Add vendor compliance reports

Signed-off-by: gearnode <bryan@frimin.fr>

CHANGELOG.md

@@ -24,6 +24,11 @@ All notable changes to this project will be documented in this file.
   - New bidirectional relationships:
     - Control objects now expose a `policies` field to list associated policies
     - Policy objects now expose a `controls` field to list associated controls
+- Added vendor compliance reports:
+  - New GraphQL types `VendorComplianceReport` and related connection types
+  - New GraphQL mutations `uploadVendorComplianceReport` and `deleteVendorComplianceReport`
+  - New `complianceReports` field on the Vendor type
+  - Support for uploading, viewing, and managing vendor compliance documentation
 
 ### Changed
 

pkg/coredata/entity_type_reg.go

@@ -20,11 +20,11 @@ const (
 	MitigationEntityType
 	TaskEntityType
 	EvidenceEntityType
-	_ControlStateTransitionEntityType
-	_TaskStateTransitionEntityType
+	_ControlStateTransitionEntityType // UNUSED
+	_TaskStateTransitionEntityType    // UNUSED
 	VendorEntityType
 	PeopleEntityType
-	_EvidenceStateTransitionEntityType
+	VendorComplianceReportEntityType
 	PolicyEntityType
 	UserEntityType
 	SessionEntityType

pkg/coredata/migrations/20250409T081100Z.sql

@@ -0,0 +1,12 @@
+CREATE TABLE vendor_compliance_reports (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    vendor_id TEXT NOT NULL REFERENCES vendors(id),
+    report_date DATE NOT NULL,
+    valid_until DATE,
+    report_name TEXT NOT NULL,
+    file_key TEXT NOT NULL,
+    file_size INTEGER NOT NULL,
+    created_at TIMESTAMP NOT NULL,
+    updated_at TIMESTAMP NOT NULL
+);

pkg/coredata/vendor_compliance_report.go

@@ -0,0 +1,215 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/page"
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+)
+
+type (
+	VendorComplianceReport struct {
+		ID         gid.GID
+		VendorID   gid.GID
+		ReportDate time.Time
+		ValidUntil *time.Time
+		ReportName string
+		FileKey    string
+		FileSize   int
+		CreatedAt  time.Time
+		UpdatedAt  time.Time
+	}
+
+	VendorComplianceReports []*VendorComplianceReport
+)
+
+func (c VendorComplianceReport) CursorKey(orderBy VendorComplianceReportOrderField) page.CursorKey {
+	switch orderBy {
+	case VendorComplianceReportOrderFieldReportDate:
+		return page.NewCursorKey(c.ID, c.ReportDate)
+	case VendorComplianceReportOrderFieldCreatedAt:
+		return page.NewCursorKey(c.ID, c.CreatedAt)
+	}
+
+	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
+}
+
+func (vcs *VendorComplianceReports) LoadForVendorID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	vendorID gid.GID,
+	cursor *page.Cursor[VendorComplianceReportOrderField],
+) error {
+	q := `
+SELECT
+	id,
+	report_date,
+	valid_until,
+	report_name,
+	file_key,
+	file_size,
+	created_at,
+	updated_at
+FROM
+	vendor_compliance_reports
+WHERE
+	%s
+	AND vendor_id = @vendor_id
+	AND %s
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.NamedArgs{"vendor_id": vendorID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query vendor compliance reports: %w", err)
+	}
+
+	vendorComplianceReports, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[VendorComplianceReport])
+	if err != nil {
+		return fmt.Errorf("cannot collect vendor compliance reports: %w", err)
+	}
+
+	*vcs = vendorComplianceReports
+
+	return nil
+}
+
+func (vcr *VendorComplianceReport) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	vendorComplianceReportID gid.GID,
+) error {
+	q := `
+SELECT
+	id,
+	vendor_id,
+	report_date,
+	valid_until,
+	report_name,
+	file_key,
+	file_size,
+	created_at,
+	updated_at
+FROM
+	vendor_compliance_reports
+WHERE
+	%s
+	AND id = @id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.NamedArgs{"id": vendorComplianceReportID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query vendor compliance report: %w", err)
+	}
+
+	vendorComplianceReport, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[VendorComplianceReport])
+	if err != nil {
+		return fmt.Errorf("cannot collect vendor compliance report: %w", err)
+	}
+
+	*vcr = vendorComplianceReport
+
+	return nil
+}
+
+func (vcr *VendorComplianceReport) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO
+	vendor_compliance_reports (
+		id,
+		tenant_id,
+		vendor_id,
+		report_date,
+		valid_until,
+		report_name,
+		file_key,
+		file_size,
+		created_at,
+		updated_at
+	)
+VALUES (
+	@id,
+	@tenant_id,
+	@vendor_id,
+	@report_date,
+	@valid_until,
+	@report_name,
+	@file_key,
+	@file_size,
+	@created_at,
+	@updated_at
+)
+`
+	args := pgx.NamedArgs{
+		"id":          vcr.ID,
+		"tenant_id":   scope.GetTenantID(),
+		"vendor_id":   vcr.VendorID,
+		"report_date": vcr.ReportDate,
+		"valid_until": vcr.ValidUntil,
+		"report_name": vcr.ReportName,
+		"file_key":    vcr.FileKey,
+		"file_size":   vcr.FileSize,
+		"created_at":  vcr.CreatedAt,
+		"updated_at":  vcr.UpdatedAt,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}
+
+func (vcr *VendorComplianceReport) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+DELETE FROM
+	vendor_compliance_reports
+WHERE
+	%s
+	AND id = @id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.NamedArgs{"id": vcr.ID}
+
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}

