Refatcor policies management

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/server/api/console/v1/schema.graphql

@@ -95,8 +95,8 @@ enum PolicyStatus
   @goModel(model: "github.com/getprobo/probo/pkg/coredata.PolicyStatus") {
   DRAFT
     @goEnum(value: "github.com/getprobo/probo/pkg/coredata.PolicyStatusDraft")
-  ACTIVE
-    @goEnum(value: "github.com/getprobo/probo/pkg/coredata.PolicyStatusActive")
+  PUBLISHED
+    @goEnum(value: "github.com/getprobo/probo/pkg/coredata.PolicyStatusPublished")
 }
 
 enum EvidenceType
@@ -184,7 +184,14 @@ enum TaskOrderField
 
 enum PolicyOrderField
   @goModel(model: "github.com/getprobo/probo/pkg/coredata.PolicyOrderField") {
-  NAME
+  TITLE
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.PolicyOrderFieldTitle"
+    )
+  CREATED_AT
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.PolicyOrderFieldCreatedAt"
+    )
 }
 
 enum RiskOrderField
@@ -260,6 +267,18 @@ enum BusinessImpact
     @goEnum(value: "github.com/getprobo/probo/pkg/coredata.BusinessImpactCritical")
 }
 
+enum PolicyVersionOrderField
+  @goModel(model: "github.com/getprobo/probo/pkg/coredata.PolicyVersionOrderField") {
+  VERSION
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.PolicyVersionOrderFieldVersion"
+    )
+  CREATED_AT
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.PolicyVersionOrderFieldCreatedAt"
+    )
+}
+
 # Order Input Types
 input UserOrder
   @goModel(
@@ -359,6 +378,18 @@ input ConnectorOrder {
   direction: OrderDirection!
 }
 
+input PolicyVersionOrder
+  @goModel(
+    model: "github.com/getprobo/probo/pkg/server/api/console/v1/types.PolicyVersionOrderBy"
+  ) {
+  direction: OrderDirection!
+  field: PolicyVersionOrderField!
+}
+
+input PolicyVersionFilter {
+  status: PolicyStatus
+}
+
 # Core Types
 type Organization implements Node {
   id: ID!
@@ -631,12 +662,20 @@ type Evidence implements Node {
 
 type Policy implements Node {
   id: ID!
-  name: String!
-  status: PolicyStatus!
-  content: String!
-  reviewDate: Datetime
+  title: String!
+  description: String!
+  currentPublishedVersion: Int
   owner: People! @goField(forceResolver: true)
 
+  versions(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: PolicyVersionOrder
+    filter: PolicyVersionFilter
+  ): PolicyVersionConnection! @goField(forceResolver: true)
+
   controls(
     first: Int
     after: CursorKey
@@ -852,6 +891,16 @@ type VendorRiskAssessmentEdge {
   node: VendorRiskAssessment!
 }
 
+type PolicyVersionConnection {
+  edges: [PolicyVersionEdge!]!
+  pageInfo: PageInfo!
+}
+
+type PolicyVersionEdge {
+  cursor: CursorKey!
+  node: PolicyVersion!
+}
+
 # Root Types
 type Query {
   node(id: ID!): Node!
@@ -952,8 +1001,11 @@ type Mutation {
 
   # Policy mutations
   createPolicy(input: CreatePolicyInput!): CreatePolicyPayload!
-  updatePolicy(input: UpdatePolicyInput!): UpdatePolicyPayload!
   deletePolicy(input: DeletePolicyInput!): DeletePolicyPayload!
+  publishPolicyVersion(input: PublishPolicyVersionInput!): PublishPolicyVersionPayload!
+  createDraftPolicyVersion(input: CreateDraftPolicyVersionInput!): CreateDraftPolicyVersionPayload!
+  updatePolicyVersion(input: UpdatePolicyVersionInput!): UpdatePolicyVersionPayload!
+  requestSignature(input: RequestSignatureInput!): RequestSignaturePayload!
 
   createVendorRiskAssessment(input: CreateVendorRiskAssessmentInput!): CreateVendorRiskAssessmentPayload!
 }
@@ -1224,20 +1276,17 @@ input DeleteVendorComplianceReportInput {
 
 input CreatePolicyInput {
   organizationId: ID!
-  name: String!
+  title: String!
   content: String!
-  status: PolicyStatus!
-  reviewDate: Datetime
   ownerId: ID!
 }
 
 input UpdatePolicyInput {
   id: ID!
-  name: String
+  title: String
   content: String
-  status: PolicyStatus
-  reviewDate: Datetime
   ownerId: ID
+  createdBy: ID
 }
 
 input DeletePolicyInput {
@@ -1414,6 +1463,7 @@ type DeleteVendorComplianceReportPayload {
 
