Add granular trust center access

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
2025-09-25 14:48:40 +02:00
parent 60d1238534
commit 770a795cd3
27 changed files with 6650 additions and 806 deletions
--- a/pkg/coredata/audit.go
+++ b/pkg/coredata/audit.go
@@ -190,6 +190,56 @@ WHERE
 	return nil
 }

+func (a *Audits) LoadAllByOrganizationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+	filter *AuditFilter,
+) error {
+	q := `
+SELECT
+	id,
+	name,
+	organization_id,
+	framework_id,
+	report_id,
+	valid_from,
+	valid_until,
+	state,
+	show_on_trust_center,
+	created_at,
+	updated_at
+FROM
+	audits
+WHERE
+	%s
+	AND organization_id = @organization_id
+	AND %s
+ORDER BY valid_from DESC
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"organization_id": organizationID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, filter.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query audits: %w", err)
+	}
+
+	audits, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Audit])
+	if err != nil {
+		return fmt.Errorf("cannot collect audits: %w", err)
+	}
+
+	*a = audits
+
+	return nil
+}
+
 func (a *Audit) Insert(
 	ctx context.Context,
 	conn pg.Conn,
@@ -420,3 +470,48 @@ WHERE %s

 	return nil
 }
+
+func (a *Audit) LoadByReportID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	reportID gid.GID,
+) error {
+	q := `
+SELECT
+	id,
+	name,
+	organization_id,
+	framework_id,
+	report_id,
+	valid_from,
+	valid_until,
+	state,
+	show_on_trust_center,
+	created_at,
+	updated_at
+FROM
+	audits
+WHERE %s
+	AND report_id = @report_id
+LIMIT 1;
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"report_id": reportID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query audit: %w", err)
+	}
+
+	audit, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Audit])
+	if err != nil {
+		return fmt.Errorf("cannot collect audit: %w", err)
+	}
+
+	*a = audit
+
+	return nil
+}
--- a/pkg/coredata/document.go
+++ b/pkg/coredata/document.go
@@ -186,6 +186,55 @@ WHERE
 	return nil
 }

