Add risk publish to document system

Replace the old snapshot-based system for risks with the publish
document system, mirroring the prior vendor / processing activity / DPIA
/ TIA migration. Includes the GraphQL mutation, MCP tool, CLI command,
n8n operation, frontend publish dialog, e2e tests, and a prosemirror
register template covering name, description, category, treatment,
owner, inherent and residual scoring, and notes.

The risk register lives as a generated DocumentTypeRegister document on
the organization, reused across publishes (the major version bumps on
every republish). Approvers can be passed in to create a draft pending
approval; otherwise the version is published immediately. The frontend
Risks page exposes a Publish button and a Document link button when the
document exists, and pre-fills the previous default approvers.

Risks was the last remaining snapshot type, so this commit also removes
the entire snapshot system: drop snapshotId from the Risk GraphQL type
and RiskFilter; remove RiskSnapshotter, Risks.Snapshot,
InsertRiskSnapshots, and the SnapshotID/SourceID fields on Risk; delete
Snapshot, ControlSnapshot, SnapshotsType, SnapshotOrderField,
Snapshottable, the SnapshotService, the Snapshot console resolvers and
GraphQL schema, the Snapshot MCP types and operations
(list/get/take/listControlSnapshots), the snapshot CLI (prb snapshot),
the snapshot frontend pages, routes, banner, LinkedSnapshotsCard,
SnapshotGraph, snapshot helpers, and the snapshot n8n resource and
control link/unlink snapshot operations. The snapshot_id columns remain
in the database but are now filtered out with snapshot_id IS NULL.

Add Get/Upsert/Clear GeneratedDocumentID methods on Risk backed by a new
risks_document_id column on generated_documents, matching the
ProcessingActivity/Finding/Vendor pattern. The migration command
migrate-risk-snapshots-to-documents uses raw SQL queries instead of the
Go snapshot types, since those are gone.

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
This commit is contained in:
Sacha Al Himdani
2026-04-29 18:11:19 +02:00
parent 01bc3ac696
commit 553901e4ad
93 changed files with 2384 additions and 5741 deletions

View File

@@ -582,144 +582,6 @@ func TestControlAuditMapping_CreateDelete(t *testing.T) {
})
}
func TestControlSnapshotMapping_CreateDelete(t *testing.T) {
t.Parallel()
owner := testutil.NewClient(t, testutil.RoleOwner)
// Create a framework and control
var createFrameworkResult struct {
CreateFramework struct {
FrameworkEdge struct {
Node struct {
ID string `json:"id"`
} `json:"node"`
} `json:"frameworkEdge"`
} `json:"createFramework"`
}
err := owner.Execute(`
mutation($input: CreateFrameworkInput!) {
createFramework(input: $input) {
frameworkEdge {
node {
id
}
}
}
}
`, map[string]any{
"input": map[string]any{
"organizationId": owner.GetOrganizationID().String(),
"name": "Framework for ControlSnapshot Mapping",
},
}, &createFrameworkResult)
require.NoError(t, err)
frameworkID := createFrameworkResult.CreateFramework.FrameworkEdge.Node.ID
var createControlResult struct {
CreateControl struct {
ControlEdge struct {
Node struct {
ID string `json:"id"`
} `json:"node"`
} `json:"controlEdge"`
} `json:"createControl"`
}
err = owner.Execute(`
mutation($input: CreateControlInput!) {
createControl(input: $input) {
controlEdge {
node {
id
}
}
}
}
`, map[string]any{
"input": map[string]any{
"frameworkId": frameworkID,
"name": "Control for Snapshot Mapping",
"description": "Test control",
"sectionTitle": "Section 1",
"bestPractice": true,
"maturityLevel": "INITIAL",
},
}, &createControlResult)
require.NoError(t, err)
controlID := createControlResult.CreateControl.ControlEdge.Node.ID
// Create a snapshot
var createSnapshotResult struct {
CreateSnapshot struct {
SnapshotEdge struct {
Node struct {
ID string `json:"id"`
} `json:"node"`
} `json:"snapshotEdge"`
} `json:"createSnapshot"`
}
err = owner.Execute(`
mutation($input: CreateSnapshotInput!) {
createSnapshot(input: $input) {
snapshotEdge {
node {
id
}
}
}
}
`, map[string]any{
"input": map[string]any{
"organizationId": owner.GetOrganizationID().String(),
"name": "Snapshot for Control Mapping",
"type": "RISKS",
},
}, &createSnapshotResult)
require.NoError(t, err)
snapshotID := createSnapshotResult.CreateSnapshot.SnapshotEdge.Node.ID
t.Run("create mapping", func(t *testing.T) {
_, err := owner.Do(`
mutation($input: CreateControlSnapshotMappingInput!) {
createControlSnapshotMapping(input: $input) {
controlEdge {
node {
id
}
}
snapshotEdge {
node {
id
}
}
}
}
`, map[string]any{
"input": map[string]any{
"controlId": controlID,
"snapshotId": snapshotID,
},
})
require.NoError(t, err)
})
t.Run("delete mapping", func(t *testing.T) {
_, err := owner.Do(`
mutation($input: DeleteControlSnapshotMappingInput!) {
deleteControlSnapshotMapping(input: $input) {
deletedControlId
deletedSnapshotId
}
}
`, map[string]any{
"input": map[string]any{
"controlId": controlID,
"snapshotId": snapshotID,
},
})
require.NoError(t, err)
})
}
func TestRiskDocumentMapping_CreateDelete(t *testing.T) {
t.Parallel()
owner := testutil.NewClient(t, testutil.RoleOwner)

