diff --git a/pkg/server/api/connect/v1/scim_resolvers.go b/pkg/server/api/connect/v1/scim_resolvers.go index 4db3cc601..6d952781c 100644 --- a/pkg/server/api/connect/v1/scim_resolvers.go +++ b/pkg/server/api/connect/v1/scim_resolvers.go @@ -200,7 +200,7 @@ func (r *sCIMConfigurationResolver) Bridge(ctx context.Context, obj *types.SCIMC return nil, nil } - if _, err := r.authorize(ctx, obj.ID, iam.ActionSCIMConfigurationGet); err != nil { + if _, err := r.authorize(ctx, obj.Bridge.ID, iam.ActionSCIMConfigurationGet); err != nil { return nil, err } diff --git a/pkg/server/api/console/v1/asset_resolvers.go b/pkg/server/api/console/v1/asset_resolvers.go index 29688056b..ce0f0ea5d 100644 --- a/pkg/server/api/console/v1/asset_resolvers.go +++ b/pkg/server/api/console/v1/asset_resolvers.go @@ -25,7 +25,7 @@ import ( // Owner is the resolver for the owner field. func (r *assetResolver) Owner(ctx context.Context, obj *types.Asset) (*types.Profile, error) { - if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { + if _, err := r.authorize(ctx, obj.Owner.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } @@ -132,7 +132,7 @@ func (r *assetConnectionResolver) TotalCount(ctx context.Context, obj *types.Ass // Owner is the resolver for the owner field. func (r *datumResolver) Owner(ctx context.Context, obj *types.Datum) (*types.Profile, error) { - if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { + if _, err := r.authorize(ctx, obj.Owner.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } diff --git a/pkg/server/api/console/v1/audit_resolvers.go b/pkg/server/api/console/v1/audit_resolvers.go index e27214486..d2808c30c 100644 --- a/pkg/server/api/console/v1/audit_resolvers.go +++ b/pkg/server/api/console/v1/audit_resolvers.go @@ -47,7 +47,7 @@ func (r *auditResolver) Organization(ctx context.Context, obj *types.Audit) (*ty // Framework is the resolver for the framework field. func (r *auditResolver) Framework(ctx context.Context, obj *types.Audit) (*types.Framework, error) { - if _, err := r.authorize(ctx, obj.ID, probo.ActionFrameworkGet); err != nil { + if _, err := r.authorize(ctx, obj.Framework.ID, probo.ActionFrameworkGet); err != nil { return nil, err } @@ -69,14 +69,14 @@ func (r *auditResolver) Framework(ctx context.Context, obj *types.Audit) (*types // ReportFile is the resolver for the reportFile field. func (r *auditResolver) ReportFile(ctx context.Context, obj *types.Audit) (*types.File, error) { - if _, err := r.authorize(ctx, obj.ID, probo.ActionReportGet); err != nil { - return nil, err - } - if obj.ReportFile == nil { return nil, nil } + if _, err := r.authorize(ctx, obj.ReportFile.ID, probo.ActionReportGet); err != nil { + return nil, err + } + loaders := dataloader.FromContext(ctx) file, err := loaders.File.Load(ctx, obj.ReportFile.ID) @@ -274,7 +274,7 @@ func (r *findingResolver) Owner(ctx context.Context, obj *types.Finding) (*types return nil, nil } - if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { + if _, err := r.authorize(ctx, obj.Owner.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } @@ -300,7 +300,7 @@ func (r *findingResolver) Risk(ctx context.Context, obj *types.Finding) (*types. return nil, nil } - if _, err := r.authorize(ctx, obj.ID, probo.ActionRiskGet); err != nil { + if _, err := r.authorize(ctx, obj.Risk.ID, probo.ActionRiskGet); err != nil { return nil, err } diff --git a/pkg/server/api/console/v1/base_resolvers.go b/pkg/server/api/console/v1/base_resolvers.go index 5d4718624..480e82c15 100644 --- a/pkg/server/api/console/v1/base_resolvers.go +++ b/pkg/server/api/console/v1/base_resolvers.go @@ -111,6 +111,16 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error return types.NewControl(control), nil } + case coredata.ApplicabilityStatementEntityType: + action = probo.ActionApplicabilityStatementGet + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { + applicabilityStatement, err := r.probo.StatementsOfApplicability.GetApplicabilityStatement(ctx, scope, id) + if err != nil { + return nil, err + } + + return types.NewApplicabilityStatement(applicabilityStatement), nil + } case coredata.RiskEntityType: action = probo.ActionRiskGet loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { diff --git a/pkg/server/api/console/v1/control_resolvers.go b/pkg/server/api/console/v1/control_resolvers.go index 42c07e8d1..79246cbb8 100644 --- a/pkg/server/api/console/v1/control_resolvers.go +++ b/pkg/server/api/console/v1/control_resolvers.go @@ -40,7 +40,7 @@ func (r *applicabilityStatementResolver) StatementOfApplicability(ctx context.Co // Control is the resolver for the control field. func (r *applicabilityStatementResolver) Control(ctx context.Context, obj *types.ApplicabilityStatement) (*types.Control, error) { - if _, err := r.authorize(ctx, obj.ID, probo.ActionControlGet); err != nil { + if _, err := r.authorize(ctx, obj.Control.ID, probo.ActionControlGet); err != nil { return nil, err } @@ -160,7 +160,7 @@ func (r *controlResolver) RiskAssessment(ctx context.Context, obj *types.Control // Framework is the resolver for the framework field. func (r *controlResolver) Framework(ctx context.Context, obj *types.Control) (*types.Framework, error) { - if _, err := r.authorize(ctx, obj.ID, probo.ActionFrameworkGet); err != nil { + if _, err := r.authorize(ctx, obj.Framework.ID, probo.ActionFrameworkGet); err != nil { return nil, err } diff --git a/pkg/server/api/console/v1/cookie_banner_resolvers.go b/pkg/server/api/console/v1/cookie_banner_resolvers.go index 9c23c6962..dc61da401 100644 --- a/pkg/server/api/console/v1/cookie_banner_resolvers.go +++ b/pkg/server/api/console/v1/cookie_banner_resolvers.go @@ -149,7 +149,7 @@ func (r *cookieBannerResolver) PolicyDocument(ctx context.Context, obj *types.Co return nil, nil } - if _, err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil { + if _, err := r.authorize(ctx, obj.PolicyDocument.ID, probo.ActionDocumentGet); err != nil { return nil, err } diff --git a/pkg/server/api/console/v1/document_resolvers.go b/pkg/server/api/console/v1/document_resolvers.go index 6c7ad082c..d2eedbb37 100644 --- a/pkg/server/api/console/v1/document_resolvers.go +++ b/pkg/server/api/console/v1/document_resolvers.go @@ -205,7 +205,7 @@ func (r *documentConnectionResolver) TotalCount(ctx context.Context, obj *types. // Document is the resolver for the document field. func (r *documentVersionResolver) Document(ctx context.Context, obj *types.DocumentVersion) (*types.Document, error) { - if _, err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil { + if _, err := r.authorize(ctx, obj.Document.ID, probo.ActionDocumentGet); err != nil { return nil, err } @@ -420,7 +420,7 @@ func (r *documentVersionApprovalDecisionResolver) DocumentVersion(ctx context.Co // Approver is the resolver for the approver field. func (r *documentVersionApprovalDecisionResolver) Approver(ctx context.Context, obj *types.DocumentVersionApprovalDecision) (*types.Profile, error) { - if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { + if _, err := r.authorize(ctx, obj.Approver.