Add baa on vendors

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/server/api/console/v1/schema.graphql

@@ -915,6 +915,8 @@ type Vendor implements Node {
     orderBy: VendorComplianceReportOrder
   ): VendorComplianceReportConnection! @goField(forceResolver: true)
 
+  businessAssociateAgreement: VendorBusinessAssociateAgreement @goField(forceResolver: true)
+
   riskAssessments(
     first: Int
     after: CursorKey
@@ -956,6 +958,18 @@ type VendorComplianceReport implements Node {
   updatedAt: Datetime!
 }
 
+type VendorBusinessAssociateAgreement implements Node {
+  id: ID!
+  vendor: Vendor! @goField(forceResolver: true)
+  validFrom: Datetime
+  validUntil: Datetime
+  fileName: String!
+  fileUrl: String! @goField(forceResolver: true)
+  fileSize: Int!
+  createdAt: Datetime!
+  updatedAt: Datetime!
+}
+
 type Framework implements Node {
   id: ID!
   name: String!
@@ -1593,6 +1607,17 @@ type Mutation {
     input: DeleteVendorComplianceReportInput!
   ): DeleteVendorComplianceReportPayload!
 
+  # Vendor Business Associate Agreement mutations
+  uploadVendorBusinessAssociateAgreement(
+    input: UploadVendorBusinessAssociateAgreementInput!
+  ): UploadVendorBusinessAssociateAgreementPayload!
+  updateVendorBusinessAssociateAgreement(
+    input: UpdateVendorBusinessAssociateAgreementInput!
+  ): UpdateVendorBusinessAssociateAgreementPayload!
+  deleteVendorBusinessAssociateAgreement(
+    input: DeleteVendorBusinessAssociateAgreementInput!
+  ): DeleteVendorBusinessAssociateAgreementPayload!
+
   # Document mutations
   createDocument(input: CreateDocumentInput!): CreateDocumentPayload!
   updateDocument(input: UpdateDocumentInput!): UpdateDocumentPayload!
@@ -1948,6 +1973,24 @@ input DeleteVendorComplianceReportInput {
   reportId: ID!
 }
 
+input UploadVendorBusinessAssociateAgreementInput {
+  vendorId: ID!
+  validFrom: Datetime
+  validUntil: Datetime
+  fileName: String!
+  file: Upload!
+}
+
+input UpdateVendorBusinessAssociateAgreementInput {
+  vendorId: ID!
+  validFrom: Datetime
+  validUntil: Datetime
+}
+
+input DeleteVendorBusinessAssociateAgreementInput {
+  vendorId: ID!
+}
+
 input CreateDocumentInput {
   organizationId: ID!
   title: String!
@@ -2228,6 +2271,18 @@ type DeleteVendorComplianceReportPayload {
   deletedVendorComplianceReportId: ID!
 }
 
+type UploadVendorBusinessAssociateAgreementPayload {
+  vendorBusinessAssociateAgreement: VendorBusinessAssociateAgreement!
+}
+
+type UpdateVendorBusinessAssociateAgreementPayload {
+  vendorBusinessAssociateAgreement: VendorBusinessAssociateAgreement!
+}
+
+type DeleteVendorBusinessAssociateAgreementPayload {
+  deletedVendorId: ID!
+}
+
 type CreateDocumentPayload {
   documentEdge: DocumentEdge!
   documentVersionEdge: DocumentVersionEdge!

pkg/server/api/console/v1/types/types.go

@@ -595,6 +595,14 @@ type DeleteTrustCenterAccessPayload struct {
 	DeletedTrustCenterAccessID gid.GID `json:"deletedTrustCenterAccessId"`
 }
 
+type DeleteVendorBusinessAssociateAgreementInput struct {
+	VendorID gid.GID `json:"vendorId"`
+}
+
+type DeleteVendorBusinessAssociateAgreementPayload struct {
+	DeletedVendorID gid.GID `json:"deletedVendorId"`
+}
+
 type DeleteVendorComplianceReportInput struct {
 	ReportID gid.GID `json:"reportId"`
 }
@@ -1256,6 +1264,16 @@ type UpdateTrustCenterPayload struct {
 	TrustCenter *TrustCenter `json:"trustCenter"`
 }
 