 type CreatePolicyPayload {
   policyEdge: PolicyEdge!
+  policyVersionEdge: PolicyVersionEdge!
 }
 
 type UpdatePolicyPayload {
@@ -1489,4 +1539,112 @@ input DeleteMesureInput {
 
 type DeleteMesurePayload {
   deletedMesureId: ID!
-}
+}
+
+type PolicyVersion implements Node {
+  id: ID!
+  policy: Policy! @goField(forceResolver: true)
+  status: PolicyStatus!
+  version: Int!
+  content: String!
+  changelog: String!
+
+  signatures(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: PolicyVersionSignatureOrder
+  ): PolicyVersionSignatureConnection! @goField(forceResolver: true)
+
+  publishedBy: People @goField(forceResolver: true)
+  publishedAt: Datetime
+  createdAt: Datetime!
+  updatedAt: Datetime!
+}
+
+type PolicyVersionSignatureConnection {
+  edges: [PolicyVersionSignatureEdge!]!
+  pageInfo: PageInfo!
+}
+
+type PolicyVersionSignatureEdge {
+  cursor: CursorKey!
+  node: PolicyVersionSignature!
+}
+
+input PolicyVersionSignatureOrder {
+  field: PolicyVersionSignatureOrderField!
+  direction: OrderDirection!
+}
+
+enum PolicyVersionSignatureState
+  @goModel(model: "github.com/getprobo/probo/pkg/coredata.PolicyVersionSignatureState") {
+  REQUESTED
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.PolicyVersionSignatureStateRequested"
+    )
+  SIGNED
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.PolicyVersionSignatureStateSigned"
+    )
+}
+
+enum PolicyVersionSignatureOrderField
+  @goModel(model: "github.com/getprobo/probo/pkg/coredata.PolicyVersionSignatureOrderField") {
+  CREATED_AT
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.PolicyVersionSignatureOrderFieldCreatedAt"
+    )
+  SIGNED_AT
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.PolicyVersionSignatureOrderFieldSignedAt"
+    )
+}
+
+type PolicyVersionSignature implements Node {
+  id: ID!
+  policyVersion: PolicyVersion! @goField(forceResolver: true)
+  state: PolicyVersionSignatureState!
+  signedBy: People! @goField(forceResolver: true)
+  signedAt: Datetime
+  requestedAt: Datetime!
+  requestedBy: People! @goField(forceResolver: true)
+  createdAt: Datetime!
+  updatedAt: Datetime!
+}
+
+input RequestSignatureInput {
+  policyVersionId: ID!
+  signatoryId: ID!
+}
+
+type RequestSignaturePayload {
+  policyVersionSignatureEdge: PolicyVersionSignatureEdge!
+}
+
+input PublishPolicyVersionInput {
+  policyId: ID!
+}
+
+type PublishPolicyVersionPayload {
+  policyVersion: PolicyVersion!
+  policy: Policy!
+}
+
+type CreateDraftPolicyVersionPayload {
+  policyVersionEdge: PolicyVersionEdge!
+}
+
+input CreateDraftPolicyVersionInput {
+  policyID: ID!
+}
+
+input UpdatePolicyVersionInput {
+  policyVersionId: ID!
+  content: String!
+}
+
+type UpdatePolicyVersionPayload {
+  policyVersion: PolicyVersion!
+}

pkg/server/api/console/v1/types/policy.go

@@ -44,12 +44,10 @@ func NewPolicyEdge(policy *coredata.Policy, orderBy coredata.PolicyOrderField) *
 
 func NewPolicy(policy *coredata.Policy) *Policy {
 	return &Policy{
-		ID:         policy.ID,
-		Name:       policy.Name,
-		Content:    policy.Content,
-		CreatedAt:  policy.CreatedAt,
-		UpdatedAt:  policy.UpdatedAt,
-		Status:     policy.Status,
-		ReviewDate: policy.ReviewDate,
+		ID:                      policy.ID,
+		Title:                   policy.Title,
+		CurrentPublishedVersion: policy.CurrentPublishedVersion,
+		CreatedAt:               policy.CreatedAt,
+		UpdatedAt:               policy.UpdatedAt,
 	}
 }