pkg/coredata/vendor_compliance_report_order_field.go

@@ -0,0 +1,41 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+type (
+	VendorComplianceReportOrderField string
+)
+
+const (
+	VendorComplianceReportOrderFieldReportDate VendorComplianceReportOrderField = "REPORT_DATE"
+	VendorComplianceReportOrderFieldCreatedAt  VendorComplianceReportOrderField = "CREATED_AT"
+)
+
+func (p VendorComplianceReportOrderField) Column() string {
+	return string(p)
+}
+
+func (p VendorComplianceReportOrderField) String() string {
+	return string(p)
+}
+
+func (p VendorComplianceReportOrderField) MarshalText() ([]byte, error) {
+	return []byte(p.String()), nil
+}
+
+func (p *VendorComplianceReportOrderField) UnmarshalText(text []byte) error {
+	*p = VendorComplianceReportOrderField(text)
+	return nil
+}

pkg/probo/service.go

@@ -38,16 +38,17 @@ type (
 
 		scope coredata.Scoper
 
-		Frameworks    *FrameworkService
-		Mitigations   *MitigationService
-		Tasks         *TaskService
-		Evidences     *EvidenceService
-		Organizations *OrganizationService
-		Vendors       *VendorService
-		Peoples       *PeopleService
-		Policies      *PolicyService
-		Controls      *ControlService
-		Risks         *RiskService
+		Frameworks              *FrameworkService
+		Mitigations             *MitigationService
+		Tasks                   *TaskService
+		Evidences               *EvidenceService
+		Organizations           *OrganizationService
+		Vendors                 *VendorService
+		Peoples                 *PeopleService
+		Policies                *PolicyService
+		Controls                *ControlService
+		Risks                   *RiskService
+		VendorComplianceReports *VendorComplianceReportService
 	}
 )
 
@@ -88,6 +89,6 @@ func (s *Service) WithTenant(tenantID gid.TenantID) *TenantService {
 	tenantService.Organizations = &OrganizationService{svc: tenantService}
 	tenantService.Controls = &ControlService{svc: tenantService}
 	tenantService.Risks = &RiskService{svc: tenantService}
-
+	tenantService.VendorComplianceReports = &VendorComplianceReportService{svc: tenantService}
 	return tenantService
 }

