rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add control-policy mappings and rename control APIs

Browse Source 
This introduces the ability to map controls to policies alongside the
existing control-mitigation mappings. The feature adds bidirectional
relationships with new GraphQL fields on Control and Policy types.

Signed-off-by: gearnode <bryan@frimin.fr>
This commit is contained in:
gearnode
2025-04-08 21:14:11 -07:00
parent 348e2641bb
commit 4ce72c03f7
17 changed files with 1630 additions and 207 deletions
Download Patch File Download Diff File Expand all files Collapse all files

60
pkg/coredata/control.go
View File

@@ -56,6 +56,66 @@ func (c Control) CursorKey(orderBy ControlOrderField) page.CursorKey {
panic(fmt.Sprintf("unsupported order by: %s", orderBy))
}
func (c *Controls) LoadByPolicyID(
ctx context.Context,
conn pg.Conn,
scope Scoper,
policyID gid.GID,
cursor *page.Cursor[ControlOrderField],
) error {
q := `
WITH ctrl AS (
SELECT
c.id,
c.reference_id,
c.framework_id,
c.tenant_id,
c.name,
c.description,
c.created_at,
c.updated_at
FROM
controls c
INNER JOIN
controls_policies cp ON c.id = cp.control_id
WHERE
cp.policy_id = @policy_id
)
SELECT
id,
reference_id,
framework_id,
tenant_id,
name,
description,
created_at,
updated_at
FROM
ctrl
WHERE %s
AND %s
`
q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
args := pgx.NamedArgs{"policy_id": policyID}
maps.Copy(args, scope.SQLArguments())
maps.Copy(args, cursor.SQLArguments())
rows, err := conn.Query(ctx, q, args)
if err != nil {
return fmt.Errorf("cannot query controls: %w", err)
}
controls, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Control])
if err != nil {
return fmt.Errorf("cannot collect controls: %w", err)
}
*c = controls
return nil
}
func (c *Controls) LoadByMitigationID(
ctx context.Context,
conn pg.Conn,

95
pkg/coredata/control_policy.go Normal file
View File

@@ -0,0 +1,95 @@
// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package coredata
import (
"context"
"fmt"
"maps"
"time"
"github.com/getprobo/probo/pkg/gid"
"github.com/jackc/pgx/v5"
"go.gearno.de/kit/pg"
)
type (
ControlPolicy struct {
ControlID gid.GID `db:"control_id"`
PolicyID gid.GID `db:"policy_id"`
TenantID gid.TenantID `db:"tenant_id"`
CreatedAt time.Time `db:"created_at"`
}
ControlPolicies []*ControlPolicy
)
func (cp ControlPolicy) Insert(
ctx context.Context,
conn pg.Conn,
scope Scoper,
) error {
q := `
INSERT INTO
controls_mitigations (
control_id,
policy_id,
tenant_id,
created_at
)
VALUES (
@control_id,
@policy_id,
@tenant_id,
@created_at
);
`
args := pgx.StrictNamedArgs{
"control_id": cp.ControlID,
"policy_id": cp.PolicyID,
"tenant_id": scope.GetTenantID(),
"created_at": cp.CreatedAt,
}
_, err := conn.Exec(ctx, q, args)
return err
}
func (cp ControlPolicy) Delete(
ctx context.Context,
conn pg.Conn,
scope Scoper,
) error {
q := `
DELETE
FROM
controls_mitigations
WHERE
%s
AND control_id = @control_id
AND policy_id = @policy_id;
`
args := pgx.StrictNamedArgs{
"control_id": cp.ControlID,
"policy_id": cp.PolicyID,
}
maps.Copy(args, scope.SQLArguments())
q = fmt.Sprintf(q, scope.SQLFragment())
_, err := conn.Exec(ctx, q, args)
return err
}

7
pkg/coredata/migrations/20250408T205600Z.sql Normal file
View File

@@ -0,0 +1,7 @@
CREATE TABLE controls_policies (
control_id TEXT NOT NULL REFERENCES controls(id),
policy_id TEXT NOT NULL REFERENCES policies(id),
tenant_id TEXT NOT NULL,
created_at TIMESTAMP WITH TIME ZONE NOT NULL,
PRIMARY KEY (control_id, policy_id)
);