+func (p *Documents) LoadAllByOrganizationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+	filter *DocumentFilter,
+) error {
+	q := `
+SELECT
+	id,
+    organization_id,
+    owner_id,
+    title,
+    document_type,
+    current_published_version,
+    show_on_trust_center,
+    created_at,
+    updated_at
+FROM
+    documents
+WHERE
+    %s
+    AND deleted_at IS NULL
+    AND organization_id = @organization_id
+    AND %s
+ORDER BY title ASC
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment())
+
+	args := pgx.NamedArgs{"organization_id": organizationID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, filter.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query documents: %w", err)
+	}
+
+	documents, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Document])
+	if err != nil {
+		return fmt.Errorf("cannot collect documents: %w", err)
+	}
+
+	*p = documents
+
+	return nil
+}
+
 func (p Document) Insert(
 	ctx context.Context,
 	conn pg.Conn,
--- a/pkg/coredata/entity_type_reg.go
+++ b/pkg/coredata/entity_type_reg.go
@@ -57,4 +57,5 @@ const (
 	ProcessingActivityEntityType
 	ExportJobEntityType
 	TrustCenterReferenceEntityType
+	TrustCenterDocumentAccessEntityType
 )
--- a/pkg/coredata/migrations/20250924T111957Z.sql
+++ b/pkg/coredata/migrations/20250924T111957Z.sql
@@ -0,0 +1,16 @@
+CREATE TABLE trust_center_document_accesses(
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    trust_center_access_id TEXT NOT NULL REFERENCES trust_center_accesses(id)
+        ON UPDATE CASCADE ON DELETE CASCADE,
+    document_id TEXT REFERENCES documents(id)
+        ON UPDATE CASCADE ON DELETE CASCADE,
+    report_id TEXT REFERENCES reports(id)
+        ON UPDATE CASCADE ON DELETE CASCADE,
+    active BOOLEAN NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    updated_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    UNIQUE (trust_center_access_id, document_id),
+    UNIQUE (trust_center_access_id, report_id),
+    CHECK ((document_id IS NOT NULL) != (report_id IS NOT NULL))
+);
--- a/pkg/coredata/trust_center_document_access.go
+++ b/pkg/coredata/trust_center_document_access.go
@@ -0,0 +1,616 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/page"
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+)
+
+type (
+	TrustCenterDocumentAccess struct {
+		ID                  gid.GID   `db:"id"`
+		TrustCenterAccessID gid.GID   `db:"trust_center_access_id"`
+		DocumentID          *gid.GID  `db:"document_id"`
+		ReportID            *gid.GID  `db:"report_id"`
+		Active              bool      `db:"active"`
+		CreatedAt           time.Time `db:"created_at"`
+		UpdatedAt           time.Time `db:"updated_at"`
+	}
+
+	TrustCenterDocumentAccesses []*TrustCenterDocumentAccess
+)
+
+func (tcda *TrustCenterDocumentAccess) CursorKey(orderBy TrustCenterDocumentAccessOrderField) page.CursorKey {
+	switch orderBy {
+	case TrustCenterDocumentAccessOrderFieldCreatedAt:
+		return page.NewCursorKey(tcda.ID, tcda.CreatedAt)
+	}
+
+	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
+}
+
+func (tcda *TrustCenterDocumentAccess) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	accessID gid.GID,
+) error {
+	q := `
+SELECT
+	id,
+	trust_center_access_id,
+	document_id,
+	report_id,
+	active,
+	created_at,
+	updated_at
+FROM
+	trust_center_document_accesses
+WHERE
+	%s
+	AND id = @access_id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"access_id": accessID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query trust center document access: %w", err)
+	}
+
+	access, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[TrustCenterDocumentAccess])
+	if err != nil {
+		return fmt.Errorf("cannot collect trust center document access: %w", err)
+	}
+
+	*tcda = access
+
+	return nil
+}
+
+func (tcda *TrustCenterDocumentAccess) LoadByTrustCenterAccessIDAndDocumentID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	trustCenterAccessID gid.GID,
+	documentID gid.GID,
+) error {
+	q := `
+SELECT
+	id,
+	trust_center_access_id,
+	document_id,
+	report_id,
+	active,
+	created_at,
+	updated_at
+FROM
+	trust_center_document_accesses
+WHERE
+	%s
+	AND trust_center_access_id = @trust_center_access_id
+	AND document_id = @document_id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"trust_center_access_id": trustCenterAccessID,
+		"document_id":            documentID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query trust center document access: %w", err)
+	}
+
+	access, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[TrustCenterDocumentAccess])
+	if err != nil {
+		return fmt.Errorf("cannot collect trust center document access: %w", err)
+	}
+
+	*tcda = access
+
+	return nil
+}
+
+func (tcda *TrustCenterDocumentAccess) LoadByTrustCenterAccessIDAndReportID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	trustCenterAccessID gid.GID,
+	reportID gid.GID,
+) error {
+	q := `
+SELECT
+	id,
+	trust_center_access_id,
+	document_id,
+	report_id,
+	active,
+	created_at,
+	updated_at
+FROM
+	trust_center_document_accesses
+WHERE
+	%s
+	AND trust_center_access_id = @trust_center_access_id
+	AND report_id = @report_id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"trust_center_access_id": trustCenterAccessID,
+		"report_id":              reportID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query trust center document access: %w", err)
+	}
+
+	access, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[TrustCenterDocumentAccess])
+	if err != nil {
+		return fmt.Errorf("cannot collect trust center document access: %w", err)
+	}
+
+	*tcda = access
+
+	return nil
+}
+
+func (tcda *TrustCenterDocumentAccess) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO trust_center_document_accesses (
+	id,
+	tenant_id,
+	trust_center_access_id,
+	document_id,
+	report_id,
+	active,
+	created_at,
+	updated_at
+) VALUES (
+	@id,
+	@tenant_id,
+	@trust_center_access_id,
+	@document_id,
+	@report_id,
+	@active,
+	@created_at,
+	@updated_at
+)
+`
+
+	args := pgx.StrictNamedArgs{
+		"id":                     tcda.ID,
+		"tenant_id":              scope.GetTenantID(),
+		"trust_center_access_id": tcda.TrustCenterAccessID,
+		"document_id":            tcda.DocumentID,
+		"report_id":              tcda.ReportID,
+		"active":                 tcda.Active,
+		"created_at":             tcda.CreatedAt,
+		"updated_at":             tcda.UpdatedAt,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot insert trust center document access: %w", err)
+	}
+
+	return nil
+}
+
+func (tcda *TrustCenterDocumentAccess) Update(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+UPDATE trust_center_document_accesses SET
+	active = @active,
+	updated_at = @updated_at
+WHERE
+	%s
+	AND id = @id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"id":         tcda.ID,
+		"active":     tcda.Active,
+		"updated_at": tcda.UpdatedAt,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot update trust center document access: %w", err)
+	}
+
+	return nil
+}
+
+func (tcda *TrustCenterDocumentAccess) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+DELETE FROM trust_center_document_accesses
+WHERE
+	%s
+	AND id = @id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"id": tcda.ID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot delete trust center document access: %w", err)
+	}
+
+	return nil
+}
+
+func (tcdas *TrustCenterDocumentAccesses) CountByTrustCenterAccessID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	trustCenterAccessID gid.GID,
+) (int, error) {
+	q := `
+SELECT
+	COUNT(id)
+FROM
+	trust_center_document_accesses
+WHERE
+	%s
+	AND trust_center_access_id = @trust_center_access_id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"trust_center_access_id": trustCenterAccessID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	row := conn.QueryRow(ctx, q, args)
+
+	var count int
+	if err := row.Scan(&count); err != nil {
+		return 0, fmt.Errorf("cannot scan count: %w", err)
+	}
+
+	return count, nil
+}
+
+func (tcdas *TrustCenterDocumentAccesses) LoadByTrustCenterAccessID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	trustCenterAccessID gid.GID,
+	cursor *page.Cursor[TrustCenterDocumentAccessOrderField],
+) error {
+	q := `
+SELECT
+	id,
+	trust_center_access_id,
+	document_id,
+	report_id,
+	active,
+	created_at,
+	updated_at
+FROM
+	trust_center_document_accesses
+WHERE
+	%s
+	AND trust_center_access_id = @trust_center_access_id
+	AND %s
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"trust_center_access_id": trustCenterAccessID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query trust center document accesses: %w", err)
+	}
+
+	accesses, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[TrustCenterDocumentAccess])
+	if err != nil {
+		return fmt.Errorf("cannot collect trust center document accesses: %w", err)
+	}
+
+	*tcdas = accesses
+
+	return nil
+}
+
+func (tcdas *TrustCenterDocumentAccesses) LoadAllByTrustCenterAccessID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	trustCenterAccessID gid.GID,
+) error {
+	q := `
+SELECT
+	id,
+	trust_center_access_id,
+	document_id,
+	report_id,
+	active,
+	created_at,
+	updated_at
+FROM
+	trust_center_document_accesses
+WHERE
+	%s
+	AND trust_center_access_id = @trust_center_access_id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"trust_center_access_id": trustCenterAccessID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query trust center document accesses: %w", err)
+	}
+
+	accesses, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[TrustCenterDocumentAccess])
+	if err != nil {
+		return fmt.Errorf("cannot collect trust center document accesses: %w", err)
+	}
+
+	*tcdas = accesses
+
+	return nil
+}
+
+func DeactivateByTrustCenterAccessID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	trustCenterAccessID gid.GID,
+	updatedAt time.Time,
+) error {
+	q := `
+UPDATE trust_center_document_accesses
+SET active = false, updated_at = @updated_at
+WHERE
+	%s
+	AND trust_center_access_id = @trust_center_access_id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"trust_center_access_id": trustCenterAccessID,
+		"updated_at":             updatedAt,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot deactivate trust center document accesses: %w", err)
+	}
+
+	return nil
+}
+
+func ActivateByDocumentIDs(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	trustCenterAccessID gid.GID,
+	documentIDs []gid.GID,
+	updatedAt time.Time,
+) error {
+	if len(documentIDs) == 0 {
+		return nil
+	}
+
+	q := `
+UPDATE trust_center_document_accesses
+SET active = true, updated_at = @updated_at
+WHERE
+	%s
+	AND trust_center_access_id = @trust_center_access_id
+	AND document_id = ANY(@document_ids)
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"trust_center_access_id": trustCenterAccessID,
+		"document_ids":           documentIDs,
+		"updated_at":             updatedAt,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot activate trust center document accesses by document IDs: %w", err)
+	}
+
+	return nil
+}
+
+func ActivateByReportIDs(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	trustCenterAccessID gid.GID,
+	reportIDs []gid.GID,
+	updatedAt time.Time,
+) error {
+	if len(reportIDs) == 0 {
+		return nil
+	}
+
+	q := `
+UPDATE trust_center_document_accesses
+SET active = true, updated_at = @updated_at
+WHERE
+	%s
+	AND trust_center_access_id = @trust_center_access_id
+	AND report_id = ANY(@report_ids)
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"trust_center_access_id": trustCenterAccessID,
+		"report_ids":             reportIDs,
+		"updated_at":             updatedAt,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot activate trust center document accesses by report IDs: %w", err)
+	}
+
+	return nil
+}
+
+func (tcdas TrustCenterDocumentAccesses) BulkInsertDocumentAccesses(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	trustCenterAccessID gid.GID,
+	documentIDs []gid.GID,
+	createdAt time.Time,
+) error {
+	if len(documentIDs) == 0 {
+		return nil
+	}
+
+	q := `
+WITH document_access_data AS (
+	SELECT
+		generate_gid(decode_base64_unpadded(@tenant_id), @trust_center_document_access_entity_type) AS id,
+		@tenant_id AS tenant_id,
+		@trust_center_access_id AS trust_center_access_id,
+		unnest(@document_ids::text[]) AS document_id,
+		null::text AS report_id,
+		false AS active,
+		@created_at::timestamptz AS created_at,
+		@updated_at::timestamptz AS updated_at
+)
+INSERT INTO trust_center_document_accesses (
+	id, tenant_id, trust_center_access_id, document_id, report_id, active, created_at, updated_at
+)
+SELECT * FROM document_access_data
+`
+
+	args := pgx.StrictNamedArgs{
+		"tenant_id":              scope.GetTenantID(),
+		"trust_center_access_id": trustCenterAccessID,
+		"document_ids":           documentIDs,
+		"trust_center_document_access_entity_type": TrustCenterDocumentAccessEntityType,
+		"created_at": createdAt,
+		"updated_at": createdAt,
+	}
+
+	if _, err := conn.Exec(ctx, q, args); err != nil {
+		return fmt.Errorf("cannot bulk insert trust center document accesses: %w", err)
+	}
+
+	return nil
+}
+
+func (tcdas TrustCenterDocumentAccesses) BulkInsertReportAccesses(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	trustCenterAccessID gid.GID,
+	reportIDs []gid.GID,
+	createdAt time.Time,
+) error {
+	if len(reportIDs) == 0 {
+		return nil
+	}
+
+	q := `
+WITH report_access_data AS (
+	SELECT
+		generate_gid(decode_base64_unpadded(@tenant_id), @trust_center_document_access_entity_type) AS id,
+		@tenant_id AS tenant_id,
+		@trust_center_access_id AS trust_center_access_id,
+		null::text AS document_id,
+		unnest(@report_ids::text[]) AS report_id,
+		false AS active,
+		@created_at::timestamptz AS created_at,
+		@updated_at::timestamptz AS updated_at
+)
+INSERT INTO trust_center_document_accesses (
+	id, tenant_id, trust_center_access_id, document_id, report_id, active, created_at, updated_at
+)
+SELECT * FROM report_access_data
+`
+
+	args := pgx.StrictNamedArgs{
+		"tenant_id": scope.GetTenantID(),
+		"trust_center_document_access_entity_type": TrustCenterDocumentAccessEntityType,
+		"trust_center_access_id":                   trustCenterAccessID,
+		"report_ids":                               reportIDs,
+		"created_at":                               createdAt,
+		"updated_at":                               createdAt,
+	}
+
+	if _, err := conn.Exec(ctx, q, args); err != nil {
+		return fmt.Errorf("cannot bulk insert trust center report accesses: %w", err)
+	}
+
+	return nil
+}
--- a/pkg/coredata/trust_center_document_access_order_field.go
+++ b/pkg/coredata/trust_center_document_access_order_field.go
@@ -0,0 +1,47 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"fmt"
+)
+
+type TrustCenterDocumentAccessOrderField string
+
+const (
+	TrustCenterDocumentAccessOrderFieldCreatedAt TrustCenterDocumentAccessOrderField = "CREATED_AT"
+)
+
+func (tcdaof TrustCenterDocumentAccessOrderField) Column() string {
+	return string(tcdaof)
+}
+
+func (tcdaof TrustCenterDocumentAccessOrderField) String() string {
+	return string(tcdaof)
+}
+
+func (tcdaof TrustCenterDocumentAccessOrderField) MarshalText() ([]byte, error) {
+	return []byte(tcdaof.String()), nil
+}
+
+func (tcdaof *TrustCenterDocumentAccessOrderField) UnmarshalText(text []byte) error {
+	val := string(text)
+	switch val {
+	case string(TrustCenterDocumentAccessOrderFieldCreatedAt):
+		*tcdaof = TrustCenterDocumentAccessOrderField(val)
+		return nil
+	}
+	return fmt.Errorf("invalid TrustCenterDocumentAccessOrderField value: %q", val)
+}
--- a/pkg/probo/audit_service.go
+++ b/pkg/probo/audit_service.go
@@ -83,6 +83,26 @@ func (s AuditService) Get(
 	return audit, nil
 }

+func (s AuditService) GetByReportID(
+	ctx context.Context,
+	reportID gid.GID,
+) (*coredata.Audit, error) {
+	audit := &coredata.Audit{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return audit.LoadByReportID(ctx, conn, s.svc.scope, reportID)
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return audit, nil
+}
+
 func (s *AuditService) Create(
 	ctx context.Context,
 	req *CreateAuditRequest,
--- a/pkg/probo/trust_center_access_service.go
+++ b/pkg/probo/trust_center_access_service.go
@@ -16,7 +16,6 @@ package probo

 import (
 	"context"
-	"errors"
 	"fmt"
 	"net/mail"
 	"net/url"
@@ -40,13 +39,14 @@ type (
 		TrustCenterID gid.GID
 		Email         string
 		Name          string
-		Active        bool
 	}

