Update RBAC on console

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/server/api/connect/v1/schema.graphql

@@ -230,7 +230,7 @@ type Membership implements Node {
   profile: MembershipProfile @goField(forceResolver: true) @isViewer
   organization: Organization @goField(forceResolver: true)
   role: MembershipRole!
-  permissions: [Permission!]!
+  permissions: [Permission!] @goField(forceResolver: true)
 
   lastSession: Session @goField(forceResolver: true) @isViewer
 }
@@ -276,11 +276,6 @@ type Permission implements Node {
   principalId: ID!
 }
 
-type PermissionGrant {
-  application: Application!
-  accessLevel: AccessLevel!
-}
-
 type Application {
   id: ApplicationId!
   name: String!
@@ -303,7 +298,6 @@ type SAMLConfiguration implements Node {
   spMetadataUrl: String!
   testLoginUrl: String!
   attributeMappings: SAMLAttributeMappings!
-  defaultPermissions: [PermissionGrant!]!
 }
 
 type SAMLAttributeMappings {

pkg/server/api/connect/v1/schema/schema.go

@@ -267,11 +267,6 @@ type ComplexityRoot struct {
 		PrincipalType func(childComplexity int) int
 	}
 
-	PermissionGrant struct {
-		AccessLevel func(childComplexity int) int
-		Application func(childComplexity int) int
-	}
-
 	PersonalAPIKey struct {
 		CreatedAt     func(childComplexity int) int
 		ExpiresAt     func(childComplexity int) int
@@ -335,7 +330,6 @@ type ComplexityRoot struct {
 		AttributeMappings       func(childComplexity int) int
 		AutoSignupEnabled       func(childComplexity int) int
 		CreatedAt               func(childComplexity int) int
-		DefaultPermissions      func(childComplexity int) int
 		DomainVerificationToken func(childComplexity int) int
 		DomainVerifiedAt        func(childComplexity int) int
 		EmailDomain             func(childComplexity int) int
@@ -438,6 +432,7 @@ type MembershipResolver interface {
 	Profile(ctx context.Context, obj *types.Membership) (*types.MembershipProfile, error)
 	Organization(ctx context.Context, obj *types.Membership) (*types.Organization, error)
 
+	Permissions(ctx context.Context, obj *types.Membership) ([]*types.Permission, error)
 	LastSession(ctx context.Context, obj *types.Membership) (*types.Session, error)
 }
 type MembershipConnectionResolver interface {
@@ -1385,19 +1380,6 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 
 		return e.complexity.Permission.PrincipalType(childComplexity), true
 
-	case "PermissionGrant.accessLevel":
-		if e.complexity.PermissionGrant.AccessLevel == nil {
-			break
-		}
-
-		return e.complexity.PermissionGrant.AccessLevel(childComplexity), true
-	case "PermissionGrant.application":
-		if e.complexity.PermissionGrant.Application == nil {
-			break
-		}
-
-		return e.complexity.PermissionGrant.Application(childComplexity), true
-
 	case "PersonalAPIKey.createdAt":
 		if e.complexity.PersonalAPIKey.CreatedAt == nil {
 			break
@@ -1593,12 +1575,6 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 		}
 
 		return e.complexity.SAMLConfiguration.CreatedAt(childComplexity), true
-	case "SAMLConfiguration.defaultPermissions":
-		if e.complexity.SAMLConfiguration.DefaultPermissions == nil {
-			break
-		}
-
-		return e.complexity.SAMLConfiguration.DefaultPermissions(childComplexity), true
 	case "SAMLConfiguration.domainVerificationToken":
 		if e.complexity.SAMLConfiguration.DomainVerificationToken == nil {
 			break
@@ -2219,7 +2195,7 @@ type Membership implements Node {
   profile: MembershipProfile @goField(forceResolver: true) @isViewer
   organization: Organization @goField(forceResolver: true)
   role: MembershipRole!
-  permissions: [Permission!]!
+  permissions: [Permission!] @goField(forceResolver: true)
 
   lastSession: Session @goField(forceResolver: true) @isViewer
 }
@@ -2265,11 +2241,6 @@ type Permission implements Node {
   principalId: ID!
 }
 
