rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add granular trust center access

Browse Source 
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
This commit is contained in:
Sacha Al Himdani
2025-09-25 14:48:40 +02:00
parent 60d1238534
commit 770a795cd3
27 changed files with 6650 additions and 806 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
pkg/server/api/trust/v1/schema.graphql
View File

@@ -57,6 +57,8 @@ type Document implements Node {
id: ID!
title: String!
documentType: DocumentType!
isUserAuthorized: Boolean! @goField(forceResolver: true)
hasUserRequestedAccess: Boolean! @goField(forceResolver: true)
}
type DocumentConnection {
@@ -78,6 +80,8 @@ type Framework implements Node {
type Report implements Node {
id: ID!
filename: String!
isUserAuthorized: Boolean! @goField(forceResolver: true)
hasUserRequestedAccess: Boolean! @goField(forceResolver: true)
}
type Audit implements Node {
@@ -517,13 +521,13 @@ type TrustCenterAccess implements Node {
updatedAt: Datetime!
}
input CreateTrustCenterAccessInput {
input RequestAllAccessesInput {
trustCenterId: ID!
email: String!
name: String!
email: String
name: String
}
type CreateTrustCenterAccessPayload {
type RequestAccessesPayload {
trustCenterAccess: TrustCenterAccess!
}
@@ -539,6 +543,20 @@ input AcceptNonDisclosureAgreementInput {
trustCenterId: ID!
}
input RequestDocumentAccessInput {
trustCenterId: ID!
documentId: ID!
email: String
name: String
}
input RequestReportAccessInput {
trustCenterId: ID!
reportId: ID!
email: String
name: String
}
type ExportDocumentPDFPayload {
data: String!
}
@@ -547,7 +565,7 @@ type ExportReportPDFPayload {
data: String!
}
type AcceptNonDisclosureAgreementPayload{
type AcceptNonDisclosureAgreementPayload {
success: Boolean!
}
@@ -557,9 +575,9 @@ type Query {
}
type Mutation {
createTrustCenterAccess(
input: CreateTrustCenterAccessInput!
): CreateTrustCenterAccessPayload! @mustBeAuthenticated(role: NONE)
requestAllAccesses(
input: RequestAllAccessesInput!
): RequestAccessesPayload! @mustBeAuthenticated(role: NONE)
exportDocumentPDF(
input: ExportDocumentPDFInput!
@@ -572,4 +590,12 @@ type Mutation {
acceptNonDisclosureAgreement(
input: AcceptNonDisclosureAgreementInput!
): AcceptNonDisclosureAgreementPayload! @mustBeAuthenticated(role: USER)
requestDocumentAccess(
input: RequestDocumentAccessInput!
): RequestAccessesPayload! @mustBeAuthenticated(role: NONE)
requestReportAccess(
input: RequestReportAccessInput!
): RequestAccessesPayload! @mustBeAuthenticated(role: NONE)
}

1236
pkg/server/api/trust/v1/schema/schema.go
View File

File diff suppressed because it is too large Load Diff

48
pkg/server/api/trust/v1/types/types.go
View File

@@ -46,20 +46,12 @@ type AuditEdge struct {
Node *Audit `json:"node"`
}
type CreateTrustCenterAccessInput struct {
TrustCenterID gid.GID `json:"trustCenterId"`
Email string `json:"email"`
Name string `json:"name"`
}
type CreateTrustCenterAccessPayload struct {
TrustCenterAccess *TrustCenterAccess `json:"trustCenterAccess"`
}
type Document struct {
ID gid.GID `json:"id"`
Title string `json:"title"`
DocumentType coredata.DocumentType `json:"documentType"`
ID gid.GID `json:"id"`
Title string `json:"title"`
DocumentType coredata.DocumentType `json:"documentType"`
IsUserAuthorized bool `json:"isUserAuthorized"`
HasUserRequestedAccess bool `json:"hasUserRequestedAccess"`
}
func (Document) IsNode() {}
@@ -126,13 +118,39 @@ type Query struct {
}
type Report struct {
ID gid.GID `json:"id"`
Filename string `json:"filename"`
ID gid.GID `json:"id"`
Filename string `json:"filename"`
IsUserAuthorized bool `json:"isUserAuthorized"`
HasUserRequestedAccess bool `json:"hasUserRequestedAccess"`
}
func (Report) IsNode() {}
func (this Report) GetID() gid.GID { return this.ID }
type RequestAccessesPayload struct {
TrustCenterAccess *TrustCenterAccess `json:"trustCenterAccess"`
}
type RequestAllAccessesInput struct {
TrustCenterID gid.GID `json:"trustCenterId"`
Email *string `json:"email,omitempty"`
Name *string `json:"name,omitempty"`
}
type RequestDocumentAccessInput struct {
TrustCenterID gid.GID `json:"trustCenterId"`
DocumentID gid.GID `json:"documentId"`
Email *string `json:"email,omitempty"`
Name *string `json:"name,omitempty"`
}
type RequestReportAccessInput struct {
TrustCenterID gid.GID `json:"trustCenterId"`
ReportID gid.GID `json:"reportId"`
Email *string `json:"email,omitempty"`
Name *string `json:"name,omitempty"`
}
type TrustCenter struct {
ID gid.GID `json:"id"`
Active bool `json:"active"`

