@@ -61,7 +61,7 @@ func (p MembershipProfile) CursorKey(orderBy MembershipProfileOrderField) page.C
|
||||
}
|
||||
|
||||
func (p *MembershipProfile) AuthorizationAttributes(ctx context.Context, conn pg.Conn) (map[string]string, error) {
|
||||
q := `SELECT m.organization_id FROM iam_membership_profiles mp JOIN iam_memberships m ON mp.membership_id = m.id WHERE mp.id = $1 LIMIT 1;`
|
||||
q := `SELECT m.organization_id, mp.identity_id FROM iam_membership_profiles mp JOIN iam_memberships m ON mp.membership_id = m.id WHERE mp.id = $1 LIMIT 1;`
|
||||
|
||||
var organizationID gid.GID
|
||||
if err := conn.QueryRow(ctx, q, p.ID).Scan(&organizationID); err != nil {
|
||||
@@ -241,6 +241,7 @@ func (p *MembershipProfiles) LoadByMeetingID(
|
||||
WITH attendees AS (
|
||||
SELECT
|
||||
p.id,
|
||||
p.tenant_id,
|
||||
p.identity_id,
|
||||
p.membership_id,
|
||||
i.email_address,
|
||||
|
||||
@@ -445,6 +445,8 @@ WHERE
|
||||
-- 8. Now that references are filled, add the NOT NULL constraints to those who need it
|
||||
ALTER TABLE
|
||||
assets
|
||||
ALTER COLUMN
|
||||
owner_id DROP NOT NULL,
|
||||
ALTER COLUMN
|
||||
owner_profile_id
|
||||
SET
|
||||
@@ -452,6 +454,8 @@ SET
|
||||
|
||||
ALTER TABLE
|
||||
continual_improvements
|
||||
ALTER COLUMN
|
||||
owner_id DROP NOT NULL,
|
||||
ALTER COLUMN
|
||||
owner_profile_id
|
||||
SET
|
||||
@@ -459,6 +463,8 @@ SET
|
||||
|
||||
ALTER TABLE
|
||||
data
|
||||
ALTER COLUMN
|
||||
owner_id DROP NOT NULL,
|
||||
ALTER COLUMN
|
||||
owner_profile_id
|
||||
SET
|
||||
@@ -466,20 +472,28 @@ SET
|
||||
|
||||
ALTER TABLE
|
||||
document_versions
|
||||
ALTER COLUMN
|
||||
owner_id DROP NOT NULL,
|
||||
ALTER COLUMN
|
||||
owner_profile_id
|
||||
SET
|
||||
NOT NULL;
|
||||
|
||||
ALTER TABLE
|
||||
meeting_attendees
|
||||
meeting_attendees DROP CONSTRAINT meeting_attendees_pkey,
|
||||
ALTER COLUMN
|
||||
attendee_id DROP NOT NULL,
|
||||
ALTER COLUMN
|
||||
attendee_profile_id
|
||||
SET
|
||||
NOT NULL;
|
||||
NOT NULL,
|
||||
ADD
|
||||
PRIMARY KEY (attendee_profile_id);
|
||||
|
||||
ALTER TABLE
|
||||
nonconformities
|
||||
ALTER COLUMN
|
||||
owner_id DROP NOT NULL,
|
||||
ALTER COLUMN
|
||||
owner_profile_id
|
||||
SET
|
||||
@@ -487,6 +501,8 @@ SET
|
||||
|
||||
ALTER TABLE
|
||||
obligations
|
||||
ALTER COLUMN
|
||||
owner_id DROP NOT NULL,
|
||||
ALTER COLUMN
|
||||
owner_profile_id
|
||||
SET
|
||||
@@ -494,6 +510,8 @@ SET
|
||||
|
||||
ALTER TABLE
|
||||
document_version_signatures
|
||||
ALTER COLUMN
|
||||
signed_by DROP NOT NULL,
|
||||
ALTER COLUMN
|
||||
signed_by_profile_id
|
||||
SET
|
||||
@@ -501,6 +519,8 @@ SET
|
||||
|
||||
ALTER TABLE
|
||||
states_of_applicability
|
||||
ALTER COLUMN
|
||||
owner_id DROP NOT NULL,
|
||||
ALTER COLUMN
|
||||
owner_profile_id
|
||||
SET
|
||||
|
||||
@@ -84,6 +84,18 @@ var IAMSelfManageInvitationPolicy = policy.NewPolicy(
|
||||
).
|
||||
WithDescription("Allows users to view and accept invitations sent to them")
|
||||
|
||||
// IAMSelfManageProfilePolicy allows users to view their own profiles.
|
||||
var IAMSelfManageProfilePolicy = policy.NewPolicy(
|
||||
"iam:self-manage-profile",
|
||||
"Self-Manage Profiles",
|
||||
|
||||
// Users can view their own profiles
|
||||
policy.Allow(ActionMembershipProfileGet).
