rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add risk publish to document system

Browse Source 
Replace the old snapshot-based system for risks with the publish
document system, mirroring the prior vendor / processing activity / DPIA
/ TIA migration. Includes the GraphQL mutation, MCP tool, CLI command,
n8n operation, frontend publish dialog, e2e tests, and a prosemirror
register template covering name, description, category, treatment,
owner, inherent and residual scoring, and notes.

The risk register lives as a generated DocumentTypeRegister document on
the organization, reused across publishes (the major version bumps on
every republish). Approvers can be passed in to create a draft pending
approval; otherwise the version is published immediately. The frontend
Risks page exposes a Publish button and a Document link button when the
document exists, and pre-fills the previous default approvers.

Risks was the last remaining snapshot type, so this commit also removes
the entire snapshot system: drop snapshotId from the Risk GraphQL type
and RiskFilter; remove RiskSnapshotter, Risks.Snapshot,
InsertRiskSnapshots, and the SnapshotID/SourceID fields on Risk; delete
Snapshot, ControlSnapshot, SnapshotsType, SnapshotOrderField,
Snapshottable, the SnapshotService, the Snapshot console resolvers and
GraphQL schema, the Snapshot MCP types and operations
(list/get/take/listControlSnapshots), the snapshot CLI (prb snapshot),
the snapshot frontend pages, routes, banner, LinkedSnapshotsCard,
SnapshotGraph, snapshot helpers, and the snapshot n8n resource and
control link/unlink snapshot operations. The snapshot_id columns remain
in the database but are now filtered out with snapshot_id IS NULL.

Add Get/Upsert/Clear GeneratedDocumentID methods on Risk backed by a new
risks_document_id column on generated_documents, matching the
ProcessingActivity/Finding/Vendor pattern. The migration command
migrate-risk-snapshots-to-documents uses raw SQL queries instead of the
Go snapshot types, since those are gone.

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
This commit is contained in:
Sacha Al Himdani
2026-04-29 18:11:19 +02:00
parent 01bc3ac696
commit 553901e4ad
93 changed files with 2384 additions and 5741 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
pkg/server/api/console/v1/base_resolvers.go
View File

@@ -239,15 +239,6 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
}
return types.NewTransferImpactAssessment(tia), nil
}
case coredata.SnapshotEntityType:
action = probo.ActionSnapshotList
loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
snapshot, err := prb.Snapshots.Get(ctx, id)
if err != nil {
return nil, err
}
return types.NewSnapshot(snapshot), nil
}
case coredata.TrustCenterEntityType:
action = probo.ActionTrustCenterGet
loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {

71
pkg/server/api/console/v1/control_resolvers.go
View File

@@ -300,37 +300,6 @@ func (r *controlResolver) Obligations(ctx context.Context, obj *types.Control, f
return types.NewObligationConnection(page, r, obj.ID), nil
}
// Snapshots is the resolver for the snapshots field.
func (r *controlResolver) Snapshots(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.SnapshotOrderBy) (*types.SnapshotConnection, error) {
if err := r.authorize(ctx, obj.ID, probo.ActionSnapshotList); err != nil {
return nil, err
}
prb := r.ProboService(ctx, obj.ID.TenantID())
pageOrderBy := page.OrderBy[coredata.SnapshotOrderField]{
Field: coredata.SnapshotOrderFieldCreatedAt,
Direction: page.OrderDirectionDesc,
}
if orderBy != nil {
pageOrderBy = page.OrderBy[coredata.SnapshotOrderField]{
Field: orderBy.Field,
Direction: orderBy.Direction,
}
}
cursor := types.NewCursor(first, after, last, before, pageOrderBy)
page, err := prb.Snapshots.ListForControlID(ctx, obj.ID, cursor)
if err != nil {
r.logger.ErrorCtx(ctx, "cannot list control snapshots", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
return types.NewSnapshotConnection(page, r, obj.ID), nil
}
// Permission is the resolver for the permission field.
func (r *controlResolver) Permission(ctx context.Context, obj *types.Control, action string) (bool, error) {
return r.Resolver.Permission(ctx, obj, action)
@@ -708,46 +677,6 @@ func (r *mutationResolver) DeleteControlObligationMapping(ctx context.Context, i
}, nil
}
// CreateControlSnapshotMapping is the resolver for the createControlSnapshotMapping field.
func (r *mutationResolver) CreateControlSnapshotMapping(ctx context.Context, input types.CreateControlSnapshotMappingInput) (*types.CreateControlSnapshotMappingPayload, error) {
if err := r.authorize(ctx, input.ControlID, probo.ActionControlSnapshotMappingCreate); err != nil {
return nil, err
}
prb := r.ProboService(ctx, input.SnapshotID.TenantID())
control, snapshot, err := prb.Controls.CreateSnapshotMapping(ctx, input.ControlID, input.SnapshotID)
if err != nil {
r.logger.ErrorCtx(ctx, "cannot create control snapshot mapping", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
return &types.CreateControlSnapshotMappingPayload{
ControlEdge: types.NewControlEdge(control, coredata.ControlOrderFieldCreatedAt),
SnapshotEdge: types.NewSnapshotEdge(snapshot, coredata.SnapshotOrderFieldCreatedAt),
}, nil
}
// DeleteControlSnapshotMapping is the resolver for the deleteControlSnapshotMapping field.
func (r *mutationResolver) DeleteControlSnapshotMapping(ctx context.Context, input types.DeleteControlSnapshotMappingInput) (*types.DeleteControlSnapshotMappingPayload, error) {
if err := r.authorize(ctx, input.ControlID, probo.ActionControlSnapshotMappingDelete); err != nil {
return nil, err
}
prb := r.ProboService(ctx, input.SnapshotID.TenantID())
control, snapshot, err := prb.Controls.DeleteSnapshotMapping(ctx, input.ControlID, input.SnapshotID)
if err != nil {
r.logger.ErrorCtx(ctx, "cannot delete control snapshot mapping", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
return &types.DeleteControlSnapshotMappingPayload{
DeletedControlID: control.ID,
DeletedSnapshotID: snapshot.ID,
}, nil
}
// CreateStatementOfApplicability is the resolver for the createStatementOfApplicability field.
func (r *mutationResolver) CreateStatementOfApplicability(ctx context.Context, input types.CreateStatementOfApplicabilityInput) (*types.CreateStatementOfApplicabilityPayload, error) {
if err := r.authorize(ctx, input.OrganizationID, probo.ActionStatementOfApplicabilityCreate); err != nil {

