) (*types.CreateMailingListUpdatePayload, error) { - if err := r.authorize(ctx, input.MailingListID, probo.ActionMailingListUpdateCreate); err != nil { + if _, err := r.authorize(ctx, input.MailingListID, probo.ActionMailingListUpdateCreate); err != nil { return nil, err } @@ -133,7 +133,7 @@ func (r *mutationResolver) CreateMailingListUpdate(ctx context.Context, input ty // UpdateMailingListUpdate is the resolver for the updateMailingListUpdate field. func (r *mutationResolver) UpdateMailingListUpdate(ctx context.Context, input types.UpdateMailingListUpdateInput) (*types.UpdateMailingListUpdatePayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionMailingListUpdateUpdate); err != nil { + if _, err := r.authorize(ctx, input.ID, probo.ActionMailingListUpdateUpdate); err != nil { return nil, err } @@ -170,7 +170,7 @@ func (r *mutationResolver) UpdateMailingListUpdate(ctx context.Context, input ty // SendMailingListUpdate is the resolver for the sendMailingListUpdate field. func (r *mutationResolver) SendMailingListUpdate(ctx context.Context, input types.SendMailingListUpdateInput) (*types.SendMailingListUpdatePayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionMailingListUpdateUpdate); err != nil { + if _, err := r.authorize(ctx, input.ID, probo.ActionMailingListUpdateUpdate); err != nil { return nil, err } @@ -196,7 +196,7 @@ func (r *mutationResolver) SendMailingListUpdate(ctx context.Context, input type // DeleteMailingListUpdate is the resolver for the deleteMailingListUpdate field. func (r *mutationResolver) DeleteMailingListUpdate(ctx context.Context, input types.DeleteMailingListUpdateInput) (*types.DeleteMailingListUpdatePayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionMailingListUpdateDelete); err != nil { + if _, err := r.authorize(ctx, input.ID, probo.ActionMailingListUpdateDelete); err != nil { return nil, err } @@ -217,7 +217,7 @@ func (r *mutationResolver) DeleteMailingListUpdate(ctx context.Context, input ty // UpdateMailingList is the resolver for the updateMailingList field. func (r *mutationResolver) UpdateMailingList(ctx context.Context, input types.UpdateMailingListInput) (*types.UpdateMailingListPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionMailingListUpdate); err != nil { + if _, err := r.authorize(ctx, input.ID, probo.ActionMailingListUpdate); err != nil { return nil, err } @@ -234,7 +234,7 @@ func (r *mutationResolver) UpdateMailingList(ctx context.Context, input types.Up // CreateMailingListSubscriber is the resolver for the createMailingListSubscriber field. func (r *mutationResolver) CreateMailingListSubscriber(ctx context.Context, input types.CreateMailingListSubscriberInput) (*types.CreateMailingListSubscriberPayload, error) { - if err := r.authorize(ctx, input.MailingListID, probo.ActionMailingListSubscriberCreate); err != nil { + if _, err := r.authorize(ctx, input.MailingListID, probo.ActionMailingListSubscriberCreate); err != nil { return nil, err } @@ -268,7 +268,7 @@ func (r *mutationResolver) CreateMailingListSubscriber(ctx context.Context, inpu // DeleteMailingListSubscriber is the resolver for the deleteMailingListSubscriber field. func (r *mutationResolver) DeleteMailingListSubscriber(ctx context.Context, input types.DeleteMailingListSubscriberInput) (*types.DeleteMailingListSubscriberPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionMailingListSubscriberDelete); err != nil { + if _, err := r.authorize(ctx, input.ID, probo.ActionMailingListSubscriberDelete); err != nil { return nil, err } diff --git a/pkg/server/api/console/v1/measure_resolvers.go b/pkg/server/api/console/v1/measure_resolvers.go index 99f4c5ce4..ba4f059d1 100644 --- a/pkg/server/api/console/v1/measure_resolvers.go +++ b/pkg/server/api/console/v1/measure_resolvers.go @@ -22,11 +22,11 @@ import ( // Evidences is the resolver for the evidences field. func (r *measureResolver) Evidences(ctx context.Context, obj *types.Measure, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.EvidenceOrderBy) (*types.EvidenceConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionEvidenceList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionEvidenceList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.EvidenceOrderField]{ @@ -53,11 +53,11 @@ func (r *measureResolver) Evidences(ctx context.Context, obj *types.Measure, fir // Tasks is the resolver for the tasks field. func (r *measureResolver) Tasks(ctx context.Context, obj *types.Measure, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.TaskOrderBy) (*types.TaskConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionTaskList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionTaskList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.TaskOrderField]{ @@ -84,11 +84,11 @@ func (r *measureResolver) Tasks(ctx context.Context, obj *types.Measure, first * // Risks is the resolver for the risks field. func (r *measureResolver) Risks(ctx context.Context, obj *types.Measure, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskOrderBy, filter *types.RiskFilter) (*types.RiskConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionRiskList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionRiskList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.RiskOrderField]{ @@ -120,11 +120,11 @@ func (r *measureResolver) Risks(ctx context.Context, obj *types.Measure, first * // Controls is the resolver for the controls field. func (r *measureResolver) Controls(ctx context.Context, obj *types.Measure, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy, filter *types.ControlFilter) (*types.ControlConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionControlList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionControlList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.ControlOrderField]{ @@ -156,11 +156,11 @@ func (r *measureResolver) Controls(ctx context.Context, obj *types.Measure, firs // Documents is the resolver for the documents field. func (r *measureResolver) Documents(ctx context.Context, obj *types.Measure, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentOrderBy, filter *types.DocumentFilter) (*types.DocumentConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionDocumentList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.DocumentOrderField]{ @@ -200,11 +200,11 @@ func (r *measureResolver) Permission(ctx context.Context, obj *types.Measure, ac // TotalCount is the resolver for the totalCount field. func (r *measureConnectionResolver) TotalCount(ctx context.Context, obj *types.MeasureConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionMeasureList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionMeasureList) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) prb := r.probo switch obj.Resolver.(type) { @@ -241,11 +241,11 @@ func (r *measureConnectionResolver) TotalCount(ctx context.Context, obj *types.M // // CreateMeasure is the resolver for the createMeasure field. func (r *mutationResolver) CreateMeasure(ctx context.Context, input types.CreateMeasureInput) (*types.CreateMeasurePayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionMeasureCreate); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionMeasureCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo measure, err := prb.Measures.Create( @@ -278,11 +278,11 @@ func (r *mutationResolver) CreateMeasure(ctx context.Context, input types.Create // UpdateMeasure is the resolver for the updateMeasure field. func (r *mutationResolver) UpdateMeasure(ctx context.Context, input types.UpdateMeasureInput) (*types.UpdateMeasurePayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionMeasureUpdate); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionMeasureUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo measure, err := prb.Measures.Update( @@ -312,11 +312,11 @@ func (r *mutationResolver) UpdateMeasure(ctx context.Context, input types.Update // ImportMeasure is the resolver for the importMeasure field. func (r *mutationResolver) ImportMeasure(ctx context.Context, input types.ImportMeasureInput) (*types.ImportMeasurePayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionMeasureImport); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionMeasureImport) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo var req probo.ImportMeasureRequest @@ -343,15 +343,14 @@ func (r *mutationResolver) ImportMeasure(ctx context.Context, input types.Import // DeleteMeasure is the resolver for the deleteMeasure field. func (r *mutationResolver) DeleteMeasure(ctx context.Context, input types.DeleteMeasureInput) (*types.DeleteMeasurePayload, error) { - if err := r.authorize(ctx, input.MeasureID, probo.ActionMeasureDelete); err != nil { + scope, err := r.authorize(ctx, input.MeasureID, probo.ActionMeasureDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.MeasureID) prb := r.probo - err := prb.Measures.Delete(ctx, scope, input.MeasureID) - if err != nil { + if err := prb.Measures.Delete(ctx, scope, input.MeasureID); err != nil { r.logger.ErrorCtx(ctx, "cannot delete measure", log.Error(err)) return nil, gqlutils.Internal(ctx) } @@ -363,11 +362,11 @@ func (r *mutationResolver) DeleteMeasure(ctx context.Context, input types.Delete // CreateMeasureDocumentMapping is the resolver for the createMeasureDocumentMapping field. func (r *mutationResolver) CreateMeasureDocumentMapping(ctx context.Context, input types.CreateMeasureDocumentMappingInput) (*types.CreateMeasureDocumentMappingPayload, error) { - if err := r.authorize(ctx, input.MeasureID, probo.ActionMeasureDocumentMappingCreate); err != nil { + scope, err := r.authorize(ctx, input.MeasureID, probo.ActionMeasureDocumentMappingCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.MeasureID) prb := r.probo measure, document, err := prb.Measures.CreateDocumentMapping(ctx, scope, input.MeasureID, input.DocumentID) @@ -389,11 +388,11 @@ func (r *mutationResolver) CreateMeasureDocumentMapping(ctx context.Context, inp // DeleteMeasureDocumentMapping is the resolver for the deleteMeasureDocumentMapping field. func (r *mutationResolver) DeleteMeasureDocumentMapping(ctx context.Context, input types.DeleteMeasureDocumentMappingInput) (*types.DeleteMeasureDocumentMappingPayload, error) { - if err := r.authorize(ctx, input.MeasureID, probo.ActionMeasureDocumentMappingDelete); err != nil { + scope, err := r.authorize(ctx, input.MeasureID, probo.ActionMeasureDocumentMappingDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.MeasureID) prb := r.probo measure, document, err := prb.Measures.DeleteDocumentMapping(ctx, scope, input.MeasureID, input.DocumentID) diff --git a/pkg/server/api/console/v1/obligation_resolvers.go b/pkg/server/api/console/v1/obligation_resolvers.go index 599d2ac2c..86789bee1 100644 --- a/pkg/server/api/console/v1/obligation_resolvers.go +++ b/pkg/server/api/console/v1/obligation_resolvers.go @@ -23,11 +23,11 @@ import ( // CreateObligation is the resolver for the createObligation field. func (r *mutationResolver) CreateObligation(ctx context.Context, input types.CreateObligationInput) (*types.CreateObligationPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionObligationCreate); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionObligationCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo req := probo.CreateObligationRequest{ @@ -62,11 +62,11 @@ func (r *mutationResolver) CreateObligation(ctx context.Context, input types.Cre // UpdateObligation is the resolver for the updateObligation field. func (r *mutationResolver) UpdateObligation(ctx context.Context, input types.UpdateObligationInput) (*types.UpdateObligationPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionObligationUpdate); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionObligationUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo req := probo.UpdateObligationRequest{ @@ -101,15 +101,14 @@ func (r *mutationResolver) UpdateObligation(ctx context.Context, input types.Upd // DeleteObligation is the resolver for the deleteObligation field. func (r *mutationResolver) DeleteObligation(ctx context.Context, input types.DeleteObligationInput) (*types.DeleteObligationPayload, error) { - if err := r.authorize(ctx, input.ObligationID, probo.ActionObligationDelete); err != nil { + scope, err := r.authorize(ctx, input.ObligationID, probo.ActionObligationDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ObligationID) prb := r.probo - err := prb.Obligations.Delete(ctx, scope, input.ObligationID) - if err != nil { + if err := prb.Obligations.Delete(ctx, scope, input.ObligationID); err != nil { r.logger.ErrorCtx(ctx, "cannot delete obligation", log.Error(err)) return nil, gqlutils.Internal(ctx) } @@ -121,11 +120,11 @@ func (r *mutationResolver) DeleteObligation(ctx context.Context, input types.Del // PublishObligationList is the resolver for the publishObligationList field. func (r *mutationResolver) PublishObligationList(ctx context.Context, input types.PublishObligationListInput) (*types.PublishObligationListPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionObligationPublish); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionObligationPublish) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo document, documentVersion, err := prb.GeneratedDocuments.PublishObligationList(ctx, scope, input.OrganizationID, input.ApproverIds, input.Minor) @@ -151,7 +150,7 @@ func (r *mutationResolver) PublishObligationList(ctx context.Context, input type // Organization is the resolver for the organization field. func (r *obligationResolver) Organization(ctx context.Context, obj *types.Obligation) (*types.Organization, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { return nil, err } @@ -173,7 +172,7 @@ func (r *obligationResolver) Organization(ctx context.Context, obj *types.Obliga // Owner is the resolver for the owner field. func (r *obligationResolver) Owner(ctx context.Context, obj *types.Obligation) (*types.Profile, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } @@ -200,11 +199,11 @@ func (r *obligationResolver) Permission(ctx context.Context, obj *types.Obligati // TotalCount is the resolver for the totalCount field. func (r *obligationConnectionResolver) TotalCount(ctx context.Context, obj *types.ObligationConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionObligationList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionObligationList) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) prb := r.probo switch obj.Resolver.(type) { diff --git a/pkg/server/api/console/v1/organization_resolvers.go b/pkg/server/api/console/v1/organization_resolvers.go index c57a07190..27a49d272 100644 --- a/pkg/server/api/console/v1/organization_resolvers.go +++ b/pkg/server/api/console/v1/organization_resolvers.go @@ -28,11 +28,11 @@ import ( // UpdateOrganizationContext is the resolver for the updateOrganizationContext field. func (r *mutationResolver) UpdateOrganizationContext(ctx context.Context, input types.UpdateOrganizationContextInput) (*types.UpdateOrganizationContextPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionOrganizationContextUpdate); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionOrganizationContextUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo req := probo.UpdateOrganizationContextRequest{ @@ -62,11 +62,11 @@ func (r *mutationResolver) UpdateOrganizationContext(ctx context.Context, input // LogoURL is the resolver for the logoUrl field. func (r *organizationResolver) LogoURL(ctx context.Context, obj *types.Organization) (*string, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGetLogoUrl); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGetLogoUrl) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo logoURL, err := prb.Organizations.GenerateLogoURL(ctx, scope, obj.ID, 1*time.Hour) @@ -80,11 +80,11 @@ func (r *organizationResolver) LogoURL(ctx context.Context, obj *types.Organizat // HorizontalLogoURL is the resolver for the horizontalLogoUrl field. func (r *organizationResolver) HorizontalLogoURL(ctx context.Context, obj *types.Organization) (*string, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGetHorizontalLogoUrl); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGetHorizontalLogoUrl) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo horizontalLogoURL, err := prb.Organizations.GenerateHorizontalLogoURL(ctx, scope, obj.ID, 1*time.Hour) @@ -98,11 +98,11 @@ func (r *organizationResolver) HorizontalLogoURL(ctx context.Context, obj *types // Context is the resolver for the context field. func (r *organizationResolver) Context(ctx context.Context, obj *types.Organization) (*types.OrganizationContext, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationContextGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationContextGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo orgContext, err := prb.Organizations.GetContext(ctx, scope, obj.ID) @@ -116,7 +116,7 @@ func (r *organizationResolver) Context(ctx context.Context, obj *types.Organizat // Profiles is the resolver for the profiles field. func (r *organizationResolver) Profiles(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ProfileOrderBy, filter *types.ProfileFilter) (*types.ProfileConnection, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileList); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileList); err != nil { return nil, err } @@ -157,11 +157,11 @@ func (r *organizationResolver) Profiles(ctx context.Context, obj *types.Organiza // MeasureCategories is the resolver for the measureCategories field. func (r *organizationResolver) MeasureCategories(ctx context.Context, obj *types.Organization) ([]string, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionMeasureList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionMeasureList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo categories, err := prb.Measures.ListDistinctCategoriesForOrganizationID(ctx, scope, obj.ID) @@ -175,12 +175,11 @@ func (r *organizationResolver) MeasureCategories(ctx context.Context, obj *types // AccessSources is the resolver for the accessSources field. func (r *organizationResolver) AccessSources(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AccessSourceOrder) (*types.AccessSourceConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) - pageOrderBy := page.OrderBy[coredata.AccessSourceOrderField]{ Field: coredata.AccessSourceOrderFieldCreatedAt, Direction: page.OrderDirectionDesc, @@ -204,12 +203,11 @@ func (r *organizationResolver) AccessSources(ctx context.Context, obj *types.Org // AccessReviewCampaigns is the resolver for the accessReviewCampaigns field. func (r *organizationResolver) AccessReviewCampaigns(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AccessReviewCampaignOrder) (*types.AccessReviewCampaignConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionAccessReviewCampaignList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessReviewCampaignList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) - pageOrderBy := page.OrderBy[coredata.AccessReviewCampaignOrderField]{ Field: coredata.AccessReviewCampaignOrderFieldCreatedAt, Direction: page.OrderDirectionDesc, @@ -233,11 +231,11 @@ func (r *organizationResolver) AccessReviewCampaigns(ctx context.Context, obj *t // AssetListDocument is the resolver for the assetListDocument field. func (r *organizationResolver) AssetListDocument(ctx context.Context, obj *types.Organization) (*types.Document, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo assetDocumentID, err := prb.GeneratedDocuments.GetAssetListDocumentID(ctx, scope, obj.ID) @@ -259,11 +257,11 @@ func (r *organizationResolver) AssetListDocument(ctx context.Context, obj *types // Assets is the resolver for the assets field. func (r *organizationResolver) Assets(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AssetOrderBy) (*types.AssetConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionAssetList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionAssetList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.AssetOrderField]{ @@ -290,11 +288,11 @@ func (r *organizationResolver) Assets(ctx context.Context, obj *types.Organizati // DataListDocument is the resolver for the dataListDocument field. func (r *organizationResolver) DataListDocument(ctx context.Context, obj *types.Organization) (*types.Document, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo dataDocumentID, err := prb.GeneratedDocuments.GetDataListDocumentID(ctx, scope, obj.ID) @@ -316,11 +314,11 @@ func (r *organizationResolver) DataListDocument(ctx context.Context, obj *types. // Data is the resolver for the data field. func (r *organizationResolver) Data(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DatumOrderBy) (*types.DatumConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionDatumList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionDatumList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.DatumOrderField]{ @@ -347,11 +345,11 @@ func (r *organizationResolver) Data(ctx context.Context, obj *types.Organization // Audits is the resolver for the audits field. func (r *organizationResolver) Audits(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AuditOrderBy) (*types.AuditConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionAuditList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionAuditList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.AuditOrderField]{ @@ -378,11 +376,11 @@ func (r *organizationResolver) Audits(ctx context.Context, obj *types.Organizati // FindingsDocument is the resolver for the findingsDocument field. func (r *organizationResolver) FindingsDocument(ctx context.Context, obj *types.Organization) (*types.Document, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo findingDocumentID, err := prb.GeneratedDocuments.GetFindingsDocumentID(ctx, scope, obj.ID) @@ -404,11 +402,11 @@ func (r *organizationResolver) FindingsDocument(ctx context.Context, obj *types. // Findings is the resolver for the findings field. func (r *organizationResolver) Findings(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.FindingOrder, filter *types.FindingFilter) (*types.FindingConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionFindingList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionFindingList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.FindingOrderField]{ @@ -451,7 +449,7 @@ func (r *organizationResolver) Findings(ctx context.Context, obj *types.Organiza // AuditLogEntries is the resolver for the auditLogEntries field. func (r *organizationResolver) AuditLogEntries(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AuditLogEntryOrderBy, filter *types.AuditLogEntryFilter) (*types.AuditLogEntryConnection, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionAuditLogEntryList); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionAuditLogEntryList); err != nil { return nil, err } @@ -499,11 +497,11 @@ func (r *organizationResolver) AuditLogEntries(ctx context.Context, obj *types.O // SlackConnections is the resolver for the slackConnections field. func (r *organizationResolver) SlackConnections(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.SlackConnectionConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionSlackConnectionList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionSlackConnectionList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo slackProvider := coredata.ConnectorProviderSlack @@ -532,11 +530,11 @@ func (r *organizationResolver) SlackOAuth2Scopes(ctx context.Context, obj *types // Connectors is the resolver for the connectors field. func (r *organizationResolver) Connectors(ctx context.Context, obj *types.Organization, filter *types.ConnectorFilter) ([]*types.Connector, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionConnectorList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionConnectorList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo connectors, err := prb.Connectors.ListAllForOrganizationID(ctx, scope, obj.ID) @@ -565,7 +563,7 @@ func (r *organizationResolver) Connectors(ctx context.Context, obj *types.Organi // ConnectorProviderInfos is the resolver for the connectorProviderInfos field. func (r *organizationResolver) ConnectorProviderInfos(ctx context.Context, obj *types.Organization) ([]*types.ConnectorProviderInfo, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionConnectorList); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionConnectorList); err != nil { return nil, err } @@ -596,11 +594,11 @@ func (r *organizationResolver) ConnectorProviderInfos(ctx context.Context, obj * // Controls is the resolver for the controls field. func (r *organizationResolver) Controls(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy, filter *types.ControlFilter) (*types.ControlConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionControlList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionControlList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.ControlOrderField]{ @@ -632,11 +630,11 @@ func (r *organizationResolver) Controls(ctx context.Context, obj *types.Organiza // StatementsOfApplicability is the resolver for the statementsOfApplicability field. func (r *organizationResolver) StatementsOfApplicability(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.StatementOfApplicabilityOrderBy) (*types.StatementOfApplicabilityConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionStatementOfApplicabilityList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionStatementOfApplicabilityList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.StatementOfApplicabilityOrderField]{ @@ -663,11 +661,11 @@ func (r *organizationResolver) StatementsOfApplicability(ctx context.Context, ob // DataProtectionImpactAssessments is the resolver for the dataProtectionImpactAssessments field. func (r *organizationResolver) DataProtectionImpactAssessments(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DataProtectionImpactAssessmentOrderBy) (*types.DataProtectionImpactAssessmentConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionDataProtectionImpactAssessmentList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionDataProtectionImpactAssessmentList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.DataProtectionImpactAssessmentOrderField]{ @@ -695,11 +693,11 @@ func (r *organizationResolver) DataProtectionImpactAssessments(ctx context.Conte // DataProtectionImpactAssessmentsDocument is the resolver for the dataProtectionImpactAssessmentsDocument field. func (r *organizationResolver) DataProtectionImpactAssessmentsDocument(ctx context.Context, obj *types.Organization) (*types.Document, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo documentID, err := prb.GeneratedDocuments.GetDataProtectionImpactAssessmentsDocumentID(ctx, scope, obj.ID) @@ -728,11 +726,11 @@ func (r *organizationResolver) DataProtectionImpactAssessmentsDocument(ctx conte // TransferImpactAssessments is the resolver for the transferImpactAssessments field. func (r *organizationResolver) TransferImpactAssessments(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.TransferImpactAssessmentOrderBy) (*types.TransferImpactAssessmentConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionTransferImpactAssessmentList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionTransferImpactAssessmentList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.TransferImpactAssessmentOrderField]{ @@ -760,11 +758,11 @@ func (r *organizationResolver) TransferImpactAssessments(ctx context.Context, ob // TransferImpactAssessmentsDocument is the resolver for the transferImpactAssessmentsDocument field. func (r *organizationResolver) TransferImpactAssessmentsDocument(ctx context.Context, obj *types.Organization) (*types.Document, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo documentID, err := prb.GeneratedDocuments.GetTransferImpactAssessmentsDocumentID(ctx, scope, obj.ID) @@ -793,11 +791,11 @@ func (r *organizationResolver) TransferImpactAssessmentsDocument(ctx context.Con // Documents is the resolver for the documents field. func (r *organizationResolver) Documents(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentOrderBy, filter *types.DocumentFilter) (*types.DocumentConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionDocumentList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.DocumentOrderField]{ @@ -838,11 +836,11 @@ func (r *organizationResolver) Evidences(ctx context.Context, obj *types.Organiz // Frameworks is the resolver for the frameworks field. func (r *organizationResolver) Frameworks(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.FrameworkOrderBy) (*types.FrameworkConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionFrameworkList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionFrameworkList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.FrameworkOrderField]{ @@ -869,11 +867,11 @@ func (r *organizationResolver) Frameworks(ctx context.Context, obj *types.Organi // Measures is the resolver for the measures field. func (r *organizationResolver) Measures(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.MeasureOrderBy, filter *types.MeasureFilter) (*types.MeasureConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionMeasureList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionMeasureList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.MeasureOrderField]{ @@ -905,11 +903,11 @@ func (r *organizationResolver) Measures(ctx context.Context, obj *types.Organiza // ObligationsDocument is the resolver for the obligationsDocument field. func (r *organizationResolver) ObligationsDocument(ctx context.Context, obj *types.Organization) (*types.Document, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo obligationDocumentID, err := prb.GeneratedDocuments.GetObligationsDocumentID(ctx, scope, obj.ID) @@ -931,11 +929,11 @@ func (r *organizationResolver) ObligationsDocument(ctx context.Context, obj *typ // Obligations is the resolver for the obligations field. func (r *organizationResolver) Obligations(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ObligationOrderBy) (*types.ObligationConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionObligationList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionObligationList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.ObligationOrderField]{ @@ -963,11 +961,11 @@ func (r *organizationResolver) Obligations(ctx context.Context, obj *types.Organ // ProcessingActivities is the resolver for the processingActivities field. func (r *organizationResolver) ProcessingActivities(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ProcessingActivityOrderBy) (*types.ProcessingActivityConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionProcessingActivityList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionProcessingActivityList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.ProcessingActivityOrderField]{ @@ -995,11 +993,11 @@ func (r *organizationResolver) ProcessingActivities(ctx context.Context, obj *ty // ProcessingActivitiesDocument is the resolver for the processingActivitiesDocument field. func (r *organizationResolver) ProcessingActivitiesDocument(ctx context.Context, obj *types.Organization) (*types.Document, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo documentID, err := prb.GeneratedDocuments.GetProcessingActivitiesDocumentID(ctx, scope, obj.ID) @@ -1028,11 +1026,11 @@ func (r *organizationResolver) ProcessingActivitiesDocument(ctx context.Context, // RightsRequests is the resolver for the rightsRequests field. func (r *organizationResolver) RightsRequests(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RightsRequestOrderBy) (*types.RightsRequestConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionRightsRequestList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionRightsRequestList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.RightsRequestOrderField]{ @@ -1060,11 +1058,11 @@ func (r *organizationResolver) RightsRequests(ctx context.Context, obj *types.Or // Risks is the resolver for the risks field. func (r *organizationResolver) Risks(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskOrderBy, filter *types.RiskFilter) (*types.RiskConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionRiskList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionRiskList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.RiskOrderField]{ @@ -1096,11 +1094,11 @@ func (r *organizationResolver) Risks(ctx context.Context, obj *types.Organizatio // RisksDocument is the resolver for the risksDocument field. func (r *organizationResolver) RisksDocument(ctx context.Context, obj *types.Organization) (*types.Document, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo documentID, err := prb.GeneratedDocuments.GetRisksDocumentID(ctx, scope, obj.ID) @@ -1129,12 +1127,11 @@ func (r *organizationResolver) RisksDocument(ctx context.Context, obj *types.Org // RiskAssessments is the resolver for the riskAssessments field. func (r *organizationResolver) RiskAssessments(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskAssessmentOrderBy) (*types.RiskAssessmentConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) - pageOrderBy := page.OrderBy[coredata.RiskAssessmentOrderField]{ Field: coredata.RiskAssessmentOrderFieldCreatedAt, Direction: page.OrderDirectionDesc, @@ -1159,12 +1156,11 @@ func (r *organizationResolver) RiskAssessments(ctx context.Context, obj *types.O // RiskAssessmentScenarios is the resolver for the riskAssessmentScenarios field. func (r *organizationResolver) RiskAssessmentScenarios(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskAssessmentScenarioOrderBy) (*types.RiskAssessmentScenarioConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentScenarioList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentScenarioList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) - pageOrderBy := page.OrderBy[coredata.RiskAssessmentScenarioOrderField]{ Field: coredata.RiskAssessmentScenarioOrderFieldCreatedAt, Direction: page.OrderDirectionDesc, @@ -1189,11 +1185,11 @@ func (r *organizationResolver) RiskAssessmentScenarios(ctx context.Context, obj // Tasks is the resolver for the tasks field. func (r *organizationResolver) Tasks(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.TaskOrderBy) (*types.TaskConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionTaskList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionTaskList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.TaskOrderField]{ @@ -1220,11 +1216,11 @@ func (r *organizationResolver) Tasks(ctx context.Context, obj *types.Organizatio // TrustCenter is the resolver for the trustCenter field. func (r *organizationResolver) TrustCenter(ctx context.Context, obj *types.Organization) (*types.TrustCenter, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo trustCenter, err := prb.TrustCenters.GetByOrganizationID(ctx, scope, obj.ID) @@ -1247,11 +1243,11 @@ func (r *organizationResolver) TrustCenter(ctx context.Context, obj *types.Organ // CustomDomain is the resolver for the customDomain field. func (r *organizationResolver) CustomDomain(ctx context.Context, obj *types.Organization) (*types.CustomDomain, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionCustomDomainGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionCustomDomainGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo domain, err := prb.CustomDomains.GetOrganizationCustomDomain(ctx, scope, obj.ID) @@ -1269,11 +1265,11 @@ func (r *organizationResolver) CustomDomain(ctx context.Context, obj *types.Orga // TrustCenterFiles is the resolver for the trustCenterFiles field. func (r *organizationResolver) TrustCenterFiles(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.OrderBy[coredata.TrustCenterFileOrderField]) (*types.TrustCenterFileConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterFileList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterFileList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.TrustCenterFileOrderField]{ @@ -1300,7 +1296,8 @@ func (r *organizationResolver) TrustCenterFiles(ctx context.Context, obj *types. // CookieBanners is the resolver for the cookieBanners field. func (r *organizationResolver) CookieBanners(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.CookieBannerOrderBy) (*types.CookieBannerConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionCookieBannerList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionCookieBannerList) + if err != nil { return nil, err } @@ -1316,7 +1313,6 @@ func (r *organizationResolver) CookieBanners(ctx context.Context, obj *types.Org } cursor := types.NewCursor(first, after, last, before, pageOrderBy) - scope := coredata.NewScopeFromObjectID(obj.ID) banners, err := r.cookieBanner.ListCookieBannersForOrganization(ctx, scope, obj.ID, cursor, coredata.NewCookieBannerFilter(nil)) if err != nil { @@ -1331,11 +1327,11 @@ func (r *organizationResolver) CookieBanners(ctx context.Context, obj *types.Org // ThirdParties is the resolver for the thirdParties field. func (r *organizationResolver) ThirdParties(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ThirdPartyOrderBy) (*types.ThirdPartyConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.ThirdPartyOrderField]{ @@ -1364,11 +1360,11 @@ func (r *organizationResolver) ThirdParties(ctx context.Context, obj *types.Orga // ThirdPartiesDocument is the resolver for the thirdPartiesDocument field. func (r *organizationResolver) ThirdPartiesDocument(ctx context.Context, obj *types.Organization) (*types.Document, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo documentID, err := prb.GeneratedDocuments.GetThirdPartiesDocumentID(ctx, scope, obj.ID) @@ -1397,11 +1393,11 @@ func (r *organizationResolver) ThirdPartiesDocument(ctx context.Context, obj *ty // WebhookSubscriptions is the resolver for the webhookSubscriptions field. func (r *organizationResolver) WebhookSubscriptions(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.WebhookSubscriptionOrderBy) (*types.WebhookSubscriptionConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionWebhookSubscriptionList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionWebhookSubscriptionList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.WebhookSubscriptionOrderField]{ @@ -1438,7 +1434,7 @@ func (r *profileResolver) Permission(ctx context.Context, obj *types.Profile, ac // TotalCount is the resolver for the totalCount field. func (r *profileConnectionResolver) TotalCount(ctx context.Context, obj *types.ProfileConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, iam.ActionMembershipProfileList); err != nil { + if _, err := r.authorize(ctx, obj.ParentID, iam.ActionMembershipProfileList); err != nil { return 0, err } diff --git