243
pkg/server/api/trust/v1/v1_resolver.go
View File

@@ -57,20 +57,90 @@ func (r *auditResolver) Report(ctx context.Context, obj *types.Audit) (*types.Re
return types.NewReport(report), nil
}
// CreateTrustCenterAccess is the resolver for the createTrustCenterAccess field.
func (r *mutationResolver) CreateTrustCenterAccess(ctx context.Context, input types.CreateTrustCenterAccessInput) (*types.CreateTrustCenterAccessPayload, error) {
// IsUserAuthorized is the resolver for the isUserAuthorized field.
func (r *documentResolver) IsUserAuthorized(ctx context.Context, obj *types.Document) (bool, error) {
privateTrustService, err := r.PrivateTrustService(ctx, obj.ID.TenantID())
if err != nil {
return false, nil
}
userData := r.UserFromContext(ctx)
if userData != nil {
return true, nil
}
tokenData := TokenAccessFromContext(ctx)
if tokenData != nil {
documentAccess, err := privateTrustService.TrustCenterAccesses.LoadDocumentAccess(ctx, tokenData.TrustCenterID, tokenData.GetEmail(), obj.ID)
if err != nil {
return false, nil
}
return documentAccess.Active, nil
}
panic(fmt.Errorf("no user or token data found"))
}
// HasUserRequestedAccess is the resolver for the hasUserRequestedAccess field.
func (r *documentResolver) HasUserRequestedAccess(ctx context.Context, obj *types.Document) (bool, error) {
privateTrustService, err := r.PrivateTrustService(ctx, obj.ID.TenantID())
if err != nil {
return false, nil
}
userData := r.UserFromContext(ctx)
if userData != nil {
return false, nil
}
tokenData := TokenAccessFromContext(ctx)
if tokenData != nil {
// Try to load document access - if it exists (regardless of active status), user has requested it
_, err := privateTrustService.TrustCenterAccesses.LoadDocumentAccess(ctx, tokenData.TrustCenterID, tokenData.GetEmail(), obj.ID)
if err != nil {
return false, nil // No access requested or error
}
return true, nil // Access exists (requested)
}
return false, nil
}
// RequestAllAccesses is the resolver for the requestAllAccesses field.
func (r *mutationResolver) RequestAllAccesses(ctx context.Context, input types.RequestAllAccessesInput) (*types.RequestAccessesPayload, error) {
publicTrustService := r.PublicTrustService(ctx, input.TrustCenterID.TenantID())
access, err := publicTrustService.TrustCenterAccesses.Create(ctx, &trust.CreateTrustCenterAccessRequest{
userData := r.UserFromContext(ctx)
if userData != nil {
return nil, fmt.Errorf("session users cannot request trust center access")
}
email := input.Email
tokenData := TokenAccessFromContext(ctx)
if tokenData != nil {
if email != nil || input.Name != nil {
return nil, fmt.Errorf("email and name are not allowed for authenticated users")
}
emailValue := tokenData.GetEmail()
email = &emailValue
}
if email == nil {
return nil, fmt.Errorf("email is required for unauthenticated users")
}
access, err := publicTrustService.TrustCenterAccesses.Request(ctx, &trust.RequestTrustCenterAccessRequest{
TrustCenterID: input.TrustCenterID,
Email: input.Email,
Email: *email,
Name: input.Name,
DocumentIDs: nil,
ReportIDs: nil,
})
if err != nil {
panic(fmt.Errorf("cannot create trust center access: %w", err))
}
return &types.CreateTrustCenterAccessPayload{
return &types.RequestAccessesPayload{
TrustCenterAccess: &types.TrustCenterAccess{
ID: access.ID,
Email: access.Email,
@@ -101,6 +171,15 @@ func (r *mutationResolver) ExportDocumentPDF(ctx context.Context, input types.Ex
if err != nil {
panic(fmt.Errorf("cannot check if user has accepted NDA: %w", err))
}
