rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refactor risk management

Browse Source 
Signed-off-by: gearnode <bryan@frimin.fr>
This commit is contained in:
gearnode
2025-04-12 00:18:31 -07:00
parent c5e7f030a8
commit 16efab774a
48 changed files with 5725 additions and 779 deletions
Download Patch File Download Diff File Expand all files Collapse all files

79
pkg/server/api/console/v1/schema.graphql
View File

@@ -608,8 +608,12 @@ type Risk implements Node {
id: ID!
name: String!
description: String!
probability: Float!
impact: Float!
inherentLikelihood: Float!
inherentImpact: Float!
inherentSeverity: Float!
residualLikelihood: Float!
residualImpact: Float!
residualSeverity: Float!
mitigations(
first: Int
@@ -619,6 +623,22 @@ type Risk implements Node {
orderBy: MitigationOrder
): MitigationConnection! @goField(forceResolver: true)
policies(
first: Int
after: CursorKey
last: Int
before: CursorKey
orderBy: PolicyOrder
): PolicyConnection! @goField(forceResolver: true)
controls(
first: Int
after: CursorKey
last: Int
before: CursorKey
orderBy: ControlOrder
): ControlConnection! @goField(forceResolver: true)
createdAt: Datetime!
updatedAt: Datetime!
}
@@ -831,8 +851,19 @@ type Mutation {
createRisk(input: CreateRiskInput!): CreateRiskPayload!
updateRisk(input: UpdateRiskInput!): UpdateRiskPayload!
deleteRisk(input: DeleteRiskInput!): DeleteRiskPayload!
createRiskMapping(input: CreateRiskMappingInput!): CreateRiskMappingPayload!
deleteRiskMapping(input: DeleteRiskMappingInput!): DeleteRiskMappingPayload!
createRiskMitigationMapping(
input: CreateRiskMitigationMappingInput!
): CreateRiskMitigationMappingPayload!
deleteRiskMitigationMapping(
input: DeleteRiskMitigationMappingInput!
): DeleteRiskMitigationMappingPayload!
createRiskPolicyMapping(
input: CreateRiskPolicyMappingInput!
): CreateRiskPolicyMappingPayload!
deleteRiskPolicyMapping(
input: DeleteRiskPolicyMappingInput!
): DeleteRiskPolicyMappingPayload!
# Evidence mutations
requestEvidence(input: RequestEvidenceInput!): RequestEvidencePayload!
@@ -1033,34 +1064,46 @@ input CreateRiskInput {
organizationId: ID!
name: String!
description: String!
probability: Float!
impact: Float!
inherentLikelihood: Float!
inherentImpact: Float!
residualLikelihood: Float
residualImpact: Float
}
input UpdateRiskInput {
id: ID!
name: String
description: String
probability: Float
impact: Float
inherentLikelihood: Float
inherentImpact: Float
residualLikelihood: Float
residualImpact: Float
}
input DeleteRiskInput {
riskId: ID!
}
input CreateRiskMappingInput {
input CreateRiskMitigationMappingInput {
riskId: ID!
mitigationId: ID!
probability: Float!
impact: Float!
}
input DeleteRiskMappingInput {
input DeleteRiskMitigationMappingInput {
riskId: ID!
mitigationId: ID!
}
input CreateRiskPolicyMappingInput {
riskId: ID!
policyId: ID!
}
input DeleteRiskPolicyMappingInput {
riskId: ID!
policyId: ID!
}
input RequestEvidenceInput {
taskId: ID!
name: String!
@@ -1250,11 +1293,19 @@ type DeleteRiskPayload {
deletedRiskId: ID!
}
type CreateRiskMappingPayload {
type CreateRiskMitigationMappingPayload {
success: Boolean!
}
type DeleteRiskMappingPayload {
type DeleteRiskMitigationMappingPayload {
success: Boolean!
}
type CreateRiskPolicyMappingPayload {
success: Boolean!
}
type DeleteRiskPolicyMappingPayload {
success: Boolean!
}

1553
pkg/server/api/console/v1/schema/schema.go
View File

File diff suppressed because it is too large Load Diff

18
pkg/server/api/console/v1/types/risk.go
View File

@@ -45,12 +45,16 @@ func NewRiskEdge(r *coredata.Risk, orderBy coredata.RiskOrderField) *RiskEdge {
func NewRisk(r *coredata.Risk) *Risk {
return &Risk{
ID: r.ID,
Name: r.Name,
Description: r.Description,
Probability: r.Probability,
Impact: r.Impact,
CreatedAt: r.CreatedAt,
UpdatedAt: r.UpdatedAt,
ID: r.ID,
Name: r.Name,
Description: r.Description,
InherentLikelihood: r.InherentLikelihood,
InherentImpact: r.InherentImpact,
InherentSeverity: r.InherentSeverity(),
ResidualLikelihood: r.ResidualLikelihood,
ResidualImpact: r.ResidualImpact,
ResidualSeverity: r.ResidualSeverity(),
CreatedAt: r.CreatedAt,
UpdatedAt: r.UpdatedAt,
}
}

