add the integration caller (#2642)

matoszz · web-flow · commit 54bc7b3e4838 · 2026-07-29T16:13:39.000+01:00
diff --git a/config/helm-values.yaml b/config/helm-values.yaml
@@ -285,7 +285,7 @@ coreConfiguration:
       # -- DisplayName is the display name of the virtual support identity, used for record attribution
       displayname: "Openlane Support"  # @schema type:string; default:Openlane Support
       # -- SubjectID is the stable subject id of the virtual support identity used for created_by/updated_by
-      # attribution. It must be a valid ULID and is consistent without a backing user row. Default should match anon.SupportSubjectID
+      # attribution. It must be a valid ULID and is consistent without a backing user row. Default should match auth.SupportSubjectID
       subjectid: "01JSPPRT000000000000000000"  # @schema type:string; default:01JSPPRT000000000000000000
       # -- IssuerURL is the issuer URL of the second factor identity provider
       issuerurl: ""  # @schema type:string
diff --git a/go.mod b/go.mod
@@ -108,7 +108,7 @@ require (
 	github.com/theopenlane/go-client v0.12.5
 	github.com/theopenlane/gqlgen-plugins v0.14.7
 	github.com/theopenlane/httpsling v0.3.0
-	github.com/theopenlane/iam v0.35.1
+	github.com/theopenlane/iam v0.35.4
 	github.com/theopenlane/newman v0.4.2
 	github.com/theopenlane/riverboat v0.9.18
 	github.com/theopenlane/utils v0.7.1
diff --git a/go.sum b/go.sum
@@ -740,8 +740,8 @@ github.com/theopenlane/gqlgen-plugins v0.14.7 h1:B9I6tpgevch3xQfV3qqRTpxHIlJvwtX
 github.com/theopenlane/gqlgen-plugins v0.14.7/go.mod h1:fUjo1cVKEAPLhtRrH+iJtrfivCNp+GxVSB/UJgVBDuA=
 github.com/theopenlane/httpsling v0.3.0 h1:Bad0dGdqCqAB8UVDyVo+YCevzRvGHhmkK22F7T3pXtY=
 github.com/theopenlane/httpsling v0.3.0/go.mod h1:iJc3XRLYTFIpfCnPpLZVMBP0xsWIPAb7ozARtQoclAE=
-github.com/theopenlane/iam v0.35.1 h1:F/tTPwmS7gO1TM0WOleco3z5K+h44QTZY/VUC9i/QdA=
-github.com/theopenlane/iam v0.35.1/go.mod h1:O60TH2GCj6zfXJ8VwKbP6aWZ7l4m7zCK2Qtbrn3bmFo=
+github.com/theopenlane/iam v0.35.4 h1:XnCfCCAXF7lCqtqzkxyeMUhkIe3hCBkL4X4UyJFk3SI=
+github.com/theopenlane/iam v0.35.4/go.mod h1:ZwJNFkCURwpyftECj/o4cu6qifMSdWtblFkzdnU8/Qk=
 github.com/theopenlane/newman v0.4.2 h1:8hcZkPBZgPrROB9UXZSQv4xDUP7KDya2o8WfYokXCl0=
 github.com/theopenlane/newman v0.4.2/go.mod h1:tCDhl2yzEFNg387YdQK5ztgwgH0dYgDnTB8SPqPNRbY=
 github.com/theopenlane/oscalot v0.1.0 h1:ExYiMU4Q1ezbGq77sxkgahmfmc46L+2NqB39fg0HXjU=
diff --git a/internal/ent/hooks/trustcenterndarequest.go b/internal/ent/hooks/trustcenterndarequest.go
@@ -24,7 +24,6 @@ import (
 	"github.com/theopenlane/core/internal/ent/generated/user"
 	"github.com/theopenlane/core/internal/httpserve/authmanager"
 	emaildef "github.com/theopenlane/core/internal/integrations/definitions/email"
-	"github.com/theopenlane/core/pkg/anon"
 	"github.com/theopenlane/core/pkg/logx"
 )
 
