Add processing activity, DPIA and TIA publish to document system
Replace the old PDF/snapshot-based exports for processing activities, Data Protection Impact Assessments and Transfer Impact Assessments with the publish document system. Includes GraphQL mutations, MCP tools, CLI commands, n8n operations, frontend publish dialogs, e2e tests, and prosemirror register templates that mirror the previous PDF layouts. Each register lives as a generated DocumentTypeRegister document on the organization, reused across publishes (the major version bumps on every republish). Approvers can be passed in to create a draft pending approval; otherwise the version is published immediately. The frontend ProcessingActivities page exposes a Publish dropdown per register and a Document link button per active tab, pre-fills the previous default approvers, and navigates to the published document on success. Remove snapshot mode entirely from these three entities: drop snapshotId and sourceId from GraphQL schemas, types, filters, resolvers, MCP spec, frontend routes and pages; remove SnapshotsTypeProcessingActivities from the snapshot registry and delete the ProcessingActivities.Snapshot, ProcessingActivitySnapshotter interface and *.InsertProcessingActivitySnapshots methods. The snapshot_id columns remain in the database but are now filtered out with snapshot_id IS NULL. Add Get/Upsert/Clear GeneratedDocumentID methods on each entity type (ProcessingActivity, DataProtectionImpactAssessment, TransferImpactAssessment) backed by new columns in the generated_documents table, matching the Finding/Obligation pattern. Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
This commit is contained in:
Sacha Al Himdani
305
e2e/console/dpia_publish_test.go
Normal file
305
e2e/console/dpia_publish_test.go
Normal file
@@ -0,0 +1,305 @@
|
||||
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
|
||||
//
|
||||
// Permission to use, copy, modify, and/or distribute this software for any
|
||||
// purpose with or without fee is hereby granted, provided that the above
|
||||
// copyright notice and this permission notice appear in all copies.
|
||||
//
|
||||
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
||||
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
||||
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
// PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
package console_test
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
"go.probo.inc/probo/e2e/internal/factory"
|
||||
"go.probo.inc/probo/e2e/internal/testutil"
|
||||
)
|
||||
|
||||
func TestDataProtectionImpactAssessment_PublishList(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
t.Run(
|
||||
"publish without approvers publishes immediately",
|
||||
func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
owner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
paID := factory.NewProcessingActivity(owner).
|
||||
WithName("DPIA Publish PA").
|
||||
WithLawfulBasis("CONSENT").
|
||||
Create()
|
||||
createDPIAForPublish(t, owner, paID, "DPIA description")
|
||||
|
||||
const query = `
|
||||
mutation($input: PublishDataProtectionImpactAssessmentListInput!) {
|
||||
publishDataProtectionImpactAssessmentList(input: $input) {
|
||||
documentEdge {
|
||||
node {
|
||||
id
|
||||
writeMode
|
||||
status
|
||||
}
|
||||
}
|
||||
documentVersionEdge {
|
||||
node {
|
||||
id
|
||||
title
|
||||
documentType
|
||||
status
|
||||
major
|
||||
minor
|
||||
content
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var result struct {
|
||||
PublishDataProtectionImpactAssessmentList struct {
|
||||
DocumentEdge struct {
|
||||
Node struct {
|
||||
ID string `json:"id"`
|
||||
WriteMode string `json:"writeMode"`
|
||||
Status string `json:"status"`
|
||||
} `json:"node"`
|
||||
} `json:"documentEdge"`
|
||||
DocumentVersionEdge struct {
|
||||
Node struct {
|
||||
ID string `json:"id"`
|
||||
Title string `json:"title"`
|
||||
DocumentType string `json:"documentType"`
|
||||
Status string `json:"status"`
|
||||
Major int `json:"major"`
|
||||
Minor int `json:"minor"`
|
||||
Content string `json:"content"`
|
||||
} `json:"node"`
|
||||
} `json:"documentVersionEdge"`
|
||||
} `json:"publishDataProtectionImpactAssessmentList"`
|
||||
}
|
||||
|
||||
err := owner.Execute(
|
||||
query,
|
||||
map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": owner.GetOrganizationID(),
|
||||
},
|
||||
},
|
||||
&result,
|
||||
)
|
||||
require.NoError(t, err)
|
||||
|
||||
doc := result.PublishDataProtectionImpactAssessmentList.DocumentEdge.Node
|
||||
assert.NotEmpty(t, doc.ID)
|
||||
assert.Equal(t, "GENERATED", doc.WriteMode)
|
||||
assert.Equal(t, "ACTIVE", doc.Status)
|
||||
|
||||
ver := result.PublishDataProtectionImpactAssessmentList.DocumentVersionEdge.Node
|
||||
assert.NotEmpty(t, ver.ID)
|
||||
assert.Equal(t, "REGISTER", ver.DocumentType)
|
||||
assert.Equal(t, "PUBLISHED", ver.Status)
|
||||
assert.Equal(t, 1, ver.Major)
|
||||
assert.Equal(t, 0, ver.Minor)
|
||||
assert.Contains(t, ver.Content, "DPIA description")
|
||||
},
|
||||
)
|
||||
|
||||
t.Run(
|
||||
"publish with approvers creates draft pending approval",
|
||||
func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
owner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
paID := factory.NewProcessingActivity(owner).
|
||||
WithName("DPIA Approval PA").
|
||||
WithLawfulBasis("CONSENT").
|
||||
Create()
|
||||
createDPIAForPublish(t, owner, paID, "DPIA Approval")
|
||||
|
||||
const query = `
|
||||
mutation($input: PublishDataProtectionImpactAssessmentListInput!) {
|
||||
publishDataProtectionImpactAssessmentList(input: $input) {
|
||||
documentVersionEdge {
|
||||
node {
|
||||
status
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var result struct {
|
||||
PublishDataProtectionImpactAssessmentList struct {
|
||||
DocumentVersionEdge struct {
|
||||
Node struct {
|
||||
Status string `json:"status"`
|
||||
} `json:"node"`
|
||||
} `json:"documentVersionEdge"`
|
||||
} `json:"publishDataProtectionImpactAssessmentList"`
|
||||
}
|
||||
|
||||
err := owner.Execute(
|
||||
query,
|
||||
map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": owner.GetOrganizationID(),
|
||||
"approverIds": []string{owner.GetProfileID().String()},
|
||||
},
|
||||
},
|
||||
&result,
|
||||
)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(
|
||||
t,
|
||||
"PENDING_APPROVAL",
|
||||
result.PublishDataProtectionImpactAssessmentList.DocumentVersionEdge.Node.Status,
|
||||
)
|
||||
},
|
||||
)
|
||||
|
||||
t.Run(
|
||||
"document linked back to organization via dataProtectionImpactAssessmentsDocument",
|
||||
func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
owner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
paID := factory.NewProcessingActivity(owner).
|
||||
WithName("DPIA Link PA").
|
||||
WithLawfulBasis("CONSENT").