34
pkg/server/api/console/v1/graphql/control.graphql
View File

@@ -141,14 +141,6 @@ type Control implements Node {
orderBy: ObligationOrder
): ObligationConnection! @goField(forceResolver: true)
snapshots(
first: Int
after: CursorKey
last: Int
before: CursorKey
orderBy: SnapshotOrder
): SnapshotConnection! @goField(forceResolver: true)
createdAt: Datetime!
updatedAt: Datetime!
@@ -265,12 +257,6 @@ extend type Mutation {
deleteControlObligationMapping(
input: DeleteControlObligationMappingInput!
): DeleteControlObligationMappingPayload!
createControlSnapshotMapping(
input: CreateControlSnapshotMappingInput!
): CreateControlSnapshotMappingPayload!
deleteControlSnapshotMapping(
input: DeleteControlSnapshotMappingInput!
): DeleteControlSnapshotMappingPayload!
createStatementOfApplicability(
input: CreateStatementOfApplicabilityInput!
): CreateStatementOfApplicabilityPayload!
@@ -366,16 +352,6 @@ input DeleteControlObligationMappingInput {
obligationId: ID!
}
input CreateControlSnapshotMappingInput {
controlId: ID!
snapshotId: ID!
}
input DeleteControlSnapshotMappingInput {
controlId: ID!
snapshotId: ID!
}
input CreateStatementOfApplicabilityInput {
organizationId: ID!
name: String!
@@ -465,16 +441,6 @@ type DeleteControlObligationMappingPayload {
deletedObligationId: ID!
}
type CreateControlSnapshotMappingPayload {
controlEdge: ControlEdge!
snapshotEdge: SnapshotEdge!
}
type DeleteControlSnapshotMappingPayload {
deletedControlId: ID!
deletedSnapshotId: ID!
}
type CreateStatementOfApplicabilityPayload {
statementOfApplicabilityEdge: StatementOfApplicabilityEdge!
}

10
pkg/server/api/console/v1/graphql/organization.graphql
View File

@@ -286,16 +286,10 @@ type Organization implements Node {
last: Int
before: CursorKey
orderBy: RiskOrder
filter: RiskFilter = { snapshotId: null }
filter: RiskFilter
): RiskConnection! @goField(forceResolver: true)
snapshots(
first: Int
after: CursorKey
last: Int
before: CursorKey
orderBy: SnapshotOrder
): SnapshotConnection! @goField(forceResolver: true)
risksDocument: Document @goField(forceResolver: true)
tasks(
first: Int

15
pkg/server/api/console/v1/graphql/risk.graphql
View File

@@ -53,12 +53,10 @@ input RiskOrder
input RiskFilter {
query: String
snapshotId: ID
}
type Risk implements Node {
id: ID!
snapshotId: ID
name: String!
description: String
category: String!
@@ -151,6 +149,19 @@ extend type Mutation {
deleteRiskObligationMapping(
input: DeleteRiskObligationMappingInput!
): DeleteRiskObligationMappingPayload!
publishRiskList(
input: PublishRiskListInput!
): PublishRiskListPayload!
}
input PublishRiskListInput {
organizationId: ID!
approverIds: [ID!]
}
type PublishRiskListPayload {
documentEdge: DocumentEdge!
documentVersionEdge: DocumentVersionEdge!
}
input CreateRiskInput {

83
pkg/server/api/console/v1/graphql/snapshot.graphql
View File

@@ -1,83 +0,0 @@
enum SnapshotsType
@goModel(model: "go.probo.inc/probo/pkg/coredata.SnapshotsType") {
RISKS @goEnum(value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeRisks")
}
enum SnapshotOrderField
@goModel(model: "go.probo.inc/probo/pkg/coredata.SnapshotOrderField") {
CREATED_AT
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.SnapshotOrderFieldCreatedAt"
)
NAME
@goEnum(value: "go.probo.inc/probo/pkg/coredata.SnapshotOrderFieldName")
TYPE
@goEnum(value: "go.probo.inc/probo/pkg/coredata.SnapshotOrderFieldType")
}
input SnapshotOrder
@goModel(
model: "go.probo.inc/probo/pkg/server/api/console/v1/types.SnapshotOrderBy"
) {
direction: OrderDirection!
field: SnapshotOrderField!
}
type Snapshot implements Node {
id: ID!
organization: Organization! @goField(forceResolver: true)
name: String!
description: String
type: SnapshotsType!
controls(
first: Int
after: CursorKey
last: Int
before: CursorKey
orderBy: ControlOrder
filter: ControlFilter
): ControlConnection! @goField(forceResolver: true)
createdAt: Datetime!
permission(action: String!): Boolean! @goField(forceResolver: true)
}
type SnapshotConnection
@goModel(
model: "go.probo.inc/probo/pkg/server/api/console/v1/types.SnapshotConnection"
) {
totalCount: Int! @goField(forceResolver: true)
edges: [SnapshotEdge!]!
pageInfo: PageInfo!
}
type SnapshotEdge {
cursor: CursorKey!
node: Snapshot!
}
extend type Mutation {
createSnapshot(input: CreateSnapshotInput!): CreateSnapshotPayload!
deleteSnapshot(input: DeleteSnapshotInput!): DeleteSnapshotPayload!
}
input CreateSnapshotInput {
organizationId: ID!
name: String!
description: String
type: SnapshotsType!
}
input DeleteSnapshotInput {
snapshotId: ID!
}
type CreateSnapshotPayload {
snapshotEdge: SnapshotEdge!
}
type DeleteSnapshotPayload {
deletedSnapshotId: ID!
}

