skip fga check for support user when cloning into a program

Author: adelowo

internal/graphapi/control_clone.go

@@ -214,21 +214,25 @@ func (r *mutationResolver) cloneControls(ctx context.Context, controlsToClone []
 			return nil, generated.ErrPermissionDenied
 		}
 
-		allow, err := r.db.Authz.CheckAccess(ctx, fgax.AccessCheck{
-			ObjectType:  generated.TypeProgram,
-			ObjectID:    *programID,
-			Relation:    fgax.CanEdit,
-			SubjectID:   caller.SubjectID,
-			SubjectType: caller.SubjectType(),
-		})
-		if err != nil {
-			return nil, err
-		}
+		// support users should skip this check but for other users,
+		// we still want to verify they have edit access to the program
+		if !caller.Has(auth.CapOrgSupport) {
+			allow, err := r.db.Authz.CheckAccess(ctx, fgax.AccessCheck{
+				ObjectType:  generated.TypeProgram,
+				ObjectID:    *programID,
+				Relation:    fgax.CanEdit,
+				SubjectID:   caller.SubjectID,
+				SubjectType: caller.SubjectType(),
+			})
+			if err != nil {
+				return nil, err
+			}
 
-		if !allow {
-			logger.Error().Str("organization_id", caller.OrganizationID).Str("user_id", caller.SubjectID).Msg("no access to edit specified program")
+			if !allow {
+				logger.Error().Str("organization_id", caller.OrganizationID).Str("user_id", caller.SubjectID).Msg("no access to edit specified program")
 
-			return nil, generated.ErrPermissionDenied
+				return nil, generated.ErrPermissionDenied
+			}
 		}
 	}
 

internal/graphapi/control_test.go

@@ -821,6 +821,18 @@ func TestMutationCreateControlsByClone(t *testing.T) {
 			client:             suite.client.api,
 			ctx:                sharedTestUser1.UserCtx,
 		},
+		{
+			name: "happy path for support user, all controls under standard with program",
+			request: testclient.CloneControlInput{
+				ControlIDs: controlIDs,
+				ProgramID:  &program.ID,
+			},
+			expectedControls:   controls,
+			expectedStandard:   &publicStandard.ShortName,
+			expectedNumProgram: 1,
+			client:             suite.client.api,
+			ctx:                newSupportCtx(sharedTestUser1.UserCtx, sharedTestUser1.OrganizationID),
+		},
 		{
 			name: "all controls under standard with program no access",
 			request: testclient.CloneControlInput{