Replace third-party owners with administrators

Migrate business and security owners into a shared administrators list across GraphQL, MCP, CLI, n8n, and the console.

Signed-off-by: Sacha Al Himdani <sacha@probo.com>

pkg/coredata/migrations/20260727T100635Z.sql

@@ -0,0 +1,70 @@
+-- Copyright (c) 2025-2026 Probo Inc <hello@probo.com>.
+--
+-- Permission is hereby granted, free of charge, to any person obtaining a copy
+-- of this software and associated documentation files (the "Software"), to deal
+-- in the Software without restriction, including without limitation the rights
+-- to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+-- copies of the Software, and to permit persons to whom the Software is
+-- furnished to do so, subject to the following conditions:
+--
+-- The above copyright notice and this permission notice shall be included in
+-- all copies or substantial portions of the Software.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+-- IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+-- FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+-- AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+-- LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+-- OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+-- SOFTWARE.
+
+CREATE TABLE third_party_administrators (
+    third_party_id            text                     NOT NULL,
+    administrator_profile_id  text                     NOT NULL,
+    tenant_id                 text                     NOT NULL,
+    organization_id           text                     NOT NULL,
+    created_at                timestamp with time zone NOT NULL,
+    updated_at                timestamp with time zone NOT NULL,
+    PRIMARY KEY (third_party_id, administrator_profile_id),
+    FOREIGN KEY (third_party_id) REFERENCES third_parties(id) ON UPDATE CASCADE ON DELETE CASCADE,
+    FOREIGN KEY (administrator_profile_id) REFERENCES iam_membership_profiles(id) ON UPDATE CASCADE ON DELETE RESTRICT
+);
+
+-- Migrate existing business and security owners into administrators (dedupe).
+INSERT INTO third_party_administrators (
+    third_party_id,
+    administrator_profile_id,
+    tenant_id,
+    organization_id,
+    created_at,
+    updated_at
+)
+SELECT
+    id,
+    business_owner_profile_id,
+    tenant_id,
+    organization_id,
+    created_at,
+    updated_at
+FROM third_parties
+WHERE business_owner_profile_id IS NOT NULL
+ON CONFLICT (third_party_id, administrator_profile_id) DO NOTHING;
+
+INSERT INTO third_party_administrators (
+    third_party_id,
+    administrator_profile_id,
+    tenant_id,
+    organization_id,
+    created_at,
+    updated_at
+)
+SELECT
+    id,
+    security_owner_profile_id,
+    tenant_id,
+    organization_id,
+    created_at,
+    updated_at
+FROM third_parties
+WHERE security_owner_profile_id IS NOT NULL
+ON CONFLICT (third_party_id, administrator_profile_id) DO NOTHING;

