rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Plug trust center part 1

Browse Source 
Signed-off-by: Émile Ré <emile@getprobo.com>
This commit is contained in:
Émile Ré
2026-01-09 19:14:17 +01:00
committed by Bryan Frimin
parent 663400c4f6
commit 7322201dab
41 changed files with 1959 additions and 1033 deletions
Download Patch File Download Diff File Expand all files Collapse all files

164
pkg/iam/auth_service.go
View File

@@ -16,6 +16,7 @@ package iam
import (
"context"
"errors"
"fmt"
"time"
@@ -50,6 +51,11 @@ type (
FullName string
}
LoadOrCreateIdentityRequest struct {
Email mail.Addr
FullName string
}
CreateIdentityWithPasswordRequest struct {
Email mail.Addr
Password string
@@ -59,11 +65,16 @@ type (
PasswordResetData struct {
Email mail.Addr `json:"email"`
}
MagicLinkData struct {
Email mail.Addr `json:"email"`
}
)
const (
TokenTypeOrganizationInvitation = "organization_invitation"
TokenTypePasswordReset = "password_reset"
TokenTypeMagicLink = "magic_link"
)
func NewAuthService(svc *Service) *AuthService {
@@ -98,6 +109,14 @@ func (req ChangePasswordRequest) Validate() error {
return v.Error()
}
func (req LoadOrCreateIdentityRequest) Validate() error {
v := validator.New()
v.Check(req.FullName, "fullName", validator.NotEmpty(), validator.MinLen(1), validator.MaxLen(255))
return v.Error()
}
func (req CreateIdentityWithPasswordRequest) Validate() error {
v := validator.New()
@@ -300,6 +319,51 @@ func (s AuthService) SendPasswordResetInstructionByEmail(
)
}
func (s AuthService) LoadOrCreateIdentity(
ctx context.Context,
req *LoadOrCreateIdentityRequest,
) (*coredata.Identity, error) {
if err := req.Validate(); err != nil {
return nil, fmt.Errorf("invalid request: %w", err)
}
var (
identity *coredata.Identity
now = time.Now()
)
if err := s.pg.WithTx(ctx, func(tx pg.Conn) error {
identity = &coredata.Identity{}
if err := identity.LoadByEmail(ctx, tx, req.Email); err != nil {
if !errors.Is(err, coredata.ErrResourceNotFound) {
return fmt.Errorf("cannot load identity: %w", err)
}
identity = &coredata.Identity{
ID: gid.New(gid.NilTenant, coredata.IdentityEntityType),
EmailAddress: req.Email,
FullName: req.FullName,
HashedPassword: nil,
EmailAddressVerified: false,
CreatedAt: now,
UpdatedAt: now,
}
err = identity.Insert(ctx, tx)
if err != nil {
return fmt.Errorf("cannot insert identity: %w", err)
}
}
return nil
}); err != nil {
return nil, err
}
return identity, nil
}
func (s AuthService) CreateIdentityWithPassword(
ctx context.Context,
req *CreateIdentityWithPasswordRequest,
@@ -476,3 +540,103 @@ func (s AuthService) OpenSessionWithPassword(ctx context.Context, email mail.Add
return identity, session, err
}
func (s AuthService) SendMagicLink(ctx context.Context, email mail.Addr) error {
token, err := statelesstoken.NewToken(
s.tokenSecret,
TokenTypeMagicLink,
s.magicLinkTokenValidity,
MagicLinkData{
Email: email,
},
)
if err != nil {
return fmt.Errorf("cannot generate magic link token: %w", err)
}
base, err := baseurl.Parse(s.baseURL)
if err != nil {
return fmt.Errorf("cannot parse base URL: %w", err)
}
magicLinkURL := base.
WithPath("/auth/magic-link").
WithQuery("token", token).
MustString()
return s.pg.WithTx(
ctx,
func(tx pg.Conn) error {
fullName := email.Username()
identity := &coredata.Identity{}
err := identity.LoadByEmail(ctx, tx, email)
if err == nil {
fullName = identity.FullName
} else {
if !errors.Is(err, coredata.ErrResourceNotFound) {
return fmt.Errorf("cannot load identity: %w", err)
}
}
subject, textBody, htmlBody, err := emails.RenderMagicLink(
s.baseURL,
fullName,
magicLinkURL,
s.invitationTokenValidity,
)
if err != nil {
return fmt.Errorf("cannot render magic link email: %w", err)
}
magicLinkEmail := coredata.NewEmail(
fullName,
email,
subject,
textBody,
htmlBody,
)
err = magicLinkEmail.Insert(ctx, tx)
if err != nil {
return fmt.Errorf("cannot insert email: %w", err)
}
return nil
},
)
}
func (s AuthService) OpenSessionWithMagicLink(ctx context.Context, token string) (*coredata.Identity, *coredata.Session, error) {
var (
identity = &coredata.Identity{}
session = &coredata.Session{}
)
payload, err := statelesstoken.ValidateToken[MagicLinkData](s.tokenSecret, TokenTypeMagicLink, token)
if err != nil {
return nil, nil, NewInvalidTokenError()
}
if err := s.pg.WithTx(
ctx,
func(conn pg.Conn) error {
err := identity.LoadByEmail(ctx, conn, payload.Data.Email)
if err != nil {
return fmt.Errorf("cannot load identity by email: %w", err)
}
session = coredata.NewRootSession(identity.ID, coredata.AuthMethodPassword, s.sessionDuration)
err = session.Insert(ctx, conn)
if err != nil {
return fmt.Errorf("cannot insert session: %w", err)
}
return nil
},
); err != nil {
return nil, nil, err
}
return identity, session, err
}

3
pkg/iam/service.go
View File

@@ -31,6 +31,7 @@ type (
disableSignup bool
invitationTokenValidity time.Duration
passwordResetTokenValidity time.Duration
magicLinkTokenValidity time.Duration
sessionDuration time.Duration
bucket string
certificate *x509.Certificate
@@ -53,6 +54,7 @@ type (
DisableSignup bool
InvitationTokenValidity time.Duration
PasswordResetTokenValidity time.Duration
MagicLinkTokenValidity time.Duration
SessionDuration time.Duration
Bucket string
TokenSecret string
@@ -99,6 +101,7 @@ func NewService(
disableSignup: cfg.DisableSignup,
invitationTokenValidity: cfg.InvitationTokenValidity,
passwordResetTokenValidity: cfg.PasswordResetTokenValidity,
magicLinkTokenValidity: cfg.MagicLinkTokenValidity,
sessionDuration: cfg.SessionDuration,
bucket: cfg.Bucket,
certificate: cfg.Certificate,

13
pkg/mail/addr.go
View File

@@ -16,6 +16,19 @@ func (a Addr) String() string {
return string(a)
}
func (a *Addr) Username() string {
if a == nil || *a == Nil {
return ""
}
parts := strings.Split(a.String(), "@")
if len(parts) != 2 {
return ""
}
return parts[0]
}
func (a *Addr) Domain() string {
if a == nil || *a == Nil {
return ""

22
pkg/probo/service.go
View File

@@ -468,3 +468,25 @@ func (s *Service) LoadTrustCenterByID(ctx context.Context, id gid.GID) (*TrustCe
return &info, err
}
func (s *Service) LoadTrustCenterByOrganizationID(ctx context.Context, organizationID gid.GID) (*TrustCenterInfo, error) {
var info TrustCenterInfo
err := s.pg.WithConn(
ctx,
func(conn pg.Conn) error {
scope := coredata.NewScope(organizationID.TenantID())
var trustCenter coredata.TrustCenter
if err := trustCenter.LoadByOrganizationID(ctx, conn, scope, organizationID); err != nil {
return fmt.Errorf("cannot load trust center: %w", err)
}
info.ID = trustCenter.ID
info.OrganizationID = trustCenter.OrganizationID
return nil
},
)
return &info, err
}

