Refactor SOA

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/server/api/console/v1/schema.graphql

@@ -599,6 +599,14 @@ enum DocumentVersionOrderField
         )
 }
 
+enum ApplicabilityStatementOrderField
+    @goModel(model: "go.probo.inc/probo/pkg/coredata.ApplicabilityStatementOrderField") {
+    CREATED_AT
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ApplicabilityStatementOrderFieldCreatedAt"
+        )
+}
+
 enum CountryCode
     @goModel(model: "go.probo.inc/probo/pkg/coredata.CountryCode") {
     AD @goEnum(value: "go.probo.inc/probo/pkg/coredata.CountryCodeAD")
@@ -1475,6 +1483,14 @@ input SnapshotOrder
     field: SnapshotOrderField!
 }
 
+input ApplicabilityStatementOrder
+    @goModel(
+        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.ApplicabilityStatementOrderBy"
+    ) {
+    direction: OrderDirection!
+    field: ApplicabilityStatementOrderField!
+}
+
 input DocumentVersionFilter {
     status: DocumentStatus
 }
@@ -1992,6 +2008,9 @@ type Control implements Node {
     status: ControlStatus!
     exclusionJustification: String
     bestPractice: Boolean!
+    regulatory: Boolean! @goField(forceResolver: true)
+    contractual: Boolean! @goField(forceResolver: true)
+    riskAssessment: Boolean! @goField(forceResolver: true)
 
     framework: Framework! @goField(forceResolver: true)
 
@@ -2038,14 +2057,6 @@ type Control implements Node {
         orderBy: SnapshotOrder
     ): SnapshotConnection! @goField(forceResolver: true)
 
-    stateOfApplicabilityControls(
-        first: Int
-        after: CursorKey
-        last: Int
-        before: CursorKey
-        orderBy: StateOfApplicabilityOrder
-    ): StateOfApplicabilityControlConnection! @goField(forceResolver: true)
-
     createdAt: Datetime!
     updatedAt: Datetime!
 
@@ -2225,17 +2236,39 @@ type StateOfApplicability implements Node {
     createdAt: Datetime!
     updatedAt: Datetime!
 
-    controls(
+    applicabilityStatements(
         first: Int
         after: CursorKey
         last: Int
         before: CursorKey
-        orderBy: ControlOrder
-        filter: ControlFilter
-    ): ControlConnection! @goField(forceResolver: true)
+        orderBy: ApplicabilityStatementOrder
+    ): ApplicabilityStatementConnection! @goField(forceResolver: true)
 
-    availableControls: [AvailableStateOfApplicabilityControl!]!
-        @goField(forceResolver: true)
+    permission(action: String!): Boolean! @goField(forceResolver: true)
+}
+
+type ApplicabilityStatementConnection
+    @goModel(
+        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.ApplicabilityStatementConnection"
+    ) {
+    totalCount: Int! @goField(forceResolver: true)
+    edges: [ApplicabilityStatementEdge!]!
+    pageInfo: PageInfo!
+}
+
+type ApplicabilityStatementEdge {
+    cursor: CursorKey!
+    node: ApplicabilityStatement!
+}
+
+type ApplicabilityStatement implements Node {
+    id: ID!
+    stateOfApplicability: StateOfApplicability! @goField(forceResolver: true)
+    control: Control! @goField(forceResolver: true)
+    applicability: Boolean!
+    justification: String!
+    createdAt: Datetime!
+    updatedAt: Datetime!
 
     permission(action: String!): Boolean! @goField(forceResolver: true)
 }
@@ -2801,6 +2834,7 @@ type StateOfApplicabilityEdge {
     node: StateOfApplicability!
 }
 
+
 type RiskConnection
     @goModel(
         model: "go.probo.inc/probo/pkg/server/api/console/v1/types.RiskConnection"
@@ -3124,12 +3158,15 @@ type Mutation {
     deleteControlDocumentMapping(
         input: DeleteControlDocumentMappingInput!
     ): DeleteControlDocumentMappingPayload!
-    createStateOfApplicabilityControlMapping(
-        input: CreateStateOfApplicabilityControlMappingInput!
-    ): CreateStateOfApplicabilityControlMappingPayload!
-    deleteStateOfApplicabilityControlMapping(
-        input: DeleteStateOfApplicabilityControlMappingInput!
-    ): DeleteStateOfApplicabilityControlMappingPayload!
+    createApplicabilityStatement(
+        input: CreateApplicabilityStatementInput!
+    ): CreateApplicabilityStatementPayload!
+    updateApplicabilityStatement(
+        input: UpdateApplicabilityStatementInput!
+    ): UpdateApplicabilityStatementPayload!
+    deleteApplicabilityStatement(
+        input: DeleteApplicabilityStatementInput!
+    ): DeleteApplicabilityStatementPayload!
     createControlAuditMapping(
         input: CreateControlAuditMappingInput!
     ): CreateControlAuditMappingPayload!
@@ -3678,16 +3715,21 @@ input DeleteControlDocumentMappingInput {
     documentId: ID!
 }
 
-input CreateStateOfApplicabilityControlMappingInput {
+input CreateApplicabilityStatementInput {
     stateOfApplicabilityId: ID!
     controlId: ID!
     applicability: Boolean!
     justification: String
 }
 