|
||||
Create()
|
||||
createDPIAForPublish(t, owner, paID, "DPIA Link")
|
||||
|
||||
const publishQuery = `
|
||||
mutation($input: PublishDataProtectionImpactAssessmentListInput!) {
|
||||
publishDataProtectionImpactAssessmentList(input: $input) {
|
||||
documentEdge { node { id } }
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var publishResult struct {
|
||||
PublishDataProtectionImpactAssessmentList struct {
|
||||
DocumentEdge struct {
|
||||
Node struct {
|
||||
ID string `json:"id"`
|
||||
} `json:"node"`
|
||||
} `json:"documentEdge"`
|
||||
} `json:"publishDataProtectionImpactAssessmentList"`
|
||||
}
|
||||
|
||||
err := owner.Execute(
|
||||
publishQuery,
|
||||
map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": owner.GetOrganizationID(),
|
||||
},
|
||||
},
|
||||
&publishResult,
|
||||
)
|
||||
require.NoError(t, err)
|
||||
|
||||
docID := publishResult.PublishDataProtectionImpactAssessmentList.DocumentEdge.Node.ID
|
||||
|
||||
const orgQuery = `
|
||||
query($id: ID!) {
|
||||
node(id: $id) {
|
||||
... on Organization {
|
||||
dataProtectionImpactAssessmentsDocument { id }
|
||||
}
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var orgResult struct {
|
||||
Node struct {
|
||||
DataProtectionImpactAssessmentsDocument *struct {
|
||||
ID string `json:"id"`
|
||||
} `json:"dataProtectionImpactAssessmentsDocument"`
|
||||
} `json:"node"`
|
||||
}
|
||||
|
||||
err = owner.Execute(
|
||||
orgQuery,
|
||||
map[string]any{"id": owner.GetOrganizationID()},
|
||||
&orgResult,
|
||||
)
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, orgResult.Node.DataProtectionImpactAssessmentsDocument)
|
||||
assert.Equal(t, docID, orgResult.Node.DataProtectionImpactAssessmentsDocument.ID)
|
||||
},
|
||||
)
|
||||
}
|
||||
|
||||
func TestDataProtectionImpactAssessment_PublishList_RBAC(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
owner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
viewer := testutil.NewClientInOrg(t, testutil.RoleViewer, owner)
|
||||
|
||||
paID := factory.NewProcessingActivity(owner).
|
||||
WithName("DPIA RBAC PA").
|
||||
WithLawfulBasis("CONSENT").
|
||||
Create()
|
||||
createDPIAForPublish(t, owner, paID, "DPIA RBAC")
|
||||
|
||||
const query = `
|
||||
mutation($input: PublishDataProtectionImpactAssessmentListInput!) {
|
||||
publishDataProtectionImpactAssessmentList(input: $input) {
|
||||
documentEdge { node { id } }
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
t.Run("viewer cannot publish DPIA list", func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
err := viewer.ExecuteShouldFail(
|
||||
query,
|
||||
map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": owner.GetOrganizationID(),
|
||||
},
|
||||
},
|
||||
)
|
||||
testutil.RequireForbiddenError(t, err)
|
||||
})
|
||||
}
|
||||
|
||||
func createDPIAForPublish(t *testing.T, client *testutil.Client, processingActivityID string, description string) string {
|
||||
t.Helper()
|
||||
|
||||
const query = `
|
||||
mutation($input: CreateDataProtectionImpactAssessmentInput!) {
|
||||
createDataProtectionImpactAssessment(input: $input) {
|
||||
dataProtectionImpactAssessment { id }
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var result struct {
|
||||
CreateDataProtectionImpactAssessment struct {
|
||||
DataProtectionImpactAssessment struct {
|
||||
ID string `json:"id"`
|
||||
} `json:"dataProtectionImpactAssessment"`
|
||||
} `json:"createDataProtectionImpactAssessment"`
|
||||
}
|
||||
|
||||
err := client.Execute(query, map[string]any{
|
||||
"input": map[string]any{
|
||||
"processingActivityId": processingActivityID,
|
||||
"description": description,
|
||||
"residualRisk": "LOW",
|
||||
},
|
||||
}, &result)
|
||||
require.NoError(t, err)
|
||||
|
||||
return result.CreateDataProtectionImpactAssessment.DataProtectionImpactAssessment.ID
|
||||
}
|
||||
348
e2e/console/processing_activity_publish_test.go
Normal file
348
e2e/console/processing_activity_publish_test.go
Normal file
@@ -0,0 +1,348 @@
|
||||
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
|
||||
//
|
||||
// Permission to use, copy, modify, and/or distribute this software for any
|
||||
// purpose with or without fee is hereby granted, provided that the above
|
||||
// copyright notice and this permission notice appear in all copies.
|
||||
//
|
||||
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
||||
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
||||
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
// PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
package console_test
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
"go.probo.inc/probo/e2e/internal/factory"
|
||||
"go.probo.inc/probo/e2e/internal/testutil"
|
||||
)
|
||||
|
||||
func TestProcessingActivity_PublishProcessingActivityList(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
owner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
|
||||
t.Run(
|
||||
"publish without approvers publishes immediately",
|
||||
func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
owner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
|
||||
_ = factory.NewProcessingActivity(owner).
|
||||
WithName("Test Processing Activity").
|
||||
WithLawfulBasis("CONSENT").
|
||||
Create()
|
||||
|
||||
const query = `
|
||||
mutation($input: PublishProcessingActivityListInput!) {
|
||||
publishProcessingActivityList(input: $input) {
|
||||
documentEdge {
|
||||
node {
|
||||
id
|
||||
writeMode
|
||||
status
|
||||
}
|
||||
}
|
||||
documentVersionEdge {
|
||||
node {
|
||||
id
|
||||
title
|
||||
documentType
|
||||
status
|
||||
major
|
||||
minor
|
||||
content
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var result struct {
|
||||
PublishProcessingActivityList struct {
|
||||
DocumentEdge struct {
|
||||
Node struct {
|
||||
ID string `json:"id"`
|
||||
WriteMode string `json:"writeMode"`
|
||||
Status string `json:"status"`
|
||||
} `json:"node"`
|
||||
} `json:"documentEdge"`
|
||||
DocumentVersionEdge struct {
|
||||
Node struct {
|
||||
ID string `json:"id"`
|
||||
Title string `json:"title"`
|
||||
DocumentType string `json:"documentType"`
|
||||
Status string `json:"status"`
|
||||
Major int `json:"major"`
|
||||
Minor int `json:"minor"`
|
||||
Content string `json:"content"`
|
||||
} `json:"node"`
|
||||
} `json:"documentVersionEdge"`
|
||||
} `json:"publishProcessingActivityList"`
|
||||
}
|
||||
|
||||
err := owner.Execute(
|
||||
query,
|
||||
map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": owner.GetOrganizationID(),
|
||||
},
|
||||
},
|
||||
&result,
|
||||
)
|
||||
require.NoError(t, err)
|
||||
|
||||
doc := result.PublishProcessingActivityList.DocumentEdge.Node
|
||||
assert.NotEmpty(t, doc.ID)
|
||||
assert.Equal(t, "GENERATED", doc.WriteMode)
|
||||
assert.Equal(t, "ACTIVE", doc.Status)
|
||||
|
||||
ver := result.PublishProcessingActivityList.DocumentVersionEdge.Node
|
||||
assert.NotEmpty(t, ver.ID)
|
||||
assert.Equal(t, "REGISTER", ver.DocumentType)
|
||||
assert.Equal(t, "PUBLISHED", ver.Status)
|
||||
assert.Equal(t, 1, ver.Major)
|
||||
assert.Equal(t, 0, ver.Minor)
|
||||
assert.Contains(t, ver.Content, "Purpose")
|
||||
assert.Contains(t, ver.Content, "Test Processing Activity")
|
||||
},
|
||||
)
|
||||
|
||||
t.Run(
|
||||
"publish with approvers creates draft pending approval",
|
||||
func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
_ = factory.NewProcessingActivity(owner).
