rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add auditor role

Browse Source 
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
This commit is contained in:
Sacha Al Himdani
2025-12-10 14:41:54 +01:00
parent 9e5a775f66
commit f77676c88c
45 changed files with 1256 additions and 796 deletions
Download Patch File Download Diff File Expand all files Collapse all files

99
pkg/authz/permissions.go
View File

@@ -31,6 +31,7 @@ const (
RoleAdmin Role = "ADMIN"
RoleEmployee Role = "EMPLOYEE"
RoleViewer Role = "VIEWER"
RoleAuditor Role = "AUDITOR"
RoleFull Role = "FULL"
)
@@ -257,33 +258,32 @@ const (
)
var (
AllRoles = []Role{RoleOwner, RoleAdmin, RoleEmployee, RoleViewer, RoleFull}
NonEmployeeRoles = []Role{RoleOwner, RoleAdmin, RoleViewer, RoleFull}
EditRoles = []Role{RoleOwner, RoleAdmin, RoleFull}
AllRoles = []Role{RoleOwner, RoleAdmin, RoleEmployee, RoleViewer, RoleAuditor, RoleFull}
EditRoles = []Role{RoleOwner, RoleAdmin, RoleFull}
CoreRoles = []Role{RoleOwner, RoleAdmin, RoleViewer, RoleFull}
NonEmployeeRoles = []Role{RoleOwner, RoleAdmin, RoleViewer, RoleAuditor, RoleFull}
InternalRoles = []Role{RoleOwner, RoleAdmin, RoleViewer, RoleEmployee, RoleFull}
)
var Permissions = map[uint16]map[Action][]Role{
coredata.OrganizationEntityType: {
ActionGet: AllRoles,
ActionListSignableDocuments: AllRoles,
ActionGetLogoUrl: AllRoles,
ActionGet: AllRoles,
ActionGetLogoUrl: AllRoles,
ActionListSignableDocuments: InternalRoles,
ActionListDocuments: NonEmployeeRoles,
ActionGetHorizontalLogoUrl: NonEmployeeRoles,
ActionMemberships: NonEmployeeRoles,
ActionPeoples: NonEmployeeRoles,
ActionTotalCount: NonEmployeeRoles,
ActionListMembers: NonEmployeeRoles,
ActionListInvitations: NonEmployeeRoles,
ActionListSlackConnections: NonEmployeeRoles,
ActionListFrameworks: NonEmployeeRoles,
ActionListControls: NonEmployeeRoles,
ActionListVendors: NonEmployeeRoles,
ActionListPeople: NonEmployeeRoles,
ActionListMeetings: NonEmployeeRoles,
ActionListMeasures: NonEmployeeRoles,
ActionListRisks: NonEmployeeRoles,
ActionListTasks: NonEmployeeRoles,
ActionListAssets: NonEmployeeRoles,
ActionListData: NonEmployeeRoles,
ActionListAudits: NonEmployeeRoles,
@@ -292,13 +292,20 @@ var Permissions = map[uint16]map[Action][]Role{
ActionListContinualImprovements: NonEmployeeRoles,
ActionListProcessingActivities: NonEmployeeRoles,
ActionListSnapshots: NonEmployeeRoles,
ActionListTrustCenterFiles: NonEmployeeRoles,
ActionGetTrustCenter: NonEmployeeRoles,
ActionGetCustomDomain: NonEmployeeRoles,
ActionListSAMLConfigurations: NonEmployeeRoles,
ActionConfirmEmail: NonEmployeeRoles,
ActionAcceptInvitation: NonEmployeeRoles,
ActionListTrustCenterFiles: CoreRoles,
ActionGetTrustCenter: CoreRoles,
ActionMemberships: CoreRoles,
ActionListMembers: CoreRoles,
ActionListInvitations: CoreRoles,
ActionListSlackConnections: CoreRoles,
ActionGetCustomDomain: CoreRoles,
ActionListSAMLConfigurations: CoreRoles,
ActionListMeetings: CoreRoles,
ActionListTasks: CoreRoles,
ActionUpdateOrganization: EditRoles,
ActionDeleteOrganizationHorizontalLogo: EditRoles,
ActionCreateTrustCenter: EditRoles,
@@ -336,11 +343,11 @@ var Permissions = map[uint16]map[Action][]Role{
ActionDeleteOrganization: {RoleOwner},
},
coredata.TrustCenterEntityType: {
ActionGet: NonEmployeeRoles,
ActionGetNdaFileUrl: NonEmployeeRoles,
ActionGetOrganization: NonEmployeeRoles,
ActionListAccesses: NonEmployeeRoles,
ActionListReferences: NonEmployeeRoles,
ActionGet: CoreRoles,
ActionGetNdaFileUrl: CoreRoles,
