Improve data isolation for policy and vendor

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/probo/policy_service.go

@@ -127,10 +127,11 @@ func (s *PolicyService) Create(
 	policyID := gid.New(s.svc.scope.GetTenantID(), coredata.PolicyEntityType)
 	policyVersionID := gid.New(s.svc.scope.GetTenantID(), coredata.PolicyVersionEntityType)
 
+	organization := &coredata.Organization{}
+	people := &coredata.People{}
+
 	policy := &coredata.Policy{
 		ID:        policyID,
-		OrganizationID: req.OrganizationID,
-		OwnerID:        req.OwnerID,
 		Title:     req.Title,
 		CreatedAt: now,
 		UpdatedAt: now,
@@ -149,6 +150,17 @@ func (s *PolicyService) Create(
 	err := s.svc.pg.WithTx(
 		ctx,
 		func(conn pg.Conn) error {
+			if err := organization.LoadByID(ctx, conn, s.svc.scope, req.OrganizationID); err != nil {
+				return fmt.Errorf("cannot load organization: %w", err)
+			}
+
+			if err := people.LoadByID(ctx, conn, s.svc.scope, req.OwnerID); err != nil {
+				return fmt.Errorf("cannot load people: %w", err)
+			}
+
+			policy.OrganizationID = organization.ID
+			policy.OwnerID = people.ID
+
 			if err := policy.Insert(ctx, conn, s.svc.scope); err != nil {
 				return fmt.Errorf("cannot insert policy: %w", err)
 			}

pkg/probo/vendor_service.go

@@ -86,15 +86,20 @@ func (s VendorService) ListForOrganizationID(
 	cursor *page.Cursor[coredata.VendorOrderField],
 ) (*page.Page[*coredata.Vendor, coredata.VendorOrderField], error) {
 	var vendors coredata.Vendors
+	organization := &coredata.Organization{}
 
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(conn pg.Conn) error {
+			if err := organization.LoadByID(ctx, conn, s.svc.scope, organizationID); err != nil {
+				return fmt.Errorf("cannot load organization: %w", err)
+			}
+
 			return vendors.LoadByOrganizationID(
 				ctx,
 				conn,
 				s.svc.scope,
-				organizationID,
+				organization.ID,
 				cursor,
 			)
 		},
@@ -192,12 +197,22 @@ func (s VendorService) Update(
 				vendor.TrustPageURL = req.TrustPageURL
 			}
 
+			businessOwner := &coredata.People{}
+			if err := businessOwner.LoadByID(ctx, conn, s.svc.scope, *req.BusinessOwnerID); err != nil {
+				return fmt.Errorf("cannot load business owner: %w", err)
+			}
+
 			if req.BusinessOwnerID != nil {
-				vendor.BusinessOwnerID = req.BusinessOwnerID
+				vendor.BusinessOwnerID = &businessOwner.ID
+			}
+
+			securityOwner := &coredata.People{}
+			if err := securityOwner.LoadByID(ctx, conn, s.svc.scope, *req.SecurityOwnerID); err != nil {
+				return fmt.Errorf("cannot load security owner: %w", err)
 			}
 
 			if req.SecurityOwnerID != nil {
-				vendor.SecurityOwnerID = req.SecurityOwnerID
+				vendor.SecurityOwnerID = &securityOwner.ID
 			}
 
 			vendor.UpdatedAt = time.Now()
@@ -255,12 +270,13 @@ func (s VendorService) Create(
 	req CreateVendorRequest,
 ) (*coredata.Vendor, error) {
 	now := time.Now()
-	vendorID := gid.New(s.svc.scope.GetTenantID(), coredata.VendorEntityType)
+	var vendor *coredata.Vendor
 
-	organization := &coredata.Organization{}
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
 			vendor := &coredata.Vendor{
-		ID:                         vendorID,
+				ID:                         gid.New(s.svc.scope.GetTenantID(), coredata.VendorEntityType),
-		OrganizationID:             req.OrganizationID,
 				Name:                       req.Name,
 				CreatedAt:                  now,
 				UpdatedAt:                  now,
@@ -278,19 +294,35 @@ func (s VendorService) Create(
 				TermsOfServiceURL:          req.TermsOfServiceURL,
 			}
 
+			organization := &coredata.Organization{}
+			if err := organization.LoadByID(ctx, conn, s.svc.scope, req.OrganizationID); err != nil {
+				return fmt.Errorf("cannot load organization %q: %w", req.OrganizationID, err)
+			}
+
+			vendor.OrganizationID = organization.ID
+
+			if req.BusinessOwnerID != nil {
+				businessOwner := &coredata.People{}
+				if err := businessOwner.LoadByID(ctx, conn, s.svc.scope, *req.BusinessOwnerID); err != nil {
+					return fmt.Errorf("cannot load business owner: %w", err)
+				}
+				vendor.BusinessOwnerID = &businessOwner.ID
+			}
+
+			if req.SecurityOwnerID != nil {
+				securityOwner := &coredata.People{}
+				if err := securityOwner.LoadByID(ctx, conn, s.svc.scope, *req.SecurityOwnerID); err != nil {
+					return fmt.Errorf("cannot load security owner: %w", err)
+				}
+				vendor.SecurityOwnerID = &securityOwner.ID
+			}
+
 			if req.Category != nil {
 				vendor.Category = *req.Category
 			} else {
 				vendor.Category = "Other"
 			}
 
-	err := s.svc.pg.WithTx(
-		ctx,
-		func(conn pg.Conn) error {
-			if err := organization.LoadByID(ctx, conn, s.svc.scope, req.OrganizationID); err != nil {
-				return fmt.Errorf("cannot load organization %q: %w", req.OrganizationID, err)
-			}
-
 			if err := vendor.Insert(ctx, conn, s.svc.scope); err != nil {
 				return fmt.Errorf("cannot insert vendor: %w", err)
 			}