-input DeleteStateOfApplicabilityControlMappingInput {
-    stateOfApplicabilityId: ID!
-    controlId: ID!
+input UpdateApplicabilityStatementInput {
+    applicabilityStatementId: ID!
+    applicability: Boolean!
+    justification: String
+}
+
+input DeleteApplicabilityStatementInput {
+    applicabilityStatementId: ID!
 }
 
 input CreateControlAuditMappingInput {
@@ -3916,58 +3958,16 @@ input UpdateStateOfApplicabilityInput {
     ownerId: ID
 }
 
-input StateOfApplicabilityControlInput {
+input ApplicabilityStatementInput {
     controlId: ID!
     applicability: Boolean!
     justification: String
 }
 
-type AvailableStateOfApplicabilityControl {
-    controlId: ID!
-    sectionTitle: String!
-    name: String!
-    frameworkId: ID!
-    frameworkName: String!
-    organizationId: ID!
-    stateOfApplicabilityId: ID
-    applicability: Boolean
-    justification: String
-    bestPractice: Boolean!
-    regulatory: Boolean!
-    contractual: Boolean!
-    riskAssessment: Boolean!
-}
-
 input DeleteStateOfApplicabilityInput {
     stateOfApplicabilityId: ID!
 }
 
-type StateOfApplicabilityControl {
-    id: ID!
-    stateOfApplicabilityId: ID!
-    controlId: ID!
-    stateOfApplicability: StateOfApplicability! @goField(forceResolver: true)
-    applicability: Boolean!
-    justification: String
-}
-
-type StateOfApplicabilityControlConnection
-    @goModel(
-        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.StateOfApplicabilityControlConnection"
-    ) {
-    totalCount: Int!
-    edges: [StateOfApplicabilityControlEdge!]!
-    pageInfo: PageInfo!
-}
-
-type StateOfApplicabilityControlEdge
-    @goModel(
-        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.StateOfApplicabilityControlEdge"
-    ) {
-    cursor: CursorKey!
-    node: StateOfApplicabilityControl!
-}
-
 input ExportStateOfApplicabilityPDFInput {
     stateOfApplicabilityId: ID!
 }
@@ -4466,14 +4466,16 @@ type DeleteControlDocumentMappingPayload {
     deletedDocumentId: ID!
 }
 
-type CreateStateOfApplicabilityControlMappingPayload {
-    stateOfApplicabilityControlEdge: StateOfApplicabilityControlEdge!
+type CreateApplicabilityStatementPayload {
+    applicabilityStatementEdge: ApplicabilityStatementEdge!
 }
 
-type DeleteStateOfApplicabilityControlMappingPayload {
-    deletedStateOfApplicabilityId: ID!
-    deletedControlId: ID!
-    deletedStateOfApplicabilityControlId: ID!
+type UpdateApplicabilityStatementPayload {
+    applicabilityStatement: ApplicabilityStatement!
+}
+
+type DeleteApplicabilityStatementPayload {
+    deletedApplicabilityStatementId: ID!
 }
 
 type CreateControlAuditMappingPayload {

pkg/server/api/console/v1/types/applicability_statement_connection.go

@@ -0,0 +1,84 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type (
+	ApplicabilityStatementOrderBy OrderBy[coredata.ApplicabilityStatementOrderField]
+
+	ApplicabilityStatementConnection struct {
+		TotalCount int
+		Edges      []*ApplicabilityStatementEdge
+		PageInfo   PageInfo
+
+		Resolver any
+		ParentID gid.GID
+	}
+)
+
+func NewApplicabilityStatementConnection(
+	p *page.Page[*coredata.ApplicabilityStatement, coredata.ApplicabilityStatementOrderField],
+	parentType any,
+	parentID gid.GID,
+) *ApplicabilityStatementConnection {
+	edges := make([]*ApplicabilityStatementEdge, len(p.Data))
+	for i, statement := range p.Data {
+		edges[i] = NewApplicabilityStatementEdge(statement, p.Cursor.OrderBy.Field)
+	}
+
+	return &ApplicabilityStatementConnection{
+		Edges:    edges,
+		PageInfo: *NewPageInfo(p),
+
+		Resolver: parentType,
+		ParentID: parentID,
+	}
+}
+
+func NewApplicabilityStatementEdge(
+	statement *coredata.ApplicabilityStatement,
+	orderBy coredata.ApplicabilityStatementOrderField,
+) *ApplicabilityStatementEdge {
+	return &ApplicabilityStatementEdge{
+		Cursor: statement.CursorKey(orderBy),
+		Node:   NewApplicabilityStatement(statement),
+	}
+}
+
+func NewApplicabilityStatement(as *coredata.ApplicabilityStatement) *ApplicabilityStatement {
+	justification := ""
+	if as.Justification != nil {
+		justification = *as.Justification
+	}
+
+	return &ApplicabilityStatement{
+		ID: as.ID,
+		StateOfApplicability: &StateOfApplicability{
+			ID: as.StateOfApplicabilityID,
+		},
+		Control: &Control{
+			ID: as.ControlID,
+		},
+		Applicability: as.Applicability,
+		Justification: justification,
+		CreatedAt:     as.CreatedAt,
+		UpdatedAt:     as.UpdatedAt,
+	}
+}