-type PermissionGrant {
-  application: Application!
-  accessLevel: AccessLevel!
-}
-
 type Application {
   id: ApplicationId!
   name: String!
@@ -2292,7 +2263,6 @@ type SAMLConfiguration implements Node {
   spMetadataUrl: String!
   testLoginUrl: String!
   attributeMappings: SAMLAttributeMappings!
-  defaultPermissions: [PermissionGrant!]!
 }
 
 type SAMLAttributeMappings {
@@ -5132,12 +5102,12 @@ func (ec *executionContext) _Membership_permissions(ctx context.Context, field g
 		field,
 		ec.fieldContext_Membership_permissions,
 		func(ctx context.Context) (any, error) {
-			return obj.Permissions, nil
+			return ec.resolvers.Membership().Permissions(ctx, obj)
 		},
 		nil,
-		ec.marshalNPermission2ᚕᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconnectᚋv1ᚋtypesᚐPermissionᚄ,
-		true,
+		ec.marshalOPermission2ᚕᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconnectᚋv1ᚋtypesᚐPermissionᚄ,
 		true,
+		false,
 	)
 }
 
@@ -5145,8 +5115,8 @@ func (ec *executionContext) fieldContext_Membership_permissions(_ context.Contex
 	fc = &graphql.FieldContext{
 		Object:     "Membership",
 		Field:      field,
-		IsMethod:   false,
-		IsResolver: false,
+		IsMethod:   true,
+		IsResolver: true,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
 			switch field.Name {
 			case "id":
@@ -8107,74 +8077,6 @@ func (ec *executionContext) fieldContext_Permission_principalId(_ context.Contex
 	return fc, nil
 }
 
-func (ec *executionContext) _PermissionGrant_application(ctx context.Context, field graphql.CollectedField, obj *types.PermissionGrant) (ret graphql.Marshaler) {
-	return graphql.ResolveField(
-		ctx,
-		ec.OperationContext,
-		field,
-		ec.fieldContext_PermissionGrant_application,
-		func(ctx context.Context) (any, error) {
-			return obj.Application, nil
-		},
-		nil,
-		ec.marshalNApplication2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconnectᚋv1ᚋtypesᚐApplication,
-		true,
-		true,
-	)
-}
-
-func (ec *executionContext) fieldContext_PermissionGrant_application(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
-	fc = &graphql.FieldContext{
-		Object:     "PermissionGrant",
-		Field:      field,
-		IsMethod:   false,
-		IsResolver: false,
-		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			switch field.Name {
-			case "id":
-				return ec.fieldContext_Application_id(ctx, field)
-			case "name":
-				return ec.fieldContext_Application_name(ctx, field)
-			case "description":
-				return ec.fieldContext_Application_description(ctx, field)
-			case "availableAccessLevels":
-				return ec.fieldContext_Application_availableAccessLevels(ctx, field)
-			}
-			return nil, fmt.Errorf("no field named %q was found under type Application", field.Name)
-		},
-	}
-	return fc, nil
-}
-
-func (ec *executionContext) _PermissionGrant_accessLevel(ctx context.Context, field graphql.CollectedField, obj *types.PermissionGrant) (ret graphql.Marshaler) {
-	return graphql.ResolveField(
-		ctx,
-		ec.OperationContext,
-		field,
-		ec.fieldContext_PermissionGrant_accessLevel,
-		func(ctx context.Context) (any, error) {
-			return obj.AccessLevel, nil
-		},
-		nil,
-		ec.marshalNAccessLevel2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconnectᚋv1ᚋtypesᚐAccessLevel,
-		true,
-		true,
-	)
-}
-
-func (ec *executionContext) fieldContext_PermissionGrant_accessLevel(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
-	fc = &graphql.FieldContext{
-		Object:     "PermissionGrant",
-		Field:      field,
-		IsMethod:   false,
-		IsResolver: false,
-		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type AccessLevel does not have child fields")
-		},
-	}
-	return fc, nil
-}
-
 func (ec *executionContext) _PersonalAPIKey_id(ctx context.Context, field graphql.CollectedField, obj *types.PersonalAPIKey) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
@@ -9623,41 +9525,6 @@ func (ec *executionContext) fieldContext_SAMLConfiguration_attributeMappings(_ c
 	return fc, nil
 }
 
