922c0c2db8
Increase sleep time from 10ms to 1100ms to ensure timestamp precision works consistently across databases with second-level granularity. Strengthen AssertTimestampsOnUpdate to require strictly increasing timestamps instead of allowing equal values. Signed-off-by: Bryan Frimin <bryan@getprobo.com>
2986 lines
86 KiB
Go
2986 lines
86 KiB
Go
// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
|
|
//
|
|
// Permission to use, copy, modify, and/or distribute this software for any
|
|
// purpose with or without fee is hereby granted, provided that the above
|
|
// copyright notice and this permission notice appear in all copies.
|
|
//
|
|
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
|
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
|
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
|
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
|
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
|
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
|
// PERFORMANCE OF THIS SOFTWARE.
|
|
|
|
package console_test
|
|
|
|
import (
|
|
"fmt"
|
|
"maps"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"go.probo.inc/probo/e2e/internal/factory"
|
|
"go.probo.inc/probo/e2e/internal/testutil"
|
|
)
|
|
|
|
func TestProcessingActivity_Create(t *testing.T) {
|
|
t.Parallel()
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
|
|
tests := []struct {
|
|
name string
|
|
input map[string]any
|
|
assertField string
|
|
assertValue any
|
|
}{
|
|
{
|
|
name: "with full details",
|
|
input: map[string]any{
|
|
"name": "Customer Data Processing",
|
|
"purpose": "Provide services",
|
|
"lawfulBasis": "CONTRACTUAL_NECESSITY",
|
|
"internationalTransfers": false,
|
|
"specialOrCriminalData": "NO",
|
|
"dataProtectionImpactAssessmentNeeded": "NOT_NEEDED",
|
|
"transferImpactAssessmentNeeded": "NOT_NEEDED",
|
|
"role": "CONTROLLER",
|
|
},
|
|
assertField: "name",
|
|
assertValue: "Customer Data Processing",
|
|
},
|
|
{
|
|
name: "with CONSENT lawful basis",
|
|
input: map[string]any{
|
|
"name": "Consent Processing",
|
|
"lawfulBasis": "CONSENT",
|
|
"specialOrCriminalData": "NO",
|
|
"internationalTransfers": false,
|
|
"dataProtectionImpactAssessmentNeeded": "NOT_NEEDED",
|
|
"transferImpactAssessmentNeeded": "NOT_NEEDED",
|
|
"role": "CONTROLLER",
|
|
},
|
|
assertField: "lawfulBasis",
|
|
assertValue: "CONSENT",
|
|
},
|
|
{
|
|
name: "with LEGITIMATE_INTEREST lawful basis",
|
|
input: map[string]any{
|
|
"name": "Legitimate Interest Processing",
|
|
"lawfulBasis": "LEGITIMATE_INTEREST",
|
|
"specialOrCriminalData": "NO",
|
|
"internationalTransfers": false,
|
|
"dataProtectionImpactAssessmentNeeded": "NOT_NEEDED",
|
|
"transferImpactAssessmentNeeded": "NOT_NEEDED",
|
|
"role": "CONTROLLER",
|
|
},
|
|
assertField: "lawfulBasis",
|
|
assertValue: "LEGITIMATE_INTEREST",
|
|
},
|
|
{
|
|
name: "with international transfers enabled",
|
|
input: map[string]any{
|
|
"name": "International Processing",
|
|
"lawfulBasis": "CONSENT",
|
|
"internationalTransfers": true,
|
|
"specialOrCriminalData": "NO",
|
|
"dataProtectionImpactAssessmentNeeded": "NOT_NEEDED",
|
|
"transferImpactAssessmentNeeded": "NOT_NEEDED",
|
|
"role": "CONTROLLER",
|
|
},
|
|
assertField: "internationalTransfers",
|
|
assertValue: true,
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
query := `
|
|
mutation CreateProcessingActivity($input: CreateProcessingActivityInput!) {
|
|
createProcessingActivity(input: $input) {
|
|
processingActivityEdge {
|
|
node {
|
|
id
|
|
name
|
|
lawfulBasis
|
|
internationalTransfers
|
|
}
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
input := map[string]any{
|
|
"organizationId": owner.GetOrganizationID().String(),
|
|
}
|
|
maps.Copy(input, tt.input)
|
|
|
|
var result struct {
|
|
CreateProcessingActivity struct {
|
|
ProcessingActivityEdge struct {
|
|
Node struct {
|
|
ID string `json:"id"`
|
|
Name string `json:"name"`
|
|
LawfulBasis string `json:"lawfulBasis"`
|
|
InternationalTransfers bool `json:"internationalTransfers"`
|
|
} `json:"node"`
|
|
} `json:"processingActivityEdge"`
|
|
} `json:"createProcessingActivity"`
|
|
}
|
|
|
|
err := owner.Execute(query, map[string]any{"input": input}, &result)
|
|
require.NoError(t, err)
|
|
|
|
node := result.CreateProcessingActivity.ProcessingActivityEdge.Node
|
|
assert.NotEmpty(t, node.ID)
|
|
|
|
switch tt.assertField {
|
|
case "name":
|
|
assert.Equal(t, tt.assertValue, node.Name)
|
|
case "lawfulBasis":
|
|
assert.Equal(t, tt.assertValue, node.LawfulBasis)
|
|
case "internationalTransfers":
|
|
assert.Equal(t, tt.assertValue, node.InternationalTransfers)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestProcessingActivity_Create_Validation(t *testing.T) {
|
|
t.Parallel()
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
|
|
tests := []struct {
|
|
name string
|
|
input map[string]any
|
|
skipOrganization bool
|
|
wantErrorContains string
|
|
}{
|
|
{
|
|
name: "missing organizationId",
|
|
input: map[string]any{
|
|
"name": "Test Processing",
|
|
"lawfulBasis": "CONSENT",
|
|
"specialOrCriminalData": "NO",
|
|
"internationalTransfers": false,
|
|
"dataProtectionImpactAssessmentNeeded": "NOT_NEEDED",
|
|
"transferImpactAssessmentNeeded": "NOT_NEEDED",
|
|
"role": "CONTROLLER",
|
|
},
|
|
skipOrganization: true,
|
|
wantErrorContains: "organizationId",
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
query := `
|
|
mutation CreateProcessingActivity($input: CreateProcessingActivityInput!) {
|
|
createProcessingActivity(input: $input) {
|
|
processingActivityEdge {
|
|
node {
|
|
id
|
|
}
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
input := make(map[string]any)
|
|
if !tt.skipOrganization {
|
|
input["organizationId"] = owner.GetOrganizationID().String()
|
|
}
|
|
maps.Copy(input, tt.input)
|
|
|
|
_, err := owner.Do(query, map[string]any{"input": input})
|
|
require.Error(t, err)
|
|
assert.Contains(t, err.Error(), tt.wantErrorContains)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestProcessingActivity_Update(t *testing.T) {
|
|
t.Parallel()
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
|
|
tests := []struct {
|
|
name string
|
|
setup func() string
|
|
input func(id string) map[string]any
|
|
assertField string
|
|
assertValue any
|
|
}{
|
|
{
|
|
name: "update name",
|
|
setup: func() string {
|
|
return factory.NewProcessingActivity(owner).
|
|
WithName("Processing to Update").
|
|
Create()
|
|
},
|
|
input: func(id string) map[string]any {
|
|
return map[string]any{
|
|
"id": id,
|
|
"name": "Updated Processing Activity",
|
|
}
|
|
},
|
|
assertField: "name",
|
|
assertValue: "Updated Processing Activity",
|
|
},
|
|
{
|
|
name: "update lawful basis",
|
|
setup: func() string {
|
|
return factory.NewProcessingActivity(owner).
|
|
WithName("Lawful Basis Test").
|
|
WithLawfulBasis("CONSENT").
|
|
Create()
|
|
},
|
|
input: func(id string) map[string]any {
|
|
return map[string]any{"id": id, "lawfulBasis": "LEGITIMATE_INTEREST"}
|
|
},
|
|
assertField: "lawfulBasis",
|
|
assertValue: "LEGITIMATE_INTEREST",
|
|
},
|
|
{
|
|
name: "enable international transfers",
|
|
setup: func() string {
|
|
return factory.NewProcessingActivity(owner).
|
|
WithName("International Test").
|
|
WithInternationalTransfers(false).
|
|
Create()
|
|
},
|
|
input: func(id string) map[string]any {
|
|
return map[string]any{"id": id, "internationalTransfers": true}
|
|
},
|
|
assertField: "internationalTransfers",
|
|
assertValue: true,
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
paID := tt.setup()
|
|
|
|
query := `
|
|
mutation UpdateProcessingActivity($input: UpdateProcessingActivityInput!) {
|
|
updateProcessingActivity(input: $input) {
|
|
processingActivity {
|
|
id
|
|
name
|
|
lawfulBasis
|
|
internationalTransfers
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
var result struct {
|
|
UpdateProcessingActivity struct {
|
|
ProcessingActivity struct {
|
|
ID string `json:"id"`
|
|
Name string `json:"name"`
|
|
LawfulBasis string `json:"lawfulBasis"`
|
|
InternationalTransfers bool `json:"internationalTransfers"`
|
|
} `json:"processingActivity"`
|
|
} `json:"updateProcessingActivity"`
|
|
}
|
|
|
|
err := owner.Execute(query, map[string]any{"input": tt.input(paID)}, &result)
|
|
require.NoError(t, err)
|
|
|
|
pa := result.UpdateProcessingActivity.ProcessingActivity
|
|
switch tt.assertField {
|
|
case "name":
|
|
assert.Equal(t, tt.assertValue, pa.Name)
|
|
case "lawfulBasis":
|
|
assert.Equal(t, tt.assertValue, pa.LawfulBasis)
|
|
case "internationalTransfers":
|
|
assert.Equal(t, tt.assertValue, pa.InternationalTransfers)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestProcessingActivity_Update_Validation(t *testing.T) {
|
|
t.Parallel()
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
|
|
tests := []struct {
|
|
name string
|
|
setup func() string
|
|
input func(id string) map[string]any
|
|
wantErrorContains string
|
|
}{
|
|
{
|
|
name: "invalid ID format",
|
|
setup: func() string { return "invalid-id-format" },
|
|
input: func(id string) map[string]any {
|
|
return map[string]any{"id": id, "name": "Test"}
|
|
},
|
|
wantErrorContains: "base64",
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
paID := tt.setup()
|
|
|
|
query := `
|
|
mutation UpdateProcessingActivity($input: UpdateProcessingActivityInput!) {
|
|
updateProcessingActivity(input: $input) {
|
|
processingActivity {
|
|
id
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
_, err := owner.Do(query, map[string]any{"input": tt.input(paID)})
|
|
require.Error(t, err)
|
|
assert.Contains(t, err.Error(), tt.wantErrorContains)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestProcessingActivity_Delete(t *testing.T) {
|
|
t.Parallel()
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
|
|
t.Run("delete existing processing activity", func(t *testing.T) {
|
|
paID := factory.NewProcessingActivity(owner).WithName("PA to Delete").Create()
|
|
|
|
query := `
|
|
mutation DeleteProcessingActivity($input: DeleteProcessingActivityInput!) {
|
|
deleteProcessingActivity(input: $input) {
|
|
deletedProcessingActivityId
|
|
}
|
|
}
|
|
`
|
|
|
|
var result struct {
|
|
DeleteProcessingActivity struct {
|
|
DeletedProcessingActivityID string `json:"deletedProcessingActivityId"`
|
|
} `json:"deleteProcessingActivity"`
|
|
}
|
|
|
|
err := owner.Execute(query, map[string]any{
|
|
"input": map[string]any{"processingActivityId": paID},
|
|
}, &result)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, paID, result.DeleteProcessingActivity.DeletedProcessingActivityID)
|
|
})
|
|
}
|
|
|
|
func TestProcessingActivity_Delete_Validation(t *testing.T) {
|
|
t.Parallel()
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
|
|
tests := []struct {
|
|
name string
|
|
paID string
|
|
wantErrorContains string
|
|
}{
|
|
{
|
|
name: "invalid ID format",
|
|
paID: "invalid-id-format",
|
|
wantErrorContains: "base64",
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
query := `
|
|
mutation DeleteProcessingActivity($input: DeleteProcessingActivityInput!) {
|
|
deleteProcessingActivity(input: $input) {
|
|
deletedProcessingActivityId
|
|
}
|
|
}
|
|
`
|
|
|
|
_, err := owner.Do(query, map[string]any{
|
|
"input": map[string]any{"processingActivityId": tt.paID},
|
|
})
|
|
require.Error(t, err)
|
|
assert.Contains(t, err.Error(), tt.wantErrorContains)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestProcessingActivity_List(t *testing.T) {
|
|
t.Parallel()
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
|
|
paNames := []string{"Processing A", "Processing B", "Processing C"}
|
|
for _, name := range paNames {
|
|
factory.NewProcessingActivity(owner).WithName(name).Create()
|
|
}
|
|
|
|
query := `
|
|
query GetProcessingActivities($id: ID!) {
|
|
node(id: $id) {
|
|
... on Organization {
|
|
processingActivities(first: 10) {
|
|
edges {
|
|
node {
|
|
id
|
|
name
|
|
}
|
|
}
|
|
totalCount
|
|
}
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
var result struct {
|
|
Node struct {
|
|
ProcessingActivities struct {
|
|
Edges []struct {
|
|
Node struct {
|
|
ID string `json:"id"`
|
|
Name string `json:"name"`
|
|
} `json:"node"`
|
|
} `json:"edges"`
|
|
TotalCount int `json:"totalCount"`
|
|
} `json:"processingActivities"`
|
|
} `json:"node"`
|
|
}
|
|
|
|
err := owner.Execute(query, map[string]any{
|
|
"id": owner.GetOrganizationID().String(),
|
|
}, &result)
|
|
require.NoError(t, err)
|
|
assert.GreaterOrEqual(t, result.Node.ProcessingActivities.TotalCount, 3)
|
|
}
|
|
|
|
func TestProcessingActivity_Query(t *testing.T) {
|
|
t.Parallel()
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
|
|
t.Run("query with non-existent ID returns error", func(t *testing.T) {
|
|
query := `
|
|
query($id: ID!) {
|
|
node(id: $id) {
|
|
... on ProcessingActivity {
|
|
id
|
|
name
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
err := owner.ExecuteShouldFail(query, map[string]any{
|
|
"id": "V0wtM0tMNmJBQ1lBQUFBQUFackhLSTJfbXJJRUFZVXo",
|
|
})
|
|
require.Error(t, err, "Non-existent ID should return error")
