rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refactor risk management

Browse Source 
Signed-off-by: gearnode <bryan@frimin.fr>
This commit is contained in:
gearnode
2025-04-12 00:18:31 -07:00
parent c5e7f030a8
commit 16efab774a
48 changed files with 5725 additions and 779 deletions
Download Patch File Download Diff File Expand all files Collapse all files

66
pkg/coredata/control.go
View File

@@ -175,6 +175,72 @@ WHERE %s
return nil
}
func (c *Controls) LoadByRiskID(
ctx context.Context,
conn pg.Conn,
scope Scoper,
riskID gid.GID,
cursor *page.Cursor[ControlOrderField],
) error {
q := `
WITH ctrl AS (
SELECT DISTINCT
c.id,
c.reference_id,
c.framework_id,
c.tenant_id,
c.name,
c.description,
c.created_at,
c.updated_at
FROM
controls c
LEFT JOIN
controls_policies cp ON c.id = cp.control_id
LEFT JOIN
risks_policies rp ON cp.policy_id = rp.policy_id
LEFT JOIN
controls_mitigations cm ON c.id = cm.control_id
LEFT JOIN
risks_mitigations rm ON (rm.mitigation_id = cm.mitigation_id)
WHERE
rp.risk_id = @risk_id OR rm.risk_id = @risk_id
)
SELECT
id,
reference_id,
framework_id,
tenant_id,
name,
description,
created_at,
updated_at
FROM
ctrl
WHERE %s
AND %s
`
q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
args := pgx.NamedArgs{"risk_id": riskID}
maps.Copy(args, scope.SQLArguments())
maps.Copy(args, cursor.SQLArguments())
rows, err := conn.Query(ctx, q, args)
if err != nil {
return fmt.Errorf("cannot query controls: %w", err)
}
controls, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Control])
if err != nil {
return fmt.Errorf("cannot collect controls: %w", err)
}
*c = controls
return nil
}
func (c *Controls) LoadByFrameworkID(
ctx context.Context,
conn pg.Conn,

7
pkg/coredata/migrations/20250411T212500Z.sql Normal file
View File

@@ -0,0 +1,7 @@
ALTER TABLE risks RENAME COLUMN probability TO likelihood;
ALTER TABLE risks ADD COLUMN residual_likelihood float;
ALTER TABLE risks ADD COLUMN residual_impact float;
ALTER TABLE risks ALTER COLUMN likelihood TYPE float;
ALTER TABLE risks ALTER COLUMN impact TYPE float;
ALTER TABLE risks_mitigations DROP COLUMN probability, DROP COLUMN impact;

5
pkg/coredata/migrations/20250411T215600Z.sql Normal file
View File

@@ -0,0 +1,5 @@
UPDATE risks SET residual_impact = impact WHERE residual_impact IS NULL;
UPDATE risks SET residual_likelihood = likelihood WHERE residual_likelihood IS NULL;
ALTER TABLE risks ALTER COLUMN residual_impact SET NOT NULL;
ALTER TABLE risks ALTER COLUMN residual_likelihood SET NOT NULL;

2
pkg/coredata/migrations/20250411T225200Z.sql Normal file
View File

@@ -0,0 +1,2 @@
ALTER TABLE risks RENAME COLUMN likelihood TO inherent_likelihood;
ALTER TABLE risks RENAME COLUMN impact TO inherent_impact;

7
pkg/coredata/migrations/20250411T233300Z.sql Normal file
View File

@@ -0,0 +1,7 @@
CREATE TABLE risks_policies (
risk_id TEXT NOT NULL REFERENCES risks(id),
policy_id TEXT NOT NULL REFERENCES policies(id),
tenant_id TEXT NOT NULL,
created_at timestamp NOT NULL,
PRIMARY KEY (risk_id, policy_id)
);