-func (ec *executionContext) _SAMLConfiguration_defaultPermissions(ctx context.Context, field graphql.CollectedField, obj *types.SAMLConfiguration) (ret graphql.Marshaler) {
-	return graphql.ResolveField(
-		ctx,
-		ec.OperationContext,
-		field,
-		ec.fieldContext_SAMLConfiguration_defaultPermissions,
-		func(ctx context.Context) (any, error) {
-			return obj.DefaultPermissions, nil
-		},
-		nil,
-		ec.marshalNPermissionGrant2ᚕᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconnectᚋv1ᚋtypesᚐPermissionGrantᚄ,
-		true,
-		true,
-	)
-}
-
-func (ec *executionContext) fieldContext_SAMLConfiguration_defaultPermissions(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
-	fc = &graphql.FieldContext{
-		Object:     "SAMLConfiguration",
-		Field:      field,
-		IsMethod:   false,
-		IsResolver: false,
-		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			switch field.Name {
-			case "application":
-				return ec.fieldContext_PermissionGrant_application(ctx, field)
-			case "accessLevel":
-				return ec.fieldContext_PermissionGrant_accessLevel(ctx, field)
-			}
-			return nil, fmt.Errorf("no field named %q was found under type PermissionGrant", field.Name)
-		},
-	}
-	return fc, nil
-}
-
 func (ec *executionContext) _SAMLConfigurationConnection_edges(ctx context.Context, field graphql.CollectedField, obj *types.SAMLConfigurationConnection) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
@@ -9813,8 +9680,6 @@ func (ec *executionContext) fieldContext_SAMLConfigurationEdge_node(_ context.Co
 				return ec.fieldContext_SAMLConfiguration_testLoginUrl(ctx, field)
 			case "attributeMappings":
 				return ec.fieldContext_SAMLConfiguration_attributeMappings(ctx, field)
-			case "defaultPermissions":
-				return ec.fieldContext_SAMLConfiguration_defaultPermissions(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type SAMLConfiguration", field.Name)
 		},
@@ -10736,8 +10601,6 @@ func (ec *executionContext) fieldContext_UpdateSAMLConfigurationPayload_samlConf
 				return ec.fieldContext_SAMLConfiguration_testLoginUrl(ctx, field)
 			case "attributeMappings":
 				return ec.fieldContext_SAMLConfiguration_attributeMappings(ctx, field)
-			case "defaultPermissions":
-				return ec.fieldContext_SAMLConfiguration_defaultPermissions(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type SAMLConfiguration", field.Name)
 		},
@@ -14543,10 +14406,38 @@ func (ec *executionContext) _Membership(ctx context.Context, sel ast.SelectionSe
 				atomic.AddUint32(&out.Invalids, 1)
 			}
 		case "permissions":
-			out.Values[i] = ec._Membership_permissions(ctx, field, obj)
-			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&out.Invalids, 1)
+			field := field
+
+			innerFunc := func(ctx context.Context, _ *graphql.FieldSet) (res graphql.Marshaler) {
+				defer func() {
+					if r := recover(); r != nil {
+						ec.Error(ctx, ec.Recover(ctx, r))
+					}
+				}()
+				res = ec._Membership_permissions(ctx, field, obj)
+				return res
 			}
+
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
+
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 		case "lastSession":
 			field := field
 
@@ -15387,50 +15278,6 @@ func (ec *executionContext) _Permission(ctx context.Context, sel ast.SelectionSe
 	return out
 }
 
