Assets as document: replace snapshot with publish workflow

Remove assets from the snapshot system and replace with a publish-based document workflow that generates versioned ProseMirror documents. - Remove snapshot_id/source_id from asset and asset_vendor models - Delete AssetFilter (no longer needed without snapshot filtering) - Add PublishAssetList service, GraphQL mutation, MCP tool, CLI command, and n8n operation - Add asset_list_document_id column to generated_documents table - Generate ProseMirror documents with asset inventory tables (name, type, amount, data types stored, owner, vendors) - Add AssetListDocument resolver on Organization type - Update frontend to remove snapshot routes/params and add publish dialog - Add e2e tests for asset publish (immediate, with approvers, reuse, RBAC) - Add migration script for converting legacy asset snapshots to documents - Exclude ASSETS from snapshot type lists and e2e snapshot tests - Move generated_documents SQL to coredata methods on Datum and Asset - Clear generated document and SOA references on soft delete and archive Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
2026-04-21 18:40:49 +02:00
parent 565b71526c
commit b603d04d8d
40 changed files with 2315 additions and 486 deletions
--- a/pkg/coredata/asset.go
+++ b/pkg/coredata/asset.go
@@ -30,8 +30,6 @@ import (
 type (
 	Asset struct {
 		ID              gid.GID   `db:"id"`
-		SnapshotID      *gid.GID  `db:"snapshot_id"`
-		SourceID        *gid.GID  `db:"source_id"`
 		Name            string    `db:"name"`
 		Amount          int       `db:"amount"`
 		OwnerID         gid.GID   `db:"owner_profile_id"`
@@ -80,8 +78,6 @@ func (a *Asset) LoadByID(
 	q := `
 SELECT
 	id,
-	snapshot_id,
-	source_id,
 	name,
 	organization_id,
 	owner_profile_id,
@@ -95,6 +91,7 @@ FROM
 WHERE
 	%s
 	AND id = @asset_id
+	AND snapshot_id IS NULL
 LIMIT 1;
 `

@@ -130,8 +127,6 @@ func (a *Asset) LoadByOwnerID(
 	q := `
 SELECT
 	id,
-	snapshot_id,
-	source_id,
 	name,
 	organization_id,
 	owner_profile_id,
@@ -145,6 +140,7 @@ FROM
 WHERE
 	%s
 	AND owner_profile_id = @owner_profile_id
+	AND snapshot_id IS NULL
 LIMIT 1;
 `

@@ -177,7 +173,6 @@ func (a *Assets) CountByOrganizationID(
 	conn pg.Querier,
 	scope Scoper,
 	organizationID gid.GID,
-	filter *AssetFilter,
 ) (int, error) {
 	q := `
 SELECT
@@ -187,14 +182,13 @@ FROM
 WHERE
 	%s
 	AND organization_id = @organization_id
-	AND %s
+	AND snapshot_id IS NULL
 `

-	q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment())
+	q = fmt.Sprintf(q, scope.SQLFragment())

 	args := pgx.StrictNamedArgs{"organization_id": organizationID}
 	maps.Copy(args, scope.SQLArguments())
-	maps.Copy(args, filter.SQLArguments())

 	row := conn.QueryRow(ctx, q, args)

@@ -212,13 +206,10 @@ func (a *Assets) LoadByOrganizationID(
 	scope Scoper,
 	organizationID gid.GID,
 	cursor *page.Cursor[AssetOrderField],
-	filter *AssetFilter,
 ) error {
 	q := `
 SELECT
 	id,
-	snapshot_id,
-	source_id,
 	name,
 	organization_id,
 	owner_profile_id,
@@ -232,15 +223,14 @@ FROM
 WHERE
 	%s
 	AND organization_id = @organization_id
-	AND %s
+	AND snapshot_id IS NULL
 	AND %s
 `