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } @@ -621,7 +621,7 @@ func (r *documentVersionSignatureResolver) DocumentVersion(ctx context.Context, // SignedBy is the resolver for the signedBy field. func (r *documentVersionSignatureResolver) SignedBy(ctx context.Context, obj *types.DocumentVersionSignature) (*types.Profile, error) { - if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { + if _, err := r.authorize(ctx, obj.SignedBy.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } diff --git a/pkg/server/api/console/v1/evidence_resolvers.go b/pkg/server/api/console/v1/evidence_resolvers.go index dff934da2..f57dcfb56 100644 --- a/pkg/server/api/console/v1/evidence_resolvers.go +++ b/pkg/server/api/console/v1/evidence_resolvers.go @@ -22,14 +22,14 @@ import ( // File is the resolver for the file field. func (r *evidenceResolver) File(ctx context.Context, obj *types.Evidence) (*types.File, error) { - if _, err := r.authorize(ctx, obj.ID, probo.ActionFileGet); err != nil { - return nil, err - } - if obj.File == nil { return nil, nil } + if _, err := r.authorize(ctx, obj.File.ID, probo.ActionFileGet); err != nil { + return nil, err + } + loaders := dataloader.FromContext(ctx) file, err := loaders.File.Load(ctx, obj.File.ID) @@ -48,15 +48,15 @@ func (r *evidenceResolver) File(ctx context.Context, obj *types.Evidence) (*type // Task is the resolver for the task field. func (r *evidenceResolver) Task(ctx context.Context, obj *types.Evidence) (*types.Task, error) { - if _, err := r.authorize(ctx, obj.ID, probo.ActionTaskGet); err != nil { - return nil, err - } - if obj.Task == nil { r.logger.ErrorCtx(ctx, "evidence is not associated with a task") return nil, gqlutils.Internal(ctx) } + if _, err := r.authorize(ctx, obj.Task.ID, probo.ActionTaskGet); err != nil { + return nil, err + } + loaders := dataloader.FromContext(ctx) task, err := loaders.Task.Load(ctx, obj.Task.ID) @@ -75,7 +75,7 @@ func (r *evidenceResolver) Task(ctx context.Context, obj *types.Evidence) (*type // Measure is the resolver for the measure field. func (r *evidenceResolver) Measure(ctx context.Context, obj *types.Evidence) (*types.Measure, error) { - if _, err := r.authorize(ctx, obj.ID, probo.ActionMeasureGet); err != nil { + if _, err := r.authorize(ctx, obj.Measure.ID, probo.ActionMeasureGet); err != nil { return nil, err } diff --git a/pkg/server/api/console/v1/obligation_resolvers.go b/pkg/server/api/console/v1/obligation_resolvers.go index b7eab95fd..83b7045c5 100644 --- a/pkg/server/api/console/v1/obligation_resolvers.go +++ b/pkg/server/api/console/v1/obligation_resolvers.go @@ -160,7 +160,7 @@ func (r *obligationResolver) Organization(ctx context.Context, obj *types.Obliga // Owner is the resolver for the owner field. func (r *obligationResolver) Owner(ctx context.Context, obj *types.Obligation) (*types.Profile, error) { - if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { + if _, err := r.authorize(ctx, obj.Owner.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } diff --git a/pkg/server/api/console/v1/processing_activity_resolvers.go b/pkg/server/api/console/v1/processing_activity_resolvers.go index 971d7a4bc..14abd75d2 100644 --- a/pkg/server/api/console/v1/processing_activity_resolvers.go +++ b/pkg/server/api/console/v1/processing_activity_resolvers.go @@ -168,14 +168,14 @@ func (r *processingActivityResolver) Organization(ctx context.Context, obj *type // DataProtectionOfficer is the resolver for the dataProtectionOfficer field. func (r *processingActivityResolver) DataProtectionOfficer(ctx context.Context, obj *types.ProcessingActivity) (*types.Profile, error) { - if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { - return