Add baa on vendors

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/coredata/entity_type_reg.go

@@ -39,4 +39,6 @@ const (
 	ReportEntityType
 	TrustCenterEntityType
 	TrustCenterAccessEntityType
+	VendorBusinessAssociateAgreementEntityType
+	FileEntityType
 )

pkg/coredata/file.go

@@ -0,0 +1,176 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+)
+
+type (
+	File struct {
+		ID         gid.GID    `db:"id"`
+		BucketName string     `db:"bucket_name"`
+		MimeType   string     `db:"mime_type"`
+		FileName   string     `db:"file_name"`
+		FileKey    string     `db:"file_key"`
+		FileSize   int        `db:"file_size"`
+		CreatedAt  time.Time  `db:"created_at"`
+		UpdatedAt  time.Time  `db:"updated_at"`
+		DeletedAt  *time.Time `db:"deleted_at"`
+	}
+
+	Files []*File
+)
+
+func (f *File) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	fileID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    bucket_name,
+    mime_type,
+    file_name,
+    file_key,
+    file_size,
+    created_at,
+    updated_at,
+    deleted_at
+FROM
+    files
+WHERE
+    %s
+    AND id = @file_id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"file_id": fileID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query file: %w", err)
+	}
+	defer rows.Close()
+
+	file, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[File])
+	if err != nil {
+		return fmt.Errorf("cannot collect file: %w", err)
+	}
+
+	*f = file
+
+	return nil
+}
+
+func (f File) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO
+    files (
+        id,
+        tenant_id,
+        bucket_name,
+        mime_type,
+        file_name,
+        file_key,
+        file_size,
+        created_at,
+        updated_at,
+        deleted_at
+    )
+VALUES (
+    @file_id,
+    @tenant_id,
+    @bucket_name,
+    @mime_type,
+    @file_name,
+    @file_key,
+    @file_size,
+    @created_at,
+    @updated_at,
+    @deleted_at
+)
+`
+
+	args := pgx.StrictNamedArgs{
+		"file_id":     f.ID,
+		"tenant_id":   scope.GetTenantID(),
+		"bucket_name": f.BucketName,
+		"mime_type":   f.MimeType,
+		"file_name":   f.FileName,
+		"file_key":    f.FileKey,
+		"file_size":   f.FileSize,
+		"created_at":  f.CreatedAt,
+		"updated_at":  f.UpdatedAt,
+		"deleted_at":  f.DeletedAt,
+	}
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}
+
+func (f File) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+DELETE FROM files WHERE %s AND id = @file_id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"file_id": f.ID}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}
+
+func (f File) SoftDelete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+UPDATE files SET deleted_at = @deleted_at, updated_at = @updated_at WHERE %s AND id = @file_id
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"file_id":    f.ID,
+		"updated_at": time.Now(),
+		"deleted_at": time.Now(),
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}

pkg/coredata/migrations/20250812T120141Z.sql

@@ -0,0 +1,42 @@
+CREATE TABLE files (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    bucket_name TEXT NOT NULL,
+    mime_type TEXT NOT NULL,
+    file_name TEXT NOT NULL,
+    file_key UUID NOT NULL UNIQUE,
+    file_size INTEGER NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    updated_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    deleted_at TIMESTAMP WITH TIME ZONE
+);
+
+CREATE TABLE vendor_business_associate_agreements (
+    id TEXT PRIMARY KEY,
+    organization_id TEXT NOT NULL,
+    tenant_id TEXT NOT NULL,
+    vendor_id TEXT NOT NULL,
+    valid_from DATE,
+    valid_until DATE,
+    file_id TEXT NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    updated_at TIMESTAMP WITH TIME ZONE NOT NULL,
+
+    CONSTRAINT vendor_business_associate_agreements_organization_vendor_unique
+        UNIQUE (organization_id, vendor_id),
+
+    CONSTRAINT vendor_business_associate_agreements_file_id_unique
+        UNIQUE (file_id),
+
+    CONSTRAINT vendor_business_associate_agreements_organization_id_fkey
+        FOREIGN KEY (organization_id)
+        REFERENCES organizations(id)
+        ON UPDATE CASCADE
+        ON DELETE CASCADE,
+
+    CONSTRAINT vendor_business_associate_agreements_file_id_fkey
+        FOREIGN KEY (file_id)
+        REFERENCES files(id)
+        ON UPDATE CASCADE
+        ON DELETE CASCADE
+);

