From ea8253ea78544fa2ffa68d0e0c0ed29eeeb1c002 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89mile=20R=C3=A9?= <emile@getprobo.com>
Date: Fri, 13 Mar 2026 12:45:30 +0400
Subject: [PATCH] Add membership provisioning middleware to compliance page
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Émile Ré <emile@getprobo.com>
---
 .../membership_provisioning_middleware.go     | 64 +++++++++++++++++++
 pkg/server/api/trust/v1/nda_directive.go      |  5 --
 pkg/server/api/trust/v1/resolver.go           |  1 +
 3 files changed, 65 insertions(+), 5 deletions(-)
 create mode 100644 pkg/server/api/compliancepage/membership_provisioning_middleware.go

diff --git a/pkg/server/api/compliancepage/membership_provisioning_middleware.go b/pkg/server/api/compliancepage/membership_provisioning_middleware.go
new file mode 100644
index 000000000..c593dae57
--- /dev/null
+++ b/pkg/server/api/compliancepage/membership_provisioning_middleware.go
@@ -0,0 +1,64 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package compliancepage
+
+import (
+	"net/http"
+
+	"github.com/99designs/gqlgen/graphql"
+	"github.com/vektah/gqlparser/v2/gqlerror"
+	"go.gearno.de/kit/httpserver"
+	"go.gearno.de/kit/log"
+	"go.probo.inc/probo/pkg/server/api/authn"
+	"go.probo.inc/probo/pkg/server/gqlutils"
+	"go.probo.inc/probo/pkg/trust"
+)
+
+func NewMembershipProvisioningMiddleware(trustSvc *trust.Service, logger *log.Logger) func(next http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(
+			func(w http.ResponseWriter, r *http.Request) {
+				ctx := r.Context()
+
+				identity := authn.IdentityFromContext(ctx)
+				if identity == nil {
+					next.ServeHTTP(w, r)
+					return
+				}
+
+				compliancePage := CompliancePageFromContext(r.Context())
+
+				if _, err := trustSvc.
+					WithTenant(compliancePage.TenantID).
+					TrustCenterAccesses.
+					EnsureAccess(ctx, compliancePage.ID, identity.ID); err != nil {
+
+					httpserver.RenderJSON(
+						w,
+						http.StatusInternalServerError,
+						&graphql.Response{
+							Errors: gqlerror.List{
+								gqlutils.Internal(ctx),
+							},
+						},
+					)
+					return
+				}
+
+				next.ServeHTTP(w, r)
+			},
+		)
+	}
+}
diff --git a/pkg/server/api/trust/v1/nda_directive.go b/pkg/server/api/trust/v1/nda_directive.go
index aa20b48f2..8c41fda4f 100644
--- a/pkg/server/api/trust/v1/nda_directive.go
+++ b/pkg/server/api/trust/v1/nda_directive.go
@@ -16,7 +16,6 @@ package trust_v1
 
 import (
 	"context"
-	"errors"
 
 	"github.com/99designs/gqlgen/graphql"
 	"go.gearno.de/kit/log"
@@ -47,10 +46,6 @@ func newNDADirective(
 
 		membership, err := trustSvc.GetMembershipByCompliancePageIDAndIdentityID(ctx, compliancePage.ID, identity.ID)
 		if err != nil {
-			if errors.Is(err, trust.ErrMembershipNotFound) {
-				return nil, gqlutils.Unauthenticatedf(ctx, "authentication needed")
-			}
-
 			logger.ErrorCtx(ctx, "cannot get compliance page membership", log.Error(err))
 			return nil, gqlutils.Internal(ctx)
 		}
diff --git a/pkg/server/api/trust/v1/resolver.go b/pkg/server/api/trust/v1/resolver.go
index d0ba8f987..eee7f1893 100644
--- a/pkg/server/api/trust/v1/resolver.go
+++ b/pkg/server/api/trust/v1/resolver.go
@@ -88,6 +88,7 @@ func NewMux(
 
 	r.Use(compliancepage.NewCompliancePagePresenceMiddleware())
 	r.Use(authn.NewSessionMiddleware(iamSvc, cookieConfig))
+	r.Use(compliancepage.NewMembershipProvisioningMiddleware(trustSvc, logger))
 
 	graphqlHandler := NewGraphQLHandler(iamSvc, trustSvc, esignSvc, mailmanSvc, logger, baseURL, cookieConfig, tokenSecret)
 	r.Handle("/graphql", graphqlHandler)