Add contols audits

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/coredata/audit.go

@@ -314,3 +314,109 @@ WHERE
 
 	return nil
 }
+
+func (a *Audits) CountByControlID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	controlID gid.GID,
+) (int, error) {
+	q := `
+WITH audits_by_control AS (
+		SELECT
+			a.id,
+			a.tenant_id
+		FROM
+			audits a
+		INNER JOIN
+			controls_audits ca ON a.id = ca.audit_id
+		WHERE
+			ca.control_id = @control_id
+	)
+	SELECT
+		COUNT(id)
+	FROM
+		audits_by_control
+	WHERE %s
+	`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"control_id": controlID}
+	maps.Copy(args, scope.SQLArguments())
+
+	row := conn.QueryRow(ctx, q, args)
+
+	var count int
+	if err := row.Scan(&count); err != nil {
+		return 0, fmt.Errorf("cannot scan count: %w", err)
+	}
+
+	return count, nil
+}
+
+func (a *Audits) LoadByControlID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	controlID gid.GID,
+	cursor *page.Cursor[AuditOrderField],
+) error {
+	q := `
+WITH audits_by_control AS (
+	SELECT
+		a.id,
+		a.tenant_id,
+		a.name,
+		a.organization_id,
+		a.framework_id,
+		a.report_id,
+		a.valid_from,
+		a.valid_until,
+		a.state,
+		a.show_on_trust_center,
+		a.created_at,
+		a.updated_at
+	FROM
+		audits a
+	INNER JOIN
+		controls_audits ca ON a.id = ca.audit_id
+	WHERE
+		ca.control_id = @control_id
+)
+SELECT
+	id,
+	name,
+	organization_id,
+	framework_id,
+	report_id,
+	valid_from,
+	valid_until,
+	state,
+	show_on_trust_center,
+	created_at,
+	updated_at
+FROM
+	audits_by_control
+WHERE %s
+	AND %s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.NamedArgs{"control_id": controlID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query audits: %w", err)
+	}
+
+	audits, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Audit])
+	if err != nil {
+		return fmt.Errorf("cannot collect audits: %w", err)
+	}
+
+	*a = audits
+
+	return nil
+}

pkg/coredata/control.go

@@ -826,3 +826,114 @@ RETURNING
 
 	return nil
 }
+
+func (c *Controls) CountByAuditID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	auditID gid.GID,
+	filter *ControlFilter,
+) (int, error) {
+	q := `
+WITH ctrl AS (
+		SELECT
+			c.id,
+			c.tenant_id,
+			c.search_vector
+		FROM
+			controls c
+		INNER JOIN
+			controls_audits ca ON c.id = ca.control_id
+		WHERE
+			ca.audit_id = @audit_id
+	)
+	SELECT
+		COUNT(id)
+	FROM
+		ctrl
+	WHERE %s
+		AND %s
+	`
+	q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment())
+
+	args := pgx.NamedArgs{"audit_id": auditID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, filter.SQLArguments())
+
+	row := conn.QueryRow(ctx, q, args)
+
+	var count int
+	if err := row.Scan(&count); err != nil {
+		return 0, fmt.Errorf("cannot scan count: %w", err)
+	}
+
+	return count, nil
+}
+
+func (c *Controls) LoadByAuditID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	auditID gid.GID,
+	cursor *page.Cursor[ControlOrderField],
+	filter *ControlFilter,
+) error {
+	q := `
+WITH ctrl AS (
+	SELECT
+		c.id,
+		c.section_title,
+		c.framework_id,
+		c.tenant_id,
+		c.name,
+		c.description,
+		c.status,
+		c.exclusion_justification,
+		c.created_at,
+		c.updated_at,
+		c.search_vector
+	FROM
+		controls c
+	INNER JOIN
+		controls_audits ca ON c.id = ca.control_id
+	WHERE
+		ca.audit_id = @audit_id
+)
+SELECT
+	id,
+	section_title,
+	framework_id,
+    tenant_id,
+	name,
+	description,
+	status,
+	exclusion_justification,
+	created_at,
+	updated_at
+FROM
+	ctrl
+WHERE %s
+	AND %s
+	AND %s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.NamedArgs{"audit_id": auditID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, filter.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query controls: %w", err)
+	}
+
+	controls, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Control])
+	if err != nil {
+		return fmt.Errorf("cannot collect controls: %w", err)
+	}
+
+	*c = controls
+
+	return nil
+}