pkg/server/api/console/v1/types/policy_version.go

@@ -0,0 +1,56 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"github.com/getprobo/probo/pkg/coredata"
+	"github.com/getprobo/probo/pkg/page"
+)
+
+type (
+	PolicyVersionOrderBy OrderBy[coredata.PolicyVersionOrderField]
+)
+
+func NewPolicyVersionConnection(page *page.Page[*coredata.PolicyVersion, coredata.PolicyVersionOrderField]) *PolicyVersionConnection {
+	edges := make([]*PolicyVersionEdge, len(page.Data))
+	for i, policyVersion := range page.Data {
+		edges[i] = NewPolicyVersionEdge(policyVersion, page.Cursor.OrderBy.Field)
+	}
+
+	return &PolicyVersionConnection{
+		Edges:    edges,
+		PageInfo: NewPageInfo(page),
+	}
+}
+
+func NewPolicyVersionEdge(policyVersion *coredata.PolicyVersion, orderBy coredata.PolicyVersionOrderField) *PolicyVersionEdge {
+	return &PolicyVersionEdge{
+		Cursor: policyVersion.CursorKey(orderBy),
+		Node:   NewPolicyVersion(policyVersion),
+	}
+}
+
+func NewPolicyVersion(policyVersion *coredata.PolicyVersion) *PolicyVersion {
+	return &PolicyVersion{
+		ID:          policyVersion.ID,
+		Version:     policyVersion.VersionNumber,
+		Content:     policyVersion.Content,
+		Status:      policyVersion.Status,
+		PublishedAt: policyVersion.PublishedAt,
+		Changelog:   policyVersion.Changelog,
+		CreatedAt:   policyVersion.CreatedAt,
+		UpdatedAt:   policyVersion.UpdatedAt,
+	}
+}

pkg/server/api/console/v1/types/policy_version_signature.go

@@ -0,0 +1,54 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"github.com/getprobo/probo/pkg/coredata"
+	"github.com/getprobo/probo/pkg/page"
+)
+
+type (
+	PolicyVersionSignatureOrderBy OrderBy[coredata.PolicyVersionSignatureOrderField]
+)
+
+func NewPolicyVersionSignatureConnection(page *page.Page[*coredata.PolicyVersionSignature, coredata.PolicyVersionSignatureOrderField]) *PolicyVersionSignatureConnection {
+	edges := make([]*PolicyVersionSignatureEdge, len(page.Data))
+	for i, policyVersionSignature := range page.Data {
+		edges[i] = NewPolicyVersionSignatureEdge(policyVersionSignature, page.Cursor.OrderBy.Field)
+	}
+
+	return &PolicyVersionSignatureConnection{
+		Edges:    edges,
+		PageInfo: NewPageInfo(page),
+	}
+}
+
+func NewPolicyVersionSignatureEdge(policyVersionSignature *coredata.PolicyVersionSignature, orderBy coredata.PolicyVersionSignatureOrderField) *PolicyVersionSignatureEdge {
+	return &PolicyVersionSignatureEdge{
+		Cursor: policyVersionSignature.CursorKey(orderBy),
+		Node:   NewPolicyVersionSignature(policyVersionSignature),
+	}
+}
+
+func NewPolicyVersionSignature(policyVersionSignature *coredata.PolicyVersionSignature) *PolicyVersionSignature {
+	return &PolicyVersionSignature{
+		ID:          policyVersionSignature.ID,
+		State:       policyVersionSignature.State,
+		SignedAt:    policyVersionSignature.SignedAt,
+		RequestedAt: policyVersionSignature.RequestedAt,
+		CreatedAt:   policyVersionSignature.CreatedAt,
+		UpdatedAt:   policyVersionSignature.UpdatedAt,
+	}
+}

pkg/server/api/console/v1/types/types.go

@@ -104,6 +104,14 @@ type CreateControlPolicyMappingPayload struct {
 	Success bool `json:"success"`
 }
 
+type CreateDraftPolicyVersionInput struct {
+	PolicyID gid.GID `json:"policyID"`
+}
+
+type CreateDraftPolicyVersionPayload struct {
+	PolicyVersionEdge *PolicyVersionEdge `json:"policyVersionEdge"`
+}
+
 type CreateEvidenceInput struct {
 	TaskID      gid.GID               `json:"taskId"`
 	Name        string                `json:"name"`
@@ -159,16 +167,15 @@ type CreatePeoplePayload struct {
 }
 
 type CreatePolicyInput struct {
-	OrganizationID gid.GID               `json:"organizationId"`
-	Name           string                `json:"name"`
-	Content        string                `json:"content"`
-	Status         coredata.PolicyStatus `json:"status"`
-	ReviewDate     *time.Time            `json:"reviewDate,omitempty"`
-	OwnerID        gid.GID               `json:"ownerId"`
+	OrganizationID gid.GID `json:"organizationId"`
+	Title          string  `json:"title"`
+	Content        string  `json:"content"`
+	OwnerID        gid.GID `json:"ownerId"`
 }
 
 type CreatePolicyPayload struct {
-	PolicyEdge *PolicyEdge `json:"policyEdge"`
+	PolicyEdge        *PolicyEdge        `json:"policyEdge"`
+	PolicyVersionEdge *PolicyVersionEdge `json:"policyVersionEdge"`
 }
 