pkg/server/api/console/v1/types/state_of_applicability_control_connection.go

@@ -1,76 +0,0 @@
-// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
-//
-// Permission to use, copy, modify, and/or distribute this software for any
-// purpose with or without fee is hereby granted, provided that the above
-// copyright notice and this permission notice appear in all copies.
-//
-// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
-// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
-// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
-// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-// PERFORMANCE OF THIS SOFTWARE.
-
-package types
-
-import (
-	"go.probo.inc/probo/pkg/coredata"
-	"go.probo.inc/probo/pkg/gid"
-	"go.probo.inc/probo/pkg/page"
-)
-
-type (
-	StateOfApplicabilityControlConnection struct {
-		TotalCount int
-		Edges      []*StateOfApplicabilityControlEdge
-		PageInfo   PageInfo
-
-		Resolver any
-		ParentID gid.GID
-	}
-
-	StateOfApplicabilityControlEdge struct {
-		Cursor page.CursorKey
-		Node   *StateOfApplicabilityControl
-	}
-)
-
-func NewStateOfApplicabilityControlConnection(
-	p *page.Page[*coredata.StateOfApplicabilityControl, coredata.StateOfApplicabilityOrderField],
-	parentType any,
-	parentID gid.GID,
-) *StateOfApplicabilityControlConnection {
-	edges := make([]*StateOfApplicabilityControlEdge, len(p.Data))
-	for i, control := range p.Data {
-		edges[i] = NewStateOfApplicabilityControlEdge(control, p.Cursor.OrderBy.Field)
-	}
-
-	return &StateOfApplicabilityControlConnection{
-		Edges:    edges,
-		PageInfo: *NewPageInfo(p),
-
-		Resolver: parentType,
-		ParentID: parentID,
-	}
-}
-
-func NewStateOfApplicabilityControlEdge(
-	control *coredata.StateOfApplicabilityControl,
-	orderBy coredata.StateOfApplicabilityOrderField,
-) *StateOfApplicabilityControlEdge {
-	return &StateOfApplicabilityControlEdge{
-		Cursor: control.CursorKey(orderBy),
-		Node:   NewStateOfApplicabilityControl(control),
-	}
-}
-
-func NewStateOfApplicabilityControl(control *coredata.StateOfApplicabilityControl) *StateOfApplicabilityControl {
-	return &StateOfApplicabilityControl{
-		ID:                     control.ID,
-		StateOfApplicabilityID: control.StateOfApplicabilityID,
-		ControlID:              control.ControlID,
-		Applicability:          control.Applicability,
-		Justification:          control.Justification,
-	}
-}

pkg/server/api/console/v1/types/types.go

@@ -17,6 +17,31 @@ type Node interface {
 	GetID() gid.GID
 }
 
+type ApplicabilityStatement struct {
+	ID                   gid.GID               `json:"id"`
+	StateOfApplicability *StateOfApplicability `json:"stateOfApplicability"`
+	Control              *Control              `json:"control"`
+	Applicability        bool                  `json:"applicability"`
+	Justification        string                `json:"justification"`
+	CreatedAt            time.Time             `json:"createdAt"`
+	UpdatedAt            time.Time             `json:"updatedAt"`
+	Permission           bool                  `json:"permission"`
+}
+
+func (ApplicabilityStatement) IsNode()             {}
+func (this ApplicabilityStatement) GetID() gid.GID { return this.ID }
+
+type ApplicabilityStatementEdge struct {
+	Cursor page.CursorKey          `json:"cursor"`
+	Node   *ApplicabilityStatement `json:"node"`
+}
+
+type ApplicabilityStatementInput struct {
+	ControlID     gid.GID `json:"controlId"`
+	Applicability bool    `json:"applicability"`
+	Justification *string `json:"justification,omitempty"`
+}
+
 type AssessVendorInput struct {
 	ID         gid.GID `json:"id"`
 	WebsiteURL string  `json:"websiteUrl"`
@@ -78,22 +103,6 @@ type AuditEdge struct {
 	Node   *Audit         `json:"node"`
 }
 
-type AvailableStateOfApplicabilityControl struct {
-	ControlID              gid.GID  `json:"controlId"`
-	SectionTitle           string   `json:"sectionTitle"`
-	Name                   string   `json:"name"`
-	FrameworkID            gid.GID  `json:"frameworkId"`
-	FrameworkName          string   `json:"frameworkName"`
-	OrganizationID         gid.GID  `json:"organizationId"`
-	StateOfApplicabilityID *gid.GID `json:"stateOfApplicabilityId,omitempty"`
-	Applicability          *bool    `json:"applicability,omitempty"`
-	Justification          *string  `json:"justification,omitempty"`
-	BestPractice           bool     `json:"bestPractice"`
-	Regulatory             bool     `json:"regulatory"`
-	Contractual            bool     `json:"contractual"`
-	RiskAssessment         bool     `json:"riskAssessment"`
-}
-
 type BulkDeleteDocumentsInput struct {
 	DocumentIds []gid.GID `json:"documentIds"`
 }
@@ -170,24 +179,26 @@ type ContinualImprovementFilter struct {
 }
 
