Add third-party self-referential relations

Introduce a self-referential many-to-many relation table so a third party can have child third parties. Each relation is directional (parent to child); both directions can coexist as independent rows. Add a first_level boolean on third_parties (default true) with a filter on the list page that defaults to showing only first-level third parties. Frontend adds a "Third Parties" tab on the detail page where users can link existing third parties or create new ones from the common third party catalog (created as non-first-level). The list page gets a First Level/All toggle filter. Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
2026-05-19 19:13:16 +02:00
parent 8ff68798fb
commit b6b1e801b1
37 changed files with 2399 additions and 45 deletions
--- a/e2e/console/third_party_relation_test.go
+++ b/e2e/console/third_party_relation_test.go
@@ -0,0 +1,508 @@
+// Copyright (c) 2025-2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/factory"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+func TestThirdPartyRelation_AddAndList(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	parentID := factory.NewThirdParty(owner).WithName("Parent Corp").Create()
+	childID := factory.NewThirdParty(owner).WithName("Child Corp").Create()
+
+	addRelation(t, owner, parentID, childID)
+
+	t.Run("list child third parties", func(t *testing.T) {
+		t.Parallel()
+
+		const query = `
+			query($id: ID!) {
+				node(id: $id) {
+					... on ThirdParty {
+						childThirdParties(first: 10) {
+							totalCount
+							edges {
+								node {
+									id
+									name
+								}
+							}
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			Node struct {
+				ChildThirdParties struct {
+					TotalCount int `json:"totalCount"`
+					Edges      []struct {
+						Node struct {
+							ID   string `json:"id"`
+							Name string `json:"name"`
+						} `json:"node"`
+					} `json:"edges"`
+				} `json:"childThirdParties"`
+			} `json:"node"`
+		}
+
+		err := owner.Execute(query, map[string]any{"id": parentID}, &result)
+
+		require.NoError(t, err)
+		assert.Equal(t, 1, result.Node.ChildThirdParties.TotalCount)
+		require.Len(t, result.Node.ChildThirdParties.Edges, 1)
+		assert.Equal(t, childID, result.Node.ChildThirdParties.Edges[0].Node.ID)
+	})
+}
+
+func TestThirdPartyRelation_Remove(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	parentID := factory.NewThirdParty(owner).WithName("Parent Remove").Create()
+	childID := factory.NewThirdParty(owner).WithName("Child Remove").Create()
+
+	addRelation(t, owner, parentID, childID)
+
+	const removeQuery = `
+		mutation($input: DeleteThirdPartyThirdPartyMappingInput!) {
+			deleteThirdPartyThirdPartyMapping(input: $input) {
+				removedThirdPartyId
+			}
+		}
+	`
+
+	var result struct {
+		DeleteThirdPartyThirdPartyMapping struct {
+			RemovedThirdPartyID string `json:"removedThirdPartyId"`
+		} `json:"deleteThirdPartyThirdPartyMapping"`
+	}
+
+	err := owner.Execute(removeQuery, map[string]any{
+		"input": map[string]any{
+			"parentThirdPartyId": parentID,
+			"childThirdPartyId":  childID,
+		},
+	}, &result)
+
+	require.NoError(t, err)
+	assert.Equal(t, childID, result.DeleteThirdPartyThirdPartyMapping.RemovedThirdPartyID)
+
+	count := countChildThirdParties(t, owner, parentID)
+	assert.Equal(t, 0, count)
+}
+
+func TestThirdPartyRelation_Bidirectional(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	aID := factory.NewThirdParty(owner).WithName("Company A").Create()
+	bID := factory.NewThirdParty(owner).WithName("Company B").Create()
+
+	addRelation(t, owner, aID, bID)
+	addRelation(t, owner, bID, aID)
+
+	t.Run("A has B as child", func(t *testing.T) {
+		t.Parallel()
+		count := countChildThirdParties(t, owner, aID)
+		assert.Equal(t, 1, count)
+	})
+
+	t.Run("B has A as child", func(t *testing.T) {
+		t.Parallel()
+		count := countChildThirdParties(t, owner, bID)
+		assert.Equal(t, 1, count)
+	})
+}
+
+func TestThirdPartyRelation_Idempotent(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	parentID := factory.NewThirdParty(owner).WithName("Idempotent Parent").Create()
+	childID := factory.NewThirdParty(owner).WithName("Idempotent Child").Create()
+
+	addRelation(t, owner, parentID, childID)
+	addRelation(t, owner, parentID, childID)
+