nil, err - } - if obj.DataProtectionOfficer == nil { return nil, nil } + if _, err := r.authorize(ctx, obj.DataProtectionOfficer.ID, iam.ActionMembershipProfileGet); err != nil { + return nil, err + } + loaders := dataloader.FromContext(ctx) dpo, err := loaders.Profile.Load(ctx, obj.DataProtectionOfficer.ID) diff --git a/pkg/server/api/console/v1/risk_resolvers.go b/pkg/server/api/console/v1/risk_resolvers.go index 73c066f08..db262fe0c 100644 --- a/pkg/server/api/console/v1/risk_resolvers.go +++ b/pkg/server/api/console/v1/risk_resolvers.go @@ -259,14 +259,14 @@ func (r *mutationResolver) PublishRiskList(ctx context.Context, input types.Publ // Owner is the resolver for the owner field. func (r *riskResolver) Owner(ctx context.Context, obj *types.Risk) (*types.Profile, error) { - if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { - return nil, err - } - if obj.Owner == nil { return nil, nil } + if _, err := r.authorize(ctx, obj.Owner.ID, iam.ActionMembershipProfileGet); err != nil { + return nil, err + } + loaders := dataloader.FromContext(ctx) owner, err := loaders.Profile.Load(ctx, obj.Owner.ID) diff --git a/pkg/server/api/console/v1/task_resolvers.go b/pkg/server/api/console/v1/task_resolvers.go index a6c7a1ebd..ded2df954 100644 --- a/pkg/server/api/console/v1/task_resolvers.go +++ b/pkg/server/api/console/v1/task_resolvers.go @@ -117,14 +117,14 @@ func (r *mutationResolver) DeleteTask(ctx context.Context, input types.DeleteTas // AssignedTo is the resolver for the assignedTo field. func (r *taskResolver) AssignedTo(ctx context.Context, obj *types.Task) (*types.Profile, error) { - if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { - return nil, err - } - if obj.AssignedTo == nil { return nil, nil } + if _, err := r.authorize(ctx, obj.AssignedTo.ID, iam.ActionMembershipProfileGet); err != nil { + return nil, err + } + loaders := dataloader.FromContext(ctx) assignee, err := loaders.Profile.Load(ctx, obj.AssignedTo.ID) @@ -165,14 +165,14 @@ func (r *taskResolver) Organization(ctx context.Context, obj *types.Task) (*type // Measure is the resolver for the measure field. func (r *taskResolver) Measure(ctx context.Context, obj *types.Task) (*types.Measure, error) { - if _, err := r.authorize(ctx, obj.ID, probo.ActionMeasureGet); err != nil { - return nil, err - } - if obj.Measure == nil { return nil, nil } + if _, err := r.authorize(ctx, obj.Measure.ID, probo.ActionMeasureGet); err != nil { + return nil, err + } + loaders := dataloader.FromContext(ctx) measure, err := loaders.Measure.Load(ctx, obj.Measure.ID) diff --git a/pkg/server/api/console/v1/third_party_resolvers.go b/pkg/server/api/console/v1/third_party_resolvers.go index c5c3b2923..2cd76d0c7 100644 --- a/pkg/server/api/console/v1/third_party_resolvers.go +++ b/pkg/server/api/console/v1/third_party_resolvers.go @@ -857,14 +857,14 @@ func (r *thirdPartyResolver) Measures(ctx context.Context, obj *types.ThirdParty // BusinessOwner is the resolver for the businessOwner field. func (r *thirdPartyResolver) BusinessOwner(ctx context.Context, obj *types.ThirdParty) (*types.Profile, error) { - if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { - return nil, err - } - if obj.BusinessOwner == nil { return nil, nil } + if _, err := r.authorize(ctx, obj.BusinessOwner.ID, iam.ActionMembershipProfileGet); err != nil { + return nil, err + } + loaders := dataloader.FromContext(ctx) businessOwner, err := loaders.Profile.Load(ctx, obj.BusinessOwner.ID) @@ -883,14 +883,14 @@ func (r *thirdPartyResolver) BusinessOwner(ctx context.Context, obj *types.Third // SecurityOwner