View File

@@ -0,0 +1,336 @@
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package console_test
import (
"testing"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"go.probo.inc/probo/e2e/internal/factory"
"go.probo.inc/probo/e2e/internal/testutil"
)
func TestRisk_PublishRiskList(t *testing.T) {
t.Parallel()
t.Run(
"publish without approvers publishes immediately",
func(t *testing.T) {
t.Parallel()
owner := testutil.NewClient(t, testutil.RoleOwner)
factory.CreateRisk(owner, factory.Attrs{"name": "Test Risk"})
const query = `
mutation($input: PublishRiskListInput!) {
publishRiskList(input: $input) {
documentEdge {
node {
id
writeMode
status
}
}
documentVersionEdge {
node {
id
title
documentType
status
major
minor
content
}
}
}
}
`
var result struct {
PublishRiskList struct {
DocumentEdge struct {
Node struct {
ID string `json:"id"`
WriteMode string `json:"writeMode"`
Status string `json:"status"`
} `json:"node"`
} `json:"documentEdge"`
DocumentVersionEdge struct {
Node struct {
ID string `json:"id"`
Title string `json:"title"`
DocumentType string `json:"documentType"`
Status string `json:"status"`
Major int `json:"major"`
Minor int `json:"minor"`
Content string `json:"content"`
} `json:"node"`
} `json:"documentVersionEdge"`
} `json:"publishRiskList"`
}
err := owner.Execute(
query,
map[string]any{
"input": map[string]any{
"organizationId": owner.GetOrganizationID(),
},
},
&result,
)
require.NoError(t, err)
doc := result.PublishRiskList.DocumentEdge.Node
assert.NotEmpty(t, doc.ID)
assert.Equal(t, "GENERATED", doc.WriteMode)
assert.Equal(t, "ACTIVE", doc.Status)
ver := result.PublishRiskList.DocumentVersionEdge.Node
assert.NotEmpty(t, ver.ID)
assert.Equal(t, "REGISTER", ver.DocumentType)
assert.Equal(t, "PUBLISHED", ver.Status)
assert.Equal(t, 1, ver.Major)
assert.Equal(t, 0, ver.Minor)
assert.Contains(t, ver.Content, "Purpose")
},
)
t.Run(
"publish with approvers creates draft pending approval",
func(t *testing.T) {
t.Parallel()
owner := testutil.NewClient(t, testutil.RoleOwner)
const query = `
mutation($input: PublishRiskListInput!) {
publishRiskList(input: $input) {
documentEdge {
node { id writeMode }
}
documentVersionEdge {
node { id status major }
}
}
}
`
var result struct {
PublishRiskList struct {
DocumentEdge struct {
Node struct {
ID string `json:"id"`
WriteMode string `json:"writeMode"`
} `json:"node"`
} `json:"documentEdge"`
DocumentVersionEdge struct {
Node struct {
ID string `json:"id"`
Status string `json:"status"`
Major int `json:"major"`
} `json:"node"`
} `json:"documentVersionEdge"`
} `json:"publishRiskList"`
}
err := owner.Execute(
query,
map[string]any{
"input": map[string]any{
"organizationId": owner.GetOrganizationID(),
"approverIds": []string{owner.GetProfileID().String()},
},
},
&result,
)
require.NoError(t, err)
doc := result.PublishRiskList.DocumentEdge.Node
assert.NotEmpty(t, doc.ID)
assert.Equal(t, "GENERATED", doc.WriteMode)
ver := result.PublishRiskList.DocumentVersionEdge.Node
assert.NotEmpty(t, ver.ID)
assert.Equal(t, "PENDING_APPROVAL", ver.Status)
},
)
t.Run(
"second publish reuses document and bumps major version",
func(t *testing.T) {
t.Parallel()
