Add risk list and create risk

Signed-off-by: gearnode <bryan@frimin.fr>

pkg/coredata/entity_type_reg.go

@@ -20,14 +20,15 @@ const (
 	MitigationEntityType
 	TaskEntityType
 	EvidenceEntityType
-	ControlStateTransitionEntityType
-	TaskStateTransitionEntityType
+	_ControlStateTransitionEntityType
+	_TaskStateTransitionEntityType
 	VendorEntityType
 	PeopleEntityType
-	EvidenceStateTransitionEntityType
+	_EvidenceStateTransitionEntityType
 	PolicyEntityType
 	UserEntityType
 	SessionEntityType
 	EmailEntityType
 	ControlEntityType
+	RiskEntityType
 )

pkg/coredata/migrations/20250330T163200Z.sql

@@ -0,0 +1,9 @@
+CREATE TABLE risks (
+    id TEXT PRIMARY KEY, 
+    tenant_id TEXT NOT NULL,
+    organization_id TEXT NOT NULL REFERENCES organizations(id),
+    name TEXT NOT NULL,
+    description TEXT,
+    created_at TIMESTAMP NOT NULL,
+    updated_at TIMESTAMP NOT NULL
+);

pkg/coredata/risk.go

@@ -0,0 +1,198 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/page"
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+)
+
+type (
+	Risk struct {
+		ID             gid.GID
+		OrganizationID gid.GID
+		Name           string
+		Description    string
+		CreatedAt      time.Time
+		UpdatedAt      time.Time
+	}
+
+	Risks []*Risk
+)
+
+func (r *Risk) CursorKey(orderBy RiskOrderField) page.CursorKey {
+	switch orderBy {
+	case RiskOrderFieldCreatedAt:
+		return page.CursorKey{ID: r.ID, Value: r.CreatedAt}
+	}
+
+	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
+}
+
+func (r *Risks) LoadByOrganizationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+	cursor *page.Cursor[RiskOrderField],
+) error {
+	q := `
+SELECT
+	id,
+	organization_id,
+	name,
+	description,
+	created_at,
+	updated_at
+FROM risks
+WHERE %s
+	AND organization_id = @organization_id
+	AND %s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.NamedArgs{"organization_id": organizationID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query risks: %w", err)
+	}
+
+	risks, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Risk])
+	if err != nil {
+		return fmt.Errorf("cannot collect risks: %w", err)
+	}
+
+	*r = risks
+
+	return nil
+}
+
+func (r *Risk) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	riskID gid.GID,
+) error {
+	q := `
+SELECT
+	id,
+	organization_id,
+	name,
+	description,
+	created_at,
+	updated_at
+FROM risks
+WHERE %s
+	AND id = @id
+LIMIT 1;
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": r.ID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query risk: %w", err)
+	}
+
+	risk, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Risk])
+	if err != nil {
+		return fmt.Errorf("cannot collect risk: %w", err)
+	}
+
+	*r = risk
+
+	return nil
+}
+
+func (r *Risk) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO risks (id, tenant_id, organization_id, name, description, created_at, updated_at)
+VALUES (@id, @tenant_id, @organization_id, @name, @description, @created_at, @updated_at)
+`
+
+	args := pgx.StrictNamedArgs{
+		"id":              r.ID,
+		"tenant_id":       scope.GetTenantID(),
+		"organization_id": r.OrganizationID,
+		"name":            r.Name,
+		"description":     r.Description,
+		"created_at":      r.CreatedAt,
+		"updated_at":      r.UpdatedAt,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}
+
+func (r *Risk) Update(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+UPDATE risks
+SET
+	name = @name,
+	description = @description,
+	updated_at = @updated_at
+WHERE %s
+	AND tenant_id = @tenant_id
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"name":        r.Name,
+		"description": r.Description,
+		"updated_at":  r.UpdatedAt,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}
+
+func (r *Risk) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+DELETE FROM risks WHERE %s AND id = @id
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"id": r.ID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}

pkg/coredata/risk_order_field.go

@@ -0,0 +1,40 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+type (
+	RiskOrderField string
+)
+
+const (
+	RiskOrderFieldCreatedAt RiskOrderField = "CREATED_AT"
+)
+
+func (p RiskOrderField) Column() string {
+	return string(p)
+}
+
+func (p RiskOrderField) String() string {
+	return string(p)
+}
+
+func (p RiskOrderField) MarshalText() ([]byte, error) {
+	return []byte(p.String()), nil
+}
+
+func (p *RiskOrderField) UnmarshalText(text []byte) error {
+	*p = RiskOrderField(text)
+	return nil
+}

