Enable rbac on node query

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/probo/actions.go

@@ -35,6 +35,7 @@ const (
 	ActionTrustCenterReferenceCreate              = "core:trust-center:create-reference"
 
 	// TrustCenterAccess actions
+	ActionTrustCenterAccessGet    = "core:trust-center-access:get"
 	ActionTrustCenterAccessUpdate = "core:trust-center-access:update"
 	ActionTrustCenterAccessDelete = "core:trust-center-access:delete"
 
@@ -65,16 +66,19 @@ const (
 	ActionVendorAssess = "core:vendor:assess"
 
 	// VendorContact actions
+	ActionVendorContactGet    = "core:vendor-contact:get"
 	ActionVendorContactCreate = "core:vendor-contact:create"
 	ActionVendorContactUpdate = "core:vendor-contact:update"
 	ActionVendorContactDelete = "core:vendor-contact:delete"
 
 	// VendorService actions
+	ActionVendorServiceGet    = "core:vendor-service:get"
 	ActionVendorServiceCreate = "core:vendor-service:create"
 	ActionVendorServiceUpdate = "core:vendor-service:update"
 	ActionVendorServiceDelete = "core:vendor-service:delete"
 
 	// VendorComplianceReport actions
+	ActionVendorComplianceReportGet    = "core:vendor-compliance-report:get"
 	ActionVendorComplianceReportUpload = "core:vendor-compliance-report:upload"
 	ActionVendorComplianceReportDelete = "core:vendor-compliance-report:delete"
 
@@ -243,6 +247,7 @@ const (
 
 	// Meeting actions
 	ActionMeetingList   = "core:meeting:list"
+	ActionMeetingGet    = "core:meeting:get"
 	ActionMeetingCreate = "core:meeting:create"
 	ActionMeetingUpdate = "core:meeting:update"
 	ActionMeetingDelete = "core:meeting:delete"
@@ -263,6 +268,7 @@ const (
 	ActionDataProtectionOfficerList = "core:data-protection-officer:list"
 
 	ActionRightsRequesList = "core:rights-request:list"
+	ActionRightsRequestGet = "core:rights-request:get"
 
 	ActionStateOfApplicabilityList   = "core:state-of-applicability:list"
 	ActionStateOfApplicabilityGet    = "core:state-of-applicability:get"

pkg/server/api/console/v1/v1_resolver.go

@@ -5798,282 +5798,309 @@ func (r *processingActivityConnectionResolver) TotalCount(ctx context.Context, o
 
 // Node is the resolver for the node field.
 func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error) {
-	// TODO use right action
+	var (
-	//r.MustAuthorize(ctx, id, probo.ActionGet)
+		loadNode func(ctx context.Context, id gid.GID) (types.Node, error)
-
+		action   string
-	prb := r.ProboService(ctx, id.TenantID())
+		prb      = r.ProboService(ctx, id.TenantID())
+	)
 
