Add vendor contacts

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/coredata/entity_type_reg.go

@@ -41,4 +41,5 @@ const (
 	TrustCenterAccessEntityType
 	VendorBusinessAssociateAgreementEntityType
 	FileEntityType
+	VendorContactEntityType
 )

pkg/coredata/migrations/20250813T160929Z.sql

@@ -0,0 +1,17 @@
+CREATE TABLE vendor_contacts (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    vendor_id TEXT NOT NULL,
+    full_name TEXT,
+    email CITEXT,
+    phone TEXT,
+    role TEXT,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    updated_at TIMESTAMP WITH TIME ZONE NOT NULL,
+
+    CONSTRAINT vendor_contacts_vendor_id_fkey
+        FOREIGN KEY (vendor_id)
+        REFERENCES vendors(id)
+        ON UPDATE CASCADE
+        ON DELETE CASCADE
+);

pkg/coredata/vendor_contact.go

@@ -0,0 +1,277 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/page"
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+)
+
+type (
+	VendorContact struct {
+		ID        gid.GID   `db:"id"`
+		VendorID  gid.GID   `db:"vendor_id"`
+		FullName  *string   `db:"full_name"`
+		Email     *string   `db:"email"`
+		Phone     *string   `db:"phone"`
+		Role      *string   `db:"role"`
+		CreatedAt time.Time `db:"created_at"`
+		UpdatedAt time.Time `db:"updated_at"`
+	}
+
+	VendorContacts []*VendorContact
+
+	ErrVendorContactNotFound struct {
+		Identifier string
+	}
+)
+
+func (e ErrVendorContactNotFound) Error() string {
+	return fmt.Sprintf("vendor contact not found: %s", e.Identifier)
+}
+
+func (vc VendorContact) CursorKey(orderBy VendorContactOrderField) page.CursorKey {
+	switch orderBy {
+	case VendorContactOrderFieldCreatedAt:
+		return page.CursorKey{ID: vc.ID, Value: vc.CreatedAt}
+	case VendorContactOrderFieldFullName:
+		return page.CursorKey{ID: vc.ID, Value: vc.FullName}
+	case VendorContactOrderFieldEmail:
+		return page.CursorKey{ID: vc.ID, Value: vc.Email}
+	}
+
+	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
+}
+
+func (vc *VendorContact) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	vendorContactID gid.GID,
+) error {
+	q := `
+SELECT
+	id,
+	vendor_id,
+	full_name,
+	email,
+	phone,
+	role,
+	created_at,
+	updated_at
+FROM
+	vendor_contacts
+WHERE
+	%s
+	AND id = @vendor_contact_id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"vendor_contact_id": vendorContactID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query vendor contact: %w", err)
+	}
+	defer rows.Close()
+
+	vendorContact, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[VendorContact])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrVendorContactNotFound{Identifier: vendorContactID.String()}
+		}
+
+		return fmt.Errorf("cannot collect vendor contact: %w", err)
+	}
+
+	*vc = vendorContact
+
+	return nil
+}
+
+func (vc *VendorContacts) LoadByVendorID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	vendorID gid.GID,
+	cursor *page.Cursor[VendorContactOrderField],
+) error {
+	q := `
+SELECT
+	id,
+	vendor_id,
+	full_name,
+	email,
+	phone,
+	role,
+	created_at,
+	updated_at
+FROM
+	vendor_contacts
+WHERE
+	%s
+	AND vendor_id = @vendor_id
+	AND %s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"vendor_id": vendorID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query vendor contacts: %w", err)
+	}
+	defer rows.Close()
+
+	vendorContacts, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[VendorContact])
+	if err != nil {
+		return fmt.Errorf("cannot collect vendor contacts: %w", err)
+	}
+
+	*vc = vendorContacts
+
+	return nil
+}
+
+func (vc VendorContact) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO
+	vendor_contacts (
+		tenant_id,
+		id,
+		vendor_id,
+		full_name,
+		email,
+		phone,
+		role,
+		created_at,
+		updated_at
+	)
+VALUES (
+	@tenant_id,
+	@vendor_contact_id,
+	@vendor_id,
+	@full_name,
+	@email,
+	@phone,
+	@role,
+	@created_at,
+	@updated_at
+)
+`
+
+	args := pgx.StrictNamedArgs{
+		"tenant_id":         scope.GetTenantID(),
+		"vendor_contact_id": vc.ID,
+		"vendor_id":         vc.VendorID,
+		"full_name":         vc.FullName,
+		"email":             vc.Email,
+		"phone":             vc.Phone,
+		"role":              vc.Role,
+		"created_at":        vc.CreatedAt,
+		"updated_at":        vc.UpdatedAt,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot insert vendor contact: %w", err)
+	}
+
+	return nil
+}
+
+func (vc VendorContact) Update(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+UPDATE
+	vendor_contacts
+SET
+	full_name = @full_name,
+	email = @email,
+	phone = @phone,
+	role = @role,
+	updated_at = @updated_at
+WHERE
+	%s
+	AND id = @vendor_contact_id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"vendor_contact_id": vc.ID,
+		"full_name":         vc.FullName,
+		"email":             vc.Email,
+		"phone":             vc.Phone,
+		"role":              vc.Role,
+		"updated_at":        vc.UpdatedAt,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot update vendor contact: %w", err)
+	}
+
+	return nil
+}
+
+func (vc VendorContact) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+DELETE FROM
+	vendor_contacts
+WHERE
+	%s
+	AND id = @vendor_contact_id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"vendor_contact_id": vc.ID}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot delete vendor contact: %w", err)
+	}
+
+	return nil
+}

