rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix bad id used to call authorize

Browse Source 
Signed-off-by: Bryan Frimin <bryan@probo.com>
This commit is contained in:
Bryan Frimin
2026-07-03 10:07:46 +02:00
parent 504cdc8f96
commit 7054540e9c
15 changed files with 74 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/server/api/connect/v1/scim_resolvers.go
View File

@@ -200,7 +200,7 @@ func (r *sCIMConfigurationResolver) Bridge(ctx context.Context, obj *types.SCIMC
return nil, nil
}
if _, err := r.authorize(ctx, obj.ID, iam.ActionSCIMConfigurationGet); err != nil {
if _, err := r.authorize(ctx, obj.Bridge.ID, iam.ActionSCIMConfigurationGet); err != nil {
return nil, err
}

4
pkg/server/api/console/v1/asset_resolvers.go
View File

@@ -25,7 +25,7 @@ import (
// Owner is the resolver for the owner field.
func (r *assetResolver) Owner(ctx context.Context, obj *types.Asset) (*types.Profile, error) {
if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
if _, err := r.authorize(ctx, obj.Owner.ID, iam.ActionMembershipProfileGet); err != nil {
return nil, err
}
@@ -132,7 +132,7 @@ func (r *assetConnectionResolver) TotalCount(ctx context.Context, obj *types.Ass
// Owner is the resolver for the owner field.
func (r *datumResolver) Owner(ctx context.Context, obj *types.Datum) (*types.Profile, error) {
if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
if _, err := r.authorize(ctx, obj.Owner.ID, iam.ActionMembershipProfileGet); err != nil {
return nil, err
}

14
pkg/server/api/console/v1/audit_resolvers.go
View File

@@ -47,7 +47,7 @@ func (r *auditResolver) Organization(ctx context.Context, obj *types.Audit) (*ty
// Framework is the resolver for the framework field.
func (r *auditResolver) Framework(ctx context.Context, obj *types.Audit) (*types.Framework, error) {
if _, err := r.authorize(ctx, obj.ID, probo.ActionFrameworkGet); err != nil {
if _, err := r.authorize(ctx, obj.Framework.ID, probo.ActionFrameworkGet); err != nil {
return nil, err
}
@@ -69,14 +69,14 @@ func (r *auditResolver) Framework(ctx context.Context, obj *types.Audit) (*types
// ReportFile is the resolver for the reportFile field.
func (r *auditResolver) ReportFile(ctx context.Context, obj *types.Audit) (*types.File, error) {
if _, err := r.authorize(ctx, obj.ID, probo.ActionReportGet); err != nil {
return nil, err
}
if obj.ReportFile == nil {
return nil, nil
}
if _, err := r.authorize(ctx, obj.ReportFile.ID, probo.ActionReportGet); err != nil {
return nil, err
}
loaders := dataloader.FromContext(ctx)
file, err := loaders.File.Load(ctx, obj.ReportFile.ID)
@@ -274,7 +274,7 @@ func (r *findingResolver) Owner(ctx context.Context, obj *types.Finding) (*types
return nil, nil
}
if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
if _, err := r.authorize(ctx, obj.Owner.ID, iam.ActionMembershipProfileGet); err != nil {
return nil, err
}
@@ -300,7 +300,7 @@ func (r *findingResolver) Risk(ctx context.Context, obj *types.Finding) (*types.
return nil, nil
}
if _, err := r.authorize(ctx, obj.ID, probo.ActionRiskGet); err != nil {
if _, err := r.authorize(ctx, obj.Risk.ID, probo.ActionRiskGet); err != nil {
return nil, err
}

10
pkg/server/api/console/v1/base_resolvers.go
View File

@@ -111,6 +111,16 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
return types.NewControl(control), nil
}
case coredata.ApplicabilityStatementEntityType:
action = probo.ActionApplicabilityStatementGet
loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) {
applicabilityStatement, err := r.probo.StatementsOfApplicability.GetApplicabilityStatement(ctx, scope, id)
if err != nil {
return nil, err
}
return types.NewApplicabilityStatement(applicabilityStatement), nil
}
case coredata.RiskEntityType:
action = probo.ActionRiskGet
loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) {

