From 8a817a70ecc0bb51ad77afa736db62c2c8d1e10e Mon Sep 17 00:00:00 2001
From: Sacha Al Himdani <sacha@getprobo.com>
Date: Wed, 10 Dec 2025 19:29:09 +0100
Subject: [PATCH] Fix permissions

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
---
 pkg/authz/permissions.go                 | 7 +++++--
 pkg/server/api/console/v1/v1_resolver.go | 4 ++--
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkg/authz/permissions.go b/pkg/authz/permissions.go
index 39da9e698..d23beba90 100644
--- a/pkg/authz/permissions.go
+++ b/pkg/authz/permissions.go
@@ -47,6 +47,7 @@ const (
 	ActionGetDocument                   Action = "getDocument"
 	ActionGetReport                     Action = "getReport"
 	ActionGetFile                       Action = "getFile"
+	ActionGetAudit                      Action = "getAudit"
 	ActionGetFileUrl                    Action = "getFileUrl"
 	ActionGetFramework                  Action = "getFramework"
 	ActionGetHorizontalLogoUrl          Action = "getHorizontalLogoUrl"
@@ -557,8 +558,9 @@ var Permissions = map[uint16]map[Action][]Role{
 		ActionSignatures:               NonEmployeeRoles,
 		ActionExportDocumentVersionPDF: NonEmployeeRoles,
 
-		ActionUpdateDocumentVersion: EditRoles,
-		ActionRequestSignature:      EditRoles,
+		ActionUpdateDocumentVersion:      EditRoles,
+		ActionRequestSignature:           EditRoles,
+		ActionDeleteDraftDocumentVersion: EditRoles,
 	},
 	coredata.DocumentVersionSignatureEntityType: {
 		ActionGet:             NonEmployeeRoles,
@@ -619,6 +621,7 @@ var Permissions = map[uint16]map[Action][]Role{
 	},
 	coredata.ReportEntityType: {
 		ActionGet:             NonEmployeeRoles,
+		ActionGetAudit:        NonEmployeeRoles,
 		ActionGetFile:         NonEmployeeRoles,
 		ActionGetOrganization: NonEmployeeRoles,
 		ActionGetSnapshot:     NonEmployeeRoles,
diff --git a/pkg/server/api/console/v1/v1_resolver.go b/pkg/server/api/console/v1/v1_resolver.go
index 2a1186169..2ba60db71 100644
--- a/pkg/server/api/console/v1/v1_resolver.go
+++ b/pkg/server/api/console/v1/v1_resolver.go
@@ -5827,6 +5827,8 @@ func (r *reportResolver) DownloadURL(ctx context.Context, obj *types.Report) (*s
 
 // Audit is the resolver for the audit field.
 func (r *reportResolver) Audit(ctx context.Context, obj *types.Report) (*types.Audit, error) {
+	r.MustBeAuthorized(ctx, obj.ID, authz.ActionGetAudit)
+
 	prb := r.ProboService(ctx, obj.ID.TenantID())
 
 	audit, err := prb.Audits.GetByReportID(ctx, obj.ID)
@@ -5834,8 +5836,6 @@ func (r *reportResolver) Audit(ctx context.Context, obj *types.Report) (*types.A
 		panic(fmt.Errorf("cannot load audit for report: %w", err))
 	}
 
-	r.MustBeAuthorized(ctx, audit.OrganizationID, authz.ActionAudit)
-
 	return types.NewAudit(audit), nil
 }