74
pkg/server/api/console/v1/types/types.go
View File

@@ -147,21 +147,21 @@ type CreatePolicyPayload struct {
}
type CreateRiskInput struct {
OrganizationID gid.GID `json:"organizationId"`
Name string `json:"name"`
Description string `json:"description"`
Probability float64 `json:"probability"`
Impact float64 `json:"impact"`
OrganizationID gid.GID `json:"organizationId"`
Name string `json:"name"`
Description string `json:"description"`
InherentLikelihood float64 `json:"inherentLikelihood"`
InherentImpact float64 `json:"inherentImpact"`
ResidualLikelihood *float64 `json:"residualLikelihood,omitempty"`
ResidualImpact *float64 `json:"residualImpact,omitempty"`
}
type CreateRiskMappingInput struct {
type CreateRiskMitigationMappingInput struct {
RiskID gid.GID `json:"riskId"`
MitigationID gid.GID `json:"mitigationId"`
Probability float64 `json:"probability"`
Impact float64 `json:"impact"`
}
type CreateRiskMappingPayload struct {
type CreateRiskMitigationMappingPayload struct {
Success bool `json:"success"`
}
@@ -169,6 +169,15 @@ type CreateRiskPayload struct {
RiskEdge *RiskEdge `json:"riskEdge"`
}
type CreateRiskPolicyMappingInput struct {
RiskID gid.GID `json:"riskId"`
PolicyID gid.GID `json:"policyId"`
}
type CreateRiskPolicyMappingPayload struct {
Success bool `json:"success"`
}
type CreateTaskInput struct {
MitigationID gid.GID `json:"mitigationId"`
Name string `json:"name"`
@@ -269,12 +278,12 @@ type DeleteRiskInput struct {
RiskID gid.GID `json:"riskId"`
}
type DeleteRiskMappingInput struct {
type DeleteRiskMitigationMappingInput struct {
RiskID gid.GID `json:"riskId"`
MitigationID gid.GID `json:"mitigationId"`
}
type DeleteRiskMappingPayload struct {
type DeleteRiskMitigationMappingPayload struct {
Success bool `json:"success"`
}
@@ -282,6 +291,15 @@ type DeleteRiskPayload struct {
DeletedRiskID gid.GID `json:"deletedRiskId"`
}
type DeleteRiskPolicyMappingInput struct {
RiskID gid.GID `json:"riskId"`
PolicyID gid.GID `json:"policyId"`
}
type DeleteRiskPolicyMappingPayload struct {
Success bool `json:"success"`
}
type DeleteTaskInput struct {
TaskID gid.GID `json:"taskId"`
}
@@ -536,14 +554,20 @@ type RequestEvidencePayload struct {
}
type Risk struct {
ID gid.GID `json:"id"`
Name string `json:"name"`
Description string `json:"description"`
Probability float64 `json:"probability"`
Impact float64 `json:"impact"`
Mitigations *MitigationConnection `json:"mitigations"`
CreatedAt time.Time `json:"createdAt"`
UpdatedAt time.Time `json:"updatedAt"`
ID gid.GID `json:"id"`
Name string `json:"name"`
Description string `json:"description"`
InherentLikelihood float64 `json:"inherentLikelihood"`
InherentImpact float64 `json:"inherentImpact"`
InherentSeverity float64 `json:"inherentSeverity"`
ResidualLikelihood float64 `json:"residualLikelihood"`
ResidualImpact float64 `json:"residualImpact"`
ResidualSeverity float64 `json:"residualSeverity"`
Mitigations *MitigationConnection `json:"mitigations"`
Policies *PolicyConnection `json:"policies"`
Controls *ControlConnection `json:"controls"`
CreatedAt time.Time `json:"createdAt"`
UpdatedAt time.Time `json:"updatedAt"`
}
func (Risk) IsNode() {}
@@ -656,11 +680,13 @@ type UpdatePolicyPayload struct {
}
type UpdateRiskInput struct {
ID gid.GID `json:"id"`
Name *string `json:"name,omitempty"`
Description *string `json:"description,omitempty"`
Probability *float64 `json:"probability,omitempty"`
Impact *float64 `json:"impact,omitempty"`
ID gid.GID `json:"id"`
Name *string `json:"name,omitempty"`
Description *string `json:"description,omitempty"`
InherentLikelihood *float64 `json:"inherentLikelihood,omitempty"`
InherentImpact *float64 `json:"inherentImpact,omitempty"`
ResidualLikelihood *float64 `json:"residualLikelihood,omitempty"`
ResidualImpact *float64 `json:"residualImpact,omitempty"`
}
type UpdateRiskPayload struct {