-var permissionGrantImplementors = []string{"PermissionGrant"}
-
-func (ec *executionContext) _PermissionGrant(ctx context.Context, sel ast.SelectionSet, obj *types.PermissionGrant) graphql.Marshaler {
-	fields := graphql.CollectFields(ec.OperationContext, sel, permissionGrantImplementors)
-
-	out := graphql.NewFieldSet(fields)
-	deferred := make(map[string]*graphql.FieldSet)
-	for i, field := range fields {
-		switch field.Name {
-		case "__typename":
-			out.Values[i] = graphql.MarshalString("PermissionGrant")
-		case "application":
-			out.Values[i] = ec._PermissionGrant_application(ctx, field, obj)
-			if out.Values[i] == graphql.Null {
-				out.Invalids++
-			}
-		case "accessLevel":
-			out.Values[i] = ec._PermissionGrant_accessLevel(ctx, field, obj)
-			if out.Values[i] == graphql.Null {
-				out.Invalids++
-			}
-		default:
-			panic("unknown field " + strconv.Quote(field.Name))
-		}
-	}
-	out.Dispatch(ctx)
-	if out.Invalids > 0 {
-		return graphql.Null
-	}
-
-	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
-
-	for label, dfs := range deferred {
-		ec.processDeferredGroup(graphql.DeferredGroup{
-			Label:    label,
-			Path:     graphql.GetPath(ctx),
-			FieldSet: dfs,
-			Context:  ctx,
-		})
-	}
-
-	return out
-}
-
 var personalAPIKeyImplementors = []string{"PersonalAPIKey", "Node"}
 
 func (ec *executionContext) _PersonalAPIKey(ctx context.Context, sel ast.SelectionSet, obj *types.PersonalAPIKey) graphql.Marshaler {
@@ -16096,11 +15943,6 @@ func (ec *executionContext) _SAMLConfiguration(ctx context.Context, sel ast.Sele
 			if out.Values[i] == graphql.Null {
 				out.Invalids++
 			}
-		case "defaultPermissions":
-			out.Values[i] = ec._SAMLConfiguration_defaultPermissions(ctx, field, obj)
-			if out.Values[i] == graphql.Null {
-				out.Invalids++
-			}
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
@@ -17767,50 +17609,6 @@ func (ec *executionContext) marshalNPageInfo2goᚗproboᚗincᚋproboᚋpkgᚋse
 	return ec._PageInfo(ctx, sel, &v)
 }
 
-func (ec *executionContext) marshalNPermission2ᚕᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconnectᚋv1ᚋtypesᚐPermissionᚄ(ctx context.Context, sel ast.SelectionSet, v []*types.Permission) graphql.Marshaler {
-	ret := make(graphql.Array, len(v))
-	var wg sync.WaitGroup
-	isLen1 := len(v) == 1
-	if !isLen1 {
-		wg.Add(len(v))
-	}
-	for i := range v {
-		i := i
-		fc := &graphql.FieldContext{
-			Index:  &i,
-			Result: &v[i],
-		}
-		ctx := graphql.WithFieldContext(ctx, fc)
-		f := func(i int) {
-			defer func() {
-				if r := recover(); r != nil {
-					ec.Error(ctx, ec.Recover(ctx, r))
-					ret = nil
-				}
-			}()
-			if !isLen1 {
-				defer wg.Done()
-			}
-			ret[i] = ec.marshalNPermission2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconnectᚋv1ᚋtypesᚐPermission(ctx, sel, v[i])
-		}
-		if isLen1 {
-			f(i)
-		} else {
-			go f(i)
-		}
-
-	}
-	wg.Wait()
-
-	for _, e := range ret {
-		if e == graphql.Null {
-			return graphql.Null
-		}
-	}
-
-	return ret
-}
-
 func (ec *executionContext) marshalNPermission2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconnectᚋv1ᚋtypesᚐPermission(ctx context.Context, sel ast.SelectionSet, v *types.Permission) graphql.Marshaler {
 	if v == nil {
 		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
@@ -17821,60 +17619,6 @@ func (ec *executionContext) marshalNPermission2ᚖgoᚗproboᚗincᚋproboᚋpkg
 	return ec._Permission(ctx, sel, v)
 }
 