a/pkg/server/api/console/v1/processing_activity_resolvers.go b/pkg/server/api/console/v1/processing_activity_resolvers.go index a85584662..a9ac31975 100644 --- a/pkg/server/api/console/v1/processing_activity_resolvers.go +++ b/pkg/server/api/console/v1/processing_activity_resolvers.go @@ -23,11 +23,11 @@ import ( // CreateProcessingActivity is the resolver for the createProcessingActivity field. func (r *mutationResolver) CreateProcessingActivity(ctx context.Context, input types.CreateProcessingActivityInput) (*types.CreateProcessingActivityPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionProcessingActivityCreate); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionProcessingActivityCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo req := probo.CreateProcessingActivityRequest{ @@ -66,11 +66,11 @@ func (r *mutationResolver) CreateProcessingActivity(ctx context.Context, input t // UpdateProcessingActivity is the resolver for the updateProcessingActivity field. func (r *mutationResolver) UpdateProcessingActivity(ctx context.Context, input types.UpdateProcessingActivityInput) (*types.UpdateProcessingActivityPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionProcessingActivityUpdate); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionProcessingActivityUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo req := probo.UpdateProcessingActivityRequest{ @@ -109,15 +109,14 @@ func (r *mutationResolver) UpdateProcessingActivity(ctx context.Context, input t // DeleteProcessingActivity is the resolver for the deleteProcessingActivity field. func (r *mutationResolver) DeleteProcessingActivity(ctx context.Context, input types.DeleteProcessingActivityInput) (*types.DeleteProcessingActivityPayload, error) { - if err := r.authorize(ctx, input.ProcessingActivityID, probo.ActionProcessingActivityDelete); err != nil { + scope, err := r.authorize(ctx, input.ProcessingActivityID, probo.ActionProcessingActivityDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ProcessingActivityID) prb := r.probo - err := prb.ProcessingActivities.Delete(ctx, scope, input.ProcessingActivityID) - if err != nil { + if err := prb.ProcessingActivities.Delete(ctx, scope, input.ProcessingActivityID); err != nil { r.logger.ErrorCtx(ctx, "cannot delete processing activity", log.Error(err)) return nil, gqlutils.Internal(ctx) } @@ -129,11 +128,11 @@ func (r *mutationResolver) DeleteProcessingActivity(ctx context.Context, input t // PublishProcessingActivityList is the resolver for the publishProcessingActivityList field. func (r *mutationResolver) PublishProcessingActivityList(ctx context.Context, input types.PublishProcessingActivityListInput) (*types.PublishProcessingActivityListPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionProcessingActivityPublish); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionProcessingActivityPublish) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo document, documentVersion, err := prb.GeneratedDocuments.PublishProcessingActivityList(ctx, scope, input.OrganizationID, input.ApproverIds, input.Minor) @@ -159,7 +158,7 @@ func (r *mutationResolver) PublishProcessingActivityList(ctx context.Context, in // Organization is the resolver for the organization field. func (r *processingActivityResolver) Organization(ctx context.Context, obj *types.ProcessingActivity) (*types.Organization, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { return nil, err } @@ -181,7 +180,7 @@ func (r *processingActivityResolver) Organization(ctx context.Context, obj *type // DataProtectionOfficer is the resolver for the dataProtectionOfficer field. func (r *processingActivityResolver) DataProtectionOfficer(ctx context.Context, obj *types.ProcessingActivity) (*types.Profile, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } @@ -207,11 +206,11 @@ func (r *processingActivityResolver) DataProtectionOfficer(ctx context.Context, // ThirdParties is the resolver for the thirdParties field. func (r *processingActivityResolver) ThirdParties(ctx context.Context, obj *types.ProcessingActivity, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ThirdPartyOrderBy) (*types.ThirdPartyConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.ThirdPartyOrderField]{ @@ -238,11 +237,11 @@ func (r *processingActivityResolver) ThirdParties(ctx context.Context, obj *type // DataProtectionImpactAssessment is the resolver for the dataProtectionImpactAssessment field. func (r *processingActivityResolver) DataProtectionImpactAssessment(ctx context.Context, obj *types.ProcessingActivity) (*types.DataProtectionImpactAssessment, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionDataProtectionImpactAssessmentGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionDataProtectionImpactAssessmentGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo dpia, err := prb.DataProtectionImpactAssessments.GetByProcessingActivityID(ctx, scope, obj.ID) @@ -261,11 +260,11 @@ func (r *processingActivityResolver) DataProtectionImpactAssessment(ctx context. // TransferImpactAssessment is the resolver for the transferImpactAssessment field. func (r *processingActivityResolver) TransferImpactAssessment(ctx context.Context, obj *types.ProcessingActivity) (*types.TransferImpactAssessment, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionTransferImpactAssessmentGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionTransferImpactAssessmentGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo tia, err := prb.TransferImpactAssessments.GetByProcessingActivityID(ctx, scope, obj.ID) @@ -289,11 +288,11 @@ func (r *processingActivityResolver) Permission(ctx context.Context, obj *types. // TotalCount is the resolver for the totalCount field. func (r *processingActivityConnectionResolver) TotalCount(ctx context.Context, obj *types.ProcessingActivityConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionProcessingActivityList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionProcessingActivityList) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) prb := r.probo switch obj.Resolver.(type) { diff --git a/pkg/server/api/console/v1/resolver.go b/pkg/server/api/console/v1/resolver.go index 5241a69fa..dbe81e560 100644 --- a/pkg/server/api/console/v1/resolver.go +++ b/pkg/server/api/console/v1/resolver.go @@ -360,5 +360,6 @@ func isValidPagerDutySubdomain(s string) bool { } func (r *Resolver) Permission(ctx context.Context, obj types.Node, action string) (bool, error) { - return r.authorize(ctx, obj.GetID(), action, authz.WithDryRun()) == nil, nil + _, err := r.authorize(ctx, obj.GetID(), action, authz.WithDryRun()) + return err == nil, nil } diff --git a/pkg/server/api/console/v1/rights_request_resolvers.go b/pkg/server/api/console/v1/rights_request_resolvers.go index 8f197a4d5..486a64e99 100644 --- a/pkg/server/api/console/v1/rights_request_resolvers.go +++ b/pkg/server/api/console/v1/rights_request_resolvers.go @@ -21,11 +21,11 @@ import ( // CreateRightsRequest is the resolver for the createRightsRequest field. func (r *mutationResolver) CreateRightsRequest(ctx context.Context, input types.CreateRightsRequestInput) (*types.CreateRightsRequestPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionRightsRequestCreate); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionRightsRequestCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo req := probo.CreateRightsRequestRequest{ @@ -57,11 +57,11 @@ func (r *mutationResolver) CreateRightsRequest(ctx context.Context, input types. // UpdateRightsRequest is the resolver for the updateRightsRequest field. func (r *mutationResolver) UpdateRightsRequest(ctx context.Context, input types.UpdateRightsRequestInput) (*types.UpdateRightsRequestPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionRightsRequestUpdate); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionRightsRequestUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo req := probo.UpdateRightsRequestRequest{ @@ -93,15 +93,14 @@ func (r *mutationResolver) UpdateRightsRequest(ctx context.Context, input types. // DeleteRightsRequest is the resolver for the deleteRightsRequest field. func (r *mutationResolver) DeleteRightsRequest(ctx context.Context, input types.DeleteRightsRequestInput) (*types.DeleteRightsRequestPayload, error) { - if err := r.authorize(ctx, input.RightsRequestID, probo.ActionRightsRequestDelete); err != nil { + scope, err := r.authorize(ctx, input.RightsRequestID, probo.ActionRightsRequestDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.RightsRequestID) prb := r.probo - err := prb.RightsRequests.Delete(ctx, scope, input.RightsRequestID) - if err != nil { + if err := prb.RightsRequests.Delete(ctx, scope, input.RightsRequestID); err != nil { r.logger.ErrorCtx(ctx, "cannot delete rights request", log.Error(err)) return nil, gqlutils.Internal(ctx) } @@ -113,11 +112,11 @@ func (r *mutationResolver) DeleteRightsRequest(ctx context.Context, input types. // Organization is the resolver for the organization field. func (r *rightsRequestResolver) Organization(ctx context.Context, obj *types.RightsRequest) (*types.Organization, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionOrganizationGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, iam.ActionOrganizationGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo rightsRequest, err := prb.RightsRequests.Get(ctx, scope, obj.ID) @@ -147,11 +146,11 @@ func (r *rightsRequestResolver) Permission(ctx context.Context, obj *types.Right // TotalCount is the resolver for the totalCount field. func (r *rightsRequestConnectionResolver) TotalCount(ctx context.Context, obj *types.RightsRequestConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionRightsRequestList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionRightsRequestList) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) prb := r.probo switch obj.Resolver.(type) { diff --git a/pkg/server/api/console/v1/risk_assessment_resolvers.go b/pkg/server/api/console/v1/risk_assessment_resolvers.go index 9354f8886..280f7673d 100644 --- a/pkg/server/api/console/v1/risk_assessment_resolvers.go +++ b/pkg/server/api/console/v1/risk_assessment_resolvers.go @@ -24,12 +24,11 @@ import ( // CreateRiskAssessment is the resolver for the createRiskAssessment field. func (r *mutationResolver) CreateRiskAssessment(ctx context.Context, input types.CreateRiskAssessmentInput) (*types.CreateRiskAssessmentPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionRiskAssessmentCreate); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionRiskAssessmentCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) - ra, err := r.riskManagement.Create( ctx, scope, @@ -60,12 +59,11 @@ func (r *mutationResolver) CreateRiskAssessment(ctx context.Context, input types // UpdateRiskAssessment is the resolver for the updateRiskAssessment field. func (r *mutationResolver) UpdateRiskAssessment(ctx context.Context, input types.UpdateRiskAssessmentInput) (*types.UpdateRiskAssessmentPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionRiskAssessmentUpdate); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionRiskAssessmentUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) - ra, err := r.riskManagement.Update( ctx, scope, @@ -90,11 +88,11 @@ func (r *mutationResolver) UpdateRiskAssessment(ctx context.Context, input types // DeleteRiskAssessment is the resolver for the deleteRiskAssessment field. func (r *mutationResolver) DeleteRiskAssessment(ctx context.Context, input types.DeleteRiskAssessmentInput) (*types.DeleteRiskAssessmentPayload, error) { - if err := r.authorize(ctx, input.RiskAssessmentID, probo.ActionRiskAssessmentDelete); err != nil { + scope, err := r.authorize(ctx, input.RiskAssessmentID, probo.ActionRiskAssessmentDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.RiskAssessmentID) if err := r.riskManagement.Delete(ctx, scope, input.RiskAssessmentID); err != nil { if errors.Is(err, coredata.ErrResourceNotFound) { return nil, gqlutils.NotFound(ctx, err) @@ -110,12 +108,11 @@ func (r *mutationResolver) DeleteRiskAssessment(ctx context.Context, input types // CreateRiskAssessmentScope is the resolver for the createRiskAssessmentScope field. func (r *mutationResolver) CreateRiskAssessmentScope(ctx context.Context, input types.CreateRiskAssessmentScopeInput) (*types.CreateRiskAssessmentScopePayload, error) { - if err := r.authorize(ctx, input.RiskAssessmentID, probo.ActionRiskAssessmentScopeCreate); err != nil { + scope, err := r.authorize(ctx, input.RiskAssessmentID, probo.ActionRiskAssessmentScopeCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.RiskAssessmentID) - raScope, err := r.riskManagement.CreateScope( ctx, scope, @@ -145,12 +142,11 @@ func (r *mutationResolver) CreateRiskAssessmentScope(ctx context.Context, input // UpdateRiskAssessmentScope is the resolver for the updateRiskAssessmentScope field. func (r *mutationResolver) UpdateRiskAssessmentScope(ctx context.Context, input types.UpdateRiskAssessmentScopeInput) (*types.UpdateRiskAssessmentScopePayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionRiskAssessmentScopeUpdate); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionRiskAssessmentScopeUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) - raScope, err := r.riskManagement.UpdateScope( ctx, scope, @@ -174,11 +170,11 @@ func (r *mutationResolver) UpdateRiskAssessmentScope(ctx context.Context, input // DeleteRiskAssessmentScope is the resolver for the deleteRiskAssessmentScope field. func (r *mutationResolver) DeleteRiskAssessmentScope(ctx context.Context, input types.DeleteRiskAssessmentScopeInput) (*types.DeleteRiskAssessmentScopePayload, error) { - if err := r.authorize(ctx, input.RiskAssessmentScopeID, probo.ActionRiskAssessmentScopeDelete); err != nil { + scope, err := r.authorize(ctx, input.RiskAssessmentScopeID, probo.ActionRiskAssessmentScopeDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.RiskAssessmentScopeID) if err := r.riskManagement.DeleteScope(ctx, scope, input.RiskAssessmentScopeID); err != nil { if errors.Is(err, coredata.ErrResourceNotFound) { return nil, gqlutils.NotFound(ctx, err) @@ -194,12 +190,11 @@ func (r *mutationResolver) DeleteRiskAssessmentScope(ctx context.Context, input // CreateRiskAssessmentNode is the resolver for the createRiskAssessmentNode field. func (r *mutationResolver) CreateRiskAssessmentNode(ctx context.Context, input types.CreateRiskAssessmentNodeInput) (*types.CreateRiskAssessmentNodePayload, error) { - if err := r.authorize(ctx, input.RiskAssessmentScopeID, probo.ActionRiskAssessmentNodeCreate); err != nil { + scope, err := r.authorize(ctx, input.RiskAssessmentScopeID, probo.ActionRiskAssessmentNodeCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.RiskAssessmentScopeID) - node, err := r.riskManagement.CreateNode( ctx, scope, @@ -233,12 +228,11 @@ func (r *mutationResolver) CreateRiskAssessmentNode(ctx context.Context, input t // UpdateRiskAssessmentNode is the resolver for the updateRiskAssessmentNode field. func (r *mutationResolver) UpdateRiskAssessmentNode(ctx context.Context, input types.UpdateRiskAssessmentNodeInput) (*types.UpdateRiskAssessmentNodePayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionRiskAssessmentNodeUpdate); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionRiskAssessmentNodeUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) - node, err := r.riskManagement.UpdateNode( ctx, scope, @@ -263,11 +257,11 @@ func (r *mutationResolver) UpdateRiskAssessmentNode(ctx context.Context, input t // DeleteRiskAssessmentNode is the resolver for the deleteRiskAssessmentNode field. func (r *mutationResolver) DeleteRiskAssessmentNode(ctx context.Context, input types.DeleteRiskAssessmentNodeInput) (*types.DeleteRiskAssessmentNodePayload, error) { - if err := r.authorize(ctx, input.RiskAssessmentNodeID, probo.ActionRiskAssessmentNodeDelete); err != nil { + scope, err := r.authorize(ctx, input.RiskAssessmentNodeID, probo.ActionRiskAssessmentNodeDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.RiskAssessmentNodeID) if err := r.riskManagement.DeleteNode(ctx, scope, input.RiskAssessmentNodeID); err != nil { if errors.Is(err, coredata.ErrResourceNotFound) { return nil, gqlutils.NotFound(ctx, err) @@ -283,12 +277,11 @@ func (r *mutationResolver) DeleteRiskAssessmentNode(ctx context.Context, input t // CreateRiskAssessmentProcess is the resolver for the createRiskAssessmentProcess field. func (r *mutationResolver) CreateRiskAssessmentProcess(ctx context.Context, input types.CreateRiskAssessmentProcessInput) (*types.CreateRiskAssessmentProcessPayload, error) { - if err := r.authorize(ctx, input.RiskAssessmentScopeID, probo.ActionRiskAssessmentProcessCreate); err != nil { + scope, err := r.authorize(ctx, input.RiskAssessmentScopeID, probo.ActionRiskAssessmentProcessCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.RiskAssessmentScopeID) - process, err := r.riskManagement.CreateProcess( ctx, scope, @@ -323,12 +316,11 @@ func (r *mutationResolver) CreateRiskAssessmentProcess(ctx context.Context, inpu // UpdateRiskAssessmentProcess is the resolver for the updateRiskAssessmentProcess field. func (r *mutationResolver) UpdateRiskAssessmentProcess(ctx context.Context, input types.UpdateRiskAssessmentProcessInput) (*types.UpdateRiskAssessmentProcessPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionRiskAssessmentProcessUpdate); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionRiskAssessmentProcessUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) - process, err := r.riskManagement.UpdateProcess( ctx, scope, @@ -354,11 +346,11 @@ func (r *mutationResolver) UpdateRiskAssessmentProcess(ctx context.Context, inpu // DeleteRiskAssessmentProcess is the resolver for the deleteRiskAssessmentProcess field. func (r *mutationResolver) DeleteRiskAssessmentProcess(ctx context.Context, input types.DeleteRiskAssessmentProcessInput) (*types.DeleteRiskAssessmentProcessPayload, error) { - if err := r.authorize(ctx, input.RiskAssessmentProcessID, probo.ActionRiskAssessmentProcessDelete); err != nil { + scope, err := r.authorize(ctx, input.RiskAssessmentProcessID, probo.ActionRiskAssessmentProcessDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.RiskAssessmentProcessID) if err := r.riskManagement.DeleteProcess(ctx, scope, input.RiskAssessmentProcessID); err != nil { if errors.Is(err, coredata.ErrResourceNotFound) { return nil, gqlutils.NotFound(ctx, err) @@ -374,12 +366,11 @@ func (r *mutationResolver) DeleteRiskAssessmentProcess(ctx context.Context, inpu // CreateRiskAssessmentThreat is the resolver for the createRiskAssessmentThreat field. func (r *mutationResolver) CreateRiskAssessmentThreat(ctx context.Context, input types.CreateRiskAssessmentThreatInput) (*types.CreateRiskAssessmentThreatPayload, error) { - if err := r.authorize(ctx, input.RiskAssessmentScopeID, probo.ActionRiskAssessmentThreatCreate); err != nil { + scope, err := r.authorize(ctx, input.RiskAssessmentScopeID, probo.ActionRiskAssessmentThreatCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.RiskAssessmentScopeID) - threat, err := r.riskManagement.CreateThreat( ctx, scope, @@ -414,12 +405,11 @@ func (r *mutationResolver) CreateRiskAssessmentThreat(ctx context.Context, input // UpdateRiskAssessmentThreat is the resolver for the updateRiskAssessmentThreat field. func (r *mutationResolver) UpdateRiskAssessmentThreat(ctx context.Context, input types.UpdateRiskAssessmentThreatInput) (*types.UpdateRiskAssessmentThreatPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionRiskAssessmentThreatUpdate); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionRiskAssessmentThreatUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) - threat, err := r.riskManagement.UpdateThreat( ctx, scope, @@ -445,11 +435,11 @@ func (r *mutationResolver) UpdateRiskAssessmentThreat(ctx context.Context, input // DeleteRiskAssessmentThreat is the resolver for the deleteRiskAssessmentThreat field. func (r *mutationResolver) DeleteRiskAssessmentThreat(ctx context.Context, input types.DeleteRiskAssessmentThreatInput) (*types.DeleteRiskAssessmentThreatPayload, error) { - if err := r.authorize(ctx, input.RiskAssessmentThreatID, probo.ActionRiskAssessmentThreatDelete); err != nil { + scope, err := r.authorize(ctx, input.RiskAssessmentThreatID, probo.ActionRiskAssessmentThreatDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.RiskAssessmentThreatID) if err := r.riskManagement.DeleteThreat(ctx, scope, input.RiskAssessmentThreatID); err != nil { if errors.Is(err, coredata.ErrResourceNotFound) { return nil, gqlutils.NotFound(ctx, err) @@ -465,12 +455,11 @@ func (r *mutationResolver) DeleteRiskAssessmentThreat(ctx context.Context, input // CreateRiskAssessmentScenario is the resolver for the createRiskAssessmentScenario field. func (r *mutationResolver) CreateRiskAssessmentScenario(ctx context.Context, input types.CreateRiskAssessmentScenarioInput) (*types.CreateRiskAssessmentScenarioPayload, error) { - if err := r.authorize(ctx, input.RiskAssessmentScopeID, probo.ActionRiskAssessmentScenarioCreate); err != nil { + scope, err := r.authorize(ctx, input.RiskAssessmentScopeID, probo.ActionRiskAssessmentScenarioCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.RiskAssessmentScopeID) - scenario, err := r.riskManagement.CreateScenario( ctx, scope, @@ -504,12 +493,11 @@ func (r *mutationResolver) CreateRiskAssessmentScenario(ctx context.Context, inp // UpdateRiskAssessmentScenario is the resolver for the updateRiskAssessmentScenario field. func (r *mutationResolver) UpdateRiskAssessmentScenario(ctx context.Context, input types.UpdateRiskAssessmentScenarioInput) (*types.UpdateRiskAssessmentScenarioPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionRiskAssessmentScenarioUpdate); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionRiskAssessmentScenarioUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) - scenario, err := r.riskManagement.UpdateScenario( ctx, scope, @@ -534,11 +522,11 @@ func (r *mutationResolver) UpdateRiskAssessmentScenario(ctx context.Context, inp // DeleteRiskAssessmentScenario is the resolver for the deleteRiskAssessmentScenario field. func (r *mutationResolver) DeleteRiskAssessmentScenario(ctx context.Context, input types.DeleteRiskAssessmentScenarioInput) (*types.DeleteRiskAssessmentScenarioPayload, error) { - if err := r.authorize(ctx, input.RiskAssessmentScenarioID, probo.ActionRiskAssessmentScenarioDelete); err != nil { + scope, err := r.authorize(ctx, input.RiskAssessmentScenarioID, probo.ActionRiskAssessmentScenarioDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.RiskAssessmentScenarioID) if err := r.riskManagement.DeleteScenario(ctx, scope, input.RiskAssessmentScenarioID); err != nil { if errors.Is(err, coredata.ErrResourceNotFound) { return nil, gqlutils.NotFound(ctx, err) @@ -554,11 +542,11 @@ func (r *mutationResolver) DeleteRiskAssessmentScenario(ctx context.Context, inp // LinkRiskAssessmentScenarioThreat is the resolver for the linkRiskAssessmentScenarioThreat field. func (r *mutationResolver) LinkRiskAssessmentScenarioThreat(ctx context.Context, input types.LinkRiskAssessmentScenarioThreatInput) (*types.LinkRiskAssessmentScenarioThreatPayload, error) { - if err := r.authorize(ctx, input.RiskAssessmentScenarioID, probo.ActionRiskAssessmentScenarioThreatLink); err != nil { + scope, err := r.authorize(ctx, input.RiskAssessmentScenarioID, probo.ActionRiskAssessmentScenarioThreatLink) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.RiskAssessmentScenarioID) if err := r.riskManagement.LinkScenarioThreat( ctx, scope, @@ -591,11 +579,11 @@ func (r *mutationResolver) LinkRiskAssessmentScenarioThreat(ctx context.Context, // UnlinkRiskAssessmentScenarioThreat is the resolver for the unlinkRiskAssessmentScenarioThreat field. func (r *mutationResolver) UnlinkRiskAssessmentScenarioThreat(ctx context.Context, input types.UnlinkRiskAssessmentScenarioThreatInput) (*types.UnlinkRiskAssessmentScenarioThreatPayload, error) { - if err := r.authorize(ctx, input.RiskAssessmentScenarioID, probo.ActionRiskAssessmentScenarioThreatUnlink); err != nil { + scope, err := r.authorize(ctx, input.RiskAssessmentScenarioID, probo.ActionRiskAssessmentScenarioThreatUnlink) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.RiskAssessmentScenarioID) if err := r.riskManagement.UnlinkScenarioThreat( ctx, scope, @@ -624,11 +612,11 @@ func (r *mutationResolver) UnlinkRiskAssessmentScenarioThreat(ctx context.Contex // LinkRiskAssessmentScenarioRisk is the resolver for the linkRiskAssessmentScenarioRisk field. func (r *mutationResolver) LinkRiskAssessmentScenarioRisk(ctx context.Context, input types.LinkRiskAssessmentScenarioRiskInput) (*types.LinkRiskAssessmentScenarioRiskPayload, error) { - if err := r.authorize(ctx, input.RiskAssessmentScenarioID, probo.ActionRiskAssessmentScenarioRiskLink); err != nil { + scope, err := r.authorize(ctx, input.RiskAssessmentScenarioID, probo.ActionRiskAssessmentScenarioRiskLink) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.RiskAssessmentScenarioID) if err := r.riskManagement.LinkScenarioRisk( ctx, scope, @@ -669,11 +657,11 @@ func (r *mutationResolver) LinkRiskAssessmentScenarioRisk(ctx context.Context, i // UnlinkRiskAssessmentScenarioRisk is the resolver for the unlinkRiskAssessmentScenarioRisk field. func (r *mutationResolver) UnlinkRiskAssessmentScenarioRisk(ctx context.Context, input types.UnlinkRiskAssessmentScenarioRiskInput) (*types.UnlinkRiskAssessmentScenarioRiskPayload, error) { - if err := r.authorize(ctx, input.RiskAssessmentScenarioID, probo.ActionRiskAssessmentScenarioRiskUnlink); err != nil { + scope, err := r.authorize(ctx, input.RiskAssessmentScenarioID, probo.ActionRiskAssessmentScenarioRiskUnlink) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.RiskAssessmentScenarioID) if err := r.riskManagement.UnlinkScenarioRisk( ctx, scope, @@ -705,7 +693,7 @@ func (r *mutationResolver) UnlinkRiskAssessmentScenarioRisk(ctx context.Context, // Organization is the resolver for the organization field. func (r *riskAssessmentResolver) Organization(ctx context.Context, obj *types.RiskAssessment) (*types.Organization, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { return nil, err } @@ -727,12 +715,11 @@ func (r *riskAssessmentResolver) Organization(ctx context.Context, obj *types.Ri // Scopes is the resolver for the scopes field. func (r *riskAssessmentResolver) Scopes(ctx context.Context, obj *types.RiskAssessment, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskAssessmentScopeOrderBy) (*types.RiskAssessmentScopeConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentScopeList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentScopeList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) - pageOrderBy := page.OrderBy[coredata.RiskAssessmentScopeOrderField]{ Field: coredata.RiskAssessmentScopeOrderFieldCreatedAt, Direction: page.OrderDirectionDesc, @@ -759,12 +746,11 @@ func (r *riskAssessmentResolver) Permission(ctx context.Context, obj *types.Risk // TotalCount is the resolver for the totalCount field. func (r *riskAssessmentConnectionResolver) TotalCount(ctx context.Context, obj *types.RiskAssessmentConnection) (*int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionRiskAssessmentList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionRiskAssessmentList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) - count, err := r.riskManagement.CountForOrganizationID(ctx, scope, obj.ParentID) if err != nil { r.logger.ErrorCtx(ctx, "cannot count risk assessments", log.Error(err)) @@ -776,12 +762,11 @@ func (r *riskAssessmentConnectionResolver) TotalCount(ctx context.Context, obj * // TotalCount is the resolver for the totalCount field. func (r *riskAssessmentNodeConnectionResolver) TotalCount(ctx context.Context, obj *types.RiskAssessmentNodeConnection) (*int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionRiskAssessmentNodeList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionRiskAssessmentNodeList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) - count, err := r.riskManagement.CountNodesForScopeID(ctx, scope, obj.ParentID) if err != nil { r.logger.ErrorCtx(ctx, "cannot count risk assessment nodes", log.Error(err)) @@ -793,12 +778,11 @@ func (r *riskAssessmentNodeConnectionResolver) TotalCount(ctx context.Context, o // TotalCount is the resolver for the totalCount field. func (r *riskAssessmentProcessConnectionResolver) TotalCount(ctx context.Context, obj *types.RiskAssessmentProcessConnection) (*int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionRiskAssessmentProcessList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionRiskAssessmentProcessList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) - count, err := r.riskManagement.CountProcessesForScopeID(ctx, scope, obj.ParentID) if err != nil { r.logger.ErrorCtx(ctx, "cannot count risk assessment processes", log.Error(err)) @@ -810,12 +794,11 @@ func (r *riskAssessmentProcessConnectionResolver) TotalCount(ctx context.Context // Scope is the resolver for the scope field. func (r *riskAssessmentScenarioResolver) Scope(ctx context.Context, obj *types.RiskAssessmentScenario) (*types.RiskAssessmentScope, error) { - if err := r.authorize(ctx, obj.RiskAssessmentScopeID, probo.ActionRiskAssessmentScopeGet); err != nil { + scope, err := r.authorize(ctx, obj.RiskAssessmentScopeID, probo.ActionRiskAssessmentScopeGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.RiskAssessmentScopeID) - raScope, err := r.riskManagement.GetScope(ctx, scope, obj.RiskAssessmentScopeID) if err != nil { r.logger.ErrorCtx(ctx, "cannot load risk assessment scope", log.Error(err)) @@ -827,12 +810,11 @@ func (r *riskAssessmentScenarioResolver) Scope(ctx context.Context, obj *types.R // Threats is the resolver for the threats field. func (r *riskAssessmentScenarioResolver) Threats(ctx context.Context, obj *types.RiskAssessmentScenario, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskAssessmentThreatOrderBy) (*types.RiskAssessmentThreatConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentThreatList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentThreatList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) - pageOrderBy := page.OrderBy[coredata.RiskAssessmentThreatOrderField]{ Field: coredata.RiskAssessmentThreatOrderFieldCreatedAt, Direction: page.OrderDirectionDesc, @@ -854,12 +836,11 @@ func (r *riskAssessmentScenarioResolver) Threats(ctx context.Context, obj *types // Risks is the resolver for the risks field. func (r *riskAssessmentScenarioResolver) Risks(ctx context.Context, obj *types.RiskAssessmentScenario, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskOrderBy) (*types.RiskConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionRiskList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionRiskList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) - pageOrderBy := page.OrderBy[coredata.RiskOrderField]{ Field: coredata.RiskOrderFieldCreatedAt, Direction: page.OrderDirectionDesc, @@ -881,12 +862,11 @@ func (r *riskAssessmentScenarioResolver) Risks(ctx context.Context, obj *types.R // TotalCount is the resolver for the totalCount field. func (r *riskAssessmentScenarioConnectionResolver) TotalCount(ctx context.Context, obj *types.RiskAssessmentScenarioConnection) (*int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionRiskAssessmentScenarioList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionRiskAssessmentScenarioList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) - switch obj.Resolver.(type) { case *riskAssessmentScopeResolver: count, err := r.riskManagement.CountScenariosForScopeID(ctx, scope, obj.ParentID) @@ -917,12 +897,11 @@ func (r *riskAssessmentScenarioConnectionResolver) TotalCount(ctx context.Contex // Nodes is the resolver for the nodes field. func (r *riskAssessmentScopeResolver) Nodes(ctx context.Context, obj *types.RiskAssessmentScope, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskAssessmentNodeOrderBy) (*types.RiskAssessmentNodeConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentNodeList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentNodeList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) - pageOrderBy := page.OrderBy[coredata.RiskAssessmentNodeOrderField]{ Field: coredata.RiskAssessmentNodeOrderFieldCreatedAt, Direction: page.OrderDirectionDesc, @@ -944,12 +923,11 @@ func (r *riskAssessmentScopeResolver) Nodes(ctx context.Context, obj *types.Risk // Processes is the resolver for the processes field. func (r *riskAssessmentScopeResolver) Processes(ctx context.Context, obj *types.RiskAssessmentScope, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskAssessmentProcessOrderBy) (*types.RiskAssessmentProcessConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentProcessList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentProcessList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) - pageOrderBy := page.OrderBy[coredata.RiskAssessmentProcessOrderField]{ Field: coredata.RiskAssessmentProcessOrderFieldCreatedAt, Direction: page.OrderDirectionDesc, @@ -971,12 +949,11 @@ func (r *riskAssessmentScopeResolver) Processes(ctx context.Context, obj *types. // Threats is the resolver for the threats field. func (r *riskAssessmentScopeResolver) Threats(ctx context.Context, obj *types.RiskAssessmentScope, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskAssessmentThreatOrderBy) (*types.RiskAssessmentThreatConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentThreatList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentThreatList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) - pageOrderBy := page.OrderBy[coredata.RiskAssessmentThreatOrderField]{ Field: coredata.RiskAssessmentThreatOrderFieldCreatedAt, Direction: page.OrderDirectionDesc, @@ -998,12 +975,11 @@ func (r *riskAssessmentScopeResolver) Threats(ctx context.Context, obj *types.Ri // Scenarios is the resolver for the scenarios field. func (r *riskAssessmentScopeResolver) Scenarios(ctx context.Context, obj *types.RiskAssessmentScope, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskAssessmentScenarioOrderBy) (*types.RiskAssessmentScenarioConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentScenarioList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentScenarioList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) - pageOrderBy := page.OrderBy[coredata.RiskAssessmentScenarioOrderField]{ Field: coredata.RiskAssessmentScenarioOrderFieldCreatedAt, Direction: page.OrderDirectionDesc, @@ -1025,12 +1001,11 @@ func (r *riskAssessmentScopeResolver) Scenarios(ctx context.Context, obj *types. // MermaidChart is the resolver for the mermaidChart field. func (r *riskAssessmentScopeResolver) MermaidChart(ctx context.Context, obj *types.RiskAssessmentScope) (string, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentScopeGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentScopeGet) + if err != nil { return "", err } - scope := coredata.NewScopeFromObjectID(obj.ID) - chart, err := r.riskManagement.BuildScopeMermaidChart(ctx, scope, obj.ID) if err != nil { r.logger.ErrorCtx(ctx, "cannot build risk assessment scope mermaid chart", log.Error(err)) @@ -1042,12 +1017,11 @@ func (r *riskAssessmentScopeResolver) MermaidChart(ctx context.Context, obj *typ // TotalCount is the resolver for the totalCount field. func (r *riskAssessmentScopeConnectionResolver) TotalCount(ctx context.Context, obj *types.RiskAssessmentScopeConnection) (*int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionRiskAssessmentScopeList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionRiskAssessmentScopeList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) - count, err := r.riskManagement.CountScopesForRiskAssessmentID(ctx, scope, obj.ParentID) if err != nil { r.logger.ErrorCtx(ctx, "cannot count risk assessment scopes", log.Error(err)) @@ -1059,12 +1033,11 @@ func (r *riskAssessmentScopeConnectionResolver) TotalCount(ctx context.Context, // TotalCount is the resolver for the totalCount field. func (r *riskAssessmentThreatConnectionResolver) TotalCount(ctx context.Context, obj *types.RiskAssessmentThreatConnection) (*int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionRiskAssessmentThreatList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionRiskAssessmentThreatList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) - switch obj.Resolver.