Add third-party self-referential relations

Introduce a self-referential many-to-many relation table so a third party can have child third parties. Each relation is directional (parent to child); both directions can coexist as independent rows. Add a first_level boolean on third_parties (default true) with a filter on the list page that defaults to showing only first-level third parties. Frontend adds a "Third Parties" tab on the detail page where users can link existing third parties or create new ones from the common third party catalog (created as non-first-level). The list page gets a First Level/All toggle filter. Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
2026-05-19 19:13:16 +02:00
parent 8ff68798fb
commit b6b1e801b1
37 changed files with 2399 additions and 45 deletions
--- a/pkg/coredata/migrations/20260519T100000Z.sql
+++ b/pkg/coredata/migrations/20260519T100000Z.sql
@@ -0,0 +1,25 @@
+-- Copyright (c) 2025-2026 Probo Inc <hello@getprobo.com>.
+--
+-- Permission to use, copy, modify, and/or distribute this software for any
+-- purpose with or without fee is hereby granted, provided that the above
+-- copyright notice and this permission notice appear in all copies.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+-- PERFORMANCE OF THIS SOFTWARE.
+
+ALTER TABLE third_parties ADD COLUMN first_level boolean NOT NULL DEFAULT true;
+ALTER TABLE third_parties ALTER COLUMN first_level DROP DEFAULT;
+
+CREATE TABLE third_party_third_parties (
+    parent_third_party_id text NOT NULL REFERENCES third_parties(id) ON DELETE CASCADE,
+    child_third_party_id  text NOT NULL REFERENCES third_parties(id) ON DELETE CASCADE,
+    tenant_id             bytea NOT NULL,
+    created_at            timestamptz NOT NULL,
+    PRIMARY KEY (parent_third_party_id, child_third_party_id),
+    CHECK (parent_third_party_id <> child_third_party_id)
+);
--- a/pkg/coredata/third_party.go
+++ b/pkg/coredata/third_party.go
@@ -162,6 +162,7 @@ type (
 		SecurityPageURL               *string            `db:"security_page_url"`
 		TrustPageURL                  *string            `db:"trust_page_url"`
 		ShowOnTrustCenter             bool               `db:"show_on_trust_center"`
+		FirstLevel                    bool               `db:"first_level"`
 		CreatedAt                     time.Time          `db:"created_at"`
 		UpdatedAt                     time.Time          `db:"updated_at"`
 	}
@@ -253,6 +254,7 @@ SELECT
    security_page_url,
    trust_page_url,
    show_on_trust_center,
+    first_level,
    created_at,
    updated_at
 FROM
@@ -320,6 +322,7 @@ SELECT
    security_page_url,
    trust_page_url,
    show_on_trust_center,
+    first_level,
    created_at,
    updated_at
 FROM
@@ -381,6 +384,7 @@ INSERT INTO
        security_page_url,
        trust_page_url,
        show_on_trust_center,
+        first_level,
        created_at,
        updated_at
    )
@@ -409,6 +413,7 @@ VALUES (
    @security_page_url,
    @trust_page_url,
    @show_on_trust_center,
+    @first_level,
    @created_at,
    @updated_at
 )
@@ -439,6 +444,7 @@ VALUES (
 		"security_page_url":                v.SecurityPageURL,
 		"trust_page_url":                   v.TrustPageURL,
 		"show_on_trust_center":             v.ShowOnTrustCenter,
+		"first_level":                      v.FirstLevel,
 		"created_at":                       v.CreatedAt,
 		"updated_at":                       v.UpdatedAt,
 	}
@@ -534,6 +540,7 @@ SELECT
 	security_page_url,
 	trust_page_url,
 	show_on_trust_center,
+	first_level,
 	created_at,
 	updated_at
 FROM
@@ -597,6 +604,7 @@ SELECT
 	security_page_url,
 	trust_page_url,
 	show_on_trust_center,
+	first_level,
 	created_at,
 	updated_at
 FROM
@@ -657,6 +665,7 @@ SET
 	business_owner_profile_id = @business_owner_profile_id,
 	security_owner_profile_id = @security_owner_profile_id,
 	show_on_trust_center = @show_on_trust_center,
+	first_level = @first_level,
 	updated_at = @updated_at
 WHERE %s
    AND id = @third_party_id
@@ -686,6 +695,7 @@ WHERE %s
 		"business_owner_profile_id":        v.BusinessOwnerID,
 		"security_owner_profile_id":        v.SecurityOwnerID,
 		"show_on_trust_center":             v.ShowOnTrustCenter,
+		"first_level":                      v.FirstLevel,
 	}

