rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix SOA permissions handling + add scope conditions

Browse Source 
Signed-off-by: Émile Ré <emile@getprobo.com>
This commit is contained in:
Émile Ré
2026-01-21 13:30:41 +04:00
parent ff65303a1a
commit 7ce73bbcfa
12 changed files with 272 additions and 201 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
apps/console/src/__generated__/core/FrameworkDetailPageFragment.graphql.ts generated
View File

@@ -1,5 +1,5 @@
/**
* @generated SignedSource<<7f57391fcdf09c326854f1cc2e0008c2>>
* @generated SignedSource<<3db987ede3a3aa1dfa570e76a00ef224>>
* @lightSyntaxTransform
* @nogrep
*/
@@ -15,6 +15,7 @@ export type FrameworkDetailPageFragment$data = {
readonly canCreateControl: boolean;
readonly canDelete: boolean;
readonly canExport: boolean;
readonly canGenerateSOA: boolean;
readonly canUpdate: boolean;
readonly controls: {
readonly __id: string;
@@ -140,6 +141,19 @@ return {
"name": "permission",
"storageKey": "permission(action:\"core:control:create\")"
},
{
"alias": "canGenerateSOA",
"args": [
{
"kind": "Literal",
"name": "action",
"value": "core:framework:generate-state-of-applicability"
}
],
"kind": "ScalarField",
"name": "permission",
"storageKey": "permission(action:\"core:framework:generate-state-of-applicability\")"
},
{
"alias": null,
"args": null,
@@ -247,6 +261,6 @@ return {
};
})();
(node as any).hash = "c88994d5f1872bfe21cfe65e1911b76a";
(node as any).hash = "a3eb8b9d80c69d7faa83eae88e3b986b";
export default node;

19
apps/console/src/__generated__/core/FrameworkGraphNodeQuery.graphql.ts generated
View File

@@ -1,5 +1,5 @@
/**
* @generated SignedSource<<bbc7e1cc0c5c3f72d0297ff14a1dff77>>
* @generated SignedSource<<a493a708fe8353db1159647a455582ad>>
* @lightSyntaxTransform
* @nogrep
*/
@@ -189,6 +189,19 @@ return {
"name": "permission",
"storageKey": "permission(action:\"core:control:create\")"
},
{
"alias": "canGenerateSOA",
"args": [
{
"kind": "Literal",
"name": "action",
"value": "core:framework:generate-state-of-applicability"
}
],
"kind": "ScalarField",
"name": "permission",
"storageKey": "permission(action:\"core:framework:generate-state-of-applicability\")"
},
{
"alias": null,
"args": null,
@@ -301,12 +314,12 @@ return {
]
},
"params": {
"cacheID": "2a82ae6447b93b0fa6b570571694052b",
"cacheID": "58485d98106169267addab7729095131",
"id": null,
"metadata": {},
"name": "FrameworkGraphNodeQuery",
"operationKind": "query",
"text": "query FrameworkGraphNodeQuery(\n $frameworkId: ID!\n) {\n node(id: $frameworkId) {\n __typename\n ... on Framework {\n id\n name\n ...FrameworkDetailPageFragment\n }\n id\n }\n}\n\nfragment FrameworkDetailPageFragment on Framework {\n id\n name\n description\n lightLogoURL\n darkLogoURL\n canExport: permission(action: \"core:franework:export\")\n canUpdate: permission(action: \"core:framework:update\")\n canDelete: permission(action: \"core:framework:delete\")\n canCreateControl: permission(action: \"core:control:create\")\n organization {\n name\n id\n }\n controls(first: 250, orderBy: {field: SECTION_TITLE, direction: ASC}) {\n edges {\n node {\n id\n sectionTitle\n name\n status\n exclusionJustification\n bestPractice\n }\n }\n }\n}\n"
"text": "query FrameworkGraphNodeQuery(\n $frameworkId: ID!\n) {\n node(id: $frameworkId) {\n __typename\n ... on Framework {\n id\n name\n ...FrameworkDetailPageFragment\n }\n id\n }\n}\n\nfragment FrameworkDetailPageFragment on Framework {\n id\n name\n description\n lightLogoURL\n darkLogoURL\n canExport: permission(action: \"core:franework:export\")\n canUpdate: permission(action: \"core:framework:update\")\n canDelete: permission(action: \"core:framework:delete\")\n canCreateControl: permission(action: \"core:control:create\")\n canGenerateSOA: permission(action: \"core:framework:generate-state-of-applicability\")\n organization {\n name\n id\n }\n controls(first: 250, orderBy: {field: SECTION_TITLE, direction: ASC}) {\n edges {\n node {\n id\n sectionTitle\n name\n status\n exclusionJustification\n bestPractice\n }\n }\n }\n}\n"
}
};
})();