pkg/coredata/vendor_business_associate_agreement.go

@@ -0,0 +1,277 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/page"
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+)
+
+type (
+	VendorBusinessAssociateAgreement struct {
+		ID             gid.GID    `db:"id"`
+		OrganizationID gid.GID    `db:"organization_id"`
+		VendorID       gid.GID    `db:"vendor_id"`
+		ValidFrom      *time.Time `db:"valid_from"`
+		ValidUntil     *time.Time `db:"valid_until"`
+		FileID         gid.GID    `db:"file_id"`
+		CreatedAt      time.Time  `db:"created_at"`
+		UpdatedAt      time.Time  `db:"updated_at"`
+	}
+
+	VendorBusinessAssociateAgreements []*VendorBusinessAssociateAgreement
+)
+
+func (v VendorBusinessAssociateAgreement) CursorKey(orderBy VendorBusinessAssociateAgreementOrderField) page.CursorKey {
+	switch orderBy {
+	case VendorBusinessAssociateAgreementOrderFieldValidFrom:
+		return page.NewCursorKey(v.ID, v.ValidFrom)
+	case VendorBusinessAssociateAgreementOrderFieldCreatedAt:
+		return page.NewCursorKey(v.ID, v.CreatedAt)
+	}
+
+	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
+}
+
+func (vbaa *VendorBusinessAssociateAgreement) LoadByVendorID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	vendorID gid.GID,
+) error {
+	q := `
+SELECT
+	id,
+	organization_id,
+	vendor_id,
+	valid_from,
+	valid_until,
+	file_id,
+	created_at,
+	updated_at
+FROM
+	vendor_business_associate_agreements
+WHERE
+	%s
+	AND vendor_id = @vendor_id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.NamedArgs{"vendor_id": vendorID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query vendor business associate agreement: %w", err)
+	}
+
+	vendorBusinessAssociateAgreement, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[VendorBusinessAssociateAgreement])
+	if err != nil {
+		return fmt.Errorf("cannot collect vendor business associate agreement: %w", err)
+	}
+
+	*vbaa = vendorBusinessAssociateAgreement
+
+	return nil
+}
+
+func (vbaa *VendorBusinessAssociateAgreement) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	vendorBusinessAssociateAgreementID gid.GID,
+) error {
+	q := `
+SELECT
+	id,
+	organization_id,
+	vendor_id,
+	valid_from,
+	valid_until,
+	file_id,
+	created_at,
+	updated_at
+FROM
+	vendor_business_associate_agreements
+WHERE
+	%s
+	AND id = @id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.NamedArgs{"id": vendorBusinessAssociateAgreementID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query vendor business associate agreement: %w", err)
+	}
+
+	vendorBusinessAssociateAgreement, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[VendorBusinessAssociateAgreement])
+	if err != nil {
+		return fmt.Errorf("cannot collect vendor business associate agreement: %w", err)
+	}
+
+	*vbaa = vendorBusinessAssociateAgreement
+
+	return nil
+}
+
+func (vbaa *VendorBusinessAssociateAgreement) Update(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+UPDATE
+	vendor_business_associate_agreements
+SET
+	valid_from = @valid_from,
+	valid_until = @valid_until,
+	file_id = @file_id,
+	updated_at = @updated_at
+WHERE
+	%s
+	AND id = @id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"id":          vbaa.ID,
+		"valid_from":  vbaa.ValidFrom,
+		"valid_until": vbaa.ValidUntil,
+		"file_id":     vbaa.FileID,
+		"updated_at":  vbaa.UpdatedAt,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot update vendor business associate agreement: %w", err)
+	}
+
+	return nil
+}
+
+func (vbaa *VendorBusinessAssociateAgreement) Upsert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO
+	vendor_business_associate_agreements (
+		id,
+		tenant_id,
+		organization_id,
+		vendor_id,
+		valid_from,
+		valid_until,
+		file_id,
+		created_at,
+		updated_at
+	)
+VALUES (
+	@id,
+	@tenant_id,
+	@organization_id,
+	@vendor_id,
+	@valid_from,
+	@valid_until,
+	@file_id,
+	@created_at,
+	@updated_at
+)
+ON CONFLICT (organization_id, vendor_id) DO UPDATE SET
+	id = EXCLUDED.id,
+	valid_from = EXCLUDED.valid_from,
+	valid_until = EXCLUDED.valid_until,
+	file_id = EXCLUDED.file_id,
+	updated_at = EXCLUDED.updated_at
+`
+	args := pgx.StrictNamedArgs{
+		"id":              vbaa.ID,
+		"tenant_id":       scope.GetTenantID(),
+		"vendor_id":       vbaa.VendorID,
+		"organization_id": vbaa.OrganizationID,
+		"valid_from":      vbaa.ValidFrom,
+		"valid_until":     vbaa.ValidUntil,
+		"file_id":         vbaa.FileID,
+		"created_at":      vbaa.CreatedAt,
+		"updated_at":      vbaa.UpdatedAt,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}
+
+func (vbaa *VendorBusinessAssociateAgreement) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+DELETE
+FROM
+	vendor_business_associate_agreements
+WHERE
+	%s
+	AND id = @id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": vbaa.ID}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}
+
+func (vbaa *VendorBusinessAssociateAgreement) DeleteByVendorID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	vendorID gid.GID,
+) error {
+	q := `
+DELETE
+FROM
+	vendor_business_associate_agreements
+WHERE
+	%s
+	AND vendor_id = @vendor_id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"vendor_id": vendorID}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}