6
pkg/probo/trust_center_access_service.go
View File

@@ -40,7 +40,7 @@ type (
CreateTrustCenterAccessRequest struct {
TrustCenterID gid.GID
Email mail.Addr
Name string
FullName string
}
UpdateTrustCenterDocumentAccessRequest struct {
@@ -69,7 +69,7 @@ func (ctcar *CreateTrustCenterAccessRequest) Validate() error {
v.Check(ctcar.TrustCenterID, "trust_center_id", validator.Required(), validator.GID(coredata.TrustCenterEntityType))
v.Check(ctcar.Email, "email", validator.Required(), validator.NotEmpty())
v.Check(ctcar.Email.Domain(), "email", validator.NotBlacklisted())
v.Check(ctcar.Name, "name", validator.SafeTextNoNewLine(TitleMaxLength))
v.Check(ctcar.FullName, "name", validator.SafeTextNoNewLine(TitleMaxLength))
return v.Error()
}
@@ -244,7 +244,7 @@ func (s TrustCenterAccessService) Create(
TenantID: s.svc.scope.GetTenantID(),
TrustCenterID: req.TrustCenterID,
Email: req.Email,
Name: req.Name,
Name: req.FullName,
Active: false,
HasAcceptedNonDisclosureAgreement: false,
CreatedAt: now,

1
pkg/probod/auth_config.go
View File

@@ -26,6 +26,7 @@ type (
DisableSignup bool `json:"disable-signup"`
InvitationConfirmationTokenValidity int `json:"invitation-confirmation-token-validity"`
PasswordResetTokenValidity int `json:"password-reset-token-validity"`
MagicLinkTokenValidity int `json:"magic-link-token-validity"`
SAML samlConfig `json:"saml"`
}

2
pkg/probod/probod.go
View File

@@ -125,6 +125,7 @@ func New() *Implm {
DisableSignup: false,
InvitationConfirmationTokenValidity: 3600,
PasswordResetTokenValidity: 3600,
MagicLinkTokenValidity: 3600,
SAML: samlConfig{
SessionDuration: 604800,
CleanupIntervalSeconds: 86400,
@@ -318,6 +319,7 @@ func (impl *Implm) Run(
DisableSignup: impl.cfg.Auth.DisableSignup,
InvitationTokenValidity: time.Duration(impl.cfg.Auth.InvitationConfirmationTokenValidity) * time.Second,
PasswordResetTokenValidity: time.Duration(impl.cfg.Auth.PasswordResetTokenValidity) * time.Second,
MagicLinkTokenValidity: time.Duration(impl.cfg.Auth.MagicLinkTokenValidity) * time.Second,
SessionDuration: time.Duration(impl.cfg.Auth.Cookie.Duration) * time.Hour,
Bucket: impl.cfg.AWS.Bucket,
TokenSecret: impl.cfg.Auth.Cookie.Secret,

1
pkg/server/api/authn/context.go
View File

@@ -28,6 +28,7 @@ var (
identityContextKey = &ctxKey{name: "identity"}
sessionContextKey = &ctxKey{name: "session"}
apiKeyContextKey = &ctxKey{name: "api_key"}
TrustCenterKey = &ctxKey{name: "trust_center"}
)
func SessionFromContext(ctx context.Context) *coredata.Session {

6
pkg/server/api/connect/v1/v1_resolver.go
View File

@@ -359,11 +359,11 @@ func (r *membershipProfileResolver) Permission(ctx context.Context, obj *types.M
func (r *mutationResolver) SignIn(ctx context.Context, input types.SignInInput) (*types.SignInPayload, error) {
// TODO: handle existing session to only open child session and chnage root session auth method to PASSWORD
user, session, err := r.iam.AuthService.OpenSessionWithPassword(ctx, input.Email, input.Password)
identity, session, err := r.iam.AuthService.OpenSessionWithPassword(ctx, input.Email, input.Password)
if err != nil {
var errInvalidPassword *iam.ErrInvalidPassword
if errors.As(err, &errInvalidPassword) {
return nil, graphql.ErrorOnPath(ctx, err)
return nil, gqlutils.Invalid(ctx, err)
}
var errInvalidCredentials *iam.ErrInvalidCredentials
@@ -384,7 +384,7 @@ func (r *mutationResolver) SignIn(ctx context.Context, input types.SignInInput)
r.sessionCookie.Set(w, session)
return &types.SignInPayload{
Identity: types.NewIdentity(user),
Identity: types.NewIdentity(identity),
Session: types.NewSession(session),
}, nil
}

1
pkg/server/api/console/v1/graphql_handler.go
View File

@@ -32,6 +32,7 @@ func NewGraphQLHandler(iamSvc *iam.Service, proboSvc *probo.Service, customDomai
probo: proboSvc,
iam: iamSvc,
customDomainCname: customDomainCname,
logger: logger,
},
}

8
pkg/server/api/console/v1/resolver.go
View File

@@ -46,6 +46,7 @@ type (
authorize authz.AuthorizeFunc
probo *probo.Service
iam *iam.Service
logger *log.Logger
customDomainCname string
}
)
@@ -97,7 +98,10 @@ func NewMux(
}
w.WriteHeader(http.StatusOK)
json.NewEncoder(w).Encode(requests)
if err := json.NewEncoder(w).Encode(requests); err != nil {
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
},
)
@@ -151,7 +155,7 @@ func NewMux(
w.Header().Set("Content-Type", "application/pdf")
w.Header().Set("Content-Disposition", fmt.Sprintf("inline; filename=\"%s.pdf\"", uuid.String()))
w.WriteHeader(http.StatusOK)
w.Write(pdfData)
_, _ = w.Write(pdfData)
},
)

10
pkg/server/api/console/v1/types/audit.go
View File

@@ -60,7 +60,7 @@ func NewAuditEdge(a *coredata.Audit, orderField coredata.AuditOrderField) *Audit
}
func NewAudit(a *coredata.Audit) *Audit {
return &Audit{
node := &Audit{
ID: a.ID,
Organization: &Organization{
ID: a.OrganizationID,
@@ -76,4 +76,12 @@ func NewAudit(a *coredata.Audit) *Audit {
CreatedAt: a.CreatedAt,
UpdatedAt: a.UpdatedAt,
}
if a.ReportID != nil {
node.Report = &Report{
ID: *a.ReportID,
}
}
return node
}

25
pkg/server/api/console/v1/v1_resolver.go
View File

@@ -14,6 +14,7 @@ import (
"time"
pgx "github.com/jackc/pgx/v5"
"go.gearno.de/kit/log"
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/iam"
@@ -1674,12 +1675,28 @@ func (r *mutationResolver) CreateTrustCenterAccess(ctx context.Context, input ty
prb := r.ProboService(ctx, input.TrustCenterID.TenantID())
// TODO: when admin/owner creates trust center access, we should have an invite for it instead of directly creating the identity
identity := authn.IdentityFromContext(ctx)
if identity == nil {
var err error
identity, err = r.iam.AuthService.LoadOrCreateIdentity(
ctx,
&iam.LoadOrCreateIdentityRequest{
Email: input.Email,
},
)
if err != nil {
r.logger.ErrorCtx(ctx, "cannot load or create identity", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
}
access, err := prb.TrustCenterAccesses.Create(
ctx,
&probo.CreateTrustCenterAccessRequest{
TrustCenterID: input.TrustCenterID,
Email: input.Email,
Name: input.Name,
Email: identity.EmailAddress,
FullName: identity.FullName,
},
)
if err != nil {
@@ -1687,8 +1704,8 @@ func (r *mutationResolver) CreateTrustCenterAccess(ctx context.Context, input ty
return nil, gqlutils.Conflict(ctx, err)
}
// TODO no panic use gqlutils.InternalError
panic(fmt.Errorf("cannot create trust center access: %w", err))
r.logger.ErrorCtx(ctx, "cannot create trust center access", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
return &types.CreateTrustCenterAccessPayload{

