Add control-policy mappings and rename control APIs

This introduces the ability to map controls to policies alongside the
existing control-mitigation mappings. The feature adds bidirectional
relationships with new GraphQL fields on Control and Policy types.

Signed-off-by: gearnode <bryan@frimin.fr>

pkg/server/api/console/v1/schema.graphql

@@ -448,6 +448,14 @@ type Control implements Node {
     orderBy: MitigationOrder
   ): MitigationConnection! @goField(forceResolver: true)
 
+  policies(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: PolicyOrder
+  ): PolicyConnection! @goField(forceResolver: true)
+
   createdAt: Datetime!
   updatedAt: Datetime!
 }
@@ -530,6 +538,15 @@ type Policy implements Node {
   content: String!
   reviewDate: Datetime
   owner: People! @goField(forceResolver: true)
+
+  controls(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: ControlOrder
+  ): ControlConnection! @goField(forceResolver: true)
+
   createdAt: Datetime!
   updatedAt: Datetime!
 }
@@ -727,12 +744,18 @@ type Mutation {
   importMitigation(input: ImportMitigationInput!): ImportMitigationPayload!
 
   # Control mutations
-  createControlMapping(
-    input: CreateControlMappingInput!
-  ): CreateControlMappingPayload!
-  deleteControlMapping(
-    input: DeleteControlMappingInput!
-  ): DeleteControlMappingPayload!
+  createControlMitigationMapping(
+    input: CreateControlMitigationMappingInput!
+  ): CreateControlMitigationMappingPayload!
+  createControlPolicyMapping(
+    input: CreateControlPolicyMappingInput!
+  ): CreateControlPolicyMappingPayload!
+  deleteControlMitigationMapping(
+    input: DeleteControlMitigationMappingInput!
+  ): DeleteControlMitigationMappingPayload!
+  deleteControlPolicyMapping(
+    input: DeleteControlPolicyMappingInput!
+  ): DeleteControlPolicyMappingPayload!
 
   # Task mutations
   createTask(input: CreateTaskInput!): CreateTaskPayload!
@@ -897,16 +920,26 @@ input UnassignTaskInput {
   taskId: ID!
 }
 
-input CreateControlMappingInput {
+input CreateControlMitigationMappingInput {
   controlId: ID!
   mitigationId: ID!
 }
 
-input DeleteControlMappingInput {
+input CreateControlPolicyMappingInput {
+  controlId: ID!
+  policyId: ID!
+}
+
+input DeleteControlMitigationMappingInput {
   controlId: ID!
   mitigationId: ID!
 }
 
+input DeleteControlPolicyMappingInput {
+  controlId: ID!
+  policyId: ID!
+}
+
 input CreateRiskInput {
   organizationId: ID!
   name: String!
@@ -1088,11 +1121,19 @@ type UnassignTaskPayload {
   task: Task!
 }
 
-type CreateControlMappingPayload {
+type CreateControlMitigationMappingPayload {
   success: Boolean!
 }
 
-type DeleteControlMappingPayload {
+type CreateControlPolicyMappingPayload {
+  success: Boolean!
+}
+
+type DeleteControlMitigationMappingPayload {
+  success: Boolean!
+}
+
+type DeleteControlPolicyMappingPayload {
   success: Boolean!
 }
 

pkg/server/api/console/v1/types/types.go

@@ -42,6 +42,7 @@ type Control struct {
 	Name        string                `json:"name"`
 	Description string                `json:"description"`
 	Mitigations *MitigationConnection `json:"mitigations"`
+	Policies    *PolicyConnection     `json:"policies"`
 	CreatedAt   time.Time             `json:"createdAt"`
 	UpdatedAt   time.Time             `json:"updatedAt"`
 }
@@ -59,12 +60,21 @@ type ControlEdge struct {
 	Node   *Control       `json:"node"`
 }
 