 	maps.Copy(args, scope.SQLArguments())
@@ -803,6 +813,7 @@ WITH vend AS (
 		v.security_page_url,
 		v.trust_page_url,
 		v.show_on_trust_center,
+		v.first_level,
 		v.created_at,
 		v.updated_at
 	FROM
@@ -837,6 +848,7 @@ SELECT
 	security_page_url,
 	trust_page_url,
 	show_on_trust_center,
+	first_level,
 	created_at,
 	updated_at
 FROM
@@ -938,6 +950,7 @@ WITH vend AS (
 		v.security_page_url,
 		v.trust_page_url,
 		v.show_on_trust_center,
+		v.first_level,
 		v.created_at,
 		v.updated_at
 	FROM
@@ -972,6 +985,7 @@ SELECT
 	security_page_url,
 	trust_page_url,
 	show_on_trust_center,
+	first_level,
 	created_at,
 	updated_at
 FROM
@@ -1033,6 +1047,7 @@ WITH vend AS (
 		v.security_page_url,
 		v.trust_page_url,
 		v.show_on_trust_center,
+		v.first_level,
 		v.created_at,
 		v.updated_at
 	FROM
@@ -1067,6 +1082,7 @@ SELECT
 	security_page_url,
 	trust_page_url,
 	show_on_trust_center,
+	first_level,
 	created_at,
 	updated_at
 FROM
@@ -1129,6 +1145,7 @@ WITH vend AS (
 		v.security_page_url,
 		v.trust_page_url,
 		v.show_on_trust_center,
+		v.first_level,
 		v.created_at,
 		v.updated_at
 	FROM
@@ -1163,6 +1180,7 @@ SELECT
 	security_page_url,
 	trust_page_url,
 	show_on_trust_center,
+	first_level,
 	created_at,
 	updated_at
 FROM
@@ -1293,6 +1311,7 @@ WITH vend AS (
 		v.security_page_url,
 		v.trust_page_url,
 		v.show_on_trust_center,
+		v.first_level,
 		v.created_at,
 		v.updated_at
 	FROM
@@ -1327,6 +1346,7 @@ SELECT
 	security_page_url,
 	trust_page_url,
 	show_on_trust_center,
+	first_level,
 	created_at,
 	updated_at
 FROM
@@ -1387,6 +1407,7 @@ SELECT
 	security_page_url,
 	trust_page_url,
 	show_on_trust_center,
+	first_level,
 	created_at,
 	updated_at
 FROM
--- a/pkg/coredata/third_party_filter.go
+++ b/pkg/coredata/third_party_filter.go
@@ -21,12 +21,14 @@ import (
 type (
 	ThirdPartyFilter struct {
 		showOnTrustCenter *bool
+		firstLevel        *bool
 	}
 )

-func NewThirdPartyFilter(showOnTrustCenter *bool) *ThirdPartyFilter {
+func NewThirdPartyFilter(showOnTrustCenter *bool, firstLevel *bool) *ThirdPartyFilter {
 	return &ThirdPartyFilter{
 		showOnTrustCenter: showOnTrustCenter,
+		firstLevel:        firstLevel,
 	}
 }

@@ -39,6 +41,12 @@ func (f *ThirdPartyFilter) SQLArguments() pgx.StrictNamedArgs {
 		args["show_on_trust_center"] = nil
 	}

+	if f.firstLevel != nil {
+		args["first_level"] = *f.firstLevel
+	} else {
+		args["first_level"] = nil
+	}
+
 	return args
 }

