Fixes after rebase

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/coredata/migrations/20260111T211335Z.sql

@@ -1,8 +1,14 @@
-ALTER TABLE auth_saml_configurations
-    ALTER COLUMN email_domain TYPE CITEXT;
+ALTER TABLE
+    iam_saml_configurations
+ALTER COLUMN
+    email_domain TYPE CITEXT;
 
-ALTER TABLE peoples
-    ALTER COLUMN primary_email_address TYPE CITEXT;
+ALTER TABLE
+    peoples
+ALTER COLUMN
+    primary_email_address TYPE CITEXT;
 
-ALTER TABLE peoples
-    ALTER COLUMN additional_email_addresses TYPE CITEXT[];
+ALTER TABLE
+    peoples
+ALTER COLUMN
+    additional_email_addresses TYPE CITEXT [];

pkg/coredata/rights_requests.go

@@ -28,10 +28,6 @@ import (
 )
 
 type (
-	ErrRightsRequestNotFound struct {
-		Identifier string
-	}
-
 	RightsRequest struct {
 		ID             gid.GID            `db:"id"`
 		OrganizationID gid.GID            `db:"organization_id"`
@@ -49,10 +45,6 @@ type (
 	RightsRequests []*RightsRequest
 )
 
-func (e ErrRightsRequestNotFound) Error() string {
-	return fmt.Sprintf("rights request not found: %q", e.Identifier)
-}
-
 func (rr *RightsRequest) CursorKey(field RightsRequestOrderField) page.CursorKey {
 	switch field {
 	case RightsRequestOrderFieldCreatedAt:
@@ -68,6 +60,21 @@ func (rr *RightsRequest) CursorKey(field RightsRequestOrderField) page.CursorKey
 	panic(fmt.Sprintf("unsupported order by: %s", field))
 }
 
+// AuthorizationAttributes returns the authorization attributes for policy evaluation.
+func (rr *RightsRequest) AuthorizationAttributes(ctx context.Context, conn pg.Conn) (map[string]string, error) {
+	q := `SELECT organization_id FROM rights_requests WHERE id = $1 LIMIT 1;`
+
+	var organizationID gid.GID
+	if err := conn.QueryRow(ctx, q, rr.ID).Scan(&organizationID); err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, ErrResourceNotFound
+		}
+		return nil, fmt.Errorf("cannot query rights request authorization attributes: %w", err)
+	}
+
+	return map[string]string{"organization_id": organizationID.String()}, nil
+}
+
 func (rr *RightsRequest) LoadByID(
 	ctx context.Context,
 	conn pg.Conn,
@@ -108,7 +115,7 @@ LIMIT 1;
 	request, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[RightsRequest])
 	if err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
-			return &ErrRightsRequestNotFound{Identifier: rightsRequestID.String()}
+			return ErrResourceNotFound
 		}
 
 		return fmt.Errorf("cannot collect rights request: %w", err)

pkg/probo/policies.go

@@ -71,12 +71,13 @@ var ViewerPolicy = policy.NewPolicy(
 		ActionObligationGet, ActionObligationList,
 		ActionContinualImprovementGet, ActionContinualImprovementList,
 		ActionProcessingActivityGet, ActionProcessingActivityList,
-		ActionDataProtectionImpactAssessmentGet,
+		ActionDataProtectionImpactAssessmentGet, ActionDataProtectionImpactAssessmentList,
 		ActionTransferImpactAssessmentGet, ActionTransferImpactAssessmentList,
 		ActionSnapshotGet, ActionSnapshotList,
 		ActionMeetingGet, ActionMeetingList,
 		ActionFileGet, ActionFileDownloadUrl,
 		ActionSlackConnectionList,
+		ActionRightsRequestGet, ActionRightsRequestList,
 	).WithSID("entity-read-access").When(organizationCondition),
 
 	policy.Allow(

pkg/server/api/console/v1/v1_resolver.go

@@ -7497,7 +7497,7 @@ func (r *transferImpactAssessmentConnectionResolver) TotalCount(ctx context.Cont
 
 // NdaFileURL is the resolver for the ndaFileUrl field.
 func (r *trustCenterResolver) NdaFileURL(ctx context.Context, obj *types.TrustCenter) (*string, error) {
-	hasPermission, err := r.Permission(ctx, obj, probo.ActionTrustCenterGetNda)
+	hasPermission, err := r.Resolver.Permission(ctx, obj, probo.ActionTrustCenterGetNda)
 	if err != nil {
 		panic(fmt.Errorf("cannot authorize: %w", err))
 	}