Expire vendor risk assement

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/coredata/migrations/20250422T033400Z.sql

@@ -0,0 +1,2 @@
+ALTER TABLE vendor_risk_assessments ALTER COLUMN approved_at DROP NOT NULL;
+ALTER TABLE vendor_risk_assessments ALTER COLUMN approved_by DROP NOT NULL;

pkg/coredata/migrations/20250422T152800Z.sql

@@ -0,0 +1,3 @@
+
+ALTER TABLE vendor_risk_assessments DROP COLUMN accessed_at;
+ALTER TABLE vendor_risk_assessments DROP COLUMN accessed_by;

pkg/coredata/people.go

@@ -98,6 +98,53 @@ LIMIT 1;
 	return nil
 }
 
+func (p *People) LoadByUserID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+	userID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    kind,
+    user_id,
+    full_name,
+    primary_email_address,
+    additional_email_addresses,
+    created_at,
+    updated_at
+FROM
+    peoples
+WHERE
+    %s
+    AND organization_id = @organization_id
+    AND user_id = @user_id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"organization_id": organizationID, "user_id": userID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query people: %w", err)
+	}
+
+	people, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[People])
+	if err != nil {
+		return fmt.Errorf("cannot collect people: %w", err)
+	}
+
+	*p = people
+
+	return nil
+}
+
 func (p People) Insert(
 	ctx context.Context,
 	conn pg.Conn,

pkg/coredata/vendor.go

@@ -350,3 +350,37 @@ WHERE %s
 	_, err := conn.Exec(ctx, q, args)
 	return err
 }
+
+func (v Vendor) ExpireNonExpiredRiskAssessments(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	now := time.Now()
+
+	q := `
+	UPDATE vendor_risk_assessments
+	SET 
+		expires_at = @now,
+		updated_at = @now
+	WHERE
+		%s
+		AND vendor_id = @vendor_id
+		AND expires_at > @now
+	`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"vendor_id": v.ID,
+		"now":       now,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot expire existing risk assessments: %w", err)
+	}
+
+	return nil
+}

pkg/coredata/vendor_risk_assessment.go

@@ -33,9 +33,8 @@ type (
 		VendorID        gid.GID         `db:"vendor_id"`
 		AssessedAt      time.Time       `db:"assessed_at"`
 		AssessedBy      gid.GID         `db:"assessed_by"`
-		AccessedAt      time.Time       `db:"accessed_at"`
-		ApprovedBy      gid.GID         `db:"approved_by"`
-		ApprovedAt      time.Time       `db:"approved_at"`
+		ApprovedBy      *gid.GID        `db:"approved_by"`
+		ApprovedAt      *time.Time      `db:"approved_at"`
 		ExpiresAt       time.Time       `db:"expires_at"`
 		DataSensitivity DataSensitivity `db:"data_sensitivity"`
 		BusinessImpact  BusinessImpact  `db:"business_impact"`
@@ -96,7 +95,6 @@ INSERT INTO
         vendor_id,
         assessed_at,
         assessed_by,
-        accessed_at,
         approved_by,
         approved_at,
         expires_at,
@@ -112,11 +110,12 @@ VALUES (
     @vendor_id,
     @assessed_at,
     @assessed_by,
+    @approved_by,
+    @approved_at,
     @expires_at,
     @data_sensitivity,
     @business_impact,
     @notes,
-    @attachments,
     @created_at,
     @updated_at
 )
@@ -128,7 +127,6 @@ VALUES (
 		"vendor_id":        r.VendorID,
 		"assessed_at":      r.AssessedAt,
 		"assessed_by":      r.AssessedBy,
-		"accessed_at":      r.AccessedAt,
 		"approved_by":      r.ApprovedBy,
 		"approved_at":      r.ApprovedAt,
 		"expires_at":       r.ExpiresAt,
@@ -155,7 +153,6 @@ SELECT
     vendor_id,
     assessed_at,
     assessed_by,
-    accessed_at,
     approved_by,
     approved_at,
     expires_at,
@@ -206,7 +203,6 @@ SELECT
     vendor_id,
     assessed_at,
     assessed_by,
-    accessed_at,
     approved_by,
     approved_at,
     expires_at,
@@ -260,7 +256,6 @@ SELECT
     vendor_id,
     assessed_at,
     assessed_by,
-    accessed_at,
     approved_by,
     approved_at,
     expires_at,