 type CreateRiskInput struct {
@@ -556,15 +563,15 @@ type PeopleEdge struct {
 }
 
 type Policy struct {
-	ID         gid.GID               `json:"id"`
-	Name       string                `json:"name"`
-	Status     coredata.PolicyStatus `json:"status"`
-	Content    string                `json:"content"`
-	ReviewDate *time.Time            `json:"reviewDate,omitempty"`
-	Owner      *People               `json:"owner"`
-	Controls   *ControlConnection    `json:"controls"`
-	CreatedAt  time.Time             `json:"createdAt"`
-	UpdatedAt  time.Time             `json:"updatedAt"`
+	ID                      gid.GID                  `json:"id"`
+	Title                   string                   `json:"title"`
+	Description             string                   `json:"description"`
+	CurrentPublishedVersion *int                     `json:"currentPublishedVersion,omitempty"`
+	Owner                   *People                  `json:"owner"`
+	Versions                *PolicyVersionConnection `json:"versions"`
+	Controls                *ControlConnection       `json:"controls"`
+	CreatedAt               time.Time                `json:"createdAt"`
+	UpdatedAt               time.Time                `json:"updatedAt"`
 }
 
 func (Policy) IsNode()             {}
@@ -580,6 +587,76 @@ type PolicyEdge struct {
 	Node   *Policy        `json:"node"`
 }
 
+type PolicyVersion struct {
+	ID          gid.GID                           `json:"id"`
+	Policy      *Policy                           `json:"policy"`
+	Status      coredata.PolicyStatus             `json:"status"`
+	Version     int                               `json:"version"`
+	Content     string                            `json:"content"`
+	Changelog   string                            `json:"changelog"`
+	Signatures  *PolicyVersionSignatureConnection `json:"signatures"`
+	PublishedBy *People                           `json:"publishedBy,omitempty"`
+	PublishedAt *time.Time                        `json:"publishedAt,omitempty"`
+	CreatedAt   time.Time                         `json:"createdAt"`
+	UpdatedAt   time.Time                         `json:"updatedAt"`
+}
+
+func (PolicyVersion) IsNode()             {}
+func (this PolicyVersion) GetID() gid.GID { return this.ID }
+
+type PolicyVersionConnection struct {
+	Edges    []*PolicyVersionEdge `json:"edges"`
+	PageInfo *PageInfo            `json:"pageInfo"`
+}
+
+type PolicyVersionEdge struct {
+	Cursor page.CursorKey `json:"cursor"`
+	Node   *PolicyVersion `json:"node"`
+}
+
+type PolicyVersionFilter struct {
+	Status *coredata.PolicyStatus `json:"status,omitempty"`
+}
+
+type PolicyVersionSignature struct {
+	ID            gid.GID                              `json:"id"`
+	PolicyVersion *PolicyVersion                       `json:"policyVersion"`
+	State         coredata.PolicyVersionSignatureState `json:"state"`
+	SignedBy      *People                              `json:"signedBy"`
+	SignedAt      *time.Time                           `json:"signedAt,omitempty"`
+	RequestedAt   time.Time                            `json:"requestedAt"`
+	RequestedBy   *People                              `json:"requestedBy"`
+	CreatedAt     time.Time                            `json:"createdAt"`
+	UpdatedAt     time.Time                            `json:"updatedAt"`
+}
+
+func (PolicyVersionSignature) IsNode()             {}
+func (this PolicyVersionSignature) GetID() gid.GID { return this.ID }
+
+type PolicyVersionSignatureConnection struct {
+	Edges    []*PolicyVersionSignatureEdge `json:"edges"`
+	PageInfo *PageInfo                     `json:"pageInfo"`
+}
+
+type PolicyVersionSignatureEdge struct {
+	Cursor page.CursorKey          `json:"cursor"`
+	Node   *PolicyVersionSignature `json:"node"`
+}
+
+type PolicyVersionSignatureOrder struct {
+	Field     coredata.PolicyVersionSignatureOrderField `json:"field"`
+	Direction page.OrderDirection                       `json:"direction"`
+}
+
+type PublishPolicyVersionInput struct {
+	PolicyID gid.GID `json:"policyId"`
+}
+
+type PublishPolicyVersionPayload struct {
+	PolicyVersion *PolicyVersion `json:"policyVersion"`
+	Policy        *Policy        `json:"policy"`
+}
+
 type Query struct {
 }
 
@@ -603,6 +680,15 @@ type RequestEvidencePayload struct {
 	EvidenceEdge *EvidenceEdge `json:"evidenceEdge"`
 }
 