@@ -54,7 +53,7 @@ func HookTrustCenterNDARequestCreate() ent.Hook {
 			email, _ := m.Email()
 
 			queryCtx := ctx
-			if anon.IsTrustCenter(ctx) {
+			if auth.IsTrustCenterFromContext(ctx) {
 				queryCtx = privacy.DecisionContext(ctx, privacy.Allow)
 			}
 
diff --git a/internal/ent/interceptors/controls.go b/internal/ent/interceptors/controls.go
@@ -14,7 +14,6 @@ import (
 	"github.com/theopenlane/core/internal/ent/generated/intercept"
 	"github.com/theopenlane/core/internal/ent/privacy/rule"
 	"github.com/theopenlane/core/internal/ent/privacy/utils"
-	"github.com/theopenlane/core/pkg/anon"
 	"github.com/theopenlane/core/pkg/logx"
 )
 
@@ -33,7 +32,7 @@ func InterceptorTrustCenterControl() ent.Interceptor {
 		// 1. marked as trust center controls (cloned from the trust center standard)
 		// 2. have public visibility
 		// 3. owned by the trust center's organization
-		if anon.IsTrustCenter(ctx) {
+		if auth.IsTrustCenterFromContext(ctx) {
 			orgID, err := auth.GetOrganizationIDFromContext(ctx)
 			if err != nil {
 				logx.FromContext(ctx).Err(err).Msg("failed to get organization ID from context for trust center control query")
diff --git a/internal/ent/interceptors/subprocessor.go b/internal/ent/interceptors/subprocessor.go
@@ -9,7 +9,6 @@ import (
 	"github.com/theopenlane/core/internal/ent/generated/intercept"
 	"github.com/theopenlane/core/internal/ent/generated/subprocessor"
 	"github.com/theopenlane/core/internal/ent/generated/trustcentersubprocessor"
-	"github.com/theopenlane/core/pkg/anon"
 	"github.com/theopenlane/iam/auth"
 )
 
@@ -18,7 +17,7 @@ func TraverseSubprocessor() ent.Interceptor {
 	return intercept.TraverseSubprocessor(func(ctx context.Context, q *generated.SubprocessorQuery) error {
 		// allow anonymous access to subprocessors this will only allow view
 		// access to the trust center-owned subprocessors
-		if tcID, _, ok := anon.TrustCenterScope(ctx); ok {
+		if tcID, _, ok := auth.TrustCenterScopeFromContext(ctx); ok {
 			q.Where(
 				subprocessor.Or(
 					subprocessor.And(
diff --git a/internal/ent/privacy/policy/checks.go b/internal/ent/privacy/policy/checks.go
@@ -21,7 +21,6 @@ import (
 	access "github.com/theopenlane/core/internal/ent/privacy"
 	"github.com/theopenlane/core/internal/ent/privacy/rule"
 	"github.com/theopenlane/core/internal/ent/privacy/utils"
-	"github.com/theopenlane/core/pkg/anon"
 	"github.com/theopenlane/core/pkg/logx"
 	"github.com/theopenlane/core/pkg/mapx"
 )
@@ -136,7 +135,7 @@ func CanEditObjectUnderParents(parents []string, fetch func(ctx context.Context,
 // CheckOrgReadAccess checks if the requestor has access to read the organization
 func CheckOrgReadAccess() privacy.QueryRule {
 	return privacy.QueryRuleFunc(func(ctx context.Context, q ent.Query) error {
-		if anon.IsTrustCenter(ctx) {
+		if auth.IsTrustCenterFromContext(ctx) {
 			return privacy.Denyf("anonymous users cannot access organization data")
 		}
 
