From ce0952e4ec56b09a5d1c73320366d171745c444b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=89mile=20R=C3=A9?= Date: Thu, 5 Feb 2026 17:13:13 +0400 Subject: [PATCH] Remove people related authz actions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Émile Ré --- pkg/iam/iam_actions.go | 3 ++- pkg/iam/iam_policies.go | 15 +++++++++--- pkg/probo/actions.go | 7 ------ pkg/probo/policies.go | 2 -- pkg/server/api/console/v1/v1_resolver.go | 30 ++++++++++++------------ 5 files changed, 29 insertions(+), 28 deletions(-) diff --git a/pkg/iam/iam_actions.go b/pkg/iam/iam_actions.go index ef5c4ffeb..04d79a72c 100644 --- a/pkg/iam/iam_actions.go +++ b/pkg/iam/iam_actions.go @@ -52,7 +52,8 @@ const ( ActionMembershipRoleSetOwner = "iam:membership-role:set-owner" // Membership Profile actions - ActionMembershipProfileGet = "iam:membership-profile:get" + ActionMembershipProfileGet = "iam:membership-profile:get" + ActionMembershipProfileList = "iam:membership-profile:list" // Personal API Key actions ActionPersonalAPIKeyCreate = "iam:personal-api-key:create" diff --git a/pkg/iam/iam_policies.go b/pkg/iam/iam_policies.go index 3b1f80db4..963b551d3 100644 --- a/pkg/iam/iam_policies.go +++ b/pkg/iam/iam_policies.go @@ -146,7 +146,10 @@ var IAMOwnerPolicy = policy.NewPolicy( When(policy.Equals("principal.organization_id", "resource.organization_id")), // Full access to membership profiles (scoped to own organization) - policy.Allow(ActionMembershipProfileGet). + policy.Allow( + ActionMembershipProfileGet, + ActionMembershipProfileList, + ). WithSID("full-membership-profile-access"). When(policy.Equals("principal.organization_id", "resource.organization_id")), @@ -221,7 +224,10 @@ var IAMAdminPolicy = policy.NewPolicy( ), // Can view membership profiles (scoped to own organization) - policy.Allow(ActionMembershipProfileGet). + policy.Allow( + ActionMembershipProfileGet, + ActionMembershipProfileList, + ). WithSID("membership-profile-admin-access"). When(policy.Equals("principal.organization_id", "resource.organization_id")), @@ -297,7 +303,10 @@ var IAMViewerPolicy = policy.NewPolicy( When(policy.Equals("principal.organization_id", "resource.organization_id")), // Can view membership profiles (scoped to own organization) - policy.Allow(ActionMembershipProfileGet). + policy.Allow( + ActionMembershipProfileGet, + ActionMembershipProfileList, + ). WithSID("membership-profile-viewer-access"). When(policy.Equals("principal.organization_id", "resource.organization_id")), diff --git a/pkg/probo/actions.go b/pkg/probo/actions.go index 689f2b0fc..96d632711 100644 --- a/pkg/probo/actions.go +++ b/pkg/probo/actions.go @@ -55,13 +55,6 @@ const ( ActionTrustCenterFileDelete = "core:trust-center-file:delete" ActionTrustCenterFileCreate = "core:trust-center-file:create" - // People actions - ActionPeopleGet = "core:people:get" - ActionPeopleList = "core:people:list" - ActionPeopleCreate = "core:people:create" - ActionPeopleUpdate = "core:people:update" - ActionPeopleDelete = "core:people:delete" - // Vendor actions ActionVendorList = "core:vendor:list" ActionVendorGet = "core:vendor:get" diff --git a/pkg/probo/policies.go b/pkg/probo/policies.go index 792406069..d379a1f22 100644 --- a/pkg/probo/policies.go +++ b/pkg/probo/policies.go @@ -46,7 +46,6 @@ var ViewerPolicy = policy.NewPolicy( ).WithSID("org-read-access").When(organizationCondition), policy.Allow( - ActionPeopleGet, ActionPeopleList, ActionVendorGet, ActionVendorList, ActionVendorContactGet, ActionVendorContactList, ActionVendorServiceGet, ActionVendorServiceList, @@ -114,7 +113,6 @@ var AuditorPolicy = policy.NewPolicy( ).WithSID("org-read-access").When(organizationCondition), policy.Allow( - ActionPeopleGet, ActionPeopleList, ActionVendorGet, ActionVendorList, ActionVendorContactGet, ActionVendorContactList, ActionVendorServiceGet, ActionVendorServiceList, diff --git a/pkg/server/api/console/v1/v1_resolver.go b/pkg/server/api/console/v1/v1_resolver.go index 4defee9cd..72f23f02a 100644 --- a/pkg/server/api/console/v1/v1_resolver.go +++ b/pkg/server/api/console/v1/v1_resolver.go @@ -85,7 +85,7 @@ func (r *applicabilityStatementConnectionResolver) TotalCount(ctx context.Contex // Owner is the resolver for the owner field. func (r *assetResolver) Owner(ctx context.Context, obj *types.Asset) (*types.Profile, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil { + if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } @@ -345,7 +345,7 @@ func (r *continualImprovementResolver) Organization(ctx context.Context, obj *ty // Owner is the resolver for the owner field. func (r *continualImprovementResolver) Owner(ctx context.Context, obj *types.ContinualImprovement) (*types.Profile, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil { + if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } @@ -763,7 +763,7 @@ func (r *dataProtectionImpactAssessmentConnectionResolver) TotalCount(ctx contex // Owner is the resolver for the owner field. func (r *datumResolver) Owner(ctx context.Context, obj *types.Datum) (*types.Profile, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil { + if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } @@ -863,7 +863,7 @@ func (r *datumConnectionResolver) TotalCount(ctx context.Context, obj *types.Dat // Owner is the resolver for the owner field. func (r *documentResolver) Owner(ctx context.Context, obj *types.Document) (*types.Profile, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil { + if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } @@ -1032,7 +1032,7 @@ func (r *documentVersionResolver) Document(ctx context.Context, obj *types.Docum // Owner is the resolver for the owner field. func (r *documentVersionResolver) Owner(ctx context.Context, obj *types.DocumentVersion) (*types.Profile, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil { + if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } @@ -1160,7 +1160,7 @@ func (r *documentVersionSignatureResolver) DocumentVersion(ctx context.Context, // SignedBy is the resolver for the signedBy field. func (r *documentVersionSignatureResolver) SignedBy(ctx context.Context, obj *types.DocumentVersionSignature) (*types.Profile, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil { + if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } @@ -1610,7 +1610,7 @@ func (r *measureConnectionResolver) TotalCount(ctx context.Context, obj *types.M func (r *meetingResolver) Attendees(ctx context.Context, obj *types.Meeting) ([]*types.Profile, error) { // TODO bug must be paginated - if err := r.authorize(ctx, obj.ID, probo.ActionPeopleList); err != nil { + if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileList); err != nil { return nil, err } @@ -5323,7 +5323,7 @@ func (r *nonconformityResolver) Audit(ctx context.Context, obj *types.Nonconform // Owner is the resolver for the owner field. func (r *nonconformityResolver) Owner(ctx context.Context, obj *types.Nonconformity) (*types.Profile, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil { + if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } @@ -5394,7 +5394,7 @@ func (r *obligationResolver) Organization(ctx context.Context, obj *types.Obliga // Owner is the resolver for the owner field. func (r *obligationResolver) Owner(ctx context.Context, obj *types.Obligation) (*types.Profile, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil { + if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } @@ -6302,7 +6302,7 @@ func (r *processingActivityResolver) Organization(ctx context.Context, obj *type // DataProtectionOfficer is the resolver for the dataProtectionOfficer field. func (r *processingActivityResolver) DataProtectionOfficer(ctx context.Context, obj *types.ProcessingActivity) (*types.Profile, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil { + if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } @@ -6838,7 +6838,7 @@ func (r *rightsRequestConnectionResolver) TotalCount(ctx context.Context, obj *t // Owner is the resolver for the owner field. func (r *riskResolver) Owner(ctx context.Context, obj *types.Risk) (*types.Profile, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil { + if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } @@ -7209,7 +7209,7 @@ func (r *stateOfApplicabilityResolver) Organization(ctx context.Context, obj *ty // Owner is the resolver for the owner field. func (r *stateOfApplicabilityResolver) Owner(ctx context.Context, obj *types.StateOfApplicability) (*types.Profile, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil { + if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } @@ -7276,7 +7276,7 @@ func (r *stateOfApplicabilityConnectionResolver) TotalCount(ctx context.Context, // AssignedTo is the resolver for the assignedTo field. func (r *taskResolver) AssignedTo(ctx context.Context, obj *types.Task) (*types.Profile, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil { + if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } @@ -8024,7 +8024,7 @@ func (r *vendorResolver) RiskAssessments(ctx context.Context, obj *types.Vendor, // BusinessOwner is the resolver for the businessOwner field. func (r *vendorResolver) BusinessOwner(ctx context.Context, obj *types.Vendor) (*types.Profile, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil { + if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err } @@ -8046,7 +8046,7 @@ func (r *vendorResolver) BusinessOwner(ctx context.Context, obj *types.Vendor) ( // SecurityOwner is the resolver for the securityOwner field. func (r *vendorResolver) SecurityOwner(ctx context.Context, obj *types.Vendor) (*types.Profile, error) { - if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil { + if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { return nil, err }