rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SOA as document: replace export with publish workflow

Browse Source 
Statements of Applicability are no longer exported as one-off PDFs.
Instead, each SOA owns a persistent document that accumulates versions
over time, following the same publish/approve lifecycle as authored
documents.

Publishing without approvers publishes immediately; publishing with
approvers creates a draft pending approval via the existing quorum
system. SOAs can also store default approvers that are pre-populated in
the publish dialog.

The SOA is removed from the snapshot system — applicability statements
are now queried directly (snapshot_id IS NULL) rather than through
snapshot copies.

A standalone migration script (cmd/migrate-soa-snapshots-to-documents)
converts existing SOA snapshots into documents with proper ProseMirror
content, preserving version history and approval decisions.

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
This commit is contained in:
Sacha Al Himdani
2026-04-10 13:38:42 +02:00
parent 53edc5ba26
commit c635492f75
74 changed files with 3509 additions and 1595 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
apps/console/src/pages/organizations/documents/DocumentLayout.tsx
View File

@@ -67,6 +67,7 @@ export const documentLayoutQuery = graphql`
... on Document {
id
status
writeMode
canPublish: permission(action: "core:document-version:publish")
...PublishDialog_documentFragment
controlInfo: controls(first: 0) {
@@ -146,6 +147,7 @@ export function DocumentLayout(props: { queryRef: PreloadedQuery<DocumentLayoutQ
const isPendingApproval = currentVersion.status === "PENDING_APPROVAL";
const isDraft = currentVersion.status === "DRAFT";
const isPublished = currentVersion.status === "PUBLISHED";
const isGenerated = document.writeMode === "GENERATED";
const isEditable = isLatestVersion && !isPendingApproval;
const lastQuorum = currentVersion.approvalQuorums?.edges?.[0]?.node ?? null;
const hasApprovals = lastQuorum != null;
@@ -223,11 +225,12 @@ export function DocumentLayout(props: { queryRef: PreloadedQuery<DocumentLayoutQ
fKey={currentVersion}
documentId={document.id}
documentStatus={document.status}
isEditable={isEditable}
isEditable={isEditable && !isGenerated}
onDocumentUpdated={handleDocumentUpdated}
/>
)}
>
{isGenerated && <Badge variant="neutral">{__("Generated")}</Badge>}
<Badge
variant={currentVersion.status === "PUBLISHED" ? "success" : currentVersion.status === "PENDING_APPROVAL" ? "warning" : "highlight"}
>
@@ -239,6 +242,8 @@ export function DocumentLayout(props: { queryRef: PreloadedQuery<DocumentLayoutQ
documentFragmentRef={document}
versionFragmentRef={currentVersion}
isEditable={isEditable}
isGenerated={isGenerated}
isLatestVersion={isLatestVersion}
onDocumentUpdated={handleDocumentUpdated}
/>

125
apps/console/src/pages/organizations/documents/_components/DocumentDetailsCard.tsx
View File

@@ -124,9 +124,18 @@ export function DocumentDetailsCard(props: {
documentFragmentRef: DocumentDetailsCard_documentFragment$key;
versionFragmentRef: DocumentDetailsCard_versionFragment$key;
isEditable: boolean;
isGenerated?: boolean;
isLatestVersion?: boolean;
onDocumentUpdated: () => void;
}) {
const { documentFragmentRef, versionFragmentRef, isEditable, onDocumentUpdated } = props;
const {
documentFragmentRef,
versionFragmentRef,
isEditable,
isGenerated = false,
isLatestVersion = true,
onDocumentUpdated,
} = props;
const { __ } = useTranslate();
const organizationId = useOrganizationId();
@@ -140,6 +149,8 @@ export function DocumentDetailsCard(props: {
const version = useFragment<DocumentDetailsCard_versionFragment$key>(versionFragment, versionFragmentRef);
const canEdit = document.canUpdate && isEditable;
const canEditVersionFields = canEdit && !isGenerated;
const canEditApprovers = document.canUpdate && isLatestVersion;
const { control, handleSubmit, reset } = useFormWithSchema(
schema,
@@ -272,59 +283,6 @@ export function DocumentDetailsCard(props: {
return (
<Card className="space-y-4" padded>
<div className="grid grid-cols-3 gap-4">
<div>
<div className="text-xs text-txt-tertiary font-semibold mb-1">
{__("Approvers")}
</div>
{isEditingApprovers
? (
<div className="flex items-center gap-2">
<div className="flex-1">
<PeopleMultiSelectField
name="approverIds"
control={approversControl}
organizationId={organizationId}
selectedPeople={document.defaultApprovers.map(a => ({
id: a.id,
fullName: a.fullName,
emailAddress: a.emailAddress,
}))}
placeholder={__("Add approvers...")}
/>
</div>
<Button
variant="quaternary"
icon={IconCheckmark1}
onClick={() => void handleApproversSubmit(handleUpdateApprovers)()}
disabled={isUpdatingApprovers}
/>
<Button
variant="quaternary"
icon={IconCrossLargeX}
onClick={() => {
setIsEditingApprovers(false);
resetApprovers({ approverIds: document.defaultApprovers.map(a => a.id) });
}}
/>
</div>
)
: (
<div className="flex items-center gap-2">
<div className="text-sm text-txt-primary">
{document.defaultApprovers.length > 0
? document.defaultApprovers.map(a => a.fullName).join(", ")
: __("None")}
</div>
{canEdit && (
<Button
variant="quaternary"
icon={IconPencil}
onClick={() => setIsEditingApprovers(true)}
/>
)}
</div>
)}
</div>
<div>
<div className="text-xs text-txt-tertiary font-semibold mb-1">
{__("Type")}
@@ -362,7 +320,7 @@ export function DocumentDetailsCard(props: {
<div className="text-sm text-txt-primary">
{getDocumentTypeLabel(__, version.documentType)}
</div>
{canEdit && (
{canEditVersionFields && (
<Button
variant="quaternary"
icon={IconPencil}
@@ -409,7 +367,7 @@ export function DocumentDetailsCard(props: {
<div className="text-sm text-txt-primary">
{getDocumentClassificationLabel(__, version.classification)}
</div>
{canEdit && (
{canEditVersionFields && (
<Button
variant="quaternary"
icon={IconPencil}
@@ -419,6 +377,61 @@ export function DocumentDetailsCard(props: {
</div>
)}
</div>
{isLatestVersion && (
<div>
<div className="text-xs text-txt-tertiary font-semibold mb-1">
{__("Approvers")}
</div>
{isEditingApprovers
? (
<div className="flex items-center gap-2">
<div className="flex-1">
<PeopleMultiSelectField
name="approverIds"
control={approversControl}
organizationId={organizationId}
selectedPeople={document.defaultApprovers.map(a => ({
id: a.id,
fullName: a.fullName,
emailAddress: a.emailAddress,
}))}
placeholder={__("Add approvers...")}
/>
</div>
<Button
variant="quaternary"
icon={IconCheckmark1}
onClick={() => void handleApproversSubmit(handleUpdateApprovers)()}
disabled={isUpdatingApprovers}
/>
<Button
variant="quaternary"
icon={IconCrossLargeX}
onClick={() => {
setIsEditingApprovers(false);
resetApprovers({ approverIds: document.defaultApprovers.map(a => a.id) });
}}
/>
</div>
)
: (
<div className="flex items-center gap-2">
<div className="text-sm text-txt-primary">
{document.defaultApprovers.length > 0
? document.defaultApprovers.map(a => a.fullName).join(", ")
: __("None")}
</div>
{canEditApprovers && (
<Button
variant="quaternary"
icon={IconPencil}
onClick={() => setIsEditingApprovers(true)}
/>
)}
</div>
)}
</div>
)}
</div>
<div className="grid grid-cols-3 gap-4">
<div>

47
apps/console/src/pages/organizations/documents/_components/DocumentList.tsx
View File

@@ -12,7 +12,7 @@
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
import { documentClassifications, documentTypes, getDocumentClassificationLabel, getDocumentTypeLabel, sprintf } from "@probo/helpers";
import { documentClassifications, documentTypes, documentWriteModes, getDocumentClassificationLabel, getDocumentTypeLabel, getDocumentWriteModeLabel, sprintf } from "@probo/helpers";
import { useList } from "@probo/hooks";
import { useTranslate } from "@probo/i18n";
import { Button, Card, Checkbox, IconArchive, IconArrowDown, IconCrossLargeX, IconSignature, IconTrashCan, IconUpload, Option, Select, Tbody, Th, Thead, Tr, useConfirm } from "@probo/ui";
@@ -23,7 +23,7 @@ import { ConnectionHandler, graphql } from "relay-runtime";
import type { DocumentListBulkArchiveMutation } from "#/__generated__/core/DocumentListBulkArchiveMutation.graphql";
import type { DocumentListBulkUnarchiveMutation } from "#/__generated__/core/DocumentListBulkUnarchiveMutation.graphql";
import type { DocumentListFragment$key } from "#/__generated__/core/DocumentListFragment.graphql";
import type { DocumentClassification, DocumentOrderField, DocumentsListQuery, DocumentType } from "#/__generated__/core/DocumentsListQuery.graphql";
import type { DocumentClassification, DocumentOrderField, DocumentsListQuery, DocumentType, DocumentWriteMode } from "#/__generated__/core/DocumentsListQuery.graphql";
import { BulkExportDialog, type BulkExportDialogRef } from "#/components/documents/BulkExportDialog";
import { type Order, SortableTable, SortableTh } from "#/components/SortableTable";
import { useBulkDeleteDocumentsMutation, useBulkExportDocumentsMutation } from "#/hooks/graph/DocumentGraph";
@@ -50,6 +50,7 @@ const fragment = graphql`
status: { type: "[DocumentStatus!]", defaultValue: [ACTIVE] }
documentTypes: { type: "[DocumentType!]", defaultValue: null }
classifications: { type: "[DocumentClassification!]", defaultValue: null }
writeModes: { type: "[DocumentWriteMode!]", defaultValue: null }
) {
documents(
first: $first
@@ -57,7 +58,7 @@ const fragment = graphql`
last: $last
before: $before
orderBy: $order
filter: { status: $status documentTypes: $documentTypes classifications: $classifications }
filter: { status: $status documentTypes: $documentTypes classifications: $classifications writeModes: $writeModes }
) @connection(key: "DocumentsListQuery_documents" filters: ["orderBy", "filter"]) {
__id
edges {
@@ -130,6 +131,7 @@ export function DocumentList(props: {
const [documentTypeFilter, setDocumentTypeFilter] = useState<DocumentType | null>(null);
const [classificationFilter, setClassificationFilter] = useState<DocumentClassification | null>(null);
const [writeModeFilter, setWriteModeFilter] = useState<DocumentWriteMode | null>(null);
const [isPending, startTransition] = useTransition();
const refetch = pagination.refetch;
@@ -140,11 +142,12 @@ export function DocumentList(props: {
status: [tab],
documentTypes: documentTypeFilter ? [documentTypeFilter] : null,
classifications: classificationFilter ? [classificationFilter] : null,
writeModes: writeModeFilter ? [writeModeFilter] : null,
},
{ fetchPolicy: "store-and-network" },
);
});
}, [tab, refetch, documentTypeFilter, classificationFilter]);
}, [tab, refetch, documentTypeFilter, classificationFilter, writeModeFilter]);
const documents = pagination.data.documents.edges.map(({ node }) => node);
const connectionId = pagination.data.documents.__id;
@@ -194,6 +197,7 @@ export function DocumentList(props: {
status: [tab],
documentTypes: newType ? [newType] : null,
classifications: classificationFilter ? [classificationFilter] : null,
writeModes: writeModeFilter ? [writeModeFilter] : null,
},
},
),
@@ -214,6 +218,28 @@ export function DocumentList(props: {
status: [tab],
documentTypes: documentTypeFilter ? [documentTypeFilter] : null,
classifications: newClassification ? [newClassification] : null,
writeModes: writeModeFilter ? [writeModeFilter] : null,
},
},
),
);
};
const handleWriteModeFilterChange = (value: string) => {
const newWriteMode = value === "ALL" ? null : (value as DocumentWriteMode);
clear();
setWriteModeFilter(newWriteMode);
onConnectionIdChange(
ConnectionHandler.getConnectionID(
organizationId,
"DocumentsListQuery_documents",
{
orderBy: { direction: "ASC", field: "TITLE" },
filter: {
status: [tab],
documentTypes: documentTypeFilter ? [documentTypeFilter] : null,
classifications: classificationFilter ? [classificationFilter] : null,
writeModes: newWriteMode ? [newWriteMode] : null,
},
},
),
@@ -297,6 +323,7 @@ export function DocumentList(props: {
status: [tab],
documentTypes: documentTypeFilter ? [documentTypeFilter] : null,
classifications: classificationFilter ? [classificationFilter] : null,
writeModes: writeModeFilter ? [writeModeFilter] : null,
},
},
),
@@ -309,12 +336,24 @@ export function DocumentList(props: {
status: [tab],
documentTypes: documentTypeFilter ? [documentTypeFilter] : null,
classifications: classificationFilter ? [classificationFilter] : null,
writeModes: writeModeFilter ? [writeModeFilter] : null,
});
};
return (
<div className="space-y-4">
<div className="flex items-center gap-4">
<Select
value={writeModeFilter ?? "ALL"}
onValueChange={handleWriteModeFilterChange}
>
<Option value="ALL">{__("All sources")}</Option>
{documentWriteModes.map(source => (
<Option key={source} value={source}>
{getDocumentWriteModeLabel(__, source) ?? source}
</Option>
))}
</Select>
<Select
value={documentTypeFilter ?? "ALL"}
onValueChange={handleDocumentTypeFilterChange}

4
apps/console/src/pages/organizations/documents/description/DocumentDescriptionPage.tsx
View File

@@ -42,6 +42,7 @@ export const documentDescriptionPageQuery = graphql`
... on Document {
id
status
writeMode
canUpdate: permission(action: "core:document:update")
# We use this on /documents/:documentId/description
lastVersion: versions(first: 1 orderBy: { field: CREATED_AT, direction: DESC }) @skip(if: $versionSpecified) {
@@ -146,7 +147,8 @@ export function DocumentDescriptionPage(props: {
const canEdit = isEditable
&& document.canUpdate
&& document.status !== "ARCHIVED";
&& document.status !== "ARCHIVED"
&& document.writeMode !== "GENERATED";
// The editor key must change on explicit actions (delete draft, edit
// title/type) but NOT on auto-save side effects (cursor preservation).

242
apps/console/src/pages/organizations/statements-of-applicability/StatementOfApplicabilityDetailPage.tsx
View File

@@ -12,7 +12,7 @@
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
import { formatDate, formatError, type GraphQLError, promisifyMutation, sprintf, validateSnapshotConsistency } from "@probo/helpers";
import { formatDate, formatError, type GraphQLError, promisifyMutation, sprintf } from "@probo/helpers";
import { usePageTitle } from "@probo/hooks";
import { useTranslate } from "@probo/i18n";
import {
@@ -21,17 +21,18 @@ import {
Button,
Card,
DropdownItem,
IconArrowDown,
IconCheckmark1,
IconCrossLargeX,
IconPageTextLine,
IconPencil,
IconTrashCan,
IconUpload,
Input,
PageHeader,
useConfirm,
useToast,
} from "@probo/ui";
import { Suspense, useState } from "react";
import { useState } from "react";
import {
ConnectionHandler,
graphql,
@@ -39,19 +40,16 @@ import {
useMutation,
usePreloadedQuery,
} from "react-relay";
import { useNavigate, useParams } from "react-router";
import { Link, useNavigate, useParams } from "react-router";
import { z } from "zod";
import type { StatementOfApplicabilityDetailPageDeleteMutation } from "#/__generated__/core/StatementOfApplicabilityDetailPageDeleteMutation.graphql";
import type { StatementOfApplicabilityDetailPageExportMutation } from "#/__generated__/core/StatementOfApplicabilityDetailPageExportMutation.graphql";
import type { StatementOfApplicabilityDetailPageQuery } from "#/__generated__/core/StatementOfApplicabilityDetailPageQuery.graphql";
import type { StatementOfApplicabilityDetailPageUpdateMutation } from "#/__generated__/core/StatementOfApplicabilityDetailPageUpdateMutation.graphql";
import { PeopleSelectField } from "#/components/form/PeopleSelectField";
import { SnapshotBanner } from "#/components/SnapshotBanner";
import { useFormWithSchema } from "#/hooks/useFormWithSchema";
import { useMutationWithToasts } from "#/hooks/useMutationWithToasts";
import { useOrganizationId } from "#/hooks/useOrganizationId";
import { PublishStatementOfApplicabilityDialog } from "./dialogs/PublishStatementOfApplicabilityDialog";
import StatementOfApplicabilityControlsTab from "./tabs/StatementOfApplicabilityControlsTab";
export const statementOfApplicabilityDetailPageQuery = graphql`
@@ -60,32 +58,23 @@ export const statementOfApplicabilityDetailPageQuery = graphql`
... on StatementOfApplicability {
id
name
snapshotId
createdAt
updatedAt
document {
id
defaultApprovers {
id
}
}
canUpdate: permission(action: "core:statement-of-applicability:update")
canDelete: permission(action: "core:statement-of-applicability:delete")
canExport: permission(action: "core:statement-of-applicability:export")
owner {
id
fullName
}
canPublish: permission(action: "core:statement-of-applicability:publish")
...StatementOfApplicabilityControlsTabFragment
}
}
}
`;
const exportMutation = graphql`
mutation StatementOfApplicabilityDetailPageExportMutation(
$input: ExportStatementOfApplicabilityPDFInput!
) {
exportStatementOfApplicabilityPDF(input: $input) {
data
}
}
`;
const updateMutation = graphql`
mutation StatementOfApplicabilityDetailPageUpdateMutation(
$input: UpdateStatementOfApplicabilityInput!
@@ -94,14 +83,8 @@ const updateMutation = graphql`
statementOfApplicability {
id
name
sourceId
snapshotId
createdAt
updatedAt
owner {
id
fullName
}
}
}
}
@@ -125,16 +108,14 @@ type Props = {
};
export default function StatementOfApplicabilityDetailPage(props: Props) {
const { statementOfApplicabilityId, snapshotId } = useParams<{
const { statementOfApplicabilityId } = useParams<{
statementOfApplicabilityId: string;
snapshotId?: string;
}>();
const organizationId = useOrganizationId();
const data = usePreloadedQuery(statementOfApplicabilityDetailPageQuery, props.queryRef);
const statementOfApplicability = data.node;
const { __ } = useTranslate();
const navigate = useNavigate();
const isSnapshotMode = Boolean(snapshotId);
const confirm = useConfirm();
const { toast } = useToast();
@@ -144,12 +125,9 @@ export default function StatementOfApplicabilityDetailPage(props: Props) {
);
}
validateSnapshotConsistency(statementOfApplicability, snapshotId);
const connectionId = ConnectionHandler.getConnectionID(
organizationId,
StatementOfApplicabilityConnectionKey,
{ filter: { snapshotId: snapshotId ?? null } },
);
const [deleteStatementOfApplicability]
@@ -196,60 +174,16 @@ export default function StatementOfApplicabilityDetailPage(props: Props) {
usePageTitle(statementOfApplicability.name || __("Statement of Applicability"));
const [isEditingName, setIsEditingName] = useState(false);
const [isEditingOwner, setIsEditingOwner] = useState(false);
const [updateStatementOfApplicability, isUpdating]
= useMutationWithToasts<StatementOfApplicabilityDetailPageUpdateMutation>(
updateMutation,
{
successMessage: __("Statement of Applicability updated successfully."),
errorMessage: __("Failed to update Statement of Applicability"),
},
);
= useMutation<StatementOfApplicabilityDetailPageUpdateMutation>(updateMutation);
const canUpdate = !isSnapshotMode && statementOfApplicability.canUpdate;
const canDelete = !isSnapshotMode && statementOfApplicability.canDelete;
const [exportStatementOfApplicabilityPDF, isExporting]
= useMutationWithToasts<StatementOfApplicabilityDetailPageExportMutation>(
exportMutation,
{
successMessage: __(
"Statement of Applicability exported successfully.",
),
errorMessage: __("Failed to export Statement of Applicability"),
},
);
const handleExport = async () => {
if (!statementOfApplicability.id) return;
await exportStatementOfApplicabilityPDF({
variables: {
input: {
statementOfApplicabilityId: statementOfApplicability.id,
},
},
onCompleted: (data) => {
if (data.exportStatementOfApplicabilityPDF?.data) {
const link = window.document.createElement("a");
link.href = data.exportStatementOfApplicabilityPDF.data;
link.download = `${statementOfApplicability.name || "statement-of-applicability"}.pdf`;
window.document.body.appendChild(link);
link.click();
window.document.body.removeChild(link);
}
},
});
};
const canUpdate = statementOfApplicability.canUpdate;
const canDelete = statementOfApplicability.canDelete;
const nameSchema = z.object({
name: z.string().min(1, __("Name is required")),
});
const ownerSchema = z.object({
ownerId: z.string().min(1, __("Owner is required")),
});
const {
register: registerName,
handleSubmit: handleSubmitName,
@@ -260,46 +194,34 @@ export default function StatementOfApplicabilityDetailPage(props: Props) {
},
});
const {
control: controlOwner,
handleSubmit: handleSubmitOwner,
reset: resetOwner,
} = useFormWithSchema(ownerSchema, {
defaultValues: {
ownerId: statementOfApplicability.owner?.id || "",
},
});
const handleUpdateName = handleSubmitName(async (data) => {
const handleUpdateName = handleSubmitName((data) => {
if (!statementOfApplicability.id) return;
await updateStatementOfApplicability({
updateStatementOfApplicability({
variables: {
input: {
id: statementOfApplicability.id,
name: data.name,
},
},
onSuccess: () => {
onCompleted() {
toast({
title: __("Success"),
description: __("Statement of Applicability updated successfully."),
variant: "success",
});
setIsEditingName(false);
resetName({ name: data.name });
},
});
});
const handleUpdateOwner = handleSubmitOwner(async (data) => {
if (!statementOfApplicability.id) return;
await updateStatementOfApplicability({
variables: {
input: {
id: statementOfApplicability.id,
ownerId: data.ownerId,
},
},
onSuccess: () => {
setIsEditingOwner(false);
resetOwner({ ownerId: data.ownerId });
onError(error) {
toast({
title: __("Error"),
description: formatError(
__("Failed to update Statement of Applicability"),
error as GraphQLError,
),
variant: "error",
});
},
});
});
@@ -311,20 +233,12 @@ export default function StatementOfApplicabilityDetailPage(props: Props) {
});
};
const handleCancelOwnerEdit = () => {
setIsEditingOwner(false);
resetOwner({
ownerId: statementOfApplicability.owner?.id || "",
});
};
const defaultApproverIds = (statementOfApplicability.document?.defaultApprovers ?? []).map(a => a.id);
const listUrl = snapshotId
? `/organizations/${organizationId}/snapshots/${snapshotId}/statements-of-applicability`
: `/organizations/${organizationId}/statements-of-applicability`;
const listUrl = `/organizations/${organizationId}/statements-of-applicability`;
return (
<div className="space-y-6">
{snapshotId && <SnapshotBanner snapshotId={snapshotId} />}
<Breadcrumb
items={[
{
@@ -385,16 +299,33 @@ export default function StatementOfApplicabilityDetailPage(props: Props) {
)
}
>
{statementOfApplicability.canExport && (
<Button
variant="secondary"
icon={IconArrowDown}
onClick={() => void handleExport()}
disabled={isExporting}
>
{__("Export")}
{statementOfApplicability.document?.id && (
<Button variant="secondary" asChild>
<Link
to={`/organizations/${organizationId}/documents/${statementOfApplicability.document.id}`}
>
<IconPageTextLine size={16} />
{__("Document")}
</Link>
</Button>
)}
{statementOfApplicability.canPublish && statementOfApplicability.id && (
<PublishStatementOfApplicabilityDialog
statementOfApplicabilityId={statementOfApplicability.id}
defaultApproverIds={defaultApproverIds}
onPublished={(documentId) => {
void navigate(
`/organizations/${organizationId}/documents/${documentId}`,
);
}}
>
<Button
icon={IconUpload}
>
{__("Publish")}
</Button>
</PublishStatementOfApplicabilityDialog>
)}
{canDelete && (
<ActionDropdown variant="secondary">
<DropdownItem
@@ -412,56 +343,6 @@ export default function StatementOfApplicabilityDetailPage(props: Props) {
<div className="space-y-4">
<h2 className="text-base font-medium">{__("Details")}</h2>
<Card className="space-y-4" padded>
<div className="grid grid-cols-2 gap-4">
<div>
<div className="text-xs text-txt-tertiary font-semibold mb-1">
{__("Owner")}
</div>
{isEditingOwner && canUpdate
? (
<div className="flex items-center gap-2">
<Suspense
fallback={
<div>{__("Loading...")}</div>
}
>
<PeopleSelectField
organizationId={organizationId}
control={controlOwner}
name="ownerId"
/>
</Suspense>
<Button
variant="quaternary"
icon={IconCheckmark1}
onClick={() => void handleUpdateOwner()}
disabled={isUpdating}
/>
<Button
variant="quaternary"
icon={IconCrossLargeX}
onClick={handleCancelOwnerEdit}
/>
</div>
)
: (
<div className="flex items-center gap-2">
<div className="text-sm text-txt-primary">
{statementOfApplicability.owner
?.fullName || "-"}
</div>
{canUpdate && (
<Button
variant="quaternary"
icon={IconPencil}
onClick={() =>
setIsEditingOwner(true)}
/>
)}
</div>
)}
</div>
</div>
<div className="grid grid-cols-2 gap-4">
<div>
<div className="text-xs text-txt-tertiary font-semibold mb-1">
@@ -494,7 +375,6 @@ export default function StatementOfApplicabilityDetailPage(props: Props) {
id: string;
}
}
isSnapshotMode={isSnapshotMode}
/>
</div>
)}

23
apps/console/src/pages/organizations/statements-of-applicability/StatementsOfApplicabilityPage.tsx
View File