|
||||
WithName("Approval PA").
|
||||
WithLawfulBasis("CONSENT").
|
||||
Create()
|
||||
|
||||
const query = `
|
||||
mutation($input: PublishProcessingActivityListInput!) {
|
||||
publishProcessingActivityList(input: $input) {
|
||||
documentVersionEdge {
|
||||
node {
|
||||
id
|
||||
status
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var result struct {
|
||||
PublishProcessingActivityList struct {
|
||||
DocumentVersionEdge struct {
|
||||
Node struct {
|
||||
ID string `json:"id"`
|
||||
Status string `json:"status"`
|
||||
} `json:"node"`
|
||||
} `json:"documentVersionEdge"`
|
||||
} `json:"publishProcessingActivityList"`
|
||||
}
|
||||
|
||||
err := owner.Execute(
|
||||
query,
|
||||
map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": owner.GetOrganizationID(),
|
||||
"approverIds": []string{owner.GetProfileID().String()},
|
||||
},
|
||||
},
|
||||
&result,
|
||||
)
|
||||
require.NoError(t, err)
|
||||
|
||||
ver := result.PublishProcessingActivityList.DocumentVersionEdge.Node
|
||||
assert.NotEmpty(t, ver.ID)
|
||||
assert.Equal(t, "PENDING_APPROVAL", ver.Status)
|
||||
},
|
||||
)
|
||||
|
||||
t.Run(
|
||||
"second publish reuses existing document and bumps major version",
|
||||
func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
secondOwner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
|
||||
_ = factory.NewProcessingActivity(secondOwner).
|
||||
WithName("Reuse PA").
|
||||
WithLawfulBasis("CONSENT").
|
||||
Create()
|
||||
|
||||
const query = `
|
||||
mutation($input: PublishProcessingActivityListInput!) {
|
||||
publishProcessingActivityList(input: $input) {
|
||||
documentEdge {
|
||||
node { id }
|
||||
}
|
||||
documentVersionEdge {
|
||||
node { id major }
|
||||
}
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var result1, result2 struct {
|
||||
PublishProcessingActivityList struct {
|
||||
DocumentEdge struct {
|
||||
Node struct {
|
||||
ID string `json:"id"`
|
||||
} `json:"node"`
|
||||
} `json:"documentEdge"`
|
||||
DocumentVersionEdge struct {
|
||||
Node struct {
|
||||
ID string `json:"id"`
|
||||
Major int `json:"major"`
|
||||
} `json:"node"`
|
||||
} `json:"documentVersionEdge"`
|
||||
} `json:"publishProcessingActivityList"`
|
||||
}
|
||||
|
||||
input := map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": secondOwner.GetOrganizationID(),
|
||||
},
|
||||
}
|
||||
|
||||
err := secondOwner.Execute(query, input, &result1)
|
||||
require.NoError(t, err)
|
||||
|
||||
err = secondOwner.Execute(query, input, &result2)
|
||||
require.NoError(t, err)
|
||||
|
||||
assert.Equal(
|
||||
t,
|
||||
result1.PublishProcessingActivityList.DocumentEdge.Node.ID,
|
||||
result2.PublishProcessingActivityList.DocumentEdge.Node.ID,
|
||||
"should reuse the same document",
|
||||
)
|
||||
assert.Equal(t, 1, result1.PublishProcessingActivityList.DocumentVersionEdge.Node.Major)
|
||||
assert.Equal(t, 2, result2.PublishProcessingActivityList.DocumentVersionEdge.Node.Major)
|
||||
},
|
||||
)
|
||||
|
||||
t.Run(
|
||||
"document linked back to organization via processingActivitiesDocument",
|
||||
func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
thirdOwner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
|
||||
_ = factory.NewProcessingActivity(thirdOwner).
|
||||
WithName("Linked PA").
|
||||
WithLawfulBasis("CONSENT").
|
||||
Create()
|
||||
|
||||
const publishQuery = `
|
||||
mutation($input: PublishProcessingActivityListInput!) {
|
||||
publishProcessingActivityList(input: $input) {
|
||||
documentEdge {
|
||||
node { id }
|
||||
}
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var publishResult struct {
|
||||
PublishProcessingActivityList struct {
|
||||
DocumentEdge struct {
|
||||
Node struct {
|
||||
ID string `json:"id"`
|
||||
} `json:"node"`
|
||||
} `json:"documentEdge"`
|
||||
} `json:"publishProcessingActivityList"`
|
||||
}
|
||||
|
||||
err := thirdOwner.Execute(
|
||||
publishQuery,
|
||||
map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": thirdOwner.GetOrganizationID(),
|
||||
},
|
||||
},
|
||||
&publishResult,
|
||||
)
|
||||
require.NoError(t, err)
|
||||
|
||||
docID := publishResult.PublishProcessingActivityList.DocumentEdge.Node.ID
|
||||
|
||||
const orgQuery = `
|
||||
query($id: ID!) {
|
||||
node(id: $id) {
|
||||
... on Organization {
|
||||
id
|
||||
processingActivitiesDocument { id }
|
||||
}
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var orgResult struct {
|
||||
Node struct {
|
||||
ID string `json:"id"`
|
||||
ProcessingActivitiesDocument *struct {
|
||||
ID string `json:"id"`
|
||||
} `json:"processingActivitiesDocument"`
|
||||
} `json:"node"`
|
||||
}
|
||||
|
||||
err = thirdOwner.Execute(
|
||||
orgQuery,
|
||||
map[string]any{"id": thirdOwner.GetOrganizationID()},
|
||||
&orgResult,
|
||||
)
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, orgResult.Node.ProcessingActivitiesDocument)
|
||||
assert.Equal(t, docID, orgResult.Node.ProcessingActivitiesDocument.ID)
|
||||
},
|
||||
)
|
||||
}
|
||||
|
||||
func TestProcessingActivity_PublishProcessingActivityList_RBAC(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
owner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
viewer := testutil.NewClientInOrg(t, testutil.RoleViewer, owner)
|
||||
|
||||
_ = factory.NewProcessingActivity(owner).
|
||||
WithName("RBAC PA").
|
||||
WithLawfulBasis("CONSENT").
