Add mapping between risk and mitigation

Signed-off-by: gearnode <bryan@frimin.fr>

pkg/coredata/mitigation.go

@@ -55,6 +55,74 @@ func (c Mitigation) CursorKey(orderBy MitigationOrderField) page.CursorKey {
 	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
 }
 
+func (c *Mitigations) LoadByRiskID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	riskID gid.GID,
+	cursor *page.Cursor[MitigationOrderField],
+) error {
+	q := `
+WITH mtgtns AS (
+	SELECT
+		m.id,
+		m.tenant_id,
+		m.organization_id,
+		m.category,
+		m.name,
+		m.description,
+		m.state,
+		m.importance,
+		m.content_ref,
+		m.created_at,
+		m.updated_at,
+		m.standards
+	FROM
+		mitigations m
+	INNER JOIN
+		risks_mitigations rm ON m.id = rm.mitigation_id
+	WHERE
+		rm.risk_id = @risk_id
+)
+SELECT
+	id,
+	tenant_id,
+	organization_id,
+	category,
+	name,
+	description,
+	state,
+	importance,
+	content_ref,
+	created_at,
+	updated_at,
+	standards
+FROM
+	mtgtns
+WHERE %s
+	AND %s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"risk_id": riskID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query mitigations: %w", err)
+	}
+
+	mitigations, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Mitigation])
+	if err != nil {
+		return fmt.Errorf("cannot collect mitigations: %w", err)
+	}
+
+	*c = mitigations
+
+	return nil
+}
+
 func (c *Mitigations) LoadByControlID(
 	ctx context.Context,
 	conn pg.Conn,

pkg/coredata/risk.go

@@ -50,6 +50,65 @@ func (r *Risk) CursorKey(orderBy RiskOrderField) page.CursorKey {
 	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
 }
 
+func (r *Risks) LoadByMitigationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	mitigationID gid.GID,
+	cursor *page.Cursor[RiskOrderField],
+) error {
+	q := `
+WITH rsks AS (
+	SELECT
+		r.id,
+		r.organization_id,
+		r.name,
+		r.description,
+		r.probability,
+		r.impact,
+		r.created_at,
+		r.updated_at
+	FROM
+		risks r
+	INNER JOIN
+		risks_mitigations rm ON r.id = rm.risk_id
+	WHERE
+		rm.mitigation_id = @mitigation_id
+)
+SELECT
+	id,
+	organization_id,
+	name,
+	description,
+	probability,
+	impact,
+	created_at,
+	updated_at
+FROM
+	rsks
+WHERE %s
+	AND %s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.NamedArgs{"mitigation_id": mitigationID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query risks: %w", err)
+	}
+
+	risks, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Risk])
+	if err != nil {
+		return fmt.Errorf("cannot collect risks: %w", err)
+	}
+
+	*r = risks
+
+	return nil
+}
+
 func (r *Risks) LoadByOrganizationID(
 	ctx context.Context,
 	conn pg.Conn,

pkg/coredata/risk_mitigation.go

@@ -0,0 +1,103 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+)
+
+type (
+	RiskMitigation struct {
+		RiskID       gid.GID      `db:"risk_id"`
+		MitigationID gid.GID      `db:"mitigation_id"`
+		TenantID     gid.TenantID `db:"tenant_id"`
+		CreatedAt    time.Time    `db:"created_at"`
+		Probability  float64      `db:"probability"`
+		Impact       float64      `db:"impact"`
+	}
+
+	RiskMitigations []*RiskMitigation
+)
+
+func (rm RiskMitigation) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO
+    risks_mitigations (
+        risk_id,
+        mitigation_id,
+        tenant_id,
+        probability,
+        impact,
+        created_at
+    )
+VALUES (
+    @risk_id,
+    @mitigation_id,
+    @tenant_id,
+    @probability,
+    @impact,
+    @created_at
+);
+`
+
+	args := pgx.StrictNamedArgs{
+		"risk_id":       rm.RiskID,
+		"mitigation_id": rm.MitigationID,
+		"tenant_id":     scope.GetTenantID(),
+		"probability":   rm.Probability,
+		"impact":        rm.Impact,
+		"created_at":    rm.CreatedAt,
+	}
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}
+
+func (rm RiskMitigation) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+DELETE
+FROM
+    risks_mitigations
+WHERE
+    %s
+    AND risk_id = @risk_id
+    AND mitigation_id = @mitigation_id;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"risk_id":       rm.RiskID,
+		"mitigation_id": rm.MitigationID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}