 	switch id.EntityType() {
 	case coredata.OrganizationEntityType:
-		organization, err := prb.Organizations.Get(ctx, id)
+		action = iam.ActionIAMOrganizationGet
-		if err != nil {
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			if errors.Is(err, coredata.ErrResourceAlreadyExists) {
+			organization, err := prb.Organizations.Get(ctx, id)
-				return nil, gqlutils.Conflict(err)
+			if err != nil {
+				return nil, err
 			}
-
+			return types.NewOrganization(organization), nil
-			panic(fmt.Errorf("cannot get organization: %w", err))
 		}
-
-		return types.NewOrganization(organization), nil
 	case coredata.PeopleEntityType:
-		people, err := prb.Peoples.Get(ctx, id)
+		action = probo.ActionPeopleGet
-		if err != nil {
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			if errors.Is(err, coredata.ErrResourceAlreadyExists) {
+			people, err := prb.Peoples.Get(ctx, id)
-				return nil, gqlutils.Conflict(err)
+			if err != nil {
+				return nil, err
 			}
-
+			return types.NewPeople(people), nil
-			panic(fmt.Errorf("cannot get people: %w", err))
 		}
-
-		return types.NewPeople(people), nil
 	case coredata.VendorEntityType:
-		vendor, err := prb.Vendors.Get(ctx, id)
+		action = probo.ActionVendorGet
-		if err != nil {
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			if errors.Is(err, coredata.ErrResourceAlreadyExists) {
+			vendor, err := prb.Vendors.Get(ctx, id)
-				return nil, gqlutils.Conflict(err)
+			if err != nil {
+				return nil, err
 			}
-
+			return types.NewVendor(vendor), nil
-			panic(fmt.Errorf("cannot get vendor: %w", err))
 		}
-
-		return types.NewVendor(vendor), nil
 	case coredata.FrameworkEntityType:
-		framework, err := prb.Frameworks.Get(ctx, id)
+		action = probo.ActionFrameworkGet
-		if err != nil {
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			if errors.Is(err, coredata.ErrResourceAlreadyExists) {
+			framework, err := prb.Frameworks.Get(ctx, id)
-				return nil, gqlutils.Conflict(err)
+			if err != nil {
+				return nil, err
 			}
-
+			return types.NewFramework(framework), nil
-			panic(fmt.Errorf("cannot get framework: %w", err))
 		}
-
-		return types.NewFramework(framework), nil
 	case coredata.MeasureEntityType:
-		measure, err := prb.Measures.Get(ctx, id)
+		action = probo.ActionMeasureGet
-		if err != nil {
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			if errors.Is(err, coredata.ErrResourceAlreadyExists) {
+			measure, err := prb.Measures.Get(ctx, id)
-				return nil, gqlutils.Conflict(err)
+			if err != nil {
+				return nil, err
 			}
-
+			return types.NewMeasure(measure), nil
-			panic(fmt.Errorf("cannot get measure: %w", err))
 		}
-
-		return types.NewMeasure(measure), nil
 	case coredata.TaskEntityType:
-		task, err := prb.Tasks.Get(ctx, id)
+		action = probo.ActionTaskGet
-		if err != nil {
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			if errors.Is(err, coredata.ErrResourceAlreadyExists) {
+			task, err := prb.Tasks.Get(ctx, id)
-				return nil, gqlutils.Conflict(err)
+			if err != nil {
+				return nil, err
 			}
-
+			return types.NewTask(task), nil
-			panic(fmt.Errorf("cannot get task: %w", err))
 		}
-
-		return types.NewTask(task), nil
 	case coredata.EvidenceEntityType:
-		evidence, err := prb.Evidences.Get(ctx, id)
+		action = probo.ActionEvidenceList
-		if err != nil {
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			panic(fmt.Errorf("cannot get evidence: %w", err))
+			evidence, err := prb.Evidences.Get(ctx, id)
+			if err != nil {
+				return nil, err
+			}
+			return types.NewEvidence(evidence), nil
 		}
-
-		return types.NewEvidence(evidence), nil
 	case coredata.DocumentEntityType:
-		document, err := prb.Documents.Get(ctx, id)
+		action = probo.ActionDocumentGet
-		if err != nil {
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			if errors.Is(err, coredata.ErrResourceAlreadyExists) {
+			document, err := prb.Documents.Get(ctx, id)
-				return nil, gqlutils.Conflict(err)
+			if err != nil {
+				return nil, err
 			}
-
+			return types.NewDocument(document), nil
-			panic(fmt.Errorf("cannot get document: %w", err))
 		}
-
-		return types.NewDocument(document), nil