-type CreateControlMappingInput struct {
+type CreateControlMitigationMappingInput struct {
 	ControlID    gid.GID `json:"controlId"`
 	MitigationID gid.GID `json:"mitigationId"`
 }
 
-type CreateControlMappingPayload struct {
+type CreateControlMitigationMappingPayload struct {
+	Success bool `json:"success"`
+}
+
+type CreateControlPolicyMappingInput struct {
+	ControlID gid.GID `json:"controlId"`
+	PolicyID  gid.GID `json:"policyId"`
+}
+
+type CreateControlPolicyMappingPayload struct {
 	Success bool `json:"success"`
 }
 
@@ -188,12 +198,21 @@ type CreateVendorPayload struct {
 	VendorEdge *VendorEdge `json:"vendorEdge"`
 }
 
-type DeleteControlMappingInput struct {
+type DeleteControlMitigationMappingInput struct {
 	ControlID    gid.GID `json:"controlId"`
 	MitigationID gid.GID `json:"mitigationId"`
 }
 
-type DeleteControlMappingPayload struct {
+type DeleteControlMitigationMappingPayload struct {
+	Success bool `json:"success"`
+}
+
+type DeleteControlPolicyMappingInput struct {
+	ControlID gid.GID `json:"controlId"`
+	PolicyID  gid.GID `json:"policyId"`
+}
+
+type DeleteControlPolicyMappingPayload struct {
 	Success bool `json:"success"`
 }
 
@@ -458,6 +477,7 @@ type Policy struct {
 	Content    string                `json:"content"`
 	ReviewDate *time.Time            `json:"reviewDate,omitempty"`
 	Owner      *People               `json:"owner"`
+	Controls   *ControlConnection    `json:"controls"`
 	CreatedAt  time.Time             `json:"createdAt"`
 	UpdatedAt  time.Time             `json:"updatedAt"`
 }

pkg/server/api/console/v1/v1_resolver.go

@@ -44,6 +44,31 @@ func (r *controlResolver) Mitigations(ctx context.Context, obj *types.Control, f
 	return types.NewMitigationConnection(page), nil
 }
 
+// Policies is the resolver for the policies field.
+func (r *controlResolver) Policies(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.PolicyOrderBy) (*types.PolicyConnection, error) {
+	svc := r.GetTenantServiceIfAuthorized(ctx, obj.ID.TenantID())
+
+	pageOrderBy := page.OrderBy[coredata.PolicyOrderField]{
+		Field:     coredata.PolicyOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.PolicyOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	page, err := svc.Policies.ListForControlID(ctx, obj.ID, cursor)
+	if err != nil {
+		return nil, fmt.Errorf("cannot list policies: %w", err)
+	}
+
+	return types.NewPolicyConnection(page), nil
+}
+
 // FileURL is the resolver for the fileUrl field.
 func (r *evidenceResolver) FileURL(ctx context.Context, obj *types.Evidence) (*string, error) {
 	svc := r.GetTenantServiceIfAuthorized(ctx, obj.ID.TenantID())
@@ -521,30 +546,58 @@ func (r *mutationResolver) ImportMitigation(ctx context.Context, input types.Imp
 	}, nil
 }
 
-// CreateControlMapping is the resolver for the createControlMapping field.
-func (r *mutationResolver) CreateControlMapping(ctx context.Context, input types.CreateControlMappingInput) (*types.CreateControlMappingPayload, error) {
+// CreateControlMitigationMapping is the resolver for the createControlMitigationMapping field.
+func (r *mutationResolver) CreateControlMitigationMapping(ctx context.Context, input types.CreateControlMitigationMappingInput) (*types.CreateControlMitigationMappingPayload, error) {
 	svc := r.GetTenantServiceIfAuthorized(ctx, input.MitigationID.TenantID())
 
-	err := svc.Controls.CreateMapping(ctx, input.ControlID, input.MitigationID)
+	err := svc.Controls.CreateMitigationMapping(ctx, input.ControlID, input.MitigationID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot create control mapping: %w", err)
+		panic(fmt.Errorf("cannot create control mitigation mapping: %w", err))
 	}
 