|
||||
Create()
|
||||
|
||||
const query = `
|
||||
mutation($input: PublishProcessingActivityListInput!) {
|
||||
publishProcessingActivityList(input: $input) {
|
||||
documentEdge {
|
||||
node { id }
|
||||
}
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
t.Run(
|
||||
"viewer cannot publish processing activity list",
|
||||
func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
err := viewer.ExecuteShouldFail(
|
||||
query,
|
||||
map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": owner.GetOrganizationID(),
|
||||
},
|
||||
},
|
||||
)
|
||||
testutil.RequireForbiddenError(t, err)
|
||||
},
|
||||
)
|
||||
}
|
||||
@@ -2306,680 +2306,3 @@ func TestProcessingActivity_TIA_RBAC(t *testing.T) {
|
||||
testutil.RequireForbiddenError(t, err, "viewer should not be able to delete TIA")
|
||||
})
|
||||
}
|
||||
|
||||
func TestProcessingActivity_Snapshot_DPIA_TIA(t *testing.T) {
|
||||
t.Parallel()
|
||||
owner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
|
||||
t.Run("snapshot includes DPIA and TIA", func(t *testing.T) {
|
||||
paID := factory.NewProcessingActivity(owner).
|
||||
WithName("Snapshot DPIA TIA Test").
|
||||
Create()
|
||||
|
||||
var dpiaResult struct {
|
||||
CreateDataProtectionImpactAssessment struct {
|
||||
DataProtectionImpactAssessment struct {
|
||||
ID string `json:"id"`
|
||||
} `json:"dataProtectionImpactAssessment"`
|
||||
} `json:"createDataProtectionImpactAssessment"`
|
||||
}
|
||||
err := owner.Execute(`
|
||||
mutation($input: CreateDataProtectionImpactAssessmentInput!) {
|
||||
createDataProtectionImpactAssessment(input: $input) {
|
||||
dataProtectionImpactAssessment { id }
|
||||
}
|
||||
}
|
||||
`, map[string]any{
|
||||
"input": map[string]any{
|
||||
"processingActivityId": paID,
|
||||
"description": "DPIA for snapshot",
|
||||
"residualRisk": "MEDIUM",
|
||||
},
|
||||
}, &dpiaResult)
|
||||
require.NoError(t, err)
|
||||
|
||||
var tiaResult struct {
|
||||
CreateTransferImpactAssessment struct {
|
||||
TransferImpactAssessment struct {
|
||||
ID string `json:"id"`
|
||||
} `json:"transferImpactAssessment"`
|
||||
} `json:"createTransferImpactAssessment"`
|
||||
}
|
||||
err = owner.Execute(`
|
||||
mutation($input: CreateTransferImpactAssessmentInput!) {
|
||||
createTransferImpactAssessment(input: $input) {
|
||||
transferImpactAssessment { id }
|
||||
}
|
||||
}
|
||||
`, map[string]any{
|
||||
"input": map[string]any{
|
||||
"processingActivityId": paID,
|
||||
"dataSubjects": "TIA subjects for snapshot",
|
||||
"transfer": "EU to US",
|
||||
},
|
||||
}, &tiaResult)
|
||||
require.NoError(t, err)
|
||||
|
||||
var snapshotResult struct {
|
||||
CreateSnapshot struct {
|
||||
SnapshotEdge struct {
|
||||
Node struct {
|
||||
ID string `json:"id"`
|
||||
} `json:"node"`
|
||||
} `json:"snapshotEdge"`
|
||||
} `json:"createSnapshot"`
|
||||
}
|
||||
err = owner.Execute(`
|
||||
mutation($input: CreateSnapshotInput!) {
|
||||
createSnapshot(input: $input) {
|
||||
snapshotEdge {
|
||||
node { id }
|
||||
}
|
||||
}
|
||||
}
|
||||
`, map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": owner.GetOrganizationID().String(),
|
||||
"name": fmt.Sprintf("PA Snapshot Test %d", time.Now().UnixNano()),
|
||||
"type": "PROCESSING_ACTIVITIES",
|
||||
},
|
||||
}, &snapshotResult)
|
||||
require.NoError(t, err)
|
||||
snapshotID := snapshotResult.CreateSnapshot.SnapshotEdge.Node.ID
|
||||
|
||||
var queryResult struct {
|
||||
Node struct {
|
||||
ProcessingActivities struct {
|
||||
Edges []struct {
|
||||
Node struct {
|
||||
ID string `json:"id"`
|
||||
Name string `json:"name"`
|
||||
DataProtectionImpactAssessment *struct {
|
||||
ID string `json:"id"`
|
||||
Description *string `json:"description"`
|
||||
ResidualRisk *string `json:"residualRisk"`
|
||||
} `json:"dataProtectionImpactAssessment"`
|
||||
TransferImpactAssessment *struct {
|
||||
ID string `json:"id"`
|
||||
DataSubjects *string `json:"dataSubjects"`
|
||||
Transfer *string `json:"transfer"`
|
||||
} `json:"transferImpactAssessment"`
|
||||
} `json:"node"`
|
||||
} `json:"edges"`
|
||||
} `json:"processingActivities"`
|
||||
} `json:"node"`
|
||||
}
|
||||
err = owner.Execute(`
|
||||
query($orgId: ID!, $snapshotId: ID!) {
|
||||
node(id: $orgId) {
|
||||
... on Organization {
|
||||
processingActivities(first: 100, filter: { snapshotId: $snapshotId }) {
|
||||
edges {
|
||||
node {
|
||||
id
|
||||
name
|
||||
dataProtectionImpactAssessment {
|
||||
id
|
||||
description
|
||||
residualRisk
|
||||
}
|
||||
transferImpactAssessment {
|
||||
id
|
||||
dataSubjects
|
||||
transfer
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
`, map[string]any{
|
||||
"orgId": owner.GetOrganizationID().String(),
|
||||
"snapshotId": snapshotID,
|
||||
}, &queryResult)
|
||||
require.NoError(t, err)
|
||||
|
||||
var foundPA bool
|
||||
for _, edge := range queryResult.Node.ProcessingActivities.Edges {
|
||||
if edge.Node.Name == "Snapshot DPIA TIA Test" {
|
||||
foundPA = true
|
||||
require.NotNil(t, edge.Node.DataProtectionImpactAssessment, "DPIA should be included in snapshot")
|
||||
assert.Equal(t, "DPIA for snapshot", *edge.Node.DataProtectionImpactAssessment.Description)
|
||||
assert.Equal(t, "MEDIUM", *edge.Node.DataProtectionImpactAssessment.ResidualRisk)
|
||||
|
||||
require.NotNil(t, edge.Node.TransferImpactAssessment, "TIA should be included in snapshot")
|
||||
assert.Equal(t, "TIA subjects for snapshot", *edge.Node.TransferImpactAssessment.DataSubjects)
|
||||
assert.Equal(t, "EU to US", *edge.Node.TransferImpactAssessment.Transfer)
|
||||
break
|
||||
}
|
||||
}
|
||||
assert.True(t, foundPA, "Processing activity should be found in snapshot")
|
||||
})
|
||||
|
||||
t.Run("snapshot DPIA and TIA are independent of source", func(t *testing.T) {
|
||||
paID := factory.NewProcessingActivity(owner).
|
||||
WithName("Snapshot Independence Test").