@@ -25,19 +25,16 @@ import {
Thead,
Tr,
} from "@probo/ui";
import { useEffect } from "react";
import {
graphql,
type PreloadedQuery,
usePaginationFragment,
usePreloadedQuery,
} from "react-relay";
import { useParams } from "react-router";
import type { StatementsOfApplicabilityPageFragment$key } from "#/__generated__/core/StatementsOfApplicabilityPageFragment.graphql";
import type { StatementsOfApplicabilityPagePaginationQuery } from "#/__generated__/core/StatementsOfApplicabilityPagePaginationQuery.graphql";
import type { StatementsOfApplicabilityPageQuery } from "#/__generated__/core/StatementsOfApplicabilityPageQuery.graphql";
import { SnapshotBanner } from "#/components/SnapshotBanner";
import { StatementOfApplicabilityRow } from "./_components/StatementOfApplicabilityRow";
import { CreateStatementOfApplicabilityDialog } from "./dialogs/CreateStatementOfApplicabilityDialog";
@@ -67,7 +64,6 @@ const paginatedFragment = graphql`
after: { type: "CursorKey", defaultValue: null }
before: { type: "CursorKey", defaultValue: null }
last: { type: "Int", defaultValue: null }
filter: { type: "StatementOfApplicabilityFilter", defaultValue: { snapshotId: null } }
) {
statementsOfApplicability(
first: $first
@@ -75,8 +71,7 @@ const paginatedFragment = graphql`
last: $last
before: $before
orderBy: $order
filter: $filter
) @connection(key: "StatementsOfApplicabilityPage_statementsOfApplicability", filters: ["filter"]) {
) @connection(key: "StatementsOfApplicabilityPage_statementsOfApplicability") {
__id
edges {
node {
@@ -94,8 +89,6 @@ export default function StatementsOfApplicabilityPage({
queryRef: PreloadedQuery<StatementsOfApplicabilityPageQuery>;
}) {
const { __ } = useTranslate();
const { snapshotId } = useParams<{ snapshotId?: string }>();
const isSnapshotMode = Boolean(snapshotId);
usePageTitle(__("Statements of Applicability"));
@@ -109,33 +102,21 @@ export default function StatementsOfApplicabilityPage({
data: { statementsOfApplicability },
loadNext,
hasNext,
refetch,
isLoadingNext,
} = usePaginationFragment<
StatementsOfApplicabilityPagePaginationQuery,
StatementsOfApplicabilityPageFragment$key
>(paginatedFragment, organization);
useEffect(() => {
if (snapshotId) {
refetch(
{ filter: { snapshotId } },
{ fetchPolicy: "store-or-network" },
);
}
}, [snapshotId, refetch]);
return (
<div className="space-y-6">
{snapshotId && <SnapshotBanner snapshotId={snapshotId} />}
<PageHeader
title={__("Statements of Applicability")}
description={__(
"Manage statements of applicability for your organization's frameworks.",
)}
>
{!isSnapshotMode
&& organization.canCreateStatementOfApplicability && (
{organization.canCreateStatementOfApplicability && (
<CreateStatementOfApplicabilityDialog
connectionId={statementsOfApplicability.__id}
>

9
apps/console/src/pages/organizations/statements-of-applicability/_components/StatementOfApplicabilityRow.tsx
View File

@@ -24,7 +24,6 @@ import {
useToast,
} from "@probo/ui";
import { useFragment, useMutation } from "react-relay";
import { useParams } from "react-router";
import { graphql } from "relay-runtime";
import type { StatementOfApplicabilityRowDeleteMutation } from "#/__generated__/core/StatementOfApplicabilityRowDeleteMutation.graphql";
@@ -62,13 +61,11 @@ type Props = {
export function StatementOfApplicabilityRow({ fKey, connectionId }: Props) {
const { __ } = useTranslate();
const organizationId = useOrganizationId();
const { snapshotId } = useParams<{ snapshotId?: string }>();
const confirm = useConfirm();
const { toast } = useToast();
const isSnapshotMode = Boolean(snapshotId);
const statementOfApplicability = useFragment(fragment, fKey);
const canDelete = !isSnapshotMode && statementOfApplicability.canDelete;
const canDelete = statementOfApplicability.canDelete;
const [deleteStatementOfApplicability] = useMutation<StatementOfApplicabilityRowDeleteMutation>(deleteMutation);
@@ -106,9 +103,7 @@ export function StatementOfApplicabilityRow({ fKey, connectionId }: Props) {
);
};
const detailUrl = snapshotId
? `/organizations/${organizationId}/snapshots/${snapshotId}/statements-of-applicability/${statementOfApplicability.id}`
: `/organizations/${organizationId}/statements-of-applicability/${statementOfApplicability.id}`;
const detailUrl = `/organizations/${organizationId}/statements-of-applicability/${statementOfApplicability.id}`;
return (
<Tr to={detailUrl}>

56
apps/console/src/pages/organizations/statements-of-applicability/dialogs/CreateStatementOfApplicabilityDialog.tsx
View File

@@ -12,6 +12,7 @@
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
import { formatError, type GraphQLError } from "@probo/helpers";
import { useTranslate } from "@probo/i18n";
import {
Breadcrumb,
@@ -21,17 +22,16 @@ import {
DialogFooter,
Field,
useDialogRef,
useToast,
} from "@probo/ui";
import type { ReactNode } from "react";
import { Suspense } from "react";
import { graphql } from "react-relay";
import { useMutation } from "react-relay";
import { useNavigate } from "react-router";
import { graphql } from "relay-runtime";
import { z } from "zod";
import type { CreateStatementOfApplicabilityDialogMutation } from "#/__generated__/core/CreateStatementOfApplicabilityDialogMutation.graphql";
import { PeopleSelectField } from "#/components/form/PeopleSelectField";
import { useFormWithSchema } from "#/hooks/useFormWithSchema";
import { useMutationWithToasts } from "#/hooks/useMutationWithToasts";
import { useOrganizationId } from "#/hooks/useOrganizationId";
const createMutation = graphql`
@@ -44,8 +44,6 @@ const createMutation = graphql`
node {
id
name
sourceId
snapshotId
createdAt
updatedAt
canDelete: permission(action: "core:statement-of-applicability:delete")
@@ -63,7 +61,6 @@ type Props = {
const schema = z.object({
name: z.string().min(1),
ownerId: z.string().min(1),
});
export function CreateStatementOfApplicabilityDialog({
@@ -71,41 +68,37 @@ export function CreateStatementOfApplicabilityDialog({
connectionId,
}: Props) {
const { __ } = useTranslate();
const { toast } = useToast();
const organizationId = useOrganizationId();
const navigate = useNavigate();
const { control, register, handleSubmit, reset } = useFormWithSchema(
const { register, handleSubmit, reset } = useFormWithSchema(
schema,
{
defaultValues: {
name: "",
ownerId: "",
},
},
);
const ref = useDialogRef();
const [createStatementOfApplicability, isCreating]
= useMutationWithToasts<CreateStatementOfApplicabilityDialogMutation>(
createMutation,
{
successMessage: __(
"Statement of applicability created successfully.",
),
errorMessage: __("Failed to create statement of applicability"),
},
);
= useMutation<CreateStatementOfApplicabilityDialogMutation>(createMutation);
const onSubmit = async (data: z.infer<typeof schema>) => {
await createStatementOfApplicability({
const onSubmit = (data: z.infer<typeof schema>) => {
createStatementOfApplicability({
variables: {
input: {
name: data.name,
organizationId,
ownerId: data.ownerId,
},
connections: [connectionId],
},
onCompleted: (response) => {
onCompleted(response) {
toast({
title: __("Success"),
description: __("Statement of applicability created successfully."),
variant: "success",
});
reset();
ref.current?.close();
const statementOfApplicabilityId
@@ -115,6 +108,16 @@ export function CreateStatementOfApplicabilityDialog({
`/organizations/${organizationId}/statements-of-applicability/${statementOfApplicabilityId}`,
);
},
onError(error) {
toast({
title: __("Error"),
description: formatError(
__("Failed to create statement of applicability"),
error as GraphQLError,
),
variant: "error",
});
},
});
};
@@ -139,15 +142,6 @@ export function CreateStatementOfApplicabilityDialog({
type="text"
required
/>
<Field label={__("Owner")}>
<Suspense fallback={<div>{__("Loading...")}</div>}>
<PeopleSelectField
organizationId={organizationId}
control={control}
name="ownerId"
/>
</Suspense>
</Field>
</DialogContent>
<DialogFooter>
<Button disabled={isCreating} type="submit">

161
apps/console/src/pages/organizations/statements-of-applicability/dialogs/PublishStatementOfApplicabilityDialog.tsx Normal file
View File

@@ -0,0 +1,161 @@
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
import { formatError, type GraphQLError } from "@probo/helpers";
import { useTranslate } from "@probo/i18n";
import {
Button,
Dialog,
DialogContent,
DialogFooter,
IconSend,
IconUpload,
useDialogRef,
useToast,
} from "@probo/ui";
import type { ReactNode } from "react";
import { useMemo } from "react";
import { useMutation } from "react-relay";
import { graphql } from "relay-runtime";
import { z } from "zod";
import type { PublishStatementOfApplicabilityDialogMutation } from "#/__generated__/core/PublishStatementOfApplicabilityDialogMutation.graphql";
import { PeopleMultiSelectField } from "#/components/form/PeopleMultiSelectField";
import { useFormWithSchema } from "#/hooks/useFormWithSchema";
import { useOrganizationId } from "#/hooks/useOrganizationId";
const publishMutation = graphql`
mutation PublishStatementOfApplicabilityDialogMutation(
$input: PublishStatementOfApplicabilityInput!
) {
publishStatementOfApplicability(input: $input) {
documentEdge {
node {
id
}
}
}
}
`;
type Props = {
children: ReactNode;
statementOfApplicabilityId: string;
defaultApproverIds?: string[];
onPublished?: (documentId: string) => void;
};
export function PublishStatementOfApplicabilityDialog({
children,
statementOfApplicabilityId,
defaultApproverIds = [],
onPublished,
}: Props) {
const { __ } = useTranslate();
const { toast } = useToast();
const organizationId = useOrganizationId();
const dialogRef = useDialogRef();
const schema = useMemo(() => z.object({
approverIds: z.array(z.string()),
}), []);
const {
control,
handleSubmit,
reset,
watch,
} = useFormWithSchema(schema, {
defaultValues: {
approverIds: defaultApproverIds,
},
});
const [publish, isPublishing]
= useMutation<PublishStatementOfApplicabilityDialogMutation>(publishMutation);
const approverIds = watch("approverIds");
const hasApprovers = approverIds.length > 0;
const onSubmit = (data: z.infer<typeof schema>) => {
publish({
variables: {
input: {
statementOfApplicabilityId,
approverIds: data.approverIds.length > 0 ? data.approverIds : undefined,
},
},
onCompleted(response) {
const documentId = response.publishStatementOfApplicability?.documentEdge?.node?.id;
if (documentId) {
toast({
title: __("Success"),
description: hasApprovers
? __("Approval requested successfully.")
: __("Statement of Applicability published successfully."),
variant: "success",
});
dialogRef.current?.close();
reset();
onPublished?.(documentId);
}
},
onError(error) {
toast({
title: __("Error"),
description: formatError(
__("Failed to publish Statement of Applicability"),
error as GraphQLError,
),
variant: "error",
});
},
});
};
return (
<Dialog
className="max-w-xl"
ref={dialogRef}
trigger={children}
title={__("Publish Statement of Applicability")}
>
<form onSubmit={e => void handleSubmit(onSubmit)(e)}>
<DialogContent padded>
<div className="space-y-4">
<p className="text-sm text-txt-secondary">
{__("Select approvers to request approval before publishing, or publish directly without approvers.")}
</p>
<PeopleMultiSelectField
name="approverIds"
label={__("Approvers")}
control={control}
organizationId={organizationId}
placeholder={__("Add approvers...")}
/>
</div>
</DialogContent>
<DialogFooter>
<Button
type="submit"
icon={hasApprovers ? IconSend : IconUpload}
disabled={isPublishing}
>
{hasApprovers ? __("Request approval") : __("Publish")}
</Button>
</DialogFooter>
</form>
</Dialog>
);
}

11
apps/console/src/pages/organizations/statements-of-applicability/tabs/StatementOfApplicabilityControlsTab.tsx
View File

@@ -117,12 +117,10 @@ const deleteApplicabilityStatementMutation = graphql`
export default function StatementOfApplicabilityControlsTab({
statementOfApplicability,
isSnapshotMode = false,
}: {
statementOfApplicability: StatementOfApplicabilityControlsTabFragment$key & {
id: string;
};
isSnapshotMode?: boolean;
}) {
const { __ } = useTranslate();
const data = useFragment(controlsFragment, statementOfApplicability);
@@ -166,12 +164,9 @@ export default function StatementOfApplicabilityControlsTab({
},
);
const canCreate
= !isSnapshotMode && data.canCreateApplicabilityStatement;
const canUpdate
= !isSnapshotMode && data.canUpdateApplicabilityStatement;
const canDelete
= !isSnapshotMode && data.canDeleteApplicabilityStatement;
const canCreate = data.canCreateApplicabilityStatement;
const canUpdate = data.canUpdateApplicabilityStatement;
const canDelete = data.canDeleteApplicabilityStatement;
const handleOpenAddStatementDialog = () => {
if (!data.organization || !connectionId) return;

14
apps/console/src/routes/statementsOfApplicabilityRoutes.ts
View File

@@ -25,13 +25,6 @@ export const statementsOfApplicabilityRoutes = [
() => import("#/pages/organizations/statements-of-applicability/StatementsOfApplicabilityPageLoader"),
),
},
{
path: "snapshots/:snapshotId/statements-of-applicability",
Fallback: PageSkeleton,
Component: lazy(
() => import("#/pages/organizations/statements-of-applicability/StatementsOfApplicabilityPageLoader"),
),
},
{
path: "statements-of-applicability/:statementOfApplicabilityId",
Fallback: PageSkeleton,
@@ -39,11 +32,4 @@ export const statementsOfApplicabilityRoutes = [
() => import("#/pages/organizations/statements-of-applicability/StatementOfApplicabilityDetailPageLoader"),
),
},
{
path: "snapshots/:snapshotId/statements-of-applicability/:statementOfApplicabilityId",
Fallback: PageSkeleton,
Component: lazy(
() => import("#/pages/organizations/statements-of-applicability/StatementOfApplicabilityDetailPageLoader"),
),
},
] satisfies AppRoute[];

538
cmd/migrate-soa-snapshots-to-documents/main.go Normal file
View File

@@ -0,0 +1,538 @@
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
// Command migrate-soa-snapshots-to-documents creates documents, document
// versions, approval quorums, and approval decisions from existing SOA
// snapshots. For each snapshot it generates the ProseMirror content using
// the same builder as the publish flow.
package main
import (
"context"
"flag"
"fmt"
"net/url"
"os"
"time"
"github.com/jackc/pgx/v5"
"go.gearno.de/kit/pg"
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/docgen"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/probo"
)
func main() {
if err := run(); err != nil {
fmt.Fprintf(os.Stderr, "error: %v\n", err)
os.Exit(1)
}
}
func run() error {
var (
pgDSN string
dryRun bool
)
flag.StringVar(
&pgDSN,
"pg-dsn",
os.Getenv("DATABASE_URL"),
"PostgreSQL connection URL (default: DATABASE_URL env)",
)
flag.BoolVar(&dryRun, "dry-run", false, "show what would be done without writing")
flag.Parse()
if pgDSN == "" {
return fmt.Errorf("set -pg-dsn or DATABASE_URL")
}
ctx := context.Background()
pgClient, err := newPgClientFromDSN(pgDSN)
if err != nil {
return fmt.Errorf("cannot create pg client: %w", err)
}
return pgClient.WithTx(ctx, func(ctx context.Context, tx pg.Tx) error {
return migrate(ctx, tx, dryRun)
})
}
type originalSOA struct {
id string
tenantID gid.TenantID
organizationID gid.GID
name string
ownerProfileID *string
}
type snapshotSOA struct {
id string
snapshotID string
ownerProfileID *string
publishedAt time.Time
}
func migrate(ctx context.Context, tx pg.Tx, dryRun bool) error {
originals, err := loadOriginalSOAs(ctx, tx)
if err != nil {
return err
}
if len(originals) == 0 {
fmt.Println("no SOAs with snapshots to migrate")
return nil
}
var stats struct {
documents, versions, quorums, decisions, defaultApprovers int
}
for _, orig := range originals {
snapshots, err := loadSnapshots(ctx, tx, orig.id)
if err != nil {
return err
}
if dryRun {
fmt.Printf("would migrate SOA %s (%s) — %d snapshot(s)\n", orig.id, orig.name, len(snapshots))
continue
}
documentID := gid.New(orig.tenantID, coredata.DocumentEntityType)
now := time.Now()
_, err = tx.Exec(
ctx,
`
INSERT INTO documents (
id, tenant_id, organization_id, write_mode,
current_published_major, current_published_minor,
trust_center_visibility, status, created_at, updated_at
) VALUES (
@id, @tenant_id, @organization_id,
'GENERATED'::document_write_mode,
@current_published_major, 0,
'NONE'::trust_center_visibility,
'ACTIVE'::document_status,
@created_at, @updated_at
)`,
pgx.NamedArgs{
"id": documentID,
"tenant_id": orig.tenantID,
"organization_id": orig.organizationID,
"current_published_major": len(snapshots),
"created_at": now,
"updated_at": now,
},
)
if err != nil {
return fmt.Errorf("cannot insert document for SOA %s: %w", orig.id, err)
}
stats.documents++
_, err = tx.Exec(
ctx,
`UPDATE statements_of_applicability SET document_id = @document_id WHERE id = @id`,
pgx.NamedArgs{
"document_id": documentID,
"id": orig.id,
},
)
if err != nil {
return fmt.Errorf("cannot link document to SOA %s: %w", orig.id, err)
}
if orig.ownerProfileID != nil {
_, err = tx.Exec(
ctx,
`
INSERT INTO document_default_approvers (
document_id, approver_profile_id, tenant_id, organization_id, created_at, updated_at
) VALUES (
@document_id, @approver_profile_id, @tenant_id, @organization_id, @created_at, @created_at
)`,
pgx.NamedArgs{
"document_id": documentID,
"approver_profile_id": *orig.ownerProfileID,
"tenant_id": orig.tenantID,
"organization_id": orig.organizationID,
"created_at": now,
},
)
if err != nil {
return fmt.Errorf("cannot insert default approver for SOA %s: %w", orig.id, err)
}
stats.defaultApprovers++
}
for major, snap := range snapshots {
content, err := buildSnapshotContent(ctx, tx, snap.id, orig.name)
if err != nil {
return fmt.Errorf("cannot build content for snapshot %s of SOA %s: %w", snap.snapshotID, orig.id, err)
}
versionID := gid.New(orig.tenantID, coredata.DocumentVersionEntityType)
_, err = tx.Exec(
ctx,
`
INSERT INTO document_versions (
id, tenant_id, organization_id, document_id,
title, major, minor, classification, document_type,
content, changelog, status, orientation,
published_at, created_at, updated_at
) VALUES (
@id, @tenant_id, @organization_id, @document_id,
@title, @major, 0,
'CONFIDENTIAL'::document_classification,
'STATEMENT_OF_APPLICABILITY'::document_type,
@content, '',
'PUBLISHED'::document_version_status,
'LANDSCAPE'::document_version_orientation,
@published_at, @published_at, @published_at
)`,
pgx.NamedArgs{
"id": versionID,
"tenant_id": orig.tenantID,
"organization_id": orig.organizationID,
"document_id": documentID,
"title": orig.name,
"major": major + 1,
"content": content,
"published_at": snap.publishedAt,
},
)
if err != nil {
return fmt.Errorf("cannot insert version for snapshot %s: %w", snap.snapshotID, err)
}
stats.versions++
if snap.ownerProfileID != nil {
quorumID := gid.New(orig.tenantID, coredata.DocumentVersionApprovalQuorumEntityType)
_, err = tx.Exec(
ctx,
`
INSERT INTO document_version_approval_quorums (
id, tenant_id, organization_id, version_id, status, created_at, updated_at
) VALUES (
@id, @tenant_id, @organization_id, @version_id,
'APPROVED'::document_version_approval_quorum_status,
@created_at, @created_at
)`,
pgx.NamedArgs{
"id": quorumID,
"tenant_id": orig.tenantID,
"organization_id": orig.organizationID,
"version_id": versionID,
"created_at": snap.publishedAt,
},
)
if err != nil {
return fmt.Errorf("cannot insert quorum for snapshot %s: %w", snap.snapshotID, err)
}
stats.quorums++
decisionID := gid.New(orig.tenantID, coredata.DocumentVersionApprovalDecisionEntityType)
_, err = tx.Exec(
ctx,
`
INSERT INTO document_version_approval_decisions (
id, tenant_id, organization_id, quorum_id,
approver_id, state, decided_at, created_at, updated_at
) VALUES (
@id, @tenant_id, @organization_id, @quorum_id,
@approver_id,
'APPROVED'::document_version_approval_decision_state,
@decided_at, @decided_at, @decided_at
)`,
pgx.NamedArgs{
"id": decisionID,
"tenant_id": orig.tenantID,
"organization_id": orig.organizationID,
"quorum_id": quorumID,
"approver_id": *snap.ownerProfileID,
"decided_at": snap.publishedAt,
},
)
if err != nil {
return fmt.Errorf("cannot insert decision for snapshot %s: %w", snap.snapshotID, err)
}
stats.decisions++
}
}
fmt.Printf("migrated SOA %s (%s) — %d version(s)\n", orig.id, orig.name, len(snapshots))
}
if dryRun {
fmt.Printf("\n%d SOA(s) would be migrated\n", len(originals))
return nil
}
fmt.Printf("\ncreated %d document(s), %d version(s), %d quorum(s), %d decision(s), %d default approver(s)\n",
stats.documents, stats.versions, stats.quorums, stats.decisions, stats.defaultApprovers)
return nil
}
func loadOriginalSOAs(ctx context.Context, tx pg.Tx) ([]originalSOA, error) {
rows, err := tx.Query(
ctx,
`
SELECT
soa.id,
soa.tenant_id,
soa.organization_id,
soa.name,
soa.owner_profile_id
FROM statements_of_applicability soa
WHERE soa.snapshot_id IS NULL
AND soa.document_id IS NULL
AND EXISTS (
SELECT 1 FROM statements_of_applicability snap
WHERE snap.source_id = soa.id AND snap.snapshot_id IS NOT NULL
)
ORDER BY soa.created_at;
`,
)
if err != nil {
return nil, fmt.Errorf("cannot query original SOAs: %w", err)
}
defer rows.Close()
var result []originalSOA
for rows.Next() {
var o originalSOA
if err := rows.Scan(&o.id, &o.tenantID, &o.organizationID, &o.name, &o.ownerProfileID); err != nil {
return nil, fmt.Errorf("cannot scan original SOA: %w", err)
}
result = append(result, o)
}
return result, rows.Err()
}
func loadSnapshots(ctx context.Context, tx pg.Tx, originalSOAID string) ([]snapshotSOA, error) {
rows, err := tx.Query(
ctx,
`
SELECT
snap.id,
snap.snapshot_id,
snap.owner_profile_id,
snap_record.created_at
FROM statements_of_applicability snap
JOIN snapshots snap_record ON snap_record.id = snap.snapshot_id
WHERE snap.source_id = @source_id
AND snap.snapshot_id IS NOT NULL
ORDER BY snap_record.created_at ASC;
`,
pgx.NamedArgs{"source_id": originalSOAID},
)
if err != nil {
return nil, fmt.Errorf("cannot query snapshots for SOA %s: %w", originalSOAID, err)
}
defer rows.Close()
var result []snapshotSOA
for rows.Next() {
var s snapshotSOA
if err := rows.Scan(&s.id, &s.snapshotID, &s.ownerProfileID, &s.publishedAt); err != nil {
return nil, fmt.Errorf("cannot scan snapshot: %w", err)
}
result = append(result, s)
}
return result, rows.Err()
}
type snapshotControl struct {
frameworkName string
sectionTitle string
controlName string
applicability bool
justification *string
bestPractice bool
implemented string
notImplementedJustification *string
hasLegal bool
hasContractual bool
hasRisk bool
}
func buildSnapshotContent(ctx context.Context, tx pg.Tx, snapshotSOAID string, soaName string) (string, error) {
rows, err := tx.Query(
ctx,
`
WITH control_risks_via_measures AS (
SELECT DISTINCT cm.control_id
FROM controls_measures cm
INNER JOIN risks_measures rm ON cm.measure_id = rm.measure_id
),
control_risks_via_documents AS (
SELECT DISTINCT cd.control_id
FROM controls_documents cd
INNER JOIN risks_documents rd ON cd.document_id = rd.document_id
),
control_risks AS (
SELECT control_id FROM control_risks_via_measures
UNION
SELECT control_id FROM control_risks_via_documents
)
SELECT
f.name AS framework_name,
c.section_title,
c.name AS control_name,
stmt.applicability,
stmt.justification,
c.best_practice,
c.implemented,
c.not_implemented_justification,
EXISTS (
SELECT 1 FROM controls_obligations co
JOIN obligations o ON o.id = co.obligation_id
WHERE co.control_id = c.id AND o.type = 'LEGAL'
) AS has_legal,
EXISTS (
SELECT 1 FROM controls_obligations co
JOIN obligations o ON o.id = co.obligation_id
WHERE co.control_id = c.id AND o.type = 'CONTRACTUAL'
) AS has_contractual,
EXISTS (
SELECT 1 FROM control_risks cr WHERE cr.control_id = c.id
) AS has_risk
FROM applicability_statements stmt
JOIN controls c ON c.id = stmt.control_id
JOIN frameworks f ON f.id = c.framework_id
WHERE stmt.statement_of_applicability_id = @soa_id
ORDER BY f.name, c.section_title;
`,
pgx.NamedArgs{"soa_id": snapshotSOAID},
)
if err != nil {
return "", fmt.Errorf("cannot load snapshot controls: %w", err)
}
defer rows.Close()
var soaRows []docgen.SOARow
for rows.Next() {
var sc snapshotControl
if err := rows.Scan(
&sc.frameworkName,
&sc.sectionTitle,
&sc.controlName,
&sc.applicability,
&sc.justification,
&sc.bestPractice,
&sc.implemented,
&sc.notImplementedJustification,
&sc.hasLegal,
&sc.hasContractual,
&sc.hasRisk,
); err != nil {
return "", fmt.Errorf("cannot scan control: %w", err)
}
applicable := sc.applicability
justification := "-"
if !applicable && sc.justification != nil {
justification = *sc.justification
}
implemented := "-"
if applicable {
if sc.implemented == "IMPLEMENTED" {
implemented = "Yes"
} else {
implemented = "No"
}
}
notImplJustification := "-"
if applicable && sc.implemented != "IMPLEMENTED" && sc.notImplementedJustification != nil {
notImplJustification = *sc.notImplementedJustification
}
regulatory := "-"
contractual := "-"
bestPractice := "-"
riskAssessment := "-"
if applicable {
regulatory = docgen.BoolLabel(sc.hasLegal)
contractual = docgen.BoolLabel(sc.hasContractual)
bestPractice = docgen.BoolLabel(sc.bestPractice)
riskAssessment = docgen.BoolLabel(sc.hasRisk)
}
soaRows = append(soaRows, docgen.SOARow{
FrameworkName: sc.frameworkName,
ControlSection: sc.sectionTitle,
ControlName: sc.controlName,
Applicability: docgen.BoolLabel(applicable),
Justification: justification,
Implemented: implemented,
NotImplJustification: notImplJustification,
Regulatory: regulatory,
Contractual: contractual,
BestPractice: bestPractice,
RiskAssessment: riskAssessment,
})
}
if err := rows.Err(); err != nil {
return "", err
}
data := docgen.StatementOfApplicabilityData{
Title: soaName,
TotalControls: len(soaRows),
Rows: soaRows,
}
return probo.BuildStatementOfApplicabilityDocument(data)
}
func newPgClientFromDSN(dsn string) (*pg.Client, error) {
u, err := url.Parse(dsn)
if err != nil {
return nil, fmt.Errorf("cannot parse DSN")
}
var opts []pg.Option
if u.Host != "" {
opts = append(opts, pg.WithAddr(u.Host))
}
if u.User != nil {
opts = append(opts, pg.WithUser(u.User.Username()))
if password, ok := u.User.Password(); ok {
opts = append(opts, pg.WithPassword(password))
}
}
if len(u.Path) > 1 {
opts = append(opts, pg.WithDatabase(u.Path[1:]))
}
return pg.NewClient(opts...)
}