4
pkg/server/api/console/v1/measure_resolvers.go
View File

@@ -101,9 +101,9 @@ func (r *measureResolver) Risks(ctx context.Context, obj *types.Measure, first *
cursor := types.NewCursor(first, after, last, before, pageOrderBy)
var riskFilter = coredata.NewRiskFilter(nil, nil)
var riskFilter = coredata.NewRiskFilter(nil)
if filter != nil {
riskFilter = coredata.NewRiskFilter(filter.Query, &filter.SnapshotID)
riskFilter = coredata.NewRiskFilter(filter.Query)
}
page, err := prb.Risks.ListForMeasureID(ctx, obj.ID, cursor, riskFilter)

41
pkg/server/api/console/v1/organization_resolvers.go
View File

@@ -1027,9 +1027,9 @@ func (r *organizationResolver) Risks(ctx context.Context, obj *types.Organizatio
cursor := types.NewCursor(first, after, last, before, pageOrderBy)
var riskFilter = coredata.NewRiskFilter(nil, nil)
var riskFilter = coredata.NewRiskFilter(nil)
if filter != nil {
riskFilter = coredata.NewRiskFilter(filter.Query, &filter.SnapshotID)
riskFilter = coredata.NewRiskFilter(filter.Query)
}
page, err := prb.Risks.ListForOrganizationID(ctx, obj.ID, cursor, riskFilter)
@@ -1041,34 +1041,33 @@ func (r *organizationResolver) Risks(ctx context.Context, obj *types.Organizatio
return types.NewRiskConnection(page, r, obj.ID, riskFilter), nil
}
// Snapshots is the resolver for the snapshots field.
func (r *organizationResolver) Snapshots(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.SnapshotOrderBy) (*types.SnapshotConnection, error) {
if err := r.authorize(ctx, obj.ID, probo.ActionSnapshotList); err != nil {
// RisksDocument is the resolver for the risksDocument field.
func (r *organizationResolver) RisksDocument(ctx context.Context, obj *types.Organization) (*types.Document, error) {
if err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil {
return nil, err
}
prb := r.ProboService(ctx, obj.ID.TenantID())
pageOrderBy := page.OrderBy[coredata.SnapshotOrderField]{
Field: coredata.SnapshotOrderFieldCreatedAt,
Direction: page.OrderDirectionDesc,
}
if orderBy != nil {
pageOrderBy = page.OrderBy[coredata.SnapshotOrderField]{
Field: orderBy.Field,
Direction: orderBy.Direction,
}
}
cursor := types.NewCursor(first, after, last, before, pageOrderBy)
page, err := prb.Snapshots.ListForOrganizationID(ctx, obj.ID, cursor)
documentID, err := prb.GeneratedDocuments.GetRisksDocumentID(ctx, obj.ID)
if err != nil {
r.logger.ErrorCtx(ctx, "cannot list organization snapshots", log.Error(err))
r.logger.ErrorCtx(ctx, "cannot get risks document ID", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
if documentID == nil {
return nil, nil
}
document, err := prb.Documents.Get(ctx, *documentID)
if err != nil {
if errors.Is(err, coredata.ErrResourceNotFound) {
return nil, nil
}
r.logger.ErrorCtx(ctx, "cannot load risks document", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
return types.NewSnapshotConnection(page, r, obj.ID), nil
return types.NewDocument(document), nil
}
// Tasks is the resolver for the tasks field.

23
pkg/server/api/console/v1/risk_resolvers.go
View File

@@ -239,6 +239,29 @@ func (r *mutationResolver) DeleteRiskObligationMapping(ctx context.Context, inpu
}, nil
}
// PublishRiskList is the resolver for the publishRiskList field.
func (r *mutationResolver) PublishRiskList(ctx context.Context, input types.PublishRiskListInput) (*types.PublishRiskListPayload, error) {
if err := r.authorize(ctx, input.OrganizationID, probo.ActionRiskPublish); err != nil {
return nil, err
}
prb := r.ProboService(ctx, input.OrganizationID.TenantID())
document, documentVersion, err := prb.GeneratedDocuments.PublishRiskList(ctx, input.OrganizationID, input.ApproverIds)
if err != nil {
if errors.Is(err, coredata.ErrResourceAlreadyExists) {
return nil, gqlutils.Conflict(ctx, err)
}
r.logger.ErrorCtx(ctx, "cannot publish risk list", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
return &types.PublishRiskListPayload{
DocumentEdge: types.NewDocumentEdge(document, coredata.DocumentOrderFieldCreatedAt),
DocumentVersionEdge: types.NewDocumentVersionEdge(documentVersion, coredata.DocumentVersionOrderFieldCreatedAt),
}, nil
}
// Owner is the resolver for the owner field.
func (r *riskResolver) Owner(ctx context.Context, obj *types.Risk) (*types.Profile, error) {
if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {

165
pkg/server/api/console/v1/snapshot_resolvers.go
View File

@@ -1,165 +0,0 @@
package console_v1
// This file will be automatically regenerated based on the schema, any resolver
// implementations
// will be copied through when generating and any unknown code will be moved to the end.
// Code generated by github.com/99designs/gqlgen version v0.17.87
import (
"context"
"errors"
"go.gearno.de/kit/log"
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/page"
"go.probo.inc/probo/pkg/probo"
"go.probo.inc/probo/pkg/server/api/console/v1/schema"
"go.probo.inc/probo/pkg/server/api/console/v1/types"
"go.probo.inc/probo/pkg/server/gqlutils"
)
// CreateSnapshot is the resolver for the createSnapshot field.
func (r *mutationResolver) CreateSnapshot(ctx context.Context, input types.CreateSnapshotInput) (*types.CreateSnapshotPayload, error) {
if err := r.authorize(ctx, input.OrganizationID, probo.ActionSnapshotCreate); err != nil {
return nil, err
}
prb := r.ProboService(ctx, input.OrganizationID.TenantID())
snapshot, err := prb.Snapshots.Create(
ctx,
&probo.CreateSnapshotRequest{
OrganizationID: input.OrganizationID,
Name: input.Name,
Description: input.Description,
Type: input.Type,
},
)
if err != nil {
r.logger.ErrorCtx(ctx, "cannot create snapshot", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
return &types.CreateSnapshotPayload{
SnapshotEdge: types.NewSnapshotEdge(snapshot, coredata.SnapshotOrderFieldCreatedAt),
}, nil
}
// DeleteSnapshot is the resolver for the deleteSnapshot field.
func (r *mutationResolver) DeleteSnapshot(ctx context.Context, input types.DeleteSnapshotInput) (*types.DeleteSnapshotPayload, error) {
if err := r.authorize(ctx, input.SnapshotID, probo.ActionSnapshotDelete); err != nil {
return nil, err
}
prb := r.ProboService(ctx, input.SnapshotID.TenantID())
err := prb.Snapshots.Delete(ctx, input.SnapshotID)
if err != nil {
r.logger.ErrorCtx(ctx, "cannot delete snapshot", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
return &types.DeleteSnapshotPayload{
DeletedSnapshotID: input.SnapshotID,
}, nil
}
// Organization is the resolver for the organization field.
func (r *snapshotResolver) Organization(ctx context.Context, obj *types.Snapshot) (*types.Organization, error) {
if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
return nil, err
}
prb := r.ProboService(ctx, obj.ID.TenantID())
snapshot, err := prb.Snapshots.Get(ctx, obj.ID)
if err != nil {
r.logger.ErrorCtx(ctx, "cannot get snapshot", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
organization, err := prb.Organizations.Get(ctx, snapshot.OrganizationID)
if err != nil {
if errors.Is(err, coredata.ErrResourceNotFound) {
return nil, gqlutils.NotFound(ctx, err)
}
r.logger.ErrorCtx(ctx, "cannot get organization", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
return types.NewOrganization(organization), nil
}
// Controls is the resolver for the controls field.
func (r *snapshotResolver) Controls(ctx context.Context, obj *types.Snapshot, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy, filter *types.ControlFilter) (*types.ControlConnection, error) {
if err := r.authorize(ctx, obj.ID, probo.ActionControlList); err != nil {
return nil, err
}
prb := r.ProboService(ctx, obj.ID.TenantID())
pageOrderBy := page.OrderBy[coredata.ControlOrderField]{
Field: coredata.ControlOrderFieldCreatedAt,
Direction: page.OrderDirectionDesc,
}
if orderBy != nil {
pageOrderBy = page.OrderBy[coredata.ControlOrderField]{
Field: orderBy.Field,
Direction: orderBy.Direction,
}
}
cursor := types.NewCursor(first, after, last, before, pageOrderBy)
var controlFilter = coredata.NewControlFilter(nil)
if filter != nil {
controlFilter = coredata.NewControlFilter(filter.Query)
}
page, err := prb.Controls.ListForSnapshotID(ctx, obj.ID, cursor, controlFilter)
if err != nil {
r.logger.ErrorCtx(ctx, "cannot list snapshot controls", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
return types.NewControlConnection(page, r, obj.ID, controlFilter), nil
}
// Permission is the resolver for the permission field.
func (r *snapshotResolver) Permission(ctx context.Context, obj *types.Snapshot, action string) (bool, error) {
return r.Resolver.Permission(ctx, obj, action)
}
// TotalCount is the resolver for the totalCount field.
func (r *snapshotConnectionResolver) TotalCount(ctx context.Context, obj *types.SnapshotConnection) (int, error) {
if err := r.authorize(ctx, obj.ParentID, probo.ActionSnapshotList); err != nil {
return 0, err
}
prb := r.ProboService(ctx, obj.ParentID.TenantID())
switch obj.Resolver.(type) {
case *organizationResolver:
count, err := prb.Snapshots.CountForOrganizationID(ctx, obj.ParentID)
if err != nil {
r.logger.ErrorCtx(ctx, "cannot count snapshots", log.Error(err))
return 0, gqlutils.Internal(ctx)
}
return count, nil
}
r.logger.ErrorCtx(ctx, "unsupported resolver")
return 0, gqlutils.Internal(ctx)
}
// Snapshot returns schema.SnapshotResolver implementation.
func (r *Resolver) Snapshot() schema.SnapshotResolver { return &snapshotResolver{r} }
// SnapshotConnection returns schema.SnapshotConnectionResolver implementation.
func (r *Resolver) SnapshotConnection() schema.SnapshotConnectionResolver {
return &snapshotConnectionResolver{r}
}
type snapshotResolver struct{ *Resolver }
type snapshotConnectionResolver struct{ *Resolver }

1
pkg/server/api/console/v1/types/risk.go
View File

@@ -67,7 +67,6 @@ func NewRisk(r *coredata.Risk) *Risk {
risk := &Risk{
ID: r.ID,
Name: r.Name,
SnapshotID: r.SnapshotID,
Description: r.Description,
Treatment: r.Treatment,
InherentLikelihood: r.InherentLikelihood,

