rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add implemented state and justification to controls

Browse Source 
Introduce `implemented` enum (IMPLEMENTED/NOT_IMPLEMENTED) and
`not_implemented_justification` (nullable text) fields on the Control
entity across all API surfaces (GraphQL, MCP, CLI), database, frontend,
and SOA export.

The database stores implementation state as a PostgreSQL enum
`control_implementation_state`. Controls default to IMPLEMENTED during
migration. The SOA list and PDF export show implementation status
alongside applicability, with "-" for non-applicable controls.
Justification columns are renamed for clarity: "Justification for
non-applicability" and "Justification for non-implementation".

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
This commit is contained in:
Sacha Al Himdani
2026-03-16 19:24:34 +01:00
parent d8670d2412
commit cf1dadc0b5
25 changed files with 663 additions and 233 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
pkg/cmd/control/create/create.go
View File

@@ -33,6 +33,8 @@ mutation($input: CreateControlInput!) {
name
description
bestPractice
implemented
notImplementedJustification
}
}
}
@@ -43,11 +45,13 @@ type createResponse struct {
CreateControl struct {
ControlEdge struct {
Node struct {
ID string `json:"id"`
SectionTitle string `json:"sectionTitle"`
Name string `json:"name"`
Description *string `json:"description"`
BestPractice bool `json:"bestPractice"`
ID string `json:"id"`
SectionTitle string `json:"sectionTitle"`
Name string `json:"name"`
Description *string `json:"description"`
BestPractice bool `json:"bestPractice"`
Implemented string `json:"implemented"`
NotImplementedJustification *string `json:"notImplementedJustification"`
} `json:"node"`
} `json:"controlEdge"`
} `json:"createControl"`
@@ -55,11 +59,13 @@ type createResponse struct {
func NewCmdCreate(f *cmdutil.Factory) *cobra.Command {
var (
flagFramework string
flagSectionTitle string
flagName string
flagDescription string
flagBestPractice bool
flagFramework string
flagSectionTitle string
flagName string
flagDescription string
flagBestPractice bool
flagNotImplemented bool
flagNotImplementedJustification string
)
cmd := &cobra.Command{
@@ -86,17 +92,27 @@ func NewCmdCreate(f *cmdutil.Factory) *cobra.Command {
cfg.HTTPTimeoutDuration(),
)
implemented := "IMPLEMENTED"
if flagNotImplemented {
implemented = "NOT_IMPLEMENTED"
}
input := map[string]any{
"frameworkId": flagFramework,
"sectionTitle": flagSectionTitle,
"name": flagName,
"bestPractice": flagBestPractice,
"implemented": implemented,
}
if flagDescription != "" {
input["description"] = flagDescription
}
if flagNotImplemented && flagNotImplementedJustification != "" {
input["notImplementedJustification"] = flagNotImplementedJustification
}
data, err := client.Do(
createMutation,
map[string]any{"input": input},
@@ -127,6 +143,8 @@ func NewCmdCreate(f *cmdutil.Factory) *cobra.Command {
cmd.Flags().StringVar(&flagName, "name", "", "Control name (required)")
cmd.Flags().StringVar(&flagDescription, "description", "", "Control description")
cmd.Flags().BoolVar(&flagBestPractice, "best-practice", false, "Mark as best practice")
cmd.Flags().BoolVar(&flagNotImplemented, "not-implemented", false, "Mark as not implemented")
cmd.Flags().StringVar(&flagNotImplementedJustification, "not-implemented-justification", "", "Justification for non-implementation")
_ = cmd.MarkFlagRequired("framework")
_ = cmd.MarkFlagRequired("section-title")