is the resolver for the securityOwner field. func (r *thirdPartyResolver) SecurityOwner(ctx context.Context, obj *types.ThirdParty) (*types.Profile, error) { - if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { - return nil, err - } - if obj.SecurityOwner == nil { return nil, nil } + if _, err := r.authorize(ctx, obj.SecurityOwner.ID, iam.ActionMembershipProfileGet); err != nil { + return nil, err + } + loaders := dataloader.FromContext(ctx) securityOwner, err := loaders.Profile.Load(ctx, obj.SecurityOwner.ID) @@ -913,7 +913,7 @@ func (r *thirdPartyResolver) ParentThirdParty(ctx context.Context, obj *types.Th return nil, nil } - if _, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyGet); err != nil { + if _, err := r.authorize(ctx, obj.ParentThirdParty.ID, probo.ActionThirdPartyGet); err != nil { return nil, err } @@ -1249,7 +1249,7 @@ func (r *thirdPartyRiskAssessmentResolver) Permission(ctx context.Context, obj * // ThirdParty is the resolver for the thirdParty field. func (r *thirdPartyServiceResolver) ThirdParty(ctx context.Context, obj *types.ThirdPartyService) (*types.ThirdParty, error) { - if _, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyGet); err != nil { + if _, err := r.authorize(ctx, obj.ThirdParty.ID, probo.ActionThirdPartyGet); err != nil { return nil, err } diff --git a/pkg/server/api/console/v1/trust_center_resolvers.go b/pkg/server/api/console/v1/trust_center_resolvers.go index e74e4ba53..af0cfe20d 100644 --- a/pkg/server/api/console/v1/trust_center_resolvers.go +++ b/pkg/server/api/console/v1/trust_center_resolvers.go @@ -1044,14 +1044,14 @@ func (r *trustCenterDocumentAccessResolver) Document(ctx context.Context, obj *t // ReportFile is the resolver for the reportFile field. func (r *trustCenterDocumentAccessResolver) ReportFile(ctx context.Context, obj *types.TrustCenterDocumentAccess) (*types.File, error) { - if _, err := r.authorize(ctx, obj.ID, probo.ActionFileGet); err != nil { - return nil, err - } - if obj.ReportFile == nil { return nil, nil } + if _, err := r.authorize(ctx, obj.ReportFile.ID, probo.ActionFileGet); err != nil { + return nil, err + } + loaders := dataloader.FromContext(ctx) file, err := loaders.File.Load(ctx, obj.ReportFile.ID) diff --git a/pkg/server/api/mcp/v1/schema.resolvers.go b/pkg/server/api/mcp/v1/schema.resolvers.go index d16660187..1aea6cab0 100644 --- a/pkg/server/api/mcp/v1/schema.resolvers.go +++ b/pkg/server/api/mcp/v1/schema.resolvers.go @@ -5807,6 +5807,10 @@ func (r *Resolver) MoveTrackerPatternToCategoryTool(ctx context.Context, req *mc return nil, types.MoveTrackerPatternToCategoryOutput{}, err } + if _, err := r.Authorize(ctx, input.TargetCookieCategoryID, probo.ActionCookieCategoryUpdate); err != nil { + return nil, types.MoveTrackerPatternToCategoryOutput{}, err + } + result, err := r.cookieBanner.MoveTrackerPatternToCategory(ctx, scope, cookiebanner.MoveTrackerPatternToCategoryRequest{ TrackerPatternID: input.TrackerPatternID, TargetCookieCategoryID: input.TargetCookieCategoryID, @@ -6211,6 +6215,10 @@ func (r *Resolver) MoveTrackerResourceToCategoryTool(ctx context.Context, req *m return nil, types.MoveTrackerResourceToCategoryOutput{}, err } + if _, err := r.Authorize(ctx, input.TargetCookieCategoryID, probo.ActionCookieCategoryUpdate); err != nil { + return nil, types.MoveTrackerResourceToCategoryOutput{}, err + } + result, err := r.cookieBanner.MoveTrackerResourceToCategory(ctx, scope, cookiebanner.MoveTrackerResourceToCategoryRequest{ TrackerResourceID: input.TrackerResourceID, TargetCookieCategoryID: input.TargetCookieCategoryID,