pkg/coredata/vendor_business_associate_agreement_order_field.go

@@ -0,0 +1,41 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+type (
+	VendorBusinessAssociateAgreementOrderField string
+)
+
+const (
+	VendorBusinessAssociateAgreementOrderFieldValidFrom VendorBusinessAssociateAgreementOrderField = "VALID_FROM"
+	VendorBusinessAssociateAgreementOrderFieldCreatedAt VendorBusinessAssociateAgreementOrderField = "CREATED_AT"
+)
+
+func (p VendorBusinessAssociateAgreementOrderField) Column() string {
+	return string(p)
+}
+
+func (p VendorBusinessAssociateAgreementOrderField) String() string {
+	return string(p)
+}
+
+func (p VendorBusinessAssociateAgreementOrderField) MarshalText() ([]byte, error) {
+	return []byte(p.String()), nil
+}
+
+func (p *VendorBusinessAssociateAgreementOrderField) UnmarshalText(text []byte) error {
+	*p = VendorBusinessAssociateAgreementOrderField(text)
+	return nil
+}

pkg/probo/service.go

@@ -51,33 +51,34 @@ type (
 	}
 
 	TenantService struct {
-		pg                      *pg.Client
-		s3                      *s3.Client
-		bucket                  string
-		encryptionKey           cipher.EncryptionKey
-		scope                   coredata.Scoper
-		hostname                string
-		tokenSecret             string
-		trustConfig             TrustConfig
-		agent                   *agents.Agent
-		Frameworks              *FrameworkService
-		Measures                *MeasureService
-		Tasks                   *TaskService
-		Evidences               *EvidenceService
-		Organizations           *OrganizationService
-		Vendors                 *VendorService
-		Peoples                 *PeopleService
-		Documents               *DocumentService
-		Controls                *ControlService
-		Risks                   *RiskService
-		VendorComplianceReports *VendorComplianceReportService
-		Connectors              *ConnectorService
-		Assets                  *AssetService
-		Data                    *DatumService
-		Audits                  *AuditService
-		Reports                 *ReportService
-		TrustCenters            *TrustCenterService
-		TrustCenterAccesses     *TrustCenterAccessService
+		pg                                *pg.Client
+		s3                                *s3.Client
+		bucket                            string
+		encryptionKey                     cipher.EncryptionKey
+		scope                             coredata.Scoper
+		hostname                          string
+		tokenSecret                       string
+		trustConfig                       TrustConfig
+		agent                             *agents.Agent
+		Frameworks                        *FrameworkService
+		Measures                          *MeasureService
+		Tasks                             *TaskService
+		Evidences                         *EvidenceService
+		Organizations                     *OrganizationService
+		Vendors                           *VendorService
+		Peoples                           *PeopleService
+		Documents                         *DocumentService
+		Controls                          *ControlService
+		Risks                             *RiskService
+		VendorComplianceReports           *VendorComplianceReportService
+		VendorBusinessAssociateAgreements *VendorBusinessAssociateAgreementService
+		Connectors                        *ConnectorService
+		Assets                            *AssetService
+		Data                              *DatumService
+		Audits                            *AuditService
+		Reports                           *ReportService
+		TrustCenters                      *TrustCenterService
+		TrustCenterAccesses               *TrustCenterAccessService
 	}
 )
 
@@ -157,6 +158,7 @@ func (s *Service) WithTenant(tenantID gid.TenantID) *TenantService {
 	tenantService.Controls = &ControlService{svc: tenantService}
 	tenantService.Risks = &RiskService{svc: tenantService}
 	tenantService.VendorComplianceReports = &VendorComplianceReportService{svc: tenantService}
+	tenantService.VendorBusinessAssociateAgreements = &VendorBusinessAssociateAgreementService{svc: tenantService}
 	tenantService.Connectors = &ConnectorService{svc: tenantService}
 	tenantService.Assets = &AssetService{svc: tenantService}
 	tenantService.Data = &DatumService{svc: tenantService}