53
pkg/server/api/trust/v1/resolver.go
View File

@@ -20,13 +20,16 @@ import (
"context"
"time"
"github.com/99designs/gqlgen/graphql"
"github.com/go-chi/chi/v5"
"go.gearno.de/kit/log"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/iam"
"go.probo.inc/probo/pkg/probo"
"go.probo.inc/probo/pkg/securecookie"
"go.probo.inc/probo/pkg/server/api/authn"
"go.probo.inc/probo/pkg/server/api/trust/v1/schema"
"go.probo.inc/probo/pkg/server/api/trust/v1/types"
"go.probo.inc/probo/pkg/server/gqlutils"
"go.probo.inc/probo/pkg/trust"
)
@@ -45,10 +48,28 @@ type (
}
Resolver struct {
trust *trust.Service
trust *trust.Service
logger *log.Logger
iam *iam.Service
sessionCookie *authn.Cookie
}
)
type ctxKey struct{ name string }
var (
TrustCenterKey = &ctxKey{name: "trust_center"}
)
func TrustCenterFromContext(ctx context.Context) probo.TrustCenterInfo {
trustCenter, _ := ctx.Value(TrustCenterKey).(probo.TrustCenterInfo)
return trustCenter
}
func ContextWithTrustCenter(ctx context.Context, trustCenter probo.TrustCenterInfo) context.Context {
return context.WithValue(ctx, TrustCenterKey, trustCenter)
}
func NewMux(
logger *log.Logger,
iamSvc *iam.Service,
@@ -60,7 +81,25 @@ func NewMux(
sessionMiddleware := authn.NewSessionMiddleware(iamSvc, cookieConfig)
r.Use(sessionMiddleware)
config := schema.Config{Resolvers: &Resolver{trust: trustSvc}}
config := schema.Config{
Resolvers: &Resolver{
iam: iamSvc,
trust: trustSvc,
logger: logger,
sessionCookie: authn.NewCookie(&cookieConfig),
},
Directives: schema.DirectiveRoot{
MustBeAuthenticated: func(ctx context.Context, obj any, next graphql.Resolver, role *types.Role) (any, error) {
identity := authn.IdentityFromContext(ctx)
if identity == nil {
return nil, gqlutils.Unauthenticatedf(ctx, "authentication required")
}
return next(ctx)
},
},
}
es := schema.NewExecutableSchema(config)
graphqlHandler := gqlutils.NewHandler(es, logger)
@@ -73,14 +112,6 @@ func (r *Resolver) RootTrustService(ctx context.Context) *trust.TenantService {
return r.trust.WithTenant(gid.NewTenantID())
}
func (r *Resolver) PublicTrustService(ctx context.Context, tenantID gid.TenantID) *trust.TenantService {
func (r *Resolver) TrustService(ctx context.Context, tenantID gid.TenantID) *trust.TenantService {
return r.trust.WithTenant(tenantID)
}
func (r *Resolver) PrivateTrustService(ctx context.Context, tenantID gid.TenantID) (*trust.TenantService, error) {
// if err := trustauth.ValidateTenantAccess(ctx, r, userTenantContextKey, tenantID); err != nil {
// return nil, fmt.Errorf("cannot access trust center: %w", err)
// }
return r.trust.WithTenant(tenantID), nil
}

36
pkg/server/api/trust/v1/schema.graphql
View File

@@ -34,6 +34,15 @@ type PageInfo {
endCursor: CursorKey
}
type Identity implements Node {
id: ID!
email: EmailAddr!
fullName: String!
emailVerified: Boolean!
createdAt: Datetime!
updatedAt: Datetime!
}
type Organization implements Node {
id: ID!
name: String!
@@ -535,10 +544,18 @@ type TrustCenterAccess implements Node {
updatedAt: Datetime!
}
input SignInWithTokenInput {
token: String!
}
type SignInWithTokenPayload {
success: Boolean!
}
input RequestAllAccessesInput {
trustCenterId: ID!
email: EmailAddr
name: String
email: EmailAddr!
fullName: String!
}
type RequestAccessesPayload {
@@ -560,22 +577,22 @@ input AcceptNonDisclosureAgreementInput {
input RequestDocumentAccessInput {
trustCenterId: ID!
documentId: ID!
email: EmailAddr
name: String
email: EmailAddr!
fullName: String!
}
input RequestReportAccessInput {
trustCenterId: ID!
reportId: ID!
email: EmailAddr
name: String
email: EmailAddr!
fullName: String!
}
input RequestTrustCenterFileAccessInput {
trustCenterId: ID!
trustCenterFileId: ID!
email: EmailAddr
name: String
email: EmailAddr!
fullName: String!
}
input ExportTrustCenterFileInput {
@@ -599,12 +616,15 @@ type AcceptNonDisclosureAgreementPayload {
}
type Query {
viewer: Identity
node(id: ID!): Node!
trustCenterBySlug(slug: String!): TrustCenter @mustBeAuthenticated(role: NONE)
currentTrustCenter: TrustCenter @mustBeAuthenticated(role: NONE)
}
type Mutation {
signInWithToken(input: SignInWithTokenInput!): SignInWithTokenPayload!
requestAllAccesses(input: RequestAllAccessesInput!): RequestAccessesPayload!
@mustBeAuthenticated(role: NONE)

