rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Plug trust center part 1

Browse Source 
Signed-off-by: Émile Ré <emile@getprobo.com>
This commit is contained in:
Émile Ré
2026-01-09 19:14:17 +01:00
committed by Bryan Frimin
parent 663400c4f6
commit 7322201dab
41 changed files with 1959 additions and 1033 deletions
Download Patch File Download Diff File Expand all files Collapse all files

53
pkg/server/api/trust/v1/resolver.go
View File

@@ -20,13 +20,16 @@ import (
"context"
"time"
"github.com/99designs/gqlgen/graphql"
"github.com/go-chi/chi/v5"
"go.gearno.de/kit/log"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/iam"
"go.probo.inc/probo/pkg/probo"
"go.probo.inc/probo/pkg/securecookie"
"go.probo.inc/probo/pkg/server/api/authn"
"go.probo.inc/probo/pkg/server/api/trust/v1/schema"
"go.probo.inc/probo/pkg/server/api/trust/v1/types"
"go.probo.inc/probo/pkg/server/gqlutils"
"go.probo.inc/probo/pkg/trust"
)
@@ -45,10 +48,28 @@ type (
}
Resolver struct {
trust *trust.Service
trust *trust.Service
logger *log.Logger
iam *iam.Service
sessionCookie *authn.Cookie
}
)
type ctxKey struct{ name string }
var (
TrustCenterKey = &ctxKey{name: "trust_center"}
)
func TrustCenterFromContext(ctx context.Context) probo.TrustCenterInfo {
trustCenter, _ := ctx.Value(TrustCenterKey).(probo.TrustCenterInfo)
return trustCenter
}
func ContextWithTrustCenter(ctx context.Context, trustCenter probo.TrustCenterInfo) context.Context {
return context.WithValue(ctx, TrustCenterKey, trustCenter)
}
func NewMux(
logger *log.Logger,
iamSvc *iam.Service,
@@ -60,7 +81,25 @@ func NewMux(
sessionMiddleware := authn.NewSessionMiddleware(iamSvc, cookieConfig)
r.Use(sessionMiddleware)
config := schema.Config{Resolvers: &Resolver{trust: trustSvc}}
config := schema.Config{
Resolvers: &Resolver{
iam: iamSvc,
trust: trustSvc,
logger: logger,
sessionCookie: authn.NewCookie(&cookieConfig),
},
Directives: schema.DirectiveRoot{
MustBeAuthenticated: func(ctx context.Context, obj any, next graphql.Resolver, role *types.Role) (any, error) {
identity := authn.IdentityFromContext(ctx)
if identity == nil {
return nil, gqlutils.Unauthenticatedf(ctx, "authentication required")
}
return next(ctx)
},
},
}
es := schema.NewExecutableSchema(config)
graphqlHandler := gqlutils.NewHandler(es, logger)
@@ -73,14 +112,6 @@ func (r *Resolver) RootTrustService(ctx context.Context) *trust.TenantService {
return r.trust.WithTenant(gid.NewTenantID())
}
func (r *Resolver) PublicTrustService(ctx context.Context, tenantID gid.TenantID) *trust.TenantService {
func (r *Resolver) TrustService(ctx context.Context, tenantID gid.TenantID) *trust.TenantService {
return r.trust.WithTenant(tenantID)
}
func (r *Resolver) PrivateTrustService(ctx context.Context, tenantID gid.TenantID) (*trust.TenantService, error) {
// if err := trustauth.ValidateTenantAccess(ctx, r, userTenantContextKey, tenantID); err != nil {
// return nil, fmt.Errorf("cannot access trust center: %w", err)
// }
return r.trust.WithTenant(tenantID), nil
}

36
pkg/server/api/trust/v1/schema.graphql
View File

@@ -34,6 +34,15 @@ type PageInfo {
endCursor: CursorKey
}
type Identity implements Node {
id: ID!
email: EmailAddr!
fullName: String!
emailVerified: Boolean!
createdAt: Datetime!
updatedAt: Datetime!
}
type Organization implements Node {
id: ID!
name: String!
@@ -535,10 +544,18 @@ type TrustCenterAccess implements Node {
updatedAt: Datetime!
}
input SignInWithTokenInput {
token: String!
}
type SignInWithTokenPayload {
success: Boolean!
}
input RequestAllAccessesInput {
trustCenterId: ID!
email: EmailAddr
name: String
email: EmailAddr!
fullName: String!
}
type RequestAccessesPayload {
@@ -560,22 +577,22 @@ input AcceptNonDisclosureAgreementInput {
input RequestDocumentAccessInput {
trustCenterId: ID!
documentId: ID!
email: EmailAddr
name: String
email: EmailAddr!
fullName: String!
}
input RequestReportAccessInput {
trustCenterId: ID!
reportId: ID!
email: EmailAddr
name: String
email: EmailAddr!
fullName: String!
}
input RequestTrustCenterFileAccessInput {
trustCenterId: ID!
trustCenterFileId: ID!
email: EmailAddr
name: String
email: EmailAddr!
fullName: String!
}
input ExportTrustCenterFileInput {
@@ -599,12 +616,15 @@ type AcceptNonDisclosureAgreementPayload {
}
type Query {
viewer: Identity
node(id: ID!): Node!
trustCenterBySlug(slug: String!): TrustCenter @mustBeAuthenticated(role: NONE)
currentTrustCenter: TrustCenter @mustBeAuthenticated(role: NONE)
}
type Mutation {
signInWithToken(input: SignInWithTokenInput!): SignInWithTokenPayload!
requestAllAccesses(input: RequestAllAccessesInput!): RequestAccessesPayload!