pkg/probo/vendor_business_associate_agreement_service.go

@@ -0,0 +1,349 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package probo
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"mime"
+	"net/url"
+	"path/filepath"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/getprobo/probo/pkg/coredata"
+	"github.com/getprobo/probo/pkg/gid"
+	"go.gearno.de/crypto/uuid"
+	"go.gearno.de/kit/pg"
+)
+
+type (
+	VendorBusinessAssociateAgreementService struct {
+		svc *TenantService
+	}
+
+	VendorBusinessAssociateAgreementCreateRequest struct {
+		File       io.Reader
+		ValidFrom  *time.Time
+		ValidUntil *time.Time
+		FileName   string
+	}
+
+	VendorBusinessAssociateAgreementUpdateRequest struct {
+		ValidFrom  **time.Time
+		ValidUntil **time.Time
+	}
+)
+
+func (s VendorBusinessAssociateAgreementService) GetByVendorID(
+	ctx context.Context,
+	vendorID gid.GID,
+) (*coredata.VendorBusinessAssociateAgreement, *coredata.File, error) {
+	var vendorBusinessAssociateAgreement *coredata.VendorBusinessAssociateAgreement
+	var file *coredata.File
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			vendorBusinessAssociateAgreement = &coredata.VendorBusinessAssociateAgreement{}
+			if err := vendorBusinessAssociateAgreement.LoadByVendorID(ctx, conn, s.svc.scope, vendorID); err != nil {
+				return fmt.Errorf("cannot load vendor business associate agreement: %w", err)
+			}
+
+			file = &coredata.File{}
+			if err := file.LoadByID(ctx, conn, s.svc.scope, vendorBusinessAssociateAgreement.FileID); err != nil {
+				return fmt.Errorf("cannot load file: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return vendorBusinessAssociateAgreement, file, nil
+}
+
+func (s VendorBusinessAssociateAgreementService) Upload(
+	ctx context.Context,
+	vendorID gid.GID,
+	req *VendorBusinessAssociateAgreementCreateRequest,
+) (*coredata.VendorBusinessAssociateAgreement, *coredata.File, error) {
+	objectKey, err := uuid.NewV7()
+	if err != nil {
+		return nil, nil, fmt.Errorf("cannot generate object key: %w", err)
+	}
+
+	mimeType := mime.TypeByExtension(filepath.Ext(req.FileName))
+
+	_, err = s.svc.s3.PutObject(ctx, &s3.PutObjectInput{
+		Bucket:      &s.svc.bucket,
+		Key:         aws.String(objectKey.String()),
+		Body:        req.File,
+		ContentType: &mimeType,
+	})
+	if err != nil {
+		return nil, nil, fmt.Errorf("cannot upload file to S3: %w", err)
+	}
+
+	headOutput, err := s.svc.s3.HeadObject(ctx, &s3.HeadObjectInput{
+		Bucket: aws.String(s.svc.bucket),
+		Key:    aws.String(objectKey.String()),
+	})
+	if err != nil {
+		return nil, nil, fmt.Errorf("cannot get object metadata: %w", err)
+	}
+
+	now := time.Now()
+
+	fileID := gid.New(s.svc.scope.GetTenantID(), coredata.FileEntityType)
+	vendorBusinessAssociateAgreementID := gid.New(s.svc.scope.GetTenantID(), coredata.VendorBusinessAssociateAgreementEntityType)
+
+	var vendorBusinessAssociateAgreement *coredata.VendorBusinessAssociateAgreement
+	var file *coredata.File
+
+	err = s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			vendor := &coredata.Vendor{}
+			if err := vendor.LoadByID(ctx, conn, s.svc.scope, vendorID); err != nil {
+				return fmt.Errorf("cannot load vendor: %w", err)
+			}
+
+			file = &coredata.File{
+				ID:         fileID,
+				BucketName: s.svc.bucket,
+				MimeType:   mimeType,
+				FileName:   req.FileName,
+				FileKey:    objectKey.String(),
+				FileSize:   int(*headOutput.ContentLength),
+				CreatedAt:  now,
+				UpdatedAt:  now,
+			}
+
+			vendorBusinessAssociateAgreement = &coredata.VendorBusinessAssociateAgreement{
+				ID:             vendorBusinessAssociateAgreementID,
+				OrganizationID: vendor.OrganizationID,
+				VendorID:       vendorID,
+				ValidFrom:      req.ValidFrom,
+				ValidUntil:     req.ValidUntil,
+				FileID:         fileID,
+				CreatedAt:      now,
+				UpdatedAt:      now,
+			}
+
+			if err := file.Insert(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot insert file: %w", err)
+			}
+
+			if err := vendorBusinessAssociateAgreement.Upsert(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot insert vendor business associate agreement: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return vendorBusinessAssociateAgreement, file, nil
+}
+
+func (s VendorBusinessAssociateAgreementService) Get(
+	ctx context.Context,
+	vendorBusinessAssociateAgreementID gid.GID,
+) (*coredata.VendorBusinessAssociateAgreement, *coredata.File, error) {
+	var vendorBusinessAssociateAgreement *coredata.VendorBusinessAssociateAgreement
+	var file *coredata.File
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			vendorBusinessAssociateAgreement = &coredata.VendorBusinessAssociateAgreement{}
+			if err := vendorBusinessAssociateAgreement.LoadByID(ctx, conn, s.svc.scope, vendorBusinessAssociateAgreementID); err != nil {
+				return fmt.Errorf("cannot load vendor business associate agreement: %w", err)
+			}
+
+			file = &coredata.File{}
+			if err := file.LoadByID(ctx, conn, s.svc.scope, vendorBusinessAssociateAgreement.FileID); err != nil {