 type Control struct {
-	ID                           gid.GID                                `json:"id"`
-	Organization                 *Organization                          `json:"organization,omitempty"`
-	SectionTitle                 string                                 `json:"sectionTitle"`
-	Name                         string                                 `json:"name"`
-	Description                  *string                                `json:"description,omitempty"`
-	Status                       coredata.ControlStatus                 `json:"status"`
-	ExclusionJustification       *string                                `json:"exclusionJustification,omitempty"`
-	BestPractice                 bool                                   `json:"bestPractice"`
-	Framework                    *Framework                             `json:"framework"`
-	Measures                     *MeasureConnection                     `json:"measures"`
-	Documents                    *DocumentConnection                    `json:"documents"`
-	Audits                       *AuditConnection                       `json:"audits"`
-	Obligations                  *ObligationConnection                  `json:"obligations"`
-	Snapshots                    *SnapshotConnection                    `json:"snapshots"`
-	StateOfApplicabilityControls *StateOfApplicabilityControlConnection `json:"stateOfApplicabilityControls"`
-	CreatedAt                    time.Time                              `json:"createdAt"`
-	UpdatedAt                    time.Time                              `json:"updatedAt"`
-	Permission                   bool                                   `json:"permission"`
+	ID                     gid.GID                `json:"id"`
+	Organization           *Organization          `json:"organization,omitempty"`
+	SectionTitle           string                 `json:"sectionTitle"`
+	Name                   string                 `json:"name"`
+	Description            *string                `json:"description,omitempty"`
+	Status                 coredata.ControlStatus `json:"status"`
+	ExclusionJustification *string                `json:"exclusionJustification,omitempty"`
+	BestPractice           bool                   `json:"bestPractice"`
+	Regulatory             bool                   `json:"regulatory"`
+	Contractual            bool                   `json:"contractual"`
+	RiskAssessment         bool                   `json:"riskAssessment"`
+	Framework              *Framework             `json:"framework"`
+	Measures               *MeasureConnection     `json:"measures"`
+	Documents              *DocumentConnection    `json:"documents"`
+	Audits                 *AuditConnection       `json:"audits"`
+	Obligations            *ObligationConnection  `json:"obligations"`
+	Snapshots              *SnapshotConnection    `json:"snapshots"`
+	CreatedAt              time.Time              `json:"createdAt"`
+	UpdatedAt              time.Time              `json:"updatedAt"`
+	Permission             bool                   `json:"permission"`
 }
 
 func (Control) IsNode()             {}
@@ -202,6 +213,17 @@ type ControlFilter struct {
 	Query *string `json:"query,omitempty"`
 }
 
+type CreateApplicabilityStatementInput struct {
+	StateOfApplicabilityID gid.GID `json:"stateOfApplicabilityId"`
+	ControlID              gid.GID `json:"controlId"`
+	Applicability          bool    `json:"applicability"`
+	Justification          *string `json:"justification,omitempty"`
+}
+
+type CreateApplicabilityStatementPayload struct {
+	ApplicabilityStatementEdge *ApplicabilityStatementEdge `json:"applicabilityStatementEdge"`
+}
+
 type CreateAssetInput struct {
 	OrganizationID  gid.GID            `json:"organizationId"`
 	Name            string             `json:"name"`
@@ -552,17 +574,6 @@ type CreateSnapshotPayload struct {
 	SnapshotEdge *SnapshotEdge `json:"snapshotEdge"`
 }
 
-type CreateStateOfApplicabilityControlMappingInput struct {
-	StateOfApplicabilityID gid.GID `json:"stateOfApplicabilityId"`
-	ControlID              gid.GID `json:"controlId"`
-	Applicability          bool    `json:"applicability"`
-	Justification          *string `json:"justification,omitempty"`
-}
-
-type CreateStateOfApplicabilityControlMappingPayload struct {
-	StateOfApplicabilityControlEdge *StateOfApplicabilityControlEdge `json:"stateOfApplicabilityControlEdge"`
-}
-
 type CreateStateOfApplicabilityInput struct {
 	OrganizationID gid.GID `json:"organizationId"`
 	Name           string  `json:"name"`
@@ -756,6 +767,14 @@ type DatumFilter struct {
 	SnapshotID *gid.GID `json:"snapshotId,omitempty"`
 }
 
+type DeleteApplicabilityStatementInput struct {
+	ApplicabilityStatementID gid.GID `json:"applicabilityStatementId"`
+}
+
+type DeleteApplicabilityStatementPayload struct {
+	DeletedApplicabilityStatementID gid.GID `json:"deletedApplicabilityStatementId"`
+}
+
 type DeleteAssetInput struct {
 	AssetID gid.GID `json:"assetId"`
 }
@@ -1004,17 +1023,6 @@ type DeleteSnapshotPayload struct {
 	DeletedSnapshotID gid.GID `json:"deletedSnapshotId"`
 }
 
-type DeleteStateOfApplicabilityControlMappingInput struct {
-	StateOfApplicabilityID gid.GID `json:"stateOfApplicabilityId"`
-	ControlID              gid.GID `json:"controlId"`
-}
-
-type DeleteStateOfApplicabilityControlMappingPayload struct {
-	DeletedStateOfApplicabilityID        gid.GID `json:"deletedStateOfApplicabilityId"`
-	DeletedControlID                     gid.GID `json:"deletedControlId"`
-	DeletedStateOfApplicabilityControlID gid.GID `json:"deletedStateOfApplicabilityControlId"`
-}
-
 type DeleteStateOfApplicabilityInput struct {
 	StateOfApplicabilityID gid.GID `json:"stateOfApplicabilityId"`
 }
@@ -1746,37 +1754,21 @@ type SnapshotEdge struct {
 }
 
