Add policies

Signed-off-by: gearnode <bryan@frimin.fr>

pkg/api/console/v1/schema.graphql

@@ -121,6 +121,13 @@ type Organization implements Node {
     before: CursorKey
   ): PeopleConnection! @goField(forceResolver: true)
 
+  policies(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+  ): PolicyConnection! @goField(forceResolver: true)
+
   createdAt: Datetime!
   updatedAt: Datetime!
 }
@@ -404,6 +411,9 @@ type Mutation {
   updateControl(input: UpdateControlInput!): UpdateControlPayload!
   uploadEvidence(input: UploadEvidenceInput!): UploadEvidencePayload!
   deleteEvidence(input: DeleteEvidenceInput!): DeleteEvidencePayload!
+  createPolicy(input: CreatePolicyInput!): CreatePolicyPayload!
+  updatePolicy(input: UpdatePolicyInput!): UpdatePolicyPayload!
+  deletePolicy(input: DeletePolicyInput!): DeletePolicyPayload!
 }
 
 input CreateVendorInput {
@@ -621,3 +631,66 @@ input DeleteEvidenceInput {
 type DeleteEvidencePayload {
   deletedEvidenceId: ID!
 }
+
+enum PolicyStatus
+  @goModel(model: "github.com/getprobo/probo/pkg/probo/coredata.PolicyStatus") {
+  DRAFT
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/probo/coredata.PolicyStatusDraft"
+    )
+  ACTIVE
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/probo/coredata.PolicyStatusActive"
+    )
+}
+
+input CreatePolicyInput {
+  organizationId: ID!
+  name: String!
+  content: String!
+  status: PolicyStatus!
+}
+
+input UpdatePolicyInput {
+  id: ID!
+  expectedVersion: Int!
+  name: String
+  content: String
+  status: PolicyStatus
+}
+
+input DeletePolicyInput {
+  policyId: ID!
+}
+
+type CreatePolicyPayload {
+  policyEdge: PolicyEdge!
+}
+
+type UpdatePolicyPayload {
+  policy: Policy!
+}
+
+type DeletePolicyPayload {
+  deletedPolicyId: ID!
+}
+
+type Policy implements Node {
+  id: ID!
+  version: Int!
+  name: String!
+  status: PolicyStatus!
+  content: String!
+  createdAt: Datetime!
+  updatedAt: Datetime!
+}
+
+type PolicyConnection {
+  edges: [PolicyEdge!]!
+  pageInfo: PageInfo!
+}
+
+type PolicyEdge {
+  cursor: CursorKey!
+  node: Policy!
+}

pkg/api/console/v1/types/policy.go

@@ -0,0 +1,51 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"github.com/getprobo/probo/pkg/page"
+	"github.com/getprobo/probo/pkg/probo/coredata"
+)
+
+func NewPolicy(policy *coredata.Policy) *Policy {
+	return &Policy{
+		ID:        policy.ID,
+		Version:   policy.Version,
+		Name:      policy.Name,
+		Content:   policy.Content,
+		CreatedAt: policy.CreatedAt,
+		UpdatedAt: policy.UpdatedAt,
+		Status:    policy.Status,
+	}
+}
+
+func NewPolicyEdge(policy *coredata.Policy) *PolicyEdge {
+	return &PolicyEdge{
+		Cursor: policy.CursorKey(),
+		Node:   NewPolicy(policy),
+	}
+}
+
+func NewPolicyConnection(page *page.Page[*coredata.Policy]) *PolicyConnection {
+	edges := make([]*PolicyEdge, len(page.Data))
+	for i, policy := range page.Data {
+		edges[i] = NewPolicyEdge(policy)
+	}
+
+	return &PolicyConnection{
+		Edges:    edges,
+		PageInfo: NewPageInfo(page),
+	}
+}

pkg/api/console/v1/types/types.go

@@ -102,6 +102,17 @@ type CreatePeoplePayload struct {
 	PeopleEdge *PeopleEdge `json:"peopleEdge"`
 }
 