pkg/coredata/control_audit.go

@@ -0,0 +1,168 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+)
+
+type (
+	ControlAudit struct {
+		ControlID gid.GID   `db:"control_id"`
+		AuditID   gid.GID   `db:"audit_id"`
+		CreatedAt time.Time `db:"created_at"`
+	}
+
+	ControlAudits []*ControlAudit
+)
+
+func (ca ControlAudit) Upsert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO
+    controls_audits (
+        control_id,
+        audit_id,
+        tenant_id,
+        created_at
+    )
+VALUES (
+    @control_id,
+    @audit_id,
+    @tenant_id,
+    @created_at
+)
+ON CONFLICT (control_id, audit_id) DO NOTHING;
+`
+
+	args := pgx.StrictNamedArgs{
+		"control_id": ca.ControlID,
+		"audit_id":   ca.AuditID,
+		"tenant_id":  scope.GetTenantID(),
+		"created_at": ca.CreatedAt,
+	}
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}
+
+func (ca ControlAudit) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	controlID gid.GID,
+	auditID gid.GID,
+) error {
+	q := `
+DELETE
+FROM
+    controls_audits
+WHERE
+    %s
+    AND control_id = @control_id
+    AND audit_id = @audit_id;
+`
+
+	args := pgx.StrictNamedArgs{
+		"control_id": controlID,
+		"audit_id":   auditID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}
+
+func (cas *ControlAudits) LoadByControlID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	controlID gid.GID,
+) error {
+	q := `
+SELECT
+    control_id,
+    audit_id,
+    created_at
+FROM
+    controls_audits
+WHERE
+    %s
+    AND control_id = @control_id
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"control_id": controlID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query control_audits: %w", err)
+	}
+
+	controlAudits, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ControlAudit])
+	if err != nil {
+		return fmt.Errorf("cannot collect control_audits: %w", err)
+	}
+
+	*cas = controlAudits
+	return nil
+}
+
+func (cas *ControlAudits) LoadByAuditID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	auditID gid.GID,
+) error {
+	q := `
+SELECT
+    control_id,
+    audit_id,
+    created_at
+FROM
+    controls_audits
+WHERE
+    %s
+    AND audit_id = @audit_id
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"audit_id": auditID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query control_audits: %w", err)
+	}
+
+	controlAudits, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ControlAudit])
+	if err != nil {
+		return fmt.Errorf("cannot collect control_audits: %w", err)
+	}
+
+	*cas = controlAudits
+	return nil
+}

pkg/coredata/migrations/20250814T123441Z.sql

@@ -0,0 +1,7 @@
+CREATE TABLE controls_audits (
+    control_id TEXT NOT NULL REFERENCES controls(id),
+    audit_id TEXT NOT NULL REFERENCES audits(id),
+    tenant_id TEXT NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    PRIMARY KEY (control_id, audit_id)
+);

pkg/probo/audit_service.go

@@ -346,3 +346,34 @@ func (s AuditService) DeleteReport(
 
 	return audit, nil
 }
+
+func (s AuditService) ListForControlID(
+	ctx context.Context,
+	controlID gid.GID,
+	cursor *page.Cursor[coredata.AuditOrderField],
+) (*page.Page[*coredata.Audit, coredata.AuditOrderField], error) {
+	var audits coredata.Audits
+	control := &coredata.Control{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := control.LoadByID(ctx, conn, s.svc.scope, controlID); err != nil {
+				return fmt.Errorf("cannot load control: %w", err)
+			}
+
+			err := audits.LoadByControlID(ctx, conn, s.svc.scope, control.ID, cursor)
+			if err != nil {
+				return fmt.Errorf("cannot load audits: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(audits, cursor), nil
+}

pkg/probo/control_service.go

@@ -492,6 +492,111 @@ func (s ControlService) DeleteDocumentMapping(
 	return control, document, nil
 }
 