-	return &types.CreateControlMappingPayload{
+	return &types.CreateControlMitigationMappingPayload{
 		Success: true,
 	}, nil
 }
 
-// DeleteControlMapping is the resolver for the deleteControlMapping field.
-func (r *mutationResolver) DeleteControlMapping(ctx context.Context, input types.DeleteControlMappingInput) (*types.DeleteControlMappingPayload, error) {
-	svc := r.GetTenantServiceIfAuthorized(ctx, input.MitigationID.TenantID())
+// CreateControlPolicyMapping is the resolver for the createControlPolicyMapping field.
+func (r *mutationResolver) CreateControlPolicyMapping(ctx context.Context, input types.CreateControlPolicyMappingInput) (*types.CreateControlPolicyMappingPayload, error) {
+	svc := r.GetTenantServiceIfAuthorized(ctx, input.PolicyID.TenantID())
 
-	err := svc.Controls.DeleteMapping(ctx, input.ControlID, input.MitigationID)
+	err := svc.Controls.CreatePolicyMapping(ctx, input.ControlID, input.PolicyID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot delete control mapping: %w", err)
+		panic(fmt.Errorf("cannot create control policy mapping: %w", err))
 	}
 
-	return &types.DeleteControlMappingPayload{
+	return &types.CreateControlPolicyMappingPayload{
+		Success: true,
+	}, nil
+}
+
+// DeleteControlMitigationMapping is the resolver for the deleteControlMitigationMapping field.
+func (r *mutationResolver) DeleteControlMitigationMapping(ctx context.Context, input types.DeleteControlMitigationMappingInput) (*types.DeleteControlMitigationMappingPayload, error) {
+	svc := r.GetTenantServiceIfAuthorized(ctx, input.MitigationID.TenantID())
+
+	err := svc.Controls.DeleteMitigationMapping(ctx, input.ControlID, input.MitigationID)
+	if err != nil {
+		panic(fmt.Errorf("cannot delete control mitigation mapping: %w", err))
+	}
+
+	return &types.DeleteControlMitigationMappingPayload{
+		Success: true,
+	}, nil
+}
+
+// DeleteControlPolicyMapping is the resolver for the deleteControlPolicyMapping field.
+func (r *mutationResolver) DeleteControlPolicyMapping(ctx context.Context, input types.DeleteControlPolicyMappingInput) (*types.DeleteControlPolicyMappingPayload, error) {
+	svc := r.GetTenantServiceIfAuthorized(ctx, input.PolicyID.TenantID())
+
+	err := svc.Controls.DeletePolicyMapping(ctx, input.ControlID, input.PolicyID)
+	if err != nil {
+		panic(fmt.Errorf("cannot delete control policy mapping: %w", err))
+	}
+
+	return &types.DeleteControlPolicyMappingPayload{
 		Success: true,
 	}, nil
 }
@@ -1067,6 +1120,31 @@ func (r *policyResolver) Owner(ctx context.Context, obj *types.Policy) (*types.P
 	return types.NewPeople(owner), nil
 }
 
+// Controls is the resolver for the controls field.
+func (r *policyResolver) Controls(ctx context.Context, obj *types.Policy, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy) (*types.ControlConnection, error) {
+	svc := r.GetTenantServiceIfAuthorized(ctx, obj.ID.TenantID())
+
+	pageOrderBy := page.OrderBy[coredata.ControlOrderField]{
+		Field:     coredata.ControlOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.ControlOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	page, err := svc.Controls.ListForPolicyID(ctx, obj.ID, cursor)
+	if err != nil {
+		panic(fmt.Errorf("cannot list policy controls: %w", err))
+	}
+
+	return types.NewControlConnection(page), nil
+}
+
 // Node is the resolver for the node field.
 func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error) {
 	svc := r.GetTenantServiceIfAuthorized(ctx, id.TenantID())