Add entitlements for graph exploration.

Author: apognu

api/handle_graph_walk.go

@@ -12,18 +12,12 @@ import (
 	"github.com/checkmarble/marble-backend/dto"
 	"github.com/checkmarble/marble-backend/models"
 	"github.com/checkmarble/marble-backend/usecases"
-	"github.com/checkmarble/marble-backend/utils"
 )
 
 func handleGraphWalk(uc usecases.Usecases) func(c *gin.Context) {
 	return func(c *gin.Context) {
 		ctx := c.Request.Context()
 
-		organizationId, err := utils.OrganizationIdFromRequest(c.Request)
-		if presentError(ctx, c, err) {
-			return
-		}
-
 		nodeType := c.Param("node_type")
 		nodeId := c.Param("node_id")
 
@@ -40,7 +34,7 @@ func handleGraphWalk(uc usecases.Usecases) func(c *gin.Context) {
 		}
 
 		usecase := usecasesWithCreds(ctx, uc).NewGraphWalkUsecase()
-		result, err := usecase.WalkGraph(ctx, organizationId, nodeType, nodeId, opts)
+		result, err := usecase.WalkGraph(ctx, nodeType, nodeId, opts)
 
 		if presentError(ctx, c, err) {
 			return

dto/license_dto.go

@@ -25,6 +25,7 @@ type LicenseEntitlements struct {
 	ContinuousScreening bool `json:"continuous_screening"`
 	UserScoring         bool `json:"user_scoring"`
 	LexisNexis          bool `json:"lexisnexis"` //nolint:tagliatelle
+	GraphExploration    bool `json:"graph_exploration"`
 }
 
 func AdaptLicenseEntitlements(licenseEntitlements models.LicenseEntitlements) LicenseEntitlements {
@@ -43,6 +44,7 @@ func AdaptLicenseEntitlements(licenseEntitlements models.LicenseEntitlements) Li
 		ContinuousScreening: licenseEntitlements.ContinuousScreening,
 		UserScoring:         licenseEntitlements.UserScoring,
 		LexisNexis:          licenseEntitlements.LexisNexis,
+		GraphExploration:    licenseEntitlements.GraphExploration,
 	}
 }
 

models/license.go

@@ -65,6 +65,7 @@ type LicenseEntitlements struct {
 	ContinuousScreening bool
 	UserScoring         bool
 	LexisNexis          bool
+	GraphExploration    bool
 }
 
 type LicenseValidation struct {
@@ -91,6 +92,7 @@ func NewFullLicense() LicenseValidation {
 			ContinuousScreening: true,
 			UserScoring:         true,
 			LexisNexis:          true,
+			GraphExploration:    true,
 		},
 	}
 }

models/organization_feature_access.go

@@ -23,6 +23,7 @@ type OrganizationFeatureAccess struct {
 	AiRuleBuilding      FeatureAccess `redis:"ai_rule_building"`
 	UserScoring         FeatureAccess `redis:"user_scoring"`
 	LexisNexis          FeatureAccess `redis:"lexisnexis"`
+	GraphExploration    FeatureAccess `redis:"graph_exploration"`
 	CreatedAt           time.Time
 	UpdatedAt           time.Time
 
@@ -41,6 +42,7 @@ type DbStoredOrganizationFeatureAccess struct {
 	AiRuleBuilding      FeatureAccess
 	UserScoring         FeatureAccess
 	LexisNexis          FeatureAccess
+	GraphExploration    FeatureAccess
 	CreatedAt           time.Time
 	UpdatedAt           time.Time
 }
@@ -55,6 +57,7 @@ type UpdateOrganizationFeatureAccessInput struct {
 	AiRuleBuilding      *FeatureAccess
 	UserScoring         *FeatureAccess
 	LexisNexis          *FeatureAccess
+	GraphExploration    *FeatureAccess
 }
 
 type FeaturesConfiguration struct {
@@ -80,6 +83,7 @@ func (f DbStoredOrganizationFeatureAccess) MergeWithLicenseEntitlement(
 		AiRuleBuilding:      f.AiRuleBuilding,
 		UserScoring:         f.UserScoring,
 		LexisNexis:          f.LexisNexis,
+		GraphExploration:    f.GraphExploration,
 		CreatedAt:           f.CreatedAt,
 		UpdatedAt:           f.UpdatedAt,
 	}
@@ -124,6 +128,10 @@ func (f DbStoredOrganizationFeatureAccess) MergeWithLicenseEntitlement(
 	if !l.LexisNexis {
 		o.LexisNexis = Restricted
 	}
+	// TODO: remove for actual entitlement validation
+	if false && !l.GraphExploration {
+		o.GraphExploration = Restricted
+	}
 