pkg/probo/vendor_compliance_report_service.go

@@ -0,0 +1,195 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package probo
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"mime"
+	"net/url"
+	"path/filepath"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/getprobo/probo/pkg/coredata"
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/page"
+	"go.gearno.de/crypto/uuid"
+	"go.gearno.de/kit/pg"
+)
+
+type (
+	VendorComplianceReportService struct {
+		svc *TenantService
+	}
+
+	VendorComplianceReportCreateRequest struct {
+		File       io.Reader
+		ReportDate time.Time
+		ValidUntil *time.Time
+		ReportName string
+	}
+)
+
+func (s VendorComplianceReportService) ListForVendorID(
+	ctx context.Context,
+	vendorID gid.GID,
+	cursor *page.Cursor[coredata.VendorComplianceReportOrderField],
+) (*page.Page[*coredata.VendorComplianceReport, coredata.VendorComplianceReportOrderField], error) {
+	var vendorComplianceReports coredata.VendorComplianceReports
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return vendorComplianceReports.LoadForVendorID(ctx, conn, s.svc.scope, vendorID, cursor)
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(vendorComplianceReports, cursor), nil
+}
+
+func (s VendorComplianceReportService) Upload(
+	ctx context.Context,
+	vendorID gid.GID,
+	req *VendorComplianceReportCreateRequest,
+) (*coredata.VendorComplianceReport, error) {
+	objectKey, err := uuid.NewV7()
+	if err != nil {
+		return nil, fmt.Errorf("cannot generate object key: %w", err)
+	}
+
+	mimeType := mime.TypeByExtension(filepath.Ext(req.ReportName))
+
+	_, err = s.svc.s3.PutObject(ctx, &s3.PutObjectInput{
+		Bucket:      &s.svc.bucket,
+		Key:         aws.String(objectKey.String()),
+		Body:        req.File,
+		ContentType: &mimeType,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("cannot upload file to S3: %w", err)
+	}
+
+	headOutput, err := s.svc.s3.HeadObject(ctx, &s3.HeadObjectInput{
+		Bucket: aws.String(s.svc.bucket),
+		Key:    aws.String(objectKey.String()),
+	})
+	if err != nil {
+		return nil, fmt.Errorf("cannot get object metadata: %w", err)
+	}
+
+	now := time.Now()
+
+	vendorComplianceReportID, err := gid.NewGID(s.svc.scope.GetTenantID(), coredata.VendorComplianceReportEntityType)
+	if err != nil {
+		return nil, fmt.Errorf("cannot generate vendor compliance report ID: %w", err)
+	}
+
+	vendorComplianceReport := &coredata.VendorComplianceReport{
+		ID:         vendorComplianceReportID,
+		VendorID:   vendorID,
+		ReportDate: req.ReportDate,
+		ValidUntil: req.ValidUntil,
+		ReportName: req.ReportName,
+		FileKey:    objectKey.String(),
+		FileSize:   int(*headOutput.ContentLength),
+		CreatedAt:  now,
+		UpdatedAt:  now,
+	}
+
+	err = s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return vendorComplianceReport.Insert(ctx, conn, s.svc.scope)
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return vendorComplianceReport, nil
+}
+
+func (s VendorComplianceReportService) Get(
+	ctx context.Context,
+	vendorComplianceReportID gid.GID,
+) (*coredata.VendorComplianceReport, error) {
+	vendorComplianceReport := &coredata.VendorComplianceReport{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return vendorComplianceReport.LoadByID(ctx, conn, s.svc.scope, vendorComplianceReportID)
+		},
+	)
+
+	if err != nil {
+		return nil, fmt.Errorf("cannot load vendor compliance report: %w", err)
+	}
+
+	return vendorComplianceReport, nil
+}
+
+func (s VendorComplianceReportService) GenerateFileURL(
+	ctx context.Context,
+	vendorComplianceReportID gid.GID,
+	expiresIn time.Duration,
+) (string, error) {
+	vendorComplianceReport, err := s.Get(ctx, vendorComplianceReportID)
+	if err != nil {
+		return "", fmt.Errorf("cannot get vendor compliance report: %w", err)
+	}
+
+	presignClient := s3.NewPresignClient(s.svc.s3)
+
+	// Use RFC 6266/5987 encoding for filename with UTF-8 support
+	encodedFilename := url.QueryEscape(vendorComplianceReport.ReportName)
+	contentDisposition := fmt.Sprintf("attachment; filename=\"%s\"; filename*=UTF-8''%s",
+		encodedFilename, encodedFilename)
+
+	presignedReq, err := presignClient.PresignGetObject(ctx, &s3.GetObjectInput{
+		Bucket:                     aws.String(s.svc.bucket),
+		Key:                        aws.String(vendorComplianceReport.FileKey),
+		ResponseContentDisposition: aws.String(contentDisposition),
+	}, func(opts *s3.PresignOptions) {
+		opts.Expires = expiresIn
+	})
+	if err != nil {
+		return "", fmt.Errorf("cannot presign GetObject request: %w", err)
+	}
+
+	return presignedReq.URL, nil
+}
+
+func (s VendorComplianceReportService) Delete(
+	ctx context.Context,
+	vendorComplianceReportID gid.GID,
+) error {
+	vendorComplianceReport := &coredata.VendorComplianceReport{ID: vendorComplianceReportID}
+
+	return s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return vendorComplianceReport.Delete(ctx, conn, s.svc.scope)
+		},
+	)
+}