documentAccess, err := privateTrustService.TrustCenterAccesses.LoadDocumentAccess(ctx, tokenData.TrustCenterID, tokenData.GetEmail(), input.DocumentID)
if err != nil {
panic(fmt.Errorf("cannot check document access: %w", err))
}
if !documentAccess.Active {
return nil, fmt.Errorf("access denied: no permission to access this document")
}
}
if !hasAcceptedNDA {
@@ -144,6 +223,15 @@ func (r *mutationResolver) ExportReportPDF(ctx context.Context, input types.Expo
if err != nil {
panic(fmt.Errorf("cannot check if user has accepted NDA: %w", err))
}
reportAccess, err := privateTrustService.TrustCenterAccesses.LoadReportAccess(ctx, tokenData.TrustCenterID, tokenData.GetEmail(), input.ReportID)
if err != nil {
panic(fmt.Errorf("cannot check report access: %w", err))
}
if !reportAccess.Active {
return nil, fmt.Errorf("access denied: no permission to access this report")
}
}
if !hasAcceptedNDA {
@@ -188,6 +276,94 @@ func (r *mutationResolver) AcceptNonDisclosureAgreement(ctx context.Context, inp
return &types.AcceptNonDisclosureAgreementPayload{Success: true}, nil
}
// RequestDocumentAccess is the resolver for the requestDocumentAccess field.
func (r *mutationResolver) RequestDocumentAccess(ctx context.Context, input types.RequestDocumentAccessInput) (*types.RequestAccessesPayload, error) {
publicTrustService := r.PublicTrustService(ctx, input.TrustCenterID.TenantID())
userData := r.UserFromContext(ctx)
if userData != nil {
return nil, fmt.Errorf("sessions users cannot request trust center access")
}
email := input.Email
tokenData := TokenAccessFromContext(ctx)
if tokenData != nil {
if email != nil || input.Name != nil {
return nil, fmt.Errorf("email and name are not allowed for authenticated users")
}
emailValue := tokenData.GetEmail()
email = &emailValue
}
if email == nil {
return nil, fmt.Errorf("email is required for unauthenticated users")
}
access, err := publicTrustService.TrustCenterAccesses.Request(ctx, &trust.RequestTrustCenterAccessRequest{
TrustCenterID: input.TrustCenterID,
Email: *email,
Name: input.Name,
DocumentIDs: []gid.GID{input.DocumentID},
ReportIDs: []gid.GID{},
})
if err != nil {
panic(fmt.Errorf("cannot request document access: %w", err))
}
return &types.RequestAccessesPayload{
TrustCenterAccess: &types.TrustCenterAccess{
ID: access.ID,
Email: access.Email,
Name: access.Name,
CreatedAt: access.CreatedAt,
UpdatedAt: access.UpdatedAt,
},
}, nil
}
// RequestReportAccess is the resolver for the requestReportAccess field.
func (r *mutationResolver) RequestReportAccess(ctx context.Context, input types.RequestReportAccessInput) (*types.RequestAccessesPayload, error) {
publicTrustService := r.PublicTrustService(ctx, input.TrustCenterID.TenantID())
userData := r.UserFromContext(ctx)
if userData != nil {
return nil, fmt.Errorf("session users cannot request trust center access")
}
email := input.Email
tokenData := TokenAccessFromContext(ctx)
if tokenData != nil {
if email != nil || input.Name != nil {
return nil, fmt.Errorf("email and name are not allowed for authenticated users")
}
emailValue := tokenData.GetEmail()
email = &emailValue
}
if email == nil {
return nil, fmt.Errorf("email is required for unauthenticated users")
}
access, err := publicTrustService.TrustCenterAccesses.Request(ctx, &trust.RequestTrustCenterAccessRequest{
TrustCenterID: input.TrustCenterID,
Email: *email,
Name: input.Name,
DocumentIDs: []gid.GID{},
ReportIDs: []gid.GID{input.ReportID},
})
if err != nil {
panic(fmt.Errorf("cannot request report access: %w", err))
}
return &types.RequestAccessesPayload{
TrustCenterAccess: &types.TrustCenterAccess{