63
pkg/coredata/policy.go
View File

@@ -299,3 +299,66 @@ WHERE %s
return nil
}
func (p *Policies) LoadByRiskID(
ctx context.Context,
conn pg.Conn,
scope Scoper,
riskID gid.GID,
cursor *page.Cursor[PolicyOrderField],
) error {
q := `
WITH plcs AS (
SELECT
p.id,
p.tenant_id,
p.organization_id,
p.owner_id,
p.name,
p.content,
p.status,
p.review_date,
p.created_at,
p.updated_at
FROM
policies p
INNER JOIN
risks_policies rp ON p.id = rp.policy_id
WHERE
rp.risk_id = @risk_id
)
SELECT
id,
organization_id,
owner_id,
name,
content,
status,
review_date,
created_at,
updated_at
FROM
plcs
WHERE %s
AND %s
`
q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
args := pgx.StrictNamedArgs{"risk_id": riskID}
maps.Copy(args, scope.SQLArguments())
maps.Copy(args, cursor.SQLArguments())
rows, err := conn.Query(ctx, q, args)
if err != nil {
return fmt.Errorf("cannot query policies: %w", err)
}
policies, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Policy])
if err != nil {
return fmt.Errorf("cannot collect policies: %w", err)
}
*p = policies
return nil
}

95
pkg/coredata/risk.go
View File

@@ -28,14 +28,16 @@ import (
type (
Risk struct {
ID gid.GID
OrganizationID gid.GID
Name string
Description string
Probability float64
Impact float64
CreatedAt time.Time
UpdatedAt time.Time
ID gid.GID `db:"id"`
OrganizationID gid.GID `db:"organization_id"`
Name string `db:"name"`
Description string `db:"description"`
InherentLikelihood float64 `db:"inherent_likelihood"`
InherentImpact float64 `db:"inherent_impact"`
ResidualLikelihood float64 `db:"residual_likelihood"`
ResidualImpact float64 `db:"residual_impact"`
CreatedAt time.Time `db:"created_at"`
UpdatedAt time.Time `db:"updated_at"`
}
Risks []*Risk
@@ -50,6 +52,14 @@ func (r *Risk) CursorKey(orderBy RiskOrderField) page.CursorKey {
panic(fmt.Sprintf("unsupported order by: %s", orderBy))
}
func (r *Risk) InherentSeverity() float64 {
return r.InherentLikelihood * r.InherentImpact
}
func (r *Risk) ResidualSeverity() float64 {
return r.ResidualLikelihood * r.ResidualImpact
}
func (r *Risks) LoadByMitigationID(
ctx context.Context,
conn pg.Conn,
@@ -65,8 +75,10 @@ WITH rsks AS (
r.tenant_id,
r.name,
r.description,
r.probability,
r.impact,
r.inherent_likelihood,
r.inherent_impact,
r.residual_likelihood,
r.residual_impact,
r.created_at,
r.updated_at
FROM
@@ -81,8 +93,10 @@ SELECT
organization_id,
name,
description,
probability,
impact,
inherent_likelihood,
inherent_impact,
residual_likelihood,
residual_impact,
created_at,
updated_at
FROM
@@ -123,8 +137,10 @@ SELECT
organization_id,
name,
description,
probability,
impact,
inherent_likelihood,
inherent_impact,
residual_likelihood,
residual_impact,
created_at,
updated_at
FROM risks
@@ -164,8 +180,10 @@ SELECT
organization_id,
name,
description,
probability,
impact,
inherent_likelihood,
inherent_impact,
residual_likelihood,
residual_impact,
created_at,
updated_at
FROM risks
@@ -199,20 +217,22 @@ func (r *Risk) Insert(
scope Scoper,
) error {
q := `
INSERT INTO risks (id, tenant_id, organization_id, name, description, probability, impact, created_at, updated_at)
VALUES (@id, @tenant_id, @organization_id, @name, @description, @probability, @impact, @created_at, @updated_at)
INSERT INTO risks (id, tenant_id, organization_id, name, description, inherent_likelihood, inherent_impact, residual_likelihood, residual_impact, created_at, updated_at)
VALUES (@id, @tenant_id, @organization_id, @name, @description, @inherent_likelihood, @inherent_impact, @residual_likelihood, @residual_impact, @created_at, @updated_at)
`
args := pgx.StrictNamedArgs{
"id": r.ID,
"tenant_id": scope.GetTenantID(),
"organization_id": r.OrganizationID,
"name": r.Name,
"description": r.Description,
"probability": r.Probability,
"impact": r.Impact,
"created_at": r.CreatedAt,
"updated_at": r.UpdatedAt,
"id": r.ID,
"tenant_id": scope.GetTenantID(),
"organization_id": r.OrganizationID,
"name": r.Name,
"description": r.Description,
"inherent_likelihood": r.InherentLikelihood,
"inherent_impact": r.InherentImpact,
"residual_likelihood": r.ResidualLikelihood,
"residual_impact": r.ResidualImpact,
"created_at": r.CreatedAt,
"updated_at": r.UpdatedAt,
}
_, err := conn.Exec(ctx, q, args)
@@ -229,20 +249,25 @@ UPDATE risks
SET
name = @name,
description = @description,
probability = @probability,
impact = @impact,
inherent_likelihood = @inherent_likelihood,
inherent_impact = @inherent_impact,
residual_likelihood = @residual_likelihood,
residual_impact = @residual_impact,
updated_at = @updated_at
WHERE %s
AND tenant_id = @tenant_id
AND id = @risk_id
`
q = fmt.Sprintf(q, scope.SQLFragment())
args := pgx.StrictNamedArgs{
"name": r.Name,
"description": r.Description,
"probability": r.Probability,
"impact": r.Impact,
"updated_at": r.UpdatedAt,
"risk_id": r.ID,
"name": r.Name,
"description": r.Description,
"inherent_likelihood": r.InherentLikelihood,
"inherent_impact": r.InherentImpact,
"residual_likelihood": r.ResidualLikelihood,
"residual_impact": r.ResidualImpact,
"updated_at": r.UpdatedAt,
}
maps.Copy(args, scope.SQLArguments())