ActionGetOrganization: CoreRoles,
ActionListAccesses: CoreRoles,
ActionListReferences: CoreRoles,
ActionUpdateTrustCenter: EditRoles,
ActionUploadTrustCenterNDA: EditRoles,
@@ -349,26 +356,26 @@ var Permissions = map[uint16]map[Action][]Role{
ActionCreateTrustCenterReference: EditRoles,
},
coredata.TrustCenterAccessEntityType: {
ActionGet: NonEmployeeRoles,
ActionActiveCount: NonEmployeeRoles,
ActionPendingRequestCount: NonEmployeeRoles,
ActionAvailableDocumentAccesses: NonEmployeeRoles,
ActionGetTrustCenterFile: NonEmployeeRoles,
ActionGetReport: NonEmployeeRoles,
ActionGet: CoreRoles,
ActionActiveCount: CoreRoles,
ActionPendingRequestCount: CoreRoles,
ActionAvailableDocumentAccesses: CoreRoles,
ActionGetTrustCenterFile: CoreRoles,
ActionGetReport: CoreRoles,
ActionUpdateTrustCenterAccess: EditRoles,
ActionDeleteTrustCenterAccess: EditRoles,
},
coredata.TrustCenterReferenceEntityType: {
ActionGet: NonEmployeeRoles,
ActionGetLogoUrl: NonEmployeeRoles,
ActionGet: CoreRoles,
ActionGetLogoUrl: CoreRoles,
ActionUpdateTrustCenterReference: EditRoles,
ActionDeleteTrustCenterReference: EditRoles,
},
coredata.TrustCenterFileEntityType: {
ActionGet: NonEmployeeRoles,
ActionGetFileUrl: NonEmployeeRoles,
ActionGet: CoreRoles,
ActionGetFileUrl: CoreRoles,
ActionUpdateTrustCenterFile: EditRoles,
ActionGetTrustCenterFile: EditRoles,
@@ -487,9 +494,10 @@ var Permissions = map[uint16]map[Action][]Role{
ActionDeleteControlSnapshotMapping: EditRoles,
},
coredata.MeasureEntityType: {
ActionListTasks: CoreRoles,
ActionGet: NonEmployeeRoles,
ActionListEvidences: NonEmployeeRoles,
ActionListTasks: NonEmployeeRoles,
ActionListRisks: NonEmployeeRoles,
ActionListControls: NonEmployeeRoles,
ActionTotalCount: NonEmployeeRoles,
@@ -499,11 +507,11 @@ var Permissions = map[uint16]map[Action][]Role{
ActionUploadMeasureEvidence: EditRoles,
},
coredata.TaskEntityType: {
ActionGet: NonEmployeeRoles,
ActionGetAssignedTo: NonEmployeeRoles,
ActionGetOrganization: NonEmployeeRoles,
ActionGetMeasure: NonEmployeeRoles,
ActionListEvidences: NonEmployeeRoles,
ActionGet: CoreRoles,
ActionGetAssignedTo: CoreRoles,
ActionGetOrganization: CoreRoles,
ActionGetMeasure: CoreRoles,
ActionListEvidences: CoreRoles,
ActionUpdateTask: EditRoles,
ActionDeleteTask: EditRoles,
@@ -513,7 +521,7 @@ var Permissions = map[uint16]map[Action][]Role{
coredata.EvidenceEntityType: {
ActionGet: NonEmployeeRoles,
ActionGetFile: NonEmployeeRoles,
ActionGetTask: NonEmployeeRoles,
ActionGetTask: CoreRoles,
ActionGetMeasure: NonEmployeeRoles,
ActionDeleteEvidence: EditRoles,
@@ -521,7 +529,8 @@ var Permissions = map[uint16]map[Action][]Role{
coredata.DocumentEntityType: {
ActionListSignableDocumentVersion: AllRoles,
ActionGetSigned: AllRoles,
ActionGetSignableDocument: AllRoles,
ActionGetSignableDocument: InternalRoles,
ActionGet: NonEmployeeRoles,
ActionGetOwner: NonEmployeeRoles,
@@ -689,14 +698,14 @@ var Permissions = map[uint16]map[Action][]Role{
ActionDownloadUrl: NonEmployeeRoles,
},
coredata.TrustCenterDocumentAccessEntityType: {
ActionGet: NonEmployeeRoles,
ActionReport: NonEmployeeRoles,
ActionTrustCenterFile: NonEmployeeRoles,
ActionGet: CoreRoles,
ActionReport: CoreRoles,
ActionTrustCenterFile: CoreRoles,
},
coredata.MeetingEntityType: {
ActionGet: NonEmployeeRoles,
ActionGetOrganization: NonEmployeeRoles,
ActionTotalCount: NonEmployeeRoles,
ActionGet: CoreRoles,
ActionGetOrganization: CoreRoles,
ActionTotalCount: CoreRoles,
ActionUpdateMeeting: EditRoles,
ActionDeleteMeeting: EditRoles,