pkg/server/api/console/v1/schema.graphql

@@ -226,6 +226,20 @@ enum EvidenceOrderField
   CREATED_AT
 }
 
+enum VendorComplianceReportOrderField
+  @goModel(
+    model: "github.com/getprobo/probo/pkg/coredata.VendorComplianceReportOrderField"
+  ) {
+  REPORT_DATE
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.VendorComplianceReportOrderFieldReportDate"
+    )
+  CREATED_AT
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.VendorComplianceReportOrderFieldCreatedAt"
+    )
+}
+
 enum OrganizationOrderField {
   NAME
   CREATED_AT
@@ -313,6 +327,14 @@ input EvidenceOrder
   field: EvidenceOrderField!
 }
 
+input VendorComplianceReportOrder
+  @goModel(
+    model: "github.com/getprobo/probo/pkg/server/api/console/v1/types.VendorComplianceReportOrderBy"
+  ) {
+  direction: OrderDirection!
+  field: VendorComplianceReportOrderField!
+}
+
 input OrganizationOrder {
   direction: OrderDirection!
   field: OrganizationOrderField!
@@ -406,6 +428,15 @@ type Vendor implements Node {
   id: ID!
   name: String!
   description: String!
+
+  complianceReports(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: VendorComplianceReportOrder
+  ): VendorComplianceReportConnection! @goField(forceResolver: true)
+
   serviceStartAt: Datetime!
   serviceTerminationAt: Datetime
   serviceCriticality: ServiceCriticality!
@@ -417,6 +448,20 @@ type Vendor implements Node {
   updatedAt: Datetime!
 }
 
+type VendorComplianceReport implements Node {
+  id: ID!
+  vendor: Vendor! @goField(forceResolver: true)
+  reportDate: Datetime!
+  validUntil: Datetime
+  reportName: String!
+
+  fileUrl: String! @goField(forceResolver: true)
+  fileSize: Int!
+
+  createdAt: Datetime!
+  updatedAt: Datetime!
+}
+
 type Framework implements Node {
   id: ID!
   name: String!
@@ -699,6 +744,16 @@ type RiskEdge {
   node: Risk!
 }
 
+type VendorComplianceReportConnection {
+  edges: [VendorComplianceReportEdge!]!
+  pageInfo: PageInfo!
+}
+
+type VendorComplianceReportEdge {
+  cursor: CursorKey!
+  node: VendorComplianceReport!
+}
+
 # Root Types
 type Query {
   node(id: ID!): Node!
@@ -777,6 +832,14 @@ type Mutation {
   createEvidence(input: CreateEvidenceInput!): CreateEvidencePayload!
   deleteEvidence(input: DeleteEvidenceInput!): DeleteEvidencePayload!
 
+  # Vendor Compliance Report mutations
+  uploadVendorComplianceReport(
+    input: UploadVendorComplianceReportInput!
+  ): UploadVendorComplianceReportPayload!
+  deleteVendorComplianceReport(
+    input: DeleteVendorComplianceReportInput!
+  ): DeleteVendorComplianceReportPayload!
+
   # Policy mutations
   createPolicy(input: CreatePolicyInput!): CreatePolicyPayload!
   updatePolicy(input: UpdatePolicyInput!): UpdatePolicyPayload!
@@ -999,6 +1062,18 @@ input DeleteEvidenceInput {
   evidenceId: ID!
 }
 
+input UploadVendorComplianceReportInput {
+  vendorId: ID!
+  reportDate: Datetime!
+  validUntil: Datetime
+  reportName: String!
+  file: Upload!
+}
+
+input DeleteVendorComplianceReportInput {
+  reportId: ID!
+}
+
 input CreatePolicyInput {
   organizationId: ID!
   name: String!
@@ -1173,6 +1248,14 @@ type DeleteEvidencePayload {
   deletedEvidenceId: ID!
 }
 
+type UploadVendorComplianceReportPayload {
+  vendorComplianceReportEdge: VendorComplianceReportEdge!
+}
+
+type DeleteVendorComplianceReportPayload {
+  deletedVendorComplianceReportId: ID!
+}
+
 type CreatePolicyPayload {
   policyEdge: PolicyEdge!
 }

pkg/server/api/console/v1/types/types.go

@@ -281,6 +281,14 @@ type DeleteTaskPayload struct {
 	DeletedTaskID gid.GID `json:"deletedTaskId"`
 }
 