-func (ec *executionContext) marshalNPermissionGrant2ᚕᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconnectᚋv1ᚋtypesᚐPermissionGrantᚄ(ctx context.Context, sel ast.SelectionSet, v []*types.PermissionGrant) graphql.Marshaler {
-	ret := make(graphql.Array, len(v))
-	var wg sync.WaitGroup
-	isLen1 := len(v) == 1
-	if !isLen1 {
-		wg.Add(len(v))
-	}
-	for i := range v {
-		i := i
-		fc := &graphql.FieldContext{
-			Index:  &i,
-			Result: &v[i],
-		}
-		ctx := graphql.WithFieldContext(ctx, fc)
-		f := func(i int) {
-			defer func() {
-				if r := recover(); r != nil {
-					ec.Error(ctx, ec.Recover(ctx, r))
-					ret = nil
-				}
-			}()
-			if !isLen1 {
-				defer wg.Done()
-			}
-			ret[i] = ec.marshalNPermissionGrant2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconnectᚋv1ᚋtypesᚐPermissionGrant(ctx, sel, v[i])
-		}
-		if isLen1 {
-			f(i)
-		} else {
-			go f(i)
-		}
-
-	}
-	wg.Wait()
-
-	for _, e := range ret {
-		if e == graphql.Null {
-			return graphql.Null
-		}
-	}
-
-	return ret
-}
-
-func (ec *executionContext) marshalNPermissionGrant2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconnectᚋv1ᚋtypesᚐPermissionGrant(ctx context.Context, sel ast.SelectionSet, v *types.PermissionGrant) graphql.Marshaler {
-	if v == nil {
-		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
-			graphql.AddErrorf(ctx, "the requested element is null which the schema does not allow")
-		}
-		return graphql.Null
-	}
-	return ec._PermissionGrant(ctx, sel, v)
-}
-
 func (ec *executionContext) marshalNPersonalAPIKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconnectᚋv1ᚋtypesᚐPersonalAPIKey(ctx context.Context, sel ast.SelectionSet, v *types.PersonalAPIKey) graphql.Marshaler {
 	if v == nil {
 		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
@@ -18878,6 +18622,53 @@ func (ec *executionContext) marshalOOrganization2ᚖgoᚗproboᚗincᚋproboᚋp
 	return ec._Organization(ctx, sel, v)
 }
 
+func (ec *executionContext) marshalOPermission2ᚕᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconnectᚋv1ᚋtypesᚐPermissionᚄ(ctx context.Context, sel ast.SelectionSet, v []*types.Permission) graphql.Marshaler {
+	if v == nil {
+		return graphql.Null
+	}
+	ret := make(graphql.Array, len(v))
+	var wg sync.WaitGroup
+	isLen1 := len(v) == 1
+	if !isLen1 {
+		wg.Add(len(v))
+	}
+	for i := range v {
+		i := i
+		fc := &graphql.FieldContext{
+			Index:  &i,
+			Result: &v[i],
+		}
+		ctx := graphql.WithFieldContext(ctx, fc)
+		f := func(i int) {
+			defer func() {
+				if r := recover(); r != nil {
+					ec.Error(ctx, ec.Recover(ctx, r))
+					ret = nil
+				}
+			}()
+			if !isLen1 {
+				defer wg.Done()
+			}
+			ret[i] = ec.marshalNPermission2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconnectᚋv1ᚋtypesᚐPermission(ctx, sel, v[i])
+		}
+		if isLen1 {
+			f(i)
+		} else {
+			go f(i)
+		}
+
+	}
+	wg.Wait()
+
+	for _, e := range ret {
+		if e == graphql.Null {
+			return graphql.Null
+		}
+	}
+
+	return ret
+}
+
 func (ec *executionContext) marshalOPersonalAPIKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconnectᚋv1ᚋtypesᚐPersonalAPIKey(ctx context.Context, sel ast.SelectionSet, v *types.PersonalAPIKey) graphql.Marshaler {
 	if v == nil {
 		return graphql.Null

pkg/server/api/connect/v1/types/types.go

@@ -200,7 +200,7 @@ type Membership struct {
 	Profile      *MembershipProfile      `json:"profile,omitempty"`
 	Organization *Organization           `json:"organization,omitempty"`
 	Role         coredata.MembershipRole `json:"role"`
-	Permissions  []*Permission           `json:"permissions"`
+	Permissions  []*Permission           `json:"permissions,omitempty"`
 	LastSession  *Session                `json:"lastSession,omitempty"`
 }
 
@@ -278,11 +278,6 @@ type Permission struct {
 func (Permission) IsNode()             {}
 func (this Permission) GetID() gid.GID { return this.ID }
 