(type) { case *riskAssessmentScenarioResolver: count, err := r.riskManagement.CountThreatsForScenarioID(ctx, scope, obj.ParentID) diff --git a/pkg/server/api/console/v1/risk_resolvers.go b/pkg/server/api/console/v1/risk_resolvers.go index b7b263b7f..aa750debf 100644 --- a/pkg/server/api/console/v1/risk_resolvers.go +++ b/pkg/server/api/console/v1/risk_resolvers.go @@ -24,11 +24,11 @@ import ( // CreateRisk is the resolver for the createRisk field. func (r *mutationResolver) CreateRisk(ctx context.Context, input types.CreateRiskInput) (*types.CreateRiskPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionRiskCreate); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionRiskCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo risk, err := prb.Risks.Create( @@ -68,11 +68,11 @@ func (r *mutationResolver) CreateRisk(ctx context.Context, input types.CreateRis // UpdateRisk is the resolver for the updateRisk field. func (r *mutationResolver) UpdateRisk(ctx context.Context, input types.UpdateRiskInput) (*types.UpdateRiskPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionRiskUpdate); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionRiskUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo risk, err := prb.Risks.Update( @@ -108,15 +108,14 @@ func (r *mutationResolver) UpdateRisk(ctx context.Context, input types.UpdateRis // DeleteRisk is the resolver for the deleteRisk field. func (r *mutationResolver) DeleteRisk(ctx context.Context, input types.DeleteRiskInput) (*types.DeleteRiskPayload, error) { - if err := r.authorize(ctx, input.RiskID, probo.ActionRiskDelete); err != nil { + scope, err := r.authorize(ctx, input.RiskID, probo.ActionRiskDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.RiskID) prb := r.probo - err := prb.Risks.Delete(ctx, scope, input.RiskID) - if err != nil { + if err := prb.Risks.Delete(ctx, scope, input.RiskID); err != nil { r.logger.ErrorCtx(ctx, "cannot delete risk", log.Error(err)) return nil, gqlutils.Internal(ctx) } @@ -128,11 +127,11 @@ func (r *mutationResolver) DeleteRisk(ctx context.Context, input types.DeleteRis // CreateRiskMeasureMapping is the resolver for the createRiskMeasureMapping field. func (r *mutationResolver) CreateRiskMeasureMapping(ctx context.Context, input types.CreateRiskMeasureMappingInput) (*types.CreateRiskMeasureMappingPayload, error) { - if err := r.authorize(ctx, input.RiskID, probo.ActionRiskMeasureMappingCreate); err != nil { + scope, err := r.authorize(ctx, input.RiskID, probo.ActionRiskMeasureMappingCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.RiskID) prb := r.probo risk, measure, err := prb.Risks.CreateMeasureMapping(ctx, scope, input.RiskID, input.MeasureID) @@ -149,11 +148,11 @@ func (r *mutationResolver) CreateRiskMeasureMapping(ctx context.Context, input t // DeleteRiskMeasureMapping is the resolver for the deleteRiskMeasureMapping field. func (r *mutationResolver) DeleteRiskMeasureMapping(ctx context.Context, input types.DeleteRiskMeasureMappingInput) (*types.DeleteRiskMeasureMappingPayload, error) { - if err := r.authorize(ctx, input.RiskID, probo.ActionRiskMeasureMappingDelete); err != nil { + scope, err := r.authorize(ctx, input.RiskID, probo.ActionRiskMeasureMappingDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.RiskID) prb := r.probo risk, measure, err := prb.Risks.DeleteMeasureMapping(ctx, scope, input.RiskID, input.MeasureID) @@ -170,11 +169,11 @@ func (r *mutationResolver) DeleteRiskMeasureMapping(ctx context.Context, input t // CreateRiskDocumentMapping is the resolver for the createRiskDocumentMapping field. func (r *mutationResolver) CreateRiskDocumentMapping(ctx context.Context, input types.CreateRiskDocumentMappingInput) (*types.CreateRiskDocumentMappingPayload, error) { - if err := r.authorize(ctx, input.RiskID, probo.ActionRiskDocumentMappingCreate); err != nil { + scope, err := r.authorize(ctx, input.RiskID, probo.ActionRiskDocumentMappingCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.RiskID) prb := r.probo risk, document, err := prb.Risks.CreateDocumentMapping(ctx, scope, input.RiskID, input.DocumentID) @@ -191,11 +190,11 @@ func (r *mutationResolver) CreateRiskDocumentMapping(ctx context.Context, input // DeleteRiskDocumentMapping is the resolver for the deleteRiskDocumentMapping field. func (r *mutationResolver) DeleteRiskDocumentMapping(ctx context.Context, input types.DeleteRiskDocumentMappingInput) (*types.DeleteRiskDocumentMappingPayload, error) { - if err := r.authorize(ctx, input.RiskID, probo.ActionRiskDocumentMappingDelete); err != nil { + scope, err := r.authorize(ctx, input.RiskID, probo.ActionRiskDocumentMappingDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.RiskID) prb := r.probo risk, document, err := prb.Risks.DeleteDocumentMapping(ctx, scope, input.RiskID, input.DocumentID) @@ -212,11 +211,11 @@ func (r *mutationResolver) DeleteRiskDocumentMapping(ctx context.Context, input // CreateRiskObligationMapping is the resolver for the createRiskObligationMapping field. func (r *mutationResolver) CreateRiskObligationMapping(ctx context.Context, input types.CreateRiskObligationMappingInput) (*types.CreateRiskObligationMappingPayload, error) { - if err := r.authorize(ctx, input.RiskID, probo.ActionRiskObligationMappingCreate); err != nil { + scope, err := r.authorize(ctx, input.RiskID, probo.ActionRiskObligationMappingCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.RiskID) prb := r.probo risk, obligation, err := prb.Risks.CreateObligationMapping(ctx, scope, input.RiskID, input.ObligationID) @@ -233,11 +232,11 @@ func (r *mutationResolver) CreateRiskObligationMapping(ctx context.Context, inpu // DeleteRiskObligationMapping is the resolver for the deleteRiskObligationMapping field. func (r *mutationResolver) DeleteRiskObligationMapping(ctx context.Context, input types.DeleteRiskObligationMappingInput) (*types.DeleteRiskObligationMappingPayload, error) { - if err := r.authorize(ctx, input.RiskID, probo.ActionRiskObligationMappingDelete); err != nil { + scope, err := r.authorize(ctx, input.RiskID, probo.ActionRiskObligationMappingDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.RiskID) prb := r.probo risk, obligation, err := prb.Risks.DeleteObligationMapping(ctx, scope, input.RiskID, input.ObligationID) @@ -254,11 +253,11 @@ func (r *mutationResolver) DeleteRiskObligationMapping(ctx context.Context, inpu // PublishRiskList is the resolver for the publishRiskList field. func (r *mutationResolver) PublishRiskList(ctx context.Context, input types.PublishRiskListInput) (*types.PublishRiskListPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionRiskPublish); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionRiskPublish) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo document, documentVersion, err := prb.GeneratedDocuments.PublishRiskList(ctx, scope, input.OrganizationID, input.ApproverIds, input.Minor) @@ -284,7 +283,7 @@ func (r *mutationResolver) PublishRiskList(ctx context.Context, input types.Publ // Owner is the resolver for the owner field. func (r *riskResolver) Owner(ctx context.Context, obj *types.Risk) (*types.Profile, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } @@ -310,7 +309,7 @@ func (r *riskResolver) Owner(ctx context.Context, obj *types.Risk) (*types.Profi // Organization is the resolver for the organization field. func (r *riskResolver) Organization(ctx context.Context, obj *types.Risk) (*types.Organization, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { return nil, err } @@ -332,11 +331,11 @@ func (r *riskResolver) Organization(ctx context.Context, obj *types.Risk) (*type // Measures is the resolver for the measures field. func (r *riskResolver) Measures(ctx context.Context, obj *types.Risk, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.MeasureOrderBy, filter *types.MeasureFilter) (*types.MeasureConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionMeasureList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionMeasureList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.MeasureOrderField]{ @@ -368,11 +367,11 @@ func (r *riskResolver) Measures(ctx context.Context, obj *types.Risk, first *int // Documents is the resolver for the documents field. func (r *riskResolver) Documents(ctx context.Context, obj *types.Risk, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentOrderBy, filter *types.DocumentFilter) (*types.DocumentConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionDocumentList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.DocumentOrderField]{ @@ -407,11 +406,11 @@ func (r *riskResolver) Documents(ctx context.Context, obj *types.Risk, first *in // Controls is the resolver for the controls field. func (r *riskResolver) Controls(ctx context.Context, obj *types.Risk, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy, filter *types.ControlFilter) (*types.ControlConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionControlList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionControlList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.ControlOrderField]{ @@ -443,11 +442,11 @@ func (r *riskResolver) Controls(ctx context.Context, obj *types.Risk, first *int // Obligations is the resolver for the obligations field. func (r *riskResolver) Obligations(ctx context.Context, obj *types.Risk, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ObligationOrderBy) (*types.ObligationConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionObligationList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionObligationList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.ObligationOrderField]{ @@ -474,12 +473,11 @@ func (r *riskResolver) Obligations(ctx context.Context, obj *types.Risk, first * // Scenarios is the resolver for the scenarios field. func (r *riskResolver) Scenarios(ctx context.Context, obj *types.Risk, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskAssessmentScenarioOrderBy) (*types.RiskAssessmentScenarioConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentScenarioList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentScenarioList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) - pageOrderBy := page.OrderBy[coredata.RiskAssessmentScenarioOrderField]{ Field: coredata.RiskAssessmentScenarioOrderFieldCreatedAt, Direction: page.OrderDirectionDesc, @@ -506,11 +504,11 @@ func (r *riskResolver) Permission(ctx context.Context, obj *types.Risk, action s // TotalCount is the resolver for the totalCount field. func (r *riskConnectionResolver) TotalCount(ctx context.Context, obj *types.RiskConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionRiskList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionRiskList) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) prb := r.probo switch obj.Resolver.(type) { diff --git a/pkg/server/api/console/v1/task_resolvers.go b/pkg/server/api/console/v1/task_resolvers.go index 1e6710f84..44d004b61 100644 --- a/pkg/server/api/console/v1/task_resolvers.go +++ b/pkg/server/api/console/v1/task_resolvers.go @@ -24,11 +24,11 @@ import ( // CreateTask is the resolver for the createTask field. func (r *mutationResolver) CreateTask(ctx context.Context, input types.CreateTaskInput) (*types.CreateTaskPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionTaskCreate); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionTaskCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo task, err := prb.Tasks.Create( @@ -65,11 +65,11 @@ func (r *mutationResolver) CreateTask(ctx context.Context, input types.CreateTas // UpdateTask is the resolver for the updateTask field. func (r *mutationResolver) UpdateTask(ctx context.Context, input types.UpdateTaskInput) (*types.UpdateTaskPayload, error) { - if err := r.authorize(ctx, input.TaskID, probo.ActionTaskUpdate); err != nil { + scope, err := r.authorize(ctx, input.TaskID, probo.ActionTaskUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.TaskID) prb := r.probo task, err := prb.Tasks.Update( @@ -104,15 +104,14 @@ func (r *mutationResolver) UpdateTask(ctx context.Context, input types.UpdateTas // DeleteTask is the resolver for the deleteTask field. func (r *mutationResolver) DeleteTask(ctx context.Context, input types.DeleteTaskInput) (*types.DeleteTaskPayload, error) { - if err := r.authorize(ctx, input.TaskID, probo.ActionTaskDelete); err != nil { + scope, err := r.authorize(ctx, input.TaskID, probo.ActionTaskDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.TaskID) prb := r.probo - err := prb.Tasks.Delete(ctx, scope, input.TaskID) - if err != nil { + if err := prb.Tasks.Delete(ctx, scope, input.TaskID); err != nil { r.logger.ErrorCtx(ctx, "cannot delete task", log.Error(err)) return nil, gqlutils.Internal(ctx) } @@ -124,7 +123,7 @@ func (r *mutationResolver) DeleteTask(ctx context.Context, input types.DeleteTas // AssignedTo is the resolver for the assignedTo field. func (r *taskResolver) AssignedTo(ctx context.Context, obj *types.Task) (*types.Profile, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } @@ -150,7 +149,7 @@ func (r *taskResolver) AssignedTo(ctx context.Context, obj *types.Task) (*types. // Organization is the resolver for the organization field. func (r *taskResolver) Organization(ctx context.Context, obj *types.Task) (*types.Organization, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { return nil, err } @@ -172,7 +171,7 @@ func (r *taskResolver) Organization(ctx context.Context, obj *types.Task) (*type // Measure is the resolver for the measure field. func (r *taskResolver) Measure(ctx context.Context, obj *types.Task) (*types.Measure, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionMeasureGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionMeasureGet); err != nil { return nil, err } @@ -198,11 +197,11 @@ func (r *taskResolver) Measure(ctx context.Context, obj *types.Task) (*types.Mea // Evidences is the resolver for the evidences field. func (r *taskResolver) Evidences(ctx context.Context, obj *types.Task, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.EvidenceOrderBy) (*types.EvidenceConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionEvidenceList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionEvidenceList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.EvidenceOrderField]{ @@ -234,11 +233,11 @@ func (r *taskResolver) Permission(ctx context.Context, obj *types.Task, action s // TotalCount is the resolver for the totalCount field. func (r *taskConnectionResolver) TotalCount(ctx context.Context, obj *types.TaskConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionTaskList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionTaskList) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) prb := r.probo switch obj.Resolver.(type) { diff --git a/pkg/server/api/console/v1/third_party_resolvers.go b/pkg/server/api/console/v1/third_party_resolvers.go index b1060a5f5..79c87f482 100644 --- a/pkg/server/api/console/v1/third_party_resolvers.go +++ b/pkg/server/api/console/v1/third_party_resolvers.go @@ -27,11 +27,11 @@ import ( // CreateThirdParty is the resolver for the createThirdParty field. func (r *mutationResolver) CreateThirdParty(ctx context.Context, input types.CreateThirdPartyInput) (*types.CreateThirdPartyPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionThirdPartyCreate); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionThirdPartyCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo thirdParty, err := prb.ThirdParties.Create( @@ -80,11 +80,11 @@ func (r *mutationResolver) CreateThirdParty(ctx context.Context, input types.Cre // UpdateThirdParty is the resolver for the updateThirdParty field. func (r *mutationResolver) UpdateThirdParty(ctx context.Context, input types.UpdateThirdPartyInput) (*types.UpdateThirdPartyPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionThirdPartyUpdate); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionThirdPartyUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo thirdParty, err := prb.ThirdParties.Update( @@ -130,15 +130,14 @@ func (r *mutationResolver) UpdateThirdParty(ctx context.Context, input types.Upd // DeleteThirdParty is the resolver for the deleteThirdParty field. func (r *mutationResolver) DeleteThirdParty(ctx context.Context, input types.DeleteThirdPartyInput) (*types.DeleteThirdPartyPayload, error) { - if err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyDelete); err != nil { + scope, err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ThirdPartyID) prb := r.probo - err := prb.ThirdParties.Delete(ctx, scope, input.ThirdPartyID) - if err != nil { + if err := prb.ThirdParties.Delete(ctx, scope, input.ThirdPartyID); err != nil { r.logger.ErrorCtx(ctx, "cannot delete thirdParty", log.Error(err)) return nil, gqlutils.Internal(ctx) } @@ -150,11 +149,11 @@ func (r *mutationResolver) DeleteThirdParty(ctx context.Context, input types.Del // CreateThirdPartyContact is the resolver for the createThirdPartyContact field. func (r *mutationResolver) CreateThirdPartyContact(ctx context.Context, input types.CreateThirdPartyContactInput) (*types.CreateThirdPartyContactPayload, error) { - if err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyContactCreate); err != nil { + scope, err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyContactCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ThirdPartyID) prb := r.probo req := probo.CreateThirdPartyContactRequest{ @@ -183,11 +182,11 @@ func (r *mutationResolver) CreateThirdPartyContact(ctx context.Context, input ty // UpdateThirdPartyContact is the resolver for the updateThirdPartyContact field. func (r *mutationResolver) UpdateThirdPartyContact(ctx context.Context, input types.UpdateThirdPartyContactInput) (*types.UpdateThirdPartyContactPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionThirdPartyContactUpdate); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionThirdPartyContactUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo req := probo.UpdateThirdPartyContactRequest{ @@ -216,15 +215,14 @@ func (r *mutationResolver) UpdateThirdPartyContact(ctx context.Context, input ty // DeleteThirdPartyContact is the resolver for the deleteThirdPartyContact field. func (r *mutationResolver) DeleteThirdPartyContact(ctx context.Context, input types.DeleteThirdPartyContactInput) (*types.DeleteThirdPartyContactPayload, error) { - if err := r.authorize(ctx, input.ThirdPartyContactID, probo.ActionThirdPartyContactDelete); err != nil { + scope, err := r.authorize(ctx, input.ThirdPartyContactID, probo.ActionThirdPartyContactDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ThirdPartyContactID) prb := r.probo - err := prb.ThirdPartyContacts.Delete(ctx, scope, input.ThirdPartyContactID) - if err != nil { + if err := prb.ThirdPartyContacts.Delete(ctx, scope, input.ThirdPartyContactID); err != nil { r.logger.ErrorCtx(ctx, "cannot delete thirdParty contact", log.Error(err)) return nil, gqlutils.Internal(ctx) } @@ -236,11 +234,11 @@ func (r *mutationResolver) DeleteThirdPartyContact(ctx context.Context, input ty // CreateThirdPartyService is the resolver for the createThirdPartyService field. func (r *mutationResolver) CreateThirdPartyService(ctx context.Context, input types.CreateThirdPartyServiceInput) (*types.CreateThirdPartyServicePayload, error) { - if err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyServiceCreate); err != nil { + scope, err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyServiceCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ThirdPartyID) prb := r.probo req := probo.CreateThirdPartyServiceRequest{ @@ -267,11 +265,11 @@ func (r *mutationResolver) CreateThirdPartyService(ctx context.Context, input ty // UpdateThirdPartyService is the resolver for the updateThirdPartyService field. func (r *mutationResolver) UpdateThirdPartyService(ctx context.Context, input types.UpdateThirdPartyServiceInput) (*types.UpdateThirdPartyServicePayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionThirdPartyServiceUpdate); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionThirdPartyServiceUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo req := probo.UpdateThirdPartyServiceRequest{ @@ -298,15 +296,14 @@ func (r *mutationResolver) UpdateThirdPartyService(ctx context.Context, input ty // DeleteThirdPartyService is the resolver for the deleteThirdPartyService field. func (r *mutationResolver) DeleteThirdPartyService(ctx context.Context, input types.DeleteThirdPartyServiceInput) (*types.DeleteThirdPartyServicePayload, error) { - if err := r.authorize(ctx, input.ThirdPartyServiceID, probo.ActionThirdPartyServiceDelete); err != nil { + scope, err := r.authorize(ctx, input.ThirdPartyServiceID, probo.ActionThirdPartyServiceDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ThirdPartyServiceID) prb := r.probo - err := prb.ThirdPartyServices.Delete(ctx, scope, input.ThirdPartyServiceID) - if err != nil { + if err := prb.ThirdPartyServices.Delete(ctx, scope, input.ThirdPartyServiceID); err != nil { r.logger.ErrorCtx(ctx, "cannot delete thirdParty service", log.Error(err)) return nil, gqlutils.Internal(ctx) } @@ -318,11 +315,11 @@ func (r *mutationResolver) DeleteThirdPartyService(ctx context.Context, input ty // UploadThirdPartyComplianceReport is the resolver for the uploadThirdPartyComplianceReport field. func (r *mutationResolver) UploadThirdPartyComplianceReport(ctx context.Context, input types.UploadThirdPartyComplianceReportInput) (*types.UploadThirdPartyComplianceReportPayload, error) { - if err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyComplianceReportUpload); err != nil { + scope, err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyComplianceReportUpload) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ThirdPartyID) prb := r.probo thirdPartyComplianceReport, err := prb.ThirdPartyComplianceReports.Upload( @@ -352,15 +349,14 @@ func (r *mutationResolver) UploadThirdPartyComplianceReport(ctx context.Context, // DeleteThirdPartyComplianceReport is the resolver for the deleteThirdPartyComplianceReport field. func (r *mutationResolver) DeleteThirdPartyComplianceReport(ctx context.Context, input types.DeleteThirdPartyComplianceReportInput) (*types.DeleteThirdPartyComplianceReportPayload, error) { - if err := r.authorize(ctx, input.ReportID, probo.ActionThirdPartyComplianceReportDelete); err != nil { + scope, err := r.authorize(ctx, input.ReportID, probo.ActionThirdPartyComplianceReportDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ReportID) prb := r.probo - err := prb.ThirdPartyComplianceReports.Delete(ctx, scope, input.ReportID) - if err != nil { + if err := prb.ThirdPartyComplianceReports.Delete(ctx, scope, input.ReportID); err != nil { r.logger.ErrorCtx(ctx, "cannot delete thirdParty compliance report", log.Error(err)) return nil, gqlutils.Internal(ctx) } @@ -372,11 +368,11 @@ func (r *mutationResolver) DeleteThirdPartyComplianceReport(ctx context.Context, // UploadThirdPartyBusinessAssociateAgreement is the resolver for the uploadThirdPartyBusinessAssociateAgreement field. func (r *mutationResolver) UploadThirdPartyBusinessAssociateAgreement(ctx context.Context, input types.UploadThirdPartyBusinessAssociateAgreementInput) (*types.UploadThirdPartyBusinessAssociateAgreementPayload, error) { - if err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyBusinessAssociateAgreementUpload); err != nil { + scope, err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyBusinessAssociateAgreementUpload) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ThirdPartyID) prb := r.probo thirdPartyBusinessAssociateAgreement, file, err := prb.ThirdPartyBusinessAssociateAgreements.Upload( @@ -406,11 +402,11 @@ func (r *mutationResolver) UploadThirdPartyBusinessAssociateAgreement(ctx contex // UpdateThirdPartyBusinessAssociateAgreement is the resolver for the updateThirdPartyBusinessAssociateAgreement field. func (r *mutationResolver) UpdateThirdPartyBusinessAssociateAgreement(ctx context.Context, input types.UpdateThirdPartyBusinessAssociateAgreementInput) (*types.UpdateThirdPartyBusinessAssociateAgreementPayload, error) { - if err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyBusinessAssociateAgreementUpdate); err != nil { + scope, err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyBusinessAssociateAgreementUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ThirdPartyID) prb := r.probo thirdPartyBusinessAssociateAgreement, file, err := prb.ThirdPartyBusinessAssociateAgreements.Update( @@ -438,15 +434,14 @@ func (r *mutationResolver) UpdateThirdPartyBusinessAssociateAgreement(ctx contex // DeleteThirdPartyBusinessAssociateAgreement is the resolver for the deleteThirdPartyBusinessAssociateAgreement field. func (r *mutationResolver) DeleteThirdPartyBusinessAssociateAgreement(ctx context.Context, input types.DeleteThirdPartyBusinessAssociateAgreementInput) (*types.DeleteThirdPartyBusinessAssociateAgreementPayload, error) { - if err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyBusinessAssociateAgreementDelete); err != nil { + scope, err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyBusinessAssociateAgreementDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ThirdPartyID) prb := r.probo - err := prb.ThirdPartyBusinessAssociateAgreements.DeleteByThirdPartyID(ctx, scope, input.ThirdPartyID) - if err != nil { + if err := prb.ThirdPartyBusinessAssociateAgreements.DeleteByThirdPartyID(ctx, scope, input.ThirdPartyID); err != nil { r.logger.ErrorCtx(ctx, "cannot delete thirdParty business associate agreement", log.Error(err)) return nil, gqlutils.Internal(ctx) } @@ -458,11 +453,11 @@ func (r *mutationResolver) DeleteThirdPartyBusinessAssociateAgreement(ctx contex // UploadThirdPartyDataPrivacyAgreement is the resolver for the uploadThirdPartyDataPrivacyAgreement field. func (r *mutationResolver) UploadThirdPartyDataPrivacyAgreement(ctx context.Context, input types.UploadThirdPartyDataPrivacyAgreementInput) (*types.UploadThirdPartyDataPrivacyAgreementPayload, error) { - if err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyDataPrivacyAgreementUpload); err != nil { + scope, err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyDataPrivacyAgreementUpload) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ThirdPartyID) prb := r.probo thirdPartyDataPrivacyAgreement, file, err := prb.ThirdPartyDataPrivacyAgreements.Upload( @@ -492,11 +487,11 @@ func (r *mutationResolver) UploadThirdPartyDataPrivacyAgreement(ctx context.Cont // UpdateThirdPartyDataPrivacyAgreement is the resolver for the updateThirdPartyDataPrivacyAgreement field. func (r *mutationResolver) UpdateThirdPartyDataPrivacyAgreement(ctx context.Context, input types.UpdateThirdPartyDataPrivacyAgreementInput) (*types.UpdateThirdPartyDataPrivacyAgreementPayload, error) { - if err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyDataPrivacyAgreementUpdate); err != nil { + scope, err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyDataPrivacyAgreementUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ThirdPartyID) prb := r.probo thirdPartyDataPrivacyAgreement, file, err := prb.ThirdPartyDataPrivacyAgreements.Update( @@ -524,15 +519,14 @@ func (r *mutationResolver) UpdateThirdPartyDataPrivacyAgreement(ctx context.Cont // DeleteThirdPartyDataPrivacyAgreement is the resolver for the deleteThirdPartyDataPrivacyAgreement field. func (r *mutationResolver) DeleteThirdPartyDataPrivacyAgreement(ctx context.Context, input types.DeleteThirdPartyDataPrivacyAgreementInput) (*types.DeleteThirdPartyDataPrivacyAgreementPayload, error) { - if err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyDataPrivacyAgreementDelete); err != nil { + scope, err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyDataPrivacyAgreementDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ThirdPartyID) prb := r.probo - err := prb.ThirdPartyDataPrivacyAgreements.DeleteByThirdPartyID(ctx, scope, input.ThirdPartyID) - if err != nil { + if err := prb.ThirdPartyDataPrivacyAgreements.DeleteByThirdPartyID(ctx, scope, input.ThirdPartyID); err != nil { r.logger.ErrorCtx(ctx, "cannot delete thirdParty data privacy agreement", log.Error(err)) return nil, gqlutils.Internal(ctx) } @@ -544,11 +538,11 @@ func (r *mutationResolver) DeleteThirdPartyDataPrivacyAgreement(ctx context.Cont // CreateThirdPartyRiskAssessment is the resolver for the createThirdPartyRiskAssessment field. func (r *mutationResolver) CreateThirdPartyRiskAssessment(ctx context.Context, input types.CreateThirdPartyRiskAssessmentInput) (*types.CreateThirdPartyRiskAssessmentPayload, error) { - if err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyRiskAssessmentCreate); err != nil { + scope, err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyRiskAssessmentCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ThirdPartyID) prb := r.probo thirdPartyRiskAssessment, err := prb.ThirdParties.CreateRiskAssessment( @@ -578,11 +572,11 @@ func (r *mutationResolver) CreateThirdPartyRiskAssessment(ctx context.Context, i // AssessThirdParty is the resolver for the assessThirdParty field. func (r *mutationResolver) AssessThirdParty(ctx context.Context, input types.AssessThirdPartyInput) (*types.AssessThirdPartyPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionThirdPartyAssess); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionThirdPartyAssess) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo result, err := prb.ThirdParties.Assess( @@ -612,11 +606,11 @@ func (r *mutationResolver) AssessThirdParty(ctx context.Context, input types.Ass // PublishThirdPartyList is the resolver for the publishThirdPartyList field. func (r *mutationResolver) PublishThirdPartyList(ctx context.Context, input types.PublishThirdPartyListInput) (*types.PublishThirdPartyListPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionThirdPartyPublish); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionThirdPartyPublish) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo document, documentVersion, err := prb.GeneratedDocuments.PublishThirdPartyList(ctx, scope, input.OrganizationID, input.ApproverIds, input.Minor) @@ -642,7 +636,7 @@ func (r *mutationResolver) PublishThirdPartyList(ctx context.Context, input type // Organization is the resolver for the organization field. func (r *thirdPartyResolver) Organization(ctx context.Context, obj *types.ThirdParty) (*types.Organization, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { return nil, err } @@ -664,11 +658,11 @@ func (r *thirdPartyResolver) Organization(ctx context.Context, obj *types.ThirdP // ComplianceReports is the resolver for the complianceReports field. func (r *thirdPartyResolver) ComplianceReports(ctx context.Context, obj *types.ThirdParty, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ThirdPartyComplianceReportOrderBy) (*types.ThirdPartyComplianceReportConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyComplianceReportList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyComplianceReportList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.ThirdPartyComplianceReportOrderField]{ @@ -695,11 +689,11 @@ func (r *thirdPartyResolver) ComplianceReports(ctx context.Context, obj *types.T // BusinessAssociateAgreement is the resolver for the businessAssociateAgreement field. func (r *thirdPartyResolver) BusinessAssociateAgreement(ctx context.Context, obj *types.ThirdParty) (*types.ThirdPartyBusinessAssociateAgreement, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyBusinessAssociateAgreementGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyBusinessAssociateAgreementGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo thirdPartyBusinessAssociateAgreement, file, err := prb.ThirdPartyBusinessAssociateAgreements.GetByThirdPartyID(ctx, scope, obj.ID) @@ -718,11 +712,11 @@ func (r *thirdPartyResolver) BusinessAssociateAgreement(ctx context.Context, obj // DataPrivacyAgreement is the resolver for the dataPrivacyAgreement field. func (r *thirdPartyResolver) DataPrivacyAgreement(ctx context.Context, obj *types.ThirdParty) (*types.ThirdPartyDataPrivacyAgreement, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyDataPrivacyAgreementGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyDataPrivacyAgreementGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo thirdPartyDataPrivacyAgreement, file, err := prb.ThirdPartyDataPrivacyAgreements.GetByThirdPartyID(ctx, scope, obj.ID) @@ -741,11 +735,11 @@ func (r *thirdPartyResolver) DataPrivacyAgreement(ctx context.Context, obj *type // Contacts is the resolver for the contacts field. func (r *thirdPartyResolver) Contacts(ctx context.Context, obj *types.ThirdParty, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ThirdPartyContactOrderBy) (*types.ThirdPartyContactConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyContactList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyContactList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.ThirdPartyContactOrderField]{ @@ -772,11 +766,11 @@ func (r *thirdPartyResolver) Contacts(ctx context.Context, obj *types.ThirdParty // Services is the resolver for the services field. func (r *thirdPartyResolver) Services(ctx context.Context, obj *types.ThirdParty, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ThirdPartyServiceOrderBy) (*types.ThirdPartyServiceConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyServiceList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyServiceList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.ThirdPartyServiceOrderField]{ @@ -803,11 +797,11 @@ func (r *thirdPartyResolver) Services(ctx context.Context, obj *types.ThirdParty // RiskAssessments is the resolver for the riskAssessments field. func (r *thirdPartyResolver) RiskAssessments(ctx context.Context, obj *types.ThirdParty, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ThirdPartyRiskAssessmentOrder) (*types.ThirdPartyRiskAssessmentConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyRiskAssessmentList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyRiskAssessmentList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.ThirdPartyRiskAssessmentOrderField]{ @@ -834,7 +828,7 @@ func (r *thirdPartyResolver) RiskAssessments(ctx context.Context, obj *types.Thi // BusinessOwner is the resolver for the businessOwner field. func (r *thirdPartyResolver) BusinessOwner(ctx context.Context, obj *types.ThirdParty) (*types.Profile, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } @@ -860,7 +854,7 @@ func (r *thirdPartyResolver) BusinessOwner(ctx context.Context, obj *types.Third // SecurityOwner is the resolver for the securityOwner field. func (r *thirdPartyResolver) SecurityOwner(ctx context.Context, obj *types.ThirdParty) (*types.Profile, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } @@ -891,11 +885,11 @@ func (r *thirdPartyResolver) Permission(ctx context.Context, obj *types.ThirdPar // ThirdParty is the resolver for the thirdParty field. func (r *thirdPartyBusinessAssociateAgreementResolver) ThirdParty(ctx context.Context, obj *types.ThirdPartyBusinessAssociateAgreement) (*types.ThirdParty, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo thirdParty, err := prb.ThirdParties.Get(ctx, scope, obj.ID) @@ -912,11 +906,11 @@ func (r *thirdPartyBusinessAssociateAgreementResolver) ThirdParty(ctx context.Co // FileURL is the resolver for the fileUrl field. func (r *thirdPartyBusinessAssociateAgreementResolver) FileURL(ctx context.Context, obj *types.ThirdPartyBusinessAssociateAgreement) (string, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionFileDownloadUrl); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionFileDownloadUrl) + if err != nil { return "", err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo fileURL, err := prb.ThirdPartyBusinessAssociateAgreements.GenerateFileURL(ctx, scope, obj.ID, 1*time.Hour) @@ -935,11 +929,11 @@ func (r *thirdPartyBusinessAssociateAgreementResolver) Permission(ctx context.Co // ThirdParty is the resolver for the thirdParty field. func (r *thirdPartyComplianceReportResolver) ThirdParty(ctx context.Context, obj *types.ThirdPartyComplianceReport) (*types.ThirdParty, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo thirdParty, err := prb.ThirdParties.Get(ctx, scope, obj.ID) @@ -958,11 +952,11 @@ func (r *thirdPartyComplianceReportResolver) ThirdParty(ctx context.Context, obj // File is the resolver for the file field. func (r *thirdPartyComplianceReportResolver) File(ctx context.Context, obj *types.ThirdPartyComplianceReport) (*types.File, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionFileGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionFileGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo evidence, err := prb.ThirdPartyComplianceReports.Get(ctx, scope, obj.ID) @@ -996,11 +990,11 @@ func (r *thirdPartyComplianceReportResolver) Permission(ctx context.Context, obj // TotalCount is the resolver for the totalCount field. func (r *thirdPartyConnectionResolver) TotalCount(ctx context.Context, obj *types.ThirdPartyConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionThirdPartyList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionThirdPartyList) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) prb := r.probo switch obj.Resolver.