@mustBeAuthenticated(role: NONE)

662
pkg/server/api/trust/v1/schema/schema.go
View File

@@ -120,6 +120,15 @@ type ComplexityRoot struct {
Name func(childComplexity int) int
}
Identity struct {
CreatedAt func(childComplexity int) int
Email func(childComplexity int) int
EmailVerified func(childComplexity int) int
FullName func(childComplexity int) int
ID func(childComplexity int) int
UpdatedAt func(childComplexity int) int
}
Mutation struct {
AcceptNonDisclosureAgreement func(childComplexity int, input types.AcceptNonDisclosureAgreementInput) int
ExportDocumentPDF func(childComplexity int, input types.ExportDocumentPDFInput) int
@@ -129,6 +138,7 @@ type ComplexityRoot struct {
RequestDocumentAccess func(childComplexity int, input types.RequestDocumentAccessInput) int
RequestReportAccess func(childComplexity int, input types.RequestReportAccessInput) int
RequestTrustCenterFileAccess func(childComplexity int, input types.RequestTrustCenterFileAccessInput) int
SignInWithToken func(childComplexity int, input types.SignInWithTokenInput) int
}
Organization struct {
@@ -152,6 +162,7 @@ type ComplexityRoot struct {
CurrentTrustCenter func(childComplexity int) int
Node func(childComplexity int, id gid.GID) int
TrustCenterBySlug func(childComplexity int, slug string) int
Viewer func(childComplexity int) int
}
Report struct {
@@ -165,6 +176,10 @@ type ComplexityRoot struct {
TrustCenterAccess func(childComplexity int) int
}
SignInWithTokenPayload struct {
Success func(childComplexity int) int
}
TrustCenter struct {
Active func(childComplexity int) int
Audits func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey) int
@@ -258,6 +273,7 @@ type FrameworkResolver interface {
DarkLogoURL(ctx context.Context, obj *types.Framework) (*string, error)
}
type MutationResolver interface {
SignInWithToken(ctx context.Context, input types.SignInWithTokenInput) (*types.SignInWithTokenPayload, error)
RequestAllAccesses(ctx context.Context, input types.RequestAllAccessesInput) (*types.RequestAccessesPayload, error)
ExportDocumentPDF(ctx context.Context, input types.ExportDocumentPDFInput) (*types.ExportDocumentPDFPayload, error)
ExportReportPDF(ctx context.Context, input types.ExportReportPDFInput) (*types.ExportReportPDFPayload, error)
@@ -271,6 +287,7 @@ type OrganizationResolver interface {
LogoURL(ctx context.Context, obj *types.Organization) (*string, error)
}
type QueryResolver interface {
Viewer(ctx context.Context) (*types.Identity, error)
Node(ctx context.Context, id gid.GID) (types.Node, error)
TrustCenterBySlug(ctx context.Context, slug string) (*types.TrustCenter, error)
CurrentTrustCenter(ctx context.Context) (*types.TrustCenter, error)
@@ -472,6 +489,43 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
return e.complexity.Framework.Name(childComplexity), true
case "Identity.createdAt":
if e.complexity.Identity.CreatedAt == nil {
break
}
return e.complexity.Identity.CreatedAt(childComplexity), true
case "Identity.email":
if e.complexity.Identity.Email == nil {
break
}
return e.complexity.Identity.Email(childComplexity), true
case "Identity.emailVerified":
if e.complexity.Identity.EmailVerified == nil {
break
}
return e.complexity.Identity.EmailVerified(childComplexity), true
case "Identity.fullName":
if e.complexity.Identity.FullName == nil {
break
}
return e.complexity.Identity.FullName(childComplexity), true
case "Identity.id":
if e.complexity.Identity.ID == nil {
break
}
return e.complexity.Identity.ID(childComplexity), true
case "Identity.updatedAt":
if e.complexity.Identity.UpdatedAt == nil {
break
}
return e.complexity.Identity.UpdatedAt(childComplexity), true
case "Mutation.acceptNonDisclosureAgreement":
if e.complexity.Mutation.AcceptNonDisclosureAgreement == nil {
break
@@ -560,6 +614,17 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
}
return e.complexity.Mutation.RequestTrustCenterFileAccess(childComplexity, args["input"].(types.RequestTrustCenterFileAccessInput)), true
case "Mutation.signInWithToken":
if e.complexity.Mutation.SignInWithToken == nil {
break
}
args, err := ec.field_Mutation_signInWithToken_args(ctx, rawArgs)
if err != nil {
return 0, false
}
return e.complexity.Mutation.SignInWithToken(childComplexity, args["input"].(types.SignInWithTokenInput)), true
case "Organization.description":
if e.complexity.Organization.Description == nil {
@@ -657,6 +722,12 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
}
return e.complexity.Query.TrustCenterBySlug(childComplexity, args["slug"].(string)), true
case "Query.viewer":
if e.complexity.Query.Viewer == nil {
break
}
return e.complexity.Query.Viewer(childComplexity), true
case "Report.filename":
if e.complexity.Report.Filename == nil {
@@ -690,6 +761,13 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
return e.complexity.RequestAccessesPayload.TrustCenterAccess(childComplexity), true
case "SignInWithTokenPayload.success":
if e.complexity.SignInWithTokenPayload.Success == nil {
break
}
return e.complexity.SignInWithTokenPayload.Success(childComplexity), true
case "TrustCenter.active":
if e.complexity.TrustCenter.Active == nil {
break
@@ -1018,6 +1096,7 @@ func (e *executableSchema) Exec(ctx context.Context) graphql.ResponseHandler {
ec.unmarshalInputRequestDocumentAccessInput,
ec.unmarshalInputRequestReportAccessInput,
ec.unmarshalInputRequestTrustCenterFileAccessInput,
ec.unmarshalInputSignInWithTokenInput,
)
first := true
@@ -1151,6 +1230,15 @@ type PageInfo {
endCursor: CursorKey
}
type Identity implements Node {
id: ID!