|
|
})
|
|
}
|
|
|
|
func TestProcessingActivity_Timestamps(t *testing.T) {
|
|
t.Parallel()
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
|
|
t.Run("createdAt and updatedAt are set on create", func(t *testing.T) {
|
|
beforeCreate := time.Now().Add(-time.Second)
|
|
|
|
query := `
|
|
mutation CreateProcessingActivity($input: CreateProcessingActivityInput!) {
|
|
createProcessingActivity(input: $input) {
|
|
processingActivityEdge {
|
|
node {
|
|
id
|
|
createdAt
|
|
updatedAt
|
|
}
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
var result struct {
|
|
CreateProcessingActivity struct {
|
|
ProcessingActivityEdge struct {
|
|
Node struct {
|
|
ID string `json:"id"`
|
|
CreatedAt time.Time `json:"createdAt"`
|
|
UpdatedAt time.Time `json:"updatedAt"`
|
|
} `json:"node"`
|
|
} `json:"processingActivityEdge"`
|
|
} `json:"createProcessingActivity"`
|
|
}
|
|
|
|
err := owner.Execute(query, map[string]any{
|
|
"input": map[string]any{
|
|
"organizationId": owner.GetOrganizationID().String(),
|
|
"name": "Timestamp Test PA",
|
|
"lawfulBasis": "CONSENT",
|
|
"specialOrCriminalData": "NO",
|
|
"internationalTransfers": false,
|
|
"dataProtectionImpactAssessmentNeeded": "NOT_NEEDED",
|
|
"transferImpactAssessmentNeeded": "NOT_NEEDED",
|
|
"role": "CONTROLLER",
|
|
},
|
|
}, &result)
|
|
require.NoError(t, err)
|
|
|
|
node := result.CreateProcessingActivity.ProcessingActivityEdge.Node
|
|
testutil.AssertTimestampsOnCreate(t, node.CreatedAt, node.UpdatedAt, beforeCreate)
|
|
})
|
|
|
|
t.Run("updatedAt changes on update", func(t *testing.T) {
|
|
paID := factory.NewProcessingActivity(owner).WithName("Timestamp Update Test").Create()
|
|
|
|
getQuery := `
|
|
query($id: ID!) {
|
|
node(id: $id) {
|
|
... on ProcessingActivity {
|
|
createdAt
|
|
updatedAt
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
var getResult struct {
|
|
Node struct {
|
|
CreatedAt time.Time `json:"createdAt"`
|
|
UpdatedAt time.Time `json:"updatedAt"`
|
|
} `json:"node"`
|
|
}
|
|
|
|
err := owner.Execute(getQuery, map[string]any{"id": paID}, &getResult)
|
|
require.NoError(t, err)
|
|
|
|
initialCreatedAt := getResult.Node.CreatedAt
|
|
initialUpdatedAt := getResult.Node.UpdatedAt
|
|
|
|
// Wait long enough for timestamp to change (database may have second precision)
|
|
time.Sleep(1100 * time.Millisecond)
|
|
|
|
updateQuery := `
|
|
mutation UpdateProcessingActivity($input: UpdateProcessingActivityInput!) {
|
|
updateProcessingActivity(input: $input) {
|
|
processingActivity {
|
|
createdAt
|
|
updatedAt
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
var updateResult struct {
|
|
UpdateProcessingActivity struct {
|
|
ProcessingActivity struct {
|
|
CreatedAt time.Time `json:"createdAt"`
|
|
UpdatedAt time.Time `json:"updatedAt"`
|
|
} `json:"processingActivity"`
|
|
} `json:"updateProcessingActivity"`
|
|
}
|
|
|
|
err = owner.Execute(updateQuery, map[string]any{
|
|
"input": map[string]any{
|
|
"id": paID,
|
|
"name": "Updated Timestamp Test",
|
|
},
|
|
}, &updateResult)
|
|
require.NoError(t, err)
|
|
|
|
pa := updateResult.UpdateProcessingActivity.ProcessingActivity
|
|
testutil.AssertTimestampsOnUpdate(t, pa.CreatedAt, pa.UpdatedAt, initialCreatedAt, initialUpdatedAt)
|
|
})
|
|
}
|
|
|
|
func TestProcessingActivity_SubResolvers(t *testing.T) {
|
|
t.Parallel()
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
paID := factory.NewProcessingActivity(owner).WithName("SubResolver Test PA").Create()
|
|
|
|
t.Run("organization sub-resolver", func(t *testing.T) {
|
|
query := `
|
|
query($id: ID!) {
|
|
node(id: $id) {
|
|
... on ProcessingActivity {
|
|
id
|
|
organization {
|
|
id
|
|
name
|
|
}
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
var result struct {
|
|
Node struct {
|
|
ID string `json:"id"`
|
|
Organization struct {
|
|
ID string `json:"id"`
|
|
Name string `json:"name"`
|
|
} `json:"organization"`
|
|
} `json:"node"`
|
|
}
|
|
|
|
err := owner.Execute(query, map[string]any{"id": paID}, &result)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, owner.GetOrganizationID().String(), result.Node.Organization.ID)
|
|
assert.NotEmpty(t, result.Node.Organization.Name)
|
|
})
|
|
}
|
|
|
|
func TestProcessingActivity_RBAC(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
t.Run("create", func(t *testing.T) {
|
|
t.Run("owner can create", func(t *testing.T) {
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
|
|
_, err := owner.Do(`
|
|
mutation CreateProcessingActivity($input: CreateProcessingActivityInput!) {
|
|
createProcessingActivity(input: $input) {
|
|
processingActivityEdge { node { id } }
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"organizationId": owner.GetOrganizationID().String(),
|
|
"name": "RBAC Test PA",
|
|
"lawfulBasis": "CONSENT",
|
|
"specialOrCriminalData": "NO",
|
|
"internationalTransfers": false,
|
|
"dataProtectionImpactAssessmentNeeded": "NOT_NEEDED",
|
|
"transferImpactAssessmentNeeded": "NOT_NEEDED",
|
|
"role": "CONTROLLER",
|
|
},
|
|
})
|
|
require.NoError(t, err, "owner should be able to create processing activity")
|
|
})
|
|
|
|
t.Run("admin can create", func(t *testing.T) {
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
admin := testutil.NewClientInOrg(t, testutil.RoleAdmin, owner)
|
|
|
|
_, err := admin.Do(`
|
|
mutation CreateProcessingActivity($input: CreateProcessingActivityInput!) {
|
|
createProcessingActivity(input: $input) {
|
|
processingActivityEdge { node { id } }
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"organizationId": admin.GetOrganizationID().String(),
|
|
"name": "RBAC Test PA",
|
|
"lawfulBasis": "CONSENT",
|
|
"specialOrCriminalData": "NO",
|
|
"internationalTransfers": false,
|
|
"dataProtectionImpactAssessmentNeeded": "NOT_NEEDED",
|
|
"transferImpactAssessmentNeeded": "NOT_NEEDED",
|
|
"role": "CONTROLLER",
|
|
},
|
|
})
|
|
require.NoError(t, err, "admin should be able to create processing activity")
|
|
})
|
|
|
|
t.Run("viewer cannot create", func(t *testing.T) {
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
viewer := testutil.NewClientInOrg(t, testutil.RoleViewer, owner)
|
|
|
|
_, err := viewer.Do(`
|
|
mutation CreateProcessingActivity($input: CreateProcessingActivityInput!) {
|
|
createProcessingActivity(input: $input) {
|
|
processingActivityEdge { node { id } }
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"organizationId": viewer.GetOrganizationID().String(),
|
|
"name": "RBAC Test PA",
|
|
"lawfulBasis": "CONSENT",
|
|
"specialOrCriminalData": "NO",
|
|
"internationalTransfers": false,
|
|
"dataProtectionImpactAssessmentNeeded": "NOT_NEEDED",
|
|
"transferImpactAssessmentNeeded": "NOT_NEEDED",
|
|
"role": "CONTROLLER",
|
|
},
|
|
})
|
|
testutil.RequireForbiddenError(t, err, "viewer should not be able to create processing activity")
|
|
})
|
|
})
|
|
|
|
t.Run("update", func(t *testing.T) {
|
|
t.Run("owner can update", func(t *testing.T) {
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
paID := factory.NewProcessingActivity(owner).WithName("RBAC Update Test").Create()
|
|
|
|
_, err := owner.Do(`
|
|
mutation UpdateProcessingActivity($input: UpdateProcessingActivityInput!) {
|
|
updateProcessingActivity(input: $input) {
|
|
processingActivity { id }
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"id": paID,
|
|
"name": "Updated by Owner",
|
|
},
|
|
})
|
|
require.NoError(t, err, "owner should be able to update processing activity")
|
|
})
|
|
|
|
t.Run("admin can update", func(t *testing.T) {
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
admin := testutil.NewClientInOrg(t, testutil.RoleAdmin, owner)
|
|
paID := factory.NewProcessingActivity(owner).WithName("RBAC Update Test").Create()
|
|
|
|
_, err := admin.Do(`
|
|
mutation UpdateProcessingActivity($input: UpdateProcessingActivityInput!) {
|
|
updateProcessingActivity(input: $input) {
|
|
processingActivity { id }
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"id": paID,
|
|
"name": "Updated by Admin",
|
|
},
|
|
})
|
|
require.NoError(t, err, "admin should be able to update processing activity")
|
|
})
|
|
|
|
t.Run("viewer cannot update", func(t *testing.T) {
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
viewer := testutil.NewClientInOrg(t, testutil.RoleViewer, owner)
|
|
paID := factory.NewProcessingActivity(owner).WithName("RBAC Update Test").Create()
|
|
|
|
_, err := viewer.Do(`
|
|
mutation UpdateProcessingActivity($input: UpdateProcessingActivityInput!) {
|
|
updateProcessingActivity(input: $input) {
|
|
processingActivity { id }
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"id": paID,
|
|
"name": "Updated by Viewer",
|
|
},
|
|
})
|
|
testutil.RequireForbiddenError(t, err, "viewer should not be able to update processing activity")
|
|
})
|
|
})
|
|
|
|
t.Run("delete", func(t *testing.T) {
|
|
t.Run("owner can delete", func(t *testing.T) {
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
paID := factory.NewProcessingActivity(owner).WithName("RBAC Delete Test").Create()
|
|
|
|
_, err := owner.Do(`
|
|
mutation DeleteProcessingActivity($input: DeleteProcessingActivityInput!) {
|
|
deleteProcessingActivity(input: $input) {
|
|
deletedProcessingActivityId
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{"processingActivityId": paID},
|
|
})
|
|
require.NoError(t, err, "owner should be able to delete processing activity")
|
|
})
|
|
|
|
t.Run("admin can delete", func(t *testing.T) {
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
admin := testutil.NewClientInOrg(t, testutil.RoleAdmin, owner)
|
|
paID := factory.NewProcessingActivity(owner).WithName("RBAC Delete Test").Create()
|
|
|
|
_, err := admin.Do(`
|
|
mutation DeleteProcessingActivity($input: DeleteProcessingActivityInput!) {
|
|
deleteProcessingActivity(input: $input) {
|
|
deletedProcessingActivityId
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{"processingActivityId": paID},
|
|
})
|
|
require.NoError(t, err, "admin should be able to delete processing activity")
|
|
})
|
|
|
|
t.Run("viewer cannot delete", func(t *testing.T) {
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
viewer := testutil.NewClientInOrg(t, testutil.RoleViewer, owner)
|
|
paID := factory.NewProcessingActivity(owner).WithName("RBAC Delete Test").Create()
|
|
|
|
_, err := viewer.Do(`
|
|
mutation DeleteProcessingActivity($input: DeleteProcessingActivityInput!) {
|
|
deleteProcessingActivity(input: $input) {
|
|
deletedProcessingActivityId
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{"processingActivityId": paID},
|
|
})
|
|
testutil.RequireForbiddenError(t, err, "viewer should not be able to delete processing activity")
|
|
})
|
|
})
|
|
|
|
t.Run("read", func(t *testing.T) {
|
|
t.Run("owner can read", func(t *testing.T) {
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
paID := factory.NewProcessingActivity(owner).WithName("RBAC Read Test").Create()
|
|
|
|
var result struct {
|
|
Node *struct {
|
|
ID string `json:"id"`
|
|
Name string `json:"name"`
|
|
} `json:"node"`
|
|
}
|
|
|
|
err := owner.Execute(`
|
|
query($id: ID!) {
|
|
node(id: $id) {
|
|
... on ProcessingActivity { id name }
|
|
}
|
|
}
|
|
`, map[string]any{"id": paID}, &result)
|
|
require.NoError(t, err, "owner should be able to read processing activity")
|
|
require.NotNil(t, result.Node, "owner should receive processing activity data")
|
|
})
|
|
|
|
t.Run("admin can read", func(t *testing.T) {
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
admin := testutil.NewClientInOrg(t, testutil.RoleAdmin, owner)
|
|
paID := factory.NewProcessingActivity(owner).WithName("RBAC Read Test").Create()
|
|
|
|
var result struct {
|
|
Node *struct {
|
|
ID string `json:"id"`
|
|
Name string `json:"name"`
|
|
} `json:"node"`
|
|
}
|
|
|
|
err := admin.Execute(`
|
|
query($id: ID!) {
|
|
node(id: $id) {
|
|
... on ProcessingActivity { id name }
|
|
}
|
|
}
|
|
`, map[string]any{"id": paID}, &result)
|
|
require.NoError(t, err, "admin should be able to read processing activity")
|
|
require.NotNil(t, result.Node, "admin should receive processing activity data")
|
|
})
|
|
|
|
t.Run("viewer can read", func(t *testing.T) {
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
viewer := testutil.NewClientInOrg(t, testutil.RoleViewer, owner)
|
|
paID := factory.NewProcessingActivity(owner).WithName("RBAC Read Test").Create()
|
|
|
|
var result struct {
|
|
Node *struct {
|
|
ID string `json:"id"`
|
|
Name string `json:"name"`
|
|
} `json:"node"`
|
|
}
|
|
|
|
err := viewer.Execute(`
|
|
query($id: ID!) {
|
|
node(id: $id) {
|
|
... on ProcessingActivity { id name }
|
|
}
|
|
}
|
|
`, map[string]any{"id": paID}, &result)
|
|
require.NoError(t, err, "viewer should be able to read processing activity")
|
|
require.NotNil(t, result.Node, "viewer should receive processing activity data")
|
|
})
|
|
})
|
|
}
|
|
|
|
func TestProcessingActivity_Pagination(t *testing.T) {
|
|
t.Parallel()
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
|
|
for i := range 5 {
|
|
factory.NewProcessingActivity(owner).