+func (s ControlService) CreateAuditMapping(
+	ctx context.Context,
+	controlID gid.GID,
+	auditID gid.GID,
+) (*coredata.Control, *coredata.Audit, error) {
+	controlAudit := &coredata.ControlAudit{
+		ControlID: controlID,
+		AuditID:   auditID,
+		CreatedAt: time.Now(),
+	}
+
+	control := &coredata.Control{}
+	audit := &coredata.Audit{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := control.LoadByID(ctx, conn, s.svc.scope, controlID); err != nil {
+				return fmt.Errorf("cannot load control: %w", err)
+			}
+
+			if err := audit.LoadByID(ctx, conn, s.svc.scope, auditID); err != nil {
+				return fmt.Errorf("cannot load audit: %w", err)
+			}
+
+			if err := controlAudit.Upsert(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot create control audit mapping: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return control, audit, nil
+}
+
+func (s ControlService) DeleteAuditMapping(
+	ctx context.Context,
+	controlID gid.GID,
+	auditID gid.GID,
+) (*coredata.Control, *coredata.Audit, error) {
+	control := &coredata.Control{}
+	audit := &coredata.Audit{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := control.LoadByID(ctx, conn, s.svc.scope, controlID); err != nil {
+				return fmt.Errorf("cannot load control: %w", err)
+			}
+
+			if err := audit.LoadByID(ctx, conn, s.svc.scope, auditID); err != nil {
+				return fmt.Errorf("cannot load audit: %w", err)
+			}
+
+			controlAudit := &coredata.ControlAudit{}
+			if err := controlAudit.Delete(ctx, conn, s.svc.scope, control.ID, audit.ID); err != nil {
+				return fmt.Errorf("cannot delete control audit mapping: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, nil, fmt.Errorf("cannot delete control audit mapping: %w", err)
+	}
+
+	return control, audit, nil
+}
+
+func (s ControlService) ListForAuditID(
+	ctx context.Context,
+	auditID gid.GID,
+	cursor *page.Cursor[coredata.ControlOrderField],
+	filter *coredata.ControlFilter,
+) (*page.Page[*coredata.Control, coredata.ControlOrderField], error) {
+	var controls coredata.Controls
+	audit := &coredata.Audit{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := audit.LoadByID(ctx, conn, s.svc.scope, auditID); err != nil {
+				return fmt.Errorf("cannot load audit: %w", err)
+			}
+			if err := controls.LoadByAuditID(ctx, conn, s.svc.scope, auditID, cursor, filter); err != nil {
+				return fmt.Errorf("cannot load controls: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage([]*coredata.Control(controls), cursor), nil
+}
+
 func (s ControlService) Create(
 	ctx context.Context,
 	req CreateControlRequest,

pkg/server/api/console/v1/schema.graphql

@@ -1076,6 +1076,14 @@ type Control implements Node {
     filter: DocumentFilter
   ): DocumentConnection! @goField(forceResolver: true)
 
+  audits(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: AuditOrder
+  ): AuditConnection! @goField(forceResolver: true)
+
   createdAt: Datetime!
   updatedAt: Datetime!
 }
@@ -1257,6 +1265,16 @@ type Audit implements Node {
   report: Report @goField(forceResolver: true)
   reportUrl: String @goField(forceResolver: true)
   state: AuditState!
+
+  controls(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: ControlOrder
+    filter: ControlFilter
+  ): ControlConnection! @goField(forceResolver: true)
+
   showOnTrustCenter: Boolean!
   createdAt: Datetime!
   updatedAt: Datetime!
@@ -1636,6 +1654,12 @@ type Mutation {
   deleteControlDocumentMapping(
     input: DeleteControlDocumentMappingInput!
   ): DeleteControlDocumentMappingPayload!
+  createControlAuditMapping(
+    input: CreateControlAuditMappingInput!
+  ): CreateControlAuditMappingPayload!
+  deleteControlAuditMapping(
+    input: DeleteControlAuditMappingInput!
+  ): DeleteControlAuditMappingPayload!
 