|
||||
Create()
|
||||
|
||||
err := owner.Execute(`
|
||||
mutation($input: CreateDataProtectionImpactAssessmentInput!) {
|
||||
createDataProtectionImpactAssessment(input: $input) {
|
||||
dataProtectionImpactAssessment { id }
|
||||
}
|
||||
}
|
||||
`, map[string]any{
|
||||
"input": map[string]any{
|
||||
"processingActivityId": paID,
|
||||
"description": "Original DPIA",
|
||||
"residualRisk": "LOW",
|
||||
},
|
||||
}, nil)
|
||||
require.NoError(t, err)
|
||||
|
||||
var snapshotResult struct {
|
||||
CreateSnapshot struct {
|
||||
SnapshotEdge struct {
|
||||
Node struct {
|
||||
ID string `json:"id"`
|
||||
} `json:"node"`
|
||||
} `json:"snapshotEdge"`
|
||||
} `json:"createSnapshot"`
|
||||
}
|
||||
err = owner.Execute(`
|
||||
mutation($input: CreateSnapshotInput!) {
|
||||
createSnapshot(input: $input) {
|
||||
snapshotEdge {
|
||||
node { id }
|
||||
}
|
||||
}
|
||||
}
|
||||
`, map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": owner.GetOrganizationID().String(),
|
||||
"name": fmt.Sprintf("PA Independence Test %d", time.Now().UnixNano()),
|
||||
"type": "PROCESSING_ACTIVITIES",
|
||||
},
|
||||
}, &snapshotResult)
|
||||
require.NoError(t, err)
|
||||
snapshotID := snapshotResult.CreateSnapshot.SnapshotEdge.Node.ID
|
||||
|
||||
var sourceResult struct {
|
||||
Node struct {
|
||||
DataProtectionImpactAssessment *struct {
|
||||
ID string `json:"id"`
|
||||
Description *string `json:"description"`
|
||||
ResidualRisk *string `json:"residualRisk"`
|
||||
} `json:"dataProtectionImpactAssessment"`
|
||||
} `json:"node"`
|
||||
}
|
||||
err = owner.Execute(`
|
||||
query($id: ID!) {
|
||||
node(id: $id) {
|
||||
... on ProcessingActivity {
|
||||
dataProtectionImpactAssessment {
|
||||
id
|
||||
description
|
||||
residualRisk
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
`, map[string]any{"id": paID}, &sourceResult)
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, sourceResult.Node.DataProtectionImpactAssessment)
|
||||
sourceDpiaID := sourceResult.Node.DataProtectionImpactAssessment.ID
|
||||
|
||||
_, err = owner.Do(`
|
||||
mutation($input: UpdateDataProtectionImpactAssessmentInput!) {
|
||||
updateDataProtectionImpactAssessment(input: $input) {
|
||||
dataProtectionImpactAssessment { id }
|
||||
}
|
||||
}
|
||||
`, map[string]any{
|
||||
"input": map[string]any{
|
||||
"id": sourceDpiaID,
|
||||
"description": "Updated after snapshot",
|
||||
"residualRisk": "HIGH",
|
||||
},
|
||||
})
|
||||
require.NoError(t, err)
|
||||
|
||||
var snapshotQueryResult struct {
|
||||
Node struct {
|
||||
ProcessingActivities struct {
|
||||
Edges []struct {
|
||||
Node struct {
|
||||
Name string `json:"name"`
|
||||
DataProtectionImpactAssessment *struct {
|
||||
Description *string `json:"description"`
|
||||
ResidualRisk *string `json:"residualRisk"`
|
||||
} `json:"dataProtectionImpactAssessment"`
|
||||
} `json:"node"`
|
||||
} `json:"edges"`
|
||||
} `json:"processingActivities"`
|
||||
} `json:"node"`
|
||||
}
|
||||
err = owner.Execute(`
|
||||
query($orgId: ID!, $snapshotId: ID!) {
|
||||
node(id: $orgId) {
|
||||
... on Organization {
|
||||
processingActivities(first: 100, filter: { snapshotId: $snapshotId }) {
|
||||
edges {
|
||||
node {
|
||||
name
|
||||
dataProtectionImpactAssessment {
|
||||
description
|
||||
residualRisk
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
`, map[string]any{
|
||||
"orgId": owner.GetOrganizationID().String(),
|
||||
"snapshotId": snapshotID,
|
||||
}, &snapshotQueryResult)
|
||||
require.NoError(t, err)
|
||||
|
||||
for _, edge := range snapshotQueryResult.Node.ProcessingActivities.Edges {
|
||||
if edge.Node.Name == "Snapshot Independence Test" {
|
||||
require.NotNil(t, edge.Node.DataProtectionImpactAssessment)
|
||||
assert.Equal(t, "Original DPIA", *edge.Node.DataProtectionImpactAssessment.Description, "Snapshot DPIA should retain original value")
|
||||
assert.Equal(t, "LOW", *edge.Node.DataProtectionImpactAssessment.ResidualRisk, "Snapshot DPIA should retain original value")
|
||||
break
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
func TestProcessingActivity_ExportPDF(t *testing.T) {
|
||||
t.Parallel()
|
||||
owner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
|
||||
t.Run("export processing activities PDF", func(t *testing.T) {
|
||||
_ = factory.NewProcessingActivity(owner).
|
||||
WithName("PA Export Test 1").
|
||||
WithLawfulBasis("CONSENT").
|
||||
Create()
|
||||
_ = factory.NewProcessingActivity(owner).
|
||||
WithName("PA Export Test 2").
|
||||
WithLawfulBasis("LEGITIMATE_INTEREST").
|
||||
Create()
|
||||
|
||||
query := `
|
||||
mutation ExportProcessingActivitiesPDF($input: ExportProcessingActivitiesPDFInput!) {
|
||||
exportProcessingActivitiesPDF(input: $input) {
|
||||
data
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var result struct {
|
||||
ExportProcessingActivitiesPDF struct {
|
||||
Data string `json:"data"`
|
||||
} `json:"exportProcessingActivitiesPDF"`
|
||||
}
|
||||
|
||||
err := owner.Execute(query, map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": owner.GetOrganizationID().String(),
|
||||
"filter": nil,
|
||||
},
|
||||
}, &result)
|
||||
require.NoError(t, err)
|
||||
assert.NotEmpty(t, result.ExportProcessingActivitiesPDF.Data)
|
||||
assert.Contains(t, result.ExportProcessingActivitiesPDF.Data, "data:application/pdf;base64,")
|
||||
})
|
||||
|
||||
t.Run("export processing activities PDF with snapshot filter", func(t *testing.T) {
|
||||
_ = factory.NewProcessingActivity(owner).
|
||||
WithName("PA Snapshot Export Test").