+	count := countChildThirdParties(t, owner, parentID)
+	assert.Equal(t, 1, count)
+}
+
+func TestThirdPartyRelation_CascadeOnDelete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	parentID := factory.NewThirdParty(owner).WithName("Cascade Parent").Create()
+	childID := factory.NewThirdParty(owner).WithName("Cascade Child").Create()
+
+	addRelation(t, owner, parentID, childID)
+
+	const deleteQuery = `
+		mutation($input: DeleteThirdPartyInput!) {
+			deleteThirdParty(input: $input) {
+				deletedThirdPartyId
+			}
+		}
+	`
+
+	var result struct {
+		DeleteThirdParty struct {
+			DeletedThirdPartyID string `json:"deletedThirdPartyId"`
+		} `json:"deleteThirdParty"`
+	}
+
+	err := owner.Execute(deleteQuery, map[string]any{
+		"input": map[string]any{
+			"thirdPartyId": childID,
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	count := countChildThirdParties(t, owner, parentID)
+	assert.Equal(t, 0, count)
+}
+
+func TestThirdPartyRelation_Authorization(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	viewer := testutil.NewClientInOrg(t, testutil.RoleViewer, owner)
+
+	parentID := factory.NewThirdParty(owner).WithName("Auth Parent").Create()
+	childID := factory.NewThirdParty(owner).WithName("Auth Child").Create()
+
+	t.Run("viewer cannot add relation", func(t *testing.T) {
+		t.Parallel()
+
+		const query = `
+			mutation($input: CreateThirdPartyThirdPartyMappingInput!) {
+				createThirdPartyThirdPartyMapping(input: $input) {
+					thirdPartyEdge {
+						node { id }
+					}
+				}
+			}
+		`
+
+		_, err := viewer.Do(query, map[string]any{
+			"input": map[string]any{
+				"parentThirdPartyId": parentID,
+				"childThirdPartyId":  childID,
+			},
+		})
+		testutil.RequireForbiddenError(t, err)
+	})
+
+	t.Run("viewer cannot remove relation", func(t *testing.T) {
+		t.Parallel()
+
+		addRelation(t, owner, parentID, childID)
+
+		const query = `
+			mutation($input: DeleteThirdPartyThirdPartyMappingInput!) {
+				deleteThirdPartyThirdPartyMapping(input: $input) {
+					removedThirdPartyId
+				}
+			}
+		`
+
+		_, err := viewer.Do(query, map[string]any{
+			"input": map[string]any{
+				"parentThirdPartyId": parentID,
+				"childThirdPartyId":  childID,
+			},
+		})
+		testutil.RequireForbiddenError(t, err)
+	})
+
+	t.Run("viewer can list child third parties", func(t *testing.T) {
+		t.Parallel()
+
+		count := countChildThirdParties(t, viewer, parentID)
+		assert.GreaterOrEqual(t, count, 0)
+	})
+}
+
+func TestThirdPartyRelation_TenantIsolation(t *testing.T) {
+	t.Parallel()
+
+	org1Owner := testutil.NewClient(t, testutil.RoleOwner)
+	org2Owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	parentID := factory.NewThirdParty(org1Owner).WithName("Org1 Parent").Create()
+	childID := factory.NewThirdParty(org1Owner).WithName("Org1 Child").Create()
+	org2ChildID := factory.NewThirdParty(org2Owner).WithName("Org2 Child").Create()
+
+	addRelation(t, org1Owner, parentID, childID)
+
+	t.Run("cannot add cross-org relation", func(t *testing.T) {
+		t.Parallel()
+
+		const query = `
+			mutation($input: CreateThirdPartyThirdPartyMappingInput!) {
+				createThirdPartyThirdPartyMapping(input: $input) {
+					thirdPartyEdge {
+						node { id }
+					}
+				}
+			}
+		`
+
+		_, err := org1Owner.Do(query, map[string]any{
+			"input": map[string]any{
+				"parentThirdPartyId": parentID,
+				"childThirdPartyId":  org2ChildID,
+			},
+		})
+		require.Error(t, err)
+	})
+
+	t.Run("cannot list children of other org third party", func(t *testing.T) {
+		t.Parallel()
+
+		const query = `
+			query($id: ID!) {
+				node(id: $id) {
+					... on ThirdParty {
+						childThirdParties(first: 10) {
+							totalCount
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			Node *struct {
+				ChildThirdParties *struct {
+					TotalCount int `json:"totalCount"`
+				} `json:"childThirdParties"`
+			} `json:"node"`
+		}
+
+		err := org2Owner.Execute(query, map[string]any{"id": parentID}, &result)
+
+		nodeInaccessible := err != nil || result.Node == nil || result.Node.ChildThirdParties == nil
+		emptyResult := result.Node != nil && result.Node.ChildThirdParties != nil && result.Node.ChildThirdParties.TotalCount == 0
+		assert.True(t, nodeInaccessible || emptyResult, "expected either inaccessible node or zero children")
+	})
+}
+
