rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add compliance frameworks

Browse Source 
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
This commit is contained in:
Sacha Al Himdani
2026-03-03 08:56:39 +01:00
parent 4d882e37b0
commit c17c53e80f
36 changed files with 5303 additions and 90 deletions
Download Patch File Download Diff File Expand all files Collapse all files

428
pkg/coredata/compliance_framework.go Normal file
View File

@@ -0,0 +1,428 @@
// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package coredata
import (
"context"
"errors"
"fmt"
"maps"
"time"
"github.com/jackc/pgx/v5"
"github.com/jackc/pgx/v5/pgconn"
"go.gearno.de/kit/pg"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/page"
)
type (
ComplianceFramework struct {
ID gid.GID `db:"id"`
OrganizationID gid.GID `db:"organization_id"`
TrustCenterID gid.GID `db:"trust_center_id"`
FrameworkID gid.GID `db:"framework_id"`
Rank int `db:"rank"`
CreatedAt time.Time `db:"created_at"`
UpdatedAt time.Time `db:"updated_at"`
// Visibility is a non-db field used to return all frameworks for a trust center, including hidden ones.
Visibility ComplianceFrameworkVisibility `db:"visibility"`
}
ComplianceFrameworks []*ComplianceFramework
)
func (c ComplianceFramework) CursorKey(orderBy ComplianceFrameworkOrderField) page.CursorKey {
switch orderBy {
case ComplianceFrameworkOrderFieldCreatedAt:
return page.NewCursorKey(c.ID, c.CreatedAt)
case ComplianceFrameworkOrderFieldRank:
return page.NewCursorKey(c.ID, c.Rank)
}
panic(fmt.Sprintf("unsupported order by: %s", orderBy))
}
func (c *ComplianceFramework) AuthorizationAttributes(ctx context.Context, conn pg.Conn) (map[string]string, error) {
q := `SELECT organization_id FROM compliance_frameworks WHERE id = $1 LIMIT 1;`
var organizationID gid.GID
if err := conn.QueryRow(ctx, q, c.ID).Scan(&organizationID); err != nil {
if errors.Is(err, pgx.ErrNoRows) {
return nil, ErrResourceNotFound
}
return nil, fmt.Errorf("cannot query compliance framework authorization attributes: %w", err)
}
return map[string]string{"organization_id": organizationID.String()}, nil
}
func (c *ComplianceFramework) LoadByID(
ctx context.Context,
conn pg.Conn,
scope Scoper,
complianceFrameworkID gid.GID,
) error {
q := `
SELECT
id,
organization_id,
trust_center_id,
framework_id,
rank,
'PUBLIC' AS visibility,
created_at,
updated_at
FROM
compliance_frameworks
WHERE
%s
AND id = @compliance_framework_id
LIMIT 1;
`
q = fmt.Sprintf(q, scope.SQLFragment())
args := pgx.StrictNamedArgs{"compliance_framework_id": complianceFrameworkID}
maps.Copy(args, scope.SQLArguments())
rows, err := conn.Query(ctx, q, args)
if err != nil {
return fmt.Errorf("cannot query compliance_frameworks: %w", err)
}
cf, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[ComplianceFramework])
if err != nil {
if errors.Is(err, pgx.ErrNoRows) {
return ErrResourceNotFound
}
return fmt.Errorf("cannot collect compliance framework: %w", err)
}
*c = cf
return nil
}
func (c *ComplianceFramework) LoadByTrustCenterIDAndFrameworkID(
ctx context.Context,
conn pg.Conn,
scope Scoper,
trustCenterID gid.GID,
frameworkID gid.GID,
