rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add risk ownership

Browse Source 
Signed-off-by: gearnode <bryan@frimin.fr>
This commit is contained in:
gearnode
2025-04-12 11:18:20 -07:00
parent e3c7194afc
commit 8bbb4f59f1
16 changed files with 911 additions and 106 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
pkg/coredata/migrations/20250412T105200Z.sql Normal file
View File

@@ -0,0 +1 @@
ALTER TABLE risks ADD COLUMN owner_id TEXT REFERENCES peoples(id) ON DELETE SET NULL;

12
pkg/coredata/risk.go
View File

@@ -33,6 +33,7 @@ type (
Name string `db:"name"`
Description string `db:"description"`
Treatment RiskTreatment `db:"treatment"`
OwnerID *gid.GID `db:"owner_id"`
InherentLikelihood float64 `db:"inherent_likelihood"`
InherentImpact float64 `db:"inherent_impact"`
ResidualLikelihood float64 `db:"residual_likelihood"`
@@ -75,6 +76,7 @@ WITH rsks AS (
r.organization_id,
r.name,
r.description,
r.owner_id,
r.treatment,
r.inherent_likelihood,
r.inherent_impact,
@@ -94,6 +96,7 @@ SELECT
organization_id,
name,
description,
owner_id,
treatment,
inherent_likelihood,
inherent_impact,
@@ -139,6 +142,7 @@ SELECT
organization_id,
name,
description,
owner_id,
treatment,
inherent_likelihood,
inherent_impact,
@@ -183,6 +187,7 @@ SELECT
organization_id,
name,
description,
owner_id,
treatment,
inherent_likelihood,
inherent_impact,
@@ -221,8 +226,8 @@ func (r *Risk) Insert(
scope Scoper,
) error {
q := `
INSERT INTO risks (id, tenant_id, organization_id, name, description, treatment, inherent_likelihood, inherent_impact, residual_likelihood, residual_impact, created_at, updated_at)
VALUES (@id, @tenant_id, @organization_id, @name, @description, @treatment, @inherent_likelihood, @inherent_impact, @residual_likelihood, @residual_impact, @created_at, @updated_at)
INSERT INTO risks (id, tenant_id, organization_id, name, description, owner_id, treatment, inherent_likelihood, inherent_impact, residual_likelihood, residual_impact, created_at, updated_at)
VALUES (@id, @tenant_id, @organization_id, @name, @description, @owner_id, @treatment, @inherent_likelihood, @inherent_impact, @residual_likelihood, @residual_impact, @created_at, @updated_at)
`
args := pgx.StrictNamedArgs{
@@ -231,6 +236,7 @@ VALUES (@id, @tenant_id, @organization_id, @name, @description, @treatment, @inh
"organization_id": r.OrganizationID,
"name": r.Name,
"description": r.Description,
"owner_id": r.OwnerID,
"treatment": r.Treatment,
"inherent_likelihood": r.InherentLikelihood,
"inherent_impact": r.InherentImpact,
@@ -254,6 +260,7 @@ UPDATE risks
SET
name = @name,
description = @description,
owner_id = @owner_id,
treatment = @treatment,
inherent_likelihood = @inherent_likelihood,
inherent_impact = @inherent_impact,
@@ -269,6 +276,7 @@ WHERE %s
"risk_id": r.ID,
"name": r.Name,
"description": r.Description,
"owner_id": r.OwnerID,
"treatment": r.Treatment,
"inherent_likelihood": r.InherentLikelihood,
"inherent_impact": r.InherentImpact,

7
pkg/probo/risk_service.go
View File

@@ -35,6 +35,7 @@ type (
Name string
Description string
Treatment coredata.RiskTreatment
OwnerID *gid.GID
InherentLikelihood float64
InherentImpact float64
ResidualLikelihood *float64
@@ -46,6 +47,7 @@ type (
Name *string
Description *string
Treatment *coredata.RiskTreatment
OwnerID *gid.GID
InherentLikelihood *float64
InherentImpact *float64
ResidualLikelihood *float64
@@ -169,6 +171,7 @@ func (s RiskService) Create(
OrganizationID: req.OrganizationID,
Name: req.Name,
Description: req.Description,
OwnerID: req.OwnerID,
InherentLikelihood: req.InherentLikelihood,
InherentImpact: req.InherentImpact,
Treatment: req.Treatment,
@@ -261,6 +264,10 @@ func (s RiskService) Update(
risk.Treatment = *req.Treatment
}
if req.OwnerID != nil {
risk.OwnerID = req.OwnerID
}
risk.UpdatedAt = time.Now()
if err := risk.Update(ctx, conn, s.svc.scope); err != nil {