+type UpdateVendorBusinessAssociateAgreementInput struct {
+	VendorID   gid.GID    `json:"vendorId"`
+	ValidFrom  *time.Time `json:"validFrom,omitempty"`
+	ValidUntil *time.Time `json:"validUntil,omitempty"`
+}
+
+type UpdateVendorBusinessAssociateAgreementPayload struct {
+	VendorBusinessAssociateAgreement *VendorBusinessAssociateAgreement `json:"vendorBusinessAssociateAgreement"`
+}
+
 type UpdateVendorInput struct {
 	ID                            gid.GID                  `json:"id"`
 	Name                          *string                  `json:"name,omitempty"`
@@ -1310,6 +1328,18 @@ type UploadTaskEvidencePayload struct {
 	EvidenceEdge *EvidenceEdge `json:"evidenceEdge"`
 }
 
+type UploadVendorBusinessAssociateAgreementInput struct {
+	VendorID   gid.GID        `json:"vendorId"`
+	ValidFrom  *time.Time     `json:"validFrom,omitempty"`
+	ValidUntil *time.Time     `json:"validUntil,omitempty"`
+	FileName   string         `json:"fileName"`
+	File       graphql.Upload `json:"file"`
+}
+
+type UploadVendorBusinessAssociateAgreementPayload struct {
+	VendorBusinessAssociateAgreement *VendorBusinessAssociateAgreement `json:"vendorBusinessAssociateAgreement"`
+}
+
 type UploadVendorComplianceReportInput struct {
 	VendorID   gid.GID        `json:"vendorId"`
 	ReportDate time.Time      `json:"reportDate"`
@@ -1351,6 +1381,7 @@ type Vendor struct {
 	Description                   *string                           `json:"description,omitempty"`
 	Organization                  *Organization                     `json:"organization"`
 	ComplianceReports             *VendorComplianceReportConnection `json:"complianceReports"`
+	BusinessAssociateAgreement    *VendorBusinessAssociateAgreement `json:"businessAssociateAgreement,omitempty"`
 	RiskAssessments               *VendorRiskAssessmentConnection   `json:"riskAssessments"`
 	BusinessOwner                 *People                           `json:"businessOwner,omitempty"`
 	SecurityOwner                 *People                           `json:"securityOwner,omitempty"`
@@ -1375,6 +1406,21 @@ type Vendor struct {
 func (Vendor) IsNode()             {}
 func (this Vendor) GetID() gid.GID { return this.ID }
 
+type VendorBusinessAssociateAgreement struct {
+	ID         gid.GID    `json:"id"`
+	Vendor     *Vendor    `json:"vendor"`
+	ValidFrom  *time.Time `json:"validFrom,omitempty"`
+	ValidUntil *time.Time `json:"validUntil,omitempty"`
+	FileName   string     `json:"fileName"`
+	FileURL    string     `json:"fileUrl"`
+	FileSize   int        `json:"fileSize"`
+	CreatedAt  time.Time  `json:"createdAt"`
+	UpdatedAt  time.Time  `json:"updatedAt"`
+}
+
+func (VendorBusinessAssociateAgreement) IsNode()             {}
+func (this VendorBusinessAssociateAgreement) GetID() gid.GID { return this.ID }
+
 type VendorComplianceReport struct {
 	ID         gid.GID    `json:"id"`
 	Vendor     *Vendor    `json:"vendor"`

pkg/server/api/console/v1/types/vendor_business_associate_agreement.go

@@ -0,0 +1,31 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"github.com/getprobo/probo/pkg/coredata"
+)
+
+func NewVendorBusinessAssociateAgreement(v *coredata.VendorBusinessAssociateAgreement, file *coredata.File) *VendorBusinessAssociateAgreement {
+	return &VendorBusinessAssociateAgreement{
+		ID:         v.ID,
+		ValidFrom:  v.ValidFrom,
+		ValidUntil: v.ValidUntil,
+		FileName:   file.FileName,
+		FileSize:   file.FileSize,
+		CreatedAt:  v.CreatedAt,
+		UpdatedAt:  v.UpdatedAt,
+	}
+}