ID: access.ID,
Email: access.Email,
Name: access.Name,
CreatedAt: access.CreatedAt,
UpdatedAt: access.UpdatedAt,
},
}, nil
}
// LogoURL is the resolver for the logoUrl field.
func (r *organizationResolver) LogoURL(ctx context.Context, obj *types.Organization) (*string, error) {
publicTrustService := r.PublicTrustService(ctx, obj.ID.TenantID())
@@ -290,6 +466,55 @@ func (r *queryResolver) TrustCenterBySlug(ctx context.Context, slug string) (*ty
return response, nil
}
// IsUserAuthorized is the resolver for the isUserAuthorized field.
func (r *reportResolver) IsUserAuthorized(ctx context.Context, obj *types.Report) (bool, error) {
privateTrustService, err := r.PrivateTrustService(ctx, obj.ID.TenantID())
if err != nil {
return false, nil
}
userData := r.UserFromContext(ctx)
if userData != nil {
return true, nil
}
tokenData := TokenAccessFromContext(ctx)
if tokenData != nil {
reportAccess, err := privateTrustService.TrustCenterAccesses.LoadReportAccess(ctx, tokenData.TrustCenterID, tokenData.GetEmail(), obj.ID)
if err != nil {
return false, nil
}
return reportAccess.Active, nil
}
panic(fmt.Errorf("no user or token data found"))
}
// HasUserRequestedAccess is the resolver for the hasUserRequestedAccess field.
func (r *reportResolver) HasUserRequestedAccess(ctx context.Context, obj *types.Report) (bool, error) {
privateTrustService, err := r.PrivateTrustService(ctx, obj.ID.TenantID())
if err != nil {
return false, nil
}
userData := r.UserFromContext(ctx)
if userData != nil {
return false, nil
}
tokenData := TokenAccessFromContext(ctx)
if tokenData != nil {
_, err := privateTrustService.TrustCenterAccesses.LoadReportAccess(ctx, tokenData.TrustCenterID, tokenData.GetEmail(), obj.ID)
if err != nil {
return false, nil
}
return true, nil
}
return false, nil
}
// NdaFileURL is the resolver for the ndaFileUrl field.
func (r *trustCenterResolver) NdaFileURL(ctx context.Context, obj *types.TrustCenter) (*string, error) {
privateTrustService, err := r.PrivateTrustService(ctx, obj.ID.TenantID())
@@ -432,6 +657,9 @@ func (r *trustCenterReferenceResolver) LogoURL(ctx context.Context, obj *types.T
// Audit returns schema.AuditResolver implementation.
func (r *Resolver) Audit() schema.AuditResolver { return &auditResolver{r} }
// Document returns schema.DocumentResolver implementation.
func (r *Resolver) Document() schema.DocumentResolver { return &documentResolver{r} }
// Mutation returns schema.MutationResolver implementation.
func (r *Resolver) Mutation() schema.MutationResolver { return &mutationResolver{r} }
@@ -441,6 +669,9 @@ func (r *Resolver) Organization() schema.OrganizationResolver { return &organiza
// Query returns schema.QueryResolver implementation.
func (r *Resolver) Query() schema.QueryResolver { return &queryResolver{r} }
// Report returns schema.ReportResolver implementation.
func (r *Resolver) Report() schema.ReportResolver { return &reportResolver{r} }
// TrustCenter returns schema.TrustCenterResolver implementation.
func (r *Resolver) TrustCenter() schema.TrustCenterResolver { return &trustCenterResolver{r} }
@@ -450,8 +681,10 @@ func (r *Resolver) TrustCenterReference() schema.TrustCenterReferenceResolver {
}
type auditResolver struct{ *Resolver }
type documentResolver struct{ *Resolver }
type mutationResolver struct{ *Resolver }
type organizationResolver struct{ *Resolver }
type queryResolver struct{ *Resolver }
type reportResolver struct{ *Resolver }
type trustCenterResolver struct{ *Resolver }
type trustCenterReferenceResolver struct{ *Resolver }