4
pkg/server/api/console/v1/schema.graphql
View File

@@ -636,6 +636,8 @@ type Risk implements Node {
residualImpact: Float!
residualSeverity: Float!
owner: People @goField(forceResolver: true)
mitigations(
first: Int
after: CursorKey
@@ -1085,6 +1087,7 @@ input CreateRiskInput {
organizationId: ID!
name: String!
description: String!
ownerId: ID
treatment: RiskTreatment!
inherentLikelihood: Float!
inherentImpact: Float!
@@ -1096,6 +1099,7 @@ input UpdateRiskInput {
id: ID!
name: String
description: String
ownerId: ID
treatment: RiskTreatment
inherentLikelihood: Float
inherentImpact: Float

125
pkg/server/api/console/v1/schema/schema.go
View File

@@ -421,6 +421,7 @@ type ComplexityRoot struct {
InherentSeverity func(childComplexity int) int
Mitigations func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.MitigationOrderBy) int
Name func(childComplexity int) int
Owner func(childComplexity int) int
Policies func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.PolicyOrderBy) int
ResidualImpact func(childComplexity int) int
ResidualLikelihood func(childComplexity int) int
@@ -667,6 +668,7 @@ type QueryResolver interface {
Viewer(ctx context.Context) (*types.Viewer, error)
}
type RiskResolver interface {
Owner(ctx context.Context, obj *types.Risk) (*types.People, error)
Mitigations(ctx context.Context, obj *types.Risk, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.MitigationOrderBy) (*types.MitigationConnection, error)
Policies(ctx context.Context, obj *types.Risk, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.PolicyOrderBy) (*types.PolicyConnection, error)
Controls(ctx context.Context, obj *types.Risk, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy) (*types.ControlConnection, error)
@@ -2306,6 +2308,13 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
return e.complexity.Risk.Name(childComplexity), true
case "Risk.owner":
if e.complexity.Risk.Owner == nil {
break
}
return e.complexity.Risk.Owner(childComplexity), true
case "Risk.policies":
if e.complexity.Risk.Policies == nil {
break
@@ -3720,6 +3729,8 @@ type Risk implements Node {
residualImpact: Float!
residualSeverity: Float!
owner: People @goField(forceResolver: true)
mitigations(
first: Int
after: CursorKey
@@ -4169,6 +4180,7 @@ input CreateRiskInput {
organizationId: ID!
name: String!
description: String!
ownerId: ID
treatment: RiskTreatment!
inherentLikelihood: Float!
inherentImpact: Float!
@@ -4180,6 +4192,7 @@ input UpdateRiskInput {
id: ID!
name: String
description: String
ownerId: ID
treatment: RiskTreatment
inherentLikelihood: Float
inherentImpact: Float
@@ -17111,6 +17124,63 @@ func (ec *executionContext) fieldContext_Risk_residualSeverity(_ context.Context
return fc, nil
}
func (ec *executionContext) _Risk_owner(ctx context.Context, field graphql.CollectedField, obj *types.Risk) (ret graphql.Marshaler) {
fc, err := ec.fieldContext_Risk_owner(ctx, field)
if err != nil {
return graphql.Null
}
ctx = graphql.WithFieldContext(ctx, fc)
defer func() {
if r := recover(); r != nil {
ec.Error(ctx, ec.Recover(ctx, r))
ret = graphql.Null
}
}()
resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
ctx = rctx // use context from middleware stack in children
return ec.resolvers.Risk().Owner(rctx, obj)
})
if err != nil {
ec.Error(ctx, err)
return graphql.Null
}
if resTmp == nil {
return graphql.Null
}
res := resTmp.(*types.People)
fc.Result = res
return ec.marshalOPeople2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐPeople(ctx, field.Selections, res)
}
func (ec *executionContext) fieldContext_Risk_owner(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
fc = &graphql.FieldContext{
Object: "Risk",
Field: field,
IsMethod: true,
IsResolver: true,
Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
switch field.Name {
case "id":
return ec.fieldContext_People_id(ctx, field)
case "fullName":
return ec.fieldContext_People_fullName(ctx, field)
case "primaryEmailAddress":
return ec.fieldContext_People_primaryEmailAddress(ctx, field)
case "additionalEmailAddresses":
return ec.fieldContext_People_additionalEmailAddresses(ctx, field)
case "kind":
return ec.fieldContext_People_kind(ctx, field)
case "createdAt":
return ec.fieldContext_People_createdAt(ctx, field)
case "updatedAt":