@@ -404,7 +403,7 @@ func mapEdgeToObjectType(ctx context.Context, schema string, edge string) authzg
 // for an anon trust center request and the only edge to check is for the
 // trust_center edge. This allows the setting of the edge on a trust center child when creating things like an nda request
 func allowTrustCenterEdgeForAnon(ctx context.Context, edges []string) bool {
-	if !anon.IsTrustCenter(ctx) {
+	if !auth.IsTrustCenterFromContext(ctx) {
 		return false
 	}
 
diff --git a/internal/ent/privacy/rule/trustcenter.go b/internal/ent/privacy/rule/trustcenter.go
@@ -10,7 +10,6 @@ import (
 	"github.com/theopenlane/core/internal/ent/generated"
 	"github.com/theopenlane/core/internal/ent/generated/privacy"
 	"github.com/theopenlane/core/internal/ent/privacy/utils"
-	"github.com/theopenlane/core/pkg/anon"
 	"github.com/theopenlane/core/pkg/logx"
 	"github.com/theopenlane/iam/auth"
 	"github.com/theopenlane/iam/fgax"
@@ -37,7 +36,7 @@ func AllowIfTrustCenterAnonRequest() privacy.MutationRule {
 	return privacy.MutationRuleFunc(func(ctx context.Context, _ ent.Mutation) error {
 		logx.FromContext(ctx).Debug().Msg("checking for trust center anon context")
 
-		if anon.IsTrustCenter(ctx) {
+		if auth.IsTrustCenterFromContext(ctx) {
 			return privacy.Allow
 		}
 
diff --git a/internal/ent/schema/mixin_grouppermissions.go b/internal/ent/schema/mixin_grouppermissions.go
@@ -26,7 +26,6 @@ import (
 	"github.com/theopenlane/core/internal/ent/hooks"
 	access "github.com/theopenlane/core/internal/ent/privacy"
 	"github.com/theopenlane/core/internal/ent/privacy/rule"
-	"github.com/theopenlane/core/pkg/anon"
 	"github.com/theopenlane/core/pkg/logx"
 	"github.com/theopenlane/entx/accessmap"
 )
@@ -192,7 +191,7 @@ func (g GroupPermissionsMixin) Interceptors() []ent.Interceptor {
 	// except for blocked groups (e.g. controls)
 	return []ent.Interceptor{intercept.TraverseFunc(func(ctx context.Context, q intercept.Query) error {
 		// anonymous trust center users don't belong to groups, skip group filtering
-		if anon.IsTrustCenter(ctx) {
+		if auth.IsTrustCenterFromContext(ctx) {
 			return nil
 		}
 
diff --git a/internal/ent/schema/mixin_orgowned.go b/internal/ent/schema/mixin_orgowned.go
@@ -18,7 +18,6 @@ import (
 	"github.com/theopenlane/core/internal/ent/hooks"
 	"github.com/theopenlane/core/internal/ent/privacy/rule"
 	"github.com/theopenlane/core/internal/ent/privacy/utils"
-	"github.com/theopenlane/core/pkg/anon"
 	"github.com/theopenlane/core/pkg/logx"
 )
 
@@ -252,10 +251,10 @@ var defaultOrgInterceptorFunc InterceptorFunc = func(o ObjectOwnedMixin) ent.Int
 		}
 
 		// classify the anonymous caller for the access checks below
-		isAnon := anon.IsAnonymous(ctx)
+		isAnon := auth.IsAnonymousFromContext(ctx)
 
 		// questionnaire callers only happen via REST handlers
-		isQuestionnaireCaller := anon.IsQuestionnaire(ctx)
+		isQuestionnaireCaller := auth.IsQuestionnaireFromContext(ctx)
 
 		// Trust Center anon users without GraphQL key are blocked by BlockNonTrustCenterAnonymous middleware;
 		// questionnaire callers are legitimate REST callers and fall through to the org filter further down
@@ -312,7 +311,7 @@ func isAnonTrustCenterCaller(ctx context.Context) (string, bool, error) {
 		return "", false, auth.ErrNoAuthUser
 	}
 
-	if _, orgID, ok := anon.TrustCenterScope(ctx); ok {
+	if _, orgID, ok := auth.TrustCenterScopeFromContext(ctx); ok {
 		return orgID, true, nil
 	}
 
diff --git a/internal/ent/schemautil/trustcenter_scope.go b/internal/ent/schemautil/trustcenter_scope.go
@@ -6,7 +6,6 @@ import (
 	"github.com/theopenlane/iam/auth"
 