-type PermissionGrant struct {
-	Application *Application `json:"application"`
-	AccessLevel AccessLevel  `json:"accessLevel"`
-}
-
 type PersonalAPIKey struct {
 	ID            gid.GID         `json:"id"`
 	Name          string          `json:"name"`
@@ -378,7 +373,6 @@ type SAMLConfiguration struct {
 	SpMetadataURL           string                         `json:"spMetadataUrl"`
 	TestLoginURL            string                         `json:"testLoginUrl"`
 	AttributeMappings       *SAMLAttributeMappings         `json:"attributeMappings"`
-	DefaultPermissions      []*PermissionGrant             `json:"defaultPermissions"`
 }
 
 func (SAMLConfiguration) IsNode()             {}

pkg/server/api/connect/v1/v1_resolver.go

@@ -233,6 +233,11 @@ func (r *membershipResolver) Organization(ctx context.Context, obj *types.Member
 	return types.NewOrganization(organization), nil
 }
 
+// Permissions is the resolver for the permissions field.
+func (r *membershipResolver) Permissions(ctx context.Context, obj *types.Membership) ([]*types.Permission, error) {
+	panic("not implemented")
+}
+
 // LastSession is the resolver for the lastSession field.
 func (r *membershipResolver) LastSession(ctx context.Context, obj *types.Membership) (*types.Session, error) {
 	session := SessionFromContext(ctx)

pkg/server/api/console/v1/resolver.go

@@ -316,16 +316,23 @@ func GetTenantService(ctx context.Context, proboSvc *probo.Service, tenantID gid
 	return proboSvc.WithTenant(tenantID)
 }
 
-func (r *Resolver) MustBeAuthorized(ctx context.Context, entityID gid.GID, action iam.Action) {
+func (r *Resolver) MustAuthorize(ctx context.Context, entityID gid.GID, action iam.Action) {
 	user := connect_v1.IdentityFromContext(ctx)
-	apiKey := connect_v1.APIKeyFromContext(ctx)
+	// apiKey := connect_v1.APIKeyFromContext(ctx)
 
-	var credentialID *gid.GID
-	if apiKey != nil {
-		credentialID = &apiKey.ID
-	}
+	// var credentialID *gid.GID
+	// if apiKey != nil {
+	// 	credentialID = &apiKey.ID
+	// }
 
-	err := r.iam.LegacyAccessManagementService.Authorize(ctx, user.ID, credentialID, entityID, action)
+	err := r.iam.Authorizer.Authorize(
+		ctx,
+		iam.AuthorizeParams{
+			Principal: user.ID,
+			Resource:  entityID,
+			Action:    action,
+		},
+	)
 	if err != nil {
 		panic(err)
 	}

pkg/server/api/console/v1/schema/schema.go

@@ -252,6 +252,7 @@ type ComplexityRoot struct {
 		Measures                     func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.MeasureOrderBy, filter *types.MeasureFilter) int
 		Name                         func(childComplexity int) int
 		Obligations                  func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ObligationOrderBy, filter *types.ObligationFilter) int
+		Organization                 func(childComplexity int) int
 		SectionTitle                 func(childComplexity int) int
 		Snapshots                    func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.SnapshotOrderBy) int
 		StateOfApplicabilityControls func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.StateOfApplicabilityOrderBy) int
@@ -1932,6 +1933,8 @@ type ContinualImprovementConnectionResolver interface {
 	TotalCount(ctx context.Context, obj *types.ContinualImprovementConnection) (int, error)
 }
 type ControlResolver interface {
+	Organization(ctx context.Context, obj *types.Control) (*types.Organization, error)
+
 	Framework(ctx context.Context, obj *types.Control) (*types.Framework, error)
 	Measures(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.MeasureOrderBy, filter *types.MeasureFilter) (*types.MeasureConnection, error)
 	Documents(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentOrderBy, filter *types.DocumentFilter) (*types.DocumentConnection, error)
@@ -2926,6 +2929,12 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 		}
 
 		return e.complexity.Control.Obligations(childComplexity, args["first"].(*int), args["after"].(*page.CursorKey), args["last"].(*int), args["before"].(*page.CursorKey), args["orderBy"].(*types.ObligationOrderBy), args["filter"].(*types.ObligationFilter)), true
+	case "Control.organization":
+		if e.complexity.Control.Organization == nil {
+			break
+		}
+
+		return e.complexity.Control.Organization(childComplexity), true
 	case "Control.sectionTitle":
 		if e.complexity.Control.SectionTitle == nil {
 			break
@@ -11762,6 +11771,7 @@ type Framework implements Node {
 
 type Control implements Node {
   id: ID!
+  organization: Organization @goField(forceResolver: true)
   sectionTitle: String!
   name: String!
   description: String
@@ -21218,6 +21228,109 @@ func (ec *executionContext) fieldContext_Control_id(_ context.Context, field gra
 	return fc, nil
 }
 
