Skip to content

fix: auditor allow evidence + review crud #2470

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
golanglemonade merged 2 commits into from
Jun 11, 2026
Merged

fix: auditor allow evidence + review crud #2470

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
507b821
feat: auditor role should have crud access to evidence
golanglemonade Jun 11, 2026
e82c270
feat: auditor role should have crud access to evidence
golanglemonade Jun 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions fga/model/generated/crud.fga
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,9 +123,9 @@ extend type organization
define can_delete_entity_type: [service, user] or full_access
define can_create_entity_type: can_edit or can_edit_entity_type

define can_view_evidence: [service, user] or auditor or can_edit_evidence or can_manage_compliance or full_access
define can_edit_evidence: [service, user] or can_delete_evidence or can_manage_compliance or full_access
define can_delete_evidence: [service, user] or can_manage_compliance or full_access
define can_view_evidence: [service, user] or auditor or auditor or can_edit_evidence or can_manage_compliance or full_access
define can_edit_evidence: [service, user] or auditor or can_delete_evidence or can_manage_compliance or full_access
define can_delete_evidence: [service, user] or auditor or can_manage_compliance or full_access
define can_create_evidence: can_edit or can_edit_evidence or auditor or can_manage_compliance

define can_view_file: [service, user] or can_edit_file or full_access
Expand Down Expand Up @@ -270,9 +270,9 @@ extend type organization
define remediation_creator: [group#member]
define can_create_remediation: can_edit or can_edit_remediation or remediation_creator or can_manage_risk or can_manage_compliance

define can_view_review: [service, user, group#member] or auditor or can_edit_review or can_manage_compliance or can_manage_risk or full_access
define can_edit_review: [service, user, group#member] or can_delete_review or can_manage_compliance or can_manage_risk or full_access
define can_delete_review: [service, user, group#member] or can_manage_compliance or can_manage_risk or full_access
define can_view_review: [service, user, group#member] or auditor or auditor or can_edit_review or can_manage_compliance or can_manage_risk or full_access
define can_edit_review: [service, user, group#member] or auditor or can_delete_review or can_manage_compliance or can_manage_risk or full_access
define can_delete_review: [service, user, group#member] or auditor or can_manage_compliance or can_manage_risk or full_access
define review_creator: [group#member]
define can_create_review: can_edit or can_edit_review or review_creator or auditor or can_manage_risk or can_manage_compliance

Expand Down
3 changes: 2 additions & 1 deletion fga/model/roles/roles.fga
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,9 @@ extend type organization
# owner should be able to have full access to all objects in the system that are organization owned. The only exception would be user specific objects like their own user object or personal access tokens.
define owner: [user] or owner from parent

# @create: review, comment, discussion, task, evidence
# @create: comment, discussion, task
# @view: control, subcontrol, program, evidence, policy, procedure, review
# @crud: evidence, review
define auditor: [user] or auditor from parent

# @inherit: can_manage_compliance, can_manage_policies, can_manage_registry, can_manage_risk
Expand Down
8 changes: 8 additions & 0 deletions internal/graphapi/evidence_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -694,6 +694,14 @@ func TestMutationUpdateEvidence(t *testing.T) {
client: suite.client.api,
ctx: sharedViewOnlyUser.UserCtx,
},
{
name: "auditor allowed to updated",
request: testclient.UpdateEvidenceInput{
Status: &enums.EvidenceStatusAuditorApproved,
},
client: suite.client.api,
ctx: sharedAuditorUser.UserCtx,
},
{
name: "update not allowed, no permissions to update but can view due to program membership",
request: testclient.UpdateEvidenceInput{
Expand Down