pkg/coredata/vendor_contact_order_field.go

@@ -0,0 +1,42 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+type (
+	VendorContactOrderField string
+)
+
+const (
+	VendorContactOrderFieldCreatedAt VendorContactOrderField = "CREATED_AT"
+	VendorContactOrderFieldFullName  VendorContactOrderField = "FULL_NAME"
+	VendorContactOrderFieldEmail     VendorContactOrderField = "EMAIL"
+)
+
+func (p VendorContactOrderField) Column() string {
+	return string(p)
+}
+
+func (p VendorContactOrderField) String() string {
+	return string(p)
+}
+
+func (p VendorContactOrderField) MarshalText() ([]byte, error) {
+	return []byte(p.String()), nil
+}
+
+func (p *VendorContactOrderField) UnmarshalText(text []byte) error {
+	*p = VendorContactOrderField(text)
+	return nil
+}

pkg/probo/service.go

@@ -72,6 +72,7 @@ type (
 		Risks                             *RiskService
 		VendorComplianceReports           *VendorComplianceReportService
 		VendorBusinessAssociateAgreements *VendorBusinessAssociateAgreementService
+		VendorContacts                    *VendorContactService
 		Connectors                        *ConnectorService
 		Assets                            *AssetService
 		Data                              *DatumService
@@ -159,6 +160,7 @@ func (s *Service) WithTenant(tenantID gid.TenantID) *TenantService {
 	tenantService.Risks = &RiskService{svc: tenantService}
 	tenantService.VendorComplianceReports = &VendorComplianceReportService{svc: tenantService}
 	tenantService.VendorBusinessAssociateAgreements = &VendorBusinessAssociateAgreementService{svc: tenantService}
+	tenantService.VendorContacts = &VendorContactService{svc: tenantService}
 	tenantService.Connectors = &ConnectorService{svc: tenantService}
 	tenantService.Assets = &AssetService{svc: tenantService}
 	tenantService.Data = &DatumService{svc: tenantService}

