fix

Signed-off-by: Sarah Funkhouser <[email protected]>

internal/ent/hooks/objectownedtuples.go

@@ -332,8 +332,10 @@ func HookRelationTuples(objects map[string]string, relation fgax.Relation) ent.H
 // using the tuple structs that are about to be written
 func checkAccessToObjectsFromTuples(ctx context.Context, m ent.Mutation, tuples []fgax.TupleKey) error {
 	for _, tuple := range tuples {
-		objectID := tuple.Object.Identifier
-		objectType := string(tuple.Object.Kind)
+		// subject is the group that the permissions are being added to
+		// this is the reverse edge
+		objectID := tuple.Subject.Identifier
+		objectType := string(tuple.Subject.Kind)
 
 		if _, allow := privacy.DecisionFromContext(ctx); allow {
 			return nil

internal/graphapi/control_test.go

@@ -217,7 +217,7 @@ func (suite *GraphTestSuite) TestMutationCreateControl() {
 		{
 			name: "add groups",
 			request: openlaneclient.CreateControlInput{
-				Name:            "Test Procedure",
+				Name:            "Test Control CC1.2",
 				EditorIDs:       []string{testUser1.GroupID},
 				BlockedGroupIDs: []string{blockedGroup.ID},
 				ViewerIDs:       []string{viewerGroup.ID},