6cac6a8775
viewer.enrolledDevices shared DeviceConnection with the admin org list, so totalCount had to authorize with both employee-device:list and device:list. Mirror EmployeeDocumentConnection: a dedicated EmployeeDeviceConnection without totalCount, and keep DeviceConnection.totalCount for the org fleet only. Cover assumed-session device:get IDOR in e2e. Signed-off-by: Ludovic Vielle <ludovic@probo.com>
38 lines
1.0 KiB
GraphQL
38 lines
1.0 KiB
GraphQL
type Viewer {
|
|
id: ID!
|
|
|
|
signableDocuments(
|
|
organizationId: ID!
|
|
first: Int
|
|
after: CursorKey
|
|
last: Int
|
|
before: CursorKey
|
|
orderBy: DocumentOrder
|
|
): EmployeeDocumentConnection! @goField(forceResolver: true)
|
|
|
|
signableDocument(id: ID!): EmployeeDocument @goField(forceResolver: true)
|
|
|
|
approvableDocuments(
|
|
organizationId: ID!
|
|
first: Int
|
|
after: CursorKey
|
|
last: Int
|
|
before: CursorKey
|
|
orderBy: DocumentOrder
|
|
): EmployeeDocumentConnection! @goField(forceResolver: true)
|
|
|
|
approvableDocument(id: ID!): EmployeeDocument @goField(forceResolver: true)
|
|
|
|
enrolledDevices(
|
|
organizationId: ID!
|
|
first: Int
|
|
after: CursorKey
|
|
last: Int
|
|
before: CursorKey
|
|
orderBy: DeviceOrder
|
|
): EmployeeDeviceConnection! @goField(forceResolver: true)
|
|
|
|
# Own-device read for self-enrollment status polling before org assumption.
|
|
enrolledDevice(id: ID!): Device @goField(forceResolver: true)
|
|
}
|