Add policies

Signed-off-by: gearnode <bryan@frimin.fr>

pkg/api/console/v1/schema.graphql

@@ -121,6 +121,13 @@ type Organization implements Node {
     before: CursorKey
   ): PeopleConnection! @goField(forceResolver: true)
 
+  policies(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+  ): PolicyConnection! @goField(forceResolver: true)
+
   createdAt: Datetime!
   updatedAt: Datetime!
 }
@@ -404,6 +411,9 @@ type Mutation {
   updateControl(input: UpdateControlInput!): UpdateControlPayload!
   uploadEvidence(input: UploadEvidenceInput!): UploadEvidencePayload!
   deleteEvidence(input: DeleteEvidenceInput!): DeleteEvidencePayload!
+  createPolicy(input: CreatePolicyInput!): CreatePolicyPayload!
+  updatePolicy(input: UpdatePolicyInput!): UpdatePolicyPayload!
+  deletePolicy(input: DeletePolicyInput!): DeletePolicyPayload!
 }
 
 input CreateVendorInput {
@@ -621,3 +631,66 @@ input DeleteEvidenceInput {
 type DeleteEvidencePayload {
   deletedEvidenceId: ID!
 }
+
+enum PolicyStatus
+  @goModel(model: "github.com/getprobo/probo/pkg/probo/coredata.PolicyStatus") {
+  DRAFT
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/probo/coredata.PolicyStatusDraft"
+    )
+  ACTIVE
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/probo/coredata.PolicyStatusActive"
+    )
+}
+
+input CreatePolicyInput {
+  organizationId: ID!
+  name: String!
+  content: String!
+  status: PolicyStatus!
+}
+
+input UpdatePolicyInput {
+  id: ID!
+  expectedVersion: Int!
+  name: String
+  content: String
+  status: PolicyStatus
+}
+
+input DeletePolicyInput {
+  policyId: ID!
+}
+
+type CreatePolicyPayload {
+  policyEdge: PolicyEdge!
+}
+
+type UpdatePolicyPayload {
+  policy: Policy!
+}
+
+type DeletePolicyPayload {
+  deletedPolicyId: ID!
+}
+
+type Policy implements Node {
+  id: ID!
+  version: Int!
+  name: String!
+  status: PolicyStatus!
+  content: String!
+  createdAt: Datetime!
+  updatedAt: Datetime!
+}
+
+type PolicyConnection {
+  edges: [PolicyEdge!]!
+  pageInfo: PageInfo!
+}
+
+type PolicyEdge {
+  cursor: CursorKey!
+  node: Policy!
+}

pkg/api/console/v1/types/policy.go

@@ -0,0 +1,51 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"github.com/getprobo/probo/pkg/page"
+	"github.com/getprobo/probo/pkg/probo/coredata"
+)
+
+func NewPolicy(policy *coredata.Policy) *Policy {
+	return &Policy{
+		ID:        policy.ID,
+		Version:   policy.Version,
+		Name:      policy.Name,
+		Content:   policy.Content,
+		CreatedAt: policy.CreatedAt,
+		UpdatedAt: policy.UpdatedAt,
+		Status:    policy.Status,
+	}
+}
+
+func NewPolicyEdge(policy *coredata.Policy) *PolicyEdge {
+	return &PolicyEdge{
+		Cursor: policy.CursorKey(),
+		Node:   NewPolicy(policy),
+	}
+}
+
+func NewPolicyConnection(page *page.Page[*coredata.Policy]) *PolicyConnection {
+	edges := make([]*PolicyEdge, len(page.Data))
+	for i, policy := range page.Data {
+		edges[i] = NewPolicyEdge(policy)
+	}
+
+	return &PolicyConnection{
+		Edges:    edges,
+		PageInfo: NewPageInfo(page),
+	}
+}

pkg/api/console/v1/types/types.go

@@ -102,6 +102,17 @@ type CreatePeoplePayload struct {
 	PeopleEdge *PeopleEdge `json:"peopleEdge"`
 }
 
+type CreatePolicyInput struct {
+	OrganizationID gid.GID               `json:"organizationId"`
+	Name           string                `json:"name"`
+	Content        string                `json:"content"`
+	Status         coredata.PolicyStatus `json:"status"`
+}
+
+type CreatePolicyPayload struct {
+	PolicyEdge *PolicyEdge `json:"policyEdge"`
+}
+
 type CreateTaskInput struct {
 	ControlID   gid.GID `json:"controlId"`
 	Name        string  `json:"name"`
@@ -153,6 +164,14 @@ type DeletePeoplePayload struct {
 	DeletedPeopleID gid.GID `json:"deletedPeopleId"`
 }
 
+type DeletePolicyInput struct {
+	PolicyID gid.GID `json:"policyId"`
+}
+
+type DeletePolicyPayload struct {
+	DeletedPolicyID gid.GID `json:"deletedPolicyId"`
+}
+
 type DeleteTaskInput struct {
 	TaskID gid.GID `json:"taskId"`
 }
@@ -246,6 +265,7 @@ type Organization struct {
 	Frameworks *FrameworkConnection `json:"frameworks"`
 	Vendors    *VendorConnection    `json:"vendors"`
 	Peoples    *PeopleConnection    `json:"peoples"`
+	Policies   *PolicyConnection    `json:"policies"`
 	CreatedAt  time.Time            `json:"createdAt"`
 	UpdatedAt  time.Time            `json:"updatedAt"`
 }
@@ -294,6 +314,29 @@ type PeopleEdge struct {
 	Node   *People        `json:"node"`
 }
 