475
e2e/console/statement_of_applicability_test.go Normal file
View File

@@ -0,0 +1,475 @@
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package console_test
import (
"testing"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"go.probo.inc/probo/e2e/internal/factory"
"go.probo.inc/probo/e2e/internal/testutil"
)
func TestStatementOfApplicability_Create(t *testing.T) {
t.Parallel()
owner := testutil.NewClient(t, testutil.RoleOwner)
t.Run(
"create a statement of applicability",
func(t *testing.T) {
t.Parallel()
const query = `
mutation($input: CreateStatementOfApplicabilityInput!) {
createStatementOfApplicability(input: $input) {
statementOfApplicabilityEdge {
node {
id
name
createdAt
updatedAt
}
}
}
}
`
name := factory.SafeName("SOA")
var result struct {
CreateStatementOfApplicability struct {
StatementOfApplicabilityEdge struct {
Node struct {
ID string `json:"id"`
Name string `json:"name"`
CreatedAt string `json:"createdAt"`
UpdatedAt string `json:"updatedAt"`
} `json:"node"`
} `json:"statementOfApplicabilityEdge"`
} `json:"createStatementOfApplicability"`
}
err := owner.Execute(
query,
map[string]any{
"input": map[string]any{
"organizationId": owner.GetOrganizationID().String(),
"name": name,
},
},
&result,
)
require.NoError(t, err)
node := result.CreateStatementOfApplicability.StatementOfApplicabilityEdge.Node
assert.NotEmpty(t, node.ID)
assert.Equal(t, name, node.Name)
},
)
}
func TestStatementOfApplicability_CreateDocument(t *testing.T) {
t.Parallel()
owner := testutil.NewClient(t, testutil.RoleOwner)
t.Run(
"create document without approvers publishes immediately",
func(t *testing.T) {
t.Parallel()
frameworkID := factory.NewFramework(owner).Create()
controlID := factory.NewControl(owner, frameworkID).Create()
soaID := factory.NewStatementOfApplicability(owner).Create()
factory.CreateApplicabilityStatement(owner, soaID, controlID, true, nil)
const query = `
mutation($input: PublishStatementOfApplicabilityInput!) {
publishStatementOfApplicability(input: $input) {
documentEdge {
node {
id
writeMode
status
}
}
documentVersionEdge {
node {
id
title
documentType
orientation
status
major
minor
content
}
}
}
}
`
var result struct {
PublishStatementOfApplicability struct {
DocumentEdge struct {
Node struct {
ID string `json:"id"`
WriteMode string `json:"writeMode"`
Status string `json:"status"`
} `json:"node"`
} `json:"documentEdge"`
DocumentVersionEdge struct {
Node struct {
ID string `json:"id"`
Title string `json:"title"`
DocumentType string `json:"documentType"`
Orientation string `json:"orientation"`
Status string `json:"status"`
Major int `json:"major"`
Minor int `json:"minor"`
Content string `json:"content"`
} `json:"node"`
} `json:"documentVersionEdge"`
} `json:"publishStatementOfApplicability"`
}
err := owner.Execute(
query,
map[string]any{
"input": map[string]any{
"statementOfApplicabilityId": soaID,
},
},
&result,
)
require.NoError(t, err)
doc := result.PublishStatementOfApplicability.DocumentEdge.Node
assert.NotEmpty(t, doc.ID)
assert.Equal(t, "GENERATED", doc.WriteMode)
assert.Equal(t, "ACTIVE", doc.Status)
ver := result.PublishStatementOfApplicability.DocumentVersionEdge.Node
assert.NotEmpty(t, ver.ID)
assert.Equal(t, "STATEMENT_OF_APPLICABILITY", ver.DocumentType)
assert.Equal(t, "LANDSCAPE", ver.Orientation)
assert.Equal(t, "PUBLISHED", ver.Status)
assert.Equal(t, 1, ver.Major)
assert.Equal(t, 0, ver.Minor)
assert.Contains(t, ver.Content, "Purpose")
},
)
t.Run(
"create document with approvers creates draft with quorum",
func(t *testing.T) {
t.Parallel()
frameworkID := factory.NewFramework(owner).Create()
controlID := factory.NewControl(owner, frameworkID).Create()
soaID := factory.NewStatementOfApplicability(owner).Create()
factory.CreateApplicabilityStatement(owner, soaID, controlID, true, nil)
const query = `
mutation($input: PublishStatementOfApplicabilityInput!) {
publishStatementOfApplicability(input: $input) {
documentEdge {
node {
id
writeMode
}
}
documentVersionEdge {
node {
id
status
major
}
}
}
}
`
var result struct {
PublishStatementOfApplicability struct {
DocumentEdge struct {
Node struct {
ID string `json:"id"`
WriteMode string `json:"writeMode"`
} `json:"node"`
} `json:"documentEdge"`
DocumentVersionEdge struct {
Node struct {
ID string `json:"id"`
Status string `json:"status"`
Major int `json:"major"`
} `json:"node"`
} `json:"documentVersionEdge"`
} `json:"publishStatementOfApplicability"`
}
err := owner.Execute(
query,
map[string]any{
"input": map[string]any{
"statementOfApplicabilityId": soaID,
"approverIds": []string{owner.GetProfileID().String()},
},
},
&result,
)
require.NoError(t, err)
doc := result.PublishStatementOfApplicability.DocumentEdge.Node
assert.NotEmpty(t, doc.ID)
assert.Equal(t, "GENERATED", doc.WriteMode)
ver := result.PublishStatementOfApplicability.DocumentVersionEdge.Node
assert.NotEmpty(t, ver.ID)
assert.Equal(t, "PENDING_APPROVAL", ver.Status)
},
)
t.Run(
"creating second document reuses existing document",
func(t *testing.T) {
t.Parallel()
frameworkID := factory.NewFramework(owner).Create()
controlID := factory.NewControl(owner, frameworkID).Create()
soaID := factory.NewStatementOfApplicability(owner).Create()
factory.CreateApplicabilityStatement(owner, soaID, controlID, true, nil)
const query = `
mutation($input: PublishStatementOfApplicabilityInput!) {
publishStatementOfApplicability(input: $input) {
documentEdge {
node { id }
}
documentVersionEdge {
node { id major }
}
}
}
`
var result1, result2 struct {
PublishStatementOfApplicability struct {
DocumentEdge struct {
Node struct {
ID string `json:"id"`
} `json:"node"`
} `json:"documentEdge"`
DocumentVersionEdge struct {
Node struct {
ID string `json:"id"`
Major int `json:"major"`
} `json:"node"`
} `json:"documentVersionEdge"`
} `json:"publishStatementOfApplicability"`
}
input := map[string]any{
"input": map[string]any{
"statementOfApplicabilityId": soaID,
},
}
err := owner.Execute(query, input, &result1)
require.NoError(t, err)
err = owner.Execute(query, input, &result2)
require.NoError(t, err)
doc1 := result1.PublishStatementOfApplicability.DocumentEdge.Node.ID
doc2 := result2.PublishStatementOfApplicability.DocumentEdge.Node.ID
assert.Equal(t, doc1, doc2, "should reuse same document")
ver1Major := result1.PublishStatementOfApplicability.DocumentVersionEdge.Node.Major
ver2Major := result2.PublishStatementOfApplicability.DocumentVersionEdge.Node.Major
assert.Equal(t, 1, ver1Major)
assert.Equal(t, 2, ver2Major)
},
)
t.Run(
"document linked back to SOA",
func(t *testing.T) {
t.Parallel()
frameworkID := factory.NewFramework(owner).Create()
controlID := factory.NewControl(owner, frameworkID).Create()
soaID := factory.NewStatementOfApplicability(owner).Create()
factory.CreateApplicabilityStatement(owner, soaID, controlID, true, nil)
const createQuery = `
mutation($input: PublishStatementOfApplicabilityInput!) {
publishStatementOfApplicability(input: $input) {
documentEdge {
node { id }
}
documentVersionEdge {
node { id }
}
}
}
`
var createResult struct {
PublishStatementOfApplicability struct {
DocumentEdge struct {
Node struct {
ID string `json:"id"`
} `json:"node"`
} `json:"documentEdge"`
DocumentVersionEdge struct {
Node struct {
ID string `json:"id"`
} `json:"node"`
} `json:"documentVersionEdge"`
} `json:"publishStatementOfApplicability"`
}
err := owner.Execute(
createQuery,
map[string]any{
"input": map[string]any{
"statementOfApplicabilityId": soaID,
},
},
&createResult,
)
require.NoError(t, err)
docID := createResult.PublishStatementOfApplicability.DocumentEdge.Node.ID
const soaQuery = `
query($id: ID!) {
node(id: $id) {
... on StatementOfApplicability {
id
document { id }
}
}
}
`
var soaResult struct {
Node struct {
ID string `json:"id"`
Document *struct {
ID string `json:"id"`
} `json:"document"`
} `json:"node"`
}
err = owner.Execute(soaQuery, map[string]any{"id": soaID}, &soaResult)
require.NoError(t, err)
require.NotNil(t, soaResult.Node.Document)
assert.Equal(t, docID, soaResult.Node.Document.ID)
},
)
}
func TestStatementOfApplicability_CreateDocument_RBAC(t *testing.T) {
t.Parallel()
owner := testutil.NewClient(t, testutil.RoleOwner)
viewer := testutil.NewClientInOrg(t, testutil.RoleViewer, owner)
frameworkID := factory.NewFramework(owner).Create()
controlID := factory.NewControl(owner, frameworkID).Create()
soaID := factory.NewStatementOfApplicability(owner).Create()
factory.CreateApplicabilityStatement(owner, soaID, controlID, true, nil)
const query = `
mutation($input: PublishStatementOfApplicabilityInput!) {
publishStatementOfApplicability(input: $input) {
documentEdge {
node { id }
}
documentVersionEdge {
node { id }
}
}
}
`
t.Run(
"viewer cannot create document",
func(t *testing.T) {
t.Parallel()
err := viewer.ExecuteShouldFail(
query,
map[string]any{
"input": map[string]any{
"statementOfApplicabilityId": soaID,
},
},
)
testutil.RequireForbiddenError(t, err)
},
)
}
func TestStatementOfApplicability_TenantIsolation(t *testing.T) {
t.Parallel()
org1Owner := testutil.NewClient(t, testutil.RoleOwner)
org2Owner := testutil.NewClient(t, testutil.RoleOwner)
soaID := factory.NewStatementOfApplicability(org1Owner).Create()
t.Run(
"cannot create document for another org SOA",
func(t *testing.T) {
t.Parallel()
const query = `
mutation($input: PublishStatementOfApplicabilityInput!) {
publishStatementOfApplicability(input: $input) {
documentEdge {
node { id }
}
documentVersionEdge {
node { id }
}
}
}
`
err := org2Owner.ExecuteShouldFail(
query,
map[string]any{
"input": map[string]any{
"statementOfApplicabilityId": soaID,
},
},
)
require.Error(t, err)
},
)
}

89
e2e/internal/factory/factory.go
View File

@@ -1128,3 +1128,92 @@ func (b *AccessReviewCampaignBuilder) WithAccessSourceIDs(ids []string) *AccessR
func (b *AccessReviewCampaignBuilder) Create() string {
return CreateAccessReviewCampaign(b.client, b.organizationID, b.attrs)
}
type StatementOfApplicabilityBuilder struct {
client *testutil.Client
attrs Attrs
}
func NewStatementOfApplicability(c *testutil.Client) *StatementOfApplicabilityBuilder {
return &StatementOfApplicabilityBuilder{client: c, attrs: Attrs{}}
}
func (b *StatementOfApplicabilityBuilder) WithName(name string) *StatementOfApplicabilityBuilder {
b.attrs["name"] = name
return b
}
func (b *StatementOfApplicabilityBuilder) Create() string {
b.client.T.Helper()
a := b.attrs
const query = `
mutation($input: CreateStatementOfApplicabilityInput!) {
createStatementOfApplicability(input: $input) {
statementOfApplicabilityEdge {
node { id }
}
}
}
`
input := map[string]any{
"organizationId": b.client.GetOrganizationID().String(),
"name": a.getString("name", SafeName("SOA")),
}
var result struct {
CreateStatementOfApplicability struct {
StatementOfApplicabilityEdge struct {
Node struct {
ID string `json:"id"`
} `json:"node"`
} `json:"statementOfApplicabilityEdge"`
} `json:"createStatementOfApplicability"`
}
err := b.client.Execute(query, map[string]any{"input": input}, &result)
require.NoError(b.client.T, err, "createStatementOfApplicability mutation failed")
return result.CreateStatementOfApplicability.StatementOfApplicabilityEdge.Node.ID
}
func CreateApplicabilityStatement(c *testutil.Client, soaID, controlID string, applicability bool, justification *string) string {
c.T.Helper()
const query = `
mutation($input: CreateApplicabilityStatementInput!) {
createApplicabilityStatement(input: $input) {
applicabilityStatementEdge {
node { id }
}
}
}
`
input := map[string]any{
"statementOfApplicabilityId": soaID,
"controlId": controlID,
"applicability": applicability,
}
if justification != nil {
input["justification"] = *justification
}
var result struct {
CreateApplicabilityStatement struct {
ApplicabilityStatementEdge struct {
Node struct {
ID string `json:"id"`
} `json:"node"`
} `json:"applicabilityStatementEdge"`
} `json:"createApplicabilityStatement"`
}
err := c.Execute(query, map[string]any{"input": input}, &result)
require.NoError(c.T, err, "createApplicabilityStatement mutation failed")
return result.CreateApplicabilityStatement.ApplicabilityStatementEdge.Node.ID
}

15
packages/helpers/src/documents.ts
View File

@@ -14,7 +14,7 @@
type Translator = (s: string) => string;
export const documentTypes = ["OTHER", "GOVERNANCE", "POLICY", "PROCEDURE", "PLAN", "REGISTER", "RECORD", "REPORT", "TEMPLATE"] as const;
export const documentTypes = ["OTHER", "GOVERNANCE", "POLICY", "PROCEDURE", "PLAN", "REGISTER", "RECORD", "REPORT", "TEMPLATE", "STATEMENT_OF_APPLICABILITY"] as const;
export function getDocumentTypeLabel(__: Translator, type: string) {
switch (type) {
@@ -36,6 +36,19 @@ export function getDocumentTypeLabel(__: Translator, type: string) {
return __("Report");
case "TEMPLATE":
return __("Template");
case "STATEMENT_OF_APPLICABILITY":
return __("Statement of Applicability");
}
}
export const documentWriteModes = ["AUTHORED", "GENERATED"] as const;
export function getDocumentWriteModeLabel(__: Translator, writeMode: string) {
switch (writeMode) {
case "AUTHORED":
return __("Authored");
case "GENERATED":
return __("Generated");
}
}

2
packages/helpers/src/index.ts
View File

@@ -48,6 +48,8 @@ export {
documentTypes,
getDocumentClassificationLabel,
documentClassifications,
documentWriteModes,
getDocumentWriteModeLabel,
} from "./documents";
export { getAssetTypeVariant } from "./assets";
export {

5
packages/helpers/src/snapshots.ts
View File

@@ -22,7 +22,6 @@ export const snapshotTypes = [
"FINDINGS",
"OBLIGATIONS",
"PROCESSING_ACTIVITIES",
"STATEMENTS_OF_APPLICABILITY",
] as const;
export function getSnapshotTypeLabel(__: Translator, type: string | null | undefined) {
@@ -47,8 +46,6 @@ export function getSnapshotTypeLabel(__: Translator, type: string | null | undef
return __("Obligations");
case "PROCESSING_ACTIVITIES":
return __("Processing Activities");
case "STATEMENTS_OF_APPLICABILITY":
return __("Statements of Applicability");
default:
return __("Unknown");
}
@@ -72,8 +69,6 @@ export function getSnapshotTypeUrlPath(type?: string): string {
return "/obligations";
case "PROCESSING_ACTIVITIES":
return "/processing-activities";
case "STATEMENTS_OF_APPLICABILITY":
return "/statements-of-applicability";
default:
return "";
}

5
packages/n8n-node/nodes/Probo/Probo.node.ts
View File

@@ -131,6 +131,11 @@ export class Probo implements INodeType {
value: 'risk',
description: 'Manage risks',
},
{
name: 'Statement of Applicability',
value: 'statementOfApplicability',
description: 'Manage statements of applicability',
},
{
name: 'User',
value: 'user',

45
packages/n8n-node/nodes/Probo/actions/document/getAll.operation.ts
View File

@@ -74,11 +74,17 @@ export const description: INodeProperties[] = [
},
options: [
{
displayName: 'Query',
name: 'query',
type: 'string',
default: '',
description: 'Search query to filter documents',
displayName: 'Classifications',
name: 'classifications',
type: 'multiOptions',
default: [],
description: 'Filter by document classification',
options: [
{ name: 'Confidential', value: 'CONFIDENTIAL' },
{ name: 'Internal', value: 'INTERNAL' },
{ name: 'Public', value: 'PUBLIC' },
{ name: 'Secret', value: 'SECRET' },
],
},
{
displayName: 'Document Types',
@@ -95,21 +101,16 @@ export const description: INodeProperties[] = [
{ name: 'Record', value: 'RECORD' },
{ name: 'Register', value: 'REGISTER' },
{ name: 'Report', value: 'REPORT' },
{ name: 'Statement of Applicability', value: 'STATEMENT_OF_APPLICABILITY' },
{ name: 'Template', value: 'TEMPLATE' },
],
},
{
displayName: 'Classifications',
name: 'classifications',
type: 'multiOptions',
default: [],
description: 'Filter by document classification',
options: [
{ name: 'Confidential', value: 'CONFIDENTIAL' },
{ name: 'Internal', value: 'INTERNAL' },
{ name: 'Public', value: 'PUBLIC' },
{ name: 'Secret', value: 'SECRET' },
],
displayName: 'Query',
name: 'query',
type: 'string',
default: '',
description: 'Search query to filter documents',
},
{
displayName: 'Status',
@@ -122,6 +123,17 @@ export const description: INodeProperties[] = [
{ name: 'Archived', value: 'ARCHIVED' },
],
},
{
displayName: 'Write Modes',
name: 'writeModes',
type: 'multiOptions',
default: [],
description: 'Filter by write mode',
options: [
{ name: 'Authored', value: 'AUTHORED' },
{ name: 'Generated', value: 'GENERATED' },
],
},
],
},
];
@@ -137,6 +149,7 @@ export async function execute(
const filter: IDataObject = {};
if (filters.query) filter.query = filters.query;
if ((filters.writeModes as string[])?.length) filter.writeModes = filters.writeModes;
if ((filters.documentTypes as string[])?.length) filter.documentTypes = filters.documentTypes;
if ((filters.classifications as string[])?.length) filter.classifications = filters.classifications;
filter.status = (filters.status as string[])?.length ? filters.status : ['ACTIVE'];

2
packages/n8n-node/nodes/Probo/actions/index.ts
View File

@@ -25,6 +25,7 @@ import * as meeting from './meeting';
import * as organization from './organization';
import * as user from './user';
import * as risk from './risk';
import * as statementOfApplicability from './statementOfApplicability';
import * as vendor from './vendor';
export interface ResourceModule {
@@ -50,6 +51,7 @@ export const resources: Record<string, ResourceModule> = {
organization: organization as ResourceModule,
user: user as ResourceModule,
risk: risk as ResourceModule,
statementOfApplicability: statementOfApplicability as ResourceModule,
vendor: vendor as ResourceModule,
};

114
packages/n8n-node/nodes/Probo/actions/statementOfApplicability/create.operation.ts Normal file
View File

@@ -0,0 +1,114 @@
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
import type { INodeProperties, IExecuteFunctions, INodeExecutionData } from 'n8n-workflow';
import { proboApiRequest } from '../../GenericFunctions';
export const description: INodeProperties[] = [
{
displayName: 'Organization ID',
name: 'organizationId',
type: 'string',
displayOptions: {
show: {
resource: ['statementOfApplicability'],
operation: ['create'],
},
},
default: '',
description: 'The ID of the organization',
required: true,
},
{
displayName: 'Name',
name: 'name',
type: 'string',
displayOptions: {
show: {
resource: ['statementOfApplicability'],
operation: ['create'],
},
},
default: '',
description: 'The name of the statement of applicability',
required: true,
},
{
displayName: 'Additional Fields',
name: 'additionalFields',
type: 'collection',
placeholder: 'Add Field',
default: {},
displayOptions: {
show: {
resource: ['statementOfApplicability'],
operation: ['create'],
},
},
options: [
{
displayName: 'Default Approver IDs',
name: 'defaultApproverIds',
type: 'string',
default: '',
description: 'Comma-separated list of default approver profile IDs',
},
],
},
];
export async function execute(
this: IExecuteFunctions,
itemIndex: number,
): Promise<INodeExecutionData> {
const organizationId = this.getNodeParameter('organizationId', itemIndex) as string;
const name = this.getNodeParameter('name', itemIndex) as string;
const additionalFields = this.getNodeParameter('additionalFields', itemIndex, {}) as {
defaultApproverIds?: string;
};
const query = `
mutation CreateStatementOfApplicability($input: CreateStatementOfApplicabilityInput!) {
createStatementOfApplicability(input: $input) {
statementOfApplicabilityEdge {
node {
id
name
createdAt
updatedAt
}
}
}
}
`;
const input: Record<string, unknown> = {
organizationId,
name,
};
if (additionalFields.defaultApproverIds) {
input.defaultApproverIds = additionalFields.defaultApproverIds
.split(',')
.map(id => id.trim())
.filter(Boolean);
}
const responseData = await proboApiRequest.call(this, query, { input });
return {
json: responseData,
pairedItem: { item: itemIndex },
};
}

57
packages/n8n-node/nodes/Probo/actions/statementOfApplicability/delete.operation.ts Normal file
View File

@@ -0,0 +1,57 @@
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
import type { INodeProperties, IExecuteFunctions, INodeExecutionData } from 'n8n-workflow';
import { proboApiRequest } from '../../GenericFunctions';
export const description: INodeProperties[] = [
{
displayName: 'Statement of Applicability ID',
name: 'statementOfApplicabilityId',
type: 'string',
displayOptions: {
show: {
resource: ['statementOfApplicability'],
operation: ['delete'],
},
},
default: '',
description: 'The ID of the statement of applicability to delete',
required: true,
},
];
export async function execute(
this: IExecuteFunctions,
itemIndex: number,
): Promise<INodeExecutionData> {
const statementOfApplicabilityId = this.getNodeParameter('statementOfApplicabilityId', itemIndex) as string;
const query = `
mutation DeleteStatementOfApplicability($input: DeleteStatementOfApplicabilityInput!) {
deleteStatementOfApplicability(input: $input) {
deletedStatementOfApplicabilityId
}
}
`;
const responseData = await proboApiRequest.call(this, query, {
input: { statementOfApplicabilityId },
});
return {
json: responseData,
pairedItem: { item: itemIndex },
};
}

62
packages/n8n-node/nodes/Probo/actions/statementOfApplicability/get.operation.ts Normal file
View File

@@ -0,0 +1,62 @@
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
import type { INodeProperties, IExecuteFunctions, INodeExecutionData } from 'n8n-workflow';
import { proboApiRequest } from '../../GenericFunctions';
export const description: INodeProperties[] = [
{
displayName: 'Statement of Applicability ID',
name: 'statementOfApplicabilityId',
type: 'string',
displayOptions: {
show: {
resource: ['statementOfApplicability'],
operation: ['get'],
},
},
default: '',
description: 'The ID of the statement of applicability',
required: true,
},
];
export async function execute(
this: IExecuteFunctions,
itemIndex: number,
): Promise<INodeExecutionData> {
const statementOfApplicabilityId = this.getNodeParameter('statementOfApplicabilityId', itemIndex) as string;
const query = `
query GetStatementOfApplicability($id: ID!) {
node(id: $id) {
... on StatementOfApplicability {
id
name
createdAt
updatedAt
}
}
}
`;
const responseData = await proboApiRequest.call(this, query, {
id: statementOfApplicabilityId,
});
return {
json: responseData,
pairedItem: { item: itemIndex },
};
}

113
packages/n8n-node/nodes/Probo/actions/statementOfApplicability/getAll.operation.ts Normal file
View File