-	q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment(), cursor.SQLFragment())
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())

 	args := pgx.StrictNamedArgs{"organization_id": organizationID}
 	maps.Copy(args, scope.SQLArguments())
-	maps.Copy(args, filter.SQLArguments())
 	maps.Copy(args, cursor.SQLArguments())

 	rows, err := conn.Query(ctx, q, args)
@@ -258,6 +248,53 @@ WHERE
 	return nil
 }

+func (a *Assets) LoadAllByOrganizationID(
+	ctx context.Context,
+	conn pg.Querier,
+	scope Scoper,
+	organizationID gid.GID,
+) error {
+	q := `
+SELECT
+	id,
+	name,
+	organization_id,
+	owner_profile_id,
+	amount,
+	asset_type,
+	data_types_stored,
+	created_at,
+	updated_at
+FROM
+	assets
+WHERE
+	%s
+	AND organization_id = @organization_id
+	AND snapshot_id IS NULL
+ORDER BY
+	name ASC
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"organization_id": organizationID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query assets: %w", err)
+	}
+
+	assets, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Asset])
+	if err != nil {
+		return fmt.Errorf("cannot collect assets: %w", err)
+	}
+
+	*a = assets
+
+	return nil
+}
+
 func (a *Asset) Insert(
 	ctx context.Context,
 	conn pg.Tx,
@@ -330,8 +367,6 @@ WHERE
 	AND snapshot_id IS NULL
 RETURNING
 	id,
-	snapshot_id,
-	source_id,
 	name,
 	organization_id,
 	owner_profile_id,
@@ -396,75 +431,108 @@ WHERE
 	return nil
 }

-func (assets Assets) Snapshot(ctx context.Context, conn pg.Tx, scope Scoper, organizationID, snapshotID gid.GID) error {
-	snapshotters := []AssetSnapshotter{Assets{}, Vendors{}, AssetVendors{}}
+func (a Asset) GetGeneratedDocumentID(
+	ctx context.Context,
+	conn pg.Querier,
+	organizationID gid.GID,
+) (*gid.GID, error) {
+	var documentID *gid.GID

-	for _, snapshotter := range snapshotters {
-		if err := snapshotter.InsertAssetSnapshots(ctx, conn, scope, organizationID, snapshotID); err != nil {
-			return fmt.Errorf("cannot create asset snapshots: (%T) %w", snapshotter, err)
-		}
+	err := conn.QueryRow(
+		ctx,
+		`
+SELECT
+	asset_list_document_id
+FROM
+	generated_documents
+WHERE
+	organization_id = @organization_id
+`,
+		pgx.NamedArgs{"organization_id": organizationID},
+	).Scan(&documentID)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("cannot get asset list document ID: %w", err)
 	}

-	return nil
+	return documentID, nil
 }

-func (assets Assets) InsertAssetSnapshots(
+func (a Asset) UpsertGeneratedDocumentID(
 	ctx context.Context,
 	conn pg.Tx,
-	scope Scoper,
 	organizationID gid.GID,
-	snapshotID gid.GID,
+	tenantID gid.TenantID,
+	documentID gid.GID,
 ) error {
-	query := `
-WITH
-	source_assets AS (
-		SELECT *
-		FROM assets
-		WHERE %s AND organization_id = @organization_id AND snapshot_id IS NULL
-	)
-INSERT INTO assets (
-	tenant_id,
-	id,
-	snapshot_id,
-	source_id,
-	name,
+	now := time.Now()
+
+	_, err := conn.Exec(
+		ctx,
+		`
+INSERT INTO generated_documents (
 	organization_id,
-	owner_profile_id,
-	amount,
-	asset_type,
-	data_types_stored,
+	tenant_id,
+	asset_list_document_id,
 	created_at,
 	updated_at
-)
-SELECT
+) VALUES (
+	@organization_id,
 	@tenant_id,
-	generate_gid(decode_base64_unpadded(@tenant_id), @asset_entity_type),
-	@snapshot_id,
-	a.id,
-	a.name,
-	a.organization_id,
-	a.owner_profile_id,
-	a.amount,
-	a.asset_type,
-	a.data_types_stored,
-	a.created_at,
-	a.updated_at
-FROM source_assets a
-	`
-
-	query = fmt.Sprintf(query, scope.SQLFragment())
-
-	args := pgx.StrictNamedArgs{
-		"tenant_id":         scope.GetTenantID(),
-		"snapshot_id":       snapshotID,
-		"organization_id":   organizationID,
-		"asset_entity_type": AssetEntityType,
-	}
-	maps.Copy(args, scope.SQLArguments())
-
-	_, err := conn.Exec(ctx, query, args)
+	@asset_list_document_id,
+	@created_at,
+	@updated_at
+)
+ON CONFLICT (organization_id) DO UPDATE
+SET
+	asset_list_document_id = @asset_list_document_id,
+	updated_at = @updated_at
+`,
+		pgx.NamedArgs{
+			"organization_id":        organizationID,
+			"tenant_id":              tenantID,
+			"asset_list_document_id": documentID,
+			"created_at":             now,
+			"updated_at":             now,
+		},
+	)
 	if err != nil {
-		return fmt.Errorf("cannot insert asset snapshots: %w", err)
+		return fmt.Errorf("cannot upsert asset list document ID: %w", err)
+	}
+
+	return nil
+}
+
+func (a Asset) ClearGeneratedDocumentID(
+	ctx context.Context,
+	conn pg.Tx,
+	documentIDs []gid.GID,
+) error {
+	ids := make([]string, len(documentIDs))
+	for i, id := range documentIDs {
+		ids[i] = id.String()
+	}
+
+	_, err := conn.Exec(
+		ctx,
+		`
+UPDATE
+	generated_documents
+SET
+	asset_list_document_id = NULL,
+	updated_at = @now
+WHERE
+	asset_list_document_id = ANY(@ids)
+`,
+		pgx.NamedArgs{
+			"ids": ids,
+			"now": time.Now(),
+		},
+	)
+	if err != nil {
+		return fmt.Errorf("cannot clear asset list document references: %w", err)
 	}