+type RequestSignatureInput struct {
+	PolicyVersionID gid.GID `json:"policyVersionId"`
+	SignatoryID     gid.GID `json:"signatoryId"`
+}
+
+type RequestSignaturePayload struct {
+	PolicyVersionSignatureEdge *PolicyVersionSignatureEdge `json:"policyVersionSignatureEdge"`
+}
+
 type Risk struct {
 	ID                 gid.GID                `json:"id"`
 	Name               string                 `json:"name"`
@@ -720,18 +806,26 @@ type UpdatePeoplePayload struct {
 }
 
 type UpdatePolicyInput struct {
-	ID         gid.GID                `json:"id"`
-	Name       *string                `json:"name,omitempty"`
-	Content    *string                `json:"content,omitempty"`
-	Status     *coredata.PolicyStatus `json:"status,omitempty"`
-	ReviewDate *time.Time             `json:"reviewDate,omitempty"`
-	OwnerID    *gid.GID               `json:"ownerId,omitempty"`
+	ID        gid.GID  `json:"id"`
+	Title     *string  `json:"title,omitempty"`
+	Content   *string  `json:"content,omitempty"`
+	OwnerID   *gid.GID `json:"ownerId,omitempty"`
+	CreatedBy *gid.GID `json:"createdBy,omitempty"`
 }
 
 type UpdatePolicyPayload struct {
 	Policy *Policy `json:"policy"`
 }
 
+type UpdatePolicyVersionInput struct {
+	PolicyVersionID gid.GID `json:"policyVersionId"`
+	Content         string  `json:"content"`
+}
+
+type UpdatePolicyVersionPayload struct {
+	PolicyVersion *PolicyVersion `json:"policyVersion"`
+}
+
 type UpdateRiskInput struct {
 	ID                 gid.GID                 `json:"id"`
 	Name               *string                 `json:"name,omitempty"`

pkg/server/api/console/v1/v1_resolver.go

@@ -1008,41 +1008,29 @@ func (r *mutationResolver) DeleteVendorComplianceReport(ctx context.Context, inp
 func (r *mutationResolver) CreatePolicy(ctx context.Context, input types.CreatePolicyInput) (*types.CreatePolicyPayload, error) {
 	svc := GetTenantService(ctx, r.proboSvc, input.OrganizationID.TenantID())
 
-	policy, err := svc.Policies.Create(ctx, probo.CreatePolicyRequest{
-		OrganizationID: input.OrganizationID,
-		Name:           input.Name,
-		Content:        input.Content,
-		Status:         input.Status,
-		ReviewDate:     input.ReviewDate,
-		OwnerID:        input.OwnerID,
-	})
+	user := UserFromContext(ctx)
+	people, err := svc.Peoples.GetByUserID(ctx, user.ID)
+	if err != nil {
+		panic(fmt.Errorf("cannot get people: %w", err))
+	}
+
+	policy, policyVersion, err := svc.Policies.Create(
+		ctx,
+		probo.CreatePolicyRequest{
+			OrganizationID: input.OrganizationID,
+			Title:          input.Title,
+			OwnerID:        input.OwnerID,
+			Content:        input.Content,
+			CreatedBy:      people.ID,
+		},
+	)
 	if err != nil {
 		panic(fmt.Errorf("cannot create policy: %w", err))
 	}
 
 	return &types.CreatePolicyPayload{
-		PolicyEdge: types.NewPolicyEdge(policy, coredata.PolicyOrderFieldCreatedAt),
-	}, nil
-}
-
-// UpdatePolicy is the resolver for the updatePolicy field.
-func (r *mutationResolver) UpdatePolicy(ctx context.Context, input types.UpdatePolicyInput) (*types.UpdatePolicyPayload, error) {
-	svc := GetTenantService(ctx, r.proboSvc, input.ID.TenantID())
-
-	policy, err := svc.Policies.Update(ctx, probo.UpdatePolicyRequest{
-		ID:         input.ID,
-		Name:       input.Name,
-		Content:    input.Content,
-		Status:     input.Status,
-		ReviewDate: input.ReviewDate,
-		OwnerID:    input.OwnerID,
-	})
-	if err != nil {
-		panic(fmt.Errorf("cannot update policy: %w", err))
-	}
-
-	return &types.UpdatePolicyPayload{
-		Policy: types.NewPolicy(policy),
+		PolicyEdge:        types.NewPolicyEdge(policy, coredata.PolicyOrderFieldTitle),
+		PolicyVersionEdge: types.NewPolicyVersionEdge(policyVersion, coredata.PolicyVersionOrderFieldCreatedAt),
 	}, nil
 }
 
@@ -1060,16 +1048,96 @@ func (r *mutationResolver) DeletePolicy(ctx context.Context, input types.DeleteP
 	}, nil
 }
 
