Remove VulnerabilityFunnelStep and VulnerabilityResolutionFunnel from GraphQL authorization todo list

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

TL;DR

Remove VulnerabilityFunnelStep and VulnerabilityResolutionFunnel from config/authz/graphql/authorization_todo.txt once the funnel step services are implemented.

Context

These two types were added to authorization_todo.txt in !239809 (merged) as part of the GraphQL scaffolding for the vulnerability resolution funnel. The file contains a note discouraging further additions.

The types currently rely on resolver-level authorization (authorize!(object) and validate_advanced_vuln_management! in VulnerabilityResolutionFunnelResolver) rather than type-level authorization, which is why they were added to the list. This is acceptable for the stub resolver, but should be revisited when real data is returned.

Acceptance Criteria

  • type:VulnerabilityFunnelStep removed from config/authz/graphql/authorization_todo.txt
  • type:VulnerabilityResolutionFunnel removed from config/authz/graphql/authorization_todo.txt
  • Authorization approach for both types confirmed (resolver-level is sufficient, or type-level added if needed)

Implementation Details

File to update: config/authz/graphql/authorization_todo.txt

Types to evaluate:

  • ee/app/graphql/types/security/vulnerability_funnel_step_type.rb
  • ee/app/graphql/types/security/vulnerability_resolution_funnel_type.rb

Testing Approach

  • Unit tests
  • Integration tests
  • Manual validation steps

Estimate

Edited by 🤖 GitLab Bot 🤖