 	case coredata.ControlEntityType:
-		control, err := prb.Controls.Get(ctx, id)
+		action = probo.ActionControlList
-		if err != nil {
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			if errors.Is(err, coredata.ErrResourceAlreadyExists) {
+			control, err := prb.Controls.Get(ctx, id)
-				return nil, gqlutils.Conflict(err)
+			if err != nil {
+				return nil, err
 			}
-
+			return types.NewControl(control), nil
-			panic(fmt.Errorf("cannot get control: %w", err))
 		}
-
-		return types.NewControl(control), nil
 	case coredata.RiskEntityType:
-		risk, err := prb.Risks.Get(ctx, id)
+		action = probo.ActionRiskList
-		if err != nil {
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			if errors.Is(err, coredata.ErrResourceAlreadyExists) {
+			risk, err := prb.Risks.Get(ctx, id)
-				return nil, gqlutils.Conflict(err)
+			if err != nil {
+				return nil, err
 			}
-
+			return types.NewRisk(risk), nil
-			panic(fmt.Errorf("cannot get risk: %w", err))
 		}
-
-		return types.NewRisk(risk), nil
 	case coredata.VendorComplianceReportEntityType:
-		vendorComplianceReport, err := prb.VendorComplianceReports.Get(ctx, id)
+		action = probo.ActionVendorComplianceReportGet
-		if err != nil {
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			panic(fmt.Errorf("cannot get vendor compliance report: %w", err))
+			vendorComplianceReport, err := prb.VendorComplianceReports.Get(ctx, id)
+			if err != nil {
+				return nil, err
+			}
+			return types.NewVendorComplianceReport(vendorComplianceReport), nil
 		}
-		return types.NewVendorComplianceReport(vendorComplianceReport), nil
 	case coredata.VendorContactEntityType:
-		vendorContact, err := prb.VendorContacts.Get(ctx, id)
+		action = probo.ActionVendorContactGet
-		if err != nil {
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			panic(fmt.Errorf("cannot get vendor contact: %w", err))
+			vendorContact, err := prb.VendorContacts.Get(ctx, id)
+			if err != nil {
+				return nil, err
+			}
+			return types.NewVendorContact(vendorContact), nil
 		}
-		return types.NewVendorContact(vendorContact), nil
 	case coredata.VendorServiceEntityType:
-		vendorService, err := prb.VendorServices.Get(ctx, id)
+		action = probo.ActionVendorServiceGet
-		if err != nil {
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			panic(fmt.Errorf("cannot get vendor service: %w", err))
+			vendorService, err := prb.VendorServices.Get(ctx, id)
+			if err != nil {
+				return nil, err
+			}
+			return types.NewVendorService(vendorService), nil
 		}
-		return types.NewVendorService(vendorService), nil
 	case coredata.DocumentVersionEntityType:
-		documentVersion, err := prb.Documents.GetVersion(ctx, id)
+		action = probo.ActionDocumentVersionList
-		if err != nil {
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			panic(fmt.Errorf("cannot get document version: %w", err))
+			documentVersion, err := prb.Documents.GetVersion(ctx, id)
+			if err != nil {
+				return nil, err
+			}
+			return types.NewDocumentVersion(documentVersion), nil
 		}
-		return types.NewDocumentVersion(documentVersion), nil
 	case coredata.DocumentVersionSignatureEntityType:
-		documentVersionSignature, err := prb.Documents.GetVersionSignature(ctx, id)
+		action = probo.ActionDocumentVersionSignatureList
-		if err != nil {
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			panic(fmt.Errorf("cannot get document version signature: %w", err))
+			documentVersionSignature, err := prb.Documents.GetVersionSignature(ctx, id)
+			if err != nil {
+				return nil, err
+			}
+			return types.NewDocumentVersionSignature(documentVersionSignature), nil
 		}
-		return types.NewDocumentVersionSignature(documentVersionSignature), nil
 	case coredata.AssetEntityType:
-		asset, err := prb.Assets.Get(ctx, id)
+		action = probo.ActionAssetList
-		if err != nil {
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			if errors.Is(err, coredata.ErrResourceAlreadyExists) {
+			asset, err := prb.Assets.Get(ctx, id)
-				return nil, gqlutils.Conflict(err)
+			if err != nil {
+				return nil, err
 			}
-
+			return types.NewAsset(asset), nil