+type CreatePolicyInput struct {
+	OrganizationID gid.GID               `json:"organizationId"`
+	Name           string                `json:"name"`
+	Content        string                `json:"content"`
+	Status         coredata.PolicyStatus `json:"status"`
+}
+
+type CreatePolicyPayload struct {
+	PolicyEdge *PolicyEdge `json:"policyEdge"`
+}
+
 type CreateTaskInput struct {
 	ControlID   gid.GID `json:"controlId"`
 	Name        string  `json:"name"`
@@ -153,6 +164,14 @@ type DeletePeoplePayload struct {
 	DeletedPeopleID gid.GID `json:"deletedPeopleId"`
 }
 
+type DeletePolicyInput struct {
+	PolicyID gid.GID `json:"policyId"`
+}
+
+type DeletePolicyPayload struct {
+	DeletedPolicyID gid.GID `json:"deletedPolicyId"`
+}
+
 type DeleteTaskInput struct {
 	TaskID gid.GID `json:"taskId"`
 }
@@ -246,6 +265,7 @@ type Organization struct {
 	Frameworks *FrameworkConnection `json:"frameworks"`
 	Vendors    *VendorConnection    `json:"vendors"`
 	Peoples    *PeopleConnection    `json:"peoples"`
+	Policies   *PolicyConnection    `json:"policies"`
 	CreatedAt  time.Time            `json:"createdAt"`
 	UpdatedAt  time.Time            `json:"updatedAt"`
 }
@@ -294,6 +314,29 @@ type PeopleEdge struct {
 	Node   *People        `json:"node"`
 }
 
+type Policy struct {
+	ID        gid.GID               `json:"id"`
+	Version   int                   `json:"version"`
+	Name      string                `json:"name"`
+	Status    coredata.PolicyStatus `json:"status"`
+	Content   string                `json:"content"`
+	CreatedAt time.Time             `json:"createdAt"`
+	UpdatedAt time.Time             `json:"updatedAt"`
+}
+
+func (Policy) IsNode()             {}
+func (this Policy) GetID() gid.GID { return this.ID }
+
+type PolicyConnection struct {
+	Edges    []*PolicyEdge `json:"edges"`
+	PageInfo *PageInfo     `json:"pageInfo"`
+}
+
+type PolicyEdge struct {
+	Cursor page.CursorKey `json:"cursor"`
+	Node   *Policy        `json:"node"`
+}
+
 type Query struct {
 }
 
@@ -382,6 +425,18 @@ type UpdatePeoplePayload struct {
 	People *People `json:"people"`
 }
 
+type UpdatePolicyInput struct {
+	ID              gid.GID                `json:"id"`
+	ExpectedVersion int                    `json:"expectedVersion"`
+	Name            *string                `json:"name,omitempty"`
+	Content         *string                `json:"content,omitempty"`
+	Status          *coredata.PolicyStatus `json:"status,omitempty"`
+}
+
+type UpdatePolicyPayload struct {
+	Policy *Policy `json:"policy"`
+}
+
 type UpdateTaskStateInput struct {
 	TaskID gid.GID            `json:"taskId"`
 	State  coredata.TaskState `json:"state"`

pkg/api/console/v1/v1_resolver.go

@@ -375,6 +375,53 @@ func (r *mutationResolver) DeleteEvidence(ctx context.Context, input types.Delet
 	}, nil
 }
 
+// CreatePolicy is the resolver for the createPolicy field.
+func (r *mutationResolver) CreatePolicy(ctx context.Context, input types.CreatePolicyInput) (*types.CreatePolicyPayload, error) {
+	policy, err := r.proboSvc.Policies.Create(ctx, probo.CreatePolicyRequest{
+		OrganizationID: input.OrganizationID,
+		Name:           input.Name,
+		Content:        input.Content,
+		Status:         input.Status,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("cannot create policy: %w", err)
+	}
+
+	return &types.CreatePolicyPayload{
+		PolicyEdge: types.NewPolicyEdge(policy),
+	}, nil
+}
+
+// UpdatePolicy is the resolver for the updatePolicy field.
+func (r *mutationResolver) UpdatePolicy(ctx context.Context, input types.UpdatePolicyInput) (*types.UpdatePolicyPayload, error) {
+	policy, err := r.proboSvc.Policies.Update(ctx, probo.UpdatePolicyRequest{
+		ID:              input.ID,
+		ExpectedVersion: input.ExpectedVersion,
+		Name:            input.Name,
+		Content:         input.Content,
+		Status:          input.Status,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("cannot update policy: %w", err)
+	}
+
+	return &types.UpdatePolicyPayload{
+		Policy: types.NewPolicy(policy),
+	}, nil
+}
+
+// DeletePolicy is the resolver for the deletePolicy field.
+func (r *mutationResolver) DeletePolicy(ctx context.Context, input types.DeletePolicyInput) (*types.DeletePolicyPayload, error) {
+	err := r.proboSvc.Policies.Delete(ctx, input.PolicyID)
+	if err != nil {
+		return nil, fmt.Errorf("cannot delete policy: %w", err)
+	}
+
+	return &types.DeletePolicyPayload{
+		DeletedPolicyID: input.PolicyID,
+	}, nil
+}
+
 // Frameworks is the resolver for the frameworks field.
 func (r *organizationResolver) Frameworks(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.FrameworkConnection, error) {
 	cursor := types.NewCursor(first, after, last, before)
@@ -411,6 +458,18 @@ func (r *organizationResolver) Peoples(ctx context.Context, obj *types.Organizat
 	return types.NewPeopleConnection(page), nil
 }
 
