adding additional roles to groups graph

Author: papistacoding

internal/ent/interceptors/orgmembers.go

@@ -106,6 +106,18 @@ func getFunctionalRoles(ctx context.Context, userID string) ([]string, error) {
 		return []string{}, nil
 	}
 
+	return GetFunctionalRolesForSubject(ctx, auth.UserSubjectType, userID, caller.OrganizationID)
+}
+
+// GetFunctionalRolesForSubject returns the display names of the functional/organization roles
+// assigned to the given subject on the organization. The subject is a user or a group tupleset
+// (e.g. subjectType "group" with subjectID "<groupID>#member"), matching how the roles were assigned.
+func GetFunctionalRolesForSubject(ctx context.Context, subjectType, subjectID, orgID string) ([]string, error) {
+	caller, ok := auth.CallerFromContext(ctx)
+	if !ok || caller == nil {
+		return []string{}, nil
+	}
+
 	roles, err := fgamodel.OrganizationRoles()
 	if err != nil {
 		return []string{}, err
@@ -117,9 +129,9 @@ func getFunctionalRoles(ctx context.Context, userID string) ([]string, error) {
 	}
 
 	req := fgax.ListAccess{
-		SubjectType: auth.UserSubjectType,
-		SubjectID:   userID,
-		ObjectID:    caller.OrganizationID,
+		SubjectType: subjectType,
+		SubjectID:   subjectID,
+		ObjectID:    orgID,
 		ObjectType:  fgax.Kind(generated.TypeOrganization),
 		Relations:   ids,
 		Context:     utils.NewOrganizationContextKey(caller.SubjectEmail),

internal/graphapi/checksum/.schema_checksum

@@ -1 +1 @@
-efaaa795e6ec05a60fe60bbee7308865268f3285a68ef9ea6bab6eeb1cb05108
+34d59bef43a62206be0291012a8e57d4184b89772d83c1766206867d3aebb9dd

internal/graphapi/clientschema/checksum/.schema_checksum

@@ -1 +1 @@
-6cf47179f1aae3893e66f2e20a0d85d5734ede4a24bd270f2cbbae791c9cd0c4
+9c6cb803fee1b0a2dee46297913841b284f99c2cf7349d45ae9bb0587204094f

internal/graphapi/clientschema/schema.graphql

@@ -33874,6 +33874,10 @@ type Group implements Node {
 		"""
 		last: Int
 	): GroupPermissionConnection!
+	"""
+	additionalRoles are the functional/organization roles assigned to the group on top of object permissions
+	"""
+	additionalRoles: [String!]
 }
 """
 Return response for createBulkGroup mutation

internal/graphapi/generated/ent.generated.go

@@ -57,6 +57,7 @@ type EvidenceResolver interface {
 }
 type GroupResolver interface {
 	Permissions(ctx context.Context, obj *generated.Group, after *entgql.Cursor[string], first *int, before *entgql.Cursor[string], last *int) (*model.GroupPermissionConnection, error)
+	AdditionalRoles(ctx context.Context, obj *generated.Group) ([]string, error)
 }
 type IdentityHolderResolver interface {
 	HasPendingWorkflow(ctx context.Context, obj *generated.IdentityHolder) (bool, error)
@@ -90755,6 +90756,29 @@ func (ec *executionContext) fieldContext_Group_permissions(ctx context.Context,
 	return fc, nil
 }
 
+func (ec *executionContext) _Group_additionalRoles(ctx context.Context, field graphql.CollectedField, obj *generated.Group) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return ec.fieldContext_Group_additionalRoles(ctx, field)
+		},
+		func(ctx context.Context) (any, error) {
+			return ec.Resolvers.Group().AdditionalRoles(ctx, obj)
+		},
+		nil,
+		func(ctx context.Context, selections ast.SelectionSet, v []string) graphql.Marshaler {
+			return ec.marshalOString2ᚕstringᚄ(ctx, selections, v)
+		},
+		true,
+		false,
+	)
+}
+func (ec *executionContext) fieldContext_Group_additionalRoles(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	return graphql.NewScalarFieldContext("Group", field, true, true, errors.New("field of type String does not have child fields"))
+}
+
 func (ec *executionContext) _GroupConnection_edges(ctx context.Context, field graphql.CollectedField, obj *generated.GroupConnection) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
@@ -432904,6 +432928,39 @@ func (ec *executionContext) _Group(ctx context.Context, sel ast.SelectionSet, ob
 				continue
 			}
 
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
+		case "additionalRoles":
+			field := field
+
+			innerFunc := func(ctx context.Context, _ *graphql.FieldSet) (res graphql.Marshaler) {
+				defer func() {
+					if r := recover(); r != nil {
+						ec.Error(ctx, ec.Recover(ctx, r))
+					}
+				}()
+				res = ec._Group_additionalRoles(ctx, field, obj)
+				return res
+			}
+
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
+
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
 			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))

internal/graphapi/generated/root_.generated.go

@@ -138,6 +138,10 @@ extend type Group {
 		"""
 		last: Int
 	): GroupPermissionConnection!
+  """
+  additionalRoles are the functional/organization roles assigned to the group on top of object permissions
+  """
+  additionalRoles: [String!]
 }
 
 """

internal/graphapi/groupextended.resolvers.go

@@ -1 +1 @@
-e1ce94baccdac8be08e35c5a18aa287607897b4aae0b132075d68eba91eefdff
+7cba36adb60f3907481738c4840db8921b01fce4e2b1446cb8c8e52b793b7ed8