Add third-party self-referential relations

Introduce a self-referential many-to-many relation table so a third party can have child third parties. Each relation is directional (parent to child); both directions can coexist as independent rows. Add a first_level boolean on third_parties (default true) with a filter on the list page that defaults to showing only first-level third parties. Frontend adds a "Third Parties" tab on the detail page where users can link existing third parties or create new ones from the common third party catalog (created as non-first-level). The list page gets a First Level/All toggle filter. Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
2026-05-19 19:13:16 +02:00
parent 8ff68798fb
commit b6b1e801b1
37 changed files with 2399 additions and 45 deletions
--- a/pkg/server/api/mcp/v1/schema.resolvers.go
+++ b/pkg/server/api/mcp/v1/schema.resolvers.go
@@ -70,7 +70,7 @@ func (r *Resolver) ListThirdPartiesTool(ctx context.Context, req *mcp.CallToolRe

 	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)

-	thirdPartyFilter := coredata.NewThirdPartyFilter(nil)
+	thirdPartyFilter := coredata.NewThirdPartyFilter(nil, input.FirstLevel)

 	page, err := prb.ThirdParties.ListForOrganizationID(ctx, scope, input.OrganizationID, cursor, thirdPartyFilter)
 	if err != nil {
@@ -6148,6 +6148,59 @@ func (r *Resolver) MoveTrackerResourceToCategoryTool(ctx context.Context, req *m
 	return nil, types.MoveTrackerResourceToCategoryOutput{TrackerResource: types.NewTrackerResource(result.TrackerResource)}, nil
 }

+func (r *Resolver) CreateThirdPartyThirdPartyMappingTool(ctx context.Context, req *mcp.CallToolRequest, input *types.CreateThirdPartyThirdPartyMappingInput) (*mcp.CallToolResult, types.CreateThirdPartyThirdPartyMappingOutput, error) {
+	scope, err := r.Authorize(ctx, input.ParentThirdPartyID, probo.ActionThirdPartyRelationCreate)
+	if err != nil {
+		return nil, types.CreateThirdPartyThirdPartyMappingOutput{}, err
+	}
+
+	if _, err := r.proboSvc.ThirdParties.CreateThirdPartyMapping(ctx, scope, input.ParentThirdPartyID, input.ChildThirdPartyID); err != nil {
+		return nil, types.CreateThirdPartyThirdPartyMappingOutput{}, fmt.Errorf("cannot create third party mapping: %w", err)
+	}
+
+	return nil, types.CreateThirdPartyThirdPartyMappingOutput{}, nil
+}
+
+func (r *Resolver) DeleteThirdPartyThirdPartyMappingTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteThirdPartyThirdPartyMappingInput) (*mcp.CallToolResult, types.DeleteThirdPartyThirdPartyMappingOutput, error) {
+	scope, err := r.Authorize(ctx, input.ParentThirdPartyID, probo.ActionThirdPartyRelationDelete)
+	if err != nil {
+		return nil, types.DeleteThirdPartyThirdPartyMappingOutput{}, err
+	}
+
+	if err := r.proboSvc.ThirdParties.DeleteThirdPartyMapping(ctx, scope, input.ParentThirdPartyID, input.ChildThirdPartyID); err != nil {
+		return nil, types.DeleteThirdPartyThirdPartyMappingOutput{}, fmt.Errorf("cannot delete third party mapping: %w", err)
+	}
+
+	return nil, types.DeleteThirdPartyThirdPartyMappingOutput{}, nil
+}
+
+func (r *Resolver) ListChildThirdPartiesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListChildThirdPartiesInput) (*mcp.CallToolResult, types.ListChildThirdPartiesOutput, error) {
+	scope, err := r.Authorize(ctx, input.ParentThirdPartyID, probo.ActionThirdPartyRelationList)
+	if err != nil {
+		return nil, types.ListChildThirdPartiesOutput{}, err
+	}
+
+	pageOrderBy := page.OrderBy[coredata.ThirdPartyOrderField]{
+		Field:     coredata.ThirdPartyOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if input.OrderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.ThirdPartyOrderField]{
+			Field:     input.OrderBy.Field,
+			Direction: input.OrderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)
+
+	page, err := r.proboSvc.ThirdParties.ListForParentThirdPartyID(ctx, scope, input.ParentThirdPartyID, cursor)
+	if err != nil {
+		panic(fmt.Errorf("cannot list child third parties: %w", err))
+	}
+
+	return nil, types.NewListChildThirdPartiesOutput(page), nil
+}
+
 func (r *Resolver) ListRiskAssessmentsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListRiskAssessmentsInput) (*mcp.CallToolResult, types.ListRiskAssessmentsOutput, error) {
 	scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionRiskAssessmentList)
 	if err != nil {
--- a/pkg/server/api/mcp/v1/specification.yaml
+++ b/pkg/server/api/mcp/v1/specification.yaml
@@ -627,6 +627,9 @@ components:
        organization_id:
          $ref: "#/components/schemas/GID"
          description: Organization ID
+        first_level:
+          type: boolean
+          description: Filter by first-level status
        order_by:
          $ref: "#/components/schemas/ThirdPartyOrderBy"
          description: ThirdParty order by
@@ -650,6 +653,69 @@ components:
          items:
            $ref: "#/components/schemas/ThirdParty"

