Add e2e tests

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

e2e/console/asset_test.go

@@ -0,0 +1,378 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/factory"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+func TestAsset_Create(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	peopleID := factory.NewPeople(owner).
+		WithFullName("Asset Owner").
+		Create()
+
+	const query = `
+		mutation($input: CreateAssetInput!) {
+			createAsset(input: $input) {
+				assetEdge {
+					node {
+						id
+						name
+						amount
+						assetType
+						dataTypesStored
+						owner {
+							id
+						}
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		CreateAsset struct {
+			AssetEdge struct {
+				Node struct {
+					ID              string `json:"id"`
+					Name            string `json:"name"`
+					Amount          int    `json:"amount"`
+					AssetType       string `json:"assetType"`
+					DataTypesStored string `json:"dataTypesStored"`
+					Owner           struct {
+						ID string `json:"id"`
+					} `json:"owner"`
+				} `json:"node"`
+			} `json:"assetEdge"`
+		} `json:"createAsset"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"organizationId":  owner.GetOrganizationID().String(),
+			"name":            "Production Database Server",
+			"amount":          5,
+			"ownerId":         peopleID,
+			"assetType":       "VIRTUAL",
+			"dataTypesStored": "Customer PII, Financial Records",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	asset := result.CreateAsset.AssetEdge.Node
+	assert.NotEmpty(t, asset.ID)
+	assert.Equal(t, "Production Database Server", asset.Name)
+	assert.Equal(t, 5, asset.Amount)
+	assert.Equal(t, "VIRTUAL", asset.AssetType)
+	assert.Equal(t, "Customer PII, Financial Records", asset.DataTypesStored)
+	assert.Equal(t, peopleID, asset.Owner.ID)
+}
+
+func TestAsset_Update(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	peopleID := factory.NewPeople(owner).
+		WithFullName("Asset Owner for Update").
+		Create()
+
+	const createQuery = `
+		mutation($input: CreateAssetInput!) {
+			createAsset(input: $input) {
+				assetEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createResult struct {
+		CreateAsset struct {
+			AssetEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"assetEdge"`
+		} `json:"createAsset"`
+	}
+
+	err := owner.Execute(createQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId":  owner.GetOrganizationID().String(),
+			"name":            "Test Asset",
+			"amount":          10,
+			"ownerId":         peopleID,
+			"assetType":       "VIRTUAL",
+			"dataTypesStored": "Test data",
+		},
+	}, &createResult)
+	require.NoError(t, err)
+	assetID := createResult.CreateAsset.AssetEdge.Node.ID
+
+	const query = `
+		mutation($input: UpdateAssetInput!) {
+			updateAsset(input: $input) {
+				asset {
+					id
+					name
+					amount
+					dataTypesStored
+				}
+			}
+		}
+	`
+
+	var result struct {
+		UpdateAsset struct {
+			Asset struct {
+				ID              string `json:"id"`
+				Name            string `json:"name"`
+				Amount          int    `json:"amount"`
+				DataTypesStored string `json:"dataTypesStored"`
+			} `json:"asset"`
+		} `json:"updateAsset"`
+	}
+
+	err = owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"id":              assetID,
+			"name":            "Updated Asset Name",
+			"amount":          20,
+			"dataTypesStored": "Updated data types",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, assetID, result.UpdateAsset.Asset.ID)
+	assert.Equal(t, "Updated Asset Name", result.UpdateAsset.Asset.Name)
+	assert.Equal(t, 20, result.UpdateAsset.Asset.Amount)
+}
+
+func TestAsset_Delete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	peopleID := factory.NewPeople(owner).
+		WithFullName("Asset Owner for Delete").
+		Create()
+
+	const createQuery = `
+		mutation($input: CreateAssetInput!) {
+			createAsset(input: $input) {
+				assetEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createResult struct {
+		CreateAsset struct {
+			AssetEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"assetEdge"`
+		} `json:"createAsset"`
+	}
+
+	err := owner.Execute(createQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId":  owner.GetOrganizationID().String(),
+			"name":            "Asset to delete",
+			"amount":          1,
+			"ownerId":         peopleID,
+			"assetType":       "VIRTUAL",
+			"dataTypesStored": "None",
+		},
+	}, &createResult)
+	require.NoError(t, err)
+	assetID := createResult.CreateAsset.AssetEdge.Node.ID
+
+	const query = `
+		mutation($input: DeleteAssetInput!) {
+			deleteAsset(input: $input) {
+				deletedAssetId
+			}
+		}
+	`
+
+	var result struct {
+		DeleteAsset struct {
+			DeletedAssetID string `json:"deletedAssetId"`
+		} `json:"deleteAsset"`
+	}
+
+	err = owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"assetId": assetID,
+		},
+	}, &result)
+	require.NoError(t, err)
+	assert.Equal(t, assetID, result.DeleteAsset.DeletedAssetID)
+}
+
+func TestAsset_List(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	peopleID := factory.NewPeople(owner).
+		WithFullName("Asset Owner for List").
+		Create()
+
+	// Create multiple assets
+	for i := 0; i < 3; i++ {
+		const query = `
+			mutation($input: CreateAssetInput!) {
+				createAsset(input: $input) {
+					assetEdge {
+						node {
+							id
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			CreateAsset struct {
+				AssetEdge struct {
+					Node struct {
+						ID string `json:"id"`
+					} `json:"node"`
+				} `json:"assetEdge"`
+			} `json:"createAsset"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"organizationId":  owner.GetOrganizationID().String(),
+				"name":            fmt.Sprintf("Asset %c", 'A'+i),
+				"amount":          i + 1,
+				"ownerId":         peopleID,
+				"assetType":       "VIRTUAL",
+				"dataTypesStored": "Test data",
+			},
+		}, &result)
+		require.NoError(t, err)
+	}
+
+	const query = `
+		query($id: ID!) {
+			node(id: $id) {
+				... on Organization {
+					assets(first: 10) {
+						edges {
+							node {
+								id
+								name
+								amount
+								assetType
+							}
+						}
+						totalCount
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		Node struct {
+			Assets struct {
+				Edges []struct {
+					Node struct {
+						ID        string `json:"id"`
+						Name      string `json:"name"`
+						Amount    int    `json:"amount"`
+						AssetType string `json:"assetType"`
+					} `json:"node"`
+				} `json:"edges"`
+				TotalCount int `json:"totalCount"`
+			} `json:"assets"`
+		} `json:"node"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"id": owner.GetOrganizationID().String(),
+	}, &result)
+	require.NoError(t, err)
+	assert.GreaterOrEqual(t, result.Node.Assets.TotalCount, 3)
+}
+
+func TestAsset_Types(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	peopleID := factory.NewPeople(owner).
+		WithFullName("Asset Owner for Types").
+		Create()
+
+	assetTypes := []string{"PHYSICAL", "VIRTUAL"}
+
+	for _, assetType := range assetTypes {
+		t.Run(assetType, func(t *testing.T) {
+			const query = `
+				mutation($input: CreateAssetInput!) {
+					createAsset(input: $input) {
+						assetEdge {
+							node {
+								id
+								assetType
+							}
+						}
+					}
+				}
+			`
+
+			var result struct {
+				CreateAsset struct {
+					AssetEdge struct {
+						Node struct {
+							ID        string `json:"id"`
+							AssetType string `json:"assetType"`
+						} `json:"node"`
+					} `json:"assetEdge"`
+				} `json:"createAsset"`
+			}
+
+			err := owner.Execute(query, map[string]any{
+				"input": map[string]any{
+					"organizationId":  owner.GetOrganizationID().String(),
+					"name":            "Asset " + assetType,
+					"amount":          1,
+					"ownerId":         peopleID,
+					"assetType":       assetType,
+					"dataTypesStored": "Test data",
+				},
+			}, &result)
+			require.NoError(t, err)
+			assert.Equal(t, assetType, result.CreateAsset.AssetEdge.Node.AssetType)
+		})
+	}
+}

e2e/console/continual_improvement_test.go

@@ -0,0 +1,394 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/factory"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+func TestContinualImprovement_Create(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("CI Owner").Create()
+
+	query := `
+		mutation CreateContinualImprovement($input: CreateContinualImprovementInput!) {
+			createContinualImprovement(input: $input) {
+				continualImprovementEdge {
+					node {
+						id
+						referenceId
+						description
+						source
+						status
+						priority
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		CreateContinualImprovement struct {
+			ContinualImprovementEdge struct {
+				Node struct {
+					ID          string `json:"id"`
+					ReferenceID string `json:"referenceId"`
+					Description string `json:"description"`
+					Source      string `json:"source"`
+					Status      string `json:"status"`
+					Priority    string `json:"priority"`
+				} `json:"node"`
+			} `json:"continualImprovementEdge"`
+		} `json:"createContinualImprovement"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"referenceId":    fmt.Sprintf("CI-%d", time.Now().UnixNano()),
+			"description":    "Improve security training program",
+			"source":         "Internal Audit",
+			"ownerId":        peopleID,
+			"status":         "OPEN",
+			"priority":       "HIGH",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	ci := result.CreateContinualImprovement.ContinualImprovementEdge.Node
+	assert.NotEmpty(t, ci.ID)
+	assert.Equal(t, "Improve security training program", ci.Description)
+	assert.Equal(t, "Internal Audit", ci.Source)
+	assert.Equal(t, "OPEN", ci.Status)
+	assert.Equal(t, "HIGH", ci.Priority)
+}
+
+func TestContinualImprovement_Update(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("CI Owner").Create()
+
+	createQuery := `
+		mutation CreateContinualImprovement($input: CreateContinualImprovementInput!) {
+			createContinualImprovement(input: $input) {
+				continualImprovementEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createResult struct {
+		CreateContinualImprovement struct {
+			ContinualImprovementEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"continualImprovementEdge"`
+		} `json:"createContinualImprovement"`
+	}
+
+	err := owner.Execute(createQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"referenceId":    fmt.Sprintf("CI-UPDATE-%d", time.Now().UnixNano()),
+			"description":    "Original description",
+			"ownerId":        peopleID,
+			"status":         "OPEN",
+			"priority":       "LOW",
+		},
+	}, &createResult)
+	require.NoError(t, err)
+	ciID := createResult.CreateContinualImprovement.ContinualImprovementEdge.Node.ID
+
+	query := `
+		mutation UpdateContinualImprovement($input: UpdateContinualImprovementInput!) {
+			updateContinualImprovement(input: $input) {
+				continualImprovement {
+					id
+					description
+					status
+					priority
+				}
+			}
+		}
+	`
+
+	var result struct {
+		UpdateContinualImprovement struct {
+			ContinualImprovement struct {
+				ID          string `json:"id"`
+				Description string `json:"description"`
+				Status      string `json:"status"`
+				Priority    string `json:"priority"`
+			} `json:"continualImprovement"`
+		} `json:"updateContinualImprovement"`
+	}
+
+	err = owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"id":          ciID,
+			"description": "Updated description",
+			"status":      "IN_PROGRESS",
+			"priority":    "HIGH",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, ciID, result.UpdateContinualImprovement.ContinualImprovement.ID)
+	assert.Equal(t, "Updated description", result.UpdateContinualImprovement.ContinualImprovement.Description)
+	assert.Equal(t, "IN_PROGRESS", result.UpdateContinualImprovement.ContinualImprovement.Status)
+	assert.Equal(t, "HIGH", result.UpdateContinualImprovement.ContinualImprovement.Priority)
+}
+
+func TestContinualImprovement_Delete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("CI Owner").Create()
+
+	createQuery := `
+		mutation CreateContinualImprovement($input: CreateContinualImprovementInput!) {
+			createContinualImprovement(input: $input) {
+				continualImprovementEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createResult struct {
+		CreateContinualImprovement struct {
+			ContinualImprovementEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"continualImprovementEdge"`
+		} `json:"createContinualImprovement"`
+	}
+
+	err := owner.Execute(createQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"referenceId":    fmt.Sprintf("CI-DELETE-%d", time.Now().UnixNano()),
+			"ownerId":        peopleID,
+			"status":         "OPEN",
+			"priority":       "LOW",
+		},
+	}, &createResult)
+	require.NoError(t, err)
+	ciID := createResult.CreateContinualImprovement.ContinualImprovementEdge.Node.ID
+
+	query := `
+		mutation DeleteContinualImprovement($input: DeleteContinualImprovementInput!) {
+			deleteContinualImprovement(input: $input) {
+				deletedContinualImprovementId
+			}
+		}
+	`
+
+	var result struct {
+		DeleteContinualImprovement struct {
+			DeletedContinualImprovementID string `json:"deletedContinualImprovementId"`
+		} `json:"deleteContinualImprovement"`
+	}
+
+	err = owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"continualImprovementId": ciID,
+		},
+	}, &result)
+	require.NoError(t, err)
+	assert.Equal(t, ciID, result.DeleteContinualImprovement.DeletedContinualImprovementID)
+}
+
+func TestContinualImprovement_List(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("CI Owner").Create()
+
+	createQuery := `
+		mutation CreateContinualImprovement($input: CreateContinualImprovementInput!) {
+			createContinualImprovement(input: $input) {
+				continualImprovementEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	for i := 0; i < 3; i++ {
+		_, err := owner.Do(createQuery, map[string]any{
+			"input": map[string]any{
+				"organizationId": owner.GetOrganizationID().String(),
+				"referenceId":    fmt.Sprintf("CI-LIST-%d-%d", i, time.Now().UnixNano()),
+				"description":    fmt.Sprintf("Improvement %d", i),
+				"ownerId":        peopleID,
+				"status":         "OPEN",
+				"priority":       "MEDIUM",
+			},
+		})
+		require.NoError(t, err)
+	}
+
+	query := `
+		query GetContinualImprovements($id: ID!) {
+			node(id: $id) {
+				... on Organization {
+					continualImprovements(first: 10) {
+						edges {
+							node {
+								id
+								referenceId
+								status
+								priority
+							}
+						}
+						totalCount
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		Node struct {
+			ContinualImprovements struct {
+				Edges []struct {
+					Node struct {
+						ID          string `json:"id"`
+						ReferenceID string `json:"referenceId"`
+						Status      string `json:"status"`
+						Priority    string `json:"priority"`
+					} `json:"node"`
+				} `json:"edges"`
+				TotalCount int `json:"totalCount"`
+			} `json:"continualImprovements"`
+		} `json:"node"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"id": owner.GetOrganizationID().String(),
+	}, &result)
+	require.NoError(t, err)
+	assert.GreaterOrEqual(t, result.Node.ContinualImprovements.TotalCount, 3)
+}
+
+func TestContinualImprovement_StatusAndPriorityValues(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("CI Owner").Create()
+
+	t.Run("status values", func(t *testing.T) {
+		statuses := []string{"OPEN", "IN_PROGRESS", "CLOSED"}
+
+		for _, status := range statuses {
+			t.Run(status, func(t *testing.T) {
+				query := `
+					mutation CreateContinualImprovement($input: CreateContinualImprovementInput!) {
+						createContinualImprovement(input: $input) {
+							continualImprovementEdge {
+								node {
+									id
+									status
+								}
+							}
+						}
+					}
+				`
+
+				var result struct {
+					CreateContinualImprovement struct {
+						ContinualImprovementEdge struct {
+							Node struct {
+								ID     string `json:"id"`
+								Status string `json:"status"`
+							} `json:"node"`
+						} `json:"continualImprovementEdge"`
+					} `json:"createContinualImprovement"`
+				}
+
+				err := owner.Execute(query, map[string]any{
+					"input": map[string]any{
+						"organizationId": owner.GetOrganizationID().String(),
+						"referenceId":    fmt.Sprintf("CI-STATUS-%s-%d", status, time.Now().UnixNano()),
+						"ownerId":        peopleID,
+						"status":         status,
+						"priority":       "LOW",
+					},
+				}, &result)
+				require.NoError(t, err)
+				assert.Equal(t, status, result.CreateContinualImprovement.ContinualImprovementEdge.Node.Status)
+			})
+		}
+	})
+
+	t.Run("priority values", func(t *testing.T) {
+		priorities := []string{"LOW", "MEDIUM", "HIGH"}
+
+		for _, priority := range priorities {
+			t.Run(priority, func(t *testing.T) {
+				query := `
+					mutation CreateContinualImprovement($input: CreateContinualImprovementInput!) {
+						createContinualImprovement(input: $input) {
+							continualImprovementEdge {
+								node {
+									id
+									priority
+								}
+							}
+						}
+					}
+				`
+
+				var result struct {
+					CreateContinualImprovement struct {
+						ContinualImprovementEdge struct {
+							Node struct {
+								ID       string `json:"id"`
+								Priority string `json:"priority"`
+							} `json:"node"`
+						} `json:"continualImprovementEdge"`
+					} `json:"createContinualImprovement"`
+				}
+
+				err := owner.Execute(query, map[string]any{
+					"input": map[string]any{
+						"organizationId": owner.GetOrganizationID().String(),
+						"referenceId":    fmt.Sprintf("CI-PRIORITY-%s-%d", priority, time.Now().UnixNano()),
+						"ownerId":        peopleID,
+						"status":         "OPEN",
+						"priority":       priority,
+					},
+				}, &result)
+				require.NoError(t, err)
+				assert.Equal(t, priority, result.CreateContinualImprovement.ContinualImprovementEdge.Node.Priority)
+			})
+		}
+	})
+}