26
apps/console/src/__generated__/core/StateOfApplicabilityGraphNodeQuery.graphql.ts generated
View File

@@ -1,5 +1,5 @@
/**
* @generated SignedSource<<f3564b51cac1482be5c6c4443a9030cf>>
* @generated SignedSource<<4c350f48aeb8f51c9716aed4eeadc735>>
* @lightSyntaxTransform
* @nogrep
*/
@@ -16,6 +16,7 @@ export type StateOfApplicabilityGraphNodeQuery$variables = {
export type StateOfApplicabilityGraphNodeQuery$data = {
readonly node: {
readonly canDelete?: boolean;
readonly canExport?: boolean;
readonly canUpdate?: boolean;
readonly createdAt?: string;
readonly id?: string;
@@ -122,6 +123,19 @@ v9 = {
"storageKey": "permission(action:\"core:state-of-applicability:delete\")"
},
v10 = {
"alias": "canExport",
"args": [
{
"kind": "Literal",
"name": "action",
"value": "core:state-of-applicability:export"
}
],
"kind": "ScalarField",
"name": "permission",
"storageKey": "permission(action:\"core:state-of-applicability:export\")"
},
v11 = {
"alias": null,
"args": null,
"concreteType": "Organization",
@@ -133,7 +147,7 @@ v10 = {
],
"storageKey": null
},
v11 = {
v12 = {
"alias": null,
"args": null,
"concreteType": "People",
@@ -180,6 +194,7 @@ return {
(v9/*: any*/),
(v10/*: any*/),
(v11/*: any*/),
(v12/*: any*/),
{
"args": null,
"kind": "FragmentSpread",
@@ -230,6 +245,7 @@ return {
(v9/*: any*/),
(v10/*: any*/),
(v11/*: any*/),
(v12/*: any*/),
{
"alias": "controlsInfo",
"args": [
@@ -386,16 +402,16 @@ return {
]
},
"params": {
"cacheID": "6189c0ca41e3327629d744a658cbe6f1",
"cacheID": "529e47a135ba24716b749998d1181d9a",
"id": null,
"metadata": {},
"name": "StateOfApplicabilityGraphNodeQuery",
"operationKind": "query",
"text": "query StateOfApplicabilityGraphNodeQuery(\n $stateOfApplicabilityId: ID!\n) {\n node(id: $stateOfApplicabilityId) {\n __typename\n ... on StateOfApplicability {\n id\n name\n sourceId\n snapshotId\n createdAt\n updatedAt\n canUpdate: permission(action: \"core:state-of-applicability:update\")\n canDelete: permission(action: \"core:state-of-applicability:delete\")\n organization {\n id\n }\n owner {\n id\n fullName\n }\n ...StateOfApplicabilityControlsTabFragment\n }\n id\n }\n}\n\nfragment StateOfApplicabilityControlsTabFragment on StateOfApplicability {\n id\n controlsInfo: controls(first: 0) {\n totalCount\n }\n canCreateStateOfApplicabilityControlMapping: permission(action: \"core:state-of-applicability-control-mapping:create\")\n canDeleteStateOfApplicabilityControlMapping: permission(action: \"core:state-of-applicability-control-mapping:delete\")\n availableControls {\n controlId\n sectionTitle\n name\n frameworkId\n frameworkName\n organizationId\n stateOfApplicabilityId\n applicability\n justification\n bestPractice\n regulatory\n contractual\n riskAssessment\n }\n}\n"
"text": "query StateOfApplicabilityGraphNodeQuery(\n $stateOfApplicabilityId: ID!\n) {\n node(id: $stateOfApplicabilityId) {\n __typename\n ... on StateOfApplicability {\n id\n name\n sourceId\n snapshotId\n createdAt\n updatedAt\n canUpdate: permission(action: \"core:state-of-applicability:update\")\n canDelete: permission(action: \"core:state-of-applicability:delete\")\n canExport: permission(action: \"core:state-of-applicability:export\")\n organization {\n id\n }\n owner {\n id\n fullName\n }\n ...StateOfApplicabilityControlsTabFragment\n }\n id\n }\n}\n\nfragment StateOfApplicabilityControlsTabFragment on StateOfApplicability {\n id\n controlsInfo: controls(first: 0) {\n totalCount\n }\n canCreateStateOfApplicabilityControlMapping: permission(action: \"core:state-of-applicability-control-mapping:create\")\n canDeleteStateOfApplicabilityControlMapping: permission(action: \"core:state-of-applicability-control-mapping:delete\")\n availableControls {\n controlId\n sectionTitle\n name\n frameworkId\n frameworkName\n organizationId\n stateOfApplicabilityId\n applicability\n justification\n bestPractice\n regulatory\n contractual\n riskAssessment\n }\n}\n"
}
};
})();
(node as any).hash = "1a1f3480b9c66597d146c48ed1b00bd1";
(node as any).hash = "5ea300f4dd399cafd7985072c2013dbe";
export default node;