owner := testutil.NewClient(t, testutil.RoleOwner)
factory.CreateRisk(owner, factory.Attrs{"name": "Reuse Risk"})
const query = `
mutation($input: PublishRiskListInput!) {
publishRiskList(input: $input) {
documentEdge { node { id } }
documentVersionEdge { node { id major } }
}
}
`
var r1, r2 struct {
PublishRiskList struct {
DocumentEdge struct {
Node struct {
ID string `json:"id"`
} `json:"node"`
} `json:"documentEdge"`
DocumentVersionEdge struct {
Node struct {
ID string `json:"id"`
Major int `json:"major"`
} `json:"node"`
} `json:"documentVersionEdge"`
} `json:"publishRiskList"`
}
input := map[string]any{
"input": map[string]any{
"organizationId": owner.GetOrganizationID(),
},
}
err := owner.Execute(query, input, &r1)
require.NoError(t, err)
err = owner.Execute(query, input, &r2)
require.NoError(t, err)
assert.Equal(t,
r1.PublishRiskList.DocumentEdge.Node.ID,
r2.PublishRiskList.DocumentEdge.Node.ID,
"should reuse same document",
)
assert.Equal(t, 1, r1.PublishRiskList.DocumentVersionEdge.Node.Major)
assert.Equal(t, 2, r2.PublishRiskList.DocumentVersionEdge.Node.Major)
},
)
t.Run(
"organization risksDocument links to published document",
func(t *testing.T) {
t.Parallel()
owner := testutil.NewClient(t, testutil.RoleOwner)
factory.CreateRisk(owner, factory.Attrs{"name": "Linked Risk"})
const publishQuery = `
mutation($input: PublishRiskListInput!) {
publishRiskList(input: $input) {
documentEdge { node { id } }
documentVersionEdge { node { id } }
}
}
`
var publishResult struct {
PublishRiskList struct {
DocumentEdge struct {
Node struct {
ID string `json:"id"`
} `json:"node"`
} `json:"documentEdge"`
DocumentVersionEdge struct {
Node struct {
ID string `json:"id"`
} `json:"node"`
} `json:"documentVersionEdge"`
} `json:"publishRiskList"`
}
err := owner.Execute(
publishQuery,
map[string]any{
"input": map[string]any{
"organizationId": owner.GetOrganizationID(),
},
},
&publishResult,
)
require.NoError(t, err)
docID := publishResult.PublishRiskList.DocumentEdge.Node.ID
const orgQuery = `
query($id: ID!) {
node(id: $id) {
... on Organization {
id
risksDocument { id }
}
}
}
`
var orgResult struct {
Node struct {
ID string `json:"id"`
RisksDocument *struct {
ID string `json:"id"`
} `json:"risksDocument"`
} `json:"node"`
}
err = owner.Execute(
orgQuery,
map[string]any{"id": owner.GetOrganizationID()},
&orgResult,
)
require.NoError(t, err)
require.NotNil(t, orgResult.Node.RisksDocument)
assert.Equal(t, docID, orgResult.Node.RisksDocument.ID)
},
)
}
func TestRisk_PublishRiskList_RBAC(t *testing.T) {
t.Parallel()
owner := testutil.NewClient(t, testutil.RoleOwner)
viewer := testutil.NewClientInOrg(t, testutil.RoleViewer, owner)
factory.CreateRisk(owner, factory.Attrs{"name": "RBAC Risk"})
const query = `
mutation($input: PublishRiskListInput!) {
publishRiskList(input: $input) {
documentEdge { node { id } }
documentVersionEdge { node { id } }
}
}
`
t.Run(
"viewer cannot publish risk list",
func(t *testing.T) {
t.Parallel()
err := viewer.ExecuteShouldFail(
query,
map[string]any{
"input": map[string]any{
"organizationId": owner.GetOrganizationID(),
},
},
)
testutil.RequireForbiddenError(t, err)
},
)
}