pkg/probo/vendor_contact_service.go

@@ -0,0 +1,183 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package probo
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/getprobo/probo/pkg/coredata"
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/page"
+	"go.gearno.de/kit/pg"
+)
+
+type (
+	VendorContactService struct {
+		svc *TenantService
+	}
+
+	CreateVendorContactRequest struct {
+		VendorID gid.GID
+		FullName *string
+		Email    *string
+		Phone    *string
+		Role     *string
+	}
+
+	UpdateVendorContactRequest struct {
+		ID       gid.GID
+		FullName **string
+		Email    **string
+		Phone    **string
+		Role     **string
+	}
+)
+
+func (s VendorContactService) Get(
+	ctx context.Context,
+	vendorContactID gid.GID,
+) (*coredata.VendorContact, error) {
+	vendorContact := &coredata.VendorContact{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return vendorContact.LoadByID(ctx, conn, s.svc.scope, vendorContactID)
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return vendorContact, nil
+}
+
+func (s VendorContactService) List(
+	ctx context.Context,
+	vendorID gid.GID,
+	cursor *page.Cursor[coredata.VendorContactOrderField],
+) (*page.Page[*coredata.VendorContact, coredata.VendorContactOrderField], error) {
+	var vendorContacts coredata.VendorContacts
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return vendorContacts.LoadByVendorID(ctx, conn, s.svc.scope, vendorID, cursor)
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(vendorContacts, cursor), nil
+}
+
+func (s VendorContactService) Create(
+	ctx context.Context,
+	req CreateVendorContactRequest,
+) (*coredata.VendorContact, error) {
+	now := time.Now()
+	vendorContact := &coredata.VendorContact{
+		ID:        gid.New(s.svc.scope.GetTenantID(), coredata.VendorContactEntityType),
+		VendorID:  req.VendorID,
+		FullName:  req.FullName,
+		Email:     req.Email,
+		Phone:     req.Phone,
+		Role:      req.Role,
+		CreatedAt: now,
+		UpdatedAt: now,
+	}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := vendorContact.Insert(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot insert vendor contact: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return vendorContact, nil
+}
+
+func (s VendorContactService) Update(
+	ctx context.Context,
+	req UpdateVendorContactRequest,
+) (*coredata.VendorContact, error) {
+	vendorContact := &coredata.VendorContact{}
+
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			err := vendorContact.LoadByID(ctx, conn, s.svc.scope, req.ID)
+			if err != nil {
+				return fmt.Errorf("cannot load vendor contact: %w", err)
+			}
+
+			if req.FullName != nil {
+				vendorContact.FullName = *req.FullName
+			}
+			if req.Email != nil {
+				vendorContact.Email = *req.Email
+			}
+			if req.Phone != nil {
+				vendorContact.Phone = *req.Phone
+			}
+			if req.Role != nil {
+				vendorContact.Role = *req.Role
+			}
+			vendorContact.UpdatedAt = time.Now()
+
+			return vendorContact.Update(ctx, conn, s.svc.scope)
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return vendorContact, nil
+}
+
+func (s VendorContactService) Delete(
+	ctx context.Context,
+	vendorContactID gid.GID,
+) error {
+	vendorContact := coredata.VendorContact{ID: vendorContactID}
+	return s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := vendorContact.LoadByID(ctx, conn, s.svc.scope, vendorContactID); err != nil {
+				return fmt.Errorf("cannot load vendor contact: %w", err)
+			}
+
+			if err := vendorContact.Delete(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot delete vendor contact: %w", err)
+			}
+
+			return nil
+		},
+	)
+}

pkg/server/api/console/v1/schema.graphql

@@ -292,6 +292,24 @@ enum VendorComplianceReportOrderField
     )
 }
 
+enum VendorContactOrderField
+  @goModel(
+    model: "github.com/getprobo/probo/pkg/coredata.VendorContactOrderField"
+  ) {
+  CREATED_AT
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.VendorContactOrderFieldCreatedAt"
+    )
+  FULL_NAME
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.VendorContactOrderFieldFullName"
+    )
+  EMAIL
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.VendorContactOrderFieldEmail"
+    )
+}
+
 enum OrganizationOrderField
   @goModel(
     model: "github.com/getprobo/probo/pkg/coredata.OrganizationOrderField"
@@ -679,6 +697,14 @@ input VendorComplianceReportOrder
   field: VendorComplianceReportOrderField!
 }
 