 	return nil
--- a/pkg/coredata/asset_filter.go
+++ b/pkg/coredata/asset_filter.go
@@ -1,54 +0,0 @@
-// Copyright (c) 2025-2026 Probo Inc <hello@getprobo.com>.
-//
-// Permission to use, copy, modify, and/or distribute this software for any
-// purpose with or without fee is hereby granted, provided that the above
-// copyright notice and this permission notice appear in all copies.
-//
-// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
-// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
-// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
-// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-// PERFORMANCE OF THIS SOFTWARE.
-
-package coredata
-
-import (
-	"github.com/jackc/pgx/v5"
-	"go.probo.inc/probo/pkg/gid"
-)
-
-type (
-	AssetFilter struct {
-		snapshotID **gid.GID
-	}
-)
-
-func NewAssetFilter(snapshotID **gid.GID) *AssetFilter {
-	return &AssetFilter{
-		snapshotID: snapshotID,
-	}
-}
-
-func (f *AssetFilter) SQLArguments() pgx.NamedArgs {
-	args := pgx.NamedArgs{}
-
-	if f.snapshotID != nil && *f.snapshotID != nil {
-		args["filter_snapshot_id"] = **f.snapshotID
-	}
-
-	return args
-}
-
-func (f *AssetFilter) SQLFragment() string {
-	if f.snapshotID == nil {
-		return "TRUE"
-	}
-
-	if *f.snapshotID == nil {
-		return "snapshot_id IS NULL"
-	} else {
-		return "snapshot_id = @filter_snapshot_id"
-	}
-}
--- a/pkg/coredata/asset_vendor.go
+++ b/pkg/coredata/asset_vendor.go
@@ -17,7 +17,6 @@ package coredata
 import (
 	"context"
 	"fmt"
-	"maps"
 	"time"

 	"github.com/jackc/pgx/v5"
@@ -27,18 +26,13 @@ import (

 type (
 	AssetVendor struct {
-		AssetID    gid.GID      `db:"asset_id"`
-		VendorID   gid.GID      `db:"vendor_id"`
-		TenantID   gid.TenantID `db:"tenant_id"`
-		SnapshotID *gid.GID     `db:"snapshot_id"`
-		CreatedAt  time.Time    `db:"created_at"`
+		AssetID   gid.GID      `db:"asset_id"`
+		VendorID  gid.GID      `db:"vendor_id"`
+		TenantID  gid.TenantID `db:"tenant_id"`
+		CreatedAt time.Time    `db:"created_at"`
 	}