) error {
q := `
SELECT
id,
organization_id,
trust_center_id,
framework_id,
rank,
'PUBLIC' AS visibility,
created_at,
updated_at
FROM
compliance_frameworks
WHERE
%s
AND trust_center_id = @trust_center_id
AND framework_id = @framework_id
LIMIT 1;
`
q = fmt.Sprintf(q, scope.SQLFragment())
args := pgx.StrictNamedArgs{
"trust_center_id": trustCenterID,
"framework_id": frameworkID,
}
maps.Copy(args, scope.SQLArguments())
rows, err := conn.Query(ctx, q, args)
if err != nil {
return fmt.Errorf("cannot query compliance_frameworks: %w", err)
}
cf, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[ComplianceFramework])
if err != nil {
if errors.Is(err, pgx.ErrNoRows) {
return ErrResourceNotFound
}
return fmt.Errorf("cannot collect compliance framework: %w", err)
}
*c = cf
return nil
}
func (c *ComplianceFramework) Insert(
ctx context.Context,
conn pg.Conn,
scope Scoper,
) error {
q := `
INSERT INTO
compliance_frameworks (
id,
tenant_id,
organization_id,
trust_center_id,
framework_id,
rank,
created_at,
updated_at
)
VALUES (
@id,
@tenant_id,
@organization_id,
@trust_center_id,
@framework_id,
(SELECT COALESCE(MAX(rank), 0) + 1 FROM compliance_frameworks WHERE trust_center_id = @trust_center_id),
@created_at,
@updated_at
)
RETURNING rank;
`
args := pgx.StrictNamedArgs{
"id": c.ID,
"tenant_id": scope.GetTenantID(),
"organization_id": c.OrganizationID,
"trust_center_id": c.TrustCenterID,
"framework_id": c.FrameworkID,
"created_at": c.CreatedAt,
"updated_at": c.UpdatedAt,
}
err := conn.QueryRow(ctx, q, args).Scan(&c.Rank)
if err != nil {
var pgErr *pgconn.PgError
if errors.As(err, &pgErr) {
if pgErr.Code == "23505" {
return ErrResourceAlreadyExists
}
}
return fmt.Errorf("cannot insert compliance framework: %w", err)
}
return nil
}
func (c *ComplianceFramework) UpdateRank(
ctx context.Context,
conn pg.Conn,
scope Scoper,
) error {
q := `
WITH old AS (
SELECT
rank AS old_rank
FROM compliance_frameworks
WHERE %s AND id = @id AND trust_center_id = @trust_center_id
)
UPDATE compliance_frameworks
SET
rank = CASE
WHEN id = @id THEN @new_rank
ELSE rank + CASE
WHEN @new_rank < old.old_rank THEN 1
WHEN @new_rank > old.old_rank THEN -1
END
END,
updated_at = @updated_at
FROM old
WHERE %s
AND (
id = @id
OR (rank BETWEEN LEAST(old.old_rank, @new_rank) AND GREATEST(old.old_rank, @new_rank))
);
`
scopeFragment := scope.SQLFragment()
q = fmt.Sprintf(q, scopeFragment, scopeFragment)
args := pgx.StrictNamedArgs{
"id": c.ID,
"new_rank": c.Rank,
"trust_center_id": c.TrustCenterID,
"updated_at": c.UpdatedAt,
}
maps.Copy(args, scope.SQLArguments())
_, err := conn.Exec(ctx, q, args)
if err != nil {
return fmt.Errorf("cannot update compliance framework rank: %w", err)
}
return nil
}
func (c *ComplianceFramework) Delete(
ctx context.Context,
conn pg.Conn,
scope Scoper,
) error {
q := `
DELETE FROM
compliance_frameworks
WHERE
%s
AND id = @id;
`
q = fmt.Sprintf(q, scope.SQLFragment())
args := pgx.StrictNamedArgs{"id": c.ID}
maps.Copy(args, scope.SQLArguments())
_, err := conn.Exec(ctx, q, args)
if err != nil {
return fmt.Errorf("cannot delete compliance framework: %w", err)
}
return nil
}