12
apps/console/src/__generated__/iam/SidebarFragment.graphql.ts generated
View File

@@ -1,5 +1,5 @@
/**
* @generated SignedSource<<c1333ad749a9c6aaf8f6f671bc578c04>>
* @generated SignedSource<<63f008ba2b41fba49ba0c3145874aa72>>
* @lightSyntaxTransform
* @nogrep
*/
@@ -76,12 +76,12 @@ const node: ReaderFragment = {
{
"kind": "Literal",
"name": "action",
"value": "core:measures:list"
"value": "core:measure:list"
}
],
"kind": "ScalarField",
"name": "permission",
"storageKey": "permission(action:\"core:measures:list\")"
"storageKey": "permission(action:\"core:measure:list\")"
},
{
"alias": "canListRisks",
@@ -102,12 +102,12 @@ const node: ReaderFragment = {
{
"kind": "Literal",
"name": "action",
"value": "core:frameworks:list"
"value": "core:framework:list"
}
],
"kind": "ScalarField",
"name": "permission",
"storageKey": "permission(action:\"core:frameworks:list\")"
"storageKey": "permission(action:\"core:framework:list\")"
},
{
"alias": "canListPeople",
@@ -309,6 +309,6 @@ const node: ReaderFragment = {
"abstractKey": null
};
(node as any).hash = "3a7071a1d9ed4ffc115f5bc22e283a50";
(node as any).hash = "6d640139997b2c7561699c1efb668650";
export default node;

14
apps/console/src/__generated__/iam/ViewerMembershipLayoutQuery.graphql.ts generated
View File