e2e/console/control_test.go

@@ -0,0 +1,958 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/factory"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+func TestControl_Create(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	frameworkID := factory.CreateFramework(owner, factory.Attrs{"name": "Framework for Control Tests"})
+
+	t.Run("with full details", func(t *testing.T) {
+		query := `
+			mutation CreateControl($input: CreateControlInput!) {
+				createControl(input: $input) {
+					controlEdge {
+						node {
+							id
+							name
+							sectionTitle
+							status
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			CreateControl struct {
+				ControlEdge struct {
+					Node struct {
+						ID           string `json:"id"`
+						Name         string `json:"name"`
+						SectionTitle string `json:"sectionTitle"`
+						Status       string `json:"status"`
+					} `json:"node"`
+				} `json:"controlEdge"`
+			} `json:"createControl"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"frameworkId":  frameworkID,
+				"sectionTitle": "A.5",
+				"name":         "Information Security Policies",
+				"description":  "Policies for information security",
+				"status":       "INCLUDED",
+			},
+		}, &result)
+		require.NoError(t, err)
+
+		control := result.CreateControl.ControlEdge.Node
+		assert.NotEmpty(t, control.ID)
+		assert.Equal(t, "Information Security Policies", control.Name)
+		assert.Equal(t, "A.5", control.SectionTitle)
+		assert.Equal(t, "INCLUDED", control.Status)
+	})
+
+	t.Run("with excluded status and justification", func(t *testing.T) {
+		query := `
+			mutation CreateControl($input: CreateControlInput!) {
+				createControl(input: $input) {
+					controlEdge {
+						node {
+							id
+							status
+							exclusionJustification
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			CreateControl struct {
+				ControlEdge struct {
+					Node struct {
+						ID                     string  `json:"id"`
+						Status                 string  `json:"status"`
+						ExclusionJustification *string `json:"exclusionJustification"`
+					} `json:"node"`
+				} `json:"controlEdge"`
+			} `json:"createControl"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"frameworkId":            frameworkID,
+				"sectionTitle":           "A.10",
+				"name":                   "Cryptography",
+				"description":            "Cryptography controls",
+				"status":                 "EXCLUDED",
+				"exclusionJustification": "Not applicable - no cryptographic data processing",
+			},
+		}, &result)
+		require.NoError(t, err)
+
+		control := result.CreateControl.ControlEdge.Node
+		assert.Equal(t, "EXCLUDED", control.Status)
+		assert.Equal(t, "Not applicable - no cryptographic data processing", *control.ExclusionJustification)
+	})
+}
+
+func TestControl_Update(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	frameworkID := factory.CreateFramework(owner, factory.Attrs{"name": "Framework for Control Update"})
+	controlID := factory.CreateControl(owner, frameworkID, factory.Attrs{
+		"name":        "Control to Update",
+		"description": "Original description",
+	})
+
+	t.Run("updates name and description", func(t *testing.T) {
+		query := `
+			mutation UpdateControl($input: UpdateControlInput!) {
+				updateControl(input: $input) {
+					control {
+						id
+						name
+					}
+				}
+			}
+		`
+
+		var result struct {
+			UpdateControl struct {
+				Control struct {
+					ID   string `json:"id"`
+					Name string `json:"name"`
+				} `json:"control"`
+			} `json:"updateControl"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"id":          controlID,
+				"name":        "Updated Control Name",
+				"description": "Updated description",
+			},
+		}, &result)
+		require.NoError(t, err)
+
+		assert.Equal(t, controlID, result.UpdateControl.Control.ID)
+		assert.Equal(t, "Updated Control Name", result.UpdateControl.Control.Name)
+	})
+
+	t.Run("changes status from INCLUDED to EXCLUDED", func(t *testing.T) {
+		statusTestControlID := factory.CreateControl(owner, frameworkID, factory.Attrs{
+			"name":   "Status Change Control",
+			"status": "INCLUDED",
+		})
+
+		query := `
+			mutation UpdateControl($input: UpdateControlInput!) {
+				updateControl(input: $input) {
+					control {
+						id
+						status
+						exclusionJustification
+					}
+				}
+			}
+		`
+
+		var result struct {
+			UpdateControl struct {
+				Control struct {
+					ID                     string  `json:"id"`
+					Status                 string  `json:"status"`
+					ExclusionJustification *string `json:"exclusionJustification"`
+				} `json:"control"`
+			} `json:"updateControl"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"id":                     statusTestControlID,
+				"status":                 "EXCLUDED",
+				"exclusionJustification": "No physical assets in scope",
+			},
+		}, &result)
+		require.NoError(t, err)
+
+		assert.Equal(t, "EXCLUDED", result.UpdateControl.Control.Status)
+		assert.Equal(t, "No physical assets in scope", *result.UpdateControl.Control.ExclusionJustification)
+	})
+}
+
+func TestControl_Delete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	frameworkID := factory.CreateFramework(owner, factory.Attrs{
+		"name": "Framework for Delete",
+	})
+	controlID := factory.CreateControl(owner, frameworkID, factory.Attrs{
+		"name": "Control to Delete",
+	})
+
+	query := `
+		mutation DeleteControl($input: DeleteControlInput!) {
+			deleteControl(input: $input) {
+				deletedControlId
+			}
+		}
+	`
+
+	var result struct {
+		DeleteControl struct {
+			DeletedControlID string `json:"deletedControlId"`
+		} `json:"deleteControl"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"controlId": controlID,
+		},
+	}, &result)
+	require.NoError(t, err)
+	assert.Equal(t, controlID, result.DeleteControl.DeletedControlID)
+}
+
+func TestControl_List(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	frameworkID := factory.CreateFramework(owner, factory.Attrs{"name": "Framework for List Test"})
+
+	// Create multiple controls
+	controlNames := []string{"Control A", "Control B", "Control C"}
+	for i, name := range controlNames {
+		factory.CreateControl(owner, frameworkID, factory.Attrs{
+			"name":         name,
+			"sectionTitle": fmt.Sprintf("A.%d", 5+i),
+		})
+	}
+
+	query := `
+		query GetFrameworkControls($id: ID!) {
+			node(id: $id) {
+				... on Framework {
+					id
+					name
+					controls(first: 10) {
+						edges {
+							node {
+								id
+								name
+								sectionTitle
+							}
+						}
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		Node struct {
+			ID       string `json:"id"`
+			Name     string `json:"name"`
+			Controls struct {
+				Edges []struct {
+					Node struct {
+						ID           string `json:"id"`
+						Name         string `json:"name"`
+						SectionTitle string `json:"sectionTitle"`
+					} `json:"node"`
+				} `json:"edges"`
+			} `json:"controls"`
+		} `json:"node"`
+	}
+
+	err := owner.Execute(query, map[string]any{"id": frameworkID}, &result)
+	require.NoError(t, err)
+	assert.GreaterOrEqual(t, len(result.Node.Controls.Edges), 3)
+}
+
+func TestControl_RequiredFields(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a framework first
+	createFrameworkQuery := `
+		mutation CreateFramework($input: CreateFrameworkInput!) {
+			createFramework(input: $input) {
+				frameworkEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var frameworkResult struct {
+		CreateFramework struct {
+			FrameworkEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"frameworkEdge"`
+		} `json:"createFramework"`
+	}
+
+	err := owner.Execute(createFrameworkQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           fmt.Sprintf("Control Required Fields Test %d", time.Now().UnixNano()),
+		},
+	}, &frameworkResult)
+	require.NoError(t, err)
+	frameworkID := frameworkResult.CreateFramework.FrameworkEdge.Node.ID
+
+	createControlQuery := `
+		mutation CreateControl($input: CreateControlInput!) {
+			createControl(input: $input) {
+				controlEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	tests := []struct {
+		name      string
+		variables map[string]any
+		wantError bool
+	}{
+		{
+			name: "Missing frameworkId should fail",
+			variables: map[string]any{
+				"input": map[string]any{
+					"name":         "Test Control",
+					"description":  "Test",
+					"sectionTitle": "Section 1",
+					"status":       "INCLUDED",
+				},
+			},
+			wantError: true,
+		},
+		{
+			name: "Missing name should fail",
+			variables: map[string]any{
+				"input": map[string]any{
+					"frameworkId":  frameworkID,
+					"description":  "Test",
+					"sectionTitle": "Section 1",
+					"status":       "INCLUDED",
+				},
+			},
+			wantError: true,
+		},
+		{
+			name: "Missing sectionTitle should fail",
+			variables: map[string]any{
+				"input": map[string]any{
+					"frameworkId": frameworkID,
+					"name":        "Test Control",
+					"description": "Test",
+					"status":      "INCLUDED",
+				},
+			},
+			wantError: true,
+		},
+		{
+			name: "Missing status should fail",
+			variables: map[string]any{
+				"input": map[string]any{
+					"frameworkId":  frameworkID,
+					"name":         "Test Control",
+					"description":  "Test",
+					"sectionTitle": "Section 1",
+				},
+			},
+			wantError: true,
+		},
+		{
+			name: "Missing description should fail (required field)",
+			variables: map[string]any{
+				"input": map[string]any{
+					"frameworkId":  frameworkID,
+					"name":         "Test Control",
+					"sectionTitle": "Section 1",
+					"status":       "INCLUDED",
+				},
+			},
+			wantError: true,
+		},
+		{
+			name: "Invalid status enum should fail",
+			variables: map[string]any{
+				"input": map[string]any{
+					"frameworkId":  frameworkID,
+					"name":         "Test Control",
+					"description":  "Test",
+					"sectionTitle": "Section 1",
+					"status":       "INVALID_STATUS",
+				},
+			},
+			wantError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := owner.Do(createControlQuery, tt.variables)
+
+			if tt.wantError {
+				require.Error(t, err, "Expected validation error")
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestControl_OmittableDescription(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create framework
+	createFrameworkQuery := `
+		mutation CreateFramework($input: CreateFrameworkInput!) {
+			createFramework(input: $input) {
+				frameworkEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var frameworkResult struct {
+		CreateFramework struct {
+			FrameworkEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"frameworkEdge"`
+		} `json:"createFramework"`
+	}
+
+	err := owner.Execute(createFrameworkQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           fmt.Sprintf("Control Omittable Test %d", time.Now().UnixNano()),
+		},
+	}, &frameworkResult)
+	require.NoError(t, err)
+	frameworkID := frameworkResult.CreateFramework.FrameworkEdge.Node.ID
+
+	// Create control with description
+	createControlQuery := `
+		mutation CreateControl($input: CreateControlInput!) {
+			createControl(input: $input) {
+				controlEdge {
+					node {
+						id
+						description
+					}
+				}
+			}
+		}
+	`
+
+	var createResult struct {
+		CreateControl struct {
+			ControlEdge struct {
+				Node struct {
+					ID          string `json:"id"`
+					Description string `json:"description"`
+				} `json:"node"`
+			} `json:"controlEdge"`
+		} `json:"createControl"`
+	}
+
+	err = owner.Execute(createControlQuery, map[string]any{
+		"input": map[string]any{
+			"frameworkId":  frameworkID,
+			"name":         "Omittable Test Control",
+			"description":  "Initial description",
+			"sectionTitle": "Section 1",
+			"status":       "INCLUDED",
+		},
+	}, &createResult)
+	require.NoError(t, err)
+	controlID := createResult.CreateControl.ControlEdge.Node.ID
+
+	t.Run("Update with null description should clear it", func(t *testing.T) {
+		updateControlQuery := `
+			mutation UpdateControl($input: UpdateControlInput!) {
+				updateControl(input: $input) {
+					control {
+						id
+						description
+					}
+				}
+			}
+		`
+
+		var updateResult struct {
+			UpdateControl struct {
+				Control struct {
+					ID          string  `json:"id"`
+					Description *string `json:"description"`
+				} `json:"control"`
+			} `json:"updateControl"`
+		}
+
+		err := owner.Execute(updateControlQuery, map[string]any{
+			"input": map[string]any{
+				"id":          controlID,
+				"description": nil,
+			},
+		}, &updateResult)
+		require.NoError(t, err)
+		assert.Nil(t, updateResult.UpdateControl.Control.Description)
+	})
+
+	t.Run("Update without description should not change it", func(t *testing.T) {
+		// Set description first
+		setDescQuery := `
+			mutation UpdateControl($input: UpdateControlInput!) {
+				updateControl(input: $input) {
+					control {
+						id
+					}
+				}
+			}
+		`
+
+		var setDescResult struct {
+			UpdateControl struct {
+				Control struct {
+					ID string `json:"id"`
+				} `json:"control"`
+			} `json:"updateControl"`
+		}
+
+		err := owner.Execute(setDescQuery, map[string]any{
+			"input": map[string]any{
+				"id":          controlID,
+				"description": "Should persist",
+			},
+		}, &setDescResult)
+		require.NoError(t, err)
+
+		// Update only name
+		updateNameQuery := `
+			mutation UpdateControl($input: UpdateControlInput!) {
+				updateControl(input: $input) {
+					control {
+						id
+						name
+						description
+					}
+				}
+			}
+		`
+
+		var updateResult struct {
+			UpdateControl struct {
+				Control struct {
+					ID          string `json:"id"`
+					Name        string `json:"name"`
+					Description string `json:"description"`
+				} `json:"control"`
+			} `json:"updateControl"`
+		}
+
+		err = owner.Execute(updateNameQuery, map[string]any{
+			"input": map[string]any{
+				"id":   controlID,
+				"name": "Updated Name",
+			},
+		}, &updateResult)
+		require.NoError(t, err)
+		assert.Equal(t, "Should persist", updateResult.UpdateControl.Control.Description)
+	})
+}
+
+func TestControl_SubResolvers(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create framework
+	createFrameworkQuery := `
+		mutation CreateFramework($input: CreateFrameworkInput!) {
+			createFramework(input: $input) {
+				frameworkEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var frameworkResult struct {
+		CreateFramework struct {
+			FrameworkEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"frameworkEdge"`
+		} `json:"createFramework"`
+	}
+
+	err := owner.Execute(createFrameworkQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           fmt.Sprintf("Control SubResolver Test %d", time.Now().UnixNano()),
+		},
+	}, &frameworkResult)
+	require.NoError(t, err)
+	frameworkID := frameworkResult.CreateFramework.FrameworkEdge.Node.ID
+
+	// Create control
+	createControlQuery := `
+		mutation CreateControl($input: CreateControlInput!) {
+			createControl(input: $input) {
+				controlEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var controlResult struct {
+		CreateControl struct {
+			ControlEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"controlEdge"`
+		} `json:"createControl"`
+	}
+
+	err = owner.Execute(createControlQuery, map[string]any{
+		"input": map[string]any{
+			"frameworkId":  frameworkID,
+			"name":         "SubResolver Test Control",
+			"description":  "Test description",
+			"sectionTitle": "Section 1",
+			"status":       "INCLUDED",
+		},
+	}, &controlResult)
+	require.NoError(t, err)
+	controlID := controlResult.CreateControl.ControlEdge.Node.ID
+
+	// Create a measure and link it
+	createMeasureQuery := `
+		mutation CreateMeasure($input: CreateMeasureInput!) {
+			createMeasure(input: $input) {
+				measureEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var measureResult struct {
+		CreateMeasure struct {
+			MeasureEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"measureEdge"`
+		} `json:"createMeasure"`
+	}
+
+	err = owner.Execute(createMeasureQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           "Test Measure for Control",
+			"category":       "POLICY",
+		},
+	}, &measureResult)
+	require.NoError(t, err)
+	measureID := measureResult.CreateMeasure.MeasureEdge.Node.ID
+
+	// Create mapping
+	createMappingQuery := `
+		mutation CreateControlMeasureMapping($input: CreateControlMeasureMappingInput!) {
+			createControlMeasureMapping(input: $input) {
+				controlEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var mappingResult struct {
+		CreateControlMeasureMapping struct {
+			ControlEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"controlEdge"`
+		} `json:"createControlMeasureMapping"`
+	}
+
+	err = owner.Execute(createMappingQuery, map[string]any{
+		"input": map[string]any{
+			"controlId": controlID,
+			"measureId": measureID,
+		},
+	}, &mappingResult)
+	require.NoError(t, err)
+
+	t.Run("Control framework sub-resolver", func(t *testing.T) {
+		query := `
+			query GetControlFramework($id: ID!) {
+				node(id: $id) {
+					... on Control {
+						id
+						framework {
+							id
+							name
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			Node struct {
+				ID        string `json:"id"`
+				Framework struct {
+					ID   string `json:"id"`
+					Name string `json:"name"`
+				} `json:"framework"`
+			} `json:"node"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"id": controlID,
+		}, &result)
+		require.NoError(t, err)
+		assert.Equal(t, frameworkID, result.Node.Framework.ID)
+	})
+
+	t.Run("Control measures sub-resolver", func(t *testing.T) {
+		query := `
+			query GetControlMeasures($id: ID!) {
+				node(id: $id) {
+					... on Control {
+						id
+						measures(first: 10) {
+							edges {
+								node {
+									id
+									name
+								}
+							}
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			Node struct {
+				ID       string `json:"id"`
+				Measures struct {
+					Edges []struct {
+						Node struct {
+							ID   string `json:"id"`
+							Name string `json:"name"`
+						} `json:"node"`
+					} `json:"edges"`
+				} `json:"measures"`
+			} `json:"node"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"id": controlID,
+		}, &result)
+		require.NoError(t, err)
+		assert.GreaterOrEqual(t, len(result.Node.Measures.Edges), 1)
+	})
+}
+
+func TestControl_ExclusionJustification(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create framework
+	createFrameworkQuery := `
+		mutation CreateFramework($input: CreateFrameworkInput!) {
+			createFramework(input: $input) {
+				frameworkEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var frameworkResult struct {
+		CreateFramework struct {
+			FrameworkEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"frameworkEdge"`
+		} `json:"createFramework"`
+	}
+
+	err := owner.Execute(createFrameworkQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           fmt.Sprintf("Exclusion Test %d", time.Now().UnixNano()),
+		},
+	}, &frameworkResult)
+	require.NoError(t, err)
+	frameworkID := frameworkResult.CreateFramework.FrameworkEdge.Node.ID
+
+	t.Run("EXCLUDED status should have exclusionJustification", func(t *testing.T) {
+		createControlQuery := `
+			mutation CreateControl($input: CreateControlInput!) {
+				createControl(input: $input) {
+					controlEdge {
+						node {
+							id
+							status
+							exclusionJustification
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			CreateControl struct {
+				ControlEdge struct {
+					Node struct {
+						ID                     string `json:"id"`
+						Status                 string `json:"status"`
+						ExclusionJustification string `json:"exclusionJustification"`
+					} `json:"node"`
+				} `json:"controlEdge"`
+			} `json:"createControl"`
+		}
+
+		err := owner.Execute(createControlQuery, map[string]any{
+			"input": map[string]any{
+				"frameworkId":            frameworkID,
+				"name":                   "Excluded Control",
+				"description":            "Test",
+				"sectionTitle":           "Section 1",
+				"status":                 "EXCLUDED",
+				"exclusionJustification": "Not applicable to our business",
+			},
+		}, &result)
+		require.NoError(t, err)
+		assert.Equal(t, "EXCLUDED", result.CreateControl.ControlEdge.Node.Status)
+		assert.Equal(t, "Not applicable to our business", result.CreateControl.ControlEdge.Node.ExclusionJustification)
+	})
+
+	t.Run("Change status from INCLUDED to EXCLUDED", func(t *testing.T) {
+		// Create included control first
+		createControlQuery := `
+			mutation CreateControl($input: CreateControlInput!) {
+				createControl(input: $input) {
+					controlEdge {
+						node {
+							id
+						}
+					}
+				}
+			}
+		`
+
+		var createResult struct {
+			CreateControl struct {
+				ControlEdge struct {
+					Node struct {
+						ID string `json:"id"`
+					} `json:"node"`
+				} `json:"controlEdge"`
+			} `json:"createControl"`
+		}
+
+		err := owner.Execute(createControlQuery, map[string]any{
+			"input": map[string]any{
+				"frameworkId":  frameworkID,
+				"name":         "To Be Excluded Control",
+				"description":  "Test",
+				"sectionTitle": "Section 2",
+				"status":       "INCLUDED",
+			},
+		}, &createResult)
+		require.NoError(t, err)
+
+		// Update to excluded
+		updateControlQuery := `
+			mutation UpdateControl($input: UpdateControlInput!) {
+				updateControl(input: $input) {
+					control {
+						id
+						status
+						exclusionJustification
+					}
+				}
+			}
+		`
+
+		var updateResult struct {
+			UpdateControl struct {
+				Control struct {
+					ID                     string `json:"id"`
+					Status                 string `json:"status"`
+					ExclusionJustification string `json:"exclusionJustification"`
+				} `json:"control"`
+			} `json:"updateControl"`
+		}
+
+		err = owner.Execute(updateControlQuery, map[string]any{
+			"input": map[string]any{
+				"id":                     createResult.CreateControl.ControlEdge.Node.ID,
+				"status":                 "EXCLUDED",
+				"exclusionJustification": "Decided to exclude",
+			},
+		}, &updateResult)
+		require.NoError(t, err)
+	})
+}