email: EmailAddr!
fullName: String!
emailVerified: Boolean!
createdAt: Datetime!
updatedAt: Datetime!
}
type Organization implements Node {
id: ID!
name: String!
@@ -1652,10 +1740,18 @@ type TrustCenterAccess implements Node {
updatedAt: Datetime!
}
input SignInWithTokenInput {
token: String!
}
type SignInWithTokenPayload {
success: Boolean!
}
input RequestAllAccessesInput {
trustCenterId: ID!
email: EmailAddr
name: String
email: EmailAddr!
fullName: String!
}
type RequestAccessesPayload {
@@ -1677,22 +1773,22 @@ input AcceptNonDisclosureAgreementInput {
input RequestDocumentAccessInput {
trustCenterId: ID!
documentId: ID!
email: EmailAddr
name: String
email: EmailAddr!
fullName: String!
}
input RequestReportAccessInput {
trustCenterId: ID!
reportId: ID!
email: EmailAddr
name: String
email: EmailAddr!
fullName: String!
}
input RequestTrustCenterFileAccessInput {
trustCenterId: ID!
trustCenterFileId: ID!
email: EmailAddr
name: String
email: EmailAddr!
fullName: String!
}
input ExportTrustCenterFileInput {
@@ -1716,12 +1812,15 @@ type AcceptNonDisclosureAgreementPayload {
}
type Query {
viewer: Identity
node(id: ID!): Node!
trustCenterBySlug(slug: String!): TrustCenter @mustBeAuthenticated(role: NONE)
currentTrustCenter: TrustCenter @mustBeAuthenticated(role: NONE)
}
type Mutation {
signInWithToken(input: SignInWithTokenInput!): SignInWithTokenPayload!
requestAllAccesses(input: RequestAllAccessesInput!): RequestAccessesPayload!
@mustBeAuthenticated(role: NONE)
@@ -1858,6 +1957,17 @@ func (ec *executionContext) field_Mutation_requestTrustCenterFileAccess_args(ctx
return args, nil
}
func (ec *executionContext) field_Mutation_signInWithToken_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
var err error
args := map[string]any{}
arg0, err := graphql.ProcessArgField(ctx, rawArgs, "input", ec.unmarshalNSignInWithTokenInput2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋtrustᚋv1ᚋtypesᚐSignInWithTokenInput)
if err != nil {
return nil, err
}
args["input"] = arg0
return args, nil
}
func (ec *executionContext) field_Query___type_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
var err error
args := map[string]any{}
@@ -2841,6 +2951,225 @@ func (ec *executionContext) fieldContext_Framework_darkLogoURL(_ context.Context
return fc, nil
}
func (ec *executionContext) _Identity_id(ctx context.Context, field graphql.CollectedField, obj *types.Identity) (ret graphql.Marshaler) {
return graphql.ResolveField(
ctx,
ec.OperationContext,
field,
ec.fieldContext_Identity_id,
func(ctx context.Context) (any, error) {
return obj.ID, nil
},
nil,
ec.marshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID,
true,
true,
)
}
func (ec *executionContext) fieldContext_Identity_id(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
fc = &graphql.FieldContext{
Object: "Identity",
Field: field,
IsMethod: false,
IsResolver: false,
Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
return nil, errors.New("field of type ID does not have child fields")
},
}
return fc, nil
}
func (ec *executionContext) _Identity_email(ctx context.Context, field graphql.CollectedField, obj *types.Identity) (ret graphql.Marshaler) {
return graphql.ResolveField(
ctx,
ec.OperationContext,
field,
ec.fieldContext_Identity_email,
func(ctx context.Context) (any, error) {
return obj.Email, nil
},
nil,
ec.marshalNEmailAddr2goᚗproboᚗincᚋproboᚋpkgᚋmailᚐAddr,
true,
true,
)
}
func (ec *executionContext) fieldContext_Identity_email(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
fc = &graphql.FieldContext{
Object: "Identity",
Field: field,
IsMethod: false,
IsResolver: false,
Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
return nil, errors.New("field of type EmailAddr does not have child fields")
},
}
return fc, nil
}
func (ec *executionContext) _Identity_fullName(ctx context.Context, field graphql.CollectedField, obj *types.Identity) (ret graphql.Marshaler) {
return graphql.ResolveField(
ctx,
ec.OperationContext,
field,
ec.fieldContext_Identity_fullName,
func(ctx context.Context) (any, error) {
return obj.FullName, nil
},
nil,
ec.marshalNString2string,
true,
true,
)
}
func (ec *executionContext) fieldContext_Identity_fullName(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
fc = &graphql.FieldContext{
Object: "Identity",
Field: field,
IsMethod: false,
IsResolver: false,
Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
return nil, errors.New("field of type String does not have child fields")
},
}
return fc, nil
}
func (ec *executionContext) _Identity_emailVerified(ctx context.Context, field graphql.CollectedField, obj *types.Identity) (ret graphql.Marshaler) {
return graphql.ResolveField(
ctx,
ec.OperationContext,
field,
ec.fieldContext_Identity_emailVerified,
func(ctx context.Context) (any, error) {