@@ -1,5 +1,5 @@
/**
* @generated SignedSource<<d089cfdf5c585ba8fcb83456438efe62>>
* @generated SignedSource<<0f5d74875ad984071d92f1d0e3cfce12>>
* @lightSyntaxTransform
* @nogrep
*/
@@ -352,12 +352,12 @@ return {
{
"kind": "Literal",
"name": "action",
"value": "core:measures:list"
"value": "core:measure:list"
}
],
"kind": "ScalarField",
"name": "permission",
"storageKey": "permission(action:\"core:measures:list\")"
"storageKey": "permission(action:\"core:measure:list\")"
},
{
"alias": "canListRisks",
@@ -378,12 +378,12 @@ return {
{
"kind": "Literal",
"name": "action",
"value": "core:frameworks:list"
"value": "core:framework:list"
}
],
"kind": "ScalarField",
"name": "permission",
"storageKey": "permission(action:\"core:frameworks:list\")"
"storageKey": "permission(action:\"core:framework:list\")"
},
{
"alias": "canListPeople",
@@ -618,12 +618,12 @@ return {
]
},
"params": {
"cacheID": "d7e0b080876472d059c97bf57818c697",
"cacheID": "f380d0fe83b6d660c61c379af4d2eb7d",
"id": null,
"metadata": {},
"name": "ViewerMembershipLayoutQuery",
"operationKind": "query",
"text": "query ViewerMembershipLayoutQuery(\n $organizationId: ID!\n $hideSidebar: Boolean!\n) {\n organization: node(id: $organizationId) {\n __typename\n ... on Organization {\n ...MembershipsDropdown_organizationFragment\n ...ViewerMembershipDropdownFragment\n ...SidebarFragment @skip(if: $hideSidebar)\n viewerMembership {\n role\n profile {\n fullName\n id\n }\n id\n }\n }\n id\n }\n viewer {\n email\n ...MembershipsDropdown_viewerFragment\n pendingInvitations {\n totalCount\n }\n id\n }\n}\n\nfragment MembershipsDropdown_organizationFragment on Organization {\n name\n}\n\nfragment MembershipsDropdown_viewerFragment on Identity {\n pendingInvitations {\n totalCount\n }\n}\n\nfragment SidebarFragment on Organization {\n canListMeetings: permission(action: \"core:meeting:list\")\n canListTasks: permission(action: \"core:task:list\")\n canListMeasures: permission(action: \"core:measures:list\")\n canListRisks: permission(action: \"core:risk:list\")\n canListFrameworks: permission(action: \"core:frameworks:list\")\n canListPeople: permission(action: \"core:people:list\")\n canListVendors: permission(action: \"core:vendor:list\")\n canListDocuments: permission(action: \"core:document:list\")\n canListAssets: permission(action: \"core:asset:list\")\n canListData: permission(action: \"core:datum:list\")\n canListAudits: permission(action: \"core:audit:list\")\n canListNonconformities: permission(action: \"core:nonconformity:list\")\n canListObligations: permission(action: \"core:obligation:list\")\n canListContinualImprovements: permission(action: \"core:continual-improvement:list\")\n canListProcessingActivities: permission(action: \"core:processing-activity:list\")\n canListRightsRequests: permission(action: \"core:rights-request:list\")\n