pkg/probo/risk_service.go

@@ -0,0 +1,173 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package probo
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/getprobo/probo/pkg/coredata"
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/page"
+	"go.gearno.de/kit/pg"
+)
+
+type (
+	RiskService struct {
+		svc *TenantService
+	}
+
+	CreateRiskRequest struct {
+		OrganizationID gid.GID
+		Name           string
+		Description    string
+	}
+
+	UpdateRiskRequest struct {
+		ID          gid.GID
+		Name        *string
+		Description *string
+	}
+)
+
+func (s RiskService) Create(
+	ctx context.Context,
+	req CreateRiskRequest,
+) (*coredata.Risk, error) {
+	now := time.Now()
+	riskID, err := gid.NewGID(s.svc.scope.GetTenantID(), coredata.RiskEntityType)
+	if err != nil {
+		return nil, fmt.Errorf("cannot create global id: %w", err)
+	}
+
+	risk := &coredata.Risk{
+		ID:             riskID,
+		OrganizationID: req.OrganizationID,
+		Name:           req.Name,
+		Description:    req.Description,
+		CreatedAt:      now,
+		UpdatedAt:      now,
+	}
+
+	err = s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return risk.Insert(ctx, conn, s.svc.scope)
+		},
+	)
+
+	if err != nil {
+		return nil, fmt.Errorf("cannot create risk: %w", err)
+	}
+
+	return risk, nil
+}
+
+func (s RiskService) Get(
+	ctx context.Context,
+	riskID gid.GID,
+) (*coredata.Risk, error) {
+	risk := &coredata.Risk{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return risk.LoadByID(ctx, conn, s.svc.scope, riskID)
+		},
+	)
+
+	if err != nil {
+		return nil, fmt.Errorf("cannot get risk: %w", err)
+	}
+
+	return risk, nil
+}
+
+func (s RiskService) Update(
+	ctx context.Context,
+	req UpdateRiskRequest,
+) (*coredata.Risk, error) {
+	risk := &coredata.Risk{ID: req.ID}
+
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := risk.LoadByID(ctx, conn, s.svc.scope, req.ID); err != nil {
+				return fmt.Errorf("cannot load risk: %w", err)
+			}
+
+			if req.Name != nil {
+				risk.Name = *req.Name
+			}
+
+			if req.Description != nil {
+				risk.Description = *req.Description
+			}
+
+			if err := risk.Update(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot update risk: %w", err)
+			}
+
+			return nil
+		},
+	)
+	if err != nil {
+		return nil, fmt.Errorf("cannot update risk: %w", err)
+	}
+
+	return risk, nil
+}
+
+func (s RiskService) Delete(
+	ctx context.Context,
+	riskID gid.GID,
+) error {
+	risk := &coredata.Risk{ID: riskID}
+
+	return s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return risk.Delete(ctx, conn, s.svc.scope)
+		},
+	)
+}
+
+func (s RiskService) ListForOrganizationID(
+	ctx context.Context,
+	organizationID gid.GID,
+	cursor *page.Cursor[coredata.RiskOrderField],
+) (*page.Page[*coredata.Risk, coredata.RiskOrderField], error) {
+	var risks coredata.Risks
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return risks.LoadByOrganizationID(
+				ctx,
+				conn,
+				s.svc.scope,
+				organizationID,
+				cursor,
+			)
+		},
+	)
+
+	if err != nil {
+		return nil, fmt.Errorf("cannot list risks: %w", err)
+	}
+
+	return page.NewPage(risks, cursor), nil
+}

pkg/probo/service.go

@@ -47,6 +47,7 @@ type (
 		Peoples       *PeopleService
 		Policies      *PolicyService
 		Controls      *ControlService
+		Risks         *RiskService
 	}
 )
 
@@ -86,6 +87,7 @@ func (s *Service) WithTenant(tenantID gid.TenantID) *TenantService {
 	tenantService.Policies = &PolicyService{svc: tenantService}
 	tenantService.Organizations = &OrganizationService{svc: tenantService}
 	tenantService.Controls = &ControlService{svc: tenantService}
+	tenantService.Risks = &RiskService{svc: tenantService}
 
 	return tenantService
 }

pkg/server/api/console/v1/schema.graphql

@@ -215,6 +215,14 @@ enum PolicyOrderField
   NAME
 }
 
+enum RiskOrderField
+  @goModel(model: "github.com/getprobo/probo/pkg/coredata.RiskOrderField") {
+  CREATED_AT
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.RiskOrderFieldCreatedAt"
+    )
+}
+
 enum EvidenceOrderField
   @goModel(model: "github.com/getprobo/probo/pkg/coredata.EvidenceOrderField") {
   CREATED_AT
@@ -291,6 +299,14 @@ input PolicyOrder
   field: PolicyOrderField!
 }
 