View File

@@ -1,261 +0,0 @@
// Copyright (c) 2025-2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package console_test
import (
"fmt"
"testing"
"time"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"go.probo.inc/probo/e2e/internal/testutil"
)
func TestSnapshot_Create(t *testing.T) {
t.Parallel()
owner := testutil.NewClient(t, testutil.RoleOwner)
query := `
mutation CreateSnapshot($input: CreateSnapshotInput!) {
createSnapshot(input: $input) {
snapshotEdge {
node {
id
name
description
type
}
}
}
}
`
var result struct {
CreateSnapshot struct {
SnapshotEdge struct {
Node struct {
ID string `json:"id"`
Name string `json:"name"`
Description string `json:"description"`
Type string `json:"type"`
} `json:"node"`
} `json:"snapshotEdge"`
} `json:"createSnapshot"`
}
err := owner.Execute(query, map[string]any{
"input": map[string]any{
"organizationId": owner.GetOrganizationID().String(),
"name": "Q4 2024 Risk Snapshot",
"description": "Quarterly risk assessment snapshot",
"type": "RISKS",
},
}, &result)
require.NoError(t, err)
snapshot := result.CreateSnapshot.SnapshotEdge.Node
assert.NotEmpty(t, snapshot.ID)
assert.Equal(t, "Q4 2024 Risk Snapshot", snapshot.Name)
assert.Equal(t, "Quarterly risk assessment snapshot", snapshot.Description)
assert.Equal(t, "RISKS", snapshot.Type)
}
func TestSnapshot_Delete(t *testing.T) {
t.Parallel()
owner := testutil.NewClient(t, testutil.RoleOwner)
// Create a snapshot to delete
createQuery := `
mutation CreateSnapshot($input: CreateSnapshotInput!) {
createSnapshot(input: $input) {
snapshotEdge {
node {
id
}
}
}
}
`
var createResult struct {
CreateSnapshot struct {
SnapshotEdge struct {
Node struct {
ID string `json:"id"`
} `json:"node"`
} `json:"snapshotEdge"`
} `json:"createSnapshot"`
}
err := owner.Execute(createQuery, map[string]any{
"input": map[string]any{
"organizationId": owner.GetOrganizationID().String(),
"name": fmt.Sprintf("Snapshot to Delete %d", time.Now().UnixNano()),
"type": "RISKS",
},
}, &createResult)
require.NoError(t, err)
snapshotID := createResult.CreateSnapshot.SnapshotEdge.Node.ID
deleteQuery := `
mutation DeleteSnapshot($input: DeleteSnapshotInput!) {
deleteSnapshot(input: $input) {
deletedSnapshotId
}
}
`
var deleteResult struct {
DeleteSnapshot struct {
DeletedSnapshotID string `json:"deletedSnapshotId"`
} `json:"deleteSnapshot"`
}
err = owner.Execute(deleteQuery, map[string]any{
"input": map[string]any{
"snapshotId": snapshotID,
},
}, &deleteResult)
require.NoError(t, err)
assert.Equal(t, snapshotID, deleteResult.DeleteSnapshot.DeletedSnapshotID)
}
func TestSnapshot_List(t *testing.T) {
t.Parallel()
owner := testutil.NewClient(t, testutil.RoleOwner)
// Create multiple snapshots
snapshotTypes := []string{"RISKS"}
for i, snapshotType := range snapshotTypes {
query := `
mutation CreateSnapshot($input: CreateSnapshotInput!) {
createSnapshot(input: $input) {
snapshotEdge {
node {
id
}
}
}
}
`
var result struct {
CreateSnapshot struct {
SnapshotEdge struct {
Node struct {
ID string `json:"id"`
} `json:"node"`
} `json:"snapshotEdge"`
} `json:"createSnapshot"`
}
err := owner.Execute(query, map[string]any{
"input": map[string]any{
"organizationId": owner.GetOrganizationID().String(),
"name": fmt.Sprintf("Snapshot %d %d", i, time.Now().UnixNano()),
"type": snapshotType,
},
}, &result)
require.NoError(t, err)
}
query := `
query GetSnapshots($id: ID!) {
node(id: $id) {
... on Organization {
snapshots(first: 10) {
edges {
node {
id
name
type
}
}
totalCount
}
}
}
}
`
var result struct {
Node struct {
Snapshots struct {
Edges []struct {
Node struct {
ID string `json:"id"`
Name string `json:"name"`
Type string `json:"type"`
} `json:"node"`
} `json:"edges"`
TotalCount int `json:"totalCount"`
} `json:"snapshots"`
} `json:"node"`
}
err := owner.Execute(query, map[string]any{
"id": owner.GetOrganizationID().String(),
}, &result)
require.NoError(t, err)
assert.GreaterOrEqual(t, result.Node.Snapshots.TotalCount, len(snapshotTypes))
}
func TestSnapshot_Types(t *testing.T) {
t.Parallel()
owner := testutil.NewClient(t, testutil.RoleOwner)
snapshotTypes := []string{"RISKS"}
for _, snapshotType := range snapshotTypes {
t.Run(snapshotType, func(t *testing.T) {
query := `
mutation CreateSnapshot($input: CreateSnapshotInput!) {
createSnapshot(input: $input) {
snapshotEdge {
node {
id
type
}
}
}
}
`
var result struct {
CreateSnapshot struct {
SnapshotEdge struct {
Node struct {
ID string `json:"id"`
Type string `json:"type"`
} `json:"node"`
} `json:"snapshotEdge"`
} `json:"createSnapshot"`
}
err := owner.Execute(query, map[string]any{
"input": map[string]any{
"organizationId": owner.GetOrganizationID().String(),
"name": fmt.Sprintf("Snapshot Type %s %d", snapshotType, time.Now().UnixNano()),
"type": snapshotType,
},
}, &result)
require.NoError(t, err)
assert.Equal(t, snapshotType, result.CreateSnapshot.SnapshotEdge.Node.Type)
})
}
}