 type StateOfApplicability struct {
-	ID                gid.GID                                 `json:"id"`
-	Name              string                                  `json:"name"`
-	SourceID          *gid.GID                                `json:"sourceId,omitempty"`
-	SnapshotID        *gid.GID                                `json:"snapshotId,omitempty"`
-	Organization      *Organization                           `json:"organization,omitempty"`
-	Owner             *People                                 `json:"owner"`
-	CreatedAt         time.Time                               `json:"createdAt"`
-	UpdatedAt         time.Time                               `json:"updatedAt"`
-	Controls          *ControlConnection                      `json:"controls"`
-	AvailableControls []*AvailableStateOfApplicabilityControl `json:"availableControls"`
-	Permission        bool                                    `json:"permission"`
+	ID                      gid.GID                           `json:"id"`
+	Name                    string                            `json:"name"`
+	SourceID                *gid.GID                          `json:"sourceId,omitempty"`
+	SnapshotID              *gid.GID                          `json:"snapshotId,omitempty"`
+	Organization            *Organization                     `json:"organization,omitempty"`
+	Owner                   *People                           `json:"owner"`
+	CreatedAt               time.Time                         `json:"createdAt"`
+	UpdatedAt               time.Time                         `json:"updatedAt"`
+	ApplicabilityStatements *ApplicabilityStatementConnection `json:"applicabilityStatements"`
+	Permission              bool                              `json:"permission"`
 }
 
 func (StateOfApplicability) IsNode()             {}
 func (this StateOfApplicability) GetID() gid.GID { return this.ID }
 
-type StateOfApplicabilityControl struct {
-	ID                     gid.GID               `json:"id"`
-	StateOfApplicabilityID gid.GID               `json:"stateOfApplicabilityId"`
-	ControlID              gid.GID               `json:"controlId"`
-	StateOfApplicability   *StateOfApplicability `json:"stateOfApplicability"`
-	Applicability          bool                  `json:"applicability"`
-	Justification          *string               `json:"justification,omitempty"`
-}
-
-type StateOfApplicabilityControlInput struct {
-	ControlID     gid.GID `json:"controlId"`
-	Applicability bool    `json:"applicability"`
-	Justification *string `json:"justification,omitempty"`
-}
-
 type StateOfApplicabilityEdge struct {
 	Cursor page.CursorKey        `json:"cursor"`
 	Node   *StateOfApplicability `json:"node"`
@@ -1940,6 +1932,16 @@ type TrustCenterReferenceEdge struct {
 	Node   *TrustCenterReference `json:"node"`
 }
 
+type UpdateApplicabilityStatementInput struct {
+	ApplicabilityStatementID gid.GID `json:"applicabilityStatementId"`
+	Applicability            bool    `json:"applicability"`
+	Justification            *string `json:"justification,omitempty"`
+}
+
+type UpdateApplicabilityStatementPayload struct {
+	ApplicabilityStatement *ApplicabilityStatement `json:"applicabilityStatement"`
+}
+
 type UpdateAssetInput struct {
 	ID              gid.GID             `json:"id"`
 	Name            *string             `json:"name,omitempty"`

pkg/server/api/console/v1/v1_resolver.go

@@ -26,6 +26,63 @@ import (
 	"go.probo.inc/probo/pkg/server/gqlutils"
 )
 
+// StateOfApplicability is the resolver for the stateOfApplicability field.
+func (r *applicabilityStatementResolver) StateOfApplicability(ctx context.Context, obj *types.ApplicabilityStatement) (*types.StateOfApplicability, error) {
+	if err := r.authorize(ctx, obj.StateOfApplicability.ID, probo.ActionStateOfApplicabilityGet); err != nil {
+		return nil, err
+	}
+
+	prb := r.ProboService(ctx, obj.StateOfApplicability.ID.TenantID())
+
+	soa, err := prb.StatesOfApplicability.Get(ctx, obj.StateOfApplicability.ID)
+	if err != nil {
+		panic(fmt.Errorf("cannot get state of applicability: %w", err))
+	}
+
+	return types.NewStateOfApplicability(soa), nil
+}
+
+// Control is the resolver for the control field.
+func (r *applicabilityStatementResolver) Control(ctx context.Context, obj *types.ApplicabilityStatement) (*types.Control, error) {
+	if err := r.authorize(ctx, obj.ID, probo.ActionControlGet); err != nil {
+		return nil, err
+	}
+
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	control, err := prb.Controls.Get(ctx, obj.Control.ID)
+	if err != nil {
+		panic(fmt.Errorf("cannot get control: %w", err))
+	}
+
+	return types.NewControl(control), nil
+}
+
+// Permission is the resolver for the permission field.
+func (r *applicabilityStatementResolver) Permission(ctx context.Context, obj *types.ApplicabilityStatement, action string) (bool, error) {
+	return r.Resolver.Permission(ctx, obj, action)
+}
+
+// TotalCount is the resolver for the totalCount field.
+func (r *applicabilityStatementConnectionResolver) TotalCount(ctx context.Context, obj *types.ApplicabilityStatementConnection) (int, error) {
+	if err := r.authorize(ctx, obj.ParentID, probo.ActionApplicabilityStatementList); err != nil {
+		return 0, err
+	}
+
+	prb := r.ProboService(ctx, obj.ParentID.TenantID())
+
+	switch obj.Resolver.(type) {
+	case *stateOfApplicabilityResolver:
+		count, err := prb.StatesOfApplicability.CountApplicabilityStatements(ctx, obj.ParentID)
+		if err != nil {
+			panic(fmt.Errorf("cannot count applicability statements: %w", err))
+		}
+		return count, nil
+	}
+
+	panic(fmt.Errorf("not implemented: TotalCount for parent type %T", obj.Resolver))
+}
+
 // Owner is the resolver for the owner field.
 func (r *assetResolver) Owner(ctx context.Context, obj *types.Asset) (*types.People, error) {
 	if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil {
@@ -359,6 +416,42 @@ func (r *controlResolver) Organization(ctx context.Context, obj *types.Control)
 	return types.NewOrganization(organization), nil
 }
 