 	"github.com/theopenlane/core/internal/ent/generated/trustcenter"
-	"github.com/theopenlane/core/pkg/anon"
 	"github.com/theopenlane/core/pkg/logx"
 )
 
@@ -26,7 +25,7 @@ func TrustCenterScopePredicate() func(*sql.Selector) {
 			return
 		}
 
-		if tcID, _, ok := anon.TrustCenterScope(ctx); ok {
+		if tcID, _, ok := auth.TrustCenterScopeFromContext(ctx); ok {
 			s.Where(sql.EQ(s.C("trust_center_id"), tcID))
 			return
 		}
diff --git a/internal/graphapi/seed_test.go b/internal/graphapi/seed_test.go
@@ -17,7 +17,6 @@ import (
 	ent "github.com/theopenlane/core/internal/ent/generated"
 	"github.com/theopenlane/core/internal/graphapi/testclient"
 	coreutils "github.com/theopenlane/core/internal/testutils"
-	"github.com/theopenlane/core/pkg/anon"
 	authmw "github.com/theopenlane/core/pkg/middleware/auth"
 )
 
@@ -54,7 +53,7 @@ const (
 // on organizationID, layered on top of baseCtx. Support sessions are scoped to a single org, so a
 // context built for one org cannot be used to reach another org's resources
 func newSupportCtx(baseCtx context.Context, organizationID string) context.Context {
-	caller := auth.NewOrgSupportCaller(organizationID, anon.SupportSubjectID, supportSubjectName, supportSubjectEmail)
+	caller := auth.NewOrgSupportCaller(organizationID, auth.SupportSubjectID, supportSubjectName, supportSubjectEmail)
 	return auth.WithCaller(baseCtx, caller)
 }
 
diff --git a/internal/graphapi/trustcenterndarequest.resolvers.go b/internal/graphapi/trustcenterndarequest.resolvers.go
diff --git a/internal/graphapi/user_test.go b/internal/graphapi/user_test.go
@@ -17,7 +17,6 @@ import (
 	"github.com/theopenlane/core/internal/ent/generated/privacy"
 	"github.com/theopenlane/core/internal/ent/hooks"
 	"github.com/theopenlane/core/internal/graphapi/testclient"
-	"github.com/theopenlane/core/pkg/anon"
 )
 
 func TestQueryUser(t *testing.T) {
@@ -376,7 +375,7 @@ func TestMutationDeleteUser(t *testing.T) {
 func TestQueryUserSupportContext(t *testing.T) {
 	orgID := sharedTestUser1.OrganizationID
 
-	caller := auth.NewOrgSupportCaller(orgID, anon.SupportSubjectID, supportSubjectName, supportSubjectEmail)
+	caller := auth.NewOrgSupportCaller(orgID, auth.SupportSubjectID, supportSubjectName, supportSubjectEmail)
 	supportCtx := auth.WithCaller(sharedTestUser1.UserCtx, caller)
 
 	t.Run("Self returns synthetic support user", func(t *testing.T) {
@@ -385,7 +384,7 @@ func TestQueryUserSupportContext(t *testing.T) {
 		assert.NilError(t, err)
 		assert.Assert(t, resp != nil)
 
-		assert.Check(t, is.Equal(anon.SupportSubjectID, resp.Self.ID))
+		assert.Check(t, is.Equal(auth.SupportSubjectID, resp.Self.ID))
 		assert.Check(t, is.Equal(supportSubjectName, resp.Self.DisplayName))
 		assert.Check(t, is.Equal(supportSubjectEmail, resp.Self.Email))
 		assert.Check(t, resp.Self.Setting.EmailConfirmed)
@@ -394,12 +393,12 @@ func TestQueryUserSupportContext(t *testing.T) {
 	})
 
 	t.Run("User returns synthetic support user", func(t *testing.T) {
-		resp, err := suite.client.api.GetUserByID(supportCtx, anon.SupportSubjectID)
+		resp, err := suite.client.api.GetUserByID(supportCtx, auth.SupportSubjectID)
 
 		assert.NilError(t, err)
 		assert.Assert(t, resp != nil)
 
