Fix permissions

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/authz/permissions.go

@@ -47,6 +47,7 @@ const (
 	ActionGetDocument                   Action = "getDocument"
 	ActionGetReport                     Action = "getReport"
 	ActionGetFile                       Action = "getFile"
+	ActionGetAudit                      Action = "getAudit"
 	ActionGetFileUrl                    Action = "getFileUrl"
 	ActionGetFramework                  Action = "getFramework"
 	ActionGetHorizontalLogoUrl          Action = "getHorizontalLogoUrl"
@@ -557,8 +558,9 @@ var Permissions = map[uint16]map[Action][]Role{
 		ActionSignatures:               NonEmployeeRoles,
 		ActionExportDocumentVersionPDF: NonEmployeeRoles,
 
-		ActionUpdateDocumentVersion: EditRoles,
-		ActionRequestSignature:      EditRoles,
+		ActionUpdateDocumentVersion:      EditRoles,
+		ActionRequestSignature:           EditRoles,
+		ActionDeleteDraftDocumentVersion: EditRoles,
 	},
 	coredata.DocumentVersionSignatureEntityType: {
 		ActionGet:             NonEmployeeRoles,
@@ -619,6 +621,7 @@ var Permissions = map[uint16]map[Action][]Role{
 	},
 	coredata.ReportEntityType: {
 		ActionGet:             NonEmployeeRoles,
+		ActionGetAudit:        NonEmployeeRoles,
 		ActionGetFile:         NonEmployeeRoles,
 		ActionGetOrganization: NonEmployeeRoles,
 		ActionGetSnapshot:     NonEmployeeRoles,

pkg/server/api/console/v1/v1_resolver.go

@@ -5827,6 +5827,8 @@ func (r *reportResolver) DownloadURL(ctx context.Context, obj *types.Report) (*s
 
 // Audit is the resolver for the audit field.
 func (r *reportResolver) Audit(ctx context.Context, obj *types.Report) (*types.Audit, error) {
+	r.MustBeAuthorized(ctx, obj.ID, authz.ActionGetAudit)
+
 	prb := r.ProboService(ctx, obj.ID.TenantID())
 
 	audit, err := prb.Audits.GetByReportID(ctx, obj.ID)
@@ -5834,8 +5836,6 @@ func (r *reportResolver) Audit(ctx context.Context, obj *types.Report) (*types.A
 		panic(fmt.Errorf("cannot load audit for report: %w", err))
 	}
 
-	r.MustBeAuthorized(ctx, audit.OrganizationID, authz.ActionAudit)
-
 	return types.NewAudit(audit), nil
 }