8
pkg/coredata/risk_mitigation.go
View File

@@ -31,8 +31,6 @@ type (
MitigationID gid.GID `db:"mitigation_id"`
TenantID gid.TenantID `db:"tenant_id"`
CreatedAt time.Time `db:"created_at"`
Probability float64 `db:"probability"`
Impact float64 `db:"impact"`
}
RiskMitigations []*RiskMitigation
@@ -49,16 +47,12 @@ INSERT INTO
risk_id,
mitigation_id,
tenant_id,
probability,
impact,
created_at
)
VALUES (
@risk_id,
@mitigation_id,
@tenant_id,
@probability,
@impact,
@created_at
);
`
@@ -67,8 +61,6 @@ VALUES (
"risk_id": rm.RiskID,
"mitigation_id": rm.MitigationID,
"tenant_id": scope.GetTenantID(),
"probability": rm.Probability,
"impact": rm.Impact,
"created_at": rm.CreatedAt,
}
_, err := conn.Exec(ctx, q, args)

95
pkg/coredata/risk_policy.go Normal file
View File

@@ -0,0 +1,95 @@
// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package coredata
import (
"context"
"fmt"
"maps"
"time"
"github.com/getprobo/probo/pkg/gid"
"github.com/jackc/pgx/v5"
"go.gearno.de/kit/pg"
)
type (
RiskPolicy struct {
RiskID gid.GID `db:"risk_id"`
PolicyID gid.GID `db:"policy_id"`
TenantID gid.TenantID `db:"tenant_id"`
CreatedAt time.Time `db:"created_at"`
}
RiskPolicies []*RiskPolicy
)
func (rp RiskPolicy) Insert(
ctx context.Context,
conn pg.Conn,
scope Scoper,
) error {
q := `
INSERT INTO
risks_policies (
risk_id,
policy_id,
tenant_id,
created_at
)
VALUES (
@risk_id,
@policy_id,
@tenant_id,
@created_at
);
`
args := pgx.StrictNamedArgs{
"risk_id": rp.RiskID,
"policy_id": rp.PolicyID,
"tenant_id": scope.GetTenantID(),
"created_at": rp.CreatedAt,
}
_, err := conn.Exec(ctx, q, args)
return err
}
func (rp RiskPolicy) Delete(
ctx context.Context,
conn pg.Conn,
scope Scoper,
) error {
q := `
DELETE
FROM
risks_policies
WHERE
%s
AND risk_id = @risk_id
AND policy_id = @policy_id;
`
q = fmt.Sprintf(q, scope.SQLFragment())
args := pgx.StrictNamedArgs{
"risk_id": rp.RiskID,
"policy_id": rp.PolicyID,
}
maps.Copy(args, scope.SQLArguments())
_, err := conn.Exec(ctx, q, args)
return err
}