392f81bd74
Audited pkg/server/api/console/v1 for resolvers that touched tenant data without calling r.authorize, batchAuthorize, or Permission. Closed every gap so every data-bearing field goes through IAM (and produces an audit log entry when an organization_id is present). * High-severity reads now authorize: accessSourceResolver.Connector and ConnectionStatus, controlResolver.Regulatory/Contractual/RiskAssessment, electronicSignatureResolver.CertificateFileURL/Events, commonThirdPartyResolver.LogoURL, and the proper accessSourceResolver/accessReviewCampaignResolver/auditLogEntryResolver Organization resolvers (authorize + dataloader load, fixing the latent empty-name bug from the previous force-resolver no-op implementations). * TotalCount/DetectedCount aggregates now authorize the matching list action across access review, audit log, statement of applicability, detected tracker, tracker pattern, and tracker resource connections. * queryResolver.CommonThirdParties authorizes against the principal's identity via the new identity-scoped CommonThirdPartyCatalogPolicy. * Add ActionCommonThirdPartyGet/List, ActionElectronicSignatureGet probo action constants; wire ActionElectronicSignatureGet into ViewerPolicy and AuditorPolicy. * Implement AuthorizationAttributes on CommonThirdParty (no org) and ElectronicSignature (organization_id) so the authorizer can resolve attributes for the new actions. * Delete the dead "type AccessReview" GraphQL type (no Go constructor, no frontend reference) and drop its orphan resolver bundle. Signed-off-by: Bryan Frimin <bryan@probo.com>
44 lines
1.3 KiB
Go
44 lines
1.3 KiB
Go
package console_v1
|
|
|
|
// This file will be automatically regenerated based on the schema, any resolver
|
|
// implementations
|
|
// will be copied through when generating and any unknown code will be moved to the end.
|
|
// Code generated by github.com/99designs/gqlgen version v0.17.90
|
|
|
|
import (
|
|
"context"
|
|
"time"
|
|
|
|
"go.gearno.de/kit/log"
|
|
"go.probo.inc/probo/pkg/probo"
|
|
"go.probo.inc/probo/pkg/server/api/console/v1/schema"
|
|
"go.probo.inc/probo/pkg/server/api/console/v1/types"
|
|
"go.probo.inc/probo/pkg/server/gqlutils"
|
|
)
|
|
|
|
// LogoURL is the resolver for the logoUrl field.
|
|
func (r *commonThirdPartyResolver) LogoURL(ctx context.Context, obj *types.CommonThirdParty) (*string, error) {
|
|
if _, err := r.authorize(ctx, obj.ID, probo.ActionCommonThirdPartyGet); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
if obj.LogoFileID == nil {
|
|
return nil, nil
|
|
}
|
|
|
|
logoURL, err := r.thirdParty.GenerateLogoURL(ctx, *obj.LogoFileID, 1*time.Hour)
|
|
if err != nil {
|
|
r.logger.ErrorCtx(ctx, "cannot generate common third party logo URL", log.Error(err))
|
|
return nil, gqlutils.Internal(ctx)
|
|
}
|
|
|
|
return logoURL, nil
|
|
}
|
|
|
|
// CommonThirdParty returns schema.CommonThirdPartyResolver implementation.
|
|
func (r *Resolver) CommonThirdParty() schema.CommonThirdPartyResolver {
|
|
return &commonThirdPartyResolver{r}
|
|
}
|
|
|
|
type commonThirdPartyResolver struct{ *Resolver }
|