+// Policies is the resolver for the policies field.
+func (r *organizationResolver) Policies(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.PolicyConnection, error) {
+	cursor := types.NewCursor(first, after, last, before)
+
+	page, err := r.proboSvc.Policies.ListByOrganization(ctx, obj.ID, cursor)
+	if err != nil {
+		return nil, fmt.Errorf("cannot list organization policies: %w", err)
+	}
+
+	return types.NewPolicyConnection(page), nil
+}
+
 // Node is the resolver for the node field.
 func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error) {
 	switch id.EntityType() {
@@ -463,6 +522,12 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 		}
 
 		return types.NewEvidence(evidence), nil
+	case coredata.PolicyEntityType:
+		policy, err := r.proboSvc.Policies.Get(ctx, id)
+		if err != nil {
+			return nil, err
+		}
+		return types.NewPolicy(policy), nil
 	default:
 	}
 

pkg/probo/coredata/entity_type_reg.go

@@ -25,4 +25,5 @@ const (
 	VendorEntityType
 	PeopleEntityType
 	EvidenceStateTransitionEntityType
+	PolicyEntityType
 )

pkg/probo/coredata/migrations/20250228T000000Z.sql

@@ -0,0 +1,12 @@
+CREATE TYPE policy_status AS ENUM ('DRAFT', 'ACTIVE');
+
+CREATE TABLE policies (
+    id TEXT PRIMARY KEY,
+    organization_id TEXT REFERENCES organizations(id) NOT NULL,
+    name TEXT NOT NULL,
+    content TEXT NOT NULL,
+    status policy_status NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    updated_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    version INTEGER NOT NULL
+); 