+func (ec *executionContext) _Control_organization(ctx context.Context, field graphql.CollectedField, obj *types.Control) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_Control_organization,
+		func(ctx context.Context) (any, error) {
+			return ec.resolvers.Control().Organization(ctx, obj)
+		},
+		nil,
+		ec.marshalOOrganization2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐOrganization,
+		true,
+		false,
+	)
+}
+
+func (ec *executionContext) fieldContext_Control_organization(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Control",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_Organization_id(ctx, field)
+			case "name":
+				return ec.fieldContext_Organization_name(ctx, field)
+			case "logoUrl":
+				return ec.fieldContext_Organization_logoUrl(ctx, field)
+			case "horizontalLogoUrl":
+				return ec.fieldContext_Organization_horizontalLogoUrl(ctx, field)
+			case "description":
+				return ec.fieldContext_Organization_description(ctx, field)
+			case "websiteUrl":
+				return ec.fieldContext_Organization_websiteUrl(ctx, field)
+			case "email":
+				return ec.fieldContext_Organization_email(ctx, field)
+			case "headquarterAddress":
+				return ec.fieldContext_Organization_headquarterAddress(ctx, field)
+			case "context":
+				return ec.fieldContext_Organization_context(ctx, field)
+			case "slackConnections":
+				return ec.fieldContext_Organization_slackConnections(ctx, field)
+			case "frameworks":
+				return ec.fieldContext_Organization_frameworks(ctx, field)
+			case "controls":
+				return ec.fieldContext_Organization_controls(ctx, field)
+			case "vendors":
+				return ec.fieldContext_Organization_vendors(ctx, field)
+			case "peoples":
+				return ec.fieldContext_Organization_peoples(ctx, field)
+			case "documents":
+				return ec.fieldContext_Organization_documents(ctx, field)
+			case "meetings":
+				return ec.fieldContext_Organization_meetings(ctx, field)
+			case "statesOfApplicability":
+				return ec.fieldContext_Organization_statesOfApplicability(ctx, field)
+			case "measures":
+				return ec.fieldContext_Organization_measures(ctx, field)
+			case "risks":
+				return ec.fieldContext_Organization_risks(ctx, field)
+			case "tasks":
+				return ec.fieldContext_Organization_tasks(ctx, field)
+			case "assets":
+				return ec.fieldContext_Organization_assets(ctx, field)
+			case "data":
+				return ec.fieldContext_Organization_data(ctx, field)
+			case "audits":
+				return ec.fieldContext_Organization_audits(ctx, field)
+			case "nonconformities":
+				return ec.fieldContext_Organization_nonconformities(ctx, field)
+			case "obligations":
+				return ec.fieldContext_Organization_obligations(ctx, field)
+			case "continualImprovements":
+				return ec.fieldContext_Organization_continualImprovements(ctx, field)
+			case "rightsRequests":
+				return ec.fieldContext_Organization_rightsRequests(ctx, field)
+			case "processingActivities":
+				return ec.fieldContext_Organization_processingActivities(ctx, field)
+			case "dataProtectionImpactAssessments":
+				return ec.fieldContext_Organization_dataProtectionImpactAssessments(ctx, field)
+			case "transferImpactAssessments":
+				return ec.fieldContext_Organization_transferImpactAssessments(ctx, field)
+			case "snapshots":
+				return ec.fieldContext_Organization_snapshots(ctx, field)
+			case "trustCenterFiles":
+				return ec.fieldContext_Organization_trustCenterFiles(ctx, field)
+			case "trustCenter":
+				return ec.fieldContext_Organization_trustCenter(ctx, field)
+			case "customDomain":
+				return ec.fieldContext_Organization_customDomain(ctx, field)
+			case "createdAt":
+				return ec.fieldContext_Organization_createdAt(ctx, field)
+			case "updatedAt":
+				return ec.fieldContext_Organization_updatedAt(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type Organization", field.Name)
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _Control_sectionTitle(ctx context.Context, field graphql.CollectedField, obj *types.Control) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
@@ -21951,6 +22064,8 @@ func (ec *executionContext) fieldContext_ControlEdge_node(_ context.Context, fie
 			switch field.Name {
 			case "id":
 				return ec.fieldContext_Control_id(ctx, field)
+			case "organization":
+				return ec.fieldContext_Control_organization(ctx, field)
 			case "sectionTitle":
 				return ec.fieldContext_Control_sectionTitle(ctx, field)
 			case "name":
@@ -51012,6 +51127,8 @@ func (ec *executionContext) fieldContext_UpdateControlPayload_control(_ context.
 			switch field.Name {
 			case "id":
 				return ec.fieldContext_Control_id(ctx, field)
+			case "organization":
+				return ec.fieldContext_Control_organization(ctx, field)
 			case "sectionTitle":
 				return ec.fieldContext_Control_sectionTitle(ctx, field)
 			case "name":
@@ -67994,6 +68111,39 @@ func (ec *executionContext) _Control(ctx context.Context, sel ast.SelectionSet,
 			if out.Values[i] == graphql.Null {
 				atomic.AddUint32(&out.Invalids, 1)
 			}
+		case "organization":
+			field := field
+
+			innerFunc := func(ctx context.Context, _ *graphql.FieldSet) (res graphql.Marshaler) {
+				defer func() {
+					if r := recover(); r != nil {
+						ec.Error(ctx, ec.Recover(ctx, r))
+					}
+				}()
+				res = ec._Control_organization(ctx, field, obj)
+				return res
+			}
+
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
+
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 		case "sectionTitle":
 			out.Values[i] = ec._Control_sectionTitle(ctx, field, obj)
 			if out.Values[i] == graphql.Null {

