From ce40c6d833c766f63aa093dbdac27e2bfc2ff862 Mon Sep 17 00:00:00 2001
From: Bryan Frimin <bryan@getprobo.com>
Date: Thu, 27 Nov 2025 17:51:25 +0100
Subject: [PATCH] Fix compliance page permission

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
---
 pkg/authz/permissions.go                      |  4 +++
 .../v1/types/trust_center_document_access.go  | 26 ++++++++++---------
 pkg/server/api/console/v1/v1_resolver.go      | 12 ++++-----
 3 files changed, 24 insertions(+), 18 deletions(-)

diff --git a/pkg/authz/permissions.go b/pkg/authz/permissions.go
index 0108041ae..de9e4555d 100644
--- a/pkg/authz/permissions.go
+++ b/pkg/authz/permissions.go
@@ -282,6 +282,7 @@ var Permissions = map[uint16]map[Action][]Role{
 		ActionListSnapshots:             AllRoles,
 		ActionListTrustCenterFiles:      AllRoles,
 		ActionGetTrustCenter:            AllRoles,
+		ActionAudit:                     AllRoles,
 		ActionGetCustomDomain:           AllRoles,
 		ActionListSAMLConfigurations:    AllRoles,
 		ActionConfirmEmail:              AllRoles,
@@ -341,6 +342,9 @@ var Permissions = map[uint16]map[Action][]Role{
 		ActionActiveCount:               AllRoles,
 		ActionPendingRequestCount:       AllRoles,
 		ActionAvailableDocumentAccesses: AllRoles,
+		ActionDocument:                  AllRoles,
+		ActionReport:                    AllRoles,
+		ActionTrustCenterFile:           AllRoles,
 
 		ActionUpdateTrustCenterAccess: EditRoles,
 		ActionDeleteTrustCenterAccess: EditRoles,
diff --git a/pkg/server/api/console/v1/types/trust_center_document_access.go b/pkg/server/api/console/v1/types/trust_center_document_access.go
index 8f07d78b7..47b70c404 100644
--- a/pkg/server/api/console/v1/types/trust_center_document_access.go
+++ b/pkg/server/api/console/v1/types/trust_center_document_access.go
@@ -47,23 +47,25 @@ type (
 		TrustCenterFile   *TrustCenterFile   `json:"trustCenterFile,omitempty"`
 
 		// Internal fields used by resolvers
-		DocumentID        *gid.GID `json:"-"`
-		ReportID          *gid.GID `json:"-"`
-		TrustCenterFileID *gid.GID `json:"-"`
+		TrustCenterAccessID gid.GID  `json:"-"`
+		DocumentID          *gid.GID `json:"-"`
+		ReportID            *gid.GID `json:"-"`
+		TrustCenterFileID   *gid.GID `json:"-"`
 	}
 )
 
 func NewTrustCenterDocumentAccess(tcda *coredata.TrustCenterDocumentAccess) *TrustCenterDocumentAccess {
 	return &TrustCenterDocumentAccess{
-		ID:                tcda.ID,
-		OrganizationID:    tcda.OrganizationID,
-		Active:            tcda.Active,
-		Requested:         tcda.Requested,
-		CreatedAt:         tcda.CreatedAt,
-		UpdatedAt:         tcda.UpdatedAt,
-		DocumentID:        tcda.DocumentID,
-		ReportID:          tcda.ReportID,
-		TrustCenterFileID: tcda.TrustCenterFileID,
+		ID:                  tcda.ID,
+		OrganizationID:      tcda.OrganizationID,
+		Active:              tcda.Active,
+		Requested:           tcda.Requested,
+		CreatedAt:           tcda.CreatedAt,
+		UpdatedAt:           tcda.UpdatedAt,
+		TrustCenterAccessID: tcda.TrustCenterAccessID,
+		DocumentID:          tcda.DocumentID,
+		ReportID:            tcda.ReportID,
+		TrustCenterFileID:   tcda.TrustCenterFileID,
 	}
 }
 
diff --git a/pkg/server/api/console/v1/v1_resolver.go b/pkg/server/api/console/v1/v1_resolver.go
index 705515c89..5989adb67 100644
--- a/pkg/server/api/console/v1/v1_resolver.go
+++ b/pkg/server/api/console/v1/v1_resolver.go
@@ -6349,13 +6349,13 @@ func (r *trustCenterAccessResolver) AvailableDocumentAccesses(ctx context.Contex
 
 // Document is the resolver for the document field.
 func (r *trustCenterDocumentAccessResolver) Document(ctx context.Context, obj *types.TrustCenterDocumentAccess) (*types.Document, error) {
-	r.MustBeAuthorized(ctx, obj.ID, authz.ActionDocument)
+	r.MustBeAuthorized(ctx, obj.TrustCenterAccessID, authz.ActionDocument)
 
 	if obj.DocumentID == nil {
 		return nil, nil
 	}
 
-	prb := r.ProboService(ctx, obj.ID.TenantID())
+	prb := r.ProboService(ctx, obj.TrustCenterAccessID.TenantID())
 
 	document, err := prb.Documents.Get(ctx, *obj.DocumentID)
 	if err != nil {
@@ -6371,13 +6371,13 @@ func (r *trustCenterDocumentAccessResolver) Document(ctx context.Context, obj *t
 
 // Report is the resolver for the report field.
 func (r *trustCenterDocumentAccessResolver) Report(ctx context.Context, obj *types.TrustCenterDocumentAccess) (*types.Report, error) {
-	r.MustBeAuthorized(ctx, obj.ID, authz.ActionReport)
+	r.MustBeAuthorized(ctx, obj.TrustCenterAccessID, authz.ActionReport)
 
 	if obj.ReportID == nil {
 		return nil, nil
 	}
 
-	prb := r.ProboService(ctx, obj.ID.TenantID())
+	prb := r.ProboService(ctx, obj.TrustCenterAccessID.TenantID())
 
 	report, err := prb.Reports.Get(ctx, *obj.ReportID)
 	if err != nil {
@@ -6389,13 +6389,13 @@ func (r *trustCenterDocumentAccessResolver) Report(ctx context.Context, obj *typ
 
 // TrustCenterFile is the resolver for the trustCenterFile field.
 func (r *trustCenterDocumentAccessResolver) TrustCenterFile(ctx context.Context, obj *types.TrustCenterDocumentAccess) (*types.TrustCenterFile, error) {
-	r.MustBeAuthorized(ctx, obj.ID, authz.ActionTrustCenterFile)
+	r.MustBeAuthorized(ctx, obj.TrustCenterAccessID, authz.ActionTrustCenterFile)
 
 	if obj.TrustCenterFileID == nil {
 		return nil, nil
 	}
 
-	prb := r.ProboService(ctx, obj.ID.TenantID())
+	prb := r.ProboService(ctx, obj.TrustCenterAccessID.TenantID())
 
 	trustCenterFile, err := prb.TrustCenterFiles.Get(ctx, *obj.TrustCenterFileID)
 	if err != nil {