+input RiskOrder
+  @goModel(
+    model: "github.com/getprobo/probo/pkg/server/api/console/v1/types.RiskOrderBy"
+  ) {
+  direction: OrderDirection!
+  field: RiskOrderField!
+}
+
 input EvidenceOrder
   @goModel(
     model: "github.com/getprobo/probo/pkg/server/api/console/v1/types.EvidenceOrderBy"
@@ -358,6 +374,14 @@ type Organization implements Node {
     orderBy: MitigationOrder
   ): MitigationConnection! @goField(forceResolver: true)
 
+  risks(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: RiskOrder
+  ): RiskConnection! @goField(forceResolver: true)
+
   createdAt: Datetime!
   updatedAt: Datetime!
 }
@@ -487,6 +511,14 @@ type Policy implements Node {
   updatedAt: Datetime!
 }
 
+type Risk implements Node {
+  id: ID!
+  name: String!
+  description: String!
+  createdAt: Datetime!
+  updatedAt: Datetime!
+}
+
 type Session {
   id: ID!
   expiresAt: Datetime!
@@ -606,6 +638,16 @@ type PolicyEdge {
   node: Policy!
 }
 
+type RiskConnection {
+  edges: [RiskEdge!]!
+  pageInfo: PageInfo!
+}
+
+type RiskEdge {
+  cursor: CursorKey!
+  node: Risk!
+}
+
 # Root Types
 type Query {
   node(id: ID!): Node!
@@ -657,6 +699,11 @@ type Mutation {
   assignTask(input: AssignTaskInput!): AssignTaskPayload!
   unassignTask(input: UnassignTaskInput!): UnassignTaskPayload!
 
+  # Risk mutations
+  createRisk(input: CreateRiskInput!): CreateRiskPayload!
+  updateRisk(input: UpdateRiskInput!): UpdateRiskPayload!
+  deleteRisk(input: DeleteRiskInput!): DeleteRiskPayload!
+
   # Evidence mutations
   uploadEvidence(input: UploadEvidenceInput!): UploadEvidencePayload!
   deleteEvidence(input: DeleteEvidenceInput!): DeleteEvidencePayload!
@@ -804,6 +851,22 @@ input UnassignTaskInput {
   taskId: ID!
 }
 
+input CreateRiskInput {
+  organizationId: ID!
+  name: String!
+  description: String!
+}
+
+input UpdateRiskInput {
+  id: ID!
+  name: String
+  description: String
+}
+
+input DeleteRiskInput {
+  riskId: ID!
+}
+
 input UploadEvidenceInput {
   taskId: ID!
   name: String!
@@ -939,6 +1002,18 @@ type UnassignTaskPayload {
   task: Task!
 }
 
+type CreateRiskPayload {
+  riskEdge: RiskEdge!
+}
+
+type UpdateRiskPayload {
+  risk: Risk!
+}
+
+type DeleteRiskPayload {
+  deletedRiskId: ID!
+}
+
 type UploadEvidencePayload {
   evidenceEdge: EvidenceEdge!
 }

pkg/server/api/console/v1/types/risk.go

@@ -0,0 +1,54 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"github.com/getprobo/probo/pkg/coredata"
+	"github.com/getprobo/probo/pkg/page"
+)
+
+type (
+	RiskOrderBy OrderBy[coredata.RiskOrderField]
+)
+
+func NewRiskConnection(p *page.Page[*coredata.Risk, coredata.RiskOrderField]) *RiskConnection {
+	var edges = make([]*RiskEdge, len(p.Data))
+
+	for i := range edges {
+		edges[i] = NewRiskEdge(p.Data[i], p.Cursor.OrderBy.Field)
+	}
+
+	return &RiskConnection{
+		Edges:    edges,
+		PageInfo: NewPageInfo(p),
+	}
+}
+
+func NewRiskEdge(r *coredata.Risk, orderBy coredata.RiskOrderField) *RiskEdge {
+	return &RiskEdge{
+		Cursor: r.CursorKey(orderBy),
+		Node:   NewRisk(r),
+	}
+}
+
+func NewRisk(r *coredata.Risk) *Risk {
+	return &Risk{
+		ID:          r.ID,
+		Name:        r.Name,
+		Description: r.Description,
+		CreatedAt:   r.CreatedAt,
+		UpdatedAt:   r.UpdatedAt,
+	}
+}

pkg/server/api/console/v1/types/types.go

@@ -113,6 +113,16 @@ type CreatePolicyPayload struct {
 	PolicyEdge *PolicyEdge `json:"policyEdge"`
 }
 