+type DeleteVendorComplianceReportInput struct {
+	ReportID gid.GID `json:"reportId"`
+}
+
+type DeleteVendorComplianceReportPayload struct {
+	DeletedVendorComplianceReportID gid.GID `json:"deletedVendorComplianceReportId"`
+}
+
 type DeleteVendorInput struct {
 	VendorID gid.GID `json:"vendorId"`
 }
@@ -679,6 +687,18 @@ type UpdateVendorPayload struct {
 	Vendor *Vendor `json:"vendor"`
 }
 
+type UploadVendorComplianceReportInput struct {
+	VendorID   gid.GID        `json:"vendorId"`
+	ReportDate time.Time      `json:"reportDate"`
+	ValidUntil *time.Time     `json:"validUntil,omitempty"`
+	ReportName string         `json:"reportName"`
+	File       graphql.Upload `json:"file"`
+}
+
+type UploadVendorComplianceReportPayload struct {
+	VendorComplianceReportEdge *VendorComplianceReportEdge `json:"vendorComplianceReportEdge"`
+}
+
 type User struct {
 	ID        gid.GID   `json:"id"`
 	FullName  string    `json:"fullName"`
@@ -701,23 +721,49 @@ type UserEdge struct {
 }
 
 type Vendor struct {
-	ID                   gid.GID                     `json:"id"`
-	Name                 string                      `json:"name"`
-	Description          string                      `json:"description"`
-	ServiceStartAt       time.Time                   `json:"serviceStartAt"`
-	ServiceTerminationAt *time.Time                  `json:"serviceTerminationAt,omitempty"`
-	ServiceCriticality   coredata.ServiceCriticality `json:"serviceCriticality"`
-	RiskTier             coredata.RiskTier           `json:"riskTier"`
-	StatusPageURL        *string                     `json:"statusPageUrl,omitempty"`
-	TermsOfServiceURL    *string                     `json:"termsOfServiceUrl,omitempty"`
-	PrivacyPolicyURL     *string                     `json:"privacyPolicyUrl,omitempty"`
-	CreatedAt            time.Time                   `json:"createdAt"`
-	UpdatedAt            time.Time                   `json:"updatedAt"`
+	ID                   gid.GID                           `json:"id"`
+	Name                 string                            `json:"name"`
+	Description          string                            `json:"description"`
+	ComplianceReports    *VendorComplianceReportConnection `json:"complianceReports"`
+	ServiceStartAt       time.Time                         `json:"serviceStartAt"`
+	ServiceTerminationAt *time.Time                        `json:"serviceTerminationAt,omitempty"`
+	ServiceCriticality   coredata.ServiceCriticality       `json:"serviceCriticality"`
+	RiskTier             coredata.RiskTier                 `json:"riskTier"`
+	StatusPageURL        *string                           `json:"statusPageUrl,omitempty"`
+	TermsOfServiceURL    *string                           `json:"termsOfServiceUrl,omitempty"`
+	PrivacyPolicyURL     *string                           `json:"privacyPolicyUrl,omitempty"`
+	CreatedAt            time.Time                         `json:"createdAt"`
+	UpdatedAt            time.Time                         `json:"updatedAt"`
 }
 
 func (Vendor) IsNode()             {}
 func (this Vendor) GetID() gid.GID { return this.ID }
 
+type VendorComplianceReport struct {
+	ID         gid.GID    `json:"id"`
+	Vendor     *Vendor    `json:"vendor"`
+	ReportDate time.Time  `json:"reportDate"`
+	ValidUntil *time.Time `json:"validUntil,omitempty"`
+	ReportName string     `json:"reportName"`
+	FileURL    string     `json:"fileUrl"`
+	FileSize   int        `json:"fileSize"`
+	CreatedAt  time.Time  `json:"createdAt"`
+	UpdatedAt  time.Time  `json:"updatedAt"`
+}
+
+func (VendorComplianceReport) IsNode()             {}
+func (this VendorComplianceReport) GetID() gid.GID { return this.ID }
+
+type VendorComplianceReportConnection struct {
+	Edges    []*VendorComplianceReportEdge `json:"edges"`
+	PageInfo *PageInfo                     `json:"pageInfo"`
+}
+
+type VendorComplianceReportEdge struct {
+	Cursor page.CursorKey          `json:"cursor"`
+	Node   *VendorComplianceReport `json:"node"`
+}
+
 type VendorConnection struct {
 	Edges    []*VendorEdge `json:"edges"`
 	PageInfo *PageInfo     `json:"pageInfo"`