 	AssetVendors []*AssetVendor
-
-	AssetSnapshotter interface {
-		InsertAssetSnapshots(ctx context.Context, conn pg.Tx, scope Scoper, organizationID, snapshotID gid.GID) error
-	}
 )

 func (av AssetVendors) Merge(
@@ -124,61 +118,3 @@ FROM vendor_ids

 	return nil
 }
-
-func (av AssetVendors) InsertAssetSnapshots(
-	ctx context.Context,
-	conn pg.Tx,
-	scope Scoper,
-	organizationID gid.GID,
-	snapshotID gid.GID,
-) error {
-	query := `
-WITH
-	source_assets AS (
-		SELECT id
-		FROM assets
-		WHERE organization_id = @organization_id AND snapshot_id IS NULL
-	),
-	snapshot_assets AS (
-		SELECT id, source_id
-		FROM assets
-		WHERE organization_id = @organization_id AND snapshot_id = @snapshot_id
-	),
-	snapshot_vendors AS (
-		SELECT id, source_id
-		FROM vendors
-		WHERE organization_id = @organization_id AND snapshot_id = @snapshot_id
-	),
-	source_asset_vendors AS (
-		SELECT asset_id, vendor_id, snapshot_id, created_at
-		FROM asset_vendors
-		WHERE %s AND asset_id = ANY(SELECT id FROM source_assets) AND snapshot_id IS NULL
-	)
-INSERT INTO asset_vendors (tenant_id, asset_id, vendor_id, organization_id, snapshot_id, created_at)
-SELECT
-	@tenant_id,
-	sa.id,
-	sv.id,
-	@organization_id,
-	@snapshot_id,
-	av.created_at
-FROM source_asset_vendors av
-JOIN snapshot_assets sa ON sa.source_id = av.asset_id
-JOIN snapshot_vendors sv ON sv.source_id = av.vendor_id
-`
-
-	query = fmt.Sprintf(query, scope.SQLFragment())
-
-	args := pgx.StrictNamedArgs{
-		"snapshot_id":     snapshotID,
-		"organization_id": organizationID,
-	}
-	maps.Copy(args, scope.SQLArguments())
-
-	_, err := conn.Exec(ctx, query, args)
-	if err != nil {
-		return fmt.Errorf("cannot insert asset vendor snapshots: %w", err)
-	}
-
-	return nil
-}
--- a/pkg/coredata/datum.go
+++ b/pkg/coredata/datum.go
@@ -403,3 +403,110 @@ WHERE

 	return nil
 }
+
+func (d Datum) GetGeneratedDocumentID(
+	ctx context.Context,
+	conn pg.Querier,
+	organizationID gid.GID,
+) (*gid.GID, error) {
+	var documentID *gid.GID
+
+	err := conn.QueryRow(
+		ctx,
+		`
+SELECT
+	data_document_id
+FROM
+	generated_documents
+WHERE
+	organization_id = @organization_id
+`,
+		pgx.NamedArgs{"organization_id": organizationID},
+	).Scan(&documentID)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("cannot get data document ID: %w", err)
+	}
+
+	return documentID, nil
+}
+
+func (d Datum) UpsertGeneratedDocumentID(
+	ctx context.Context,
+	conn pg.Tx,
+	organizationID gid.GID,
+	tenantID gid.TenantID,
+	documentID gid.GID,
+) error {
+	now := time.Now()
+
+	_, err := conn.Exec(
+		ctx,
+		`
+INSERT INTO generated_documents (
+	organization_id,
+	tenant_id,
+	data_document_id,
+	created_at,
+	updated_at
+) VALUES (
+	@organization_id,
+	@tenant_id,
+	@data_document_id,
+	@created_at,
+	@updated_at
+)
+ON CONFLICT (organization_id) DO UPDATE
+SET
+	data_document_id = @data_document_id,
+	updated_at = @updated_at
+`,
+		pgx.NamedArgs{
+			"organization_id":  organizationID,
+			"tenant_id":        tenantID,
+			"data_document_id": documentID,
+			"created_at":       now,
+			"updated_at":       now,
+		},
+	)
+	if err != nil {
+		return fmt.Errorf("cannot upsert data document ID: %w", err)
+	}
+
+	return nil
+}
+
+func (d Datum) ClearGeneratedDocumentID(
+	ctx context.Context,
+	conn pg.Tx,
+	documentIDs []gid.GID,
+) error {
+	ids := make([]string, len(documentIDs))
+	for i, id := range documentIDs {
+		ids[i] = id.String()
+	}
+
+	_, err := conn.Exec(
+		ctx,
+		`
+UPDATE
+	generated_documents
+SET
+	data_document_id = NULL,
+	updated_at = @now
+WHERE
+	data_document_id = ANY(@ids)
+`,
+		pgx.NamedArgs{
+			"ids": ids,
+			"now": time.Now(),
+		},
+	)
+	if err != nil {
+		return fmt.Errorf("cannot clear data document references: %w", err)
+	}
+
+	return nil
+}
--- a/pkg/coredata/migrations/20260420T140000Z.sql
+++ b/pkg/coredata/migrations/20260420T140000Z.sql
@@ -0,0 +1,16 @@
+-- Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+--
+-- Permission to use, copy, modify, and/or distribute this software for any
+-- purpose with or without fee is hereby granted, provided that the above
+-- copyright notice and this permission notice appear in all copies.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+-- PERFORMANCE OF THIS SOFTWARE.
+
+ALTER TABLE generated_documents
+    ADD COLUMN asset_list_document_id TEXT REFERENCES documents(id) ON DELETE SET NULL;
--- a/pkg/coredata/snapshot.go
+++ b/pkg/coredata/snapshot.go
@@ -124,7 +124,7 @@ FROM
 WHERE
 	%s
 	AND organization_id = @organization_id
-	AND type NOT IN ('STATEMENTS_OF_APPLICABILITY', 'DATA')
+	AND type NOT IN ('STATEMENTS_OF_APPLICABILITY', 'DATA', 'ASSETS')
 	AND %s
 `