+// PublishPolicyVersion is the resolver for the publishPolicyVersion field.
+func (r *mutationResolver) PublishPolicyVersion(ctx context.Context, input types.PublishPolicyVersionInput) (*types.PublishPolicyVersionPayload, error) {
+	svc := GetTenantService(ctx, r.proboSvc, input.PolicyID.TenantID())
+	user := UserFromContext(ctx)
+
+	people, err := svc.Peoples.GetByUserID(ctx, user.ID)
+	if err != nil {
+		panic(fmt.Errorf("cannot get people: %w", err))
+	}
+
+	policy, policyVersion, err := svc.Policies.PublishVersion(ctx, input.PolicyID, people.ID)
+	if err != nil {
+		panic(fmt.Errorf("cannot publish policy version: %w", err))
+	}
+
+	return &types.PublishPolicyVersionPayload{
+		PolicyVersion: types.NewPolicyVersion(policyVersion),
+		Policy:        types.NewPolicy(policy),
+	}, nil
+}
+
+// CreateDraftPolicyVersion is the resolver for the createDraftPolicyVersion field.
+func (r *mutationResolver) CreateDraftPolicyVersion(ctx context.Context, input types.CreateDraftPolicyVersionInput) (*types.CreateDraftPolicyVersionPayload, error) {
+	svc := GetTenantService(ctx, r.proboSvc, input.PolicyID.TenantID())
+
+	user := UserFromContext(ctx)
+	people, err := svc.Peoples.GetByUserID(ctx, user.ID)
+	if err != nil {
+		panic(fmt.Errorf("cannot get people: %w", err))
+	}
+
+	policyVersion, err := svc.Policies.CreateDraft(ctx, input.PolicyID, people.ID)
+	if err != nil {
+		panic(fmt.Errorf("cannot create draft policy version: %w", err))
+	}
+
+	return &types.CreateDraftPolicyVersionPayload{
+		PolicyVersionEdge: types.NewPolicyVersionEdge(policyVersion, coredata.PolicyVersionOrderFieldCreatedAt),
+	}, nil
+}
+
+// UpdatePolicyVersion is the resolver for the updatePolicyVersion field.
+func (r *mutationResolver) UpdatePolicyVersion(ctx context.Context, input types.UpdatePolicyVersionInput) (*types.UpdatePolicyVersionPayload, error) {
+	svc := GetTenantService(ctx, r.proboSvc, input.PolicyVersionID.TenantID())
+
+	policyVersion, err := svc.Policies.UpdateVersion(ctx, probo.UpdatePolicyVersionRequest{
+		ID:      input.PolicyVersionID,
+		Content: input.Content,
+	})
+	if err != nil {
+		panic(fmt.Errorf("cannot update policy version: %w", err))
+	}
+
+	return &types.UpdatePolicyVersionPayload{
+		PolicyVersion: types.NewPolicyVersion(policyVersion),
+	}, nil
+}
+
+// RequestSignature is the resolver for the requestSignature field.
+func (r *mutationResolver) RequestSignature(ctx context.Context, input types.RequestSignatureInput) (*types.RequestSignaturePayload, error) {
+	svc := GetTenantService(ctx, r.proboSvc, input.PolicyVersionID.TenantID())
+
+	user := UserFromContext(ctx)
+
+	people, err := svc.Peoples.GetByUserID(ctx, user.ID)
+	if err != nil {
+		panic(fmt.Errorf("cannot get people: %w", err))
+	}
+
+	policyVersionSignature, err := svc.Policies.RequestSignature(
+		ctx,
+		probo.RequestSignatureRequest{
+			PolicyVersionID: input.PolicyVersionID,
+			RequestedBy:     people.ID,
+			Signatory:       input.SignatoryID,
+		},
+	)
+	if err != nil {
+		panic(fmt.Errorf("cannot request signature: %w", err))
+	}
+
+	return &types.RequestSignaturePayload{
+		PolicyVersionSignatureEdge: types.NewPolicyVersionSignatureEdge(policyVersionSignature, coredata.PolicyVersionSignatureOrderFieldCreatedAt),
+	}, nil
+}
+
 // CreateVendorRiskAssessment is the resolver for the createVendorRiskAssessment field.
 func (r *mutationResolver) CreateVendorRiskAssessment(ctx context.Context, input types.CreateVendorRiskAssessmentInput) (*types.CreateVendorRiskAssessmentPayload, error) {
 	svc := GetTenantService(ctx, r.proboSvc, input.VendorID.TenantID())
 