pkg/server/api/console/v1/types/vendor_compliance_report.go

@@ -0,0 +1,56 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"github.com/getprobo/probo/pkg/coredata"
+	"github.com/getprobo/probo/pkg/page"
+)
+
+type (
+	VendorComplianceReportOrderBy OrderBy[coredata.VendorComplianceReportOrderField]
+)
+
+func NewVendorComplianceReportConnection(p *page.Page[*coredata.VendorComplianceReport, coredata.VendorComplianceReportOrderField]) *VendorComplianceReportConnection {
+	var edges = make([]*VendorComplianceReportEdge, len(p.Data))
+
+	for i := range edges {
+		edges[i] = NewVendorComplianceReportEdge(p.Data[i], p.Cursor.OrderBy.Field)
+	}
+
+	return &VendorComplianceReportConnection{
+		Edges:    edges,
+		PageInfo: NewPageInfo(p),
+	}
+}
+
+func NewVendorComplianceReportEdge(c *coredata.VendorComplianceReport, orderBy coredata.VendorComplianceReportOrderField) *VendorComplianceReportEdge {
+	return &VendorComplianceReportEdge{
+		Cursor: c.CursorKey(orderBy),
+		Node:   NewVendorComplianceReport(c),
+	}
+}
+
+func NewVendorComplianceReport(c *coredata.VendorComplianceReport) *VendorComplianceReport {
+	return &VendorComplianceReport{
+		ID:         c.ID,
+		ReportDate: c.ReportDate,
+		ValidUntil: c.ValidUntil,
+		ReportName: c.ReportName,
+		FileSize:   c.FileSize,
+		CreatedAt:  c.CreatedAt,
+		UpdatedAt:  c.UpdatedAt,
+	}
+}

pkg/server/api/console/v1/v1_resolver.go

@@ -866,6 +866,43 @@ func (r *mutationResolver) DeleteEvidence(ctx context.Context, input types.Delet
 	}, nil
 }
 
+// UploadVendorComplianceReport is the resolver for the uploadVendorComplianceReport field.
+func (r *mutationResolver) UploadVendorComplianceReport(ctx context.Context, input types.UploadVendorComplianceReportInput) (*types.UploadVendorComplianceReportPayload, error) {
+	svc := r.GetTenantServiceIfAuthorized(ctx, input.VendorID.TenantID())
+
+	vendorComplianceReport, err := svc.VendorComplianceReports.Upload(
+		ctx,
+		input.VendorID,
+		&probo.VendorComplianceReportCreateRequest{
+			File:       input.File.File,
+			ReportDate: input.ReportDate,
+			ValidUntil: input.ValidUntil,
+			ReportName: input.ReportName,
+		},
+	)
+	if err != nil {
+		panic(fmt.Errorf("failed to upload vendor compliance report: %w", err))
+	}
+
+	return &types.UploadVendorComplianceReportPayload{
+		VendorComplianceReportEdge: types.NewVendorComplianceReportEdge(vendorComplianceReport, coredata.VendorComplianceReportOrderFieldCreatedAt),
+	}, nil
+}
+
+// DeleteVendorComplianceReport is the resolver for the deleteVendorComplianceReport field.
+func (r *mutationResolver) DeleteVendorComplianceReport(ctx context.Context, input types.DeleteVendorComplianceReportInput) (*types.DeleteVendorComplianceReportPayload, error) {
+	svc := r.GetTenantServiceIfAuthorized(ctx, input.ReportID.TenantID())
+
+	err := svc.VendorComplianceReports.Delete(ctx, input.ReportID)
+	if err != nil {
+		panic(fmt.Errorf("failed to delete vendor compliance report: %w", err))
+	}
+
+	return &types.DeleteVendorComplianceReportPayload{
+		DeletedVendorComplianceReportID: input.ReportID,
+	}, nil
+}
+
 // CreatePolicy is the resolver for the createPolicy field.
 func (r *mutationResolver) CreatePolicy(ctx context.Context, input types.CreatePolicyInput) (*types.CreatePolicyPayload, error) {
 	svc := r.GetTenantServiceIfAuthorized(ctx, input.OrganizationID.TenantID())
@@ -1218,6 +1255,12 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 			panic(fmt.Errorf("cannot get risk: %w", err))
 		}
 		return types.NewRisk(risk), nil
+	case coredata.VendorComplianceReportEntityType:
+		vendorComplianceReport, err := svc.VendorComplianceReports.Get(ctx, id)
+		if err != nil {
+			panic(fmt.Errorf("cannot get vendor compliance report: %w", err))
+		}
+		return types.NewVendorComplianceReport(vendorComplianceReport), nil
 	default:
 	}
 