64
pkg/coredata/policy.go
View File

@@ -271,3 +271,67 @@ RETURNING
return nil
}
func (p *Policies) LoadByControlID(
ctx context.Context,
conn pg.Conn,
scope Scoper,
controlID gid.GID,
cursor *page.Cursor[PolicyOrderField],
) error {
q := `
WITH plcs AS (
SELECT
p.id,
p.tenant_id,
p.organization_id,
p.owner_id,
p.name,
p.content,
p.status,
p.review_date,
p.created_at,
p.updated_at
FROM
policies p
INNER JOIN
controls_policies cp ON p.id = cp.policy_id
WHERE
cp.control_id = @control_id
)
SELECT
id,
tenant_id,
organization_id,
owner_id,
name,
content,
status,
review_date,
created_at,
updated_at
FROM
plcs
WHERE %s
AND %s
`
q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
args := pgx.StrictNamedArgs{"control_id": controlID}
maps.Copy(args, scope.SQLArguments())
maps.Copy(args, cursor.SQLArguments())
rows, err := conn.Query(ctx, q, args)
if err != nil {
return fmt.Errorf("cannot query policies: %w", err)
}
policies, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Policy])
if err != nil {
return fmt.Errorf("cannot collect policies: %w", err)
}
*p = policies
return nil
}

65
pkg/probo/control_service.go
View File

@@ -55,6 +55,27 @@ type (
}
)
func (s ControlService) ListForPolicyID(
ctx context.Context,
policyID gid.GID,
cursor *page.Cursor[coredata.ControlOrderField],
) (*page.Page[*coredata.Control, coredata.ControlOrderField], error) {
var controls coredata.Controls
err := s.svc.pg.WithConn(
ctx,
func(conn pg.Conn) error {
return controls.LoadByPolicyID(ctx, conn, s.svc.scope, policyID, cursor)
},
)
if err != nil {
return nil, fmt.Errorf("cannot list controls: %w", err)
}
return page.NewPage(controls, cursor), nil
}
func (s ControlService) ListForMitigationID(
ctx context.Context,
mitigationID gid.GID,
@@ -76,7 +97,7 @@ func (s ControlService) ListForMitigationID(
return page.NewPage(controls, cursor), nil
}
func (s ControlService) CreateMapping(
func (s ControlService) CreateMitigationMapping(
ctx context.Context,
controlID gid.GID,
mitigationID gid.GID,
@@ -96,7 +117,7 @@ func (s ControlService) CreateMapping(
)
}
func (s ControlService) DeleteMapping(
func (s ControlService) DeleteMitigationMapping(
ctx context.Context,
controlID gid.GID,
mitigationID gid.GID,
@@ -116,6 +137,46 @@ func (s ControlService) DeleteMapping(
)
}
func (s ControlService) CreatePolicyMapping(
ctx context.Context,
controlID gid.GID,
policyID gid.GID,
) error {
controlPolicy := &coredata.ControlPolicy{
ControlID: controlID,
PolicyID: policyID,
TenantID: s.svc.scope.GetTenantID(),
CreatedAt: time.Now(),
}
return s.svc.pg.WithConn(
ctx,
func(conn pg.Conn) error {
return controlPolicy.Insert(ctx, conn, s.svc.scope)
},
)
}
func (s ControlService) DeletePolicyMapping(
ctx context.Context,
controlID gid.GID,
policyID gid.GID,
) error {
controlPolicy := &coredata.ControlPolicy{
ControlID: controlID,
PolicyID: policyID,
TenantID: s.svc.scope.GetTenantID(),
CreatedAt: time.Now(),
}
return s.svc.pg.WithConn(
ctx,
func(conn pg.Conn) error {
return controlPolicy.Delete(ctx, conn, s.svc.scope)
},
)
}
// Create creates a new control
func (s ControlService) Create(
ctx context.Context,