pkg/probo/coredata/policy.go

@@ -0,0 +1,250 @@
+package coredata
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/page"
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+)
+
+type (
+	Policy struct {
+		ID             gid.GID      `db:"id"`
+		OrganizationID gid.GID      `db:"organization_id"`
+		Status         PolicyStatus `db:"status"`
+		Name           string       `db:"name"`
+		Content        string       `db:"content"`
+		CreatedAt      time.Time    `db:"created_at"`
+		UpdatedAt      time.Time    `db:"updated_at"`
+		Version        int          `db:"version"`
+	}
+
+	Policies []*Policy
+
+	UpdatePolicyParams struct {
+		ExpectedVersion int
+		Name            *string
+		Content         *string
+		Status          *PolicyStatus
+	}
+)
+
+func (p Policy) CursorKey() page.CursorKey {
+	return page.NewCursorKey(p.ID, p.CreatedAt)
+}
+
+func (p *Policy) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope *Scope,
+	policyID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    name,
+	status,
+    content,
+    created_at,
+    updated_at,
+    version
+FROM
+    policies
+WHERE
+    %s
+    AND id = @policy_id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"policy_id": policyID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query policies: %w", err)
+	}
+
+	policy, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Policy])
+	if err != nil {
+		return fmt.Errorf("cannot collect policy: %w", err)
+	}
+
+	*p = policy
+
+	return nil
+}
+
+func (p *Policies) LoadByOrganizationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope *Scope,
+	organizationID gid.GID,
+	cursor *page.Cursor,
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    name,
+	status,
+    content,
+    created_at,
+    updated_at,
+    version
+FROM
+    policies
+WHERE
+    %s
+    AND organization_id = @organization_id
+    AND %s
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"organization_id": organizationID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query policies: %w", err)
+	}
+
+	policies, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Policy])
+	if err != nil {
+		return fmt.Errorf("cannot collect policies: %w", err)
+	}
+
+	*p = policies
+
+	return nil
+}
+
+func (p Policy) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+) error {
+	q := `
+INSERT INTO
+    policies (
+        id,
+        organization_id,
+        name,
+		status,
+        content,
+        created_at,
+        updated_at,
+        version
+    )
+VALUES (
+    @policy_id,
+    @organization_id,
+    @name,
+    @status,
+    @content,
+    @created_at,
+    @updated_at,
+    @version
+);
+`
+
+	args := pgx.StrictNamedArgs{
+		"policy_id":       p.ID,
+		"organization_id": p.OrganizationID,
+		"name":            p.Name,
+		"status":          p.Status,
+		"content":         p.Content,
+		"created_at":      p.CreatedAt,
+		"updated_at":      p.UpdatedAt,
+		"version":         p.Version,
+	}
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}
+
+func (p Policy) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope *Scope,
+) error {
+	q := `
+DELETE FROM policies WHERE %s AND id = @policy_id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"policy_id": p.ID}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}
+
+func (p *Policy) Update(
+	ctx context.Context,
+	conn pg.Conn,
+	scope *Scope,
+	params UpdatePolicyParams,
+) error {
+	q := `
+UPDATE policies SET
+    name = COALESCE(@name, name),
+    status = COALESCE(@status, status),
+    content = COALESCE(@content, content),
+    updated_at = @updated_at,
+    version = version + 1
+WHERE %s
+    AND id = @policy_id
+    AND version = @expected_version
+RETURNING 
+    id,
+    organization_id,
+    name,
+    content,
+    created_at,
+    updated_at,
+	status,
+    version
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"policy_id":        p.ID,
+		"expected_version": params.ExpectedVersion,
+		"updated_at":       time.Now(),
+	}
+
+	if params.Name != nil {
+		args["name"] = *params.Name
+	}
+	if params.Content != nil {
+		args["content"] = *params.Content
+	}
+	if params.Status != nil {
+		args["status"] = *params.Status
+	}
+
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query policies: %w", err)
+	}
+
+	policy, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Policy])
+	if err != nil {
+		return fmt.Errorf("cannot collect policy: %w", err)
+	}
+
+	*p = policy
+
+	return nil
+}

pkg/probo/coredata/policy_status.go

@@ -0,0 +1,74 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"database/sql/driver"
+	"fmt"
+)
+
+type (
+	PolicyStatus uint8
+)
+
+const (
+	PolicyStatusDraft PolicyStatus = iota
+	PolicyStatusActive
+)
+
+func (ps PolicyStatus) MarshalText() ([]byte, error) {
+	return []byte(ps.String()), nil
+}
+
+func (ps *PolicyStatus) UnmarshalText(data []byte) error {
+	val := string(data)
+
+	switch val {
+	case PolicyStatusDraft.String():
+		*ps = PolicyStatusDraft
+	case PolicyStatusActive.String():
+		*ps = PolicyStatusActive
+	default:
+		return fmt.Errorf("invalid PolicyStatus value: %q", val)
+	}
+
+	return nil
+}
+
+func (ps PolicyStatus) String() string {
+	var val string
+
+	switch ps {
+	case PolicyStatusDraft:
+		val = "DRAFT"
+	case PolicyStatusActive:
+		val = "ACTIVE"
+	}
+
+	return val
+}
+
+func (ps *PolicyStatus) Scan(value any) error {
+	val, ok := value.(string)
+	if !ok {
+		return fmt.Errorf("invalid scan source for PolicyStatus, expected string got %T", value)
+	}
+
+	return ps.UnmarshalText([]byte(val))
+}
+
+func (ps PolicyStatus) Value() (driver.Value, error) {
+	return ps.String(), nil
+}

