Require explicit portal access request IDs

Drop the request-all shortcut so callers always name the
documents, reports, and files to request. TopBar Get Access
now only signs in; bulk selection is the multi-resource path.

Signed-off-by: Émile Ré <emile@probo.com>

e2e/console/security_write_gap_test.go

@@ -81,9 +81,9 @@ func TestSecurity_WriteGap_PublishRiskListApproverIDs(t *testing.T) {
 // not per-tenant.
 //
 // CompliancePortalAccess rows are normally created through the trust/v1 public
-// portal's visitor request flow (requestAllAccesses), which needs a
-// separate authenticated visitor identity and NDA acceptance. To keep this
-// test focused on the fix under test (the Update mutation's FK validation)
+// portal's visitor request flow (requestAccesses / requestDocumentAccess), which
+// needs a separate authenticated visitor identity and NDA acceptance. To keep
+// this test focused on the fix under test (the Update mutation's FK validation)
 // rather than that unrelated flow, the access row's prerequisite state is
 // seeded directly via SQL against the same Postgres database the e2e probod
 // instance runs against, then the real updateCompliancePortalAccess mutation is

e2e/trust/compliance_portal_request_accesses_test.go

@@ -132,6 +132,35 @@ func TestCompliancePortal_RequestAccesses_TenantIsolation(t *testing.T) {
 	)
 }
 
+// TestCompliancePortal_RequestAccesses_EmptyRejects verifies that requestAccesses
+// with no document, report, or file ids is rejected — there is no "request all"
+// shortcut; callers must always name the targets explicitly.
+func TestCompliancePortal_RequestAccesses_EmptyRejects(t *testing.T) {
+	t.Parallel()
+
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	compliancePortalID := lookupCompliancePortalID(t, owner)
+	trustHost := lookupTrustHost(t, owner, compliancePortalID)
+
+	visitor := testutil.SelfProvisionCompliancePortalVisitor(t, trustHost)
+
+	err := visitor.ExecuteTrust(trustHost, requestAccessesMutation, map[string]any{
+		"input": map[string]any{
+			"documentIds":             []string{},
+			"reportIds":               []string{},
+			"compliancePortalFileIds": []string{},
+		},
+	}, nil)
+	require.Error(t, err, "requestAccesses with empty id lists must be rejected")
+	assert.Contains(
+		t,
+		err.Error(),
+		"at least one document, report, or file id is required",
+		"empty request must surface a client validation error",
+	)
+}
+
 // setupPrivatePortalDocument creates a document and marks it privately visible on
 // the owner's compliance portal, returning the document ID.
 func setupPrivatePortalDocument(t *testing.T, owner *testutil.Client) string {