155
pkg/server/api/console/v1/v1_resolver.go
View File

@@ -723,11 +723,13 @@ func (r *mutationResolver) CreateRisk(ctx context.Context, input types.CreateRis
risk, err := svc.Risks.Create(
ctx,
probo.CreateRiskRequest{
OrganizationID: input.OrganizationID,
Name: input.Name,
Description: input.Description,
Probability: input.Probability,
Impact: input.Impact,
OrganizationID: input.OrganizationID,
Name: input.Name,
Description: input.Description,
InherentLikelihood: input.InherentLikelihood,
InherentImpact: input.InherentImpact,
ResidualLikelihood: input.ResidualLikelihood,
ResidualImpact: input.ResidualImpact,
},
)
if err != nil {
@@ -746,11 +748,13 @@ func (r *mutationResolver) UpdateRisk(ctx context.Context, input types.UpdateRis
risk, err := svc.Risks.Update(
ctx,
probo.UpdateRiskRequest{
ID: input.ID,
Name: input.Name,
Description: input.Description,
Probability: input.Probability,
Impact: input.Impact,
ID: input.ID,
Name: input.Name,
Description: input.Description,
InherentLikelihood: input.InherentLikelihood,
InherentImpact: input.InherentImpact,
ResidualLikelihood: input.ResidualLikelihood,
ResidualImpact: input.ResidualImpact,
},
)
if err != nil {
@@ -776,30 +780,58 @@ func (r *mutationResolver) DeleteRisk(ctx context.Context, input types.DeleteRis
}, nil
}
// CreateRiskMapping is the resolver for the createRiskMapping field.
func (r *mutationResolver) CreateRiskMapping(ctx context.Context, input types.CreateRiskMappingInput) (*types.CreateRiskMappingPayload, error) {
// CreateRiskMitigationMapping is the resolver for the createRiskMitigationMapping field.
func (r *mutationResolver) CreateRiskMitigationMapping(ctx context.Context, input types.CreateRiskMitigationMappingInput) (*types.CreateRiskMitigationMappingPayload, error) {
svc := r.GetTenantServiceIfAuthorized(ctx, input.RiskID.TenantID())
err := svc.Risks.CreateMapping(ctx, input.RiskID, input.MitigationID, input.Probability, input.Impact)
err := svc.Risks.CreateMitigationMapping(ctx, input.RiskID, input.MitigationID)
if err != nil {
panic(fmt.Errorf("cannot create risk mapping: %w", err))
panic(fmt.Errorf("cannot create risk mitigation mapping: %w", err))
}
return &types.CreateRiskMappingPayload{
return &types.CreateRiskMitigationMappingPayload{
Success: true,
}, nil
}
// DeleteRiskMapping is the resolver for the deleteRiskMapping field.
func (r *mutationResolver) DeleteRiskMapping(ctx context.Context, input types.DeleteRiskMappingInput) (*types.DeleteRiskMappingPayload, error) {
// DeleteRiskMitigationMapping is the resolver for the deleteRiskMitigationMapping field.
func (r *mutationResolver) DeleteRiskMitigationMapping(ctx context.Context, input types.DeleteRiskMitigationMappingInput) (*types.DeleteRiskMitigationMappingPayload, error) {
svc := r.GetTenantServiceIfAuthorized(ctx, input.RiskID.TenantID())
err := svc.Risks.DeleteMapping(ctx, input.RiskID, input.MitigationID)
err := svc.Risks.DeleteMitigationMapping(ctx, input.RiskID, input.MitigationID)
if err != nil {
panic(fmt.Errorf("cannot delete risk mapping: %w", err))
panic(fmt.Errorf("cannot delete risk mitigation mapping: %w", err))
}
return &types.DeleteRiskMappingPayload{
return &types.DeleteRiskMitigationMappingPayload{
Success: true,
}, nil
}
// CreateRiskPolicyMapping is the resolver for the createRiskPolicyMapping field.
func (r *mutationResolver) CreateRiskPolicyMapping(ctx context.Context, input types.CreateRiskPolicyMappingInput) (*types.CreateRiskPolicyMappingPayload, error) {
svc := r.GetTenantServiceIfAuthorized(ctx, input.RiskID.TenantID())
err := svc.Risks.CreatePolicyMapping(ctx, input.RiskID, input.PolicyID)
if err != nil {
panic(fmt.Errorf("cannot create risk policy mapping: %w", err))
}
return &types.CreateRiskPolicyMappingPayload{
Success: true,
}, nil
}
// DeleteRiskPolicyMapping is the resolver for the deleteRiskPolicyMapping field.