(type) { @@ -1037,11 +1031,11 @@ func (r *thirdPartyConnectionResolver) TotalCount(ctx context.Context, obj *type // ThirdParty is the resolver for the thirdParty field. func (r *thirdPartyContactResolver) ThirdParty(ctx context.Context, obj *types.ThirdPartyContact) (*types.ThirdParty, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo // Get the thirdParty contact to access the ThirdPartyID @@ -1072,11 +1066,11 @@ func (r *thirdPartyContactResolver) Permission(ctx context.Context, obj *types.T // ThirdParty is the resolver for the thirdParty field. func (r *thirdPartyDataPrivacyAgreementResolver) ThirdParty(ctx context.Context, obj *types.ThirdPartyDataPrivacyAgreement) (*types.ThirdParty, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo thirdParty, err := prb.ThirdParties.Get(ctx, scope, obj.ID) @@ -1095,11 +1089,11 @@ func (r *thirdPartyDataPrivacyAgreementResolver) ThirdParty(ctx context.Context, // FileURL is the resolver for the fileUrl field. func (r *thirdPartyDataPrivacyAgreementResolver) FileURL(ctx context.Context, obj *types.ThirdPartyDataPrivacyAgreement) (string, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionFileDownloadUrl); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionFileDownloadUrl) + if err != nil { return "", err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo fileURL, err := prb.ThirdPartyDataPrivacyAgreements.GenerateFileURL(ctx, scope, obj.ID, 1*time.Hour) @@ -1118,11 +1112,11 @@ func (r *thirdPartyDataPrivacyAgreementResolver) Permission(ctx context.Context, // ThirdParty is the resolver for the thirdParty field. func (r *thirdPartyRiskAssessmentResolver) ThirdParty(ctx context.Context, obj *types.ThirdPartyRiskAssessment) (*types.ThirdParty, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo thirdParty, err := prb.ThirdParties.GetByRiskAssessmentID(ctx, scope, obj.ID) @@ -1146,7 +1140,7 @@ func (r *thirdPartyRiskAssessmentResolver) Permission(ctx context.Context, obj * // ThirdParty is the resolver for the thirdParty field. func (r *thirdPartyServiceResolver) ThirdParty(ctx context.Context, obj *types.ThirdPartyService) (*types.ThirdParty, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyGet); err != nil { return nil, err } diff --git a/pkg/server/api/console/v1/trust_center_resolvers.go b/pkg/server/api/console/v1/trust_center_resolvers.go index 54bfcd642..7377419ec 100644 --- a/pkg/server/api/console/v1/trust_center_resolvers.go +++ b/pkg/server/api/console/v1/trust_center_resolvers.go @@ -31,7 +31,7 @@ func (r *complianceExternalURLResolver) Permission(ctx context.Context, obj *typ // Framework is the resolver for the framework field. func (r *complianceFrameworkResolver) Framework(ctx context.Context, obj *types.ComplianceFramework) (*types.Framework, error) { - if err := r.authorize(ctx, obj.FrameworkID, probo.ActionFrameworkGet); err != nil { + if _, err := r.authorize(ctx, obj.FrameworkID, probo.ActionFrameworkGet); err != nil { return nil, err } @@ -58,11 +58,11 @@ func (r *customDomainResolver) Permission(ctx context.Context, obj *types.Custom // UpdateTrustCenter is the resolver for the updateTrustCenter field. func (r *mutationResolver) UpdateTrustCenter(ctx context.Context, input types.UpdateTrustCenterInput) (*types.UpdateTrustCenterPayload, error) { - if err := r.authorize(ctx, input.TrustCenterID, probo.ActionTrustCenterUpdate); err != nil { + scope, err := r.authorize(ctx, input.TrustCenterID, probo.ActionTrustCenterUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.TrustCenterID) prb := r.probo trustCenter, file, err := prb.TrustCenters.Update( @@ -90,11 +90,11 @@ func (r *mutationResolver) UpdateTrustCenter(ctx context.Context, input types.Up // UploadTrustCenterNda is the resolver for the uploadTrustCenterNDA field. func (r *mutationResolver) UploadTrustCenterNda(ctx context.Context, input types.UploadTrustCenterNDAInput) (*types.UploadTrustCenterNDAPayload, error) { - if err := r.authorize(ctx, input.TrustCenterID, probo.ActionTrustCenterNonDisclosureAgreementUpload); err != nil { + scope, err := r.authorize(ctx, input.TrustCenterID, probo.ActionTrustCenterNonDisclosureAgreementUpload) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.TrustCenterID) prb := r.probo trustCenter, file, err := prb.TrustCenters.UploadNDA( @@ -122,11 +122,11 @@ func (r *mutationResolver) UploadTrustCenterNda(ctx context.Context, input types // DeleteTrustCenterNda is the resolver for the deleteTrustCenterNDA field. func (r *mutationResolver) DeleteTrustCenterNda(ctx context.Context, input types.DeleteTrustCenterNDAInput) (*types.DeleteTrustCenterNDAPayload, error) { - if err := r.authorize(ctx, input.TrustCenterID, probo.ActionTrustCenterNonDisclosureAgreementDelete); err != nil { + scope, err := r.authorize(ctx, input.TrustCenterID, probo.ActionTrustCenterNonDisclosureAgreementDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.TrustCenterID) prb := r.probo trustCenter, file, err := prb.TrustCenters.DeleteNDA(ctx, scope, input.TrustCenterID) @@ -142,11 +142,11 @@ func (r *mutationResolver) DeleteTrustCenterNda(ctx context.Context, input types // UpdateTrustCenterBrand is the resolver for the updateTrustCenterBrand field. func (r *mutationResolver) UpdateTrustCenterBrand(ctx context.Context, input types.UpdateTrustCenterBrandInput) (*types.UpdateTrustCenterBrandPayload, error) { - if err := r.authorize(ctx, input.TrustCenterID, probo.ActionTrustCenterUpdate); err != nil { + scope, err := r.authorize(ctx, input.TrustCenterID, probo.ActionTrustCenterUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.TrustCenterID) prb := r.probo req := &probo.UpdateTrustCenterBrandRequest{ @@ -205,11 +205,11 @@ func (r *mutationResolver) UpdateTrustCenterBrand(ctx context.Context, input typ // UpdateTrustCenterAccess is the resolver for the updateTrustCenterAccess field. func (r *mutationResolver) UpdateTrustCenterAccess(ctx context.Context, input types.UpdateTrustCenterAccessInput) (*types.UpdateTrustCenterAccessPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionTrustCenterAccessUpdate); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionTrustCenterAccessUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo var ( @@ -265,15 +265,14 @@ func (r *mutationResolver) UpdateTrustCenterAccess(ctx context.Context, input ty // DeleteTrustCenterAccess is the resolver for the deleteTrustCenterAccess field. func (r *mutationResolver) DeleteTrustCenterAccess(ctx context.Context, input types.DeleteTrustCenterAccessInput) (*types.DeleteTrustCenterAccessPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionTrustCenterAccessDelete); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionTrustCenterAccessDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo - err := prb.TrustCenterAccesses.Delete(ctx, scope, input.ID) - if err != nil { + if err := prb.TrustCenterAccesses.Delete(ctx, scope, input.ID); err != nil { r.logger.ErrorCtx(ctx, "cannot delete trust center access", log.Error(err)) return nil, gqlutils.Internal(ctx) } @@ -285,11 +284,11 @@ func (r *mutationResolver) DeleteTrustCenterAccess(ctx context.Context, input ty // CreateTrustCenterReference is the resolver for the createTrustCenterReference field. func (r *mutationResolver) CreateTrustCenterReference(ctx context.Context, input types.CreateTrustCenterReferenceInput) (*types.CreateTrustCenterReferencePayload, error) { - if err := r.authorize(ctx, input.TrustCenterID, probo.ActionTrustCenterReferenceCreate); err != nil { + scope, err := r.authorize(ctx, input.TrustCenterID, probo.ActionTrustCenterReferenceCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.TrustCenterID) prb := r.probo reference, err := prb.TrustCenterReferences.Create( @@ -324,11 +323,11 @@ func (r *mutationResolver) CreateTrustCenterReference(ctx context.Context, input // UpdateTrustCenterReference is the resolver for the updateTrustCenterReference field. func (r *mutationResolver) UpdateTrustCenterReference(ctx context.Context, input types.UpdateTrustCenterReferenceInput) (*types.UpdateTrustCenterReferencePayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionTrustCenterReferenceUpdate); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionTrustCenterReferenceUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo req := &probo.UpdateTrustCenterReferenceRequest{ @@ -366,15 +365,14 @@ func (r *mutationResolver) UpdateTrustCenterReference(ctx context.Context, input // DeleteTrustCenterReference is the resolver for the deleteTrustCenterReference field. func (r *mutationResolver) DeleteTrustCenterReference(ctx context.Context, input types.DeleteTrustCenterReferenceInput) (*types.DeleteTrustCenterReferencePayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionTrustCenterReferenceDelete); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionTrustCenterReferenceDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo - err := prb.TrustCenterReferences.Delete(ctx, scope, input.ID) - if err != nil { + if err := prb.TrustCenterReferences.Delete(ctx, scope, input.ID); err != nil { r.logger.ErrorCtx(ctx, "cannot delete trust center reference", log.Error(err)) return nil, gqlutils.Internal(ctx) } @@ -386,11 +384,11 @@ func (r *mutationResolver) DeleteTrustCenterReference(ctx context.Context, input // CreateComplianceFramework is the resolver for the createComplianceFramework field. func (r *mutationResolver) CreateComplianceFramework(ctx context.Context, input types.CreateComplianceFrameworkInput) (*types.CreateComplianceFrameworkPayload, error) { - if err := r.authorize(ctx, input.TrustCenterID, probo.ActionComplianceFrameworkCreate); err != nil { + scope, err := r.authorize(ctx, input.TrustCenterID, probo.ActionComplianceFrameworkCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.TrustCenterID) prb := r.probo cf, err := prb.ComplianceFrameworks.Create( @@ -417,11 +415,11 @@ func (r *mutationResolver) CreateComplianceFramework(ctx context.Context, input // UpdateComplianceFramework is the resolver for the updateComplianceFramework field. func (r *mutationResolver) UpdateComplianceFramework(ctx context.Context, input types.UpdateComplianceFrameworkInput) (*types.UpdateComplianceFrameworkPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionComplianceFrameworkUpdateRank); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionComplianceFrameworkUpdateRank) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo cf, err := prb.ComplianceFrameworks.Update(ctx, scope, &probo.UpdateComplianceFrameworkRequest{ @@ -445,20 +443,19 @@ func (r *mutationResolver) UpdateComplianceFramework(ctx context.Context, input // DeleteComplianceFramework is the resolver for the deleteComplianceFramework field. func (r *mutationResolver) DeleteComplianceFramework(ctx context.Context, input types.DeleteComplianceFrameworkInput) (*types.DeleteComplianceFrameworkPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionComplianceFrameworkDelete); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionComplianceFrameworkDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo - err := prb.ComplianceFrameworks.Delete( + if err := prb.ComplianceFrameworks.Delete( ctx, scope, &probo.DeleteComplianceFrameworkRequest{ ID: input.ID, }, - ) - if err != nil { + ); err != nil { if validationErrors, ok := errors.AsType[validator.ValidationErrors](err); ok { return nil, gqlutils.InvalidValidationErrors(ctx, validationErrors) } @@ -475,11 +472,11 @@ func (r *mutationResolver) DeleteComplianceFramework(ctx context.Context, input // CreateComplianceExternalURL is the resolver for the createComplianceExternalURL field. func (r *mutationResolver) CreateComplianceExternalURL(ctx context.Context, input types.CreateComplianceExternalURLInput) (*types.CreateComplianceExternalURLPayload, error) { - if err := r.authorize(ctx, input.TrustCenterID, probo.ActionComplianceExternalURLCreate); err != nil { + scope, err := r.authorize(ctx, input.TrustCenterID, probo.ActionComplianceExternalURLCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.TrustCenterID) prb := r.probo item, err := prb.ComplianceExternalURLs.Create( @@ -507,11 +504,11 @@ func (r *mutationResolver) CreateComplianceExternalURL(ctx context.Context, inpu // UpdateComplianceExternalURL is the resolver for the updateComplianceExternalURL field. func (r *mutationResolver) UpdateComplianceExternalURL(ctx context.Context, input types.UpdateComplianceExternalURLInput) (*types.UpdateComplianceExternalURLPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionComplianceExternalURLUpdate); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionComplianceExternalURLUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo item, err := prb.ComplianceExternalURLs.Update(ctx, scope, &probo.UpdateComplianceExternalURLRequest{ @@ -537,11 +534,11 @@ func (r *mutationResolver) UpdateComplianceExternalURL(ctx context.Context, inpu // DeleteComplianceExternalURL is the resolver for the deleteComplianceExternalURL field. func (r *mutationResolver) DeleteComplianceExternalURL(ctx context.Context, input types.DeleteComplianceExternalURLInput) (*types.DeleteComplianceExternalURLPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionComplianceExternalURLDelete); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionComplianceExternalURLDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo if err := prb.ComplianceExternalURLs.Delete(ctx, scope, &probo.DeleteComplianceExternalURLRequest{ID: input.ID}); err != nil { @@ -561,11 +558,11 @@ func (r *mutationResolver) DeleteComplianceExternalURL(ctx context.Context, inpu // CreateTrustCenterFile is the resolver for the createTrustCenterFile field. func (r *mutationResolver) CreateTrustCenterFile(ctx context.Context, input types.CreateTrustCenterFileInput) (*types.CreateTrustCenterFilePayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionTrustCenterFileCreate); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionTrustCenterFileCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo file, err := prb.TrustCenterFiles.Create( @@ -600,11 +597,11 @@ func (r *mutationResolver) CreateTrustCenterFile(ctx context.Context, input type // UpdateTrustCenterFile is the resolver for the updateTrustCenterFile field. func (r *mutationResolver) UpdateTrustCenterFile(ctx context.Context, input types.UpdateTrustCenterFileInput) (*types.UpdateTrustCenterFilePayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionTrustCenterFileUpdate); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionTrustCenterFileUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo file, err := prb.TrustCenterFiles.Update( @@ -633,11 +630,11 @@ func (r *mutationResolver) UpdateTrustCenterFile(ctx context.Context, input type // GetTrustCenterFile is the resolver for the getTrustCenterFile field. func (r *mutationResolver) GetTrustCenterFile(ctx context.Context, input types.GetTrustCenterFileInput) (*types.GetTrustCenterFilePayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionTrustCenterFileGet); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionTrustCenterFileGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo file, err := prb.TrustCenterFiles.Get(ctx, scope, input.ID) @@ -653,15 +650,14 @@ func (r *mutationResolver) GetTrustCenterFile(ctx context.Context, input types.G // DeleteTrustCenterFile is the resolver for the deleteTrustCenterFile field. func (r *mutationResolver) DeleteTrustCenterFile(ctx context.Context, input types.DeleteTrustCenterFileInput) (*types.DeleteTrustCenterFilePayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionTrustCenterFileDelete); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionTrustCenterFileDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo - err := prb.TrustCenterFiles.Delete(ctx, scope, input.ID) - if err != nil { + if err := prb.TrustCenterFiles.Delete(ctx, scope, input.ID); err != nil { r.logger.ErrorCtx(ctx, "cannot delete trust center file", log.Error(err)) return nil, gqlutils.Internal(ctx) } @@ -673,11 +669,11 @@ func (r *mutationResolver) DeleteTrustCenterFile(ctx context.Context, input type // CreateCustomDomain is the resolver for the createCustomDomain field. func (r *mutationResolver) CreateCustomDomain(ctx context.Context, input types.CreateCustomDomainInput) (*types.CreateCustomDomainPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionCustomDomainCreate); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionCustomDomainCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo domain, err := prb.CustomDomains.CreateCustomDomain( @@ -704,11 +700,11 @@ func (r *mutationResolver) CreateCustomDomain(ctx context.Context, input types.C // DeleteCustomDomain is the resolver for the deleteCustomDomain field. func (r *mutationResolver) DeleteCustomDomain(ctx context.Context, input types.DeleteCustomDomainInput) (*types.DeleteCustomDomainPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionCustomDomainDelete); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionCustomDomainDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo // TODO Drop this wierd logic @@ -737,11 +733,11 @@ func (r *mutationResolver) DeleteCustomDomain(ctx context.Context, input types.D // LogoFileURL is the resolver for the logoFileUrl field. func (r *trustCenterResolver) LogoFileURL(ctx context.Context, obj *types.TrustCenter) (*string, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo logoURL, err := prb.TrustCenters.GenerateLogoURL(ctx, scope, obj.ID, 1*time.Hour) @@ -755,11 +751,11 @@ func (r *trustCenterResolver) LogoFileURL(ctx context.Context, obj *types.TrustC // DarkLogoFileURL is the resolver for the darkLogoFileUrl field. func (r *trustCenterResolver) DarkLogoFileURL(ctx context.Context, obj *types.TrustCenter) (*string, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo logoURL, err := prb.TrustCenters.GenerateDarkLogoURL(ctx, scope, obj.ID, 1*time.Hour) @@ -797,11 +793,11 @@ func (r *trustCenterResolver) NdaFileURL(ctx context.Context, obj *types.TrustCe // Organization is the resolver for the organization field. func (r *trustCenterResolver) Organization(ctx context.Context, obj *types.TrustCenter) (*types.Organization, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo trustCenter, err := prb.TrustCenters.Get(ctx, scope, obj.ID) @@ -826,11 +822,11 @@ func (r *trustCenterResolver) Organization(ctx context.Context, obj *types.Trust // Accesses is the resolver for the accesses field. func (r *trustCenterResolver) Accesses(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.OrderBy[coredata.TrustCenterAccessOrderField]) (*types.TrustCenterAccessConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterAccessList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterAccessList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.TrustCenterAccessOrderField]{ @@ -857,11 +853,11 @@ func (r *trustCenterResolver) Accesses(ctx context.Context, obj *types.TrustCent // References is the resolver for the references field. func (r *trustCenterResolver) References(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.OrderBy[coredata.TrustCenterReferenceOrderField]) (*types.TrustCenterReferenceConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterReferenceList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterReferenceList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.TrustCenterReferenceOrderField]{ @@ -888,11 +884,11 @@ func (r *trustCenterResolver) References(ctx context.Context, obj *types.TrustCe // ComplianceFrameworks is the resolver for the complianceFrameworks field. func (r *trustCenterResolver) ComplianceFrameworks(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.OrderBy[coredata.ComplianceFrameworkOrderField]) (*types.ComplianceFrameworkConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionComplianceFrameworkList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionComplianceFrameworkList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.ComplianceFrameworkOrderField]{ @@ -919,11 +915,11 @@ func (r *trustCenterResolver) ComplianceFrameworks(ctx context.Context, obj *typ // ExternalUrls is the resolver for the externalUrls field. func (r *trustCenterResolver) ExternalUrls(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.OrderBy[coredata.ComplianceExternalURLOrderField]) (*types.ComplianceExternalURLConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionComplianceExternalURLList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionComplianceExternalURLList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.ComplianceExternalURLOrderField]{ @@ -950,7 +946,8 @@ func (r *trustCenterResolver) ExternalUrls(ctx context.Context, obj *types.Trust // MailingList is the resolver for the mailingList field. func (r *trustCenterResolver) MailingList(ctx context.Context, obj *types.TrustCenter) (*types.MailingList, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionMailingListSubscriberList); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionMailingListSubscriberList) + if err != nil { return nil, err } @@ -958,7 +955,6 @@ func (r *trustCenterResolver) MailingList(ctx context.Context, obj *types.TrustC return obj.MailingList, nil } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo ml, err := prb.TrustCenters.GetMailingList(ctx, scope, obj.ID) @@ -981,11 +977,11 @@ func (r *trustCenterResolver) Permission(ctx context.Context, obj *types.TrustCe // NdaSignature is the resolver for the ndaSignature field. func (r *trustCenterAccessResolver) NdaSignature(ctx context.Context, obj *types.TrustCenterAccess) (*types.ElectronicSignature, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterAccessGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterAccessGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo access, err := prb.TrustCenterAccesses.Get(ctx, scope, obj.ID) @@ -1007,11 +1003,11 @@ func (r *trustCenterAccessResolver) NdaSignature(ctx context.Context, obj *types // PendingRequestCount is the resolver for the pendingRequestCount field. func (r *trustCenterAccessResolver) PendingRequestCount(ctx context.Context, obj *types.TrustCenterAccess) (int, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterAccessGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterAccessGet) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo count, err := prb.TrustCenterAccesses.CountPendingRequestDocumentAccesses(ctx, scope, obj.ID) @@ -1025,11 +1021,11 @@ func (r *trustCenterAccessResolver) PendingRequestCount(ctx context.Context, obj // ActiveCount is the resolver for the activeCount field. func (r *trustCenterAccessResolver) ActiveCount(ctx context.Context, obj *types.TrustCenterAccess) (int, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterAccessGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterAccessGet) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo count, err := prb.TrustCenterAccesses.CountActiveDocumentAccesses(ctx, scope, obj.ID) @@ -1043,7 +1039,7 @@ func (r *trustCenterAccessResolver) ActiveCount(ctx context.Context, obj *types. // Profile is the resolver for the profile field. func (r *trustCenterAccessResolver) Profile(ctx context.Context, obj *types.TrustCenterAccess) (*types.Profile, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } @@ -1063,11 +1059,11 @@ func (r *trustCenterAccessResolver) Profile(ctx context.Context, obj *types.Trus // AvailableDocumentAccesses is the resolver for the availableDocumentAccesses field. func (r *trustCenterAccessResolver) AvailableDocumentAccesses(ctx context.Context, obj *types.TrustCenterAccess, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.OrderBy[coredata.TrustCenterDocumentAccessOrderField]) (*types.TrustCenterDocumentAccessConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterAccessGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterAccessGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.TrustCenterDocumentAccessOrderField]{ @@ -1099,7 +1095,8 @@ func (r *trustCenterAccessResolver) Permission(ctx context.Context, obj *types.T // Document is the resolver for the document field. func (r *trustCenterDocumentAccessResolver) Document(ctx context.Context, obj *types.TrustCenterDocumentAccess) (*types.Document, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet) + if err != nil { return nil, err } @@ -1107,7 +1104,6 @@ func (r *trustCenterDocumentAccessResolver) Document(ctx context.Context, obj *t return nil, nil } - scope := coredata.NewScopeFromObjectID(obj.TrustCenterAccessID) prb := r.probo document, err := prb.Documents.Get(ctx, scope, *obj.DocumentID) @@ -1126,7 +1122,8 @@ func (r *trustCenterDocumentAccessResolver) Document(ctx context.Context, obj *t // Report is the resolver for the report field. func (r *trustCenterDocumentAccessResolver) Report(ctx context.Context, obj *types.TrustCenterDocumentAccess) (*types.Report, error) { - if err := r.authorize(ctx, obj.TrustCenterAccessID, probo.ActionReportGet); err != nil { + scope, err := r.authorize(ctx, obj.TrustCenterAccessID, probo.ActionReportGet) + if err != nil { return nil, err } @@ -1134,7 +1131,6 @@ func (r *trustCenterDocumentAccessResolver) Report(ctx context.Context, obj *typ return nil, nil } - scope := coredata.NewScopeFromObjectID(obj.TrustCenterAccessID) prb := r.probo report, err := prb.Reports.Get(ctx, scope, *obj.ReportID) @@ -1148,7 +1144,8 @@ func (r *trustCenterDocumentAccessResolver) Report(ctx context.Context, obj *typ // TrustCenterFile is the resolver for the trustCenterFile field. func (r *trustCenterDocumentAccessResolver) TrustCenterFile(ctx context.Context, obj *types.TrustCenterDocumentAccess) (*types.TrustCenterFile, error) { - if err := r.authorize(ctx, obj.TrustCenterAccessID, probo.ActionTrustCenterFileGet); err != nil { + scope, err := r.authorize(ctx, obj.TrustCenterAccessID, probo.ActionTrustCenterFileGet) + if err != nil { return nil, err } @@ -1156,7 +1153,6 @@ func (r *trustCenterDocumentAccessResolver) TrustCenterFile(ctx context.Context, return nil, nil } - scope := coredata.NewScopeFromObjectID(obj.TrustCenterAccessID) prb := r.probo trustCenterFile, err := prb.TrustCenterFiles.Get(ctx, scope, *obj.TrustCenterFileID) @@ -1170,11 +1166,11 @@ func (r *trustCenterDocumentAccessResolver) TrustCenterFile(ctx context.Context, // TotalCount is the resolver for the totalCount field. func (r *trustCenterDocumentAccessConnectionResolver) TotalCount(ctx context.Context, obj *types.TrustCenterDocumentAccessConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionTrustCenterDocumentAccessList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionTrustCenterDocumentAccessList) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) prb := r.probo count, err := prb.TrustCenterAccesses.CountDocumentAccesses(ctx, scope, obj.ParentID) @@ -1188,11 +1184,11 @@ func (r *trustCenterDocumentAccessConnectionResolver) TotalCount(ctx context.Con // FileURL is the resolver for the fileUrl field. func (r *trustCenterFileResolver) FileURL(ctx context.Context, obj *types.TrustCenterFile) (string, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterFileGetFileUrl); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterFileGetFileUrl) + if err != nil { return "", err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo fileURL, err := prb.TrustCenterFiles.GenerateFileURL(ctx, scope, obj.ID, 1*time.Hour) @@ -1206,11 +1202,11 @@ func (r *trustCenterFileResolver) FileURL(ctx context.Context, obj *types.TrustC // Organization is the resolver for the organization field. func (r *trustCenterFileResolver) Organization(ctx context.Context, obj *types.TrustCenterFile) (*types.Organization, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo trustCenterFile, err := prb.TrustCenterFiles.Get(ctx, scope, obj.ID) @@ -1240,11 +1236,11 @@ func (r *trustCenterFileResolver) Permission(ctx context.Context, obj *types.Tru // TotalCount is the resolver for the totalCount field. func (r *trustCenterFileConnectionResolver) TotalCount(ctx context.Context, obj *types.TrustCenterFileConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionTrustCenterFileList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionTrustCenterFileList) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) prb := r.probo count, err := prb.TrustCenterFiles.CountForOrganizationID(ctx, scope, obj.ParentID) @@ -1258,11 +1254,11 @@ func (r *trustCenterFileConnectionResolver) TotalCount(ctx context.Context, obj // LogoURL is the resolver for the logoUrl field. func (r *trustCenterReferenceResolver) LogoURL(ctx context.Context, obj *types.TrustCenterReference) (string, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterReferenceGetLogoUrl); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterReferenceGetLogoUrl) + if err != nil { return "", err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo fileURL, err := prb.TrustCenterReferences.GenerateLogoURL(ctx, scope, obj.ID, 1*time.Hour) @@ -1281,11 +1277,11 @@ func (r *trustCenterReferenceResolver) Permission(ctx context.Context, obj *type // TotalCount is the resolver for the totalCount field. func (r *trustCenterReferenceConnectionResolver) TotalCount(ctx context.Context, obj *types.TrustCenterReferenceConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionTrustCenterReferenceList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionTrustCenterReferenceList) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) prb := r.probo count, err := prb.TrustCenterReferences.CountForTrustCenterID(ctx, scope, obj.ParentID) diff --git a/pkg/server/api/console/v1/viewer_resolvers.go b/pkg/server/api/console/v1/viewer_resolvers.go index 8af2c087a..f0361bb70 100644 --- a/pkg/server/api/console/v1/viewer_resolvers.go +++ b/pkg/server/api/console/v1/viewer_resolvers.go @@ -22,11 +22,11 @@ import ( // SignableDocuments is the resolver for the signableDocuments field. func (r *viewerResolver) SignableDocuments(ctx context.Context, obj *types.Viewer, organizationID gid.GID, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentOrderBy) (*types.EmployeeDocumentConnection, error) { - if err := r.authorize(ctx, organizationID, probo.ActionEmployeeDocumentList); err != nil { + scope, err := r.authorize(ctx, organizationID, probo.ActionEmployeeDocumentList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(organizationID) prb := r.probo pageOrderBy := page.OrderBy[coredata.DocumentOrderField]{ @@ -71,11 +71,11 @@ func (r *viewerResolver) SignableDocuments(ctx context.Context, obj *types.Viewe // SignableDocument is the resolver for the signableDocument field. func (r *viewerResolver) SignableDocument(ctx context.Context, obj *types.Viewer, id gid.GID) (*types.EmployeeDocument, error) { - if err := r.authorize(ctx, id, probo.ActionEmployeeDocumentGet); err != nil { + scope, err := r.authorize(ctx, id, probo.ActionEmployeeDocumentGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(id) prb := r.probo identity := authn.IdentityFromContext(ctx) @@ -105,11 +105,11 @@ func (r *viewerResolver) SignableDocument(ctx context.Context, obj *types.Viewer // ApprovableDocuments is the resolver for the approvableDocuments field. func (r *viewerResolver) ApprovableDocuments(ctx context.Context, obj *types.Viewer, organizationID gid.GID, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentOrderBy) (*types.EmployeeDocumentConnection, error) { - if err := r.authorize(ctx, organizationID, probo.ActionEmployeeDocumentList); err != nil { + scope, err := r.authorize(ctx, organizationID, probo.ActionEmployeeDocumentList) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(organizationID) prb := r.probo pageOrderBy := page.OrderBy[coredata.DocumentOrderField]{ @@ -154,11 +154,11 @@ func (r *viewerResolver) ApprovableDocuments(ctx context.Context, obj *types.Vie // ApprovableDocument is the resolver for the approvableDocument field. func (r *viewerResolver) ApprovableDocument(ctx context.Context, obj *types.Viewer, id gid.GID) (*types.EmployeeDocument, error) { - if err := r.authorize(ctx, id, probo.ActionEmployeeDocumentGet); err != nil { + scope, err := r.authorize(ctx, id, probo.ActionEmployeeDocumentGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(id) prb := r.probo identity := authn.IdentityFromContext(ctx) diff --git a/pkg/server/api/console/v1/webhook_resolvers.go b/pkg/server/api/console/v1/webhook_resolvers.go index f0598ef76..fac2c4f0b 100644 --- a/pkg/server/api/console/v1/webhook_resolvers.go +++ b/pkg/server/api/console/v1/webhook_resolvers.go @@ -24,11 +24,11 @@ import ( // CreateWebhookSubscription is the resolver for the createWebhookSubscription field. func (r *mutationResolver) CreateWebhookSubscription(ctx context.Context, input types.CreateWebhookSubscriptionInput) (*types.CreateWebhookSubscriptionPayload, error) { - if err := r.authorize(ctx, input.OrganizationID, probo.ActionWebhookSubscriptionCreate); err != nil { + scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionWebhookSubscriptionCreate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.probo wc, err := prb.WebhookSubscriptions.Create( @@ -56,11 +56,11 @@ func (r *mutationResolver) CreateWebhookSubscription(ctx context.Context, input // UpdateWebhookSubscription is the resolver for the updateWebhookSubscription field. func (r *mutationResolver) UpdateWebhookSubscription(ctx context.Context, input types.UpdateWebhookSubscriptionInput) (*types.UpdateWebhookSubscriptionPayload, error) { - if err := r.authorize(ctx, input.ID, probo.ActionWebhookSubscriptionUpdate); err != nil { + scope, err := r.authorize(ctx, input.ID, probo.ActionWebhookSubscriptionUpdate) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.probo wc, err := prb.WebhookSubscriptions.Update( @@ -88,15 +88,14 @@ func (r *mutationResolver) UpdateWebhookSubscription(ctx context.Context, input // DeleteWebhookSubscription is the resolver for the deleteWebhookSubscription field. func (r *mutationResolver) DeleteWebhookSubscription(ctx context.Context, input types.DeleteWebhookSubscriptionInput) (*types.DeleteWebhookSubscriptionPayload, error) { - if err := r.authorize(ctx, input.WebhookSubscriptionID, probo.ActionWebhookSubscriptionDelete); err != nil { + scope, err := r.authorize(ctx, input.WebhookSubscriptionID, probo.ActionWebhookSubscriptionDelete) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(input.WebhookSubscriptionID) prb := r.probo - err := prb.WebhookSubscriptions.Delete(ctx, scope, input.WebhookSubscriptionID) - if err != nil { + if err := prb.WebhookSubscriptions.Delete(ctx, scope, input.WebhookSubscriptionID); err != nil { r.logger.ErrorCtx(ctx, "cannot delete webhook subscription", log.Error(err)) return nil, gqlutils.Internal(ctx) } @@ -108,11 +107,11 @@ func (r *mutationResolver) DeleteWebhookSubscription(ctx context.Context, input // TotalCount is the resolver for the totalCount field. func (r *webhookEventConnectionResolver) TotalCount(ctx context.Context, obj *types.WebhookEventConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionWebhookSubscriptionGet); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionWebhookSubscriptionGet) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) prb := r.probo count, err := prb.WebhookSubscriptions.CountEventsForSubscriptionID(ctx, scope, obj.ParentID) @@ -126,7 +125,7 @@ func (r *webhookEventConnectionResolver) TotalCount(ctx context.Context, obj *ty // Organization is the resolver for the organization field. func (r *webhookSubscriptionResolver) Organization(ctx context.Context, obj *types.WebhookSubscription) (*types.Organization, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { + if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil { return nil, err } @@ -148,11 +147,11 @@ func (r *webhookSubscriptionResolver) Organization(ctx context.Context, obj *typ // SigningSecret is the resolver for the signingSecret field. func (r *webhookSubscriptionResolver) SigningSecret(ctx context.Context, obj *types.WebhookSubscription) (string, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionWebhookSubscriptionUpdate); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionWebhookSubscriptionUpdate) + if err != nil { return "", err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo signingSecret, err := prb.WebhookSubscriptions.GetSigningSecret(ctx, scope, obj.ID) @@ -166,11 +165,11 @@ func (r *webhookSubscriptionResolver) SigningSecret(ctx context.Context, obj *ty // Events is the resolver for the events field. func (r *webhookSubscriptionResolver) Events(ctx context.Context, obj *types.WebhookSubscription, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.WebhookEventOrderBy) (*types.WebhookEventConnection, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionWebhookSubscriptionGet); err != nil { + scope, err := r.authorize(ctx, obj.ID, probo.ActionWebhookSubscriptionGet) + if err != nil { return nil, err } - scope := coredata.NewScopeFromObjectID(obj.ID) prb := r.probo pageOrderBy := page.OrderBy[coredata.WebhookEventOrderField]{ @@ -202,11 +201,11 @@ func (r *webhookSubscriptionResolver) Permission(ctx context.Context, obj *types // TotalCount is the resolver for the totalCount field. func (r *webhookSubscriptionConnectionResolver) TotalCount(ctx context.Context, obj *types.WebhookSubscriptionConnection) (int, error) { - if err := r.authorize(ctx, obj.ParentID, probo.ActionWebhookSubscriptionList); err != nil { + scope, err := r.authorize(ctx, obj.ParentID, probo.ActionWebhookSubscriptionList) + if err != nil { return 0, err } - scope := coredata.NewScopeFromObjectID(obj.ParentID) prb := r.probo switch obj.Resolver.