@@ -164,7 +164,7 @@ FROM
 WHERE
 	%s
 	AND organization_id = @organization_id
-	AND type NOT IN ('STATEMENTS_OF_APPLICABILITY', 'DATA')
+	AND type NOT IN ('STATEMENTS_OF_APPLICABILITY', 'DATA', 'ASSETS')
 	AND %s
 `

--- a/pkg/coredata/snapshots_type.go
+++ b/pkg/coredata/snapshots_type.go
@@ -38,7 +38,6 @@ func SnapshotsTypes() []SnapshotsType {
 	return []SnapshotsType{
 		SnapshotsTypeRisks,
 		SnapshotsTypeVendors,
-		SnapshotsTypeAssets,
 		SnapshotsTypeFindings,
 		SnapshotsTypeObligations,
 		SnapshotsTypeProcessingActivities,
--- a/pkg/coredata/snapshottable.go
+++ b/pkg/coredata/snapshottable.go
@@ -28,8 +28,6 @@ type Snapshottable interface {

 func GetSnapshottable(snapshotType SnapshotsType) (Snapshottable, error) {
 	switch snapshotType {
-	case SnapshotsTypeAssets:
-		return Assets{}, nil
 	case SnapshotsTypeRisks:
 		return Risks{}, nil
 	case SnapshotsTypeFindings:
--- a/pkg/coredata/statement_of_applicability.go
+++ b/pkg/coredata/statement_of_applicability.go
@@ -313,3 +313,36 @@ WHERE

 	return nil
 }
+
+func (s StatementOfApplicability) ClearDocumentIDByDocumentIDs(
+	ctx context.Context,
+	conn pg.Tx,
+	documentIDs []gid.GID,
+) error {
+	ids := make([]string, len(documentIDs))
+	for i, id := range documentIDs {
+		ids[i] = id.String()
+	}
+
+	_, err := conn.Exec(
+		ctx,
+		`
+UPDATE
+	statements_of_applicability
+SET
+	document_id = NULL,
+	updated_at = @now
+WHERE
+	document_id = ANY(@ids)
+`,
+		pgx.NamedArgs{
+			"ids": ids,
+			"now": time.Now(),
+		},
+	)
+	if err != nil {
+		return fmt.Errorf("cannot clear statement of applicability document references: %w", err)
+	}
+
+	return nil
+}
--- a/pkg/coredata/vendor.go
+++ b/pkg/coredata/vendor.go
@@ -1077,35 +1077,52 @@ ORDER BY
 	return vendorMap, nil
 }