|
|
WithName(fmt.Sprintf("Pagination PA %d", i)).
|
|
Create()
|
|
}
|
|
|
|
t.Run("first/after pagination", func(t *testing.T) {
|
|
query := `
|
|
query($id: ID!) {
|
|
node(id: $id) {
|
|
... on Organization {
|
|
processingActivities(first: 2) {
|
|
edges {
|
|
node { id name }
|
|
cursor
|
|
}
|
|
pageInfo {
|
|
hasNextPage
|
|
hasPreviousPage
|
|
startCursor
|
|
endCursor
|
|
}
|
|
totalCount
|
|
}
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
var result struct {
|
|
Node struct {
|
|
ProcessingActivities struct {
|
|
Edges []struct {
|
|
Node struct {
|
|
ID string `json:"id"`
|
|
Name string `json:"name"`
|
|
} `json:"node"`
|
|
Cursor string `json:"cursor"`
|
|
} `json:"edges"`
|
|
PageInfo testutil.PageInfo `json:"pageInfo"`
|
|
TotalCount int `json:"totalCount"`
|
|
} `json:"processingActivities"`
|
|
} `json:"node"`
|
|
}
|
|
|
|
err := owner.Execute(
|
|
query,
|
|
map[string]any{
|
|
"id": owner.GetOrganizationID().String(),
|
|
},
|
|
&result,
|
|
)
|
|
require.NoError(t, err)
|
|
|
|
testutil.AssertFirstPage(t, len(result.Node.ProcessingActivities.Edges), result.Node.ProcessingActivities.PageInfo, 2, true)
|
|
assert.GreaterOrEqual(t, result.Node.ProcessingActivities.TotalCount, 5)
|
|
|
|
testutil.AssertHasMorePages(t, result.Node.ProcessingActivities.PageInfo)
|
|
queryAfter := `
|
|
query($id: ID!, $after: CursorKey) {
|
|
node(id: $id) {
|
|
... on Organization {
|
|
processingActivities(first: 2, after: $after) {
|
|
edges {
|
|
node { id name }
|
|
}
|
|
pageInfo {
|
|
hasNextPage
|
|
hasPreviousPage
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
var resultAfter struct {
|
|
Node struct {
|
|
ProcessingActivities struct {
|
|
Edges []struct {
|
|
Node struct {
|
|
ID string `json:"id"`
|
|
Name string `json:"name"`
|
|
} `json:"node"`
|
|
} `json:"edges"`
|
|
PageInfo testutil.PageInfo `json:"pageInfo"`
|
|
} `json:"processingActivities"`
|
|
} `json:"node"`
|
|
}
|
|
|
|
err = owner.Execute(queryAfter, map[string]any{
|
|
"id": owner.GetOrganizationID().String(),
|
|
"after": *result.Node.ProcessingActivities.PageInfo.EndCursor,
|
|
}, &resultAfter)
|
|
require.NoError(t, err)
|
|
|
|
testutil.AssertMiddlePage(t, len(resultAfter.Node.ProcessingActivities.Edges), resultAfter.Node.ProcessingActivities.PageInfo, 2)
|
|
})
|
|
|
|
t.Run("last/before pagination", func(t *testing.T) {
|
|
query := `
|
|
query($id: ID!) {
|
|
node(id: $id) {
|
|
... on Organization {
|
|
processingActivities(last: 2) {
|
|
edges {
|
|
node { id name }
|
|
}
|
|
pageInfo {
|
|
hasNextPage
|
|
hasPreviousPage
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
var result struct {
|
|
Node struct {
|
|
ProcessingActivities struct {
|
|
Edges []struct {
|
|
Node struct {
|
|
ID string `json:"id"`
|
|
Name string `json:"name"`
|
|
} `json:"node"`
|
|
} `json:"edges"`
|
|
PageInfo testutil.PageInfo `json:"pageInfo"`
|
|
} `json:"processingActivities"`
|
|
} `json:"node"`
|
|
}
|
|
|
|
err := owner.Execute(query, map[string]any{
|
|
"id": owner.GetOrganizationID().String(),
|
|
}, &result)
|
|
require.NoError(t, err)
|
|
|
|
testutil.AssertLastPage(t, len(result.Node.ProcessingActivities.Edges), result.Node.ProcessingActivities.PageInfo, 2, true)
|
|
})
|
|
}
|
|
|
|
func TestProcessingActivity_TenantIsolation(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
org1Owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
org2Owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
|
|
paID := factory.NewProcessingActivity(org1Owner).WithName("Org1 PA").Create()
|
|
|
|
t.Run("cannot read processing activity from another organization", func(t *testing.T) {
|
|
query := `
|
|
query($id: ID!) {
|
|
node(id: $id) {
|
|
... on ProcessingActivity {
|
|
id
|
|
name
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
var result struct {
|
|
Node *struct {
|
|
ID string `json:"id"`
|
|
Name string `json:"name"`
|
|
} `json:"node"`
|
|
}
|
|
|
|
err := org2Owner.Execute(query, map[string]any{"id": paID}, &result)
|
|
testutil.AssertNodeNotAccessible(t, err, result.Node == nil, "processing activity")
|
|
})
|
|
|
|
t.Run("cannot update processing activity from another organization", func(t *testing.T) {
|
|
query := `
|
|
mutation UpdateProcessingActivity($input: UpdateProcessingActivityInput!) {
|
|
updateProcessingActivity(input: $input) {
|
|
processingActivity { id }
|
|
}
|
|
}
|
|
`
|
|
|
|
_, err := org2Owner.Do(query, map[string]any{
|
|
"input": map[string]any{
|
|
"id": paID,
|
|
"name": "Hijacked PA",
|
|
},
|
|
})
|
|
require.Error(t, err, "Should not be able to update processing activity from another org")
|
|
})
|
|
|
|
t.Run("cannot delete processing activity from another organization", func(t *testing.T) {
|
|
query := `
|
|
mutation DeleteProcessingActivity($input: DeleteProcessingActivityInput!) {
|
|
deleteProcessingActivity(input: $input) {
|
|
deletedProcessingActivityId
|
|
}
|
|
}
|
|
`
|
|
|
|
_, err := org2Owner.Do(query, map[string]any{
|
|
"input": map[string]any{
|
|
"processingActivityId": paID,
|
|
},
|
|
})
|
|
require.Error(t, err, "Should not be able to delete processing activity from another org")
|
|
})
|
|
|
|
t.Run("cannot list processing activities from another organization", func(t *testing.T) {
|
|
query := `
|
|
query($id: ID!) {
|
|
node(id: $id) {
|
|
... on Organization {
|
|
processingActivities(first: 100) {
|
|
edges {
|
|
node {
|
|
id
|
|
name
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
var result struct {
|
|
Node struct {
|
|
ProcessingActivities struct {
|
|
Edges []struct {
|
|
Node struct {
|
|
ID string `json:"id"`
|
|
Name string `json:"name"`
|
|
} `json:"node"`
|
|
} `json:"edges"`
|
|
} `json:"processingActivities"`
|
|
} `json:"node"`
|
|
}
|
|
|
|
err := org2Owner.Execute(query, map[string]any{
|
|
"id": org1Owner.GetOrganizationID().String(),
|
|
}, &result)
|
|
|
|
if err == nil {
|
|
for _, edge := range result.Node.ProcessingActivities.Edges {
|
|
assert.NotEqual(t, paID, edge.Node.ID, "Should not see processing activity from another org")
|
|
}
|
|
}
|
|
})
|
|
}
|
|
|
|
func TestProcessingActivity_Ordering(t *testing.T) {
|
|
t.Parallel()
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
|
|
factory.NewProcessingActivity(owner).WithName("AAA Order Test").Create()
|
|
factory.NewProcessingActivity(owner).WithName("ZZZ Order Test").Create()
|
|
|
|
t.Run("order by created_at descending", func(t *testing.T) {
|
|
query := `
|
|
query($id: ID!, $orderBy: ProcessingActivityOrder) {
|
|
node(id: $id) {
|
|
... on Organization {
|
|
processingActivities(first: 100, orderBy: $orderBy) {
|
|
edges {
|
|
node {
|
|
id
|
|
createdAt
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
var result struct {
|
|
Node struct {
|
|
ProcessingActivities struct {
|
|
Edges []struct {
|
|
Node struct {
|
|
ID string `json:"id"`
|
|
CreatedAt time.Time `json:"createdAt"`
|
|
} `json:"node"`
|
|
} `json:"edges"`
|
|
} `json:"processingActivities"`
|
|
} `json:"node"`
|
|
}
|
|
|
|
err := owner.Execute(query, map[string]any{
|
|
"id": owner.GetOrganizationID().String(),
|
|
"orderBy": map[string]any{
|
|
"field": "CREATED_AT",
|
|
"direction": "DESC",
|
|
},
|
|
}, &result)
|
|
require.NoError(t, err)
|
|
|
|
times := make([]time.Time, len(result.Node.ProcessingActivities.Edges))
|
|
for i, edge := range result.Node.ProcessingActivities.Edges {
|
|
times[i] = edge.Node.CreatedAt
|
|
}
|
|
testutil.AssertTimesOrderedDescending(t, times, "createdAt")
|
|
})
|
|
}
|
|
|
|
func TestProcessingActivity_LawfulBasis(t *testing.T) {
|
|
t.Parallel()
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
|
|
lawfulBases := []string{"CONSENT", "CONTRACTUAL_NECESSITY", "LEGITIMATE_INTEREST"}
|
|
|
|
for _, basis := range lawfulBases {
|
|
t.Run(basis, func(t *testing.T) {
|
|
paID := factory.NewProcessingActivity(owner).
|
|
WithName(fmt.Sprintf("PA Lawful Basis %s", basis)).