(type) { diff --git a/pkg/server/api/mcp/v1/resolver.go b/pkg/server/api/mcp/v1/resolver.go index 2a227ccca..3831f3cad 100644 --- a/pkg/server/api/mcp/v1/resolver.go +++ b/pkg/server/api/mcp/v1/resolver.go @@ -57,10 +57,10 @@ func markdownToProseMirrorJSON(markdown string) (string, error) { return string(out), nil } -func (r *Resolver) Authorize(ctx context.Context, entityID gid.GID, action iam.Action) error { +func (r *Resolver) Authorize(ctx context.Context, entityID gid.GID, action iam.Action) (*coredata.Scope, error) { identity := authn.IdentityFromContext(ctx) - err := r.iamSvc.Authorizer.Authorize( + scope, err := r.iamSvc.Authorizer.Authorize( ctx, iam.AuthorizeParams{ Principal: identity.ID, @@ -69,22 +69,22 @@ func (r *Resolver) Authorize(ctx context.Context, entityID gid.GID, action iam.A }, ) if err == nil { - return nil + return scope, nil } if _, ok := errors.AsType[*iam.ErrInsufficientPermissions](err); ok { - return fmt.Errorf("permission denied") + return nil, fmt.Errorf("permission denied") } if _, ok := errors.AsType[*iam.ErrAssumptionRequired](err); ok { - return fmt.Errorf("assumption required") + return nil, fmt.Errorf("assumption required") } if errors.Is(err, coredata.ErrResourceNotFound) { - return fmt.Errorf("resource not found") + return nil, fmt.Errorf("resource not found") } r.logger.ErrorCtx(ctx, "cannot authorize MCP request", log.Error(err)) - return fmt.Errorf("internal server error") + return nil, fmt.Errorf("internal server error") } diff --git a/pkg/server/api/mcp/v1/schema.resolvers.go b/pkg/server/api/mcp/v1/schema.resolvers.go index e4930b617..f12d8daa3 100644 --- a/pkg/server/api/mcp/v1/schema.resolvers.go +++ b/pkg/server/api/mcp/v1/schema.resolvers.go @@ -49,11 +49,10 @@ func (r *Resolver) ListOrganizationsTool(ctx context.Context, req *mcp.CallToolR // ListThirdPartiesTool handles the listThirdParties tool // List all thirdParties for the organization func (r *Resolver) ListThirdPartiesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListThirdPartiesInput) (*mcp.CallToolResult, types.ListThirdPartiesOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionThirdPartyList); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionThirdPartyList) + if err != nil { return nil, types.ListThirdPartiesOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.ThirdPartyOrderField]{ @@ -82,11 +81,10 @@ func (r *Resolver) ListThirdPartiesTool(ctx context.Context, req *mcp.CallToolRe // AddThirdPartyTool handles the addThirdParty tool // Add a new thirdParty to the organization func (r *Resolver) AddThirdPartyTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddThirdPartyInput) (*mcp.CallToolResult, types.AddThirdPartyOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionThirdPartyCreate); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionThirdPartyCreate) + if err != nil { return nil, types.AddThirdPartyOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) svc := r.proboSvc var category *coredata.ThirdPartyCategory @@ -139,11 +137,10 @@ func (r *Resolver) AddThirdPartyTool(ctx context.Context, req *mcp.CallToolReque // UpdateThirdPartyTool handles the updateThirdParty tool // Update an existing thirdParty func (r *Resolver) UpdateThirdPartyTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateThirdPartyInput) (*mcp.CallToolResult, types.UpdateThirdPartyOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionThirdPartyUpdate); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionThirdPartyUpdate) + if err != nil { return nil, types.UpdateThirdPartyOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc var description **string @@ -269,11 +266,10 @@ func (r *Resolver) UpdateThirdPartyTool(ctx context.Context, req *mcp.CallToolRe } func (r *Resolver) ListRisksTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListRisksInput) (*mcp.CallToolResult, types.ListRisksOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionRiskList); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionRiskList) + if err != nil { return nil, types.ListRisksOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.RiskOrderField]{ @@ -303,11 +299,10 @@ func (r *Resolver) ListRisksTool(ctx context.Context, req *mcp.CallToolRequest, } func (r *Resolver) GetRiskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetRiskInput) (*mcp.CallToolResult, types.GetRiskOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionRiskGet); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionRiskGet) + if err != nil { return nil, types.GetRiskOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc risk, err := prb.Risks.Get(ctx, scope, input.ID) @@ -321,11 +316,10 @@ func (r *Resolver) GetRiskTool(ctx context.Context, req *mcp.CallToolRequest, in } func (r *Resolver) AddRiskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddRiskInput) (*mcp.CallToolResult, types.AddRiskOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionRiskCreate); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionRiskCreate) + if err != nil { return nil, types.AddRiskOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) svc := r.proboSvc risk, err := svc.Risks.Create( @@ -352,11 +346,10 @@ func (r *Resolver) AddRiskTool(ctx context.Context, req *mcp.CallToolRequest, in } func (r *Resolver) UpdateRiskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateRiskInput) (*mcp.CallToolResult, types.UpdateRiskOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionRiskUpdate); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionRiskUpdate) + if err != nil { return nil, types.UpdateRiskOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc risk, err := svc.Risks.Update( @@ -385,11 +378,10 @@ func (r *Resolver) UpdateRiskTool(ctx context.Context, req *mcp.CallToolRequest, } func (r *Resolver) ListMeasuresTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListMeasuresInput) (*mcp.CallToolResult, types.ListMeasuresOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionMeasureList); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionMeasureList) + if err != nil { return nil, types.ListMeasuresOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.MeasureOrderField]{ @@ -419,11 +411,10 @@ func (r *Resolver) ListMeasuresTool(ctx context.Context, req *mcp.CallToolReques } func (r *Resolver) GetMeasureTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetMeasureInput) (*mcp.CallToolResult, types.GetMeasureOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionMeasureGet); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionMeasureGet) + if err != nil { return nil, types.GetMeasureOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc measure, err := prb.Measures.Get(ctx, scope, input.ID) @@ -437,11 +428,10 @@ func (r *Resolver) GetMeasureTool(ctx context.Context, req *mcp.CallToolRequest, } func (r *Resolver) AddMeasureTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddMeasureInput) (*mcp.CallToolResult, types.AddMeasureOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionMeasureCreate); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionMeasureCreate) + if err != nil { return nil, types.AddMeasureOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) svc := r.proboSvc measure, err := svc.Measures.Create( @@ -463,11 +453,10 @@ func (r *Resolver) AddMeasureTool(ctx context.Context, req *mcp.CallToolRequest, } func (r *Resolver) UpdateMeasureTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateMeasureInput) (*mcp.CallToolResult, types.UpdateMeasureOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionMeasureUpdate); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionMeasureUpdate) + if err != nil { return nil, types.UpdateMeasureOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc measure, err := svc.Measures.Update( @@ -490,11 +479,10 @@ func (r *Resolver) UpdateMeasureTool(ctx context.Context, req *mcp.CallToolReque } func (r *Resolver) ListFrameworksTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListFrameworksInput) (*mcp.CallToolResult, types.ListFrameworksOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionFrameworkList); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionFrameworkList) + if err != nil { return nil, types.ListFrameworksOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.FrameworkOrderField]{ @@ -519,11 +507,10 @@ func (r *Resolver) ListFrameworksTool(ctx context.Context, req *mcp.CallToolRequ } func (r *Resolver) GetFrameworkTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetFrameworkInput) (*mcp.CallToolResult, types.GetFrameworkOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionFrameworkGet); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionFrameworkGet) + if err != nil { return nil, types.GetFrameworkOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc framework, err := prb.Frameworks.Get(ctx, scope, input.ID) @@ -537,11 +524,10 @@ func (r *Resolver) GetFrameworkTool(ctx context.Context, req *mcp.CallToolReques } func (r *Resolver) AddFrameworkTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddFrameworkInput) (*mcp.CallToolResult, types.AddFrameworkOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionFrameworkCreate); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionFrameworkCreate) + if err != nil { return nil, types.AddFrameworkOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) svc := r.proboSvc framework, err := svc.Frameworks.Create( @@ -562,11 +548,10 @@ func (r *Resolver) AddFrameworkTool(ctx context.Context, req *mcp.CallToolReques } func (r *Resolver) UpdateFrameworkTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateFrameworkInput) (*mcp.CallToolResult, types.UpdateFrameworkOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionFrameworkUpdate); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionFrameworkUpdate) + if err != nil { return nil, types.UpdateFrameworkOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc framework, err := svc.Frameworks.Update( @@ -587,11 +572,10 @@ func (r *Resolver) UpdateFrameworkTool(ctx context.Context, req *mcp.CallToolReq } func (r *Resolver) ListAssetsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListAssetsInput) (*mcp.CallToolResult, types.ListAssetsOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionAssetList); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionAssetList) + if err != nil { return nil, types.ListAssetsOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.AssetOrderField]{ @@ -616,11 +600,10 @@ func (r *Resolver) ListAssetsTool(ctx context.Context, req *mcp.CallToolRequest, } func (r *Resolver) GetAssetTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetAssetInput) (*mcp.CallToolResult, types.GetAssetOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionAssetGet); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionAssetGet) + if err != nil { return nil, types.GetAssetOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc asset, err := prb.Assets.Get(ctx, scope, input.ID) @@ -634,11 +617,10 @@ func (r *Resolver) GetAssetTool(ctx context.Context, req *mcp.CallToolRequest, i } func (r *Resolver) AddAssetTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddAssetInput) (*mcp.CallToolResult, types.AddAssetOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionAssetCreate); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionAssetCreate) + if err != nil { return nil, types.AddAssetOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) svc := r.proboSvc asset, err := svc.Assets.Create( @@ -663,11 +645,10 @@ func (r *Resolver) AddAssetTool(ctx context.Context, req *mcp.CallToolRequest, i } func (r *Resolver) UpdateAssetTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateAssetInput) (*mcp.CallToolResult, types.UpdateAssetOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionAssetUpdate); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionAssetUpdate) + if err != nil { return nil, types.UpdateAssetOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc asset, err := svc.Assets.Update( @@ -692,11 +673,10 @@ func (r *Resolver) UpdateAssetTool(ctx context.Context, req *mcp.CallToolRequest } func (r *Resolver) ListDataTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListDataInput) (*mcp.CallToolResult, types.ListDataOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionDatumList); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionDatumList) + if err != nil { return nil, types.ListDataOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.DatumOrderField]{ @@ -721,11 +701,10 @@ func (r *Resolver) ListDataTool(ctx context.Context, req *mcp.CallToolRequest, i } func (r *Resolver) GetDatumTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetDatumInput) (*mcp.CallToolResult, types.GetDatumOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionDatumGet); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionDatumGet) + if err != nil { return nil, types.GetDatumOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc datum, err := prb.Data.Get(ctx, scope, input.ID) @@ -739,11 +718,10 @@ func (r *Resolver) GetDatumTool(ctx context.Context, req *mcp.CallToolRequest, i } func (r *Resolver) AddDatumTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddDatumInput) (*mcp.CallToolResult, types.AddDatumOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionDatumCreate); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionDatumCreate) + if err != nil { return nil, types.AddDatumOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) svc := r.proboSvc datum, err := svc.Data.Create( @@ -766,11 +744,10 @@ func (r *Resolver) AddDatumTool(ctx context.Context, req *mcp.CallToolRequest, i } func (r *Resolver) UpdateDatumTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateDatumInput) (*mcp.CallToolResult, types.UpdateDatumOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionDatumUpdate); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionDatumUpdate) + if err != nil { return nil, types.UpdateDatumOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc datum, err := svc.Data.Update( @@ -793,11 +770,10 @@ func (r *Resolver) UpdateDatumTool(ctx context.Context, req *mcp.CallToolRequest } func (r *Resolver) ListFindingsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListFindingsInput) (*mcp.CallToolResult, types.ListFindingsOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionFindingList); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionFindingList) + if err != nil { return nil, types.ListFindingsOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.FindingOrderField]{ @@ -832,11 +808,10 @@ func (r *Resolver) ListFindingsTool(ctx context.Context, req *mcp.CallToolReques } func (r *Resolver) GetFindingTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetFindingInput) (*mcp.CallToolResult, types.GetFindingOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionFindingGet); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionFindingGet) + if err != nil { return nil, types.GetFindingOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc finding, err := prb.Findings.Get(ctx, scope, input.ID) @@ -850,11 +825,10 @@ func (r *Resolver) GetFindingTool(ctx context.Context, req *mcp.CallToolRequest, } func (r *Resolver) AddFindingTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddFindingInput) (*mcp.CallToolResult, types.AddFindingOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionFindingCreate); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionFindingCreate) + if err != nil { return nil, types.AddFindingOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) svc := r.proboSvc finding, err := svc.Findings.Create( @@ -885,11 +859,10 @@ func (r *Resolver) AddFindingTool(ctx context.Context, req *mcp.CallToolRequest, } func (r *Resolver) UpdateFindingTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateFindingInput) (*mcp.CallToolResult, types.UpdateFindingOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionFindingUpdate); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionFindingUpdate) + if err != nil { return nil, types.UpdateFindingOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc finding, err := svc.Findings.Update( @@ -919,11 +892,10 @@ func (r *Resolver) UpdateFindingTool(ctx context.Context, req *mcp.CallToolReque } func (r *Resolver) ListObligationsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListObligationsInput) (*mcp.CallToolResult, types.ListObligationsOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionObligationList); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionObligationList) + if err != nil { return nil, types.ListObligationsOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.ObligationOrderField]{ @@ -948,11 +920,10 @@ func (r *Resolver) ListObligationsTool(ctx context.Context, req *mcp.CallToolReq } func (r *Resolver) GetObligationTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetObligationInput) (*mcp.CallToolResult, types.GetObligationOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionObligationGet); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionObligationGet) + if err != nil { return nil, types.GetObligationOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc obligation, err := prb.Obligations.Get(ctx, scope, input.ID) @@ -966,11 +937,10 @@ func (r *Resolver) GetObligationTool(ctx context.Context, req *mcp.CallToolReque } func (r *Resolver) AddObligationTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddObligationInput) (*mcp.CallToolResult, types.AddObligationOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionObligationCreate); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionObligationCreate) + if err != nil { return nil, types.AddObligationOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) svc := r.proboSvc obligation, err := svc.Obligations.Create( @@ -999,11 +969,10 @@ func (r *Resolver) AddObligationTool(ctx context.Context, req *mcp.CallToolReque } func (r *Resolver) UpdateObligationTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateObligationInput) (*mcp.CallToolResult, types.UpdateObligationOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionObligationUpdate); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionObligationUpdate) + if err != nil { return nil, types.UpdateObligationOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc obligation, err := svc.Obligations.Update( @@ -1032,11 +1001,10 @@ func (r *Resolver) UpdateObligationTool(ctx context.Context, req *mcp.CallToolRe } func (r *Resolver) ListProcessingActivitiesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListProcessingActivitiesInput) (*mcp.CallToolResult, types.ListProcessingActivitiesOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionProcessingActivityList); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionProcessingActivityList) + if err != nil { return nil, types.ListProcessingActivitiesOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.ProcessingActivityOrderField]{ @@ -1061,11 +1029,10 @@ func (r *Resolver) ListProcessingActivitiesTool(ctx context.Context, req *mcp.Ca } func (r *Resolver) GetProcessingActivityTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetProcessingActivityInput) (*mcp.CallToolResult, types.GetProcessingActivityOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionProcessingActivityGet); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionProcessingActivityGet) + if err != nil { return nil, types.GetProcessingActivityOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc processingActivity, err := prb.ProcessingActivities.Get(ctx, scope, input.ID) @@ -1079,11 +1046,10 @@ func (r *Resolver) GetProcessingActivityTool(ctx context.Context, req *mcp.CallT } func (r *Resolver) AddProcessingActivityTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddProcessingActivityInput) (*mcp.CallToolResult, types.AddProcessingActivityOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionProcessingActivityCreate); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionProcessingActivityCreate) + if err != nil { return nil, types.AddProcessingActivityOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) svc := r.proboSvc processingActivity, err := svc.ProcessingActivities.Create( @@ -1122,11 +1088,10 @@ func (r *Resolver) AddProcessingActivityTool(ctx context.Context, req *mcp.CallT } func (r *Resolver) UpdateProcessingActivityTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateProcessingActivityInput) (*mcp.CallToolResult, types.UpdateProcessingActivityOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionProcessingActivityUpdate); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionProcessingActivityUpdate) + if err != nil { return nil, types.UpdateProcessingActivityOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc var thirdPartyIDs *[]gid.GID @@ -1170,14 +1135,13 @@ func (r *Resolver) UpdateProcessingActivityTool(ctx context.Context, req *mcp.Ca } func (r *Resolver) DeleteProcessingActivityTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteProcessingActivityInput) (*mcp.CallToolResult, types.DeleteProcessingActivityOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionProcessingActivityDelete); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionProcessingActivityDelete) + if err != nil { return nil, types.DeleteProcessingActivityOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc - err := svc.ProcessingActivities.Delete(ctx, scope, input.ID) + err = svc.ProcessingActivities.Delete(ctx, scope, input.ID) if err != nil { return nil, types.DeleteProcessingActivityOutput{}, fmt.Errorf("failed to delete processing activity: %w", err) } @@ -1188,11 +1152,10 @@ func (r *Resolver) DeleteProcessingActivityTool(ctx context.Context, req *mcp.Ca } func (r *Resolver) ListDataProtectionImpactAssessmentsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListDataProtectionImpactAssessmentsInput) (*mcp.CallToolResult, types.ListDataProtectionImpactAssessmentsOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionDataProtectionImpactAssessmentList); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionDataProtectionImpactAssessmentList) + if err != nil { return nil, types.ListDataProtectionImpactAssessmentsOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.DataProtectionImpactAssessmentOrderField]{ @@ -1217,11 +1180,10 @@ func (r *Resolver) ListDataProtectionImpactAssessmentsTool(ctx context.Context, } func (r *Resolver) GetDataProtectionImpactAssessmentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetDataProtectionImpactAssessmentInput) (*mcp.CallToolResult, types.GetDataProtectionImpactAssessmentOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionDataProtectionImpactAssessmentGet); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionDataProtectionImpactAssessmentGet) + if err != nil { return nil, types.GetDataProtectionImpactAssessmentOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc dpia, err := prb.DataProtectionImpactAssessments.Get(ctx, scope, input.ID) @@ -1235,11 +1197,10 @@ func (r *Resolver) GetDataProtectionImpactAssessmentTool(ctx context.Context, re } func (r *Resolver) AddDataProtectionImpactAssessmentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddDataProtectionImpactAssessmentInput) (*mcp.CallToolResult, types.AddDataProtectionImpactAssessmentOutput, error) { - if err := r.Authorize(ctx, input.ProcessingActivityID, probo.ActionDataProtectionImpactAssessmentCreate); err != nil { + scope, err := r.Authorize(ctx, input.ProcessingActivityID, probo.ActionDataProtectionImpactAssessmentCreate) + if err != nil { return nil, types.AddDataProtectionImpactAssessmentOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ProcessingActivityID) svc := r.proboSvc dpia, err := svc.DataProtectionImpactAssessments.Create( @@ -1263,11 +1224,10 @@ func (r *Resolver) AddDataProtectionImpactAssessmentTool(ctx context.Context, re } func (r *Resolver) UpdateDataProtectionImpactAssessmentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateDataProtectionImpactAssessmentInput) (*mcp.CallToolResult, types.UpdateDataProtectionImpactAssessmentOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionDataProtectionImpactAssessmentUpdate); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionDataProtectionImpactAssessmentUpdate) + if err != nil { return nil, types.UpdateDataProtectionImpactAssessmentOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc dpia, err := svc.DataProtectionImpactAssessments.Update( @@ -1291,11 +1251,10 @@ func (r *Resolver) UpdateDataProtectionImpactAssessmentTool(ctx context.Context, } func (r *Resolver) ListTransferImpactAssessmentsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListTransferImpactAssessmentsInput) (*mcp.CallToolResult, types.ListTransferImpactAssessmentsOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionTransferImpactAssessmentList); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionTransferImpactAssessmentList) + if err != nil { return nil, types.ListTransferImpactAssessmentsOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.TransferImpactAssessmentOrderField]{ @@ -1320,11 +1279,10 @@ func (r *Resolver) ListTransferImpactAssessmentsTool(ctx context.Context, req *m } func (r *Resolver) GetTransferImpactAssessmentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetTransferImpactAssessmentInput) (*mcp.CallToolResult, types.GetTransferImpactAssessmentOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionTransferImpactAssessmentGet); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionTransferImpactAssessmentGet) + if err != nil { return nil, types.GetTransferImpactAssessmentOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc tia, err := prb.TransferImpactAssessments.Get(ctx, scope, input.ID) @@ -1338,11 +1296,10 @@ func (r *Resolver) GetTransferImpactAssessmentTool(ctx context.Context, req *mcp } func (r *Resolver) AddTransferImpactAssessmentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddTransferImpactAssessmentInput) (*mcp.CallToolResult, types.AddTransferImpactAssessmentOutput, error) { - if err := r.Authorize(ctx, input.ProcessingActivityID, probo.ActionTransferImpactAssessmentCreate); err != nil { + scope, err := r.Authorize(ctx, input.ProcessingActivityID, probo.ActionTransferImpactAssessmentCreate) + if err != nil { return nil, types.AddTransferImpactAssessmentOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ProcessingActivityID) svc := r.proboSvc tia, err := svc.TransferImpactAssessments.Create( @@ -1366,11 +1323,10 @@ func (r *Resolver) AddTransferImpactAssessmentTool(ctx context.Context, req *mcp } func (r *Resolver) UpdateTransferImpactAssessmentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateTransferImpactAssessmentInput) (*mcp.CallToolResult, types.UpdateTransferImpactAssessmentOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionTransferImpactAssessmentUpdate); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionTransferImpactAssessmentUpdate) + if err != nil { return nil, types.UpdateTransferImpactAssessmentOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc tia, err := svc.TransferImpactAssessments.Update( @@ -1394,14 +1350,13 @@ func (r *Resolver) UpdateTransferImpactAssessmentTool(ctx context.Context, req * } func (r *Resolver) DeleteTransferImpactAssessmentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteTransferImpactAssessmentInput) (*mcp.CallToolResult, types.DeleteTransferImpactAssessmentOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionTransferImpactAssessmentDelete); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionTransferImpactAssessmentDelete) + if err != nil { return nil, types.DeleteTransferImpactAssessmentOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc - err := svc.TransferImpactAssessments.Delete(ctx, scope, input.ID) + err = svc.TransferImpactAssessments.Delete(ctx, scope, input.ID) if err != nil { return nil, types.DeleteTransferImpactAssessmentOutput{}, fmt.Errorf("failed to delete transfer impact assessment: %w", err) } @@ -1412,11 +1367,10 @@ func (r *Resolver) DeleteTransferImpactAssessmentTool(ctx context.Context, req * } func (r *Resolver) ListAuditsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListAuditsInput) (*mcp.CallToolResult, types.ListAuditsOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionAuditList); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionAuditList) + if err != nil { return nil, types.ListAuditsOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.AuditOrderField]{ @@ -1441,11 +1395,10 @@ func (r *Resolver) ListAuditsTool(ctx context.Context, req *mcp.CallToolRequest, } func (r *Resolver) GetAuditTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetAuditInput) (*mcp.CallToolResult, types.GetAuditOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionAuditGet); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionAuditGet) + if err != nil { return nil, types.GetAuditOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc audit, err := prb.Audits.Get(ctx, scope, input.ID) @@ -1467,11 +1420,10 @@ func (r *Resolver) GetAuditTool(ctx context.Context, req *mcp.CallToolRequest, i } func (r *Resolver) AddAuditTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddAuditInput) (*mcp.CallToolResult, types.AddAuditOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionAuditCreate); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionAuditCreate) + if err != nil { return nil, types.AddAuditOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) svc := r.proboSvc audit, err := svc.Audits.Create( @@ -1495,11 +1447,10 @@ func (r *Resolver) AddAuditTool(ctx context.Context, req *mcp.CallToolRequest, i } func (r *Resolver) UpdateAuditTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateAuditInput) (*mcp.CallToolResult, types.UpdateAuditOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionAuditUpdate); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionAuditUpdate) + if err != nil { return nil, types.UpdateAuditOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc audit, err := svc.Audits.Update( @@ -1531,11 +1482,10 @@ func (r *Resolver) UpdateAuditTool(ctx context.Context, req *mcp.CallToolRequest } func (r *Resolver) ListControlsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListControlsInput) (*mcp.CallToolResult, types.ListControlsOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionControlList); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionControlList) + if err != nil { return nil, types.ListControlsOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.ControlOrderField]{ @@ -1558,7 +1508,6 @@ func (r *Resolver) ListControlsTool(ctx context.Context, req *mcp.CallToolReques var ( controlPage *page.Page[*coredata.Control, coredata.ControlOrderField] - err error ) if input.Filter != nil && input.Filter.FrameworkID != nil { @@ -1575,11 +1524,10 @@ func (r *Resolver) ListControlsTool(ctx context.Context, req *mcp.CallToolReques } func (r *Resolver) GetControlTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetControlInput) (*mcp.CallToolResult, types.GetControlOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionControlGet); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionControlGet) + if err != nil { return nil, types.GetControlOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc control, err := prb.Controls.Get(ctx, scope, input.ID) @@ -1593,11 +1541,10 @@ func (r *Resolver) GetControlTool(ctx context.Context, req *mcp.CallToolRequest, } func (r *Resolver) AddControlTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddControlInput) (*mcp.CallToolResult, types.AddControlOutput, error) { - if err := r.Authorize(ctx, input.FrameworkID, probo.ActionControlCreate); err != nil { + scope, err := r.Authorize(ctx, input.FrameworkID, probo.ActionControlCreate) + if err != nil { return nil, types.AddControlOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.FrameworkID) svc := r.proboSvc control, err := svc.Controls.Create( @@ -1622,11 +1569,10 @@ func (r *Resolver) AddControlTool(ctx context.Context, req *mcp.CallToolRequest, } func (r *Resolver) UpdateControlTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateControlInput) (*mcp.CallToolResult, types.UpdateControlOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionControlUpdate); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionControlUpdate) + if err != nil { return nil, types.UpdateControlOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc var maturityLevel *coredata.ControlMaturityLevel @@ -1663,7 +1609,7 @@ func (r *Resolver) LinkControlTool(ctx context.Context, req *mcp.CallToolRequest switch input.ResourceID.EntityType() { case coredata.MeasureEntityType: - if err := r.Authorize(ctx, input.ControlID, probo.ActionControlMeasureMappingCreate); err != nil { + if _, err := r.Authorize(ctx, input.ControlID, probo.ActionControlMeasureMappingCreate); err != nil { return nil, types.LinkControlOutput{}, err } @@ -1671,7 +1617,7 @@ func (r *Resolver) LinkControlTool(ctx context.Context, req *mcp.CallToolRequest return nil, types.LinkControlOutput{}, fmt.Errorf("failed to link control to measure: %w", err) } case coredata.DocumentEntityType: - if err := r.Authorize(ctx, input.ControlID, probo.ActionControlDocumentMappingCreate); err != nil { + if _, err := r.Authorize(ctx, input.ControlID, probo.ActionControlDocumentMappingCreate); err != nil { return nil, types.LinkControlOutput{}, err } @@ -1679,7 +1625,7 @@ func (r *Resolver) LinkControlTool(ctx context.Context, req *mcp.CallToolRequest return nil, types.LinkControlOutput{}, fmt.Errorf("failed to link control to document: %w", err) } case coredata.AuditEntityType: - if err := r.Authorize(ctx, input.ControlID, probo.ActionControlAuditMappingCreate); err != nil { + if _, err := r.Authorize(ctx, input.ControlID, probo.ActionControlAuditMappingCreate); err != nil { return nil, types.LinkControlOutput{}, err } @@ -1687,7 +1633,7 @@ func (r *Resolver) LinkControlTool(ctx context.Context, req *mcp.CallToolRequest return nil, types.LinkControlOutput{}, fmt.Errorf("failed to link control to audit: %w", err) } case coredata.ObligationEntityType: - if err := r.Authorize(ctx, input.ControlID, probo.ActionControlObligationMappingCreate); err != nil { + if _, err := r.Authorize(ctx, input.ControlID, probo.ActionControlObligationMappingCreate); err != nil { return nil, types.LinkControlOutput{}, err } @@ -1707,7 +1653,7 @@ func (r *Resolver) UnlinkControlTool(ctx context.Context, req *mcp.CallToolReque switch input.ResourceID.EntityType() { case coredata.MeasureEntityType: - if err := r.Authorize(ctx, input.ControlID, probo.ActionControlMeasureMappingDelete); err != nil { + if _, err := r.Authorize(ctx, input.ControlID, probo.ActionControlMeasureMappingDelete); err != nil { return nil, types.UnlinkControlOutput{}, err } @@ -1715,7 +1661,7 @@ func (r *Resolver) UnlinkControlTool(ctx context.Context, req *mcp.CallToolReque return nil, types.UnlinkControlOutput{}, fmt.Errorf("failed to unlink control from measure: %w", err) } case coredata.DocumentEntityType: - if err := r.Authorize(ctx, input.ControlID, probo.ActionControlDocumentMappingDelete); err != nil { + if _, err := r.Authorize(ctx, input.ControlID, probo.ActionControlDocumentMappingDelete); err != nil { return nil, types.UnlinkControlOutput{}, err } @@ -1723,7 +1669,7 @@ func (r *Resolver) UnlinkControlTool(ctx context.Context, req *mcp.CallToolReque return nil, types.UnlinkControlOutput{}, fmt.Errorf("failed to unlink control from document: %w", err) } case coredata.AuditEntityType: - if err := r.Authorize(ctx, input.ControlID, probo.ActionControlAuditMappingDelete); err != nil { + if _, err := r.Authorize(ctx, input.ControlID, probo.ActionControlAuditMappingDelete); err != nil { return nil, types.UnlinkControlOutput{}, err } @@ -1731,7 +1677,7 @@ func (r *Resolver) UnlinkControlTool(ctx context.Context, req *mcp.CallToolReque return nil, types.UnlinkControlOutput{}, fmt.Errorf("failed to unlink control from audit: %w", err) } case coredata.ObligationEntityType: - if err := r.Authorize(ctx, input.ControlID, probo.ActionControlObligationMappingDelete); err != nil { + if _, err := r.Authorize(ctx, input.ControlID, probo.ActionControlObligationMappingDelete); err != nil { return nil, types.UnlinkControlOutput{}, err } @@ -1746,11 +1692,10 @@ func (r *Resolver) UnlinkControlTool(ctx context.Context, req *mcp.CallToolReque } func (r *Resolver) ListControlObligationsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListControlObligationsInput) (*mcp.CallToolResult, types.ListControlObligationsOutput, error) { - if err := r.Authorize(ctx, input.ControlID, probo.ActionControlGet); err != nil { + scope, err := r.Authorize(ctx, input.ControlID, probo.ActionControlGet) + if err != nil { return nil, types.ListControlObligationsOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ControlID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.ObligationOrderField]{ @@ -1775,11 +1720,10 @@ func (r *Resolver) ListControlObligationsTool(ctx context.Context, req *mcp.Call } func (r *Resolver) ListControlMeasuresTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListControlMeasuresInput) (*mcp.CallToolResult, types.ListControlMeasuresOutput, error) { - if err := r.Authorize(ctx, input.ControlID, probo.ActionControlGet); err != nil { + scope, err := r.Authorize(ctx, input.ControlID, probo.ActionControlGet) + if err != nil { return nil, types.ListControlMeasuresOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ControlID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.MeasureOrderField]{ @@ -1804,11 +1748,10 @@ func (r *Resolver) ListControlMeasuresTool(ctx context.Context, req *mcp.CallToo } func (r *Resolver) ListControlDocumentsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListControlDocumentsInput) (*mcp.CallToolResult, types.ListControlDocumentsOutput, error) { - if err := r.Authorize(ctx, input.ControlID, probo.ActionControlGet); err != nil { + scope, err := r.Authorize(ctx, input.ControlID, probo.ActionControlGet) + if err != nil { return nil, types.ListControlDocumentsOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ControlID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.DocumentOrderField]{ @@ -1833,11 +1776,10 @@ func (r *Resolver) ListControlDocumentsTool(ctx context.Context, req *mcp.CallTo } func (r *Resolver) ListControlAuditsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListControlAuditsInput) (*mcp.CallToolResult, types.ListControlAuditsOutput, error) { - if err := r.Authorize(ctx, input.ControlID, probo.ActionControlGet); err != nil { + scope, err := r.Authorize(ctx, input.ControlID, probo.ActionControlGet) + if err != nil { return nil, types.ListControlAuditsOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ControlID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.AuditOrderField]{ @@ -1862,11 +1804,10 @@ func (r *Resolver) ListControlAuditsTool(ctx context.Context, req *mcp.CallToolR } func (r *Resolver) ListRiskObligationsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListRiskObligationsInput) (*mcp.CallToolResult, types.ListRiskObligationsOutput, error) { - if err := r.Authorize(ctx, input.RiskID, probo.ActionRiskGet); err != nil { + scope, err := r.Authorize(ctx, input.RiskID, probo.ActionRiskGet) + if err != nil { return nil, types.ListRiskObligationsOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.RiskID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.ObligationOrderField]{ @@ -1896,7 +1837,7 @@ func (r *Resolver) LinkRiskTool(ctx context.Context, req *mcp.CallToolRequest, i switch input.ResourceID.EntityType() { case coredata.DocumentEntityType: - if err := r.Authorize(ctx, input.RiskID, probo.ActionRiskDocumentMappingCreate); err != nil { + if _, err := r.Authorize(ctx, input.RiskID, probo.ActionRiskDocumentMappingCreate); err != nil { return nil, types.LinkRiskOutput{}, err } @@ -1904,7 +1845,7 @@ func (r *Resolver) LinkRiskTool(ctx context.Context, req *mcp.CallToolRequest, i return nil, types.LinkRiskOutput{}, fmt.Errorf("failed to link risk to document: %w", err) } case coredata.MeasureEntityType: - if err := r.Authorize(ctx, input.RiskID, probo.ActionRiskMeasureMappingCreate); err != nil { + if _, err := r.Authorize(ctx, input.RiskID, probo.ActionRiskMeasureMappingCreate); err != nil { return nil, types.LinkRiskOutput{}, err } @@ -1912,7 +1853,7 @@ func (r *Resolver) LinkRiskTool(ctx context.Context, req *mcp.CallToolRequest, i return nil, types.LinkRiskOutput{}, fmt.Errorf("failed to link risk to measure: %w", err) } case coredata.ObligationEntityType: - if err := r.Authorize(ctx, input.RiskID, probo.ActionRiskObligationMappingCreate); err != nil { + if _, err := r.Authorize(ctx, input.RiskID, probo.ActionRiskObligationMappingCreate); err != nil { return nil, types.LinkRiskOutput{}, err } @@ -1932,7 +1873,7 @@ func (r *Resolver) UnlinkRiskTool(ctx context.Context, req *mcp.CallToolRequest, switch input.ResourceID.EntityType() { case coredata.DocumentEntityType: - if err := r.Authorize(ctx, input.RiskID, probo.ActionRiskDocumentMappingDelete); err != nil { + if _, err := r.Authorize(ctx, input.RiskID, probo.ActionRiskDocumentMappingDelete); err != nil { return nil, types.UnlinkRiskOutput{}, err } @@ -1940,7 +1881,7 @@ func (r *Resolver) UnlinkRiskTool(ctx context.Context, req *mcp.CallToolRequest, return nil, types.UnlinkRiskOutput{}, fmt.Errorf("failed to unlink risk from document: %w", err) } case coredata.MeasureEntityType: - if err := r.Authorize(ctx, input.RiskID, probo.ActionRiskMeasureMappingDelete); err != nil { + if _, err := r.Authorize(ctx, input.RiskID, probo.ActionRiskMeasureMappingDelete); err != nil { return nil, types.UnlinkRiskOutput{}, err } @@ -1948,7 +1889,7 @@ func (r *Resolver) UnlinkRiskTool(ctx context.Context, req *mcp.CallToolRequest, return nil, types.UnlinkRiskOutput{}, fmt.Errorf("failed to unlink risk from measure: %w", err) } case coredata.ObligationEntityType: - if err := r.Authorize(ctx, input.RiskID, probo.ActionRiskObligationMappingDelete); err != nil { + if _, err := r.Authorize(ctx, input.RiskID, probo.ActionRiskObligationMappingDelete); err != nil { return nil, types.UnlinkRiskOutput{}, err } @@ -1963,11 +1904,10 @@ func (r *Resolver) UnlinkRiskTool(ctx context.Context, req *mcp.CallToolRequest, } func (r *Resolver) ListTasksTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListTasksInput) (*mcp.CallToolResult, types.ListTasksOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionTaskList); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionTaskList) + if err != nil { return nil, types.ListTasksOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.TaskOrderField]{ @@ -1992,11 +1932,10 @@ func (r *Resolver) ListTasksTool(ctx context.Context, req *mcp.CallToolRequest, } func (r *Resolver) GetTaskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetTaskInput) (*mcp.CallToolResult, types.GetTaskOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionTaskGet); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionTaskGet) + if err != nil { return nil, types.GetTaskOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc task, err := prb.Tasks.Get(ctx, scope, input.ID) @@ -2010,11 +1949,10 @@ func (r *Resolver) GetTaskTool(ctx context.Context, req *mcp.CallToolRequest, in } func (r *Resolver) AddTaskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddTaskInput) (*mcp.CallToolResult, types.AddTaskOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionTaskCreate); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionTaskCreate) + if err != nil { return nil, types.AddTaskOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) svc := r.proboSvc priority := coredata.TaskPriorityMedium @@ -2045,11 +1983,10 @@ func (r *Resolver) AddTaskTool(ctx context.Context, req *mcp.CallToolRequest, in } func (r *Resolver) UpdateTaskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateTaskInput) (*mcp.CallToolResult, types.UpdateTaskOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionTaskUpdate); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionTaskUpdate) + if