4
pkg/server/api/console/v1/control_resolvers.go
View File

@@ -40,7 +40,7 @@ func (r *applicabilityStatementResolver) StatementOfApplicability(ctx context.Co
// Control is the resolver for the control field.
func (r *applicabilityStatementResolver) Control(ctx context.Context, obj *types.ApplicabilityStatement) (*types.Control, error) {
if _, err := r.authorize(ctx, obj.ID, probo.ActionControlGet); err != nil {
if _, err := r.authorize(ctx, obj.Control.ID, probo.ActionControlGet); err != nil {
return nil, err
}
@@ -160,7 +160,7 @@ func (r *controlResolver) RiskAssessment(ctx context.Context, obj *types.Control
// Framework is the resolver for the framework field.
func (r *controlResolver) Framework(ctx context.Context, obj *types.Control) (*types.Framework, error) {
if _, err := r.authorize(ctx, obj.ID, probo.ActionFrameworkGet); err != nil {
if _, err := r.authorize(ctx, obj.Framework.ID, probo.ActionFrameworkGet); err != nil {
return nil, err
}

2
pkg/server/api/console/v1/cookie_banner_resolvers.go
View File

@@ -149,7 +149,7 @@ func (r *cookieBannerResolver) PolicyDocument(ctx context.Context, obj *types.Co
return nil, nil
}
if _, err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil {
if _, err := r.authorize(ctx, obj.PolicyDocument.ID, probo.ActionDocumentGet); err != nil {
return nil, err
}

6
pkg/server/api/console/v1/document_resolvers.go
View File

@@ -205,7 +205,7 @@ func (r *documentConnectionResolver) TotalCount(ctx context.Context, obj *types.
// Document is the resolver for the document field.
func (r *documentVersionResolver) Document(ctx context.Context, obj *types.DocumentVersion) (*types.Document, error) {
if _, err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil {
if _, err := r.authorize(ctx, obj.Document.ID, probo.ActionDocumentGet); err != nil {
return nil, err
}
@@ -420,7 +420,7 @@ func (r *documentVersionApprovalDecisionResolver) DocumentVersion(ctx context.Co
// Approver is the resolver for the approver field.
func (r *documentVersionApprovalDecisionResolver) Approver(ctx context.Context, obj *types.DocumentVersionApprovalDecision) (*types.Profile, error) {
if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
if _, err := r.authorize(ctx, obj.Approver.ID, iam.ActionMembershipProfileGet); err != nil {
return nil, err
}
@@ -621,7 +621,7 @@ func (r *documentVersionSignatureResolver) DocumentVersion(ctx context.Context,
// SignedBy is the resolver for the signedBy field.
func (r *documentVersionSignatureResolver) SignedBy(ctx context.Context, obj *types.DocumentVersionSignature) (*types.Profile, error) {
if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
if _, err := r.authorize(ctx, obj.SignedBy.ID, iam.ActionMembershipProfileGet); err != nil {
return nil, err
}

18
pkg/server/api/console/v1/evidence_resolvers.go
View File

@@ -22,14 +22,14 @@ import (
// File is the resolver for the file field.
func (r *evidenceResolver) File(ctx context.Context, obj *types.Evidence) (*types.File, error) {
if _, err := r.authorize(ctx, obj.ID, probo.ActionFileGet); err != nil {
return nil, err
}
if obj.File == nil {
return nil, nil
}
if _, err := r.authorize(ctx, obj.File.ID, probo.ActionFileGet); err != nil {
return nil, err
}
loaders := dataloader.FromContext(ctx)
file, err := loaders.File.Load(ctx, obj.File.ID)
@@ -48,15 +48,15 @@ func (r *evidenceResolver) File(ctx context.Context, obj *types.Evidence) (*type
// Task is the resolver for the task field.
func (r *evidenceResolver) Task(ctx context.Context, obj *types.Evidence) (*types.Task, error) {
if _, err := r.authorize(ctx, obj.ID, probo.ActionTaskGet); err != nil {
return nil, err
}
if obj.Task == nil {
r.logger.ErrorCtx(ctx, "evidence is not associated with a task")
return nil, gqlutils.Internal(ctx)
}
if _, err := r.authorize(ctx, obj.Task.ID, probo.ActionTaskGet); err != nil {
return nil, err
}
loaders := dataloader.FromContext(ctx)
task, err := loaders.Task.Load(ctx, obj.Task.ID)
@@ -75,7 +75,7 @@ func (r *evidenceResolver) Task(ctx context.Context, obj *types.Evidence) (*type
// Measure is the resolver for the measure field.
func (r *evidenceResolver) Measure(ctx context.Context, obj *types.Evidence) (*types.Measure, error) {
if _, err := r.authorize(ctx, obj.ID, probo.ActionMeasureGet); err != nil {
if _, err := r.authorize(ctx, obj.Measure.ID, probo.ActionMeasureGet); err != nil {
return nil, err
}