+// Regulatory is the resolver for the regulatory field.
+func (r *controlResolver) Regulatory(ctx context.Context, obj *types.Control) (bool, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	hasRegulatory, err := prb.Controls.HasRegulatoryObligation(ctx, obj.ID)
+	if err != nil {
+		panic(fmt.Errorf("cannot check regulatory obligation: %w", err))
+	}
+
+	return hasRegulatory, nil
+}
+
+// Contractual is the resolver for the contractual field.
+func (r *controlResolver) Contractual(ctx context.Context, obj *types.Control) (bool, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	hasContractual, err := prb.Controls.HasContractualObligation(ctx, obj.ID)
+	if err != nil {
+		panic(fmt.Errorf("cannot check contractual obligation: %w", err))
+	}
+
+	return hasContractual, nil
+}
+
+// RiskAssessment is the resolver for the riskAssessment field.
+func (r *controlResolver) RiskAssessment(ctx context.Context, obj *types.Control) (bool, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	hasRisk, err := prb.Controls.HasRiskAssessment(ctx, obj.ID)
+	if err != nil {
+		panic(fmt.Errorf("cannot check risk assessment: %w", err))
+	}
+
+	return hasRisk, nil
+}
+
 // Framework is the resolver for the framework field.
 func (r *controlResolver) Framework(ctx context.Context, obj *types.Control) (*types.Framework, error) {
 	if err := r.authorize(ctx, obj.ID, probo.ActionFrameworkGet); err != nil {
@@ -542,35 +635,6 @@ func (r *controlResolver) Snapshots(ctx context.Context, obj *types.Control, fir
 	return types.NewSnapshotConnection(page, r, obj.ID), nil
 }
 
-// StateOfApplicabilityControls is the resolver for the stateOfApplicabilityControls field.
-func (r *controlResolver) StateOfApplicabilityControls(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.StateOfApplicabilityOrderBy) (*types.StateOfApplicabilityControlConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionStateOfApplicabilityList); err != nil {
-		return nil, err
-	}
-
-	prb := r.ProboService(ctx, obj.ID.TenantID())
-
-	pageOrderBy := page.OrderBy[coredata.StateOfApplicabilityOrderField]{
-		Field:     coredata.StateOfApplicabilityOrderFieldCreatedAt,
-		Direction: page.OrderDirectionDesc,
-	}
-	if orderBy != nil {
-		pageOrderBy = page.OrderBy[coredata.StateOfApplicabilityOrderField]{
-			Field:     orderBy.Field,
-			Direction: orderBy.Direction,
-		}
-	}
-
-	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
-
-	p, err := prb.StatesOfApplicability.ListControlLinks(ctx, obj.ID, cursor)
-	if err != nil {
-		panic(fmt.Errorf("cannot list state of applicability controls: %w", err))
-	}
-
-	return types.NewStateOfApplicabilityControlConnection(p, r, obj.ID), nil
-}
-
 // Permission is the resolver for the permission field.
 func (r *controlResolver) Permission(ctx context.Context, obj *types.Control, action string) (bool, error) {
 	return r.Resolver.Permission(ctx, obj, action)
@@ -2730,41 +2794,57 @@ func (r *mutationResolver) DeleteControlDocumentMapping(ctx context.Context, inp
 	}, nil
 }
 
-// CreateStateOfApplicabilityControlMapping is the resolver for the createStateOfApplicabilityControlMapping field.
-func (r *mutationResolver) CreateStateOfApplicabilityControlMapping(ctx context.Context, input types.CreateStateOfApplicabilityControlMappingInput) (*types.CreateStateOfApplicabilityControlMappingPayload, error) {
-	if err := r.authorize(ctx, input.ControlID, probo.ActionStateOfApplicabilityControlMappingCreate); err != nil {
+// CreateApplicabilityStatement is the resolver for the createApplicabilityStatement field.
+func (r *mutationResolver) CreateApplicabilityStatement(ctx context.Context, input types.CreateApplicabilityStatementInput) (*types.CreateApplicabilityStatementPayload, error) {
+	if err := r.authorize(ctx, input.ControlID, probo.ActionApplicabilityStatementCreate); err != nil {
 		return nil, err
 	}
 
 	prb := r.ProboService(ctx, input.StateOfApplicabilityID.TenantID())
 
-	control, err := prb.StatesOfApplicability.LinkControl(ctx, input.StateOfApplicabilityID, input.ControlID, input.Applicability, input.Justification)
+	applicabilityStatement, err := prb.StatesOfApplicability.CreateApplicabilityStatement(ctx, input.StateOfApplicabilityID, input.ControlID, input.Applicability, input.Justification)
 	if err != nil {
-		panic(fmt.Errorf("cannot create state of applicability control mapping: %w", err))
+		panic(fmt.Errorf("cannot create applicability statement: %w", err))
 	}
 
-	return &types.CreateStateOfApplicabilityControlMappingPayload{
-		StateOfApplicabilityControlEdge: types.NewStateOfApplicabilityControlEdge(control, coredata.StateOfApplicabilityOrderFieldCreatedAt),
+	return &types.CreateApplicabilityStatementPayload{
+		ApplicabilityStatementEdge: types.NewApplicabilityStatementEdge(applicabilityStatement, coredata.ApplicabilityStatementOrderFieldCreatedAt),
 	}, nil
 }
 