 	UpdateTrustCenterAccessRequest struct {
-		ID     gid.GID
-		Name   *string
-		Active *bool
+		ID          gid.GID
+		Name        *string
+		Active      *bool
+		DocumentIDs []gid.GID
+		ReportIDs   []gid.GID
 	}

 	DeleteTrustCenterAccessRequest struct {
@@ -92,6 +92,77 @@ func (s TrustCenterAccessService) ListForTrustCenterID(
 	return page.NewPage(accesses, cursor), nil
 }

+func (s TrustCenterAccessService) ListDocumentAccesses(
+	ctx context.Context,
+	trustCenterAccessID gid.GID,
+	cursor *page.Cursor[coredata.TrustCenterDocumentAccessOrderField],
+) (*page.Page[*coredata.TrustCenterDocumentAccess, coredata.TrustCenterDocumentAccessOrderField], error) {
+	var documentAccesses coredata.TrustCenterDocumentAccesses
+
+	err := s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
+		return documentAccesses.LoadByTrustCenterAccessID(ctx, conn, s.svc.scope, trustCenterAccessID, cursor)
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(documentAccesses, cursor), nil
+}
+
+func (s TrustCenterAccessService) Get(
+	ctx context.Context,
+	accessID gid.GID,
+) (*coredata.TrustCenterAccess, error) {
+	var access coredata.TrustCenterAccess
+
+	err := s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
+		return access.LoadByID(ctx, conn, s.svc.scope, accessID)
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	return &access, nil
+}
+
+func (s TrustCenterAccessService) GetDocumentAccess(
+	ctx context.Context,
+	documentAccessID gid.GID,
+) (*coredata.TrustCenterDocumentAccess, error) {
+	var documentAccess coredata.TrustCenterDocumentAccess
+
+	err := s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
+		return documentAccess.LoadByID(ctx, conn, s.svc.scope, documentAccessID)
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	return &documentAccess, nil
+}
+
+func (s TrustCenterAccessService) CountDocumentAccesses(
+	ctx context.Context,
+	trustCenterAccessID gid.GID,
+) (int, error) {
+	var count int
+	err := s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
+		var documentAccesses coredata.TrustCenterDocumentAccesses
+		var err error
+		count, err = documentAccesses.CountByTrustCenterAccessID(ctx, conn, s.svc.scope, trustCenterAccessID)
+		return err
+	})
+
+	if err != nil {
+		return 0, err
+	}
+
+	return count, nil
+}
+
 func (s TrustCenterAccessService) ValidateToken(
 	ctx context.Context,
 	tokenString string,
@@ -134,17 +205,36 @@ func (s TrustCenterAccessService) Create(
 	var access *coredata.TrustCenterAccess

 	err := s.svc.pg.WithTx(ctx, func(tx pg.Conn) error {
-		existingAccess := &coredata.TrustCenterAccess{}
-		err := existingAccess.LoadByTrustCenterIDAndEmail(ctx, tx, s.svc.scope, req.TrustCenterID, req.Email)
+		trustCenter := &coredata.TrustCenter{}
+		if err := trustCenter.LoadByID(ctx, tx, s.svc.scope, req.TrustCenterID); err != nil {
+			return fmt.Errorf("cannot load trust center: %w", err)
+		}
+		organizationID := trustCenter.OrganizationID

-		if err == nil {
-			if err := existingAccess.Delete(ctx, tx, s.svc.scope); err != nil {
-				return fmt.Errorf("cannot delete existing trust center access: %w", err)
-			}
-		} else {
-			var notFoundErr *coredata.ErrTrustCenterAccessNotFound
-			if !errors.As(err, &notFoundErr) {
-				return fmt.Errorf("cannot load trust center access: %w", err)
+		documentIDs := []gid.GID{}
+		reportIDs := []gid.GID{}
+
+		var allDocuments coredata.Documents
+		filter := coredata.NewDocumentTrustCenterFilter()
+
+		if err := allDocuments.LoadAllByOrganizationID(ctx, tx, s.svc.scope, organizationID, filter); err != nil {
+			return fmt.Errorf("cannot list documents: %w", err)
+		}
+
+		for _, doc := range allDocuments {
+			documentIDs = append(documentIDs, doc.ID)
+		}
+
+		var allAudits coredata.Audits
+		auditFilter := coredata.NewAuditTrustCenterFilter()
+
+		if err := allAudits.LoadAllByOrganizationID(ctx, tx, s.svc.scope, organizationID, auditFilter); err != nil {
+			return fmt.Errorf("cannot list audits: %w", err)
+		}
+
+		for _, audit := range allAudits {
+			if audit.ReportID != nil {
+				reportIDs = append(reportIDs, *audit.ReportID)
 			}
 		}

@@ -154,7 +244,7 @@ func (s TrustCenterAccessService) Create(
 			TrustCenterID:                     req.TrustCenterID,
 			Email:                             req.Email,
 			Name:                              req.Name,
-			Active:                            req.Active,
+			Active:                            false,
 			HasAcceptedNonDisclosureAgreement: false,
 			CreatedAt:                         now,
 			UpdatedAt:                         now,
@@ -164,10 +254,13 @@ func (s TrustCenterAccessService) Create(
 			return fmt.Errorf("cannot insert trust center access: %w", err)
 		}

-		if req.Active {
-			if err := s.sendAccessEmail(ctx, tx, access); err != nil {
-				return fmt.Errorf("failed to send access email: %w", err)
-			}
+		var documentAccesses coredata.TrustCenterDocumentAccesses
+		if err := documentAccesses.BulkInsertDocumentAccesses(ctx, tx, s.svc.scope, access.ID, documentIDs, now); err != nil {
+			return fmt.Errorf("cannot bulk insert trust center document accesses: %w", err)
+		}
+
+		if err := documentAccesses.BulkInsertReportAccesses(ctx, tx, s.svc.scope, access.ID, reportIDs, now); err != nil {
+			return fmt.Errorf("cannot bulk insert trust center report accesses: %w", err)
 		}

 		return nil
@@ -212,6 +305,24 @@ func (s TrustCenterAccessService) Update(
 			return fmt.Errorf("cannot update trust center access: %w", err)
 		}

+		if req.DocumentIDs != nil || req.ReportIDs != nil {
+			if err := coredata.DeactivateByTrustCenterAccessID(ctx, tx, s.svc.scope, access.ID, now); err != nil {
+				return fmt.Errorf("cannot deactivate existing document accesses: %w", err)
+			}
+
+			if req.DocumentIDs != nil {
+				if err := coredata.ActivateByDocumentIDs(ctx, tx, s.svc.scope, access.ID, req.DocumentIDs, now); err != nil {
+					return fmt.Errorf("cannot activate document accesses: %w", err)
+				}
+			}
+
+			if req.ReportIDs != nil {
+				if err := coredata.ActivateByReportIDs(ctx, tx, s.svc.scope, access.ID, req.ReportIDs, now); err != nil {
+					return fmt.Errorf("cannot activate report accesses: %w", err)
+				}
+			}
+		}
+
 		if shouldSendEmail {
 			if err := s.sendAccessEmail(ctx, tx, access); err != nil {
 				return fmt.Errorf("failed to send access email: %w", err)
@@ -307,3 +418,73 @@ func (s TrustCenterAccessService) sendTrustCenterAccessEmail(
 	}
 	return nil
 }
+
+func (s TrustCenterAccessService) LoadDocumentAccess(
+	ctx context.Context,
+	trustCenterID gid.GID,
+	email string,
+	documentID gid.GID,
+) (*coredata.TrustCenterDocumentAccess, error) {
+	var documentAccess *coredata.TrustCenterDocumentAccess
+
+	err := s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
+		access := &coredata.TrustCenterAccess{}
+		err := access.LoadByTrustCenterIDAndEmail(ctx, conn, s.svc.scope, trustCenterID, email)
+		if err != nil {
+			return fmt.Errorf("cannot load trust center access: %w", err)
+		}
+
+		if !access.Active {
+			return fmt.Errorf("trust center access is not active")
+		}
+
+		documentAccess = &coredata.TrustCenterDocumentAccess{}
+		err = documentAccess.LoadByTrustCenterAccessIDAndDocumentID(ctx, conn, s.svc.scope, access.ID, documentID)
+		if err != nil {
+			return fmt.Errorf("cannot load document access: %w", err)
+		}
+
+		return nil
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	return documentAccess, nil
+}
+
+func (s TrustCenterAccessService) LoadReportAccess(
+	ctx context.Context,
+	trustCenterID gid.GID,
+	email string,
+	reportID gid.GID,
+) (*coredata.TrustCenterDocumentAccess, error) {
+	var reportAccess *coredata.TrustCenterDocumentAccess
+
+	err := s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
+		access := &coredata.TrustCenterAccess{}
+		err := access.LoadByTrustCenterIDAndEmail(ctx, conn, s.svc.scope, trustCenterID, email)
+		if err != nil {
+			return fmt.Errorf("cannot load trust center access: %w", err)
+		}
+
+		if !access.Active {
+			return fmt.Errorf("trust center access is not active")
+		}
+
+		reportAccess = &coredata.TrustCenterDocumentAccess{}
+		err = reportAccess.LoadByTrustCenterAccessIDAndReportID(ctx, conn, s.svc.scope, access.ID, reportID)
+		if err != nil {
+			return fmt.Errorf("cannot load report access: %w", err)
+		}
+
+		return nil
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	return reportAccess, nil
+}
--- a/pkg/server/api/console/v1/schema.graphql
+++ b/pkg/server/api/console/v1/schema.graphql
@@ -1103,6 +1103,14 @@ enum TrustCenterAccessOrderField
    )
 }