+				return fmt.Errorf("cannot load file: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, nil, fmt.Errorf("cannot load vendor business associate agreement: %w", err)
+	}
+
+	return vendorBusinessAssociateAgreement, file, nil
+}
+
+func (s VendorBusinessAssociateAgreementService) GenerateFileURL(
+	ctx context.Context,
+	vendorBusinessAssociateAgreementID gid.GID,
+	expiresIn time.Duration,
+) (string, error) {
+	var file *coredata.File
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			vendorBusinessAssociateAgreement := &coredata.VendorBusinessAssociateAgreement{}
+			if err := vendorBusinessAssociateAgreement.LoadByID(ctx, conn, s.svc.scope, vendorBusinessAssociateAgreementID); err != nil {
+				return fmt.Errorf("cannot load vendor business associate agreement: %w", err)
+			}
+
+			file = &coredata.File{}
+			if err := file.LoadByID(ctx, conn, s.svc.scope, vendorBusinessAssociateAgreement.FileID); err != nil {
+				return fmt.Errorf("cannot load file: %w", err)
+			}
+
+			return nil
+		},
+	)
+	if err != nil {
+		return "", err
+	}
+
+	presignClient := s3.NewPresignClient(s.svc.s3)
+
+	encodedFilename := url.QueryEscape(file.FileName)
+	contentDisposition := fmt.Sprintf("attachment; filename=\"%s\"; filename*=UTF-8''%s",
+		encodedFilename, encodedFilename)
+
+	presignedReq, err := presignClient.PresignGetObject(ctx, &s3.GetObjectInput{
+		Bucket:                     aws.String(s.svc.bucket),
+		Key:                        aws.String(file.FileKey),
+		ResponseCacheControl:       aws.String("max-age=3600, public"),
+		ResponseContentDisposition: aws.String(contentDisposition),
+	}, func(opts *s3.PresignOptions) {
+		opts.Expires = expiresIn
+	})
+	if err != nil {
+		return "", fmt.Errorf("cannot presign GetObject request: %w", err)
+	}
+
+	return presignedReq.URL, nil
+}
+
+func (s VendorBusinessAssociateAgreementService) Update(
+	ctx context.Context,
+	vendorID gid.GID,
+	req *VendorBusinessAssociateAgreementUpdateRequest,
+) (*coredata.VendorBusinessAssociateAgreement, *coredata.File, error) {
+	existingAgreement := &coredata.VendorBusinessAssociateAgreement{}
+	file := &coredata.File{}
+
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := existingAgreement.LoadByVendorID(ctx, conn, s.svc.scope, vendorID); err != nil {
+				return fmt.Errorf("cannot load existing vendor business associate agreement: %w", err)
+			}
+
+			if err := file.LoadByID(ctx, conn, s.svc.scope, existingAgreement.FileID); err != nil {
+				return fmt.Errorf("cannot load file: %w", err)
+			}
+
+			now := time.Now()
+			if req.ValidFrom != nil {
+				existingAgreement.ValidFrom = *req.ValidFrom
+			}
+			if req.ValidUntil != nil {
+				existingAgreement.ValidUntil = *req.ValidUntil
+			}
+
+			existingAgreement.UpdatedAt = now
+
+			if err := file.LoadByID(ctx, conn, s.svc.scope, existingAgreement.FileID); err != nil {
+				return fmt.Errorf("cannot load file: %w", err)
+			}
+
+			if err := existingAgreement.Update(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot update vendor business associate agreement: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return existingAgreement, file, nil
+}
+
+func (s VendorBusinessAssociateAgreementService) Delete(
+	ctx context.Context,
+	vendorBusinessAssociateAgreementID gid.GID,
+) error {
+	return s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			vendorBusinessAssociateAgreement := &coredata.VendorBusinessAssociateAgreement{}
+			if err := vendorBusinessAssociateAgreement.LoadByID(ctx, conn, s.svc.scope, vendorBusinessAssociateAgreementID); err != nil {
+				return fmt.Errorf("cannot load vendor business associate agreement: %w", err)
+			}
+
+			file := &coredata.File{ID: vendorBusinessAssociateAgreement.FileID}
+
+			if err := vendorBusinessAssociateAgreement.Delete(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot delete vendor business associate agreement: %w", err)
+			}
+
+			if err := file.SoftDelete(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot soft delete file: %w", err)
+			}
+
+			return nil
+		},
+	)
+}
+
+func (s VendorBusinessAssociateAgreementService) DeleteByVendorID(
+	ctx context.Context,
+	vendorID gid.GID,
+) error {
+	return s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			vendorBusinessAssociateAgreement := &coredata.VendorBusinessAssociateAgreement{}
+			if err := vendorBusinessAssociateAgreement.LoadByVendorID(ctx, conn, s.svc.scope, vendorID); err != nil {
+				return fmt.Errorf("cannot load vendor business associate agreement: %w", err)
+			}
+
+			file := &coredata.File{ID: vendorBusinessAssociateAgreement.FileID}
+
+			if err := vendorBusinessAssociateAgreement.DeleteByVendorID(ctx, conn, s.svc.scope, vendorID); err != nil {
+				return fmt.Errorf("cannot delete vendor business associate agreement: %w", err)
+			}
+
+			if err := file.SoftDelete(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot soft delete file: %w", err)
+			}
+
+			return nil
+		},
+	)
+}