func (r *mutationResolver) DeleteRiskPolicyMapping(ctx context.Context, input types.DeleteRiskPolicyMappingInput) (*types.DeleteRiskPolicyMappingPayload, error) {
svc := r.GetTenantServiceIfAuthorized(ctx, input.RiskID.TenantID())
err := svc.Risks.DeletePolicyMapping(ctx, input.RiskID, input.PolicyID)
if err != nil {
panic(fmt.Errorf("cannot delete risk policy mapping: %w", err))
}
return &types.DeleteRiskPolicyMappingPayload{
Success: true,
}, nil
}
@@ -1336,6 +1368,56 @@ func (r *riskResolver) Mitigations(ctx context.Context, obj *types.Risk, first *
return types.NewMitigationConnection(page), nil
}
// Policies is the resolver for the policies field.
func (r *riskResolver) Policies(ctx context.Context, obj *types.Risk, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.PolicyOrderBy) (*types.PolicyConnection, error) {
svc := r.GetTenantServiceIfAuthorized(ctx, obj.ID.TenantID())
pageOrderBy := page.OrderBy[coredata.PolicyOrderField]{
Field: coredata.PolicyOrderFieldCreatedAt,
Direction: page.OrderDirectionDesc,
}
if orderBy != nil {
pageOrderBy = page.OrderBy[coredata.PolicyOrderField]{
Field: orderBy.Field,
Direction: orderBy.Direction,
}
}
cursor := types.NewCursor(first, after, last, before, pageOrderBy)
page, err := svc.Policies.ListForRiskID(ctx, obj.ID, cursor)
if err != nil {
panic(fmt.Errorf("cannot list risk policies: %w", err))
}
return types.NewPolicyConnection(page), nil
}
// Controls is the resolver for the controls field.
func (r *riskResolver) Controls(ctx context.Context, obj *types.Risk, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy) (*types.ControlConnection, error) {
svc := r.GetTenantServiceIfAuthorized(ctx, obj.ID.TenantID())
pageOrderBy := page.OrderBy[coredata.ControlOrderField]{
Field: coredata.ControlOrderFieldCreatedAt,
Direction: page.OrderDirectionDesc,
}
if orderBy != nil {
pageOrderBy = page.OrderBy[coredata.ControlOrderField]{
Field: orderBy.Field,
Direction: orderBy.Direction,
}
}
cursor := types.NewCursor(first, after, last, before, pageOrderBy)
page, err := svc.Controls.ListForRiskID(ctx, obj.ID, cursor)
if err != nil {
panic(fmt.Errorf("cannot list risk controls: %w", err))
}
return types.NewControlConnection(page), nil
}
// AssignedTo is the resolver for the assignedTo field.
func (r *taskResolver) AssignedTo(ctx context.Context, obj *types.Task) (*types.People, error) {
svc := r.GetTenantServiceIfAuthorized(ctx, obj.ID.TenantID())
@@ -1509,3 +1591,36 @@ type taskResolver struct{ *Resolver }
type vendorResolver struct{ *Resolver }
type vendorComplianceReportResolver struct{ *Resolver }
type viewerResolver struct{ *Resolver }
// !!! WARNING !!!
// The code below was going to be deleted when updating resolvers. It has been copied here so you have
// one last chance to move it out of harms way if you want. There are two reasons this happens:
// - When renaming or deleting a resolver the old code will be put in here. You can safely delete
// it when you're done.
// - You have helper methods in this file. Move them out to keep these resolver files clean.
/*
func (r *mutationResolver) CreateRiskControlMapping(ctx context.Context, input types.CreateRiskControlMappingInput) (*types.CreateRiskControlMappingPayload, error) {
svc := r.GetTenantServiceIfAuthorized(ctx, input.RiskID.TenantID())
err := svc.Risks.CreateControlMapping(ctx, input.RiskID, input.ControlID)
if err != nil {
panic(fmt.Errorf("cannot create risk control mapping: %w", err))
}
return &types.CreateRiskControlMappingPayload{
Success: true,
}, nil
}
func (r *mutationResolver) DeleteRiskControlMapping(ctx context.Context, input types.DeleteRiskControlMappingInput) (*types.DeleteRiskControlMappingPayload, error) {
svc := r.GetTenantServiceIfAuthorized(ctx, input.RiskID.TenantID())
err := svc.Risks.DeleteControlMapping(ctx, input.RiskID, input.ControlID)
if err != nil {
panic(fmt.Errorf("cannot delete risk control mapping: %w", err))
}
return &types.DeleteRiskControlMappingPayload{
Success: true,
}, nil
}
*/