return ec.fieldContext_People_updatedAt(ctx, field)
}
return nil, fmt.Errorf("no field named %q was found under type People", field.Name)
},
}
return fc, nil
}
func (ec *executionContext) _Risk_mitigations(ctx context.Context, field graphql.CollectedField, obj *types.Risk) (ret graphql.Marshaler) {
fc, err := ec.fieldContext_Risk_mitigations(ctx, field)
if err != nil {
@@ -17589,6 +17659,8 @@ func (ec *executionContext) fieldContext_RiskEdge_node(_ context.Context, field
return ec.fieldContext_Risk_residualImpact(ctx, field)
case "residualSeverity":
return ec.fieldContext_Risk_residualSeverity(ctx, field)
case "owner":
return ec.fieldContext_Risk_owner(ctx, field)
case "mitigations":
return ec.fieldContext_Risk_mitigations(ctx, field)
case "policies":
@@ -18772,6 +18844,8 @@ func (ec *executionContext) fieldContext_UpdateRiskPayload_risk(_ context.Contex
return ec.fieldContext_Risk_residualImpact(ctx, field)
case "residualSeverity":
return ec.fieldContext_Risk_residualSeverity(ctx, field)
case "owner":
return ec.fieldContext_Risk_owner(ctx, field)
case "mitigations":
return ec.fieldContext_Risk_mitigations(ctx, field)
case "policies":
@@ -23789,7 +23863,7 @@ func (ec *executionContext) unmarshalInputCreateRiskInput(ctx context.Context, o
asMap[k] = v
}
fieldsInOrder := [...]string{"organizationId", "name", "description", "treatment", "inherentLikelihood", "inherentImpact", "residualLikelihood", "residualImpact"}
fieldsInOrder := [...]string{"organizationId", "name", "description", "ownerId", "treatment", "inherentLikelihood", "inherentImpact", "residualLikelihood", "residualImpact"}
for _, k := range fieldsInOrder {
v, ok := asMap[k]
if !ok {
@@ -23817,6 +23891,13 @@ func (ec *executionContext) unmarshalInputCreateRiskInput(ctx context.Context, o
return it, err
}
it.Description = data
case "ownerId":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("ownerId"))
data, err := ec.unmarshalOID2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋgidᚐGID(ctx, v)
if err != nil {
return it, err
}
it.OwnerID = data
case "treatment":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("treatment"))
data, err := ec.unmarshalNRiskTreatment2githubᚗcomᚋgetproboᚋproboᚋpkgᚋcoredataᚐRiskTreatment(ctx, v)
@@ -25319,7 +25400,7 @@ func (ec *executionContext) unmarshalInputUpdateRiskInput(ctx context.Context, o
asMap[k] = v
}
fieldsInOrder := [...]string{"id", "name", "description", "treatment", "inherentLikelihood", "inherentImpact", "residualLikelihood", "residualImpact"}
fieldsInOrder := [...]string{"id", "name", "description", "ownerId", "treatment", "inherentLikelihood", "inherentImpact", "residualLikelihood", "residualImpact"}
for _, k := range fieldsInOrder {
v, ok := asMap[k]
if !ok {
@@ -25347,6 +25428,13 @@ func (ec *executionContext) unmarshalInputUpdateRiskInput(ctx context.Context, o
return it, err
}
it.Description = data
case "ownerId":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("ownerId"))
data, err := ec.unmarshalOID2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋgidᚐGID(ctx, v)
if err != nil {
return it, err
}
it.OwnerID = data
case "treatment":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("treatment"))
data, err := ec.unmarshalORiskTreatment2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋcoredataᚐRiskTreatment(ctx, v)
@@ -29422,6 +29510,39 @@ func (ec *executionContext) _Risk(ctx context.Context, sel ast.SelectionSet, obj
if out.Values[i] == graphql.Null {
atomic.AddUint32(&out.Invalids, 1)
}
case "owner":
field := field
innerFunc := func(ctx context.Context, _ *graphql.FieldSet) (res graphql.Marshaler) {
defer func() {
if r := recover(); r != nil {
ec.Error(ctx, ec.Recover(ctx, r))
}
}()
res = ec._Risk_owner(ctx, field, obj)
return res
}
if field.Deferrable != nil {
dfs, ok := deferred[field.Deferrable.Label]
di := 0
if ok {
dfs.AddField(field)
di = len(dfs.Values) - 1
} else {
dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
deferred[field.Deferrable.Label] = dfs
}
dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
return innerFunc(ctx, dfs)
})
// don't run the out.Concurrently() call below
out.Values[i] = graphql.Null
continue
}
out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
case "mitigations":
field := field