662
pkg/server/api/trust/v1/schema/schema.go
View File

@@ -120,6 +120,15 @@ type ComplexityRoot struct {
Name func(childComplexity int) int
}
Identity struct {
CreatedAt func(childComplexity int) int
Email func(childComplexity int) int
EmailVerified func(childComplexity int) int
FullName func(childComplexity int) int
ID func(childComplexity int) int
UpdatedAt func(childComplexity int) int
}
Mutation struct {
AcceptNonDisclosureAgreement func(childComplexity int, input types.AcceptNonDisclosureAgreementInput) int
ExportDocumentPDF func(childComplexity int, input types.ExportDocumentPDFInput) int
@@ -129,6 +138,7 @@ type ComplexityRoot struct {
RequestDocumentAccess func(childComplexity int, input types.RequestDocumentAccessInput) int
RequestReportAccess func(childComplexity int, input types.RequestReportAccessInput) int
RequestTrustCenterFileAccess func(childComplexity int, input types.RequestTrustCenterFileAccessInput) int
SignInWithToken func(childComplexity int, input types.SignInWithTokenInput) int
}
Organization struct {
@@ -152,6 +162,7 @@ type ComplexityRoot struct {
CurrentTrustCenter func(childComplexity int) int
Node func(childComplexity int, id gid.GID) int
TrustCenterBySlug func(childComplexity int, slug string) int
Viewer func(childComplexity int) int
}
Report struct {
@@ -165,6 +176,10 @@ type ComplexityRoot struct {
TrustCenterAccess func(childComplexity int) int
}
SignInWithTokenPayload struct {
Success func(childComplexity int) int
}
TrustCenter struct {
Active func(childComplexity int) int
Audits func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey) int
@@ -258,6 +273,7 @@ type FrameworkResolver interface {
DarkLogoURL(ctx context.Context, obj *types.Framework) (*string, error)
}
type MutationResolver interface {
SignInWithToken(ctx context.Context, input types.SignInWithTokenInput) (*types.SignInWithTokenPayload, error)
RequestAllAccesses(ctx context.Context, input types.RequestAllAccessesInput) (*types.RequestAccessesPayload, error)
ExportDocumentPDF(ctx context.Context, input types.ExportDocumentPDFInput) (*types.ExportDocumentPDFPayload, error)
ExportReportPDF(ctx context.Context, input types.ExportReportPDFInput) (*types.ExportReportPDFPayload, error)
@@ -271,6 +287,7 @@ type OrganizationResolver interface {
LogoURL(ctx context.Context, obj *types.Organization) (*string, error)
}
type QueryResolver interface {
Viewer(ctx context.Context) (*types.Identity, error)
Node(ctx context.Context, id gid.GID) (types.Node, error)
TrustCenterBySlug(ctx context.Context, slug string) (*types.TrustCenter, error)
CurrentTrustCenter(ctx context.Context) (*types.TrustCenter, error)
@@ -472,6 +489,43 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
return e.complexity.Framework.Name(childComplexity), true
case "Identity.createdAt":
if e.complexity.Identity.CreatedAt == nil {
break
}
return e.complexity.Identity.CreatedAt(childComplexity), true
case "Identity.email":
if e.complexity.Identity.Email == nil {
break
}
return e.complexity.Identity.Email(childComplexity), true
case "Identity.emailVerified":
if e.complexity.Identity.EmailVerified == nil {
break
}
return e.complexity.Identity.EmailVerified(childComplexity), true
case "Identity.fullName":
if e.complexity.Identity.FullName == nil {
break
}
return e.complexity.Identity.FullName(childComplexity), true
case "Identity.id":
if e.complexity.Identity.ID == nil {
break
}
return e.complexity.Identity.ID(childComplexity), true
case "Identity.updatedAt":
if e.complexity.Identity.UpdatedAt == nil {
break
}
return e.complexity.Identity.UpdatedAt(childComplexity), true
case "Mutation.acceptNonDisclosureAgreement":
if e.complexity.Mutation.AcceptNonDisclosureAgreement == nil {
break
@@ -560,6 +614,17 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
}
return e.complexity.Mutation.RequestTrustCenterFileAccess(childComplexity, args["input"].(types.RequestTrustCenterFileAccessInput)), true
case "Mutation.signInWithToken":
if e.complexity.Mutation.SignInWithToken == nil {
break
}
args, err := ec.field_Mutation_signInWithToken_args(ctx, rawArgs)
if err != nil {
return 0, false
}
return e.complexity.Mutation.SignInWithToken(childComplexity, args["input"].(types.SignInWithTokenInput)), true
case "Organization.description":
if e.complexity.Organization.Description == nil {
@@ -657,6 +722,12 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
}
return e.complexity.Query.TrustCenterBySlug(childComplexity, args["slug"].(string)), true
case "Query.viewer":
if e.complexity.Query.Viewer == nil {
break
}
return e.complexity.Query.Viewer(childComplexity), true
case "Report.filename":
if e.complexity.Report.Filename == nil {
@@ -690,6 +761,13 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
return e.complexity.RequestAccessesPayload.TrustCenterAccess(childComplexity), true
case "SignInWithTokenPayload.success":
if e.complexity.SignInWithTokenPayload.Success == nil {
break
}
return e.complexity.SignInWithTokenPayload.Success(childComplexity), true
case "TrustCenter.active":
if e.complexity.TrustCenter.Active == nil {
break
@@ -1018,6 +1096,7 @@ func (e *executableSchema) Exec(ctx context.Context) graphql.ResponseHandler {
ec.unmarshalInputRequestDocumentAccessInput,
ec.unmarshalInputRequestReportAccessInput,
ec.unmarshalInputRequestTrustCenterFileAccessInput,
ec.unmarshalInputSignInWithTokenInput,
)
first := true
@@ -1151,6 +1230,15 @@ type PageInfo {
endCursor: CursorKey
}
type Identity implements Node {
id: ID!
email: EmailAddr!
fullName: String!
emailVerified: Boolean!
createdAt: Datetime!
updatedAt: Datetime!
}
type Organization implements Node {
id: ID!
name: String!
@@ -1652,10 +1740,18 @@ type TrustCenterAccess implements Node {
updatedAt: Datetime!
}
input SignInWithTokenInput {
token: String!
}
type SignInWithTokenPayload {
success: Boolean!
}
input RequestAllAccessesInput {
trustCenterId: ID!
email: EmailAddr
name: String
email: EmailAddr!
fullName: String!
}
type RequestAccessesPayload {
@@ -1677,22 +1773,22 @@ input AcceptNonDisclosureAgreementInput {
input RequestDocumentAccessInput {
trustCenterId: ID!
documentId: ID!
email: EmailAddr
name: String
email: EmailAddr!
fullName: String!
}
input RequestReportAccessInput {
trustCenterId: ID!
reportId: ID!
email: EmailAddr
name: String
email: EmailAddr!
fullName: String!
}
input RequestTrustCenterFileAccessInput {
trustCenterId: ID!
trustCenterFileId: ID!
email: EmailAddr
name: String
email: EmailAddr!
fullName: String!
}
input ExportTrustCenterFileInput {
@@ -1716,12 +1812,15 @@ type AcceptNonDisclosureAgreementPayload {
}
type Query {
viewer: Identity
node(id: ID!): Node!
trustCenterBySlug(slug: String!): TrustCenter @mustBeAuthenticated(role: NONE)
currentTrustCenter: TrustCenter @mustBeAuthenticated(role: NONE)
}
type Mutation {
signInWithToken(input: SignInWithTokenInput!): SignInWithTokenPayload!
requestAllAccesses(input: RequestAllAccessesInput!): RequestAccessesPayload!
@mustBeAuthenticated(role: NONE)
@@ -1858,6 +1957,17 @@ func (ec *executionContext) field_Mutation_requestTrustCenterFileAccess_args(ctx
return args, nil
}
func (ec *executionContext) field_Mutation_signInWithToken_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
var err error
args := map[string]any{}
arg0, err := graphql.ProcessArgField(ctx, rawArgs, "input", ec.unmarshalNSignInWithTokenInput2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋtrustᚋv1ᚋtypesᚐSignInWithTokenInput)
if err != nil {
return nil, err
}
args["input"] = arg0
return args, nil
}
func (ec *executionContext) field_Query___type_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
var err error
args := map[string]any{}
@@ -2841,6 +2951,225 @@ func (ec *executionContext) fieldContext_Framework_darkLogoURL(_ context.Context
return fc, nil
}
func (ec *executionContext) _Identity_id(ctx context.Context, field graphql.CollectedField, obj *types.Identity) (ret graphql.Marshaler) {
return graphql.ResolveField(
ctx,
ec.OperationContext,
field,
ec.fieldContext_Identity_id,
func(ctx context.Context) (any, error) {
return obj.ID, nil
},
nil,
ec.marshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID,
true,
true,
)
}
func (ec *executionContext) fieldContext_Identity_id(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
fc = &graphql.FieldContext{
Object: "Identity",
Field: field,
IsMethod: false,
IsResolver: false,
Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
return nil, errors.New("field of type ID does not have child fields")
},
}
return fc, nil
}
func (ec *executionContext) _Identity_email(ctx context.Context, field graphql.CollectedField, obj *types.Identity) (ret graphql.Marshaler) {
return graphql.ResolveField(
ctx,
ec.OperationContext,
field,
ec.fieldContext_Identity_email,
func(ctx context.Context) (any, error) {
return obj.Email, nil
},
nil,
ec.marshalNEmailAddr2goᚗproboᚗincᚋproboᚋpkgᚋmailᚐAddr,
true,
true,
)
}
func (ec *executionContext) fieldContext_Identity_email(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
fc = &graphql.FieldContext{
Object: "Identity",
Field: field,
IsMethod: false,
IsResolver: false,
Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
return nil, errors.New("field of type EmailAddr does not have child fields")
},
}
return fc, nil
}
func (ec *executionContext) _Identity_fullName(ctx context.Context, field graphql.CollectedField, obj *types.Identity) (ret graphql.Marshaler) {
return graphql.ResolveField(
ctx,
ec.OperationContext,
field,