+enum TrustCenterDocumentAccessOrderField
+  @goModel(model: "github.com/getprobo/probo/pkg/coredata.TrustCenterDocumentAccessOrderField") {
+  CREATED_AT
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.TrustCenterDocumentAccessOrderFieldCreatedAt"
+    )
+}
+
 enum TrustCenterReferenceOrderField
  @goModel(model: "github.com/getprobo/probo/pkg/coredata.TrustCenterReferenceOrderField") {
  NAME
@@ -1292,6 +1300,14 @@ input TrustCenterAccessOrder
  field: TrustCenterAccessOrderField!
 }

+input TrustCenterDocumentAccessOrder
+  @goModel(
+    model: "github.com/getprobo/probo/pkg/server/api/console/v1/types.TrustCenterDocumentAccessOrderBy"
+  ) {
+  direction: OrderDirection!
+  field: TrustCenterDocumentAccessOrderField!
+}
+
 input TrustCenterReferenceOrder
  @goModel(
    model: "github.com/getprobo/probo/pkg/server/api/console/v1/types.TrustCenterReferenceOrderBy"
@@ -2143,6 +2159,7 @@ type Report implements Node {
  downloadUrl: String @goField(forceResolver: true)
  createdAt: Datetime!
  updatedAt: Datetime!
+  audit: Audit @goField(forceResolver: true)
 }

 type Session {
@@ -2193,6 +2210,38 @@ type TrustCenterAccess implements Node {
  hasAcceptedNonDisclosureAgreement: Boolean!
  createdAt: Datetime!
  updatedAt: Datetime!
+
+  documentAccesses(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: TrustCenterDocumentAccessOrder
+  ): TrustCenterDocumentAccessConnection! @goField(forceResolver: true)
+}
+
+type TrustCenterDocumentAccess implements Node {
+  id: ID!
+  active: Boolean!
+  createdAt: Datetime!
+  updatedAt: Datetime!
+  trustCenterAccess: TrustCenterAccess! @goField(forceResolver: true)
+  document: Document @goField(forceResolver: true)
+  report: Report @goField(forceResolver: true)
+}
+
+type TrustCenterDocumentAccessConnection
+  @goModel(
+    model: "github.com/getprobo/probo/pkg/server/api/console/v1/types.TrustCenterDocumentAccessConnection"
+  ) {
+  totalCount: Int! @goField(forceResolver: true)
+  edges: [TrustCenterDocumentAccessEdge!]!
+  pageInfo: PageInfo!
+}
+
+type TrustCenterDocumentAccessEdge {
+  cursor: CursorKey!
+  node: TrustCenterDocumentAccess!
 }

 type TrustCenterAccessConnection {
@@ -2887,6 +2936,8 @@ input UpdateTrustCenterAccessInput {
  id: ID!
  name: String
  active: Boolean
+  documentIds: [ID!]
+  reportIds: [ID!]
 }

 input DeleteTrustCenterAccessInput {
--- a/pkg/server/api/console/v1/schema/schema.go
+++ b/pkg/server/api/console/v1/schema/schema.go
--- a/pkg/server/api/console/v1/types/trust_center_document_access.go
+++ b/pkg/server/api/console/v1/types/trust_center_document_access.go
@@ -0,0 +1,80 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"github.com/getprobo/probo/pkg/coredata"
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/page"
+)
+
+type (
+	TrustCenterDocumentAccessOrderBy = OrderBy[coredata.TrustCenterDocumentAccessOrderField]
+
+	TrustCenterDocumentAccessConnection struct {
+		TotalCount int
+		Edges      []*TrustCenterDocumentAccessEdge
+		PageInfo   PageInfo
+
+		Resolver any
+		ParentID gid.GID
+	}
+)
+
+func NewTrustCenterDocumentAccess(tcda *coredata.TrustCenterDocumentAccess) *TrustCenterDocumentAccess {
+	return &TrustCenterDocumentAccess{
+		ID:        tcda.ID,
+		Active:    tcda.Active,
+		CreatedAt: tcda.CreatedAt,
+		UpdatedAt: tcda.UpdatedAt,
+	}
+}
+
+func NewTrustCenterDocumentAccessConnection(
+	p *page.Page[*coredata.TrustCenterDocumentAccess, coredata.TrustCenterDocumentAccessOrderField],
+	parentType any,
+	parentID gid.GID,
+) *TrustCenterDocumentAccessConnection {
+	var edges = make([]*TrustCenterDocumentAccessEdge, len(p.Data))
+
+	for i := range edges {
+		edges[i] = NewTrustCenterDocumentAccessEdge(p.Data[i], p.Cursor.OrderBy.Field)
+	}
+
+	return &TrustCenterDocumentAccessConnection{
+		Edges:    edges,
+		PageInfo: *NewPageInfo(p),
+
+		Resolver: parentType,
+		ParentID: parentID,
+	}
+}
+
+func NewTrustCenterDocumentAccessEdges(accesses []*coredata.TrustCenterDocumentAccess, orderBy coredata.TrustCenterDocumentAccessOrderField) []*TrustCenterDocumentAccessEdge {
+	edges := make([]*TrustCenterDocumentAccessEdge, len(accesses))
+
+	for i := range edges {
+		edges[i] = NewTrustCenterDocumentAccessEdge(accesses[i], orderBy)
+	}
+
+	return edges
+}
+
+func NewTrustCenterDocumentAccessEdge(access *coredata.TrustCenterDocumentAccess, orderBy coredata.TrustCenterDocumentAccessOrderField) *TrustCenterDocumentAccessEdge {
+	return &TrustCenterDocumentAccessEdge{
+		Cursor: access.CursorKey(orderBy),
+		Node:   NewTrustCenterDocumentAccess(access),
+	}
+}
--- a/pkg/server/api/console/v1/types/types.go
+++ b/pkg/server/api/console/v1/types/types.go
@@ -1388,6 +1388,7 @@ type Report struct {
 	DownloadURL *string   `json:"downloadUrl,omitempty"`
 	CreatedAt   time.Time `json:"createdAt"`
 	UpdatedAt   time.Time `json:"updatedAt"`
+	Audit       *Audit    `json:"audit,omitempty"`
 }

 func (Report) IsNode()             {}
@@ -1521,13 +1522,14 @@ func (TrustCenter) IsNode()             {}
 func (this TrustCenter) GetID() gid.GID { return this.ID }

 type TrustCenterAccess struct {
-	ID                                gid.GID   `json:"id"`
-	Email                             string    `json:"email"`
-	Name                              string    `json:"name"`
-	Active                            bool      `json:"active"`
-	HasAcceptedNonDisclosureAgreement bool      `json:"hasAcceptedNonDisclosureAgreement"`
-	CreatedAt                         time.Time `json:"createdAt"`
-	UpdatedAt                         time.Time `json:"updatedAt"`
+	ID                                gid.GID                              `json:"id"`
+	Email                             string                               `json:"email"`
+	Name                              string                               `json:"name"`
+	Active                            bool                                 `json:"active"`
+	HasAcceptedNonDisclosureAgreement bool                                 `json:"hasAcceptedNonDisclosureAgreement"`
+	CreatedAt                         time.Time                            `json:"createdAt"`
+	UpdatedAt                         time.Time                            `json:"updatedAt"`
+	DocumentAccesses                  *TrustCenterDocumentAccessConnection `json:"documentAccesses"`
 }

 func (TrustCenterAccess) IsNode()             {}
@@ -1548,6 +1550,24 @@ type TrustCenterConnection struct {
 	PageInfo *PageInfo          `json:"pageInfo"`
 }