e2e/console/document_version_test.go

@@ -0,0 +1,459 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/factory"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+// createTestDocument creates a document and returns its ID and the document version ID
+func createTestDocument(t *testing.T, owner *testutil.Client) (docID string, docVersionID string) {
+	t.Helper()
+	peopleID := factory.NewPeople(owner).WithFullName("Doc Owner").Create()
+
+	query := `
+		mutation CreateDocument($input: CreateDocumentInput!) {
+			createDocument(input: $input) {
+				documentEdge {
+					node {
+						id
+						versions(first: 1) {
+							edges {
+								node {
+									id
+								}
+							}
+						}
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		CreateDocument struct {
+			DocumentEdge struct {
+				Node struct {
+					ID       string `json:"id"`
+					Versions struct {
+						Edges []struct {
+							Node struct {
+								ID string `json:"id"`
+							} `json:"node"`
+						} `json:"edges"`
+					} `json:"versions"`
+				} `json:"node"`
+			} `json:"documentEdge"`
+		} `json:"createDocument"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"title":          "Test Document",
+			"content":        "Initial content",
+			"ownerId":        peopleID,
+			"documentType":   "POLICY",
+			"classification": "INTERNAL",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	docID = result.CreateDocument.DocumentEdge.Node.ID
+	if len(result.CreateDocument.DocumentEdge.Node.Versions.Edges) > 0 {
+		docVersionID = result.CreateDocument.DocumentEdge.Node.Versions.Edges[0].Node.ID
+	}
+	return docID, docVersionID
+}
+
+func TestDocumentVersion_PublishVersion(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	docID, _ := createTestDocument(t, owner)
+
+	query := `
+		mutation PublishDocumentVersion($input: PublishDocumentVersionInput!) {
+			publishDocumentVersion(input: $input) {
+				documentVersion {
+					id
+					status
+					version
+					changelog
+				}
+				document {
+					id
+				}
+			}
+		}
+	`
+
+	var result struct {
+		PublishDocumentVersion struct {
+			DocumentVersion struct {
+				ID        string `json:"id"`
+				Status    string `json:"status"`
+				Version   int    `json:"version"`
+				Changelog string `json:"changelog"`
+			} `json:"documentVersion"`
+			Document struct {
+				ID string `json:"id"`
+			} `json:"document"`
+		} `json:"publishDocumentVersion"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"documentId": docID,
+			"changelog":  "Initial release",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, "PUBLISHED", result.PublishDocumentVersion.DocumentVersion.Status)
+	assert.Equal(t, 1, result.PublishDocumentVersion.DocumentVersion.Version)
+	assert.Equal(t, "Initial release", result.PublishDocumentVersion.DocumentVersion.Changelog)
+}
+
+func TestDocumentVersion_CreateDraft(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create and publish a document first
+	docID, _ := createTestDocument(t, owner)
+
+	publishQuery := `
+		mutation PublishDocumentVersion($input: PublishDocumentVersionInput!) {
+			publishDocumentVersion(input: $input) {
+				documentVersion {
+					id
+				}
+			}
+		}
+	`
+
+	_, err := owner.Do(publishQuery, map[string]any{
+		"input": map[string]any{
+			"documentId": docID,
+			"changelog":  "Initial release",
+		},
+	})
+	require.NoError(t, err)
+
+	query := `
+		mutation CreateDraftDocumentVersion($input: CreateDraftDocumentVersionInput!) {
+			createDraftDocumentVersion(input: $input) {
+				documentVersionEdge {
+					node {
+						id
+						status
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		CreateDraftDocumentVersion struct {
+			DocumentVersionEdge struct {
+				Node struct {
+					ID     string `json:"id"`
+					Status string `json:"status"`
+				} `json:"node"`
+			} `json:"documentVersionEdge"`
+		} `json:"createDraftDocumentVersion"`
+	}
+
+	err = owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"documentID": docID,
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, "DRAFT", result.CreateDraftDocumentVersion.DocumentVersionEdge.Node.Status)
+}
+
+func TestDocumentVersion_UpdateContent(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	_, draftVersionID := createTestDocument(t, owner)
+
+	query := `
+		mutation UpdateDocumentVersion($input: UpdateDocumentVersionInput!) {
+			updateDocumentVersion(input: $input) {
+				documentVersion {
+					id
+					content
+				}
+			}
+		}
+	`
+
+	var result struct {
+		UpdateDocumentVersion struct {
+			DocumentVersion struct {
+				ID      string `json:"id"`
+				Content string `json:"content"`
+			} `json:"documentVersion"`
+		} `json:"updateDocumentVersion"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"documentVersionId": draftVersionID,
+			"content":           "Updated content for the document",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, "Updated content for the document", result.UpdateDocumentVersion.DocumentVersion.Content)
+}
+
+func TestDocumentVersion_RequestSignature(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create and publish a document
+	docID, _ := createTestDocument(t, owner)
+
+	publishQuery := `
+		mutation PublishDocumentVersion($input: PublishDocumentVersionInput!) {
+			publishDocumentVersion(input: $input) {
+				documentVersion {
+					id
+				}
+			}
+		}
+	`
+
+	var publishResult struct {
+		PublishDocumentVersion struct {
+			DocumentVersion struct {
+				ID string `json:"id"`
+			} `json:"documentVersion"`
+		} `json:"publishDocumentVersion"`
+	}
+
+	err := owner.Execute(publishQuery, map[string]any{
+		"input": map[string]any{
+			"documentId": docID,
+			"changelog":  "Initial release",
+		},
+	}, &publishResult)
+	require.NoError(t, err)
+
+	publishedVersionID := publishResult.PublishDocumentVersion.DocumentVersion.ID
+
+	// Create a person to sign
+	signerID := factory.NewPeople(owner).WithFullName("Document Signer").Create()
+
+	query := `
+		mutation RequestSignature($input: RequestSignatureInput!) {
+			requestSignature(input: $input) {
+				documentVersionSignatureEdge {
+					node {
+						id
+						state
+						signedBy {
+							id
+							fullName
+						}
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		RequestSignature struct {
+			DocumentVersionSignatureEdge struct {
+				Node struct {
+					ID       string `json:"id"`
+					State    string `json:"state"`
+					SignedBy struct {
+						ID       string `json:"id"`
+						FullName string `json:"fullName"`
+					} `json:"signedBy"`
+				} `json:"node"`
+			} `json:"documentVersionSignatureEdge"`
+		} `json:"requestSignature"`
+	}
+
+	err = owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"documentVersionId": publishedVersionID,
+			"signatoryId":       signerID,
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.NotEmpty(t, result.RequestSignature.DocumentVersionSignatureEdge.Node.ID)
+	assert.Equal(t, "REQUESTED", result.RequestSignature.DocumentVersionSignatureEdge.Node.State)
+	assert.Equal(t, signerID, result.RequestSignature.DocumentVersionSignatureEdge.Node.SignedBy.ID)
+}
+
+func TestDocumentVersion_BulkPublish(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create multiple documents
+	docID1, _ := createTestDocument(t, owner)
+	docID2, _ := createTestDocument(t, owner)
+
+	query := `
+		mutation BulkPublishDocumentVersions($input: BulkPublishDocumentVersionsInput!) {
+			bulkPublishDocumentVersions(input: $input) {
+				documentVersionEdges {
+					node {
+						id
+						status
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		BulkPublishDocumentVersions struct {
+			DocumentVersionEdges []struct {
+				Node struct {
+					ID     string `json:"id"`
+					Status string `json:"status"`
+				} `json:"node"`
+			} `json:"documentVersionEdges"`
+		} `json:"bulkPublishDocumentVersions"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"documentIds": []string{docID1, docID2},
+			"changelog":   "Bulk publish release",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, 2, len(result.BulkPublishDocumentVersions.DocumentVersionEdges))
+	for _, edge := range result.BulkPublishDocumentVersions.DocumentVersionEdges {
+		assert.Equal(t, "PUBLISHED", edge.Node.Status)
+	}
+}
+
+func TestDocumentVersion_BulkRequestSignatures(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create and publish a document
+	docID, _ := createTestDocument(t, owner)
+
+	publishQuery := `
+		mutation PublishDocumentVersion($input: PublishDocumentVersionInput!) {
+			publishDocumentVersion(input: $input) {
+				documentVersion {
+					id
+				}
+			}
+		}
+	`
+
+	_, err := owner.Do(publishQuery, map[string]any{
+		"input": map[string]any{
+			"documentId": docID,
+			"changelog":  "Initial release",
+		},
+	})
+	require.NoError(t, err)
+
+	// Create multiple signers
+	signer1ID := factory.NewPeople(owner).WithFullName("Bulk Signer 1").Create()
+	signer2ID := factory.NewPeople(owner).WithFullName("Bulk Signer 2").Create()
+
+	query := `
+		mutation BulkRequestSignatures($input: BulkRequestSignaturesInput!) {
+			bulkRequestSignatures(input: $input) {
+				documentVersionSignatureEdges {
+					node {
+						id
+						state
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		BulkRequestSignatures struct {
+			DocumentVersionSignatureEdges []struct {
+				Node struct {
+					ID    string `json:"id"`
+					State string `json:"state"`
+				} `json:"node"`
+			} `json:"documentVersionSignatureEdges"`
+		} `json:"bulkRequestSignatures"`
+	}
+
+	err = owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"documentIds":  []string{docID},
+			"signatoryIds": []string{signer1ID, signer2ID},
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, 2, len(result.BulkRequestSignatures.DocumentVersionSignatureEdges))
+	for _, edge := range result.BulkRequestSignatures.DocumentVersionSignatureEdges {
+		assert.Equal(t, "REQUESTED", edge.Node.State)
+	}
+}
+
+func TestDocumentVersion_BulkDelete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create multiple documents to delete
+	docID1, _ := createTestDocument(t, owner)
+	docID2, _ := createTestDocument(t, owner)
+
+	query := `
+		mutation BulkDeleteDocuments($input: BulkDeleteDocumentsInput!) {
+			bulkDeleteDocuments(input: $input) {
+				deletedDocumentIds
+			}
+		}
+	`
+
+	var result struct {
+		BulkDeleteDocuments struct {
+			DeletedDocumentIds []string `json:"deletedDocumentIds"`
+		} `json:"bulkDeleteDocuments"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"documentIds": []string{docID1, docID2},
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, 2, len(result.BulkDeleteDocuments.DeletedDocumentIds))
+	assert.Contains(t, result.BulkDeleteDocuments.DeletedDocumentIds, docID1)
+	assert.Contains(t, result.BulkDeleteDocuments.DeletedDocumentIds, docID2)
+}

e2e/console/main_test.go

@@ -0,0 +1,30 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+// Package console_test contains end-to-end tests for the Console GraphQL API.
+package console_test
+
+import (
+	"os"
+	"testing"
+
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+func TestMain(m *testing.M) {
+	testutil.Setup()
+	code := m.Run()
+	testutil.Teardown()
+	os.Exit(code)
+}

e2e/console/mapping_test.go

@@ -0,0 +1,946 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/factory"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+func TestControlMeasureMapping_CreateDelete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a framework
+	var createFrameworkResult struct {
+		CreateFramework struct {
+			FrameworkEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"frameworkEdge"`
+		} `json:"createFramework"`
+	}
+	err := owner.Execute(`
+		mutation($input: CreateFrameworkInput!) {
+			createFramework(input: $input) {
+				frameworkEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           "Framework for Mapping",
+		},
+	}, &createFrameworkResult)
+	require.NoError(t, err)
+	frameworkID := createFrameworkResult.CreateFramework.FrameworkEdge.Node.ID
+
+	// Create a control
+	var createControlResult struct {
+		CreateControl struct {
+			ControlEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"controlEdge"`
+		} `json:"createControl"`
+	}
+	err = owner.Execute(`
+		mutation($input: CreateControlInput!) {
+			createControl(input: $input) {
+				controlEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"frameworkId":  frameworkID,
+			"name":         "Control for Mapping",
+			"description":  "Test control for mapping",
+			"sectionTitle": "Section 1",
+			"status":       "INCLUDED",
+		},
+	}, &createControlResult)
+	require.NoError(t, err)
+	controlID := createControlResult.CreateControl.ControlEdge.Node.ID
+
+	// Create a measure
+	var createMeasureResult struct {
+		CreateMeasure struct {
+			MeasureEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"measureEdge"`
+		} `json:"createMeasure"`
+	}
+	err = owner.Execute(`
+		mutation($input: CreateMeasureInput!) {
+			createMeasure(input: $input) {
+				measureEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           "Measure for Mapping",
+			"category":       "POLICY",
+		},
+	}, &createMeasureResult)
+	require.NoError(t, err)
+	measureID := createMeasureResult.CreateMeasure.MeasureEdge.Node.ID
+
+	t.Run("create mapping", func(t *testing.T) {
+		var result struct {
+			CreateControlMeasureMapping struct {
+				ControlEdge struct {
+					Node struct {
+						ID string `json:"id"`
+					} `json:"node"`
+				} `json:"controlEdge"`
+				MeasureEdge struct {
+					Node struct {
+						ID string `json:"id"`
+					} `json:"node"`
+				} `json:"measureEdge"`
+			} `json:"createControlMeasureMapping"`
+		}
+		err := owner.Execute(`
+			mutation($input: CreateControlMeasureMappingInput!) {
+				createControlMeasureMapping(input: $input) {
+					controlEdge {
+						node {
+							id
+						}
+					}
+					measureEdge {
+						node {
+							id
+						}
+					}
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"controlId": controlID,
+				"measureId": measureID,
+			},
+		}, &result)
+		require.NoError(t, err)
+		assert.Equal(t, controlID, result.CreateControlMeasureMapping.ControlEdge.Node.ID)
+		assert.Equal(t, measureID, result.CreateControlMeasureMapping.MeasureEdge.Node.ID)
+	})
+
+	t.Run("delete mapping", func(t *testing.T) {
+		_, err := owner.Do(`
+			mutation($input: DeleteControlMeasureMappingInput!) {
+				deleteControlMeasureMapping(input: $input) {
+					deletedControlId
+					deletedMeasureId
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"controlId": controlID,
+				"measureId": measureID,
+			},
+		})
+		require.NoError(t, err)
+	})
+}
+
+func TestRiskMeasureMapping_CreateDelete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a risk
+	var createRiskResult struct {
+		CreateRisk struct {
+			RiskEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"riskEdge"`
+		} `json:"createRisk"`
+	}
+	err := owner.Execute(`
+		mutation($input: CreateRiskInput!) {
+			createRisk(input: $input) {
+				riskEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"organizationId":     owner.GetOrganizationID().String(),
+			"name":               "Risk for Mapping",
+			"category":           "Operational",
+			"treatment":          "MITIGATED",
+			"inherentLikelihood": 3,
+			"inherentImpact":     3,
+		},
+	}, &createRiskResult)
+	require.NoError(t, err)
+	riskID := createRiskResult.CreateRisk.RiskEdge.Node.ID
+
+	// Create a measure
+	var createMeasureResult struct {
+		CreateMeasure struct {
+			MeasureEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"measureEdge"`
+		} `json:"createMeasure"`
+	}
+	err = owner.Execute(`
+		mutation($input: CreateMeasureInput!) {
+			createMeasure(input: $input) {
+				measureEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           "Measure for Risk Mapping",
+			"category":       "TECHNICAL",
+		},
+	}, &createMeasureResult)
+	require.NoError(t, err)
+	measureID := createMeasureResult.CreateMeasure.MeasureEdge.Node.ID
+
+	t.Run("create mapping", func(t *testing.T) {
+		var result struct {
+			CreateRiskMeasureMapping struct {
+				RiskEdge struct {
+					Node struct {
+						ID string `json:"id"`
+					} `json:"node"`
+				} `json:"riskEdge"`
+				MeasureEdge struct {
+					Node struct {
+						ID string `json:"id"`
+					} `json:"node"`
+				} `json:"measureEdge"`
+			} `json:"createRiskMeasureMapping"`
+		}
+		err := owner.Execute(`
+			mutation($input: CreateRiskMeasureMappingInput!) {
+				createRiskMeasureMapping(input: $input) {
+					riskEdge {
+						node {
+							id
+						}
+					}
+					measureEdge {
+						node {
+							id
+						}
+					}
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"riskId":    riskID,
+				"measureId": measureID,
+			},
+		}, &result)
+		require.NoError(t, err)
+		assert.Equal(t, riskID, result.CreateRiskMeasureMapping.RiskEdge.Node.ID)
+		assert.Equal(t, measureID, result.CreateRiskMeasureMapping.MeasureEdge.Node.ID)
+	})
+
+	t.Run("delete mapping", func(t *testing.T) {
+		_, err := owner.Do(`
+			mutation($input: DeleteRiskMeasureMappingInput!) {
+				deleteRiskMeasureMapping(input: $input) {
+					deletedRiskId
+					deletedMeasureId
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"riskId":    riskID,
+				"measureId": measureID,
+			},
+		})
+		require.NoError(t, err)
+	})
+}
+
+func TestControlDocumentMapping_CreateDelete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a framework and control
+	var createFrameworkResult struct {
+		CreateFramework struct {
+			FrameworkEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"frameworkEdge"`
+		} `json:"createFramework"`
+	}
+	err := owner.Execute(`
+		mutation($input: CreateFrameworkInput!) {
+			createFramework(input: $input) {
+				frameworkEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           "Framework for ControlDoc Mapping",
+		},
+	}, &createFrameworkResult)
+	require.NoError(t, err)
+	frameworkID := createFrameworkResult.CreateFramework.FrameworkEdge.Node.ID
+
+	var createControlResult struct {
+		CreateControl struct {
+			ControlEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"controlEdge"`
+		} `json:"createControl"`
+	}
+	err = owner.Execute(`
+		mutation($input: CreateControlInput!) {
+			createControl(input: $input) {
+				controlEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"frameworkId":  frameworkID,
+			"name":         "Control for Document Mapping",
+			"description":  "Test control",
+			"sectionTitle": "Section 1",
+			"status":       "INCLUDED",
+		},
+	}, &createControlResult)
+	require.NoError(t, err)
+	controlID := createControlResult.CreateControl.ControlEdge.Node.ID
+
+	// Create a document
+	peopleID := factory.NewPeople(owner).WithFullName("Doc Owner").Create()
+	var createDocumentResult struct {
+		CreateDocument struct {
+			DocumentEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"documentEdge"`
+		} `json:"createDocument"`
+	}
+	err = owner.Execute(`
+		mutation($input: CreateDocumentInput!) {
+			createDocument(input: $input) {
+				documentEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"title":          "Document for Control Mapping",
+			"content":        "Document content",
+			"ownerId":        peopleID,
+			"documentType":   "POLICY",
+			"classification": "INTERNAL",
+		},
+	}, &createDocumentResult)
+	require.NoError(t, err)
+	documentID := createDocumentResult.CreateDocument.DocumentEdge.Node.ID
+
+	t.Run("create mapping", func(t *testing.T) {
+		_, err := owner.Do(`
+			mutation($input: CreateControlDocumentMappingInput!) {
+				createControlDocumentMapping(input: $input) {
+					controlEdge {
+						node {
+							id
+						}
+					}
+					documentEdge {
+						node {
+							id
+						}
+					}
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"controlId":  controlID,
+				"documentId": documentID,
+			},
+		})
+		require.NoError(t, err)
+	})
+
+	t.Run("delete mapping", func(t *testing.T) {
+		_, err := owner.Do(`
+			mutation($input: DeleteControlDocumentMappingInput!) {
+				deleteControlDocumentMapping(input: $input) {
+					deletedControlId
+					deletedDocumentId
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"controlId":  controlID,
+				"documentId": documentID,
+			},
+		})
+		require.NoError(t, err)
+	})
+}
+
+func TestControlAuditMapping_CreateDelete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a framework and control
+	var createFrameworkResult struct {
+		CreateFramework struct {
+			FrameworkEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"frameworkEdge"`
+		} `json:"createFramework"`
+	}
+	err := owner.Execute(`
+		mutation($input: CreateFrameworkInput!) {
+			createFramework(input: $input) {
+				frameworkEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           "Framework for ControlAudit Mapping",
+		},
+	}, &createFrameworkResult)
+	require.NoError(t, err)
+	frameworkID := createFrameworkResult.CreateFramework.FrameworkEdge.Node.ID
+
+	var createControlResult struct {
+		CreateControl struct {
+			ControlEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"controlEdge"`
+		} `json:"createControl"`
+	}
+	err = owner.Execute(`
+		mutation($input: CreateControlInput!) {
+			createControl(input: $input) {
+				controlEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"frameworkId":  frameworkID,
+			"name":         "Control for Audit Mapping",
+			"description":  "Test control",
+			"sectionTitle": "Section 1",
+			"status":       "INCLUDED",
+		},
+	}, &createControlResult)
+	require.NoError(t, err)
+	controlID := createControlResult.CreateControl.ControlEdge.Node.ID
+
+	// Create an audit
+	var createAuditResult struct {
+		CreateAudit struct {
+			AuditEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"auditEdge"`
+		} `json:"createAudit"`
+	}
+	err = owner.Execute(`
+		mutation($input: CreateAuditInput!) {
+			createAudit(input: $input) {
+				auditEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"frameworkId":    frameworkID,
+			"name":           "Audit for Control Mapping",
+		},
+	}, &createAuditResult)
+	require.NoError(t, err)
+	auditID := createAuditResult.CreateAudit.AuditEdge.Node.ID
+
+	t.Run("create mapping", func(t *testing.T) {
+		_, err := owner.Do(`
+			mutation($input: CreateControlAuditMappingInput!) {
+				createControlAuditMapping(input: $input) {
+					controlEdge {
+						node {
+							id
+						}
+					}
+					auditEdge {
+						node {
+							id
+						}
+					}
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"controlId": controlID,
+				"auditId":   auditID,
+			},
+		})
+		require.NoError(t, err)
+	})
+
+	t.Run("delete mapping", func(t *testing.T) {
+		_, err := owner.Do(`
+			mutation($input: DeleteControlAuditMappingInput!) {
+				deleteControlAuditMapping(input: $input) {
+					deletedControlId
+					deletedAuditId
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"controlId": controlID,
+				"auditId":   auditID,
+			},
+		})
+		require.NoError(t, err)
+	})
+}
+
+func TestControlSnapshotMapping_CreateDelete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a framework and control
+	var createFrameworkResult struct {
+		CreateFramework struct {
+			FrameworkEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"frameworkEdge"`
+		} `json:"createFramework"`
+	}
+	err := owner.Execute(`
+		mutation($input: CreateFrameworkInput!) {
+			createFramework(input: $input) {
+				frameworkEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           "Framework for ControlSnapshot Mapping",
+		},
+	}, &createFrameworkResult)
+	require.NoError(t, err)
+	frameworkID := createFrameworkResult.CreateFramework.FrameworkEdge.Node.ID
+
+	var createControlResult struct {
+		CreateControl struct {
+			ControlEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"controlEdge"`
+		} `json:"createControl"`
+	}
+	err = owner.Execute(`
+		mutation($input: CreateControlInput!) {
+			createControl(input: $input) {
+				controlEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"frameworkId":  frameworkID,
+			"name":         "Control for Snapshot Mapping",
+			"description":  "Test control",
+			"sectionTitle": "Section 1",
+			"status":       "INCLUDED",
+		},
+	}, &createControlResult)
+	require.NoError(t, err)
+	controlID := createControlResult.CreateControl.ControlEdge.Node.ID
+
+	// Create a snapshot
+	var createSnapshotResult struct {
+		CreateSnapshot struct {
+			SnapshotEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"snapshotEdge"`
+		} `json:"createSnapshot"`
+	}
+	err = owner.Execute(`
+		mutation($input: CreateSnapshotInput!) {
+			createSnapshot(input: $input) {
+				snapshotEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           "Snapshot for Control Mapping",
+			"type":           "RISKS",
+		},
+	}, &createSnapshotResult)
+	require.NoError(t, err)
+	snapshotID := createSnapshotResult.CreateSnapshot.SnapshotEdge.Node.ID
+
+	t.Run("create mapping", func(t *testing.T) {
+		_, err := owner.Do(`
+			mutation($input: CreateControlSnapshotMappingInput!) {
+				createControlSnapshotMapping(input: $input) {
+					controlEdge {
+						node {
+							id
+						}
+					}
+					snapshotEdge {
+						node {
+							id
+						}
+					}
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"controlId":  controlID,
+				"snapshotId": snapshotID,
+			},
+		})
+		require.NoError(t, err)
+	})
+
+	t.Run("delete mapping", func(t *testing.T) {
+		_, err := owner.Do(`
+			mutation($input: DeleteControlSnapshotMappingInput!) {
+				deleteControlSnapshotMapping(input: $input) {
+					deletedControlId
+					deletedSnapshotId
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"controlId":  controlID,
+				"snapshotId": snapshotID,
+			},
+		})
+		require.NoError(t, err)
+	})
+}
+
+func TestRiskDocumentMapping_CreateDelete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a risk
+	var createRiskResult struct {
+		CreateRisk struct {
+			RiskEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"riskEdge"`
+		} `json:"createRisk"`
+	}
+	err := owner.Execute(`
+		mutation($input: CreateRiskInput!) {
+			createRisk(input: $input) {
+				riskEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"organizationId":     owner.GetOrganizationID().String(),
+			"name":               "Risk for Document Mapping",
+			"category":           "Operational",
+			"treatment":          "MITIGATED",
+			"inherentLikelihood": 3,
+			"inherentImpact":     3,
+		},
+	}, &createRiskResult)
+	require.NoError(t, err)
+	riskID := createRiskResult.CreateRisk.RiskEdge.Node.ID
+
+	// Create a document
+	peopleID := factory.NewPeople(owner).WithFullName("Doc Owner").Create()
+	var createDocumentResult struct {
+		CreateDocument struct {
+			DocumentEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"documentEdge"`
+		} `json:"createDocument"`
+	}
+	err = owner.Execute(`
+		mutation($input: CreateDocumentInput!) {
+			createDocument(input: $input) {
+				documentEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"title":          "Document for Risk Mapping",
+			"content":        "Document content",
+			"ownerId":        peopleID,
+			"documentType":   "POLICY",
+			"classification": "INTERNAL",
+		},
+	}, &createDocumentResult)
+	require.NoError(t, err)
+	documentID := createDocumentResult.CreateDocument.DocumentEdge.Node.ID
+
+	t.Run("create mapping", func(t *testing.T) {
+		_, err := owner.Do(`
+			mutation($input: CreateRiskDocumentMappingInput!) {
+				createRiskDocumentMapping(input: $input) {
+					riskEdge {
+						node {
+							id
+						}
+					}
+					documentEdge {
+						node {
+							id
+						}
+					}
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"riskId":     riskID,
+				"documentId": documentID,
+			},
+		})
+		require.NoError(t, err)
+	})
+
+	t.Run("delete mapping", func(t *testing.T) {
+		_, err := owner.Do(`
+			mutation($input: DeleteRiskDocumentMappingInput!) {
+				deleteRiskDocumentMapping(input: $input) {
+					deletedRiskId
+					deletedDocumentId
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"riskId":     riskID,
+				"documentId": documentID,
+			},
+		})
+		require.NoError(t, err)
+	})
+}
+
+func TestRiskObligationMapping_CreateDelete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a risk
+	var createRiskResult struct {
+		CreateRisk struct {
+			RiskEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"riskEdge"`
+		} `json:"createRisk"`
+	}
+	err := owner.Execute(`
+		mutation($input: CreateRiskInput!) {
+			createRisk(input: $input) {
+				riskEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"organizationId":     owner.GetOrganizationID().String(),
+			"name":               "Risk for Obligation Mapping",
+			"category":           "Compliance",
+			"treatment":          "MITIGATED",
+			"inherentLikelihood": 2,
+			"inherentImpact":     4,
+		},
+	}, &createRiskResult)
+	require.NoError(t, err)
+	riskID := createRiskResult.CreateRisk.RiskEdge.Node.ID
+
+	// Create an obligation
+	peopleID := factory.NewPeople(owner).WithFullName("Obligation Owner").Create()
+	var createObligationResult struct {
+		CreateObligation struct {
+			ObligationEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"obligationEdge"`
+		} `json:"createObligation"`
+	}
+	err = owner.Execute(`
+		mutation($input: CreateObligationInput!) {
+			createObligation(input: $input) {
+				obligationEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"area":           "Risk Management",
+			"requirement":    "Obligation for Risk Mapping",
+			"ownerId":        peopleID,
+			"status":         "NON_COMPLIANT",
+		},
+	}, &createObligationResult)
+	require.NoError(t, err)
+	obligationID := createObligationResult.CreateObligation.ObligationEdge.Node.ID
+
+	t.Run("create mapping", func(t *testing.T) {
+		_, err := owner.Do(`
+			mutation($input: CreateRiskObligationMappingInput!) {
+				createRiskObligationMapping(input: $input) {
+					riskEdge {
+						node {
+							id
+						}
+					}
+					obligationEdge {
+						node {
+							id
+						}
+					}
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"riskId":       riskID,
+				"obligationId": obligationID,
+			},
+		})
+		require.NoError(t, err)
+	})
+
+	t.Run("delete mapping", func(t *testing.T) {
+		_, err := owner.Do(`
+			mutation($input: DeleteRiskObligationMappingInput!) {
+				deleteRiskObligationMapping(input: $input) {
+					deletedRiskId
+					deletedObligationId
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"riskId":       riskID,
+				"obligationId": obligationID,
+			},
+		})
+		require.NoError(t, err)
+	})
+}