 	// remove the feature accesses that are not allowed by the configuration
 	if o.Analytics.IsAllowed() && !c.Analytics {

repositories/dbmodels/db_license.go

@@ -31,6 +31,7 @@ type DBLicense struct {
 	ContinuousScreening  bool               `db:"continuous_screening"`
 	UserScoring          bool               `db:"user_scoring"`
 	LexisNexis           bool               `db:"lexisnexis"`
+	GraphExploration     bool               `db:"graph_exploration"`
 }
 
 const TABLE_LICENSES = "licenses"
@@ -61,6 +62,7 @@ func AdaptLicense(db DBLicense) (models.License, error) {
 			ContinuousScreening: db.ContinuousScreening,
 			UserScoring:         db.UserScoring,
 			LexisNexis:          db.LexisNexis,
+			GraphExploration:    db.GraphExploration,
 		},
 	}, nil
 }

repositories/dbmodels/db_organization_feature_access.go

@@ -23,6 +23,7 @@ type DBOrganizationFeatureAccess struct {
 	AiRuleBuilding      string    `db:"ai_rule_building"`
 	UserScoring         string    `db:"user_scoring"`
 	LexisNexis          string    `db:"lexisnexis"`
+	GraphExploration    string    `db:"graph_exploration"`
 	CreatedAt           time.Time `db:"created_at"`
 	UpdatedAt           time.Time `db:"updated_at"`
 }
@@ -39,6 +40,7 @@ func AdaptOrganizationFeatureAccess(db DBOrganizationFeatureAccess) (models.DbSt
 		AiRuleBuilding:      models.FeatureAccessFrom(db.AiRuleBuilding),
 		UserScoring:         models.FeatureAccessFrom(db.UserScoring),
 		LexisNexis:          models.FeatureAccessFrom(db.LexisNexis),
+		GraphExploration:    models.FeatureAccessFrom(db.GraphExploration),
 		CreatedAt:           db.CreatedAt,
 		UpdatedAt:           db.UpdatedAt,
 	}, nil

repositories/migrations/20260810081900_graph_walking.sql

@@ -1,5 +1,11 @@
 -- +goose Up
 
+alter table licenses
+    add column if not exists graph_exploration boolean default false not null;
+
+alter table organization_feature_access
+    add column if not exists graph_exploration text default 'allowed' not null;
+
 create table graph_relations (
     id uuid primary key default gen_random_uuid(),
     org_id uuid not null,
@@ -20,4 +26,10 @@ create index idx_graph_relations_org_id on graph_relations (org_id);
 
 -- +goose Down
 
+alter table licenses
+    drop column graph_exploration;
+
+alter table organization_feature_access
+    drop column graph_exploration;
+
 drop table graph_relations;

usecases/graph_relation_usecase.go

@@ -16,11 +16,21 @@ import (
 type GraphRelationUsecase struct {
 	enforceSecurity         security.EnforceSecurityOrganization
 	executorFactory         executor_factory.ExecutorFactory
+	featureAccessReader     OrganizationUsecaseFeatureAccessReader
 	dataModelRepository     repositories.DataModelRepository
 	graphRelationRepository repositories.GraphRelationRepository
 }
 
 func (uc GraphRelationUsecase) ListGraphRelations(ctx context.Context) ([]models.GraphRelation, error) {
+	fa, err := uc.featureAccessReader.GetOrganizationFeatureAccess(ctx, uc.enforceSecurity.OrgId(), nil)
+	if err != nil {
+		return []models.GraphRelation{}, err
+	}
+
+	if !fa.GraphExploration.IsAllowed() {
+		return []models.GraphRelation{}, errors.Wrap(models.ForbiddenError,
+			"organization not allowed to use the graph exploration feature")
+	}
 	if err := uc.enforceSecurity.ReadDataModel(); err != nil {
 		return nil, err
 	}
@@ -32,6 +42,15 @@ func (uc GraphRelationUsecase) ListGraphRelations(ctx context.Context) ([]models
 }
 
 func (uc GraphRelationUsecase) CreateGraphRelation(ctx context.Context, input models.CreateGraphRelation) (models.GraphRelation, error) {
+	fa, err := uc.featureAccessReader.GetOrganizationFeatureAccess(ctx, uc.enforceSecurity.OrgId(), nil)
+	if err != nil {
+		return models.GraphRelation{}, err
+	}
+
+	if !fa.GraphExploration.IsAllowed() {
+		return models.GraphRelation{}, errors.Wrap(models.ForbiddenError,
+			"organization not allowed to use the graph exploration feature")
+	}
 	if err := uc.enforceSecurity.WriteDataModel(uc.enforceSecurity.OrgId()); err != nil {
 		return models.GraphRelation{}, err
 	}
@@ -87,6 +106,15 @@ func (uc GraphRelationUsecase) CreateGraphRelation(ctx context.Context, input mo
 }
 