|
||||
Create()
|
||||
|
||||
// Create snapshot
|
||||
var snapshotResult struct {
|
||||
CreateSnapshot struct {
|
||||
SnapshotEdge struct {
|
||||
Node struct {
|
||||
ID string `json:"id"`
|
||||
} `json:"node"`
|
||||
} `json:"snapshotEdge"`
|
||||
} `json:"createSnapshot"`
|
||||
}
|
||||
err := owner.Execute(`
|
||||
mutation($input: CreateSnapshotInput!) {
|
||||
createSnapshot(input: $input) {
|
||||
snapshotEdge {
|
||||
node { id }
|
||||
}
|
||||
}
|
||||
}
|
||||
`, map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": owner.GetOrganizationID().String(),
|
||||
"name": fmt.Sprintf("PA Export Snapshot Test %d", time.Now().UnixNano()),
|
||||
"type": "PROCESSING_ACTIVITIES",
|
||||
},
|
||||
}, &snapshotResult)
|
||||
require.NoError(t, err)
|
||||
snapshotID := snapshotResult.CreateSnapshot.SnapshotEdge.Node.ID
|
||||
|
||||
query := `
|
||||
mutation ExportProcessingActivitiesPDF($input: ExportProcessingActivitiesPDFInput!) {
|
||||
exportProcessingActivitiesPDF(input: $input) {
|
||||
data
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var result struct {
|
||||
ExportProcessingActivitiesPDF struct {
|
||||
Data string `json:"data"`
|
||||
} `json:"exportProcessingActivitiesPDF"`
|
||||
}
|
||||
|
||||
err = owner.Execute(query, map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": owner.GetOrganizationID().String(),
|
||||
"filter": map[string]any{
|
||||
"snapshotId": snapshotID,
|
||||
},
|
||||
},
|
||||
}, &result)
|
||||
require.NoError(t, err)
|
||||
assert.NotEmpty(t, result.ExportProcessingActivitiesPDF.Data)
|
||||
assert.Contains(t, result.ExportProcessingActivitiesPDF.Data, "data:application/pdf;base64,")
|
||||
})
|
||||
|
||||
t.Run("export fails with no processing activities", func(t *testing.T) {
|
||||
newOwner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
|
||||
query := `
|
||||
mutation ExportProcessingActivitiesPDF($input: ExportProcessingActivitiesPDFInput!) {
|
||||
exportProcessingActivitiesPDF(input: $input) {
|
||||
data
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
_, err := newOwner.Do(query, map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": newOwner.GetOrganizationID().String(),
|
||||
"filter": nil,
|
||||
},
|
||||
})
|
||||
testutil.RequireErrorCode(t, err, "NOT_FOUND")
|
||||
assert.Contains(t, err.Error(), "no processing activities found")
|
||||
})
|
||||
}
|
||||
|
||||
func TestDataProtectionImpactAssessment_ExportPDF(t *testing.T) {
|
||||
t.Parallel()
|
||||
owner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
|
||||
t.Run("export DPIA PDF", func(t *testing.T) {
|
||||
pa1ID := factory.NewProcessingActivity(owner).
|
||||
WithName("DPIA Export Test PA 1").
|
||||
Create()
|
||||
pa2ID := factory.NewProcessingActivity(owner).
|
||||
WithName("DPIA Export Test PA 2").
|
||||
Create()
|
||||
|
||||
_, err := owner.Do(`
|
||||
mutation($input: CreateDataProtectionImpactAssessmentInput!) {
|
||||
createDataProtectionImpactAssessment(input: $input) {
|
||||
dataProtectionImpactAssessment { id }
|
||||
}
|
||||
}
|
||||
`, map[string]any{
|
||||
"input": map[string]any{
|
||||
"processingActivityId": pa1ID,
|
||||
"description": "DPIA 1 description",
|
||||
"residualRisk": "LOW",
|
||||
},
|
||||
})
|
||||
require.NoError(t, err)
|
||||
|
||||
_, err = owner.Do(`
|
||||
mutation($input: CreateDataProtectionImpactAssessmentInput!) {
|
||||
createDataProtectionImpactAssessment(input: $input) {
|
||||
dataProtectionImpactAssessment { id }
|
||||
}
|
||||
}
|
||||
`, map[string]any{
|
||||
"input": map[string]any{
|
||||
"processingActivityId": pa2ID,
|
||||
"description": "DPIA 2 description",
|
||||
"residualRisk": "MEDIUM",
|
||||
},
|
||||
})
|
||||
require.NoError(t, err)
|
||||
|
||||
query := `
|
||||
mutation ExportDataProtectionImpactAssessmentsPDF($input: ExportDataProtectionImpactAssessmentsPDFInput!) {
|
||||
exportDataProtectionImpactAssessmentsPDF(input: $input) {
|
||||
data
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var result struct {
|
||||
ExportDataProtectionImpactAssessmentsPDF struct {
|
||||
Data string `json:"data"`
|
||||
} `json:"exportDataProtectionImpactAssessmentsPDF"`
|
||||
}
|
||||
|
||||
err = owner.Execute(query, map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": owner.GetOrganizationID().String(),
|
||||
"filter": nil,
|
||||
},
|
||||
}, &result)
|
||||
require.NoError(t, err)
|
||||
assert.NotEmpty(t, result.ExportDataProtectionImpactAssessmentsPDF.Data)
|
||||
assert.Contains(t, result.ExportDataProtectionImpactAssessmentsPDF.Data, "data:application/pdf;base64,")
|
||||
})
|
||||
|
||||
t.Run("export fails with no DPIAs", func(t *testing.T) {
|
||||
newOwner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
|
||||
query := `
|
||||
mutation ExportDataProtectionImpactAssessmentsPDF($input: ExportDataProtectionImpactAssessmentsPDFInput!) {
|
||||
exportDataProtectionImpactAssessmentsPDF(input: $input) {
|
||||
data
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
_, err := newOwner.Do(query, map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": newOwner.GetOrganizationID().String(),
|
||||
"filter": nil,
|
||||
},
|
||||
})
|
||||
testutil.RequireErrorCode(t, err, "NOT_FOUND")
|
||||
assert.Contains(t, err.Error(), "no data protection impact assessments found")
|
||||
})
|
||||
}
|
||||
|
||||
func TestTransferImpactAssessment_ExportPDF(t *testing.T) {
|
||||
t.Parallel()
|
||||
owner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
|
||||
t.Run("export TIA PDF", func(t *testing.T) {
|
||||
pa1ID := factory.NewProcessingActivity(owner).
|
||||
WithName("TIA Export Test PA 1").
|
||||
Create()
|
||||
pa2ID := factory.NewProcessingActivity(owner).
|
||||
WithName("TIA Export Test PA 2").