@@ -50,5 +58,13 @@ func (f *ThirdPartyFilter) SQLFragment() string {
 			show_on_trust_center = @show_on_trust_center::boolean
 		ELSE TRUE
 	END
+)
+AND
+(
+	CASE
+		WHEN @first_level::boolean IS NOT NULL THEN
+			first_level = @first_level::boolean
+		ELSE TRUE
+	END
 )`
 }
--- a/pkg/coredata/third_party_third_party.go
+++ b/pkg/coredata/third_party_third_party.go
@@ -0,0 +1,226 @@
+// Copyright (c) 2025-2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type (
+	ThirdPartyThirdParty struct {
+		ParentThirdPartyID gid.GID      `db:"parent_third_party_id"`
+		ChildThirdPartyID  gid.GID      `db:"child_third_party_id"`
+		TenantID           gid.TenantID `db:"tenant_id"`
+		CreatedAt          time.Time    `db:"created_at"`
+	}
+
+	ThirdPartyThirdParties []*ThirdPartyThirdParty
+)
+
+func (r *ThirdPartyThirdParty) Insert(ctx context.Context, conn pg.Tx, scope Scoper) error {
+	q := `
+INSERT INTO third_party_third_parties (
+    parent_third_party_id,
+    child_third_party_id,
+    tenant_id,
+    created_at
+) VALUES (
+    @parent_third_party_id,
+    @child_third_party_id,
+    @tenant_id,
+    @created_at
+)
+ON CONFLICT (parent_third_party_id, child_third_party_id) DO NOTHING
+`
+
+	args := pgx.StrictNamedArgs{
+		"parent_third_party_id": r.ParentThirdPartyID,
+		"child_third_party_id":  r.ChildThirdPartyID,
+		"tenant_id":             scope.GetTenantID(),
+		"created_at":            r.CreatedAt,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot insert third party third party: %w", err)
+	}
+
+	return nil
+}
+
+func (r *ThirdPartyThirdParty) Delete(ctx context.Context, conn pg.Tx, scope Scoper) error {
+	q := `
+DELETE FROM third_party_third_parties
+WHERE %s
+    AND parent_third_party_id = @parent_third_party_id
+    AND child_third_party_id = @child_third_party_id
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"parent_third_party_id": r.ParentThirdPartyID,
+		"child_third_party_id":  r.ChildThirdPartyID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+
+	return err
+}
+
+func (v *ThirdParties) CountByParentThirdPartyID(
+	ctx context.Context,
+	conn pg.Querier,
+	scope Scoper,
+	parentThirdPartyID gid.GID,
+) (int, error) {
+	q := `
+WITH children AS (
+	SELECT
+		tp.id,
+		tp.tenant_id
+	FROM
+		third_parties tp
+	INNER JOIN
+		third_party_third_parties tpr ON tp.id = tpr.child_third_party_id
+	WHERE
+		tpr.parent_third_party_id = @parent_third_party_id
+)
+SELECT
+	COUNT(id)
+FROM
+	children
+WHERE %s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"parent_third_party_id": parentThirdPartyID}
+	maps.Copy(args, scope.SQLArguments())
+
+	var count int
+
+	err := conn.QueryRow(ctx, q, args).Scan(&count)
+	if err != nil {
+		return 0, fmt.Errorf("cannot count child third parties: %w", err)
+	}
+
+	return count, nil
+}
+
+func (v *ThirdParties) LoadByParentThirdPartyID(
+	ctx context.Context,
+	conn pg.Querier,
+	scope Scoper,
+	parentThirdPartyID gid.GID,
+	cursor *page.Cursor[ThirdPartyOrderField],
+) error {
+	q := `
+WITH children AS (
+	SELECT
+		tp.id,
+		tp.tenant_id,
+		tp.organization_id,
+		tp.common_third_party_id,
+		tp.name,
+		tp.description,
+		tp.category,
+		tp.headquarter_address,
+		tp.legal_name,
+		tp.website_url,
+		tp.privacy_policy_url,
+		tp.service_level_agreement_url,
+		tp.data_processing_agreement_url,
+		tp.business_associate_agreement_url,
+		tp.subprocessors_list_url,
+		tp.certifications,
+		tp.countries,
+		tp.business_owner_profile_id,
+		tp.security_owner_profile_id,
+		tp.status_page_url,
+		tp.terms_of_service_url,
+		tp.security_page_url,
+		tp.trust_page_url,
+		tp.show_on_trust_center,
+		tp.first_level,
+		tp.created_at,
+		tp.updated_at
+	FROM
+		third_parties tp
+	INNER JOIN
+		third_party_third_parties tpr ON tp.id = tpr.child_third_party_id
+	WHERE
+		tpr.parent_third_party_id = @parent_third_party_id
+)
+SELECT
+	id,
+	tenant_id,
+	organization_id,
+	common_third_party_id,
+	name,
+	description,
+	category,
+	headquarter_address,
+	legal_name,
+	website_url,
+	privacy_policy_url,
+	service_level_agreement_url,
+	data_processing_agreement_url,
+	business_associate_agreement_url,
+	subprocessors_list_url,
+	certifications,
+	countries,
+	business_owner_profile_id,
+	security_owner_profile_id,
+	status_page_url,
+	terms_of_service_url,
+	security_page_url,
+	trust_page_url,
+	show_on_trust_center,
+	first_level,
+	created_at,
+	updated_at
+FROM
+	children
+WHERE %s
+	AND %s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"parent_third_party_id": parentThirdPartyID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query child third parties: %w", err)
+	}
+
+	thirdParties, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdParty])
+	if err != nil {
+		return fmt.Errorf("cannot collect child third parties: %w", err)
+	}
+
+	*v = thirdParties
+
+	return nil
+}