Remove people related authz actions

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/iam/iam_actions.go

@@ -52,7 +52,8 @@ const (
 	ActionMembershipRoleSetOwner = "iam:membership-role:set-owner"
 
 	// Membership Profile actions
-	ActionMembershipProfileGet = "iam:membership-profile:get"
+	ActionMembershipProfileGet  = "iam:membership-profile:get"
+	ActionMembershipProfileList = "iam:membership-profile:list"
 
 	// Personal API Key actions
 	ActionPersonalAPIKeyCreate = "iam:personal-api-key:create"

pkg/iam/iam_policies.go

@@ -146,7 +146,10 @@ var IAMOwnerPolicy = policy.NewPolicy(
 		When(policy.Equals("principal.organization_id", "resource.organization_id")),
 
 	// Full access to membership profiles (scoped to own organization)
-	policy.Allow(ActionMembershipProfileGet).
+	policy.Allow(
+		ActionMembershipProfileGet,
+		ActionMembershipProfileList,
+	).
 		WithSID("full-membership-profile-access").
 		When(policy.Equals("principal.organization_id", "resource.organization_id")),
 
@@ -221,7 +224,10 @@ var IAMAdminPolicy = policy.NewPolicy(
 		),
 
 	// Can view membership profiles (scoped to own organization)
-	policy.Allow(ActionMembershipProfileGet).
+	policy.Allow(
+		ActionMembershipProfileGet,
+		ActionMembershipProfileList,
+	).
 		WithSID("membership-profile-admin-access").
 		When(policy.Equals("principal.organization_id", "resource.organization_id")),
 
@@ -297,7 +303,10 @@ var IAMViewerPolicy = policy.NewPolicy(
 		When(policy.Equals("principal.organization_id", "resource.organization_id")),
 
 	// Can view membership profiles (scoped to own organization)
-	policy.Allow(ActionMembershipProfileGet).
+	policy.Allow(
+		ActionMembershipProfileGet,
+		ActionMembershipProfileList,
+	).
 		WithSID("membership-profile-viewer-access").
 		When(policy.Equals("principal.organization_id", "resource.organization_id")),
 

pkg/probo/actions.go

@@ -55,13 +55,6 @@ const (
 	ActionTrustCenterFileDelete     = "core:trust-center-file:delete"
 	ActionTrustCenterFileCreate     = "core:trust-center-file:create"
 
-	// People actions
-	ActionPeopleGet    = "core:people:get"
-	ActionPeopleList   = "core:people:list"
-	ActionPeopleCreate = "core:people:create"
-	ActionPeopleUpdate = "core:people:update"
-	ActionPeopleDelete = "core:people:delete"
-
 	// Vendor actions
 	ActionVendorList   = "core:vendor:list"
 	ActionVendorGet    = "core:vendor:get"

pkg/probo/policies.go

@@ -46,7 +46,6 @@ var ViewerPolicy = policy.NewPolicy(
 	).WithSID("org-read-access").When(organizationCondition),
 
 	policy.Allow(
-		ActionPeopleGet, ActionPeopleList,
 		ActionVendorGet, ActionVendorList,
 		ActionVendorContactGet, ActionVendorContactList,
 		ActionVendorServiceGet, ActionVendorServiceList,
@@ -114,7 +113,6 @@ var AuditorPolicy = policy.NewPolicy(
 	).WithSID("org-read-access").When(organizationCondition),
 
 	policy.Allow(
-		ActionPeopleGet, ActionPeopleList,
 		ActionVendorGet, ActionVendorList,
 		ActionVendorContactGet, ActionVendorContactList,
 		ActionVendorServiceGet, ActionVendorServiceList,

pkg/server/api/console/v1/v1_resolver.go

@@ -85,7 +85,7 @@ func (r *applicabilityStatementConnectionResolver) TotalCount(ctx context.Contex
 
 // Owner is the resolver for the owner field.
 func (r *assetResolver) Owner(ctx context.Context, obj *types.Asset) (*types.Profile, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil {
+	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
 		return nil, err
 	}
 
@@ -345,7 +345,7 @@ func (r *continualImprovementResolver) Organization(ctx context.Context, obj *ty
 
 // Owner is the resolver for the owner field.
 func (r *continualImprovementResolver) Owner(ctx context.Context, obj *types.ContinualImprovement) (*types.Profile, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil {
+	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
 		return nil, err
 	}
 
@@ -763,7 +763,7 @@ func (r *dataProtectionImpactAssessmentConnectionResolver) TotalCount(ctx contex
 