@@ -1305,6 +1348,55 @@ func (r *taskResolver) Evidences(ctx context.Context, obj *types.Task, first *in
 	return types.NewEvidenceConnection(page), nil
 }
 
+// ComplianceReports is the resolver for the complianceReports field.
+func (r *vendorResolver) ComplianceReports(ctx context.Context, obj *types.Vendor, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.VendorComplianceReportOrderBy) (*types.VendorComplianceReportConnection, error) {
+	svc := r.GetTenantServiceIfAuthorized(ctx, obj.ID.TenantID())
+
+	pageOrderBy := page.OrderBy[coredata.VendorComplianceReportOrderField]{
+		Field:     coredata.VendorComplianceReportOrderFieldReportDate,
+		Direction: page.OrderDirectionDesc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.VendorComplianceReportOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	page, err := svc.VendorComplianceReports.ListForVendorID(ctx, obj.ID, cursor)
+	if err != nil {
+		panic(fmt.Errorf("failed to list vendor compliance reports: %w", err))
+	}
+
+	return types.NewVendorComplianceReportConnection(page), nil
+}
+
+// Vendor is the resolver for the vendor field.
+func (r *vendorComplianceReportResolver) Vendor(ctx context.Context, obj *types.VendorComplianceReport) (*types.Vendor, error) {
+	svc := r.GetTenantServiceIfAuthorized(ctx, obj.ID.TenantID())
+
+	vendor, err := svc.Vendors.Get(ctx, obj.ID)
+	if err != nil {
+		panic(fmt.Errorf("failed to get vendor: %w", err))
+	}
+
+	return types.NewVendor(vendor), nil
+}
+
+// FileURL is the resolver for the fileUrl field.
+func (r *vendorComplianceReportResolver) FileURL(ctx context.Context, obj *types.VendorComplianceReport) (string, error) {
+	svc := r.GetTenantServiceIfAuthorized(ctx, obj.ID.TenantID())
+
+	fileURL, err := svc.VendorComplianceReports.GenerateFileURL(ctx, obj.ID, 1*time.Hour)
+	if err != nil {
+		panic(fmt.Errorf("failed to generate file URL: %w", err))
+	}
+
+	return fileURL, nil
+}
+
 // Organizations is the resolver for the organizations field.
 func (r *viewerResolver) Organizations(ctx context.Context, obj *types.Viewer, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.OrganizationOrder) (*types.OrganizationConnection, error) {
 	user := UserFromContext(ctx)
@@ -1360,6 +1452,14 @@ func (r *Resolver) Risk() schema.RiskResolver { return &riskResolver{r} }
 // Task returns schema.TaskResolver implementation.
 func (r *Resolver) Task() schema.TaskResolver { return &taskResolver{r} }
 
+// Vendor returns schema.VendorResolver implementation.
+func (r *Resolver) Vendor() schema.VendorResolver { return &vendorResolver{r} }
+
+// VendorComplianceReport returns schema.VendorComplianceReportResolver implementation.
+func (r *Resolver) VendorComplianceReport() schema.VendorComplianceReportResolver {
+	return &vendorComplianceReportResolver{r}
+}
+
 // Viewer returns schema.ViewerResolver implementation.
 func (r *Resolver) Viewer() schema.ViewerResolver { return &viewerResolver{r} }
 
@@ -1373,4 +1473,6 @@ type policyResolver struct{ *Resolver }
 type queryResolver struct{ *Resolver }
 type riskResolver struct{ *Resolver }
 type taskResolver struct{ *Resolver }
+type vendorResolver struct{ *Resolver }
+type vendorComplianceReportResolver struct{ *Resolver }
 type viewerResolver struct{ *Resolver }