+type CreateRiskInput struct {
+	OrganizationID gid.GID `json:"organizationId"`
+	Name           string  `json:"name"`
+	Description    string  `json:"description"`
+}
+
+type CreateRiskPayload struct {
+	RiskEdge *RiskEdge `json:"riskEdge"`
+}
+
 type CreateTaskInput struct {
 	MitigationID gid.GID        `json:"mitigationId"`
 	Name         string         `json:"name"`
@@ -182,6 +192,14 @@ type DeletePolicyPayload struct {
 	DeletedPolicyID gid.GID `json:"deletedPolicyId"`
 }
 
+type DeleteRiskInput struct {
+	RiskID gid.GID `json:"riskId"`
+}
+
+type DeleteRiskPayload struct {
+	DeletedRiskID gid.GID `json:"deletedRiskId"`
+}
+
 type DeleteTaskInput struct {
 	TaskID gid.GID `json:"taskId"`
 }
@@ -313,6 +331,7 @@ type Organization struct {
 	Peoples     *PeopleConnection     `json:"peoples"`
 	Policies    *PolicyConnection     `json:"policies"`
 	Mitigations *MitigationConnection `json:"mitigations"`
+	Risks       *RiskConnection       `json:"risks"`
 	CreatedAt   time.Time             `json:"createdAt"`
 	UpdatedAt   time.Time             `json:"updatedAt"`
 }
@@ -401,6 +420,27 @@ type RemoveUserPayload struct {
 	Success bool `json:"success"`
 }
 
+type Risk struct {
+	ID          gid.GID   `json:"id"`
+	Name        string    `json:"name"`
+	Description string    `json:"description"`
+	CreatedAt   time.Time `json:"createdAt"`
+	UpdatedAt   time.Time `json:"updatedAt"`
+}
+
+func (Risk) IsNode()             {}
+func (this Risk) GetID() gid.GID { return this.ID }
+
+type RiskConnection struct {
+	Edges    []*RiskEdge `json:"edges"`
+	PageInfo *PageInfo   `json:"pageInfo"`
+}
+
+type RiskEdge struct {
+	Cursor page.CursorKey `json:"cursor"`
+	Node   *Risk          `json:"node"`
+}
+
 type Session struct {
 	ID        gid.GID   `json:"id"`
 	ExpiresAt time.Time `json:"expiresAt"`
@@ -497,6 +537,16 @@ type UpdatePolicyPayload struct {
 	Policy *Policy `json:"policy"`
 }
 
+type UpdateRiskInput struct {
+	ID          gid.GID `json:"id"`
+	Name        *string `json:"name,omitempty"`
+	Description *string `json:"description,omitempty"`
+}
+
+type UpdateRiskPayload struct {
+	Risk *Risk `json:"risk"`
+}
+
 type UpdateTaskInput struct {
 	TaskID       gid.GID             `json:"taskId"`
 	Name         *string             `json:"name,omitempty"`

pkg/server/api/console/v1/v1_resolver.go

@@ -457,7 +457,7 @@ func (r *mutationResolver) CreateTask(ctx context.Context, input types.CreateTas
 		TimeEstimate: input.TimeEstimate,
 	})
 	if err != nil {
-		return nil, fmt.Errorf("cannot create task: %w", err)
+		panic(fmt.Errorf("cannot create task: %w", err))
 	}
 
 	return &types.CreateTaskPayload{
@@ -477,7 +477,7 @@ func (r *mutationResolver) UpdateTask(ctx context.Context, input types.UpdateTas
 		TimeEstimate: input.TimeEstimate,
 	})
 	if err != nil {
-		return nil, fmt.Errorf("cannot update task: %w", err)
+		panic(fmt.Errorf("cannot update task: %w", err))
 	}
 
 	return &types.UpdateTaskPayload{
@@ -491,7 +491,7 @@ func (r *mutationResolver) DeleteTask(ctx context.Context, input types.DeleteTas
 
 	err := svc.Tasks.Delete(ctx, input.TaskID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot delete task: %w", err)
+		panic(fmt.Errorf("cannot delete task: %w", err))
 	}
 
 	return &types.DeleteTaskPayload{
@@ -505,7 +505,7 @@ func (r *mutationResolver) AssignTask(ctx context.Context, input types.AssignTas
 
 	task, err := svc.Tasks.Assign(ctx, input.TaskID, input.AssignedToID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot assign task: %w", err)
+		panic(fmt.Errorf("cannot assign task: %w", err))
 	}
 
 	return &types.AssignTaskPayload{
@@ -519,7 +519,7 @@ func (r *mutationResolver) UnassignTask(ctx context.Context, input types.Unassig
 
 	task, err := svc.Tasks.Unassign(ctx, input.TaskID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot unassign task: %w", err)
+		panic(fmt.Errorf("cannot unassign task: %w", err))
 	}
 
 	return &types.UnassignTaskPayload{
@@ -527,6 +527,62 @@ func (r *mutationResolver) UnassignTask(ctx context.Context, input types.Unassig
 	}, nil
 }
 