err != nil { return nil, types.UpdateTaskOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc task, err := svc.Tasks.Update( @@ -2077,11 +2014,10 @@ func (r *Resolver) UpdateTaskTool(ctx context.Context, req *mcp.CallToolRequest, } func (r *Resolver) AssignTaskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AssignTaskInput) (*mcp.CallToolResult, types.AssignTaskOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionTaskAssign); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionTaskAssign) + if err != nil { return nil, types.AssignTaskOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc task, err := svc.Tasks.Assign(ctx, scope, input.ID, input.AssignedToID) @@ -2095,11 +2031,10 @@ func (r *Resolver) AssignTaskTool(ctx context.Context, req *mcp.CallToolRequest, } func (r *Resolver) UnassignTaskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UnassignTaskInput) (*mcp.CallToolResult, types.UnassignTaskOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionTaskUnassign); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionTaskUnassign) + if err != nil { return nil, types.UnassignTaskOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc task, err := svc.Tasks.Unassign(ctx, scope, input.ID) @@ -2113,14 +2048,13 @@ func (r *Resolver) UnassignTaskTool(ctx context.Context, req *mcp.CallToolReques } func (r *Resolver) DeleteTaskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteTaskInput) (*mcp.CallToolResult, types.DeleteTaskOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionTaskDelete); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionTaskDelete) + if err != nil { return nil, types.DeleteTaskOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc - err := svc.Tasks.Delete(ctx, scope, input.ID) + err = svc.Tasks.Delete(ctx, scope, input.ID) if err != nil { return nil, types.DeleteTaskOutput{}, fmt.Errorf("failed to delete task: %w", err) } @@ -2131,11 +2065,10 @@ func (r *Resolver) DeleteTaskTool(ctx context.Context, req *mcp.CallToolRequest, } func (r *Resolver) ListDocumentsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListDocumentsInput) (*mcp.CallToolResult, types.ListDocumentsOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionDocumentList); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionDocumentList) + if err != nil { return nil, types.ListDocumentsOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.DocumentOrderField]{ @@ -2180,11 +2113,10 @@ func (r *Resolver) ListDocumentsTool(ctx context.Context, req *mcp.CallToolReque } func (r *Resolver) GetDocumentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetDocumentInput) (*mcp.CallToolResult, types.GetDocumentOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionDocumentGet); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionDocumentGet) + if err != nil { return nil, types.GetDocumentOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc document, err := prb.Documents.Get(ctx, scope, input.ID) @@ -2198,11 +2130,10 @@ func (r *Resolver) GetDocumentTool(ctx context.Context, req *mcp.CallToolRequest } func (r *Resolver) AddDocumentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddDocumentInput) (*mcp.CallToolResult, types.AddDocumentOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionDocumentCreate); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionDocumentCreate) + if err != nil { return nil, types.AddDocumentOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) svc := r.proboSvc var trustCenterVisibility *coredata.TrustCenterVisibility @@ -2235,11 +2166,10 @@ func (r *Resolver) AddDocumentTool(ctx context.Context, req *mcp.CallToolRequest } func (r *Resolver) UpdateDocumentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateDocumentInput) (*mcp.CallToolResult, types.UpdateDocumentOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionDocumentUpdate); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionDocumentUpdate) + if err != nil { return nil, types.UpdateDocumentOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc var defaultApproverIDs *[]gid.GID @@ -2286,7 +2216,7 @@ func (r *Resolver) UpdateDocumentTool(ctx context.Context, req *mcp.CallToolRequ } func (r *Resolver) ListDocumentVersionsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListDocumentVersionsInput) (*mcp.CallToolResult, types.ListDocumentVersionsOutput, error) { - if err := r.Authorize(ctx, input.DocumentID, probo.ActionDocumentVersionList); err != nil { + if _, err := r.Authorize(ctx, input.DocumentID, probo.ActionDocumentVersionList); err != nil { return nil, types.ListDocumentVersionsOutput{}, err } @@ -2319,11 +2249,10 @@ func (r *Resolver) ListDocumentVersionsTool(ctx context.Context, req *mcp.CallTo } func (r *Resolver) GetDocumentVersionTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetDocumentVersionInput) (*mcp.CallToolResult, types.GetDocumentVersionOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionDocumentVersionGet); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionDocumentVersionGet) + if err != nil { return nil, types.GetDocumentVersionOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc version, err := svc.Documents.GetVersion(ctx, scope, input.ID) @@ -2337,11 +2266,10 @@ func (r *Resolver) GetDocumentVersionTool(ctx context.Context, req *mcp.CallTool } func (r *Resolver) ListDocumentVersionSignaturesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListDocumentVersionSignaturesInput) (*mcp.CallToolResult, types.ListDocumentVersionSignaturesOutput, error) { - if err := r.Authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionSignatureList); err != nil { + scope, err := r.Authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionSignatureList) + if err != nil { return nil, types.ListDocumentVersionSignaturesOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.DocumentVersionID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.DocumentVersionSignatureOrderField]{ @@ -2388,11 +2316,10 @@ func (r *Resolver) ListDocumentVersionSignaturesTool(ctx context.Context, req *m } func (r *Resolver) GetDocumentVersionSignatureTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetDocumentVersionSignatureInput) (*mcp.CallToolResult, types.GetDocumentVersionSignatureOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionDocumentVersionSignatureGet); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionDocumentVersionSignatureGet) + if err != nil { return nil, types.GetDocumentVersionSignatureOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc signature, err := prb.Documents.GetVersionSignature(ctx, scope, input.ID) @@ -2406,11 +2333,10 @@ func (r *Resolver) GetDocumentVersionSignatureTool(ctx context.Context, req *mcp } func (r *Resolver) RequestDocumentVersionSignatureTool(ctx context.Context, req *mcp.CallToolRequest, input *types.RequestDocumentVersionSignatureInput) (*mcp.CallToolResult, types.RequestDocumentVersionSignatureOutput, error) { - if err := r.Authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionSignatureRequest); err != nil { + scope, err := r.Authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionSignatureRequest) + if err != nil { return nil, types.RequestDocumentVersionSignatureOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.DocumentVersionID) svc := r.proboSvc documentVersionSignature, err := svc.Documents.RequestSignature( @@ -2430,14 +2356,13 @@ func (r *Resolver) RequestDocumentVersionSignatureTool(ctx context.Context, req } func (r *Resolver) DeleteDocumentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteDocumentInput) (*mcp.CallToolResult, types.DeleteDocumentOutput, error) { - if err := r.Authorize(ctx, input.DocumentID, probo.ActionDocumentDelete); err != nil { + scope, err := r.Authorize(ctx, input.DocumentID, probo.ActionDocumentDelete) + if err != nil { return nil, types.DeleteDocumentOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.DocumentID) svc := r.proboSvc - err := svc.Documents.SoftDelete(ctx, scope, input.DocumentID) + err = svc.Documents.SoftDelete(ctx, scope, input.DocumentID) if err != nil { panic(fmt.Errorf("cannot soft delete document: %w", err)) } @@ -2448,14 +2373,13 @@ func (r *Resolver) DeleteDocumentTool(ctx context.Context, req *mcp.CallToolRequ } func (r *Resolver) CancelSignatureRequestTool(ctx context.Context, req *mcp.CallToolRequest, input *types.CancelSignatureRequestInput) (*mcp.CallToolResult, types.CancelSignatureRequestOutput, error) { - if err := r.Authorize(ctx, input.DocumentVersionSignatureID, probo.ActionDocumentVersionCancelSignature); err != nil { + scope, err := r.Authorize(ctx, input.DocumentVersionSignatureID, probo.ActionDocumentVersionCancelSignature) + if err != nil { return nil, types.CancelSignatureRequestOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.DocumentVersionSignatureID) svc := r.proboSvc - err := svc.Documents.CancelSignatureRequest(ctx, scope, input.DocumentVersionSignatureID) + err = svc.Documents.CancelSignatureRequest(ctx, scope, input.DocumentVersionSignatureID) if err != nil { panic(fmt.Errorf("cannot cancel signature request: %w", err)) } @@ -2466,14 +2390,13 @@ func (r *Resolver) CancelSignatureRequestTool(ctx context.Context, req *mcp.Call } func (r *Resolver) DeleteRiskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteRiskInput) (*mcp.CallToolResult, types.DeleteRiskOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionRiskDelete); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionRiskDelete) + if err != nil { return nil, types.DeleteRiskOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc - err := svc.Risks.Delete(ctx, scope, input.ID) + err = svc.Risks.Delete(ctx, scope, input.ID) if err != nil { return nil, types.DeleteRiskOutput{}, fmt.Errorf("failed to delete risk: %w", err) } @@ -2484,14 +2407,13 @@ func (r *Resolver) DeleteRiskTool(ctx context.Context, req *mcp.CallToolRequest, } func (r *Resolver) DeleteMeasureTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteMeasureInput) (*mcp.CallToolResult, types.DeleteMeasureOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionMeasureDelete); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionMeasureDelete) + if err != nil { return nil, types.DeleteMeasureOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc - err := svc.Measures.Delete(ctx, scope, input.ID) + err = svc.Measures.Delete(ctx, scope, input.ID) if err != nil { return nil, types.DeleteMeasureOutput{}, fmt.Errorf("failed to delete measure: %w", err) } @@ -2502,11 +2424,10 @@ func (r *Resolver) DeleteMeasureTool(ctx context.Context, req *mcp.CallToolReque } func (r *Resolver) ListMeasureRisksTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListMeasureRisksInput) (*mcp.CallToolResult, types.ListMeasureRisksOutput, error) { - if err := r.Authorize(ctx, input.MeasureID, probo.ActionMeasureGet); err != nil { + scope, err := r.Authorize(ctx, input.MeasureID, probo.ActionMeasureGet) + if err != nil { return nil, types.ListMeasureRisksOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.MeasureID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.RiskOrderField]{ @@ -2531,11 +2452,10 @@ func (r *Resolver) ListMeasureRisksTool(ctx context.Context, req *mcp.CallToolRe } func (r *Resolver) ListMeasureControlsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListMeasureControlsInput) (*mcp.CallToolResult, types.ListMeasureControlsOutput, error) { - if err := r.Authorize(ctx, input.MeasureID, probo.ActionMeasureGet); err != nil { + scope, err := r.Authorize(ctx, input.MeasureID, probo.ActionMeasureGet) + if err != nil { return nil, types.ListMeasureControlsOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.MeasureID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.ControlOrderField]{ @@ -2560,11 +2480,10 @@ func (r *Resolver) ListMeasureControlsTool(ctx context.Context, req *mcp.CallToo } func (r *Resolver) ListMeasureTasksTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListMeasureTasksInput) (*mcp.CallToolResult, types.ListMeasureTasksOutput, error) { - if err := r.Authorize(ctx, input.MeasureID, probo.ActionMeasureGet); err != nil { + scope, err := r.Authorize(ctx, input.MeasureID, probo.ActionMeasureGet) + if err != nil { return nil, types.ListMeasureTasksOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.MeasureID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.TaskOrderField]{ @@ -2589,11 +2508,10 @@ func (r *Resolver) ListMeasureTasksTool(ctx context.Context, req *mcp.CallToolRe } func (r *Resolver) ListMeasureEvidencesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListMeasureEvidencesInput) (*mcp.CallToolResult, types.ListMeasureEvidencesOutput, error) { - if err := r.Authorize(ctx, input.MeasureID, probo.ActionMeasureGet); err != nil { + scope, err := r.Authorize(ctx, input.MeasureID, probo.ActionMeasureGet) + if err != nil { return nil, types.ListMeasureEvidencesOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.MeasureID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.EvidenceOrderField]{ @@ -2617,7 +2535,7 @@ func (r *Resolver) LinkMeasureTool(ctx context.Context, req *mcp.CallToolRequest switch input.ResourceID.EntityType() { case coredata.ControlEntityType: - if err := r.Authorize(ctx, input.MeasureID, probo.ActionControlMeasureMappingCreate); err != nil { + if _, err := r.Authorize(ctx, input.MeasureID, probo.ActionControlMeasureMappingCreate); err != nil { return nil, types.LinkMeasureOutput{}, err } @@ -2625,7 +2543,7 @@ func (r *Resolver) LinkMeasureTool(ctx context.Context, req *mcp.CallToolRequest return nil, types.LinkMeasureOutput{}, fmt.Errorf("failed to link measure to control: %w", err) } case coredata.RiskEntityType: - if err := r.Authorize(ctx, input.MeasureID, probo.ActionRiskMeasureMappingCreate); err != nil { + if _, err := r.Authorize(ctx, input.MeasureID, probo.ActionRiskMeasureMappingCreate); err != nil { return nil, types.LinkMeasureOutput{}, err } @@ -2633,7 +2551,7 @@ func (r *Resolver) LinkMeasureTool(ctx context.Context, req *mcp.CallToolRequest return nil, types.LinkMeasureOutput{}, fmt.Errorf("failed to link measure to risk: %w", err) } case coredata.DocumentEntityType: - if err := r.Authorize(ctx, input.MeasureID, probo.ActionMeasureDocumentMappingCreate); err != nil { + if _, err := r.Authorize(ctx, input.MeasureID, probo.ActionMeasureDocumentMappingCreate); err != nil { return nil, types.LinkMeasureOutput{}, err } @@ -2653,7 +2571,7 @@ func (r *Resolver) UnlinkMeasureTool(ctx context.Context, req *mcp.CallToolReque switch input.ResourceID.EntityType() { case coredata.ControlEntityType: - if err := r.Authorize(ctx, input.MeasureID, probo.ActionControlMeasureMappingDelete); err != nil { + if _, err := r.Authorize(ctx, input.MeasureID, probo.ActionControlMeasureMappingDelete); err != nil { return nil, types.UnlinkMeasureOutput{}, err } @@ -2661,7 +2579,7 @@ func (r *Resolver) UnlinkMeasureTool(ctx context.Context, req *mcp.CallToolReque return nil, types.UnlinkMeasureOutput{}, fmt.Errorf("failed to unlink measure from control: %w", err) } case coredata.RiskEntityType: - if err := r.Authorize(ctx, input.MeasureID, probo.ActionRiskMeasureMappingDelete); err != nil { + if _, err := r.Authorize(ctx, input.MeasureID, probo.ActionRiskMeasureMappingDelete); err != nil { return nil, types.UnlinkMeasureOutput{}, err } @@ -2669,7 +2587,7 @@ func (r *Resolver) UnlinkMeasureTool(ctx context.Context, req *mcp.CallToolReque return nil, types.UnlinkMeasureOutput{}, fmt.Errorf("failed to unlink measure from risk: %w", err) } case coredata.DocumentEntityType: - if err := r.Authorize(ctx, input.MeasureID, probo.ActionMeasureDocumentMappingDelete); err != nil { + if _, err := r.Authorize(ctx, input.MeasureID, probo.ActionMeasureDocumentMappingDelete); err != nil { return nil, types.UnlinkMeasureOutput{}, err } @@ -2684,7 +2602,7 @@ func (r *Resolver) UnlinkMeasureTool(ctx context.Context, req *mcp.CallToolReque } func (r *Resolver) ListUsersTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListUsersInput) (*mcp.CallToolResult, types.ListUsersOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, iam.ActionMembershipProfileList); err != nil { + if _, err := r.Authorize(ctx, input.OrganizationID, iam.ActionMembershipProfileList); err != nil { return nil, types.ListUsersOutput{}, err } @@ -2742,7 +2660,7 @@ func (r *Resolver) GetUserTool(ctx context.Context, req *mcp.CallToolRequest, in return nil, types.GetUserOutput{}, fmt.Errorf("get user: %w", err) } - if err := r.Authorize(ctx, profile.OrganizationID, iam.ActionMembershipProfileGet); err != nil { + if _, err := r.Authorize(ctx, profile.OrganizationID, iam.ActionMembershipProfileGet); err != nil { return nil, types.GetUserOutput{}, err } @@ -2750,7 +2668,7 @@ func (r *Resolver) GetUserTool(ctx context.Context, req *mcp.CallToolRequest, in } func (r *Resolver) CreateUserTool(ctx context.Context, req *mcp.CallToolRequest, input *types.CreateUserInput) (*mcp.CallToolResult, types.CreateUserOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, iam.ActionMembershipProfileCreate); err != nil { + if _, err := r.Authorize(ctx, input.OrganizationID, iam.ActionMembershipProfileCreate); err != nil { return nil, types.CreateUserOutput{}, err } @@ -2786,7 +2704,7 @@ func (r *Resolver) CreateUserTool(ctx context.Context, req *mcp.CallToolRequest, } func (r *Resolver) InviteUserTool(ctx context.Context, req *mcp.CallToolRequest, input *types.InviteUserInput) (*mcp.CallToolResult, types.InviteUserOutput, error) { - if err := r.Authorize(ctx, input.ProfileID, iam.ActionInvitationCreate); err != nil { + if _, err := r.Authorize(ctx, input.ProfileID, iam.ActionInvitationCreate); err != nil { return nil, types.InviteUserOutput{}, err } @@ -2810,7 +2728,7 @@ func (r *Resolver) InviteUserTool(ctx context.Context, req *mcp.CallToolRequest, } func (r *Resolver) UpdateUserTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateUserInput) (*mcp.CallToolResult, types.UpdateUserOutput, error) { - if err := r.Authorize(ctx, input.ID, iam.ActionMembershipProfileUpdate); err != nil { + if _, err := r.Authorize(ctx, input.ID, iam.ActionMembershipProfileUpdate); err != nil { return nil, types.UpdateUserOutput{}, err } @@ -2850,12 +2768,12 @@ func (r *Resolver) UpdateUserTool(ctx context.Context, req *mcp.CallToolRequest, } func (r *Resolver) UpdateMembershipTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateMembershipInput) (*mcp.CallToolResult, types.UpdateMembershipOutput, error) { - if err := r.Authorize(ctx, input.MembershipID, iam.ActionMembershipUpdate); err != nil { + if _, err := r.Authorize(ctx, input.MembershipID, iam.ActionMembershipUpdate); err != nil { return nil, types.UpdateMembershipOutput{}, err } if input.Role == coredata.MembershipRoleOwner { - if err := r.Authorize(ctx, input.MembershipID, iam.ActionMembershipRoleSetOwner); err != nil { + if _, err := r.Authorize(ctx, input.MembershipID, iam.ActionMembershipRoleSetOwner); err != nil { return nil, types.UpdateMembershipOutput{}, err } } @@ -2875,7 +2793,7 @@ func (r *Resolver) UpdateMembershipTool(ctx context.Context, req *mcp.CallToolRe } func (r *Resolver) RemoveUserTool(ctx context.Context, req *mcp.CallToolRequest, input *types.RemoveUserInput) (*mcp.CallToolResult, types.RemoveUserOutput, error) { - if err := r.Authorize(ctx, input.ProfileID, iam.ActionMembershipProfileDelete); err != nil { + if _, err := r.Authorize(ctx, input.ProfileID, iam.ActionMembershipProfileDelete); err != nil { return nil, types.RemoveUserOutput{}, err } @@ -2900,14 +2818,13 @@ func (r *Resolver) RemoveUserTool(ctx context.Context, req *mcp.CallToolRequest, } func (r *Resolver) DeleteDataProtectionImpactAssessmentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteDataProtectionImpactAssessmentInput) (*mcp.CallToolResult, types.DeleteDataProtectionImpactAssessmentOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionDataProtectionImpactAssessmentDelete); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionDataProtectionImpactAssessmentDelete) + if err != nil { return nil, types.DeleteDataProtectionImpactAssessmentOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc - err := svc.DataProtectionImpactAssessments.Delete(ctx, scope, input.ID) + err = svc.DataProtectionImpactAssessments.Delete(ctx, scope, input.ID) if err != nil { return nil, types.DeleteDataProtectionImpactAssessmentOutput{}, fmt.Errorf("failed to delete data protection impact assessment: %w", err) } @@ -2918,11 +2835,10 @@ func (r *Resolver) DeleteDataProtectionImpactAssessmentTool(ctx context.Context, } func (r *Resolver) ListStatementsOfApplicabilityTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListStatementsOfApplicabilityInput) (*mcp.CallToolResult, types.ListStatementsOfApplicabilityOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionStatementOfApplicabilityList); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionStatementOfApplicabilityList) + if err != nil { return nil, types.ListStatementsOfApplicabilityOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.StatementOfApplicabilityOrderField]{ @@ -2947,11 +2863,10 @@ func (r *Resolver) ListStatementsOfApplicabilityTool(ctx context.Context, req *m } func (r *Resolver) GetStatementOfApplicabilityTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetStatementOfApplicabilityInput) (*mcp.CallToolResult, types.GetStatementOfApplicabilityOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionStatementOfApplicabilityGet); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionStatementOfApplicabilityGet) + if err != nil { return nil, types.GetStatementOfApplicabilityOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc soa, err := prb.StatementsOfApplicability.Get(ctx, scope, input.ID) @@ -2965,11 +2880,10 @@ func (r *Resolver) GetStatementOfApplicabilityTool(ctx context.Context, req *mcp } func (r *Resolver) AddStatementOfApplicabilityTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddStatementOfApplicabilityInput) (*mcp.CallToolResult, types.AddStatementOfApplicabilityOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionStatementOfApplicabilityCreate); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionStatementOfApplicabilityCreate) + if err != nil { return nil, types.AddStatementOfApplicabilityOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) svc := r.proboSvc soa, err := svc.StatementsOfApplicability.Create(ctx, scope, probo.CreateStatementOfApplicabilityRequest{ @@ -2986,11 +2900,10 @@ func (r *Resolver) AddStatementOfApplicabilityTool(ctx context.Context, req *mcp } func (r *Resolver) UpdateStatementOfApplicabilityTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateStatementOfApplicabilityInput) (*mcp.CallToolResult, types.UpdateStatementOfApplicabilityOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionStatementOfApplicabilityUpdate); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionStatementOfApplicabilityUpdate) + if err != nil { return nil, types.UpdateStatementOfApplicabilityOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc soa, err := svc.StatementsOfApplicability.Update(ctx, scope, probo.UpdateStatementOfApplicabilityRequest{ @@ -3007,14 +2920,13 @@ func (r *Resolver) UpdateStatementOfApplicabilityTool(ctx context.Context, req * } func (r *Resolver) DeleteStatementOfApplicabilityTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteStatementOfApplicabilityInput) (*mcp.CallToolResult, types.DeleteStatementOfApplicabilityOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionStatementOfApplicabilityDelete); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionStatementOfApplicabilityDelete) + if err != nil { return nil, types.DeleteStatementOfApplicabilityOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc - err := svc.StatementsOfApplicability.Delete(ctx, scope, input.ID) + err = svc.StatementsOfApplicability.Delete(ctx, scope, input.ID) if err != nil { return nil, types.DeleteStatementOfApplicabilityOutput{}, fmt.Errorf("failed to delete statement of applicability: %w", err) } @@ -3025,11 +2937,10 @@ func (r *Resolver) DeleteStatementOfApplicabilityTool(ctx context.Context, req * } func (r *Resolver) ListApplicabilityStatementsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListApplicabilityStatementsInput) (*mcp.CallToolResult, types.ListApplicabilityStatementsOutput, error) { - if err := r.Authorize(ctx, input.StatementOfApplicabilityID, probo.ActionApplicabilityStatementList); err != nil { + scope, err := r.Authorize(ctx, input.StatementOfApplicabilityID, probo.ActionApplicabilityStatementList) + if err != nil { return nil, types.ListApplicabilityStatementsOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.StatementOfApplicabilityID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.ApplicabilityStatementOrderField]{ @@ -3054,11 +2965,10 @@ func (r *Resolver) ListApplicabilityStatementsTool(ctx context.Context, req *mcp } func (r *Resolver) GetApplicabilityStatementTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetApplicabilityStatementInput) (*mcp.CallToolResult, types.GetApplicabilityStatementOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionApplicabilityStatementGet); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionApplicabilityStatementGet) + if err != nil { return nil, types.GetApplicabilityStatementOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc stmt, err := prb.StatementsOfApplicability.GetApplicabilityStatement(ctx, scope, input.ID) @@ -3072,11 +2982,10 @@ func (r *Resolver) GetApplicabilityStatementTool(ctx context.Context, req *mcp.C } func (r *Resolver) AddApplicabilityStatementTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddApplicabilityStatementInput) (*mcp.CallToolResult, types.AddApplicabilityStatementOutput, error) { - if err := r.Authorize(ctx, input.StatementOfApplicabilityID, probo.ActionApplicabilityStatementCreate); err != nil { + scope, err := r.Authorize(ctx, input.StatementOfApplicabilityID, probo.ActionApplicabilityStatementCreate) + if err != nil { return nil, types.AddApplicabilityStatementOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.StatementOfApplicabilityID) svc := r.proboSvc stmt, err := svc.StatementsOfApplicability.CreateApplicabilityStatement( @@ -3096,11 +3005,10 @@ func (r *Resolver) AddApplicabilityStatementTool(ctx context.Context, req *mcp.C } func (r *Resolver) UpdateApplicabilityStatementTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateApplicabilityStatementInput) (*mcp.CallToolResult, types.UpdateApplicabilityStatementOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionApplicabilityStatementUpdate); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionApplicabilityStatementUpdate) + if err != nil { return nil, types.UpdateApplicabilityStatementOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc stmt, err := svc.StatementsOfApplicability.UpdateApplicabilityStatement( @@ -3119,14 +3027,13 @@ func (r *Resolver) UpdateApplicabilityStatementTool(ctx context.Context, req *mc } func (r *Resolver) DeleteApplicabilityStatementTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteApplicabilityStatementInput) (*mcp.CallToolResult, types.DeleteApplicabilityStatementOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionApplicabilityStatementDelete); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionApplicabilityStatementDelete) + if err != nil { return nil, types.DeleteApplicabilityStatementOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc - err := svc.StatementsOfApplicability.DeleteApplicabilityStatement(ctx, scope, input.ID) + err = svc.StatementsOfApplicability.DeleteApplicabilityStatement(ctx, scope, input.ID) if err != nil { return nil, types.DeleteApplicabilityStatementOutput{}, fmt.Errorf("failed to delete applicability statement: %w", err) } @@ -3139,11 +3046,10 @@ func (r *Resolver) DeleteApplicabilityStatementTool(ctx context.Context, req *mc // ListThirdPartyRiskAssessmentsTool handles the listThirdPartyRiskAssessments tool // List all risk assessments for a thirdParty func (r *Resolver) ListThirdPartyRiskAssessmentsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListThirdPartyRiskAssessmentsInput) (*mcp.CallToolResult, types.ListThirdPartyRiskAssessmentsOutput, error) { - if err := r.Authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyRiskAssessmentList); err != nil { + scope, err := r.Authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyRiskAssessmentList) + if err != nil { return nil, types.ListThirdPartyRiskAssessmentsOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ThirdPartyID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.ThirdPartyRiskAssessmentOrderField]{ @@ -3170,11 +3076,10 @@ func (r *Resolver) ListThirdPartyRiskAssessmentsTool(ctx context.Context, req *m // AddThirdPartyRiskAssessmentTool handles the addThirdPartyRiskAssessment tool // Add a new risk assessment for a thirdParty func (r *Resolver) AddThirdPartyRiskAssessmentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddThirdPartyRiskAssessmentInput) (*mcp.CallToolResult, types.AddThirdPartyRiskAssessmentOutput, error) { - if err := r.Authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyRiskAssessmentCreate); err != nil { + scope, err := r.Authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyRiskAssessmentCreate) + if err != nil { return nil, types.AddThirdPartyRiskAssessmentOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ThirdPartyID) prb := r.proboSvc assessment, err := prb.ThirdParties.CreateRiskAssessment( @@ -3195,14 +3100,13 @@ func (r *Resolver) AddThirdPartyRiskAssessmentTool(ctx context.Context, req *mcp } func (r *Resolver) DeleteThirdPartyTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteThirdPartyInput) (*mcp.CallToolResult, types.DeleteThirdPartyOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionThirdPartyDelete); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionThirdPartyDelete) + if err != nil { return nil, types.DeleteThirdPartyOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc - err := svc.ThirdParties.Delete(ctx, scope, input.ID) + err = svc.ThirdParties.Delete(ctx, scope, input.ID) if err != nil { return nil, types.DeleteThirdPartyOutput{}, fmt.Errorf("failed to delete thirdParty: %w", err) } @@ -3213,14 +3117,13 @@ func (r *Resolver) DeleteThirdPartyTool(ctx context.Context, req *mcp.CallToolRe } func (r *Resolver) DeleteFindingTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteFindingInput) (*mcp.CallToolResult, types.DeleteFindingOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionFindingDelete); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionFindingDelete) + if err != nil { return nil, types.DeleteFindingOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc - err := svc.Findings.Delete(ctx, scope, input.ID) + err = svc.Findings.Delete(ctx, scope, input.ID) if err != nil { return nil, types.DeleteFindingOutput{}, fmt.Errorf("cannot delete finding: %w", err) } @@ -3231,11 +3134,10 @@ func (r *Resolver) DeleteFindingTool(ctx context.Context, req *mcp.CallToolReque } func (r *Resolver) LinkFindingAuditTool(ctx context.Context, req *mcp.CallToolRequest, input *types.LinkFindingAuditInput) (*mcp.CallToolResult, types.LinkFindingAuditOutput, error) { - if err := r.Authorize(ctx, input.FindingID, probo.ActionFindingAuditMappingCreate); err != nil { + scope, err := r.Authorize(ctx, input.FindingID, probo.ActionFindingAuditMappingCreate) + if err != nil { return nil, types.LinkFindingAuditOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.FindingID) svc := r.proboSvc finding, audit, err := svc.Findings.CreateAuditMapping(ctx, scope, input.FindingID, input.AuditID, input.ReferenceID) @@ -3250,11 +3152,10 @@ func (r *Resolver) LinkFindingAuditTool(ctx context.Context, req *mcp.CallToolRe } func (r *Resolver) UnlinkFindingAuditTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UnlinkFindingAuditInput) (*mcp.CallToolResult, types.UnlinkFindingAuditOutput, error) { - if err := r.Authorize(ctx, input.FindingID, probo.ActionFindingAuditMappingDelete); err != nil { + scope, err := r.Authorize(ctx, input.FindingID, probo.ActionFindingAuditMappingDelete) + if err != nil { return nil, types.UnlinkFindingAuditOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.FindingID) svc := r.proboSvc finding, audit, err := svc.Findings.DeleteAuditMapping(ctx, scope, input.FindingID, input.AuditID) @@ -3269,11 +3170,10 @@ func (r *Resolver) UnlinkFindingAuditTool(ctx context.Context, req *mcp.CallTool } func (r *Resolver) ListFindingAuditsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListFindingAuditsInput) (*mcp.CallToolResult, types.ListFindingAuditsOutput, error) { - if err := r.Authorize(ctx, input.FindingID, probo.ActionFindingGet); err != nil { + scope, err := r.Authorize(ctx, input.FindingID, probo.ActionFindingGet) + if err != nil { return nil, types.ListFindingAuditsOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.FindingID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.AuditOrderField]{ @@ -3300,12 +3200,11 @@ func (r *Resolver) ListFindingAuditsTool(ctx context.Context, req *mcp.CallToolR // ListAccessReviewCampaignsTool handles the listAccessReviewCampaigns tool // List access review campaigns for an organization func (r *Resolver) ListAccessReviewCampaignsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListAccessReviewCampaignsInput) (*mcp.CallToolResult, types.ListAccessReviewCampaignsOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionAccessReviewCampaignList); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionAccessReviewCampaignList) + if err != nil { return nil, types.ListAccessReviewCampaignsOutput{}, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) - pageOrderBy := page.OrderBy[coredata.AccessReviewCampaignOrderField]{ Field: coredata.AccessReviewCampaignOrderFieldCreatedAt, Direction: page.OrderDirectionDesc, @@ -3330,12 +3229,11 @@ func (r *Resolver) ListAccessReviewCampaignsTool(ctx context.Context, req *mcp.C // ListAccessEntriesTool handles the listAccessEntries tool // List access entries for a campaign with optional filters func (r *Resolver) ListAccessEntriesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListAccessEntriesInput) (*mcp.CallToolResult, types.ListAccessEntriesOutput, error) { - if err := r.Authorize(ctx, input.CampaignID, probo.ActionAccessEntryList); err != nil { + scope, err := r.Authorize(ctx, input.CampaignID, probo.ActionAccessEntryList) + if err != nil { return nil, types.ListAccessEntriesOutput{}, err } - scope := coredata.NewScopeFromObjectID(input.CampaignID) - pageOrderBy := page.OrderBy[coredata.AccessEntryOrderField]{ Field: coredata.AccessEntryOrderFieldCreatedAt, Direction: page.OrderDirectionDesc, @@ -3390,12 +3288,11 @@ func (r *Resolver) ListAccessEntriesTool(ctx context.Context, req *mcp.CallToolR // GetAccessReviewCampaignStatisticsTool handles the getAccessReviewCampaignStatistics tool // Get statistics for an access review campaign func (r *Resolver) GetAccessReviewCampaignStatisticsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetAccessReviewCampaignStatisticsInput) (*mcp.CallToolResult, types.GetAccessReviewCampaignStatisticsOutput, error) { - if err := r.Authorize(ctx, input.CampaignID, probo.ActionAccessReviewCampaignGet); err != nil { + scope, err := r.Authorize(ctx, input.CampaignID, probo.ActionAccessReviewCampaignGet) + if err != nil { return nil, types.GetAccessReviewCampaignStatisticsOutput{}, err } - scope := coredata.NewScopeFromObjectID(input.CampaignID) - stats, err := r.accessReview.Entries(scope).Statistics(ctx, input.CampaignID) if err != nil { panic(fmt.Errorf("cannot get campaign statistics: %w", err)) @@ -3409,12 +3306,11 @@ func (r *Resolver) GetAccessReviewCampaignStatisticsTool(ctx context.Context, re // RecordAccessEntryDecisionTool handles the recordAccessEntryDecision tool // Record a decision on an access entry func (r *Resolver) RecordAccessEntryDecisionTool(ctx context.Context, req *mcp.CallToolRequest, input *types.RecordAccessEntryDecisionInput) (*mcp.CallToolResult, types.RecordAccessEntryDecisionOutput, error) { - if err := r.Authorize(ctx, input.AccessEntryID, probo.ActionAccessEntryDecide); err != nil { + scope, err := r.Authorize(ctx, input.AccessEntryID, probo.ActionAccessEntryDecide) + if err != nil { return nil, types.RecordAccessEntryDecisionOutput{}, err } - scope := coredata.NewScopeFromObjectID(input.AccessEntryID) - identity := authn.IdentityFromContext(ctx) if identity == nil { return nil, types.RecordAccessEntryDecisionOutput{}, fmt.Errorf("no identity in context") @@ -3460,7 +3356,7 @@ func (r *Resolver) RecordAccessEntryDecisionsTool(ctx context.Context, req *mcp. // Authorize each entry individually to prevent cross-org bypass. for _, d := range input.Decisions { - if err := r.Authorize(ctx, d.AccessEntryID, probo.ActionAccessEntryDecide); err != nil { + if _, err := r.Authorize(ctx, d.AccessEntryID, probo.ActionAccessEntryDecide); err != nil { return nil, types.RecordAccessEntryDecisionsOutput{}, err } } @@ -3520,12 +3416,11 @@ func (r *Resolver) RecordAccessEntryDecisionsTool(ctx context.Context, req *mcp. // CloseAccessReviewCampaignTool handles the closeAccessReviewCampaign tool // Close an access review campaign func (r *Resolver) CloseAccessReviewCampaignTool(ctx context.Context, req *mcp.CallToolRequest, input *types.CloseAccessReviewCampaignInput) (*mcp.CallToolResult, types.CloseAccessReviewCampaignOutput, error) { - if err := r.Authorize(ctx, input.CampaignID, probo.ActionAccessReviewCampaignClose); err != nil { + scope, err := r.Authorize(ctx, input.CampaignID, probo.ActionAccessReviewCampaignClose) + if err != nil { return nil, types.CloseAccessReviewCampaignOutput{}, err } - scope := coredata.NewScopeFromObjectID(input.CampaignID) - campaign, err := r.accessReview.Campaigns(scope).Close(ctx, input.CampaignID) if err != nil { return nil, types.CloseAccessReviewCampaignOutput{}, fmt.Errorf("cannot close campaign: %w", err) @@ -3539,12 +3434,11 @@ func (r *Resolver) CloseAccessReviewCampaignTool(ctx context.Context, req *mcp.C // ListAccessSourcesTool handles the listAccessSources tool // List access sources for an organization func (r *Resolver) ListAccessSourcesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListAccessSourcesInput) (*mcp.CallToolResult, types.ListAccessSourcesOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionAccessSourceList); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionAccessSourceList) + if err != nil { return nil, types.ListAccessSourcesOutput{}, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) - pageOrderBy := page.OrderBy[coredata.AccessSourceOrderField]{ Field: coredata.AccessSourceOrderFieldCreatedAt, Direction: page.OrderDirectionDesc, @@ -3569,12 +3463,11 @@ func (r *Resolver) ListAccessSourcesTool(ctx context.Context, req *mcp.CallToolR // CreateAccessSourceTool handles the createAccessSource tool // Create a new access source for an organization func (r *Resolver) CreateAccessSourceTool(ctx context.Context, req *mcp.CallToolRequest, input *types.CreateAccessSourceInput) (*mcp.CallToolResult, types.CreateAccessSourceOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionAccessSourceCreate); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionAccessSourceCreate) + if err != nil { return nil, types.CreateAccessSourceOutput{}, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) - source, err := r.accessReview.Sources(scope).Create(ctx, accessreview.CreateAccessSourceRequest{ OrganizationID: input.OrganizationID, ConnectorID: input.ConnectorID, @@ -3594,12 +3487,11 @@ func (r *Resolver) CreateAccessSourceTool(ctx context.Context, req *mcp.CallTool // UpdateAccessSourceTool handles the updateAccessSource tool // Update an existing access source func (r *Resolver) UpdateAccessSourceTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateAccessSourceInput) (*mcp.CallToolResult, types.UpdateAccessSourceOutput, error) { - if err := r.Authorize(ctx, input.AccessSourceID, probo.ActionAccessSourceUpdate); err != nil { + scope, err := r.Authorize(ctx, input.AccessSourceID, probo.ActionAccessSourceUpdate) + if err != nil { return nil, types.UpdateAccessSourceOutput{}, err } - scope := coredata.NewScopeFromObjectID(input.AccessSourceID) - updateReq := accessreview.UpdateAccessSourceRequest{ AccessSourceID: input.AccessSourceID, Name: input.Name, @@ -3638,12 +3530,11 @@ func (r *Resolver) UpdateAccessSourceTool(ctx context.Context, req *mcp.CallTool // DeleteAccessSourceTool handles the deleteAccessSource tool // Delete an access source func (r *Resolver) DeleteAccessSourceTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteAccessSourceInput) (*mcp.CallToolResult, types.DeleteAccessSourceOutput, error) { - if err := r.Authorize(ctx, input.AccessSourceID, probo.ActionAccessSourceDelete); err != nil { + scope, err := r.Authorize(ctx, input.AccessSourceID, probo.ActionAccessSourceDelete) + if err != nil { return nil, types.DeleteAccessSourceOutput{}, err } - scope := coredata.NewScopeFromObjectID(input.AccessSourceID) - if err := r.accessReview.Sources(scope).Delete(ctx, input.AccessSourceID); err != nil { return nil, types.DeleteAccessSourceOutput{}, fmt.Errorf("cannot delete access source: %w", err) } @@ -3656,12 +3547,11 @@ func (r *Resolver) DeleteAccessSourceTool(ctx context.Context, req *mcp.CallTool // CreateAccessReviewCampaignTool handles the createAccessReviewCampaign tool // Create a new access review campaign for an organization func (r *Resolver) CreateAccessReviewCampaignTool(ctx context.Context, req *mcp.CallToolRequest, input *types.CreateAccessReviewCampaignInput) (*mcp.CallToolResult, types.CreateAccessReviewCampaignOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionAccessReviewCampaignCreate); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionAccessReviewCampaignCreate) + if err != nil { return nil, types.CreateAccessReviewCampaignOutput{}, err } - scope := coredata.NewScopeFromObjectID(input.OrganizationID) - var description string if input.Description != nil { description = *input.Description @@ -3686,12 +3576,11 @@ func (r *Resolver) CreateAccessReviewCampaignTool(ctx context.Context, req *mcp. // UpdateAccessReviewCampaignTool handles the updateAccessReviewCampaign tool // Update an existing access review campaign func (r *Resolver) UpdateAccessReviewCampaignTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateAccessReviewCampaignInput) (*mcp.CallToolResult, types.UpdateAccessReviewCampaignOutput, error) { - if err := r.Authorize(ctx, input.CampaignID, probo.ActionAccessReviewCampaignUpdate); err != nil { + scope, err := r.Authorize(ctx, input.CampaignID, probo.ActionAccessReviewCampaignUpdate) + if err != nil { return nil, types.UpdateAccessReviewCampaignOutput{}, err } - scope := coredata.NewScopeFromObjectID(input.CampaignID) - updateReq := accessreview.UpdateAccessReviewCampaignRequest{ CampaignID: input.CampaignID, Name: input.Name, @@ -3727,12 +3616,11 @@ func (r *Resolver) UpdateAccessReviewCampaignTool(ctx context.Context, req *mcp. // DeleteAccessReviewCampaignTool handles the deleteAccessReviewCampaign tool // Delete an access review campaign func (r *Resolver) DeleteAccessReviewCampaignTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteAccessReviewCampaignInput) (*mcp.CallToolResult, types.DeleteAccessReviewCampaignOutput, error) { - if err := r.Authorize(ctx, input.CampaignID, probo.ActionAccessReviewCampaignDelete); err != nil { + scope, err := r.Authorize(ctx, input.CampaignID, probo.ActionAccessReviewCampaignDelete) + if err != nil { return nil, types.DeleteAccessReviewCampaignOutput{}, err } - scope := coredata.NewScopeFromObjectID(input.CampaignID) - if err := r.accessReview.Campaigns(scope).Delete(ctx, input.CampaignID); err != nil { return nil, types.DeleteAccessReviewCampaignOutput{}, fmt.Errorf("cannot delete access review campaign: %w", err) } @@ -3745,12 +3633,11 @@ func (r *Resolver) DeleteAccessReviewCampaignTool(ctx context.Context, req *mcp. // StartAccessReviewCampaignTool handles the startAccessReviewCampaign tool // Start an access review campaign func (r *Resolver) StartAccessReviewCampaignTool(ctx context.Context, req *mcp.CallToolRequest, input *types.StartAccessReviewCampaignInput) (*mcp.CallToolResult, types.StartAccessReviewCampaignOutput, error) { - if err := r.Authorize(ctx, input.CampaignID, probo.ActionAccessReviewCampaignStart); err != nil { + scope, err := r.Authorize(ctx, input.CampaignID, probo.ActionAccessReviewCampaignStart) + if err != nil { return nil, types.StartAccessReviewCampaignOutput{}, err } - scope := coredata.NewScopeFromObjectID(input.CampaignID) - campaign, err := r.accessReview.Campaigns(scope).Start(ctx, input.CampaignID) if err != nil { return nil, types.StartAccessReviewCampaignOutput{}, fmt.Errorf("cannot start access review campaign: %w", err) @@ -3764,12 +3651,11 @@ func (r *Resolver) StartAccessReviewCampaignTool(ctx context.Context, req *mcp.C // CancelAccessReviewCampaignTool handles the cancelAccessReviewCampaign tool // Cancel an in-progress access review campaign func (r *Resolver) CancelAccessReviewCampaignTool(ctx context.Context, req *mcp.CallToolRequest, input *types.CancelAccessReviewCampaignInput) (*mcp.CallToolResult, types.CancelAccessReviewCampaignOutput, error) { - if err := r.Authorize(ctx, input.CampaignID, probo.ActionAccessReviewCampaignCancel); err != nil { + scope, err := r.Authorize(ctx, input.CampaignID, probo.ActionAccessReviewCampaignCancel) + if err != nil { return nil, types.CancelAccessReviewCampaignOutput{}, err } - scope := coredata.NewScopeFromObjectID(input.CampaignID) - campaign, err := r.accessReview.Campaigns(scope).Cancel(ctx, input.CampaignID) if err != nil { return nil, types.CancelAccessReviewCampaignOutput{}, fmt.Errorf("cannot cancel access review campaign: %w", err) @@ -3783,12 +3669,11 @@ func (r *Resolver) CancelAccessReviewCampaignTool(ctx context.Context, req *mcp. // AddAccessReviewCampaignScopeSourceTool handles the addAccessReviewCampaignScopeSource tool // Add an access source to an access review campaign's scope func (r *Resolver) AddAccessReviewCampaignScopeSourceTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddAccessReviewCampaignScopeSourceInput) (*mcp.CallToolResult, types.AddAccessReviewCampaignScopeSourceOutput, error) { - if err := r.Authorize(ctx, input.CampaignID, probo.ActionAccessReviewCampaignAddScopeSource); err != nil { + scope, err := r.Authorize(ctx, input.CampaignID, probo.ActionAccessReviewCampaignAddScopeSource) + if err != nil { return nil, types.AddAccessReviewCampaignScopeSourceOutput{}, err } - scope := coredata.NewScopeFromObjectID(input.CampaignID) - campaign, err := r.accessReview.Campaigns(scope).AddScopeSource(ctx, accessreview.AddCampaignScopeSourceRequest{ CampaignID: input.CampaignID, AccessSourceID: input.AccessSourceID, @@ -3805,12 +3690,11 @@ func (r *Resolver) AddAccessReviewCampaignScopeSourceTool(ctx context.Context, r // RemoveAccessReviewCampaignScopeSourceTool handles the removeAccessReviewCampaignScopeSource tool // Remove an access source from an access review campaign's scope func (r *Resolver) RemoveAccessReviewCampaignScopeSourceTool(ctx context.Context, req *mcp.CallToolRequest, input *types.RemoveAccessReviewCampaignScopeSourceInput) (*mcp.CallToolResult, types.RemoveAccessReviewCampaignScopeSourceOutput, error) { - if err := r.Authorize(ctx, input.CampaignID, probo.ActionAccessReviewCampaignRemoveScopeSource); err != nil { + scope, err := r.Authorize(ctx, input.CampaignID, probo.ActionAccessReviewCampaignRemoveScopeSource) + if err != nil { return nil, types.RemoveAccessReviewCampaignScopeSourceOutput{}, err } - scope := coredata.NewScopeFromObjectID(input.CampaignID) - campaign, err := r.accessReview.Campaigns(scope).RemoveScopeSource(ctx, accessreview.RemoveCampaignScopeSourceRequest{ CampaignID: input.CampaignID, AccessSourceID: input.AccessSourceID, @@ -3827,12 +3711,11 @@ func (r *Resolver) RemoveAccessReviewCampaignScopeSourceTool(ctx context.Context // FlagAccessEntryTool handles the flagAccessEntry tool // Flag an access entry during review func (r *Resolver) FlagAccessEntryTool(ctx context.Context, req *mcp.CallToolRequest, input *types.FlagAccessEntryInput) (*mcp.CallToolResult, types.FlagAccessEntryOutput, error) { - if err := r.Authorize(ctx, input.AccessEntryID, probo.ActionAccessEntryFlag); err != nil { + scope, err := r.Authorize(ctx, input.AccessEntryID, probo.ActionAccessEntryFlag) + if err != nil { return nil, types.FlagAccessEntryOutput{}, err } - scope := coredata.NewScopeFromObjectID(input.AccessEntryID) - entry, err := r.accessReview.Entries(scope).FlagEntry(ctx, accessreview.FlagAccessEntryRequest{ EntryID: input.AccessEntryID, Flags: input.Flags, @@ -3848,11 +3731,10 @@ func (r *Resolver) FlagAccessEntryTool(ctx context.Context, req *mcp.CallToolReq } func (r *Resolver) GetAuditReportUrlTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetAuditReportUrlInput) (*mcp.CallToolResult, types.GetAuditReportUrlOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionReportGetReportUrl); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionReportGetReportUrl) + if err != nil { return nil, types.GetAuditReportUrlOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc url, err := prb.Audits.GenerateReportURL(ctx, scope, input.ID, 15*time.Minute) @@ -3866,11 +3748,10 @@ func (r *Resolver) GetAuditReportUrlTool(ctx context.Context, req *mcp.CallToolR } func (r *Resolver) ArchiveDocumentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ArchiveDocumentInput) (*mcp.CallToolResult, types.ArchiveDocumentOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionDocumentArchive); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionDocumentArchive) + if err != nil { return nil, types.ArchiveDocumentOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc document, err := svc.Documents.Archive(ctx, scope, input.ID) @@ -3884,11 +3765,10 @@ func (r *Resolver) ArchiveDocumentTool(ctx context.Context, req *mcp.CallToolReq } func (r *Resolver) UnarchiveDocumentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UnarchiveDocumentInput) (*mcp.CallToolResult, types.UnarchiveDocumentOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionDocumentUnarchive); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionDocumentUnarchive) + if err != nil { return nil, types.UnarchiveDocumentOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc document, err := svc.Documents.Unarchive(ctx, scope, input.ID) @@ -3902,11 +3782,10 @@ func (r *Resolver) UnarchiveDocumentTool(ctx context.Context, req *mcp.CallToolR } func (r *Resolver) GetOrganizationContextTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetOrganizationContextInput) (*mcp.CallToolResult, types.GetOrganizationContextOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionOrganizationContextGet); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionOrganizationContextGet) + if err != nil { return nil, types.GetOrganizationContextOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.proboSvc orgContext, err := prb.Organizations.GetContext(ctx, scope, input.OrganizationID) @@ -3920,11 +3799,10 @@ func (r *Resolver) GetOrganizationContextTool(ctx context.Context, req *mcp.Call } func (r *Resolver) UpdateOrganizationContextTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateOrganizationContextInput) (*mcp.CallToolResult, types.UpdateOrganizationContextOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionOrganizationContextUpdate); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionOrganizationContextUpdate) + if err != nil { return nil, types.UpdateOrganizationContextOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.proboSvc orgContext, err := prb.Organizations.UpdateContext( @@ -3948,7 +3826,7 @@ func (r *Resolver) UpdateOrganizationContextTool(ctx context.Context, req *mcp.C } func (r *Resolver) GetAuditLogEntryTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetAuditLogEntryInput) (*mcp.CallToolResult, types.GetAuditLogEntryOutput, error) { - if err := r.Authorize(ctx, input.ID, iam.ActionAuditLogEntryGet); err != nil { + if _, err := r.Authorize(ctx, input.ID, iam.ActionAuditLogEntryGet); err != nil { return nil, types.GetAuditLogEntryOutput{}, err } @@ -3963,7 +3841,7 @@ func (r *Resolver) GetAuditLogEntryTool(ctx context.Context, req *mcp.CallToolRe } func (r *Resolver) ListAuditLogEntriesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListAuditLogEntriesInput) (*mcp.CallToolResult, types.ListAuditLogEntriesOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, iam.ActionAuditLogEntryList); err != nil { + if _, err := r.Authorize(ctx, input.OrganizationID, iam.ActionAuditLogEntryList); err != nil { return nil, types.ListAuditLogEntriesOutput{}, err } @@ -4003,11 +3881,10 @@ func (r *Resolver) ListAuditLogEntriesTool(ctx context.Context, req *mcp.CallToo } func (r *Resolver) ListMeasureDocumentsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListMeasureDocumentsInput) (*mcp.CallToolResult, types.ListMeasureDocumentsOutput, error) { - if err := r.Authorize(ctx, input.MeasureID, probo.ActionMeasureGet); err != nil { + scope, err := r.Authorize(ctx, input.MeasureID, probo.ActionMeasureGet) + if err != nil { return nil, types.ListMeasureDocumentsOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.MeasureID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.DocumentOrderField]{ @@ -4032,11 +3909,10 @@ func (r *Resolver) ListMeasureDocumentsTool(ctx context.Context, req *mcp.CallTo } func (r *Resolver) VoidDocumentVersionApprovalTool(ctx context.Context, req *mcp.CallToolRequest, input *types.VoidDocumentVersionApprovalInput) (*mcp.CallToolResult, types.VoidDocumentVersionApprovalOutput, error) { - if err := r.Authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionVoidApproval); err != nil { + scope, err := r.Authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionVoidApproval) + if err != nil { return nil, types.VoidDocumentVersionApprovalOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.DocumentVersionID) svc := r.proboSvc _, documentVersion, err := svc.DocumentApprovals.VoidApproval(ctx, scope, input.DocumentVersionID) @@ -4050,14 +3926,13 @@ func (r *Resolver) VoidDocumentVersionApprovalTool(ctx context.Context, req *mcp } func (r *Resolver) SendSigningNotificationsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.SendSigningNotificationsInput) (*mcp.CallToolResult, types.SendSigningNotificationsOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionDocumentSendSigningNotifications); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionDocumentSendSigningNotifications) + if err != nil { return nil, types.SendSigningNotificationsOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) svc := r.proboSvc - err := svc.Documents.SendSigningNotifications(ctx, scope, input.OrganizationID) + err = svc.Documents.SendSigningNotifications(ctx, scope, input.OrganizationID) if err != nil { panic(fmt.Errorf("cannot send signing notifications: %w", err)) } @@ -4068,11 +3943,10 @@ func (r *Resolver) SendSigningNotificationsTool(ctx context.Context, req *mcp.Ca } func (r *Resolver) DeleteDocumentDraftTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteDocumentDraftInput) (*mcp.CallToolResult, types.DeleteDocumentDraftOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionDocumentDeleteDraft); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionDocumentDeleteDraft) + if err != nil { return nil, types.DeleteDocumentDraftOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc document, err := svc.Documents.DeleteDraft(ctx, scope, input.ID) @@ -4086,11 +3960,10 @@ func (r *Resolver) DeleteDocumentDraftTool(ctx context.Context, req *mcp.CallToo } func (r *Resolver) PublishStatementOfApplicabilityTool(ctx context.Context, req *mcp.CallToolRequest, input *types.PublishStatementOfApplicabilityInput) (*mcp.CallToolResult, types.PublishStatementOfApplicabilityOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionStatementOfApplicabilityPublish); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionStatementOfApplicabilityPublish) + if err != nil { return nil, types.PublishStatementOfApplicabilityOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc document, documentVersion, err := svc.GeneratedDocuments.PublishStatementOfApplicability(ctx, scope, input.ID, input.ApproverIds, input.Minor) @@ -4105,11 +3978,10 @@ func (r *Resolver) PublishStatementOfApplicabilityTool(ctx context.Context, req } func (r *Resolver) ListWebhookSubscriptionsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListWebhookSubscriptionsInput) (*mcp.CallToolResult, types.ListWebhookSubscriptionsOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionWebhookSubscriptionList); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionWebhookSubscriptionList) + if err != nil { return nil, types.ListWebhookSubscriptionsOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.WebhookSubscriptionOrderField]{ @@ -4134,11 +4006,10 @@ func (r *Resolver) ListWebhookSubscriptionsTool(ctx context.Context, req *mcp.Ca } func (r *Resolver) GetWebhookSubscriptionTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetWebhookSubscriptionInput) (*mcp.CallToolResult, types.GetWebhookSubscriptionOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionWebhookSubscriptionGet); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionWebhookSubscriptionGet) + if err != nil { return nil, types.GetWebhookSubscriptionOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc subscription, err := prb.WebhookSubscriptions.Get(ctx, scope, input.ID) @@ -4152,11 +4023,10 @@ func (r *Resolver) GetWebhookSubscriptionTool(ctx context.Context, req *mcp.Call } func (r *Resolver) CreateWebhookSubscriptionTool(ctx context.Context, req *mcp.CallToolRequest, input *types.CreateWebhookSubscriptionInput) (*mcp.CallToolResult, types.CreateWebhookSubscriptionOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionWebhookSubscriptionCreate); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionWebhookSubscriptionCreate) + if err != nil { return nil, types.CreateWebhookSubscriptionOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.proboSvc subscription, err := prb.WebhookSubscriptions.Create( @@ -4177,11 +4047,10 @@ func (r *Resolver) CreateWebhookSubscriptionTool(ctx context.Context, req *mcp.C } func (r *Resolver) UpdateWebhookSubscriptionTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateWebhookSubscriptionInput) (*mcp.CallToolResult, types.UpdateWebhookSubscriptionOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionWebhookSubscriptionUpdate); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionWebhookSubscriptionUpdate) + if err != nil { return nil, types.UpdateWebhookSubscriptionOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc subscription, err := prb.WebhookSubscriptions.Update( @@ -4202,14 +4071,13 @@ func (r *Resolver) UpdateWebhookSubscriptionTool(ctx context.Context, req *mcp.C } func (r *Resolver) DeleteWebhookSubscriptionTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteWebhookSubscriptionInput) (*mcp.CallToolResult, types.DeleteWebhookSubscriptionOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionWebhookSubscriptionDelete); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionWebhookSubscriptionDelete) + if err != nil { return nil, types.DeleteWebhookSubscriptionOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc - err := prb.WebhookSubscriptions.Delete(ctx, scope, input.ID) + err = prb.WebhookSubscriptions.Delete(ctx, scope, input.ID) if err != nil { return nil, types.DeleteWebhookSubscriptionOutput{}, fmt.Errorf("failed to delete webhook subscription: %w", err) } @@ -4220,11 +4088,10 @@ func (r *Resolver) DeleteWebhookSubscriptionTool(ctx context.Context, req *mcp.C } func (r *Resolver) ListWebhookEventsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListWebhookEventsInput) (*mcp.CallToolResult, types.ListWebhookEventsOutput, error) { - if err := r.Authorize(ctx, input.WebhookSubscriptionID, probo.ActionWebhookSubscriptionGet); err != nil { + scope, err := r.Authorize(ctx, input.WebhookSubscriptionID, probo.ActionWebhookSubscriptionGet) + if err != nil { return nil, types.ListWebhookEventsOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.WebhookSubscriptionID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.WebhookEventOrderField]{ @@ -4249,11 +4116,10 @@ func (r *Resolver) ListWebhookEventsTool(ctx context.Context, req *mcp.CallToolR } func (r *Resolver) ListDocumentVersionApprovalQuorumsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListDocumentVersionApprovalQuorumsInput) (*mcp.CallToolResult, types.ListDocumentVersionApprovalQuorumsOutput, error) { - if err := r.Authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionApprovalList); err != nil { + scope, err := r.Authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionApprovalList) + if err != nil { return nil, types.ListDocumentVersionApprovalQuorumsOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.DocumentVersionID) svc := r.proboSvc pageOrderBy := page.OrderBy[coredata.DocumentVersionApprovalQuorumOrderField]{ @@ -4278,11 +4144,10 @@ func (r *Resolver) ListDocumentVersionApprovalQuorumsTool(ctx context.Context, r } func (r *Resolver) GetDocumentVersionApprovalQuorumTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetDocumentVersionApprovalQuorumInput) (*mcp.CallToolResult, types.GetDocumentVersionApprovalQuorumOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionDocumentVersionApprovalList); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionDocumentVersionApprovalList) + if err != nil { return nil, types.GetDocumentVersionApprovalQuorumOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc quorum, err := svc.DocumentApprovals.GetQuorum(ctx, scope, input.ID) @@ -4296,11 +4161,10 @@ func (r *Resolver) GetDocumentVersionApprovalQuorumTool(ctx context.Context, req } func (r *Resolver) ListDocumentVersionApprovalDecisionsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListDocumentVersionApprovalDecisionsInput) (*mcp.CallToolResult, types.ListDocumentVersionApprovalDecisionsOutput, error) { - if err := r.Authorize(ctx, input.QuorumID, probo.ActionDocumentVersionApprovalList); err != nil { + scope, err := r.Authorize(ctx, input.QuorumID, probo.ActionDocumentVersionApprovalList) + if err != nil { return nil, types.ListDocumentVersionApprovalDecisionsOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.QuorumID) svc := r.proboSvc pageOrderBy := page.OrderBy[coredata.DocumentVersionApprovalDecisionOrderField]{ @@ -4332,11 +4196,10 @@ func (r *Resolver) ListDocumentVersionApprovalDecisionsTool(ctx context.Context, } func (r *Resolver) GetDocumentVersionApprovalDecisionTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetDocumentVersionApprovalDecisionInput) (*mcp.CallToolResult, types.GetDocumentVersionApprovalDecisionOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionDocumentVersionApprovalList); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionDocumentVersionApprovalList) + if err != nil { return nil, types.GetDocumentVersionApprovalDecisionOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc decision, err := svc.DocumentApprovals.GetDecision(ctx, scope, input.ID) @@ -4350,11 +4213,10 @@ func (r *Resolver) GetDocumentVersionApprovalDecisionTool(ctx context.Context, r } func (r *Resolver) PublishDataListTool(ctx context.Context, req *mcp.CallToolRequest, input *types.PublishDataListInput) (*mcp.CallToolResult, types.PublishDataListOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionDatumPublish); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionDatumPublish) + if err != nil { return nil, types.PublishDataListOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) svc := r.proboSvc document, documentVersion, err := svc.GeneratedDocuments.PublishDataList(ctx, scope, input.OrganizationID, input.ApproverIds, input.Minor) @@ -4369,11 +4231,10 @@ func (r *Resolver) PublishDataListTool(ctx context.Context, req *mcp.CallToolReq } func (r *Resolver) PublishAssetListTool(ctx context.Context, req *mcp.CallToolRequest, input *types.PublishAssetListInput) (*mcp.CallToolResult, types.PublishAssetListOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionAssetPublish); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionAssetPublish) + if err != nil { return nil, types.PublishAssetListOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) svc := r.proboSvc document, documentVersion, err := svc.GeneratedDocuments.PublishAssetList(ctx, scope, input.OrganizationID, input.ApproverIds, input.Minor) @@ -4390,11 +4251,10 @@ func (r *Resolver) PublishAssetListTool(ctx context.Context, req *mcp.CallToolRe // ListThirdPartyContactsTool handles the listThirdPartyContacts tool // List all contacts for a thirdParty func (r *Resolver) ListThirdPartyContactsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListThirdPartyContactsInput) (*mcp.CallToolResult, types.ListThirdPartyContactsOutput, error) { - if err := r.Authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyContactList); err != nil { + scope, err := r.Authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyContactList) + if err != nil { return nil, types.ListThirdPartyContactsOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ThirdPartyID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.ThirdPartyContactOrderField]{ @@ -4421,11 +4281,10 @@ func (r *Resolver) ListThirdPartyContactsTool(ctx context.Context, req *mcp.Call // AddThirdPartyContactTool handles the addThirdPartyContact tool // Add a new contact to a thirdParty func (r *Resolver) AddThirdPartyContactTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddThirdPartyContactInput) (*mcp.CallToolResult, types.AddThirdPartyContactOutput, error) { - if err := r.Authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyContactCreate); err != nil { + scope, err := r.Authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyContactCreate) + if err != nil { return nil, types.AddThirdPartyContactOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ThirdPartyID) prb := r.proboSvc emailAddr, err := mail.ParseAddr(input.Email) @@ -4452,11 +4311,10 @@ func (r *Resolver) AddThirdPartyContactTool(ctx context.Context, req *mcp.CallTo // UpdateThirdPartyContactTool handles the updateThirdPartyContact tool // Update an existing thirdParty contact func (r *Resolver) UpdateThirdPartyContactTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateThirdPartyContactInput) (*mcp.CallToolResult, types.UpdateThirdPartyContactOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionThirdPartyContactUpdate); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionThirdPartyContactUpdate) + if err != nil { return nil, types.UpdateThirdPartyContactOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc updateReq := probo.UpdateThirdPartyContactRequest{ @@ -4498,14 +4356,13 @@ func (r *Resolver) UpdateThirdPartyContactTool(ctx context.Context, req *mcp.Cal // DeleteThirdPartyContactTool handles the deleteThirdPartyContact tool // Delete a thirdParty contact func (r *Resolver) DeleteThirdPartyContactTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteThirdPartyContactInput) (*mcp.CallToolResult, types.DeleteThirdPartyContactOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionThirdPartyContactDelete); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionThirdPartyContactDelete) + if err != nil { return nil, types.DeleteThirdPartyContactOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc - err := prb.ThirdPartyContacts.Delete(ctx, scope, input.ID) + err = prb.ThirdPartyContacts.Delete(ctx, scope, input.ID) if err != nil { return nil, types.DeleteThirdPartyContactOutput{}, fmt.Errorf("cannot delete thirdParty contact: %w", err) } @@ -4518,11 +4375,10 @@ func (r *Resolver) DeleteThirdPartyContactTool(ctx context.Context, req *mcp.Cal // ListThirdPartyServicesTool handles the listThirdPartyServices tool // List all services for a thirdParty func (r *Resolver) ListThirdPartyServicesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListThirdPartyServicesInput) (*mcp.CallToolResult, types.ListThirdPartyServicesOutput, error) { - if err := r.Authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyServiceList); err != nil { + scope, err := r.Authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyServiceList) + if err != nil { return nil, types.ListThirdPartyServicesOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ThirdPartyID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.ThirdPartyServiceOrderField]{ @@ -4549,11 +4405,10 @@ func (r *Resolver) ListThirdPartyServicesTool(ctx context.Context, req *mcp.Call // AddThirdPartyServiceTool handles the addThirdPartyService tool // Add a new service to a thirdParty func (r *Resolver) AddThirdPartyServiceTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddThirdPartyServiceInput) (*mcp.CallToolResult, types.AddThirdPartyServiceOutput, error) { - if err := r.Authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyServiceCreate); err != nil { + scope, err := r.Authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyServiceCreate) + if err != nil { return nil, types.AddThirdPartyServiceOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ThirdPartyID) prb := r.proboSvc thirdPartyService, err := prb.ThirdPartyServices.Create(ctx, scope, probo.CreateThirdPartyServiceRequest{ @@ -4573,11 +4428,10 @@ func (r *Resolver) AddThirdPartyServiceTool(ctx context.Context, req *mcp.CallTo // UpdateThirdPartyServiceTool handles the updateThirdPartyService tool // Update an existing thirdParty service func (r *Resolver) UpdateThirdPartyServiceTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateThirdPartyServiceInput) (*mcp.CallToolResult, types.UpdateThirdPartyServiceOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionThirdPartyServiceUpdate); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionThirdPartyServiceUpdate) + if err != nil { return nil, types.UpdateThirdPartyServiceOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc updateReq := probo.UpdateThirdPartyServiceRequest{ @@ -4605,14 +4459,13 @@ func (r *Resolver) UpdateThirdPartyServiceTool(ctx context.Context, req *mcp.Cal // DeleteThirdPartyServiceTool handles the deleteThirdPartyService tool // Delete a thirdParty service func (r *Resolver) DeleteThirdPartyServiceTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteThirdPartyServiceInput) (*mcp.CallToolResult, types.DeleteThirdPartyServiceOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionThirdPartyServiceDelete); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionThirdPartyServiceDelete) + if err != nil { return nil, types.DeleteThirdPartyServiceOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc - err := prb.ThirdPartyServices.Delete(ctx, scope, input.ID) + err = prb.ThirdPartyServices.Delete(ctx, scope, input.ID) if err != nil { return nil, types.DeleteThirdPartyServiceOutput{}, fmt.Errorf("cannot delete thirdParty service: %w", err) } @@ -4622,14 +4475,13 @@ func (r *Resolver) DeleteThirdPartyServiceTool(ctx context.Context, req *mcp.Cal }, nil } func (r *Resolver) DeleteAssetTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteAssetInput) (*mcp.CallToolResult, types.DeleteAssetOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionAssetDelete); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionAssetDelete) + if err != nil { return nil, types.DeleteAssetOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc - err := svc.Assets.Delete(ctx, scope, input.ID) + err = svc.Assets.Delete(ctx, scope, input.ID) if err != nil { return nil, types.DeleteAssetOutput{}, fmt.Errorf("failed to delete asset: %w", err) } @@ -4639,14 +4491,13 @@ func (r *Resolver) DeleteAssetTool(ctx context.Context, req *mcp.CallToolRequest }, nil } func (r *Resolver) DeleteDatumTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteDatumInput) (*mcp.CallToolResult, types.DeleteDatumOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionDatumDelete); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionDatumDelete) + if err != nil { return nil, types.DeleteDatumOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc - err := svc.Data.Delete(ctx, scope, input.ID) + err = svc.Data.Delete(ctx, scope, input.ID) if err != nil { return nil, types.DeleteDatumOutput{}, fmt.Errorf("failed to delete datum: %w", err) } @@ -4656,14 +4507,13 @@ func (r *Resolver) DeleteDatumTool(ctx context.Context, req *mcp.CallToolRequest }, nil } func (r *Resolver) DeleteObligationTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteObligationInput) (*mcp.CallToolResult, types.DeleteObligationOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionObligationDelete); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionObligationDelete) + if err != nil { return nil, types.DeleteObligationOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc - err := svc.Obligations.Delete(ctx, scope, input.ID) + err = svc.Obligations.Delete(ctx, scope, input.ID) if err != nil { return nil, types.DeleteObligationOutput{}, fmt.Errorf("failed to delete obligation: %w", err) } @@ -4673,14 +4523,13 @@ func (r *Resolver) DeleteObligationTool(ctx context.Context, req *mcp.CallToolRe }, nil } func (r *Resolver) DeleteAuditTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteAuditInput) (*mcp.CallToolResult, types.DeleteAuditOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionAuditDelete); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionAuditDelete) + if err != nil { return nil, types.DeleteAuditOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc - err := svc.Audits.Delete(ctx, scope, input.ID) + err = svc.Audits.Delete(ctx, scope, input.ID) if err != nil { return nil, types.DeleteAuditOutput{}, fmt.Errorf("failed to delete audit: %w", err) } @@ -4690,11 +4539,10 @@ func (r *Resolver) DeleteAuditTool(ctx context.Context, req *mcp.CallToolRequest }, nil } func (r *Resolver) ListRightsRequestsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListRightsRequestsInput) (*mcp.CallToolResult, types.ListRightsRequestsOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionRightsRequestList); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionRightsRequestList) + if err != nil { return nil, types.ListRightsRequestsOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.RightsRequestOrderField]{ @@ -4718,11 +4566,10 @@ func (r *Resolver) ListRightsRequestsTool(ctx context.Context, req *mcp.CallTool return nil, types.NewListRightsRequestsOutput(page), nil } func (r *Resolver) GetRightsRequestTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetRightsRequestInput) (*mcp.CallToolResult, types.GetRightsRequestOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionRightsRequestGet); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionRightsRequestGet) + if err != nil { return nil, types.GetRightsRequestOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc rightsRequest, err := prb.RightsRequests.Get(ctx, scope, input.ID) @@ -4735,11 +4582,10 @@ func (r *Resolver) GetRightsRequestTool(ctx context.Context, req *mcp.CallToolRe }, nil } func (r *Resolver) AddRightsRequestTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddRightsRequestInput) (*mcp.CallToolResult, types.AddRightsRequestOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionRightsRequestCreate); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionRightsRequestCreate) + if err != nil { return nil, types.AddRightsRequestOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) svc := r.proboSvc rightsRequest, err := svc.RightsRequests.Create( @@ -4764,11 +4610,10 @@ func (r *Resolver) AddRightsRequestTool(ctx context.Context, req *mcp.CallToolRe }, nil } func (r *Resolver) UpdateRightsRequestTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateRightsRequestInput) (*mcp.CallToolResult, types.UpdateRightsRequestOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionRightsRequestUpdate); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionRightsRequestUpdate) + if err != nil { return nil, types.UpdateRightsRequestOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc var dataSubject **string @@ -4798,14 +4643,13 @@ func (r *Resolver) UpdateRightsRequestTool(ctx context.Context, req *mcp.CallToo }, nil } func (r *Resolver) DeleteRightsRequestTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteRightsRequestInput) (*mcp.CallToolResult, types.DeleteRightsRequestOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionRightsRequestDelete); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionRightsRequestDelete) + if err != nil { return nil, types.DeleteRightsRequestOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc - err := svc.RightsRequests.Delete(ctx, scope, input.ID) + err = svc.RightsRequests.Delete(ctx, scope, input.ID) if err != nil { return nil, types.DeleteRightsRequestOutput{}, fmt.Errorf("failed to delete rights request: %w", err) } @@ -4818,11 +4662,10 @@ func (r *Resolver) DeleteRightsRequestTool(ctx context.Context, req *mcp.CallToo // GetTrustCenterTool handles the getTrustCenter tool // Get the trust center for an organization func (r *Resolver) GetTrustCenterTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetTrustCenterInput) (*mcp.CallToolResult, types.GetTrustCenterOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionTrustCenterGet); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionTrustCenterGet) + if