Add third-party self-referential relations

Introduce a self-referential many-to-many relation table so a
third party can have child third parties. Each relation is
directional (parent to child); both directions can coexist as
independent rows.

Add a first_level boolean on third_parties (default true) with
a filter on the list page that defaults to showing only
first-level third parties.

Frontend adds a "Third Parties" tab on the detail page where
users can link existing third parties or create new ones from
the common third party catalog (created as non-first-level).
The list page gets a First Level/All toggle filter.

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/server/api/console/v1/graphql/organization.graphql

@@ -331,6 +331,7 @@ type Organization implements Node {
         last: Int
         before: CursorKey
         orderBy: ThirdPartyOrder
+        filter: ThirdPartyFilter
     ): ThirdPartyConnection! @goField(forceResolver: true)
 
     thirdPartiesDocument: Document @goField(forceResolver: true)

pkg/server/api/console/v1/graphql/third_party.graphql

@@ -177,6 +177,10 @@ input ThirdPartyOrder
     field: ThirdPartyOrderField!
 }
 
+input ThirdPartyFilter {
+    firstLevel: Boolean
+}
+
 input ThirdPartyComplianceReportOrder
     @goModel(
         model: "go.probo.inc/probo/pkg/server/api/console/v1/types.ThirdPartyComplianceReportOrderBy"
@@ -269,6 +273,16 @@ type ThirdParty implements Node {
     legalName: String
     websiteUrl: String
     showOnTrustCenter: Boolean!
+    firstLevel: Boolean!
+
+    childThirdParties(
+        first: Int
+        after: CursorKey
+        last: Int
+        before: CursorKey
+        orderBy: ThirdPartyOrder
+    ): ThirdPartyConnection! @goField(forceResolver: true)
+
     createdAt: Datetime!
     updatedAt: Datetime!
 
@@ -460,6 +474,12 @@ extend type Mutation {
     publishThirdPartyList(
         input: PublishThirdPartyListInput!
     ): PublishThirdPartyListPayload!
+    createThirdPartyThirdPartyMapping(
+        input: CreateThirdPartyThirdPartyMappingInput!
+    ): CreateThirdPartyThirdPartyMappingPayload!
+    deleteThirdPartyThirdPartyMapping(
+        input: DeleteThirdPartyThirdPartyMappingInput!
+    ): DeleteThirdPartyThirdPartyMappingPayload!
 }
 
 input PublishThirdPartyListInput {
@@ -494,6 +514,7 @@ input CreateThirdPartyInput {
     termsOfServiceUrl: String
     businessOwnerId: ID
     securityOwnerId: ID
+    firstLevel: Boolean
 }
 
 input UpdateThirdPartyInput {
@@ -518,6 +539,7 @@ input UpdateThirdPartyInput {
     businessOwnerId: ID @goField(omittable: true)
     securityOwnerId: ID @goField(omittable: true)
     showOnTrustCenter: Boolean
+    firstLevel: Boolean
 }
 
 input DeleteThirdPartyInput {
@@ -709,3 +731,21 @@ type AssessThirdPartyPayload {
     report: String!
     subprocessors: [ThirdPartySubprocessor!]!
 }
+
+input CreateThirdPartyThirdPartyMappingInput {
+    parentThirdPartyId: ID!
+    childThirdPartyId: ID!
+}
+
+type CreateThirdPartyThirdPartyMappingPayload {
+    thirdPartyEdge: ThirdPartyEdge!
+}
+
+input DeleteThirdPartyThirdPartyMappingInput {
+    parentThirdPartyId: ID!
+    childThirdPartyId: ID!
+}
+
+type DeleteThirdPartyThirdPartyMappingPayload {
+    removedThirdPartyId: ID!
+}