auditor should be able to view org files/avatar (#2554)

Author: adelowo

fga/model/base/file.fga

@@ -24,10 +24,9 @@ type file
     # parent permissions derived based on `crud` permissions or parents
     define parent_deleter: full_access from parent_context or can_delete from parent
     define parent_editor: can_edit from parent_context or can_edit_file from parent_context or can_edit from parent
-    define parent_viewer: can_view from parent_context or can_view_file from parent_context or can_view from parent
+    define parent_viewer: can_view from parent_context or can_view_file from parent_context or can_view_org from parent or can_view from parent
     define parent_context: [organization]
     # NOTE: organization is generally not considered a parent, but for backwards compatibility with files, we are keeping this here - do not replicate on other models
     define parent: [user, program, organization, group, control, procedure, template, document_data, contact, internal_policy, narrative, evidence, note, trust_center_setting, subprocessor, export, trust_center_watermark_config, standard,trust_center_entity, entity, identity_holder, trust_center_subprocessor, scan, platform, review]
     define tc_doc_parent: [trust_center_doc]
 
-

fga/tests/tests.yaml

@@ -830,6 +830,18 @@ tests:
           can_view: true
           can_edit: true
           can_delete: true
+      - user: user:ulid-auditor # organization auditor should be able to view organization avatar files
+        object: file:file-org-avatar
+        assertions:
+          can_view: true
+          can_edit: false
+          can_delete: false
+      - user: user:ulid-auditor # organization auditor should not view all organization-scoped files
+        object: file:file-org-scoped
+        assertions:
+          can_view: false
+          can_edit: false
+          can_delete: false
       # test user-owned file access
       - user: user:ulid-file-owner # the file owner should have full access
         object: file:file-user-owned

fga/tests/tuples/files.yaml

@@ -26,6 +26,15 @@
 - user: contact:contact-1
   relation: parent
   object: file:file-3 # contact has access to file
+- user: user:ulid-auditor
+  relation: auditor
+  object: organization:auditor-file-org
+- user: organization:auditor-file-org
+  relation: parent
+  object: file:file-org-avatar
+- user: organization:auditor-file-org
+  relation: parent_context
+  object: file:file-org-scoped
 
 #setup organization with empty domain condition
 - user: organization:contact-org#member