err != nil { return nil, types.GetTrustCenterOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.proboSvc trustCenter, err := prb.TrustCenters.GetByOrganizationID(ctx, scope, input.OrganizationID) @@ -4853,11 +4696,10 @@ func (r *Resolver) GetTrustCenterTool(ctx context.Context, req *mcp.CallToolRequ // UpdateTrustCenterTool handles the updateTrustCenter tool // Update the trust center settings func (r *Resolver) UpdateTrustCenterTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateTrustCenterInput) (*mcp.CallToolResult, types.UpdateTrustCenterOutput, error) { - if err := r.Authorize(ctx, input.TrustCenterID, probo.ActionTrustCenterUpdate); err != nil { + scope, err := r.Authorize(ctx, input.TrustCenterID, probo.ActionTrustCenterUpdate) + if err != nil { return nil, types.UpdateTrustCenterOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.TrustCenterID) prb := r.proboSvc updateReq := &probo.UpdateTrustCenterRequest{ @@ -4882,11 +4724,10 @@ func (r *Resolver) UpdateTrustCenterTool(ctx context.Context, req *mcp.CallToolR // ListTrustCenterReferencesTool handles the listTrustCenterReferences tool // List all references for a trust center func (r *Resolver) ListTrustCenterReferencesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListTrustCenterReferencesInput) (*mcp.CallToolResult, types.ListTrustCenterReferencesOutput, error) { - if err := r.Authorize(ctx, input.TrustCenterID, probo.ActionTrustCenterReferenceList); err != nil { + scope, err := r.Authorize(ctx, input.TrustCenterID, probo.ActionTrustCenterReferenceList) + if err != nil { return nil, types.ListTrustCenterReferencesOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.TrustCenterID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.TrustCenterReferenceOrderField]{ @@ -4913,11 +4754,10 @@ func (r *Resolver) ListTrustCenterReferencesTool(ctx context.Context, req *mcp.C // AddTrustCenterReferenceTool handles the addTrustCenterReference tool // Add a new reference to the trust center func (r *Resolver) AddTrustCenterReferenceTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddTrustCenterReferenceInput) (*mcp.CallToolResult, types.AddTrustCenterReferenceOutput, error) { - if err := r.Authorize(ctx, input.TrustCenterID, probo.ActionTrustCenterReferenceCreate); err != nil { + scope, err := r.Authorize(ctx, input.TrustCenterID, probo.ActionTrustCenterReferenceCreate) + if err != nil { return nil, types.AddTrustCenterReferenceOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.TrustCenterID) prb := r.proboSvc var websiteURL string @@ -4944,11 +4784,10 @@ func (r *Resolver) AddTrustCenterReferenceTool(ctx context.Context, req *mcp.Cal // UpdateTrustCenterReferenceTool handles the updateTrustCenterReference tool // Update a trust center reference func (r *Resolver) UpdateTrustCenterReferenceTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateTrustCenterReferenceInput) (*mcp.CallToolResult, types.UpdateTrustCenterReferenceOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionTrustCenterReferenceUpdate); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionTrustCenterReferenceUpdate) + if err != nil { return nil, types.UpdateTrustCenterReferenceOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc updateRefReq := &probo.UpdateTrustCenterReferenceRequest{ @@ -4978,14 +4817,13 @@ func (r *Resolver) UpdateTrustCenterReferenceTool(ctx context.Context, req *mcp. // DeleteTrustCenterReferenceTool handles the deleteTrustCenterReference tool // Delete a trust center reference func (r *Resolver) DeleteTrustCenterReferenceTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteTrustCenterReferenceInput) (*mcp.CallToolResult, types.DeleteTrustCenterReferenceOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionTrustCenterReferenceDelete); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionTrustCenterReferenceDelete) + if err != nil { return nil, types.DeleteTrustCenterReferenceOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc - err := prb.TrustCenterReferences.Delete(ctx, scope, input.ID) + err = prb.TrustCenterReferences.Delete(ctx, scope, input.ID) if err != nil { return nil, types.DeleteTrustCenterReferenceOutput{}, fmt.Errorf("cannot delete trust center reference: %w", err) } @@ -4996,11 +4834,10 @@ func (r *Resolver) DeleteTrustCenterReferenceTool(ctx context.Context, req *mcp. // ListTrustCenterFilesTool handles the listTrustCenterFiles tool // List all files for the trust center func (r *Resolver) ListTrustCenterFilesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListTrustCenterFilesInput) (*mcp.CallToolResult, types.ListTrustCenterFilesOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionTrustCenterFileList); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionTrustCenterFileList) + if err != nil { return nil, types.ListTrustCenterFilesOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.TrustCenterFileOrderField]{ @@ -5038,14 +4875,13 @@ func (r *Resolver) ListTrustCenterFilesTool(ctx context.Context, req *mcp.CallTo // DeleteTrustCenterFileTool handles the deleteTrustCenterFile tool // Delete a trust center file func (r *Resolver) DeleteTrustCenterFileTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteTrustCenterFileInput) (*mcp.CallToolResult, types.DeleteTrustCenterFileOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionTrustCenterFileDelete); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionTrustCenterFileDelete) + if err != nil { return nil, types.DeleteTrustCenterFileOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc - err := prb.TrustCenterFiles.Delete(ctx, scope, input.ID) + err = prb.TrustCenterFiles.Delete(ctx, scope, input.ID) if err != nil { return nil, types.DeleteTrustCenterFileOutput{}, fmt.Errorf("cannot delete trust center file: %w", err) } @@ -5056,11 +4892,10 @@ func (r *Resolver) DeleteTrustCenterFileTool(ctx context.Context, req *mcp.CallT // ListComplianceExternalURLsTool handles the listComplianceExternalURLs tool // List all external URLs for a trust center func (r *Resolver) ListComplianceExternalURLsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListComplianceExternalURLsInput) (*mcp.CallToolResult, types.ListComplianceExternalURLsOutput, error) { - if err := r.Authorize(ctx, input.TrustCenterID, probo.ActionComplianceExternalURLList); err != nil { + scope, err := r.Authorize(ctx, input.TrustCenterID, probo.ActionComplianceExternalURLList) + if err != nil { return nil, types.ListComplianceExternalURLsOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.TrustCenterID) prb := r.proboSvc pageOrderBy := page.OrderBy[coredata.ComplianceExternalURLOrderField]{ @@ -5087,11 +4922,10 @@ func (r *Resolver) ListComplianceExternalURLsTool(ctx context.Context, req *mcp. // AddComplianceExternalURLTool handles the addComplianceExternalURL tool // Add a new external URL to the trust center func (r *Resolver) AddComplianceExternalURLTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddComplianceExternalURLInput) (*mcp.CallToolResult, types.AddComplianceExternalURLOutput, error) { - if err := r.Authorize(ctx, input.TrustCenterID, probo.ActionComplianceExternalURLCreate); err != nil { + scope, err := r.Authorize(ctx, input.TrustCenterID, probo.ActionComplianceExternalURLCreate) + if err != nil { return nil, types.AddComplianceExternalURLOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.TrustCenterID) prb := r.proboSvc item, err := prb.ComplianceExternalURLs.Create( @@ -5112,11 +4946,10 @@ func (r *Resolver) AddComplianceExternalURLTool(ctx context.Context, req *mcp.Ca // UpdateComplianceExternalURLTool handles the updateComplianceExternalURL tool // Update a compliance external URL func (r *Resolver) UpdateComplianceExternalURLTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateComplianceExternalURLInput) (*mcp.CallToolResult, types.UpdateComplianceExternalURLOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionComplianceExternalURLUpdate); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionComplianceExternalURLUpdate) + if err != nil { return nil, types.UpdateComplianceExternalURLOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc updateURLReq := &probo.UpdateComplianceExternalURLRequest{ @@ -5146,14 +4979,13 @@ func (r *Resolver) UpdateComplianceExternalURLTool(ctx context.Context, req *mcp // DeleteComplianceExternalURLTool handles the deleteComplianceExternalURL tool // Delete a compliance external URL func (r *Resolver) DeleteComplianceExternalURLTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteComplianceExternalURLInput) (*mcp.CallToolResult, types.DeleteComplianceExternalURLOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionComplianceExternalURLDelete); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionComplianceExternalURLDelete) + if err != nil { return nil, types.DeleteComplianceExternalURLOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) prb := r.proboSvc - err := prb.ComplianceExternalURLs.Delete( + err = prb.ComplianceExternalURLs.Delete( ctx, scope, &probo.DeleteComplianceExternalURLRequest{ ID: input.ID, @@ -5169,11 +5001,10 @@ func (r *Resolver) DeleteComplianceExternalURLTool(ctx context.Context, req *mcp // CreateCustomDomainTool handles the createCustomDomain tool // Create a custom domain for the organization func (r *Resolver) CreateCustomDomainTool(ctx context.Context, req *mcp.CallToolRequest, input *types.CreateCustomDomainInput) (*mcp.CallToolResult, types.CreateCustomDomainOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionCustomDomainCreate); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionCustomDomainCreate) + if err != nil { return nil, types.CreateCustomDomainOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.proboSvc domain, err := prb.CustomDomains.CreateCustomDomain( @@ -5193,11 +5024,10 @@ func (r *Resolver) CreateCustomDomainTool(ctx context.Context, req *mcp.CallTool // DeleteCustomDomainTool handles the deleteCustomDomain tool // Delete the custom domain for the organization func (r *Resolver) DeleteCustomDomainTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteCustomDomainInput) (*mcp.CallToolResult, types.DeleteCustomDomainOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionCustomDomainDelete); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionCustomDomainDelete) + if err != nil { return nil, types.DeleteCustomDomainOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) prb := r.proboSvc domain, err := prb.CustomDomains.GetOrganizationCustomDomain(ctx, scope, input.OrganizationID) @@ -5219,11 +5049,10 @@ func (r *Resolver) DeleteCustomDomainTool(ctx context.Context, req *mcp.CallTool } func (r *Resolver) AssessThirdPartyTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AssessThirdPartyInput) (*mcp.CallToolResult, types.AssessThirdPartyOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionThirdPartyAssess); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionThirdPartyAssess) + if err != nil { return nil, types.AssessThirdPartyOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) svc := r.proboSvc result, err := svc.ThirdParties.Assess( @@ -5242,11 +5071,10 @@ func (r *Resolver) AssessThirdPartyTool(ctx context.Context, req *mcp.CallToolRe } func (r *Resolver) PublishFindingListTool(ctx context.Context, req *mcp.CallToolRequest, input *types.PublishFindingListInput) (*mcp.CallToolResult, types.PublishFindingListOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionFindingPublish); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionFindingPublish) + if err != nil { return nil, types.PublishFindingListOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) svc := r.proboSvc document, documentVersion, err := svc.GeneratedDocuments.PublishFindingList(ctx, scope, input.OrganizationID, input.ApproverIds, input.Minor) @@ -5261,11 +5089,10 @@ func (r *Resolver) PublishFindingListTool(ctx context.Context, req *mcp.CallTool } func (r *Resolver) PublishObligationListTool(ctx context.Context, req *mcp.CallToolRequest, input *types.PublishObligationListInput) (*mcp.CallToolResult, types.PublishObligationListOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionObligationPublish); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionObligationPublish) + if err != nil { return nil, types.PublishObligationListOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) svc := r.proboSvc document, documentVersion, err := svc.GeneratedDocuments.PublishObligationList(ctx, scope, input.OrganizationID, input.ApproverIds, input.Minor) @@ -5280,11 +5107,10 @@ func (r *Resolver) PublishObligationListTool(ctx context.Context, req *mcp.CallT } func (r *Resolver) PublishProcessingActivityListTool(ctx context.Context, req *mcp.CallToolRequest, input *types.PublishProcessingActivityListInput) (*mcp.CallToolResult, types.PublishProcessingActivityListOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionProcessingActivityPublish); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionProcessingActivityPublish) + if err != nil { return nil, types.PublishProcessingActivityListOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) svc := r.proboSvc document, documentVersion, err := svc.GeneratedDocuments.PublishProcessingActivityList(ctx, scope, input.OrganizationID, input.ApproverIds, input.Minor) @@ -5299,11 +5125,10 @@ func (r *Resolver) PublishProcessingActivityListTool(ctx context.Context, req *m } func (r *Resolver) PublishDataProtectionImpactAssessmentListTool(ctx context.Context, req *mcp.CallToolRequest, input *types.PublishDataProtectionImpactAssessmentListInput) (*mcp.CallToolResult, types.PublishDataProtectionImpactAssessmentListOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionDataProtectionImpactAssessmentPublish); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionDataProtectionImpactAssessmentPublish) + if err != nil { return nil, types.PublishDataProtectionImpactAssessmentListOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) svc := r.proboSvc document, documentVersion, err := svc.GeneratedDocuments.PublishDataProtectionImpactAssessmentList(ctx, scope, input.OrganizationID, input.ApproverIds, input.Minor) @@ -5318,11 +5143,10 @@ func (r *Resolver) PublishDataProtectionImpactAssessmentListTool(ctx context.Con } func (r *Resolver) PublishTransferImpactAssessmentListTool(ctx context.Context, req *mcp.CallToolRequest, input *types.PublishTransferImpactAssessmentListInput) (*mcp.CallToolResult, types.PublishTransferImpactAssessmentListOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionTransferImpactAssessmentPublish); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionTransferImpactAssessmentPublish) + if err != nil { return nil, types.PublishTransferImpactAssessmentListOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) svc := r.proboSvc document, documentVersion, err := svc.GeneratedDocuments.PublishTransferImpactAssessmentList(ctx, scope, input.OrganizationID, input.ApproverIds, input.Minor) @@ -5337,11 +5161,10 @@ func (r *Resolver) PublishTransferImpactAssessmentListTool(ctx context.Context, } func (r *Resolver) PublishThirdPartyListTool(ctx context.Context, req *mcp.CallToolRequest, input *types.PublishThirdPartyListInput) (*mcp.CallToolResult, types.PublishThirdPartyListOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionThirdPartyPublish); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionThirdPartyPublish) + if err != nil { return nil, types.PublishThirdPartyListOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) svc := r.proboSvc document, documentVersion, err := svc.GeneratedDocuments.PublishThirdPartyList(ctx, scope, input.OrganizationID, input.ApproverIds, input.Minor) @@ -5356,7 +5179,7 @@ func (r *Resolver) PublishThirdPartyListTool(ctx context.Context, req *mcp.CallT } func (r *Resolver) ListCookieBannersTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListCookieBannersInput) (*mcp.CallToolResult, types.ListCookieBannersOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionCookieBannerList); err != nil { + if _, err := r.Authorize(ctx, input.OrganizationID, probo.ActionCookieBannerList); err != nil { return nil, types.ListCookieBannersOutput{}, err } scope := coredata.NewScopeFromObjectID(input.OrganizationID) @@ -5373,7 +5196,7 @@ func (r *Resolver) ListCookieBannersTool(ctx context.Context, req *mcp.CallToolR } func (r *Resolver) GetCookieBannerTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetCookieBannerInput) (*mcp.CallToolResult, types.GetCookieBannerOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionCookieBannerGet); err != nil { + if _, err := r.Authorize(ctx, input.ID, probo.ActionCookieBannerGet); err != nil { return nil, types.GetCookieBannerOutput{}, err } scope := coredata.NewScopeFromObjectID(input.ID) @@ -5387,7 +5210,7 @@ func (r *Resolver) GetCookieBannerTool(ctx context.Context, req *mcp.CallToolReq } func (r *Resolver) AddCookieBannerTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddCookieBannerInput) (*mcp.CallToolResult, types.AddCookieBannerOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionCookieBannerCreate); err != nil { + if _, err := r.Authorize(ctx, input.OrganizationID, probo.ActionCookieBannerCreate); err != nil { return nil, types.AddCookieBannerOutput{}, err } scope := coredata.NewScopeFromObjectID(input.OrganizationID) @@ -5408,7 +5231,7 @@ func (r *Resolver) AddCookieBannerTool(ctx context.Context, req *mcp.CallToolReq } func (r *Resolver) UpdateCookieBannerTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateCookieBannerInput) (*mcp.CallToolResult, types.UpdateCookieBannerOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionCookieBannerUpdate); err != nil { + if _, err := r.Authorize(ctx, input.ID, probo.ActionCookieBannerUpdate); err != nil { return nil, types.UpdateCookieBannerOutput{}, err } scope := coredata.NewScopeFromObjectID(input.ID) @@ -5443,11 +5266,10 @@ func (r *Resolver) UpdateCookieBannerTool(ctx context.Context, req *mcp.CallTool } func (r *Resolver) DeleteCookieBannerTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteCookieBannerInput) (*mcp.CallToolResult, types.DeleteCookieBannerOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionCookieBannerDelete); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionCookieBannerDelete) + if err != nil { return nil, types.DeleteCookieBannerOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) if err := r.cookieBanner.DeleteCookieBanner(ctx, scope, input.ID); err != nil { return nil, types.DeleteCookieBannerOutput{}, fmt.Errorf("cannot delete cookie banner: %w", err) } @@ -5456,7 +5278,7 @@ func (r *Resolver) DeleteCookieBannerTool(ctx context.Context, req *mcp.CallTool } func (r *Resolver) ActivateCookieBannerTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ActivateCookieBannerInput) (*mcp.CallToolResult, types.ActivateCookieBannerOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionCookieBannerActivate); err != nil { + if _, err := r.Authorize(ctx, input.ID, probo.ActionCookieBannerActivate); err != nil { return nil, types.ActivateCookieBannerOutput{}, err } scope := coredata.NewScopeFromObjectID(input.ID) @@ -5470,7 +5292,7 @@ func (r *Resolver) ActivateCookieBannerTool(ctx context.Context, req *mcp.CallTo } func (r *Resolver) DeactivateCookieBannerTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeactivateCookieBannerInput) (*mcp.CallToolResult, types.DeactivateCookieBannerOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionCookieBannerDeactivate); err != nil { + if _, err := r.Authorize(ctx, input.ID, probo.ActionCookieBannerDeactivate); err != nil { return nil, types.DeactivateCookieBannerOutput{}, err } scope := coredata.NewScopeFromObjectID(input.ID) @@ -5484,7 +5306,7 @@ func (r *Resolver) DeactivateCookieBannerTool(ctx context.Context, req *mcp.Call } func (r *Resolver) ListCookieCategoriesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListCookieCategoriesInput) (*mcp.CallToolResult, types.ListCookieCategoriesOutput, error) { - if err := r.Authorize(ctx, input.CookieBannerID, probo.ActionCookieCategoryList); err != nil { + if _, err := r.Authorize(ctx, input.CookieBannerID, probo.ActionCookieCategoryList); err != nil { return nil, types.ListCookieCategoriesOutput{}, err } scope := coredata.NewScopeFromObjectID(input.CookieBannerID) @@ -5501,7 +5323,7 @@ func (r *Resolver) ListCookieCategoriesTool(ctx context.Context, req *mcp.CallTo } func (r *Resolver) GetCookieCategoryTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetCookieCategoryInput) (*mcp.CallToolResult, types.GetCookieCategoryOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionCookieCategoryGet); err != nil { + if _, err := r.Authorize(ctx, input.ID, probo.ActionCookieCategoryGet); err != nil { return nil, types.GetCookieCategoryOutput{}, err } scope := coredata.NewScopeFromObjectID(input.ID) @@ -5515,7 +5337,7 @@ func (r *Resolver) GetCookieCategoryTool(ctx context.Context, req *mcp.CallToolR } func (r *Resolver) AddCookieCategoryTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddCookieCategoryInput) (*mcp.CallToolResult, types.AddCookieCategoryOutput, error) { - if err := r.Authorize(ctx, input.CookieBannerID, probo.ActionCookieCategoryCreate); err != nil { + if _, err := r.Authorize(ctx, input.CookieBannerID, probo.ActionCookieCategoryCreate); err != nil { return nil, types.AddCookieCategoryOutput{}, err } scope := coredata.NewScopeFromObjectID(input.CookieBannerID) @@ -5535,7 +5357,7 @@ func (r *Resolver) AddCookieCategoryTool(ctx context.Context, req *mcp.CallToolR } func (r *Resolver) UpdateCookieCategoryTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateCookieCategoryInput) (*mcp.CallToolResult, types.UpdateCookieCategoryOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionCookieCategoryUpdate); err != nil { + if _, err := r.Authorize(ctx, input.ID, probo.ActionCookieCategoryUpdate); err != nil { return nil, types.UpdateCookieCategoryOutput{}, err } scope := coredata.NewScopeFromObjectID(input.ID) @@ -5562,11 +5384,10 @@ func (r *Resolver) UpdateCookieCategoryTool(ctx context.Context, req *mcp.CallTo } func (r *Resolver) DeleteCookieCategoryTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteCookieCategoryInput) (*mcp.CallToolResult, types.DeleteCookieCategoryOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionCookieCategoryDelete); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionCookieCategoryDelete) + if err != nil { return nil, types.DeleteCookieCategoryOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) if err := r.cookieBanner.DeleteCookieCategory(ctx, scope, input.ID); err != nil { return nil, types.DeleteCookieCategoryOutput{}, fmt.Errorf("cannot delete cookie category: %w", err) } @@ -5575,7 +5396,7 @@ func (r *Resolver) DeleteCookieCategoryTool(ctx context.Context, req *mcp.CallTo } func (r *Resolver) ReorderCookieCategoryTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ReorderCookieCategoryInput) (*mcp.CallToolResult, types.ReorderCookieCategoryOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionCookieCategoryUpdate); err != nil { + if _, err := r.Authorize(ctx, input.ID, probo.ActionCookieCategoryUpdate); err != nil { return nil, types.ReorderCookieCategoryOutput{}, err } scope := coredata.NewScopeFromObjectID(input.ID) @@ -5597,7 +5418,7 @@ func (r *Resolver) ReorderCookieCategoryTool(ctx context.Context, req *mcp.CallT } func (r *Resolver) ListTrackerPatternsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListTrackerPatternsInput) (*mcp.CallToolResult, types.ListTrackerPatternsOutput, error) { - if err := r.Authorize(ctx, input.CookieCategoryID, probo.ActionTrackerPatternList); err != nil { + if _, err := r.Authorize(ctx, input.CookieCategoryID, probo.ActionTrackerPatternList); err != nil { return nil, types.ListTrackerPatternsOutput{}, err } scope := coredata.NewScopeFromObjectID(input.CookieCategoryID) @@ -5614,7 +5435,7 @@ func (r *Resolver) ListTrackerPatternsTool(ctx context.Context, req *mcp.CallToo } func (r *Resolver) GetTrackerPatternTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetTrackerPatternInput) (*mcp.CallToolResult, types.GetTrackerPatternOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionTrackerPatternGet); err != nil { + if _, err := r.Authorize(ctx, input.ID, probo.ActionTrackerPatternGet); err != nil { return nil, types.GetTrackerPatternOutput{}, err } scope := coredata.NewScopeFromObjectID(input.ID) @@ -5628,7 +5449,7 @@ func (r *Resolver) GetTrackerPatternTool(ctx context.Context, req *mcp.CallToolR } func (r *Resolver) AddTrackerPatternTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddTrackerPatternInput) (*mcp.CallToolResult, types.AddTrackerPatternOutput, error) { - if err := r.Authorize(ctx, input.CookieCategoryID, probo.ActionTrackerPatternCreate); err != nil { + if _, err := r.Authorize(ctx, input.CookieCategoryID, probo.ActionTrackerPatternCreate); err != nil { return nil, types.AddTrackerPatternOutput{}, err } scope := coredata.NewScopeFromObjectID(input.CookieCategoryID) @@ -5650,7 +5471,7 @@ func (r *Resolver) AddTrackerPatternTool(ctx context.Context, req *mcp.CallToolR } func (r *Resolver) UpdateTrackerPatternTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateTrackerPatternInput) (*mcp.CallToolResult, types.UpdateTrackerPatternOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionTrackerPatternUpdate); err != nil { + if _, err := r.Authorize(ctx, input.ID, probo.ActionTrackerPatternUpdate); err != nil { return nil, types.UpdateTrackerPatternOutput{}, err } scope := coredata.NewScopeFromObjectID(input.ID) @@ -5678,11 +5499,10 @@ func (r *Resolver) UpdateTrackerPatternTool(ctx context.Context, req *mcp.CallTo } func (r *Resolver) DeleteTrackerPatternTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteTrackerPatternInput) (*mcp.CallToolResult, types.DeleteTrackerPatternOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionTrackerPatternDelete); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionTrackerPatternDelete) + if err != nil { return nil, types.DeleteTrackerPatternOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) if err := r.cookieBanner.DeleteTrackerPattern(ctx, scope, input.ID); err != nil { return nil, types.DeleteTrackerPatternOutput{}, fmt.Errorf("cannot delete tracker pattern: %w", err) } @@ -5691,7 +5511,7 @@ func (r *Resolver) DeleteTrackerPatternTool(ctx context.Context, req *mcp.CallTo } func (r *Resolver) MoveTrackerPatternToCategoryTool(ctx context.Context, req *mcp.CallToolRequest, input *types.MoveTrackerPatternToCategoryInput) (*mcp.CallToolResult, types.MoveTrackerPatternToCategoryOutput, error) { - if err := r.Authorize(ctx, input.TrackerPatternID, probo.ActionTrackerPatternUpdate); err != nil { + if _, err := r.Authorize(ctx, input.TrackerPatternID, probo.ActionTrackerPatternUpdate); err != nil { return nil, types.MoveTrackerPatternToCategoryOutput{}, err } scope := coredata.NewScopeFromObjectID(input.TrackerPatternID) @@ -5708,7 +5528,7 @@ func (r *Resolver) MoveTrackerPatternToCategoryTool(ctx context.Context, req *mc } func (r *Resolver) PublishCookieBannerVersionTool(ctx context.Context, req *mcp.CallToolRequest, input *types.PublishCookieBannerVersionInput) (*mcp.CallToolResult, types.PublishCookieBannerVersionOutput, error) { - if err := r.Authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerVersionPublish); err != nil { + if _, err := r.Authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerVersionPublish); err != nil { return nil, types.PublishCookieBannerVersionOutput{}, err } scope := coredata.NewScopeFromObjectID(input.CookieBannerID) @@ -5722,7 +5542,7 @@ func (r *Resolver) PublishCookieBannerVersionTool(ctx context.Context, req *mcp. } func (r *Resolver) ListCookieBannerVersionsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListCookieBannerVersionsInput) (*mcp.CallToolResult, types.ListCookieBannerVersionsOutput, error) { - if err := r.Authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerVersionList); err != nil { + if _, err := r.Authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerVersionList); err != nil { return nil, types.ListCookieBannerVersionsOutput{}, err } scope := coredata.NewScopeFromObjectID(input.CookieBannerID) @@ -5739,7 +5559,7 @@ func (r *Resolver) ListCookieBannerVersionsTool(ctx context.Context, req *mcp.Ca } func (r *Resolver) UpsertCookieBannerTranslationTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpsertCookieBannerTranslationInput) (*mcp.CallToolResult, types.UpsertCookieBannerTranslationOutput, error) { - if err := r.Authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerUpdate); err != nil { + if _, err := r.Authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerUpdate); err != nil { return nil, types.UpsertCookieBannerTranslationOutput{}, err } scope := coredata.NewScopeFromObjectID(input.CookieBannerID) @@ -5757,7 +5577,7 @@ func (r *Resolver) UpsertCookieBannerTranslationTool(ctx context.Context, req *m } func (r *Resolver) ListCookieConsentRecordsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListCookieConsentRecordsInput) (*mcp.CallToolResult, types.ListCookieConsentRecordsOutput, error) { - if err := r.Authorize(ctx, input.CookieBannerID, probo.ActionCookieConsentRecordList); err != nil { + if _, err := r.Authorize(ctx, input.CookieBannerID, probo.ActionCookieConsentRecordList); err != nil { return nil, types.ListCookieConsentRecordsOutput{}, err } scope := coredata.NewScopeFromObjectID(input.CookieBannerID) @@ -5783,7 +5603,7 @@ func (r *Resolver) ListCookieConsentRecordsTool(ctx context.Context, req *mcp.Ca } func (r *Resolver) GetCookieConsentRecordTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetCookieConsentRecordInput) (*mcp.CallToolResult, types.GetCookieConsentRecordOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionCookieConsentRecordList); err != nil { + if _, err := r.Authorize(ctx, input.ID, probo.ActionCookieConsentRecordList); err != nil { return nil, types.GetCookieConsentRecordOutput{}, err } scope := coredata.NewScopeFromObjectID(input.ID) @@ -5797,11 +5617,10 @@ func (r *Resolver) GetCookieConsentRecordTool(ctx context.Context, req *mcp.Call } func (r *Resolver) PublishRiskListTool(ctx context.Context, req *mcp.CallToolRequest, input *types.PublishRiskListInput) (*mcp.CallToolResult, types.PublishRiskListOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, probo.ActionRiskPublish); err != nil { + scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionRiskPublish) + if err != nil { return nil, types.PublishRiskListOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.OrganizationID) svc := r.proboSvc document, documentVersion, err := svc.GeneratedDocuments.PublishRiskList(ctx, scope, input.OrganizationID, input.ApproverIds, input.Minor) @@ -5816,7 +5635,7 @@ func (r *Resolver) PublishRiskListTool(ctx context.Context, req *mcp.CallToolReq } func (r *Resolver) GetSCIMConfigurationTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetSCIMConfigurationInput) (*mcp.CallToolResult, types.GetSCIMConfigurationOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, iam.ActionSCIMConfigurationGet); err != nil { + if _, err := r.Authorize(ctx, input.OrganizationID, iam.ActionSCIMConfigurationGet); err != nil { return nil, types.GetSCIMConfigurationOutput{}, err } @@ -5833,7 +5652,7 @@ func (r *Resolver) GetSCIMConfigurationTool(ctx context.Context, req *mcp.CallTo } func (r *Resolver) CreateSCIMConfigurationTool(ctx context.Context, req *mcp.CallToolRequest, input *types.CreateSCIMConfigurationInput) (*mcp.CallToolResult, types.CreateSCIMConfigurationOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, iam.ActionSCIMConfigurationCreate); err != nil { + if _, err := r.Authorize(ctx, input.OrganizationID, iam.ActionSCIMConfigurationCreate); err != nil { return nil, types.CreateSCIMConfigurationOutput{}, err } @@ -5860,7 +5679,7 @@ func (r *Resolver) CreateSCIMConfigurationTool(ctx context.Context, req *mcp.Cal } func (r *Resolver) DeleteSCIMConfigurationTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteSCIMConfigurationInput) (*mcp.CallToolResult, types.DeleteSCIMConfigurationOutput, error) { - if err := r.Authorize(ctx, input.OrganizationID, iam.ActionSCIMConfigurationDelete); err != nil { + if _, err := r.Authorize(ctx, input.OrganizationID, iam.ActionSCIMConfigurationDelete); err != nil { return nil, types.DeleteSCIMConfigurationOutput{}, err } @@ -5873,7 +5692,7 @@ func (r *Resolver) DeleteSCIMConfigurationTool(ctx context.Context, req *mcp.Cal } func (r *Resolver) RegenerateSCIMTokenTool(ctx context.Context, req *mcp.CallToolRequest, input *types.RegenerateSCIMTokenInput) (*mcp.CallToolResult, types.RegenerateSCIMTokenOutput, error) { - if err := r.Authorize(ctx, input.ScimConfigurationID, iam.ActionSCIMConfigurationUpdate); err != nil { + if _, err := r.Authorize(ctx, input.ScimConfigurationID, iam.ActionSCIMConfigurationUpdate); err != nil { return nil, types.RegenerateSCIMTokenOutput{}, err } @@ -5889,7 +5708,7 @@ func (r *Resolver) RegenerateSCIMTokenTool(ctx context.Context, req *mcp.CallToo } func (r *Resolver) GetSCIMBridgeTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetSCIMBridgeInput) (*mcp.CallToolResult, types.GetSCIMBridgeOutput, error) { - if err := r.Authorize(ctx, input.ID, iam.ActionSCIMBridgeGet); err != nil { + if _, err := r.Authorize(ctx, input.ID, iam.ActionSCIMBridgeGet); err != nil { return nil, types.GetSCIMBridgeOutput{}, err } @@ -5906,7 +5725,7 @@ func (r *Resolver) GetSCIMBridgeTool(ctx context.Context, req *mcp.CallToolReque } func (r *Resolver) UpdateSCIMBridgeTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateSCIMBridgeInput) (*mcp.CallToolResult, types.UpdateSCIMBridgeOutput, error) { - if err := r.Authorize(ctx, input.ScimBridgeID, iam.ActionSCIMBridgeUpdate); err != nil { + if _, err := r.Authorize(ctx, input.ScimBridgeID, iam.ActionSCIMBridgeUpdate); err != nil { return nil, types.UpdateSCIMBridgeOutput{}, err } @@ -5919,7 +5738,7 @@ func (r *Resolver) UpdateSCIMBridgeTool(ctx context.Context, req *mcp.CallToolRe } func (r *Resolver) ListSCIMEventsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListSCIMEventsInput) (*mcp.CallToolResult, types.ListSCIMEventsOutput, error) { - if err := r.Authorize(ctx, input.ScimConfigurationID, iam.ActionSCIMEventList); err != nil { + if _, err := r.Authorize(ctx, input.ScimConfigurationID, iam.ActionSCIMEventList); err != nil { return nil, types.ListSCIMEventsOutput{}, err } @@ -5950,11 +5769,10 @@ func (r *Resolver) PublishDocumentTool(ctx context.Context, req *mcp.CallToolReq action = probo.ActionDocumentVersionRequestApproval } - if err := r.Authorize(ctx, input.DocumentID, action); err != nil { + scope, err := r.Authorize(ctx, input.DocumentID, action) + if err != nil { return nil, types.PublishDocumentOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.DocumentID) svc := r.proboSvc result, err := svc.Documents.PublishVersion(ctx, scope, probo.PublishDocumentRequest{ @@ -5979,7 +5797,7 @@ func (r *Resolver) PublishDocumentTool(ctx context.Context, req *mcp.CallToolReq } func (r *Resolver) ListTrackerResourcesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListTrackerResourcesInput) (*mcp.CallToolResult, types.ListTrackerResourcesOutput, error) { - if err := r.Authorize(ctx, input.CookieCategoryID, probo.ActionTrackerResourceList); err != nil { + if _, err := r.Authorize(ctx, input.CookieCategoryID, probo.ActionTrackerResourceList); err != nil { return nil, types.ListTrackerResourcesOutput{}, err } scope := coredata.NewScopeFromObjectID(input.CookieCategoryID) @@ -5996,7 +5814,7 @@ func (r *Resolver) ListTrackerResourcesTool(ctx context.Context, req *mcp.CallTo } func (r *Resolver) GetTrackerResourceTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetTrackerResourceInput) (*mcp.CallToolResult, types.GetTrackerResourceOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionTrackerResourceGet); err != nil { + if _, err := r.Authorize(ctx, input.ID, probo.ActionTrackerResourceGet); err != nil { return nil, types.GetTrackerResourceOutput{}, err } scope := coredata.NewScopeFromObjectID(input.ID) @@ -6010,7 +5828,7 @@ func (r *Resolver) GetTrackerResourceTool(ctx context.Context, req *mcp.CallTool } func (r *Resolver) AddTrackerResourceTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddTrackerResourceInput) (*mcp.CallToolResult, types.AddTrackerResourceOutput, error) { - if err := r.Authorize(ctx, input.CookieCategoryID, probo.ActionTrackerResourceCreate); err != nil { + if _, err := r.Authorize(ctx, input.CookieCategoryID, probo.ActionTrackerResourceCreate); err != nil { return nil, types.AddTrackerResourceOutput{}, err } scope := coredata.NewScopeFromObjectID(input.CookieCategoryID) @@ -6036,7 +5854,7 @@ func (r *Resolver) AddTrackerResourceTool(ctx context.Context, req *mcp.CallTool } func (r *Resolver) UpdateTrackerResourceTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateTrackerResourceInput) (*mcp.CallToolResult, types.UpdateTrackerResourceOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionTrackerResourceUpdate); err != nil { + if _, err := r.Authorize(ctx, input.ID, probo.ActionTrackerResourceUpdate); err != nil { return nil, types.UpdateTrackerResourceOutput{}, err } scope := coredata.NewScopeFromObjectID(input.ID) @@ -6063,11 +5881,10 @@ func (r *Resolver) UpdateTrackerResourceTool(ctx context.Context, req *mcp.CallT } func (r *Resolver) DeleteTrackerResourceTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteTrackerResourceInput) (*mcp.CallToolResult, types.DeleteTrackerResourceOutput, error) { - if err := r.Authorize(ctx, input.ID, probo.ActionTrackerResourceDelete); err != nil { + scope, err := r.Authorize(ctx, input.ID, probo.ActionTrackerResourceDelete) + if err != nil { return nil, types.DeleteTrackerResourceOutput{}, err } - - scope := coredata.NewScopeFromObjectID(input.ID) if err := r.cookieBanner.DeleteTrackerResource(ctx, scope, input.ID); err != nil { return nil, types.DeleteTrackerResourceOutput{}, fmt.Errorf("cannot delete tracker resource: %w", err) } @@ -6076,7 +5893,7 @@ func (r *Resolver) DeleteTrackerResourceTool(ctx context.Context, req *mcp.CallT } func (r *Resolver) MoveTrackerResourceToCategoryTool(ctx context.Context, req *mcp.CallToolRequest, input *types.MoveTrackerResourceToCategoryInput) (*mcp.CallToolResult, types.MoveTrackerResourceToCategoryOutput, error) { - if err := r.Authorize(ctx, input.TrackerResourceID, probo.ActionTrackerResourceUpdate); err != nil { + if _, err := r.Authorize(ctx, input.TrackerResourceID, probo.ActionTrackerResourceUpdate); err != nil { return nil, types.MoveTrackerResourceToCategoryOutput{}, err } scope := coredata.NewScopeFromObjectID(input.TrackerResourceID)