func (c *ComplianceFrameworks) LoadByTrustCenterID(
ctx context.Context,
conn pg.Conn,
scope Scoper,
trustCenterID gid.GID,
cursor *page.Cursor[ComplianceFrameworkOrderField],
) error {
q := `
SELECT
id,
organization_id,
trust_center_id,
framework_id,
rank,
'PUBLIC' AS visibility,
created_at,
updated_at
FROM
compliance_frameworks
WHERE
%s
AND trust_center_id = @trust_center_id
AND %s
`
q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
args := pgx.NamedArgs{"trust_center_id": trustCenterID}
maps.Copy(args, scope.SQLArguments())
maps.Copy(args, cursor.SQLArguments())
rows, err := conn.Query(ctx, q, args)
if err != nil {
return fmt.Errorf("cannot query compliance_frameworks: %w", err)
}
results, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ComplianceFramework])
if err != nil {
return fmt.Errorf("cannot collect compliance frameworks: %w", err)
}
*c = results
return nil
}
func (c *ComplianceFrameworks) LoadWithHiddenByTrustCenterID(
ctx context.Context,
conn pg.Conn,
scope Scoper,
trustCenterID gid.GID,
cursor *page.Cursor[ComplianceFrameworkOrderField],
) error {
q := `
WITH combined AS (
SELECT
COALESCE(cf.id, f.id) AS id,
COALESCE(cf.organization_id, tc.organization_id) AS organization_id,
COALESCE(cf.trust_center_id, tc.id) AS trust_center_id,
f.id AS framework_id,
CASE
WHEN cf.id IS NOT NULL THEN cf.rank
ELSE COALESCE(MAX(cf.rank) OVER (), 0) + ROW_NUMBER() OVER (PARTITION BY (cf.id IS NULL) ORDER BY f.created_at)
END AS rank,
CASE WHEN cf.id IS NULL THEN 'NONE' ELSE 'PUBLIC' END AS visibility,
COALESCE(cf.created_at, f.created_at) AS created_at,
COALESCE(cf.updated_at, f.updated_at) AS updated_at
FROM trust_centers tc
JOIN frameworks f
ON f.organization_id = tc.organization_id
AND f.tenant_id = @tenant_id
LEFT JOIN compliance_frameworks cf
ON cf.framework_id = f.id
AND cf.trust_center_id = tc.id
AND cf.tenant_id = @tenant_id
WHERE tc.id = @trust_center_id
AND tc.tenant_id = @tenant_id
)
SELECT id, organization_id, trust_center_id, framework_id, rank, visibility, created_at, updated_at
FROM combined
WHERE %s
`
q = fmt.Sprintf(q, cursor.SQLFragment())
args := pgx.NamedArgs{"trust_center_id": trustCenterID}
maps.Copy(args, scope.SQLArguments())
maps.Copy(args, cursor.SQLArguments())
rows, err := conn.Query(ctx, q, args)
if err != nil {
return fmt.Errorf("cannot query compliance frameworks with hidden: %w", err)
}
results, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ComplianceFramework])
if err != nil {
return fmt.Errorf("cannot collect compliance frameworks with hidden: %w", err)
}
*c = results
return nil
}
func (c *ComplianceFrameworks) CountByTrustCenterID(
ctx context.Context,
conn pg.Conn,
scope Scoper,
trustCenterID gid.GID,
) (int, error) {
q := `
SELECT
COUNT(*)
FROM
compliance_frameworks
WHERE
%s
AND trust_center_id = @trust_center_id
`
q = fmt.Sprintf(q, scope.SQLFragment())
args := pgx.StrictNamedArgs{"trust_center_id": trustCenterID}
maps.Copy(args, scope.SQLArguments())
var count int
err := conn.QueryRow(ctx, q, args).Scan(&count)
if err != nil {
return 0, fmt.Errorf("cannot count compliance frameworks: %w", err)
}
return count, nil
}

