fix: auditor allow evidence + review crud (#2470)

* feat: auditor role should have crud access to evidence

Signed-off-by: Sarah Funkhouser <147884153+golanglemonade@users.noreply.github.com>

* feat: auditor role should have crud access to evidence

Signed-off-by: Sarah Funkhouser <147884153+golanglemonade@users.noreply.github.com>

---------

Signed-off-by: Sarah Funkhouser <147884153+golanglemonade@users.noreply.github.com>

Author: golanglemonade

fga/model/generated/crud.fga

@@ -123,9 +123,9 @@ extend type organization
     define can_delete_entity_type: [service, user] or full_access
     define can_create_entity_type: can_edit or can_edit_entity_type
 
-    define can_view_evidence: [service, user] or auditor or can_edit_evidence or can_manage_compliance or full_access
-    define can_edit_evidence: [service, user] or can_delete_evidence or can_manage_compliance or full_access
-    define can_delete_evidence: [service, user] or can_manage_compliance or full_access
+    define can_view_evidence: [service, user] or auditor or auditor or can_edit_evidence or can_manage_compliance or full_access
+    define can_edit_evidence: [service, user] or auditor or can_delete_evidence or can_manage_compliance or full_access
+    define can_delete_evidence: [service, user] or auditor or can_manage_compliance or full_access
     define can_create_evidence: can_edit or can_edit_evidence or auditor or can_manage_compliance
 
     define can_view_file: [service, user] or can_edit_file or full_access
@@ -270,9 +270,9 @@ extend type organization
     define remediation_creator: [group#member]
     define can_create_remediation: can_edit or can_edit_remediation or remediation_creator or can_manage_risk or can_manage_compliance
 
-    define can_view_review: [service, user, group#member] or auditor or can_edit_review or can_manage_compliance or can_manage_risk or full_access
-    define can_edit_review: [service, user, group#member] or can_delete_review or can_manage_compliance or can_manage_risk or full_access
-    define can_delete_review: [service, user, group#member] or can_manage_compliance or can_manage_risk or full_access
+    define can_view_review: [service, user, group#member] or auditor or auditor or can_edit_review or can_manage_compliance or can_manage_risk or full_access
+    define can_edit_review: [service, user, group#member] or auditor or can_delete_review or can_manage_compliance or can_manage_risk or full_access
+    define can_delete_review: [service, user, group#member] or auditor or can_manage_compliance or can_manage_risk or full_access
     define review_creator: [group#member]
     define can_create_review: can_edit or can_edit_review or review_creator or auditor or can_manage_risk or can_manage_compliance
 

fga/model/roles/roles.fga

@@ -13,8 +13,9 @@ extend type organization
     # owner should be able to have full access to all objects in the system that are organization owned. The only exception would be user specific objects like their own user object or personal access tokens.
     define owner: [user] or owner from parent
 
-    # @create: review, comment, discussion, task, evidence
+    # @create: comment, discussion, task
     # @view: control, subcontrol, program, evidence, policy, procedure, review
+    # @crud: evidence, review
     define auditor: [user] or auditor from parent
 
     # @inherit: can_manage_compliance, can_manage_policies, can_manage_registry, can_manage_risk

internal/graphapi/evidence_test.go

@@ -694,6 +694,14 @@ func TestMutationUpdateEvidence(t *testing.T) {
 			client: suite.client.api,
 			ctx:    sharedViewOnlyUser.UserCtx,
 		},
+		{
+			name: "auditor allowed to updated",
+			request: testclient.UpdateEvidenceInput{
+				Status: &enums.EvidenceStatusAuditorApproved,
+			},
+			client: suite.client.api,
+			ctx:    sharedAuditorUser.UserCtx,
+		},
 		{
 			name: "update not allowed, no permissions to update but can view due to program membership",
 			request: testclient.UpdateEvidenceInput{