+input VendorContactOrder
+  @goModel(
+    model: "github.com/getprobo/probo/pkg/server/api/console/v1/types.VendorContactOrderBy"
+  ) {
+  direction: OrderDirection!
+  field: VendorContactOrderField!
+}
+
 input OrganizationOrder {
   direction: OrderDirection!
   field: OrganizationOrderField!
@@ -917,6 +943,14 @@ type Vendor implements Node {
 
   businessAssociateAgreement: VendorBusinessAssociateAgreement @goField(forceResolver: true)
 
+  contacts(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: VendorContactOrder
+  ): VendorContactConnection! @goField(forceResolver: true)
+
   riskAssessments(
     first: Int
     after: CursorKey
@@ -970,6 +1004,17 @@ type VendorBusinessAssociateAgreement implements Node {
   updatedAt: Datetime!
 }
 
+type VendorContact implements Node {
+  id: ID!
+  vendor: Vendor! @goField(forceResolver: true)
+  fullName: String
+  email: String
+  phone: String
+  role: String
+  createdAt: Datetime!
+  updatedAt: Datetime!
+}
+
 type Framework implements Node {
   id: ID!
   name: String!
@@ -1418,6 +1463,16 @@ type VendorComplianceReportEdge {
   node: VendorComplianceReport!
 }
 
+type VendorContactConnection {
+  edges: [VendorContactEdge!]!
+  pageInfo: PageInfo!
+}
+
+type VendorContactEdge {
+  cursor: CursorKey!
+  node: VendorContact!
+}
+
 type ConnectorConnection {
   edges: [ConnectorEdge!]!
   pageInfo: PageInfo!
@@ -1529,6 +1584,11 @@ type Mutation {
   updateVendor(input: UpdateVendorInput!): UpdateVendorPayload!
   deleteVendor(input: DeleteVendorInput!): DeleteVendorPayload!
 
+  # Vendor Contact mutations
+  createVendorContact(input: CreateVendorContactInput!): CreateVendorContactPayload!
+  updateVendorContact(input: UpdateVendorContactInput!): UpdateVendorContactPayload!
+  deleteVendorContact(input: DeleteVendorContactInput!): DeleteVendorContactPayload!
+
   # Framework mutations
   createFramework(input: CreateFrameworkInput!): CreateFrameworkPayload!
   updateFramework(input: UpdateFrameworkInput!): UpdateFrameworkPayload!
@@ -1763,6 +1823,26 @@ input DeleteVendorInput {
   vendorId: ID!
 }
 
+input CreateVendorContactInput {
+  vendorId: ID!
+  fullName: String
+  email: String
+  phone: String
+  role: String
+}
+
+input UpdateVendorContactInput {
+  id: ID!
+  fullName: String
+  email: String
+  phone: String
+  role: String
+}
+
+input DeleteVendorContactInput {
+  vendorContactId: ID!
+}
+
 input CreatePeopleInput {
   organizationId: ID!
   fullName: String!
@@ -2135,6 +2215,18 @@ type DeleteVendorPayload {
   deletedVendorId: ID!
 }
 
+type CreateVendorContactPayload {
+  vendorContactEdge: VendorContactEdge!
+}
+
+type UpdateVendorContactPayload {
+  vendorContact: VendorContact!
+}
+
+type DeleteVendorContactPayload {
+  deletedVendorContactId: ID!
+}
+
 type CreatePeoplePayload {
   peopleEdge: PeopleEdge!
 }

pkg/server/api/console/v1/types/types.go

@@ -377,6 +377,18 @@ type CreateTrustCenterAccessPayload struct {
 	TrustCenterAccessEdge *TrustCenterAccessEdge `json:"trustCenterAccessEdge"`
 }
 