e2e/console/member_test.go

@@ -0,0 +1,315 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+func TestMember_UpdateMembership(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create an admin to update
+	_ = testutil.NewClientInOrg(t, testutil.RoleAdmin, owner)
+
+	// Get the member ID of the admin
+	query := `
+		query($id: ID!) {
+			node(id: $id) {
+				... on Organization {
+					memberships(first: 10) {
+						edges {
+							node {
+								id
+								role
+								userID
+							}
+						}
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		Node struct {
+			Memberships struct {
+				Edges []struct {
+					Node struct {
+						ID     string `json:"id"`
+						Role   string `json:"role"`
+						UserID string `json:"userID"`
+					} `json:"node"`
+				} `json:"edges"`
+			} `json:"memberships"`
+		} `json:"node"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"id": owner.GetOrganizationID().String(),
+	}, &result)
+	require.NoError(t, err)
+
+	// Find the admin member
+	var adminMemberID string
+	for _, edge := range result.Node.Memberships.Edges {
+		if edge.Node.Role == "ADMIN" {
+			adminMemberID = edge.Node.ID
+			break
+		}
+	}
+	require.NotEmpty(t, adminMemberID, "Should find admin member")
+
+	// Update the member role to VIEWER
+	mutation := `
+		mutation($input: UpdateMembershipInput!) {
+			updateMembership(input: $input) {
+				membership {
+					id
+					role
+				}
+			}
+		}
+	`
+
+	var mutationResult struct {
+		UpdateMembership struct {
+			Membership struct {
+				ID   string `json:"id"`
+				Role string `json:"role"`
+			} `json:"membership"`
+		} `json:"updateMembership"`
+	}
+
+	err = owner.Execute(mutation, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"memberId":       adminMemberID,
+			"role":           "VIEWER",
+		},
+	}, &mutationResult)
+	require.NoError(t, err)
+
+	assert.Equal(t, "VIEWER", mutationResult.UpdateMembership.Membership.Role)
+}
+
+func TestMember_RemoveMember(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a member to remove
+	memberToRemove := testutil.NewClientInOrg(t, testutil.RoleViewer, owner)
+	_ = memberToRemove
+
+	// Get the member ID
+	query := `
+		query($id: ID!) {
+			node(id: $id) {
+				... on Organization {
+					memberships(first: 50) {
+						edges {
+							node {
+								id
+								role
+							}
+						}
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		Node struct {
+			Memberships struct {
+				Edges []struct {
+					Node struct {
+						ID   string `json:"id"`
+						Role string `json:"role"`
+					} `json:"node"`
+				} `json:"edges"`
+			} `json:"memberships"`
+		} `json:"node"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"id": owner.GetOrganizationID().String(),
+	}, &result)
+	require.NoError(t, err)
+
+	// Find a viewer member to remove
+	var memberID string
+	for _, edge := range result.Node.Memberships.Edges {
+		if edge.Node.Role == "VIEWER" {
+			memberID = edge.Node.ID
+			break
+		}
+	}
+	assert.NotEmpty(t, memberID, "Should find viewer member")
+
+	// Remove the member
+	mutation := `
+		mutation($input: RemoveMemberInput!) {
+			removeMember(input: $input) {
+				deletedMemberId
+			}
+		}
+	`
+
+	var mutationResult struct {
+		RemoveMember struct {
+			DeletedMemberID string `json:"deletedMemberId"`
+		} `json:"removeMember"`
+	}
+
+	err = owner.Execute(mutation, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"memberId":       memberID,
+		},
+	}, &mutationResult)
+	require.NoError(t, err)
+
+	assert.Equal(t, memberID, mutationResult.RemoveMember.DeletedMemberID)
+}
+
+func TestInvitation_Delete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create an invitation
+	inviteMutation := `
+		mutation($input: InviteUserInput!) {
+			inviteUser(input: $input) {
+				invitationEdge {
+					node {
+						id
+						email
+						status
+					}
+				}
+			}
+		}
+	`
+
+	var inviteResult struct {
+		InviteUser struct {
+			InvitationEdge struct {
+				Node struct {
+					ID     string `json:"id"`
+					Email  string `json:"email"`
+					Status string `json:"status"`
+				} `json:"node"`
+			} `json:"invitationEdge"`
+		} `json:"inviteUser"`
+	}
+
+	err := owner.Execute(inviteMutation, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"email":          fmt.Sprintf("invite.delete.%d@example.com", time.Now().UnixNano()),
+			"fullName":       "Test User",
+			"role":           "VIEWER",
+			"createPeople":   false,
+		},
+	}, &inviteResult)
+	require.NoError(t, err)
+
+	invitationID := inviteResult.InviteUser.InvitationEdge.Node.ID
+	assert.NotEmpty(t, invitationID)
+
+	// Delete the invitation
+	deleteMutation := `
+		mutation($input: DeleteInvitationInput!) {
+			deleteInvitation(input: $input) {
+				deletedInvitationId
+			}
+		}
+	`
+
+	var deleteResult struct {
+		DeleteInvitation struct {
+			DeletedInvitationID string `json:"deletedInvitationId"`
+		} `json:"deleteInvitation"`
+	}
+
+	err = owner.Execute(deleteMutation, map[string]any{
+		"input": map[string]any{
+			"invitationId": invitationID,
+		},
+	}, &deleteResult)
+	require.NoError(t, err)
+
+	assert.Equal(t, invitationID, deleteResult.DeleteInvitation.DeletedInvitationID)
+}
+
+func TestMember_List(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create additional members
+	testutil.NewClientInOrg(t, testutil.RoleAdmin, owner)
+	testutil.NewClientInOrg(t, testutil.RoleViewer, owner)
+
+	query := `
+		query($id: ID!) {
+			node(id: $id) {
+				... on Organization {
+					memberships(first: 10) {
+						edges {
+							node {
+								id
+								role
+								userID
+								emailAddress
+							}
+						}
+						totalCount
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		Node struct {
+			Memberships struct {
+				Edges []struct {
+					Node struct {
+						ID           string `json:"id"`
+						Role         string `json:"role"`
+						UserID       string `json:"userID"`
+						EmailAddress string `json:"emailAddress"`
+					} `json:"node"`
+				} `json:"edges"`
+				TotalCount int `json:"totalCount"`
+			} `json:"memberships"`
+		} `json:"node"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"id": owner.GetOrganizationID().String(),
+	}, &result)
+	require.NoError(t, err)
+
+	assert.GreaterOrEqual(t, result.Node.Memberships.TotalCount, 3, "Should have at least 3 members")
+}

e2e/console/nonconformity_test.go

@@ -0,0 +1,439 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/factory"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+// createAuditForNC creates a framework and audit for nonconformity testing
+func createAuditForNC(t *testing.T, owner *testutil.Client, name string) string {
+	t.Helper()
+
+	// Create a framework first
+	createFrameworkQuery := `
+		mutation CreateFramework($input: CreateFrameworkInput!) {
+			createFramework(input: $input) {
+				frameworkEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createFrameworkResult struct {
+		CreateFramework struct {
+			FrameworkEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"frameworkEdge"`
+		} `json:"createFramework"`
+	}
+
+	err := owner.Execute(createFrameworkQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           "Framework for " + name,
+		},
+	}, &createFrameworkResult)
+	require.NoError(t, err)
+	frameworkID := createFrameworkResult.CreateFramework.FrameworkEdge.Node.ID
+
+	// Create an audit
+	createAuditQuery := `
+		mutation CreateAudit($input: CreateAuditInput!) {
+			createAudit(input: $input) {
+				auditEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createAuditResult struct {
+		CreateAudit struct {
+			AuditEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"auditEdge"`
+		} `json:"createAudit"`
+	}
+
+	err = owner.Execute(createAuditQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"frameworkId":    frameworkID,
+			"name":           name,
+			"state":          "NOT_STARTED",
+		},
+	}, &createAuditResult)
+	require.NoError(t, err)
+
+	return createAuditResult.CreateAudit.AuditEdge.Node.ID
+}
+
+func TestNonconformity_Create(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("NC Owner").Create()
+	auditID := createAuditForNC(t, owner, "NC Test Audit")
+
+	query := `
+		mutation CreateNonconformity($input: CreateNonconformityInput!) {
+			createNonconformity(input: $input) {
+				nonconformityEdge {
+					node {
+						id
+						referenceId
+						description
+						rootCause
+						correctiveAction
+						status
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		CreateNonconformity struct {
+			NonconformityEdge struct {
+				Node struct {
+					ID               string `json:"id"`
+					ReferenceID      string `json:"referenceId"`
+					Description      string `json:"description"`
+					RootCause        string `json:"rootCause"`
+					CorrectiveAction string `json:"correctiveAction"`
+					Status           string `json:"status"`
+				} `json:"node"`
+			} `json:"nonconformityEdge"`
+		} `json:"createNonconformity"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"organizationId":   owner.GetOrganizationID().String(),
+			"referenceId":      fmt.Sprintf("NC-%d", time.Now().UnixNano()),
+			"description":      "Unauthorized access detected",
+			"auditId":          auditID,
+			"rootCause":        "Insufficient access controls",
+			"correctiveAction": "Implement MFA",
+			"ownerId":          peopleID,
+			"status":           "OPEN",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	nc := result.CreateNonconformity.NonconformityEdge.Node
+	assert.NotEmpty(t, nc.ID)
+	assert.Equal(t, "Unauthorized access detected", nc.Description)
+	assert.Equal(t, "Insufficient access controls", nc.RootCause)
+	assert.Equal(t, "OPEN", nc.Status)
+}
+
+func TestNonconformity_Update(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("NC Owner").Create()
+	auditID := createAuditForNC(t, owner, "NC Update Test Audit")
+
+	// Create a nonconformity to update
+	createQuery := `
+		mutation CreateNonconformity($input: CreateNonconformityInput!) {
+			createNonconformity(input: $input) {
+				nonconformityEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createResult struct {
+		CreateNonconformity struct {
+			NonconformityEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"nonconformityEdge"`
+		} `json:"createNonconformity"`
+	}
+
+	err := owner.Execute(createQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"referenceId":    fmt.Sprintf("NC-UPDATE-%d", time.Now().UnixNano()),
+			"auditId":        auditID,
+			"rootCause":      "Original root cause",
+			"ownerId":        peopleID,
+			"status":         "OPEN",
+		},
+	}, &createResult)
+	require.NoError(t, err)
+	ncID := createResult.CreateNonconformity.NonconformityEdge.Node.ID
+
+	query := `
+		mutation UpdateNonconformity($input: UpdateNonconformityInput!) {
+			updateNonconformity(input: $input) {
+				nonconformity {
+					id
+					rootCause
+					correctiveAction
+					status
+				}
+			}
+		}
+	`
+
+	var result struct {
+		UpdateNonconformity struct {
+			Nonconformity struct {
+				ID               string `json:"id"`
+				RootCause        string `json:"rootCause"`
+				CorrectiveAction string `json:"correctiveAction"`
+				Status           string `json:"status"`
+			} `json:"nonconformity"`
+		} `json:"updateNonconformity"`
+	}
+
+	err = owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"id":               ncID,
+			"rootCause":        "Updated root cause",
+			"correctiveAction": "New corrective action",
+			"status":           "IN_PROGRESS",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	nc := result.UpdateNonconformity.Nonconformity
+	assert.Equal(t, ncID, nc.ID)
+	assert.Equal(t, "Updated root cause", nc.RootCause)
+	assert.Equal(t, "New corrective action", nc.CorrectiveAction)
+	assert.Equal(t, "IN_PROGRESS", nc.Status)
+}
+
+func TestNonconformity_Delete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("NC Owner").Create()
+	auditID := createAuditForNC(t, owner, "NC Delete Test Audit")
+
+	// Create a nonconformity to delete
+	createQuery := `
+		mutation CreateNonconformity($input: CreateNonconformityInput!) {
+			createNonconformity(input: $input) {
+				nonconformityEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createResult struct {
+		CreateNonconformity struct {
+			NonconformityEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"nonconformityEdge"`
+		} `json:"createNonconformity"`
+	}
+
+	err := owner.Execute(createQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"referenceId":    fmt.Sprintf("NC-DELETE-%d", time.Now().UnixNano()),
+			"auditId":        auditID,
+			"rootCause":      "Test root cause",
+			"ownerId":        peopleID,
+			"status":         "OPEN",
+		},
+	}, &createResult)
+	require.NoError(t, err)
+	ncID := createResult.CreateNonconformity.NonconformityEdge.Node.ID
+
+	deleteQuery := `
+		mutation DeleteNonconformity($input: DeleteNonconformityInput!) {
+			deleteNonconformity(input: $input) {
+				deletedNonconformityId
+			}
+		}
+	`
+
+	var deleteResult struct {
+		DeleteNonconformity struct {
+			DeletedNonconformityID string `json:"deletedNonconformityId"`
+		} `json:"deleteNonconformity"`
+	}
+
+	err = owner.Execute(deleteQuery, map[string]any{
+		"input": map[string]any{
+			"nonconformityId": ncID,
+		},
+	}, &deleteResult)
+	require.NoError(t, err)
+	assert.Equal(t, ncID, deleteResult.DeleteNonconformity.DeletedNonconformityID)
+}
+
+func TestNonconformity_List(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("NC Owner").Create()
+	auditID := createAuditForNC(t, owner, "NC List Test Audit")
+
+	// Create multiple nonconformities
+	createQuery := `
+		mutation CreateNonconformity($input: CreateNonconformityInput!) {
+			createNonconformity(input: $input) {
+				nonconformityEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	for i := 0; i < 3; i++ {
+		var createResult struct {
+			CreateNonconformity struct {
+				NonconformityEdge struct {
+					Node struct {
+						ID string `json:"id"`
+					} `json:"node"`
+				} `json:"nonconformityEdge"`
+			} `json:"createNonconformity"`
+		}
+
+		err := owner.Execute(createQuery, map[string]any{
+			"input": map[string]any{
+				"organizationId": owner.GetOrganizationID().String(),
+				"referenceId":    fmt.Sprintf("NC-LIST-%d-%d", i, time.Now().UnixNano()),
+				"auditId":        auditID,
+				"rootCause":      fmt.Sprintf("Root cause %d", i),
+				"ownerId":        peopleID,
+				"status":         "OPEN",
+			},
+		}, &createResult)
+		require.NoError(t, err)
+	}
+
+	query := `
+		query GetNonconformities($id: ID!) {
+			node(id: $id) {
+				... on Organization {
+					nonconformities(first: 10) {
+						edges {
+							node {
+								id
+								referenceId
+								status
+							}
+						}
+						totalCount
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		Node struct {
+			Nonconformities struct {
+				Edges []struct {
+					Node struct {
+						ID          string `json:"id"`
+						ReferenceID string `json:"referenceId"`
+						Status      string `json:"status"`
+					} `json:"node"`
+				} `json:"edges"`
+				TotalCount int `json:"totalCount"`
+			} `json:"nonconformities"`
+		} `json:"node"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"id": owner.GetOrganizationID().String(),
+	}, &result)
+	require.NoError(t, err)
+	assert.GreaterOrEqual(t, result.Node.Nonconformities.TotalCount, 3)
+}
+
+func TestNonconformity_StatusValues(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("NC Owner").Create()
+	auditID := createAuditForNC(t, owner, "NC Status Test Audit")
+
+	statuses := []string{"OPEN", "IN_PROGRESS", "CLOSED"}
+
+	for _, status := range statuses {
+		t.Run(status, func(t *testing.T) {
+			query := `
+				mutation CreateNonconformity($input: CreateNonconformityInput!) {
+					createNonconformity(input: $input) {
+						nonconformityEdge {
+							node {
+								id
+								status
+							}
+						}
+					}
+				}
+			`
+
+			var result struct {
+				CreateNonconformity struct {
+					NonconformityEdge struct {
+						Node struct {
+							ID     string `json:"id"`
+							Status string `json:"status"`
+						} `json:"node"`
+					} `json:"nonconformityEdge"`
+				} `json:"createNonconformity"`
+			}
+
+			err := owner.Execute(query, map[string]any{
+				"input": map[string]any{
+					"organizationId": owner.GetOrganizationID().String(),
+					"referenceId":    fmt.Sprintf("NC-STATUS-%s-%d", status, time.Now().UnixNano()),
+					"auditId":        auditID,
+					"rootCause":      "Test root cause",
+					"ownerId":        peopleID,
+					"status":         status,
+				},
+			}, &result)
+			require.NoError(t, err)
+			assert.Equal(t, status, result.CreateNonconformity.NonconformityEdge.Node.Status)
+		})
+	}
+}