-// DeleteStateOfApplicabilityControlMapping is the resolver for the deleteStateOfApplicabilityControlMapping field.
-func (r *mutationResolver) DeleteStateOfApplicabilityControlMapping(ctx context.Context, input types.DeleteStateOfApplicabilityControlMappingInput) (*types.DeleteStateOfApplicabilityControlMappingPayload, error) {
-	if err := r.authorize(ctx, input.StateOfApplicabilityID, probo.ActionStateOfApplicabilityControlMappingDelete); err != nil {
+// UpdateApplicabilityStatement is the resolver for the updateApplicabilityStatement field.
+func (r *mutationResolver) UpdateApplicabilityStatement(ctx context.Context, input types.UpdateApplicabilityStatementInput) (*types.UpdateApplicabilityStatementPayload, error) {
+	if err := r.authorize(ctx, input.ApplicabilityStatementID, probo.ActionApplicabilityStatementUpdate); err != nil {
 		return nil, err
 	}
 
-	prb := r.ProboService(ctx, input.StateOfApplicabilityID.TenantID())
+	prb := r.ProboService(ctx, input.ApplicabilityStatementID.TenantID())
 
-	deletedID, err := prb.StatesOfApplicability.DeleteControlLink(ctx, input.StateOfApplicabilityID, input.ControlID)
+	applicabilityStatement, err := prb.StatesOfApplicability.UpdateApplicabilityStatement(ctx, input.ApplicabilityStatementID, input.Applicability, input.Justification)
 	if err != nil {
-		panic(fmt.Errorf("cannot delete state of applicability control mapping: %w", err))
+		panic(fmt.Errorf("cannot update applicability statement: %w", err))
 	}
 
-	return &types.DeleteStateOfApplicabilityControlMappingPayload{
-		DeletedStateOfApplicabilityID:        input.StateOfApplicabilityID,
-		DeletedControlID:                     input.ControlID,
-		DeletedStateOfApplicabilityControlID: deletedID,
+	return &types.UpdateApplicabilityStatementPayload{
+		ApplicabilityStatement: types.NewApplicabilityStatement(applicabilityStatement),
+	}, nil
+}
+
+// DeleteApplicabilityStatement is the resolver for the deleteApplicabilityStatement field.
+func (r *mutationResolver) DeleteApplicabilityStatement(ctx context.Context, input types.DeleteApplicabilityStatementInput) (*types.DeleteApplicabilityStatementPayload, error) {
+	if err := r.authorize(ctx, input.ApplicabilityStatementID, probo.ActionApplicabilityStatementDelete); err != nil {
+		return nil, err
+	}
+
+	prb := r.ProboService(ctx, input.ApplicabilityStatementID.TenantID())
+
+	err := prb.StatesOfApplicability.DeleteApplicabilityStatement(ctx, input.ApplicabilityStatementID)
+	if err != nil {
+		panic(fmt.Errorf("cannot delete applicability statement: %w", err))
+	}
+
+	return &types.DeleteApplicabilityStatementPayload{
+		DeletedApplicabilityStatementID: input.ApplicabilityStatementID,
 	}, nil
 }
 
@@ -7201,73 +7281,33 @@ func (r *stateOfApplicabilityResolver) Owner(ctx context.Context, obj *types.Sta
 	return types.NewPeople(people), nil
 }
 
-// Controls is the resolver for the controls field.
-func (r *stateOfApplicabilityResolver) Controls(ctx context.Context, obj *types.StateOfApplicability, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy, filter *types.ControlFilter) (*types.ControlConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionControlList); err != nil {
+// ApplicabilityStatements is the resolver for the applicabilityStatements field.
+func (r *stateOfApplicabilityResolver) ApplicabilityStatements(ctx context.Context, obj *types.StateOfApplicability, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ApplicabilityStatementOrderBy) (*types.ApplicabilityStatementConnection, error) {
+	if err := r.authorize(ctx, obj.ID, probo.ActionApplicabilityStatementList); err != nil {
 		return nil, err
 	}
 
 	prb := r.ProboService(ctx, obj.ID.TenantID())
 
-	pageOrderBy := page.OrderBy[coredata.ControlOrderField]{
-		Field:     coredata.ControlOrderFieldCreatedAt,
-		Direction: page.OrderDirectionDesc,
+	pageOrderBy := page.OrderBy[coredata.ApplicabilityStatementOrderField]{
+		Field:     coredata.ApplicabilityStatementOrderFieldCreatedAt,
+		Direction: page.OrderDirectionAsc,
 	}
 	if orderBy != nil {
-		pageOrderBy = page.OrderBy[coredata.ControlOrderField]{
-			Field:     orderBy.Field,
+		pageOrderBy = page.OrderBy[coredata.ApplicabilityStatementOrderField]{
+			Field:     coredata.ApplicabilityStatementOrderField(orderBy.Field),
 			Direction: orderBy.Direction,
 		}
 	}
 
 	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
 
-	var controlFilter = coredata.NewControlFilter(nil)
-	if filter != nil {
-		controlFilter = coredata.NewControlFilter(filter.Query)
-	}
-
-	page, err := prb.Controls.ListForStateOfApplicabilityID(ctx, obj.ID, cursor, controlFilter)
+	p, err := prb.StatesOfApplicability.ListApplicabilityStatements(ctx, obj.ID, cursor)
 	if err != nil {
-		panic(fmt.Errorf("cannot list state of applicability controls: %w", err))
+		panic(fmt.Errorf("cannot list applicability statements: %w", err))
 	}
 