@@ -0,0 +1,113 @@
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
import type { INodeProperties, IExecuteFunctions, INodeExecutionData, IDataObject } from 'n8n-workflow';
import { proboApiRequestAllItems } from '../../GenericFunctions';
export const description: INodeProperties[] = [
{
displayName: 'Organization ID',
name: 'organizationId',
type: 'string',
displayOptions: {
show: {
resource: ['statementOfApplicability'],
operation: ['getAll'],
},
},
default: '',
description: 'The ID of the organization',
required: true,
},
{
displayName: 'Return All',
name: 'returnAll',
type: 'boolean',
displayOptions: {
show: {
resource: ['statementOfApplicability'],
operation: ['getAll'],
},
},
default: false,
description: 'Whether to return all results or only up to a given limit',
},
{
displayName: 'Limit',
name: 'limit',
type: 'number',
displayOptions: {
show: {
resource: ['statementOfApplicability'],
operation: ['getAll'],
returnAll: [false],
},
},
typeOptions: {
minValue: 1,
},
default: 50,
description: 'Max number of results to return',
},
];
export async function execute(
this: IExecuteFunctions,
itemIndex: number,
): Promise<INodeExecutionData> {
const organizationId = this.getNodeParameter('organizationId', itemIndex) as string;
const returnAll = this.getNodeParameter('returnAll', itemIndex) as boolean;
const limit = this.getNodeParameter('limit', itemIndex, 50) as number;
const query = `
query GetStatementsOfApplicability($organizationId: ID!, $first: Int, $after: CursorKey) {
node(id: $organizationId) {
... on Organization {
statementsOfApplicability(first: $first, after: $after) {
edges {
node {
id
name
createdAt
updatedAt
}
}
pageInfo {
hasNextPage
endCursor
}
}
}
}
}
`;
const statementsOfApplicability = await proboApiRequestAllItems.call(
this,
query,
{ organizationId },
(response) => {
const data = response?.data as IDataObject | undefined;
const node = data?.node as IDataObject | undefined;
return node?.statementsOfApplicability as IDataObject | undefined;
},
returnAll,
limit,
);
return {
json: { statementsOfApplicability },
pairedItem: { item: itemIndex },
};
}

89
packages/n8n-node/nodes/Probo/actions/statementOfApplicability/index.ts Normal file
View File

@@ -0,0 +1,89 @@
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
import type { INodeProperties } from 'n8n-workflow';
import * as createOp from './create.operation';
import * as getOp from './get.operation';
import * as getAllOp from './getAll.operation';
import * as updateOp from './update.operation';
import * as deleteOp from './delete.operation';
import * as publishOp from './publish.operation';
export const description: INodeProperties[] = [
{
displayName: 'Operation',
name: 'operation',
type: 'options',
noDataExpression: true,
displayOptions: {
show: {
resource: ['statementOfApplicability'],
},
},
options: [
{
name: 'Create',
value: 'create',
description: 'Create a new statement of applicability',
action: 'Create a statement of applicability',
},
{
name: 'Delete',
value: 'delete',
description: 'Delete a statement of applicability',
action: 'Delete a statement of applicability',
},
{
name: 'Get',
value: 'get',
description: 'Get a statement of applicability',
action: 'Get a statement of applicability',
},
{
name: 'Get Many',
value: 'getAll',
description: 'Get many statements of applicability',
action: 'Get many statements of applicability',
},
{
name: 'Publish',
value: 'publish',
description: 'Publish a statement of applicability as a document version',
action: 'Publish a statement of applicability',
},
{
name: 'Update',
value: 'update',
description: 'Update an existing statement of applicability',
action: 'Update a statement of applicability',
},
],
default: 'create',
},
...createOp.description,
...getOp.description,
...getAllOp.description,
...updateOp.description,
...deleteOp.description,
...publishOp.description,
];
export {
createOp as create,
getOp as get,
getAllOp as getAll,
updateOp as update,
deleteOp as delete,
publishOp as publish,
};

101
packages/n8n-node/nodes/Probo/actions/statementOfApplicability/publish.operation.ts Normal file
View File

@@ -0,0 +1,101 @@
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
import type { INodeProperties, IExecuteFunctions, INodeExecutionData } from 'n8n-workflow';
import { proboApiRequest } from '../../GenericFunctions';
export const description: INodeProperties[] = [
{
displayName: 'Statement of Applicability ID',
name: 'statementOfApplicabilityId',
type: 'string',
displayOptions: {
show: {
resource: ['statementOfApplicability'],
operation: ['publish'],
},
},
default: '',
description: 'The ID of the statement of applicability to publish',
required: true,
},
{
displayName: 'Approver IDs',
name: 'approverIds',
type: 'string',
displayOptions: {
show: {
resource: ['statementOfApplicability'],
operation: ['publish'],
},
},
default: '',
description: 'Comma-separated list of approver profile IDs',
},
];
export async function execute(
this: IExecuteFunctions,
itemIndex: number,
): Promise<INodeExecutionData> {
const statementOfApplicabilityId = this.getNodeParameter('statementOfApplicabilityId', itemIndex) as string;
const approverIds = this.getNodeParameter('approverIds', itemIndex, '') as string;
const query = `
mutation PublishStatementOfApplicability($input: PublishStatementOfApplicabilityInput!) {
publishStatementOfApplicability(input: $input) {
documentEdge {
node {
id
status
currentPublishedMajor
currentPublishedMinor
createdAt
updatedAt
}
}
documentVersionEdge {
node {
id
title
major
minor
status
classification
documentType
publishedAt
createdAt
updatedAt
}
}
}
}
`;
const input: Record<string, unknown> = { statementOfApplicabilityId };
if (approverIds) {
input.approverIds = approverIds
.split(',')
.map(id => id.trim())
.filter(Boolean);
}
const responseData = await proboApiRequest.call(this, query, { input });
return {
json: responseData,
pairedItem: { item: itemIndex },
};
}

102
packages/n8n-node/nodes/Probo/actions/statementOfApplicability/update.operation.ts Normal file
View File

@@ -0,0 +1,102 @@
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
import type { INodeProperties, IExecuteFunctions, INodeExecutionData } from 'n8n-workflow';
import { proboApiRequest } from '../../GenericFunctions';
export const description: INodeProperties[] = [
{
displayName: 'Statement of Applicability ID',
name: 'id',
type: 'string',
displayOptions: {
show: {
resource: ['statementOfApplicability'],
operation: ['update'],
},
},
default: '',
description: 'The ID of the statement of applicability to update',
required: true,
},
{
displayName: 'Update Fields',
name: 'updateFields',
type: 'collection',
placeholder: 'Add Field',
default: {},
displayOptions: {
show: {
resource: ['statementOfApplicability'],
operation: ['update'],
},
},
options: [
{
displayName: 'Name',
name: 'name',
type: 'string',
default: '',
description: 'The name of the statement of applicability',
},
{
displayName: 'Default Approver IDs',
name: 'defaultApproverIds',
type: 'string',
default: '',
description: 'Comma-separated list of default approver profile IDs',
},
],
},
];
export async function execute(
this: IExecuteFunctions,
itemIndex: number,
): Promise<INodeExecutionData> {
const id = this.getNodeParameter('id', itemIndex) as string;
const updateFields = this.getNodeParameter('updateFields', itemIndex, {}) as {
name?: string;
defaultApproverIds?: string;
};
const query = `
mutation UpdateStatementOfApplicability($input: UpdateStatementOfApplicabilityInput!) {
updateStatementOfApplicability(input: $input) {
statementOfApplicability {
id
name
createdAt
updatedAt
}
}
}
`;
const input: Record<string, unknown> = { id };
if (updateFields.name) input.name = updateFields.name;
if (updateFields.defaultApproverIds) {
input.defaultApproverIds = updateFields.defaultApproverIds
.split(',')
.map(id => id.trim())
.filter(Boolean);
}
const responseData = await proboApiRequest.call(this, query, { input });
return {
json: responseData,
pairedItem: { item: itemIndex },
};
}

2
packages/ui/src/RichEditor/RichEditor.tsx
View File

@@ -67,7 +67,7 @@ const extensions = [
];
const richEditorVariants = tv({
base: ["relative flex-1 py-14 pr-8 bg-level-1 shadow-base"],
base: ["relative flex-1 min-w-0 overflow-auto py-14 pr-8 bg-level-1 shadow-base"],
variants: {
disabled: {
true: "pl-8",

4
packages/ui/src/rich-editor.css
View File

@@ -59,7 +59,7 @@
}
table {
@apply border border-border-mid border-collapse;
@apply border border-border-mid border-collapse w-max;
tbody {
@apply border border-border-mid border-collapse;
}
@@ -85,7 +85,7 @@
}
.tableWrapper {
@apply relative overflow-x-auto my-4;
@apply relative overflow-auto my-4 max-h-[70vh];
}
.mermaid-block {

16
pkg/cmd/document/list/list.go
View File

@@ -78,6 +78,7 @@ func NewCmdList(f *cmdutil.Factory) *cobra.Command {
flagOrderBy string
flagOrderDir string
flagQuery string
flagWriteMode string
flagDocumentType string
flagClassification string
flagStatus string
@@ -148,11 +149,21 @@ func NewCmdList(f *cmdutil.Factory) *cobra.Command {
if flagQuery != "" {
filter["query"] = flagQuery
}
if flagWriteMode != "" {
if err := cmdutil.ValidateEnum(
"write-mode",
flagWriteMode,
[]string{"AUTHORED", "GENERATED"},
); err != nil {
return err
}
filter["writeModes"] = []string{flagWriteMode}
}
if flagDocumentType != "" {
if err := cmdutil.ValidateEnum(
"document-type",
flagDocumentType,
[]string{"OTHER", "GOVERNANCE", "POLICY", "PROCEDURE", "PLAN", "REGISTER", "RECORD", "REPORT", "TEMPLATE"},
[]string{"OTHER", "GOVERNANCE", "POLICY", "PROCEDURE", "PLAN", "REGISTER", "RECORD", "REPORT", "TEMPLATE", "STATEMENT_OF_APPLICABILITY"},
); err != nil {
return err
}
@@ -261,7 +272,8 @@ func NewCmdList(f *cmdutil.Factory) *cobra.Command {
cmd.Flags().StringVar(&flagOrderBy, "order-by", "", "Order by field (TITLE, CREATED_AT, UPDATED_AT, DOCUMENT_TYPE)")
cmd.Flags().StringVar(&flagOrderDir, "order-direction", "DESC", "Sort direction (ASC, DESC)")
cmd.Flags().StringVarP(&flagQuery, "query", "q", "", "Search query")
cmd.Flags().StringVar(&flagDocumentType, "document-type", "", "Filter by document type (OTHER, GOVERNANCE, POLICY, PROCEDURE, PLAN, REGISTER, RECORD, REPORT, TEMPLATE)")
cmd.Flags().StringVar(&flagWriteMode, "write-mode", "", "Filter by write mode (AUTHORED, GENERATED)")
cmd.Flags().StringVar(&flagDocumentType, "document-type", "", "Filter by document type (OTHER, GOVERNANCE, POLICY, PROCEDURE, PLAN, REGISTER, RECORD, REPORT, TEMPLATE, STATEMENT_OF_APPLICABILITY)")
cmd.Flags().StringVar(&flagClassification, "classification", "", "Filter by classification (PUBLIC, INTERNAL, CONFIDENTIAL, SECRET)")
cmd.Flags().StringVar(&flagStatus, "status", "", "Filter by status (ACTIVE, ARCHIVED)")
flagOutput = cmdutil.AddOutputFlag(cmd)

137
pkg/cmd/soa/publish/publish.go Normal file
View File

@@ -0,0 +1,137 @@
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package publish
import (
"encoding/json"
"fmt"
"github.com/spf13/cobra"
"go.probo.inc/probo/pkg/cli/api"
"go.probo.inc/probo/pkg/cmd/cmdutil"
)
const publishMutation = `
mutation($input: PublishStatementOfApplicabilityInput!) {
publishStatementOfApplicability(input: $input) {
documentEdge {
node {
id
status
createdAt
}
}
documentVersionEdge {
node {
id
title
major
minor
status
}
}
}
}
`
type publishResponse struct {
PublishStatementOfApplicability struct {
DocumentEdge struct {
Node struct {
ID string `json:"id"`
Status string `json:"status"`
CreatedAt string `json:"createdAt"`
} `json:"node"`
} `json:"documentEdge"`
DocumentVersionEdge struct {
Node struct {
ID string `json:"id"`
Title string `json:"title"`
Major int `json:"major"`
Minor int `json:"minor"`
Status string `json:"status"`
} `json:"node"`
} `json:"documentVersionEdge"`
} `json:"publishStatementOfApplicability"`
}
func NewCmdPublish(f *cmdutil.Factory) *cobra.Command {
var flagApprover []string
cmd := &cobra.Command{
Use: "publish <soa-id>",
Short: "Publish a statement of applicability as a document version",
Example: ` # Publish an SOA
prb soa publish SOA_ID
# Publish with approvers
prb soa publish SOA_ID --approver PROFILE_ID1 --approver PROFILE_ID2`,
Args: cobra.ExactArgs(1),
RunE: func(cmd *cobra.Command, args []string) error {
cfg, err := f.Config()
if err != nil {
return err
}
host, hc, err := cfg.DefaultHost()
if err != nil {
return err
}
client := api.NewClient(
host,
hc.Token,
"/api/console/v1/graphql",
cfg.HTTPTimeoutDuration(),
)
input := map[string]any{
"statementOfApplicabilityId": args[0],
}
if len(flagApprover) > 0 {
input["approverIds"] = flagApprover
}
data, err := client.Do(
publishMutation,
map[string]any{"input": input},
)
if err != nil {
return err
}
var resp publishResponse
if err := json.Unmarshal(data, &resp); err != nil {
return fmt.Errorf("cannot parse response: %w", err)
}
v := resp.PublishStatementOfApplicability.DocumentVersionEdge.Node
_, _ = fmt.Fprintf(
f.IOStreams.Out,
"Published statement of applicability %s (v%d.%d)\n",
v.Title,
v.Major,
v.Minor,
)
return nil
},
}
cmd.Flags().StringArrayVar(&flagApprover, "approver", nil, "Approver profile ID (can be repeated)")
return cmd
}

2
pkg/cmd/soa/soa.go
View File

@@ -20,6 +20,7 @@ import (
"go.probo.inc/probo/pkg/cmd/soa/create"
"go.probo.inc/probo/pkg/cmd/soa/delete"
"go.probo.inc/probo/pkg/cmd/soa/list"
"go.probo.inc/probo/pkg/cmd/soa/publish"
"go.probo.inc/probo/pkg/cmd/soa/statement"
"go.probo.inc/probo/pkg/cmd/soa/update"
"go.probo.inc/probo/pkg/cmd/soa/view"
@@ -36,6 +37,7 @@ func NewCmdSoa(f *cmdutil.Factory) *cobra.Command {
cmd.AddCommand(view.NewCmdView(f))
cmd.AddCommand(update.NewCmdUpdate(f))
cmd.AddCommand(delete.NewCmdDelete(f))
cmd.AddCommand(publish.NewCmdPublish(f))
cmd.AddCommand(statement.NewCmdStatement(f))
return cmd

55
pkg/coredata/applicability_statement.go
View File

@@ -156,7 +156,6 @@ WITH current_soa AS (
WHERE
%s
AND id = @statement_of_applicability_id
AND snapshot_id IS NULL
)
SELECT
soac.id,
@@ -351,7 +350,6 @@ WITH current_soa AS (
WHERE
%s
AND id = @statement_of_applicability_id
AND snapshot_id IS NULL
)
DELETE FROM applicability_statements
WHERE statement_of_applicability_id IN (SELECT id FROM current_soa)
@@ -467,6 +465,57 @@ WHERE
return nil
}
func (sacs *ApplicabilityStatements) LoadAllByStatementOfApplicabilityID(
ctx context.Context,
conn pg.Querier,
scope Scoper,
statementOfApplicabilityID gid.GID,
) error {
q := `
SELECT
a.id,
a.statement_of_applicability_id,
a.control_id,
a.organization_id,
a.snapshot_id,
a.applicability,
a.justification,
a.created_at,
a.updated_at,
f.name || ' - ' || c.section_title AS section_title
FROM
applicability_statements a
INNER JOIN
controls c ON c.id = a.control_id
INNER JOIN
frameworks f ON f.id = c.framework_id
WHERE
a.%s
AND a.statement_of_applicability_id = @statement_of_applicability_id
ORDER BY
section_title ASC;
`
q = fmt.Sprintf(q, scope.SQLFragment())
args := pgx.StrictNamedArgs{
"statement_of_applicability_id": statementOfApplicabilityID,
}
maps.Copy(args, scope.SQLArguments())
rows, err := conn.Query(ctx, q, args)
if err != nil {
return fmt.Errorf("cannot query applicability_statements: %w", err)
}
controls, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ApplicabilityStatement])
if err != nil {
return fmt.Errorf("cannot collect applicability_statements: %w", err)
}
*sacs = controls
return nil
}
func (sacs *ApplicabilityStatements) CountByStatementOfApplicabilityID(
ctx context.Context,
conn pg.Querier,
@@ -484,7 +533,7 @@ WHERE
`
q = fmt.Sprintf(q, scope.SQLFragment())
args := pgx.NamedArgs{"statement_of_applicability_id": statementOfApplicabilityID}
args := pgx.StrictNamedArgs{"statement_of_applicability_id": statementOfApplicabilityID}
maps.Copy(args, scope.SQLArguments())
var count int

50
pkg/coredata/control_obligation.go
View File

@@ -33,6 +33,11 @@ type (
}
ControlObligations []*ControlObligation
ControlObligationType struct {
ControlID gid.GID `db:"control_id"`
ObligationType ObligationType `db:"obligation_type"`
}
)
func (co ControlObligation) Upsert(
@@ -137,3 +142,48 @@ WHERE %s
return count, nil
}
func LoadObligationTypesByControlIDs(
ctx context.Context,
conn pg.Querier,
scope Scoper,
controlIDs []gid.GID,
) ([]ControlObligationType, error) {
q := `
WITH control_obls AS (
SELECT DISTINCT
co.control_id,
o.type AS obligation_type,
o.tenant_id
FROM
controls_obligations co
INNER JOIN
obligations o ON co.obligation_id = o.id
WHERE
co.control_id = ANY(@control_ids)
)
SELECT
control_id,
obligation_type
FROM
control_obls
WHERE
%s;
`
q = fmt.Sprintf(q, scope.SQLFragment())
args := pgx.StrictNamedArgs{"control_ids": controlIDs}
maps.Copy(args, scope.SQLArguments())
rows, err := conn.Query(ctx, q, args)
if err != nil {
return nil, fmt.Errorf("cannot load obligation types by control IDs: %w", err)
}
result, err := pgx.CollectRows(rows, pgx.RowToStructByName[ControlObligationType])
if err != nil {
return nil, fmt.Errorf("cannot collect control obligation types: %w", err)
}
return result, nil
}

13
pkg/coredata/document.go
View File

@@ -35,6 +35,7 @@ type (
CurrentPublishedMajor *int `db:"current_published_major"`
CurrentPublishedMinor *int `db:"current_published_minor"`
TrustCenterVisibility TrustCenterVisibility `db:"trust_center_visibility"`
WriteMode DocumentWriteMode `db:"write_mode"`
Status DocumentStatus `db:"status"`
ArchivedAt *time.Time `db:"archived_at"`
CreatedAt time.Time `db:"created_at"`
@@ -102,6 +103,7 @@ SELECT
documents.organization_id,
documents.current_published_major,
documents.current_published_minor,
documents.write_mode,
documents.trust_center_visibility,
documents.status,
documents.archived_at,
@@ -161,6 +163,7 @@ SELECT
documents.organization_id,
documents.current_published_major,
documents.current_published_minor,
documents.write_mode,
documents.trust_center_visibility,
documents.status,
documents.archived_at,
@@ -221,6 +224,7 @@ SELECT
documents.organization_id,
documents.current_published_major,
documents.current_published_minor,
documents.write_mode,
documents.trust_center_visibility,
documents.status,
documents.archived_at,
@@ -311,6 +315,7 @@ base AS (
documents.organization_id,
documents.current_published_major,
documents.current_published_minor,
documents.write_mode,
documents.trust_center_visibility,
documents.status,
documents.archived_at,
@@ -370,6 +375,7 @@ SELECT
documents.organization_id,
documents.current_published_major,
documents.current_published_minor,
documents.write_mode,
documents.trust_center_visibility,
documents.status,
documents.archived_at,
@@ -443,6 +449,7 @@ base AS (
documents.organization_id,
documents.current_published_major,
documents.current_published_minor,
documents.write_mode,
documents.trust_center_visibility,
documents.status,
documents.archived_at,
@@ -497,6 +504,7 @@ INSERT INTO
organization_id,
current_published_major,
current_published_minor,
write_mode,
trust_center_visibility,
status,
archived_at,
@@ -509,6 +517,7 @@ VALUES (
@organization_id,
@current_published_major,
@current_published_minor,
@write_mode,
@trust_center_visibility,
@status,
@archived_at,
@@ -523,6 +532,7 @@ VALUES (
"organization_id": p.OrganizationID,
"current_published_major": p.CurrentPublishedMajor,
"current_published_minor": p.CurrentPublishedMinor,
"write_mode": p.WriteMode,
"trust_center_visibility": p.TrustCenterVisibility,
"status": p.Status,
"archived_at": p.ArchivedAt,
@@ -675,6 +685,7 @@ base AS (
sd.current_published_major,
sd.current_published_minor,
sd.trust_center_visibility,
sd.write_mode,
sd.status,
sd.archived_at,
sd.created_at,
@@ -774,6 +785,7 @@ base AS (
sd.current_published_major,
sd.current_published_minor,
sd.trust_center_visibility,
sd.write_mode,
sd.status,
sd.archived_at,
sd.created_at,
@@ -873,6 +885,7 @@ base AS (
sd.current_published_major,
sd.current_published_minor,
sd.trust_center_visibility,
sd.write_mode,
sd.status,
sd.archived_at,
sd.created_at,

21
pkg/coredata/document_filter.go
View File

@@ -28,6 +28,7 @@ type (
employeeFilterModes []EmployeeFilterMode
documentTypes []DocumentType
classifications []DocumentClassification
writeModes []DocumentWriteMode
status []DocumentStatus
}
)
@@ -71,6 +72,11 @@ func (f *DocumentFilter) WithClassifications(classifications []DocumentClassific
return f
}
func (f *DocumentFilter) WithWriteModes(writeModes []DocumentWriteMode) *DocumentFilter {
f.writeModes = writeModes
return f
}
func (f *DocumentFilter) WithStatus(status []DocumentStatus) *DocumentFilter {
f.status = status
return f
@@ -101,6 +107,14 @@ func (f *DocumentFilter) SQLArguments() pgx.NamedArgs {
}
}
var writeModes []string
if f.writeModes != nil {
writeModes = make([]string, len(f.writeModes))
for i, cs := range f.writeModes {
writeModes[i] = cs.String()
}
}
var status []string
if f.status != nil {
status = make([]string, len(f.status))
@@ -122,6 +136,7 @@ func (f *DocumentFilter) SQLArguments() pgx.NamedArgs {
"employee_filter_modes": employeeFilterModes,
"document_types": documentTypes,
"classifications": classifications,
"write_modes": writeModes,
"document_status": status,
}
}
@@ -209,6 +224,12 @@ func (f *DocumentFilter) SQLFragment() string {
ELSE TRUE
END
AND
CASE
WHEN @write_modes::text[] IS NOT NULL THEN
documents.write_mode::text = ANY(@write_modes::text[])
ELSE TRUE
END
AND
CASE
WHEN @document_status::text[] IS NULL THEN TRUE
ELSE status::text = ANY(@document_status::text[])

22
pkg/coredata/document_type.go
View File

@@ -24,15 +24,16 @@ type (
)
const (
DocumentTypeOther DocumentType = "OTHER"
DocumentTypeGovernance DocumentType = "GOVERNANCE"
DocumentTypePolicy DocumentType = "POLICY"
DocumentTypeProcedure DocumentType = "PROCEDURE"
DocumentTypePlan DocumentType = "PLAN"
DocumentTypeRegister DocumentType = "REGISTER"
DocumentTypeRecord DocumentType = "RECORD"
DocumentTypeReport DocumentType = "REPORT"
DocumentTypeTemplate DocumentType = "TEMPLATE"
DocumentTypeOther DocumentType = "OTHER"
DocumentTypeGovernance DocumentType = "GOVERNANCE"
DocumentTypePolicy DocumentType = "POLICY"
DocumentTypeProcedure DocumentType = "PROCEDURE"
DocumentTypePlan DocumentType = "PLAN"
DocumentTypeRegister DocumentType = "REGISTER"
DocumentTypeRecord DocumentType = "RECORD"
DocumentTypeReport DocumentType = "REPORT"
DocumentTypeTemplate DocumentType = "TEMPLATE"
DocumentTypeStatementOfApplicability DocumentType = "STATEMENT_OF_APPLICABILITY"
)
func DocumentTypes() []DocumentType {
@@ -46,6 +47,7 @@ func DocumentTypes() []DocumentType {
DocumentTypeRecord,
DocumentTypeReport,
DocumentTypeTemplate,
DocumentTypeStatementOfApplicability,
}
}
@@ -75,6 +77,8 @@ func (dt *DocumentType) UnmarshalText(data []byte) error {
*dt = DocumentTypeReport
case DocumentTypeTemplate.String():
*dt = DocumentTypeTemplate
case DocumentTypeStatementOfApplicability.String():
*dt = DocumentTypeStatementOfApplicability
default:
return fmt.Errorf("invalid DocumentType value: %q", val)
}