|
|
WithLawfulBasis(basis).
|
|
Create()
|
|
|
|
query := `
|
|
query($id: ID!) {
|
|
node(id: $id) {
|
|
... on ProcessingActivity {
|
|
id
|
|
lawfulBasis
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
var result struct {
|
|
Node struct {
|
|
ID string `json:"id"`
|
|
LawfulBasis string `json:"lawfulBasis"`
|
|
} `json:"node"`
|
|
}
|
|
|
|
err := owner.Execute(query, map[string]any{"id": paID}, &result)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, basis, result.Node.LawfulBasis)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestProcessingActivity_Role(t *testing.T) {
|
|
t.Parallel()
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
|
|
roles := []string{"CONTROLLER", "PROCESSOR"}
|
|
|
|
for _, role := range roles {
|
|
t.Run(role, func(t *testing.T) {
|
|
query := `
|
|
mutation CreateProcessingActivity($input: CreateProcessingActivityInput!) {
|
|
createProcessingActivity(input: $input) {
|
|
processingActivityEdge {
|
|
node {
|
|
id
|
|
role
|
|
}
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
var result struct {
|
|
CreateProcessingActivity struct {
|
|
ProcessingActivityEdge struct {
|
|
Node struct {
|
|
ID string `json:"id"`
|
|
Role string `json:"role"`
|
|
} `json:"node"`
|
|
} `json:"processingActivityEdge"`
|
|
} `json:"createProcessingActivity"`
|
|
}
|
|
|
|
err := owner.Execute(query, map[string]any{
|
|
"input": map[string]any{
|
|
"organizationId": owner.GetOrganizationID().String(),
|
|
"name": fmt.Sprintf("PA Role %s", role),
|
|
"lawfulBasis": "CONSENT",
|
|
"specialOrCriminalData": "NO",
|
|
"internationalTransfers": false,
|
|
"dataProtectionImpactAssessmentNeeded": "NOT_NEEDED",
|
|
"transferImpactAssessmentNeeded": "NOT_NEEDED",
|
|
"role": role,
|
|
},
|
|
}, &result)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, role, result.CreateProcessingActivity.ProcessingActivityEdge.Node.Role)
|
|
})
|
|
}
|
|
|
|
t.Run("update role", func(t *testing.T) {
|
|
paID := factory.NewProcessingActivity(owner).
|
|
WithName("Role Update Test").
|
|
Create()
|
|
|
|
query := `
|
|
mutation UpdateProcessingActivity($input: UpdateProcessingActivityInput!) {
|
|
updateProcessingActivity(input: $input) {
|
|
processingActivity {
|
|
id
|
|
role
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
var result struct {
|
|
UpdateProcessingActivity struct {
|
|
ProcessingActivity struct {
|
|
ID string `json:"id"`
|
|
Role string `json:"role"`
|
|
} `json:"processingActivity"`
|
|
} `json:"updateProcessingActivity"`
|
|
}
|
|
|
|
err := owner.Execute(query, map[string]any{
|
|
"input": map[string]any{
|
|
"id": paID,
|
|
"role": "PROCESSOR",
|
|
},
|
|
}, &result)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "PROCESSOR", result.UpdateProcessingActivity.ProcessingActivity.Role)
|
|
})
|
|
}
|
|
|
|
func TestProcessingActivity_ReviewDates(t *testing.T) {
|
|
t.Parallel()
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
|
|
t.Run("create with review dates", func(t *testing.T) {
|
|
query := `
|
|
mutation CreateProcessingActivity($input: CreateProcessingActivityInput!) {
|
|
createProcessingActivity(input: $input) {
|
|
processingActivityEdge {
|
|
node {
|
|
id
|
|
lastReviewDate
|
|
nextReviewDate
|
|
}
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
var result struct {
|
|
CreateProcessingActivity struct {
|
|
ProcessingActivityEdge struct {
|
|
Node struct {
|
|
ID string `json:"id"`
|
|
LastReviewDate *string `json:"lastReviewDate"`
|
|
NextReviewDate *string `json:"nextReviewDate"`
|
|
} `json:"node"`
|
|
} `json:"processingActivityEdge"`
|
|
} `json:"createProcessingActivity"`
|
|
}
|
|
|
|
err := owner.Execute(query, map[string]any{
|
|
"input": map[string]any{
|
|
"organizationId": owner.GetOrganizationID().String(),
|
|
"name": "PA Review Dates Test",
|
|
"lawfulBasis": "CONSENT",
|
|
"specialOrCriminalData": "NO",
|
|
"internationalTransfers": false,
|
|
"dataProtectionImpactAssessmentNeeded": "NOT_NEEDED",
|
|
"transferImpactAssessmentNeeded": "NOT_NEEDED",
|
|
"role": "CONTROLLER",
|
|
"lastReviewDate": "2024-01-15T00:00:00Z",
|
|
"nextReviewDate": "2025-01-15T00:00:00Z",
|
|
},
|
|
}, &result)
|
|
require.NoError(t, err)
|
|
require.NotNil(t, result.CreateProcessingActivity.ProcessingActivityEdge.Node.LastReviewDate)
|
|
require.NotNil(t, result.CreateProcessingActivity.ProcessingActivityEdge.Node.NextReviewDate)
|
|
})
|
|
|
|
t.Run("update review dates", func(t *testing.T) {
|
|
paID := factory.NewProcessingActivity(owner).
|
|
WithName("Review Date Update Test").
|
|
Create()
|
|
|
|
query := `
|
|
mutation UpdateProcessingActivity($input: UpdateProcessingActivityInput!) {
|
|
updateProcessingActivity(input: $input) {
|
|
processingActivity {
|
|
id
|
|
lastReviewDate
|
|
nextReviewDate
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
var result struct {
|
|
UpdateProcessingActivity struct {
|
|
ProcessingActivity struct {
|
|
ID string `json:"id"`
|
|
LastReviewDate *string `json:"lastReviewDate"`
|
|
NextReviewDate *string `json:"nextReviewDate"`
|
|
} `json:"processingActivity"`
|
|
} `json:"updateProcessingActivity"`
|
|
}
|
|
|
|
err := owner.Execute(query, map[string]any{
|
|
"input": map[string]any{
|
|
"id": paID,
|
|
"lastReviewDate": "2024-06-01T00:00:00Z",
|
|
"nextReviewDate": "2025-06-01T00:00:00Z",
|
|
},
|
|
}, &result)
|
|
require.NoError(t, err)
|
|
require.NotNil(t, result.UpdateProcessingActivity.ProcessingActivity.LastReviewDate)
|
|
require.NotNil(t, result.UpdateProcessingActivity.ProcessingActivity.NextReviewDate)
|
|
})
|
|
}
|
|
|
|
func TestProcessingActivity_DPIA(t *testing.T) {
|
|
t.Parallel()
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
|
|
t.Run("create DPIA", func(t *testing.T) {
|
|
paID := factory.NewProcessingActivity(owner).
|
|
WithName("DPIA Create Test").
|
|
Create()
|
|
|
|
query := `
|
|
mutation CreateDataProtectionImpactAssessment($input: CreateDataProtectionImpactAssessmentInput!) {
|
|
createDataProtectionImpactAssessment(input: $input) {
|
|
dataProtectionImpactAssessment {
|
|
id
|
|
description
|
|
necessityAndProportionality
|
|
potentialRisk
|
|
mitigations
|
|
residualRisk
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
var result struct {
|
|
CreateDataProtectionImpactAssessment struct {
|
|
DataProtectionImpactAssessment struct {
|
|
ID string `json:"id"`
|
|
Description *string `json:"description"`
|
|
NecessityAndProportionality *string `json:"necessityAndProportionality"`
|
|
PotentialRisk *string `json:"potentialRisk"`
|
|
Mitigations *string `json:"mitigations"`
|
|
ResidualRisk *string `json:"residualRisk"`
|
|
} `json:"dataProtectionImpactAssessment"`
|
|
} `json:"createDataProtectionImpactAssessment"`
|
|
}
|
|
|
|
err := owner.Execute(query, map[string]any{
|
|
"input": map[string]any{
|
|
"processingActivityId": paID,
|
|
"description": "Test DPIA description",
|
|
"necessityAndProportionality": "Test necessity",
|
|
"potentialRisk": "Test risk",
|
|
"mitigations": "Test mitigations",
|
|
"residualRisk": "LOW",
|
|
},
|
|
}, &result)
|
|
require.NoError(t, err)
|
|
assert.NotEmpty(t, result.CreateDataProtectionImpactAssessment.DataProtectionImpactAssessment.ID)
|
|
assert.Equal(t, "Test DPIA description", *result.CreateDataProtectionImpactAssessment.DataProtectionImpactAssessment.Description)
|
|
assert.Equal(t, "LOW", *result.CreateDataProtectionImpactAssessment.DataProtectionImpactAssessment.ResidualRisk)
|
|
})
|
|
|
|
t.Run("read DPIA via processing activity", func(t *testing.T) {
|
|
paID := factory.NewProcessingActivity(owner).
|
|
WithName("DPIA Read Test").
|
|
Create()
|
|
|
|
createQuery := `
|
|
mutation CreateDataProtectionImpactAssessment($input: CreateDataProtectionImpactAssessmentInput!) {
|
|
createDataProtectionImpactAssessment(input: $input) {
|
|
dataProtectionImpactAssessment { id }
|
|
}
|
|
}
|
|
`
|
|
_, err := owner.Do(createQuery, map[string]any{
|
|
"input": map[string]any{
|
|
"processingActivityId": paID,
|
|
"description": "Read test DPIA",
|
|
"residualRisk": "MEDIUM",
|
|
},
|
|
})
|
|
require.NoError(t, err)
|
|
|
|
readQuery := `
|
|
query($id: ID!) {
|
|
node(id: $id) {
|
|
... on ProcessingActivity {
|
|
id
|
|
dataProtectionImpactAssessment {
|
|
id
|
|
description
|
|
residualRisk
|
|
}
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
var result struct {
|
|
Node struct {
|
|
ID string `json:"id"`
|
|
DataProtectionImpactAssessment *struct {
|
|
ID string `json:"id"`
|
|
Description *string `json:"description"`
|
|
ResidualRisk *string `json:"residualRisk"`
|
|
} `json:"dataProtectionImpactAssessment"`
|
|
} `json:"node"`
|
|
}
|
|
|
|
err = owner.Execute(readQuery, map[string]any{"id": paID}, &result)
|
|
require.NoError(t, err)
|
|
require.NotNil(t, result.Node.DataProtectionImpactAssessment)
|
|
assert.Equal(t, "Read test DPIA", *result.Node.DataProtectionImpactAssessment.Description)
|
|
assert.Equal(t, "MEDIUM", *result.Node.DataProtectionImpactAssessment.ResidualRisk)
|
|
})
|
|
|
|
t.Run("update DPIA", func(t *testing.T) {
|
|
paID := factory.NewProcessingActivity(owner).
|
|
WithName("DPIA Update Test").
|
|
Create()
|
|
|
|
createQuery := `
|
|
mutation CreateDataProtectionImpactAssessment($input: CreateDataProtectionImpactAssessmentInput!) {
|
|
createDataProtectionImpactAssessment(input: $input) {
|
|
dataProtectionImpactAssessment { id }
|
|
}
|
|
}
|
|
`
|
|
var createResult struct {
|
|
CreateDataProtectionImpactAssessment struct {
|
|
DataProtectionImpactAssessment struct {
|
|
ID string `json:"id"`
|
|
} `json:"dataProtectionImpactAssessment"`
|
|
} `json:"createDataProtectionImpactAssessment"`
|
|
}
|
|
err := owner.Execute(createQuery, map[string]any{
|
|
"input": map[string]any{
|
|
"processingActivityId": paID,
|
|
"description": "Original description",
|
|
"residualRisk": "LOW",
|
|
},
|
|
}, &createResult)
|
|
require.NoError(t, err)
|
|
dpiaID := createResult.CreateDataProtectionImpactAssessment.DataProtectionImpactAssessment.ID
|
|
|
|
updateQuery := `
|
|
mutation UpdateDataProtectionImpactAssessment($input: UpdateDataProtectionImpactAssessmentInput!) {
|
|
updateDataProtectionImpactAssessment(input: $input) {
|
|
dataProtectionImpactAssessment {
|
|
id
|
|
description
|
|
residualRisk
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
var updateResult struct {
|
|
UpdateDataProtectionImpactAssessment struct {
|
|
DataProtectionImpactAssessment struct {
|
|
ID string `json:"id"`
|
|
Description *string `json:"description"`
|
|
ResidualRisk *string `json:"residualRisk"`
|
|
} `json:"dataProtectionImpactAssessment"`
|
|
} `json:"updateDataProtectionImpactAssessment"`
|
|
}
|
|
|
|
err = owner.Execute(updateQuery, map[string]any{
|
|
"input": map[string]any{
|
|
"id": dpiaID,
|
|
"description": "Updated description",
|
|
"residualRisk": "HIGH",
|
|
},
|
|
}, &updateResult)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "Updated description", *updateResult.UpdateDataProtectionImpactAssessment.DataProtectionImpactAssessment.Description)
|
|
assert.Equal(t, "HIGH", *updateResult.UpdateDataProtectionImpactAssessment.DataProtectionImpactAssessment.ResidualRisk)
|
|
})
|
|
|
|
t.Run("delete DPIA", func(t *testing.T) {
|
|
paID := factory.NewProcessingActivity(owner).