-	fmt.Println("input.AssessedBy", input.AssessedBy)
-	fmt.Println("input.ExpiresAt", input.ExpiresAt)
-	fmt.Println("input.DataSensitivity", input.DataSensitivity)
-	fmt.Println("input.BusinessImpact", input.BusinessImpact)
-	fmt.Println("input.Notes", input.Notes)
-
 	vendorRiskAssessment, err := svc.Vendors.CreateRiskAssessment(
 		ctx,
 		probo.CreateVendorRiskAssessmentRequest{
@@ -1225,7 +1293,7 @@ func (r *organizationResolver) Policies(ctx context.Context, obj *types.Organiza
 	svc := GetTenantService(ctx, r.proboSvc, obj.ID.TenantID())
 
 	pageOrderBy := page.OrderBy[coredata.PolicyOrderField]{
-		Field:     coredata.PolicyOrderFieldName,
+		Field:     coredata.PolicyOrderFieldTitle,
 		Direction: page.OrderDirectionDesc,
 	}
 	if orderBy != nil {
@@ -1313,6 +1381,31 @@ func (r *policyResolver) Owner(ctx context.Context, obj *types.Policy) (*types.P
 	return types.NewPeople(owner), nil
 }
 
+// Versions is the resolver for the versions field.
+func (r *policyResolver) Versions(ctx context.Context, obj *types.Policy, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.PolicyVersionOrderBy, filter *types.PolicyVersionFilter) (*types.PolicyVersionConnection, error) {
+	svc := GetTenantService(ctx, r.proboSvc, obj.ID.TenantID())
+
+	pageOrderBy := page.OrderBy[coredata.PolicyVersionOrderField]{
+		Field:     coredata.PolicyVersionOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.PolicyVersionOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	page, err := svc.Policies.ListVersions(ctx, obj.ID, cursor)
+	if err != nil {
+		panic(fmt.Errorf("cannot list policy versions: %w", err))
+	}
+
+	return types.NewPolicyVersionConnection(page), nil
+}
+
 // Controls is the resolver for the controls field.
 func (r *policyResolver) Controls(ctx context.Context, obj *types.Policy, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy) (*types.ControlConnection, error) {
 	svc := GetTenantService(ctx, r.proboSvc, obj.ID.TenantID())
@@ -1338,6 +1431,120 @@ func (r *policyResolver) Controls(ctx context.Context, obj *types.Policy, first
 	return types.NewControlConnection(page), nil
 }
 
+// Policy is the resolver for the policy field.
+func (r *policyVersionResolver) Policy(ctx context.Context, obj *types.PolicyVersion) (*types.Policy, error) {
+	svc := GetTenantService(ctx, r.proboSvc, obj.ID.TenantID())
+
+	policyVersion, err := svc.Policies.GetVersion(ctx, obj.ID)
+	if err != nil {
+		panic(fmt.Errorf("cannot get policy version: %w", err))
+	}
+
+	policy, err := svc.Policies.Get(ctx, policyVersion.PolicyID)
+	if err != nil {
+		panic(fmt.Errorf("cannot get policy: %w", err))
+	}
+
+	return types.NewPolicy(policy), nil
+}
+
+// Signatures is the resolver for the signatures field.
+func (r *policyVersionResolver) Signatures(ctx context.Context, obj *types.PolicyVersion, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.PolicyVersionSignatureOrder) (*types.PolicyVersionSignatureConnection, error) {
+	svc := GetTenantService(ctx, r.proboSvc, obj.ID.TenantID())
+
+	pageOrderBy := page.OrderBy[coredata.PolicyVersionSignatureOrderField]{
+		Field:     coredata.PolicyVersionSignatureOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.PolicyVersionSignatureOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	page, err := svc.Policies.ListSignatures(ctx, obj.ID, cursor)
+	if err != nil {
+		panic(fmt.Errorf("cannot list policy version signatures: %w", err))
+	}
+
+	return types.NewPolicyVersionSignatureConnection(page), nil
+}
+
+// PublishedBy is the resolver for the publishedBy field.
+func (r *policyVersionResolver) PublishedBy(ctx context.Context, obj *types.PolicyVersion) (*types.People, error) {
+	svc := GetTenantService(ctx, r.proboSvc, obj.ID.TenantID())
+
+	policyVersion, err := svc.Policies.GetVersion(ctx, obj.ID)
+	if err != nil {
+		panic(fmt.Errorf("cannot get policy version: %w", err))
+	}
+
+	if policyVersion.PublishedBy == nil {
+		return nil, nil
+	}
+
+	people, err := svc.Peoples.Get(ctx, *policyVersion.PublishedBy)
+	if err != nil {
+		panic(fmt.Errorf("cannot get people: %w", err))
+	}
+
+	return types.NewPeople(people), nil
+}
+
+// PolicyVersion is the resolver for the policyVersion field.
+func (r *policyVersionSignatureResolver) PolicyVersion(ctx context.Context, obj *types.PolicyVersionSignature) (*types.PolicyVersion, error) {
+	svc := GetTenantService(ctx, r.proboSvc, obj.ID.TenantID())
+
+	policyVersionSignature, err := svc.Policies.GetVersionSignature(ctx, obj.ID)
+	if err != nil {
+		panic(fmt.Errorf("cannot get policy version signature: %w", err))
+	}
+
+	policyVersion, err := svc.Policies.GetVersion(ctx, policyVersionSignature.PolicyVersionID)
+	if err != nil {
+		panic(fmt.Errorf("cannot get policy version: %w", err))
+	}
+
+	return types.NewPolicyVersion(policyVersion), nil
+}
+
+// SignedBy is the resolver for the signedBy field.
+func (r *policyVersionSignatureResolver) SignedBy(ctx context.Context, obj *types.PolicyVersionSignature) (*types.People, error) {
+	svc := GetTenantService(ctx, r.proboSvc, obj.ID.TenantID())
+
+	policyVersionSignature, err := svc.Policies.GetVersionSignature(ctx, obj.ID)
+	if err != nil {
+		panic(fmt.Errorf("cannot get policy version signature: %w", err))
+	}
+
+	people, err := svc.Peoples.Get(ctx, policyVersionSignature.SignedBy)
+	if err != nil {
+		panic(fmt.Errorf("cannot get people: %w", err))
+	}
+
+	return types.NewPeople(people), nil
+}
+
+// RequestedBy is the resolver for the requestedBy field.
+func (r *policyVersionSignatureResolver) RequestedBy(ctx context.Context, obj *types.PolicyVersionSignature) (*types.People, error) {
+	svc := GetTenantService(ctx, r.proboSvc, obj.ID.TenantID())
+
+	policyVersionSignature, err := svc.Policies.GetVersionSignature(ctx, obj.ID)
+	if err != nil {
+		panic(fmt.Errorf("cannot get policy version signature: %w", err))
+	}
+
+	people, err := svc.Peoples.Get(ctx, policyVersionSignature.RequestedBy)
+	if err != nil {
+		panic(fmt.Errorf("cannot get people: %w", err))
+	}
+
+	return types.NewPeople(people), nil
+}
+
 // Node is the resolver for the node field.
 func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error) {
 	svc := GetTenantService(ctx, r.proboSvc, id.TenantID())
@@ -1417,6 +1624,18 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 			panic(fmt.Errorf("cannot get vendor compliance report: %w", err))
 		}
 		return types.NewVendorComplianceReport(vendorComplianceReport), nil
+	case coredata.PolicyVersionEntityType:
+		policyVersion, err := svc.Policies.GetVersion(ctx, id)
+		if err != nil {
+			panic(fmt.Errorf("cannot get policy version: %w", err))
+		}
+		return types.NewPolicyVersion(policyVersion), nil
+	case coredata.PolicyVersionSignatureEntityType:
+		policyVersionSignature, err := svc.Policies.GetVersionSignature(ctx, id)
+		if err != nil {
+			panic(fmt.Errorf("cannot get policy version signature: %w", err))
+		}
+		return types.NewPolicyVersionSignature(policyVersionSignature), nil
 	default:
 	}
 