73
pkg/server/api/console/v1/types/snapshot.go
View File

@@ -1,73 +0,0 @@
// Copyright (c) 2025-2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package types
import (
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/page"
)
type (
SnapshotOrderBy OrderBy[coredata.SnapshotOrderField]
SnapshotConnection struct {
TotalCount int
Edges []*SnapshotEdge
PageInfo PageInfo
Resolver any
ParentID gid.GID
}
)
func NewSnapshotConnection(
p *page.Page[*coredata.Snapshot, coredata.SnapshotOrderField],
parentType any,
parentID gid.GID,
) *SnapshotConnection {
edges := make([]*SnapshotEdge, len(p.Data))
for i, snapshot := range p.Data {
edges[i] = NewSnapshotEdge(snapshot, p.Cursor.OrderBy.Field)
}
return &SnapshotConnection{
Edges: edges,
PageInfo: *NewPageInfo(p),
Resolver: parentType,
ParentID: parentID,
}
}
func NewSnapshotEdge(s *coredata.Snapshot, orderField coredata.SnapshotOrderField) *SnapshotEdge {
return &SnapshotEdge{
Node: NewSnapshot(s),
Cursor: s.CursorKey(orderField),
}
}
func NewSnapshot(s *coredata.Snapshot) *Snapshot {
return &Snapshot{
ID: s.ID,
Organization: &Organization{
ID: s.OrganizationID,
},
Name: s.Name,
Type: s.Type,
Description: s.Description,
CreatedAt: s.CreatedAt,
}
}