canListSnapshots: permission(action: \"core:snapshot:list\")\n canGetTrustCenter: permission(action: \"core:trust-center:get\")\n canUpdateOrganization: permission(action: \"iam:organization:update\")\n canListStatesOfApplicability: permission(action: \"core:state-of-applicability:list\")\n}\n\nfragment ViewerMembershipDropdownFragment on Organization {\n viewerMembership {\n identity {\n email\n canListAPIKeys: permission(action: \"iam:personal-api-key:list\")\n id\n }\n profile {\n fullName\n id\n }\n id\n }\n}\n"
"text": "query ViewerMembershipLayoutQuery(\n $organizationId: ID!\n $hideSidebar: Boolean!\n) {\n organization: node(id: $organizationId) {\n __typename\n ... on Organization {\n ...MembershipsDropdown_organizationFragment\n ...ViewerMembershipDropdownFragment\n ...SidebarFragment @skip(if: $hideSidebar)\n viewerMembership {\n role\n profile {\n fullName\n id\n }\n id\n }\n }\n id\n }\n viewer {\n email\n ...MembershipsDropdown_viewerFragment\n pendingInvitations {\n totalCount\n }\n id\n }\n}\n\nfragment MembershipsDropdown_organizationFragment on Organization {\n name\n}\n\nfragment MembershipsDropdown_viewerFragment on Identity {\n pendingInvitations {\n totalCount\n }\n}\n\nfragment SidebarFragment on Organization {\n canListMeetings: permission(action: \"core:meeting:list\")\n canListTasks: permission(action: \"core:task:list\")\n canListMeasures: permission(action: \"core:measure:list\")\n canListRisks: permission(action: \"core:risk:list\")\n canListFrameworks: permission(action: \"core:framework:list\")\n canListPeople: permission(action: \"core:people:list\")\n canListVendors: permission(action: \"core:vendor:list\")\n canListDocuments: permission(action: \"core:document:list\")\n canListAssets: permission(action: \"core:asset:list\")\n canListData: permission(action: \"core:datum:list\")\n canListAudits: permission(action: \"core:audit:list\")\n canListNonconformities: permission(action: \"core:nonconformity:list\")\n canListObligations: permission(action: \"core:obligation:list\")\n canListContinualImprovements: permission(action: \"core:continual-improvement:list\")\n canListProcessingActivities: permission(action: \"core:processing-activity:list\")\n canListRightsRequests: permission(action: \"core:rights-request:list\")\n canListSnapshots: permission(action: \"core:snapshot:list\")\n canGetTrustCenter: permission(action: \"core:trust-center:get\")\n canUpdateOrganization: permission(action: \"iam:organization:update\")\n canListStatesOfApplicability: permission(action: \"core:state-of-applicability:list\")\n}\n\nfragment ViewerMembershipDropdownFragment on Organization {\n viewerMembership {\n identity {\n email\n canListAPIKeys: permission(action: \"iam:personal-api-key:list\")\n id\n }\n profile {\n fullName\n id\n }\n id\n }\n}\n"
}
};
})();