21
pkg/probo/policy_service.go
View File

@@ -168,3 +168,24 @@ func (s *PolicyService) ListByOrganizationID(
return page.NewPage(policies, cursor), nil
}
func (s *PolicyService) ListForControlID(
ctx context.Context,
controlID gid.GID,
cursor *page.Cursor[coredata.PolicyOrderField],
) (*page.Page[*coredata.Policy, coredata.PolicyOrderField], error) {
var policies coredata.Policies
err := s.svc.pg.WithConn(
ctx,
func(conn pg.Conn) error {
return policies.LoadByControlID(ctx, conn, s.svc.scope, controlID, cursor)
},
)
if err != nil {
return nil, err
}
return page.NewPage(policies, cursor), nil
}

61
pkg/server/api/console/v1/schema.graphql
View File

@@ -448,6 +448,14 @@ type Control implements Node {
orderBy: MitigationOrder
): MitigationConnection! @goField(forceResolver: true)
policies(
first: Int
after: CursorKey
last: Int
before: CursorKey
orderBy: PolicyOrder
): PolicyConnection! @goField(forceResolver: true)
createdAt: Datetime!
updatedAt: Datetime!
}
@@ -530,6 +538,15 @@ type Policy implements Node {
content: String!
reviewDate: Datetime
owner: People! @goField(forceResolver: true)
controls(
first: Int
after: CursorKey
last: Int
before: CursorKey
orderBy: ControlOrder
): ControlConnection! @goField(forceResolver: true)
createdAt: Datetime!
updatedAt: Datetime!
}
@@ -727,12 +744,18 @@ type Mutation {
importMitigation(input: ImportMitigationInput!): ImportMitigationPayload!
# Control mutations
createControlMapping(
input: CreateControlMappingInput!
): CreateControlMappingPayload!
deleteControlMapping(
input: DeleteControlMappingInput!
): DeleteControlMappingPayload!
createControlMitigationMapping(
input: CreateControlMitigationMappingInput!
): CreateControlMitigationMappingPayload!
createControlPolicyMapping(
input: CreateControlPolicyMappingInput!
): CreateControlPolicyMappingPayload!
deleteControlMitigationMapping(
input: DeleteControlMitigationMappingInput!
): DeleteControlMitigationMappingPayload!
deleteControlPolicyMapping(
input: DeleteControlPolicyMappingInput!
): DeleteControlPolicyMappingPayload!
# Task mutations
createTask(input: CreateTaskInput!): CreateTaskPayload!
@@ -897,16 +920,26 @@ input UnassignTaskInput {
taskId: ID!
}
input CreateControlMappingInput {
input CreateControlMitigationMappingInput {
controlId: ID!
mitigationId: ID!
}
input DeleteControlMappingInput {
input CreateControlPolicyMappingInput {
controlId: ID!
policyId: ID!
}
input DeleteControlMitigationMappingInput {
controlId: ID!
mitigationId: ID!
}
input DeleteControlPolicyMappingInput {
controlId: ID!
policyId: ID!
}
input CreateRiskInput {
organizationId: ID!
name: String!
@@ -1088,11 +1121,19 @@ type UnassignTaskPayload {
task: Task!
}
type CreateControlMappingPayload {
type CreateControlMitigationMappingPayload {
success: Boolean!
}
type DeleteControlMappingPayload {
type CreateControlPolicyMappingPayload {
success: Boolean!
}
type DeleteControlMitigationMappingPayload {
success: Boolean!
}
type DeleteControlPolicyMappingPayload {
success: Boolean!
}