e2e/console/obligation_test.go

@@ -0,0 +1,352 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/factory"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+func TestObligation_Create(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("Obligation Owner").Create()
+
+	query := `
+		mutation CreateObligation($input: CreateObligationInput!) {
+			createObligation(input: $input) {
+				obligationEdge {
+					node {
+						id
+						area
+						source
+						requirement
+						regulator
+						status
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		CreateObligation struct {
+			ObligationEdge struct {
+				Node struct {
+					ID          string `json:"id"`
+					Area        string `json:"area"`
+					Source      string `json:"source"`
+					Requirement string `json:"requirement"`
+					Regulator   string `json:"regulator"`
+					Status      string `json:"status"`
+				} `json:"node"`
+			} `json:"obligationEdge"`
+		} `json:"createObligation"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"area":           "Data Protection",
+			"source":         "GDPR Article 5",
+			"requirement":    "Data must be processed lawfully",
+			"regulator":      "ICO",
+			"ownerId":        peopleID,
+			"status":         "NON_COMPLIANT",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.NotEmpty(t, result.CreateObligation.ObligationEdge.Node.ID)
+	assert.Equal(t, "Data Protection", result.CreateObligation.ObligationEdge.Node.Area)
+	assert.Equal(t, "GDPR Article 5", result.CreateObligation.ObligationEdge.Node.Source)
+	assert.Equal(t, "Data must be processed lawfully", result.CreateObligation.ObligationEdge.Node.Requirement)
+	assert.Equal(t, "ICO", result.CreateObligation.ObligationEdge.Node.Regulator)
+	assert.Equal(t, "NON_COMPLIANT", result.CreateObligation.ObligationEdge.Node.Status)
+}
+
+func TestObligation_Update(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("Obligation Owner").Create()
+
+	// Create an obligation to update
+	createQuery := `
+		mutation CreateObligation($input: CreateObligationInput!) {
+			createObligation(input: $input) {
+				obligationEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createResult struct {
+		CreateObligation struct {
+			ObligationEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"obligationEdge"`
+		} `json:"createObligation"`
+	}
+
+	err := owner.Execute(createQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"area":           "Original Area",
+			"ownerId":        peopleID,
+			"status":         "NON_COMPLIANT",
+		},
+	}, &createResult)
+	require.NoError(t, err)
+
+	obligationID := createResult.CreateObligation.ObligationEdge.Node.ID
+
+	query := `
+		mutation UpdateObligation($input: UpdateObligationInput!) {
+			updateObligation(input: $input) {
+				obligation {
+					id
+					area
+					status
+				}
+			}
+		}
+	`
+
+	var result struct {
+		UpdateObligation struct {
+			Obligation struct {
+				ID     string `json:"id"`
+				Area   string `json:"area"`
+				Status string `json:"status"`
+			} `json:"obligation"`
+		} `json:"updateObligation"`
+	}
+
+	err = owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"id":     obligationID,
+			"area":   "Updated Area",
+			"status": "COMPLIANT",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, obligationID, result.UpdateObligation.Obligation.ID)
+	assert.Equal(t, "Updated Area", result.UpdateObligation.Obligation.Area)
+	assert.Equal(t, "COMPLIANT", result.UpdateObligation.Obligation.Status)
+}
+
+func TestObligation_Delete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("Obligation Owner").Create()
+
+	// Create an obligation to delete
+	createQuery := `
+		mutation CreateObligation($input: CreateObligationInput!) {
+			createObligation(input: $input) {
+				obligationEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createResult struct {
+		CreateObligation struct {
+			ObligationEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"obligationEdge"`
+		} `json:"createObligation"`
+	}
+
+	err := owner.Execute(createQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"area":           "Obligation to Delete",
+			"ownerId":        peopleID,
+			"status":         "NON_COMPLIANT",
+		},
+	}, &createResult)
+	require.NoError(t, err)
+
+	obligationID := createResult.CreateObligation.ObligationEdge.Node.ID
+
+	deleteQuery := `
+		mutation DeleteObligation($input: DeleteObligationInput!) {
+			deleteObligation(input: $input) {
+				deletedObligationId
+			}
+		}
+	`
+
+	var deleteResult struct {
+		DeleteObligation struct {
+			DeletedObligationID string `json:"deletedObligationId"`
+		} `json:"deleteObligation"`
+	}
+
+	err = owner.Execute(deleteQuery, map[string]any{
+		"input": map[string]any{
+			"obligationId": obligationID,
+		},
+	}, &deleteResult)
+	require.NoError(t, err)
+	assert.Equal(t, obligationID, deleteResult.DeleteObligation.DeletedObligationID)
+}
+
+func TestObligation_List(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("Obligation Owner").Create()
+
+	// Create multiple obligations
+	areas := []string{"Area A", "Area B", "Area C"}
+	for _, area := range areas {
+		query := `
+			mutation CreateObligation($input: CreateObligationInput!) {
+				createObligation(input: $input) {
+					obligationEdge {
+						node {
+							id
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			CreateObligation struct {
+				ObligationEdge struct {
+					Node struct {
+						ID string `json:"id"`
+					} `json:"node"`
+				} `json:"obligationEdge"`
+			} `json:"createObligation"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"organizationId": owner.GetOrganizationID().String(),
+				"area":           area,
+				"ownerId":        peopleID,
+				"status":         "NON_COMPLIANT",
+			},
+		}, &result)
+		require.NoError(t, err)
+	}
+
+	query := `
+		query GetObligations($id: ID!) {
+			node(id: $id) {
+				... on Organization {
+					obligations(first: 10) {
+						edges {
+							node {
+								id
+								area
+								status
+							}
+						}
+						totalCount
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		Node struct {
+			Obligations struct {
+				Edges []struct {
+					Node struct {
+						ID     string `json:"id"`
+						Area   string `json:"area"`
+						Status string `json:"status"`
+					} `json:"node"`
+				} `json:"edges"`
+				TotalCount int `json:"totalCount"`
+			} `json:"obligations"`
+		} `json:"node"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"id": owner.GetOrganizationID().String(),
+	}, &result)
+	require.NoError(t, err)
+
+	assert.GreaterOrEqual(t, result.Node.Obligations.TotalCount, 3)
+}
+
+func TestObligation_StatusValues(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("Obligation Owner").Create()
+
+	statuses := []string{"NON_COMPLIANT", "PARTIALLY_COMPLIANT", "COMPLIANT"}
+
+	for _, status := range statuses {
+		t.Run(status, func(t *testing.T) {
+			query := `
+				mutation CreateObligation($input: CreateObligationInput!) {
+					createObligation(input: $input) {
+						obligationEdge {
+							node {
+								id
+								status
+							}
+						}
+					}
+				}
+			`
+
+			var result struct {
+				CreateObligation struct {
+					ObligationEdge struct {
+						Node struct {
+							ID     string `json:"id"`
+							Status string `json:"status"`
+						} `json:"node"`
+					} `json:"obligationEdge"`
+				} `json:"createObligation"`
+			}
+
+			err := owner.Execute(query, map[string]any{
+				"input": map[string]any{
+					"organizationId": owner.GetOrganizationID().String(),
+					"area":           "Status Test " + status,
+					"ownerId":        peopleID,
+					"status":         status,
+				},
+			}, &result)
+			require.NoError(t, err)
+
+			assert.Equal(t, status, result.CreateObligation.ObligationEdge.Node.Status)
+		})
+	}
+}

e2e/console/organization_test.go

@@ -0,0 +1,186 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+func TestOrganization_Update(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	t.Run("update name and description", func(t *testing.T) {
+		newName := fmt.Sprintf("Updated Org %d", time.Now().UnixNano())
+
+		query := `
+			mutation UpdateOrganization($input: UpdateOrganizationInput!) {
+				updateOrganization(input: $input) {
+					organization {
+						id
+						name
+						description
+					}
+				}
+			}
+		`
+
+		var result struct {
+			UpdateOrganization struct {
+				Organization struct {
+					ID          string `json:"id"`
+					Name        string `json:"name"`
+					Description string `json:"description"`
+				} `json:"organization"`
+			} `json:"updateOrganization"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"organizationId": owner.GetOrganizationID().String(),
+				"name":           newName,
+				"description":    "Updated organization description",
+			},
+		}, &result)
+		require.NoError(t, err)
+
+		assert.Equal(t, owner.GetOrganizationID().String(), result.UpdateOrganization.Organization.ID)
+		assert.Equal(t, newName, result.UpdateOrganization.Organization.Name)
+		assert.Equal(t, "Updated organization description", result.UpdateOrganization.Organization.Description)
+	})
+
+	t.Run("update website and email", func(t *testing.T) {
+		query := `
+			mutation UpdateOrganization($input: UpdateOrganizationInput!) {
+				updateOrganization(input: $input) {
+					organization {
+						id
+						websiteUrl
+						email
+					}
+				}
+			}
+		`
+
+		var result struct {
+			UpdateOrganization struct {
+				Organization struct {
+					ID         string `json:"id"`
+					WebsiteUrl string `json:"websiteUrl"`
+					Email      string `json:"email"`
+				} `json:"organization"`
+			} `json:"updateOrganization"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"organizationId": owner.GetOrganizationID().String(),
+				"websiteUrl":     "https://example.com",
+				"email":          "contact@example.com",
+			},
+		}, &result)
+		require.NoError(t, err)
+
+		assert.Equal(t, "https://example.com", result.UpdateOrganization.Organization.WebsiteUrl)
+		assert.Equal(t, "contact@example.com", result.UpdateOrganization.Organization.Email)
+	})
+
+	t.Run("update headquarter address", func(t *testing.T) {
+		query := `
+			mutation UpdateOrganization($input: UpdateOrganizationInput!) {
+				updateOrganization(input: $input) {
+					organization {
+						id
+						headquarterAddress
+					}
+				}
+			}
+		`
+
+		var result struct {
+			UpdateOrganization struct {
+				Organization struct {
+					ID                 string `json:"id"`
+					HeadquarterAddress string `json:"headquarterAddress"`
+				} `json:"organization"`
+			} `json:"updateOrganization"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"organizationId":     owner.GetOrganizationID().String(),
+				"headquarterAddress": "123 Main St, Suite 100, San Francisco, CA 94102",
+			},
+		}, &result)
+		require.NoError(t, err)
+
+		assert.Equal(t, "123 Main St, Suite 100, San Francisco, CA 94102", result.UpdateOrganization.Organization.HeadquarterAddress)
+	})
+}
+
+func TestOrganization_UpdateContext(t *testing.T) {
+	t.Skip("updateOrganizationContext mutation not implemented")
+}
+
+func TestOrganization_Get(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	query := `
+		query GetOrganization($id: ID!) {
+			node(id: $id) {
+				... on Organization {
+					id
+					name
+					description
+					websiteUrl
+					email
+					headquarterAddress
+					context {
+						summary
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		Node struct {
+			ID                 string `json:"id"`
+			Name               string `json:"name"`
+			Description        string `json:"description"`
+			WebsiteUrl         string `json:"websiteUrl"`
+			Email              string `json:"email"`
+			HeadquarterAddress string `json:"headquarterAddress"`
+			Context            struct {
+				Summary string `json:"summary"`
+			} `json:"context"`
+		} `json:"node"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"id": owner.GetOrganizationID().String(),
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, owner.GetOrganizationID().String(), result.Node.ID)
+	assert.NotEmpty(t, result.Node.Name)
+}

