diff --git a/pkg/coredata/entity_type_reg.go b/pkg/coredata/entity_type_reg.go index 0c6346ac0..e1c16f818 100644 --- a/pkg/coredata/entity_type_reg.go +++ b/pkg/coredata/entity_type_reg.go @@ -177,6 +177,10 @@ func NewEntityFromID(id gid.GID) (any, bool) { return &TransferImpactAssessment{ID: id}, true case RightsRequestEntityType: return &RightsRequest{ID: id}, true + case StateOfApplicabilityEntityType: + return &StateOfApplicability{ID: id}, true + case StateOfApplicabilityControlEntityType: + return &StateOfApplicabilityControl{ID: id}, true case MembershipProfileEntityType: return &MembershipProfile{ID: id}, true case SCIMConfigurationEntityType: @@ -187,239 +191,3 @@ func NewEntityFromID(id gid.GID) (any, bool) { return nil, false } } - -type EntityInfo struct { - Model string - Table string -} - -var entityRegistry = map[uint16]EntityInfo{ - OrganizationEntityType: { - Model: "Organization", - Table: "organizations", - }, - FrameworkEntityType: { - Model: "Framework", - Table: "frameworks", - }, - MeasureEntityType: { - Model: "Measure", - Table: "measures", - }, - TaskEntityType: { - Model: "Task", - Table: "tasks", - }, - EvidenceEntityType: { - Model: "Evidence", - Table: "evidences", - }, - ConnectorEntityType: { - Model: "Connector", - Table: "connectors", - }, - VendorRiskAssessmentEntityType: { - Model: "VendorRiskAssessment", - Table: "vendor_risk_assessments", - }, - VendorEntityType: { - Model: "Vendor", - Table: "vendors", - }, - PeopleEntityType: { - Model: "People", - Table: "peoples", - }, - VendorComplianceReportEntityType: { - Model: "VendorComplianceReport", - Table: "vendor_compliance_reports", - }, - DocumentEntityType: { - Model: "Document", - Table: "documents", - }, - IdentityEntityType: { - Model: "Identity", - Table: "identities", - }, - SessionEntityType: { - Model: "Session", - Table: "iam_sessions", - }, - EmailEntityType: { - Model: "Email", - Table: "emails", - }, - ControlEntityType: { - Model: "Control", - Table: "controls", - }, - RiskEntityType: { - Model: "Risk", - Table: "risks", - }, - DocumentVersionEntityType: { - Model: "DocumentVersion", - Table: "document_versions", - }, - DocumentVersionSignatureEntityType: { - Model: "DocumentVersionSignature", - Table: "document_version_signatures", - }, - AssetEntityType: { - Model: "Asset", - Table: "assets", - }, - DatumEntityType: { - Model: "Datum", - Table: "data", - }, - AuditEntityType: { - Model: "Audit", - Table: "audits", - }, - ReportEntityType: { - Model: "Report", - Table: "reports", - }, - TrustCenterEntityType: { - Model: "TrustCenter", - Table: "trust_centers", - }, - TrustCenterAccessEntityType: { - Model: "TrustCenterAccess", - Table: "trust_center_accesses", - }, - VendorBusinessAssociateAgreementEntityType: { - Model: "VendorBusinessAssociateAgreement", - Table: "vendor_business_associate_agreements", - }, - FileEntityType: { - Model: "File", - Table: "files", - }, - VendorContactEntityType: { - Model: "VendorContact", - Table: "vendor_contacts", - }, - VendorDataPrivacyAgreementEntityType: { - Model: "VendorDataPrivacyAgreement", - Table: "vendor_data_privacy_agreements", - }, - NonconformityEntityType: { - Model: "Nonconformity", - Table: "nonconformities", - }, - ObligationEntityType: { - Model: "Obligation", - Table: "obligations", - }, - VendorServiceEntityType: { - Model: "VendorService", - Table: "vendor_services", - }, - SnapshotEntityType: { - Model: "Snapshot", - Table: "snapshots", - }, - ContinualImprovementEntityType: { - Model: "ContinualImprovement", - Table: "continual_improvements", - }, - ProcessingActivityEntityType: { - Model: "ProcessingActivity", - Table: "processing_activities", - }, - ExportJobEntityType: { - Model: "ExportJob", - Table: "export_jobs", - }, - TrustCenterReferenceEntityType: { - Model: "TrustCenterReference", - Table: "trust_center_references", - }, - TrustCenterDocumentAccessEntityType: { - Model: "TrustCenterDocumentAccess", - Table: "trust_center_document_accesses", - }, - CustomDomainEntityType: { - Model: "CustomDomain", - Table: "custom_domains", - }, - InvitationEntityType: { - Model: "Invitation", - Table: "iam_invitations", - }, - MembershipEntityType: { - Model: "Membership", - Table: "iam_memberships", - }, - SlackMessageEntityType: { - Model: "SlackMessage", - Table: "slack_messages", - }, - TrustCenterFileEntityType: { - Model: "TrustCenterFile", - Table: "trust_center_files", - }, - SAMLConfigurationEntityType: { - Model: "SAMLConfiguration", - Table: "iam_saml_configurations", - }, - PersonalAPIKeyEntityType: { - Model: "PersonalAPIKey", - Table: "iam_personal_api_keys", - }, - MeetingEntityType: { - Model: "Meeting", - Table: "meetings", - }, - DataProtectionImpactAssessmentEntityType: { - Model: "DataProtectionImpactAssessment", - Table: "processing_activity_data_protection_impact_assessments", - }, - TransferImpactAssessmentEntityType: { - Model: "TransferImpactAssessment", - Table: "processing_activity_transfer_impact_assessments", - }, - RightsRequestEntityType: { - Model: "RightsRequest", - Table: "rights_requests", - }, - StateOfApplicabilityEntityType: { - Model: "StateOfApplicability", - Table: "states_of_applicability", - }, - StateOfApplicabilityControlEntityType: { - Model: "StateOfApplicabilityControl", - Table: "states_of_applicability_controls", - }, - MembershipProfileEntityType: { - Model: "MembershipProfile", - Table: "iam_membership_profiles", - }, - SCIMConfigurationEntityType: { - Model: "SCIMConfiguration", - Table: "iam_scim_configurations", - }, - SCIMEventEntityType: { - Model: "SCIMEvent", - Table: "iam_scim_events", - }, -} - -func EntityTable(entityType uint16) (string, bool) { - info, ok := entityRegistry[entityType] - if !ok { - return "", false - } - return info.Table, true -} - -func EntityModel(entityType uint16) (string, bool) { - info, ok := entityRegistry[entityType] - if !ok { - return "", false - } - return info.Model, true -} diff --git a/pkg/coredata/membership.go b/pkg/coredata/membership.go index 4d1d6a79d..79b36d2d8 100644 --- a/pkg/coredata/membership.go +++ b/pkg/coredata/membership.go @@ -269,64 +269,6 @@ LIMIT 1; }, nil } -func LoadRoleByIdentityAndEntityIDOnly( - ctx context.Context, - conn pg.Conn, - scope Scoper, - identityID gid.GID, - entityID gid.GID, -) (MembershipRole, error) { - entityType := entityID.EntityType() - - if entityType == OrganizationEntityType { - query := ` -SELECT role -FROM iam_memberships -WHERE - identity_id = $1 - AND tenant_id = $2 - AND organization_id = $3 -LIMIT 1; -` - var role