|
||||
Create()
|
||||
|
||||
_, err := owner.Do(`
|
||||
mutation($input: CreateTransferImpactAssessmentInput!) {
|
||||
createTransferImpactAssessment(input: $input) {
|
||||
transferImpactAssessment { id }
|
||||
}
|
||||
}
|
||||
`, map[string]any{
|
||||
"input": map[string]any{
|
||||
"processingActivityId": pa1ID,
|
||||
"dataSubjects": "TIA 1 subjects",
|
||||
"transfer": "EU to US",
|
||||
},
|
||||
})
|
||||
require.NoError(t, err)
|
||||
|
||||
_, err = owner.Do(`
|
||||
mutation($input: CreateTransferImpactAssessmentInput!) {
|
||||
createTransferImpactAssessment(input: $input) {
|
||||
transferImpactAssessment { id }
|
||||
}
|
||||
}
|
||||
`, map[string]any{
|
||||
"input": map[string]any{
|
||||
"processingActivityId": pa2ID,
|
||||
"dataSubjects": "TIA 2 subjects",
|
||||
"transfer": "EU to UK",
|
||||
},
|
||||
})
|
||||
require.NoError(t, err)
|
||||
|
||||
query := `
|
||||
mutation ExportTransferImpactAssessmentsPDF($input: ExportTransferImpactAssessmentsPDFInput!) {
|
||||
exportTransferImpactAssessmentsPDF(input: $input) {
|
||||
data
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var result struct {
|
||||
ExportTransferImpactAssessmentsPDF struct {
|
||||
Data string `json:"data"`
|
||||
} `json:"exportTransferImpactAssessmentsPDF"`
|
||||
}
|
||||
|
||||
err = owner.Execute(query, map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": owner.GetOrganizationID().String(),
|
||||
"filter": nil,
|
||||
},
|
||||
}, &result)
|
||||
require.NoError(t, err)
|
||||
assert.NotEmpty(t, result.ExportTransferImpactAssessmentsPDF.Data)
|
||||
assert.Contains(t, result.ExportTransferImpactAssessmentsPDF.Data, "data:application/pdf;base64,")
|
||||
})
|
||||
|
||||
t.Run("export fails with no TIAs", func(t *testing.T) {
|
||||
newOwner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
|
||||
query := `
|
||||
mutation ExportTransferImpactAssessmentsPDF($input: ExportTransferImpactAssessmentsPDFInput!) {
|
||||
exportTransferImpactAssessmentsPDF(input: $input) {
|
||||
data
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
_, err := newOwner.Do(query, map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": newOwner.GetOrganizationID().String(),
|
||||
"filter": nil,
|
||||
},
|
||||
})
|
||||
testutil.RequireErrorCode(t, err, "NOT_FOUND")
|
||||
assert.Contains(t, err.Error(), "no transfer impact assessments found")
|
||||
})
|
||||
}
|
||||
|
||||
func TestProcessingActivity_ExportPDF_RBAC(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
t.Run("owner can export PDF", func(t *testing.T) {
|
||||
owner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
_ = factory.NewProcessingActivity(owner).WithName("RBAC Export Test").Create()
|
||||
|
||||
query := `
|
||||
mutation ExportProcessingActivitiesPDF($input: ExportProcessingActivitiesPDFInput!) {
|
||||
exportProcessingActivitiesPDF(input: $input) {
|
||||
data
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var result struct {
|
||||
ExportProcessingActivitiesPDF struct {
|
||||
Data string `json:"data"`
|
||||
} `json:"exportProcessingActivitiesPDF"`
|
||||
}
|
||||
|
||||
err := owner.Execute(query, map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": owner.GetOrganizationID().String(),
|
||||
"filter": nil,
|
||||
},
|
||||
}, &result)
|
||||
require.NoError(t, err, "owner should be able to export PDF")
|
||||
assert.NotEmpty(t, result.ExportProcessingActivitiesPDF.Data)
|
||||
})
|
||||
|
||||
t.Run("admin can export PDF", func(t *testing.T) {
|
||||
owner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
admin := testutil.NewClientInOrg(t, testutil.RoleAdmin, owner)
|
||||
_ = factory.NewProcessingActivity(owner).WithName("RBAC Export Test").Create()
|
||||
|
||||
query := `
|
||||
mutation ExportProcessingActivitiesPDF($input: ExportProcessingActivitiesPDFInput!) {
|
||||
exportProcessingActivitiesPDF(input: $input) {
|
||||
data
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var result struct {
|
||||
ExportProcessingActivitiesPDF struct {
|
||||
Data string `json:"data"`
|
||||
} `json:"exportProcessingActivitiesPDF"`
|
||||
}
|
||||
|
||||
err := admin.Execute(query, map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": admin.GetOrganizationID().String(),
|
||||
"filter": nil,
|
||||
},
|
||||
}, &result)
|
||||
require.NoError(t, err, "admin should be able to export PDF")
|
||||
assert.NotEmpty(t, result.ExportProcessingActivitiesPDF.Data)
|
||||
})
|
||||
|
||||
t.Run("viewer can export PDF", func(t *testing.T) {
|
||||
owner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
viewer := testutil.NewClientInOrg(t, testutil.RoleViewer, owner)
|
||||
_ = factory.NewProcessingActivity(owner).WithName("RBAC Export Test").Create()
|
||||
|
||||
query := `
|
||||
mutation ExportProcessingActivitiesPDF($input: ExportProcessingActivitiesPDFInput!) {
|
||||
exportProcessingActivitiesPDF(input: $input) {
|
||||
data
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var result struct {
|
||||
ExportProcessingActivitiesPDF struct {
|
||||
Data string `json:"data"`
|
||||
} `json:"exportProcessingActivitiesPDF"`
|
||||
}
|
||||
|
||||
err := viewer.Execute(query, map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": viewer.GetOrganizationID().String(),
|
||||
"filter": nil,
|
||||
},
|
||||
}, &result)
|
||||
require.NoError(t, err, "viewer should be able to export PDF")
|
||||
assert.NotEmpty(t, result.ExportProcessingActivitiesPDF.Data)
|
||||
})
|
||||
}
|
||||
|
||||
304
e2e/console/tia_publish_test.go
Normal file
304
e2e/console/tia_publish_test.go
Normal file
@@ -0,0 +1,304 @@
|
||||
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
|
||||
//
|
||||
// Permission to use, copy, modify, and/or distribute this software for any
|
||||
// purpose with or without fee is hereby granted, provided that the above
|
||||
// copyright notice and this permission notice appear in all copies.
|
||||
//
|
||||
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
||||
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
||||
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
// PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
package console_test
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
"go.probo.inc/probo/e2e/internal/factory"
|
||||
"go.probo.inc/probo/e2e/internal/testutil"
|
||||
)
|
||||
|
||||
func TestTransferImpactAssessment_PublishList(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
t.Run(
|
||||
"publish without approvers publishes immediately",
|
||||
func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
owner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
paID := factory.NewProcessingActivity(owner).
|
||||
WithName("TIA Publish PA").
|
||||
WithLawfulBasis("CONSENT").