ec.fieldContext_Identity_fullName,
func(ctx context.Context) (any, error) {
return obj.FullName, nil
},
nil,
ec.marshalNString2string,
true,
true,
)
}
func (ec *executionContext) fieldContext_Identity_fullName(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
fc = &graphql.FieldContext{
Object: "Identity",
Field: field,
IsMethod: false,
IsResolver: false,
Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
return nil, errors.New("field of type String does not have child fields")
},
}
return fc, nil
}
func (ec *executionContext) _Identity_emailVerified(ctx context.Context, field graphql.CollectedField, obj *types.Identity) (ret graphql.Marshaler) {
return graphql.ResolveField(
ctx,
ec.OperationContext,
field,
ec.fieldContext_Identity_emailVerified,
func(ctx context.Context) (any, error) {
return obj.EmailVerified, nil
},
nil,
ec.marshalNBoolean2bool,
true,
true,
)
}
func (ec *executionContext) fieldContext_Identity_emailVerified(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
fc = &graphql.FieldContext{
Object: "Identity",
Field: field,
IsMethod: false,
IsResolver: false,
Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
return nil, errors.New("field of type Boolean does not have child fields")
},
}
return fc, nil
}
func (ec *executionContext) _Identity_createdAt(ctx context.Context, field graphql.CollectedField, obj *types.Identity) (ret graphql.Marshaler) {
return graphql.ResolveField(
ctx,
ec.OperationContext,
field,
ec.fieldContext_Identity_createdAt,
func(ctx context.Context) (any, error) {
return obj.CreatedAt, nil
},
nil,
ec.marshalNDatetime2timeᚐTime,
true,
true,
)
}
func (ec *executionContext) fieldContext_Identity_createdAt(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
fc = &graphql.FieldContext{
Object: "Identity",
Field: field,
IsMethod: false,
IsResolver: false,
Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
return nil, errors.New("field of type Datetime does not have child fields")
},
}
return fc, nil
}
func (ec *executionContext) _Identity_updatedAt(ctx context.Context, field graphql.CollectedField, obj *types.Identity) (ret graphql.Marshaler) {
return graphql.ResolveField(
ctx,
ec.OperationContext,
field,
ec.fieldContext_Identity_updatedAt,
func(ctx context.Context) (any, error) {
return obj.UpdatedAt, nil
},
nil,
ec.marshalNDatetime2timeᚐTime,
true,
true,
)
}
func (ec *executionContext) fieldContext_Identity_updatedAt(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
fc = &graphql.FieldContext{
Object: "Identity",
Field: field,
IsMethod: false,
IsResolver: false,
Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
return nil, errors.New("field of type Datetime does not have child fields")
},
}
return fc, nil
}
func (ec *executionContext) _Mutation_signInWithToken(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
return graphql.ResolveField(
ctx,
ec.OperationContext,
field,
ec.fieldContext_Mutation_signInWithToken,
func(ctx context.Context) (any, error) {
fc := graphql.GetFieldContext(ctx)
return ec.resolvers.Mutation().SignInWithToken(ctx, fc.Args["input"].(types.SignInWithTokenInput))
},
nil,
ec.marshalNSignInWithTokenPayload2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋtrustᚋv1ᚋtypesᚐSignInWithTokenPayload,
true,
true,
)
}
func (ec *executionContext) fieldContext_Mutation_signInWithToken(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
fc = &graphql.FieldContext{
Object: "Mutation",
Field: field,
IsMethod: true,
IsResolver: true,
Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
switch field.Name {
case "success":
return ec.fieldContext_SignInWithTokenPayload_success(ctx, field)
}
return nil, fmt.Errorf("no field named %q was found under type SignInWithTokenPayload", field.Name)
},
}
defer func() {
if r := recover(); r != nil {
err = ec.Recover(ctx, r)
ec.Error(ctx, err)
}
}()
ctx = graphql.WithFieldContext(ctx, fc)
if fc.Args, err = ec.field_Mutation_signInWithToken_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
ec.Error(ctx, err)
return fc, err
}
return fc, nil
}
func (ec *executionContext) _Mutation_requestAllAccesses(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
return graphql.ResolveField(
ctx,
@@ -3664,6 +3993,49 @@ func (ec *executionContext) fieldContext_PageInfo_endCursor(_ context.Context, f
return fc, nil
}
func (ec *executionContext) _Query_viewer(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
return graphql.ResolveField(
ctx,
ec.OperationContext,
field,
ec.fieldContext_Query_viewer,
func(ctx context.Context) (any, error) {
return ec.resolvers.Query().Viewer(ctx)
},
nil,
ec.marshalOIdentity2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋtrustᚋv1ᚋtypesᚐIdentity,
true,
false,
)
}
func (ec *executionContext) fieldContext_Query_viewer(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
fc = &graphql.FieldContext{
Object: "Query",
Field: field,
IsMethod: true,
IsResolver: true,
Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
switch field.Name {
case "id":
return ec.fieldContext_Identity_id(ctx, field)
case "email":
return ec.fieldContext_Identity_email(ctx, field)
case "fullName":
return ec.fieldContext_Identity_fullName(ctx, field)
case "emailVerified":
return ec.fieldContext_Identity_emailVerified(ctx, field)
case "createdAt":
return ec.fieldContext_Identity_createdAt(ctx, field)
case "updatedAt":
return ec.fieldContext_Identity_updatedAt(ctx, field)
}
return nil, fmt.Errorf("no field named %q was found under type Identity", field.Name)
},
}
return fc, nil
}
func (ec *executionContext) _Query_node(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
return graphql.ResolveField(
ctx,
@@ -4132,6 +4504,35 @@ func (ec *executionContext) fieldContext_RequestAccessesPayload_trustCenterAcces
return fc, nil
}
func (ec *executionContext) _SignInWithTokenPayload_success(ctx context.Context, field graphql.CollectedField, obj *types.SignInWithTokenPayload) (ret graphql.Marshaler) {
return graphql.ResolveField(
ctx,
ec.OperationContext,
field,
ec.fieldContext_SignInWithTokenPayload_success,
func(ctx context.Context) (any, error) {
return obj.Success, nil
},
nil,
ec.marshalNBoolean2bool,
true,
true,
)
}
func (ec *executionContext) fieldContext_SignInWithTokenPayload_success(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
fc = &graphql.FieldContext{
Object: "SignInWithTokenPayload",
Field: field,
IsMethod: false,
IsResolver: false,
Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
return nil, errors.New("field of type Boolean does not have child fields")
},
}
return fc, nil
}
func (ec *executionContext) _TrustCenter_id(ctx context.Context, field graphql.CollectedField, obj *types.TrustCenter) (ret graphql.Marshaler) {
return graphql.ResolveField(
ctx,
@@ -7219,7 +7620,7 @@ func (ec *executionContext) unmarshalInputRequestAllAccessesInput(ctx context.Co
asMap[k] = v
}
fieldsInOrder := [...]string{"trustCenterId", "email", "name"}
fieldsInOrder := [...]string{"trustCenterId", "email", "fullName"}
for _, k := range fieldsInOrder {
v, ok := asMap[k]
if !ok {
@@ -7235,18 +7636,18 @@ func (ec *executionContext) unmarshalInputRequestAllAccessesInput(ctx context.Co
it.TrustCenterID = data
case "email":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("email"))
data, err := ec.unmarshalOEmailAddr2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋmailᚐAddr(ctx, v)
data, err := ec.unmarshalNEmailAddr2goᚗproboᚗincᚋproboᚋpkgᚋmailᚐAddr(ctx, v)
if err != nil {
return it, err
}
it.Email = data
case "name":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("name"))
data, err := ec.unmarshalOString2ᚖstring(ctx, v)
case "fullName":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("fullName"))
data, err := ec.unmarshalNString2string(ctx, v)
if err != nil {
return it, err
}
it.Name = data
it.FullName = data
}
}
@@ -7260,7 +7661,7 @@ func (ec *executionContext) unmarshalInputRequestDocumentAccessInput(ctx context
asMap[k] = v
}
fieldsInOrder := [...]string{"trustCenterId", "documentId", "email", "name"}
fieldsInOrder := [...]string{"trustCenterId", "documentId", "email", "fullName"}
for _, k := range fieldsInOrder {
v, ok := asMap[k]
if !ok {
@@ -7283,18 +7684,18 @@ func (ec *executionContext) unmarshalInputRequestDocumentAccessInput(ctx context
it.DocumentID = data
case "email":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("email"))
data, err := ec.unmarshalOEmailAddr2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋmailᚐAddr(ctx, v)
data, err := ec.unmarshalNEmailAddr2goᚗproboᚗincᚋproboᚋpkgᚋmailᚐAddr(ctx, v)
if err != nil {
return it, err
}
it.Email = data
case "name":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("name"))
data, err := ec.unmarshalOString2ᚖstring(ctx, v)
case "fullName":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("fullName"))
data, err := ec.unmarshalNString2string(ctx, v)
if err != nil {
return it, err
}
it.Name = data
it.FullName = data
}
}
@@ -7308,7 +7709,7 @@ func (ec *executionContext) unmarshalInputRequestReportAccessInput(ctx context.C
asMap[k] = v
}
fieldsInOrder := [...]string{"trustCenterId", "reportId", "email", "name"}
fieldsInOrder := [...]string{"trustCenterId", "reportId", "email", "fullName"}
for _, k := range fieldsInOrder {
v, ok := asMap[k]
if !ok {
@@ -7331,18 +7732,18 @@ func (ec *executionContext) unmarshalInputRequestReportAccessInput(ctx context.C
it.ReportID = data
case "email":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("email"))