1233
pkg/server/api/console/v1/schema/schema.go
View File

File diff suppressed because it is too large Load Diff

28
pkg/server/api/console/v1/types/types.go
View File

@@ -42,6 +42,7 @@ type Control struct {
Name string `json:"name"`
Description string `json:"description"`
Mitigations *MitigationConnection `json:"mitigations"`
Policies *PolicyConnection `json:"policies"`
CreatedAt time.Time `json:"createdAt"`
UpdatedAt time.Time `json:"updatedAt"`
}
@@ -59,12 +60,21 @@ type ControlEdge struct {
Node *Control `json:"node"`
}
type CreateControlMappingInput struct {
type CreateControlMitigationMappingInput struct {
ControlID gid.GID `json:"controlId"`
MitigationID gid.GID `json:"mitigationId"`
}
type CreateControlMappingPayload struct {
type CreateControlMitigationMappingPayload struct {
Success bool `json:"success"`
}
type CreateControlPolicyMappingInput struct {
ControlID gid.GID `json:"controlId"`
PolicyID gid.GID `json:"policyId"`
}
type CreateControlPolicyMappingPayload struct {
Success bool `json:"success"`
}
@@ -188,12 +198,21 @@ type CreateVendorPayload struct {
VendorEdge *VendorEdge `json:"vendorEdge"`
}
type DeleteControlMappingInput struct {
type DeleteControlMitigationMappingInput struct {
ControlID gid.GID `json:"controlId"`
MitigationID gid.GID `json:"mitigationId"`
}
type DeleteControlMappingPayload struct {
type DeleteControlMitigationMappingPayload struct {
Success bool `json:"success"`
}
type DeleteControlPolicyMappingInput struct {
ControlID gid.GID `json:"controlId"`
PolicyID gid.GID `json:"policyId"`
}
type DeleteControlPolicyMappingPayload struct {
Success bool `json:"success"`
}
@@ -458,6 +477,7 @@ type Policy struct {
Content string `json:"content"`
ReviewDate *time.Time `json:"reviewDate,omitempty"`
Owner *People `json:"owner"`
Controls *ControlConnection `json:"controls"`
CreatedAt time.Time `json:"createdAt"`
UpdatedAt time.Time `json:"updatedAt"`
}