   # Task mutations
   createTask(input: CreateTaskInput!): CreateTaskPayload!
@@ -1987,6 +2011,16 @@ input DeleteControlDocumentMappingInput {
   documentId: ID!
 }
 
+input CreateControlAuditMappingInput {
+  controlId: ID!
+  auditId: ID!
+}
+
+input DeleteControlAuditMappingInput {
+  controlId: ID!
+  auditId: ID!
+}
+
 input CreateRiskInput {
   organizationId: ID!
   name: String!
@@ -2352,6 +2386,16 @@ type DeleteControlDocumentMappingPayload {
   deletedDocumentId: ID!
 }
 
+type CreateControlAuditMappingPayload {
+  controlEdge: ControlEdge!
+  auditEdge: AuditEdge!
+}
+
+type DeleteControlAuditMappingPayload {
+  deletedControlId: ID!
+  deletedAuditId: ID!
+}
+
 type CreateRiskPayload {
   riskEdge: RiskEdge!
 }

pkg/server/api/console/v1/types/types.go

@@ -66,6 +66,7 @@ type Audit struct {
 	Report            *Report             `json:"report,omitempty"`
 	ReportURL         *string             `json:"reportUrl,omitempty"`
 	State             coredata.AuditState `json:"state"`
+	Controls          *ControlConnection  `json:"controls"`
 	ShowOnTrustCenter bool                `json:"showOnTrustCenter"`
 	CreatedAt         time.Time           `json:"createdAt"`
 	UpdatedAt         time.Time           `json:"updatedAt"`
@@ -150,6 +151,7 @@ type Control struct {
 	Framework              *Framework             `json:"framework"`
 	Measures               *MeasureConnection     `json:"measures"`
 	Documents              *DocumentConnection    `json:"documents"`
+	Audits                 *AuditConnection       `json:"audits"`
 	CreatedAt              time.Time              `json:"createdAt"`
 	UpdatedAt              time.Time              `json:"updatedAt"`
 }
@@ -194,6 +196,16 @@ type CreateAuditPayload struct {
 	AuditEdge *AuditEdge `json:"auditEdge"`
 }
 
+type CreateControlAuditMappingInput struct {
+	ControlID gid.GID `json:"controlId"`
+	AuditID   gid.GID `json:"auditId"`
+}
+
+type CreateControlAuditMappingPayload struct {
+	ControlEdge *ControlEdge `json:"controlEdge"`
+	AuditEdge   *AuditEdge   `json:"auditEdge"`
+}
+
 type CreateControlDocumentMappingInput struct {
 	ControlID  gid.GID `json:"controlId"`
 	DocumentID gid.GID `json:"documentId"`
@@ -473,6 +485,16 @@ type DeleteAuditReportPayload struct {
 	Audit *Audit `json:"audit"`
 }
 
+type DeleteControlAuditMappingInput struct {
+	ControlID gid.GID `json:"controlId"`
+	AuditID   gid.GID `json:"auditId"`
+}
+
+type DeleteControlAuditMappingPayload struct {
+	DeletedControlID gid.GID `json:"deletedControlId"`
+	DeletedAuditID   gid.GID `json:"deletedAuditId"`
+}
+
 type DeleteControlDocumentMappingInput struct {
 	ControlID  gid.GID `json:"controlId"`
 	DocumentID gid.GID `json:"documentId"`

pkg/server/api/console/v1/v1_resolver.go

@@ -179,6 +179,36 @@ func (r *auditResolver) ReportURL(ctx context.Context, obj *types.Audit) (*strin
 	return url, nil
 }
 