-func (vs Vendors) InsertAssetSnapshots(
+func (vs *Vendors) LoadAllByAssetID(
 	ctx context.Context,
-	conn pg.Tx,
+	conn pg.Querier,
 	scope Scoper,
-	organizationID gid.GID,
-	snapshotID gid.GID,
+	assetID gid.GID,
 ) error {
-	query := `
-WITH
-	source_assets AS (
-		SELECT id
-		FROM assets
-		WHERE organization_id = @organization_id AND snapshot_id IS NULL
-	),
-	source_asset_vendors AS (
-		SELECT asset_id, vendor_id, snapshot_id, created_at
-		FROM asset_vendors
-		WHERE asset_id = ANY(SELECT id FROM source_assets)
-	),
-	source_vendors AS (
-		SELECT *
-		FROM vendors
-		WHERE %s AND id = ANY(SELECT vendor_id FROM source_asset_vendors)
-	)
-INSERT INTO vendors (
-	tenant_id,
+	q := `
+WITH vend AS (
+	SELECT
+		v.id,
+		v.tenant_id,
+		v.organization_id,
+		v.name,
+		v.description,
+		v.category,
+		v.headquarter_address,
+		v.legal_name,
+		v.website_url,
+		v.privacy_policy_url,
+		v.service_level_agreement_url,
+		v.data_processing_agreement_url,
+		v.business_associate_agreement_url,
+		v.subprocessors_list_url,
+		v.certifications,
+		v.countries,
+		v.business_owner_profile_id,
+		v.security_owner_profile_id,
+		v.status_page_url,
+		v.terms_of_service_url,
+		v.security_page_url,
+		v.trust_page_url,
+		v.show_on_trust_center,
+		v.snapshot_id,
+		v.source_id,
+		v.created_at,
+		v.updated_at
+	FROM
+		vendors v
+	INNER JOIN
+		asset_vendors av ON v.id = av.vendor_id
+	WHERE
+		av.asset_id = @asset_id
+)
+SELECT
 	id,
-	snapshot_id,
-	source_id,
+	tenant_id,
 	organization_id,
 	name,
 	description,
@@ -1127,55 +1144,32 @@ INSERT INTO vendors (
 	security_page_url,
 	trust_page_url,
 	show_on_trust_center,
+	snapshot_id,
+	source_id,
 	created_at,
 	updated_at
-)
-SELECT
-	@tenant_id,
-	generate_gid(decode_base64_unpadded(@tenant_id), @vendor_entity_type),
-	@snapshot_id,
-	v.id,
-	v.organization_id,
-	v.name,
-	v.description,
-	v.category,
-	v.headquarter_address,
-	v.legal_name,
-	v.website_url,
-	v.privacy_policy_url,
-	v.service_level_agreement_url,
-	v.data_processing_agreement_url,
-	v.business_associate_agreement_url,
-	v.subprocessors_list_url,
-	v.certifications,
-	v.countries,
-	v.business_owner_profile_id,
-	v.security_owner_profile_id,
-	v.status_page_url,
-	v.terms_of_service_url,
-	v.security_page_url,
-	v.trust_page_url,
-	v.show_on_trust_center,
-	v.created_at,
-	v.updated_at
-FROM source_vendors v
-	`
+FROM
+	vend
+WHERE %s
+ORDER BY name ASC
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())

-	query = fmt.Sprintf(query, scope.SQLFragment())
-
-	args := pgx.StrictNamedArgs{
-		"tenant_id":          scope.GetTenantID(),
-		"snapshot_id":        snapshotID,
-		"organization_id":    organizationID,
-		"vendor_entity_type": VendorEntityType,
-	}
+	args := pgx.StrictNamedArgs{"asset_id": assetID}
 	maps.Copy(args, scope.SQLArguments())

-	_, err := conn.Exec(ctx, query, args)
+	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot insert vendor snapshots for assets: %w", err)
+		return fmt.Errorf("cannot query vendors: %w", err)
 	}

+	vendors, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Vendor])
+	if err != nil {
+		return fmt.Errorf("cannot collect vendors: %w", err)
+	}
+
+	*vs = vendors
+
 	return nil
 }