1
apps/console/src/hooks/graph/StateOfApplicabilityGraph.ts
View File

@@ -204,6 +204,7 @@ export const stateOfApplicabilityNodeQuery = graphql`
updatedAt
canUpdate: permission(action: "core:state-of-applicability:update")
canDelete: permission(action: "core:state-of-applicability:delete")
canExport: permission(action: "core:state-of-applicability:export")
organization {
id
}

4
apps/console/src/pages/iam/organizations/_components/Sidebar.tsx
View File

@@ -31,9 +31,9 @@ const fragment = graphql`
fragment SidebarFragment on Organization {
canListMeetings: permission(action: "core:meeting:list")
canListTasks: permission(action: "core:task:list")
canListMeasures: permission(action: "core:measures:list")
canListMeasures: permission(action: "core:measure:list")
canListRisks: permission(action: "core:risk:list")
canListFrameworks: permission(action: "core:frameworks:list")
canListFrameworks: permission(action: "core:framework:list")
canListPeople: permission(action: "core:people:list")
canListVendors: permission(action: "core:vendor:list")
canListDocuments: permission(action: "core:document:list")

103
apps/console/src/pages/organizations/frameworks/FrameworkDetailPage.tsx
View File

@@ -43,6 +43,7 @@ const frameworkDetailFragment = graphql`
canUpdate: permission(action: "core:framework:update")
canDelete: permission(action: "core:framework:delete")
canCreateControl: permission(action: "core:control:create")
canGenerateSOA: permission(action: "core:framework:generate-state-of-applicability")
organization {
name
}
@@ -151,6 +152,8 @@ export default function FrameworkDetailPage(props: Props) {
);
}
const hasAnyAction = framework.canExport || framework.canDelete || framework.canGenerateSOA
return (
<div className="space-y-6">
<PageHeader
@@ -171,53 +174,59 @@ export default function FrameworkDetailPage(props: Props) {
</Button>
</FrameworkFormDialog>
)}
<ActionDropdown variant="secondary">
<DropdownItem
variant="primary"
onClick={() => {
generateFrameworkStateOfApplicability({
variables: { frameworkId: framework.id },
onCompleted: (data) => {
if (
data
.generateFrameworkStateOfApplicability
?.data
) {
const link =
window.document.createElement("a");
link.href =
data.generateFrameworkStateOfApplicability.data;
link.download = `${framework.organization.name}-${framework.name}-SOA.xlsx`;
window.document.body.appendChild(link);
link.click();
window.document.body.removeChild(link);
}
},
});
}}
>
{__("Download SOA")}
</DropdownItem>
<DropdownItem
variant="primary"
onClick={() => {
exportFramework({
variables: { frameworkId: framework.id },
});
}}
>
{__("Export Framework")}
</DropdownItem>
{framework.canDelete && (
<DropdownItem
icon={IconTrashCan}
variant="danger"
onClick={onDelete}
>
{__("Delete")}
</DropdownItem>
)}
</ActionDropdown>
{hasAnyAction && (
<ActionDropdown variant="secondary">
{framework.canGenerateSOA &&
<DropdownItem
variant="primary"
onClick={() => {
generateFrameworkStateOfApplicability({
variables: { frameworkId: framework.id },
onCompleted: (data) => {
if (
data
.generateFrameworkStateOfApplicability
?.data
) {
const link =
window.document.createElement("a");
link.href =
data.generateFrameworkStateOfApplicability.data;
link.download = `${framework.organization.name}-${framework.name}-SOA.xlsx`;
window.document.body.appendChild(link);
link.click();
window.document.body.removeChild(link);
}
},
});
}}
>
{__("Download SOA")}
</DropdownItem>
}
{framework.canExport &&
<DropdownItem
variant="primary"
onClick={() => {
exportFramework({
variables: { frameworkId: framework.id },
});
}}
>
{__("Export Framework")}
</DropdownItem>
}
{framework.canDelete && (
<DropdownItem
icon={IconTrashCan}
variant="danger"
onClick={onDelete}
>
{__("Delete")}
</DropdownItem>
)}
</ActionDropdown>
)}
</PageHeader>
<div className="text-lg font-semibold">
{__("Requirement categories")}

18
apps/console/src/pages/organizations/states-of-applicability/StateOfApplicabilityDetailPage.tsx
View File

@@ -279,14 +279,16 @@ export default function StateOfApplicabilityDetailPage(props: Props) {
)
}
>
<Button
variant="secondary"
icon={IconArrowDown}
onClick={handleExport}
disabled={isExporting}
>
{__("Export")}
</Button>
{stateOfApplicability.canExport && (
<Button
variant="secondary"
icon={IconArrowDown}
onClick={handleExport}
disabled={isExporting}
>
{__("Export")}
</Button>
)}
{canDelete && (
<ActionDropdown variant="secondary">
<DropdownItem