42
pkg/coredata/document_version.go
View File

@@ -30,20 +30,21 @@ import (
type (
DocumentVersion struct {
ID gid.GID `db:"id"`
OrganizationID gid.GID `db:"organization_id"`
DocumentID gid.GID `db:"document_id"`
Title string `db:"title"`
Major int `db:"major"`
Minor int `db:"minor"`
Classification DocumentClassification `db:"classification"`
DocumentType DocumentType `db:"document_type"`
Content string `db:"content"`
Changelog string `db:"changelog"`
Status DocumentVersionStatus `db:"status"`
PublishedAt *time.Time `db:"published_at"`
CreatedAt time.Time `db:"created_at"`
UpdatedAt time.Time `db:"updated_at"`
ID gid.GID `db:"id"`
OrganizationID gid.GID `db:"organization_id"`
DocumentID gid.GID `db:"document_id"`
Title string `db:"title"`
Major int `db:"major"`
Minor int `db:"minor"`
Classification DocumentClassification `db:"classification"`
DocumentType DocumentType `db:"document_type"`
Content string `db:"content"`
Changelog string `db:"changelog"`
Status DocumentVersionStatus `db:"status"`
Orientation DocumentVersionOrientation `db:"orientation"`
PublishedAt *time.Time `db:"published_at"`
CreatedAt time.Time `db:"created_at"`
UpdatedAt time.Time `db:"updated_at"`
}
DocumentVersions []*DocumentVersion
@@ -93,6 +94,7 @@ SELECT
content,
changelog,
status,
orientation,
published_at,
created_at,
updated_at
@@ -156,6 +158,7 @@ SELECT
content,
changelog,
status,
orientation,
published_at,
created_at,
updated_at
@@ -211,6 +214,8 @@ INSERT INTO document_versions (
content,
changelog,
status,
orientation,
published_at,
created_at,
updated_at
)
@@ -227,6 +232,8 @@ VALUES (
@content,
@changelog,
@status,
@orientation,
@published_at,
@created_at,
@updated_at
)
@@ -244,6 +251,8 @@ VALUES (
"content": dv.Content,
"changelog": dv.Changelog,
"status": dv.Status,
"orientation": dv.Orientation,
"published_at": dv.PublishedAt,
"created_at": dv.CreatedAt,
"updated_at": dv.UpdatedAt,
}
@@ -285,6 +294,7 @@ SELECT
content,
changelog,
status,
orientation,
published_at,
created_at,
updated_at
@@ -344,6 +354,7 @@ SELECT
content,
changelog,
status,
orientation,
published_at,
created_at,
updated_at
@@ -399,6 +410,7 @@ SELECT
content,
changelog,
status,
orientation,
published_at,
created_at,
updated_at
@@ -453,6 +465,7 @@ UPDATE document_versions SET
published_at = @published_at,
classification = @classification,
document_type = @document_type,
orientation = @orientation,
updated_at = @updated_at
WHERE %s
AND id = @document_version_id
@@ -471,6 +484,7 @@ WHERE %s
"published_at": dv.PublishedAt,
"classification": dv.Classification,
"document_type": dv.DocumentType,
"orientation": dv.Orientation,
"updated_at": dv.UpdatedAt,
}
maps.Copy(args, scope.SQLArguments())

72
pkg/coredata/document_version_orientation.go Normal file
View File

@@ -0,0 +1,72 @@
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package coredata
import (
"database/sql/driver"
"fmt"
)
type (
DocumentVersionOrientation string
)
const (
DocumentVersionOrientationPortrait DocumentVersionOrientation = "PORTRAIT"
DocumentVersionOrientationLandscape DocumentVersionOrientation = "LANDSCAPE"
)
func DocumentVersionOrientations() []DocumentVersionOrientation {
return []DocumentVersionOrientation{
DocumentVersionOrientationPortrait,
DocumentVersionOrientationLandscape,
}
}
func (o DocumentVersionOrientation) MarshalText() ([]byte, error) {
return []byte(o.String()), nil
}
func (o *DocumentVersionOrientation) UnmarshalText(data []byte) error {
val := string(data)
switch val {
case DocumentVersionOrientationPortrait.String():
*o = DocumentVersionOrientationPortrait
case DocumentVersionOrientationLandscape.String():
*o = DocumentVersionOrientationLandscape
default:
return fmt.Errorf("invalid DocumentVersionOrientation value: %q", val)
}
return nil
}
func (o DocumentVersionOrientation) String() string {
return string(o)
}
func (o *DocumentVersionOrientation) Scan(value any) error {
val, ok := value.(string)
if !ok {
return fmt.Errorf("invalid scan source for DocumentVersionOrientation, expected string got %T", value)
}
return o.UnmarshalText([]byte(val))
}
func (o DocumentVersionOrientation) Value() (driver.Value, error) {
return o.String(), nil
}

48
pkg/coredata/document_write_mode.go Normal file
View File

@@ -0,0 +1,48 @@
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package coredata
import "fmt"
type (
DocumentWriteMode string
)
const (
DocumentWriteModeAuthored DocumentWriteMode = "AUTHORED"
DocumentWriteModeGenerated DocumentWriteMode = "GENERATED"
)
func (e DocumentWriteMode) IsValid() bool {
switch e {
case DocumentWriteModeAuthored, DocumentWriteModeGenerated:
return true
}
return false
}
func (e DocumentWriteMode) String() string { return string(e) }
func (e *DocumentWriteMode) UnmarshalText(text []byte) error {
*e = DocumentWriteMode(text)
if !e.IsValid() {
return fmt.Errorf("%s is not a valid DocumentWriteMode", string(text))
}
return nil
}
func (e DocumentWriteMode) MarshalText() ([]byte, error) {
return []byte(e.String()), nil
}

42
pkg/coredata/electronic_signature_document_type.go
View File

@@ -24,22 +24,23 @@ type (
)
const (
ElectronicSignatureDocumentTypeNDA ElectronicSignatureDocumentType = "NDA"
ElectronicSignatureDocumentTypeDPA ElectronicSignatureDocumentType = "DPA"
ElectronicSignatureDocumentTypeMSA ElectronicSignatureDocumentType = "MSA"
ElectronicSignatureDocumentTypeSOW ElectronicSignatureDocumentType = "SOW"
ElectronicSignatureDocumentTypeSLA ElectronicSignatureDocumentType = "SLA"
ElectronicSignatureDocumentTypeTOS ElectronicSignatureDocumentType = "TOS"
ElectronicSignatureDocumentTypePrivacyPolicy ElectronicSignatureDocumentType = "PRIVACY_POLICY"
ElectronicSignatureDocumentTypeGovernance ElectronicSignatureDocumentType = "GOVERNANCE"
ElectronicSignatureDocumentTypePolicy ElectronicSignatureDocumentType = "POLICY"
ElectronicSignatureDocumentTypeProcedure ElectronicSignatureDocumentType = "PROCEDURE"
ElectronicSignatureDocumentTypePlan ElectronicSignatureDocumentType = "PLAN"
ElectronicSignatureDocumentTypeRegister ElectronicSignatureDocumentType = "REGISTER"
ElectronicSignatureDocumentTypeRecord ElectronicSignatureDocumentType = "RECORD"
ElectronicSignatureDocumentTypeReport ElectronicSignatureDocumentType = "REPORT"
ElectronicSignatureDocumentTypeTemplate ElectronicSignatureDocumentType = "TEMPLATE"
ElectronicSignatureDocumentTypeOther ElectronicSignatureDocumentType = "OTHER"
ElectronicSignatureDocumentTypeNDA ElectronicSignatureDocumentType = "NDA"
ElectronicSignatureDocumentTypeDPA ElectronicSignatureDocumentType = "DPA"
ElectronicSignatureDocumentTypeMSA ElectronicSignatureDocumentType = "MSA"
ElectronicSignatureDocumentTypeSOW ElectronicSignatureDocumentType = "SOW"
ElectronicSignatureDocumentTypeSLA ElectronicSignatureDocumentType = "SLA"
ElectronicSignatureDocumentTypeTOS ElectronicSignatureDocumentType = "TOS"
ElectronicSignatureDocumentTypePrivacyPolicy ElectronicSignatureDocumentType = "PRIVACY_POLICY"
ElectronicSignatureDocumentTypeGovernance ElectronicSignatureDocumentType = "GOVERNANCE"
ElectronicSignatureDocumentTypePolicy ElectronicSignatureDocumentType = "POLICY"
ElectronicSignatureDocumentTypeProcedure ElectronicSignatureDocumentType = "PROCEDURE"
ElectronicSignatureDocumentTypePlan ElectronicSignatureDocumentType = "PLAN"
ElectronicSignatureDocumentTypeRegister ElectronicSignatureDocumentType = "REGISTER"
ElectronicSignatureDocumentTypeRecord ElectronicSignatureDocumentType = "RECORD"
ElectronicSignatureDocumentTypeReport ElectronicSignatureDocumentType = "REPORT"
ElectronicSignatureDocumentTypeTemplate ElectronicSignatureDocumentType = "TEMPLATE"
ElectronicSignatureDocumentTypeStatementOfApplicability ElectronicSignatureDocumentType = "STATEMENT_OF_APPLICABILITY"
ElectronicSignatureDocumentTypeOther ElectronicSignatureDocumentType = "OTHER"
ESignProcessConsentText = "By typing my full name and clicking Accept, I consent to sign this document electronically and agree that my electronic signature has the same legal validity as a handwritten signature."
)
@@ -61,6 +62,7 @@ func ElectronicSignatureDocumentTypes() []ElectronicSignatureDocumentType {
ElectronicSignatureDocumentTypeRecord,
ElectronicSignatureDocumentTypeReport,
ElectronicSignatureDocumentTypeTemplate,
ElectronicSignatureDocumentTypeStatementOfApplicability,
ElectronicSignatureDocumentTypeOther,
}
}
@@ -103,6 +105,8 @@ func (dt *ElectronicSignatureDocumentType) UnmarshalText(data []byte) error {
*dt = ElectronicSignatureDocumentTypeReport
case ElectronicSignatureDocumentTypeTemplate.String():
*dt = ElectronicSignatureDocumentTypeTemplate
case ElectronicSignatureDocumentTypeStatementOfApplicability.String():
*dt = ElectronicSignatureDocumentTypeStatementOfApplicability
case ElectronicSignatureDocumentTypeOther.String():
*dt = ElectronicSignatureDocumentTypeOther
default:
@@ -161,6 +165,8 @@ func (dt ElectronicSignatureDocumentType) DisplayName() string {
return "Report"
case ElectronicSignatureDocumentTypeTemplate:
return "Template"
case ElectronicSignatureDocumentTypeStatementOfApplicability:
return "Statement of Applicability"
default:
return string(dt)
}
@@ -199,6 +205,8 @@ func (dt ElectronicSignatureDocumentType) ConsentText() (string, error) {
docAgreement = "I acknowledge and agree to this Report."
case ElectronicSignatureDocumentTypeTemplate:
docAgreement = "I acknowledge and agree to this Template."
case ElectronicSignatureDocumentTypeStatementOfApplicability:
docAgreement = "I acknowledge and agree to this Statement of Applicability."
case ElectronicSignatureDocumentTypeOther:
return "", fmt.Errorf("cannot get consent text: document type OTHER requires explicit consent text")
default:
@@ -226,6 +234,8 @@ func ElectronicSignatureDocumentTypeFromDocumentType(dt DocumentType) Electronic
return ElectronicSignatureDocumentTypeReport
case DocumentTypeTemplate:
return ElectronicSignatureDocumentTypeTemplate
case DocumentTypeStatementOfApplicability:
return ElectronicSignatureDocumentTypeStatementOfApplicability
default:
return ElectronicSignatureDocumentTypeOther
}

45
pkg/coredata/migrations/20260410T120000Z.sql Normal file
View File

@@ -0,0 +1,45 @@
-- Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
--
-- Permission to use, copy, modify, and/or distribute this software for any
-- purpose with or without fee is hereby granted, provided that the above
-- copyright notice and this permission notice appear in all copies.
--
-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-- PERFORMANCE OF THIS SOFTWARE.
CREATE TYPE document_version_orientation AS ENUM ('PORTRAIT', 'LANDSCAPE');
CREATE TYPE document_write_mode AS ENUM ('AUTHORED', 'GENERATED');
ALTER TABLE document_versions
ADD COLUMN orientation document_version_orientation DEFAULT 'PORTRAIT';
ALTER TABLE document_versions
ALTER COLUMN orientation DROP DEFAULT;
ALTER TABLE documents
ADD COLUMN write_mode document_write_mode NOT NULL DEFAULT 'AUTHORED';
ALTER TABLE documents
ALTER COLUMN write_mode DROP DEFAULT;
ALTER TYPE document_type ADD VALUE 'STATEMENT_OF_APPLICABILITY';
ALTER TYPE electronic_signature_document_type ADD VALUE 'STATEMENT_OF_APPLICABILITY';
ALTER TABLE statements_of_applicability
ADD COLUMN document_id TEXT UNIQUE REFERENCES documents(id) ON DELETE SET NULL;
-- TODO: drop owner_profile_id column
ALTER TABLE statements_of_applicability
ALTER COLUMN owner_profile_id DROP NOT NULL;
-- TODO: drop statements_of_applicability.source_id column
-- TODO: drop statements_of_applicability.snapshot_id column
-- TODO: drop applicability_statements.snapshot_id column

2
pkg/coredata/snapshot.go
View File

@@ -124,6 +124,7 @@ FROM
WHERE
%s
AND organization_id = @organization_id
AND type != 'STATEMENTS_OF_APPLICABILITY'
AND %s
`
@@ -163,6 +164,7 @@ FROM
WHERE
%s
AND organization_id = @organization_id
AND type != 'STATEMENTS_OF_APPLICABILITY'
AND %s
`

1
pkg/coredata/snapshots_type.go
View File

@@ -43,7 +43,6 @@ func SnapshotsTypes() []SnapshotsType {
SnapshotsTypeFindings,
SnapshotsTypeObligations,
SnapshotsTypeProcessingActivities,
SnapshotsTypeStatementsOfApplicability,
}
}

2
pkg/coredata/snapshottable.go
View File

@@ -42,8 +42,6 @@ func GetSnapshottable(snapshotType SnapshotsType) (Snapshottable, error) {
return ProcessingActivities{}, nil
case SnapshotsTypeVendors:
return Vendors{}, nil
case SnapshotsTypeStatementsOfApplicability:
return StatementsOfApplicability{}, nil
default:
return nil, fmt.Errorf("unsupported snapshot type: %s", snapshotType)
}

179
pkg/coredata/statement_of_applicability.go
View File

@@ -33,9 +33,7 @@ type (
ID gid.GID `db:"id"`
OrganizationID gid.GID `db:"organization_id"`
Name string `db:"name"`
SourceID *gid.GID `db:"source_id"`
SnapshotID *gid.GID `db:"snapshot_id"`
OwnerID gid.GID `db:"owner_profile_id"`
DocumentID *gid.GID `db:"document_id"`
CreatedAt time.Time `db:"created_at"`
UpdatedAt time.Time `db:"updated_at"`
}
@@ -79,9 +77,7 @@ SELECT
id,
organization_id,
name,
source_id,
snapshot_id,
owner_profile_id,
document_id,
created_at,
updated_at
FROM
@@ -89,6 +85,7 @@ FROM
WHERE
%s
AND id = @statement_of_applicability_id
AND snapshot_id IS NULL
LIMIT 1;
`
@@ -121,16 +118,13 @@ func (s *StatementsOfApplicability) LoadByOrganizationID(
scope Scoper,
organizationID gid.GID,
cursor *page.Cursor[StatementOfApplicabilityOrderField],
filter *StatementOfApplicabilityFilter,
) error {
q := `
SELECT
id,
organization_id,
name,
source_id,
snapshot_id,
owner_profile_id,
document_id,
created_at,
updated_at
FROM
@@ -138,14 +132,13 @@ FROM
WHERE
%s
AND organization_id = @organization_id
AND %s
AND snapshot_id IS NULL
AND %s
`
q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment(), cursor.SQLFragment())
q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
args := pgx.NamedArgs{"organization_id": organizationID}
maps.Copy(args, scope.SQLArguments())
maps.Copy(args, filter.SQLArguments())
maps.Copy(args, cursor.SQLArguments())
rows, err := conn.Query(ctx, q, args)
@@ -167,7 +160,6 @@ func (s *StatementsOfApplicability) CountByOrganizationID(
conn pg.Querier,
scope Scoper,
organizationID gid.GID,
filter *StatementOfApplicabilityFilter,
) (int, error) {
q := `
SELECT
@@ -177,15 +169,14 @@ FROM
WHERE
%s
AND organization_id = @organization_id
AND %s
AND snapshot_id IS NULL
`
q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment())
q = fmt.Sprintf(q, scope.SQLFragment())
args := pgx.StrictNamedArgs{
"organization_id": organizationID,
}
maps.Copy(args, scope.SQLArguments())
maps.Copy(args, filter.SQLArguments())
row := conn.QueryRow(ctx, q, args)
var count int
@@ -208,9 +199,7 @@ INSERT INTO
id,
organization_id,
name,
source_id,
snapshot_id,
owner_profile_id,
document_id,
created_at,
updated_at
)
@@ -219,9 +208,7 @@ VALUES (
@statement_of_applicability_id,
@organization_id,
@name,
@source_id,
@snapshot_id,
@owner_profile_id,
@document_id,
@created_at,
@updated_at
);
@@ -232,9 +219,7 @@ VALUES (
"statement_of_applicability_id": s.ID,
"organization_id": s.OrganizationID,
"name": s.Name,
"source_id": s.SourceID,
"snapshot_id": s.SnapshotID,
"owner_profile_id": s.OwnerID,
"document_id": s.DocumentID,
"created_at": s.CreatedAt,
"updated_at": s.UpdatedAt,
}
@@ -262,11 +247,12 @@ func (s *StatementOfApplicability) Update(
UPDATE statements_of_applicability
SET
name = @name,
owner_profile_id = @owner_profile_id,
document_id = @document_id,
updated_at = @updated_at
WHERE
%s
AND id = @statement_of_applicability_id
AND snapshot_id IS NULL
`
q = fmt.Sprintf(q, scope.SQLFragment())
@@ -274,7 +260,7 @@ WHERE
args := pgx.StrictNamedArgs{
"statement_of_applicability_id": s.ID,
"name": s.Name,
"owner_profile_id": s.OwnerID,
"document_id": s.DocumentID,
"updated_at": s.UpdatedAt,
}
maps.Copy(args, scope.SQLArguments())
@@ -307,6 +293,7 @@ DELETE FROM statements_of_applicability
WHERE
%s
AND id = @statement_of_applicability_id
AND snapshot_id IS NULL
`
q = fmt.Sprintf(q, scope.SQLFragment())
@@ -326,139 +313,3 @@ WHERE
return nil
}
func (soas StatementsOfApplicability) Snapshot(ctx context.Context, conn pg.Tx, scope Scoper, organizationID, snapshotID gid.GID) error {
if err := soas.insertStatementOfApplicabilitySnapshots(ctx, conn, scope, organizationID, snapshotID); err != nil {
return fmt.Errorf("cannot insert statement_of_applicability snapshots: %w", err)
}
if err := soas.insertStatementOfApplicabilityControlSnapshots(ctx, conn, scope, organizationID, snapshotID); err != nil {
return fmt.Errorf("cannot insert statement_of_applicability_control snapshots: %w", err)
}
return nil
}
func (soas StatementsOfApplicability) insertStatementOfApplicabilitySnapshots(
ctx context.Context,
conn pg.Querier,
scope Scoper,
organizationID gid.GID,
snapshotID gid.GID,
) error {
query := `
INSERT INTO statements_of_applicability (
id,
tenant_id,
organization_id,
name,
source_id,
snapshot_id,
owner_profile_id,
created_at,
updated_at
)
SELECT
generate_gid(decode_base64_unpadded(@tenant_id), @statement_of_applicability_entity_type),
@tenant_id,
soa.organization_id,
soa.name,
soa.id,
@snapshot_id,
soa.owner_profile_id,
soa.created_at,
soa.updated_at
FROM statements_of_applicability soa
WHERE
%s
AND soa.organization_id = @organization_id
AND soa.snapshot_id IS NULL
`
query = fmt.Sprintf(query, scope.SQLFragment())
args := pgx.StrictNamedArgs{
"tenant_id": scope.GetTenantID(),
"snapshot_id": snapshotID,
"organization_id": organizationID,
"statement_of_applicability_entity_type": StatementOfApplicabilityEntityType,
}
maps.Copy(args, scope.SQLArguments())
_, err := conn.Exec(ctx, query, args)
if err != nil {
return fmt.Errorf("cannot insert statement_of_applicability snapshots: %w", err)
}
return nil
}
func (soas StatementsOfApplicability) insertStatementOfApplicabilityControlSnapshots(
ctx context.Context,
conn pg.Querier,
scope Scoper,
organizationID gid.GID,
snapshotID gid.GID,
) error {
query := `
WITH source_soa AS (
SELECT id, organization_id
FROM statements_of_applicability
WHERE
%s
AND organization_id = @organization_id
AND snapshot_id IS NULL
),
snapshot_soa AS (
SELECT id, source_id
FROM statements_of_applicability
WHERE snapshot_id = @snapshot_id
)
INSERT INTO applicability_statements (
id,
statement_of_applicability_id,
control_id,
organization_id,
tenant_id,
snapshot_id,
applicability,
justification,
created_at,
updated_at
)
SELECT
generate_gid(decode_base64_unpadded(@tenant_id), @applicability_statement_entity_type),
snapshot_soa.id,
soac.control_id,
soac.organization_id,
@tenant_id,
@snapshot_id,
soac.applicability,
soac.justification,
soac.created_at,
soac.updated_at
FROM applicability_statements soac
INNER JOIN source_soa
ON soac.statement_of_applicability_id = source_soa.id
INNER JOIN snapshot_soa
ON snapshot_soa.source_id = source_soa.id
WHERE soac.snapshot_id IS NULL
`
query = fmt.Sprintf(query, scope.SQLFragment())
args := pgx.StrictNamedArgs{
"tenant_id": scope.GetTenantID(),
"snapshot_id": snapshotID,
"organization_id": organizationID,
"applicability_statement_entity_type": ApplicabilityStatementEntityType,
}
maps.Copy(args, scope.SQLArguments())
_, err := conn.Exec(ctx, query, args)
if err != nil {
return fmt.Errorf("cannot insert statement_of_applicability_control snapshots: %w", err)
}
return nil
}

61
pkg/coredata/statement_of_applicability_filter.go
View File

@@ -1,61 +0,0 @@
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package coredata
import (
"github.com/jackc/pgx/v5"
"go.probo.inc/probo/pkg/gid"
)
type (
StatementOfApplicabilityFilter struct {
snapshotID **gid.GID
}
)
func NewStatementOfApplicabilityFilter(snapshotID **gid.GID) *StatementOfApplicabilityFilter {
return &StatementOfApplicabilityFilter{
snapshotID: snapshotID,
}
}
func (f *StatementOfApplicabilityFilter) SQLArguments() pgx.StrictNamedArgs {
args := pgx.StrictNamedArgs{}
if f.snapshotID == nil {
args["has_snapshot_filter"] = false
args["filter_snapshot_id"] = nil
} else if *f.snapshotID == nil {
args["has_snapshot_filter"] = true
args["filter_snapshot_id"] = nil
} else {
args["has_snapshot_filter"] = true
args["filter_snapshot_id"] = **f.snapshotID
}
return args
}
func (f *StatementOfApplicabilityFilter) SQLFragment() string {
return `
CASE
WHEN @has_snapshot_filter::boolean = false THEN TRUE
WHEN @has_snapshot_filter::boolean = true AND @filter_snapshot_id::text IS NOT NULL THEN
snapshot_id = @filter_snapshot_id::text
WHEN @has_snapshot_filter::boolean = true AND @filter_snapshot_id::text IS NULL THEN
snapshot_id IS NULL
ELSE TRUE
END`
}

65
pkg/docgen/generator.go
View File

@@ -44,9 +44,6 @@ var (
//go:embed transfer_impact_assessments_template.html
transferImpactAssessmentsTemplateContent string
//go:embed soa_template.html
soaTemplateContent string
templateFuncs = template.FuncMap{
"now": func() time.Time { return time.Now() },
"eq": func(a, b any) bool { return a == b },
@@ -186,8 +183,6 @@ var (
dataProtectionImpactAssessmentsTemplate = template.Must(template.New("dataProtectionImpactAssessments").Funcs(templateFuncs).Parse(dataProtectionImpactAssessmentsTemplateContent))
transferImpactAssessmentsTemplate = template.Must(template.New("transferImpactAssessments").Funcs(templateFuncs).Parse(transferImpactAssessmentsTemplateContent))
statementOfApplicabilityTemplate = template.Must(template.New("statement-of-applicability").Funcs(templateFuncs).Parse(soaTemplateContent))
)
type (
@@ -205,6 +200,7 @@ type (
Signatures []SignatureData
CompanyHorizontalLogoBase64 string
MermaidJS template.JS
Landscape bool
}
SignatureData struct {
@@ -280,37 +276,35 @@ type (
}
StatementOfApplicabilityData struct {
Title string
OrganizationName string
CreatedAt time.Time
TotalControls int
FrameworkGroups []FrameworkControlGroup
CompanyHorizontalLogoBase64 string
Version int
PublishedAt time.Time
Approver string
Title string
OrganizationName string
CreatedAt time.Time
TotalControls int
Rows []SOARow
}
FrameworkControlGroup struct {
FrameworkName string
Controls []ControlData
}
ControlData struct {
FrameworkName string
SectionTitle string
Name string
Applicability *bool
Justification *string
BestPractice *bool
Implemented *string
NotImplementedJustification *string
Regulatory *bool
Contractual *bool
RiskAssessment *bool
SOARow struct {
FrameworkName string
ControlSection string
ControlName string
Applicability string
Justification string
Implemented string
NotImplJustification string
Regulatory string
Contractual string
BestPractice string
RiskAssessment string
}
)
func BoolLabel(v bool) string {
if v {
return "Yes"
}
return "No"
}
const (
ClassificationPublic Classification = "PUBLIC"
ClassificationInternal Classification = "INTERNAL"
@@ -381,12 +375,3 @@ func RenderTransferImpactAssessmentsTableHTML(data TransferImpactAssessmentTable
return buf.Bytes(), nil
}
func RenderStatementOfApplicabilityHTML(data StatementOfApplicabilityData) ([]byte, error) {
var buf bytes.Buffer
if err := statementOfApplicabilityTemplate.Execute(&buf, data); err != nil {
return nil, fmt.Errorf("cannot execute SOA template: %w", err)
}
return buf.Bytes(), nil
}