48
pkg/coredata/compliance_framework_order_field.go Normal file
View File

@@ -0,0 +1,48 @@
// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package coredata
type (
ComplianceFrameworkOrderField string
)
const (
ComplianceFrameworkOrderFieldCreatedAt ComplianceFrameworkOrderField = "CREATED_AT"
ComplianceFrameworkOrderFieldRank ComplianceFrameworkOrderField = "RANK"
)
func (p ComplianceFrameworkOrderField) Column() string {
switch p {
case ComplianceFrameworkOrderFieldCreatedAt:
return "created_at"
case ComplianceFrameworkOrderFieldRank:
return "rank"
default:
return string(p)
}
}
func (p ComplianceFrameworkOrderField) String() string {
return string(p)
}
func (p ComplianceFrameworkOrderField) MarshalText() ([]byte, error) {
return []byte(p.String()), nil
}
func (p *ComplianceFrameworkOrderField) UnmarshalText(text []byte) error {
*p = ComplianceFrameworkOrderField(text)
return nil
}

26
pkg/coredata/compliance_framework_visibility.go Normal file
View File

@@ -0,0 +1,26 @@
// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package coredata
type ComplianceFrameworkVisibility string
const (
ComplianceFrameworkVisibilityNone ComplianceFrameworkVisibility = "NONE"
ComplianceFrameworkVisibilityPublic ComplianceFrameworkVisibility = "PUBLIC"
)
func (v ComplianceFrameworkVisibility) String() string {
return string(v)
}

3
pkg/coredata/entity_type_reg.go
View File

@@ -85,6 +85,7 @@ const (
ElectronicSignatureEntityType uint16 = 59
ElectronicSignatureEventEntityType uint16 = 60
EmailAttachmentEntityType uint16 = 61
ComplianceFrameworkEntityType uint16 = 62
)
func NewEntityFromID(id gid.GID) (any, bool) {
@@ -209,6 +210,8 @@ func NewEntityFromID(id gid.GID) (any, bool) {
return &ElectronicSignatureEvent{ID: id}, true
case EmailAttachmentEntityType:
return &EmailAttachment{ID: id}, true
case ComplianceFrameworkEntityType:
return &ComplianceFramework{ID: id}, true
default:
return nil, false
}

2
pkg/coredata/framework.go
View File

@@ -47,7 +47,7 @@ type (
func (f *Framework) CursorKey(orderBy FrameworkOrderField) page.CursorKey {
switch orderBy {
case FrameworkOrderFieldCreatedAt:
return page.CursorKey{ID: f.ID, Value: f.CreatedAt}
return page.NewCursorKey(f.ID, f.CreatedAt)
}
panic(fmt.Sprintf("unsupported order by: %s", orderBy))

54
pkg/coredata/migrations/20260302T120000Z.sql Normal file
View File

@@ -0,0 +1,54 @@
CREATE TABLE compliance_frameworks (
id TEXT NOT NULL PRIMARY KEY,
tenant_id TEXT NOT NULL,
organization_id TEXT NOT NULL REFERENCES organizations(id) ON UPDATE CASCADE ON DELETE CASCADE,
trust_center_id TEXT NOT NULL REFERENCES trust_centers(id) ON UPDATE CASCADE ON DELETE CASCADE,
framework_id TEXT NOT NULL REFERENCES frameworks(id) ON UPDATE CASCADE ON DELETE CASCADE,
rank INTEGER NOT NULL,
created_at TIMESTAMP WITH TIME ZONE NOT NULL,
updated_at TIMESTAMP WITH TIME ZONE NOT NULL,
UNIQUE (trust_center_id, framework_id)
);
ALTER TABLE compliance_frameworks
ADD CONSTRAINT compliance_frameworks_trust_center_id_rank_key
UNIQUE (trust_center_id, rank)
DEFERRABLE INITIALLY DEFERRED;
INSERT INTO compliance_frameworks (
id,
tenant_id,
organization_id,
trust_center_id,
framework_id,
rank,
created_at,
updated_at
)
WITH distinct_frameworks AS (
SELECT DISTINCT
a.tenant_id,
a.organization_id,
a.framework_id
FROM audits a
WHERE a.trust_center_visibility IN ('PRIVATE', 'PUBLIC')
AND EXISTS (
SELECT 1 FROM trust_centers tc
WHERE tc.organization_id = a.organization_id
)
)
SELECT
generate_gid(decode_base64_unpadded(df.tenant_id), 62),
df.tenant_id,
df.organization_id,
tc.id AS trust_center_id,
df.framework_id,
ROW_NUMBER() OVER (
PARTITION BY df.organization_id
ORDER BY f.created_at ASC, df.framework_id ASC
) AS rank,
NOW(),
NOW()
FROM distinct_frameworks df
JOIN trust_centers tc ON tc.organization_id = df.organization_id
JOIN frameworks f ON f.id = df.framework_id;