114
pkg/coredata/state_of_applicability.go
View File

@@ -264,7 +264,8 @@ SET
name = @name,
owner_id = @owner_id,
updated_at = @updated_at
WHERE %s
WHERE
%s
AND id = @state_of_applicability_id
`
@@ -303,7 +304,8 @@ func (s *StateOfApplicability) Delete(
) error {
q := `
DELETE FROM states_of_applicability
WHERE %s
WHERE
%s
AND id = @state_of_applicability_id
`
q = fmt.Sprintf(q, scope.SQLFragment())
@@ -346,31 +348,32 @@ func (soas StatesOfApplicability) insertStateOfApplicabilitySnapshots(
) error {
query := `
INSERT INTO states_of_applicability (
id,
tenant_id,
organization_id,
name,
source_id,
snapshot_id,
owner_id,
created_at,
updated_at
id,
tenant_id,
organization_id,
name,
source_id,
snapshot_id,
owner_id,
created_at,
updated_at
)
SELECT
generate_gid(decode_base64_unpadded(@tenant_id), @state_of_applicability_entity_type),
@tenant_id,
soa.organization_id,
soa.name,
soa.id,
@snapshot_id,
soa.owner_id,
soa.created_at,
soa.updated_at
generate_gid(decode_base64_unpadded(@tenant_id), @state_of_applicability_entity_type),
@tenant_id,
soa.organization_id,
soa.name,
soa.id,
@snapshot_id,
soa.owner_id,
soa.created_at,
soa.updated_at
FROM states_of_applicability soa
WHERE %s
AND soa.organization_id = @organization_id
AND soa.snapshot_id IS NULL
`
WHERE
%s
AND soa.organization_id = @organization_id
AND soa.snapshot_id IS NULL
`
query = fmt.Sprintf(query, scope.SQLFragment())
@@ -399,47 +402,48 @@ func (soas StatesOfApplicability) insertStateOfApplicabilityControlSnapshots(
) error {
query := `
WITH source_soa AS (
SELECT id, organization_id
FROM states_of_applicability
WHERE %s
AND organization_id = @organization_id
AND snapshot_id IS NULL
SELECT id, organization_id
FROM states_of_applicability
WHERE
%s
AND organization_id = @organization_id
AND snapshot_id IS NULL
),
snapshot_soa AS (
SELECT id, source_id
FROM states_of_applicability
WHERE snapshot_id = @snapshot_id
SELECT id, source_id
FROM states_of_applicability
WHERE snapshot_id = @snapshot_id
)
INSERT INTO states_of_applicability_controls (
id,
state_of_applicability_id,
control_id,
organization_id,
tenant_id,
snapshot_id,
applicability,
justification,
created_at,
updated_at
id,
state_of_applicability_id,
control_id,
organization_id,
tenant_id,
snapshot_id,
applicability,
justification,
created_at,
updated_at
)
SELECT
generate_gid(decode_base64_unpadded(@tenant_id), @state_of_applicability_control_entity_type),
snapshot_soa.id,
soac.control_id,
soac.organization_id,
@tenant_id,
@snapshot_id,
soac.applicability,
soac.justification,
soac.created_at,
soac.updated_at
generate_gid(decode_base64_unpadded(@tenant_id), @state_of_applicability_control_entity_type),
snapshot_soa.id,
soac.control_id,
soac.organization_id,
@tenant_id,
@snapshot_id,
soac.applicability,
soac.justification,
soac.created_at,
soac.updated_at
FROM states_of_applicability_controls soac
INNER JOIN source_soa
ON soac.state_of_applicability_id = source_soa.id
ON soac.state_of_applicability_id = source_soa.id
INNER JOIN snapshot_soa
ON snapshot_soa.source_id = source_soa.id
ON snapshot_soa.source_id = source_soa.id
WHERE soac.snapshot_id IS NULL
`
`
query = fmt.Sprintf(query, scope.SQLFragment())