pkg/server/api/console/v1/schema.graphql

@@ -915,6 +915,8 @@ type Vendor implements Node {
     orderBy: VendorComplianceReportOrder
   ): VendorComplianceReportConnection! @goField(forceResolver: true)
 
+  businessAssociateAgreement: VendorBusinessAssociateAgreement @goField(forceResolver: true)
+
   riskAssessments(
     first: Int
     after: CursorKey
@@ -956,6 +958,18 @@ type VendorComplianceReport implements Node {
   updatedAt: Datetime!
 }
 
+type VendorBusinessAssociateAgreement implements Node {
+  id: ID!
+  vendor: Vendor! @goField(forceResolver: true)
+  validFrom: Datetime
+  validUntil: Datetime
+  fileName: String!
+  fileUrl: String! @goField(forceResolver: true)
+  fileSize: Int!
+  createdAt: Datetime!
+  updatedAt: Datetime!
+}
+
 type Framework implements Node {
   id: ID!
   name: String!
@@ -1593,6 +1607,17 @@ type Mutation {
     input: DeleteVendorComplianceReportInput!
   ): DeleteVendorComplianceReportPayload!
 
+  # Vendor Business Associate Agreement mutations
+  uploadVendorBusinessAssociateAgreement(
+    input: UploadVendorBusinessAssociateAgreementInput!
+  ): UploadVendorBusinessAssociateAgreementPayload!
+  updateVendorBusinessAssociateAgreement(
+    input: UpdateVendorBusinessAssociateAgreementInput!
+  ): UpdateVendorBusinessAssociateAgreementPayload!
+  deleteVendorBusinessAssociateAgreement(
+    input: DeleteVendorBusinessAssociateAgreementInput!
+  ): DeleteVendorBusinessAssociateAgreementPayload!
+
   # Document mutations
   createDocument(input: CreateDocumentInput!): CreateDocumentPayload!
   updateDocument(input: UpdateDocumentInput!): UpdateDocumentPayload!
@@ -1948,6 +1973,24 @@ input DeleteVendorComplianceReportInput {
   reportId: ID!
 }
 
+input UploadVendorBusinessAssociateAgreementInput {
+  vendorId: ID!
+  validFrom: Datetime
+  validUntil: Datetime
+  fileName: String!
+  file: Upload!
+}
+
+input UpdateVendorBusinessAssociateAgreementInput {
+  vendorId: ID!
+  validFrom: Datetime
+  validUntil: Datetime
+}
+
+input DeleteVendorBusinessAssociateAgreementInput {
+  vendorId: ID!
+}
+
 input CreateDocumentInput {
   organizationId: ID!
   title: String!
@@ -2228,6 +2271,18 @@ type DeleteVendorComplianceReportPayload {
   deletedVendorComplianceReportId: ID!
 }
 
+type UploadVendorBusinessAssociateAgreementPayload {
+  vendorBusinessAssociateAgreement: VendorBusinessAssociateAgreement!
+}
+
+type UpdateVendorBusinessAssociateAgreementPayload {
+  vendorBusinessAssociateAgreement: VendorBusinessAssociateAgreement!
+}
+
+type DeleteVendorBusinessAssociateAgreementPayload {
+  deletedVendorId: ID!
+}
+
 type CreateDocumentPayload {
   documentEdge: DocumentEdge!
   documentVersionEdge: DocumentVersionEdge!

pkg/server/api/console/v1/types/types.go

@@ -595,6 +595,14 @@ type DeleteTrustCenterAccessPayload struct {
 	DeletedTrustCenterAccessID gid.GID `json:"deletedTrustCenterAccessId"`
 }
 
+type DeleteVendorBusinessAssociateAgreementInput struct {
+	VendorID gid.GID `json:"vendorId"`
+}
+
+type DeleteVendorBusinessAssociateAgreementPayload struct {
+	DeletedVendorID gid.GID `json:"deletedVendorId"`
+}
+
 type DeleteVendorComplianceReportInput struct {
 	ReportID gid.GID `json:"reportId"`
 }
@@ -1256,6 +1264,16 @@ type UpdateTrustCenterPayload struct {
 	TrustCenter *TrustCenter `json:"trustCenter"`
 }
 
+type UpdateVendorBusinessAssociateAgreementInput struct {
+	VendorID   gid.GID    `json:"vendorId"`
+	ValidFrom  *time.Time `json:"validFrom,omitempty"`
+	ValidUntil *time.Time `json:"validUntil,omitempty"`
+}
+
+type UpdateVendorBusinessAssociateAgreementPayload struct {
+	VendorBusinessAssociateAgreement *VendorBusinessAssociateAgreement `json:"vendorBusinessAssociateAgreement"`
+}
+
 type UpdateVendorInput struct {
 	ID                            gid.GID                  `json:"id"`
 	Name                          *string                  `json:"name,omitempty"`
@@ -1310,6 +1328,18 @@ type UploadTaskEvidencePayload struct {
 	EvidenceEdge *EvidenceEdge `json:"evidenceEdge"`
 }
 
+type UploadVendorBusinessAssociateAgreementInput struct {
+	VendorID   gid.GID        `json:"vendorId"`
+	ValidFrom  *time.Time     `json:"validFrom,omitempty"`
+	ValidUntil *time.Time     `json:"validUntil,omitempty"`
+	FileName   string         `json:"fileName"`
+	File       graphql.Upload `json:"file"`
+}
+
+type UploadVendorBusinessAssociateAgreementPayload struct {
+	VendorBusinessAssociateAgreement *VendorBusinessAssociateAgreement `json:"vendorBusinessAssociateAgreement"`
+}
+
 type UploadVendorComplianceReportInput struct {
 	VendorID   gid.GID        `json:"vendorId"`
 	ReportDate time.Time      `json:"reportDate"`
@@ -1351,6 +1381,7 @@ type Vendor struct {
 	Description                   *string                           `json:"description,omitempty"`
 	Organization                  *Organization                     `json:"organization"`
 	ComplianceReports             *VendorComplianceReportConnection `json:"complianceReports"`
+	BusinessAssociateAgreement    *VendorBusinessAssociateAgreement `json:"businessAssociateAgreement,omitempty"`
 	RiskAssessments               *VendorRiskAssessmentConnection   `json:"riskAssessments"`
 	BusinessOwner                 *People                           `json:"businessOwner,omitempty"`
 	SecurityOwner                 *People                           `json:"securityOwner,omitempty"`
@@ -1375,6 +1406,21 @@ type Vendor struct {
 func (Vendor) IsNode()             {}
 func (this Vendor) GetID() gid.GID { return this.ID }
 