2
pkg/server/api/console/v1/obligation_resolvers.go
View File

@@ -160,7 +160,7 @@ func (r *obligationResolver) Organization(ctx context.Context, obj *types.Obliga
// Owner is the resolver for the owner field.
func (r *obligationResolver) Owner(ctx context.Context, obj *types.Obligation) (*types.Profile, error) {
if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
if _, err := r.authorize(ctx, obj.Owner.ID, iam.ActionMembershipProfileGet); err != nil {
return nil, err
}

8
pkg/server/api/console/v1/processing_activity_resolvers.go
View File

@@ -168,14 +168,14 @@ func (r *processingActivityResolver) Organization(ctx context.Context, obj *type
// DataProtectionOfficer is the resolver for the dataProtectionOfficer field.
func (r *processingActivityResolver) DataProtectionOfficer(ctx context.Context, obj *types.ProcessingActivity) (*types.Profile, error) {
if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
return nil, err
}
if obj.DataProtectionOfficer == nil {
return nil, nil
}
if _, err := r.authorize(ctx, obj.DataProtectionOfficer.ID, iam.ActionMembershipProfileGet); err != nil {
return nil, err
}
loaders := dataloader.FromContext(ctx)
dpo, err := loaders.Profile.Load(ctx, obj.DataProtectionOfficer.ID)

8
pkg/server/api/console/v1/risk_resolvers.go
View File

@@ -259,14 +259,14 @@ func (r *mutationResolver) PublishRiskList(ctx context.Context, input types.Publ
// Owner is the resolver for the owner field.
func (r *riskResolver) Owner(ctx context.Context, obj *types.Risk) (*types.Profile, error) {
if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
return nil, err
}
if obj.Owner == nil {
return nil, nil
}
if _, err := r.authorize(ctx, obj.Owner.ID, iam.ActionMembershipProfileGet); err != nil {
return nil, err
}
loaders := dataloader.FromContext(ctx)
owner, err := loaders.Profile.Load(ctx, obj.Owner.ID)

16
pkg/server/api/console/v1/task_resolvers.go
View File

@@ -117,14 +117,14 @@ func (r *mutationResolver) DeleteTask(ctx context.Context, input types.DeleteTas
// AssignedTo is the resolver for the assignedTo field.
func (r *taskResolver) AssignedTo(ctx context.Context, obj *types.Task) (*types.Profile, error) {
if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
return nil, err
}
if obj.AssignedTo == nil {
return nil, nil
}
if _, err := r.authorize(ctx, obj.AssignedTo.ID, iam.ActionMembershipProfileGet); err != nil {
return nil, err
}
loaders := dataloader.FromContext(ctx)
assignee, err := loaders.Profile.Load(ctx, obj.AssignedTo.ID)
@@ -165,14 +165,14 @@ func (r *taskResolver) Organization(ctx context.Context, obj *types.Task) (*type
// Measure is the resolver for the measure field.
func (r *taskResolver) Measure(ctx context.Context, obj *types.Task) (*types.Measure, error) {
if _, err := r.authorize(ctx, obj.ID, probo.ActionMeasureGet); err != nil {
return nil, err
}
if obj.Measure == nil {
return nil, nil
}
if _, err := r.authorize(ctx, obj.Measure.ID, probo.ActionMeasureGet); err != nil {
return nil, err
}
loaders := dataloader.FromContext(ctx)
measure, err := loaders.Measure.Load(ctx, obj.Measure.ID)