return obj.EmailVerified, nil
},
nil,
ec.marshalNBoolean2bool,
true,
true,
)
}
func (ec *executionContext) fieldContext_Identity_emailVerified(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
fc = &graphql.FieldContext{
Object: "Identity",
Field: field,
IsMethod: false,
IsResolver: false,
Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
return nil, errors.New("field of type Boolean does not have child fields")
},
}
return fc, nil
}
func (ec *executionContext) _Identity_createdAt(ctx context.Context, field graphql.CollectedField, obj *types.Identity) (ret graphql.Marshaler) {
return graphql.ResolveField(
ctx,
ec.OperationContext,
field,
ec.fieldContext_Identity_createdAt,
func(ctx context.Context) (any, error) {
return obj.CreatedAt, nil
},
nil,
ec.marshalNDatetime2timeᚐTime,
true,
true,
)
}
func (ec *executionContext) fieldContext_Identity_createdAt(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
fc = &graphql.FieldContext{
Object: "Identity",
Field: field,
IsMethod: false,
IsResolver: false,
Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
return nil, errors.New("field of type Datetime does not have child fields")
},
}
return fc, nil
}
func (ec *executionContext) _Identity_updatedAt(ctx context.Context, field graphql.CollectedField, obj *types.Identity) (ret graphql.Marshaler) {
return graphql.ResolveField(
ctx,
ec.OperationContext,
field,
ec.fieldContext_Identity_updatedAt,
func(ctx context.Context) (any, error) {
return obj.UpdatedAt, nil
},
nil,
ec.marshalNDatetime2timeᚐTime,
true,
true,
)
}
func (ec *executionContext) fieldContext_Identity_updatedAt(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
fc = &graphql.FieldContext{
Object: "Identity",
Field: field,
IsMethod: false,
IsResolver: false,
Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
return nil, errors.New("field of type Datetime does not have child fields")
},
}
return fc, nil
}
func (ec *executionContext) _Mutation_signInWithToken(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
return graphql.ResolveField(
ctx,
ec.OperationContext,
field,
ec.fieldContext_Mutation_signInWithToken,
func(ctx context.Context) (any, error) {
fc := graphql.GetFieldContext(ctx)
return ec.resolvers.Mutation().SignInWithToken(ctx, fc.Args["input"].(types.SignInWithTokenInput))
},
nil,
ec.marshalNSignInWithTokenPayload2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋtrustᚋv1ᚋtypesᚐSignInWithTokenPayload,
true,
true,
)
}
func (ec *executionContext) fieldContext_Mutation_signInWithToken(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
fc = &graphql.FieldContext{
Object: "Mutation",
Field: field,
IsMethod: true,
IsResolver: true,
Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
switch field.Name {
case "success":
return ec.fieldContext_SignInWithTokenPayload_success(ctx, field)
}
return nil, fmt.Errorf("no field named %q was found under type SignInWithTokenPayload", field.Name)
},
}
defer func() {
if r := recover(); r != nil {
err = ec.Recover(ctx, r)
ec.Error(ctx, err)
}
}()
ctx = graphql.WithFieldContext(ctx, fc)
if fc.Args, err = ec.field_Mutation_signInWithToken_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
ec.Error(ctx, err)
return fc, err
}
return fc, nil
}
func (ec *executionContext) _Mutation_requestAllAccesses(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
return graphql.ResolveField(
ctx,
@@ -3664,6 +3993,49 @@ func (ec *executionContext) fieldContext_PageInfo_endCursor(_ context.Context, f
return fc, nil
}
func (ec *executionContext) _Query_viewer(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
return graphql.ResolveField(
ctx,
ec.OperationContext,
field,
ec.fieldContext_Query_viewer,
func(ctx context.Context) (any, error) {
return ec.resolvers.Query().Viewer(ctx)
},
nil,
ec.marshalOIdentity2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋtrustᚋv1ᚋtypesᚐIdentity,
true,
false,
)
}
func (ec *executionContext) fieldContext_Query_viewer(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
fc = &graphql.FieldContext{
Object: "Query",
Field: field,
IsMethod: true,
IsResolver: true,
Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
switch field.Name {
case "id":
return ec.fieldContext_Identity_id(ctx, field)
case "email":
return ec.fieldContext_Identity_email(ctx, field)
case "fullName":
return ec.fieldContext_Identity_fullName(ctx, field)
case "emailVerified":
return ec.fieldContext_Identity_emailVerified(ctx, field)
case "createdAt":
return ec.fieldContext_Identity_createdAt(ctx, field)
case "updatedAt":
return ec.fieldContext_Identity_updatedAt(ctx, field)
}
return nil, fmt.Errorf("no field named %q was found under type Identity", field.Name)
},
}
return fc, nil
}
func (ec *executionContext) _Query_node(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