|
|
WithName("DPIA Delete Test").
|
|
Create()
|
|
|
|
createQuery := `
|
|
mutation CreateDataProtectionImpactAssessment($input: CreateDataProtectionImpactAssessmentInput!) {
|
|
createDataProtectionImpactAssessment(input: $input) {
|
|
dataProtectionImpactAssessment { id }
|
|
}
|
|
}
|
|
`
|
|
var createResult struct {
|
|
CreateDataProtectionImpactAssessment struct {
|
|
DataProtectionImpactAssessment struct {
|
|
ID string `json:"id"`
|
|
} `json:"dataProtectionImpactAssessment"`
|
|
} `json:"createDataProtectionImpactAssessment"`
|
|
}
|
|
err := owner.Execute(createQuery, map[string]any{
|
|
"input": map[string]any{
|
|
"processingActivityId": paID,
|
|
"description": "To be deleted",
|
|
},
|
|
}, &createResult)
|
|
require.NoError(t, err)
|
|
dpiaID := createResult.CreateDataProtectionImpactAssessment.DataProtectionImpactAssessment.ID
|
|
|
|
deleteQuery := `
|
|
mutation DeleteDataProtectionImpactAssessment($input: DeleteDataProtectionImpactAssessmentInput!) {
|
|
deleteDataProtectionImpactAssessment(input: $input) {
|
|
deletedDataProtectionImpactAssessmentId
|
|
}
|
|
}
|
|
`
|
|
|
|
var deleteResult struct {
|
|
DeleteDataProtectionImpactAssessment struct {
|
|
DeletedDataProtectionImpactAssessmentID string `json:"deletedDataProtectionImpactAssessmentId"`
|
|
} `json:"deleteDataProtectionImpactAssessment"`
|
|
}
|
|
|
|
err = owner.Execute(deleteQuery, map[string]any{
|
|
"input": map[string]any{
|
|
"dataProtectionImpactAssessmentId": dpiaID,
|
|
},
|
|
}, &deleteResult)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, dpiaID, deleteResult.DeleteDataProtectionImpactAssessment.DeletedDataProtectionImpactAssessmentID)
|
|
|
|
readQuery := `
|
|
query($id: ID!) {
|
|
node(id: $id) {
|
|
... on ProcessingActivity {
|
|
dataProtectionImpactAssessment { id }
|
|
}
|
|
}
|
|
}
|
|
`
|
|
var readResult struct {
|
|
Node struct {
|
|
DataProtectionImpactAssessment *struct {
|
|
ID string `json:"id"`
|
|
} `json:"dataProtectionImpactAssessment"`
|
|
} `json:"node"`
|
|
}
|
|
err = owner.Execute(readQuery, map[string]any{"id": paID}, &readResult)
|
|
require.NoError(t, err)
|
|
assert.Nil(t, readResult.Node.DataProtectionImpactAssessment)
|
|
})
|
|
|
|
t.Run("DPIA residual risk values", func(t *testing.T) {
|
|
residualRisks := []string{"LOW", "MEDIUM", "HIGH"}
|
|
|
|
for _, risk := range residualRisks {
|
|
t.Run(risk, func(t *testing.T) {
|
|
paID := factory.NewProcessingActivity(owner).
|
|
WithName(fmt.Sprintf("DPIA Risk %s", risk)).
|
|
Create()
|
|
|
|
query := `
|
|
mutation CreateDataProtectionImpactAssessment($input: CreateDataProtectionImpactAssessmentInput!) {
|
|
createDataProtectionImpactAssessment(input: $input) {
|
|
dataProtectionImpactAssessment {
|
|
id
|
|
residualRisk
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
var result struct {
|
|
CreateDataProtectionImpactAssessment struct {
|
|
DataProtectionImpactAssessment struct {
|
|
ID string `json:"id"`
|
|
ResidualRisk *string `json:"residualRisk"`
|
|
} `json:"dataProtectionImpactAssessment"`
|
|
} `json:"createDataProtectionImpactAssessment"`
|
|
}
|
|
|
|
err := owner.Execute(query, map[string]any{
|
|
"input": map[string]any{
|
|
"processingActivityId": paID,
|
|
"residualRisk": risk,
|
|
},
|
|
}, &result)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, risk, *result.CreateDataProtectionImpactAssessment.DataProtectionImpactAssessment.ResidualRisk)
|
|
})
|
|
}
|
|
})
|
|
}
|
|
|
|
func TestProcessingActivity_TIA(t *testing.T) {
|
|
t.Parallel()
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
|
|
t.Run("create TIA", func(t *testing.T) {
|
|
paID := factory.NewProcessingActivity(owner).
|
|
WithName("TIA Create Test").
|
|
Create()
|
|
|
|
query := `
|
|
mutation CreateTransferImpactAssessment($input: CreateTransferImpactAssessmentInput!) {
|
|
createTransferImpactAssessment(input: $input) {
|
|
transferImpactAssessment {
|
|
id
|
|
dataSubjects
|
|
legalMechanism
|
|
transfer
|
|
localLawRisk
|
|
supplementaryMeasures
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
var result struct {
|
|
CreateTransferImpactAssessment struct {
|
|
TransferImpactAssessment struct {
|
|
ID string `json:"id"`
|
|
DataSubjects *string `json:"dataSubjects"`
|
|
LegalMechanism *string `json:"legalMechanism"`
|
|
Transfer *string `json:"transfer"`
|
|
LocalLawRisk *string `json:"localLawRisk"`
|
|
SupplementaryMeasures *string `json:"supplementaryMeasures"`
|
|
} `json:"transferImpactAssessment"`
|
|
} `json:"createTransferImpactAssessment"`
|
|
}
|
|
|
|
err := owner.Execute(query, map[string]any{
|
|
"input": map[string]any{
|
|
"processingActivityId": paID,
|
|
"dataSubjects": "EU customers",
|
|
"legalMechanism": "Standard Contractual Clauses",
|
|
"transfer": "EU to US",
|
|
"localLawRisk": "Moderate risk due to surveillance laws",
|
|
"supplementaryMeasures": "Encryption at rest and in transit",
|
|
},
|
|
}, &result)
|
|
require.NoError(t, err)
|
|
assert.NotEmpty(t, result.CreateTransferImpactAssessment.TransferImpactAssessment.ID)
|
|
assert.Equal(t, "EU customers", *result.CreateTransferImpactAssessment.TransferImpactAssessment.DataSubjects)
|
|
assert.Equal(t, "Standard Contractual Clauses", *result.CreateTransferImpactAssessment.TransferImpactAssessment.LegalMechanism)
|
|
})
|
|
|
|
t.Run("read TIA via processing activity", func(t *testing.T) {
|
|
paID := factory.NewProcessingActivity(owner).
|
|
WithName("TIA Read Test").
|
|
Create()
|
|
|
|
createQuery := `
|
|
mutation CreateTransferImpactAssessment($input: CreateTransferImpactAssessmentInput!) {
|
|
createTransferImpactAssessment(input: $input) {
|
|
transferImpactAssessment { id }
|
|
}
|
|
}
|
|
`
|
|
_, err := owner.Do(createQuery, map[string]any{
|
|
"input": map[string]any{
|
|
"processingActivityId": paID,
|
|
"dataSubjects": "Read test subjects",
|
|
"transfer": "Read test transfer",
|
|
},
|
|
})
|
|
require.NoError(t, err)
|
|
|
|
readQuery := `
|
|
query($id: ID!) {
|
|
node(id: $id) {
|
|
... on ProcessingActivity {
|
|
id
|
|
transferImpactAssessment {
|
|
id
|
|
dataSubjects
|
|
transfer
|
|
}
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
var result struct {
|
|
Node struct {
|
|
ID string `json:"id"`
|
|
TransferImpactAssessment *struct {
|
|
ID string `json:"id"`
|
|
DataSubjects *string `json:"dataSubjects"`
|
|
Transfer *string `json:"transfer"`
|
|
} `json:"transferImpactAssessment"`
|
|
} `json:"node"`
|
|
}
|
|
|
|
err = owner.Execute(readQuery, map[string]any{"id": paID}, &result)
|
|
require.NoError(t, err)
|
|
require.NotNil(t, result.Node.TransferImpactAssessment)
|
|
assert.Equal(t, "Read test subjects", *result.Node.TransferImpactAssessment.DataSubjects)
|
|
assert.Equal(t, "Read test transfer", *result.Node.TransferImpactAssessment.Transfer)
|
|
})
|
|
|
|
t.Run("update TIA", func(t *testing.T) {
|
|
paID := factory.NewProcessingActivity(owner).
|
|
WithName("TIA Update Test").
|
|
Create()
|
|
|
|
createQuery := `
|
|
mutation CreateTransferImpactAssessment($input: CreateTransferImpactAssessmentInput!) {
|
|
createTransferImpactAssessment(input: $input) {
|
|
transferImpactAssessment { id }
|
|
}
|
|
}
|
|
`
|
|
var createResult struct {
|
|
CreateTransferImpactAssessment struct {
|
|
TransferImpactAssessment struct {
|
|
ID string `json:"id"`
|
|
} `json:"transferImpactAssessment"`
|
|
} `json:"createTransferImpactAssessment"`
|
|
}
|
|
err := owner.Execute(createQuery, map[string]any{
|
|
"input": map[string]any{
|
|
"processingActivityId": paID,
|
|
"dataSubjects": "Original subjects",
|
|
"transfer": "Original transfer",
|
|
},
|
|
}, &createResult)
|
|
require.NoError(t, err)
|
|
tiaID := createResult.CreateTransferImpactAssessment.TransferImpactAssessment.ID
|
|
|
|
updateQuery := `
|
|
mutation UpdateTransferImpactAssessment($input: UpdateTransferImpactAssessmentInput!) {
|
|
updateTransferImpactAssessment(input: $input) {
|
|
transferImpactAssessment {
|
|
id
|
|
dataSubjects
|
|
transfer
|
|
legalMechanism
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
var updateResult struct {
|
|
UpdateTransferImpactAssessment struct {
|
|
TransferImpactAssessment struct {
|
|
ID string `json:"id"`
|
|
DataSubjects *string `json:"dataSubjects"`
|
|
Transfer *string `json:"transfer"`
|
|
LegalMechanism *string `json:"legalMechanism"`
|
|
} `json:"transferImpactAssessment"`
|
|
} `json:"updateTransferImpactAssessment"`
|
|
}
|
|
|
|
err = owner.Execute(updateQuery, map[string]any{
|
|
"input": map[string]any{
|
|
"id": tiaID,
|
|
"dataSubjects": "Updated subjects",
|
|
"transfer": "Updated transfer",
|
|
"legalMechanism": "Binding Corporate Rules",
|
|
},
|
|
}, &updateResult)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "Updated subjects", *updateResult.UpdateTransferImpactAssessment.TransferImpactAssessment.DataSubjects)
|
|
assert.Equal(t, "Updated transfer", *updateResult.UpdateTransferImpactAssessment.TransferImpactAssessment.Transfer)
|
|
assert.Equal(t, "Binding Corporate Rules", *updateResult.UpdateTransferImpactAssessment.TransferImpactAssessment.LegalMechanism)
|
|
})
|
|
|
|
t.Run("delete TIA", func(t *testing.T) {
|
|
paID := factory.NewProcessingActivity(owner).
|
|
WithName("TIA Delete Test").