MembershipRole - err := conn.QueryRow(ctx, query, identityID, scope.GetTenantID(), entityID).Scan(&role) - if err != nil { - if errors.Is(err, pgx.ErrNoRows) { - return "", ErrResourceNotFound - } - return "", fmt.Errorf("cannot query role: %w", err) - } - return role, nil - } - - tableName, ok := EntityTable(entityType) - if !ok { - return "", fmt.Errorf("unsupported entity type for role lookup: %d", entityType) - } - - query := ` -SELECT m.role -FROM iam_memberships m -WHERE - m.identity_id = $1 - AND tenant_id = $2 - AND m.organization_id = (SELECT organization_id FROM ` + tableName + ` WHERE id = $3) -LIMIT 1; -` - - var role MembershipRole - err := conn.QueryRow(ctx, query, identityID, scope.GetTenantID(), entityID).Scan(&role) - if err != nil { - if errors.Is(err, pgx.ErrNoRows) { - return "", ErrResourceNotFound - } - - return "", fmt.Errorf("cannot query role: %w", err) - } - - return role, nil -} - func (m *Membership) LoadByIdentityAndOrg( ctx context.Context, conn pg.Conn, diff --git a/pkg/coredata/state_of_applicability.go b/pkg/coredata/state_of_applicability.go index 25ae20ef6..af722b662 100644 --- a/pkg/coredata/state_of_applicability.go +++ b/pkg/coredata/state_of_applicability.go @@ -54,6 +54,20 @@ func (s StateOfApplicability) CursorKey(orderBy StateOfApplicabilityOrderField) panic(fmt.Sprintf("unsupported order by: %s", orderBy)) } +func (s *StateOfApplicability) AuthorizationAttributes(ctx context.Context, conn pg.Conn) (map[string]string, error) { + q := `SELECT organization_id FROM states_of_applicability WHERE id = $1 LIMIT 1;` + + var organizationID gid.GID + if err := conn.QueryRow(ctx, q, s.ID).Scan(&organizationID); err != nil { + if errors.Is(err, pgx.ErrNoRows) { + return nil, ErrResourceNotFound + } + return nil, fmt.Errorf("cannot query state of applicability authorization attributes: %w", err) + } + + return map[string]string{"organization_id": organizationID.String()}, nil +} + func (s *StateOfApplicability) LoadByID( ctx context.Context, conn pg.Conn, diff --git a/pkg/coredata/state_of_applicability_control.go b/pkg/coredata/state_of_applicability_control.go index df7ad8b22..b6c2bcc0e 100644 --- a/pkg/coredata/state_of_applicability_control.go +++ b/pkg/coredata/state_of_applicability_control.go @@ -60,26 +60,8 @@ type ( } AvailableStateOfApplicabilityControls []*AvailableStateOfApplicabilityControl - - ErrStateOfApplicabilityControlNotFound struct { - StateOfApplicabilityID gid.GID - ControlID gid.GID - } - - ErrStateOfApplicabilityControlAlreadyExists struct { - StateOfApplicabilityID gid.GID - ControlID gid.GID - } ) -func (e ErrStateOfApplicabilityControlNotFound) Error() string { - return fmt.Sprintf("state of applicability control not found: state_of_applicability_id=%s, control_id=%s", e.StateOfApplicabilityID, e.ControlID) -} - -func (e ErrStateOfApplicabilityControlAlreadyExists) Error() string { - return fmt.Sprintf("state of applicability control already exists: state_of_applicability_id=%s, control_id=%s", e.StateOfApplicabilityID, e.ControlID) -} - func (s StateOfApplicabilityControl) CursorKey(orderBy StateOfApplicabilityOrderField) page.CursorKey { switch orderBy { case StateOfApplicabilityOrderFieldName: @@ -91,6 +73,20 @@ func (s StateOfApplicabilityControl) CursorKey(orderBy StateOfApplicabilityOrder panic(fmt.Sprintf("unsupported order by: %s", orderBy)) } +func (s *StateOfApplicabilityControl) AuthorizationAttributes(ctx context.Context, conn pg.Conn) (map[string]string, error) { + q := `SELECT organization_id FROM states_of_applicability_controls WHERE id = $1 LIMIT 1;` + + var organizationID gid.GID + if err := conn.QueryRow(ctx, q, s.ID).Scan(&organizationID); err != nil { + if errors.Is(err, pgx.ErrNoRows) { + return nil, ErrResourceNotFound + } + return nil, fmt.Errorf("cannot query state of applicability control authorization attributes: %w", err) + } + + return map[string]string{"organization_id": organizationID.String()}, nil +} + func (sac *StateOfApplicabilityControl) LoadByStateOfApplicabilityIDAndControlID( ctx context.Context, conn pg.Conn, @@ -140,10 +136,7 @@ LIMIT 1; control, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[StateOfApplicabilityControl]) if err != nil { if errors.Is(err, pgx.ErrNoRows) { - return &ErrStateOfApplicabilityControlNotFound{ - StateOfApplicabilityID: stateOfApplicabilityID, - ControlID: controlID, - } + return ErrResourceNotFound } return fmt.Errorf("cannot collect state of applicability control: %w", err) } @@ -203,10 +196,7 @@ VALUES ( var pgErr *pgconn.PgError if errors.As(err, &pgErr) { if pgErr.Code == "23505" { - return &ErrStateOfApplicabilityControlAlreadyExists{ - StateOfApplicabilityID: sac.StateOfApplicabilityID, - ControlID: sac.ControlID, - } + return ErrResourceAlreadyExists } } diff --git a/pkg/iam/errors.go b/pkg/iam/errors.go index ccc1bb135..437876434 100644 --- a/pkg/iam/errors.go +++ b/pkg/iam/errors.go @@ -276,19 +276,6 @@ func (e ErrUnsupportedPrincipalType) Error() string { return fmt.Sprintf("unsupported principal type: %d", e.EntityType) } -type ErrNoPermissionsDefined struct { - EntityModel string - Action Action -} - -func NewNoPermissionsDefinedError(entityModel string, action Action) error { - return &ErrNoPermissionsDefined{EntityModel: entityModel, Action: action} -} - -func (e ErrNoPermissionsDefined) Error() string { - return fmt.Sprintf("no permissions defined for action %s on entity %s", e.Action, e.EntityModel) -} - type ErrSignupDisabled struct{} func NewErrSignupDisabled() error { diff --git a/pkg/iam/permissions.go b/pkg/iam/permissions.go deleted file mode 100644 index 9a6abc3dc..000000000 --- a/pkg/iam/permissions.go +++ /dev/null @@ -1,845 +0,0 @@ -// Copyright (c) 2025 Probo Inc . -// -// Permission to use, copy, modify, and/or distribute this software for any -// purpose with or without fee is hereby granted, provided that the above -// copyright notice and this permission notice appear in all copies. -// -// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH -// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, -// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM -// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR -// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR -// PERFORMANCE OF THIS SOFTWARE. - -// LEGACY PERMISSION SYSTEM - DEPRECATED -// -// This file contains the legacy permission system that maps entity types and actions -// to allowed roles. It is being replaced by a policy-based authorization system. -// -// Migration path: -// - New