return graphql.ResolveField(
ctx,
@@ -4132,6 +4504,35 @@ func (ec *executionContext) fieldContext_RequestAccessesPayload_trustCenterAcces
return fc, nil
}
func (ec *executionContext) _SignInWithTokenPayload_success(ctx context.Context, field graphql.CollectedField, obj *types.SignInWithTokenPayload) (ret graphql.Marshaler) {
return graphql.ResolveField(
ctx,
ec.OperationContext,
field,
ec.fieldContext_SignInWithTokenPayload_success,
func(ctx context.Context) (any, error) {
return obj.Success, nil
},
nil,
ec.marshalNBoolean2bool,
true,
true,
)
}
func (ec *executionContext) fieldContext_SignInWithTokenPayload_success(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
fc = &graphql.FieldContext{
Object: "SignInWithTokenPayload",
Field: field,
IsMethod: false,
IsResolver: false,
Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
return nil, errors.New("field of type Boolean does not have child fields")
},
}
return fc, nil
}
func (ec *executionContext) _TrustCenter_id(ctx context.Context, field graphql.CollectedField, obj *types.TrustCenter) (ret graphql.Marshaler) {
return graphql.ResolveField(
ctx,
@@ -7219,7 +7620,7 @@ func (ec *executionContext) unmarshalInputRequestAllAccessesInput(ctx context.Co
asMap[k] = v
}
fieldsInOrder := [...]string{"trustCenterId", "email", "name"}
fieldsInOrder := [...]string{"trustCenterId", "email", "fullName"}
for _, k := range fieldsInOrder {
v, ok := asMap[k]
if !ok {
@@ -7235,18 +7636,18 @@ func (ec *executionContext) unmarshalInputRequestAllAccessesInput(ctx context.Co
it.TrustCenterID = data
case "email":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("email"))
data, err := ec.unmarshalOEmailAddr2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋmailᚐAddr(ctx, v)
data, err := ec.unmarshalNEmailAddr2goᚗproboᚗincᚋproboᚋpkgᚋmailᚐAddr(ctx, v)
if err != nil {
return it, err
}
it.Email = data
case "name":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("name"))
data, err := ec.unmarshalOString2ᚖstring(ctx, v)
case "fullName":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("fullName"))
data, err := ec.unmarshalNString2string(ctx, v)
if err != nil {
return it, err
}
it.Name = data
it.FullName = data
}
}
@@ -7260,7 +7661,7 @@ func (ec *executionContext) unmarshalInputRequestDocumentAccessInput(ctx context
asMap[k] = v
}
fieldsInOrder := [...]string{"trustCenterId", "documentId", "email", "name"}
fieldsInOrder := [...]string{"trustCenterId", "documentId", "email", "fullName"}
for _, k := range fieldsInOrder {
v, ok := asMap[k]
if !ok {
@@ -7283,18 +7684,18 @@ func (ec *executionContext) unmarshalInputRequestDocumentAccessInput(ctx context
it.DocumentID = data
case "email":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("email"))
data, err := ec.unmarshalOEmailAddr2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋmailᚐAddr(ctx, v)
data, err := ec.unmarshalNEmailAddr2goᚗproboᚗincᚋproboᚋpkgᚋmailᚐAddr(ctx, v)
if err != nil {
return it, err
}
it.Email = data
case "name":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("name"))
data, err := ec.unmarshalOString2ᚖstring(ctx, v)
case "fullName":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("fullName"))
data, err := ec.unmarshalNString2string(ctx, v)
if err != nil {
return it, err
}
it.Name = data
it.FullName = data
}
}
@@ -7308,7 +7709,7 @@ func (ec *executionContext) unmarshalInputRequestReportAccessInput(ctx context.C
asMap[k] = v
}
fieldsInOrder := [...]string{"trustCenterId", "reportId", "email", "name"}
fieldsInOrder := [...]string{"trustCenterId", "reportId", "email", "fullName"}
for _, k := range fieldsInOrder {
v, ok := asMap[k]
if !ok {
@@ -7331,18 +7732,18 @@ func (ec *executionContext) unmarshalInputRequestReportAccessInput(ctx context.C
it.ReportID = data
case "email":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("email"))
data, err := ec.unmarshalOEmailAddr2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋmailᚐAddr(ctx, v)
data, err := ec.unmarshalNEmailAddr2goᚗproboᚗincᚋproboᚋpkgᚋmailᚐAddr(ctx, v)
if err != nil {
return it, err
}
it.Email = data
case "name":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("name"))
data, err := ec.unmarshalOString2ᚖstring(ctx, v)
case "fullName":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("fullName"))
data, err := ec.unmarshalNString2string(ctx, v)
if err != nil {
return it, err
}
it.Name = data
it.FullName = data
}
}
@@ -7356,7 +7757,7 @@ func (ec *executionContext) unmarshalInputRequestTrustCenterFileAccessInput(ctx
asMap[k] = v
}
fieldsInOrder := [...]string{"trustCenterId", "trustCenterFileId", "email", "name"}
fieldsInOrder := [...]string{"trustCenterId", "trustCenterFileId", "email", "fullName"}
for _, k := range fieldsInOrder {