data, err := ec.unmarshalOEmailAddr2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋmailᚐAddr(ctx, v)
data, err := ec.unmarshalNEmailAddr2goᚗproboᚗincᚋproboᚋpkgᚋmailᚐAddr(ctx, v)
if err != nil {
return it, err
}
it.Email = data
case "name":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("name"))
data, err := ec.unmarshalOString2ᚖstring(ctx, v)
case "fullName":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("fullName"))
data, err := ec.unmarshalNString2string(ctx, v)
if err != nil {
return it, err
}
it.Name = data
it.FullName = data
}
}
@@ -7356,7 +7757,7 @@ func (ec *executionContext) unmarshalInputRequestTrustCenterFileAccessInput(ctx
asMap[k] = v
}
fieldsInOrder := [...]string{"trustCenterId", "trustCenterFileId", "email", "name"}
fieldsInOrder := [...]string{"trustCenterId", "trustCenterFileId", "email", "fullName"}
for _, k := range fieldsInOrder {
v, ok := asMap[k]
if !ok {
@@ -7379,18 +7780,45 @@ func (ec *executionContext) unmarshalInputRequestTrustCenterFileAccessInput(ctx
it.TrustCenterFileID = data
case "email":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("email"))
data, err := ec.unmarshalOEmailAddr2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋmailᚐAddr(ctx, v)
data, err := ec.unmarshalNEmailAddr2goᚗproboᚗincᚋproboᚋpkgᚋmailᚐAddr(ctx, v)
if err != nil {
return it, err
}
it.Email = data
case "name":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("name"))
data, err := ec.unmarshalOString2ᚖstring(ctx, v)
case "fullName":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("fullName"))
data, err := ec.unmarshalNString2string(ctx, v)
if err != nil {
return it, err
}
it.Name = data
it.FullName = data
}
}
return it, nil
}
func (ec *executionContext) unmarshalInputSignInWithTokenInput(ctx context.Context, obj any) (types.SignInWithTokenInput, error) {
var it types.SignInWithTokenInput
asMap := map[string]any{}
for k, v := range obj.(map[string]any) {
asMap[k] = v
}
fieldsInOrder := [...]string{"token"}
for _, k := range fieldsInOrder {
v, ok := asMap[k]
if !ok {
continue
}
switch k {
case "token":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("token"))
data, err := ec.unmarshalNString2string(ctx, v)
if err != nil {
return it, err
}
it.Token = data
}
}
@@ -7454,6 +7882,13 @@ func (ec *executionContext) _Node(ctx context.Context, sel ast.SelectionSet, obj
return graphql.Null
}
return ec._Organization(ctx, sel, obj)
case types.Identity:
return ec._Identity(ctx, sel, &obj)
case *types.Identity:
if obj == nil {
return graphql.Null
}
return ec._Identity(ctx, sel, obj)
case types.Framework:
return ec._Framework(ctx, sel, &obj)
case *types.Framework:
@@ -8155,6 +8590,70 @@ func (ec *executionContext) _Framework(ctx context.Context, sel ast.SelectionSet
return out
}
var identityImplementors = []string{"Identity", "Node"}
func (ec *executionContext) _Identity(ctx context.Context, sel ast.SelectionSet, obj *types.Identity) graphql.Marshaler {
fields := graphql.CollectFields(ec.OperationContext, sel, identityImplementors)
out := graphql.NewFieldSet(fields)
deferred := make(map[string]*graphql.FieldSet)
for i, field := range fields {
switch field.Name {
case "__typename":
out.Values[i] = graphql.MarshalString("Identity")
case "id":
out.Values[i] = ec._Identity_id(ctx, field, obj)
if out.Values[i] == graphql.Null {
out.Invalids++
}
case "email":
out.Values[i] = ec._Identity_email(ctx, field, obj)
if out.Values[i] == graphql.Null {
out.Invalids++
}
case "fullName":
out.Values[i] = ec._Identity_fullName(ctx, field, obj)
if out.Values[i] == graphql.Null {
out.Invalids++
}
case "emailVerified":
out.Values[i] = ec._Identity_emailVerified(ctx, field, obj)
if out.Values[i] == graphql.Null {
out.Invalids++
}
case "createdAt":
out.Values[i] = ec._Identity_createdAt(ctx, field, obj)
if out.Values[i] == graphql.Null {
out.Invalids++
}
case "updatedAt":
out.Values[i] = ec._Identity_updatedAt(ctx, field, obj)
if out.Values[i] == graphql.Null {
out.Invalids++
}
default:
panic("unknown field " + strconv.Quote(field.Name))
}
}
out.Dispatch(ctx)
if out.Invalids > 0 {
return graphql.Null
}
atomic.AddInt32(&ec.deferred, int32(len(deferred)))
for label, dfs := range deferred {
ec.processDeferredGroup(graphql.DeferredGroup{
Label: label,
Path: graphql.GetPath(ctx),
FieldSet: dfs,
Context: ctx,
})
}
return out
}
var mutationImplementors = []string{"Mutation"}
func (ec *executionContext) _Mutation(ctx context.Context, sel ast.SelectionSet) graphql.Marshaler {
@@ -8174,6 +8673,13 @@ func (ec *executionContext) _Mutation(ctx context.Context, sel ast.SelectionSet)
switch field.Name {
case "__typename":
out.Values[i] = graphql.MarshalString("Mutation")
case "signInWithToken":
out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
return ec._Mutation_signInWithToken(ctx, field)
})
if out.Values[i] == graphql.Null {
out.Invalids++
}
case "requestAllAccesses":
out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
return ec._Mutation_requestAllAccesses(ctx, field)
@@ -8405,6 +8911,25 @@ func (ec *executionContext) _Query(ctx context.Context, sel ast.SelectionSet) gr
switch field.Name {
case "__typename":
out.Values[i] = graphql.MarshalString("Query")
case "viewer":
field := field
innerFunc := func(ctx context.Context, _ *graphql.FieldSet) (res graphql.Marshaler) {
defer func() {
if r := recover(); r != nil {
ec.Error(ctx, ec.Recover(ctx, r))
}
}()
res = ec._Query_viewer(ctx, field)
return res
}
rrm := func(ctx context.Context) graphql.Marshaler {
return ec.OperationContext.RootResolverMiddleware(ctx,
func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
}
out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return rrm(innerCtx) })
case "node":
field := field
@@ -8651,6 +9176,45 @@ func (ec *executionContext) _RequestAccessesPayload(ctx context.Context, sel ast
return out
}
var signInWithTokenPayloadImplementors = []string{"SignInWithTokenPayload"}
func (ec *executionContext) _SignInWithTokenPayload(ctx context.Context, sel ast.SelectionSet, obj *types.SignInWithTokenPayload) graphql.Marshaler {
fields := graphql.CollectFields(ec.OperationContext, sel, signInWithTokenPayloadImplementors)
out := graphql.NewFieldSet(fields)
deferred := make(map[string]*graphql.FieldSet)
for i, field := range fields {
switch field.Name {
case "__typename":
out.Values[i] = graphql.MarshalString("SignInWithTokenPayload")
case "success":
out.Values[i] = ec._SignInWithTokenPayload_success(ctx, field, obj)
if out.Values[i] == graphql.Null {
out.Invalids++
}
default:
panic("unknown field " + strconv.Quote(field.Name))
}
}
out.Dispatch(ctx)
if out.Invalids > 0 {
return graphql.Null
}
atomic.AddInt32(&ec.deferred, int32(len(deferred)))
for label, dfs := range deferred {
ec.processDeferredGroup(graphql.DeferredGroup{
Label: label,
Path: graphql.GetPath(ctx),
FieldSet: dfs,
Context: ctx,
})
}
return out
}
var trustCenterImplementors = []string{"TrustCenter", "Node"}
func (ec *executionContext) _TrustCenter(ctx context.Context, sel ast.SelectionSet, obj *types.TrustCenter) graphql.Marshaler {
@@ -10954,6 +11518,25 @@ func (ec *executionContext) unmarshalNRequestTrustCenterFileAccessInput2goᚗpro
return res, graphql.ErrorOnPath(ctx, err)
}
func (ec *executionContext) unmarshalNSignInWithTokenInput2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋtrustᚋv1ᚋtypesᚐSignInWithTokenInput(ctx context.Context, v any) (types.SignInWithTokenInput, error) {
res, err := ec.unmarshalInputSignInWithTokenInput(ctx, v)
return res, graphql.ErrorOnPath(ctx, err)
}
func (ec *executionContext) marshalNSignInWithTokenPayload2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋtrustᚋv1ᚋtypesᚐSignInWithTokenPayload(ctx context.Context, sel ast.SelectionSet, v types.SignInWithTokenPayload) graphql.Marshaler {
return ec._SignInWithTokenPayload(ctx, sel, &v)
}
func (ec *executionContext) marshalNSignInWithTokenPayload2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋtrustᚋv1ᚋtypesᚐSignInWithTokenPayload(ctx context.Context, sel ast.SelectionSet, v *types.SignInWithTokenPayload) graphql.Marshaler {
if v == nil {
if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
graphql.AddErrorf(ctx, "the requested element is null which the schema does not allow")
}
return graphql.Null
}
return ec._SignInWithTokenPayload(ctx, sel, v)
}
func (ec *executionContext) unmarshalNString2string(ctx context.Context, v any) (string, error) {
res, err := graphql.UnmarshalString(v)
return res, graphql.ErrorOnPath(ctx, err)
@@ -11583,22 +12166,11 @@ func (ec *executionContext) marshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkg
return res
}
func (ec *executionContext) unmarshalOEmailAddr2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋmailᚐAddr(ctx context.Context, v any) (*mail.Addr, error) {
if v == nil {
return nil, nil
}
res, err := mail1.UnmarshalAddrScalar(v)
return &res, graphql.ErrorOnPath(ctx, err)
}
func (ec *executionContext) marshalOEmailAddr2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋmailᚐAddr(ctx context.Context, sel ast.SelectionSet, v *mail.Addr) graphql.Marshaler {
func (ec *executionContext) marshalOIdentity2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋtrustᚋv1ᚋtypesᚐIdentity(ctx context.Context, sel ast.SelectionSet, v *types.Identity) graphql.Marshaler {
if v == nil {
return graphql.Null
}
_ = sel
_ = ctx
res := mail1.MarshalAddrScalar(*v)
return res
return ec._Identity(ctx, sel, v)
}
func (ec *executionContext) unmarshalOInt2ᚖint(ctx context.Context, v any) (*int, error) {