-		assert.Check(t, is.Equal(anon.SupportSubjectID, resp.User.ID))
+		assert.Check(t, is.Equal(auth.SupportSubjectID, resp.User.ID))
 		assert.Check(t, is.Equal(supportSubjectName, resp.User.DisplayName))
 		assert.Check(t, is.Equal(supportSubjectEmail, resp.User.Email))
 	})
diff --git a/internal/httpserve/handlers/handlers.go b/internal/httpserve/handlers/handlers.go
@@ -103,7 +103,7 @@ type SupportAccessConfig struct {
 	// DisplayName is the display name of the virtual support identity, used for record attribution
 	DisplayName string `json:"displayname" koanf:"displayname" default:"Openlane Support"`
 	// SubjectID is the stable subject id of the virtual support identity used for created_by/updated_by
-	// attribution. It must be a valid ULID and is consistent without a backing user row. Default should match anon.SupportSubjectID
+	// attribution. It must be a valid ULID and is consistent without a backing user row. Default should match auth.SupportSubjectID
 	SubjectID string `json:"subjectid" koanf:"subjectid" default:"01JSPPRT000000000000000000"`
 	// Password is the shared password for the virtual support identity, validated against this value
 	Password string `json:"password" koanf:"password" default:"" sensitive:"true"`
diff --git a/internal/httpserve/handlers/support_test.go b/internal/httpserve/handlers/support_test.go
@@ -23,7 +23,6 @@ import (
 	"github.com/theopenlane/core/internal/ent/generated/privacy"
 	"github.com/theopenlane/core/internal/graphapi/testclient"
 	"github.com/theopenlane/core/internal/httpserve/handlers"
-	"github.com/theopenlane/core/pkg/anon"
 	"github.com/theopenlane/core/pkg/middleware/impersonation"
 	"github.com/theopenlane/utils/ulids"
 )
@@ -35,7 +34,7 @@ func supportTestConfig(issuer string) handlers.SupportAccessConfig {
 		Enabled:           true,
 		Email:             "support@theopenlane.io",
 		DisplayName:       "Openlane Support",
-		SubjectID:         anon.SupportSubjectID,
+		SubjectID:         auth.SupportSubjectID,
 		Password:          "super-secret-support-password",
 		ClientID:          "support-client",
 		ClientSecret:      "secret",
@@ -162,7 +161,7 @@ func (suite *HandlerTestSuite) TestSupportAccessLoginAndCallback() {
 			// the minted token must carry both identities: the virtual support user and the individual
 			claims, err := suite.h.TokenManager.ValidateImpersonationToken(context.Background(), cbOut.Token)
 			require.NoError(t, err)
-			assert.Equal(t, anon.SupportSubjectID, claims.UserID, "target is the virtual support identity")
+			assert.Equal(t, auth.SupportSubjectID, claims.UserID, "target is the virtual support identity")
 			assert.Equal(t, "engineer@theopenlane.io", claims.ImpersonatorID, "impersonator is the individual from the IdP")
 			assert.Equal(t, "support", claims.Type)
 			assert.Equal(t, org.ID, claims.OrgID)
diff --git a/internal/integrations/operations/context.go b/internal/integrations/operations/context.go
@@ -1,8 +1,9 @@
 package operations
 
 import (
-	"github.com/theopenlane/core/pkg/gala"
 	"github.com/theopenlane/iam/auth"
+
+	"github.com/theopenlane/core/pkg/gala"
 )
 
 const (
diff --git a/internal/integrations/operations/dispatcher.go b/internal/integrations/operations/dispatcher.go
@@ -6,6 +6,8 @@ import (
 	"errors"
 	"time"
 
