Link measures to third parties

Add a many-to-many relationship between measures and third parties,
surfaced as a measures tab on the third party detail page and a third
parties tab on the measure detail page. Each side gets a paginated
list with a link/unlink dialog.

Also remove the right-hand drawer on the measure detail page and
expose the state as a badge in the page header, mirroring how the
compliance page surfaces its active flag.

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/server/api/console/v1/asset_resolvers.go

@@ -72,7 +72,7 @@ func (r *assetResolver) ThirdParties(ctx context.Context, obj *types.Asset, firs
 		return nil, gqlutils.Internal(ctx)
 	}
 
-	return types.NewThirdPartyConnection(page, r, obj.ID), nil
+	return types.NewThirdPartyConnection(page, r, obj.ID, nil), nil
 }
 
 // Organization is the resolver for the organization field.
@@ -177,7 +177,7 @@ func (r *datumResolver) ThirdParties(ctx context.Context, obj *types.Datum, firs
 		return nil, gqlutils.Internal(ctx)
 	}
 
-	return types.NewThirdPartyConnection(page, r, obj.ID), nil
+	return types.NewThirdPartyConnection(page, r, obj.ID, nil), nil
 }
 
 // Organization is the resolver for the organization field.

pkg/server/api/console/v1/graphql/measure.graphql

@@ -95,6 +95,14 @@ type Measure implements Node {
         filter: DocumentFilter
     ): DocumentConnection! @goField(forceResolver: true)
 
+    thirdParties(
+        first: Int
+        after: CursorKey
+        last: Int
+        before: CursorKey
+        orderBy: ThirdPartyOrder
+    ): ThirdPartyConnection! @goField(forceResolver: true)
+
     createdAt: Datetime!
     updatedAt: Datetime!
 
@@ -126,6 +134,12 @@ extend type Mutation {
     deleteMeasureDocumentMapping(
         input: DeleteMeasureDocumentMappingInput!
     ): DeleteMeasureDocumentMappingPayload!
+    createMeasureThirdPartyMapping(
+        input: CreateMeasureThirdPartyMappingInput!
+    ): CreateMeasureThirdPartyMappingPayload!
+    deleteMeasureThirdPartyMapping(
+        input: DeleteMeasureThirdPartyMappingInput!
+    ): DeleteMeasureThirdPartyMappingPayload!
 }
 
 input CreateMeasureInput {
@@ -187,3 +201,23 @@ type DeleteMeasureDocumentMappingPayload {
     deletedMeasureId: ID!
     deletedDocumentId: ID!
 }
+
+input CreateMeasureThirdPartyMappingInput {
+    measureId: ID!
+    thirdPartyId: ID!
+}
+
+input DeleteMeasureThirdPartyMappingInput {
+    measureId: ID!
+    thirdPartyId: ID!
+}
+
+type CreateMeasureThirdPartyMappingPayload {
+    measureEdge: MeasureEdge!
+    thirdPartyEdge: ThirdPartyEdge!
+}
+
+type DeleteMeasureThirdPartyMappingPayload {
+    deletedMeasureId: ID!
+    deletedThirdPartyId: ID!
+}

pkg/server/api/console/v1/graphql/third_party.graphql

@@ -179,6 +179,7 @@ input ThirdPartyOrder
 
 input ThirdPartyFilter {
     firstLevel: Boolean
+    query: String
 }
 
 input ThirdPartyComplianceReportOrder
@@ -255,6 +256,15 @@ type ThirdParty implements Node {
         orderBy: ThirdPartyRiskAssessmentOrder
     ): ThirdPartyRiskAssessmentConnection! @goField(forceResolver: true)
 
+    measures(
+        first: Int
+        after: CursorKey
+        last: Int
+        before: CursorKey
+        orderBy: MeasureOrder
+        filter: MeasureFilter
+    ): MeasureConnection! @goField(forceResolver: true)
+
     businessOwner: Profile @goField(forceResolver: true)
     securityOwner: Profile @goField(forceResolver: true)
 

pkg/server/api/console/v1/measure_resolvers.go

@@ -188,6 +188,35 @@ func (r *measureResolver) Documents(ctx context.Context, obj *types.Measure, fir
 	return types.NewDocumentConnection(pg, r, obj.ID, documentFilter), nil
 }
 
+// ThirdParties is the resolver for the thirdParties field.
+func (r *measureResolver) ThirdParties(ctx context.Context, obj *types.Measure, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ThirdPartyOrderBy) (*types.ThirdPartyConnection, error) {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyList)
+	if err != nil {
+		return nil, err
+	}
+
+	pageOrderBy := page.OrderBy[coredata.ThirdPartyOrderField]{
+		Field:     coredata.ThirdPartyOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.ThirdPartyOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	page, err := r.probo.ThirdParties.ListForMeasureID(ctx, scope, obj.ID, cursor)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot list measure third parties", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewThirdPartyConnection(page, r, obj.ID, nil), nil
+}
+
 // Permission is the resolver for the permission field.
 func (r *measureResolver) Permission(ctx context.Context, obj *types.Measure, action string) (bool, error) {
 	return r.Resolver.Permission(ctx, obj, action)
@@ -224,6 +253,14 @@ func (r *measureConnectionResolver) TotalCount(ctx context.Context, obj *types.M
 			return 0, gqlutils.Internal(ctx)
 		}
 