e2e/console/people_test.go

@@ -0,0 +1,670 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/factory"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+func TestPeople_Create(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	t.Run("with full details", func(t *testing.T) {
+		query := `
+			mutation CreatePeople($input: CreatePeopleInput!) {
+				createPeople(input: $input) {
+					peopleEdge {
+						node {
+							id
+							fullName
+							kind
+							position
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			CreatePeople struct {
+				PeopleEdge struct {
+					Node struct {
+						ID       string  `json:"id"`
+						FullName string  `json:"fullName"`
+						Kind     string  `json:"kind"`
+						Position *string `json:"position"`
+					} `json:"node"`
+				} `json:"peopleEdge"`
+			} `json:"createPeople"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"organizationId":      owner.GetOrganizationID().String(),
+				"fullName":            "John Doe",
+				"primaryEmailAddress": "john.doe@example.com",
+				"kind":                "EMPLOYEE",
+				"position":            "Software Engineer",
+			},
+		}, &result)
+		require.NoError(t, err)
+
+		people := result.CreatePeople.PeopleEdge.Node
+		assert.NotEmpty(t, people.ID)
+		assert.Equal(t, "John Doe", people.FullName)
+		assert.Equal(t, "EMPLOYEE", people.Kind)
+		assert.Equal(t, "Software Engineer", *people.Position)
+	})
+
+	t.Run("with different kinds", func(t *testing.T) {
+		kinds := []struct {
+			name string
+			kind string
+		}{
+			{"Employee", "EMPLOYEE"},
+			{"Contractor", "CONTRACTOR"},
+			{"Service Account", "SERVICE_ACCOUNT"},
+		}
+
+		for _, tt := range kinds {
+			t.Run(tt.name, func(t *testing.T) {
+				peopleID := factory.CreatePeople(owner, factory.Attrs{
+					"fullName": "Person " + tt.kind,
+					"kind":     tt.kind,
+				})
+
+				query := `
+					query GetPeople($id: ID!) {
+						node(id: $id) {
+							... on People {
+								id
+								kind
+							}
+						}
+					}
+				`
+
+				var result struct {
+					Node struct {
+						ID   string `json:"id"`
+						Kind string `json:"kind"`
+					} `json:"node"`
+				}
+
+				err := owner.Execute(query, map[string]any{"id": peopleID}, &result)
+				require.NoError(t, err)
+				assert.Equal(t, tt.kind, result.Node.Kind)
+			})
+		}
+	})
+
+	t.Run("with additional emails", func(t *testing.T) {
+		t.Skip("additionalEmailAddresses feature not fully implemented")
+	})
+}
+
+func TestPeople_Update(t *testing.T) {
+	t.Skip("updatePeople has server bug with additional_email_addresses null constraint")
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.CreatePeople(owner, factory.Attrs{
+		"fullName": "Person to Update",
+	})
+
+	query := `
+		mutation UpdatePeople($input: UpdatePeopleInput!) {
+			updatePeople(input: $input) {
+				people {
+					id
+					fullName
+				}
+			}
+		}
+	`
+
+	var result struct {
+		UpdatePeople struct {
+			People struct {
+				ID       string `json:"id"`
+				FullName string `json:"fullName"`
+			} `json:"people"`
+		} `json:"updatePeople"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"id":       peopleID,
+			"fullName": "Updated Name",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, peopleID, result.UpdatePeople.People.ID)
+	assert.Equal(t, "Updated Name", result.UpdatePeople.People.FullName)
+}
+
+func TestPeople_Delete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.CreatePeople(owner, factory.Attrs{
+		"fullName": "Person to Delete",
+	})
+
+	query := `
+		mutation DeletePeople($input: DeletePeopleInput!) {
+			deletePeople(input: $input) {
+				deletedPeopleId
+			}
+		}
+	`
+
+	var result struct {
+		DeletePeople struct {
+			DeletedPeopleID string `json:"deletedPeopleId"`
+		} `json:"deletePeople"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"peopleId": peopleID,
+		},
+	}, &result)
+	require.NoError(t, err)
+	assert.Equal(t, peopleID, result.DeletePeople.DeletedPeopleID)
+}
+
+func TestPeople_List(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create multiple people
+	peopleNames := []string{"Person A", "Person B", "Person C"}
+	for _, name := range peopleNames {
+		factory.CreatePeople(owner, factory.Attrs{"fullName": name})
+	}
+
+	query := `
+		query ListPeoples($orgId: ID!) {
+			node(id: $orgId) {
+				... on Organization {
+					peoples(first: 10) {
+						edges {
+							node {
+								id
+								fullName
+							}
+						}
+						totalCount
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		Node struct {
+			Peoples struct {
+				Edges []struct {
+					Node struct {
+						ID       string `json:"id"`
+						FullName string `json:"fullName"`
+					} `json:"node"`
+				} `json:"edges"`
+				TotalCount int `json:"totalCount"`
+			} `json:"peoples"`
+		} `json:"node"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"orgId": owner.GetOrganizationID().String(),
+	}, &result)
+	require.NoError(t, err)
+	assert.GreaterOrEqual(t, result.Node.Peoples.TotalCount, 3)
+}
+
+func TestPeople_RequiredFields(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	tests := []struct {
+		name              string
+		input             map[string]any
+		skipOrganization  bool
+		wantErrorContains string
+	}{
+		{
+			name: "missing organizationId",
+			input: map[string]any{
+				"fullName":            "Test Person",
+				"primaryEmailAddress": "test@example.com",
+				"kind":                "EMPLOYEE",
+			},
+			skipOrganization:  true,
+			wantErrorContains: "organizationId",
+		},
+		{
+			name: "missing fullName",
+			input: map[string]any{
+				"primaryEmailAddress": "test@example.com",
+				"kind":                "EMPLOYEE",
+			},
+			wantErrorContains: "fullName",
+		},
+		{
+			name: "missing primaryEmailAddress",
+			input: map[string]any{
+				"fullName": "Test Person",
+				"kind":     "EMPLOYEE",
+			},
+			wantErrorContains: "primaryEmailAddress",
+		},
+		{
+			name: "missing kind",
+			input: map[string]any{
+				"fullName":            "Test Person",
+				"primaryEmailAddress": "test@example.com",
+			},
+			wantErrorContains: "kind",
+		},
+		{
+			name: "empty fullName",
+			input: map[string]any{
+				"fullName":            "",
+				"primaryEmailAddress": "test@example.com",
+				"kind":                "EMPLOYEE",
+			},
+			wantErrorContains: "full_name",
+		},
+		{
+			name: "invalid kind enum",
+			input: map[string]any{
+				"fullName":            "Test Person",
+				"primaryEmailAddress": "test@example.com",
+				"kind":                "INVALID_KIND",
+			},
+			wantErrorContains: "kind",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			query := `
+				mutation CreatePeople($input: CreatePeopleInput!) {
+					createPeople(input: $input) {
+						peopleEdge {
+							node {
+								id
+							}
+						}
+					}
+				}
+			`
+
+			input := make(map[string]any)
+			if !tt.skipOrganization {
+				input["organizationId"] = owner.GetOrganizationID().String()
+			}
+			for k, v := range tt.input {
+				input[k] = v
+			}
+
+			_, err := owner.Do(query, map[string]any{"input": input})
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), tt.wantErrorContains)
+		})
+	}
+}
+
+func TestPeople_KindEnum(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	kinds := []string{
+		"EMPLOYEE",
+		"CONTRACTOR",
+	}
+
+	for _, kind := range kinds {
+		t.Run("create with kind "+kind, func(t *testing.T) {
+			peopleID := factory.NewPeople(owner).
+				WithFullName("Kind Test " + kind).
+				WithKind(kind).
+				Create()
+
+			query := `
+				query($id: ID!) {
+					node(id: $id) {
+						... on People {
+							id
+							kind
+						}
+					}
+				}
+			`
+
+			var result struct {
+				Node struct {
+					ID   string `json:"id"`
+					Kind string `json:"kind"`
+				} `json:"node"`
+			}
+
+			err := owner.Execute(query, map[string]any{"id": peopleID}, &result)
+			require.NoError(t, err)
+			assert.Equal(t, kind, result.Node.Kind)
+		})
+	}
+}
+
+func TestPeople_SubResolvers(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	peopleID := factory.NewPeople(owner).
+		WithFullName("SubResolver Test Person").
+		Create()
+
+	t.Run("people node query", func(t *testing.T) {
+		query := `
+			query GetPeople($id: ID!) {
+				node(id: $id) {
+					... on People {
+						id
+						fullName
+						primaryEmailAddress
+						kind
+					}
+				}
+			}
+		`
+
+		var result struct {
+			Node struct {
+				ID                  string `json:"id"`
+				FullName            string `json:"fullName"`
+				PrimaryEmailAddress string `json:"primaryEmailAddress"`
+				Kind                string `json:"kind"`
+			} `json:"node"`
+		}
+
+		err := owner.Execute(query, map[string]any{"id": peopleID}, &result)
+		require.NoError(t, err)
+		assert.Equal(t, peopleID, result.Node.ID)
+		assert.Equal(t, "SubResolver Test Person", result.Node.FullName)
+	})
+
+}
+
+func TestPeople_InvalidID(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	t.Run("update with invalid ID", func(t *testing.T) {
+		query := `
+			mutation UpdatePeople($input: UpdatePeopleInput!) {
+				updatePeople(input: $input) {
+					people {
+						id
+					}
+				}
+			}
+		`
+
+		_, err := owner.Do(query, map[string]any{
+			"input": map[string]any{
+				"id":       "invalid-id-format",
+				"fullName": "Test",
+			},
+		})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "base64")
+	})
+
+	t.Run("delete with invalid ID", func(t *testing.T) {
+		query := `
+			mutation DeletePeople($input: DeletePeopleInput!) {
+				deletePeople(input: $input) {
+					deletedPeopleId
+				}
+			}
+		`
+
+		_, err := owner.Do(query, map[string]any{
+			"input": map[string]any{
+				"peopleId": "invalid-id-format",
+			},
+		})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "base64")
+	})
+
+	t.Run("query with non-existent ID", func(t *testing.T) {
+		query := `
+			query GetPeople($id: ID!) {
+				node(id: $id) {
+					... on People {
+						id
+						fullName
+					}
+				}
+			}
+		`
+
+		err := owner.ExecuteShouldFail(query, map[string]any{
+			"id": "V0wtM0tMNmJBQ1lBQUFBQUFackhLSTJfbXJJRUFZVXo",
+		})
+		require.Error(t, err, "Non-existent ID should return error")
+	})
+}
+
+func TestPeople_OmittablePosition(t *testing.T) {
+	t.Skip("Skipped: server returns internal error when updating position field")
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	peopleID := factory.NewPeople(owner).
+		WithFullName("Position Test Person").
+		Create()
+
+	t.Run("set position", func(t *testing.T) {
+		query := `
+			mutation UpdatePeople($input: UpdatePeopleInput!) {
+				updatePeople(input: $input) {
+					people {
+						id
+						position
+					}
+				}
+			}
+		`
+
+		var result struct {
+			UpdatePeople struct {
+				People struct {
+					ID       string  `json:"id"`
+					Position *string `json:"position"`
+				} `json:"people"`
+			} `json:"updatePeople"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"id":       peopleID,
+				"position": "Software Engineer",
+			},
+		}, &result)
+		require.NoError(t, err)
+		require.NotNil(t, result.UpdatePeople.People.Position)
+		assert.Equal(t, "Software Engineer", *result.UpdatePeople.People.Position)
+	})
+
+	t.Run("clear position with null", func(t *testing.T) {
+		query := `
+			mutation UpdatePeople($input: UpdatePeopleInput!) {
+				updatePeople(input: $input) {
+					people {
+						id
+						position
+					}
+				}
+			}
+		`
+
+		var result struct {
+			UpdatePeople struct {
+				People struct {
+					ID       string  `json:"id"`
+					Position *string `json:"position"`
+				} `json:"people"`
+			} `json:"updatePeople"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"id":       peopleID,
+				"position": nil,
+			},
+		}, &result)
+		require.NoError(t, err)
+		assert.Nil(t, result.UpdatePeople.People.Position)
+	})
+
+	t.Run("update without position preserves value", func(t *testing.T) {
+		// First set a position
+		setQuery := `
+			mutation UpdatePeople($input: UpdatePeopleInput!) {
+				updatePeople(input: $input) {
+					people {
+						id
+					}
+				}
+			}
+		`
+
+		err := owner.Execute(setQuery, map[string]any{
+			"input": map[string]any{
+				"id":       peopleID,
+				"position": "Senior Engineer",
+			},
+		}, nil)
+		require.NoError(t, err)
+
+		// Update only fullName
+		query := `
+			mutation UpdatePeople($input: UpdatePeopleInput!) {
+				updatePeople(input: $input) {
+					people {
+						id
+						fullName
+						position
+					}
+				}
+			}
+		`
+
+		var result struct {
+			UpdatePeople struct {
+				People struct {
+					ID       string  `json:"id"`
+					FullName string  `json:"fullName"`
+					Position *string `json:"position"`
+				} `json:"people"`
+			} `json:"updatePeople"`
+		}
+
+		err = owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"id":       peopleID,
+				"fullName": "Updated Name",
+			},
+		}, &result)
+		require.NoError(t, err)
+		require.NotNil(t, result.UpdatePeople.People.Position)
+		assert.Equal(t, "Senior Engineer", *result.UpdatePeople.People.Position)
+	})
+}
+
+func TestPeople_TenantIsolation(t *testing.T) {
+	t.Parallel()
+
+	org1Owner := testutil.NewClient(t, testutil.RoleOwner)
+	org2Owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	peopleID := factory.NewPeople(org1Owner).WithFullName("Org1 Person").Create()
+
+	t.Run("cannot read people from another organization", func(t *testing.T) {
+		query := `
+			query($id: ID!) {
+				node(id: $id) {
+					... on People {
+						id
+						fullName
+					}
+				}
+			}
+		`
+
+		var result struct {
+			Node *struct {
+				ID       string `json:"id"`
+				FullName string `json:"fullName"`
+			} `json:"node"`
+		}
+
+		err := org2Owner.Execute(query, map[string]any{"id": peopleID}, &result)
+		testutil.AssertNodeNotAccessible(t, err, result.Node == nil, "people")
+	})
+
+	t.Run("cannot update people from another organization", func(t *testing.T) {
+		query := `
+			mutation UpdatePeople($input: UpdatePeopleInput!) {
+				updatePeople(input: $input) {
+					people { id }
+				}
+			}
+		`
+
+		_, err := org2Owner.Do(query, map[string]any{
+			"input": map[string]any{
+				"id":       peopleID,
+				"fullName": "Hijacked Person",
+			},
+		})
+		require.Error(t, err, "Should not be able to update people from another org")
+	})
+
+	t.Run("cannot delete people from another organization", func(t *testing.T) {
+		query := `
+			mutation DeletePeople($input: DeletePeopleInput!) {
+				deletePeople(input: $input) {
+					deletedPeopleId
+				}
+			}
+		`
+
+		_, err := org2Owner.Do(query, map[string]any{
+			"input": map[string]any{
+				"peopleId": peopleID,
+			},
+		})
+		require.Error(t, err, "Should not be able to delete people from another org")
+	})
+}

e2e/console/snapshot_test.go

@@ -0,0 +1,261 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+func TestSnapshot_Create(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	query := `
+		mutation CreateSnapshot($input: CreateSnapshotInput!) {
+			createSnapshot(input: $input) {
+				snapshotEdge {
+					node {
+						id
+						name
+						description
+						type
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		CreateSnapshot struct {
+			SnapshotEdge struct {
+				Node struct {
+					ID          string `json:"id"`
+					Name        string `json:"name"`
+					Description string `json:"description"`
+					Type        string `json:"type"`
+				} `json:"node"`
+			} `json:"snapshotEdge"`
+		} `json:"createSnapshot"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           "Q4 2024 Risk Snapshot",
+			"description":    "Quarterly risk assessment snapshot",
+			"type":           "RISKS",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	snapshot := result.CreateSnapshot.SnapshotEdge.Node
+	assert.NotEmpty(t, snapshot.ID)
+	assert.Equal(t, "Q4 2024 Risk Snapshot", snapshot.Name)
+	assert.Equal(t, "Quarterly risk assessment snapshot", snapshot.Description)
+	assert.Equal(t, "RISKS", snapshot.Type)
+}
+
+func TestSnapshot_Delete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a snapshot to delete
+	createQuery := `
+		mutation CreateSnapshot($input: CreateSnapshotInput!) {
+			createSnapshot(input: $input) {
+				snapshotEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createResult struct {
+		CreateSnapshot struct {
+			SnapshotEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"snapshotEdge"`
+		} `json:"createSnapshot"`
+	}
+
+	err := owner.Execute(createQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           fmt.Sprintf("Snapshot to Delete %d", time.Now().UnixNano()),
+			"type":           "ASSETS",
+		},
+	}, &createResult)
+	require.NoError(t, err)
+
+	snapshotID := createResult.CreateSnapshot.SnapshotEdge.Node.ID
+
+	deleteQuery := `
+		mutation DeleteSnapshot($input: DeleteSnapshotInput!) {
+			deleteSnapshot(input: $input) {
+				deletedSnapshotId
+			}
+		}
+	`
+
+	var deleteResult struct {
+		DeleteSnapshot struct {
+			DeletedSnapshotID string `json:"deletedSnapshotId"`
+		} `json:"deleteSnapshot"`
+	}
+
+	err = owner.Execute(deleteQuery, map[string]any{
+		"input": map[string]any{
+			"snapshotId": snapshotID,
+		},
+	}, &deleteResult)
+
+	require.NoError(t, err)
+	assert.Equal(t, snapshotID, deleteResult.DeleteSnapshot.DeletedSnapshotID)
+}
+
+func TestSnapshot_List(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create multiple snapshots
+	snapshotTypes := []string{"RISKS", "VENDORS", "ASSETS", "DATA"}
+	for i, snapshotType := range snapshotTypes {
+		query := `
+			mutation CreateSnapshot($input: CreateSnapshotInput!) {
+				createSnapshot(input: $input) {
+					snapshotEdge {
+						node {
+							id
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			CreateSnapshot struct {
+				SnapshotEdge struct {
+					Node struct {
+						ID string `json:"id"`
+					} `json:"node"`
+				} `json:"snapshotEdge"`
+			} `json:"createSnapshot"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"organizationId": owner.GetOrganizationID().String(),
+				"name":           fmt.Sprintf("Snapshot %d %d", i, time.Now().UnixNano()),
+				"type":           snapshotType,
+			},
+		}, &result)
+		require.NoError(t, err)
+	}
+
+	query := `
+		query GetSnapshots($id: ID!) {
+			node(id: $id) {
+				... on Organization {
+					snapshots(first: 10) {
+						edges {
+							node {
+								id
+								name
+								type
+							}
+						}
+						totalCount
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		Node struct {
+			Snapshots struct {
+				Edges []struct {
+					Node struct {
+						ID   string `json:"id"`
+						Name string `json:"name"`
+						Type string `json:"type"`
+					} `json:"node"`
+				} `json:"edges"`
+				TotalCount int `json:"totalCount"`
+			} `json:"snapshots"`
+		} `json:"node"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"id": owner.GetOrganizationID().String(),
+	}, &result)
+	require.NoError(t, err)
+	assert.GreaterOrEqual(t, result.Node.Snapshots.TotalCount, 4)
+}
+
+func TestSnapshot_Types(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	snapshotTypes := []string{"RISKS", "VENDORS", "ASSETS", "DATA"}
+
+	for _, snapshotType := range snapshotTypes {
+		t.Run(snapshotType, func(t *testing.T) {
+			query := `
+				mutation CreateSnapshot($input: CreateSnapshotInput!) {
+					createSnapshot(input: $input) {
+						snapshotEdge {
+							node {
+								id
+								type
+							}
+						}
+					}
+				}
+			`
+
+			var result struct {
+				CreateSnapshot struct {
+					SnapshotEdge struct {
+						Node struct {
+							ID   string `json:"id"`
+							Type string `json:"type"`
+						} `json:"node"`
+					} `json:"snapshotEdge"`
+				} `json:"createSnapshot"`
+			}
+
+			err := owner.Execute(query, map[string]any{
+				"input": map[string]any{
+					"organizationId": owner.GetOrganizationID().String(),
+					"name":           fmt.Sprintf("Snapshot Type %s %d", snapshotType, time.Now().UnixNano()),
+					"type":           snapshotType,
+				},
+			}, &result)
+			require.NoError(t, err)
+			assert.Equal(t, snapshotType, result.CreateSnapshot.SnapshotEdge.Node.Type)
+		})
+	}
+}

e2e/console/task_assignment_test.go

@@ -0,0 +1,135 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/factory"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+func TestTask_Assign(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create measure and task
+	measureID := factory.NewMeasure(owner).Create()
+	taskID := factory.NewTask(owner, measureID).Create()
+	peopleID := factory.NewPeople(owner).WithFullName("Task Assignee").Create()
+
+	query := `
+		mutation AssignTask($input: AssignTaskInput!) {
+			assignTask(input: $input) {
+				task {
+					id
+					assignedTo {
+						id
+						fullName
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		AssignTask struct {
+			Task struct {
+				ID         string `json:"id"`
+				AssignedTo struct {
+					ID       string `json:"id"`
+					FullName string `json:"fullName"`
+				} `json:"assignedTo"`
+			} `json:"task"`
+		} `json:"assignTask"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"taskId":       taskID,
+			"assignedToId": peopleID,
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, taskID, result.AssignTask.Task.ID)
+	assert.Equal(t, peopleID, result.AssignTask.Task.AssignedTo.ID)
+	assert.Equal(t, "Task Assignee", result.AssignTask.Task.AssignedTo.FullName)
+}
+
+func TestTask_Unassign(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create measure, task, people and assign
+	measureID := factory.NewMeasure(owner).Create()
+	taskID := factory.NewTask(owner, measureID).Create()
+	peopleID := factory.NewPeople(owner).WithFullName("Person to Unassign").Create()
+
+	// First assign the task
+	assignQuery := `
+		mutation AssignTask($input: AssignTaskInput!) {
+			assignTask(input: $input) {
+				task {
+					id
+				}
+			}
+		}
+	`
+
+	_, err := owner.Do(assignQuery, map[string]any{
+		"input": map[string]any{
+			"taskId":       taskID,
+			"assignedToId": peopleID,
+		},
+	})
+	require.NoError(t, err)
+
+	query := `
+		mutation UnassignTask($input: UnassignTaskInput!) {
+			unassignTask(input: $input) {
+				task {
+					id
+					assignedTo {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		UnassignTask struct {
+			Task struct {
+				ID         string `json:"id"`
+				AssignedTo *struct {
+					ID string `json:"id"`
+				} `json:"assignedTo"`
+			} `json:"task"`
+		} `json:"unassignTask"`
+	}
+
+	err = owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"taskId": taskID,
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, taskID, result.UnassignTask.Task.ID)
+	assert.Nil(t, result.UnassignTask.Task.AssignedTo)
+}

