rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Create access at login time

Browse Source 
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
This commit is contained in:
Bryan Frimin
2026-02-20 15:06:36 +01:00
parent 9ec950d633
commit bb28cbec0b
7 changed files with 145 additions and 105 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
pkg/server/api/trust/v1/v1_resolver.go
View File

@@ -174,7 +174,7 @@ func (r *mutationResolver) SendMagicLink(ctx context.Context, input types.SendMa
// VerifyMagicLink is the resolver for the verifyMagicLink field.
func (r *mutationResolver) VerifyMagicLink(ctx context.Context, input types.VerifyMagicLinkInput) (*types.VerifyMagicLinkPayload, error) {
_, session, err := r.iam.AuthService.OpenSessionWithMagicLink(ctx, input.Token)
identity, session, err := r.iam.AuthService.OpenSessionWithMagicLink(ctx, input.Token)
if err != nil {
var errInvalidToken *iam.ErrInvalidToken
if errors.As(err, &errInvalidToken) {
@@ -185,6 +185,13 @@ func (r *mutationResolver) VerifyMagicLink(ctx context.Context, input types.Veri
return nil, gqlutils.Internal(ctx)
}
trustCenter := compliancepage.CompliancePageFromContext(ctx)
trustService := r.TrustService(ctx, trustCenter.ID.TenantID())
if _, err := trustService.TrustCenterAccesses.EnsureAccess(ctx, trustCenter.ID, identity.EmailAddress, identity.FullName); err != nil {
r.logger.ErrorCtx(ctx, "cannot ensure trust center access", log.Error(err))
}
w := gqlutils.HTTPResponseWriterFromContext(ctx)
r.sessionCookie.Set(w, session)

141
pkg/trust/trust_center_access_service.go
View File

@@ -60,6 +60,87 @@ func (tcar *TrustCenterAccessRequest) Validate() error {
return v.Error()
}
func (s TrustCenterAccessService) ensureAccessInTx(
ctx context.Context,
tx pg.Conn,
trustCenterID gid.GID,
email mail.Addr,
fullName string,
) (*coredata.TrustCenterAccess, *coredata.TrustCenter, error) {
now := time.Now()
trustCenter := &coredata.TrustCenter{}
if err := trustCenter.LoadByID(ctx, tx, s.svc.scope, trustCenterID); err != nil {
return nil, nil, fmt.Errorf("cannot load trust center: %w", err)
}
existingAccess := &coredata.TrustCenterAccess{}
err := existingAccess.LoadByTrustCenterIDAndEmail(ctx, tx, s.svc.scope, trustCenterID, email)
if err == nil {
return existingAccess, trustCenter, nil
}
if !errors.Is(err, coredata.ErrResourceNotFound) {
return nil, nil, fmt.Errorf("cannot load trust center access: %w", err)
}
access := &coredata.TrustCenterAccess{
ID: gid.New(s.svc.scope.GetTenantID(), coredata.TrustCenterAccessEntityType),
OrganizationID: trustCenter.OrganizationID,
TenantID: s.svc.scope.GetTenantID(),
TrustCenterID: trustCenterID,
Email: email,
Name: fullName,
State: coredata.TrustCenterAccessStateActive,
HasAcceptedNonDisclosureAgreement: false,
CreatedAt: now,
UpdatedAt: now,
}
if trustCenter.NonDisclosureAgreementFileID != nil && s.svc.esign != nil {
sig, err := s.svc.esign.CreateSignature(
ctx,
tx,
&esign.CreateSignatureRequest{
OrganizationID: access.OrganizationID,
DocumentType: coredata.ElectronicSignatureDocumentTypeNDA,
FileID: *trustCenter.NonDisclosureAgreementFileID,
SignerEmail: access.Email,
},
)
if err != nil {
return nil, nil, fmt.Errorf("cannot create pending signature: %w", err)
}
access.ElectronicSignatureID = &sig.ID
}
if err := access.Insert(ctx, tx, s.svc.scope); err != nil {
return nil, nil, fmt.Errorf("cannot insert trust center access: %w", err)
}
return access, trustCenter, nil
}
func (s TrustCenterAccessService) EnsureAccess(
ctx context.Context,
trustCenterID gid.GID,
email mail.Addr,
fullName string,
) (*coredata.TrustCenterAccess, error) {
var access *coredata.TrustCenterAccess
err := s.svc.pg.WithTx(
ctx,
func(tx pg.Conn) error {
var err error
access, _, err = s.ensureAccessInTx(ctx, tx, trustCenterID, email, fullName)
return err
},
)
return access, err
}
func (s TrustCenterAccessService) Request(
ctx context.Context,
req *TrustCenterAccessRequest,
@@ -69,20 +150,20 @@ func (s TrustCenterAccessService) Request(
}
var (
now = time.Now()
access *coredata.TrustCenterAccess
trustCenter *coredata.TrustCenter
now = time.Now()
access *coredata.TrustCenterAccess
)
err := s.svc.pg.WithTx(
ctx,
func(tx pg.Conn) error {
trustCenter = &coredata.TrustCenter{}
if err := trustCenter.LoadByID(ctx, tx, s.svc.scope, req.TrustCenterID); err != nil {
return fmt.Errorf("cannot load trust center: %w", err)
}
var trustCenter *coredata.TrustCenter
var err error
// TODO: load document to ensure they are requestable
access, trustCenter, err = s.ensureAccessInTx(ctx, tx, req.TrustCenterID, req.Email, req.FullName)
if err != nil {
return err
}
organizationID := trustCenter.OrganizationID
@@ -132,50 +213,6 @@ func (s TrustCenterAccessService) Request(
}
}
existingAccess := &coredata.TrustCenterAccess{}
err := existingAccess.LoadByTrustCenterIDAndEmail(ctx, tx, s.svc.scope, req.TrustCenterID, req.Email)
if err == nil {
access = existingAccess
} else {
if !errors.Is(err, coredata.ErrResourceNotFound) {
return fmt.Errorf("cannot load trust center access: %w", err)
}
access = &coredata.TrustCenterAccess{
ID: gid.New(s.svc.scope.GetTenantID(), coredata.TrustCenterAccessEntityType),
OrganizationID: organizationID,
TenantID: s.svc.scope.GetTenantID(),
TrustCenterID: req.TrustCenterID,
Email: req.Email,
Name: req.FullName,
State: coredata.TrustCenterAccessStateActive,
HasAcceptedNonDisclosureAgreement: false,
CreatedAt: now,
UpdatedAt: now,
}
if trustCenter.NonDisclosureAgreementFileID != nil && s.svc.esign != nil {
sig, err := s.svc.esign.CreateSignature(
ctx,
tx,
&esign.CreateSignatureRequest{
OrganizationID: access.OrganizationID,
DocumentType: coredata.ElectronicSignatureDocumentTypeNDA,
FileID: *trustCenter.NonDisclosureAgreementFileID,
SignerEmail: access.Email,
},
)
if err != nil {
return fmt.Errorf("cannot create pending signature: %w", err)
}
access.ElectronicSignatureID = &sig.ID
}
if err := access.Insert(ctx, tx, s.svc.scope); err != nil {
return fmt.Errorf("cannot insert trust center access: %w", err)
}
}
var existingAccesses coredata.TrustCenterDocumentAccesses
if err := existingAccesses.LoadAllByTrustCenterAccessID(ctx, tx, s.svc.scope, access.ID); err != nil {
return fmt.Errorf("cannot load existing access records: %w", err)