diff --git a/e2e/console/security_read_gap_test.go b/e2e/console/security_read_gap_test.go index fbc77bf66..9cea1696c 100644 --- a/e2e/console/security_read_gap_test.go +++ b/e2e/console/security_read_gap_test.go @@ -257,6 +257,7 @@ func TestSecurity_ReadGap_ApplicabilityStatementControl(t *testing.T) { got = edge.Node.Control } } + require.Nil(t, got, "must not be able to read a cross-tenant control via applicabilityStatement.control") } } @@ -445,6 +446,7 @@ func TestSecurity_ReadGap_DocumentVersionApprovalDecisionApprover(t *testing.T) ID string `json:"id"` FullName string `json:"fullName"` } + for _, qEdge := range readResult.Node.ApprovalQuorums.Edges { for _, dEdge := range qEdge.Node.Decisions.Edges { if dEdge.Node.ID == decisionID { @@ -452,6 +454,7 @@ func TestSecurity_ReadGap_DocumentVersionApprovalDecisionApprover(t *testing.T) } } } + require.Nil(t, got, "must not be able to read a cross-tenant profile via documentVersionApprovalDecision.approver") } } diff --git a/e2e/console/security_write_gap_test.go b/e2e/console/security_write_gap_test.go index e6a224209..e3dd39b3b 100644 --- a/e2e/console/security_write_gap_test.go +++ b/e2e/console/security_write_gap_test.go @@ -154,6 +154,7 @@ func seedTrustCenterAccess(t *testing.T, owner *testutil.Client, trustCenterID s accessID.String(), tenantID.String(), owner.GetOrganizationID().String(), tcID.String(), owner.GetUserID().String(), factory.SafeEmail(), "Test Access", now, ) + return err }) require.NoError(t, err, "test setup: cannot seed trust_center_accesses row") diff --git a/pkg/probo/trust_center_access_service.go b/pkg/probo/trust_center_access_service.go index 642c4959f..05621f9c3 100644 --- a/pkg/probo/trust_center_access_service.go +++ b/pkg/probo/trust_center_access_service.go @@ -242,6 +242,7 @@ func (s TrustCenterAccessService) Update( if len(req.DocumentAccesses) > 0 { var documentData []coredata.MergeTrustCenterDocumentAccessesData + documentIDs := make([]gid.GID, 0, len(req.DocumentAccesses)) for _, d := range req.DocumentAccesses { documentData = append(documentData, coredata.MergeTrustCenterDocumentAccessesData{ @@ -263,6 +264,7 @@ func (s TrustCenterAccessService) Update( if len(req.ReportAccesses) > 0 { var reportData []coredata.MergeTrustCenterDocumentAccessesData + reportIDs := make([]gid.GID, 0, len(req.ReportAccesses)) for _, d := range req.ReportAccesses { reportData = append(reportData, coredata.MergeTrustCenterDocumentAccessesData{ @@ -284,6 +286,7 @@ func (s TrustCenterAccessService) Update( if len(req.TrustCenterFileAccesses) > 0 { var fileData []coredata.MergeTrustCenterDocumentAccessesData + trustCenterFileIDs := make([]gid.GID, 0, len(req.TrustCenterFileAccesses)) for _, d := range req.TrustCenterFileAccesses { fileData = append(fileData, coredata.MergeTrustCenterDocumentAccessesData{