v, ok := asMap[k]
if !ok {
@@ -7379,18 +7780,45 @@ func (ec *executionContext) unmarshalInputRequestTrustCenterFileAccessInput(ctx
it.TrustCenterFileID = data
case "email":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("email"))
data, err := ec.unmarshalOEmailAddr2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋmailᚐAddr(ctx, v)
data, err := ec.unmarshalNEmailAddr2goᚗproboᚗincᚋproboᚋpkgᚋmailᚐAddr(ctx, v)
if err != nil {
return it, err
}
it.Email = data
case "name":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("name"))
data, err := ec.unmarshalOString2ᚖstring(ctx, v)
case "fullName":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("fullName"))
data, err := ec.unmarshalNString2string(ctx, v)
if err != nil {
return it, err
}
it.Name = data
it.FullName = data
}
}
return it, nil
}
func (ec *executionContext) unmarshalInputSignInWithTokenInput(ctx context.Context, obj any) (types.SignInWithTokenInput, error) {
var it types.SignInWithTokenInput
asMap := map[string]any{}
for k, v := range obj.(map[string]any) {
asMap[k] = v
}
fieldsInOrder := [...]string{"token"}
for _, k := range fieldsInOrder {
v, ok := asMap[k]
if !ok {
continue
}
switch k {
case "token":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("token"))
data, err := ec.unmarshalNString2string(ctx, v)
if err != nil {
return it, err
}
it.Token = data
}
}
@@ -7454,6 +7882,13 @@ func (ec *executionContext) _Node(ctx context.Context, sel ast.SelectionSet, obj
return graphql.Null
}
return ec._Organization(ctx, sel, obj)
case types.Identity:
return ec._Identity(ctx, sel, &obj)
case *types.Identity:
if obj == nil {
return graphql.Null
}
return ec._Identity(ctx, sel, obj)
case types.Framework:
return ec._Framework(ctx, sel, &obj)
case *types.Framework:
@@ -8155,6 +8590,70 @@ func (ec *executionContext) _Framework(ctx context.Context, sel ast.SelectionSet
return out
}
var identityImplementors = []string{"Identity", "Node"}
func (ec *executionContext) _Identity(ctx context.Context, sel ast.SelectionSet, obj *types.Identity) graphql.Marshaler {
fields := graphql.CollectFields(ec.OperationContext, sel, identityImplementors)
out := graphql.NewFieldSet(fields)
deferred := make(map[string]*graphql.FieldSet)
for i, field := range fields {
switch field.Name {
case "__typename":
out.Values[i] = graphql.MarshalString("Identity")
case "id":
out.Values[i] = ec._Identity_id(ctx, field, obj)
if out.Values[i] == graphql.Null {
out.Invalids++
}
case "email":
out.Values[i] = ec._Identity_email(ctx, field, obj)
if out.Values[i] == graphql.Null {
out.Invalids++
}
case "fullName":
out.Values[i] = ec._Identity_fullName(ctx, field, obj)
if out.Values[i] == graphql.Null {
out.Invalids++
}
case "emailVerified":
out.Values[i] = ec._Identity_emailVerified(ctx, field, obj)
if out.Values[i] == graphql.Null {
out.Invalids++
}
case "createdAt":
out.Values[i] = ec._Identity_createdAt(ctx, field, obj)
if out.Values[i] == graphql.Null {
out.Invalids++
}
case "updatedAt":
out.Values[i] = ec._Identity_updatedAt(ctx, field, obj)
if out.Values[i] == graphql.Null {
out.Invalids++
}
default:
panic("unknown field " + strconv.Quote(field.Name))
}
}
out.Dispatch(ctx)
if out.Invalids > 0 {
return graphql.Null
}
atomic.AddInt32(&ec.deferred, int32(len(deferred)))
for label, dfs := range deferred {
ec.processDeferredGroup(graphql.DeferredGroup{
Label: label,
Path: graphql.GetPath(ctx),
FieldSet: dfs,
Context: ctx,
})
}
return out
}
var mutationImplementors = []string{"Mutation"}
func (ec *executionContext) _Mutation(ctx context.Context, sel ast.SelectionSet) graphql.Marshaler {
@@ -8174,6 +8673,13 @@ func (ec *executionContext) _Mutation(ctx context.Context, sel ast.SelectionSet)
switch field.Name {
case "__typename":
out.Values[i] = graphql.MarshalString("Mutation")
case "signInWithToken":
out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
return ec._Mutation_signInWithToken(ctx, field)
})
if out.Values[i] == graphql.Null {
out.Invalids++
}
case "requestAllAccesses":
out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
return ec._Mutation_requestAllAccesses(ctx, field)
@@ -8405,6 +8911,25 @@ func (ec *executionContext) _Query(ctx context.Context, sel ast.SelectionSet) gr
switch field.Name {
case "__typename":
out.Values[i] = graphql.MarshalString("Query")
case "viewer":
field := field
innerFunc := func(ctx context.Context, _ *graphql.FieldSet) (res graphql.Marshaler) {
defer func() {
if r := recover(); r != nil {
ec.Error(ctx, ec.Recover(ctx, r))
}
}()
res = ec._Query_viewer(ctx, field)
return res
}
rrm := func(ctx context.Context) graphql.Marshaler {
return ec.OperationContext.RootResolverMiddleware(ctx,
func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
}
out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return rrm(innerCtx) })