+type VendorBusinessAssociateAgreement struct {
+	ID         gid.GID    `json:"id"`
+	Vendor     *Vendor    `json:"vendor"`
+	ValidFrom  *time.Time `json:"validFrom,omitempty"`
+	ValidUntil *time.Time `json:"validUntil,omitempty"`
+	FileName   string     `json:"fileName"`
+	FileURL    string     `json:"fileUrl"`
+	FileSize   int        `json:"fileSize"`
+	CreatedAt  time.Time  `json:"createdAt"`
+	UpdatedAt  time.Time  `json:"updatedAt"`
+}
+
+func (VendorBusinessAssociateAgreement) IsNode()             {}
+func (this VendorBusinessAssociateAgreement) GetID() gid.GID { return this.ID }
+
 type VendorComplianceReport struct {
 	ID         gid.GID    `json:"id"`
 	Vendor     *Vendor    `json:"vendor"`

pkg/server/api/console/v1/types/vendor_business_associate_agreement.go

@@ -0,0 +1,31 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"github.com/getprobo/probo/pkg/coredata"
+)
+
+func NewVendorBusinessAssociateAgreement(v *coredata.VendorBusinessAssociateAgreement, file *coredata.File) *VendorBusinessAssociateAgreement {
+	return &VendorBusinessAssociateAgreement{
+		ID:         v.ID,
+		ValidFrom:  v.ValidFrom,
+		ValidUntil: v.ValidUntil,
+		FileName:   file.FileName,
+		FileSize:   file.FileSize,
+		CreatedAt:  v.CreatedAt,
+		UpdatedAt:  v.UpdatedAt,
+	}
+}

pkg/server/api/console/v1/v1_resolver.go

@@ -18,6 +18,7 @@ import (
 	"github.com/getprobo/probo/pkg/probo"
 	"github.com/getprobo/probo/pkg/server/api/console/v1/schema"
 	"github.com/getprobo/probo/pkg/server/api/console/v1/types"
+	pgx "github.com/jackc/pgx/v5"
 	"github.com/vektah/gqlparser/v2/gqlerror"
 )
 
@@ -1905,6 +1906,64 @@ func (r *mutationResolver) DeleteVendorComplianceReport(ctx context.Context, inp
 	}, nil
 }
 
+// UploadVendorBusinessAssociateAgreement is the resolver for the uploadVendorBusinessAssociateAgreement field.
+func (r *mutationResolver) UploadVendorBusinessAssociateAgreement(ctx context.Context, input types.UploadVendorBusinessAssociateAgreementInput) (*types.UploadVendorBusinessAssociateAgreementPayload, error) {
+	prb := r.ProboService(ctx, input.VendorID.TenantID())
+
+	vendorBusinessAssociateAgreement, file, err := prb.VendorBusinessAssociateAgreements.Upload(
+		ctx,
+		input.VendorID,
+		&probo.VendorBusinessAssociateAgreementCreateRequest{
+			File:       input.File.File,
+			ValidFrom:  input.ValidFrom,
+			ValidUntil: input.ValidUntil,
+			FileName:   input.FileName,
+		},
+	)
+	if err != nil {
+		return nil, fmt.Errorf("failed to upload vendor business associate agreement: %w", err)
+	}
+
+	return &types.UploadVendorBusinessAssociateAgreementPayload{
+		VendorBusinessAssociateAgreement: types.NewVendorBusinessAssociateAgreement(vendorBusinessAssociateAgreement, file),
+	}, nil
+}
+
+// UpdateVendorBusinessAssociateAgreement is the resolver for the updateVendorBusinessAssociateAgreement field.
+func (r *mutationResolver) UpdateVendorBusinessAssociateAgreement(ctx context.Context, input types.UpdateVendorBusinessAssociateAgreementInput) (*types.UpdateVendorBusinessAssociateAgreementPayload, error) {
+	prb := r.ProboService(ctx, input.VendorID.TenantID())
+
+	vendorBusinessAssociateAgreement, file, err := prb.VendorBusinessAssociateAgreements.Update(
+		ctx,
+		input.VendorID,
+		&probo.VendorBusinessAssociateAgreementUpdateRequest{
+			ValidFrom:  &input.ValidFrom,
+			ValidUntil: &input.ValidUntil,
+		},
+	)
+	if err != nil {
+		return nil, fmt.Errorf("failed to update vendor business associate agreement: %w", err)
+	}
+
+	return &types.UpdateVendorBusinessAssociateAgreementPayload{
+		VendorBusinessAssociateAgreement: types.NewVendorBusinessAssociateAgreement(vendorBusinessAssociateAgreement, file),
+	}, nil
+}
+
+// DeleteVendorBusinessAssociateAgreement is the resolver for the deleteVendorBusinessAssociateAgreement field.
+func (r *mutationResolver) DeleteVendorBusinessAssociateAgreement(ctx context.Context, input types.DeleteVendorBusinessAssociateAgreementInput) (*types.DeleteVendorBusinessAssociateAgreementPayload, error) {
+	prb := r.ProboService(ctx, input.VendorID.TenantID())
+
+	err := prb.VendorBusinessAssociateAgreements.DeleteByVendorID(ctx, input.VendorID)
+	if err != nil {
+		return nil, fmt.Errorf("failed to delete vendor business associate agreement: %w", err)
+	}
+
+	return &types.DeleteVendorBusinessAssociateAgreementPayload{
+		DeletedVendorID: input.VendorID,
+	}, nil
+}
+
 // CreateDocument is the resolver for the createDocument field.
 func (r *mutationResolver) CreateDocument(ctx context.Context, input types.CreateDocumentInput) (*types.CreateDocumentPayload, error) {
 	prb := r.ProboService(ctx, input.OrganizationID.TenantID())
@@ -3330,6 +3389,22 @@ func (r *vendorResolver) ComplianceReports(ctx context.Context, obj *types.Vendo
 	return types.NewVendorComplianceReportConnection(page), nil
 }
 