e2e/console/task_test.go

@@ -0,0 +1,864 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/factory"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+func TestTask_Create(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	measureID := factory.NewMeasure(owner).WithName("Measure for Task Tests").Create()
+
+	query := `
+		mutation CreateTask($input: CreateTaskInput!) {
+			createTask(input: $input) {
+				taskEdge {
+					node {
+						id
+						name
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		CreateTask struct {
+			TaskEdge struct {
+				Node struct {
+					ID   string `json:"id"`
+					Name string `json:"name"`
+				} `json:"node"`
+			} `json:"taskEdge"`
+		} `json:"createTask"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"measureId":      measureID,
+			"name":           "Owner Task",
+			"description":    "Created by owner",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	task := result.CreateTask.TaskEdge.Node
+	assert.NotEmpty(t, task.ID)
+	assert.Equal(t, "Owner Task", task.Name)
+}
+
+func TestTask_Update(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	measureID := factory.NewMeasure(owner).Create()
+	taskID := factory.NewTask(owner, measureID).
+		WithName("Task to Update").
+		WithDescription("Original description").
+		Create()
+
+	query := `
+		mutation UpdateTask($input: UpdateTaskInput!) {
+			updateTask(input: $input) {
+				task {
+					id
+					name
+				}
+			}
+		}
+	`
+
+	var result struct {
+		UpdateTask struct {
+			Task struct {
+				ID   string `json:"id"`
+				Name string `json:"name"`
+			} `json:"task"`
+		} `json:"updateTask"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"taskId":      taskID,
+			"name":        "Updated by Owner",
+			"description": "Owner updated this",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, taskID, result.UpdateTask.Task.ID)
+	assert.Equal(t, "Updated by Owner", result.UpdateTask.Task.Name)
+}
+
+func TestTask_Delete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	measureID := factory.NewMeasure(owner).Create()
+	taskID := factory.NewTask(owner, measureID).
+		WithName("Task to Delete").
+		Create()
+
+	query := `
+		mutation DeleteTask($input: DeleteTaskInput!) {
+			deleteTask(input: $input) {
+				deletedTaskId
+			}
+		}
+	`
+
+	var result struct {
+		DeleteTask struct {
+			DeletedTaskID string `json:"deletedTaskId"`
+		} `json:"deleteTask"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"taskId": taskID,
+		},
+	}, &result)
+	require.NoError(t, err)
+	assert.Equal(t, taskID, result.DeleteTask.DeletedTaskID)
+}
+
+func TestTask_ListByMeasure(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	measureID := factory.NewMeasure(owner).Create()
+
+	// Create multiple tasks
+	taskNames := []string{"Task A", "Task B", "Task C"}
+	for _, name := range taskNames {
+		factory.NewTask(owner, measureID).WithName(name).Create()
+	}
+
+	query := `
+		query GetMeasureTasks($id: ID!) {
+			node(id: $id) {
+				... on Measure {
+					id
+					tasks(first: 10) {
+						edges {
+							node {
+								id
+								name
+							}
+						}
+						totalCount
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		Node struct {
+			ID    string `json:"id"`
+			Tasks struct {
+				Edges []struct {
+					Node struct {
+						ID   string `json:"id"`
+						Name string `json:"name"`
+					} `json:"node"`
+				} `json:"edges"`
+				TotalCount int `json:"totalCount"`
+			} `json:"tasks"`
+		} `json:"node"`
+	}
+
+	err := owner.Execute(query, map[string]any{"id": measureID}, &result)
+	require.NoError(t, err)
+	assert.GreaterOrEqual(t, result.Node.Tasks.TotalCount, 3)
+}
+
+func TestTask_RequiredFields(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	tests := []struct {
+		name              string
+		input             map[string]any
+		skipOrganization  bool
+		wantErrorContains string
+	}{
+		{
+			name: "missing organizationId",
+			input: map[string]any{
+				"name": "Test Task",
+			},
+			skipOrganization:  true,
+			wantErrorContains: "organizationId",
+		},
+		{
+			name: "missing name",
+			input: map[string]any{
+				"organizationId": "placeholder",
+			},
+			wantErrorContains: "name",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			query := `
+				mutation CreateTask($input: CreateTaskInput!) {
+					createTask(input: $input) {
+						taskEdge {
+							node {
+								id
+							}
+						}
+					}
+				}
+			`
+
+			input := make(map[string]any)
+			if !tt.skipOrganization {
+				input["organizationId"] = owner.GetOrganizationID().String()
+			}
+			for k, v := range tt.input {
+				if v == "placeholder" {
+					continue // Skip placeholder values
+				}
+				input[k] = v
+			}
+
+			_, err := owner.Do(query, map[string]any{"input": input})
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), tt.wantErrorContains)
+		})
+	}
+}
+
+func TestTask_StateEnum(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	measureID := factory.NewMeasure(owner).
+		WithName("Task State Test").
+		Create()
+
+	states := []string{
+		"TODO",
+		"DONE",
+	}
+
+	for _, state := range states {
+		t.Run("update to state "+state, func(t *testing.T) {
+			taskID := factory.NewTask(owner, measureID).
+				WithName("State Test " + state).
+				Create()
+
+			query := `
+				mutation UpdateTask($input: UpdateTaskInput!) {
+					updateTask(input: $input) {
+						task {
+							id
+							state
+						}
+					}
+				}
+			`
+
+			var result struct {
+				UpdateTask struct {
+					Task struct {
+						ID    string `json:"id"`
+						State string `json:"state"`
+					} `json:"task"`
+				} `json:"updateTask"`
+			}
+
+			err := owner.Execute(query, map[string]any{
+				"input": map[string]any{
+					"taskId": taskID,
+					"state":  state,
+				},
+			}, &result)
+			require.NoError(t, err, "State %s should be valid", state)
+			assert.Equal(t, state, result.UpdateTask.Task.State)
+		})
+	}
+}
+
+func TestTask_SubResolvers(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	measureID := factory.NewMeasure(owner).
+		WithName("Task SubResolver Test").
+		Create()
+
+	taskID := factory.NewTask(owner, measureID).
+		WithName("SubResolver Test Task").
+		Create()
+
+	t.Run("task node query", func(t *testing.T) {
+		query := `
+			query GetTask($id: ID!) {
+				node(id: $id) {
+					... on Task {
+						id
+						name
+						description
+						state
+					}
+				}
+			}
+		`
+
+		var result struct {
+			Node struct {
+				ID          string  `json:"id"`
+				Name        string  `json:"name"`
+				Description *string `json:"description"`
+				State       string  `json:"state"`
+			} `json:"node"`
+		}
+
+		err := owner.Execute(query, map[string]any{"id": taskID}, &result)
+		require.NoError(t, err)
+		assert.Equal(t, taskID, result.Node.ID)
+		assert.Equal(t, "SubResolver Test Task", result.Node.Name)
+	})
+
+	t.Run("measure sub-resolver", func(t *testing.T) {
+		query := `
+			query($id: ID!) {
+				node(id: $id) {
+					... on Task {
+						id
+						measure {
+							id
+							name
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			Node struct {
+				ID      string `json:"id"`
+				Measure struct {
+					ID   string `json:"id"`
+					Name string `json:"name"`
+				} `json:"measure"`
+			} `json:"node"`
+		}
+
+		err := owner.Execute(query, map[string]any{"id": taskID}, &result)
+		require.NoError(t, err)
+		assert.Equal(t, measureID, result.Node.Measure.ID)
+		assert.NotEmpty(t, result.Node.Measure.Name)
+	})
+
+	t.Run("assignedTo sub-resolver (null)", func(t *testing.T) {
+		query := `
+			query($id: ID!) {
+				node(id: $id) {
+					... on Task {
+						id
+						assignedTo {
+							id
+							fullName
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			Node struct {
+				ID         string `json:"id"`
+				AssignedTo *struct {
+					ID       string `json:"id"`
+					FullName string `json:"fullName"`
+				} `json:"assignedTo"`
+			} `json:"node"`
+		}
+
+		err := owner.Execute(query, map[string]any{"id": taskID}, &result)
+		require.NoError(t, err)
+		assert.Nil(t, result.Node.AssignedTo)
+	})
+}
+
+func TestTask_InvalidID(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	t.Run("update with invalid ID", func(t *testing.T) {
+		query := `
+			mutation UpdateTask($input: UpdateTaskInput!) {
+				updateTask(input: $input) {
+					task {
+						id
+					}
+				}
+			}
+		`
+
+		_, err := owner.Do(query, map[string]any{
+			"input": map[string]any{
+				"taskId": "invalid-id-format",
+				"name":   "Test",
+			},
+		})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "base64")
+	})
+
+	t.Run("delete with invalid ID", func(t *testing.T) {
+		query := `
+			mutation DeleteTask($input: DeleteTaskInput!) {
+				deleteTask(input: $input) {
+					deletedTaskId
+				}
+			}
+		`
+
+		_, err := owner.Do(query, map[string]any{
+			"input": map[string]any{
+				"taskId": "invalid-id-format",
+			},
+		})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "base64")
+	})
+
+	t.Run("query with non-existent ID", func(t *testing.T) {
+		query := `
+			query GetTask($id: ID!) {
+				node(id: $id) {
+					... on Task {
+						id
+						name
+					}
+				}
+			}
+		`
+
+		err := owner.ExecuteShouldFail(query, map[string]any{
+			"id": "V0wtM0tMNmJBQ1lBQUFBQUFackhLSTJfbXJJRUFZVXo",
+		})
+		require.Error(t, err, "Non-existent ID should return error")
+	})
+}
+
+func TestTask_OmittableDescription(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	measureID := factory.NewMeasure(owner).
+		WithName("Task Description Test").
+		Create()
+
+	taskID := factory.NewTask(owner, measureID).
+		WithName("Description Test Task").
+		WithDescription("Initial description").
+		Create()
+
+	t.Run("set description", func(t *testing.T) {
+		query := `
+			mutation UpdateTask($input: UpdateTaskInput!) {
+				updateTask(input: $input) {
+					task {
+						id
+						description
+					}
+				}
+			}
+		`
+
+		var result struct {
+			UpdateTask struct {
+				Task struct {
+					ID          string  `json:"id"`
+					Description *string `json:"description"`
+				} `json:"task"`
+			} `json:"updateTask"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"taskId":      taskID,
+				"description": "Updated description",
+			},
+		}, &result)
+		require.NoError(t, err)
+		require.NotNil(t, result.UpdateTask.Task.Description)
+		assert.Equal(t, "Updated description", *result.UpdateTask.Task.Description)
+	})
+
+	t.Run("clear description with null", func(t *testing.T) {
+		query := `
+			mutation UpdateTask($input: UpdateTaskInput!) {
+				updateTask(input: $input) {
+					task {
+						id
+						description
+					}
+				}
+			}
+		`
+
+		var result struct {
+			UpdateTask struct {
+				Task struct {
+					ID          string  `json:"id"`
+					Description *string `json:"description"`
+				} `json:"task"`
+			} `json:"updateTask"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"taskId":      taskID,
+				"description": nil,
+			},
+		}, &result)
+		require.NoError(t, err)
+		assert.Nil(t, result.UpdateTask.Task.Description)
+	})
+
+	t.Run("update without description preserves value", func(t *testing.T) {
+		// First set a description
+		setQuery := `
+			mutation UpdateTask($input: UpdateTaskInput!) {
+				updateTask(input: $input) {
+					task {
+						id
+					}
+				}
+			}
+		`
+
+		err := owner.Execute(setQuery, map[string]any{
+			"input": map[string]any{
+				"taskId":      taskID,
+				"description": "Should persist",
+			},
+		}, nil)
+		require.NoError(t, err)
+
+		// Update only name
+		query := `
+			mutation UpdateTask($input: UpdateTaskInput!) {
+				updateTask(input: $input) {
+					task {
+						id
+						name
+						description
+					}
+				}
+			}
+		`
+
+		var result struct {
+			UpdateTask struct {
+				Task struct {
+					ID          string  `json:"id"`
+					Name        string  `json:"name"`
+					Description *string `json:"description"`
+				} `json:"task"`
+			} `json:"updateTask"`
+		}
+
+		err = owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"taskId": taskID,
+				"name":   "Updated Name",
+			},
+		}, &result)
+		require.NoError(t, err)
+		require.NotNil(t, result.UpdateTask.Task.Description)
+		assert.Equal(t, "Should persist", *result.UpdateTask.Task.Description)
+	})
+}
+
+func TestTask_OmittableAssignee(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a people for assignee
+	peopleID := factory.NewPeople(owner).
+		WithFullName("Task Assignee Person").
+		Create()
+
+	measureID := factory.NewMeasure(owner).
+		WithName("Task Assignee Test").
+		Create()
+
+	taskID := factory.NewTask(owner, measureID).
+		WithName("Assignee Test Task").
+		Create()
+
+	t.Run("set assignee", func(t *testing.T) {
+		query := `
+			mutation AssignTask($input: AssignTaskInput!) {
+				assignTask(input: $input) {
+					task {
+						id
+						assignedTo {
+							id
+							fullName
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			AssignTask struct {
+				Task struct {
+					ID         string `json:"id"`
+					AssignedTo struct {
+						ID       string `json:"id"`
+						FullName string `json:"fullName"`
+					} `json:"assignedTo"`
+				} `json:"task"`
+			} `json:"assignTask"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"taskId":       taskID,
+				"assignedToId": peopleID,
+			},
+		}, &result)
+		require.NoError(t, err)
+		assert.Equal(t, peopleID, result.AssignTask.Task.AssignedTo.ID)
+	})
+
+	t.Run("clear assignee", func(t *testing.T) {
+		query := `
+			mutation UnassignTask($input: UnassignTaskInput!) {
+				unassignTask(input: $input) {
+					task {
+						id
+						assignedTo {
+							id
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			UnassignTask struct {
+				Task struct {
+					ID         string `json:"id"`
+					AssignedTo *struct {
+						ID string `json:"id"`
+					} `json:"assignedTo"`
+				} `json:"task"`
+			} `json:"unassignTask"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"taskId": taskID,
+			},
+		}, &result)
+		require.NoError(t, err)
+		assert.Nil(t, result.UnassignTask.Task.AssignedTo)
+	})
+}
+
+func TestTask_OmittableDeadline(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	measureID := factory.NewMeasure(owner).
+		WithName("Task Deadline Test").
+		Create()
+
+	// Create task with deadline via mutation (factory doesn't support deadline)
+	query := `
+		mutation CreateTask($input: CreateTaskInput!) {
+			createTask(input: $input) {
+				taskEdge {
+					node {
+						id
+						deadline
+					}
+				}
+			}
+		}
+	`
+
+	var createResult struct {
+		CreateTask struct {
+			TaskEdge struct {
+				Node struct {
+					ID       string  `json:"id"`
+					Deadline *string `json:"deadline"`
+				} `json:"node"`
+			} `json:"taskEdge"`
+		} `json:"createTask"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"measureId":      measureID,
+			"name":           "Deadline Test Task",
+			"deadline":       "2025-12-31T00:00:00Z",
+		},
+	}, &createResult)
+	require.NoError(t, err)
+
+	taskID := createResult.CreateTask.TaskEdge.Node.ID
+	require.NotNil(t, createResult.CreateTask.TaskEdge.Node.Deadline)
+
+	t.Run("update deadline", func(t *testing.T) {
+		query := `
+			mutation UpdateTask($input: UpdateTaskInput!) {
+				updateTask(input: $input) {
+					task {
+						id
+						deadline
+					}
+				}
+			}
+		`
+
+		var result struct {
+			UpdateTask struct {
+				Task struct {
+					ID       string  `json:"id"`
+					Deadline *string `json:"deadline"`
+				} `json:"task"`
+			} `json:"updateTask"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"taskId":   taskID,
+				"deadline": "2026-01-15T00:00:00Z",
+			},
+		}, &result)
+		require.NoError(t, err)
+		require.NotNil(t, result.UpdateTask.Task.Deadline)
+		assert.Contains(t, *result.UpdateTask.Task.Deadline, "2026-01-15")
+	})
+
+	t.Run("clear deadline with null", func(t *testing.T) {
+		query := `
+			mutation UpdateTask($input: UpdateTaskInput!) {
+				updateTask(input: $input) {
+					task {
+						id
+						deadline
+					}
+				}
+			}
+		`
+
+		var result struct {
+			UpdateTask struct {
+				Task struct {
+					ID       string  `json:"id"`
+					Deadline *string `json:"deadline"`
+				} `json:"task"`
+			} `json:"updateTask"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"taskId":   taskID,
+				"deadline": nil,
+			},
+		}, &result)
+		require.NoError(t, err)
+		assert.Nil(t, result.UpdateTask.Task.Deadline)
+	})
+}
+
+func TestTask_TenantIsolation(t *testing.T) {
+	t.Parallel()
+
+	org1Owner := testutil.NewClient(t, testutil.RoleOwner)
+	org2Owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	measureID := factory.NewMeasure(org1Owner).WithName("Org1 Measure").Create()
+	taskID := factory.NewTask(org1Owner, measureID).WithName("Org1 Task").Create()
+
+	t.Run("cannot read task from another organization", func(t *testing.T) {
+		query := `
+			query($id: ID!) {
+				node(id: $id) {
+					... on Task {
+						id
+						name
+					}
+				}
+			}
+		`
+
+		var result struct {
+			Node *struct {
+				ID   string `json:"id"`
+				Name string `json:"name"`
+			} `json:"node"`
+		}
+
+		err := org2Owner.Execute(query, map[string]any{"id": taskID}, &result)
+		testutil.AssertNodeNotAccessible(t, err, result.Node == nil, "task")
+	})
+
+	t.Run("cannot update task from another organization", func(t *testing.T) {
+		query := `
+			mutation UpdateTask($input: UpdateTaskInput!) {
+				updateTask(input: $input) {
+					task { id }
+				}
+			}
+		`
+
+		_, err := org2Owner.Do(query, map[string]any{
+			"input": map[string]any{
+				"taskId": taskID,
+				"name":   "Hijacked Task",
+			},
+		})
+		require.Error(t, err, "Should not be able to update task from another org")
+	})
+
+	t.Run("cannot delete task from another organization", func(t *testing.T) {
+		query := `
+			mutation DeleteTask($input: DeleteTaskInput!) {
+				deleteTask(input: $input) {
+					deletedTaskId
+				}
+			}
+		`
+
+		_, err := org2Owner.Do(query, map[string]any{
+			"input": map[string]any{
+				"taskId": taskID,
+			},
+		})
+		require.Error(t, err, "Should not be able to delete task from another org")
+	})
+}

e2e/console/testdata/config.yaml

@@ -0,0 +1,89 @@
+unit:
+  metrics:
+    addr: "localhost:19081"
+  tracing:
+    addr: "localhost:14317"
+    max-batch-size: 512
+    batch-timeout: 5
+    export-timeout: 30
+    max-queue-size: 2048
+
+probod:
+  base-url: "http://localhost:18080"
+  encryption-key: "thisisnotasecretAAAAAAAAAAAAAAAAAAAAAAAAAAA="
+  chrome-dp-addr: "localhost:9222"
+
+  api:
+    addr: "localhost:18080"
+    cors:
+      allowed-origins: ["http://localhost:18080"]
+    extra-header-fields: {}
+
+  pg:
+    addr: "localhost:5432"
+    username: "postgres"
+    password: "postgres"
+    database: "probod_test"
+    pool-size: 10
+
+  auth:
+    disable-signup: false
+    invitation-confirmation-token-validity: 3600
+    cookie:
+      name: "SSID"
+      domain: "localhost"
+      secret: "this-is-a-secure-secret-for-cookie-signing-at-least-32-bytes"
+      duration: 24
+      secure: false
+    password:
+      pepper: "this-is-a-secure-pepper-for-password-hashing-at-least-32-bytes"
+      iterations: 600000
+
+  trust-auth:
+    cookie-name: "TCT"
+    cookie-domain: "localhost"
+    cookie-duration: 24
+    token-duration: 720
+    report-url-duration: 15
+    token-secret: "this-is-a-secure-secret-for-trust-token-signing-at-least-32-bytes"
+    scope: "trust_center_readonly"
+    token-type: "trust_center_access"
+
+  trust-center:
+    http-addr: ":10080"
+    https-addr: ":10443"
+
+  aws:
+    region: "us-east-1"
+    bucket: "probod-test"
+    access-key-id: "probod"
+    secret-access-key: "thisisnotasecret"
+    endpoint: "http://127.0.0.1:9000"
+
+  notifications:
+    mailer:
+      sender-name: "Probo Test"
+      sender-email: "no-reply@test.getprobo.com"
+      smtp:
+        addr: "localhost:1025"
+        tls-required: false
+      mailer-interval: 60
+    slack:
+      sender-interval: 60
+
+  openai:
+    api-key: "thisisnotasecret"
+    temperature: 0.1
+    model-name: "gpt-4o"
+
+  custom-domains:
+    renewal-interval: 3600
+    provision-interval: 30
+    cname-target: "custom.test.getprobo.com"
+    acme:
+      directory: "https://localhost:14000/dir"
+      email: "admin@test.getprobo.com"
+      key-type: "EC256"
+      root-ca: ""
+
+  connectors: []

e2e/console/vendor_contact_test.go

@@ -0,0 +1,293 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/factory"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+func TestVendorContact_Create(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a vendor first
+	vendorID := factory.NewVendor(owner).WithName("Contact Test Vendor").Create()
+
+	query := `
+		mutation CreateVendorContact($input: CreateVendorContactInput!) {
+			createVendorContact(input: $input) {
+				vendorContactEdge {
+					node {
+						id
+						fullName
+						email
+						phone
+						role
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		CreateVendorContact struct {
+			VendorContactEdge struct {
+				Node struct {
+					ID       string `json:"id"`
+					FullName string `json:"fullName"`
+					Email    string `json:"email"`
+					Phone    string `json:"phone"`
+					Role     string `json:"role"`
+				} `json:"node"`
+			} `json:"vendorContactEdge"`
+		} `json:"createVendorContact"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"vendorId": vendorID,
+			"fullName": "John Doe",
+			"email":    fmt.Sprintf("john.doe.%d@vendor.com", time.Now().UnixNano()),
+			"phone":    "+1-555-123-4567",
+			"role":     "Account Manager",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	contact := result.CreateVendorContact.VendorContactEdge.Node
+	assert.NotEmpty(t, contact.ID)
+	assert.Equal(t, "John Doe", contact.FullName)
+	assert.Equal(t, "+1-555-123-4567", contact.Phone)
+	assert.Equal(t, "Account Manager", contact.Role)
+}
+
+func TestVendorContact_Update(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a vendor and contact
+	vendorID := factory.NewVendor(owner).WithName("Update Contact Vendor").Create()
+
+	createQuery := `
+		mutation CreateVendorContact($input: CreateVendorContactInput!) {
+			createVendorContact(input: $input) {
+				vendorContactEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createResult struct {
+		CreateVendorContact struct {
+			VendorContactEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"vendorContactEdge"`
+		} `json:"createVendorContact"`
+	}
+
+	err := owner.Execute(createQuery, map[string]any{
+		"input": map[string]any{
+			"vendorId": vendorID,
+			"fullName": "Initial Name",
+			"email":    fmt.Sprintf("initial.%d@vendor.com", time.Now().UnixNano()),
+		},
+	}, &createResult)
+	require.NoError(t, err)
+
+	contactID := createResult.CreateVendorContact.VendorContactEdge.Node.ID
+
+	query := `
+		mutation UpdateVendorContact($input: UpdateVendorContactInput!) {
+			updateVendorContact(input: $input) {
+				vendorContact {
+					id
+					fullName
+					phone
+					role
+				}
+			}
+		}
+	`
+
+	var result struct {
+		UpdateVendorContact struct {
+			VendorContact struct {
+				ID       string `json:"id"`
+				FullName string `json:"fullName"`
+				Phone    string `json:"phone"`
+				Role     string `json:"role"`
+			} `json:"vendorContact"`
+		} `json:"updateVendorContact"`
+	}
+
+	err = owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"id":       contactID,
+			"fullName": "Updated Name",
+			"phone":    "+1-555-999-8888",
+			"role":     "Senior Account Manager",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, contactID, result.UpdateVendorContact.VendorContact.ID)
+	assert.Equal(t, "Updated Name", result.UpdateVendorContact.VendorContact.FullName)
+	assert.Equal(t, "+1-555-999-8888", result.UpdateVendorContact.VendorContact.Phone)
+	assert.Equal(t, "Senior Account Manager", result.UpdateVendorContact.VendorContact.Role)
+}
+
+func TestVendorContact_Delete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	vendorID := factory.NewVendor(owner).WithName("Delete Contact Vendor").Create()
+
+	// Create a contact to delete
+	createQuery := `
+		mutation CreateVendorContact($input: CreateVendorContactInput!) {
+			createVendorContact(input: $input) {
+				vendorContactEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createResult struct {
+		CreateVendorContact struct {
+			VendorContactEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"vendorContactEdge"`
+		} `json:"createVendorContact"`
+	}
+
+	err := owner.Execute(createQuery, map[string]any{
+		"input": map[string]any{
+			"vendorId": vendorID,
+			"fullName": fmt.Sprintf("Contact to Delete %d", time.Now().UnixNano()),
+			"email":    fmt.Sprintf("delete.%d@vendor.com", time.Now().UnixNano()),
+		},
+	}, &createResult)
+	require.NoError(t, err)
+
+	contactID := createResult.CreateVendorContact.VendorContactEdge.Node.ID
+
+	deleteQuery := `
+		mutation DeleteVendorContact($input: DeleteVendorContactInput!) {
+			deleteVendorContact(input: $input) {
+				deletedVendorContactId
+			}
+		}
+	`
+
+	var result struct {
+		DeleteVendorContact struct {
+			DeletedVendorContactID string `json:"deletedVendorContactId"`
+		} `json:"deleteVendorContact"`
+	}
+
+	err = owner.Execute(deleteQuery, map[string]any{
+		"input": map[string]any{
+			"vendorContactId": contactID,
+		},
+	}, &result)
+	require.NoError(t, err)
+	assert.Equal(t, contactID, result.DeleteVendorContact.DeletedVendorContactID)
+}
+
+func TestVendorContact_List(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	vendorID := factory.NewVendor(owner).WithName("List Contacts Vendor").Create()
+
+	// Create multiple contacts
+	for i := 0; i < 3; i++ {
+		query := `
+			mutation CreateVendorContact($input: CreateVendorContactInput!) {
+				createVendorContact(input: $input) {
+					vendorContactEdge {
+						node {
+							id
+						}
+					}
+				}
+			}
+		`
+
+		_, err := owner.Do(query, map[string]any{
+			"input": map[string]any{
+				"vendorId": vendorID,
+				"fullName": fmt.Sprintf("Contact %d", i),
+				"email":    fmt.Sprintf("contact.%d.%d@vendor.com", i, time.Now().UnixNano()),
+			},
+		})
+		require.NoError(t, err)
+	}
+
+	query := `
+		query GetVendorContacts($id: ID!) {
+			node(id: $id) {
+				... on Vendor {
+					contacts(first: 10) {
+						edges {
+							node {
+								id
+								fullName
+								email
+							}
+						}
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		Node struct {
+			Contacts struct {
+				Edges []struct {
+					Node struct {
+						ID       string `json:"id"`
+						FullName string `json:"fullName"`
+						Email    string `json:"email"`
+					} `json:"node"`
+				} `json:"edges"`
+			} `json:"contacts"`
+		} `json:"node"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"id": vendorID,
+	}, &result)
+	require.NoError(t, err)
+	assert.GreaterOrEqual(t, len(result.Node.Contacts.Edges), 3)
+}