|
||||
WithSID("view-own-profiles").
|
||||
When(policy.Equals("principal.id", "resource.identity_id")),
|
||||
).
|
||||
WithDescription("Allows users to view their organization profiles")
|
||||
|
||||
// IAMSelfManageMembershipPolicy allows users to view their own memberships.
|
||||
var IAMSelfManageMembershipPolicy = policy.NewPolicy(
|
||||
"iam:self-manage-membership",
|
||||
|
||||
@@ -504,9 +504,9 @@ func (s *OrganizationService) CreateOrganization(
|
||||
ctx context.Context,
|
||||
identityID gid.GID,
|
||||
req *CreateOrganizationRequest,
|
||||
) (*coredata.Organization, error) {
|
||||
) (*coredata.Organization, *coredata.Membership, error) {
|
||||
if err := req.Validate(); err != nil {
|
||||
return nil, fmt.Errorf("invalid request: %w", err)
|
||||
return nil, nil, fmt.Errorf("invalid request: %w", err)
|
||||
}
|
||||
|
||||
var (
|
||||
@@ -584,7 +584,7 @@ func (s *OrganizationService) CreateOrganization(
|
||||
)
|
||||
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("cannot upload logo file: %w", err)
|
||||
return nil, nil, fmt.Errorf("cannot upload logo file: %w", err)
|
||||
}
|
||||
|
||||
logoFile.FileSize = fileSize
|
||||
@@ -621,7 +621,7 @@ func (s *OrganizationService) CreateOrganization(
|
||||
)
|
||||
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("cannot upload logo file: %w", err)
|
||||
return nil, nil, fmt.Errorf("cannot upload logo file: %w", err)
|
||||
}
|
||||
|
||||
horizontalLogoFile.FileSize = fileSize
|
||||
@@ -713,10 +713,10 @@ func (s *OrganizationService) CreateOrganization(
|
||||
},
|
||||
)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("cannot insert organization: %w", err)
|
||||
return nil, nil, fmt.Errorf("cannot insert organization: %w", err)
|
||||
}
|
||||
|
||||
return organization, nil
|
||||
return organization, membership, nil
|
||||
}
|
||||
|
||||
func (s *OrganizationService) UpdateOrganization(ctx context.Context, organizationID gid.GID, req *UpdateOrganizationRequest) (*coredata.Organization, error) {
|
||||
|
||||
@@ -66,6 +66,7 @@ func IAMPolicySet() *PolicySet {
|
||||
IAMSelfManageIdentityPolicy,
|
||||
IAMSelfManageSessionPolicy,
|
||||
IAMSelfManageInvitationPolicy,
|
||||
IAMSelfManageProfilePolicy,
|
||||
IAMSelfManageMembershipPolicy,
|
||||
IAMSelfManagePersonalAPIKeyPolicy,
|
||||
)
|
||||
|
||||
@@ -196,8 +196,8 @@ func (s MeetingService) Create(
|
||||
}
|
||||
|
||||
if len(req.AttendeeIDs) > 0 {
|
||||
var attendeePeople coredata.MembershipProfiles
|
||||
if err := attendeePeople.LoadByIDs(ctx, conn, s.svc.scope, req.AttendeeIDs); err != nil {
|
||||
var attendeeProfiles coredata.MembershipProfiles
|
||||
if err := attendeeProfiles.LoadByIDs(ctx, conn, s.svc.scope, req.AttendeeIDs); err != nil {
|
||||
return fmt.Errorf("cannot load attendee profiles: %w", err)
|
||||
}
|
||||
|
||||
|
||||
@@ -251,7 +251,7 @@ func (r *membershipResolver) Identity(ctx context.Context, obj *types.Membership
|
||||
|
||||
// Profile is the resolver for the profile field.
|
||||
func (r *membershipResolver) Profile(ctx context.Context, obj *types.Membership) (*types.MembershipProfile, error) {
|
||||
if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
|
||||
if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet, authz.WithSkipAssumptionCheck()); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
@@ -833,7 +833,7 @@ func (r *mutationResolver) CreateOrganization(ctx context.Context, input types.C
|
||||
Size: input.HorizontalLogoFile.Size,
|
||||
}
|
||||
}
|
||||
organization, err := r.iam.OrganizationService.CreateOrganization(
|
||||
organization, membership, err := r.iam.OrganizationService.CreateOrganization(
|
||||
ctx,
|
||||
identity.ID,
|
||||
&iam.CreateOrganizationRequest{
|
||||
@@ -848,7 +848,8 @@ func (r *mutationResolver) CreateOrganization(ctx context.Context, input types.C
|
||||
}
|
||||
|
||||
return &types.CreateOrganizationPayload{
|
||||
Organization: types.NewOrganization(organization),
|
||||
Organization: types.NewOrganization(organization),
|
||||
MembershipEdge: types.NewMembershipEdge(membership, coredata.MembershipOrderFieldCreatedAt),
|
||||
}, nil
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user