+// Controls is the resolver for the controls field.
+func (r *auditResolver) Controls(ctx context.Context, obj *types.Audit, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy, filter *types.ControlFilter) (*types.ControlConnection, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	pageOrderBy := page.OrderBy[coredata.ControlOrderField]{
+		Field:     coredata.ControlOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.ControlOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	var controlFilter = coredata.NewControlFilter(nil)
+	if filter != nil {
+		controlFilter = coredata.NewControlFilter(filter.Query)
+	}
+
+	page, err := prb.Controls.ListForAuditID(ctx, obj.ID, cursor, controlFilter)
+	if err != nil {
+		return nil, fmt.Errorf("cannot list audit controls: %w", err)
+	}
+
+	return types.NewControlConnection(page, r, obj.ID, controlFilter), nil
+}
+
 // TotalCount is the resolver for the totalCount field.
 func (r *auditConnectionResolver) TotalCount(ctx context.Context, obj *types.AuditConnection) (int, error) {
 	prb := r.ProboService(ctx, obj.ParentID.TenantID())
@@ -267,6 +297,31 @@ func (r *controlResolver) Documents(ctx context.Context, obj *types.Control, fir
 	return types.NewDocumentConnection(page, r, obj.ID, documentFilter), nil
 }
 
+// Audits is the resolver for the audits field.
+func (r *controlResolver) Audits(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AuditOrderBy) (*types.AuditConnection, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	pageOrderBy := page.OrderBy[coredata.AuditOrderField]{
+		Field:     coredata.AuditOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.AuditOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	page, err := prb.Audits.ListForControlID(ctx, obj.ID, cursor)
+	if err != nil {
+		return nil, fmt.Errorf("cannot list control audits: %w", err)
+	}
+
+	return types.NewAuditConnection(page, r, obj.ID), nil
+}
+
 // TotalCount is the resolver for the totalCount field.
 func (r *controlConnectionResolver) TotalCount(ctx context.Context, obj *types.ControlConnection) (int, error) {
 	prb := r.ProboService(ctx, obj.ParentID.TenantID())
@@ -1598,6 +1653,36 @@ func (r *mutationResolver) DeleteControlDocumentMapping(ctx context.Context, inp
 	}, nil
 }
 
+// CreateControlAuditMapping is the resolver for the createControlAuditMapping field.
+func (r *mutationResolver) CreateControlAuditMapping(ctx context.Context, input types.CreateControlAuditMappingInput) (*types.CreateControlAuditMappingPayload, error) {
+	prb := r.ProboService(ctx, input.AuditID.TenantID())
+
+	control, audit, err := prb.Controls.CreateAuditMapping(ctx, input.ControlID, input.AuditID)
+	if err != nil {
+		return nil, fmt.Errorf("cannot create control audit mapping: %w", err)
+	}
+
+	return &types.CreateControlAuditMappingPayload{
+		ControlEdge: types.NewControlEdge(control, coredata.ControlOrderFieldCreatedAt),
+		AuditEdge:   types.NewAuditEdge(audit, coredata.AuditOrderFieldCreatedAt),
+	}, nil
+}
+
+// DeleteControlAuditMapping is the resolver for the deleteControlAuditMapping field.
+func (r *mutationResolver) DeleteControlAuditMapping(ctx context.Context, input types.DeleteControlAuditMappingInput) (*types.DeleteControlAuditMappingPayload, error) {
+	prb := r.ProboService(ctx, input.AuditID.TenantID())
+
+	control, audit, err := prb.Controls.DeleteAuditMapping(ctx, input.ControlID, input.AuditID)
+	if err != nil {
+		return nil, fmt.Errorf("cannot delete control audit mapping: %w", err)
+	}
+
+	return &types.DeleteControlAuditMappingPayload{
+		DeletedControlID: control.ID,
+		DeletedAuditID:   audit.ID,
+	}, nil
+}
+
 // CreateTask is the resolver for the createTask field.
 func (r *mutationResolver) CreateTask(ctx context.Context, input types.CreateTaskInput) (*types.CreateTaskPayload, error) {
 	prb := r.ProboService(ctx, input.MeasureID.TenantID())