|
|
Create()
|
|
|
|
createQuery := `
|
|
mutation CreateTransferImpactAssessment($input: CreateTransferImpactAssessmentInput!) {
|
|
createTransferImpactAssessment(input: $input) {
|
|
transferImpactAssessment { id }
|
|
}
|
|
}
|
|
`
|
|
var createResult struct {
|
|
CreateTransferImpactAssessment struct {
|
|
TransferImpactAssessment struct {
|
|
ID string `json:"id"`
|
|
} `json:"transferImpactAssessment"`
|
|
} `json:"createTransferImpactAssessment"`
|
|
}
|
|
err := owner.Execute(createQuery, map[string]any{
|
|
"input": map[string]any{
|
|
"processingActivityId": paID,
|
|
"dataSubjects": "To be deleted",
|
|
},
|
|
}, &createResult)
|
|
require.NoError(t, err)
|
|
tiaID := createResult.CreateTransferImpactAssessment.TransferImpactAssessment.ID
|
|
|
|
deleteQuery := `
|
|
mutation DeleteTransferImpactAssessment($input: DeleteTransferImpactAssessmentInput!) {
|
|
deleteTransferImpactAssessment(input: $input) {
|
|
deletedTransferImpactAssessmentId
|
|
}
|
|
}
|
|
`
|
|
|
|
var deleteResult struct {
|
|
DeleteTransferImpactAssessment struct {
|
|
DeletedTransferImpactAssessmentID string `json:"deletedTransferImpactAssessmentId"`
|
|
} `json:"deleteTransferImpactAssessment"`
|
|
}
|
|
|
|
err = owner.Execute(deleteQuery, map[string]any{
|
|
"input": map[string]any{
|
|
"transferImpactAssessmentId": tiaID,
|
|
},
|
|
}, &deleteResult)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, tiaID, deleteResult.DeleteTransferImpactAssessment.DeletedTransferImpactAssessmentID)
|
|
|
|
readQuery := `
|
|
query($id: ID!) {
|
|
node(id: $id) {
|
|
... on ProcessingActivity {
|
|
transferImpactAssessment { id }
|
|
}
|
|
}
|
|
}
|
|
`
|
|
var readResult struct {
|
|
Node struct {
|
|
TransferImpactAssessment *struct {
|
|
ID string `json:"id"`
|
|
} `json:"transferImpactAssessment"`
|
|
} `json:"node"`
|
|
}
|
|
err = owner.Execute(readQuery, map[string]any{"id": paID}, &readResult)
|
|
require.NoError(t, err)
|
|
assert.Nil(t, readResult.Node.TransferImpactAssessment)
|
|
})
|
|
}
|
|
|
|
func TestProcessingActivity_DPIA_RBAC(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
t.Run("owner can manage DPIA", func(t *testing.T) {
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
paID := factory.NewProcessingActivity(owner).WithName("DPIA RBAC Owner Test").Create()
|
|
|
|
var createResult struct {
|
|
CreateDataProtectionImpactAssessment struct {
|
|
DataProtectionImpactAssessment struct {
|
|
ID string `json:"id"`
|
|
} `json:"dataProtectionImpactAssessment"`
|
|
} `json:"createDataProtectionImpactAssessment"`
|
|
}
|
|
err := owner.Execute(`
|
|
mutation($input: CreateDataProtectionImpactAssessmentInput!) {
|
|
createDataProtectionImpactAssessment(input: $input) {
|
|
dataProtectionImpactAssessment { id }
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"processingActivityId": paID,
|
|
"description": "Owner DPIA",
|
|
},
|
|
}, &createResult)
|
|
require.NoError(t, err, "owner should be able to create DPIA")
|
|
dpiaID := createResult.CreateDataProtectionImpactAssessment.DataProtectionImpactAssessment.ID
|
|
|
|
_, err = owner.Do(`
|
|
mutation($input: UpdateDataProtectionImpactAssessmentInput!) {
|
|
updateDataProtectionImpactAssessment(input: $input) {
|
|
dataProtectionImpactAssessment { id }
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"id": dpiaID,
|
|
"description": "Updated by owner",
|
|
},
|
|
})
|
|
require.NoError(t, err, "owner should be able to update DPIA")
|
|
|
|
_, err = owner.Do(`
|
|
mutation($input: DeleteDataProtectionImpactAssessmentInput!) {
|
|
deleteDataProtectionImpactAssessment(input: $input) {
|
|
deletedDataProtectionImpactAssessmentId
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"dataProtectionImpactAssessmentId": dpiaID,
|
|
},
|
|
})
|
|
require.NoError(t, err, "owner should be able to delete DPIA")
|
|
})
|
|
|
|
t.Run("admin can manage DPIA", func(t *testing.T) {
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
admin := testutil.NewClientInOrg(t, testutil.RoleAdmin, owner)
|
|
paID := factory.NewProcessingActivity(owner).WithName("DPIA RBAC Admin Test").Create()
|
|
|
|
var createResult struct {
|
|
CreateDataProtectionImpactAssessment struct {
|
|
DataProtectionImpactAssessment struct {
|
|
ID string `json:"id"`
|
|
} `json:"dataProtectionImpactAssessment"`
|
|
} `json:"createDataProtectionImpactAssessment"`
|
|
}
|
|
err := admin.Execute(`
|
|
mutation($input: CreateDataProtectionImpactAssessmentInput!) {
|
|
createDataProtectionImpactAssessment(input: $input) {
|
|
dataProtectionImpactAssessment { id }
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"processingActivityId": paID,
|
|
"description": "Admin DPIA",
|
|
},
|
|
}, &createResult)
|
|
require.NoError(t, err, "admin should be able to create DPIA")
|
|
dpiaID := createResult.CreateDataProtectionImpactAssessment.DataProtectionImpactAssessment.ID
|
|
|
|
_, err = admin.Do(`
|
|
mutation($input: UpdateDataProtectionImpactAssessmentInput!) {
|
|
updateDataProtectionImpactAssessment(input: $input) {
|
|
dataProtectionImpactAssessment { id }
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"id": dpiaID,
|
|
"description": "Updated by admin",
|
|
},
|
|
})
|
|
require.NoError(t, err, "admin should be able to update DPIA")
|
|
|
|
_, err = admin.Do(`
|
|
mutation($input: DeleteDataProtectionImpactAssessmentInput!) {
|
|
deleteDataProtectionImpactAssessment(input: $input) {
|
|
deletedDataProtectionImpactAssessmentId
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"dataProtectionImpactAssessmentId": dpiaID,
|
|
},
|
|
})
|
|
require.NoError(t, err, "admin should be able to delete DPIA")
|
|
})
|
|
|
|
t.Run("viewer cannot manage DPIA", func(t *testing.T) {
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
viewer := testutil.NewClientInOrg(t, testutil.RoleViewer, owner)
|
|
paID := factory.NewProcessingActivity(owner).WithName("DPIA RBAC Viewer Test").Create()
|
|
|
|
_, err := viewer.Do(`
|
|
mutation($input: CreateDataProtectionImpactAssessmentInput!) {
|
|
createDataProtectionImpactAssessment(input: $input) {
|
|
dataProtectionImpactAssessment { id }
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"processingActivityId": paID,
|
|
"description": "Viewer DPIA",
|
|
},
|
|
})
|
|
testutil.RequireForbiddenError(t, err, "viewer should not be able to create DPIA")
|
|
|
|
var createResult struct {
|
|
CreateDataProtectionImpactAssessment struct {
|
|
DataProtectionImpactAssessment struct {
|
|
ID string `json:"id"`
|
|
} `json:"dataProtectionImpactAssessment"`
|
|
} `json:"createDataProtectionImpactAssessment"`
|
|
}
|
|
err = owner.Execute(`
|
|
mutation($input: CreateDataProtectionImpactAssessmentInput!) {
|
|
createDataProtectionImpactAssessment(input: $input) {
|
|
dataProtectionImpactAssessment { id }
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"processingActivityId": paID,
|
|
"description": "Owner created DPIA",
|
|
},
|
|
}, &createResult)
|
|
require.NoError(t, err)
|
|
dpiaID := createResult.CreateDataProtectionImpactAssessment.DataProtectionImpactAssessment.ID
|
|
|
|
_, err = viewer.Do(`
|
|
mutation($input: UpdateDataProtectionImpactAssessmentInput!) {
|
|
updateDataProtectionImpactAssessment(input: $input) {
|
|
dataProtectionImpactAssessment { id }
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"id": dpiaID,
|
|
"description": "Updated by viewer",
|
|
},
|
|
})
|
|
testutil.RequireForbiddenError(t, err, "viewer should not be able to update DPIA")
|
|
|
|
_, err = viewer.Do(`
|
|
mutation($input: DeleteDataProtectionImpactAssessmentInput!) {
|
|
deleteDataProtectionImpactAssessment(input: $input) {
|
|
deletedDataProtectionImpactAssessmentId
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"dataProtectionImpactAssessmentId": dpiaID,
|
|
},
|
|
})
|
|
testutil.RequireForbiddenError(t, err, "viewer should not be able to delete DPIA")
|
|
})
|
|
}
|
|
|
|
func TestProcessingActivity_TIA_RBAC(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
t.Run("owner can manage TIA", func(t *testing.T) {
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
paID := factory.NewProcessingActivity(owner).WithName("TIA RBAC Owner Test").Create()
|
|
|
|
var createResult struct {
|
|
CreateTransferImpactAssessment struct {
|
|
TransferImpactAssessment struct {
|
|
ID string `json:"id"`
|
|
} `json:"transferImpactAssessment"`
|
|
} `json:"createTransferImpactAssessment"`
|
|
}
|
|
err := owner.Execute(`
|
|
mutation($input: CreateTransferImpactAssessmentInput!) {
|
|
createTransferImpactAssessment(input: $input) {
|
|
transferImpactAssessment { id }
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"processingActivityId": paID,
|
|
"dataSubjects": "Owner TIA subjects",
|
|
},
|
|
}, &createResult)
|
|
require.NoError(t, err, "owner should be able to create TIA")
|
|
tiaID := createResult.CreateTransferImpactAssessment.TransferImpactAssessment.ID
|
|
|
|
_, err = owner.Do(`
|
|
mutation($input: UpdateTransferImpactAssessmentInput!) {
|
|
updateTransferImpactAssessment(input: $input) {
|
|
transferImpactAssessment { id }
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"id": tiaID,
|
|
"dataSubjects": "Updated by owner",
|
|
},
|
|
})
|
|
require.NoError(t, err, "owner should be able to update TIA")
|
|
|
|
_, err = owner.Do(`
|
|
mutation($input: DeleteTransferImpactAssessmentInput!) {
|
|
deleteTransferImpactAssessment(input: $input) {
|
|
deletedTransferImpactAssessmentId
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"transferImpactAssessmentId": tiaID,
|
|
},
|
|
})
|
|
require.NoError(t, err, "owner should be able to delete TIA")
|
|
})
|
|
|
|
t.Run("admin can manage TIA", func(t *testing.T) {
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
admin := testutil.NewClientInOrg(t, testutil.RoleAdmin, owner)
|
|
paID := factory.NewProcessingActivity(owner).WithName("TIA RBAC Admin Test").Create()
|
|
|
|
var createResult struct {
|
|
CreateTransferImpactAssessment struct {
|
|
TransferImpactAssessment struct {
|
|
ID string `json:"id"`
|
|
} `json:"transferImpactAssessment"`
|
|
} `json:"createTransferImpactAssessment"`
|
|
}
|
|
err := admin.Execute(`
|
|
mutation($input: CreateTransferImpactAssessmentInput!) {
|
|
createTransferImpactAssessment(input: $input) {
|
|
transferImpactAssessment { id }
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"processingActivityId": paID,
|
|
"dataSubjects": "Admin TIA subjects",
|
|
},
|
|
}, &createResult)
|
|
require.NoError(t, err, "admin should be able to create TIA")
|
|
tiaID := createResult.CreateTransferImpactAssessment.TransferImpactAssessment.ID
|
|
|
|
_, err = admin.Do(`
|
|
mutation($input: UpdateTransferImpactAssessmentInput!) {
|
|
updateTransferImpactAssessment(input: $input) {
|
|
transferImpactAssessment { id }
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"id": tiaID,
|
|
"dataSubjects": "Updated by admin",
|
|
},
|
|
})
|
|
require.NoError(t, err, "admin should be able to update TIA")
|
|
|
|
_, err = admin.Do(`
|
|
mutation($input: DeleteTransferImpactAssessmentInput!) {
|
|
deleteTransferImpactAssessment(input: $input) {
|
|
deletedTransferImpactAssessmentId
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"transferImpactAssessmentId": tiaID,
|
|
},
|
|
})
|
|
require.NoError(t, err, "admin should be able to delete TIA")
|
|
})
|
|
|
|
t.Run("viewer cannot manage TIA", func(t *testing.T) {
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
viewer := testutil.NewClientInOrg(t, testutil.RoleViewer, owner)
|
|
paID := factory.NewProcessingActivity(owner).WithName("TIA RBAC Viewer Test").Create()
|
|
|
|
_, err := viewer.Do(`
|
|
mutation($input: CreateTransferImpactAssessmentInput!) {
|
|
createTransferImpactAssessment(input: $input) {
|
|
transferImpactAssessment { id }
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"processingActivityId": paID,
|
|
"dataSubjects": "Viewer TIA subjects",
|
|
},
|
|
})
|
|
testutil.RequireForbiddenError(t, err, "viewer should not be able to create TIA")
|
|
|
|
var createResult struct {
|
|
CreateTransferImpactAssessment struct {
|
|
TransferImpactAssessment struct {
|
|
ID string `json:"id"`
|
|
} `json:"transferImpactAssessment"`
|
|
} `json:"createTransferImpactAssessment"`
|
|
}
|
|
err = owner.Execute(`
|
|
mutation($input: CreateTransferImpactAssessmentInput!) {
|
|
createTransferImpactAssessment(input: $input) {
|
|
transferImpactAssessment { id }
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"processingActivityId": paID,
|
|
"dataSubjects": "Owner created TIA",
|
|
},
|
|
}, &createResult)
|
|
require.NoError(t, err)
|
|
tiaID := createResult.CreateTransferImpactAssessment.TransferImpactAssessment.ID
|
|
|
|
_, err = viewer.Do(`
|
|
mutation($input: UpdateTransferImpactAssessmentInput!) {
|
|
updateTransferImpactAssessment(input: $input) {
|
|
transferImpactAssessment { id }
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"id": tiaID,
|
|
"dataSubjects": "Updated by viewer",
|
|
},
|
|
})
|
|
testutil.RequireForbiddenError(t, err, "viewer should not be able to update TIA")
|
|
|
|
_, err = viewer.Do(`
|
|
mutation($input: DeleteTransferImpactAssessmentInput!) {
|
|
deleteTransferImpactAssessment(input: $input) {
|
|
deletedTransferImpactAssessmentId
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"transferImpactAssessmentId": tiaID,
|
|
},
|
|
})
|
|
testutil.RequireForbiddenError(t, err, "viewer should not be able to delete TIA")
|
|
})
|
|
}
|
|
|
|
func TestProcessingActivity_Snapshot_DPIA_TIA(t *testing.T) {
|
|
t.Parallel()
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
|
|
t.Run("snapshot includes DPIA and TIA", func(t *testing.T) {
|
|
paID := factory.NewProcessingActivity(owner).