3
pkg/server/api/console/v1/types/types.go
View File

@@ -150,6 +150,7 @@ type CreateRiskInput struct {
OrganizationID gid.GID `json:"organizationId"`
Name string `json:"name"`
Description string `json:"description"`
OwnerID *gid.GID `json:"ownerId,omitempty"`
Treatment coredata.RiskTreatment `json:"treatment"`
InherentLikelihood float64 `json:"inherentLikelihood"`
InherentImpact float64 `json:"inherentImpact"`
@@ -565,6 +566,7 @@ type Risk struct {
ResidualLikelihood float64 `json:"residualLikelihood"`
ResidualImpact float64 `json:"residualImpact"`
ResidualSeverity float64 `json:"residualSeverity"`
Owner *People `json:"owner,omitempty"`
Mitigations *MitigationConnection `json:"mitigations"`
Policies *PolicyConnection `json:"policies"`
Controls *ControlConnection `json:"controls"`
@@ -685,6 +687,7 @@ type UpdateRiskInput struct {
ID gid.GID `json:"id"`
Name *string `json:"name,omitempty"`
Description *string `json:"description,omitempty"`
OwnerID *gid.GID `json:"ownerId,omitempty"`
Treatment *coredata.RiskTreatment `json:"treatment,omitempty"`
InherentLikelihood *float64 `json:"inherentLikelihood,omitempty"`
InherentImpact *float64 `json:"inherentImpact,omitempty"`

23
pkg/server/api/console/v1/v1_resolver.go
View File

@@ -727,6 +727,7 @@ func (r *mutationResolver) CreateRisk(ctx context.Context, input types.CreateRis
Name: input.Name,
Description: input.Description,
Treatment: input.Treatment,
OwnerID: input.OwnerID,
InherentLikelihood: input.InherentLikelihood,
InherentImpact: input.InherentImpact,
ResidualLikelihood: input.ResidualLikelihood,
@@ -753,6 +754,7 @@ func (r *mutationResolver) UpdateRisk(ctx context.Context, input types.UpdateRis
Name: input.Name,
Description: input.Description,
Treatment: input.Treatment,
OwnerID: input.OwnerID,
InherentLikelihood: input.InherentLikelihood,
InherentImpact: input.InherentImpact,
ResidualLikelihood: input.ResidualLikelihood,
@@ -1345,6 +1347,27 @@ func (r *queryResolver) Viewer(ctx context.Context) (*types.Viewer, error) {
}, nil
}
// Owner is the resolver for the owner field.
func (r *riskResolver) Owner(ctx context.Context, obj *types.Risk) (*types.People, error) {
svc := r.GetTenantServiceIfAuthorized(ctx, obj.ID.TenantID())
risk, err := svc.Risks.Get(ctx, obj.ID)
if err != nil {
panic(fmt.Errorf("cannot get risk: %w", err))
}
if risk.OwnerID == nil {
return nil, nil
}
owner, err := svc.Peoples.Get(ctx, *risk.OwnerID)
if err != nil {
panic(fmt.Errorf("cannot get owner: %w", err))
}
return types.NewPeople(owner), nil
}
// Mitigations is the resolver for the mitigations field.
func (r *riskResolver) Mitigations(ctx context.Context, obj *types.Risk, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.MitigationOrderBy) (*types.MitigationConnection, error) {
svc := r.GetTenantServiceIfAuthorized(ctx, obj.ID.TenantID())