523
pkg/docgen/soa_template.html
View File

@@ -1,523 +0,0 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Statement of Applicability</title>
<style>
@page {
size: A4 landscape;
margin: 2.5cm;
@bottom-right {
content: "Page " counter(page) " of " counter(pages);
font-family: Arial, sans-serif;
font-size: 9pt;
color: #666;
}
}
body {
font-family: Arial, sans-serif;
font-size: 7.5pt;
line-height: 1.4;
color: #333;
margin: 0;
padding: 0;
background: white;
}
/* Cover page */
.cover-page {
page-break-after: always;
}
.company-header {
margin-bottom: 30px;
page-break-after: avoid;
}
.company-logo {
max-height: 50px;
max-width: 100%;
height: auto;
width: auto;
display: block;
}
.export-title {
font-size: 22pt;
font-weight: normal;
color: #1a1a1a;
margin: 0 0 25px 0;
text-align: left;
}
.export-subtitle {
font-size: 18pt;
font-weight: normal;
color: #1a1a1a;
margin: 0 0 25px 0;
text-align: left;
}
.document-meta {
margin: 0 0 30px 0;
font-size: 9pt;
}
.meta-table {
width: 100%;
border-collapse: collapse;
border: 1px solid #333;
}
.meta-table td {
padding: 6px 8px;
border: 1px solid #333;
vertical-align: middle;
}
.meta-table td:first-child {
font-weight: 600;
width: 25%;
background: #f8f8f8;
color: #333;
}
.classification {
font-weight: bold;
text-transform: uppercase;
}
.purpose-section {
margin: 30px 0;
page-break-after: avoid;
}
.purpose-title {
font-size: 15pt;
font-weight: bold;
color: #000;
margin: 0 0 15px 0;
page-break-after: avoid;
}
.purpose-text {
font-size: 10pt;
color: #333;
line-height: 1.5;
text-align: justify;
}
/* Controls page */
.controls-page {
page-break-before: always;
}
.controls-title {
font-size: 15pt;
font-weight: bold;
color: #000;
margin: 0 0 15px 0;
page-break-after: avoid;
}
.controls-table {
width: 100%;
border-collapse: collapse;
font-size: 8pt;
margin-top: 10px;
}
.controls-table th,
.controls-table td {
padding: 5px 6px;
text-align: left;
border: 1px solid #ddd;
vertical-align: top;
}
.controls-table th {
background: #f5f5f5;
font-weight: bold;
color: #333;
}
.controls-table tr {
page-break-inside: avoid;
}
.section-tag {
display: inline-block;
background: #e0e0e0;
color: #333;
padding: 2px 5px;
border-radius: 3px;
font-size: 7pt;
font-weight: 500;
margin-right: 5px;
}
.state-tag {
display: inline-block;
padding: 2px 5px;
border-radius: 4px;
font-size: 8pt;
font-weight: 500;
}
.state-tag-success {
background: #eefadc;
color: #5d770d;
}
.state-tag-warning {
background: #fff4d5;
color: #ad5700;
}
.state-tag-danger {
background: #ffefef;
color: #cd2b31;
}
/* Annex page */
.annex-page {
page-break-before: always;
}
.annex-title {
font-size: 15pt;
font-weight: bold;
color: #000;
margin: 0 0 15px 0;
page-break-after: avoid;
}
.annex-section {
margin-bottom: 20px;
}
.annex-section-title {
font-size: 13pt;
font-weight: bold;
color: #000;
margin: 15px 0 10px 0;
}
.annex-subsection-title {
font-size: 10pt;
font-weight: bold;
color: #333;
margin: 12px 0 8px 0;
}
.annex-enum-list {
margin: 10px 0;
padding-left: 20px;
}
.annex-enum-item {
margin-bottom: 8px;
font-size: 10pt;
line-height: 1.5;
}
.annex-enum-name {
font-weight: 600;
color: #333;
}
.annex-enum-description {
color: #000;
margin-left: 5px;
}
/* Prevent bad page breaks */
h1, h2, h3, h4, h5, h6 {
page-break-after: avoid;
page-break-inside: avoid;
}
@media print {
body {
background: white;
}
}
</style>
</head>
<body>
<div class="cover-page">
<div class="company-header">
{{- if .CompanyHorizontalLogoBase64}}
{{imgTag .CompanyHorizontalLogoBase64 "Company Logo" "company-logo"}}
{{- end}}
</div>
<h1 class="export-title">Statement of Applicability</h1>
<h2 class="export-subtitle">{{.Title}}</h2>
<div class="document-meta">
<table class="meta-table">
<tr>
<td>Classification</td>
<td>
<span class="classification">CONFIDENTIAL</span>
</td>
</tr>
<tr>
<td>Approver</td>
<td>{{.Approver}}</td>
</tr>
<tr>
<td>Version</td>
<td>{{.Version}}</td>
</tr>
<tr>
<td>Published</td>
<td>{{.PublishedAt.Format "January 2, 2006"}}</td>
</tr>
</table>
</div>
<div class="purpose-section">
<div class="purpose-title">1. Purpose</div>
<div class="purpose-text">
This document provides a comprehensive overview of the statement of applicability for controls within the organization.
It serves as a record of which controls are applicable or not applicable to the organization, along with their
relationships to regulatory requirements, contractual obligations, risk assessments, and best practices.
</div>
</div>
</div>
{{- if .FrameworkGroups}}
<div class="controls-page">
<h1 class="controls-title">2. Controls</h1>
<table class="controls-table">
<thead>
<tr>
<th rowspan="2" style="width: 12%;">Framework</th>
<th rowspan="2" style="width: 24%;">Control</th>
<th rowspan="2" style="width: 8%;">Applicability</th>
<th rowspan="2" style="width: 14%;">Justification for non-applicability</th>
<th rowspan="2" style="width: 8%;">Implemented</th>
<th rowspan="2" style="width: 10%;">Justification for non-implementation</th>
<th colspan="4" style="width: 24%; text-align: center;">Justification for inclusion</th>
</tr>
<tr>
<th style="width: 6%;">Regulatory</th>
<th style="width: 6%;">Contractual</th>
<th style="width: 6%;">Best Practice</th>
<th style="width: 6%;">Risk Assessment</th>
</tr>
</thead>
<tbody>
{{- range $group := .FrameworkGroups}}
{{- range $group.Controls}}
<tr>
<td>{{$group.FrameworkName}}</td>
<td><span class="section-tag">{{.SectionTitle}}</span>{{.Name}}</td>
<td>
{{- $state := boolToYesNo .Applicability}}
{{- if eq $state "yes"}}
<span class="state-tag state-tag-success">Yes</span>
{{- else if eq $state "no"}}
<span class="state-tag state-tag-danger">No</span>
{{- else}}
<span class="state-tag">-</span>
{{- end}}
</td>
<td>
{{- $appStateJ := boolToYesNo .Applicability}}
{{- if and (eq $appStateJ "no") .Justification}}
{{.Justification}}
{{- else}}
-
{{- end}}
</td>
<td>
{{- $appState := boolToYesNo .Applicability}}
{{- if eq $appState "no"}}
<span class="state-tag">-</span>
{{- else if .Implemented}}
{{- if eq (derefString .Implemented) "IMPLEMENTED"}}
<span class="state-tag state-tag-success">Yes</span>
{{- else}}
<span class="state-tag state-tag-danger">No</span>
{{- end}}
{{- else}}
<span class="state-tag">-</span>
{{- end}}
</td>
<td>
{{- $appState2 := boolToYesNo .Applicability}}
{{- if eq $appState2 "no"}}
-
{{- else if and .Implemented (eq (derefString .Implemented) "NOT_IMPLEMENTED") .NotImplementedJustification}}
{{.NotImplementedJustification}}
{{- else}}
-
{{- end}}
</td>
<td>{{boolToYesNoDash .Regulatory}}</td>
<td>{{boolToYesNoDash .Contractual}}</td>
<td>{{boolToYesNoDash .BestPractice}}</td>
<td>{{boolToYesNoDash .RiskAssessment}}</td>
</tr>
{{- end}}
{{- end}}
</tbody>
</table>
</div>
{{- end}}
<div class="annex-page">
<h1 class="annex-title">3. Annexes</h1>
<div class="annex-section">
<div class="annex-section-title">3.1 Column Definitions</div>
</div>
<div class="annex-section">
<div class="annex-subsection-title">Framework</div>
<ul class="annex-enum-list">
<li class="annex-enum-item">
<span class="annex-enum-description">The name of the compliance framework or standard to which the control belongs (e.g., ISO 27001, SOC 2, GDPR).</span>
</li>
</ul>
</div>
<div class="annex-section">
<div class="annex-subsection-title">Control</div>
<ul class="annex-enum-list">
<li class="annex-enum-item">
<span class="annex-enum-description">The specific control identifier and name within the framework, including its section reference.</span>
</li>
</ul>
</div>
<div class="annex-section">
<div class="annex-subsection-title">Applicability</div>
<ul class="annex-enum-list">
<li class="annex-enum-item">
<span class="annex-enum-name">Yes:</span>
<span class="annex-enum-description">The control is applicable to the organization.</span>
</li>
<li class="annex-enum-item">
<span class="annex-enum-name">No:</span>
<span class="annex-enum-description">The control is not applicable to the organization (with justification provided).</span>
</li>
</ul>
</div>
<div class="annex-section">
<div class="annex-subsection-title">Justification for non-applicability</div>
<ul class="annex-enum-list">
<li class="annex-enum-item">
<span class="annex-enum-description">Provides the rationale when a control is not applicable. This field is empty for applicable controls.</span>
</li>
</ul>
</div>
<div class="annex-section">
<div class="annex-subsection-title">Implemented</div>
<ul class="annex-enum-list">
<li class="annex-enum-item">
<span class="annex-enum-name">Yes:</span>
<span class="annex-enum-description">The control has been implemented by the organization.</span>
</li>
<li class="annex-enum-item">
<span class="annex-enum-name">No:</span>
<span class="annex-enum-description">The control has not been implemented (with justification provided).</span>
</li>
<li class="annex-enum-item">
<span class="annex-enum-name">-:</span>
<span class="annex-enum-description">Not applicable (control is not applicable).</span>
</li>
</ul>
</div>
<div class="annex-section">
<div class="annex-subsection-title">Justification for non-implementation</div>
<ul class="annex-enum-list">
<li class="annex-enum-item">
<span class="annex-enum-description">Provides the rationale when a control is not implemented. This field is empty for implemented controls or when the control is not applicable.</span>
</li>
</ul>
</div>
<div class="annex-section">
<div class="annex-subsection-title">Justification for inclusion</div>
<div class="annex-enum-description" style="margin-bottom: 12px;">
For applicable controls, this section provides additional context on why the control is included, based on regulatory requirements, contractual obligations, best practices, or risk assessments.
</div>
<div style="margin-left: 20px;">
<div class="annex-subsection-title" style="font-size: 9pt; margin-top: 10px;">Regulatory</div>
<ul class="annex-enum-list">
<li class="annex-enum-item">
<span class="annex-enum-name">Yes:</span>
<span class="annex-enum-description">The control is linked to one or more legal or regulatory obligations.</span>
</li>
<li class="annex-enum-item">
<span class="annex-enum-name">No:</span>
<span class="annex-enum-description">The control is not associated with any legal or regulatory obligations.</span>
</li>
<li class="annex-enum-item">
<span class="annex-enum-name">-:</span>
<span class="annex-enum-description">Not applicable (control is not applicable).</span>
</li>
</ul>
<div class="annex-subsection-title" style="font-size: 9pt; margin-top: 10px;">Contractual</div>
<ul class="annex-enum-list">
<li class="annex-enum-item">
<span class="annex-enum-name">Yes:</span>
<span class="annex-enum-description">The control is linked to one or more contractual obligations.</span>
</li>
<li class="annex-enum-item">
<span class="annex-enum-name">No:</span>
<span class="annex-enum-description">The control is not associated with any contractual obligations.</span>
</li>
<li class="annex-enum-item">
<span class="annex-enum-name">-:</span>
<span class="annex-enum-description">Not applicable (control is not applicable).</span>
</li>
</ul>
<div class="annex-subsection-title" style="font-size: 9pt; margin-top: 10px;">Best Practice</div>
<ul class="annex-enum-list">
<li class="annex-enum-item">
<span class="annex-enum-name">Yes:</span>
<span class="annex-enum-description">The control is designated as a best practice recommendation.</span>
</li>
<li class="annex-enum-item">
<span class="annex-enum-name">No:</span>
<span class="annex-enum-description">The control is not designated as a best practice.</span>
</li>
<li class="annex-enum-item">
<span class="annex-enum-name">-:</span>
<span class="annex-enum-description">Not applicable (control is not applicable).</span>
</li>
</ul>
<div class="annex-subsection-title" style="font-size: 9pt; margin-top: 10px;">Risk Assessment</div>
<ul class="annex-enum-list">
<li class="annex-enum-item">
<span class="annex-enum-name">Yes:</span>
<span class="annex-enum-description">The control is associated with one or more identified risks through risk mitigation measures.</span>
</li>
<li class="annex-enum-item">
<span class="annex-enum-name">No:</span>
<span class="annex-enum-description">The control is not currently associated with any identified risks.</span>
</li>
<li class="annex-enum-item">
<span class="annex-enum-name">-:</span>
<span class="annex-enum-description">Not applicable (control is not applicable).</span>
</li>
</ul>
</div>
</div>
</div>
</body>
</html>

12
pkg/docgen/template.html
View File

@@ -8,7 +8,7 @@
<style>
/* A4 Page Setup for printing */
@page {
size: A4;
size: A4{{if .Landscape}} landscape{{end}};
margin: 2.5cm;
@bottom-right {
@@ -118,8 +118,16 @@
widows: 3;
}
.document-content hr {
border: none;
margin: 0;
padding: 0;
height: 0;
page-break-after: always;
}
.document-content h1 {
font-size: 14pt;
font-size: 18pt;
font-weight: bold;
color: #000;
margin: 20px 0 12px 0;

12
pkg/probo/actions.go
View File

@@ -338,12 +338,12 @@ const (
ActionRightsRequestDelete = "core:rights-request:delete"
// StatementOfApplicability actions
ActionStatementOfApplicabilityList = "core:statement-of-applicability:list"
ActionStatementOfApplicabilityGet = "core:statement-of-applicability:get"
ActionStatementOfApplicabilityCreate = "core:statement-of-applicability:create"
ActionStatementOfApplicabilityUpdate = "core:statement-of-applicability:update"
ActionStatementOfApplicabilityDelete = "core:statement-of-applicability:delete"
ActionStatementOfApplicabilityExport = "core:statement-of-applicability:export"
ActionStatementOfApplicabilityList = "core:statement-of-applicability:list"
ActionStatementOfApplicabilityGet = "core:statement-of-applicability:get"
ActionStatementOfApplicabilityCreate = "core:statement-of-applicability:create"
ActionStatementOfApplicabilityUpdate = "core:statement-of-applicability:update"
ActionStatementOfApplicabilityDelete = "core:statement-of-applicability:delete"
ActionStatementOfApplicabilityPublish = "core:statement-of-applicability:publish"
ActionApplicabilityStatementGet = "core:applicability-statement:get"
ActionApplicabilityStatementList = "core:applicability-statement:list"

6
pkg/probo/document_approval_service.go
View File

@@ -136,7 +136,7 @@ func (s *DocumentApprovalService) RequestApproval(
return &ErrDocumentVersionNotDraft{}
}
q, err := s.requestApprovalInTx(ctx, tx, document, documentVersion, req.ApproverIDs, req.Changelog)
q, err := s.RequestApprovalInTx(ctx, tx, document, documentVersion, req.ApproverIDs, req.Changelog)
if err != nil {
return err
}
@@ -158,7 +158,7 @@ func (s *DocumentApprovalService) RequestApproval(
return quorum, nil
}
func (s *DocumentApprovalService) requestApprovalInTx(
func (s *DocumentApprovalService) RequestApprovalInTx(
ctx context.Context,
tx pg.Tx,
document *coredata.Document,
@@ -264,7 +264,7 @@ func (s *DocumentApprovalService) BulkPublishMajorVersions(
approverIDs[i] = a.ApproverProfileID
}
if _, err := s.requestApprovalInTx(ctx, tx, document, dv, approverIDs, &req.Changelog); err != nil {
if _, err := s.RequestApprovalInTx(ctx, tx, document, dv, approverIDs, &req.Changelog); err != nil {
return fmt.Errorf("cannot request approval for %q: %w", documentID, err)
}
} else {

31
pkg/probo/document_service.go
View File

@@ -77,6 +77,12 @@ type (
ErrDocumentNotArchived struct {
}
ErrDocumentGenerated struct {
}
ErrDocumentVersionGenerated struct {
}
ErrDocumentVersionSignatureAlreadySigned struct {
}
@@ -217,6 +223,14 @@ func (e ErrDocumentNotArchived) Error() string {
return "cannot unarchive a document that is not archived"
}
func (e ErrDocumentGenerated) Error() string {
return "cannot create draft for a generated document"
}
func (e ErrDocumentVersionGenerated) Error() string {
return "cannot edit a generated document version"
}
func (e ErrDocumentVersionSignatureAlreadySigned) Error() string {
return "document version signature already signed"
}
@@ -587,6 +601,7 @@ func (s *DocumentService) Create(
document := &coredata.Document{
ID: documentID,
WriteMode: coredata.DocumentWriteModeAuthored,
TrustCenterVisibility: coredata.TrustCenterVisibilityNone,
Status: coredata.DocumentStatusActive,
CreatedAt: now,
@@ -616,6 +631,7 @@ func (s *DocumentService) Create(
Status: coredata.DocumentVersionStatusDraft,
Classification: req.Classification,
DocumentType: req.DocumentType,
Orientation: coredata.DocumentVersionOrientationPortrait,
CreatedAt: now,
UpdatedAt: now,
}
@@ -1100,6 +1116,7 @@ func (s *DocumentService) createDraftInTx(
Classification: latestVersion.Classification,
DocumentType: latestVersion.DocumentType,
Content: latestVersion.Content,
Orientation: latestVersion.Orientation,
Status: coredata.DocumentVersionStatusDraft,
CreatedAt: now,
UpdatedAt: now,
@@ -1677,6 +1694,10 @@ func (s *DocumentService) Update(
hasVersionChanges := req.Title != nil || req.Content != nil || req.Classification != nil || req.DocumentType != nil
if hasVersionChanges && document.WriteMode == coredata.DocumentWriteModeGenerated {
return &ErrDocumentVersionGenerated{}
}
if !hasVersionChanges {
if req.DefaultApproverIDs != nil {
defaultApprovers := &coredata.DocumentDefaultApprovers{}
@@ -2191,6 +2212,8 @@ func exportDocumentPDF(
}
}
isLandscape := version.Orientation == coredata.DocumentVersionOrientationLandscape
docData := docgen.DocumentData{
Title: version.Title,
Content: json.RawMessage([]byte(version.Content)),
@@ -2201,6 +2224,7 @@ func exportDocumentPDF(
PublishedAt: version.PublishedAt,
Signatures: signatureData,
CompanyHorizontalLogoBase64: horizontalLogoBase64,
Landscape: isLandscape,
}
htmlContent, err := docgen.RenderHTML(docData)
@@ -2208,9 +2232,14 @@ func exportDocumentPDF(
return nil, fmt.Errorf("cannot generate HTML: %w", err)
}
orientation := html2pdf.OrientationPortrait
if isLandscape {
orientation = html2pdf.OrientationLandscape
}
cfg := html2pdf.RenderConfig{
PageFormat: html2pdf.PageFormatA4,
Orientation: html2pdf.OrientationPortrait,
Orientation: orientation,
MarginTop: html2pdf.NewMarginInches(1.0),
MarginBottom: html2pdf.NewMarginInches(1.0),
MarginLeft: html2pdf.NewMarginInches(1.0),

362
pkg/probo/generated_document_service.go Normal file
View File

@@ -0,0 +1,362 @@
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package probo
import (
"bytes"
"context"
"encoding/json"
"errors"
"fmt"
"text/template"
"time"
"go.gearno.de/kit/pg"
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/docgen"
"go.probo.inc/probo/pkg/gid"
)
type GeneratedDocumentService struct {
svc *TenantService
}
func (s *GeneratedDocumentService) PublishStatementOfApplicability(
ctx context.Context,
statementOfApplicabilityID gid.GID,
approverIDs []gid.GID,
) (*coredata.Document, *coredata.DocumentVersion, error) {
var (
document *coredata.Document
documentVersion *coredata.DocumentVersion
)
err := s.svc.pg.WithTx(
ctx,
func(ctx context.Context, tx pg.Tx) error {
soa := &coredata.StatementOfApplicability{}
if err := soa.LoadByID(ctx, tx, s.svc.scope, statementOfApplicabilityID); err != nil {
return fmt.Errorf("cannot load statement of applicability: %w", err)
}
documentData, err := s.buildStatementOfApplicabilityDocumentData(ctx, tx, soa)
if err != nil {
return fmt.Errorf("cannot build document data: %w", err)
}
prosemirrorJSON, err := BuildStatementOfApplicabilityDocument(documentData)
if err != nil {
return fmt.Errorf("cannot build prosemirror document: %w", err)
}
now := time.Now()
var existingDoc *coredata.Document
if soa.DocumentID != nil {
doc := &coredata.Document{}
err = doc.LoadByID(ctx, tx, s.svc.scope, *soa.DocumentID)
if err != nil && !errors.Is(err, coredata.ErrResourceNotFound) {
return fmt.Errorf("cannot load statement of applicability document: %w", err)
}
if err == nil && doc.ArchivedAt == nil {
existingDoc = doc
} else {
soa.DocumentID = nil
soa.UpdatedAt = now
if err := soa.Update(ctx, tx, s.svc.scope); err != nil {
return fmt.Errorf("cannot clear document reference: %w", err)
}
}
}
hasApprovers := len(approverIDs) > 0
if existingDoc == nil {
documentID := gid.New(s.svc.scope.GetTenantID(), coredata.DocumentEntityType)
document = &coredata.Document{
ID: documentID,
OrganizationID: soa.OrganizationID,
WriteMode: coredata.DocumentWriteModeGenerated,
TrustCenterVisibility: coredata.TrustCenterVisibilityNone,
Status: coredata.DocumentStatusActive,
CreatedAt: now,
UpdatedAt: now,
}
if err := document.Insert(ctx, tx, s.svc.scope); err != nil {
return fmt.Errorf("cannot insert document: %w", err)
}
soa.DocumentID = &documentID
soa.UpdatedAt = now
if err := soa.Update(ctx, tx, s.svc.scope); err != nil {
return fmt.Errorf("cannot update document reference: %w", err)
}
} else {
document = existingDoc
}
var newMajor int
if document.CurrentPublishedMajor != nil {
newMajor = *document.CurrentPublishedMajor + 1
} else {
newMajor = 1
}
versionStatus := coredata.DocumentVersionStatusPublished
var publishedAt *time.Time
if hasApprovers {
versionStatus = coredata.DocumentVersionStatusDraft
} else {
publishedAt = &now
}
documentVersionID := gid.New(s.svc.scope.GetTenantID(), coredata.DocumentVersionEntityType)
documentVersion = &coredata.DocumentVersion{
ID: documentVersionID,
OrganizationID: soa.OrganizationID,
DocumentID: document.ID,
Title: soa.Name,
Major: newMajor,
Minor: 0,
Content: prosemirrorJSON,
Status: versionStatus,
Classification: coredata.DocumentClassificationConfidential,
DocumentType: coredata.DocumentTypeStatementOfApplicability,
Orientation: coredata.DocumentVersionOrientationLandscape,
PublishedAt: publishedAt,
CreatedAt: now,
UpdatedAt: now,
}
if err := documentVersion.Insert(ctx, tx, s.svc.scope); err != nil {
if errors.Is(err, coredata.ErrResourceAlreadyExists) {
return fmt.Errorf("a version is pending approval, approve or reject it before publishing a new one: %w", err)
}
return fmt.Errorf("cannot insert document version: %w", err)
}
if hasApprovers {
defaultApprovers := &coredata.DocumentDefaultApprovers{}
if err := defaultApprovers.MergeByDocumentID(ctx, tx, s.svc.scope, document.ID, soa.OrganizationID, approverIDs); err != nil {
return fmt.Errorf("cannot save default approvers: %w", err)
}
_, err := s.svc.DocumentApprovals.RequestApprovalInTx(
ctx,
tx,
document,
documentVersion,
approverIDs,
nil,
)
if err != nil {
return fmt.Errorf("cannot request approval: %w", err)
}
} else {
document.CurrentPublishedMajor = &newMajor
document.CurrentPublishedMinor = new(0)
document.UpdatedAt = now
if err := document.Update(ctx, tx, s.svc.scope); err != nil {
return fmt.Errorf("cannot update document: %w", err)
}
}
return nil
},
)
if err != nil {
return nil, nil, err
}
return document, documentVersion, nil
}
func (s *GeneratedDocumentService) buildStatementOfApplicabilityDocumentData(
ctx context.Context,
conn pg.Querier,
statementOfApplicability *coredata.StatementOfApplicability,
) (docgen.StatementOfApplicabilityData, error) {
organization := &coredata.Organization{}
if err := organization.LoadByID(ctx, conn, s.svc.scope, statementOfApplicability.OrganizationID); err != nil {
return docgen.StatementOfApplicabilityData{}, fmt.Errorf("cannot load organization: %w", err)
}
var applicabilityStatements coredata.ApplicabilityStatements
if err := applicabilityStatements.LoadAllByStatementOfApplicabilityID(ctx, conn, s.svc.scope, statementOfApplicability.ID); err != nil {
return docgen.StatementOfApplicabilityData{}, fmt.Errorf("cannot load applicability statements: %w", err)
}
if len(applicabilityStatements) == 0 {
return docgen.StatementOfApplicabilityData{
Title: statementOfApplicability.Name,
OrganizationName: organization.Name,
CreatedAt: statementOfApplicability.CreatedAt,
TotalControls: 0,
}, nil
}
controlIDs := make([]gid.GID, len(applicabilityStatements))
for i, stmt := range applicabilityStatements {
controlIDs[i] = stmt.ControlID
}
var controls coredata.Controls
if err := controls.LoadByIDs(ctx, conn, s.svc.scope, controlIDs); err != nil {
return docgen.StatementOfApplicabilityData{}, fmt.Errorf("cannot load controls: %w", err)
}
controlMap := make(map[gid.GID]*coredata.Control, len(controls))
frameworkIDSet := make(map[gid.GID]struct{})
for _, c := range controls {
controlMap[c.ID] = c
frameworkIDSet[c.FrameworkID] = struct{}{}
}
frameworkIDs := make([]gid.GID, 0, len(frameworkIDSet))
for id := range frameworkIDSet {
frameworkIDs = append(frameworkIDs, id)
}
var frameworks coredata.Frameworks
if err := frameworks.LoadByIDs(ctx, conn, s.svc.scope, frameworkIDs); err != nil {
return docgen.StatementOfApplicabilityData{}, fmt.Errorf("cannot load frameworks: %w", err)
}
frameworkMap := make(map[gid.GID]*coredata.Framework, len(frameworks))
for _, f := range frameworks {
frameworkMap[f.ID] = f
}
controlOblTypes, err := coredata.LoadObligationTypesByControlIDs(ctx, conn, s.svc.scope, controlIDs)
if err != nil {
return docgen.StatementOfApplicabilityData{}, fmt.Errorf("cannot load obligation types: %w", err)
}
type obligationKey struct {
controlID gid.GID
oblType coredata.ObligationType
}
oblSet := make(map[obligationKey]struct{}, len(controlOblTypes))
for _, co := range controlOblTypes {
oblSet[obligationKey{co.ControlID, co.ObligationType}] = struct{}{}
}
var controlsWithRisk coredata.ControlsWithRisk
if err := controlsWithRisk.LoadByControlIDs(ctx, conn, s.svc.scope, controlIDs); err != nil {
return docgen.StatementOfApplicabilityData{}, fmt.Errorf("cannot load controls with risks: %w", err)
}
riskSet := make(map[gid.GID]struct{}, len(controlsWithRisk))
for _, cwr := range controlsWithRisk {
riskSet[cwr.ControlID] = struct{}{}
}
rows := make([]docgen.SOARow, 0, len(applicabilityStatements))
for _, stmt := range applicabilityStatements {
control := controlMap[stmt.ControlID]
if control == nil {
continue
}
framework := frameworkMap[control.FrameworkID]
if framework == nil {
continue
}
applicable := stmt.Applicability
justification := "-"
if !applicable && stmt.Justification != nil {
justification = *stmt.Justification
}
implemented := "-"
if applicable {
if control.Implemented == coredata.ControlImplementationStateImplemented {
implemented = "Yes"
} else {
implemented = "No"
}
}
notImplJustification := "-"
if applicable && control.Implemented != coredata.ControlImplementationStateImplemented && control.NotImplementedJustification != nil {
notImplJustification = *control.NotImplementedJustification
}
regulatory := "-"
contractual := "-"
bestPractice := "-"
riskAssessment := "-"
if applicable {
_, hasLegal := oblSet[obligationKey{stmt.ControlID, coredata.ObligationTypeLegal}]
regulatory = docgen.BoolLabel(hasLegal)
_, hasContractual := oblSet[obligationKey{stmt.ControlID, coredata.ObligationTypeContractual}]
contractual = docgen.BoolLabel(hasContractual)
bestPractice = docgen.BoolLabel(control.BestPractice)
_, hasRisk := riskSet[stmt.ControlID]
riskAssessment = docgen.BoolLabel(hasRisk)
}
rows = append(rows, docgen.SOARow{
FrameworkName: framework.Name,
ControlSection: control.SectionTitle,
ControlName: control.Name,
Applicability: docgen.BoolLabel(applicable),
Justification: justification,
Implemented: implemented,
NotImplJustification: notImplJustification,
Regulatory: regulatory,
Contractual: contractual,
BestPractice: bestPractice,
RiskAssessment: riskAssessment,
})
}
return docgen.StatementOfApplicabilityData{
Title: statementOfApplicability.Name,
OrganizationName: organization.Name,
CreatedAt: statementOfApplicability.CreatedAt,
TotalControls: len(applicabilityStatements),
Rows: rows,
}, nil
}
var soaTemplate = template.Must(
template.New("statement_of_applicability.json.tmpl").
Funcs(template.FuncMap{
"json": func(v any) (string, error) {
b, err := json.Marshal(v)
if err != nil {
return "", err
}
return string(b), nil
},
}).
ParseFS(Templates, "templates/statement_of_applicability.json.tmpl"),
)
func BuildStatementOfApplicabilityDocument(data docgen.StatementOfApplicabilityData) (string, error) {
var buf bytes.Buffer
if err := soaTemplate.Execute(&buf, data); err != nil {
return "", fmt.Errorf("cannot execute soa template: %w", err)
}
return buf.String(), nil
}