|
||||
Create()
|
||||
createTIAForPublish(t, owner, paID, "EU to US transfer")
|
||||
|
||||
const query = `
|
||||
mutation($input: PublishTransferImpactAssessmentListInput!) {
|
||||
publishTransferImpactAssessmentList(input: $input) {
|
||||
documentEdge {
|
||||
node {
|
||||
id
|
||||
writeMode
|
||||
status
|
||||
}
|
||||
}
|
||||
documentVersionEdge {
|
||||
node {
|
||||
id
|
||||
title
|
||||
documentType
|
||||
status
|
||||
major
|
||||
minor
|
||||
content
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var result struct {
|
||||
PublishTransferImpactAssessmentList struct {
|
||||
DocumentEdge struct {
|
||||
Node struct {
|
||||
ID string `json:"id"`
|
||||
WriteMode string `json:"writeMode"`
|
||||
Status string `json:"status"`
|
||||
} `json:"node"`
|
||||
} `json:"documentEdge"`
|
||||
DocumentVersionEdge struct {
|
||||
Node struct {
|
||||
ID string `json:"id"`
|
||||
Title string `json:"title"`
|
||||
DocumentType string `json:"documentType"`
|
||||
Status string `json:"status"`
|
||||
Major int `json:"major"`
|
||||
Minor int `json:"minor"`
|
||||
Content string `json:"content"`
|
||||
} `json:"node"`
|
||||
} `json:"documentVersionEdge"`
|
||||
} `json:"publishTransferImpactAssessmentList"`
|
||||
}
|
||||
|
||||
err := owner.Execute(
|
||||
query,
|
||||
map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": owner.GetOrganizationID(),
|
||||
},
|
||||
},
|
||||
&result,
|
||||
)
|
||||
require.NoError(t, err)
|
||||
|
||||
doc := result.PublishTransferImpactAssessmentList.DocumentEdge.Node
|
||||
assert.NotEmpty(t, doc.ID)
|
||||
assert.Equal(t, "GENERATED", doc.WriteMode)
|
||||
assert.Equal(t, "ACTIVE", doc.Status)
|
||||
|
||||
ver := result.PublishTransferImpactAssessmentList.DocumentVersionEdge.Node
|
||||
assert.NotEmpty(t, ver.ID)
|
||||
assert.Equal(t, "REGISTER", ver.DocumentType)
|
||||
assert.Equal(t, "PUBLISHED", ver.Status)
|
||||
assert.Equal(t, 1, ver.Major)
|
||||
assert.Equal(t, 0, ver.Minor)
|
||||
assert.Contains(t, ver.Content, "EU to US transfer")
|
||||
},
|
||||
)
|
||||
|
||||
t.Run(
|
||||
"publish with approvers creates draft pending approval",
|
||||
func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
owner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
paID := factory.NewProcessingActivity(owner).
|
||||
WithName("TIA Approval PA").
|
||||
WithLawfulBasis("CONSENT").
|
||||
Create()
|
||||
createTIAForPublish(t, owner, paID, "TIA Approval")
|
||||
|
||||
const query = `
|
||||
mutation($input: PublishTransferImpactAssessmentListInput!) {
|
||||
publishTransferImpactAssessmentList(input: $input) {
|
||||
documentVersionEdge {
|
||||
node {
|
||||
status
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var result struct {
|
||||
PublishTransferImpactAssessmentList struct {
|
||||
DocumentVersionEdge struct {
|
||||
Node struct {
|
||||
Status string `json:"status"`
|
||||
} `json:"node"`
|
||||
} `json:"documentVersionEdge"`
|
||||
} `json:"publishTransferImpactAssessmentList"`
|
||||
}
|
||||
|
||||
err := owner.Execute(
|
||||
query,
|
||||
map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": owner.GetOrganizationID(),
|
||||
"approverIds": []string{owner.GetProfileID().String()},
|
||||
},
|
||||
},
|
||||
&result,
|
||||
)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(
|
||||
t,
|
||||
"PENDING_APPROVAL",
|
||||
result.PublishTransferImpactAssessmentList.DocumentVersionEdge.Node.Status,
|
||||
)
|
||||
},
|
||||
)
|
||||
|
||||
t.Run(
|
||||
"document linked back to organization via transferImpactAssessmentsDocument",
|
||||
func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
owner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
paID := factory.NewProcessingActivity(owner).
|
||||
WithName("TIA Link PA").
|
||||
WithLawfulBasis("CONSENT").
|
||||
Create()
|
||||
createTIAForPublish(t, owner, paID, "TIA Link")
|
||||
|
||||
const publishQuery = `
|
||||
mutation($input: PublishTransferImpactAssessmentListInput!) {
|
||||
publishTransferImpactAssessmentList(input: $input) {
|
||||
documentEdge { node { id } }
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var publishResult struct {
|
||||
PublishTransferImpactAssessmentList struct {
|
||||
DocumentEdge struct {
|
||||
Node struct {
|
||||
ID string `json:"id"`
|
||||
} `json:"node"`
|
||||
} `json:"documentEdge"`
|
||||
} `json:"publishTransferImpactAssessmentList"`
|
||||
}
|
||||
|
||||
err := owner.Execute(
|
||||
publishQuery,
|
||||
map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": owner.GetOrganizationID(),
|
||||
},
|
||||
},
|
||||
&publishResult,
|
||||
)
|
||||
require.NoError(t, err)
|
||||
|
||||
docID := publishResult.PublishTransferImpactAssessmentList.DocumentEdge.Node.ID
|
||||
|
||||
const orgQuery = `
|
||||
query($id: ID!) {
|
||||
node(id: $id) {
|
||||
... on Organization {
|
||||
transferImpactAssessmentsDocument { id }
|
||||
}
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var orgResult struct {
|
||||
Node struct {
|
||||
TransferImpactAssessmentsDocument *struct {
|
||||
ID string `json:"id"`
|
||||
} `json:"transferImpactAssessmentsDocument"`
|
||||
} `json:"node"`
|
||||
}
|
||||
|
||||
err = owner.Execute(
|
||||
orgQuery,
|
||||
map[string]any{"id": owner.GetOrganizationID()},
|
||||
&orgResult,
|
||||
)
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, orgResult.Node.TransferImpactAssessmentsDocument)
|
||||
assert.Equal(t, docID, orgResult.Node.TransferImpactAssessmentsDocument.ID)
|
||||
},
|
||||
)
|
||||
}
|
||||
|
||||
func TestTransferImpactAssessment_PublishList_RBAC(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
owner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
viewer := testutil.NewClientInOrg(t, testutil.RoleViewer, owner)
|
||||
|
||||
paID := factory.NewProcessingActivity(owner).
|
||||
WithName("TIA RBAC PA").
|
||||
WithLawfulBasis("CONSENT").
|
||||
Create()
|
||||
createTIAForPublish(t, owner, paID, "TIA RBAC")
|
||||
|
||||
const query = `
|
||||
mutation($input: PublishTransferImpactAssessmentListInput!) {
|
||||
publishTransferImpactAssessmentList(input: $input) {
|
||||
documentEdge { node { id } }
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
t.Run("viewer cannot publish TIA list", func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
err := viewer.ExecuteShouldFail(
|
||||
query,
|
||||
map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": owner.GetOrganizationID(),
|
||||
},
|
||||
},
|
||||
)
|
||||
testutil.RequireForbiddenError(t, err)
|
||||
})
|
||||
}
|
||||
|
||||
func createTIAForPublish(t *testing.T, client *testutil.Client, processingActivityID string, transfer string) string {
|
||||
t.Helper()
|
||||
|
||||
const query = `
|
||||
mutation($input: CreateTransferImpactAssessmentInput!) {
|
||||
createTransferImpactAssessment(input: $input) {
|
||||
transferImpactAssessment { id }
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var result struct {
|
||||
CreateTransferImpactAssessment struct {
|
||||
TransferImpactAssessment struct {
|
||||
ID string `json:"id"`
|
||||
} `json:"transferImpactAssessment"`
|
||||
} `json:"createTransferImpactAssessment"`
|
||||
}
|
||||
|
||||
err := client.Execute(query, map[string]any{
|
||||
"input": map[string]any{
|
||||
"processingActivityId": processingActivityID,
|
||||
"transfer": transfer,
|
||||
},
|
||||
}, &result)
|
||||
require.NoError(t, err)
|
||||
|
||||
return result.CreateTransferImpactAssessment.TransferImpactAssessment.ID
|
||||
}
|
||||
Reference in New Issue
Block a user