+type CreateVendorContactInput struct {
+	VendorID gid.GID `json:"vendorId"`
+	FullName *string `json:"fullName,omitempty"`
+	Email    *string `json:"email,omitempty"`
+	Phone    *string `json:"phone,omitempty"`
+	Role     *string `json:"role,omitempty"`
+}
+
+type CreateVendorContactPayload struct {
+	VendorContactEdge *VendorContactEdge `json:"vendorContactEdge"`
+}
+
 type CreateVendorInput struct {
 	OrganizationID                gid.GID                  `json:"organizationId"`
 	Name                          string                   `json:"name"`
@@ -611,6 +623,14 @@ type DeleteVendorComplianceReportPayload struct {
 	DeletedVendorComplianceReportID gid.GID `json:"deletedVendorComplianceReportId"`
 }
 
+type DeleteVendorContactInput struct {
+	VendorContactID gid.GID `json:"vendorContactId"`
+}
+
+type DeleteVendorContactPayload struct {
+	DeletedVendorContactID gid.GID `json:"deletedVendorContactId"`
+}
+
 type DeleteVendorInput struct {
 	VendorID gid.GID `json:"vendorId"`
 }
@@ -1274,6 +1294,18 @@ type UpdateVendorBusinessAssociateAgreementPayload struct {
 	VendorBusinessAssociateAgreement *VendorBusinessAssociateAgreement `json:"vendorBusinessAssociateAgreement"`
 }
 
+type UpdateVendorContactInput struct {
+	ID       gid.GID `json:"id"`
+	FullName *string `json:"fullName,omitempty"`
+	Email    *string `json:"email,omitempty"`
+	Phone    *string `json:"phone,omitempty"`
+	Role     *string `json:"role,omitempty"`
+}
+
+type UpdateVendorContactPayload struct {
+	VendorContact *VendorContact `json:"vendorContact"`
+}
+
 type UpdateVendorInput struct {
 	ID                            gid.GID                  `json:"id"`
 	Name                          *string                  `json:"name,omitempty"`
@@ -1382,6 +1414,7 @@ type Vendor struct {
 	Organization                  *Organization                     `json:"organization"`
 	ComplianceReports             *VendorComplianceReportConnection `json:"complianceReports"`
 	BusinessAssociateAgreement    *VendorBusinessAssociateAgreement `json:"businessAssociateAgreement,omitempty"`
+	Contacts                      *VendorContactConnection          `json:"contacts"`
 	RiskAssessments               *VendorRiskAssessmentConnection   `json:"riskAssessments"`
 	BusinessOwner                 *People                           `json:"businessOwner,omitempty"`
 	SecurityOwner                 *People                           `json:"securityOwner,omitempty"`
@@ -1446,6 +1479,30 @@ type VendorComplianceReportEdge struct {
 	Node   *VendorComplianceReport `json:"node"`
 }
 
+type VendorContact struct {
+	ID        gid.GID   `json:"id"`
+	Vendor    *Vendor   `json:"vendor"`
+	FullName  *string   `json:"fullName,omitempty"`
+	Email     *string   `json:"email,omitempty"`
+	Phone     *string   `json:"phone,omitempty"`
+	Role      *string   `json:"role,omitempty"`
+	CreatedAt time.Time `json:"createdAt"`
+	UpdatedAt time.Time `json:"updatedAt"`
+}
+
+func (VendorContact) IsNode()             {}
+func (this VendorContact) GetID() gid.GID { return this.ID }
+
+type VendorContactConnection struct {
+	Edges    []*VendorContactEdge `json:"edges"`
+	PageInfo *PageInfo            `json:"pageInfo"`
+}
+
+type VendorContactEdge struct {
+	Cursor page.CursorKey `json:"cursor"`
+	Node   *VendorContact `json:"node"`
+}
+
 type VendorEdge struct {
 	Cursor page.CursorKey `json:"cursor"`
 	Node   *Vendor        `json:"node"`

