Add control-policy mappings and rename control APIs

This introduces the ability to map controls to policies alongside the
existing control-mitigation mappings. The feature adds bidirectional
relationships with new GraphQL fields on Control and Policy types.

Signed-off-by: gearnode <bryan@frimin.fr>

pkg/coredata/control.go

@@ -56,6 +56,66 @@ func (c Control) CursorKey(orderBy ControlOrderField) page.CursorKey {
 	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
 }
 
+func (c *Controls) LoadByPolicyID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	policyID gid.GID,
+	cursor *page.Cursor[ControlOrderField],
+) error {
+	q := `
+WITH ctrl AS (
+	SELECT
+		c.id,
+		c.reference_id,
+		c.framework_id,
+		c.tenant_id,
+		c.name,
+		c.description,
+		c.created_at,
+		c.updated_at
+	FROM
+		controls c
+	INNER JOIN
+		controls_policies cp ON c.id = cp.control_id
+	WHERE
+		cp.policy_id = @policy_id
+)
+SELECT
+	id,
+	reference_id,
+	framework_id,
+	tenant_id,
+	name,
+	description,
+	created_at,
+	updated_at
+FROM
+	ctrl
+WHERE %s
+	AND %s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.NamedArgs{"policy_id": policyID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query controls: %w", err)
+	}
+
+	controls, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Control])
+	if err != nil {
+		return fmt.Errorf("cannot collect controls: %w", err)
+	}
+
+	*c = controls
+
+	return nil
+}
+
 func (c *Controls) LoadByMitigationID(
 	ctx context.Context,
 	conn pg.Conn,

pkg/coredata/control_policy.go

@@ -0,0 +1,95 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+)
+
+type (
+	ControlPolicy struct {
+		ControlID gid.GID      `db:"control_id"`
+		PolicyID  gid.GID      `db:"policy_id"`
+		TenantID  gid.TenantID `db:"tenant_id"`
+		CreatedAt time.Time    `db:"created_at"`
+	}
+
+	ControlPolicies []*ControlPolicy
+)
+
+func (cp ControlPolicy) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO
+    controls_mitigations (
+        control_id,
+        policy_id,
+        tenant_id,
+        created_at
+    )
+VALUES (
+    @control_id,
+    @policy_id,
+    @tenant_id,
+    @created_at
+);
+`
+
+	args := pgx.StrictNamedArgs{
+		"control_id": cp.ControlID,
+		"policy_id":  cp.PolicyID,
+		"tenant_id":  scope.GetTenantID(),
+		"created_at": cp.CreatedAt,
+	}
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}
+
+func (cp ControlPolicy) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+DELETE
+FROM
+    controls_mitigations
+WHERE
+    %s
+    AND control_id = @control_id
+    AND policy_id = @policy_id;
+`
+
+	args := pgx.StrictNamedArgs{
+		"control_id": cp.ControlID,
+		"policy_id":  cp.PolicyID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}

pkg/coredata/migrations/20250408T205600Z.sql

@@ -0,0 +1,7 @@
+CREATE TABLE controls_policies (
+    control_id TEXT NOT NULL REFERENCES controls(id),
+    policy_id TEXT NOT NULL REFERENCES policies(id),
+    tenant_id TEXT NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    PRIMARY KEY (control_id, policy_id)
+);

pkg/coredata/policy.go

@@ -271,3 +271,67 @@ RETURNING
 
 	return nil
 }
+
+func (p *Policies) LoadByControlID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	controlID gid.GID,
+	cursor *page.Cursor[PolicyOrderField],
+) error {
+	q := `
+WITH plcs AS (
+	SELECT
+		p.id,
+		p.tenant_id,
+		p.organization_id,
+		p.owner_id,
+		p.name,
+		p.content,
+		p.status,
+		p.review_date,
+		p.created_at,
+		p.updated_at
+	FROM
+		policies p
+	INNER JOIN
+		controls_policies cp ON p.id = cp.policy_id
+	WHERE
+		cp.control_id = @control_id
+)
+SELECT
+	id,
+	tenant_id,
+	organization_id,
+	owner_id,
+	name,
+	content,
+	status,
+	review_date,
+	created_at,
+	updated_at
+FROM
+	plcs
+WHERE %s
+	AND %s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"control_id": controlID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query policies: %w", err)
+	}
+
+	policies, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Policy])
+	if err != nil {
+		return fmt.Errorf("cannot collect policies: %w", err)
+	}
+
+	*p = policies
+
+	return nil
+}