+    CreateThirdPartyThirdPartyMappingInput:
+      type: object
+      required:
+        - parent_third_party_id
+        - child_third_party_id
+      properties:
+        parent_third_party_id:
+          $ref: "#/components/schemas/GID"
+          description: Parent third party ID
+        child_third_party_id:
+          $ref: "#/components/schemas/GID"
+          description: Child third party ID
+
+    CreateThirdPartyThirdPartyMappingOutput:
+      type: object
+
+    DeleteThirdPartyThirdPartyMappingInput:
+      type: object
+      required:
+        - parent_third_party_id
+        - child_third_party_id
+      properties:
+        parent_third_party_id:
+          $ref: "#/components/schemas/GID"
+          description: Parent third party ID
+        child_third_party_id:
+          $ref: "#/components/schemas/GID"
+          description: Child third party ID
+
+    DeleteThirdPartyThirdPartyMappingOutput:
+      type: object
+
+    ListChildThirdPartiesInput:
+      type: object
+      required:
+        - parent_third_party_id
+      properties:
+        parent_third_party_id:
+          $ref: "#/components/schemas/GID"
+          description: Parent third party ID
+        order_by:
+          $ref: "#/components/schemas/ThirdPartyOrderBy"
+          description: ThirdParty order by
+        size:
+          type: integer
+          description: Page size
+        cursor:
+          $ref: "#/components/schemas/CursorKey"
+          description: Page cursor
+
+    ListChildThirdPartiesOutput:
+      type: object
+      required:
+        - thirdParties
+      properties:
+        next_cursor:
+          $ref: "#/components/schemas/CursorKey"
+          description: Next cursor
+        thirdParties:
+          type: array
+          items:
+            $ref: "#/components/schemas/ThirdParty"
+
    ThirdParty:
      type: object
      required:
@@ -657,6 +723,7 @@ components:
        - name
        - organization_id
        - category
+        - first_level
        - created_at
        - updated_at
      properties:
@@ -780,6 +847,9 @@ components:
            - string
            - "null"
          description: Trust page URL
+        first_level:
+          type: boolean
+          description: Whether this is a first-level third party
        created_at:
          type: string
          format: date-time
@@ -11788,6 +11858,31 @@ tools:
      $ref: "#/components/schemas/ListThirdPartiesInput"
    outputSchema:
      $ref: "#/components/schemas/ListThirdPartiesOutput"
+  - name: createThirdPartyThirdPartyMapping
+    description: Link a child third party to a parent third party
+    hints:
+      readonly: false
+    inputSchema:
+      $ref: "#/components/schemas/CreateThirdPartyThirdPartyMappingInput"
+    outputSchema:
+      $ref: "#/components/schemas/CreateThirdPartyThirdPartyMappingOutput"
+  - name: deleteThirdPartyThirdPartyMapping
+    description: Unlink a child third party from a parent third party
+    hints:
+      readonly: false
+    inputSchema:
+      $ref: "#/components/schemas/DeleteThirdPartyThirdPartyMappingInput"
+    outputSchema:
+      $ref: "#/components/schemas/DeleteThirdPartyThirdPartyMappingOutput"
+  - name: listChildThirdParties
+    description: List child third parties linked to a parent third party
+    hints:
+      readonly: true
+      idempotent: true
+    inputSchema:
+      $ref: "#/components/schemas/ListChildThirdPartiesInput"
+    outputSchema:
+      $ref: "#/components/schemas/ListChildThirdPartiesOutput"
  - name: listUsers
    description: List all users for the organization
    hints:
--- a/pkg/server/api/mcp/v1/types/third_party.go
+++ b/pkg/server/api/mcp/v1/types/third_party.go
@@ -87,6 +87,7 @@ func NewThirdParty(v *coredata.ThirdParty) *ThirdParty {
 		TermsOfServiceURL:             v.TermsOfServiceURL,
 		SecurityPageURL:               v.SecurityPageURL,
 		TrustPageURL:                  v.TrustPageURL,
+		FirstLevel:                    v.FirstLevel,
 		CreatedAt:                     v.CreatedAt,
 		UpdatedAt:                     v.UpdatedAt,
 	}
@@ -111,6 +112,25 @@ func NewListThirdPartiesOutput(thirdPartyPage *page.Page[*coredata.ThirdParty, c
 	}
 }

+func NewListChildThirdPartiesOutput(thirdPartyPage *page.Page[*coredata.ThirdParty, coredata.ThirdPartyOrderField]) ListChildThirdPartiesOutput {
+	thirdParties := make([]*ThirdParty, 0, len(thirdPartyPage.Data))
+	for _, v := range thirdPartyPage.Data {
+		thirdParties = append(thirdParties, NewThirdParty(v))
+	}
+
+	var nextCursor *page.CursorKey
+
+	if len(thirdPartyPage.Data) > 0 {
+		cursorKey := thirdPartyPage.Data[len(thirdPartyPage.Data)-1].CursorKey(thirdPartyPage.Cursor.OrderBy.Field)
+		nextCursor = &cursorKey
+	}
+
+	return ListChildThirdPartiesOutput{
+		NextCursor:   nextCursor,
+		ThirdParties: thirdParties,
+	}
+}
+
 func NewAddThirdPartyOutput(v *coredata.ThirdParty) AddThirdPartyOutput {
 	return AddThirdPartyOutput{
 		ThirdParty: NewThirdParty(v),