pkg/server/api/console/v1/types/control.go

@@ -51,6 +51,9 @@ func NewControlEdge(control *coredata.Control, orderField coredata.ControlOrderF
 func NewControl(control *coredata.Control) *Control {
 	return &Control{
 		ID: control.ID,
+		Organization: &Organization{
+			ID: control.OrganizationID,
+		},
 		Framework: &Framework{
 			ID: control.FrameworkID,
 		},

pkg/server/api/console/v1/types/types.go

@@ -168,6 +168,7 @@ type ContinualImprovementFilter struct {
 
 type Control struct {
 	ID                           gid.GID                                `json:"id"`
+	Organization                 *Organization                          `json:"organization,omitempty"`
 	SectionTitle                 string                                 `json:"sectionTitle"`
 	Name                         string                                 `json:"name"`
 	Description                  *string                                `json:"description,omitempty"`

pkg/server/api/mcp/v1/resolver.go

@@ -30,7 +30,34 @@ func (r *Resolver) MustBeAuthorized(ctx context.Context, entityID gid.GID, actio
 		credentialID = &apiKey.ID
 	}
 
-	err := r.iamSvc.LegacyAccessManagementService.Authorize(ctx, user.ID, credentialID, entityID, action)
+	// When API key is used, fall back to legacy system for intersection semantics.
+	// The legacy system handles API key role checking properly.
+	// TODO: Migrate API key authorization to new system.
+	if credentialID != nil {
+		err := r.iamSvc.LegacyAccessManagementService.Authorize(ctx, user.ID, credentialID, entityID, action)
+		if err != nil {
+			panic(err)
+		}
+		return
+	}
+
+	// Map legacy action to new namespaced action
+	newAction, ok := probo.MapLegacyAction(entityID.EntityType(), action)
+	if !ok {
+		// Fall back to legacy system for unmapped actions
+		err := r.iamSvc.LegacyAccessManagementService.Authorize(ctx, user.ID, credentialID, entityID, action)
+		if err != nil {
+			panic(err)
+		}
+		return
+	}
+
+	// Use new authorizer with mapped action
+	err := r.iamSvc.Authorizer.Authorize(ctx, iam.AuthorizeParams{
+		Principal: user.ID,
+		Resource:  entityID,
+		Action:    newAction,
+	})
 	if err != nil {
 		panic(err)
 	}