142
pkg/coredata/state_of_applicability_control.go
View File

@@ -96,28 +96,29 @@ func (sac *StateOfApplicabilityControl) LoadByStateOfApplicabilityIDAndControlID
) error {
q := `
WITH current_soa AS (
SELECT id
FROM states_of_applicability
WHERE %s
AND id = @state_of_applicability_id
AND snapshot_id IS NULL
SELECT id
FROM states_of_applicability
WHERE
%s
AND id = @state_of_applicability_id
AND snapshot_id IS NULL
)
SELECT
soac.id,
soac.state_of_applicability_id,
soac.control_id,
soac.organization_id,
soac.snapshot_id,
soac.applicability,
soac.justification,
soac.created_at,
soac.updated_at
soac.id,
soac.state_of_applicability_id,
soac.control_id,
soac.organization_id,
soac.snapshot_id,
soac.applicability,
soac.justification,
soac.created_at,
soac.updated_at
FROM
states_of_applicability_controls soac
states_of_applicability_controls soac
INNER JOIN
current_soa ON soac.state_of_applicability_id = current_soa.id
current_soa ON soac.state_of_applicability_id = current_soa.id
WHERE
soac.control_id = @control_id
soac.control_id = @control_id
LIMIT 1;
`
q = fmt.Sprintf(q, scope.SQLFragment())
@@ -217,7 +218,8 @@ SET
applicability = @applicability,
justification = @justification,
updated_at = @updated_at
WHERE %s
WHERE
%s
AND state_of_applicability_id = @state_of_applicability_id
AND control_id = @control_id
`
@@ -304,15 +306,16 @@ func (sac *StateOfApplicabilityControl) Delete(
) error {
q := `
WITH current_soa AS (
SELECT id
FROM states_of_applicability
WHERE %s
AND id = @state_of_applicability_id
AND snapshot_id IS NULL
SELECT id
FROM states_of_applicability
WHERE
%s
AND id = @state_of_applicability_id
AND snapshot_id IS NULL
)
DELETE FROM states_of_applicability_controls
WHERE state_of_applicability_id IN (SELECT id FROM current_soa)
AND control_id = @control_id;
AND control_id = @control_id;
`
args := pgx.StrictNamedArgs{
@@ -380,39 +383,41 @@ func (sacs *StateOfApplicabilityControls) LoadByControlID(
) error {
q := `
WITH soac_ctrl AS (
SELECT
soac.id,
soac.state_of_applicability_id,
soac.control_id,
soac.organization_id,
soac.snapshot_id,
soac.applicability,
soac.justification,
soac.created_at,
soac.updated_at,
soac.tenant_id
FROM
states_of_applicability_controls soac
INNER JOIN
states_of_applicability soa ON soac.state_of_applicability_id = soa.id
WHERE
soac.control_id = @control_id
AND soa.snapshot_id IS NULL
SELECT
soac.id,
soac.state_of_applicability_id,
soac.control_id,
soac.organization_id,
soac.snapshot_id,
soac.applicability,
soac.justification,
soac.created_at,
soac.updated_at,
soac.tenant_id
FROM
states_of_applicability_controls soac
INNER JOIN
states_of_applicability soa ON soac.state_of_applicability_id = soa.id
WHERE
soac.%[1]s
AND soac.control_id = @control_id
AND soa.snapshot_id IS NULL
)
SELECT
id,
state_of_applicability_id,
control_id,
organization_id,
snapshot_id,
applicability,
justification,
created_at,
updated_at
id,
state_of_applicability_id,
control_id,
organization_id,
snapshot_id,
applicability,
justification,
created_at,
updated_at
FROM
soac_ctrl
WHERE %s
AND %s
soac_ctrl
WHERE
%[1]s
AND %[2]s
`
q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
@@ -442,21 +447,25 @@ func (sacs *StateOfApplicabilityControls) CountByControlID(
) (int, error) {
q := `
WITH soac_ctrl AS (
SELECT
soac.id,
soac.organization_id,
soac.tenant_id
FROM
states_of_applicability_controls soac
WHERE
soac.control_id = @control_id
SELECT
soac.id,
soac.organization_id,
soac.tenant_id
FROM
states_of_applicability_controls soac
INNER JOIN
states_of_applicability soa ON soac.state_of_applicability_id = soa.id
WHERE
soac.%[1]s
AND soac.control_id = @control_id
AND soa.snapshot_id IS NULL
)
SELECT
COUNT(id)
COUNT(id)
FROM
soac_ctrl
soac_ctrl
WHERE
%s;
%[1]s;
`
q = fmt.Sprintf(q, scope.SQLFragment())
@@ -499,7 +508,8 @@ filtered_controls AS (
c.tenant_id,
c.best_practice
FROM controls c
WHERE %s
WHERE
%s
),
all_controls AS (
SELECT

2
pkg/probo/policies.go
View File

@@ -78,6 +78,8 @@ var ViewerPolicy = policy.NewPolicy(
ActionFileGet, ActionFileDownloadUrl,
ActionSlackConnectionList,
ActionRightsRequestGet, ActionRightsRequestList,
ActionStateOfApplicabilityGet, ActionStateOfApplicabilityList,
ActionStateOfApplicabilityControlMappingList,
).WithSID("entity-read-access").When(organizationCondition),
policy.Allow(