actions are defined in core_actions.go with namespaced format (e.g., "core:asset:get") -// - New policies are defined in core_policies.go and iam_policies.go -// - The action_mapping.go file provides a bridge between legacy and new actions -// - The Authorizer in authorizer.go evaluates policies using the new system -// -// During the migration period, the MustBeAuthorized function in resolvers will: -// 1. Attempt to map legacy actions to new namespaced actions -// 2. Use the new Authorizer if mapping succeeds -// 3. Fall back to LegacyAccessManagementService for unmapped actions or API key requests -// -// Once migration is complete, this file and access_management_service.go will be removed. -// -// Deprecated: Use Authorizer.Authorize() with new namespaced actions instead. -package iam - -import ( - "slices" - - "go.probo.inc/probo/pkg/coredata" -) - -type ( - Role string -) - -const ( - RoleOwner Role = "OWNER" - RoleAdmin Role = "ADMIN" - RoleEmployee Role = "EMPLOYEE" - RoleViewer Role = "VIEWER" - RoleAuditor Role = "AUDITOR" - RoleFull Role = "FULL" -) - -const ( - ActionGet Action = "get" - - ActionGetAssetType Action = "getAssetType" - ActionGetAssignedTo Action = "getAssignedTo" - ActionGetAuthMethod Action = "getAuthMethod" - ActionGetBusinessAssociateAgreement Action = "getBusinessAssociateAgreement" - ActionGetBusinessOwner Action = "getBusinessOwner" - ActionGetCustomDomain Action = "getCustomDomain" - ActionGetDataPrivacyAgreement Action = "getDataPrivacyAgreement" - ActionGetDataProtectionOfficer Action = "getDataProtectionOfficer" - ActionGetDataProtectionImpactAssessment Action = "getDataProtectionImpactAssessment" - ActionGetTransferImpactAssessment Action = "getTransferImpactAssessment" - ActionGetDocument Action = "getDocument" - ActionGetReport Action = "getReport" - ActionGetFile Action = "getFile" - ActionGetAudit Action = "getAudit" - ActionGetFileUrl Action = "getFileUrl" - ActionGetFramework Action = "getFramework" - ActionGetHorizontalLogoUrl Action = "getHorizontalLogoUrl" - ActionGetLogoUrl Action = "getLogoUrl" - ActionGetMeasure Action = "getMeasure" - ActionGetNdaFileUrl Action = "getNdaFileUrl" - ActionGetOrganization Action = "getOrganization" - ActionGetOwner Action = "getOwner" - ActionGetSecurityOwner Action = "getSecurityOwner" - ActionGetSigned Action = "getSigned" - ActionGetSignableDocument Action = "getSignableDocument" - ActionGetSnapshot Action = "getSnapshot" - ActionGetTask Action = "getTask" - ActionGetTrustCenter Action = "getTrustCenter" - ActionGetTrustCenterFile Action = "getTrustCenterFile" - ActionGetVendor Action = "getVendor" - - ActionActiveCount Action = "activeCount" - ActionAudit Action = "audit" - ActionAvailableDocumentAccesses Action = "availableDocumentAccesses" - ActionDocumentVersion Action = "documentVersion" - ActionDownloadUrl Action = "downloadUrl" - ActionMemberships Action = "memberships" - ActionPendingRequestCount Action = "pendingRequestCount" - ActionPeoples Action = "peoples" - ActionReport Action = "report" - ActionReportUrl Action = "reportUrl" - ActionSignatures Action = "signatures" - ActionSignedBy Action = "signedBy" - ActionSpMetadataUrl Action = "spMetadataUrl" - ActionTestLoginUrl Action = "testLoginUrl" - ActionTotalCount Action = "totalCount" - ActionTrustCenterFile Action = "trustCenterFile" - - ActionListAccesses Action = "listAccesses" - ActionListAssets Action = "listAssets" - ActionListAudits Action = "listAudits" - ActionListComplianceReports Action = "listComplianceReports" - ActionListContacts Action = "listContacts" - ActionListContinualImprovements Action = "listContinualImprovements" - ActionListRightsRequests Action = "listRightsRequests" - ActionListControls Action = "listControls" - ActionListData Action = "listData" - ActionListDocuments Action = "listDocuments" - ActionListEvidences Action = "listEvidences" - ActionListFrameworks Action = "listFrameworks" - ActionListInvitations Action = "listInvitations" - ActionListMeasures Action = "listMeasures" - ActionListMeetings Action = "listMeetings" - ActionListMembers Action = "listMembers" - ActionListNonconformities Action = "listNonconformities" - ActionListStatesOfApplicability Action = "listStatesOfApplicability" - ActionListObligations Action = "listObligations" - ActionListPeople Action = "listPeople" - ActionListProcessingActivities Action = "listProcessingActivities" - ActionListReferences Action = "listReferences" - ActionListRiskAssessments Action = "listRiskAssessments" - ActionListRisks Action = "listRisks" - ActionListSAMLConfigurations Action = "listSAMLConfigurations" - ActionListServices Action = "listServices" - ActionListSlackConnections Action = "listSlackConnections" - ActionListSnapshots Action = "listSnapshots" - ActionListTasks Action = "listTasks" - ActionListTrustCenterFiles Action = "listTrustCenterFiles" - ActionListVendors Action = "listVendors" - ActionListVersions Action = "listVersions" - ActionListSignableDocuments Action = "listSignableDocuments" - ActionListSignableDocumentVersion Action = "listSignableDocumentVersion" - - ActionCreateAsset Action = "createAsset" - ActionCreateAudit Action = "createAudit" - ActionCreateContinualImprovement Action = "createContinualImprovement" - ActionCreateRightsRequest Action = "createRightsRequest" - ActionCreateControl Action = "createControl" - ActionCreateControlAuditMapping Action = "createControlAuditMapping" - ActionCreateControlObligationMapping Action = "createControlObligationMapping" - ActionCreateControlDocumentMapping Action = "createControlDocumentMapping" - ActionCreateControlMeasureMapping Action = "createControlMeasureMapping" - ActionCreateControlSnapshotMapping Action = "createControlSnapshotMapping" - ActionCreateStateOfApplicabilityControlMapping Action = "createStateOfApplicabilityControlMapping" - ActionCreateCustomDomain Action = "createCustomDomain" - ActionCreateDatum Action = "createDatum" - ActionCreateDocument Action = "createDocument" - ActionCreateDraftDocumentVersion Action = "createDraftDocumentVersion" - ActionCreateFramework Action = "createFramework" - ActionCreateMeasure Action = "createMeasure" - ActionCreateMeeting Action = "createMeeting" - ActionCreateNonconformity Action = "createNonconformity" - ActionCreateObligation Action = "createObligation" - ActionCreatePeople Action = "createPeople" - ActionCreateProcessingActivity Action = "createProcessingActivity" - ActionCreateStateOfApplicability Action = "createStateOfApplicability" - ActionCreateDataProtectionImpactAssessment