121
pkg/server/api/mcp/v1/schema.resolvers.go
View File

@@ -274,10 +274,9 @@ func (r *Resolver) ListRisksTool(ctx context.Context, req *mcp.CallToolRequest,
cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)
noSnapshot := (*gid.GID)(nil)
riskFilter := coredata.NewRiskFilter(nil, &noSnapshot)
riskFilter := coredata.NewRiskFilter(nil)
if input.Filter != nil {
riskFilter = coredata.NewRiskFilter(input.Filter.Query, &input.Filter.SnapshotID)
riskFilter = coredata.NewRiskFilter(input.Filter.Query)
}
page, err := prb.Risks.ListForOrganizationID(ctx, input.OrganizationID, cursor, riskFilter)
@@ -1511,11 +1510,6 @@ func (r *Resolver) LinkControlTool(ctx context.Context, req *mcp.CallToolRequest
if _, _, err := svc.Controls.CreateAuditMapping(ctx, input.ControlID, input.ResourceID); err != nil {
return nil, types.LinkControlOutput{}, fmt.Errorf("failed to link control to audit: %w", err)
}
case coredata.SnapshotEntityType:
r.MustAuthorize(ctx, input.ControlID, probo.ActionControlSnapshotMappingCreate)
if _, _, err := svc.Controls.CreateSnapshotMapping(ctx, input.ControlID, input.ResourceID); err != nil {
return nil, types.LinkControlOutput{}, fmt.Errorf("failed to link control to snapshot: %w", err)
}
case coredata.ObligationEntityType:
r.MustAuthorize(ctx, input.ControlID, probo.ActionControlObligationMappingCreate)
if _, _, err := svc.Controls.CreateObligationMapping(ctx, input.ControlID, input.ResourceID); err != nil {
@@ -1547,11 +1541,6 @@ func (r *Resolver) UnlinkControlTool(ctx context.Context, req *mcp.CallToolReque
if _, _, err := svc.Controls.DeleteAuditMapping(ctx, input.ControlID, input.ResourceID); err != nil {
return nil, types.UnlinkControlOutput{}, fmt.Errorf("failed to unlink control from audit: %w", err)
}
case coredata.SnapshotEntityType:
r.MustAuthorize(ctx, input.ControlID, probo.ActionControlSnapshotMappingDelete)
if _, _, err := svc.Controls.DeleteSnapshotMapping(ctx, input.ControlID, input.ResourceID); err != nil {
return nil, types.UnlinkControlOutput{}, fmt.Errorf("failed to unlink control from snapshot: %w", err)
}
case coredata.ObligationEntityType:
r.MustAuthorize(ctx, input.ControlID, probo.ActionControlObligationMappingDelete)
if _, _, err := svc.Controls.DeleteObligationMapping(ctx, input.ControlID, input.ResourceID); err != nil {
@@ -1668,32 +1657,6 @@ func (r *Resolver) ListControlAuditsTool(ctx context.Context, req *mcp.CallToolR
return nil, types.NewListControlAuditsOutput(auditPage), nil
}
func (r *Resolver) ListControlSnapshotsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListControlSnapshotsInput) (*mcp.CallToolResult, types.ListControlSnapshotsOutput, error) {
r.MustAuthorize(ctx, input.ControlID, probo.ActionControlGet)
prb := r.ProboService(ctx, input.ControlID)
pageOrderBy := page.OrderBy[coredata.SnapshotOrderField]{
Field: coredata.SnapshotOrderFieldCreatedAt,
Direction: page.OrderDirectionDesc,
}
if input.OrderBy != nil {
pageOrderBy = page.OrderBy[coredata.SnapshotOrderField]{
Field: input.OrderBy.Field,
Direction: input.OrderBy.Direction,
}
}
cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)
snapshotPage, err := prb.Snapshots.ListForControlID(ctx, input.ControlID, cursor)
if err != nil {
return nil, types.ListControlSnapshotsOutput{}, fmt.Errorf("failed to list control snapshots: %w", err)
}
return nil, types.NewListControlSnapshotsOutput(snapshotPage), nil
}
func (r *Resolver) ListRiskObligationsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListRiskObligationsInput) (*mcp.CallToolResult, types.ListRiskObligationsOutput, error) {
r.MustAuthorize(ctx, input.RiskID, probo.ActionRiskGet)
@@ -1915,68 +1878,6 @@ func (r *Resolver) DeleteTaskTool(ctx context.Context, req *mcp.CallToolRequest,
}, nil
}
func (r *Resolver) ListSnapshotsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListSnapshotsInput) (*mcp.CallToolResult, types.ListSnapshotsOutput, error) {
r.MustAuthorize(ctx, input.OrganizationID, probo.ActionSnapshotList)
prb := r.ProboService(ctx, input.OrganizationID)
pageOrderBy := page.OrderBy[coredata.SnapshotOrderField]{
Field: coredata.SnapshotOrderFieldCreatedAt,
Direction: page.OrderDirectionDesc,
}
if input.OrderBy != nil {
pageOrderBy = page.OrderBy[coredata.SnapshotOrderField]{
Field: input.OrderBy.Field,
Direction: input.OrderBy.Direction,
}
}
cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)
page, err := prb.Snapshots.ListForOrganizationID(ctx, input.OrganizationID, cursor)
if err != nil {
panic(fmt.Errorf("cannot list organization snapshots: %w", err))
}
return nil, types.NewListSnapshotsOutput(page), nil
}
func (r *Resolver) GetSnapshotTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetSnapshotInput) (*mcp.CallToolResult, types.GetSnapshotOutput, error) {
r.MustAuthorize(ctx, input.ID, probo.ActionSnapshotGet)
prb := r.ProboService(ctx, input.ID)
snapshot, err := prb.Snapshots.Get(ctx, input.ID)
if err != nil {
return nil, types.GetSnapshotOutput{}, fmt.Errorf("failed to get snapshot: %w", err)
}
return nil, types.GetSnapshotOutput{
Snapshot: types.NewSnapshot(snapshot),
}, nil
}
func (r *Resolver) TakeSnapshotTool(ctx context.Context, req *mcp.CallToolRequest, input *types.TakeSnapshotInput) (*mcp.CallToolResult, types.TakeSnapshotOutput, error) {
r.MustAuthorize(ctx, input.OrganizationID, probo.ActionSnapshotCreate)
prb := r.ProboService(ctx, input.OrganizationID)
snapshot, err := prb.Snapshots.Create(
ctx,
&probo.CreateSnapshotRequest{
OrganizationID: input.OrganizationID,
Name: input.Name,
Description: input.Description,
Type: input.Type,
},
)
if err != nil {
return nil, types.TakeSnapshotOutput{}, fmt.Errorf("failed to take snapshot: %w", err)
}
return nil, types.TakeSnapshotOutput{
Snapshot: types.NewSnapshot(snapshot),
}, nil
}
func (r *Resolver) ListDocumentsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListDocumentsInput) (*mcp.CallToolResult, types.ListDocumentsOutput, error) {
r.MustAuthorize(ctx, input.OrganizationID, probo.ActionDocumentList)
@@ -2314,7 +2215,7 @@ func (r *Resolver) ListMeasureRisksTool(ctx context.Context, req *mcp.CallToolRe
cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)
riskPage, err := prb.Risks.ListForMeasureID(ctx, input.MeasureID, cursor, coredata.NewRiskFilter(nil, nil))
riskPage, err := prb.Risks.ListForMeasureID(ctx, input.MeasureID, cursor, coredata.NewRiskFilter(nil))
if err != nil {
return nil, types.ListMeasureRisksOutput{}, fmt.Errorf("failed to list measure risks: %w", err)
}
@@ -5190,3 +5091,19 @@ func (r *Resolver) GetCookieConsentRecordTool(ctx context.Context, req *mcp.Call
}
return nil, types.GetCookieConsentRecordOutput{CookieConsentRecord: types.NewCookieConsentRecord(record)}, nil
}
func (r *Resolver) PublishRiskListTool(ctx context.Context, req *mcp.CallToolRequest, input *types.PublishRiskListInput) (*mcp.CallToolResult, types.PublishRiskListOutput, error) {
r.MustAuthorize(ctx, input.OrganizationID, probo.ActionRiskPublish)
svc := r.ProboService(ctx, input.OrganizationID)
document, documentVersion, err := svc.GeneratedDocuments.PublishRiskList(ctx, input.OrganizationID, input.ApproverIds)
if err != nil {
return nil, types.PublishRiskListOutput{}, fmt.Errorf("cannot publish risk list: %w", err)
}
return nil, types.PublishRiskListOutput{
DocumentID: document.ID,
DocumentVersionID: documentVersion.ID,
}, nil
}