pkg/server/api/console/v1/v1_resolver.go

@@ -18,6 +18,7 @@ import (
 	"github.com/getprobo/probo/pkg/probo"
 	"github.com/getprobo/probo/pkg/server/api/console/v1/schema"
 	"github.com/getprobo/probo/pkg/server/api/console/v1/types"
+	pgx "github.com/jackc/pgx/v5"
 	"github.com/vektah/gqlparser/v2/gqlerror"
 )
 
@@ -1905,6 +1906,64 @@ func (r *mutationResolver) DeleteVendorComplianceReport(ctx context.Context, inp
 	}, nil
 }
 
+// UploadVendorBusinessAssociateAgreement is the resolver for the uploadVendorBusinessAssociateAgreement field.
+func (r *mutationResolver) UploadVendorBusinessAssociateAgreement(ctx context.Context, input types.UploadVendorBusinessAssociateAgreementInput) (*types.UploadVendorBusinessAssociateAgreementPayload, error) {
+	prb := r.ProboService(ctx, input.VendorID.TenantID())
+
+	vendorBusinessAssociateAgreement, file, err := prb.VendorBusinessAssociateAgreements.Upload(
+		ctx,
+		input.VendorID,
+		&probo.VendorBusinessAssociateAgreementCreateRequest{
+			File:       input.File.File,
+			ValidFrom:  input.ValidFrom,
+			ValidUntil: input.ValidUntil,
+			FileName:   input.FileName,
+		},
+	)
+	if err != nil {
+		return nil, fmt.Errorf("failed to upload vendor business associate agreement: %w", err)
+	}
+
+	return &types.UploadVendorBusinessAssociateAgreementPayload{
+		VendorBusinessAssociateAgreement: types.NewVendorBusinessAssociateAgreement(vendorBusinessAssociateAgreement, file),
+	}, nil
+}
+
+// UpdateVendorBusinessAssociateAgreement is the resolver for the updateVendorBusinessAssociateAgreement field.
+func (r *mutationResolver) UpdateVendorBusinessAssociateAgreement(ctx context.Context, input types.UpdateVendorBusinessAssociateAgreementInput) (*types.UpdateVendorBusinessAssociateAgreementPayload, error) {
+	prb := r.ProboService(ctx, input.VendorID.TenantID())
+
+	vendorBusinessAssociateAgreement, file, err := prb.VendorBusinessAssociateAgreements.Update(
+		ctx,
+		input.VendorID,
+		&probo.VendorBusinessAssociateAgreementUpdateRequest{
+			ValidFrom:  &input.ValidFrom,
+			ValidUntil: &input.ValidUntil,
+		},
+	)
+	if err != nil {
+		return nil, fmt.Errorf("failed to update vendor business associate agreement: %w", err)
+	}
+
+	return &types.UpdateVendorBusinessAssociateAgreementPayload{
+		VendorBusinessAssociateAgreement: types.NewVendorBusinessAssociateAgreement(vendorBusinessAssociateAgreement, file),
+	}, nil
+}
+
+// DeleteVendorBusinessAssociateAgreement is the resolver for the deleteVendorBusinessAssociateAgreement field.
+func (r *mutationResolver) DeleteVendorBusinessAssociateAgreement(ctx context.Context, input types.DeleteVendorBusinessAssociateAgreementInput) (*types.DeleteVendorBusinessAssociateAgreementPayload, error) {
+	prb := r.ProboService(ctx, input.VendorID.TenantID())
+
+	err := prb.VendorBusinessAssociateAgreements.DeleteByVendorID(ctx, input.VendorID)
+	if err != nil {
+		return nil, fmt.Errorf("failed to delete vendor business associate agreement: %w", err)
+	}
+
+	return &types.DeleteVendorBusinessAssociateAgreementPayload{
+		DeletedVendorID: input.VendorID,
+	}, nil
+}
+
 // CreateDocument is the resolver for the createDocument field.
 func (r *mutationResolver) CreateDocument(ctx context.Context, input types.CreateDocumentInput) (*types.CreateDocumentPayload, error) {
 	prb := r.ProboService(ctx, input.OrganizationID.TenantID())
@@ -3330,6 +3389,22 @@ func (r *vendorResolver) ComplianceReports(ctx context.Context, obj *types.Vendo
 	return types.NewVendorComplianceReportConnection(page), nil
 }
 