-	return types.NewControlConnection(page, r, obj.ID, controlFilter), nil
-}
-
-// AvailableControls is the resolver for the availableControls field.
-func (r *stateOfApplicabilityResolver) AvailableControls(ctx context.Context, obj *types.StateOfApplicability) ([]*types.AvailableStateOfApplicabilityControl, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionControlList); err != nil {
-		return nil, err
-	}
-
-	prb := r.ProboService(ctx, obj.ID.TenantID())
-
-	availableControls, err := prb.StatesOfApplicability.ListAvailableControls(ctx, obj.ID)
-	if err != nil {
-		panic(fmt.Errorf("cannot list available controls: %w", err))
-	}
-
-	result := make([]*types.AvailableStateOfApplicabilityControl, 0, len(availableControls))
-	for _, ac := range availableControls {
-		result = append(result, &types.AvailableStateOfApplicabilityControl{
-			ControlID:              ac.ControlID,
-			SectionTitle:           ac.SectionTitle,
-			Name:                   ac.Name,
-			FrameworkID:            ac.FrameworkID,
-			FrameworkName:          ac.FrameworkName,
-			OrganizationID:         ac.OrganizationID,
-			StateOfApplicabilityID: ac.StateOfApplicabilityID,
-			Applicability:          ac.Applicability,
-			Justification:          ac.Justification,
-			BestPractice:           ac.BestPractice,
-			Regulatory:             ac.Regulatory,
-			Contractual:            ac.Contractual,
-			RiskAssessment:         ac.RiskAssessment,
-		})
-	}
-
-	return result, nil
+	return types.NewApplicabilityStatementConnection(p, r, obj.ID), nil
 }
 
 // Permission is the resolver for the permission field.
@@ -7291,22 +7331,6 @@ func (r *stateOfApplicabilityConnectionResolver) TotalCount(ctx context.Context,
 	panic(fmt.Errorf("unsupported resolver: %T", obj.Resolver))
 }
 
-// StateOfApplicability is the resolver for the stateOfApplicability field.
-func (r *stateOfApplicabilityControlResolver) StateOfApplicability(ctx context.Context, obj *types.StateOfApplicabilityControl) (*types.StateOfApplicability, error) {
-	if err := r.authorize(ctx, obj.StateOfApplicabilityID, probo.ActionStateOfApplicabilityGet); err != nil {
-		return nil, err
-	}
-
-	prb := r.ProboService(ctx, obj.StateOfApplicabilityID.TenantID())
-
-	soa, err := prb.StatesOfApplicability.Get(ctx, obj.StateOfApplicabilityID)
-	if err != nil {
-		panic(fmt.Errorf("cannot get state of applicability: %w", err))
-	}
-
-	return types.NewStateOfApplicability(soa), nil
-}
-
 // AssignedTo is the resolver for the assignedTo field.
 func (r *taskResolver) AssignedTo(ctx context.Context, obj *types.Task) (*types.People, error) {
 	if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil {
@@ -8420,6 +8444,16 @@ func (r *viewerResolver) SignableDocument(ctx context.Context, obj *types.Viewer
 	}, nil
 }
 
+// ApplicabilityStatement returns schema.ApplicabilityStatementResolver implementation.
+func (r *Resolver) ApplicabilityStatement() schema.ApplicabilityStatementResolver {
+	return &applicabilityStatementResolver{r}
+}
+
+// ApplicabilityStatementConnection returns schema.ApplicabilityStatementConnectionResolver implementation.
+func (r *Resolver) ApplicabilityStatementConnection() schema.ApplicabilityStatementConnectionResolver {
+	return &applicabilityStatementConnectionResolver{r}
+}
+
 // Asset returns schema.AssetResolver implementation.
 func (r *Resolver) Asset() schema.AssetResolver { return &assetResolver{r} }
 
@@ -8611,11 +8645,6 @@ func (r *Resolver) StateOfApplicabilityConnection() schema.StateOfApplicabilityC
 	return &stateOfApplicabilityConnectionResolver{r}
 }
 
-// StateOfApplicabilityControl returns schema.StateOfApplicabilityControlResolver implementation.
-func (r *Resolver) StateOfApplicabilityControl() schema.StateOfApplicabilityControlResolver {
-	return &stateOfApplicabilityControlResolver{r}
-}
-
 // Task returns schema.TaskResolver implementation.
 func (r *Resolver) Task() schema.TaskResolver { return &taskResolver{r} }
 
@@ -8707,6 +8736,8 @@ func (r *Resolver) VendorService() schema.VendorServiceResolver { return &vendor
 // Viewer returns schema.ViewerResolver implementation.
 func (r *Resolver) Viewer() schema.ViewerResolver { return &viewerResolver{r} }
 
+type applicabilityStatementResolver struct{ *Resolver }
+type applicabilityStatementConnectionResolver struct{ *Resolver }
 type assetResolver struct{ *Resolver }
 type assetConnectionResolver struct{ *Resolver }
 type auditResolver struct{ *Resolver }
@@ -8754,7 +8785,6 @@ type snapshotResolver struct{ *Resolver }
 type snapshotConnectionResolver struct{ *Resolver }
 type stateOfApplicabilityResolver struct{ *Resolver }
 type stateOfApplicabilityConnectionResolver struct{ *Resolver }
-type stateOfApplicabilityControlResolver struct{ *Resolver }
 type taskResolver struct{ *Resolver }
 type taskConnectionResolver struct{ *Resolver }
 type transferImpactAssessmentResolver struct{ *Resolver }