pkg/server/api/console/v1/types/vendor_contact.go

@@ -0,0 +1,56 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"github.com/getprobo/probo/pkg/coredata"
+	"github.com/getprobo/probo/pkg/page"
+)
+
+type (
+	VendorContactOrderBy OrderBy[coredata.VendorContactOrderField]
+)
+
+func NewVendorContactConnection(p *page.Page[*coredata.VendorContact, coredata.VendorContactOrderField]) *VendorContactConnection {
+	var edges = make([]*VendorContactEdge, len(p.Data))
+
+	for i := range edges {
+		edges[i] = NewVendorContactEdge(p.Data[i], p.Cursor.OrderBy.Field)
+	}
+
+	return &VendorContactConnection{
+		Edges:    edges,
+		PageInfo: NewPageInfo(p),
+	}
+}
+
+func NewVendorContactEdge(c *coredata.VendorContact, orderBy coredata.VendorContactOrderField) *VendorContactEdge {
+	return &VendorContactEdge{
+		Cursor: c.CursorKey(orderBy),
+		Node:   NewVendorContact(c),
+	}
+}
+
+func NewVendorContact(c *coredata.VendorContact) *VendorContact {
+	return &VendorContact{
+		ID:        c.ID,
+		FullName:  c.FullName,
+		Email:     c.Email,
+		Phone:     c.Phone,
+		Role:      c.Role,
+		CreatedAt: c.CreatedAt,
+		UpdatedAt: c.UpdatedAt,
+	}
+}

pkg/server/api/console/v1/v1_resolver.go

@@ -1250,6 +1250,64 @@ func (r *mutationResolver) DeleteVendor(ctx context.Context, input types.DeleteV
 	}, nil
 }
 
+// CreateVendorContact is the resolver for the createVendorContact field.
+func (r *mutationResolver) CreateVendorContact(ctx context.Context, input types.CreateVendorContactInput) (*types.CreateVendorContactPayload, error) {
+	prb := r.ProboService(ctx, input.VendorID.TenantID())
+
+	req := probo.CreateVendorContactRequest{
+		VendorID: input.VendorID,
+		FullName: input.FullName,
+		Email:    input.Email,
+		Phone:    input.Phone,
+		Role:     input.Role,
+	}
+
+	vendorContact, err := prb.VendorContacts.Create(ctx, req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create vendor contact: %w", err)
+	}
+
+	return &types.CreateVendorContactPayload{
+		VendorContactEdge: types.NewVendorContactEdge(vendorContact, coredata.VendorContactOrderFieldCreatedAt),
+	}, nil
+}
+
+// UpdateVendorContact is the resolver for the updateVendorContact field.
+func (r *mutationResolver) UpdateVendorContact(ctx context.Context, input types.UpdateVendorContactInput) (*types.UpdateVendorContactPayload, error) {
+	prb := r.ProboService(ctx, input.ID.TenantID())
+
+	req := probo.UpdateVendorContactRequest{
+		ID:       input.ID,
+		FullName: &input.FullName,
+		Email:    &input.Email,
+		Phone:    &input.Phone,
+		Role:     &input.Role,
+	}
+
+	vendorContact, err := prb.VendorContacts.Update(ctx, req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to update vendor contact: %w", err)
+	}
+
+	return &types.UpdateVendorContactPayload{
+		VendorContact: types.NewVendorContact(vendorContact),
+	}, nil
+}
+
+// DeleteVendorContact is the resolver for the deleteVendorContact field.
+func (r *mutationResolver) DeleteVendorContact(ctx context.Context, input types.DeleteVendorContactInput) (*types.DeleteVendorContactPayload, error) {
+	prb := r.ProboService(ctx, input.VendorContactID.TenantID())
+
+	err := prb.VendorContacts.Delete(ctx, input.VendorContactID)
+	if err != nil {
+		return nil, fmt.Errorf("failed to delete vendor contact: %w", err)
+	}
+
+	return &types.DeleteVendorContactPayload{
+		DeletedVendorContactID: input.VendorContactID,
+	}, nil
+}
+
 // CreateFramework is the resolver for the createFramework field.
 func (r *mutationResolver) CreateFramework(ctx context.Context, input types.CreateFrameworkInput) (*types.CreateFrameworkPayload, error) {
 	prb := r.ProboService(ctx, input.OrganizationID.TenantID())
@@ -2972,6 +3030,12 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 			panic(fmt.Errorf("cannot get vendor compliance report: %w", err))
 		}
 		return types.NewVendorComplianceReport(vendorComplianceReport), nil
+	case coredata.VendorContactEntityType:
+		vendorContact, err := prb.VendorContacts.Get(ctx, id)
+		if err != nil {
+			panic(fmt.Errorf("cannot get vendor contact: %w", err))
+		}
+		return types.NewVendorContact(vendorContact), nil
 	case coredata.DocumentVersionEntityType:
 		documentVersion, err := prb.Documents.GetVersion(ctx, id)
 		if err != nil {
@@ -3405,6 +3469,31 @@ func (r *vendorResolver) BusinessAssociateAgreement(ctx context.Context, obj *ty
 	return types.NewVendorBusinessAssociateAgreement(vendorBusinessAssociateAgreement, file), nil
 }
 