+// BusinessAssociateAgreement is the resolver for the businessAssociateAgreement field.
+func (r *vendorResolver) BusinessAssociateAgreement(ctx context.Context, obj *types.Vendor) (*types.VendorBusinessAssociateAgreement, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	vendorBusinessAssociateAgreement, file, err := prb.VendorBusinessAssociateAgreements.GetByVendorID(ctx, obj.ID)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, nil
+		}
+
+		return nil, fmt.Errorf("failed to get vendor business associate agreement: %w", err)
+	}
+
+	return types.NewVendorBusinessAssociateAgreement(vendorBusinessAssociateAgreement, file), nil
+}
+
 // RiskAssessments is the resolver for the riskAssessments field.
 func (r *vendorResolver) RiskAssessments(ctx context.Context, obj *types.Vendor, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.VendorRiskAssessmentOrder) (*types.VendorRiskAssessmentConnection, error) {
 	prb := r.ProboService(ctx, obj.ID.TenantID())
@@ -3396,6 +3471,30 @@ func (r *vendorResolver) SecurityOwner(ctx context.Context, obj *types.Vendor) (
 	return types.NewPeople(people), nil
 }
 
+// Vendor is the resolver for the vendor field.
+func (r *vendorBusinessAssociateAgreementResolver) Vendor(ctx context.Context, obj *types.VendorBusinessAssociateAgreement) (*types.Vendor, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	vendor, err := prb.Vendors.Get(ctx, obj.ID)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get vendor: %w", err)
+	}
+
+	return types.NewVendor(vendor), nil
+}
+
+// FileURL is the resolver for the fileUrl field.
+func (r *vendorBusinessAssociateAgreementResolver) FileURL(ctx context.Context, obj *types.VendorBusinessAssociateAgreement) (string, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	fileURL, err := prb.VendorBusinessAssociateAgreements.GenerateFileURL(ctx, obj.ID, 1*time.Hour)
+	if err != nil {
+		return "", fmt.Errorf("failed to generate file URL: %w", err)
+	}
+
+	return fileURL, nil
+}
+
 // Vendor is the resolver for the vendor field.
 func (r *vendorComplianceReportResolver) Vendor(ctx context.Context, obj *types.VendorComplianceReport) (*types.Vendor, error) {
 	prb := r.ProboService(ctx, obj.ID.TenantID())
@@ -3614,6 +3713,11 @@ func (r *Resolver) User() schema.UserResolver { return &userResolver{r} }
 // Vendor returns schema.VendorResolver implementation.
 func (r *Resolver) Vendor() schema.VendorResolver { return &vendorResolver{r} }
 
+// VendorBusinessAssociateAgreement returns schema.VendorBusinessAssociateAgreementResolver implementation.
+func (r *Resolver) VendorBusinessAssociateAgreement() schema.VendorBusinessAssociateAgreementResolver {
+	return &vendorBusinessAssociateAgreementResolver{r}
+}
+
 // VendorComplianceReport returns schema.VendorComplianceReportResolver implementation.
 func (r *Resolver) VendorComplianceReport() schema.VendorComplianceReportResolver {
 	return &vendorComplianceReportResolver{r}
@@ -3662,6 +3766,7 @@ type taskConnectionResolver struct{ *Resolver }
 type trustCenterResolver struct{ *Resolver }
 type userResolver struct{ *Resolver }
 type vendorResolver struct{ *Resolver }
+type vendorBusinessAssociateAgreementResolver struct{ *Resolver }
 type vendorComplianceReportResolver struct{ *Resolver }
 type vendorConnectionResolver struct{ *Resolver }
 type vendorRiskAssessmentResolver struct{ *Resolver }