 func (uc GraphRelationUsecase) DeleteGraphRelation(ctx context.Context, relationId uuid.UUID) error {
+	fa, err := uc.featureAccessReader.GetOrganizationFeatureAccess(ctx, uc.enforceSecurity.OrgId(), nil)
+	if err != nil {
+		return err
+	}
+
+	if !fa.GraphExploration.IsAllowed() {
+		return errors.Wrap(models.ForbiddenError,
+			"organization not allowed to use the graph exploration feature")
+	}
 	if err := uc.enforceSecurity.WriteDataModel(uc.enforceSecurity.OrgId()); err != nil {
 		return err
 	}

usecases/graph_relation_usecase_test.go

@@ -29,9 +29,14 @@ func graphRelationUsecase(repo *mocks.GraphRelationRepository, orgId uuid.UUID)
 	dataModelRepository.On("GetDataModel", mock.Anything, mock.Anything, mock.Anything, false, true).
 		Return(amlDataModel(), nil)
 
+	featureAccessReader := new(mocks.FeatureAccessReader)
+	featureAccessReader.On("GetOrganizationFeatureAccess", mock.Anything, mock.Anything, (*models.UserId)(nil)).
+		Return(models.OrganizationFeatureAccess{GraphExploration: models.Allowed}, nil)
+
 	return GraphRelationUsecase{
 		enforceSecurity:         enforceSecurity,
 		executorFactory:         executor_factory.NewExecutorFactoryStub(),
+		featureAccessReader:     featureAccessReader,
 		dataModelRepository:     dataModelRepository,
 		graphRelationRepository: repo,
 	}

usecases/graph_walk_usecase.go

@@ -142,6 +142,7 @@ const (
 type GraphWalkUsecase struct {
 	enforceSecurity         security.EnforceSecurity
 	executorFactory         executor_factory.ExecutorFactory
+	featureAccessReader     OrganizationUsecaseFeatureAccessReader
 	dataModelRepository     repositories.DataModelRepository
 	graphRepository         repositories.GraphRepository
 	graphRelationRepository repositories.GraphRelationRepository
@@ -159,15 +160,25 @@ type GraphWalkUsecase struct {
 // matches reached. Everything newly found feeds the next degree.
 func (uc GraphWalkUsecase) WalkGraph(
 	ctx context.Context,
-	organizationId uuid.UUID,
 	startType, startId string,
 	opts models.GraphWalkOptions,
 ) (models.GraphResult, error) {
-	if err := uc.enforceSecurity.ReadOrganization(organizationId); err != nil {
+	orgId := uc.enforceSecurity.OrgId()
+
+	fa, err := uc.featureAccessReader.GetOrganizationFeatureAccess(ctx, orgId, nil)
+	if err != nil {
+		return models.GraphResult{}, err
+	}
+
+	if !fa.GraphExploration.IsAllowed() {
+		return models.GraphResult{}, errors.Wrap(models.ForbiddenError,
+			"organization not allowed to use the graph exploration feature")
+	}
+	if err := uc.enforceSecurity.ReadOrganization(orgId); err != nil {
 		return models.GraphResult{}, err
 	}
 
-	dataModel, err := uc.dataModelRepository.GetDataModel(ctx, uc.executorFactory.NewExecutor(), organizationId, false, true)
+	dataModel, err := uc.dataModelRepository.GetDataModel(ctx, uc.executorFactory.NewExecutor(), orgId, false, true)
 	if err != nil {
 		return models.GraphResult{}, err
 	}
@@ -184,12 +195,12 @@ func (uc GraphWalkUsecase) WalkGraph(
 
 	// An organization declares its own shared-attribute relations against its own data model. An
 	// organization that has declared none still gets a walk: it just follows links only.
-	relations, err := uc.graphRelationRepository.ListGraphRelations(ctx, uc.executorFactory.NewExecutor(), organizationId)
+	relations, err := uc.graphRelationRepository.ListGraphRelations(ctx, uc.executorFactory.NewExecutor(), orgId)
 	if err != nil {
 		return models.GraphResult{}, err
 	}
 
-	exec, err := uc.executorFactory.NewClientDbExecutor(ctx, organizationId)
+	exec, err := uc.executorFactory.NewClientDbExecutor(ctx, orgId)
 	if err != nil {
 		return models.GraphResult{}, err
 	}
@@ -220,7 +231,7 @@ func (uc GraphWalkUsecase) WalkGraph(
 		return models.GraphResult{}, err
 	}
 
-	if err := uc.enrichGraph(ctx, organizationId, exec, dataModel, graph); err != nil {
+	if err := uc.enrichGraph(ctx, orgId, exec, dataModel, graph); err != nil {
 		return models.GraphResult{}, err
 	}