100
pkg/server/api/console/v1/v1_resolver.go
View File

@@ -44,6 +44,31 @@ func (r *controlResolver) Mitigations(ctx context.Context, obj *types.Control, f
return types.NewMitigationConnection(page), nil
}
// Policies is the resolver for the policies field.
func (r *controlResolver) Policies(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.PolicyOrderBy) (*types.PolicyConnection, error) {
svc := r.GetTenantServiceIfAuthorized(ctx, obj.ID.TenantID())
pageOrderBy := page.OrderBy[coredata.PolicyOrderField]{
Field: coredata.PolicyOrderFieldCreatedAt,
Direction: page.OrderDirectionDesc,
}
if orderBy != nil {
pageOrderBy = page.OrderBy[coredata.PolicyOrderField]{
Field: orderBy.Field,
Direction: orderBy.Direction,
}
}
cursor := types.NewCursor(first, after, last, before, pageOrderBy)
page, err := svc.Policies.ListForControlID(ctx, obj.ID, cursor)
if err != nil {
return nil, fmt.Errorf("cannot list policies: %w", err)
}
return types.NewPolicyConnection(page), nil
}
// FileURL is the resolver for the fileUrl field.
func (r *evidenceResolver) FileURL(ctx context.Context, obj *types.Evidence) (*string, error) {
svc := r.GetTenantServiceIfAuthorized(ctx, obj.ID.TenantID())
@@ -521,30 +546,58 @@ func (r *mutationResolver) ImportMitigation(ctx context.Context, input types.Imp
}, nil
}
// CreateControlMapping is the resolver for the createControlMapping field.
func (r *mutationResolver) CreateControlMapping(ctx context.Context, input types.CreateControlMappingInput) (*types.CreateControlMappingPayload, error) {
// CreateControlMitigationMapping is the resolver for the createControlMitigationMapping field.
func (r *mutationResolver) CreateControlMitigationMapping(ctx context.Context, input types.CreateControlMitigationMappingInput) (*types.CreateControlMitigationMappingPayload, error) {
svc := r.GetTenantServiceIfAuthorized(ctx, input.MitigationID.TenantID())
err := svc.Controls.CreateMapping(ctx, input.ControlID, input.MitigationID)
err := svc.Controls.CreateMitigationMapping(ctx, input.ControlID, input.MitigationID)
if err != nil {
return nil, fmt.Errorf("cannot create control mapping: %w", err)
panic(fmt.Errorf("cannot create control mitigation mapping: %w", err))
}
return &types.CreateControlMappingPayload{
return &types.CreateControlMitigationMappingPayload{
Success: true,
}, nil
}
// DeleteControlMapping is the resolver for the deleteControlMapping field.
func (r *mutationResolver) DeleteControlMapping(ctx context.Context, input types.DeleteControlMappingInput) (*types.DeleteControlMappingPayload, error) {
svc := r.GetTenantServiceIfAuthorized(ctx, input.MitigationID.TenantID())
// CreateControlPolicyMapping is the resolver for the createControlPolicyMapping field.
func (r *mutationResolver) CreateControlPolicyMapping(ctx context.Context, input types.CreateControlPolicyMappingInput) (*types.CreateControlPolicyMappingPayload, error) {
svc := r.GetTenantServiceIfAuthorized(ctx, input.PolicyID.TenantID())
err := svc.Controls.DeleteMapping(ctx, input.ControlID, input.MitigationID)
err := svc.Controls.CreatePolicyMapping(ctx, input.ControlID, input.PolicyID)
if err != nil {
return nil, fmt.Errorf("cannot delete control mapping: %w", err)
panic(fmt.Errorf("cannot create control policy mapping: %w", err))
}
return &types.DeleteControlMappingPayload{
return &types.CreateControlPolicyMappingPayload{
Success: true,
}, nil
}
// DeleteControlMitigationMapping is the resolver for the deleteControlMitigationMapping field.
func (r *mutationResolver) DeleteControlMitigationMapping(ctx context.Context, input types.DeleteControlMitigationMappingInput) (*types.DeleteControlMitigationMappingPayload, error) {
svc := r.GetTenantServiceIfAuthorized(ctx, input.MitigationID.TenantID())
err := svc.Controls.DeleteMitigationMapping(ctx, input.ControlID, input.MitigationID)
if err != nil {
panic(fmt.Errorf("cannot delete control mitigation mapping: %w", err))
}
return &types.DeleteControlMitigationMappingPayload{
Success: true,
}, nil
}
// DeleteControlPolicyMapping is the resolver for the deleteControlPolicyMapping field.
func (r *mutationResolver) DeleteControlPolicyMapping(ctx context.Context, input types.DeleteControlPolicyMappingInput) (*types.DeleteControlPolicyMappingPayload, error) {
svc := r.GetTenantServiceIfAuthorized(ctx, input.PolicyID.TenantID())
err := svc.Controls.DeletePolicyMapping(ctx, input.ControlID, input.PolicyID)
if err != nil {
panic(fmt.Errorf("cannot delete control policy mapping: %w", err))
}
return &types.DeleteControlPolicyMappingPayload{
Success: true,
}, nil
}
@@ -1067,6 +1120,31 @@ func (r *policyResolver) Owner(ctx context.Context, obj *types.Policy) (*types.P
return types.NewPeople(owner), nil
}
// Controls is the resolver for the controls field.
func (r *policyResolver) Controls(ctx context.Context, obj *types.Policy, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy) (*types.ControlConnection, error) {
svc := r.GetTenantServiceIfAuthorized(ctx, obj.ID.TenantID())
pageOrderBy := page.OrderBy[coredata.ControlOrderField]{
Field: coredata.ControlOrderFieldCreatedAt,
Direction: page.OrderDirectionDesc,
}
if orderBy != nil {
pageOrderBy = page.OrderBy[coredata.ControlOrderField]{
Field: orderBy.Field,
Direction: orderBy.Direction,
}
}
cursor := types.NewCursor(first, after, last, before, pageOrderBy)
page, err := svc.Controls.ListForPolicyID(ctx, obj.ID, cursor)
if err != nil {
panic(fmt.Errorf("cannot list policy controls: %w", err))
}
return types.NewControlConnection(page), nil
}
// Node is the resolver for the node field.
func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error) {
svc := r.GetTenantServiceIfAuthorized(ctx, id.TenantID())