rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SOA as document: replace export with publish workflow

Browse Source 
Statements of Applicability are no longer exported as one-off PDFs.
Instead, each SOA owns a persistent document that accumulates versions
over time, following the same publish/approve lifecycle as authored
documents.

Publishing without approvers publishes immediately; publishing with
approvers creates a draft pending approval via the existing quorum
system. SOAs can also store default approvers that are pre-populated in
the publish dialog.

The SOA is removed from the snapshot system — applicability statements
are now queried directly (snapshot_id IS NULL) rather than through
snapshot copies.

A standalone migration script (cmd/migrate-soa-snapshots-to-documents)
converts existing SOA snapshots into documents with proper ProseMirror
content, preserving version history and approval decisions.

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
This commit is contained in:
Sacha Al Himdani
2026-04-10 13:38:42 +02:00
parent 53edc5ba26
commit c635492f75
74 changed files with 3509 additions and 1595 deletions
Download Patch File Download Diff File Expand all files Collapse all files

475
e2e/console/statement_of_applicability_test.go Normal file
View File

@@ -0,0 +1,475 @@
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package console_test
import (
"testing"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"go.probo.inc/probo/e2e/internal/factory"
"go.probo.inc/probo/e2e/internal/testutil"
)
func TestStatementOfApplicability_Create(t *testing.T) {
t.Parallel()
owner := testutil.NewClient(t, testutil.RoleOwner)
t.Run(
"create a statement of applicability",
func(t *testing.T) {
t.Parallel()
const query = `
mutation($input: CreateStatementOfApplicabilityInput!) {
createStatementOfApplicability(input: $input) {
statementOfApplicabilityEdge {
node {
id
name
createdAt
updatedAt
}
}
}
}
`
name := factory.SafeName("SOA")
var result struct {
CreateStatementOfApplicability struct {
StatementOfApplicabilityEdge struct {
Node struct {
ID string `json:"id"`
Name string `json:"name"`
CreatedAt string `json:"createdAt"`
UpdatedAt string `json:"updatedAt"`
} `json:"node"`
} `json:"statementOfApplicabilityEdge"`
} `json:"createStatementOfApplicability"`
}
err := owner.Execute(
query,
map[string]any{
"input": map[string]any{
"organizationId": owner.GetOrganizationID().String(),
"name": name,
},
},
&result,
)
require.NoError(t, err)
node := result.CreateStatementOfApplicability.StatementOfApplicabilityEdge.Node
assert.NotEmpty(t, node.ID)
assert.Equal(t, name, node.Name)
},
)
}
func TestStatementOfApplicability_CreateDocument(t *testing.T) {
t.Parallel()
owner := testutil.NewClient(t, testutil.RoleOwner)
t.Run(
"create document without approvers publishes immediately",
func(t *testing.T) {
t.Parallel()
frameworkID := factory.NewFramework(owner).Create()
controlID := factory.NewControl(owner, frameworkID).Create()
soaID := factory.NewStatementOfApplicability(owner).Create()
factory.CreateApplicabilityStatement(owner, soaID, controlID, true, nil)
const query = `
mutation($input: PublishStatementOfApplicabilityInput!) {
publishStatementOfApplicability(input: $input) {
documentEdge {
node {
id
writeMode
status
}
}
documentVersionEdge {
node {
id
title
documentType
orientation
status
major
minor
content
}
}
}
}
`
var result struct {
PublishStatementOfApplicability struct {
DocumentEdge struct {
Node struct {
ID string `json:"id"`
WriteMode string `json:"writeMode"`
Status string `json:"status"`
} `json:"node"`
} `json:"documentEdge"`
DocumentVersionEdge struct {
Node struct {
ID string `json:"id"`
Title string `json:"title"`
DocumentType string `json:"documentType"`
Orientation string `json:"orientation"`
Status string `json:"status"`
Major int `json:"major"`
Minor int `json:"minor"`
Content string `json:"content"`
} `json:"node"`
} `json:"documentVersionEdge"`
} `json:"publishStatementOfApplicability"`
}
err := owner.Execute(
query,
map[string]any{
"input": map[string]any{
"statementOfApplicabilityId": soaID,
},
},
&result,
)
require.NoError(t, err)
doc := result.PublishStatementOfApplicability.DocumentEdge.Node
assert.NotEmpty(t, doc.ID)
assert.Equal(t, "GENERATED", doc.WriteMode)
assert.Equal(t, "ACTIVE", doc.Status)
ver := result.PublishStatementOfApplicability.DocumentVersionEdge.Node
assert.NotEmpty(t, ver.ID)
assert.Equal(t, "STATEMENT_OF_APPLICABILITY", ver.DocumentType)
assert.Equal(t, "LANDSCAPE", ver.Orientation)
assert.Equal(t, "PUBLISHED", ver.Status)
assert.Equal(t, 1, ver.Major)
assert.Equal(t, 0, ver.Minor)
assert.Contains(t, ver.Content, "Purpose")
},
)
t.Run(
"create document with approvers creates draft with quorum",
func(t *testing.T) {
t.Parallel()
frameworkID := factory.NewFramework(owner).Create()
controlID := factory.NewControl(owner, frameworkID).Create()
soaID := factory.NewStatementOfApplicability(owner).Create()
factory.CreateApplicabilityStatement(owner, soaID, controlID, true, nil)
const query = `
mutation($input: PublishStatementOfApplicabilityInput!) {
publishStatementOfApplicability(input: $input) {
documentEdge {
node {
id
writeMode
}
}
documentVersionEdge {
node {
id
status
major
}
}
}
}
`
var result struct {
PublishStatementOfApplicability struct {
DocumentEdge struct {
Node struct {
ID string `json:"id"`
WriteMode string `json:"writeMode"`