4
pkg/probo/policies.go
View File

@@ -170,8 +170,8 @@ var AuditorPolicy = policy.NewPolicy(
).WithSID("employee-document-access").When(organizationCondition),
policy.Allow(
ActionStatementOfApplicabilityExport,
).WithSID("soa-export").When(organizationCondition),
ActionStatementOfApplicabilityPublish,
).WithSID("soa-publish").When(organizationCondition),
).WithDescription("Read-only probo access for auditors (excludes internal/employee content)")
// EmployeePolicy defines permissions for employee role.

7
pkg/probo/service.go
View File

@@ -118,6 +118,7 @@ type (
DataProtectionImpactAssessments *DataProtectionImpactAssessmentService
TransferImpactAssessments *TransferImpactAssessmentService
StatementsOfApplicability *StatementOfApplicabilityService
GeneratedDocuments *GeneratedDocumentService
Files *FileService
CustomDomains *CustomDomainService
SlackMessages *slack.SlackMessageService
@@ -284,8 +285,10 @@ func (s *Service) WithTenant(tenantID gid.TenantID) *TenantService {
html2pdfConverter: s.html2pdfConverter,
}
tenantService.StatementsOfApplicability = &StatementOfApplicabilityService{
svc: tenantService,
html2pdfConverter: s.html2pdfConverter,
svc: tenantService,
}
tenantService.GeneratedDocuments = &GeneratedDocumentService{
svc: tenantService,
}
tenantService.Files = &FileService{svc: tenantService}
tenantService.CustomDomains = &CustomDomainService{

264
pkg/probo/statement_of_applicability_service.go
View File

@@ -17,34 +17,28 @@ package probo
import (
"context"
"fmt"
"io"
"time"
"go.gearno.de/kit/pg"
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/docgen"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/html2pdf"
"go.probo.inc/probo/pkg/page"
"go.probo.inc/probo/pkg/validator"
)
type StatementOfApplicabilityService struct {
svc *TenantService
html2pdfConverter *html2pdf.Converter
svc *TenantService
}
type (
CreateStatementOfApplicabilityRequest struct {
OrganizationID gid.GID
Name string
OwnerID gid.GID
}
UpdateStatementOfApplicabilityRequest struct {
StatementOfApplicabilityID gid.GID
Name *string
OwnerID *gid.GID
}
)
@@ -53,7 +47,6 @@ func (csr *CreateStatementOfApplicabilityRequest) Validate() error {
v.Check(csr.OrganizationID, "organization_id", validator.Required(), validator.GID(coredata.OrganizationEntityType))
v.Check(csr.Name, "name", validator.SafeTextNoNewLine(TitleMaxLength))
v.Check(csr.OwnerID, "owner_id", validator.Required(), validator.GID(coredata.MembershipProfileEntityType))
return v.Error()
}
@@ -63,7 +56,6 @@ func (usr *UpdateStatementOfApplicabilityRequest) Validate() error {
v.Check(usr.StatementOfApplicabilityID, "statement_of_applicability_id", validator.Required(), validator.GID(coredata.StatementOfApplicabilityEntityType))
v.Check(usr.Name, "name", validator.SafeTextNoNewLine(TitleMaxLength))
v.Check(usr.OwnerID, "owner_id", validator.GID(coredata.MembershipProfileEntityType))
return v.Error()
}
@@ -72,7 +64,6 @@ func (s StatementOfApplicabilityService) ListForOrganizationID(
ctx context.Context,
organizationID gid.GID,
cursor *page.Cursor[coredata.StatementOfApplicabilityOrderField],
filter *coredata.StatementOfApplicabilityFilter,
) (*page.Page[*coredata.StatementOfApplicability, coredata.StatementOfApplicabilityOrderField], error) {
var statementsOfApplicability coredata.StatementsOfApplicability
organization := &coredata.Organization{}
@@ -90,7 +81,6 @@ func (s StatementOfApplicabilityService) ListForOrganizationID(
s.svc.scope,
organization.ID,
cursor,
filter,
)
if err != nil {
return fmt.Errorf("cannot load statements_of_applicability: %w", err)
@@ -110,7 +100,6 @@ func (s StatementOfApplicabilityService) ListForOrganizationID(
func (s StatementOfApplicabilityService) CountForOrganizationID(
ctx context.Context,
organizationID gid.GID,
filter *coredata.StatementOfApplicabilityFilter,
) (int, error) {
var count int
@@ -118,7 +107,7 @@ func (s StatementOfApplicabilityService) CountForOrganizationID(
ctx,
func(ctx context.Context, conn pg.Querier) (err error) {
statementsOfApplicability := &coredata.StatementsOfApplicability{}
count, err = statementsOfApplicability.CountByOrganizationID(ctx, conn, s.svc.scope, organizationID, filter)
count, err = statementsOfApplicability.CountByOrganizationID(ctx, conn, s.svc.scope, organizationID)
if err != nil {
return fmt.Errorf("cannot count statements_of_applicability: %w", err)
}
@@ -180,7 +169,6 @@ func (s StatementOfApplicabilityService) Create(
ID: statementOfApplicabilityID,
OrganizationID: organization.ID,
Name: req.Name,
OwnerID: req.OwnerID,
CreatedAt: now,
UpdatedAt: now,
}
@@ -223,9 +211,6 @@ func (s StatementOfApplicabilityService) Update(
if req.Name != nil {
statementOfApplicability.Name = *req.Name
}
if req.OwnerID != nil {
statementOfApplicability.OwnerID = *req.OwnerID
}
statementOfApplicability.UpdatedAt = time.Now()
@@ -444,248 +429,3 @@ func (s StatementOfApplicabilityService) ListControlLinks(
return page.NewPage(controls, cursor), nil
}
func (s StatementOfApplicabilityService) ExportPDF(
ctx context.Context,
statementOfApplicabilityID gid.GID,
) ([]byte, error) {
var documentData docgen.StatementOfApplicabilityData
err := s.svc.pg.WithConn(
ctx,
func(ctx context.Context, conn pg.Querier) error {
statementOfApplicability := &coredata.StatementOfApplicability{}
if err := statementOfApplicability.LoadByID(ctx, conn, s.svc.scope, statementOfApplicabilityID); err != nil {
return fmt.Errorf("cannot load statement of applicability: %w", err)
}
organization := &coredata.Organization{}
if err := organization.LoadByID(ctx, conn, s.svc.scope, statementOfApplicability.OrganizationID); err != nil {
return fmt.Errorf("cannot load organization: %w", err)
}
owner := &coredata.MembershipProfile{}
if err := owner.LoadByID(ctx, conn, s.svc.scope, statementOfApplicability.OwnerID); err != nil {
return fmt.Errorf("cannot load owner profile: %w", err)
}
// Load applicability statements
var applicabilityStatements coredata.ApplicabilityStatements
cursor := page.NewCursor(
10000,
nil,
page.Head,
page.OrderBy[coredata.ApplicabilityStatementOrderField]{
Field: coredata.ApplicabilityStatementOrderFieldControlSectionTitle,
Direction: page.OrderDirectionAsc,
},
)
if err := applicabilityStatements.LoadByStatementOfApplicabilityID(ctx, conn, s.svc.scope, statementOfApplicabilityID, cursor); err != nil {
return fmt.Errorf("cannot load applicability statements: %w", err)
}
if len(applicabilityStatements) == 0 {
// No linked controls, skip loading additional data
documentData = docgen.StatementOfApplicabilityData{
Title: statementOfApplicability.Name,
OrganizationName: organization.Name,
CreatedAt: statementOfApplicability.CreatedAt,
TotalControls: 0,
FrameworkGroups: []docgen.FrameworkControlGroup{},
}
return nil
}
frameworkControlsMap := make(map[string][]docgen.ControlData)
frameworkOrder := []string{}
for _, stmt := range applicabilityStatements {
// Load control
control := &coredata.Control{}
if err := control.LoadByID(ctx, conn, s.svc.scope, stmt.ControlID); err != nil {
return fmt.Errorf("cannot load control: %w", err)
}
// Load framework
framework := &coredata.Framework{}
if err := framework.LoadByID(ctx, conn, s.svc.scope, control.FrameworkID); err != nil {
return fmt.Errorf("cannot load framework: %w", err)
}
// Count legal obligations
var controlObligations coredata.ControlObligations
legalType := coredata.ObligationTypeLegal
legalFilter := coredata.NewControlObligationFilter(&legalType)
legalCount, err := controlObligations.CountByControlID(ctx, conn, s.svc.scope, stmt.ControlID, legalFilter)
if err != nil {
return fmt.Errorf("cannot count legal obligations: %w", err)
}
// Count contractual obligations
contractualType := coredata.ObligationTypeContractual
contractualFilter := coredata.NewControlObligationFilter(&contractualType)
contractualCount, err := controlObligations.CountByControlID(ctx, conn, s.svc.scope, stmt.ControlID, contractualFilter)
if err != nil {
return fmt.Errorf("cannot count contractual obligations: %w", err)
}
// Check if control has risk
var controlsWithRisk coredata.ControlsWithRisk
if err := controlsWithRisk.LoadByControlIDs(ctx, conn, s.svc.scope, []gid.GID{stmt.ControlID}); err != nil {
return fmt.Errorf("cannot load controls with risks: %w", err)
}
hasRisk := len(controlsWithRisk) > 0
if _, exists := frameworkControlsMap[framework.Name]; !exists {
frameworkOrder = append(frameworkOrder, framework.Name)
frameworkControlsMap[framework.Name] = []docgen.ControlData{}
}
var regulatory *bool
var contractual *bool
var bestPractice *bool
var riskAssessment *bool
if stmt.Applicability {
falseVal := false
trueVal := true
regulatory = &falseVal
contractual = &falseVal
riskAssessment = &falseVal
if legalCount > 0 {
regulatory = &trueVal
}
if contractualCount > 0 {
contractual = &trueVal
}
if hasRisk {
riskAssessment = &trueVal
}
bestPractice = &control.BestPractice
}
applicability := stmt.Applicability
implemented := control.Implemented.String()
frameworkControlsMap[framework.Name] = append(
frameworkControlsMap[framework.Name],
docgen.ControlData{
FrameworkName: framework.Name,
SectionTitle: control.SectionTitle,
Name: control.Name,
Applicability: &applicability,
Justification: stmt.Justification,
BestPractice: bestPractice,
Implemented: &implemented,
NotImplementedJustification: func() *string {
if control.Implemented == coredata.ControlImplementationStateImplemented {
return nil
}
return control.NotImplementedJustification
}(),
Regulatory: regulatory,
Contractual: contractual,
RiskAssessment: riskAssessment,
},
)
}
frameworkGroups := make([]docgen.FrameworkControlGroup, len(frameworkOrder))
for i, frameworkName := range frameworkOrder {
frameworkGroups[i] = docgen.FrameworkControlGroup{
FrameworkName: frameworkName,
Controls: frameworkControlsMap[frameworkName],
}
}
var snapshots coredata.Snapshots
snapshotType := coredata.SnapshotsTypeStatementsOfApplicability
var version int
var publishedAt time.Time
if statementOfApplicability.SnapshotID != nil {
snapshot := &coredata.Snapshot{}
if err := snapshot.LoadByID(ctx, conn, s.svc.scope, *statementOfApplicability.SnapshotID); err != nil {
return fmt.Errorf("cannot load snapshot: %w", err)
}
publishedAt = snapshot.CreatedAt
snapshotFilter := coredata.NewSnapshotFilter(&snapshotType).WithBeforeDate(&snapshot.CreatedAt)
snapshotCount, err := snapshots.CountByOrganizationID(ctx, conn, s.svc.scope, statementOfApplicability.OrganizationID, snapshotFilter)
if err != nil {
return fmt.Errorf("cannot count states of applicability snapshots: %w", err)
}
version = snapshotCount
} else {
publishedAt = time.Now()
snapshotFilter := coredata.NewSnapshotFilter(&snapshotType)
snapshotCount, err := snapshots.CountByOrganizationID(ctx, conn, s.svc.scope, statementOfApplicability.OrganizationID, snapshotFilter)
if err != nil {
return fmt.Errorf("cannot count states of applicability snapshots: %w", err)
}
version = snapshotCount + 1
}
horizontalLogoBase64 := ""
if organization.HorizontalLogoFileID != nil {
fileRecord := &coredata.File{}
fileErr := fileRecord.LoadByID(ctx, conn, s.svc.scope, *organization.HorizontalLogoFileID)
if fileErr == nil {
base64Data, mimeType, logoErr := s.svc.fileManager.GetFileBase64(ctx, fileRecord)
if logoErr == nil {
horizontalLogoBase64 = fmt.Sprintf("data:%s;base64,%s", mimeType, base64Data)
}
}
}
documentData = docgen.StatementOfApplicabilityData{
Title: statementOfApplicability.Name,
OrganizationName: organization.Name,
CreatedAt: statementOfApplicability.CreatedAt,
TotalControls: len(applicabilityStatements),
FrameworkGroups: frameworkGroups,
CompanyHorizontalLogoBase64: horizontalLogoBase64,
Version: version,
PublishedAt: publishedAt,
Approver: owner.FullName,
}
return nil
},
)
if err != nil {
return nil, err
}
htmlData, err := docgen.RenderStatementOfApplicabilityHTML(documentData)
if err != nil {
return nil, fmt.Errorf("cannot render HTML: %w", err)
}
cfg := html2pdf.RenderConfig{
PageFormat: html2pdf.PageFormatA4,
Orientation: html2pdf.OrientationPortrait,
MarginTop: html2pdf.NewMarginInches(1.0),
MarginBottom: html2pdf.NewMarginInches(1.0),
MarginLeft: html2pdf.NewMarginInches(1.0),
MarginRight: html2pdf.NewMarginInches(1.0),
PrintBackground: true,
Scale: 1.0,
}
pdfReader, err := s.html2pdfConverter.GeneratePDF(ctx, htmlData, cfg)
if err != nil {
return nil, fmt.Errorf("cannot generate PDF: %w", err)
}
pdfData, err := io.ReadAll(pdfReader)
if err != nil {
return nil, fmt.Errorf("cannot read PDF data: %w", err)
}
return pdfData, nil
}

189
pkg/probo/templates/statement_of_applicability.json.tmpl Normal file
View File

@@ -0,0 +1,189 @@
{
"type": "doc",
"content": [
{
"type": "heading",
"attrs": { "level": 1 },
"content": [{ "type": "text", "text": "1. Purpose" }]
},
{
"type": "paragraph",
"content": [{ "type": "text", "text": "This document provides a comprehensive overview of the statement of applicability for controls within the organization. It serves as a record of which controls are applicable or not applicable to the organization, along with their relationships to regulatory requirements, contractual obligations, risk assessments, and best practices." }]
},
{ "type": "horizontalRule" },
{
"type": "heading",
"attrs": { "level": 1 },
"content": [{ "type": "text", "text": "2. Controls" }]
},
{
"type": "table",
"content": [
{
"type": "tableRow",
"content": [
{ "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 2, "colwidth": [120] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Framework", "marks": [{ "type": "bold" }] }] }] },
{ "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 2, "colwidth": [250] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Control", "marks": [{ "type": "bold" }] }] }] },
{ "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 2, "colwidth": [70] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Applicability", "marks": [{ "type": "bold" }] }] }] },
{ "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 2, "colwidth": [130] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Justification for non-applicability", "marks": [{ "type": "bold" }] }] }] },
{ "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 2, "colwidth": [70] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Implemented", "marks": [{ "type": "bold" }] }] }] },
{ "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 2, "colwidth": [110] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Justification for non-implementation", "marks": [{ "type": "bold" }] }] }] },
{ "type": "tableHeader", "attrs": { "colspan": 4, "rowspan": 1 }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Justification for inclusion", "marks": [{ "type": "bold" }] }] }] }
]
},
{
"type": "tableRow",
"content": [
{ "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [60] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Regulatory", "marks": [{ "type": "bold" }] }] }] },
{ "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [60] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Contractual", "marks": [{ "type": "bold" }] }] }] },
{ "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [60] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Best Practice", "marks": [{ "type": "bold" }] }] }] },
{ "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [60] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Risk Assessment", "marks": [{ "type": "bold" }] }] }] }
]
}{{range .Rows}},
{
"type": "tableRow",
"content": [
{ "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [120] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .FrameworkName}} }] }] },
{ "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [250] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json (printf "[%s] " .ControlSection)}}, "marks": [{ "type": "code" }] }, { "type": "text", "text": {{json .ControlName}} }] }] },
{ "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [70] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .Applicability}} }] }] },
{ "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [130] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .Justification}} }] }] },
{ "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [70] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .Implemented}} }] }] },
{ "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [110] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .NotImplJustification}} }] }] },
{ "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [60] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .Regulatory}} }] }] },
{ "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [60] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .Contractual}} }] }] },
{ "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [60] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .BestPractice}} }] }] },
{ "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [60] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .RiskAssessment}} }] }] }
]
}{{end}}
]
},
{ "type": "horizontalRule" },
{
"type": "heading",
"attrs": { "level": 1 },
"content": [{ "type": "text", "text": "3. Definitions" }]
},
{
"type": "heading",
"attrs": { "level": 3 },
"content": [{ "type": "text", "text": "Framework" }]
},
{
"type": "paragraph",
"content": [{ "type": "text", "text": "The name of the compliance framework or standard to which the control belongs (e.g., ISO 27001, SOC 2, GDPR)." }]
},
{
"type": "heading",
"attrs": { "level": 3 },
"content": [{ "type": "text", "text": "Control" }]
},
{
"type": "paragraph",
"content": [{ "type": "text", "text": "The specific control identifier and name within the framework, including its section reference." }]
},
{
"type": "heading",
"attrs": { "level": 3 },
"content": [{ "type": "text", "text": "Applicability" }]
},
{
"type": "bulletList",
"content": [
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Yes: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "The control is applicable to the organization." }] }] },
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "No: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "The control is not applicable to the organization (with justification provided)." }] }] }
]
},
{
"type": "heading",
"attrs": { "level": 3 },
"content": [{ "type": "text", "text": "Justification for non-applicability" }]
},
{
"type": "paragraph",
"content": [{ "type": "text", "text": "Provides the rationale when a control is not applicable. This field is empty for applicable controls." }]
},
{
"type": "heading",
"attrs": { "level": 3 },
"content": [{ "type": "text", "text": "Implemented" }]
},
{
"type": "bulletList",
"content": [
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Yes: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "The control has been implemented by the organization." }] }] },
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "No: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "The control has not been implemented (with justification provided)." }] }] },
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "-: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "Not applicable (control is not applicable)." }] }] }
]
},
{
"type": "heading",
"attrs": { "level": 3 },
"content": [{ "type": "text", "text": "Justification for non-implementation" }]
},
{
"type": "paragraph",
"content": [{ "type": "text", "text": "Provides the rationale when a control is not implemented. This field is empty for implemented controls or when the control is not applicable." }]
},
{
"type": "heading",
"attrs": { "level": 3 },
"content": [{ "type": "text", "text": "Justification for inclusion" }]
},
{
"type": "paragraph",
"content": [{ "type": "text", "text": "For applicable controls, this section provides additional context on why the control is included, based on regulatory requirements, contractual obligations, best practices, or risk assessments." }]
},
{
"type": "heading",
"attrs": { "level": 4 },
"content": [{ "type": "text", "text": "Regulatory" }]
},
{
"type": "bulletList",
"content": [
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Yes: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "The control is linked to one or more legal or regulatory obligations." }] }] },
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "No: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "The control is not associated with any legal or regulatory obligations." }] }] },
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "-: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "Not applicable (control is not applicable)." }] }] }
]
},
{
"type": "heading",
"attrs": { "level": 4 },
"content": [{ "type": "text", "text": "Contractual" }]
},
{
"type": "bulletList",
"content": [
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Yes: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "The control is linked to one or more contractual obligations." }] }] },
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "No: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "The control is not associated with any contractual obligations." }] }] },
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "-: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "Not applicable (control is not applicable)." }] }] }
]
},
{
"type": "heading",
"attrs": { "level": 4 },
"content": [{ "type": "text", "text": "Best Practice" }]
},
{
"type": "bulletList",
"content": [
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Yes: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "The control is designated as a best practice recommendation." }] }] },
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "No: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "The control is not designated as a best practice." }] }] },
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "-: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "Not applicable (control is not applicable)." }] }] }
]
},
{
"type": "heading",
"attrs": { "level": 4 },
"content": [{ "type": "text", "text": "Risk Assessment" }]
},
{
"type": "bulletList",
"content": [
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Yes: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "The control is associated with one or more identified risks through risk mitigation measures." }] }] },
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "No: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "The control is not currently associated with any identified risks." }] }] },
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "-: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "Not applicable (control is not applicable)." }] }] }
]
}
]
}