+type TrustCenterDocumentAccess struct {
+	ID                gid.GID            `json:"id"`
+	Active            bool               `json:"active"`
+	CreatedAt         time.Time          `json:"createdAt"`
+	UpdatedAt         time.Time          `json:"updatedAt"`
+	TrustCenterAccess *TrustCenterAccess `json:"trustCenterAccess"`
+	Document          *Document          `json:"document,omitempty"`
+	Report            *Report            `json:"report,omitempty"`
+}
+
+func (TrustCenterDocumentAccess) IsNode()             {}
+func (this TrustCenterDocumentAccess) GetID() gid.GID { return this.ID }
+
+type TrustCenterDocumentAccessEdge struct {
+	Cursor page.CursorKey             `json:"cursor"`
+	Node   *TrustCenterDocumentAccess `json:"node"`
+}
+
 type TrustCenterEdge struct {
 	Cursor page.CursorKey `json:"cursor"`
 	Node   *TrustCenter   `json:"node"`
@@ -1810,9 +1830,11 @@ type UpdateTaskPayload struct {
 }

 type UpdateTrustCenterAccessInput struct {
-	ID     gid.GID `json:"id"`
-	Name   *string `json:"name,omitempty"`
-	Active *bool   `json:"active,omitempty"`
+	ID          gid.GID   `json:"id"`
+	Name        *string   `json:"name,omitempty"`
+	Active      *bool     `json:"active,omitempty"`
+	DocumentIds []gid.GID `json:"documentIds,omitempty"`
+	ReportIds   []gid.GID `json:"reportIds,omitempty"`
 }

 type UpdateTrustCenterAccessPayload struct {
--- a/pkg/server/api/console/v1/v1_resolver.go
+++ b/pkg/server/api/console/v1/v1_resolver.go
@@ -1167,7 +1167,6 @@ func (r *mutationResolver) CreateTrustCenterAccess(ctx context.Context, input ty
 		TrustCenterID: input.TrustCenterID,
 		Email:         input.Email,
 		Name:          input.Name,
-		Active:        input.Active,
 	})
 	if err != nil {
 		return nil, fmt.Errorf("cannot create trust center access: %w", err)
@@ -1183,9 +1182,11 @@ func (r *mutationResolver) UpdateTrustCenterAccess(ctx context.Context, input ty
 	prb := r.ProboService(ctx, input.ID.TenantID())

 	access, err := prb.TrustCenterAccesses.Update(ctx, &probo.UpdateTrustCenterAccessRequest{
-		ID:     input.ID,
-		Name:   input.Name,
-		Active: input.Active,
+		ID:          input.ID,
+		Name:        input.Name,
+		Active:      input.Active,
+		DocumentIDs: input.DocumentIds,
+		ReportIDs:   input.ReportIds,
 	})
 	if err != nil {
 		panic(fmt.Errorf("cannot update trust center access: %w", err))
@@ -4279,6 +4280,18 @@ func (r *reportResolver) DownloadURL(ctx context.Context, obj *types.Report) (*s
 	return url, nil
 }

+// Audit is the resolver for the audit field.
+func (r *reportResolver) Audit(ctx context.Context, obj *types.Report) (*types.Audit, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	audit, err := prb.Audits.GetByReportID(ctx, obj.ID)
+	if err != nil {
+		return nil, fmt.Errorf("cannot load audit for report: %w", err)
+	}
+
+	return types.NewAudit(audit), nil
+}
+
 // Owner is the resolver for the owner field.
 func (r *riskResolver) Owner(ctx context.Context, obj *types.Risk) (*types.People, error) {
 	prb := r.ProboService(ctx, obj.ID.TenantID())
@@ -4696,6 +4709,91 @@ func (r *trustCenterResolver) References(ctx context.Context, obj *types.TrustCe
 	return types.NewTrustCenterReferenceConnection(result, obj.ID), nil
 }

+// DocumentAccesses is the resolver for the documentAccesses field.
+func (r *trustCenterAccessResolver) DocumentAccesses(ctx context.Context, obj *types.TrustCenterAccess, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.OrderBy[coredata.TrustCenterDocumentAccessOrderField]) (*types.TrustCenterDocumentAccessConnection, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	pageOrderBy := page.OrderBy[coredata.TrustCenterDocumentAccessOrderField]{
+		Field:     coredata.TrustCenterDocumentAccessOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.TrustCenterDocumentAccessOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	result, err := prb.TrustCenterAccesses.ListDocumentAccesses(ctx, obj.ID, cursor)
+	if err != nil {
+		panic(fmt.Errorf("cannot list trust center document accesses: %w", err))
+	}
+
+	return types.NewTrustCenterDocumentAccessConnection(result, obj, obj.ID), nil
+}
+
+// TrustCenterAccess is the resolver for the trustCenterAccess field.
+func (r *trustCenterDocumentAccessResolver) TrustCenterAccess(ctx context.Context, obj *types.TrustCenterDocumentAccess) (*types.TrustCenterAccess, error) {
+	// The TrustCenterAccess is already loaded from the connection resolver
+	return obj.TrustCenterAccess, nil
+}
+
+// Document is the resolver for the document field.
+func (r *trustCenterDocumentAccessResolver) Document(ctx context.Context, obj *types.TrustCenterDocumentAccess) (*types.Document, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	documentAccess, err := prb.TrustCenterAccesses.GetDocumentAccess(ctx, obj.ID)
+	if err != nil {
+		return nil, fmt.Errorf("cannot load trust center document access: %w", err)
+	}
+
+	if documentAccess.DocumentID == nil {
+		return nil, nil
+	}
+
+	document, err := prb.Documents.Get(ctx, *documentAccess.DocumentID)
+	if err != nil {
+		return nil, fmt.Errorf("cannot load document: %w", err)
+	}
+
+	return types.NewDocument(document), nil
+}
+
+// Report is the resolver for the report field.
+func (r *trustCenterDocumentAccessResolver) Report(ctx context.Context, obj *types.TrustCenterDocumentAccess) (*types.Report, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	documentAccess, err := prb.TrustCenterAccesses.GetDocumentAccess(ctx, obj.ID)
+	if err != nil {
+		return nil, fmt.Errorf("cannot load trust center document access: %w", err)
+	}
+
+	if documentAccess.ReportID == nil {
+		return nil, nil
+	}
+
+	report, err := prb.Reports.Get(ctx, *documentAccess.ReportID)
+	if err != nil {
+		return nil, fmt.Errorf("cannot load report: %w", err)
+	}
+
+	return types.NewReport(report), nil
+}
+
+// TotalCount is the resolver for the totalCount field.
+func (r *trustCenterDocumentAccessConnectionResolver) TotalCount(ctx context.Context, obj *types.TrustCenterDocumentAccessConnection) (int, error) {
+	prb := r.ProboService(ctx, obj.ParentID.TenantID())
+
+	count, err := prb.TrustCenterAccesses.CountDocumentAccesses(ctx, obj.ParentID)
+	if err != nil {
+		return 0, fmt.Errorf("cannot count trust center document accesses: %w", err)
+	}
+
+	return count, nil
+}
+
 // LogoURL is the resolver for the logoUrl field.
 func (r *trustCenterReferenceResolver) LogoURL(ctx context.Context, obj *types.TrustCenterReference) (string, error) {
 	prb := r.ProboService(ctx, obj.ID.TenantID())
@@ -5249,6 +5347,21 @@ func (r *Resolver) TaskConnection() schema.TaskConnectionResolver { return &task
 // TrustCenter returns schema.TrustCenterResolver implementation.
 func (r *Resolver) TrustCenter() schema.TrustCenterResolver { return &trustCenterResolver{r} }

+// TrustCenterAccess returns schema.TrustCenterAccessResolver implementation.
+func (r *Resolver) TrustCenterAccess() schema.TrustCenterAccessResolver {
+	return &trustCenterAccessResolver{r}
+}
+
+// TrustCenterDocumentAccess returns schema.TrustCenterDocumentAccessResolver implementation.
+func (r *Resolver) TrustCenterDocumentAccess() schema.TrustCenterDocumentAccessResolver {
+	return &trustCenterDocumentAccessResolver{r}
+}
+
+// TrustCenterDocumentAccessConnection returns schema.TrustCenterDocumentAccessConnectionResolver implementation.
+func (r *Resolver) TrustCenterDocumentAccessConnection() schema.TrustCenterDocumentAccessConnectionResolver {
+	return &trustCenterDocumentAccessConnectionResolver{r}
+}
+
 // TrustCenterReference returns schema.TrustCenterReferenceResolver implementation.
 func (r *Resolver) TrustCenterReference() schema.TrustCenterReferenceResolver {
 	return &trustCenterReferenceResolver{r}
@@ -5337,6 +5450,9 @@ type snapshotConnectionResolver struct{ *Resolver }
 type taskResolver struct{ *Resolver }
 type taskConnectionResolver struct{ *Resolver }
 type trustCenterResolver struct{ *Resolver }
+type trustCenterAccessResolver struct{ *Resolver }
+type trustCenterDocumentAccessResolver struct{ *Resolver }
+type trustCenterDocumentAccessConnectionResolver struct{ *Resolver }
 type trustCenterReferenceResolver struct{ *Resolver }
 type trustCenterReferenceConnectionResolver struct{ *Resolver }
 type userResolver struct{ *Resolver }
--- a/pkg/server/api/trust/v1/schema.graphql
+++ b/pkg/server/api/trust/v1/schema.graphql
@@ -57,6 +57,8 @@ type Document implements Node {
  id: ID!
  title: String!
  documentType: DocumentType!
+  isUserAuthorized: Boolean! @goField(forceResolver: true)
+  hasUserRequestedAccess: Boolean! @goField(forceResolver: true)
 }

 type DocumentConnection {
@@ -78,6 +80,8 @@ type Framework implements Node {
 type Report implements Node {
  id: ID!
  filename: String!
+  isUserAuthorized: Boolean! @goField(forceResolver: true)
+  hasUserRequestedAccess: Boolean! @goField(forceResolver: true)
 }

 type Audit implements Node {
@@ -517,13 +521,13 @@ type TrustCenterAccess implements Node {
  updatedAt: Datetime!
 }