} `json:"node"`
} `json:"documentEdge"`
DocumentVersionEdge struct {
Node struct {
ID string `json:"id"`
Status string `json:"status"`
Major int `json:"major"`
} `json:"node"`
} `json:"documentVersionEdge"`
} `json:"publishStatementOfApplicability"`
}
err := owner.Execute(
query,
map[string]any{
"input": map[string]any{
"statementOfApplicabilityId": soaID,
"approverIds": []string{owner.GetProfileID().String()},
},
},
&result,
)
require.NoError(t, err)
doc := result.PublishStatementOfApplicability.DocumentEdge.Node
assert.NotEmpty(t, doc.ID)
assert.Equal(t, "GENERATED", doc.WriteMode)
ver := result.PublishStatementOfApplicability.DocumentVersionEdge.Node
assert.NotEmpty(t, ver.ID)
assert.Equal(t, "PENDING_APPROVAL", ver.Status)
},
)
t.Run(
"creating second document reuses existing document",
func(t *testing.T) {
t.Parallel()
frameworkID := factory.NewFramework(owner).Create()
controlID := factory.NewControl(owner, frameworkID).Create()
soaID := factory.NewStatementOfApplicability(owner).Create()
factory.CreateApplicabilityStatement(owner, soaID, controlID, true, nil)
const query = `
mutation($input: PublishStatementOfApplicabilityInput!) {
publishStatementOfApplicability(input: $input) {
documentEdge {
node { id }
}
documentVersionEdge {
node { id major }
}
}
}
`
var result1, result2 struct {
PublishStatementOfApplicability struct {
DocumentEdge struct {
Node struct {
ID string `json:"id"`
} `json:"node"`
} `json:"documentEdge"`
DocumentVersionEdge struct {
Node struct {
ID string `json:"id"`
Major int `json:"major"`
} `json:"node"`
} `json:"documentVersionEdge"`
} `json:"publishStatementOfApplicability"`
}
input := map[string]any{
"input": map[string]any{
"statementOfApplicabilityId": soaID,
},
}
err := owner.Execute(query, input, &result1)
require.NoError(t, err)
err = owner.Execute(query, input, &result2)
require.NoError(t, err)
doc1 := result1.PublishStatementOfApplicability.DocumentEdge.Node.ID
doc2 := result2.PublishStatementOfApplicability.DocumentEdge.Node.ID
assert.Equal(t, doc1, doc2, "should reuse same document")
ver1Major := result1.PublishStatementOfApplicability.DocumentVersionEdge.Node.Major
ver2Major := result2.PublishStatementOfApplicability.DocumentVersionEdge.Node.Major
assert.Equal(t, 1, ver1Major)
assert.Equal(t, 2, ver2Major)
},
)
t.Run(
"document linked back to SOA",
func(t *testing.T) {
t.Parallel()
frameworkID := factory.NewFramework(owner).Create()
controlID := factory.NewControl(owner, frameworkID).Create()
soaID := factory.NewStatementOfApplicability(owner).Create()
factory.CreateApplicabilityStatement(owner, soaID, controlID, true, nil)
const createQuery = `
mutation($input: PublishStatementOfApplicabilityInput!) {
publishStatementOfApplicability(input: $input) {
documentEdge {
node { id }
}
documentVersionEdge {
node { id }
}
}
}
`
var createResult struct {
PublishStatementOfApplicability struct {
DocumentEdge struct {
Node struct {
ID string `json:"id"`
} `json:"node"`
} `json:"documentEdge"`
DocumentVersionEdge struct {
Node struct {
ID string `json:"id"`
} `json:"node"`
} `json:"documentVersionEdge"`
} `json:"publishStatementOfApplicability"`
}
err := owner.Execute(
createQuery,
map[string]any{
"input": map[string]any{
"statementOfApplicabilityId": soaID,
},
},
&createResult,
)
require.NoError(t, err)
docID := createResult.PublishStatementOfApplicability.DocumentEdge.Node.ID
const soaQuery = `
query($id: ID!) {
node(id: $id) {
... on StatementOfApplicability {
id
document { id }
}
}
}
`
var soaResult struct {
Node struct {
ID string `json:"id"`
Document *struct {
ID string `json:"id"`
} `json:"document"`
} `json:"node"`
}
err = owner.Execute(soaQuery, map[string]any{"id": soaID}, &soaResult)
require.NoError(t, err)
require.NotNil(t, soaResult.Node.Document)
assert.Equal(t, docID, soaResult.Node.Document.ID)
},
)
}
func TestStatementOfApplicability_CreateDocument_RBAC(t *testing.T) {
t.Parallel()
owner := testutil.NewClient(t, testutil.RoleOwner)
viewer := testutil.NewClientInOrg(t, testutil.RoleViewer, owner)
frameworkID := factory.NewFramework(owner).Create()
controlID := factory.NewControl(owner, frameworkID).Create()
soaID := factory.NewStatementOfApplicability(owner).Create()
factory.CreateApplicabilityStatement(owner, soaID, controlID, true, nil)
const query = `
mutation($input: PublishStatementOfApplicabilityInput!) {
publishStatementOfApplicability(input: $input) {
documentEdge {
node { id }
}
documentVersionEdge {
node { id }
}
}
}
`
t.Run(
"viewer cannot create document",
func(t *testing.T) {
t.Parallel()
err := viewer.ExecuteShouldFail(
query,
map[string]any{
"input": map[string]any{
"statementOfApplicabilityId": soaID,
},
},
)
testutil.RequireForbiddenError(t, err)
},
)
}
func TestStatementOfApplicability_TenantIsolation(t *testing.T) {
t.Parallel()
org1Owner := testutil.NewClient(t, testutil.RoleOwner)
org2Owner := testutil.NewClient(t, testutil.RoleOwner)
soaID := factory.NewStatementOfApplicability(org1Owner).Create()
t.Run(
"cannot create document for another org SOA",
func(t *testing.T) {
t.Parallel()
const query = `
mutation($input: PublishStatementOfApplicabilityInput!) {
publishStatementOfApplicability(input: $input) {
documentEdge {
node { id }
}
documentVersionEdge {
node { id }
}
}
}
`
err := org2Owner.ExecuteShouldFail(
query,
map[string]any{
"input": map[string]any{
"statementOfApplicabilityId": soaID,
},
},
)
require.Error(t, err)
},
)
}