2
pkg/coredata/entity_type_reg.go
View File

@@ -220,7 +220,7 @@ var entityRegistry = map[uint16]EntityInfo{
Table: "trust_center_references",
},
TrustCenterDocumentAccessEntityType: {
Model: "",
Model: "TrustCenterDocumentAccess",
Table: "trust_center_document_accesses",
},
CustomDomainEntityType: {

3
pkg/coredata/member_role.go
View File

@@ -26,6 +26,7 @@ const (
MembershipRoleAdmin MembershipRole = "ADMIN"
MembershipRoleEmployee MembershipRole = "EMPLOYEE"
MembershipRoleViewer MembershipRole = "VIEWER"
MembershipRoleAuditor MembershipRole = "AUDITOR"
)
func (r MembershipRole) String() string {
@@ -52,6 +53,8 @@ func (r *MembershipRole) Scan(value any) error {
*r = MembershipRoleEmployee
case "VIEWER":
*r = MembershipRoleViewer
case "AUDITOR":
*r = MembershipRoleAuditor
default:
return fmt.Errorf("invalid MembershipRole value: %q", s)
}

1
pkg/coredata/migrations/20251210T133440Z.sql Normal file
View File

@@ -0,0 +1 @@
ALTER TYPE authz_role ADD VALUE 'AUDITOR';

2
pkg/server/api/console/v1/schema.graphql
View File

@@ -38,6 +38,7 @@ enum Role {
OWNER
ADMIN
VIEWER
AUDITOR
FULL
}
@@ -98,6 +99,7 @@ enum MembershipRole
EMPLOYEE
@goEnum(value: "go.probo.inc/probo/pkg/coredata.MembershipRoleEmployee")
VIEWER @goEnum(value: "go.probo.inc/probo/pkg/coredata.MembershipRoleViewer")
AUDITOR @goEnum(value: "go.probo.inc/probo/pkg/coredata.MembershipRoleAuditor")
}
enum APIRole @goModel(model: "go.probo.inc/probo/pkg/coredata.APIRole") {

4
pkg/server/api/console/v1/schema/schema.go
View File

@@ -9592,6 +9592,7 @@ enum Role {
OWNER
ADMIN
VIEWER
AUDITOR
FULL
}
@@ -9652,6 +9653,7 @@ enum MembershipRole
EMPLOYEE
@goEnum(value: "go.probo.inc/probo/pkg/coredata.MembershipRoleEmployee")
VIEWER @goEnum(value: "go.probo.inc/probo/pkg/coredata.MembershipRoleViewer")
AUDITOR @goEnum(value: "go.probo.inc/probo/pkg/coredata.MembershipRoleAuditor")
}
enum APIRole @goModel(model: "go.probo.inc/probo/pkg/coredata.APIRole") {
@@ -87915,12 +87917,14 @@ var (
"ADMIN": coredata.MembershipRoleAdmin,
"EMPLOYEE": coredata.MembershipRoleEmployee,
"VIEWER": coredata.MembershipRoleViewer,
"AUDITOR": coredata.MembershipRoleAuditor,
}
marshalNMembershipRole2goᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐMembershipRole = map[coredata.MembershipRole]string{
coredata.MembershipRoleOwner: "OWNER",
coredata.MembershipRoleAdmin: "ADMIN",
coredata.MembershipRoleEmployee: "EMPLOYEE",
coredata.MembershipRoleViewer: "VIEWER",
coredata.MembershipRoleAuditor: "AUDITOR",
}
)

12
pkg/server/api/console/v1/types/types.go
View File

@@ -2537,22 +2537,24 @@ type Viewer struct {
type Role string
const (
RoleOwner Role = "OWNER"
RoleAdmin Role = "ADMIN"
RoleViewer Role = "VIEWER"
RoleFull Role = "FULL"
RoleOwner Role = "OWNER"
RoleAdmin Role = "ADMIN"
RoleViewer Role = "VIEWER"
RoleAuditor Role = "AUDITOR"
RoleFull Role = "FULL"
)
var AllRole = []Role{
RoleOwner,
RoleAdmin,
RoleViewer,
RoleAuditor,
RoleFull,
}
func (e Role) IsValid() bool {
switch e {
case RoleOwner, RoleAdmin, RoleViewer, RoleFull:
case RoleOwner, RoleAdmin, RoleViewer, RoleAuditor, RoleFull:
return true
}
return false