-input CreateTrustCenterAccessInput {
+input RequestAllAccessesInput {
  trustCenterId: ID!
-  email: String!
-  name: String!
+  email: String
+  name: String
 }

-type CreateTrustCenterAccessPayload {
+type RequestAccessesPayload {
  trustCenterAccess: TrustCenterAccess!
 }

@@ -539,6 +543,20 @@ input AcceptNonDisclosureAgreementInput {
  trustCenterId: ID!
 }

+input RequestDocumentAccessInput {
+  trustCenterId: ID!
+  documentId: ID!
+  email: String
+  name: String
+}
+
+input RequestReportAccessInput {
+  trustCenterId: ID!
+  reportId: ID!
+  email: String
+  name: String
+}
+
 type ExportDocumentPDFPayload {
  data: String!
 }
@@ -547,7 +565,7 @@ type ExportReportPDFPayload {
  data: String!
 }

-type  AcceptNonDisclosureAgreementPayload{
+type AcceptNonDisclosureAgreementPayload {
  success: Boolean!
 }

@@ -557,9 +575,9 @@ type Query {
 }

 type Mutation {
-  createTrustCenterAccess(
-    input: CreateTrustCenterAccessInput!
-  ): CreateTrustCenterAccessPayload! @mustBeAuthenticated(role: NONE)
+  requestAllAccesses(
+    input: RequestAllAccessesInput!
+  ): RequestAccessesPayload! @mustBeAuthenticated(role: NONE)

  exportDocumentPDF(
    input: ExportDocumentPDFInput!
@@ -572,4 +590,12 @@ type Mutation {
  acceptNonDisclosureAgreement(
    input: AcceptNonDisclosureAgreementInput!
  ): AcceptNonDisclosureAgreementPayload! @mustBeAuthenticated(role: USER)
+
+  requestDocumentAccess(
+    input: RequestDocumentAccessInput!
+  ): RequestAccessesPayload! @mustBeAuthenticated(role: NONE)
+
+  requestReportAccess(
+    input: RequestReportAccessInput!
+  ): RequestAccessesPayload! @mustBeAuthenticated(role: NONE)
 }
--- a/pkg/server/api/trust/v1/schema/schema.go
+++ b/pkg/server/api/trust/v1/schema/schema.go
--- a/pkg/server/api/trust/v1/types/types.go
+++ b/pkg/server/api/trust/v1/types/types.go
@@ -46,20 +46,12 @@ type AuditEdge struct {
 	Node   *Audit         `json:"node"`
 }

-type CreateTrustCenterAccessInput struct {
-	TrustCenterID gid.GID `json:"trustCenterId"`
-	Email         string  `json:"email"`
-	Name          string  `json:"name"`
-}
-
-type CreateTrustCenterAccessPayload struct {
-	TrustCenterAccess *TrustCenterAccess `json:"trustCenterAccess"`
-}
-
 type Document struct {
-	ID           gid.GID               `json:"id"`
-	Title        string                `json:"title"`
-	DocumentType coredata.DocumentType `json:"documentType"`
+	ID                     gid.GID               `json:"id"`
+	Title                  string                `json:"title"`
+	DocumentType           coredata.DocumentType `json:"documentType"`
+	IsUserAuthorized       bool                  `json:"isUserAuthorized"`
+	HasUserRequestedAccess bool                  `json:"hasUserRequestedAccess"`
 }

 func (Document) IsNode()             {}
@@ -126,13 +118,39 @@ type Query struct {
 }

 type Report struct {
-	ID       gid.GID `json:"id"`
-	Filename string  `json:"filename"`
+	ID                     gid.GID `json:"id"`
+	Filename               string  `json:"filename"`
+	IsUserAuthorized       bool    `json:"isUserAuthorized"`
+	HasUserRequestedAccess bool    `json:"hasUserRequestedAccess"`
 }

 func (Report) IsNode()             {}
 func (this Report) GetID() gid.GID { return this.ID }

+type RequestAccessesPayload struct {
+	TrustCenterAccess *TrustCenterAccess `json:"trustCenterAccess"`
+}
+
+type RequestAllAccessesInput struct {
+	TrustCenterID gid.GID `json:"trustCenterId"`
+	Email         *string `json:"email,omitempty"`
+	Name          *string `json:"name,omitempty"`
+}
+
+type RequestDocumentAccessInput struct {
+	TrustCenterID gid.GID `json:"trustCenterId"`
+	DocumentID    gid.GID `json:"documentId"`
+	Email         *string `json:"email,omitempty"`
+	Name          *string `json:"name,omitempty"`
+}
+
+type RequestReportAccessInput struct {
+	TrustCenterID gid.GID `json:"trustCenterId"`
+	ReportID      gid.GID `json:"reportId"`
+	Email         *string `json:"email,omitempty"`
+	Name          *string `json:"name,omitempty"`
+}
+
 type TrustCenter struct {
 	ID                                gid.GID                         `json:"id"`
 	Active                            bool                            `json:"active"`
--- a/pkg/server/api/trust/v1/v1_resolver.go
+++ b/pkg/server/api/trust/v1/v1_resolver.go
@@ -57,20 +57,90 @@ func (r *auditResolver) Report(ctx context.Context, obj *types.Audit) (*types.Re
 	return types.NewReport(report), nil
 }

-// CreateTrustCenterAccess is the resolver for the createTrustCenterAccess field.
-func (r *mutationResolver) CreateTrustCenterAccess(ctx context.Context, input types.CreateTrustCenterAccessInput) (*types.CreateTrustCenterAccessPayload, error) {
+// IsUserAuthorized is the resolver for the isUserAuthorized field.
+func (r *documentResolver) IsUserAuthorized(ctx context.Context, obj *types.Document) (bool, error) {
+	privateTrustService, err := r.PrivateTrustService(ctx, obj.ID.TenantID())
+	if err != nil {
+		return false, nil
+	}
+
+	userData := r.UserFromContext(ctx)
+	if userData != nil {
+		return true, nil
+	}
+
+	tokenData := TokenAccessFromContext(ctx)
+	if tokenData != nil {
+		documentAccess, err := privateTrustService.TrustCenterAccesses.LoadDocumentAccess(ctx, tokenData.TrustCenterID, tokenData.GetEmail(), obj.ID)
+		if err != nil {
+			return false, nil
+		}
+
+		return documentAccess.Active, nil
+	}
+
+	panic(fmt.Errorf("no user or token data found"))
+}
+
+// HasUserRequestedAccess is the resolver for the hasUserRequestedAccess field.
+func (r *documentResolver) HasUserRequestedAccess(ctx context.Context, obj *types.Document) (bool, error) {
+	privateTrustService, err := r.PrivateTrustService(ctx, obj.ID.TenantID())
+	if err != nil {
+		return false, nil
+	}
+
+	userData := r.UserFromContext(ctx)
+	if userData != nil {
+		return false, nil
+	}
+
+	tokenData := TokenAccessFromContext(ctx)
+	if tokenData != nil {
+		// Try to load document access - if it exists (regardless of active status), user has requested it
+		_, err := privateTrustService.TrustCenterAccesses.LoadDocumentAccess(ctx, tokenData.TrustCenterID, tokenData.GetEmail(), obj.ID)
+		if err != nil {
+			return false, nil // No access requested or error
+		}
+		return true, nil // Access exists (requested)
+	}
+
+	return false, nil
+}
+
+// RequestAllAccesses is the resolver for the requestAllAccesses field.
+func (r *mutationResolver) RequestAllAccesses(ctx context.Context, input types.RequestAllAccessesInput) (*types.RequestAccessesPayload, error) {
 	publicTrustService := r.PublicTrustService(ctx, input.TrustCenterID.TenantID())

-	access, err := publicTrustService.TrustCenterAccesses.Create(ctx, &trust.CreateTrustCenterAccessRequest{
+	userData := r.UserFromContext(ctx)
+	if userData != nil {
+		return nil, fmt.Errorf("session users cannot request trust center access")
+	}
+
+	email := input.Email
+	tokenData := TokenAccessFromContext(ctx)
+	if tokenData != nil {
+		if email != nil || input.Name != nil {
+			return nil, fmt.Errorf("email and name are not allowed for authenticated users")
+		}
+		emailValue := tokenData.GetEmail()
+		email = &emailValue
+	}
+	if email == nil {
+		return nil, fmt.Errorf("email is required for unauthenticated users")
+	}
+
+	access, err := publicTrustService.TrustCenterAccesses.Request(ctx, &trust.RequestTrustCenterAccessRequest{
 		TrustCenterID: input.TrustCenterID,
-		Email:         input.Email,
+		Email:         *email,
 		Name:          input.Name,
+		DocumentIDs:   nil,
+		ReportIDs:     nil,
 	})
 	if err != nil {
 		panic(fmt.Errorf("cannot create trust center access: %w", err))
 	}