+	"github.com/theopenlane/iam/auth"
+
 	"github.com/theopenlane/core/common/enums"
 	ent "github.com/theopenlane/core/internal/ent/generated"
 	"github.com/theopenlane/core/internal/ent/generated/integration"
@@ -43,6 +45,8 @@ func Dispatch(ctx context.Context, reg *registry.Registry, db *ent.Client, runti
 		installation = record
 		definitionID = record.DefinitionID
 		ownerID = record.OwnerID
+
+		ctx = auth.EnsureIntegrationCaller(ctx, record.OwnerID)
 	}
 
 	operation, err := reg.Operation(definitionID, req.Operation)
diff --git a/internal/integrations/runtime/execution.go b/internal/integrations/runtime/execution.go
diff --git a/internal/integrations/runtime/execution_test.go b/internal/integrations/runtime/execution_test.go
diff --git a/internal/integrations/runtime/webhooks.go b/internal/integrations/runtime/webhooks.go
diff --git a/jsonschema/api-docs.md b/jsonschema/api-docs.md
diff --git a/jsonschema/core.config.json b/jsonschema/core.config.json
diff --git a/pkg/anon/anon.go b/pkg/anon/anon.go
diff --git a/pkg/anon/doc.go b/pkg/anon/doc.go

Original file line number	Diff line number	Diff line change
`@@ -24,7 +24,6 @@ import (`
`24`	`24`	`"github.com/theopenlane/core/internal/ent/generated/user"`
`25`	`25`	`"github.com/theopenlane/core/internal/httpserve/authmanager"`
`26`	`26`	`emaildef "github.com/theopenlane/core/internal/integrations/definitions/email"`
`27`		`- "github.com/theopenlane/core/pkg/anon"`
`28`	`27`	`"github.com/theopenlane/core/pkg/logx"`
`29`	`28`	`)`
`30`	`29`
`@@ -54,7 +53,7 @@ func HookTrustCenterNDARequestCreate() ent.Hook {`
`54`	`53`	`email, _ := m.Email()`
`55`	`54`
`56`	`55`	`queryCtx := ctx`
`57`		`- if anon.IsTrustCenter(ctx) {`
	`56`	`+ if auth.IsTrustCenterFromContext(ctx) {`
`58`	`57`	`queryCtx = privacy.DecisionContext(ctx, privacy.Allow)`
`59`	`58`	`}`
`60`	`59`
Original file line number	Diff line number	Diff line change
`@@ -18,7 +18,6 @@ import (`
`18`	`18`	`"github.com/theopenlane/core/internal/ent/hooks"`
`19`	`19`	`"github.com/theopenlane/core/internal/ent/privacy/rule"`
`20`	`20`	`"github.com/theopenlane/core/internal/ent/privacy/utils"`
`21`		`- "github.com/theopenlane/core/pkg/anon"`
`22`	`21`	`"github.com/theopenlane/core/pkg/logx"`
`23`	`22`	`)`
`24`	`23`
`@@ -252,10 +251,10 @@ var defaultOrgInterceptorFunc InterceptorFunc = func(o ObjectOwnedMixin) ent.Int`
`252`	`251`	`}`
`253`	`252`
`254`	`253`	`// classify the anonymous caller for the access checks below`
`255`		`- isAnon := anon.IsAnonymous(ctx)`
	`254`	`+ isAnon := auth.IsAnonymousFromContext(ctx)`
`256`	`255`
`257`	`256`	`// questionnaire callers only happen via REST handlers`
`258`		`- isQuestionnaireCaller := anon.IsQuestionnaire(ctx)`
	`257`	`+ isQuestionnaireCaller := auth.IsQuestionnaireFromContext(ctx)`
`259`	`258`
`260`	`259`	`// Trust Center anon users without GraphQL key are blocked by BlockNonTrustCenterAnonymous middleware;`
`261`	`260`	`// questionnaire callers are legitimate REST callers and fall through to the org filter further down`
`@@ -312,7 +311,7 @@ func isAnonTrustCenterCaller(ctx context.Context) (string, bool, error) {`
`312`	`311`	`return "", false, auth.ErrNoAuthUser`
`313`	`312`	`}`
`314`	`313`
`315`		`- if _, orgID, ok := anon.TrustCenterScope(ctx); ok {`
	`314`	`+ if _, orgID, ok := auth.TrustCenterScopeFromContext(ctx); ok {`
`316`	`315`	`return orgID, true, nil`
`317`	`316`	`}`
`318`	`317`