|
|
WithName("Snapshot DPIA TIA Test").
|
|
Create()
|
|
|
|
var dpiaResult struct {
|
|
CreateDataProtectionImpactAssessment struct {
|
|
DataProtectionImpactAssessment struct {
|
|
ID string `json:"id"`
|
|
} `json:"dataProtectionImpactAssessment"`
|
|
} `json:"createDataProtectionImpactAssessment"`
|
|
}
|
|
err := owner.Execute(`
|
|
mutation($input: CreateDataProtectionImpactAssessmentInput!) {
|
|
createDataProtectionImpactAssessment(input: $input) {
|
|
dataProtectionImpactAssessment { id }
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"processingActivityId": paID,
|
|
"description": "DPIA for snapshot",
|
|
"residualRisk": "MEDIUM",
|
|
},
|
|
}, &dpiaResult)
|
|
require.NoError(t, err)
|
|
|
|
var tiaResult struct {
|
|
CreateTransferImpactAssessment struct {
|
|
TransferImpactAssessment struct {
|
|
ID string `json:"id"`
|
|
} `json:"transferImpactAssessment"`
|
|
} `json:"createTransferImpactAssessment"`
|
|
}
|
|
err = owner.Execute(`
|
|
mutation($input: CreateTransferImpactAssessmentInput!) {
|
|
createTransferImpactAssessment(input: $input) {
|
|
transferImpactAssessment { id }
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"processingActivityId": paID,
|
|
"dataSubjects": "TIA subjects for snapshot",
|
|
"transfer": "EU to US",
|
|
},
|
|
}, &tiaResult)
|
|
require.NoError(t, err)
|
|
|
|
var snapshotResult struct {
|
|
CreateSnapshot struct {
|
|
SnapshotEdge struct {
|
|
Node struct {
|
|
ID string `json:"id"`
|
|
} `json:"node"`
|
|
} `json:"snapshotEdge"`
|
|
} `json:"createSnapshot"`
|
|
}
|
|
err = owner.Execute(`
|
|
mutation($input: CreateSnapshotInput!) {
|
|
createSnapshot(input: $input) {
|
|
snapshotEdge {
|
|
node { id }
|
|
}
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"organizationId": owner.GetOrganizationID().String(),
|
|
"name": fmt.Sprintf("PA Snapshot Test %d", time.Now().UnixNano()),
|
|
"type": "PROCESSING_ACTIVITIES",
|
|
},
|
|
}, &snapshotResult)
|
|
require.NoError(t, err)
|
|
snapshotID := snapshotResult.CreateSnapshot.SnapshotEdge.Node.ID
|
|
|
|
var queryResult struct {
|
|
Node struct {
|
|
ProcessingActivities struct {
|
|
Edges []struct {
|
|
Node struct {
|
|
ID string `json:"id"`
|
|
Name string `json:"name"`
|
|
DataProtectionImpactAssessment *struct {
|
|
ID string `json:"id"`
|
|
Description *string `json:"description"`
|
|
ResidualRisk *string `json:"residualRisk"`
|
|
} `json:"dataProtectionImpactAssessment"`
|
|
TransferImpactAssessment *struct {
|
|
ID string `json:"id"`
|
|
DataSubjects *string `json:"dataSubjects"`
|
|
Transfer *string `json:"transfer"`
|
|
} `json:"transferImpactAssessment"`
|
|
} `json:"node"`
|
|
} `json:"edges"`
|
|
} `json:"processingActivities"`
|
|
} `json:"node"`
|
|
}
|
|
err = owner.Execute(`
|
|
query($orgId: ID!, $snapshotId: ID!) {
|
|
node(id: $orgId) {
|
|
... on Organization {
|
|
processingActivities(first: 100, filter: { snapshotId: $snapshotId }) {
|
|
edges {
|
|
node {
|
|
id
|
|
name
|
|
dataProtectionImpactAssessment {
|
|
id
|
|
description
|
|
residualRisk
|
|
}
|
|
transferImpactAssessment {
|
|
id
|
|
dataSubjects
|
|
transfer
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"orgId": owner.GetOrganizationID().String(),
|
|
"snapshotId": snapshotID,
|
|
}, &queryResult)
|
|
require.NoError(t, err)
|
|
|
|
var foundPA bool
|
|
for _, edge := range queryResult.Node.ProcessingActivities.Edges {
|
|
if edge.Node.Name == "Snapshot DPIA TIA Test" {
|
|
foundPA = true
|
|
require.NotNil(t, edge.Node.DataProtectionImpactAssessment, "DPIA should be included in snapshot")
|
|
assert.Equal(t, "DPIA for snapshot", *edge.Node.DataProtectionImpactAssessment.Description)
|
|
assert.Equal(t, "MEDIUM", *edge.Node.DataProtectionImpactAssessment.ResidualRisk)
|
|
|
|
require.NotNil(t, edge.Node.TransferImpactAssessment, "TIA should be included in snapshot")
|
|
assert.Equal(t, "TIA subjects for snapshot", *edge.Node.TransferImpactAssessment.DataSubjects)
|
|
assert.Equal(t, "EU to US", *edge.Node.TransferImpactAssessment.Transfer)
|
|
break
|
|
}
|
|
}
|
|
assert.True(t, foundPA, "Processing activity should be found in snapshot")
|
|
})
|
|
|
|
t.Run("snapshot DPIA and TIA are independent of source", func(t *testing.T) {
|
|
paID := factory.NewProcessingActivity(owner).
|
|
WithName("Snapshot Independence Test").
|
|
Create()
|
|
|
|
err := owner.Execute(`
|
|
mutation($input: CreateDataProtectionImpactAssessmentInput!) {
|
|
createDataProtectionImpactAssessment(input: $input) {
|
|
dataProtectionImpactAssessment { id }
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"processingActivityId": paID,
|
|
"description": "Original DPIA",
|
|
"residualRisk": "LOW",
|
|
},
|
|
}, nil)
|
|
require.NoError(t, err)
|
|
|
|
var snapshotResult struct {
|
|
CreateSnapshot struct {
|
|
SnapshotEdge struct {
|
|
Node struct {
|
|
ID string `json:"id"`
|
|
} `json:"node"`
|
|
} `json:"snapshotEdge"`
|
|
} `json:"createSnapshot"`
|
|
}
|
|
err = owner.Execute(`
|
|
mutation($input: CreateSnapshotInput!) {
|
|
createSnapshot(input: $input) {
|
|
snapshotEdge {
|
|
node { id }
|
|
}
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"organizationId": owner.GetOrganizationID().String(),
|
|
"name": fmt.Sprintf("PA Independence Test %d", time.Now().UnixNano()),
|
|
"type": "PROCESSING_ACTIVITIES",
|
|
},
|
|
}, &snapshotResult)
|
|
require.NoError(t, err)
|
|
snapshotID := snapshotResult.CreateSnapshot.SnapshotEdge.Node.ID
|
|
|
|
var sourceResult struct {
|
|
Node struct {
|
|
DataProtectionImpactAssessment *struct {
|
|
ID string `json:"id"`
|
|
Description *string `json:"description"`
|
|
ResidualRisk *string `json:"residualRisk"`
|
|
} `json:"dataProtectionImpactAssessment"`
|
|
} `json:"node"`
|
|
}
|
|
err = owner.Execute(`
|
|
query($id: ID!) {
|
|
node(id: $id) {
|
|
... on ProcessingActivity {
|
|
dataProtectionImpactAssessment {
|
|
id
|
|
description
|
|
residualRisk
|
|
}
|
|
}
|
|
}
|
|
}
|
|
`, map[string]any{"id": paID}, &sourceResult)
|
|
require.NoError(t, err)
|
|
require.NotNil(t, sourceResult.Node.DataProtectionImpactAssessment)
|
|
sourceDpiaID := sourceResult.Node.DataProtectionImpactAssessment.ID
|
|
|
|
_, err = owner.Do(`
|
|
mutation($input: UpdateDataProtectionImpactAssessmentInput!) {
|
|
updateDataProtectionImpactAssessment(input: $input) {
|
|
dataProtectionImpactAssessment { id }
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"id": sourceDpiaID,
|
|
"description": "Updated after snapshot",
|
|
"residualRisk": "HIGH",
|
|
},
|
|
})
|
|
require.NoError(t, err)
|
|
|
|
var snapshotQueryResult struct {
|
|
Node struct {
|
|
ProcessingActivities struct {
|
|
Edges []struct {
|
|
Node struct {
|
|
Name string `json:"name"`
|
|
DataProtectionImpactAssessment *struct {
|
|
Description *string `json:"description"`
|
|
ResidualRisk *string `json:"residualRisk"`
|
|
} `json:"dataProtectionImpactAssessment"`
|
|
} `json:"node"`
|
|
} `json:"edges"`
|
|
} `json:"processingActivities"`
|
|
} `json:"node"`
|
|
}
|
|
err = owner.Execute(`
|
|
query($orgId: ID!, $snapshotId: ID!) {
|
|
node(id: $orgId) {
|
|
... on Organization {
|
|
processingActivities(first: 100, filter: { snapshotId: $snapshotId }) {
|
|
edges {
|
|
node {
|
|
name
|
|
dataProtectionImpactAssessment {
|
|
description
|
|
residualRisk
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"orgId": owner.GetOrganizationID().String(),
|
|
"snapshotId": snapshotID,
|
|
}, &snapshotQueryResult)
|
|
require.NoError(t, err)
|
|
|
|
for _, edge := range snapshotQueryResult.Node.ProcessingActivities.Edges {
|
|
if edge.Node.Name == "Snapshot Independence Test" {
|
|
require.NotNil(t, edge.Node.DataProtectionImpactAssessment)
|
|
assert.Equal(t, "Original DPIA", *edge.Node.DataProtectionImpactAssessment.Description, "Snapshot DPIA should retain original value")
|
|
assert.Equal(t, "LOW", *edge.Node.DataProtectionImpactAssessment.ResidualRisk, "Snapshot DPIA should retain original value")
|
|
break
|
|
}
|
|
}
|
|
})
|
|
}
|
|
|
|
func TestProcessingActivity_ExportPDF(t *testing.T) {
|
|
t.Parallel()
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
|
|
t.Run("export processing activities PDF", func(t *testing.T) {
|
|
_ = factory.NewProcessingActivity(owner).
|
|
WithName("PA Export Test 1").
|
|
WithLawfulBasis("CONSENT").
|
|
Create()
|
|
_ = factory.NewProcessingActivity(owner).
|
|
WithName("PA Export Test 2").
|
|
WithLawfulBasis("LEGITIMATE_INTEREST").
|
|
Create()
|
|
|
|
query := `
|
|
mutation ExportProcessingActivitiesPDF($input: ExportProcessingActivitiesPDFInput!) {
|
|
exportProcessingActivitiesPDF(input: $input) {
|
|
data
|
|
}
|
|
}
|
|
`
|
|
|
|
var result struct {
|
|
ExportProcessingActivitiesPDF struct {
|
|
Data string `json:"data"`
|
|
} `json:"exportProcessingActivitiesPDF"`
|
|
}
|
|
|
|
err := owner.Execute(query, map[string]any{
|
|
"input": map[string]any{
|
|
"organizationId": owner.GetOrganizationID().String(),
|
|
"filter": nil,
|
|
},
|
|
}, &result)
|
|
require.NoError(t, err)
|
|
assert.NotEmpty(t, result.ExportProcessingActivitiesPDF.Data)
|
|
assert.Contains(t, result.ExportProcessingActivitiesPDF.Data, "data:application/pdf;base64,")
|
|
})
|
|
|
|
t.Run("export processing activities PDF with snapshot filter", func(t *testing.T) {
|
|
_ = factory.NewProcessingActivity(owner).
|
|
WithName("PA Snapshot Export Test").