72
pkg/server/api/console/v1/control_resolvers.go
View File

@@ -7,7 +7,6 @@ package console_v1
import (
"context"
"encoding/base64"
"errors"
"fmt"
@@ -15,7 +14,6 @@ import (
"go.gearno.de/kit/log"
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/iam"
"go.probo.inc/probo/pkg/page"
"go.probo.inc/probo/pkg/probo"
"go.probo.inc/probo/pkg/server/api/console/v1/dataloader"
@@ -229,6 +227,7 @@ func (r *controlResolver) Documents(ctx context.Context, obj *types.Control, fir
var documentFilter = coredata.NewDocumentFilter(nil)
if filter != nil {
documentFilter = coredata.NewDocumentFilter(filter.Query).
WithWriteModes(filter.WriteModes).
WithDocumentTypes(filter.DocumentTypes).
WithClassifications(filter.Classifications)
}
@@ -768,7 +767,6 @@ func (r *mutationResolver) CreateStatementOfApplicability(ctx context.Context, i
probo.CreateStatementOfApplicabilityRequest{
OrganizationID: input.OrganizationID,
Name: input.Name,
OwnerID: input.OwnerID,
},
)
if err != nil {
@@ -805,7 +803,6 @@ func (r *mutationResolver) UpdateStatementOfApplicability(ctx context.Context, i
probo.UpdateStatementOfApplicabilityRequest{
StatementOfApplicabilityID: input.ID,
Name: name,
OwnerID: input.OwnerID,
},
)
if err != nil {
@@ -843,28 +840,53 @@ func (r *mutationResolver) DeleteStatementOfApplicability(ctx context.Context, i
}, nil
}
// ExportStatementOfApplicabilityPDF is the resolver for the exportStatementOfApplicabilityPDF field.
func (r *mutationResolver) ExportStatementOfApplicabilityPDF(ctx context.Context, input types.ExportStatementOfApplicabilityPDFInput) (*types.ExportStatementOfApplicabilityPDFPayload, error) {
if err := r.authorize(ctx, input.StatementOfApplicabilityID, probo.ActionStatementOfApplicabilityExport); err != nil {
// PublishStatementOfApplicability is the resolver for the publishStatementOfApplicability field.
func (r *mutationResolver) PublishStatementOfApplicability(ctx context.Context, input types.PublishStatementOfApplicabilityInput) (*types.PublishStatementOfApplicabilityPayload, error) {
if err := r.authorize(ctx, input.StatementOfApplicabilityID, probo.ActionStatementOfApplicabilityPublish); err != nil {
return nil, err
}
prb := r.ProboService(ctx, input.StatementOfApplicabilityID.TenantID())
pdfData, err := prb.StatementsOfApplicability.ExportPDF(ctx, input.StatementOfApplicabilityID)
document, documentVersion, err := prb.GeneratedDocuments.PublishStatementOfApplicability(ctx, input.StatementOfApplicabilityID, input.ApproverIds)
if err != nil {
r.logger.ErrorCtx(ctx, "cannot export statement of applicability PDF", log.Error(err))
if errors.Is(err, coredata.ErrResourceAlreadyExists) {
return nil, gqlutils.Conflict(ctx, err)
}
r.logger.ErrorCtx(ctx, "cannot publish statement of applicability", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
base64Data := base64.StdEncoding.EncodeToString(pdfData)
dataURI := fmt.Sprintf("data:application/pdf;base64,%s", base64Data)
return &types.ExportStatementOfApplicabilityPDFPayload{
Data: dataURI,
return &types.PublishStatementOfApplicabilityPayload{
DocumentEdge: types.NewDocumentEdge(document, coredata.DocumentOrderFieldCreatedAt),
DocumentVersionEdge: types.NewDocumentVersionEdge(documentVersion, coredata.DocumentVersionOrderFieldCreatedAt),
}, nil
}
// Document is the resolver for the document field.
func (r *statementOfApplicabilityResolver) Document(ctx context.Context, obj *types.StatementOfApplicability) (*types.Document, error) {
if obj.Document == nil {
return nil, nil
}
if err := r.authorize(ctx, obj.Document.ID, probo.ActionDocumentGet); err != nil {
return nil, err
}
prb := r.ProboService(ctx, obj.Document.ID.TenantID())
document, err := prb.Documents.Get(ctx, obj.Document.ID)
if err != nil {
if errors.Is(err, coredata.ErrResourceNotFound) {
return nil, nil
}
r.logger.ErrorCtx(ctx, "cannot load document", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
return types.NewDocument(document), nil
}
// Organization is the resolver for the organization field.
func (r *statementOfApplicabilityResolver) Organization(ctx context.Context, obj *types.StatementOfApplicability) (*types.Organization, error) {
if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
@@ -885,26 +907,6 @@ func (r *statementOfApplicabilityResolver) Organization(ctx context.Context, obj
return types.NewOrganization(organization), nil
}
// Owner is the resolver for the owner field.
func (r *statementOfApplicabilityResolver) Owner(ctx context.Context, obj *types.StatementOfApplicability) (*types.Profile, error) {
if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
return nil, err
}
loaders := dataloader.FromContext(ctx)
owner, err := loaders.Profile.Load(ctx, obj.Owner.ID)
if err != nil {
if errors.Is(err, coredata.ErrResourceNotFound) || errors.Is(err, dataloadgen.ErrNotFound) {
return nil, gqlutils.NotFound(ctx, err)
}
r.logger.ErrorCtx(ctx, "cannot load owner", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
return types.NewProfile(owner), nil
}
// ApplicabilityStatements is the resolver for the applicabilityStatements field.
func (r *statementOfApplicabilityResolver) ApplicabilityStatements(ctx context.Context, obj *types.StatementOfApplicability, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ApplicabilityStatementOrderBy) (*types.ApplicabilityStatementConnection, error) {
if err := r.authorize(ctx, obj.ID, probo.ActionApplicabilityStatementList); err != nil {
@@ -946,7 +948,7 @@ func (r *statementOfApplicabilityConnectionResolver) TotalCount(ctx context.Cont
switch obj.Resolver.(type) {
case *organizationResolver:
count, err := prb.StatementsOfApplicability.CountForOrganizationID(ctx, obj.ParentID, obj.Filters)
count, err := prb.StatementsOfApplicability.CountForOrganizationID(ctx, obj.ParentID)
if err != nil {
r.logger.ErrorCtx(ctx, "cannot count statements_of_applicability", log.Error(err))
return 0, gqlutils.Internal(ctx)

24
pkg/server/api/console/v1/graphql/control.graphql
View File

@@ -78,10 +78,6 @@ input ControlFilter {
query: String
}
input StatementOfApplicabilityFilter {
snapshotId: ID
}
type Control implements Node {
id: ID!
organization: Organization @goField(forceResolver: true)
@@ -163,10 +159,8 @@ type ControlEdge {
type StatementOfApplicability implements Node {
id: ID!
name: String!
sourceId: ID
snapshotId: ID
document: Document @goField(forceResolver: true)
organization: Organization @goField(forceResolver: true)
owner: Profile! @goField(forceResolver: true)
createdAt: Datetime!
updatedAt: Datetime!
@@ -273,9 +267,9 @@ extend type Mutation {
deleteStatementOfApplicability(
input: DeleteStatementOfApplicabilityInput!
): DeleteStatementOfApplicabilityPayload!
exportStatementOfApplicabilityPDF(
input: ExportStatementOfApplicabilityPDFInput!
): ExportStatementOfApplicabilityPDFPayload!
publishStatementOfApplicability(
input: PublishStatementOfApplicabilityInput!
): PublishStatementOfApplicabilityPayload!
}
input CreateControlInput {
@@ -372,13 +366,11 @@ input DeleteControlSnapshotMappingInput {
input CreateStatementOfApplicabilityInput {
organizationId: ID!
name: String!
ownerId: ID!
}
input UpdateStatementOfApplicabilityInput {
id: ID!
name: String
ownerId: ID
}
input ApplicabilityStatementInput {
@@ -391,8 +383,9 @@ input DeleteStatementOfApplicabilityInput {
statementOfApplicabilityId: ID!
}
input ExportStatementOfApplicabilityPDFInput {
input PublishStatementOfApplicabilityInput {
statementOfApplicabilityId: ID!
approverIds: [ID!]
}
type CreateControlPayload {
@@ -481,6 +474,7 @@ type DeleteStatementOfApplicabilityPayload {
deletedStatementOfApplicabilityId: ID!
}
type ExportStatementOfApplicabilityPDFPayload {
data: String!
type PublishStatementOfApplicabilityPayload {
documentEdge: DocumentEdge!
documentVersionEdge: DocumentVersionEdge!
}

33
pkg/server/api/console/v1/graphql/document.graphql
View File

@@ -37,6 +37,36 @@ enum DocumentType
REPORT @goEnum(value: "go.probo.inc/probo/pkg/coredata.DocumentTypeReport")
TEMPLATE
@goEnum(value: "go.probo.inc/probo/pkg/coredata.DocumentTypeTemplate")
STATEMENT_OF_APPLICABILITY
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.DocumentTypeStatementOfApplicability"
)
}
enum DocumentVersionOrientation
@goModel(
model: "go.probo.inc/probo/pkg/coredata.DocumentVersionOrientation"
) {
PORTRAIT
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.DocumentVersionOrientationPortrait"
)
LANDSCAPE
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.DocumentVersionOrientationLandscape"
)
}
enum DocumentWriteMode
@goModel(model: "go.probo.inc/probo/pkg/coredata.DocumentWriteMode") {
AUTHORED
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.DocumentWriteModeAuthored"
)
GENERATED
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.DocumentWriteModeGenerated"
)
}
enum DocumentClassification
@@ -199,6 +229,7 @@ input DocumentVersionOrder
input DocumentFilter {
query: String
writeModes: [DocumentWriteMode!]
documentTypes: [DocumentType!]
classifications: [DocumentClassification!]
status: [DocumentStatus!]
@@ -259,6 +290,7 @@ type Document implements Node {
defaultApprovers: [Profile!]! @goField(forceResolver: true)
writeMode: DocumentWriteMode!
status: DocumentStatus!
archivedAt: Datetime
@@ -279,6 +311,7 @@ type DocumentVersion implements Node {
title: String!
classification: DocumentClassification!
documentType: DocumentType!
orientation: DocumentVersionOrientation!
approvers(
first: Int
after: CursorKey

4
pkg/server/api/console/v1/graphql/electronic_signature.graphql
View File

@@ -60,6 +60,10 @@ enum ElectronicSignatureDocumentType
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.ElectronicSignatureDocumentTypeOther"
)
STATEMENT_OF_APPLICABILITY
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.ElectronicSignatureDocumentTypeStatementOfApplicability"
)
}
enum ElectronicSignatureEventType

1
pkg/server/api/console/v1/graphql/organization.graphql
View File

@@ -190,7 +190,6 @@ type Organization implements Node {
last: Int
before: CursorKey
orderBy: StatementOfApplicabilityOrder
filter: StatementOfApplicabilityFilter = { snapshotId: null }
): StatementOfApplicabilityConnection! @goField(forceResolver: true)
dataProtectionImpactAssessments(

1
pkg/server/api/console/v1/measure_resolvers.go
View File

@@ -174,6 +174,7 @@ func (r *measureResolver) Documents(ctx context.Context, obj *types.Measure, fir
var documentFilter = coredata.NewDocumentFilter(nil)
if filter != nil {
documentFilter = coredata.NewDocumentFilter(filter.Query).
WithWriteModes(filter.WriteModes).
WithDocumentTypes(filter.DocumentTypes).
WithClassifications(filter.Classifications)
}

12
pkg/server/api/console/v1/organization_resolvers.go
View File

@@ -540,7 +540,7 @@ func (r *organizationResolver) Controls(ctx context.Context, obj *types.Organiza
}
// StatementsOfApplicability is the resolver for the statementsOfApplicability field.
func (r *organizationResolver) StatementsOfApplicability(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.StatementOfApplicabilityOrderBy, filter *types.StatementOfApplicabilityFilter) (*types.StatementOfApplicabilityConnection, error) {
func (r *organizationResolver) StatementsOfApplicability(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.StatementOfApplicabilityOrderBy) (*types.StatementOfApplicabilityConnection, error) {
if err := r.authorize(ctx, obj.ID, probo.ActionStatementOfApplicabilityList); err != nil {
return nil, err
}
@@ -560,18 +560,13 @@ func (r *organizationResolver) StatementsOfApplicability(ctx context.Context, ob
cursor := types.NewCursor(first, after, last, before, pageOrderBy)
var statementOfApplicabilityFilter = coredata.NewStatementOfApplicabilityFilter(nil)
if filter != nil {
statementOfApplicabilityFilter = coredata.NewStatementOfApplicabilityFilter(&filter.SnapshotID)
}
page, err := prb.StatementsOfApplicability.ListForOrganizationID(ctx, obj.ID, cursor, statementOfApplicabilityFilter)
page, err := prb.StatementsOfApplicability.ListForOrganizationID(ctx, obj.ID, cursor)
if err != nil {
r.logger.ErrorCtx(ctx, "cannot list organization statements_of_applicability", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
return types.NewStatementOfApplicabilityConnection(page, r, obj.ID, statementOfApplicabilityFilter), nil
return types.NewStatementOfApplicabilityConnection(page, r, obj.ID), nil
}
// DataProtectionImpactAssessments is the resolver for the dataProtectionImpactAssessments field.
@@ -670,6 +665,7 @@ func (r *organizationResolver) Documents(ctx context.Context, obj *types.Organiz
var documentFilter = coredata.NewDocumentFilter(nil)
if filter != nil {
documentFilter = coredata.NewDocumentFilter(filter.Query).
WithWriteModes(filter.WriteModes).
WithDocumentTypes(filter.DocumentTypes).
WithClassifications(filter.Classifications).
WithStatus(filter.Status)

1
pkg/server/api/console/v1/risk_resolvers.go
View File

@@ -344,6 +344,7 @@ func (r *riskResolver) Documents(ctx context.Context, obj *types.Risk, first *in
var documentFilter = coredata.NewDocumentFilter(nil)
if filter != nil {
documentFilter = coredata.NewDocumentFilter(filter.Query).
WithWriteModes(filter.WriteModes).
WithDocumentTypes(filter.DocumentTypes).
WithClassifications(filter.Classifications)
}

1
pkg/server/api/console/v1/types/document.go
View File

@@ -81,6 +81,7 @@ func NewDocument(document *coredata.Document) *Document {
},
CurrentPublishedMajor: document.CurrentPublishedMajor,
CurrentPublishedMinor: document.CurrentPublishedMinor,
WriteMode: document.WriteMode,
TrustCenterVisibility: document.TrustCenterVisibility,
Status: document.Status,
ArchivedAt: document.ArchivedAt,

1
pkg/server/api/console/v1/types/document_version.go
View File

@@ -83,6 +83,7 @@ func NewDocumentVersion(documentVersion *coredata.DocumentVersion) *DocumentVers
Status: documentVersion.Status,
Classification: documentVersion.Classification,
DocumentType: documentVersion.DocumentType,
Orientation: documentVersion.Orientation,
PublishedAt: documentVersion.PublishedAt,
Changelog: documentVersion.Changelog,
CreatedAt: documentVersion.CreatedAt,

24
pkg/server/api/console/v1/types/statement_of_applicability.go
View File

@@ -30,7 +30,6 @@ type (
Resolver any
ParentID gid.GID
Filters *coredata.StatementOfApplicabilityFilter
}
)
@@ -38,7 +37,6 @@ func NewStatementOfApplicabilityConnection(
p *page.Page[*coredata.StatementOfApplicability, coredata.StatementOfApplicabilityOrderField],
parentType any,
parentID gid.GID,
filters *coredata.StatementOfApplicabilityFilter,
) *StatementOfApplicabilityConnection {
var edges = make([]*StatementOfApplicabilityEdge, len(p.Data))
@@ -52,7 +50,6 @@ func NewStatementOfApplicabilityConnection(
Resolver: parentType,
ParentID: parentID,
Filters: filters,
}
}
@@ -64,18 +61,21 @@ func NewStatementOfApplicabilityEdge(soa *coredata.StatementOfApplicability, ord
}
func NewStatementOfApplicability(soa *coredata.StatementOfApplicability) *StatementOfApplicability {
return &StatementOfApplicability{
s := &StatementOfApplicability{
ID: soa.ID,
Organization: &Organization{
ID: soa.OrganizationID,
},
Owner: &Profile{
ID: soa.OwnerID,
},
Name: soa.Name,
SourceID: soa.SourceID,
SnapshotID: soa.SnapshotID,
CreatedAt: soa.CreatedAt,
UpdatedAt: soa.UpdatedAt,
Name: soa.Name,
CreatedAt: soa.CreatedAt,
UpdatedAt: soa.UpdatedAt,
}
if soa.DocumentID != nil {
s.Document = &Document{
ID: *soa.DocumentID,
}
}
return s
}

49
pkg/server/api/mcp/v1/schema.resolvers.go
View File

@@ -6,7 +6,6 @@ package mcp_v1
import (
"context"
"encoding/base64"
"errors"
"fmt"
"time"
@@ -2045,6 +2044,7 @@ func (r *Resolver) ListDocumentsTool(ctx context.Context, req *mcp.CallToolReque
}
documentFilter = coredata.NewDocumentFilter(query).
WithWriteModes(input.Filter.WriteModes).
WithDocumentTypes(input.Filter.DocumentTypes).
WithClassifications(input.Filter.Classifications).
WithStatus(input.Filter.Status)
@@ -2818,13 +2818,7 @@ func (r *Resolver) ListStatementsOfApplicabilityTool(ctx context.Context, req *m
cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)
noSnapshot := (*gid.GID)(nil)
filter := coredata.NewStatementOfApplicabilityFilter(&noSnapshot)
if input.Filter != nil {
filter = coredata.NewStatementOfApplicabilityFilter(&input.Filter.SnapshotID)
}
pg, err := prb.StatementsOfApplicability.ListForOrganizationID(ctx, input.OrganizationID, cursor, filter)
pg, err := prb.StatementsOfApplicability.ListForOrganizationID(ctx, input.OrganizationID, cursor)
if err != nil {
return nil, types.ListStatementsOfApplicabilityOutput{}, fmt.Errorf("failed to list statements of applicability: %w", err)
}
@@ -2855,7 +2849,6 @@ func (r *Resolver) AddStatementOfApplicabilityTool(ctx context.Context, req *mcp
soa, err := svc.StatementsOfApplicability.Create(ctx, probo.CreateStatementOfApplicabilityRequest{
OrganizationID: input.OrganizationID,
Name: input.Name,
OwnerID: input.OwnerID,
})
if err != nil {
return nil, types.AddStatementOfApplicabilityOutput{}, fmt.Errorf("failed to create statement of applicability: %w", err)
@@ -2874,7 +2867,6 @@ func (r *Resolver) UpdateStatementOfApplicabilityTool(ctx context.Context, req *
soa, err := svc.StatementsOfApplicability.Update(ctx, probo.UpdateStatementOfApplicabilityRequest{
StatementOfApplicabilityID: input.ID,
Name: input.Name,
OwnerID: input.OwnerID,
})
if err != nil {
return nil, types.UpdateStatementOfApplicabilityOutput{}, fmt.Errorf("failed to update statement of applicability: %w", err)
@@ -2900,27 +2892,6 @@ func (r *Resolver) DeleteStatementOfApplicabilityTool(ctx context.Context, req *
}, nil
}
func (r *Resolver) ExportStatementOfApplicabilityPDFTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ExportStatementOfApplicabilityPDFInput) (*mcp.CallToolResult, types.ExportStatementOfApplicabilityPDFOutput, error) {
r.MustAuthorize(ctx, input.ID, probo.ActionStatementOfApplicabilityExport)
svc := r.ProboService(ctx, input.ID)
soa, err := svc.StatementsOfApplicability.Get(ctx, input.ID)
if err != nil {
return nil, types.ExportStatementOfApplicabilityPDFOutput{}, fmt.Errorf("failed to get statement of applicability: %w", err)
}
pdfData, err := svc.StatementsOfApplicability.ExportPDF(ctx, input.ID)
if err != nil {
return nil, types.ExportStatementOfApplicabilityPDFOutput{}, fmt.Errorf("failed to export statement of applicability PDF: %w", err)
}
return nil, types.ExportStatementOfApplicabilityPDFOutput{
PdfBase64: base64.StdEncoding.EncodeToString(pdfData),
Filename: soa.Name + ".pdf",
}, nil
}
func (r *Resolver) ListApplicabilityStatementsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListApplicabilityStatementsInput) (*mcp.CallToolResult, types.ListApplicabilityStatementsOutput, error) {
r.MustAuthorize(ctx, input.StatementOfApplicabilityID, probo.ActionApplicabilityStatementList)
@@ -3935,3 +3906,19 @@ func (r *Resolver) DeleteDocumentDraftTool(ctx context.Context, req *mcp.CallToo
Document: types.NewDocument(document),
}, nil
}
func (r *Resolver) PublishStatementOfApplicabilityTool(ctx context.Context, req *mcp.CallToolRequest, input *types.PublishStatementOfApplicabilityInput) (*mcp.CallToolResult, types.PublishStatementOfApplicabilityOutput, error) {
r.MustAuthorize(ctx, input.ID, probo.ActionStatementOfApplicabilityPublish)
svc := r.ProboService(ctx, input.ID)
document, documentVersion, err := svc.GeneratedDocuments.PublishStatementOfApplicability(ctx, input.ID, input.ApproverIds)
if err != nil {
return nil, types.PublishStatementOfApplicabilityOutput{}, fmt.Errorf("cannot publish statement of applicability: %w", err)
}
return nil, types.PublishStatementOfApplicabilityOutput{
DocumentID: document.ID,
DocumentVersionID: documentVersion.ID,
}, nil
}

69
pkg/server/api/mcp/v1/specification.yaml
View File

@@ -5144,6 +5144,7 @@ components:
- RECORD
- REPORT
- TEMPLATE
- STATEMENT_OF_APPLICABILITY
go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.DocumentType
DocumentClassification:
@@ -5170,6 +5171,13 @@ components:
- ARCHIVED
go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.DocumentStatus
DocumentWriteMode:
type: string
enum:
- AUTHORED
- GENERATED
go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.DocumentWriteMode
DocumentVersionSignatureState:
type: string
enum:
@@ -5244,6 +5252,7 @@ components:
- id
- organization_id
- trust_center_visibility
- write_mode
- status
- created_at
- updated_at
@@ -5267,6 +5276,9 @@ components:
trust_center_visibility:
$ref: "#/components/schemas/TrustCenterVisibility"
description: Trust center visibility
write_mode:
$ref: "#/components/schemas/DocumentWriteMode"
description: Write mode (authored or generated)
status:
$ref: "#/components/schemas/DocumentStatus"
description: Document status
@@ -5419,6 +5431,11 @@ components:
query:
type: string
description: Search query
write_modes:
type: array
items:
$ref: "#/components/schemas/DocumentWriteMode"
description: Filter by write mode (AUTHORED or GENERATED)
trust_center_visibilities:
type: array
items:
@@ -6119,7 +6136,6 @@ components:
- id
- organization_id
- name
- owner_id
- created_at
- updated_at
properties:
@@ -6132,14 +6148,11 @@ components:
name:
type: string
description: Statement of applicability name
owner_id:
$ref: "#/components/schemas/GID"
description: Owner profile ID
snapshot_id:
document_id:
anyOf:
- $ref: "#/components/schemas/GID"
- type: "null"
description: Snapshot ID
description: Associated document ID
created_at:
type: string
format: date-time
@@ -6211,7 +6224,6 @@ components:
required:
- organization_id
- name
- owner_id
properties:
organization_id:
$ref: "#/components/schemas/GID"
@@ -6219,9 +6231,6 @@ components:
name:
type: string
description: Statement of applicability name
owner_id:
$ref: "#/components/schemas/GID"
description: Owner profile ID
AddStatementOfApplicabilityOutput:
type: object
@@ -6242,9 +6251,6 @@ components:
name:
type: string
description: Statement of applicability name
owner_id:
$ref: "#/components/schemas/GID"
description: Owner profile ID
UpdateStatementOfApplicabilityOutput:
type: object
@@ -6272,7 +6278,8 @@ components:
$ref: "#/components/schemas/GID"
description: Deleted statement of applicability ID
ExportStatementOfApplicabilityPDFInput:
PublishStatementOfApplicabilityInput:
type: object
required:
- id
@@ -6280,19 +6287,24 @@ components:
id:
$ref: "#/components/schemas/GID"
description: Statement of applicability ID
approver_ids:
type: array
items:
$ref: "#/components/schemas/GID"
description: Optional approver profile IDs. If provided, creates a draft pending approval instead of publishing immediately.
ExportStatementOfApplicabilityPDFOutput:
PublishStatementOfApplicabilityOutput:
type: object
required:
- pdf_base64
- filename
- document_id
- document_version_id
properties:
pdf_base64:
type: string
description: Base64-encoded PDF content
filename:
type: string
description: Suggested filename for the PDF
document_id:
$ref: "#/components/schemas/GID"
description: Created or updated document ID
document_version_id:
$ref: "#/components/schemas/GID"
description: Created document version ID
ApplicabilityStatementOrderField:
type: string
@@ -8597,15 +8609,14 @@ tools:
$ref: "#/components/schemas/DeleteStatementOfApplicabilityInput"
outputSchema:
$ref: "#/components/schemas/DeleteStatementOfApplicabilityOutput"
- name: exportStatementOfApplicabilityPDF
description: Export a statement of applicability as a PDF document
- name: publishStatementOfApplicability
description: Publish a statement of applicability as a document. If a document already exists, a new version is created.
hints:
readonly: true
idempotent: true
readonly: false
inputSchema:
$ref: "#/components/schemas/ExportStatementOfApplicabilityPDFInput"
$ref: "#/components/schemas/PublishStatementOfApplicabilityInput"
outputSchema:
$ref: "#/components/schemas/ExportStatementOfApplicabilityPDFOutput"
$ref: "#/components/schemas/PublishStatementOfApplicabilityOutput"
- name: listApplicabilityStatements
description: List all applicability statements for a statement of applicability
hints:

1
pkg/server/api/mcp/v1/types/document.go
View File

@@ -47,6 +47,7 @@ func NewDocument(d *coredata.Document) *Document {
OrganizationID: d.OrganizationID,
CurrentPublishedMajor: d.CurrentPublishedMajor,
CurrentPublishedMinor: d.CurrentPublishedMinor,
WriteMode: d.WriteMode,
TrustCenterVisibility: d.TrustCenterVisibility,
Status: d.Status,
ArchivedAt: d.ArchivedAt,

3
pkg/server/api/mcp/v1/types/statement_of_applicability.go
View File

@@ -23,8 +23,7 @@ func NewStatementOfApplicability(s *coredata.StatementOfApplicability) *Statemen
ID: s.ID,
OrganizationID: s.OrganizationID,
Name: s.Name,
OwnerID: s.OwnerID,
SnapshotID: s.SnapshotID,
DocumentID: s.DocumentID,
CreatedAt: s.CreatedAt,
UpdatedAt: s.UpdatedAt,
}

4
pkg/server/api/trust/v1/graphql/trust_center.graphql
View File

@@ -83,6 +83,10 @@ enum DocumentType
REPORT @goEnum(value: "go.probo.inc/probo/pkg/coredata.DocumentTypeReport")
TEMPLATE
@goEnum(value: "go.probo.inc/probo/pkg/coredata.DocumentTypeTemplate")
STATEMENT_OF_APPLICABILITY
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.DocumentTypeStatementOfApplicability"
)
}
type Document implements Node @nda {