-			panic(fmt.Errorf("cannot get asset: %w", err))
 		}
-
-		return types.NewAsset(asset), nil
 	case coredata.DatumEntityType:
-		datum, err := prb.Data.Get(ctx, id)
+		action = probo.ActionDatumList
-		if err != nil {
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			panic(fmt.Errorf("cannot get data: %w", err))
+			datum, err := prb.Data.Get(ctx, id)
+			if err != nil {
+				return nil, err
+			}
+			return types.NewDatum(datum), nil
 		}
-
-		return types.NewDatum(datum), nil
 	case coredata.AuditEntityType:
-		audit, err := prb.Audits.Get(ctx, id)
+		action = probo.ActionAuditList
-		if err != nil {
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			if errors.Is(err, coredata.ErrResourceAlreadyExists) {
+			audit, err := prb.Audits.Get(ctx, id)
-				return nil, gqlutils.Conflict(err)
+			if err != nil {
+				return nil, err
 			}
-
+			return types.NewAudit(audit), nil
-			panic(fmt.Errorf("cannot get audit: %w", err))
 		}
-
-		return types.NewAudit(audit), nil
 	case coredata.NonconformityEntityType:
-		nonconformity, err := prb.Nonconformities.Get(ctx, id)
+		action = probo.ActionNonconformityList
-		if err != nil {
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			panic(fmt.Errorf("cannot get nonconformity: %w", err))
+			nonconformity, err := prb.Nonconformities.Get(ctx, id)
+			if err != nil {
+				return nil, err
+			}
+			return types.NewNonconformity(nonconformity), nil
 		}
-
-		return types.NewNonconformity(nonconformity), nil
 	case coredata.ObligationEntityType:
-		obligation, err := prb.Obligations.Get(ctx, id)
+		action = probo.ActionObligationList
-		if err != nil {
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			panic(fmt.Errorf("cannot get obligation: %w", err))
+			obligation, err := prb.Obligations.Get(ctx, id)
+			if err != nil {
+				return nil, err
+			}
+			return types.NewObligation(obligation), nil
 		}
-
-		return types.NewObligation(obligation), nil
 	case coredata.ContinualImprovementEntityType:
-		continualImprovement, err := prb.ContinualImprovements.Get(ctx, id)
+		action = probo.ActionContinualImprovementList
-		if err != nil {
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			panic(fmt.Errorf("cannot get continual improvement: %w", err))
+			continualImprovement, err := prb.ContinualImprovements.Get(ctx, id)
+			if err != nil {
+				return nil, err
+			}
+			return types.NewContinualImprovement(continualImprovement), nil
 		}
-
-		return types.NewContinualImprovement(continualImprovement), nil
 	case coredata.ReportEntityType:
-		report, err := prb.Reports.Get(ctx, id)
+		action = probo.ActionReportGet
-		if err != nil {
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			panic(fmt.Errorf("cannot get report: %w", err))
+			report, err := prb.Reports.Get(ctx, id)
+			if err != nil {
+				return nil, err
+			}
+			return types.NewReport(report), nil
 		}
-		return types.NewReport(report), nil
 	case coredata.ProcessingActivityEntityType:
-		processingActivity, err := prb.ProcessingActivities.Get(ctx, id)
+		action = probo.ActionProcessingActivityList
-		if err != nil {
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			panic(fmt.Errorf("cannot get processing activity: %w", err))
+			processingActivity, err := prb.ProcessingActivities.Get(ctx, id)
+			if err != nil {
+				return nil, err
+			}
+			return types.NewProcessingActivity(processingActivity), nil
 		}
-
-		return types.NewProcessingActivity(processingActivity), nil
 	case coredata.DataProtectionImpactAssessmentEntityType:
-		dpia, err := prb.DataProtectionImpactAssessments.Get(ctx, id)
+		// TODO: add action
-		if err != nil {
+		// action = probo.ActionDataProtectionImpactAssessmentGet
-			panic(fmt.Errorf("cannot get processing activity dpia: %w", err))
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
+			dpia, err := prb.DataProtectionImpactAssessments.Get(ctx, id)
+			if err != nil {
+				return nil, err
+			}
+			return types.NewDataProtectionImpactAssessment(dpia), nil
 		}
-
-		return types.NewDataProtectionImpactAssessment(dpia), nil
 	case coredata.TransferImpactAssessmentEntityType:
-		tia, err := prb.TransferImpactAssessments.Get(ctx, id)