Action = "createDataProtectionImpactAssessment" - ActionCreateTransferImpactAssessment Action = "createTransferImpactAssessment" - ActionCreateRisk Action = "createRisk" - ActionCreateRiskDocumentMapping Action = "createRiskDocumentMapping" - ActionCreateRiskMeasureMapping Action = "createRiskMeasureMapping" - ActionCreateRiskObligationMapping Action = "createRiskObligationMapping" - ActionCreateSAMLConfiguration Action = "createSAMLConfiguration" - ActionCreateSnapshot Action = "createSnapshot" - ActionCreateTask Action = "createTask" - ActionCreateTrustCenter Action = "createTrustCenter" - ActionCreateTrustCenterAccess Action = "createTrustCenterAccess" - ActionCreateTrustCenterFile Action = "createTrustCenterFile" - ActionCreateTrustCenterReference Action = "createTrustCenterReference" - ActionCreateVendor Action = "createVendor" - ActionCreateVendorContact Action = "createVendorContact" - ActionCreateVendorRiskAssessment Action = "createVendorRiskAssessment" - ActionCreateVendorService Action = "createVendorService" - - ActionUpdateAsset Action = "updateAsset" - ActionUpdateAudit Action = "updateAudit" - ActionUpdateContinualImprovement Action = "updateContinualImprovement" - ActionUpdateRightsRequest Action = "updateRightsRequest" - ActionUpdateControl Action = "updateControl" - ActionUpdateDatum Action = "updateDatum" - ActionUpdateDocument Action = "updateDocument" - ActionUpdateDocumentVersion Action = "updateDocumentVersion" - ActionUpdateFramework Action = "updateFramework" - ActionUpdateMeasure Action = "updateMeasure" - ActionUpdateMeeting Action = "updateMeeting" - ActionUpdateMembership Action = "updateMembership" - ActionUpdateNonconformity Action = "updateNonconformity" - ActionUpdateObligation Action = "updateObligation" - ActionUpdateOrganization Action = "updateOrganization" - ActionUpdatePeople Action = "updatePeople" - ActionUpdateProcessingActivity Action = "updateProcessingActivity" - ActionUpdateStateOfApplicability Action = "updateStateOfApplicability" - ActionUpdateDataProtectionImpactAssessment Action = "updateDataProtectionImpactAssessment" - ActionUpdateTransferImpactAssessment Action = "updateTransferImpactAssessment" - ActionUpdateRisk Action = "updateRisk" - ActionUpdateSAMLConfiguration Action = "updateSAMLConfiguration" - ActionUpdateTask Action = "updateTask" - ActionUpdateTrustCenter Action = "updateTrustCenter" - ActionUpdateTrustCenterAccess Action = "updateTrustCenterAccess" - ActionUpdateTrustCenterFile Action = "updateTrustCenterFile" - ActionUpdateTrustCenterReference Action = "updateTrustCenterReference" - ActionUpdateVendor Action = "updateVendor" - ActionUpdateVendorBusinessAssociateAgreement Action = "updateVendorBusinessAssociateAgreement" - ActionUpdateVendorContact Action = "updateVendorContact" - ActionUpdateVendorDataPrivacyAgreement Action = "updateVendorDataPrivacyAgreement" - ActionUpdateVendorService Action = "updateVendorService" - - ActionDeleteAsset Action = "deleteAsset" - ActionDeleteAudit Action = "deleteAudit" - ActionDeleteAuditReport Action = "deleteAuditReport" - ActionDeleteContinualImprovement Action = "deleteContinualImprovement" - ActionDeleteRightsRequest Action = "deleteRightsRequest" - ActionDeleteControl Action = "deleteControl" - ActionDeleteControlAuditMapping Action = "deleteControlAuditMapping" - ActionDeleteControlObligationMapping Action = "deleteControlObligationMapping" - ActionDeleteControlDocumentMapping Action = "deleteControlDocumentMapping" - ActionDeleteControlMeasureMapping Action = "deleteControlMeasureMapping" - ActionDeleteControlSnapshotMapping Action = "deleteControlSnapshotMapping" - ActionDeleteStateOfApplicabilityControlMapping Action = "deleteStateOfApplicabilityControlMapping" - ActionDeleteCustomDomain Action = "deleteCustomDomain" - ActionDeleteDatum Action = "deleteDatum" - ActionDeleteDocument Action = "deleteDocument" - ActionDeleteDraftDocumentVersion Action = "deleteDraftDocumentVersion" - ActionDeleteEvidence Action = "deleteEvidence" - ActionDeleteFramework Action = "deleteFramework" - ActionDeleteInvitation Action = "deleteInvitation" - ActionDeleteMeasure Action = "deleteMeasure" - ActionDeleteMeeting Action = "deleteMeeting" - ActionDeleteNonconformity Action = "deleteNonconformity" - ActionDeleteObligation Action = "deleteObligation" - ActionDeleteOrganization Action = "deleteOrganization" - ActionDeleteOrganizationHorizontalLogo Action = "deleteOrganizationHorizontalLogo" - ActionDeletePeople Action = "deletePeople" - ActionDeleteProcessingActivity Action = "deleteProcessingActivity" - ActionDeleteStateOfApplicability Action = "deleteStateOfApplicability" - ActionDeleteDataProtectionImpactAssessment Action = "deleteDataProtectionImpactAssessment" - ActionDeleteTransferImpactAssessment Action = "deleteTransferImpactAssessment" - ActionDeleteRisk Action = "deleteRisk" - ActionDeleteRiskDocumentMapping Action = "deleteRiskDocumentMapping" - ActionDeleteRiskMeasureMapping Action = "deleteRiskMeasureMapping" - ActionDeleteRiskObligationMapping Action = "deleteRiskObligationMapping" - ActionDeleteSAMLConfiguration Action = "deleteSAMLConfiguration" - ActionDeleteSnapshot Action = "deleteSnapshot" - ActionDeleteTask Action = "deleteTask" - ActionDeleteTrustCenterAccess Action = "deleteTrustCenterAccess" - ActionDeleteTrustCenterFile Action = "deleteTrustCenterFile" - ActionDeleteTrustCenterNDA Action = "deleteTrustCenterNDA" - ActionDeleteTrustCenterReference Action = "deleteTrustCenterReference" - ActionDeleteVendor Action = "deleteVendor" - ActionDeleteVendorBusinessAssociateAgreement Action = "deleteVendorBusinessAssociateAgreement" - ActionDeleteVendorComplianceReport Action = "deleteVendorComplianceReport" - ActionDeleteVendorContact Action = "deleteVendorContact" - ActionDeleteVendorDataPrivacyAgreement Action = "deleteVendorDataPrivacyAgreement" - ActionDeleteVendorService Action = "deleteVendorService" - - ActionAcceptInvitation Action = "acceptInvitation" - ActionAssessVendor Action = "assessVendor" - ActionAssignTask Action = "assignTask" - ActionBulkDeleteDocuments Action = "bulkDeleteDocuments" - ActionBulkExportDocuments Action = "bulkExportDocuments" - ActionBulkPublishDocumentVersions Action = "bulkPublishDocumentVersions" - ActionBulkRequestSignatures Action = "bulkRequestSignatures" - ActionCancelSignatureRequest Action = "cancelSignatureRequest" - ActionSignDocument Action = "signDocument" - ActionConfirmEmail Action = "confirmEmail" - ActionDisableSAML Action = "disableSAML" - ActionEnableSAML Action = "enableSAML" - ActionExportDocumentVersionPDF Action = "exportDocumentVersionPDF" - ActionExportSignableVersionDocumentPDF Action = "exportSignableVersionDocumentPDF" - ActionExportProcessingActivitiesPDF Action = "exportProcessingActivitiesPDF" - ActionExportDataProtectionImpactAssessmentsPDF Action = "exportDataProtectionImpactAssessmentsPDF" - ActionExportTransferImpactAssessmentsPDF Action = "exportTransferImpactAssessmentsPDF" - ActionExportFramework Action = "exportFramework" - ActionGenerateDocumentChangelog Action = "generateDocumentChangelog" - ActionGenerateFrameworkStateOfApplicability Action = "generateFrameworkStateOfApplicability" - ActionImportFramework Action = "importFramework" - ActionImportMeasure Action = "importMeasure" - ActionInitiateDomainVerification Action = "initiateDomainVerification" - ActionInviteUser Action = "inviteUser" - ActionPublishDocumentVersion Action = "publishDocumentVersion" - ActionRemoveMember Action = "removeMember" - ActionRequestSignature Action = "requestSignature" - ActionSendSigningNotifications Action = "sendSigningNotifications" - ActionUnassignTask Action = "unassignTask" - ActionUploadAuditReport Action = "uploadAuditReport" - ActionUploadMeasureEvidence Action = "uploadMeasureEvidence" - ActionUploadTrustCenterNDA Action = "uploadTrustCenterNDA" - ActionUploadVendorBusinessAssociateAgreement Action = "uploadVendorBusinessAssociateAgreement" - ActionUploadVendorComplianceReport Action = "uploadVendorComplianceReport" - ActionUploadVendorDataPrivacyAgreement Action = "uploadVendorDataPrivacyAgreement" - ActionVerifyDomain Action = "verifyDomain" -) - -var ( - AllRoles = []Role{RoleOwner, RoleAdmin, RoleEmployee, RoleViewer, RoleAuditor, RoleFull} - - EditRoles = []Role{RoleOwner, RoleAdmin, RoleFull} - - CoreRoles = []Role{RoleOwner, RoleAdmin, RoleViewer, RoleFull} - NonEmployeeRoles = []Role{RoleOwner, RoleAdmin, RoleViewer, RoleAuditor, RoleFull} - InternalRoles = []Role{RoleOwner, RoleAdmin, RoleViewer, RoleEmployee, RoleFull} -) - -var Permissions = map[uint16]map[Action][]Role{ - coredata.OrganizationEntityType: { - ActionGet: AllRoles, - ActionGetLogoUrl: AllRoles, - - ActionListSignableDocuments: InternalRoles, - - ActionListDocuments: NonEmployeeRoles, - ActionGetHorizontalLogoUrl: NonEmployeeRoles, - ActionPeoples: NonEmployeeRoles, - ActionTotalCount: NonEmployeeRoles, - ActionListFrameworks: NonEmployeeRoles, - ActionListControls: NonEmployeeRoles, - ActionListVendors: NonEmployeeRoles, - ActionListPeople: NonEmployeeRoles, - ActionListMeasures: NonEmployeeRoles, - ActionListRisks: NonEmployeeRoles, - ActionListAssets: NonEmployeeRoles, - ActionListData: NonEmployeeRoles, - ActionListAudits: NonEmployeeRoles, - ActionListNonconformities: NonEmployeeRoles, - ActionListObligations: NonEmployeeRoles, - ActionListContinualImprovements: NonEmployeeRoles, - ActionListRightsRequests: NonEmployeeRoles, - ActionListProcessingActivities: NonEmployeeRoles, - ActionExportProcessingActivitiesPDF: NonEmployeeRoles, - ActionExportDataProtectionImpactAssessmentsPDF: NonEmployeeRoles, - ActionExportTransferImpactAssessmentsPDF: NonEmployeeRoles, - ActionListSnapshots: NonEmployeeRoles, - ActionConfirmEmail: NonEmployeeRoles, - ActionAcceptInvitation: NonEmployeeRoles, - - ActionListTrustCenterFiles: CoreRoles, - ActionGetTrustCenter: CoreRoles, - ActionMemberships: CoreRoles, - ActionListMembers: CoreRoles, - ActionListInvitations: CoreRoles, - ActionListSlackConnections: CoreRoles, - ActionGetCustomDomain: CoreRoles, - ActionListSAMLConfigurations: CoreRoles, - ActionListMeetings: CoreRoles, - ActionListStatesOfApplicability: NonEmployeeRoles, - ActionListTasks: CoreRoles, - - ActionUpdateOrganization: EditRoles, - ActionDeleteOrganizationHorizontalLogo: EditRoles, - ActionCreateTrustCenter: EditRoles, - ActionInviteUser: EditRoles, - ActionUpdateMembership: EditRoles, - ActionCreatePeople: EditRoles, - ActionCreateVendor: EditRoles, - ActionCreateFramework: EditRoles, - ActionImportFramework: EditRoles, - ActionCreateControl: EditRoles, - ActionCreateMeasure: EditRoles, - ActionImportMeasure: EditRoles, - ActionCreateMeeting: EditRoles, - ActionCreateStateOfApplicability: EditRoles, - ActionCreateTask: EditRoles, - ActionCreateRisk: EditRoles, - ActionCreateDocument: EditRoles, - ActionCreateAsset: EditRoles, - ActionCreateDatum: EditRoles, - ActionCreateAudit: EditRoles, - ActionCreateNonconformity: EditRoles, - ActionCreateObligation: EditRoles, - ActionCreateContinualImprovement: EditRoles, - ActionCreateRightsRequest: EditRoles, - ActionCreateProcessingActivity: EditRoles, - ActionCreateSnapshot: EditRoles, - ActionCreateTrustCenterFile: EditRoles, - ActionSendSigningNotifications: EditRoles, - - ActionRemoveMember: {RoleOwner, RoleFull}, - - ActionCreateCustomDomain: {RoleOwner}, - ActionDeleteCustomDomain: {RoleOwner}, - ActionInitiateDomainVerification: {RoleOwner}, - ActionVerifyDomain: {RoleOwner}, - ActionCreateSAMLConfiguration: {RoleOwner}, - ActionDeleteOrganization: {RoleOwner}, - }, - coredata.TrustCenterEntityType: { - ActionGet: CoreRoles, - ActionGetNdaFileUrl: CoreRoles, - ActionGetOrganization: CoreRoles, - ActionListAccesses: CoreRoles, - ActionListReferences: CoreRoles, - - ActionUpdateTrustCenter: EditRoles, - ActionUploadTrustCenterNDA: EditRoles, - ActionDeleteTrustCenterNDA: EditRoles, - ActionCreateTrustCenterAccess: EditRoles, - ActionCreateTrustCenterReference: EditRoles, - }, - coredata.TrustCenterAccessEntityType: { - ActionGet: CoreRoles, - ActionActiveCount: CoreRoles, - ActionPendingRequestCount: CoreRoles, - ActionAvailableDocumentAccesses: CoreRoles, - ActionGetTrustCenterFile: CoreRoles, - ActionGetReport: CoreRoles, - - ActionUpdateTrustCenterAccess: EditRoles, - ActionDeleteTrustCenterAccess: EditRoles, - }, - coredata.TrustCenterReferenceEntityType: { - ActionGet: CoreRoles, - ActionGetLogoUrl: CoreRoles, - - ActionUpdateTrustCenterReference: EditRoles, - ActionDeleteTrustCenterReference: EditRoles, - }, - coredata.TrustCenterFileEntityType: { - ActionGet: CoreRoles, - ActionGetFileUrl: CoreRoles, - - ActionUpdateTrustCenterFile: EditRoles, - ActionGetTrustCenterFile: EditRoles, - ActionDeleteTrustCenterFile: EditRoles, - }, - coredata.IdentityEntityType: { - ActionGet: NonEmployeeRoles, - }, - coredata.MembershipEntityType: { - ActionGet: NonEmployeeRoles, - ActionGetAuthMethod: NonEmployeeRoles, - }, - coredata.InvitationEntityType: { - ActionGet: NonEmployeeRoles, - ActionGetOrganization: NonEmployeeRoles, - - ActionDeleteInvitation: EditRoles, - }, - coredata.PeopleEntityType: { - ActionGet: NonEmployeeRoles, - - ActionUpdatePeople: EditRoles, - ActionDeletePeople: EditRoles, - }, - coredata.VendorEntityType: { - ActionGet: NonEmployeeRoles, - ActionGetOrganization: NonEmployeeRoles, - ActionListComplianceReports: NonEmployeeRoles, - ActionGetBusinessAssociateAgreement: NonEmployeeRoles, - ActionGetDataPrivacyAgreement: NonEmployeeRoles, - ActionListContacts: NonEmployeeRoles, - ActionListServices: NonEmployeeRoles, - ActionListRiskAssessments: NonEmployeeRoles, - ActionGetBusinessOwner: NonEmployeeRoles, - ActionGetSecurityOwner: NonEmployeeRoles, - - ActionUpdateVendor: EditRoles, - ActionDeleteVendor: EditRoles, - ActionCreateVendorContact: EditRoles, - ActionCreateVendorService: EditRoles, - ActionUploadVendorComplianceReport: EditRoles, - ActionUploadVendorBusinessAssociateAgreement: EditRoles, - ActionDeleteVendorBusinessAssociateAgreement: EditRoles, - ActionUploadVendorDataPrivacyAgreement: EditRoles, - ActionCreateVendorRiskAssessment: EditRoles, - ActionAssessVendor: EditRoles, - }, - coredata.VendorComplianceReportEntityType: { - ActionGet: NonEmployeeRoles, - ActionGetVendor: NonEmployeeRoles, - ActionGetFile: NonEmployeeRoles, - - ActionDeleteVendorComplianceReport: EditRoles, - }, - coredata.VendorBusinessAssociateAgreementEntityType: { - ActionGet: NonEmployeeRoles, - ActionGetVendor: NonEmployeeRoles, - ActionGetFileUrl: NonEmployeeRoles, - - ActionUpdateVendorBusinessAssociateAgreement: EditRoles, - ActionDeleteVendorBusinessAssociateAgreement: EditRoles, - }, - coredata.VendorContactEntityType: { - ActionGet: NonEmployeeRoles, - ActionGetVendor: NonEmployeeRoles, - - ActionUpdateVendorContact: EditRoles, - ActionDeleteVendorContact: EditRoles, - }, - coredata.VendorServiceEntityType: { - ActionGet: NonEmployeeRoles, - ActionGetVendor: NonEmployeeRoles, - - ActionUpdateVendorService: EditRoles, - ActionDeleteVendorService: EditRoles, - }, - coredata.VendorDataPrivacyAgreementEntityType: { - ActionGet: NonEmployeeRoles, - ActionGetVendor: NonEmployeeRoles, - ActionGetFileUrl: NonEmployeeRoles, - - ActionUpdateVendorDataPrivacyAgreement: EditRoles, - ActionDeleteVendorDataPrivacyAgreement: EditRoles, - }, - coredata.VendorRiskAssessmentEntityType: { - ActionGet: NonEmployeeRoles, - ActionGetVendor: NonEmployeeRoles, - }, - coredata.FrameworkEntityType: { - ActionGet: NonEmployeeRoles, - ActionGetOrganization: NonEmployeeRoles, - ActionListControls: NonEmployeeRoles, - ActionGetLogoUrl: NonEmployeeRoles, - - ActionCreateControl: EditRoles, - ActionUpdateFramework: EditRoles, - ActionDeleteFramework: EditRoles, - ActionGenerateFrameworkStateOfApplicability: EditRoles, - ActionExportFramework: EditRoles, - }, - coredata.ControlEntityType: { - ActionGet: NonEmployeeRoles, - ActionGetFramework: NonEmployeeRoles, - ActionListMeasures: NonEmployeeRoles, - ActionListDocuments: NonEmployeeRoles, - ActionListAudits: NonEmployeeRoles, - ActionListObligations: NonEmployeeRoles, - ActionListSnapshots: NonEmployeeRoles, - ActionListStatesOfApplicability: NonEmployeeRoles, - - ActionUpdateControl: EditRoles, - ActionDeleteControl: EditRoles, - ActionCreateControlMeasureMapping: EditRoles, - ActionCreateControlDocumentMapping: EditRoles, - ActionDeleteControlMeasureMapping: EditRoles, - ActionDeleteControlDocumentMapping: EditRoles, - ActionCreateControlAuditMapping: EditRoles, - ActionDeleteControlAuditMapping: EditRoles, - ActionCreateControlObligationMapping: EditRoles, - ActionDeleteControlObligationMapping: EditRoles, - ActionCreateControlSnapshotMapping: EditRoles, - ActionCreateStateOfApplicabilityControlMapping: EditRoles, - ActionDeleteStateOfApplicabilityControlMapping: EditRoles, - ActionDeleteControlSnapshotMapping: EditRoles, - }, - coredata.StateOfApplicabilityControlEntityType: { - ActionDeleteStateOfApplicabilityControlMapping: EditRoles, - }, - coredata.MeasureEntityType: { - ActionListTasks: CoreRoles, - - ActionGet: NonEmployeeRoles, - ActionListEvidences: NonEmployeeRoles, - ActionListRisks: NonEmployeeRoles, - ActionListControls: NonEmployeeRoles, - ActionTotalCount: NonEmployeeRoles, - - ActionUpdateMeasure: EditRoles, - ActionDeleteMeasure: EditRoles, - ActionUploadMeasureEvidence: EditRoles, - }, - coredata.TaskEntityType: { - ActionGet: CoreRoles, - ActionGetAssignedTo: CoreRoles, - ActionGetOrganization: CoreRoles, - ActionGetMeasure: CoreRoles, - ActionListEvidences: CoreRoles, - - ActionUpdateTask: EditRoles, - ActionDeleteTask: EditRoles, - ActionAssignTask: EditRoles, - ActionUnassignTask: EditRoles, - }, - coredata.EvidenceEntityType: { - ActionGet: NonEmployeeRoles, - ActionGetFile: NonEmployeeRoles, - ActionGetTask: CoreRoles, - ActionGetMeasure: NonEmployeeRoles, - - ActionDeleteEvidence: EditRoles, - }, - coredata.DocumentEntityType: { - ActionListSignableDocumentVersion: AllRoles, - ActionGetSigned: AllRoles, - - ActionGetSignableDocument: InternalRoles, - - ActionGet: NonEmployeeRoles, - ActionGetOwner: NonEmployeeRoles, - ActionGetOrganization: NonEmployeeRoles, - ActionBulkExportDocuments: NonEmployeeRoles, - ActionTotalCount: NonEmployeeRoles, - ActionListControls: NonEmployeeRoles, - ActionListVersions: NonEmployeeRoles, - - ActionUpdateDocument: EditRoles, - ActionDeleteDocument: EditRoles, - ActionPublishDocumentVersion: EditRoles, - ActionBulkPublishDocumentVersions: EditRoles, - ActionBulkDeleteDocuments: EditRoles, - ActionGenerateDocumentChangelog: EditRoles, - ActionCreateDraftDocumentVersion: EditRoles, - ActionDeleteDraftDocumentVersion: EditRoles, - ActionUpdateDocumentVersion: EditRoles, - ActionRequestSignature: EditRoles, - ActionBulkRequestSignatures: EditRoles, - ActionSendSigningNotifications: EditRoles, - }, - coredata.DocumentVersionEntityType: { - ActionSignDocument: AllRoles, - - ActionExportSignableVersionDocumentPDF: AllRoles, - ActionGetSigned: AllRoles, - - ActionGet: NonEmployeeRoles, - ActionGetFile: NonEmployeeRoles, - ActionGetOwner: NonEmployeeRoles, - ActionGetDocument: NonEmployeeRoles, - ActionSignatures: NonEmployeeRoles, - ActionExportDocumentVersionPDF: NonEmployeeRoles, - - ActionUpdateDocumentVersion: EditRoles, - ActionRequestSignature: EditRoles, - ActionDeleteDraftDocumentVersion: EditRoles, - }, - coredata.DocumentVersionSignatureEntityType: { - ActionGet: NonEmployeeRoles, - ActionDocumentVersion: NonEmployeeRoles, - ActionSignedBy: NonEmployeeRoles, - - ActionCancelSignatureRequest: EditRoles, - }, - coredata.RiskEntityType: { - ActionGet: NonEmployeeRoles, - ActionGetOwner: NonEmployeeRoles, - ActionGetOrganization: NonEmployeeRoles, - ActionTotalCount: NonEmployeeRoles, - ActionListControls: NonEmployeeRoles, - ActionListMeasures: NonEmployeeRoles, - ActionListDocuments: NonEmployeeRoles, - ActionListObligations: NonEmployeeRoles, - - ActionUpdateRisk: EditRoles, - ActionDeleteRisk: EditRoles, - ActionCreateRiskMeasureMapping: EditRoles, - ActionDeleteRiskMeasureMapping: EditRoles, - ActionCreateRiskDocumentMapping: EditRoles, - ActionDeleteRiskDocumentMapping: EditRoles, - ActionCreateRiskObligationMapping: EditRoles, - ActionDeleteRiskObligationMapping: EditRoles, - }, - coredata.AssetEntityType: { - ActionGet: NonEmployeeRoles, - ActionGetOwner: NonEmployeeRoles, - ActionListVendors: NonEmployeeRoles, - ActionGetAssetType: NonEmployeeRoles, - ActionGetOrganization: NonEmployeeRoles, - - ActionUpdateAsset: EditRoles, - ActionDeleteAsset: EditRoles, - }, - coredata.DatumEntityType: { - ActionGet: NonEmployeeRoles, - ActionGetOwner: NonEmployeeRoles, - ActionGetOrganization: NonEmployeeRoles, - ActionListVendors: NonEmployeeRoles, - - ActionUpdateDatum: EditRoles, - ActionDeleteDatum: EditRoles, - }, - coredata.AuditEntityType: { - ActionGet: NonEmployeeRoles, - ActionGetFile: NonEmployeeRoles, - ActionGetFramework: NonEmployeeRoles, - ActionGetOrganization: NonEmployeeRoles, - ActionReport: NonEmployeeRoles, - ActionReportUrl: NonEmployeeRoles, - ActionListControls: NonEmployeeRoles, - - ActionUpdateAudit: EditRoles, - ActionDeleteAudit: EditRoles, - ActionUploadAuditReport: EditRoles, - ActionDeleteAuditReport: EditRoles, - }, - coredata.ReportEntityType: { - ActionGet: NonEmployeeRoles, - ActionGetAudit: NonEmployeeRoles, - ActionGetFile: NonEmployeeRoles, - ActionGetOrganization: NonEmployeeRoles, - ActionGetSnapshot: NonEmployeeRoles, - ActionDownloadUrl: NonEmployeeRoles, - }, - coredata.NonconformityEntityType: { - ActionGet: NonEmployeeRoles, - ActionGetOwner: NonEmployeeRoles, - ActionGetOrganization: NonEmployeeRoles, - ActionAudit: NonEmployeeRoles, - - ActionUpdateNonconformity: EditRoles, - ActionDeleteNonconformity: EditRoles, - }, - coredata.ObligationEntityType: { - ActionGet: NonEmployeeRoles, - ActionGetOrganization: NonEmployeeRoles, - ActionGetOwner: NonEmployeeRoles, - ActionListRisks: NonEmployeeRoles, - - ActionUpdateObligation: EditRoles, - ActionDeleteObligation: EditRoles, - }, - coredata.ContinualImprovementEntityType: { - ActionGet: NonEmployeeRoles, - ActionGetOwner: NonEmployeeRoles, - ActionGetOrganization: NonEmployeeRoles, - - ActionUpdateContinualImprovement: EditRoles, - ActionDeleteContinualImprovement: EditRoles, - }, - coredata.RightsRequestEntityType: { - ActionGet: NonEmployeeRoles, - ActionGetOrganization: NonEmployeeRoles, - ActionListControls: NonEmployeeRoles, - - ActionUpdateRightsRequest: EditRoles, - ActionDeleteRightsRequest: EditRoles, - }, - coredata.ProcessingActivityEntityType: { - ActionGet: NonEmployeeRoles, - ActionGetOrganization: NonEmployeeRoles, - ActionListVendors: NonEmployeeRoles, - ActionGetDataProtectionOfficer: NonEmployeeRoles, - ActionGetDataProtectionImpactAssessment: NonEmployeeRoles, - ActionGetTransferImpactAssessment: NonEmployeeRoles, - ActionExportProcessingActivitiesPDF: NonEmployeeRoles, - - ActionUpdateProcessingActivity: EditRoles, - ActionDeleteProcessingActivity: EditRoles, - ActionCreateDataProtectionImpactAssessment: EditRoles, - ActionCreateTransferImpactAssessment: EditRoles, - }, - coredata.DataProtectionImpactAssessmentEntityType: { - ActionGet: NonEmployeeRoles, - ActionGetOrganization: NonEmployeeRoles, - - ActionCreateDataProtectionImpactAssessment: EditRoles, - ActionUpdateDataProtectionImpactAssessment: EditRoles, - ActionDeleteDataProtectionImpactAssessment: EditRoles, - }, - coredata.TransferImpactAssessmentEntityType: { - ActionGet: NonEmployeeRoles, - ActionGetOrganization: NonEmployeeRoles, - - ActionCreateTransferImpactAssessment: EditRoles, - ActionUpdateTransferImpactAssessment: EditRoles, - ActionDeleteTransferImpactAssessment: EditRoles, - }, - coredata.SnapshotEntityType: { - ActionGet: NonEmployeeRoles, - ActionGetOrganization: NonEmployeeRoles, - ActionListControls: NonEmployeeRoles, - - ActionDeleteSnapshot: EditRoles, - }, - coredata.CustomDomainEntityType: { - ActionGet: {RoleOwner, RoleAdmin}, - - ActionDeleteCustomDomain: {RoleOwner}, - }, - coredata.SAMLConfigurationEntityType: { - ActionGet: {RoleOwner, RoleAdmin}, - ActionSpMetadataUrl: {RoleOwner, RoleAdmin}, - ActionTestLoginUrl: {RoleOwner, RoleAdmin}, - - ActionUpdateSAMLConfiguration: {RoleOwner, RoleAdmin}, - ActionDeleteSAMLConfiguration: {RoleOwner, RoleAdmin}, - ActionEnableSAML: {RoleOwner, RoleAdmin}, - ActionDisableSAML: {RoleOwner, RoleAdmin}, - ActionVerifyDomain: {RoleOwner}, - }, - coredata.FileEntityType: { - ActionGet: NonEmployeeRoles, - ActionDownloadUrl: NonEmployeeRoles, - }, - coredata.TrustCenterDocumentAccessEntityType: { - ActionGet: CoreRoles, - ActionReport: CoreRoles, - ActionTrustCenterFile: CoreRoles, - }, - coredata.MeetingEntityType: { - ActionGet: CoreRoles, - ActionGetOrganization: CoreRoles, - ActionTotalCount: CoreRoles, - - ActionUpdateMeeting: EditRoles, - ActionDeleteMeeting: EditRoles, - }, - coredata.StateOfApplicabilityEntityType: { - ActionGet: NonEmployeeRoles, - ActionGetOrganization: NonEmployeeRoles, - ActionListControls: NonEmployeeRoles, - ActionTotalCount: NonEmployeeRoles, - - ActionUpdateStateOfApplicability: EditRoles, - ActionDeleteStateOfApplicability: EditRoles, - ActionDeleteStateOfApplicabilityControlMapping: EditRoles, - }, -} - -func GetPermissionsForAction(entityType uint16, action Action) []Role { - if entityActions, ok := Permissions[entityType]; ok { - if roles, ok := entityActions[action]; ok { - return roles - } - } - return nil -} - -func GetPermissionsByRole(userRole Role) map[string]map[Action]bool { - permissions := make(map[string]map[Action]bool) - - for entityType, actions := range Permissions { - entityTypeName, ok := coredata.EntityModel(entityType) - if !ok { - continue - } - - if permissions[entityTypeName] == nil { - permissions[entityTypeName] = make(map[Action]bool) - } - - for action, allowedRoles := range actions { - if slices.Contains(allowedRoles, userRole) { - permissions[entityTypeName][action] = true - } - } - } - - return permissions -} diff --git a/pkg/probo/actions.go b/pkg/probo/actions.go index 00207b0ff..48ecb6eb4 100644 --- a/pkg/probo/actions.go +++ b/pkg/probo/actions.go @@ -292,6 +292,7 @@ const ( ActionTransferImpactAssessmentCreate = "core:transfer-impact-assessment:create" ActionTransferImpactAssessmentUpdate = "core:transfer-impact-assessment:update" ActionTransferImpactAssessmentDelete = "core:transfer-impact-assessment:delete" + ActionTransferImpactAssessmentExport = "core:transfer-impact-assessment:export" // TrustCenterDocumentAccess actions ActionTrustCenterDocumentAccessList = "core:trust-center-document-access:list" @@ -300,9 +301,13 @@ const ( ActionDataProtectionOfficerList = "core:data-protection-officer:list" // RightsRequest actions - ActionRightsRequesList = "core:rights-request:list" - ActionRightsRequestGet = "core:rights-request:get" + ActionRightsRequestList = "core:rights-request:list" + ActionRightsRequestGet = "core:rights-request:get" + ActionRightsRequestCreate = "core:rights-request:create" + ActionRightsRequestUpdate = "core:rights-request:update" + ActionRightsRequestDelete = "core:rights-request:delete" + // StateOfApplicability actions ActionStateOfApplicabilityList = "core:state-of-applicability:list" ActionStateOfApplicabilityGet = "core:state-of-applicability:get" ActionStateOfApplicabilityCreate = "core:state-of-applicability:create" diff --git a/pkg/server/api/console/v1/v1_resolver.go b/pkg/server/api/console/v1/v1_resolver.go index b8b3151ad..ca7f76f67 100644 --- a/pkg/server/api/console/v1/v1_resolver.go +++ b/pkg/server/api/console/v1/v1_resolver.go @@ -3789,7 +3789,7 @@ func (r *mutationResolver) ExportProcessingActivitiesPDF(ctx context.Context, in // ExportDataProtectionImpactAssessmentsPDF is the resolver for the exportDataProtectionImpactAssessmentsPDF field. func (r *mutationResolver) ExportDataProtectionImpactAssessmentsPDF(ctx context.Context, input types.ExportDataProtectionImpactAssessmentsPDFInput) (*types.ExportDataProtectionImpactAssessmentsPDFPayload, error) { - r.MustAuthorize(ctx, input.OrganizationID, iam.ActionExportDataProtectionImpactAssessmentsPDF) + r.MustAuthorize(ctx, input.OrganizationID, probo.ActionDataProtectionImpactAssessmentExport) prb := r.ProboService(ctx, input.OrganizationID.TenantID()) @@ -3804,7 +3804,6 @@ func (r *mutationResolver) ExportDataProtectionImpactAssessmentsPDF(ctx context. if errors.Is(err, coredata.ErrResourceNotFound) { return nil, gqlutils.NotFound(err) } - panic(fmt.Errorf("cannot export data protection impact assessments PDF: %w", err)) } @@ -3815,7 +3814,7 @@ func (r *mutationResolver) ExportDataProtectionImpactAssessmentsPDF(ctx context. // ExportTransferImpactAssessmentsPDF is the resolver for the exportTransferImpactAssessmentsPDF field. func (r *mutationResolver) ExportTransferImpactAssessmentsPDF(ctx context.Context, input types.ExportTransferImpactAssessmentsPDFInput) (*types.ExportTransferImpactAssessmentsPDFPayload, error) { - r.MustAuthorize(ctx, input.OrganizationID, iam.ActionExportTransferImpactAssessmentsPDF) + r.MustAuthorize(ctx, input.OrganizationID, probo.ActionTransferImpactAssessmentExport) prb := r.ProboService(ctx, input.OrganizationID.TenantID()) @@ -4378,7 +4377,7 @@ func (r *mutationResolver) DeleteContinualImprovement(ctx context.Context, input // CreateRightsRequest is the resolver for the createRightsRequest field. func (r *mutationResolver) CreateRightsRequest(ctx context.Context, input types.CreateRightsRequestInput) (*types.CreateRightsRequestPayload, error) { - r.MustAuthorize(ctx, input.OrganizationID, iam.ActionCreateRightsRequest) + r.MustAuthorize(ctx, input.OrganizationID, probo.ActionRightsRequestCreate) prb := r.ProboService(ctx, input.OrganizationID.TenantID()) @@ -4405,7 +4404,7 @@ func (r *mutationResolver) CreateRightsRequest(ctx context.Context, input types. // UpdateRightsRequest is the resolver for the updateRightsRequest field. func (r *mutationResolver) UpdateRightsRequest(ctx context.Context, input types.UpdateRightsRequestInput) (*types.UpdateRightsRequestPayload, error) { - r.MustAuthorize(ctx, input.ID, iam.ActionUpdateRightsRequest) + r.MustAuthorize(ctx, input.ID, probo.ActionRightsRequestUpdate) prb := r.ProboService(ctx, input.ID.TenantID()) @@ -4432,7 +4431,7 @@ func (r *mutationResolver) UpdateRightsRequest(ctx context.Context, input types. // DeleteRightsRequest is the resolver for the deleteRightsRequest field. func (r *mutationResolver) DeleteRightsRequest(ctx context.Context, input types.DeleteRightsRequestInput) (*types.DeleteRightsRequestPayload, error) { - r.MustAuthorize(ctx, input.RightsRequestID, iam.ActionDeleteRightsRequest) + r.MustAuthorize(ctx, input.RightsRequestID, probo.ActionRightsRequestDelete) prb := r.ProboService(ctx, input.RightsRequestID.TenantID()) @@ -5521,7 +5520,7 @@ func (r *organizationResolver) ContinualImprovements(ctx context.Context, obj *t // RightsRequests is the resolver for the rightsRequests field. func (r *organizationResolver) RightsRequests(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RightsRequestOrderBy) (*types.RightsRequestConnection, error) { - r.MustAuthorize(ctx, obj.ID, iam.ActionListRightsRequests) + r.MustAuthorize(ctx, obj.ID, probo.ActionRightsRequestList) prb := r.ProboService(ctx, obj.ID.TenantID()) @@ -5849,7 +5848,6 @@ func (r *processingActivityResolver) DataProtectionImpactAssessment(ctx context. if errors.Is(err, coredata.ErrResourceNotFound) { return nil, nil } - panic(fmt.Errorf("cannot get processing activity dpia: %w", err)) } @@ -5867,7 +5865,6 @@ func (r *processingActivityResolver) TransferImpactAssessment(ctx context.Contex if errors.Is(err, coredata.ErrResourceNotFound) { return nil, nil } - panic(fmt.Errorf("cannot get processing activity tia: %w", err)) } @@ -6267,7 +6264,7 @@ func (r *reportResolver) Permission(ctx context.Context, obj *types.Report, acti // Organization is the resolver for the organization field. func (r *rightsRequestResolver) Organization(ctx context.Context, obj *types.RightsRequest) (*types.Organization, error) { - r.MustAuthorize(ctx, obj.ID, iam.ActionGetOrganization) + r.MustAuthorize(ctx, obj.ID, probo.ActionOrganizationGet) prb := r.ProboService(ctx, obj.ID.TenantID()) @@ -6294,7 +6291,7 @@ func (r *rightsRequestResolver) Permission(ctx context.Context, obj *types.Right // TotalCount is the resolver for the totalCount field. func (r *rightsRequestConnectionResolver) TotalCount(ctx context.Context, obj *types.RightsRequestConnection) (int, error) { - r.MustAuthorize(ctx, obj.ParentID, probo.ActionRightsRequesList) + r.MustAuthorize(ctx, obj.ParentID, probo.ActionRightsRequestList) prb := r.ProboService(ctx, obj.ParentID.TenantID())