@@ -1579,7 +1798,7 @@ func (r *taskResolver) Evidences(ctx context.Context, obj *types.Task, first *in
 func (r *userResolver) People(ctx context.Context, obj *types.User, organizationID gid.GID) (*types.People, error) {
 	svc := GetTenantService(ctx, r.proboSvc, organizationID.TenantID())
 
-	people, err := svc.Peoples.GetByUserID(ctx, organizationID, obj.ID)
+	people, err := svc.Peoples.GetByUserID(ctx, obj.ID)
 	if err != nil {
 		panic(fmt.Errorf("failed to get people: %w", err))
 	}
@@ -1778,6 +1997,14 @@ func (r *Resolver) Organization() schema.OrganizationResolver { return &organiza
 // Policy returns schema.PolicyResolver implementation.
 func (r *Resolver) Policy() schema.PolicyResolver { return &policyResolver{r} }
 
+// PolicyVersion returns schema.PolicyVersionResolver implementation.
+func (r *Resolver) PolicyVersion() schema.PolicyVersionResolver { return &policyVersionResolver{r} }
+
+// PolicyVersionSignature returns schema.PolicyVersionSignatureResolver implementation.
+func (r *Resolver) PolicyVersionSignature() schema.PolicyVersionSignatureResolver {
+	return &policyVersionSignatureResolver{r}
+}
+
 // Query returns schema.QueryResolver implementation.
 func (r *Resolver) Query() schema.QueryResolver { return &queryResolver{r} }
 
@@ -1813,6 +2040,8 @@ type mesureResolver struct{ *Resolver }
 type mutationResolver struct{ *Resolver }
 type organizationResolver struct{ *Resolver }
 type policyResolver struct{ *Resolver }
+type policyVersionResolver struct{ *Resolver }
+type policyVersionSignatureResolver struct{ *Resolver }
 type queryResolver struct{ *Resolver }
 type riskResolver struct{ *Resolver }
 type taskResolver struct{ *Resolver }