pkg/coredata/third_party.go

@@ -166,8 +166,6 @@ type (
 		SubprocessorsListURL          *string                  `db:"subprocessors_list_url"`
 		Certifications                []string                 `db:"certifications"`
 		Countries                     CountryCodes             `db:"countries"`
-		BusinessOwnerID               *gid.GID                 `db:"business_owner_profile_id"`
-		SecurityOwnerID               *gid.GID                 `db:"security_owner_profile_id"`
 		StatusPageURL                 *string                  `db:"status_page_url"`
 		TermsOfServiceURL             *string                  `db:"terms_of_service_url"`
 		SecurityPageURL               *string                  `db:"security_page_url"`
@@ -263,8 +261,6 @@ SELECT
     subprocessors_list_url,
     certifications,
     countries,
-    business_owner_profile_id,
-    security_owner_profile_id,
     status_page_url,
     terms_of_service_url,
     security_page_url,
@@ -336,8 +332,6 @@ SELECT
     subprocessors_list_url,
     certifications,
     countries,
-    business_owner_profile_id,
-    security_owner_profile_id,
     status_page_url,
     terms_of_service_url,
     security_page_url,
@@ -411,8 +405,6 @@ SELECT
     subprocessors_list_url,
     certifications,
     countries,
-    business_owner_profile_id,
-    security_owner_profile_id,
     status_page_url,
     terms_of_service_url,
     security_page_url,
@@ -489,8 +481,6 @@ SELECT
     subprocessors_list_url,
     certifications,
     countries,
-    business_owner_profile_id,
-    security_owner_profile_id,
     status_page_url,
     terms_of_service_url,
     security_page_url,
@@ -566,8 +556,6 @@ SELECT
     subprocessors_list_url,
     certifications,
     countries,
-    business_owner_profile_id,
-    security_owner_profile_id,
     status_page_url,
     terms_of_service_url,
     security_page_url,
@@ -638,8 +626,6 @@ INSERT INTO
         subprocessors_list_url,
         certifications,
         countries,
-        business_owner_profile_id,
-        security_owner_profile_id,
         status_page_url,
         terms_of_service_url,
         security_page_url,
@@ -673,8 +659,6 @@ VALUES (
     @subprocessors_list_url,
     @certifications,
     @countries,
-    @business_owner_profile_id,
-    @security_owner_profile_id,
     @status_page_url,
     @terms_of_service_url,
     @security_page_url,
@@ -710,8 +694,6 @@ VALUES (
 		"subprocessors_list_url":           v.SubprocessorsListURL,
 		"certifications":                   v.Certifications,
 		"countries":                        v.Countries,
-		"business_owner_profile_id":        v.BusinessOwnerID,
-		"security_owner_profile_id":        v.SecurityOwnerID,
 		"status_page_url":                  v.StatusPageURL,
 		"terms_of_service_url":             v.TermsOfServiceURL,
 		"security_page_url":                v.SecurityPageURL,
@@ -885,8 +867,6 @@ SELECT
 	subprocessors_list_url,
 	certifications,
 	countries,
-	business_owner_profile_id,
-	security_owner_profile_id,
 	status_page_url,
 	terms_of_service_url,
 	security_page_url,
@@ -957,8 +937,6 @@ SET
 	terms_of_service_url = @terms_of_service_url,
 	security_page_url = @security_page_url,
 	trust_page_url = @trust_page_url,
-	business_owner_profile_id = @business_owner_profile_id,
-	security_owner_profile_id = @security_owner_profile_id,
 	show_on_trust_center = @show_on_trust_center,
 	level = @level,
 	vetting_status = @vetting_status,