+// BusinessAssociateAgreement is the resolver for the businessAssociateAgreement field.
+func (r *vendorResolver) BusinessAssociateAgreement(ctx context.Context, obj *types.Vendor) (*types.VendorBusinessAssociateAgreement, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	vendorBusinessAssociateAgreement, file, err := prb.VendorBusinessAssociateAgreements.GetByVendorID(ctx, obj.ID)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, nil
+		}
+
+		return nil, fmt.Errorf("failed to get vendor business associate agreement: %w", err)
+	}
+
+	return types.NewVendorBusinessAssociateAgreement(vendorBusinessAssociateAgreement, file), nil
+}
+
 // RiskAssessments is the resolver for the riskAssessments field.
 func (r *vendorResolver) RiskAssessments(ctx context.Context, obj *types.Vendor, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.VendorRiskAssessmentOrder) (*types.VendorRiskAssessmentConnection, error) {
 	prb := r.ProboService(ctx, obj.ID.TenantID())
@@ -3396,6 +3471,30 @@ func (r *vendorResolver) SecurityOwner(ctx context.Context, obj *types.Vendor) (
 	return types.NewPeople(people), nil
 }
 
+// Vendor is the resolver for the vendor field.
+func (r *vendorBusinessAssociateAgreementResolver) Vendor(ctx context.Context, obj *types.VendorBusinessAssociateAgreement) (*types.Vendor, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	vendor, err := prb.Vendors.Get(ctx, obj.ID)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get vendor: %w", err)
+	}
+
+	return types.NewVendor(vendor), nil
+}
+
+// FileURL is the resolver for the fileUrl field.
+func (r *vendorBusinessAssociateAgreementResolver) FileURL(ctx context.Context, obj *types.VendorBusinessAssociateAgreement) (string, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	fileURL, err := prb.VendorBusinessAssociateAgreements.GenerateFileURL(ctx, obj.ID, 1*time.Hour)
+	if err != nil {
+		return "", fmt.Errorf("failed to generate file URL: %w", err)
+	}
+
+	return fileURL, nil
+}
+
 // Vendor is the resolver for the vendor field.
 func (r *vendorComplianceReportResolver) Vendor(ctx context.Context, obj *types.VendorComplianceReport) (*types.Vendor, error) {
 	prb := r.ProboService(ctx, obj.ID.TenantID())
@@ -3614,6 +3713,11 @@ func (r *Resolver) User() schema.UserResolver { return &userResolver{r} }
 // Vendor returns schema.VendorResolver implementation.
 func (r *Resolver) Vendor() schema.VendorResolver { return &vendorResolver{r} }
 
+// VendorBusinessAssociateAgreement returns schema.VendorBusinessAssociateAgreementResolver implementation.
+func (r *Resolver) VendorBusinessAssociateAgreement() schema.VendorBusinessAssociateAgreementResolver {
+	return &vendorBusinessAssociateAgreementResolver{r}
+}
+
 // VendorComplianceReport returns schema.VendorComplianceReportResolver implementation.
 func (r *Resolver) VendorComplianceReport() schema.VendorComplianceReportResolver {
 	return &vendorComplianceReportResolver{r}
@@ -3662,6 +3766,7 @@ type taskConnectionResolver struct{ *Resolver }
 type trustCenterResolver struct{ *Resolver }
 type userResolver struct{ *Resolver }
 type vendorResolver struct{ *Resolver }
+type vendorBusinessAssociateAgreementResolver struct{ *Resolver }
 type vendorComplianceReportResolver struct{ *Resolver }
 type vendorConnectionResolver struct{ *Resolver }
 type vendorRiskAssessmentResolver struct{ *Resolver }