case "node":
field := field
@@ -8651,6 +9176,45 @@ func (ec *executionContext) _RequestAccessesPayload(ctx context.Context, sel ast
return out
}
var signInWithTokenPayloadImplementors = []string{"SignInWithTokenPayload"}
func (ec *executionContext) _SignInWithTokenPayload(ctx context.Context, sel ast.SelectionSet, obj *types.SignInWithTokenPayload) graphql.Marshaler {
fields := graphql.CollectFields(ec.OperationContext, sel, signInWithTokenPayloadImplementors)
out := graphql.NewFieldSet(fields)
deferred := make(map[string]*graphql.FieldSet)
for i, field := range fields {
switch field.Name {
case "__typename":
out.Values[i] = graphql.MarshalString("SignInWithTokenPayload")
case "success":
out.Values[i] = ec._SignInWithTokenPayload_success(ctx, field, obj)
if out.Values[i] == graphql.Null {
out.Invalids++
}
default:
panic("unknown field " + strconv.Quote(field.Name))
}
}
out.Dispatch(ctx)
if out.Invalids > 0 {
return graphql.Null
}
atomic.AddInt32(&ec.deferred, int32(len(deferred)))
for label, dfs := range deferred {
ec.processDeferredGroup(graphql.DeferredGroup{
Label: label,
Path: graphql.GetPath(ctx),
FieldSet: dfs,
Context: ctx,
})
}
return out
}
var trustCenterImplementors = []string{"TrustCenter", "Node"}
func (ec *executionContext) _TrustCenter(ctx context.Context, sel ast.SelectionSet, obj *types.TrustCenter) graphql.Marshaler {
@@ -10954,6 +11518,25 @@ func (ec *executionContext) unmarshalNRequestTrustCenterFileAccessInput2goᚗpro
return res, graphql.ErrorOnPath(ctx, err)
}
func (ec *executionContext) unmarshalNSignInWithTokenInput2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋtrustᚋv1ᚋtypesᚐSignInWithTokenInput(ctx context.Context, v any) (types.SignInWithTokenInput, error) {
res, err := ec.unmarshalInputSignInWithTokenInput(ctx, v)
return res, graphql.ErrorOnPath(ctx, err)
}
func (ec *executionContext) marshalNSignInWithTokenPayload2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋtrustᚋv1ᚋtypesᚐSignInWithTokenPayload(ctx context.Context, sel ast.SelectionSet, v types.SignInWithTokenPayload) graphql.Marshaler {
return ec._SignInWithTokenPayload(ctx, sel, &v)
}
func (ec *executionContext) marshalNSignInWithTokenPayload2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋtrustᚋv1ᚋtypesᚐSignInWithTokenPayload(ctx context.Context, sel ast.SelectionSet, v *types.SignInWithTokenPayload) graphql.Marshaler {
if v == nil {
if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
graphql.AddErrorf(ctx, "the requested element is null which the schema does not allow")
}
return graphql.Null
}
return ec._SignInWithTokenPayload(ctx, sel, v)
}
func (ec *executionContext) unmarshalNString2string(ctx context.Context, v any) (string, error) {
res, err := graphql.UnmarshalString(v)
return res, graphql.ErrorOnPath(ctx, err)
@@ -11583,22 +12166,11 @@ func (ec *executionContext) marshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkg
return res
}
func (ec *executionContext) unmarshalOEmailAddr2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋmailᚐAddr(ctx context.Context, v any) (*mail.Addr, error) {
if v == nil {
return nil, nil
}
res, err := mail1.UnmarshalAddrScalar(v)
return &res, graphql.ErrorOnPath(ctx, err)
}
func (ec *executionContext) marshalOEmailAddr2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋmailᚐAddr(ctx context.Context, sel ast.SelectionSet, v *mail.Addr) graphql.Marshaler {
func (ec *executionContext) marshalOIdentity2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋtrustᚋv1ᚋtypesᚐIdentity(ctx context.Context, sel ast.SelectionSet, v *types.Identity) graphql.Marshaler {
if v == nil {
return graphql.Null
}
_ = sel
_ = ctx
res := mail1.MarshalAddrScalar(*v)
return res
return ec._Identity(ctx, sel, v)
}
func (ec *executionContext) unmarshalOInt2ᚖint(ctx context.Context, v any) (*int, error) {

139
pkg/server/api/trust/v1/trust_center_access_handler.go
View File

@@ -1,139 +0,0 @@
// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package trust_v1
import (
"context"
"encoding/json"
"fmt"
"net/http"
"time"
"go.gearno.de/kit/httpserver"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/probo"
"go.probo.inc/probo/pkg/statelesstoken"
"go.probo.inc/probo/pkg/trust"
)
type ctxKey struct {
name string
}
var (
CustomDomainOrganizationIDKey = &ctxKey{name: "custom_domain_organization_id"}
)
func GetCustomDomainOrganizationID(ctx context.Context) (gid.GID, bool) {
organizationID, ok := ctx.Value(CustomDomainOrganizationIDKey).(gid.GID)
return organizationID, ok
}
type (
AuthTokenRequest struct {
Token string `json:"token"`
}
AuthTokenResponse struct {
Success bool `json:"success"`
TrustCenterID string `json:"trust_center_id,omitempty"`
Message string `json:"message,omitempty"`
}
)