+// CreateRisk is the resolver for the createRisk field.
+func (r *mutationResolver) CreateRisk(ctx context.Context, input types.CreateRiskInput) (*types.CreateRiskPayload, error) {
+	svc := r.GetTenantServiceIfAuthorized(ctx, input.OrganizationID.TenantID())
+
+	risk, err := svc.Risks.Create(
+		ctx,
+		probo.CreateRiskRequest{
+			OrganizationID: input.OrganizationID,
+			Name:           input.Name,
+			Description:    input.Description,
+		},
+	)
+	if err != nil {
+		panic(fmt.Errorf("cannot create risk: %w", err))
+	}
+
+	return &types.CreateRiskPayload{
+		RiskEdge: types.NewRiskEdge(risk, coredata.RiskOrderFieldCreatedAt),
+	}, nil
+}
+
+// UpdateRisk is the resolver for the updateRisk field.
+func (r *mutationResolver) UpdateRisk(ctx context.Context, input types.UpdateRiskInput) (*types.UpdateRiskPayload, error) {
+	svc := r.GetTenantServiceIfAuthorized(ctx, input.ID.TenantID())
+
+	risk, err := svc.Risks.Update(
+		ctx,
+		probo.UpdateRiskRequest{
+			ID:          input.ID,
+			Name:        input.Name,
+			Description: input.Description,
+		},
+	)
+	if err != nil {
+		panic(fmt.Errorf("cannot update risk: %w", err))
+	}
+
+	return &types.UpdateRiskPayload{
+		Risk: types.NewRisk(risk),
+	}, nil
+}
+
+// DeleteRisk is the resolver for the deleteRisk field.
+func (r *mutationResolver) DeleteRisk(ctx context.Context, input types.DeleteRiskInput) (*types.DeleteRiskPayload, error) {
+	svc := r.GetTenantServiceIfAuthorized(ctx, input.RiskID.TenantID())
+
+	err := svc.Risks.Delete(ctx, input.RiskID)
+	if err != nil {
+		panic(fmt.Errorf("cannot delete risk: %w", err))
+	}
+
+	return &types.DeleteRiskPayload{
+		DeletedRiskID: input.RiskID,
+	}, nil
+}
+
 // UploadEvidence is the resolver for the uploadEvidence field.
 func (r *mutationResolver) UploadEvidence(ctx context.Context, input types.UploadEvidenceInput) (*types.UploadEvidencePayload, error) {
 	svc := r.GetTenantServiceIfAuthorized(ctx, input.TaskID.TenantID())
@@ -790,6 +846,31 @@ func (r *organizationResolver) Mitigations(ctx context.Context, obj *types.Organ
 	return types.NewMitigationConnection(page), nil
 }
 
+// Risks is the resolver for the risks field.
+func (r *organizationResolver) Risks(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskOrderBy) (*types.RiskConnection, error) {
+	svc := r.GetTenantServiceIfAuthorized(ctx, obj.ID.TenantID())
+
+	pageOrderBy := page.OrderBy[coredata.RiskOrderField]{
+		Field:     coredata.RiskOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.RiskOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	page, err := svc.Risks.ListForOrganizationID(ctx, obj.ID, cursor)
+	if err != nil {
+		panic(fmt.Errorf("cannot list organization risks: %w", err))
+	}
+
+	return types.NewRiskConnection(page), nil
+}
+
 // Owner is the resolver for the owner field.
 func (r *policyResolver) Owner(ctx context.Context, obj *types.Policy) (*types.People, error) {
 	svc := r.GetTenantServiceIfAuthorized(ctx, obj.ID.TenantID())
@@ -875,6 +956,12 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 		}
 
 		return types.NewControl(control), nil
+	case coredata.RiskEntityType:
+		risk, err := svc.Risks.Get(ctx, id)
+		if err != nil {
+			return nil, err
+		}
+		return types.NewRisk(risk), nil
 	default:
 	}