+func TestThirdParty_DirectFilter(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	factory.NewThirdParty(owner).WithName("Direct TP").Create()
+
+	const createNonDirect = `
+		mutation($input: CreateThirdPartyInput!) {
+			createThirdParty(input: $input) {
+				thirdPartyEdge {
+					node {
+						id
+						firstLevel
+					}
+				}
+			}
+		}
+	`
+
+	var createResult struct {
+		CreateThirdParty struct {
+			ThirdPartyEdge struct {
+				Node struct {
+					ID         string `json:"id"`
+					FirstLevel bool   `json:"firstLevel"`
+				} `json:"node"`
+			} `json:"thirdPartyEdge"`
+		} `json:"createThirdParty"`
+	}
+
+	err := owner.Execute(createNonDirect, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           factory.SafeName("NonDirect TP"),
+			"firstLevel":     false,
+		},
+	}, &createResult)
+	require.NoError(t, err)
+	assert.False(t, createResult.CreateThirdParty.ThirdPartyEdge.Node.FirstLevel)
+
+	t.Run("filter firstLevel only", func(t *testing.T) {
+		t.Parallel()
+
+		const query = `
+			query($orgId: ID!) {
+				node(id: $orgId) {
+					... on Organization {
+						thirdParties(first: 100, filter: { firstLevel: true }) {
+							edges {
+								node {
+									id
+									firstLevel
+								}
+							}
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			Node struct {
+				ThirdParties struct {
+					Edges []struct {
+						Node struct {
+							ID         string `json:"id"`
+							FirstLevel bool   `json:"firstLevel"`
+						} `json:"node"`
+					} `json:"edges"`
+				} `json:"thirdParties"`
+			} `json:"node"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"orgId": owner.GetOrganizationID().String(),
+		}, &result)
+		require.NoError(t, err)
+
+		for _, edge := range result.Node.ThirdParties.Edges {
+			assert.True(t, edge.Node.FirstLevel, "expected all third parties to be firstLevel when filtering direct=true")
+		}
+	})
+
+	t.Run("filter all", func(t *testing.T) {
+		t.Parallel()
+
+		const query = `
+			query($orgId: ID!) {
+				node(id: $orgId) {
+					... on Organization {
+						thirdParties(first: 100) {
+							edges {
+								node {
+									id
+									firstLevel
+								}
+							}
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			Node struct {
+				ThirdParties struct {
+					Edges []struct {
+						Node struct {
+							ID         string `json:"id"`
+							FirstLevel bool   `json:"firstLevel"`
+						} `json:"node"`
+					} `json:"edges"`
+				} `json:"thirdParties"`
+			} `json:"node"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"orgId": owner.GetOrganizationID().String(),
+		}, &result)
+		require.NoError(t, err)
+
+		hasFirstLevel := false
+		hasNonFirstLevel := false
+
+		for _, edge := range result.Node.ThirdParties.Edges {
+			if edge.Node.FirstLevel {
+				hasFirstLevel = true
+			} else {
+				hasNonFirstLevel = true
+			}
+		}
+
+		assert.True(t, hasFirstLevel, "expected at least one first-level third party")
+		assert.True(t, hasNonFirstLevel, "expected at least one non-first-level third party")
+	})
+}
+
+func addRelation(t *testing.T, c *testutil.Client, parentID, childID string) {
+	t.Helper()
+
+	const query = `
+		mutation($input: CreateThirdPartyThirdPartyMappingInput!) {
+			createThirdPartyThirdPartyMapping(input: $input) {
+				thirdPartyEdge {
+					node { id }
+				}
+			}
+		}
+	`
+
+	var result struct {
+		CreateThirdPartyThirdPartyMapping struct {
+			ThirdPartyEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"thirdPartyEdge"`
+		} `json:"createThirdPartyThirdPartyMapping"`
+	}
+
+	err := c.Execute(query, map[string]any{
+		"input": map[string]any{
+			"parentThirdPartyId": parentID,
+			"childThirdPartyId":  childID,
+		},
+	}, &result)
+	require.NoError(t, err)
+}
+
+func countChildThirdParties(t *testing.T, c *testutil.Client, parentID string) int {
+	t.Helper()
+
+	const query = `
+		query($id: ID!) {
+			node(id: $id) {
+				... on ThirdParty {
+					childThirdParties(first: 1) {
+						totalCount
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		Node struct {
+			ChildThirdParties struct {
+				TotalCount int `json:"totalCount"`
+			} `json:"childThirdParties"`
+		} `json:"node"`
+	}
+
+	err := c.Execute(query, map[string]any{"id": parentID}, &result)
+	require.NoError(t, err)
+
+	return result.Node.ChildThirdParties.TotalCount
+}