func authTokenHandler(trustSvc *trust.Service, trustAuthCfg TrustAuthConfig) http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) {
var req AuthTokenRequest
// Limit request body size to 1KB to prevent DoS attacks
limitedReader := http.MaxBytesReader(w, r.Body, 1024)
if err := json.NewDecoder(limitedReader).Decode(&req); err != nil {
httpserver.RenderError(w, http.StatusBadRequest, fmt.Errorf("cannot decode body: %w", err))
return
}
if req.Token == "" {
httpserver.RenderJSON(w, http.StatusBadRequest, AuthTokenResponse{
Success: false,
Message: "Token is required",
})
return
}
accessData, err := validateTrustCenterAccessToken(r.Context(), trustSvc, trustAuthCfg, req.Token)
if err != nil {
httpserver.RenderJSON(w, http.StatusUnauthorized, AuthTokenResponse{
Success: false,
Message: "Invalid or expired token",
})
return
}
tokenString, err := statelesstoken.NewToken(
trustAuthCfg.TokenSecret,
trustAuthCfg.TokenType,
trustAuthCfg.TokenDuration,
*accessData,
)
if err != nil {
httpserver.RenderError(w, http.StatusInternalServerError, fmt.Errorf("cannot create token: %w", err))
return
}
// Determine cookie domain: use custom domain if present, otherwise use configured domain
cookieDomain := trustAuthCfg.CookieDomain
if _, ok := GetCustomDomainOrganizationID(r.Context()); ok {
// On custom domain, use the request host
if r.TLS != nil && r.TLS.ServerName != "" {
cookieDomain = r.TLS.ServerName
}
}
cookie := &http.Cookie{
Name: trustAuthCfg.CookieName,
Value: tokenString,
Domain: cookieDomain,
Path: "/",
MaxAge: int(trustAuthCfg.CookieDuration / time.Second),
Secure: trustAuthCfg.CookieSecure,
HttpOnly: true,
SameSite: http.SameSiteStrictMode,
}
http.SetCookie(w, cookie)
httpserver.RenderJSON(w, http.StatusOK, AuthTokenResponse{
Success: true,
TrustCenterID: accessData.TrustCenterID.String(),
Message: "Authentication successful",
})
}
}
func validateTrustCenterAccessToken(ctx context.Context, trustSvc *trust.Service, trustAuthCfg TrustAuthConfig, tokenString string) (*probo.TrustCenterAccessData, error) {
token, err := statelesstoken.ValidateToken[probo.TrustCenterAccessData](
trustSvc.GetTokenSecret(),
trustAuthCfg.TokenType,
tokenString,
)
if err != nil {
return nil, fmt.Errorf("cannot validate trust center access token: %w", err)
}
tenantSvc := trustSvc.WithTenant(token.Data.TrustCenterID.TenantID())
if err := tenantSvc.TrustCenterAccesses.ValidateToken(ctx, token.Data.TrustCenterID, token.Data.Email); err != nil {
return nil, fmt.Errorf("cannot validate trust center access token: %w", err)
}
return &token.Data, nil
}

50
pkg/server/api/trust/v1/types/types.go
View File

@@ -102,6 +102,18 @@ type Framework struct {
func (Framework) IsNode() {}
func (this Framework) GetID() gid.GID { return this.ID }
type Identity struct {
ID gid.GID `json:"id"`
Email mail.Addr `json:"email"`
FullName string `json:"fullName"`
EmailVerified bool `json:"emailVerified"`
CreatedAt time.Time `json:"createdAt"`
UpdatedAt time.Time `json:"updatedAt"`
}
func (Identity) IsNode() {}
func (this Identity) GetID() gid.GID { return this.ID }
type Mutation struct {
}
@@ -143,30 +155,38 @@ type RequestAccessesPayload struct {
}
type RequestAllAccessesInput struct {
TrustCenterID gid.GID `json:"trustCenterId"`
Email *mail.Addr `json:"email,omitempty"`
Name *string `json:"name,omitempty"`
TrustCenterID gid.GID `json:"trustCenterId"`
Email mail.Addr `json:"email"`
FullName string `json:"fullName"`
}
type RequestDocumentAccessInput struct {
TrustCenterID gid.GID `json:"trustCenterId"`
DocumentID gid.GID `json:"documentId"`
Email *mail.Addr `json:"email,omitempty"`
Name *string `json:"name,omitempty"`
TrustCenterID gid.GID `json:"trustCenterId"`
DocumentID gid.GID `json:"documentId"`
Email mail.Addr `json:"email"`
FullName string `json:"fullName"`
}
type RequestReportAccessInput struct {
TrustCenterID gid.GID `json:"trustCenterId"`
ReportID gid.GID `json:"reportId"`
Email *mail.Addr `json:"email,omitempty"`
Name *string `json:"name,omitempty"`
TrustCenterID gid.GID `json:"trustCenterId"`
ReportID gid.GID `json:"reportId"`
Email mail.Addr `json:"email"`
FullName string `json:"fullName"`
}
type RequestTrustCenterFileAccessInput struct {
TrustCenterID gid.GID `json:"trustCenterId"`
TrustCenterFileID gid.GID `json:"trustCenterFileId"`
Email *mail.Addr `json:"email,omitempty"`
Name *string `json:"name,omitempty"`
TrustCenterID gid.GID `json:"trustCenterId"`
TrustCenterFileID gid.GID `json:"trustCenterFileId"`
Email mail.Addr `json:"email"`
FullName string `json:"fullName"`
}
type SignInWithTokenInput struct {
Token string `json:"token"`
}
type SignInWithTokenPayload struct {
Success bool `json:"success"`
}
type TrustCenter struct {

1315
pkg/server/api/trust/v1/v1_resolver.go
View File

File diff suppressed because it is too large Load Diff