pkg/probo/policy_service.go

@@ -0,0 +1,162 @@
+package probo
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/page"
+	"github.com/getprobo/probo/pkg/probo/coredata"
+	"go.gearno.de/kit/pg"
+)
+
+type PolicyService struct {
+	svc *Service
+}
+
+type (
+	CreatePolicyRequest struct {
+		OrganizationID gid.GID
+		Name           string
+		Status         coredata.PolicyStatus
+		Content        string
+	}
+
+	UpdatePolicyRequest struct {
+		ID              gid.GID
+		ExpectedVersion int
+		Name            *string
+		Content         *string
+		Status          *coredata.PolicyStatus
+	}
+)
+
+func (s *PolicyService) Get(
+	ctx context.Context,
+	policyID gid.GID,
+) (*coredata.Policy, error) {
+	policy := &coredata.Policy{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return policy.LoadByID(ctx, conn, s.svc.scope, policyID)
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return policy, nil
+}
+
+func (s *PolicyService) Create(
+	ctx context.Context,
+	req CreatePolicyRequest,
+) (*coredata.Policy, error) {
+	now := time.Now()
+	policyID, err := gid.NewGID(coredata.PolicyEntityType)
+	if err != nil {
+		return nil, fmt.Errorf("cannot create policy global id: %w", err)
+	}
+
+	organization := &coredata.Organization{}
+	policy := &coredata.Policy{
+		ID:             policyID,
+		OrganizationID: req.OrganizationID,
+		Name:           req.Name,
+		Content:        req.Content,
+		Status:         req.Status,
+		CreatedAt:      now,
+		UpdatedAt:      now,
+	}
+
+	err = s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := organization.LoadByID(ctx, conn, s.svc.scope, req.OrganizationID); err != nil {
+				return fmt.Errorf("cannot load organization %q: %w", req.OrganizationID, err)
+			}
+
+			if err := policy.Insert(ctx, conn); err != nil {
+				return fmt.Errorf("cannot insert policy: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return policy, nil
+}
+
+func (s *PolicyService) Update(
+	ctx context.Context,
+	req UpdatePolicyRequest,
+) (*coredata.Policy, error) {
+	params := coredata.UpdatePolicyParams{
+		ExpectedVersion: req.ExpectedVersion,
+		Name:            req.Name,
+		Content:         req.Content,
+		Status:          req.Status,
+	}
+
+	policy := &coredata.Policy{ID: req.ID}
+
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			return policy.Update(ctx, conn, s.svc.scope, params)
+		})
+	if err != nil {
+		return nil, err
+	}
+
+	return policy, nil
+}
+
+func (s *PolicyService) Delete(
+	ctx context.Context,
+	policyID gid.GID,
+) error {
+	policy := coredata.Policy{ID: policyID}
+
+	return s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return policy.Delete(ctx, conn, s.svc.scope)
+		},
+	)
+}
+
+func (s *PolicyService) ListByOrganization(
+	ctx context.Context,
+	organizationID gid.GID,
+	cursor *page.Cursor,
+) (*page.Page[*coredata.Policy], error) {
+	var policies coredata.Policies
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return policies.LoadByOrganizationID(
+				ctx,
+				conn,
+				s.svc.scope,
+				organizationID,
+				cursor,
+			)
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(policies, cursor), nil
+}

pkg/probo/service.go

@@ -30,10 +30,17 @@ type (
 		scope  *coredata.Scope
 		s3     *s3.Client
 		bucket string
+
+		Policies *PolicyService
 	}
 )
 
-func NewService(ctx context.Context, pgClient *pg.Client, s3Client *s3.Client, bucket string) (*Service, error) {
+func NewService(
+	ctx context.Context,
+	pgClient *pg.Client,
+	s3Client *s3.Client,
+	bucket string,
+) (*Service, error) {
 	err := migrator.NewMigrator(pgClient, coredata.Migrations).Run(ctx, "migrations")
 	if err != nil {
 		return nil, fmt.Errorf("cannot migrate database schema: %w", err)
@@ -43,10 +50,14 @@ func NewService(ctx context.Context, pgClient *pg.Client, s3Client *s3.Client, b
 		return nil, fmt.Errorf("bucket is required")
 	}
 
-	return &Service{
+	svc := &Service{
 		pg:     pgClient,
 		s3:     s3Client,
 		scope:  coredata.NewScope(), // must be created from auth
 		bucket: bucket,
-	}, nil
+	}
+
+	svc.Policies = &PolicyService{svc: svc}
+
+	return svc, nil
 }