281
pkg/server/api/mcp/v1/specification.yaml
View File

@@ -1499,13 +1499,6 @@ components:
organization_id:
$ref: "#/components/schemas/GID"
description: Organization ID
snapshot_id:
anyOf:
- type: string
$ref: "#/components/schemas/GID"
- type: "null"
description: No snapshot
description: Snapshot ID
name:
type: string
description: Risk name
@@ -1579,12 +1572,6 @@ components:
query:
type: string
description: Search query
snapshot_id:
anyOf:
- $ref: "#/components/schemas/GID"
- type: "null"
description: Filter by snapshot ID. Defaults to null, which returns only risks with no snapshot (current live data). Pass a specific snapshot ID to retrieve risks as they were at that snapshot.
default: null
ListRisksOutput:
type: object
@@ -4772,7 +4759,7 @@ components:
description: Control ID
resource_id:
$ref: "#/components/schemas/GID"
description: ID of the resource to link (measure, document, audit, snapshot, or obligation)
description: ID of the resource to link (measure, document, audit, or obligation)
LinkControlOutput:
type: object
@@ -4788,7 +4775,7 @@ components:
description: Control ID
resource_id:
$ref: "#/components/schemas/GID"
description: ID of the resource to unlink (measure, document, audit, snapshot, or obligation)
description: ID of the resource to unlink (measure, document, audit, or obligation)
UnlinkControlOutput:
type: object
@@ -4917,37 +4904,6 @@ components:
items:
$ref: "#/components/schemas/Audit"
ListControlSnapshotsInput:
type: object
required:
- control_id
properties:
control_id:
$ref: "#/components/schemas/GID"
description: Control ID
cursor:
$ref: "#/components/schemas/CursorKey"
description: Page cursor
size:
type: integer
description: Page size
order_by:
$ref: "#/components/schemas/SnapshotOrderBy"
description: Snapshot order by
ListControlSnapshotsOutput:
type: object
required:
- snapshots
properties:
next_cursor:
$ref: "#/components/schemas/CursorKey"
description: Next cursor
snapshots:
type: array
items:
$ref: "#/components/schemas/Snapshot"
ListRiskObligationsInput:
type: object
required:
@@ -5354,150 +5310,6 @@ components:
$ref: "#/components/schemas/GID"
description: Deleted task ID
SnapshotsType:
type: string
enum:
- RISKS
- NONCONFORMITIES
- OBLIGATIONS
- CONTINUAL_IMPROVEMENTS
- PROCESSING_ACTIVITIES
- STATEMENTS_OF_APPLICABILITY
go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.SnapshotsType
SnapshotOrderField:
type: string
enum:
- CREATED_AT
- NAME
- TYPE
go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.SnapshotOrderField
SnapshotOrderBy:
type: object
required:
- field
- direction
properties:
field:
$ref: "#/components/schemas/SnapshotOrderField"
description: Snapshot order field
direction:
$ref: "#/components/schemas/OrderDirection"
description: Snapshot order direction
Snapshot:
type: object
required:
- id
- organization_id
- name
- type
- created_at
properties:
id:
$ref: "#/components/schemas/GID"
description: Snapshot ID
organization_id:
$ref: "#/components/schemas/GID"
description: Organization ID
name:
type: string
description: Snapshot name
description:
anyOf:
- type: string
description: Snapshot description
- type: "null"
description: No description
description: Snapshot description
type:
$ref: "#/components/schemas/SnapshotsType"
description: Snapshot type
created_at:
type: string
format: date-time
description: Creation timestamp
ListSnapshotsInput:
type: object
required:
- organization_id
properties:
organization_id:
$ref: "#/components/schemas/GID"
description: Organization ID
order_by:
$ref: "#/components/schemas/SnapshotOrderBy"
description: Snapshot order by
size:
type: integer
description: Page size
cursor:
$ref: "#/components/schemas/CursorKey"
description: Page cursor
ListSnapshotsOutput:
type: object
required:
- snapshots
properties:
snapshots:
type: array
items:
$ref: "#/components/schemas/Snapshot"
description: List of snapshots
next_cursor:
anyOf:
- $ref: "#/components/schemas/CursorKey"
- type: "null"
description: Next page cursor
GetSnapshotInput:
type: object
required:
- id
properties:
id:
$ref: "#/components/schemas/GID"
description: Snapshot ID
GetSnapshotOutput:
type: object
required:
- snapshot
properties:
snapshot:
$ref: "#/components/schemas/Snapshot"
TakeSnapshotInput:
type: object
required:
- organization_id
- name
- type
properties:
organization_id:
$ref: "#/components/schemas/GID"
description: Organization ID
name:
type: string
description: Snapshot name
description:
type: string
description: Snapshot description
type:
$ref: "#/components/schemas/SnapshotsType"
description: Snapshot type (determines which collection to snapshot)
TakeSnapshotOutput:
type: object
required:
- snapshot
properties:
snapshot:
$ref: "#/components/schemas/Snapshot"
DocumentType:
type: string
enum:
@@ -6815,16 +6627,6 @@ components:
cursor:
$ref: "#/components/schemas/CursorKey"
description: Page cursor
filter:
type: object
properties:
snapshot_id:
anyOf:
- $ref: "#/components/schemas/GID"
- type: "null"
description: Filter by snapshot ID. Defaults to null, which returns only statements of applicability with no snapshot (current live data). Pass a specific snapshot ID to retrieve statements of applicability as they were at that snapshot.
default: null
ListStatementsOfApplicabilityOutput:
type: object
required:
@@ -7131,6 +6933,33 @@ components:
$ref: "#/components/schemas/GID"
description: Created document version ID
PublishRiskListInput:
type: object
required:
- organization_id
properties:
organization_id:
$ref: "#/components/schemas/GID"
description: Organization ID
approver_ids:
type: array
items:
$ref: "#/components/schemas/GID"
description: Optional approver profile IDs. If provided, creates a draft pending approval instead of publishing immediately.
PublishRiskListOutput:
type: object
required:
- document_id
- document_version_id
properties:
document_id:
$ref: "#/components/schemas/GID"
description: Created or updated document ID
document_version_id:
$ref: "#/components/schemas/GID"
description: Created document version ID
PublishStatementOfApplicabilityInput:
type: object
required:
@@ -7201,11 +7030,6 @@ components:
organization_id:
$ref: "#/components/schemas/GID"
description: Organization ID
snapshot_id:
anyOf:
- $ref: "#/components/schemas/GID"
- type: "null"
description: Snapshot ID
applicability:
type: boolean
description: Whether the control is applicable
@@ -10842,7 +10666,7 @@ tools:
outputSchema:
$ref: "#/components/schemas/UpdateControlOutput"
- name: linkControl
description: Link a resource to a control (measure, document, audit, snapshot, or obligation). The resource type is determined from the resource_id GID.
description: Link a resource to a control (measure, document, audit, or obligation). The resource type is determined from the resource_id GID.
hints:
readonly: false
inputSchema:
@@ -10850,7 +10674,7 @@ tools:
outputSchema:
$ref: "#/components/schemas/LinkControlOutput"
- name: unlinkControl
description: Unlink a resource from a control (measure, document, audit, snapshot, or obligation). The resource type is determined from the resource_id GID.
description: Unlink a resource from a control (measure, document, audit, or obligation). The resource type is determined from the resource_id GID.
hints:
readonly: false
inputSchema:
@@ -10893,15 +10717,6 @@ tools:
$ref: "#/components/schemas/ListControlAuditsInput"
outputSchema:
$ref: "#/components/schemas/ListControlAuditsOutput"
- name: listControlSnapshots
description: List snapshots linked to a control
hints:
readonly: true
idempotent: true
inputSchema:
$ref: "#/components/schemas/ListControlSnapshotsInput"
outputSchema:
$ref: "#/components/schemas/ListControlSnapshotsOutput"
- name: listRiskObligations
description: List obligations linked to a risk
hints:
@@ -10986,32 +10801,6 @@ tools:
$ref: "#/components/schemas/DeleteTaskInput"
outputSchema:
$ref: "#/components/schemas/DeleteTaskOutput"
- name: listSnapshots
description: List all snapshots for the organization
hints:
readonly: true
idempotent: true
inputSchema:
$ref: "#/components/schemas/ListSnapshotsInput"
outputSchema:
$ref: "#/components/schemas/ListSnapshotsOutput"
- name: getSnapshot
description: Get a snapshot by ID
hints:
readonly: true
idempotent: true
inputSchema:
$ref: "#/components/schemas/GetSnapshotInput"
outputSchema:
$ref: "#/components/schemas/GetSnapshotOutput"
- name: takeSnapshot
description: Take a snapshot of a collection of objects (risks, vendors, findings, obligations, or processing activities)
hints:
readonly: false
inputSchema:
$ref: "#/components/schemas/TakeSnapshotInput"
outputSchema:
$ref: "#/components/schemas/TakeSnapshotOutput"
- name: listDocuments
description: List documents for the organization. By default only ACTIVE documents are returned; pass status filter to include ARCHIVED.
hints:
@@ -11281,6 +11070,14 @@ tools:
$ref: "#/components/schemas/PublishVendorListInput"
outputSchema:
$ref: "#/components/schemas/PublishVendorListOutput"
- name: publishRiskList
description: Publish the risk register for an organization as a document. If a document already exists, a new version is created.
hints:
readonly: false
inputSchema:
$ref: "#/components/schemas/PublishRiskListInput"
outputSchema:
$ref: "#/components/schemas/PublishRiskListOutput"
- name: publishStatementOfApplicability
description: Publish a statement of applicability as a document. If a document already exists, a new version is created.
hints:

1
pkg/server/api/mcp/v1/types/risk.go
View File

@@ -35,7 +35,6 @@ func NewRisk(r *coredata.Risk) *Risk {
ResidualLikelihood: r.ResidualLikelihood,
ResidualImpact: r.ResidualImpact,
ResidualRiskScore: r.ResidualRiskScore,
SnapshotID: r.SnapshotID,
CreatedAt: r.CreatedAt,
UpdatedAt: r.UpdatedAt,
}

66
pkg/server/api/mcp/v1/types/snapshot.go
View File

@@ -1,66 +0,0 @@
// Copyright (c) 2025-2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
package types
import (
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/page"
)
func NewSnapshot(s *coredata.Snapshot) *Snapshot {
return &Snapshot{
ID: s.ID,
OrganizationID: s.OrganizationID,
Name: s.Name,
Type: s.Type,
Description: s.Description,
CreatedAt: s.CreatedAt,
}
}
func NewListControlSnapshotsOutput(snapshotPage *page.Page[*coredata.Snapshot, coredata.SnapshotOrderField]) ListControlSnapshotsOutput {
snapshots := make([]*Snapshot, 0, len(snapshotPage.Data))
for _, s := range snapshotPage.Data {
snapshots = append(snapshots, NewSnapshot(s))
}
var nextCursor *page.CursorKey
if len(snapshotPage.Data) > 0 {
cursorKey := snapshotPage.Data[len(snapshotPage.Data)-1].CursorKey(snapshotPage.Cursor.OrderBy.Field)
nextCursor = &cursorKey
}
return ListControlSnapshotsOutput{
NextCursor: nextCursor,
Snapshots: snapshots,
}
}
func NewListSnapshotsOutput(snapshotPage *page.Page[*coredata.Snapshot, coredata.SnapshotOrderField]) ListSnapshotsOutput {
snapshots := make([]*Snapshot, 0, len(snapshotPage.Data))
for _, s := range snapshotPage.Data {
snapshots = append(snapshots, NewSnapshot(s))
}
var nextCursor *page.CursorKey
if len(snapshotPage.Data) > 0 {
cursorKey := snapshotPage.Data[len(snapshotPage.Data)-1].CursorKey(snapshotPage.Cursor.OrderBy.Field)
nextCursor = &cursorKey
}
return ListSnapshotsOutput{
NextCursor: nextCursor,
Snapshots: snapshots,
}
}

1
pkg/server/api/mcp/v1/types/statement_of_applicability.go
View File

@@ -51,7 +51,6 @@ func NewApplicabilityStatement(a *coredata.ApplicabilityStatement) *Applicabilit
StatementOfApplicabilityID: a.StatementOfApplicabilityID,
ControlID: a.ControlID,
OrganizationID: a.OrganizationID,
SnapshotID: a.SnapshotID,
Applicability: a.Applicability,
Justification: a.Justification,
CreatedAt: a.CreatedAt,