e2e/console/vendor_service_test.go

@@ -0,0 +1,757 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+func TestVendorService_Create(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a vendor first
+	createVendorMutation := `
+		mutation CreateVendor($input: CreateVendorInput!) {
+			createVendor(input: $input) {
+				vendorEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createVendorResult struct {
+		CreateVendor struct {
+			VendorEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"vendorEdge"`
+		} `json:"createVendor"`
+	}
+
+	err := owner.Execute(createVendorMutation, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           "AWS",
+			"category":       "CLOUD_PROVIDER",
+		},
+	}, &createVendorResult)
+	require.NoError(t, err)
+
+	vendorID := createVendorResult.CreateVendor.VendorEdge.Node.ID
+
+	tests := []struct {
+		name      string
+		role      testutil.TestRole
+		variables func() map[string]any
+		check     func(t *testing.T, err error, m *struct {
+			CreateVendorService struct {
+				VendorServiceEdge struct {
+					Node struct {
+						ID          string  `json:"id"`
+						Name        string  `json:"name"`
+						Description *string `json:"description"`
+					} `json:"node"`
+				} `json:"vendorServiceEdge"`
+			} `json:"createVendorService"`
+		})
+	}{
+		{
+			name: "Owner can create vendor service",
+			role: testutil.RoleOwner,
+			variables: func() map[string]any {
+				return map[string]any{
+					"input": map[string]any{
+						"vendorId":    vendorID,
+						"name":        "Amazon S3",
+						"description": "Simple Storage Service",
+					},
+				}
+			},
+			check: func(t *testing.T, err error, m *struct {
+				CreateVendorService struct {
+					VendorServiceEdge struct {
+						Node struct {
+							ID          string  `json:"id"`
+							Name        string  `json:"name"`
+							Description *string `json:"description"`
+						} `json:"node"`
+					} `json:"vendorServiceEdge"`
+				} `json:"createVendorService"`
+			}) {
+				require.NoError(t, err)
+				assert.NotEmpty(t, m.CreateVendorService.VendorServiceEdge.Node.ID)
+				assert.Equal(t, "Amazon S3", m.CreateVendorService.VendorServiceEdge.Node.Name)
+				assert.Equal(t, "Simple Storage Service", *m.CreateVendorService.VendorServiceEdge.Node.Description)
+			},
+		},
+		{
+			name: "Admin can create vendor service",
+			role: testutil.RoleAdmin,
+			variables: func() map[string]any {
+				return map[string]any{
+					"input": map[string]any{
+						"vendorId":    vendorID,
+						"name":        "Amazon EC2",
+						"description": "Elastic Compute Cloud",
+					},
+				}
+			},
+			check: func(t *testing.T, err error, m *struct {
+				CreateVendorService struct {
+					VendorServiceEdge struct {
+						Node struct {
+							ID          string  `json:"id"`
+							Name        string  `json:"name"`
+							Description *string `json:"description"`
+						} `json:"node"`
+					} `json:"vendorServiceEdge"`
+				} `json:"createVendorService"`
+			}) {
+				require.NoError(t, err)
+			},
+		},
+		{
+			name: "Viewer cannot create vendor service",
+			role: testutil.RoleViewer,
+			variables: func() map[string]any {
+				return map[string]any{
+					"input": map[string]any{
+						"vendorId": vendorID,
+						"name":     "Should Fail",
+					},
+				}
+			},
+			check: func(t *testing.T, err error, m *struct {
+				CreateVendorService struct {
+					VendorServiceEdge struct {
+						Node struct {
+							ID          string  `json:"id"`
+							Name        string  `json:"name"`
+							Description *string `json:"description"`
+						} `json:"node"`
+					} `json:"vendorServiceEdge"`
+				} `json:"createVendorService"`
+			}) {
+				require.Error(t, err, "Viewer should not be able to create vendor service")
+			},
+		},
+	}
+
+	createVendorServiceMutation := `
+		mutation CreateVendorService($input: CreateVendorServiceInput!) {
+			createVendorService(input: $input) {
+				vendorServiceEdge {
+					node {
+						id
+						name
+						description
+					}
+				}
+			}
+		}
+	`
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var client *testutil.Client
+			if tt.role == testutil.RoleOwner {
+				client = owner
+			} else {
+				client = testutil.NewClientInOrg(t, tt.role, owner)
+			}
+
+			var m struct {
+				CreateVendorService struct {
+					VendorServiceEdge struct {
+						Node struct {
+							ID          string  `json:"id"`
+							Name        string  `json:"name"`
+							Description *string `json:"description"`
+						} `json:"node"`
+					} `json:"vendorServiceEdge"`
+				} `json:"createVendorService"`
+			}
+
+			err := client.Execute(createVendorServiceMutation, tt.variables(), &m)
+			tt.check(t, err, &m)
+		})
+	}
+}
+
+func TestVendorService_Update(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a vendor first
+	createVendorMutation := `
+		mutation CreateVendor($input: CreateVendorInput!) {
+			createVendor(input: $input) {
+				vendorEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createVendorResult struct {
+		CreateVendor struct {
+			VendorEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"vendorEdge"`
+		} `json:"createVendor"`
+	}
+
+	err := owner.Execute(createVendorMutation, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           "Google Cloud",
+			"category":       "CLOUD_PROVIDER",
+		},
+	}, &createVendorResult)
+	require.NoError(t, err)
+
+	vendorID := createVendorResult.CreateVendor.VendorEdge.Node.ID
+
+	// Create a vendor service
+	createServiceMutation := `
+		mutation CreateVendorService($input: CreateVendorServiceInput!) {
+			createVendorService(input: $input) {
+				vendorServiceEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createServiceResult struct {
+		CreateVendorService struct {
+			VendorServiceEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"vendorServiceEdge"`
+		} `json:"createVendorService"`
+	}
+
+	err = owner.Execute(createServiceMutation, map[string]any{
+		"input": map[string]any{
+			"vendorId":    vendorID,
+			"name":        "Cloud Storage",
+			"description": "Initial description",
+		},
+	}, &createServiceResult)
+	require.NoError(t, err)
+
+	serviceID := createServiceResult.CreateVendorService.VendorServiceEdge.Node.ID
+
+	tests := []struct {
+		name      string
+		role      testutil.TestRole
+		variables func() map[string]any
+		check     func(t *testing.T, err error, m *struct {
+			UpdateVendorService struct {
+				VendorService struct {
+					ID          string  `json:"id"`
+					Name        string  `json:"name"`
+					Description *string `json:"description"`
+				} `json:"vendorService"`
+			} `json:"updateVendorService"`
+		})
+	}{
+		{
+			name: "Owner can update vendor service",
+			role: testutil.RoleOwner,
+			variables: func() map[string]any {
+				return map[string]any{
+					"input": map[string]any{
+						"id":          serviceID,
+						"name":        "Updated Cloud Storage",
+						"description": "Updated description",
+					},
+				}
+			},
+			check: func(t *testing.T, err error, m *struct {
+				UpdateVendorService struct {
+					VendorService struct {
+						ID          string  `json:"id"`
+						Name        string  `json:"name"`
+						Description *string `json:"description"`
+					} `json:"vendorService"`
+				} `json:"updateVendorService"`
+			}) {
+				require.NoError(t, err)
+				assert.Equal(t, serviceID, m.UpdateVendorService.VendorService.ID)
+				assert.Equal(t, "Updated Cloud Storage", m.UpdateVendorService.VendorService.Name)
+				assert.Equal(t, "Updated description", *m.UpdateVendorService.VendorService.Description)
+			},
+		},
+		{
+			name: "Admin can update vendor service",
+			role: testutil.RoleAdmin,
+			variables: func() map[string]any {
+				return map[string]any{
+					"input": map[string]any{
+						"id":   serviceID,
+						"name": "Admin Updated Storage",
+					},
+				}
+			},
+			check: func(t *testing.T, err error, m *struct {
+				UpdateVendorService struct {
+					VendorService struct {
+						ID          string  `json:"id"`
+						Name        string  `json:"name"`
+						Description *string `json:"description"`
+					} `json:"vendorService"`
+				} `json:"updateVendorService"`
+			}) {
+				require.NoError(t, err)
+			},
+		},
+		{
+			name: "Viewer cannot update vendor service",
+			role: testutil.RoleViewer,
+			variables: func() map[string]any {
+				return map[string]any{
+					"input": map[string]any{
+						"id":   serviceID,
+						"name": "Should Fail",
+					},
+				}
+			},
+			check: func(t *testing.T, err error, m *struct {
+				UpdateVendorService struct {
+					VendorService struct {
+						ID          string  `json:"id"`
+						Name        string  `json:"name"`
+						Description *string `json:"description"`
+					} `json:"vendorService"`
+				} `json:"updateVendorService"`
+			}) {
+				require.Error(t, err, "Viewer should not be able to update vendor service")
+			},
+		},
+	}
+
+	updateVendorServiceMutation := `
+		mutation UpdateVendorService($input: UpdateVendorServiceInput!) {
+			updateVendorService(input: $input) {
+				vendorService {
+					id
+					name
+					description
+				}
+			}
+		}
+	`
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var client *testutil.Client
+			if tt.role == testutil.RoleOwner {
+				client = owner
+			} else {
+				client = testutil.NewClientInOrg(t, tt.role, owner)
+			}
+
+			var m struct {
+				UpdateVendorService struct {
+					VendorService struct {
+						ID          string  `json:"id"`
+						Name        string  `json:"name"`
+						Description *string `json:"description"`
+					} `json:"vendorService"`
+				} `json:"updateVendorService"`
+			}
+
+			err := client.Execute(updateVendorServiceMutation, tt.variables(), &m)
+			tt.check(t, err, &m)
+		})
+	}
+}
+
+func TestVendorService_Delete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a vendor first
+	createVendorMutation := `
+		mutation CreateVendor($input: CreateVendorInput!) {
+			createVendor(input: $input) {
+				vendorEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createVendorResult struct {
+		CreateVendor struct {
+			VendorEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"vendorEdge"`
+		} `json:"createVendor"`
+	}
+
+	err := owner.Execute(createVendorMutation, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           "Azure",
+			"category":       "CLOUD_PROVIDER",
+		},
+	}, &createVendorResult)
+	require.NoError(t, err)
+
+	vendorID := createVendorResult.CreateVendor.VendorEdge.Node.ID
+
+	createService := func() string {
+		createServiceMutation := `
+			mutation CreateVendorService($input: CreateVendorServiceInput!) {
+				createVendorService(input: $input) {
+					vendorServiceEdge {
+						node {
+							id
+						}
+					}
+				}
+			}
+		`
+
+		var m struct {
+			CreateVendorService struct {
+				VendorServiceEdge struct {
+					Node struct {
+						ID string `json:"id"`
+					} `json:"node"`
+				} `json:"vendorServiceEdge"`
+			} `json:"createVendorService"`
+		}
+
+		err := owner.Execute(createServiceMutation, map[string]any{
+			"input": map[string]any{
+				"vendorId": vendorID,
+				"name":     "Service to delete",
+			},
+		}, &m)
+		require.NoError(t, err)
+
+		return m.CreateVendorService.VendorServiceEdge.Node.ID
+	}
+
+	tests := []struct {
+		name      string
+		role      testutil.TestRole
+		variables func(serviceID string) map[string]any
+		check     func(t *testing.T, err error, serviceID string, m *struct {
+			DeleteVendorService struct {
+				DeletedVendorServiceID string `json:"deletedVendorServiceId"`
+			} `json:"deleteVendorService"`
+		})
+	}{
+		{
+			name: "Viewer cannot delete vendor service",
+			role: testutil.RoleViewer,
+			variables: func(serviceID string) map[string]any {
+				return map[string]any{
+					"input": map[string]any{
+						"vendorServiceId": serviceID,
+					},
+				}
+			},
+			check: func(t *testing.T, err error, serviceID string, m *struct {
+				DeleteVendorService struct {
+					DeletedVendorServiceID string `json:"deletedVendorServiceId"`
+				} `json:"deleteVendorService"`
+			}) {
+				require.Error(t, err, "Viewer should not be able to delete vendor service")
+			},
+		},
+		{
+			name: "Admin can delete vendor service",
+			role: testutil.RoleAdmin,
+			variables: func(serviceID string) map[string]any {
+				return map[string]any{
+					"input": map[string]any{
+						"vendorServiceId": serviceID,
+					},
+				}
+			},
+			check: func(t *testing.T, err error, serviceID string, m *struct {
+				DeleteVendorService struct {
+					DeletedVendorServiceID string `json:"deletedVendorServiceId"`
+				} `json:"deleteVendorService"`
+			}) {
+				require.NoError(t, err)
+				assert.Equal(t, serviceID, m.DeleteVendorService.DeletedVendorServiceID)
+			},
+		},
+		{
+			name: "Owner can delete vendor service",
+			role: testutil.RoleOwner,
+			variables: func(serviceID string) map[string]any {
+				return map[string]any{
+					"input": map[string]any{
+						"vendorServiceId": serviceID,
+					},
+				}
+			},
+			check: func(t *testing.T, err error, serviceID string, m *struct {
+				DeleteVendorService struct {
+					DeletedVendorServiceID string `json:"deletedVendorServiceId"`
+				} `json:"deleteVendorService"`
+			}) {
+				require.NoError(t, err)
+				assert.Equal(t, serviceID, m.DeleteVendorService.DeletedVendorServiceID)
+			},
+		},
+	}
+
+	deleteVendorServiceMutation := `
+		mutation DeleteVendorService($input: DeleteVendorServiceInput!) {
+			deleteVendorService(input: $input) {
+				deletedVendorServiceId
+			}
+		}
+	`
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			serviceID := createService()
+
+			var client *testutil.Client
+			if tt.role == testutil.RoleOwner {
+				client = owner
+			} else {
+				client = testutil.NewClientInOrg(t, tt.role, owner)
+			}
+
+			var m struct {
+				DeleteVendorService struct {
+					DeletedVendorServiceID string `json:"deletedVendorServiceId"`
+				} `json:"deleteVendorService"`
+			}
+
+			err := client.Execute(deleteVendorServiceMutation, tt.variables(serviceID), &m)
+			tt.check(t, err, serviceID, &m)
+		})
+	}
+}
+
+func TestVendorService_List(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a vendor first
+	createVendorMutation := `
+		mutation CreateVendor($input: CreateVendorInput!) {
+			createVendor(input: $input) {
+				vendorEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createVendorResult struct {
+		CreateVendor struct {
+			VendorEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"vendorEdge"`
+		} `json:"createVendor"`
+	}
+
+	err := owner.Execute(createVendorMutation, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           "Vendor for Services",
+			"category":       "CLOUD_PROVIDER",
+		},
+	}, &createVendorResult)
+	require.NoError(t, err)
+
+	vendorID := createVendorResult.CreateVendor.VendorEdge.Node.ID
+
+	// Create multiple services
+	createServiceMutation := `
+		mutation CreateVendorService($input: CreateVendorServiceInput!) {
+			createVendorService(input: $input) {
+				vendorServiceEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	services := []string{"Service A", "Service B", "Service C"}
+	for _, name := range services {
+		var m struct {
+			CreateVendorService struct {
+				VendorServiceEdge struct {
+					Node struct {
+						ID string `json:"id"`
+					} `json:"node"`
+				} `json:"vendorServiceEdge"`
+			} `json:"createVendorService"`
+		}
+
+		err := owner.Execute(createServiceMutation, map[string]any{
+			"input": map[string]any{
+				"vendorId": vendorID,
+				"name":     name,
+			},
+		}, &m)
+		require.NoError(t, err)
+	}
+
+	tests := []struct {
+		name      string
+		role      testutil.TestRole
+		variables func() map[string]any
+		check     func(t *testing.T, err error, q *struct {
+			Node struct {
+				ID       string `json:"id"`
+				Services struct {
+					Edges []struct {
+						Node struct {
+							ID   string `json:"id"`
+							Name string `json:"name"`
+						} `json:"node"`
+					} `json:"edges"`
+				} `json:"services"`
+			} `json:"node"`
+		})
+	}{
+		{
+			name: "Owner can list vendor services",
+			role: testutil.RoleOwner,
+			variables: func() map[string]any {
+				return map[string]any{
+					"id": vendorID,
+				}
+			},
+			check: func(t *testing.T, err error, q *struct {
+				Node struct {
+					ID       string `json:"id"`
+					Services struct {
+						Edges []struct {
+							Node struct {
+								ID   string `json:"id"`
+								Name string `json:"name"`
+							} `json:"node"`
+						} `json:"edges"`
+					} `json:"services"`
+				} `json:"node"`
+			}) {
+				require.NoError(t, err)
+				assert.GreaterOrEqual(t, len(q.Node.Services.Edges), 3)
+			},
+		},
+		{
+			name: "Viewer can list vendor services",
+			role: testutil.RoleViewer,
+			variables: func() map[string]any {
+				return map[string]any{
+					"id": vendorID,
+				}
+			},
+			check: func(t *testing.T, err error, q *struct {
+				Node struct {
+					ID       string `json:"id"`
+					Services struct {
+						Edges []struct {
+							Node struct {
+								ID   string `json:"id"`
+								Name string `json:"name"`
+							} `json:"node"`
+						} `json:"edges"`
+					} `json:"services"`
+				} `json:"node"`
+			}) {
+				require.NoError(t, err)
+			},
+		},
+	}
+
+	listVendorServicesQuery := `
+		query ListVendorServices($id: ID!) {
+			node(id: $id) {
+				... on Vendor {
+					id
+					services(first: 10) {
+						edges {
+							node {
+								id
+								name
+							}
+						}
+					}
+				}
+			}
+		}
+	`
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var client *testutil.Client
+			if tt.role == testutil.RoleOwner {
+				client = owner
+			} else {
+				client = testutil.NewClientInOrg(t, tt.role, owner)
+			}
+
+			var q struct {
+				Node struct {
+					ID       string `json:"id"`
+					Services struct {
+						Edges []struct {
+							Node struct {
+								ID   string `json:"id"`
+								Name string `json:"name"`
+							} `json:"node"`
+						} `json:"edges"`
+					} `json:"services"`
+				} `json:"node"`
+			}
+
+			err := client.Execute(listVendorServicesQuery, tt.variables(), &q)
+			tt.check(t, err, &q)
+		})
+	}
+}