139
pkg/server/api/trust/v1/trust_center_access_handler.go
View File

@@ -1,139 +0,0 @@
// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package trust_v1
import (
"context"
"encoding/json"
"fmt"
"net/http"
"time"
"go.gearno.de/kit/httpserver"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/probo"
"go.probo.inc/probo/pkg/statelesstoken"
"go.probo.inc/probo/pkg/trust"
)
type ctxKey struct {
name string
}
var (
CustomDomainOrganizationIDKey = &ctxKey{name: "custom_domain_organization_id"}
)
func GetCustomDomainOrganizationID(ctx context.Context) (gid.GID, bool) {
organizationID, ok := ctx.Value(CustomDomainOrganizationIDKey).(gid.GID)
return organizationID, ok
}
type (
AuthTokenRequest struct {
Token string `json:"token"`
}
AuthTokenResponse struct {
Success bool `json:"success"`
TrustCenterID string `json:"trust_center_id,omitempty"`
Message string `json:"message,omitempty"`
}
)
func authTokenHandler(trustSvc *trust.Service, trustAuthCfg TrustAuthConfig) http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) {
var req AuthTokenRequest
// Limit request body size to 1KB to prevent DoS attacks
limitedReader := http.MaxBytesReader(w, r.Body, 1024)
if err := json.NewDecoder(limitedReader).Decode(&req); err != nil {
httpserver.RenderError(w, http.StatusBadRequest, fmt.Errorf("cannot decode body: %w", err))
return
}
if req.Token == "" {
httpserver.RenderJSON(w, http.StatusBadRequest, AuthTokenResponse{
Success: false,
Message: "Token is required",
})
return
}
accessData, err := validateTrustCenterAccessToken(r.Context(), trustSvc, trustAuthCfg, req.Token)
if err != nil {
httpserver.RenderJSON(w, http.StatusUnauthorized, AuthTokenResponse{
Success: false,
Message: "Invalid or expired token",
})
return
}
tokenString, err := statelesstoken.NewToken(
trustAuthCfg.TokenSecret,
trustAuthCfg.TokenType,
trustAuthCfg.TokenDuration,
*accessData,
)
if err != nil {
httpserver.RenderError(w, http.StatusInternalServerError, fmt.Errorf("cannot create token: %w", err))
return
}
// Determine cookie domain: use custom domain if present, otherwise use configured domain
cookieDomain := trustAuthCfg.CookieDomain
if _, ok := GetCustomDomainOrganizationID(r.Context()); ok {
// On custom domain, use the request host
if r.TLS != nil && r.TLS.ServerName != "" {
cookieDomain = r.TLS.ServerName
}
}
cookie := &http.Cookie{
Name: trustAuthCfg.CookieName,
Value: tokenString,
Domain: cookieDomain,
Path: "/",
MaxAge: int(trustAuthCfg.CookieDuration / time.Second),
Secure: trustAuthCfg.CookieSecure,
HttpOnly: true,
SameSite: http.SameSiteStrictMode,
}
http.SetCookie(w, cookie)
httpserver.RenderJSON(w, http.StatusOK, AuthTokenResponse{
Success: true,
TrustCenterID: accessData.TrustCenterID.String(),
Message: "Authentication successful",
})
}
}
func validateTrustCenterAccessToken(ctx context.Context, trustSvc *trust.Service, trustAuthCfg TrustAuthConfig, tokenString string) (*probo.TrustCenterAccessData, error) {
token, err := statelesstoken.ValidateToken[probo.TrustCenterAccessData](
trustSvc.GetTokenSecret(),
trustAuthCfg.TokenType,
tokenString,
)
if err != nil {
return nil, fmt.Errorf("cannot validate trust center access token: %w", err)
}
tenantSvc := trustSvc.WithTenant(token.Data.TrustCenterID.TenantID())
if err := tenantSvc.TrustCenterAccesses.ValidateToken(ctx, token.Data.TrustCenterID, token.Data.Email); err != nil {
return nil, fmt.Errorf("cannot validate trust center access token: %w", err)
}
return &token.Data, nil
}