@@ -994,8 +972,6 @@ WHERE %s
 		"terms_of_service_url":             v.TermsOfServiceURL,
 		"security_page_url":                v.SecurityPageURL,
 		"trust_page_url":                   v.TrustPageURL,
-		"business_owner_profile_id":        v.BusinessOwnerID,
-		"security_owner_profile_id":        v.SecurityOwnerID,
 		"show_on_trust_center":             v.ShowOnCompliancePortal,
 		"level":                            v.Level,
 		"vetting_status":                   v.VettingStatus,
@@ -1121,8 +1097,6 @@ WITH vend AS (
 		v.subprocessors_list_url,
 		v.certifications,
 		v.countries,
-		v.business_owner_profile_id,
-		v.security_owner_profile_id,
 		v.status_page_url,
 		v.terms_of_service_url,
 		v.security_page_url,
@@ -1161,8 +1135,6 @@ SELECT
 	subprocessors_list_url,
 	certifications,
 	countries,
-	business_owner_profile_id,
-	security_owner_profile_id,
 	status_page_url,
 	terms_of_service_url,
 	security_page_url,
@@ -1270,8 +1242,6 @@ WITH vend AS (
 		v.subprocessors_list_url,
 		v.certifications,
 		v.countries,
-		v.business_owner_profile_id,
-		v.security_owner_profile_id,
 		v.status_page_url,
 		v.terms_of_service_url,
 		v.security_page_url,
@@ -1310,8 +1280,6 @@ SELECT
 	subprocessors_list_url,
 	certifications,
 	countries,
-	business_owner_profile_id,
-	security_owner_profile_id,
 	status_page_url,
 	terms_of_service_url,
 	security_page_url,
@@ -1379,8 +1347,6 @@ WITH vend AS (
 		v.subprocessors_list_url,
 		v.certifications,
 		v.countries,
-		v.business_owner_profile_id,
-		v.security_owner_profile_id,
 		v.status_page_url,
 		v.terms_of_service_url,
 		v.security_page_url,
@@ -1419,8 +1385,6 @@ SELECT
 	subprocessors_list_url,
 	certifications,
 	countries,
-	business_owner_profile_id,
-	security_owner_profile_id,
 	status_page_url,
 	terms_of_service_url,
 	security_page_url,
@@ -1555,8 +1519,6 @@ SELECT
 	subprocessors_list_url,
 	certifications,
 	countries,
-	business_owner_profile_id,
-	security_owner_profile_id,
 	status_page_url,
 	terms_of_service_url,
 	security_page_url,
@@ -1676,8 +1638,6 @@ WITH tps AS (
 		v.subprocessors_list_url,
 		v.certifications,
 		v.countries,
-		v.business_owner_profile_id,
-		v.security_owner_profile_id,
 		v.status_page_url,
 		v.terms_of_service_url,
 		v.security_page_url,
@@ -1716,8 +1676,6 @@ SELECT
 	subprocessors_list_url,
 	certifications,
 	countries,
-	business_owner_profile_id,
-	security_owner_profile_id,
 	status_page_url,
 	terms_of_service_url,
 	security_page_url,
@@ -1814,8 +1772,6 @@ WITH RECURSIVE ancestor_chain AS (
 		tp.subprocessors_list_url,
 		tp.certifications,
 		tp.countries,
-		tp.business_owner_profile_id,
-		tp.security_owner_profile_id,
 		tp.status_page_url,
 		tp.terms_of_service_url,
 		tp.security_page_url,
@@ -1859,8 +1815,6 @@ WITH RECURSIVE ancestor_chain AS (
 		tp.subprocessors_list_url,
 		tp.certifications,
 		tp.countries,
-		tp.business_owner_profile_id,
-		tp.security_owner_profile_id,
 		tp.status_page_url,
 		tp.terms_of_service_url,
 		tp.security_page_url,
@@ -1898,8 +1852,6 @@ SELECT
 	subprocessors_list_url,
 	certifications,
 	countries,
-	business_owner_profile_id,
-	security_owner_profile_id,
 	status_page_url,
 	terms_of_service_url,
 	security_page_url,
@@ -1965,8 +1917,6 @@ SELECT
 	subprocessors_list_url,
 	certifications,
 	countries,
-	business_owner_profile_id,
-	security_owner_profile_id,
 	status_page_url,
 	terms_of_service_url,
 	security_page_url,