-	return &types.CreateTrustCenterAccessPayload{
+	return &types.RequestAccessesPayload{
 		TrustCenterAccess: &types.TrustCenterAccess{
 			ID:        access.ID,
 			Email:     access.Email,
@@ -101,6 +171,15 @@ func (r *mutationResolver) ExportDocumentPDF(ctx context.Context, input types.Ex
 		if err != nil {
 			panic(fmt.Errorf("cannot check if user has accepted NDA: %w", err))
 		}
+
+		documentAccess, err := privateTrustService.TrustCenterAccesses.LoadDocumentAccess(ctx, tokenData.TrustCenterID, tokenData.GetEmail(), input.DocumentID)
+		if err != nil {
+			panic(fmt.Errorf("cannot check document access: %w", err))
+		}
+
+		if !documentAccess.Active {
+			return nil, fmt.Errorf("access denied: no permission to access this document")
+		}
 	}

 	if !hasAcceptedNDA {
@@ -144,6 +223,15 @@ func (r *mutationResolver) ExportReportPDF(ctx context.Context, input types.Expo
 		if err != nil {
 			panic(fmt.Errorf("cannot check if user has accepted NDA: %w", err))
 		}
+
+		reportAccess, err := privateTrustService.TrustCenterAccesses.LoadReportAccess(ctx, tokenData.TrustCenterID, tokenData.GetEmail(), input.ReportID)
+		if err != nil {
+			panic(fmt.Errorf("cannot check report access: %w", err))
+		}
+
+		if !reportAccess.Active {
+			return nil, fmt.Errorf("access denied: no permission to access this report")
+		}
 	}

 	if !hasAcceptedNDA {
@@ -188,6 +276,94 @@ func (r *mutationResolver) AcceptNonDisclosureAgreement(ctx context.Context, inp
 	return &types.AcceptNonDisclosureAgreementPayload{Success: true}, nil
 }

+// RequestDocumentAccess is the resolver for the requestDocumentAccess field.
+func (r *mutationResolver) RequestDocumentAccess(ctx context.Context, input types.RequestDocumentAccessInput) (*types.RequestAccessesPayload, error) {
+	publicTrustService := r.PublicTrustService(ctx, input.TrustCenterID.TenantID())
+
+	userData := r.UserFromContext(ctx)
+	if userData != nil {
+		return nil, fmt.Errorf("sessions users cannot request trust center access")
+	}
+
+	email := input.Email
+	tokenData := TokenAccessFromContext(ctx)
+	if tokenData != nil {
+		if email != nil || input.Name != nil {
+			return nil, fmt.Errorf("email and name are not allowed for authenticated users")
+		}
+		emailValue := tokenData.GetEmail()
+		email = &emailValue
+	}
+	if email == nil {
+		return nil, fmt.Errorf("email is required for unauthenticated users")
+	}
+
+	access, err := publicTrustService.TrustCenterAccesses.Request(ctx, &trust.RequestTrustCenterAccessRequest{
+		TrustCenterID: input.TrustCenterID,
+		Email:         *email,
+		Name:          input.Name,
+		DocumentIDs:   []gid.GID{input.DocumentID},
+		ReportIDs:     []gid.GID{},
+	})
+	if err != nil {
+		panic(fmt.Errorf("cannot request document access: %w", err))
+	}
+
+	return &types.RequestAccessesPayload{
+		TrustCenterAccess: &types.TrustCenterAccess{
+			ID:        access.ID,
+			Email:     access.Email,
+			Name:      access.Name,
+			CreatedAt: access.CreatedAt,
+			UpdatedAt: access.UpdatedAt,
+		},
+	}, nil
+}
+
+// RequestReportAccess is the resolver for the requestReportAccess field.
+func (r *mutationResolver) RequestReportAccess(ctx context.Context, input types.RequestReportAccessInput) (*types.RequestAccessesPayload, error) {
+	publicTrustService := r.PublicTrustService(ctx, input.TrustCenterID.TenantID())
+
+	userData := r.UserFromContext(ctx)
+	if userData != nil {
+		return nil, fmt.Errorf("session users cannot request trust center access")
+	}
+
+	email := input.Email
+	tokenData := TokenAccessFromContext(ctx)
+	if tokenData != nil {
+		if email != nil || input.Name != nil {
+			return nil, fmt.Errorf("email and name are not allowed for authenticated users")
+		}
+		emailValue := tokenData.GetEmail()
+		email = &emailValue
+	}
+	if email == nil {
+		return nil, fmt.Errorf("email is required for unauthenticated users")
+	}
+
+	access, err := publicTrustService.TrustCenterAccesses.Request(ctx, &trust.RequestTrustCenterAccessRequest{
+		TrustCenterID: input.TrustCenterID,
+		Email:         *email,
+		Name:          input.Name,
+		DocumentIDs:   []gid.GID{},
+		ReportIDs:     []gid.GID{input.ReportID},
+	})
+	if err != nil {
+		panic(fmt.Errorf("cannot request report access: %w", err))
+	}
+
+	return &types.RequestAccessesPayload{
+		TrustCenterAccess: &types.TrustCenterAccess{
+			ID:        access.ID,
+			Email:     access.Email,
+			Name:      access.Name,
+			CreatedAt: access.CreatedAt,
+			UpdatedAt: access.UpdatedAt,
+		},
+	}, nil
+}
+
 // LogoURL is the resolver for the logoUrl field.
 func (r *organizationResolver) LogoURL(ctx context.Context, obj *types.Organization) (*string, error) {
 	publicTrustService := r.PublicTrustService(ctx, obj.ID.TenantID())
@@ -290,6 +466,55 @@ func (r *queryResolver) TrustCenterBySlug(ctx context.Context, slug string) (*ty
 	return response, nil
 }

+// IsUserAuthorized is the resolver for the isUserAuthorized field.
+func (r *reportResolver) IsUserAuthorized(ctx context.Context, obj *types.Report) (bool, error) {
+	privateTrustService, err := r.PrivateTrustService(ctx, obj.ID.TenantID())
+	if err != nil {
+		return false, nil
+	}
+
+	userData := r.UserFromContext(ctx)
+	if userData != nil {
+		return true, nil
+	}
+
+	tokenData := TokenAccessFromContext(ctx)
+	if tokenData != nil {
+		reportAccess, err := privateTrustService.TrustCenterAccesses.LoadReportAccess(ctx, tokenData.TrustCenterID, tokenData.GetEmail(), obj.ID)
+		if err != nil {
+			return false, nil
+		}
+
+		return reportAccess.Active, nil
+	}
+
+	panic(fmt.Errorf("no user or token data found"))
+}
+
+// HasUserRequestedAccess is the resolver for the hasUserRequestedAccess field.
+func (r *reportResolver) HasUserRequestedAccess(ctx context.Context, obj *types.Report) (bool, error) {
+	privateTrustService, err := r.PrivateTrustService(ctx, obj.ID.TenantID())
+	if err != nil {
+		return false, nil
+	}
+
+	userData := r.UserFromContext(ctx)
+	if userData != nil {
+		return false, nil
+	}
+
+	tokenData := TokenAccessFromContext(ctx)
+	if tokenData != nil {
+		_, err := privateTrustService.TrustCenterAccesses.LoadReportAccess(ctx, tokenData.TrustCenterID, tokenData.GetEmail(), obj.ID)
+		if err != nil {
+			return false, nil
+		}
+		return true, nil
+	}
+
+	return false, nil
+}
+
 // NdaFileURL is the resolver for the ndaFileUrl field.
 func (r *trustCenterResolver) NdaFileURL(ctx context.Context, obj *types.TrustCenter) (*string, error) {
 	privateTrustService, err := r.PrivateTrustService(ctx, obj.ID.TenantID())
@@ -432,6 +657,9 @@ func (r *trustCenterReferenceResolver) LogoURL(ctx context.Context, obj *types.T
 // Audit returns schema.AuditResolver implementation.
 func (r *Resolver) Audit() schema.AuditResolver { return &auditResolver{r} }

+// Document returns schema.DocumentResolver implementation.
+func (r *Resolver) Document() schema.DocumentResolver { return &documentResolver{r} }
+
 // Mutation returns schema.MutationResolver implementation.
 func (r *Resolver) Mutation() schema.MutationResolver { return &mutationResolver{r} }

@@ -441,6 +669,9 @@ func (r *Resolver) Organization() schema.OrganizationResolver { return &organiza
 // Query returns schema.QueryResolver implementation.
 func (r *Resolver) Query() schema.QueryResolver { return &queryResolver{r} }

+// Report returns schema.ReportResolver implementation.
+func (r *Resolver) Report() schema.ReportResolver { return &reportResolver{r} }
+
 // TrustCenter returns schema.TrustCenterResolver implementation.
 func (r *Resolver) TrustCenter() schema.TrustCenterResolver { return &trustCenterResolver{r} }

@@ -450,8 +681,10 @@ func (r *Resolver) TrustCenterReference() schema.TrustCenterReferenceResolver {
 }

 type auditResolver struct{ *Resolver }
+type documentResolver struct{ *Resolver }
 type mutationResolver struct{ *Resolver }
 type organizationResolver struct{ *Resolver }
 type queryResolver struct{ *Resolver }
+type reportResolver struct{ *Resolver }
 type trustCenterResolver struct{ *Resolver }
 type trustCenterReferenceResolver struct{ *Resolver }
--- a/pkg/trust/trust_center_access_service.go
+++ b/pkg/trust/trust_center_access_service.go
@@ -34,10 +34,12 @@ type (
 		usrmgr *usrmgr.Service
 	}