50
pkg/server/api/trust/v1/types/types.go
View File

@@ -102,6 +102,18 @@ type Framework struct {
func (Framework) IsNode() {}
func (this Framework) GetID() gid.GID { return this.ID }
type Identity struct {
ID gid.GID `json:"id"`
Email mail.Addr `json:"email"`
FullName string `json:"fullName"`
EmailVerified bool `json:"emailVerified"`
CreatedAt time.Time `json:"createdAt"`
UpdatedAt time.Time `json:"updatedAt"`
}
func (Identity) IsNode() {}
func (this Identity) GetID() gid.GID { return this.ID }
type Mutation struct {
}
@@ -143,30 +155,38 @@ type RequestAccessesPayload struct {
}
type RequestAllAccessesInput struct {
TrustCenterID gid.GID `json:"trustCenterId"`
Email *mail.Addr `json:"email,omitempty"`
Name *string `json:"name,omitempty"`
TrustCenterID gid.GID `json:"trustCenterId"`
Email mail.Addr `json:"email"`
FullName string `json:"fullName"`
}
type RequestDocumentAccessInput struct {
TrustCenterID gid.GID `json:"trustCenterId"`
DocumentID gid.GID `json:"documentId"`
Email *mail.Addr `json:"email,omitempty"`
Name *string `json:"name,omitempty"`
TrustCenterID gid.GID `json:"trustCenterId"`
DocumentID gid.GID `json:"documentId"`
Email mail.Addr `json:"email"`
FullName string `json:"fullName"`
}
type RequestReportAccessInput struct {
TrustCenterID gid.GID `json:"trustCenterId"`
ReportID gid.GID `json:"reportId"`
Email *mail.Addr `json:"email,omitempty"`
Name *string `json:"name,omitempty"`
TrustCenterID gid.GID `json:"trustCenterId"`
ReportID gid.GID `json:"reportId"`
Email mail.Addr `json:"email"`
FullName string `json:"fullName"`
}
type RequestTrustCenterFileAccessInput struct {
TrustCenterID gid.GID `json:"trustCenterId"`
TrustCenterFileID gid.GID `json:"trustCenterFileId"`
Email *mail.Addr `json:"email,omitempty"`
Name *string `json:"name,omitempty"`
TrustCenterID gid.GID `json:"trustCenterId"`
TrustCenterFileID gid.GID `json:"trustCenterFileId"`
Email mail.Addr `json:"email"`
FullName string `json:"fullName"`
}
type SignInWithTokenInput struct {
Token string `json:"token"`
}
type SignInWithTokenPayload struct {
Success bool `json:"success"`
}
type TrustCenter struct {

1315
pkg/server/api/trust/v1/v1_resolver.go
View File

File diff suppressed because it is too large Load Diff

8
pkg/server/gqlutils/errors.go
View File

@@ -58,6 +58,10 @@ func Forbidden(ctx context.Context, err error) *gqlerror.Error {
}
}
func Forbiddenf(ctx context.Context, format string, a ...any) *gqlerror.Error {
return Forbidden(ctx, fmt.Errorf(format, a...))
}
func NotFound(ctx context.Context, err error) *gqlerror.Error {
return &gqlerror.Error{
Message: err.Error(),
@@ -68,6 +72,10 @@ func NotFound(ctx context.Context, err error) *gqlerror.Error {
}
}
func NotFoundf(ctx context.Context, format string, a ...any) *gqlerror.Error {
return NotFound(ctx, fmt.Errorf(format, a...))
}
func Conflict(ctx context.Context, err error) *gqlerror.Error {
return &gqlerror.Error{
Message: err.Error(),

19
pkg/server/server.go
View File

@@ -15,7 +15,6 @@
package server
import (
"context"
"errors"
"net/http"
"strings"
@@ -193,7 +192,7 @@ func (s *Server) loadTrustCenterBySlugOrID(next http.Handler) http.Handler {
)
}
ctx = s.addTrustCenterToContext(ctx, trustCenter.ID.TenantID(), trustCenter.OrganizationID)
ctx = trust_v1.ContextWithTrustCenter(ctx, *trustCenter)
next.ServeHTTP(w, r.WithContext(ctx))
})
}
@@ -235,16 +234,20 @@ func (s *Server) loadTrustCenterByDomain(next http.Handler) http.Handler {
log.String("organization_id", organizationID.String()),
)
ctx = s.addTrustCenterToContext(ctx, organizationID.TenantID(), organizationID)
trustCenter, err := s.proboService.LoadTrustCenterByOrganizationID(ctx, organizationID)
if err != nil {
s.logger.WarnCtx(ctx, "trust center not found",
log.Error(err),
)
http.Error(w, "Trust center not found", http.StatusNotFound)
return
}
ctx = trust_v1.ContextWithTrustCenter(ctx, *trustCenter)
next.ServeHTTP(w, r.WithContext(ctx))
})
}
func (s *Server) addTrustCenterToContext(ctx context.Context, tenantID, organizationID interface{}) context.Context {
ctx = context.WithValue(ctx, trust_v1.CustomDomainOrganizationIDKey, organizationID)
return ctx
}
func (s *Server) stripTrustPrefix(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
slugOrId := chi.URLParam(r, "slugOrId")

24
pkg/trust/trust_center_access_service.go
View File

@@ -44,7 +44,7 @@ type (
TrustCenterAccessRequest struct {
TrustCenterID gid.GID
Email mail.Addr
Name string
FullName string
DocumentIDs []gid.GID
ReportIDs []gid.GID
TrustCenterFileIDs []gid.GID
@@ -63,26 +63,6 @@ func (tcar *TrustCenterAccessRequest) Validate() error {
return v.Error()
}
func (s TrustCenterAccessService) ValidateToken(
ctx context.Context,
trustCenterID gid.GID,
email mail.Addr,
) error {
return s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
access := &coredata.TrustCenterAccess{}
err := access.LoadByTrustCenterIDAndEmail(ctx, conn, s.svc.scope, trustCenterID, email)
if err != nil {
return fmt.Errorf("cannot load trust center access: %w", err)
}
if !access.Active {
return fmt.Errorf("trust center access is not active")
}
return nil
})
}
func (s TrustCenterAccessService) Request(
ctx context.Context,
req *TrustCenterAccessRequest,
@@ -170,7 +150,7 @@ func (s TrustCenterAccessService) Request(
TenantID: s.svc.scope.GetTenantID(),
TrustCenterID: req.TrustCenterID,
Email: req.Email,
Name: req.Name,
Name: req.FullName,
Active: false,
HasAcceptedNonDisclosureAgreement: false,
CreatedAt: now,