|
|
Create()
|
|
|
|
// Create snapshot
|
|
var snapshotResult struct {
|
|
CreateSnapshot struct {
|
|
SnapshotEdge struct {
|
|
Node struct {
|
|
ID string `json:"id"`
|
|
} `json:"node"`
|
|
} `json:"snapshotEdge"`
|
|
} `json:"createSnapshot"`
|
|
}
|
|
err := owner.Execute(`
|
|
mutation($input: CreateSnapshotInput!) {
|
|
createSnapshot(input: $input) {
|
|
snapshotEdge {
|
|
node { id }
|
|
}
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"organizationId": owner.GetOrganizationID().String(),
|
|
"name": fmt.Sprintf("PA Export Snapshot Test %d", time.Now().UnixNano()),
|
|
"type": "PROCESSING_ACTIVITIES",
|
|
},
|
|
}, &snapshotResult)
|
|
require.NoError(t, err)
|
|
snapshotID := snapshotResult.CreateSnapshot.SnapshotEdge.Node.ID
|
|
|
|
query := `
|
|
mutation ExportProcessingActivitiesPDF($input: ExportProcessingActivitiesPDFInput!) {
|
|
exportProcessingActivitiesPDF(input: $input) {
|
|
data
|
|
}
|
|
}
|
|
`
|
|
|
|
var result struct {
|
|
ExportProcessingActivitiesPDF struct {
|
|
Data string `json:"data"`
|
|
} `json:"exportProcessingActivitiesPDF"`
|
|
}
|
|
|
|
err = owner.Execute(query, map[string]any{
|
|
"input": map[string]any{
|
|
"organizationId": owner.GetOrganizationID().String(),
|
|
"filter": map[string]any{
|
|
"snapshotId": snapshotID,
|
|
},
|
|
},
|
|
}, &result)
|
|
require.NoError(t, err)
|
|
assert.NotEmpty(t, result.ExportProcessingActivitiesPDF.Data)
|
|
assert.Contains(t, result.ExportProcessingActivitiesPDF.Data, "data:application/pdf;base64,")
|
|
})
|
|
|
|
t.Run("export fails with no processing activities", func(t *testing.T) {
|
|
newOwner := testutil.NewClient(t, testutil.RoleOwner)
|
|
|
|
query := `
|
|
mutation ExportProcessingActivitiesPDF($input: ExportProcessingActivitiesPDFInput!) {
|
|
exportProcessingActivitiesPDF(input: $input) {
|
|
data
|
|
}
|
|
}
|
|
`
|
|
|
|
_, err := newOwner.Do(query, map[string]any{
|
|
"input": map[string]any{
|
|
"organizationId": newOwner.GetOrganizationID().String(),
|
|
"filter": nil,
|
|
},
|
|
})
|
|
testutil.RequireErrorCode(t, err, "NOT_FOUND")
|
|
assert.Contains(t, err.Error(), "no processing activities found")
|
|
})
|
|
}
|
|
|
|
func TestDataProtectionImpactAssessment_ExportPDF(t *testing.T) {
|
|
t.Parallel()
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
|
|
t.Run("export DPIA PDF", func(t *testing.T) {
|
|
pa1ID := factory.NewProcessingActivity(owner).
|
|
WithName("DPIA Export Test PA 1").
|
|
Create()
|
|
pa2ID := factory.NewProcessingActivity(owner).
|
|
WithName("DPIA Export Test PA 2").
|
|
Create()
|
|
|
|
_, err := owner.Do(`
|
|
mutation($input: CreateDataProtectionImpactAssessmentInput!) {
|
|
createDataProtectionImpactAssessment(input: $input) {
|
|
dataProtectionImpactAssessment { id }
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"processingActivityId": pa1ID,
|
|
"description": "DPIA 1 description",
|
|
"residualRisk": "LOW",
|
|
},
|
|
})
|
|
require.NoError(t, err)
|
|
|
|
_, err = owner.Do(`
|
|
mutation($input: CreateDataProtectionImpactAssessmentInput!) {
|
|
createDataProtectionImpactAssessment(input: $input) {
|
|
dataProtectionImpactAssessment { id }
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"processingActivityId": pa2ID,
|
|
"description": "DPIA 2 description",
|
|
"residualRisk": "MEDIUM",
|
|
},
|
|
})
|
|
require.NoError(t, err)
|
|
|
|
query := `
|
|
mutation ExportDataProtectionImpactAssessmentsPDF($input: ExportDataProtectionImpactAssessmentsPDFInput!) {
|
|
exportDataProtectionImpactAssessmentsPDF(input: $input) {
|
|
data
|
|
}
|
|
}
|
|
`
|
|
|
|
var result struct {
|
|
ExportDataProtectionImpactAssessmentsPDF struct {
|
|
Data string `json:"data"`
|
|
} `json:"exportDataProtectionImpactAssessmentsPDF"`
|
|
}
|
|
|
|
err = owner.Execute(query, map[string]any{
|
|
"input": map[string]any{
|
|
"organizationId": owner.GetOrganizationID().String(),
|
|
"filter": nil,
|
|
},
|
|
}, &result)
|
|
require.NoError(t, err)
|
|
assert.NotEmpty(t, result.ExportDataProtectionImpactAssessmentsPDF.Data)
|
|
assert.Contains(t, result.ExportDataProtectionImpactAssessmentsPDF.Data, "data:application/pdf;base64,")
|
|
})
|
|
|
|
t.Run("export fails with no DPIAs", func(t *testing.T) {
|
|
newOwner := testutil.NewClient(t, testutil.RoleOwner)
|
|
|
|
query := `
|
|
mutation ExportDataProtectionImpactAssessmentsPDF($input: ExportDataProtectionImpactAssessmentsPDFInput!) {
|
|
exportDataProtectionImpactAssessmentsPDF(input: $input) {
|
|
data
|
|
}
|
|
}
|
|
`
|
|
|
|
_, err := newOwner.Do(query, map[string]any{
|
|
"input": map[string]any{
|
|
"organizationId": newOwner.GetOrganizationID().String(),
|
|
"filter": nil,
|
|
},
|
|
})
|
|
testutil.RequireErrorCode(t, err, "NOT_FOUND")
|
|
assert.Contains(t, err.Error(), "no data protection impact assessments found")
|
|
})
|
|
}
|
|
|
|
func TestTransferImpactAssessment_ExportPDF(t *testing.T) {
|
|
t.Parallel()
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
|
|
t.Run("export TIA PDF", func(t *testing.T) {
|
|
pa1ID := factory.NewProcessingActivity(owner).
|
|
WithName("TIA Export Test PA 1").
|
|
Create()
|
|
pa2ID := factory.NewProcessingActivity(owner).
|
|
WithName("TIA Export Test PA 2").
|
|
Create()
|
|
|
|
_, err := owner.Do(`
|
|
mutation($input: CreateTransferImpactAssessmentInput!) {
|
|
createTransferImpactAssessment(input: $input) {
|
|
transferImpactAssessment { id }
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"processingActivityId": pa1ID,
|
|
"dataSubjects": "TIA 1 subjects",
|
|
"transfer": "EU to US",
|
|
},
|
|
})
|
|
require.NoError(t, err)
|
|
|
|
_, err = owner.Do(`
|
|
mutation($input: CreateTransferImpactAssessmentInput!) {
|
|
createTransferImpactAssessment(input: $input) {
|
|
transferImpactAssessment { id }
|
|
}
|
|
}
|
|
`, map[string]any{
|
|
"input": map[string]any{
|
|
"processingActivityId": pa2ID,
|
|
"dataSubjects": "TIA 2 subjects",
|
|
"transfer": "EU to UK",
|
|
},
|
|
})
|
|
require.NoError(t, err)
|
|
|
|
query := `
|
|
mutation ExportTransferImpactAssessmentsPDF($input: ExportTransferImpactAssessmentsPDFInput!) {
|
|
exportTransferImpactAssessmentsPDF(input: $input) {
|
|
data
|
|
}
|
|
}
|
|
`
|
|
|
|
var result struct {
|
|
ExportTransferImpactAssessmentsPDF struct {
|
|
Data string `json:"data"`
|
|
} `json:"exportTransferImpactAssessmentsPDF"`
|
|
}
|
|
|
|
err = owner.Execute(query, map[string]any{
|
|
"input": map[string]any{
|
|
"organizationId": owner.GetOrganizationID().String(),
|
|
"filter": nil,
|
|
},
|
|
}, &result)
|
|
require.NoError(t, err)
|
|
assert.NotEmpty(t, result.ExportTransferImpactAssessmentsPDF.Data)
|
|
assert.Contains(t, result.ExportTransferImpactAssessmentsPDF.Data, "data:application/pdf;base64,")
|
|
})
|
|
|
|
t.Run("export fails with no TIAs", func(t *testing.T) {
|
|
newOwner := testutil.NewClient(t, testutil.RoleOwner)
|
|
|
|
query := `
|
|
mutation ExportTransferImpactAssessmentsPDF($input: ExportTransferImpactAssessmentsPDFInput!) {
|
|
exportTransferImpactAssessmentsPDF(input: $input) {
|
|
data
|
|
}
|
|
}
|
|
`
|
|
|
|
_, err := newOwner.Do(query, map[string]any{
|
|
"input": map[string]any{
|
|
"organizationId": newOwner.GetOrganizationID().String(),
|
|
"filter": nil,
|
|
},
|
|
})
|
|
testutil.RequireErrorCode(t, err, "NOT_FOUND")
|
|
assert.Contains(t, err.Error(), "no transfer impact assessments found")
|
|
})
|
|
}
|
|
|
|
func TestProcessingActivity_ExportPDF_RBAC(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
t.Run("owner can export PDF", func(t *testing.T) {
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
_ = factory.NewProcessingActivity(owner).WithName("RBAC Export Test").Create()
|
|
|
|
query := `
|
|
mutation ExportProcessingActivitiesPDF($input: ExportProcessingActivitiesPDFInput!) {
|
|
exportProcessingActivitiesPDF(input: $input) {
|
|
data
|
|
}
|
|
}
|
|
`
|
|
|
|
var result struct {
|
|
ExportProcessingActivitiesPDF struct {
|
|
Data string `json:"data"`
|
|
} `json:"exportProcessingActivitiesPDF"`
|
|
}
|
|
|
|
err := owner.Execute(query, map[string]any{
|
|
"input": map[string]any{
|
|
"organizationId": owner.GetOrganizationID().String(),
|
|
"filter": nil,
|
|
},
|
|
}, &result)
|
|
require.NoError(t, err, "owner should be able to export PDF")
|
|
assert.NotEmpty(t, result.ExportProcessingActivitiesPDF.Data)
|
|
})
|
|
|
|
t.Run("admin can export PDF", func(t *testing.T) {
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
admin := testutil.NewClientInOrg(t, testutil.RoleAdmin, owner)
|
|
_ = factory.NewProcessingActivity(owner).WithName("RBAC Export Test").Create()
|
|
|
|
query := `
|
|
mutation ExportProcessingActivitiesPDF($input: ExportProcessingActivitiesPDFInput!) {
|
|
exportProcessingActivitiesPDF(input: $input) {
|
|
data
|
|
}
|
|
}
|
|
`
|
|
|
|
var result struct {
|
|
ExportProcessingActivitiesPDF struct {
|
|
Data string `json:"data"`
|
|
} `json:"exportProcessingActivitiesPDF"`
|
|
}
|
|
|
|
err := admin.Execute(query, map[string]any{
|
|
"input": map[string]any{
|
|
"organizationId": admin.GetOrganizationID().String(),
|
|
"filter": nil,
|
|
},
|
|
}, &result)
|
|
require.NoError(t, err, "admin should be able to export PDF")
|
|
assert.NotEmpty(t, result.ExportProcessingActivitiesPDF.Data)
|
|
})
|
|
|
|
t.Run("viewer can export PDF", func(t *testing.T) {
|
|
owner := testutil.NewClient(t, testutil.RoleOwner)
|
|
viewer := testutil.NewClientInOrg(t, testutil.RoleViewer, owner)
|
|
_ = factory.NewProcessingActivity(owner).WithName("RBAC Export Test").Create()
|
|
|
|
query := `
|
|
mutation ExportProcessingActivitiesPDF($input: ExportProcessingActivitiesPDFInput!) {
|
|
exportProcessingActivitiesPDF(input: $input) {
|
|
data
|
|
}
|
|
}
|
|
`
|
|
|
|
var result struct {
|
|
ExportProcessingActivitiesPDF struct {
|
|
Data string `json:"data"`
|
|
} `json:"exportProcessingActivitiesPDF"`
|
|
}
|
|
|
|
err := viewer.Execute(query, map[string]any{
|
|
"input": map[string]any{
|
|
"organizationId": viewer.GetOrganizationID().String(),
|
|
"filter": nil,
|
|
},
|
|
}, &result)
|
|
require.NoError(t, err, "viewer should be able to export PDF")
|
|
assert.NotEmpty(t, result.ExportProcessingActivitiesPDF.Data)
|
|
})
|
|
}
|