+		return count, nil
+	case *thirdPartyResolver:
+		count, err := r.probo.Measures.CountForThirdPartyID(ctx, scope, obj.ParentID, obj.Filters)
+		if err != nil {
+			r.logger.ErrorCtx(ctx, "cannot count measures", log.Error(err))
+			return 0, gqlutils.Internal(ctx)
+		}
+
 		return count, nil
 	}
 
@@ -388,6 +425,44 @@ func (r *mutationResolver) DeleteMeasureDocumentMapping(ctx context.Context, inp
 	}, nil
 }
 
+// CreateMeasureThirdPartyMapping is the resolver for the createMeasureThirdPartyMapping field.
+func (r *mutationResolver) CreateMeasureThirdPartyMapping(ctx context.Context, input types.CreateMeasureThirdPartyMappingInput) (*types.CreateMeasureThirdPartyMappingPayload, error) {
+	scope, err := r.authorize(ctx, input.MeasureID, probo.ActionMeasureThirdPartyMappingCreate)
+	if err != nil {
+		return nil, err
+	}
+
+	measure, thirdParty, err := r.probo.Measures.CreateThirdPartyMapping(ctx, scope, input.MeasureID, input.ThirdPartyID)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot create measure third party mapping", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return &types.CreateMeasureThirdPartyMappingPayload{
+		MeasureEdge:    types.NewMeasureEdge(measure, coredata.MeasureOrderFieldCreatedAt),
+		ThirdPartyEdge: types.NewThirdPartyEdge(thirdParty, coredata.ThirdPartyOrderFieldCreatedAt),
+	}, nil
+}
+
+// DeleteMeasureThirdPartyMapping is the resolver for the deleteMeasureThirdPartyMapping field.
+func (r *mutationResolver) DeleteMeasureThirdPartyMapping(ctx context.Context, input types.DeleteMeasureThirdPartyMappingInput) (*types.DeleteMeasureThirdPartyMappingPayload, error) {
+	scope, err := r.authorize(ctx, input.MeasureID, probo.ActionMeasureThirdPartyMappingDelete)
+	if err != nil {
+		return nil, err
+	}
+
+	measure, thirdParty, err := r.probo.Measures.DeleteThirdPartyMapping(ctx, scope, input.MeasureID, input.ThirdPartyID)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot delete measure third party mapping", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return &types.DeleteMeasureThirdPartyMappingPayload{
+		DeletedMeasureID:    measure.ID,
+		DeletedThirdPartyID: thirdParty.ID,
+	}, nil
+}
+
 // Measure returns schema.MeasureResolver implementation.
 func (r *Resolver) Measure() schema.MeasureResolver { return &measureResolver{r} }
 

pkg/server/api/console/v1/organization_resolvers.go

@@ -1291,12 +1291,16 @@ func (r *organizationResolver) ThirdParties(ctx context.Context, obj *types.Orga
 
 	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
 
-	var firstLevel *bool
+	var (
+		firstLevel *bool
+		query      *string
+	)
 	if filter != nil {
 		firstLevel = filter.FirstLevel
+		query = filter.Query
 	}
 
-	thirdPartyFilter := coredata.NewThirdPartyFilter(nil, firstLevel)
+	thirdPartyFilter := coredata.NewThirdPartyFilter(nil, firstLevel, query)
 
 	page, err := r.probo.ThirdParties.ListForOrganizationID(ctx, scope, obj.ID, cursor, thirdPartyFilter)
 	if err != nil {
@@ -1304,7 +1308,7 @@ func (r *organizationResolver) ThirdParties(ctx context.Context, obj *types.Orga
 		return nil, gqlutils.Internal(ctx)
 	}
 
-	return types.NewThirdPartyConnection(page, r, obj.ID), nil
+	return types.NewThirdPartyConnection(page, r, obj.ID, thirdPartyFilter), nil
 }
 
 // ThirdPartiesDocument is the resolver for the thirdPartiesDocument field.

pkg/server/api/console/v1/processing_activity_resolvers.go

@@ -223,7 +223,7 @@ func (r *processingActivityResolver) ThirdParties(ctx context.Context, obj *type
 		return nil, gqlutils.Internal(ctx)
 	}
 
-	return types.NewThirdPartyConnection(page, r, obj.ID), nil
+	return types.NewThirdPartyConnection(page, r, obj.ID, nil), nil
 }
 
 // DataProtectionImpactAssessment is the resolver for the dataProtectionImpactAssessment field.

pkg/server/api/console/v1/third_party_resolvers.go

@@ -820,6 +820,40 @@ func (r *thirdPartyResolver) RiskAssessments(ctx context.Context, obj *types.Thi
 	return types.NewThirdPartyRiskAssessmentConnection(page), nil
 }
 