89
e2e/internal/factory/factory.go
View File

@@ -1128,3 +1128,92 @@ func (b *AccessReviewCampaignBuilder) WithAccessSourceIDs(ids []string) *AccessR
func (b *AccessReviewCampaignBuilder) Create() string {
return CreateAccessReviewCampaign(b.client, b.organizationID, b.attrs)
}
type StatementOfApplicabilityBuilder struct {
client *testutil.Client
attrs Attrs
}
func NewStatementOfApplicability(c *testutil.Client) *StatementOfApplicabilityBuilder {
return &StatementOfApplicabilityBuilder{client: c, attrs: Attrs{}}
}
func (b *StatementOfApplicabilityBuilder) WithName(name string) *StatementOfApplicabilityBuilder {
b.attrs["name"] = name
return b
}
func (b *StatementOfApplicabilityBuilder) Create() string {
b.client.T.Helper()
a := b.attrs
const query = `
mutation($input: CreateStatementOfApplicabilityInput!) {
createStatementOfApplicability(input: $input) {
statementOfApplicabilityEdge {
node { id }
}
}
}
`
input := map[string]any{
"organizationId": b.client.GetOrganizationID().String(),
"name": a.getString("name", SafeName("SOA")),
}
var result struct {
CreateStatementOfApplicability struct {
StatementOfApplicabilityEdge struct {
Node struct {
ID string `json:"id"`
} `json:"node"`
} `json:"statementOfApplicabilityEdge"`
} `json:"createStatementOfApplicability"`
}
err := b.client.Execute(query, map[string]any{"input": input}, &result)
require.NoError(b.client.T, err, "createStatementOfApplicability mutation failed")
return result.CreateStatementOfApplicability.StatementOfApplicabilityEdge.Node.ID
}
func CreateApplicabilityStatement(c *testutil.Client, soaID, controlID string, applicability bool, justification *string) string {
c.T.Helper()
const query = `
mutation($input: CreateApplicabilityStatementInput!) {
createApplicabilityStatement(input: $input) {
applicabilityStatementEdge {
node { id }
}
}
}
`
input := map[string]any{
"statementOfApplicabilityId": soaID,
"controlId": controlID,
"applicability": applicability,
}
if justification != nil {
input["justification"] = *justification
}
var result struct {
CreateApplicabilityStatement struct {
ApplicabilityStatementEdge struct {
Node struct {
ID string `json:"id"`
} `json:"node"`
} `json:"applicabilityStatementEdge"`
} `json:"createApplicabilityStatement"`
}
err := c.Execute(query, map[string]any{"input": input}, &result)
require.NoError(c.T, err, "createApplicabilityStatement mutation failed")
return result.CreateApplicabilityStatement.ApplicabilityStatementEdge.Node.ID
}