+		// TODO: add action
-		if err != nil {
+		//action = probo.ActionTransferImpactAssessmentGet
-			panic(fmt.Errorf("cannot get processing activity tia: %w", err))
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
+			tia, err := prb.TransferImpactAssessments.Get(ctx, id)
+			if err != nil {
+				return nil, err
+			}
+			return types.NewTransferImpactAssessment(tia), nil
 		}
-
-		return types.NewTransferImpactAssessment(tia), nil
 	case coredata.SnapshotEntityType:
-		snapshot, err := prb.Snapshots.Get(ctx, id)
+		action = probo.ActionSnapshotList
-		if err != nil {
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			panic(fmt.Errorf("cannot get snapshot: %w", err))
+			snapshot, err := prb.Snapshots.Get(ctx, id)
+			if err != nil {
+				return nil, err
+			}
+			return types.NewSnapshot(snapshot), nil
 		}
-
-		return types.NewSnapshot(snapshot), nil
 	case coredata.TrustCenterEntityType:
-		trustCenter, file, err := prb.TrustCenters.Get(ctx, id)
+		action = probo.ActionTrustCenterGet
-		if err != nil {
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			panic(fmt.Errorf("cannot get trust center with file: %w", err))
+			trustCenter, file, err := prb.TrustCenters.Get(ctx, id)
+			if err != nil {
+				return nil, err
+			}
+			return types.NewTrustCenter(trustCenter, file), nil
 		}
-
-		return types.NewTrustCenter(trustCenter, file), nil
 	case coredata.TrustCenterAccessEntityType:
-		trustCenterAccess, err := prb.TrustCenterAccesses.Get(ctx, id)
+		action = probo.ActionTrustCenterAccessGet
-		if err != nil {
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			panic(fmt.Errorf("cannot get trust center access: %w", err))
+			trustCenterAccess, err := prb.TrustCenterAccesses.Get(ctx, id)
+			if err != nil {
+				return nil, err
+			}
+			return types.NewTrustCenterAccess(trustCenterAccess), nil
 		}
-
-		return types.NewTrustCenterAccess(trustCenterAccess), nil
 	case coredata.MeetingEntityType:
-		meeting, err := prb.Meetings.Get(ctx, id)
+		action = probo.ActionMeetingGet
-		if err != nil {
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			if errors.Is(err, coredata.ErrResourceAlreadyExists) {
+			meeting, err := prb.Meetings.Get(ctx, id)
-				return nil, gqlutils.Conflict(err)
+			if err != nil {
+				return nil, err
 			}
-
+			return types.NewMeeting(meeting), nil
-			panic(fmt.Errorf("cannot get meeting: %w", err))
 		}
-
-		return types.NewMeeting(meeting), nil
 	case coredata.RightsRequestEntityType:
-		rightsRequest, err := prb.RightsRequests.Get(ctx, id)
+		action = probo.ActionRightsRequestGet
-		if err != nil {
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			var errNotFound *coredata.ErrRightsRequestNotFound
+			rightsRequest, err := prb.RightsRequests.Get(ctx, id)
-			if errors.As(err, &errNotFound) {
+			if err != nil {
-				return nil, gqlutils.NotFound(errNotFound)
+				return nil, err
 			}
-			panic(fmt.Errorf("cannot get rights request: %w", err))
+			return types.NewRightsRequest(rightsRequest), nil
 		}
-
-		return types.NewRightsRequest(rightsRequest), nil
 	case coredata.StateOfApplicabilityEntityType:
-		stateOfApplicability, err := prb.StatesOfApplicability.Get(ctx, id)
+		action = probo.ActionStateOfApplicabilityGet
-		if err != nil {
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			if errors.Is(err, coredata.ErrResourceNotFound) {
+			stateOfApplicability, err := prb.StatesOfApplicability.Get(ctx, id)
-				return nil, gqlutils.NotFound(err)
+			if err != nil {
+				return nil, err
 			}
-			panic(fmt.Errorf("cannot get state_of_applicability: %w", err))
+			return types.NewStateOfApplicability(stateOfApplicability), nil
 		}
-
-		return types.NewStateOfApplicability(stateOfApplicability), nil
 	default:
 	}
 
-	panic(fmt.Errorf("unknown entity type: %d", id.EntityType()))
+	r.MustAuthorize(ctx, id, action)
+
+	node, err := loadNode(ctx, id)
+	if err != nil {
+		if errors.Is(err, coredata.ErrResourceNotFound) {
+			return nil, gqlutils.NotFound(err)
+		}
+
+		panic(fmt.Errorf("cannot load node: %w", err))
+	}
+
+	return node, nil
 }
 
 // Viewer is the resolver for the viewer field.