20
pkg/server/api/console/v1/third_party_resolvers.go
View File

@@ -857,14 +857,14 @@ func (r *thirdPartyResolver) Measures(ctx context.Context, obj *types.ThirdParty
// BusinessOwner is the resolver for the businessOwner field.
func (r *thirdPartyResolver) BusinessOwner(ctx context.Context, obj *types.ThirdParty) (*types.Profile, error) {
if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
return nil, err
}
if obj.BusinessOwner == nil {
return nil, nil
}
if _, err := r.authorize(ctx, obj.BusinessOwner.ID, iam.ActionMembershipProfileGet); err != nil {
return nil, err
}
loaders := dataloader.FromContext(ctx)
businessOwner, err := loaders.Profile.Load(ctx, obj.BusinessOwner.ID)
@@ -883,14 +883,14 @@ func (r *thirdPartyResolver) BusinessOwner(ctx context.Context, obj *types.Third
// SecurityOwner is the resolver for the securityOwner field.
func (r *thirdPartyResolver) SecurityOwner(ctx context.Context, obj *types.ThirdParty) (*types.Profile, error) {
if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
return nil, err
}
if obj.SecurityOwner == nil {
return nil, nil
}
if _, err := r.authorize(ctx, obj.SecurityOwner.ID, iam.ActionMembershipProfileGet); err != nil {
return nil, err
}
loaders := dataloader.FromContext(ctx)
securityOwner, err := loaders.Profile.Load(ctx, obj.SecurityOwner.ID)
@@ -913,7 +913,7 @@ func (r *thirdPartyResolver) ParentThirdParty(ctx context.Context, obj *types.Th
return nil, nil
}
if _, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyGet); err != nil {
if _, err := r.authorize(ctx, obj.ParentThirdParty.ID, probo.ActionThirdPartyGet); err != nil {
return nil, err
}
@@ -1249,7 +1249,7 @@ func (r *thirdPartyRiskAssessmentResolver) Permission(ctx context.Context, obj *
// ThirdParty is the resolver for the thirdParty field.
func (r *thirdPartyServiceResolver) ThirdParty(ctx context.Context, obj *types.ThirdPartyService) (*types.ThirdParty, error) {
if _, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyGet); err != nil {
if _, err := r.authorize(ctx, obj.ThirdParty.ID, probo.ActionThirdPartyGet); err != nil {
return nil, err
}

8
pkg/server/api/console/v1/trust_center_resolvers.go
View File

@@ -1044,14 +1044,14 @@ func (r *trustCenterDocumentAccessResolver) Document(ctx context.Context, obj *t
// ReportFile is the resolver for the reportFile field.
func (r *trustCenterDocumentAccessResolver) ReportFile(ctx context.Context, obj *types.TrustCenterDocumentAccess) (*types.File, error) {
if _, err := r.authorize(ctx, obj.ID, probo.ActionFileGet); err != nil {
return nil, err
}
if obj.ReportFile == nil {
return nil, nil
}
if _, err := r.authorize(ctx, obj.ReportFile.ID, probo.ActionFileGet); err != nil {
return nil, err
}
loaders := dataloader.FromContext(ctx)
file, err := loaders.File.Load(ctx, obj.ReportFile.ID)

8
pkg/server/api/mcp/v1/schema.resolvers.go
View File

@@ -5807,6 +5807,10 @@ func (r *Resolver) MoveTrackerPatternToCategoryTool(ctx context.Context, req *mc
return nil, types.MoveTrackerPatternToCategoryOutput{}, err
}
if _, err := r.Authorize(ctx, input.TargetCookieCategoryID, probo.ActionCookieCategoryUpdate); err != nil {
return nil, types.MoveTrackerPatternToCategoryOutput{}, err
}
result, err := r.cookieBanner.MoveTrackerPatternToCategory(ctx, scope, cookiebanner.MoveTrackerPatternToCategoryRequest{
TrackerPatternID: input.TrackerPatternID,
TargetCookieCategoryID: input.TargetCookieCategoryID,
@@ -6211,6 +6215,10 @@ func (r *Resolver) MoveTrackerResourceToCategoryTool(ctx context.Context, req *m
return nil, types.MoveTrackerResourceToCategoryOutput{}, err
}
if _, err := r.Authorize(ctx, input.TargetCookieCategoryID, probo.ActionCookieCategoryUpdate); err != nil {
return nil, types.MoveTrackerResourceToCategoryOutput{}, err
}
result, err := r.cookieBanner.MoveTrackerResourceToCategory(ctx, scope, cookiebanner.MoveTrackerResourceToCategoryRequest{
TrackerResourceID: input.TrackerResourceID,
TargetCookieCategoryID: input.TargetCookieCategoryID,