 // Owner is the resolver for the owner field.
 func (r *datumResolver) Owner(ctx context.Context, obj *types.Datum) (*types.Profile, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil {
+	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
 		return nil, err
 	}
 
@@ -863,7 +863,7 @@ func (r *datumConnectionResolver) TotalCount(ctx context.Context, obj *types.Dat
 
 // Owner is the resolver for the owner field.
 func (r *documentResolver) Owner(ctx context.Context, obj *types.Document) (*types.Profile, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil {
+	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
 		return nil, err
 	}
 
@@ -1032,7 +1032,7 @@ func (r *documentVersionResolver) Document(ctx context.Context, obj *types.Docum
 
 // Owner is the resolver for the owner field.
 func (r *documentVersionResolver) Owner(ctx context.Context, obj *types.DocumentVersion) (*types.Profile, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil {
+	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
 		return nil, err
 	}
 
@@ -1160,7 +1160,7 @@ func (r *documentVersionSignatureResolver) DocumentVersion(ctx context.Context,
 
 // SignedBy is the resolver for the signedBy field.
 func (r *documentVersionSignatureResolver) SignedBy(ctx context.Context, obj *types.DocumentVersionSignature) (*types.Profile, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil {
+	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
 		return nil, err
 	}
 
@@ -1610,7 +1610,7 @@ func (r *measureConnectionResolver) TotalCount(ctx context.Context, obj *types.M
 func (r *meetingResolver) Attendees(ctx context.Context, obj *types.Meeting) ([]*types.Profile, error) {
 	// TODO bug must be paginated
 
-	if err := r.authorize(ctx, obj.ID, probo.ActionPeopleList); err != nil {
+	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileList); err != nil {
 		return nil, err
 	}
 
@@ -5323,7 +5323,7 @@ func (r *nonconformityResolver) Audit(ctx context.Context, obj *types.Nonconform
 
 // Owner is the resolver for the owner field.
 func (r *nonconformityResolver) Owner(ctx context.Context, obj *types.Nonconformity) (*types.Profile, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil {
+	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
 		return nil, err
 	}
 
@@ -5394,7 +5394,7 @@ func (r *obligationResolver) Organization(ctx context.Context, obj *types.Obliga
 
 // Owner is the resolver for the owner field.
 func (r *obligationResolver) Owner(ctx context.Context, obj *types.Obligation) (*types.Profile, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil {
+	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
 		return nil, err
 	}
 
@@ -6302,7 +6302,7 @@ func (r *processingActivityResolver) Organization(ctx context.Context, obj *type
 
 // DataProtectionOfficer is the resolver for the dataProtectionOfficer field.
 func (r *processingActivityResolver) DataProtectionOfficer(ctx context.Context, obj *types.ProcessingActivity) (*types.Profile, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil {
+	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
 		return nil, err
 	}
 
@@ -6838,7 +6838,7 @@ func (r *rightsRequestConnectionResolver) TotalCount(ctx context.Context, obj *t
 
 // Owner is the resolver for the owner field.
 func (r *riskResolver) Owner(ctx context.Context, obj *types.Risk) (*types.Profile, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil {
+	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
 		return nil, err
 	}
 
@@ -7209,7 +7209,7 @@ func (r *stateOfApplicabilityResolver) Organization(ctx context.Context, obj *ty
 
 // Owner is the resolver for the owner field.
 func (r *stateOfApplicabilityResolver) Owner(ctx context.Context, obj *types.StateOfApplicability) (*types.Profile, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil {
+	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
 		return nil, err
 	}
 
@@ -7276,7 +7276,7 @@ func (r *stateOfApplicabilityConnectionResolver) TotalCount(ctx context.Context,
 
 // AssignedTo is the resolver for the assignedTo field.
 func (r *taskResolver) AssignedTo(ctx context.Context, obj *types.Task) (*types.Profile, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil {
+	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
 		return nil, err
 	}
 
@@ -8024,7 +8024,7 @@ func (r *vendorResolver) RiskAssessments(ctx context.Context, obj *types.Vendor,
 
 // BusinessOwner is the resolver for the businessOwner field.
 func (r *vendorResolver) BusinessOwner(ctx context.Context, obj *types.Vendor) (*types.Profile, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil {
+	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
 		return nil, err
 	}
 
@@ -8046,7 +8046,7 @@ func (r *vendorResolver) BusinessOwner(ctx context.Context, obj *types.Vendor) (
 
 // SecurityOwner is the resolver for the securityOwner field.
 func (r *vendorResolver) SecurityOwner(ctx context.Context, obj *types.Vendor) (*types.Profile, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil {
+	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
 		return nil, err
 	}