+// Measures is the resolver for the measures field.
+func (r *thirdPartyResolver) Measures(ctx context.Context, obj *types.ThirdParty, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.MeasureOrderBy, filter *types.MeasureFilter) (*types.MeasureConnection, error) {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionMeasureList)
+	if err != nil {
+		return nil, err
+	}
+
+	pageOrderBy := page.OrderBy[coredata.MeasureOrderField]{
+		Field:     coredata.MeasureOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.MeasureOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	var measureFilter = coredata.NewMeasureFilter(nil, nil, nil)
+	if filter != nil {
+		measureFilter = coredata.NewMeasureFilter(filter.Query, filter.State, filter.Category)
+	}
+
+	page, err := r.probo.Measures.ListForThirdPartyID(ctx, scope, obj.ID, cursor, measureFilter)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot list third party measures", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewMeasureConnection(page, r, obj.ID, measureFilter), nil
+}
+
 // BusinessOwner is the resolver for the businessOwner field.
 func (r *thirdPartyResolver) BusinessOwner(ctx context.Context, obj *types.ThirdParty) (*types.Profile, error) {
 	if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
@@ -898,7 +932,7 @@ func (r *thirdPartyResolver) ChildThirdParties(ctx context.Context, obj *types.T
 		return nil, gqlutils.Internal(ctx)
 	}
 
-	return types.NewThirdPartyConnection(page, r, obj.ID), nil
+	return types.NewThirdPartyConnection(page, r, obj.ID, nil), nil
 }
 
 // Permission is the resolver for the permission field.
@@ -1012,7 +1046,7 @@ func (r *thirdPartyConnectionResolver) TotalCount(ctx context.Context, obj *type
 
 	switch obj.Resolver.(type) {
 	case *organizationResolver:
-		count, err := r.probo.ThirdParties.CountForOrganizationID(ctx, scope, obj.ParentID)
+		count, err := r.probo.ThirdParties.CountForOrganizationID(ctx, scope, obj.ParentID, obj.Filters)
 		if err != nil {
 			r.logger.ErrorCtx(ctx, "cannot count thirdParties", log.Error(err))
 			return 0, gqlutils.Internal(ctx)
@@ -1043,7 +1077,14 @@ func (r *thirdPartyConnectionResolver) TotalCount(ctx context.Context, obj *type
 		count, err := r.probo.ThirdParties.CountForParentThirdPartyID(ctx, scope, obj.ParentID)
 		if err != nil {
 			r.logger.ErrorCtx(ctx, "cannot count child third parties", log.Error(err))
+			return 0, gqlutils.Internal(ctx)
+		}
 
+		return count, nil
+	case *measureResolver:
+		count, err := r.probo.ThirdParties.CountForMeasureID(ctx, scope, obj.ParentID)
+		if err != nil {
+			r.logger.ErrorCtx(ctx, "cannot count thirdParties", log.Error(err))
 			return 0, gqlutils.Internal(ctx)
 		}
 
@@ -1229,15 +1270,3 @@ type thirdPartyContactResolver struct{ *Resolver }
 type thirdPartyDataPrivacyAgreementResolver struct{ *Resolver }
 type thirdPartyRiskAssessmentResolver struct{ *Resolver }
 type thirdPartyServiceResolver struct{ *Resolver }
-
-// !!! WARNING !!!
-// The code below was going to be deleted when updating resolvers. It has been copied here so you have
-// one last chance to move it out of harms way if you want. There are two reasons this happens:
-//  - When renaming or deleting a resolver the old code will be put in here. You can safely delete
-//    it when you're done.
-//  - You have helper methods in this file. Move them out to keep these resolver files clean.
-/*
-	func (r *mutationResolver) UncreateThirdPartyThirdPartyMapping(ctx context.Context, input types.UncreateThirdPartyThirdPartyMappingInput) (*types.UncreateThirdPartyThirdPartyMappingPayload, error) {
-	panic(fmt.Errorf("not implemented: UncreateThirdPartyThirdPartyMapping - uncreateThirdPartyThirdPartyMapping"))
-}
-*/

pkg/server/api/console/v1/types/third_party.go

@@ -31,6 +31,7 @@ type (
 
 		Resolver any
 		ParentID gid.GID
+		Filters  *coredata.ThirdPartyFilter
 	}
 )
 
@@ -38,6 +39,7 @@ func NewThirdPartyConnection(
 	p *page.Page[*coredata.ThirdParty, coredata.ThirdPartyOrderField],
 	parentType any,
 	parentID gid.GID,
+	filters *coredata.ThirdPartyFilter,
 ) *ThirdPartyConnection {
 	var edges = make([]*ThirdPartyEdge, len(p.Data))
 
@@ -51,6 +53,7 @@ func NewThirdPartyConnection(
 
 		Resolver: parentType,
 		ParentID: parentID,
+		Filters:  filters,
 	}
 }