+type Policy struct {
+	ID        gid.GID               `json:"id"`
+	Version   int                   `json:"version"`
+	Name      string                `json:"name"`
+	Status    coredata.PolicyStatus `json:"status"`
+	Content   string                `json:"content"`
+	CreatedAt time.Time             `json:"createdAt"`
+	UpdatedAt time.Time             `json:"updatedAt"`
+}
+
+func (Policy) IsNode()             {}
+func (this Policy) GetID() gid.GID { return this.ID }
+
+type PolicyConnection struct {
+	Edges    []*PolicyEdge `json:"edges"`
+	PageInfo *PageInfo     `json:"pageInfo"`
+}
+
+type PolicyEdge struct {
+	Cursor page.CursorKey `json:"cursor"`
+	Node   *Policy        `json:"node"`
+}
+
 type Query struct {
 }
 
@@ -382,6 +425,18 @@ type UpdatePeoplePayload struct {
 	People *People `json:"people"`
 }
 
+type UpdatePolicyInput struct {
+	ID              gid.GID                `json:"id"`
+	ExpectedVersion int                    `json:"expectedVersion"`
+	Name            *string                `json:"name,omitempty"`
+	Content         *string                `json:"content,omitempty"`
+	Status          *coredata.PolicyStatus `json:"status,omitempty"`
+}
+
+type UpdatePolicyPayload struct {
+	Policy *Policy `json:"policy"`
+}
+
 type UpdateTaskStateInput struct {
 	TaskID gid.GID            `json:"taskId"`
 	State  coredata.TaskState `json:"state"`

pkg/api/console/v1/v1_resolver.go

@@ -375,6 +375,53 @@ func (r *mutationResolver) DeleteEvidence(ctx context.Context, input types.Delet
 	}, nil
 }
 
+// CreatePolicy is the resolver for the createPolicy field.
+func (r *mutationResolver) CreatePolicy(ctx context.Context, input types.CreatePolicyInput) (*types.CreatePolicyPayload, error) {
+	policy, err := r.proboSvc.Policies.Create(ctx, probo.CreatePolicyRequest{
+		OrganizationID: input.OrganizationID,
+		Name:           input.Name,
+		Content:        input.Content,
+		Status:         input.Status,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("cannot create policy: %w", err)
+	}
+
+	return &types.CreatePolicyPayload{
+		PolicyEdge: types.NewPolicyEdge(policy),
+	}, nil
+}
+
+// UpdatePolicy is the resolver for the updatePolicy field.
+func (r *mutationResolver) UpdatePolicy(ctx context.Context, input types.UpdatePolicyInput) (*types.UpdatePolicyPayload, error) {
+	policy, err := r.proboSvc.Policies.Update(ctx, probo.UpdatePolicyRequest{
+		ID:              input.ID,
+		ExpectedVersion: input.ExpectedVersion,
+		Name:            input.Name,
+		Content:         input.Content,
+		Status:          input.Status,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("cannot update policy: %w", err)
+	}
+
+	return &types.UpdatePolicyPayload{
+		Policy: types.NewPolicy(policy),
+	}, nil
+}
+
+// DeletePolicy is the resolver for the deletePolicy field.
+func (r *mutationResolver) DeletePolicy(ctx context.Context, input types.DeletePolicyInput) (*types.DeletePolicyPayload, error) {
+	err := r.proboSvc.Policies.Delete(ctx, input.PolicyID)
+	if err != nil {
+		return nil, fmt.Errorf("cannot delete policy: %w", err)
+	}
+
+	return &types.DeletePolicyPayload{
+		DeletedPolicyID: input.PolicyID,
+	}, nil
+}
+
 // Frameworks is the resolver for the frameworks field.
 func (r *organizationResolver) Frameworks(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.FrameworkConnection, error) {
 	cursor := types.NewCursor(first, after, last, before)
@@ -411,6 +458,18 @@ func (r *organizationResolver) Peoples(ctx context.Context, obj *types.Organizat
 	return types.NewPeopleConnection(page), nil
 }
 
+// Policies is the resolver for the policies field.
+func (r *organizationResolver) Policies(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.PolicyConnection, error) {
+	cursor := types.NewCursor(first, after, last, before)
+
+	page, err := r.proboSvc.Policies.ListByOrganization(ctx, obj.ID, cursor)
+	if err != nil {
+		return nil, fmt.Errorf("cannot list organization policies: %w", err)
+	}
+
+	return types.NewPolicyConnection(page), nil
+}
+
 // Node is the resolver for the node field.
 func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error) {
 	switch id.EntityType() {
@@ -463,6 +522,12 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 		}
 
 		return types.NewEvidence(evidence), nil
+	case coredata.PolicyEntityType:
+		policy, err := r.proboSvc.Policies.Get(ctx, id)
+		if err != nil {
+			return nil, err
+		}
+		return types.NewPolicy(policy), nil
 	default:
 	}