pkg/coredata/third_party_administrator.go

@@ -0,0 +1,200 @@
+// Copyright (c) 2025-2026 Probo Inc <hello@probo.com>.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/gid"
+)
+
+type (
+	ThirdPartyAdministrator struct {
+		ThirdPartyID           gid.GID   `db:"third_party_id"`
+		AdministratorProfileID gid.GID   `db:"administrator_profile_id"`
+		OrganizationID         gid.GID   `db:"organization_id"`
+		CreatedAt              time.Time `db:"created_at"`
+		UpdatedAt              time.Time `db:"updated_at"`
+	}
+
+	ThirdPartyAdministrators []*ThirdPartyAdministrator
+)
+
+// LoadByThirdPartyID loads all administrators for a third party.
+func (as *ThirdPartyAdministrators) LoadByThirdPartyID(
+	ctx context.Context,
+	conn pg.Querier,
+	scope Scoper,
+	thirdPartyID gid.GID,
+) error {
+	q := `
+SELECT
+	third_party_id,
+	administrator_profile_id,
+	organization_id,
+	created_at,
+	updated_at
+FROM third_party_administrators
+WHERE
+	%s
+	AND third_party_id = @third_party_id
+ORDER BY created_at ASC, administrator_profile_id ASC;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"third_party_id": thirdPartyID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query third party administrators: %w", err)
+	}
+
+	result, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdPartyAdministrator])
+	if err != nil {
+		return fmt.Errorf("cannot collect third party administrators: %w", err)
+	}
+
+	*as = result
+
+	return nil
+}
+
+// LoadByThirdPartyIDs loads all administrators for the given third parties.
+func (as *ThirdPartyAdministrators) LoadByThirdPartyIDs(
+	ctx context.Context,
+	conn pg.Querier,
+	scope Scoper,
+	thirdPartyIDs []gid.GID,
+) error {
+	if len(thirdPartyIDs) == 0 {
+		*as = ThirdPartyAdministrators{}
+		return nil
+	}
+
+	q := `
+SELECT
+	third_party_id,
+	administrator_profile_id,
+	organization_id,
+	created_at,
+	updated_at
+FROM third_party_administrators
+WHERE
+	%s
+	AND third_party_id = ANY(@third_party_ids)
+ORDER BY created_at ASC, administrator_profile_id ASC;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"third_party_ids": thirdPartyIDs}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query third party administrators: %w", err)
+	}
+
+	result, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdPartyAdministrator])
+	if err != nil {
+		return fmt.Errorf("cannot collect third party administrators: %w", err)
+	}
+
+	*as = result
+
+	return nil
+}
+
+// MergeByThirdPartyID merges the given administrator profile IDs for a third party,
+// inserting new ones, keeping existing ones, and deleting removed ones.
+func (as *ThirdPartyAdministrators) MergeByThirdPartyID(
+	ctx context.Context,
+	conn pg.Tx,
+	scope Scoper,
+	thirdPartyID gid.GID,
+	organizationID gid.GID,
+	administratorProfileIDs []gid.GID,
+) error {
+	q := `
+MERGE INTO third_party_administrators AS target
+USING (
+	SELECT unnest(@administrator_profile_ids::text[]) AS administrator_profile_id
+) AS source
+ON
+	%[1]s
+	AND target.third_party_id = @third_party_id
+	AND target.administrator_profile_id = source.administrator_profile_id
+WHEN NOT MATCHED THEN
+	INSERT (third_party_id, administrator_profile_id, tenant_id, organization_id, created_at, updated_at)
+	VALUES (@third_party_id, source.administrator_profile_id, @tenant_id, @organization_id, @now, @now)
+WHEN NOT MATCHED BY SOURCE
+	AND %[1]s
+	AND target.third_party_id = @third_party_id THEN
+	DELETE;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	now := time.Now()
+
+	ids := make([]string, len(administratorProfileIDs))
+	for i, id := range administratorProfileIDs {
+		ids[i] = id.String()
+	}
+
+	args := pgx.StrictNamedArgs{
+		"third_party_id":            thirdPartyID,
+		"administrator_profile_ids": ids,
+		"tenant_id":                 scope.GetTenantID(),
+		"organization_id":           organizationID,
+		"now":                       now,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	if _, err := conn.Exec(ctx, q, args); err != nil {
+		return fmt.Errorf("cannot merge third party administrators: %w", err)
+	}
+
+	result := make(ThirdPartyAdministrators, 0, len(administratorProfileIDs))
+	for _, profileID := range administratorProfileIDs {
+		result = append(
+			result,
+			&ThirdPartyAdministrator{
+				ThirdPartyID:           thirdPartyID,
+				AdministratorProfileID: profileID,
+				OrganizationID:         organizationID,
+				CreatedAt:              now,
+				UpdatedAt:              now,
+			},
+		)
+	}
+
+	*as = result
+
+	return nil
+}

pkg/coredata/third_party_vetting.go

@@ -53,8 +53,6 @@ SELECT
     subprocessors_list_url,
     certifications,
     countries,
-    business_owner_profile_id,
-    security_owner_profile_id,
     status_page_url,
     terms_of_service_url,
     security_page_url,