+// Contacts is the resolver for the contacts field.
+func (r *vendorResolver) Contacts(ctx context.Context, obj *types.Vendor, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.VendorContactOrderBy) (*types.VendorContactConnection, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	pageOrderBy := page.OrderBy[coredata.VendorContactOrderField]{
+		Field:     coredata.VendorContactOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.VendorContactOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	page, err := prb.VendorContacts.List(ctx, obj.ID, cursor)
+	if err != nil {
+		panic(fmt.Errorf("failed to list vendor contacts: %w", err))
+	}
+
+	return types.NewVendorContactConnection(page), nil
+}
+
 // RiskAssessments is the resolver for the riskAssessments field.
 func (r *vendorResolver) RiskAssessments(ctx context.Context, obj *types.Vendor, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.VendorRiskAssessmentOrder) (*types.VendorRiskAssessmentConnection, error) {
 	prb := r.ProboService(ctx, obj.ID.TenantID())
@@ -3547,6 +3636,24 @@ func (r *vendorConnectionResolver) TotalCount(ctx context.Context, obj *types.Ve
 	panic(fmt.Errorf("unsupported resolver: %T", obj.Resolver))
 }
 
+// Vendor is the resolver for the vendor field.
+func (r *vendorContactResolver) Vendor(ctx context.Context, obj *types.VendorContact) (*types.Vendor, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	// Get the vendor contact to access the VendorID
+	vendorContact, err := prb.VendorContacts.Get(ctx, obj.ID)
+	if err != nil {
+		panic(fmt.Errorf("failed to get vendor contact: %w", err))
+	}
+
+	vendor, err := prb.Vendors.Get(ctx, vendorContact.VendorID)
+	if err != nil {
+		panic(fmt.Errorf("failed to get vendor: %w", err))
+	}
+
+	return types.NewVendor(vendor), nil
+}
+
 // Vendor is the resolver for the vendor field.
 func (r *vendorRiskAssessmentResolver) Vendor(ctx context.Context, obj *types.VendorRiskAssessment) (*types.Vendor, error) {
 	prb := r.ProboService(ctx, obj.ID.TenantID())
@@ -3728,6 +3835,9 @@ func (r *Resolver) VendorConnection() schema.VendorConnectionResolver {
 	return &vendorConnectionResolver{r}
 }
 
+// VendorContact returns schema.VendorContactResolver implementation.
+func (r *Resolver) VendorContact() schema.VendorContactResolver { return &vendorContactResolver{r} }
+
 // VendorRiskAssessment returns schema.VendorRiskAssessmentResolver implementation.
 func (r *Resolver) VendorRiskAssessment() schema.VendorRiskAssessmentResolver {
 	return &vendorRiskAssessmentResolver{r}
@@ -3769,5 +3879,6 @@ type vendorResolver struct{ *Resolver }
 type vendorBusinessAssociateAgreementResolver struct{ *Resolver }
 type vendorComplianceReportResolver struct{ *Resolver }
 type vendorConnectionResolver struct{ *Resolver }
+type vendorContactResolver struct{ *Resolver }
 type vendorRiskAssessmentResolver struct{ *Resolver }
 type viewerResolver struct{ *Resolver }