-	CreateTrustCenterAccessRequest struct {
+	RequestTrustCenterAccessRequest struct {
 		TrustCenterID gid.GID
 		Email         string
-		Name          string
+		Name          *string
+		DocumentIDs   []gid.GID
+		ReportIDs     []gid.GID
 	}
 )

@@ -65,55 +67,107 @@ func (s TrustCenterAccessService) ValidateToken(
 	})
 }

-func (s TrustCenterAccessService) Create(
+func (s TrustCenterAccessService) Request(
 	ctx context.Context,
-	req *CreateTrustCenterAccessRequest,
+	req *RequestTrustCenterAccessRequest,
 ) (*coredata.TrustCenterAccess, error) {
-	if _, err := mail.ParseAddress(req.Email); err != nil {
-		return nil, fmt.Errorf("invalid email address")
-	}
-
-	if req.Name == "" {
-		return nil, fmt.Errorf("name is required")
-	}
-
 	now := time.Now()

 	var access *coredata.TrustCenterAccess

 	err := s.svc.pg.WithTx(ctx, func(tx pg.Conn) error {
+		var trustCenter *coredata.TrustCenter
+		var organizationID gid.GID
+		trustCenter = &coredata.TrustCenter{}
+		if err := trustCenter.LoadByID(ctx, tx, s.svc.scope, req.TrustCenterID); err != nil {
+			return fmt.Errorf("cannot load trust center: %w", err)
+		}
+		organizationID = trustCenter.OrganizationID
+
+		documentIDs := req.DocumentIDs
+		if req.DocumentIDs == nil {
+			var allDocuments coredata.Documents
+			filter := coredata.NewDocumentTrustCenterFilter()
+
+			if err := allDocuments.LoadAllByOrganizationID(ctx, tx, s.svc.scope, organizationID, filter); err != nil {
+				return fmt.Errorf("cannot list documents: %w", err)
+			}
+
+			for _, doc := range allDocuments {
+				documentIDs = append(documentIDs, doc.ID)
+			}
+		}
+
+		reportIDs := req.ReportIDs
+		if req.ReportIDs == nil {
+			var allAudits coredata.Audits
+			auditFilter := coredata.NewAuditTrustCenterFilter()
+
+			if err := allAudits.LoadAllByOrganizationID(ctx, tx, s.svc.scope, organizationID, auditFilter); err != nil {
+				return fmt.Errorf("cannot list audits: %w", err)
+			}
+
+			for _, audit := range allAudits {
+				if audit.ReportID != nil {
+					reportIDs = append(reportIDs, *audit.ReportID)
+				}
+			}
+		}
 		existingAccess := &coredata.TrustCenterAccess{}
 		err := existingAccess.LoadByTrustCenterIDAndEmail(ctx, tx, s.svc.scope, req.TrustCenterID, req.Email)

 		if err == nil {
-			if existingAccess.Active {
-				return fmt.Errorf("active trust center access already exists for this email")
-			}
-			if err := existingAccess.Delete(ctx, tx, s.svc.scope); err != nil {
-				return fmt.Errorf("cannot delete existing trust center access: %w", err)
-			}
+			access = existingAccess
 		} else {
 			var notFoundErr *coredata.ErrTrustCenterAccessNotFound
 			if !errors.As(err, &notFoundErr) {
 				return fmt.Errorf("cannot load trust center access: %w", err)
 			}
+
+			if req.Name == nil || *req.Name == "" {
+				return fmt.Errorf("name is required for new access requests")
+			}
+
+			if _, err := mail.ParseAddress(req.Email); err != nil {
+				return fmt.Errorf("invalid email address")
+			}
+
+			access = &coredata.TrustCenterAccess{
+				ID:                                gid.New(s.svc.scope.GetTenantID(), coredata.TrustCenterAccessEntityType),
+				TenantID:                          s.svc.scope.GetTenantID(),
+				TrustCenterID:                     req.TrustCenterID,
+				Email:                             req.Email,
+				Name:                              *req.Name,
+				Active:                            false,
+				HasAcceptedNonDisclosureAgreement: false,
+				CreatedAt:                         now,
+				UpdatedAt:                         now,
+			}
+
+			if err := access.Insert(ctx, tx, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot insert trust center access: %w", err)
+			}
 		}

-		access = &coredata.TrustCenterAccess{
-			ID:                                gid.New(s.svc.scope.GetTenantID(), coredata.TrustCenterAccessEntityType),
-			TenantID:                          s.svc.scope.GetTenantID(),
-			TrustCenterID:                     req.TrustCenterID,
-			Email:                             req.Email,
-			Name:                              req.Name,
-			Active:                            false,
-			HasAcceptedNonDisclosureAgreement: false,
-			CreatedAt:                         now,
-			UpdatedAt:                         now,
+		var existingAccesses coredata.TrustCenterDocumentAccesses
+		if err := existingAccesses.LoadAllByTrustCenterAccessID(ctx, tx, s.svc.scope, access.ID); err != nil {
+			return fmt.Errorf("cannot load existing access records: %w", err)
 		}

-		if err := access.Insert(ctx, tx, s.svc.scope); err != nil {
-			return fmt.Errorf("cannot insert trust center access: %w", err)
+		existingDocumentIDs, existingReportIDs := extractExistingIDs(existingAccesses)
+		newDocumentIDs := filterExistingIDs(documentIDs, existingDocumentIDs)
+		newReportIDs := filterExistingIDs(reportIDs, existingReportIDs)
+
+		var accesses coredata.TrustCenterDocumentAccesses
+
+		if err := accesses.BulkInsertDocumentAccesses(ctx, tx, s.svc.scope, access.ID, newDocumentIDs, now); err != nil {
+			return fmt.Errorf("cannot bulk insert trust center document accesses: %w", err)
 		}
+
+		if err := accesses.BulkInsertReportAccesses(ctx, tx, s.svc.scope, access.ID, newReportIDs, now); err != nil {
+			return fmt.Errorf("cannot bulk insert trust center report accesses: %w", err)
+		}
+
 		return nil
 	})

@@ -168,3 +222,105 @@ func (s TrustCenterAccessService) AcceptNonDisclosureAgreement(ctx context.Conte
 		return nil
 	})
 }
+
+func (s TrustCenterAccessService) LoadDocumentAccess(
+	ctx context.Context,
+	trustCenterID gid.GID,
+	email string,
+	documentID gid.GID,
+) (*coredata.TrustCenterDocumentAccess, error) {
+	var documentAccess *coredata.TrustCenterDocumentAccess
+
+	err := s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
+		access := &coredata.TrustCenterAccess{}
+		err := access.LoadByTrustCenterIDAndEmail(ctx, conn, s.svc.scope, trustCenterID, email)
+		if err != nil {
+			return fmt.Errorf("cannot load trust center access: %w", err)
+		}
+
+		if !access.Active {
+			return fmt.Errorf("trust center access is not active")
+		}
+
+		documentAccess = &coredata.TrustCenterDocumentAccess{}
+		err = documentAccess.LoadByTrustCenterAccessIDAndDocumentID(ctx, conn, s.svc.scope, access.ID, documentID)
+		if err != nil {
+			return fmt.Errorf("cannot load document access: %w", err)
+		}
+
+		return nil
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	return documentAccess, nil
+}
+
+func (s TrustCenterAccessService) LoadReportAccess(
+	ctx context.Context,
+	trustCenterID gid.GID,
+	email string,
+	reportID gid.GID,
+) (*coredata.TrustCenterDocumentAccess, error) {
+	var reportAccess *coredata.TrustCenterDocumentAccess
+
+	err := s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
+		access := &coredata.TrustCenterAccess{}
+		err := access.LoadByTrustCenterIDAndEmail(ctx, conn, s.svc.scope, trustCenterID, email)
+		if err != nil {
+			return fmt.Errorf("cannot load trust center access: %w", err)
+		}
+
+		if !access.Active {
+			return fmt.Errorf("trust center access is not active")
+		}
+
+		reportAccess = &coredata.TrustCenterDocumentAccess{}
+		err = reportAccess.LoadByTrustCenterAccessIDAndReportID(ctx, conn, s.svc.scope, access.ID, reportID)
+		if err != nil {
+			return fmt.Errorf("cannot load report access: %w", err)
+		}
+
+		return nil
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	return reportAccess, nil
+}
+
+func extractExistingIDs(accesses coredata.TrustCenterDocumentAccesses) ([]gid.GID, []gid.GID) {
+	var documentIDs []gid.GID
+	var reportIDs []gid.GID
+
+	for _, access := range accesses {
+		if access.DocumentID != nil {
+			documentIDs = append(documentIDs, *access.DocumentID)
+		}
+		if access.ReportID != nil {
+			reportIDs = append(reportIDs, *access.ReportID)
+		}
+	}
+
+	return documentIDs, reportIDs
+}
+
+func filterExistingIDs(allIDs []gid.GID, existingIDs []gid.GID) []gid.GID {
+	existingMap := make(map[gid.GID]bool)
+	for _, id := range existingIDs {
+		existingMap[id] = true
+	}
+
+	var newIDs []gid.GID
+	for _, id := range allIDs {
+		if !existingMap[id] {
+			newIDs = append(newIDs, id)
+		}
+	}
+
+	return newIDs
+}