From 8c74a7bc93402822d872f33d33ac78c2fce43b7c Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Fri, 1 May 2026 09:31:26 +0000
Subject: [PATCH] Fix auditor processing activity access
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Émile Ré <nemile.re@gmail.com>
---
 pkg/probo/policies.go      |  2 +-
 pkg/probo/policies_test.go | 75 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 76 insertions(+), 1 deletion(-)
 create mode 100644 pkg/probo/policies_test.go

diff --git a/pkg/probo/policies.go b/pkg/probo/policies.go
index aa0c76644..ed01f4ac5 100644
--- a/pkg/probo/policies.go
+++ b/pkg/probo/policies.go
@@ -150,7 +150,7 @@ var AuditorPolicy = policy.NewPolicy(
 		ActionFindingGet, ActionFindingList,
 		ActionObligationGet, ActionObligationList,
 		ActionProcessingActivityGet, ActionProcessingActivityList,
-		ActionDataProtectionImpactAssessmentGet,
+		ActionDataProtectionImpactAssessmentGet, ActionDataProtectionImpactAssessmentList,
 		ActionTransferImpactAssessmentGet, ActionTransferImpactAssessmentList,
 		ActionSnapshotGet, ActionSnapshotList,
 		ActionFileGet, ActionFileDownloadUrl,
diff --git a/pkg/probo/policies_test.go b/pkg/probo/policies_test.go
new file mode 100644
index 000000000..5e85dacee
--- /dev/null
+++ b/pkg/probo/policies_test.go
@@ -0,0 +1,75 @@
+// Copyright (c) 2025-2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package probo_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/iam/policy"
+	"go.probo.inc/probo/pkg/probo"
+)
+
+func TestAuditorPolicy_ProcessingActivityPageReadAccess(t *testing.T) {
+	t.Parallel()
+
+	organizationID := gid.New(gid.NewTenantID(), 1)
+	evaluator := policy.NewEvaluator()
+	conditionContext := policy.ConditionContext{
+		Principal: map[string]string{
+			"organization_id": organizationID.String(),
+		},
+		Resource: map[string]string{
+			"organization_id": organizationID.String(),
+		},
+	}
+
+	tests := []struct {
+		name   string
+		action string
+	}{
+		{
+			name:   "list processing activities",
+			action: probo.ActionProcessingActivityList,
+		},
+		{
+			name:   "list data protection impact assessments",
+			action: probo.ActionDataProtectionImpactAssessmentList,
+		},
+		{
+			name:   "list transfer impact assessments",
+			action: probo.ActionTransferImpactAssessmentList,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			result := evaluator.Evaluate(
+				policy.AuthorizationRequest{
+					Principal:        organizationID,
+					Resource:         organizationID,
+					Action:           tt.action,
+					ConditionContext: conditionContext,
+				},
+				[]*policy.Policy{probo.AuditorPolicy},
+			)
+
+			assert.True(t, result.IsAllowed())
+		})
+	}
+}