40
pkg/cmd/control/update/update.go
View File

@@ -32,6 +32,8 @@ mutation($input: UpdateControlInput!) {
name
description
bestPractice
implemented
notImplementedJustification
}
}
}
@@ -40,21 +42,25 @@ mutation($input: UpdateControlInput!) {
type updateResponse struct {
UpdateControl struct {
Control struct {
ID string `json:"id"`
SectionTitle string `json:"sectionTitle"`
Name string `json:"name"`
Description *string `json:"description"`
BestPractice bool `json:"bestPractice"`
ID string `json:"id"`
SectionTitle string `json:"sectionTitle"`
Name string `json:"name"`
Description *string `json:"description"`
BestPractice bool `json:"bestPractice"`
Implemented string `json:"implemented"`
NotImplementedJustification *string `json:"notImplementedJustification"`
} `json:"control"`
} `json:"updateControl"`
}
func NewCmdUpdate(f *cmdutil.Factory) *cobra.Command {
var (
flagSectionTitle string
flagName string
flagDescription string
flagBestPractice bool
flagSectionTitle string
flagName string
flagDescription string
flagBestPractice bool
flagNotImplemented bool
flagNotImplementedJustification string
)
cmd := &cobra.Command{
@@ -99,6 +105,20 @@ func NewCmdUpdate(f *cmdutil.Factory) *cobra.Command {
if cmd.Flags().Changed("best-practice") {
input["bestPractice"] = flagBestPractice
}
if cmd.Flags().Changed("not-implemented") {
if flagNotImplemented {
input["implemented"] = "NOT_IMPLEMENTED"
} else {
input["implemented"] = "IMPLEMENTED"
}
}
if cmd.Flags().Changed("not-implemented-justification") {
if flagNotImplementedJustification == "" {
input["notImplementedJustification"] = nil
} else {
input["notImplementedJustification"] = flagNotImplementedJustification
}
}
if len(input) == 1 {
return fmt.Errorf("at least one field must be specified for update")
@@ -133,6 +153,8 @@ func NewCmdUpdate(f *cmdutil.Factory) *cobra.Command {
cmd.Flags().StringVar(&flagName, "name", "", "Control name")
cmd.Flags().StringVar(&flagDescription, "description", "", "Control description")
cmd.Flags().BoolVar(&flagBestPractice, "best-practice", false, "Mark as best practice")
cmd.Flags().BoolVar(&flagNotImplemented, "not-implemented", false, "Mark as not implemented")
cmd.Flags().StringVar(&flagNotImplementedJustification, "not-implemented-justification", "", "Justification for non-implementation")
return cmd
}

92
pkg/coredata/control.go
View File

@@ -30,15 +30,17 @@ import (
type (
Control struct {
ID gid.GID `db:"id"`
OrganizationID gid.GID `db:"organization_id"`
SectionTitle string `db:"section_title"`
FrameworkID gid.GID `db:"framework_id"`
Name string `db:"name"`
Description *string `db:"description"`
BestPractice bool `db:"best_practice"`
CreatedAt time.Time `db:"created_at"`
UpdatedAt time.Time `db:"updated_at"`
ID gid.GID `db:"id"`
OrganizationID gid.GID `db:"organization_id"`
SectionTitle string `db:"section_title"`
FrameworkID gid.GID `db:"framework_id"`
Name string `db:"name"`
Description *string `db:"description"`
BestPractice bool `db:"best_practice"`
Implemented ControlImplementationState `db:"implemented"`
NotImplementedJustification *string `db:"not_implemented_justification"`
CreatedAt time.Time `db:"created_at"`
UpdatedAt time.Time `db:"updated_at"`
}
Controls []*Control
@@ -131,6 +133,8 @@ WITH ctrl AS (
c.name,
c.description,
c.best_practice,
c.implemented,
c.not_implemented_justification,
c.created_at,
c.updated_at,
c.search_vector
@@ -149,6 +153,8 @@ SELECT
name,
description,
best_practice,
implemented,
not_implemented_justification,
created_at,
updated_at
FROM
@@ -240,6 +246,8 @@ WITH ctrl AS (
c.name,
c.description,
c.best_practice,
c.implemented,
c.not_implemented_justification,
c.created_at,
c.updated_at,
c.search_vector
@@ -258,6 +266,8 @@ SELECT
name,
description,
best_practice,
implemented,
not_implemented_justification,
created_at,
updated_at
FROM
@@ -355,6 +365,8 @@ WITH ctrl AS (
c.name,
c.description,
c.best_practice,
c.implemented,
c.not_implemented_justification,
c.created_at,
c.updated_at,
c.search_vector
@@ -379,6 +391,8 @@ SELECT
name,
description,
best_practice,
implemented,
not_implemented_justification,
created_at,
updated_at
FROM
@@ -458,6 +472,8 @@ SELECT
name,
description,
best_practice,
implemented,
not_implemented_justification,
created_at,
updated_at
FROM
@@ -552,6 +568,8 @@ WITH ctrl AS (
c.name,
c.description,
c.best_practice,
c.implemented,
c.not_implemented_justification,
c.created_at,
c.updated_at,
c.search_vector
@@ -570,6 +588,8 @@ SELECT
name,
description,
best_practice,
implemented,
not_implemented_justification,
created_at,
updated_at
FROM
@@ -616,6 +636,8 @@ SELECT
name,
description,
best_practice,
implemented,
not_implemented_justification,
created_at,
updated_at
FROM
@@ -664,6 +686,8 @@ SELECT
name,
description,
best_practice,
implemented,
not_implemented_justification,
created_at,
updated_at
FROM
@@ -712,6 +736,8 @@ INSERT INTO
name,
description,
best_practice,
implemented,
not_implemented_justification,
created_at,
updated_at
)
@@ -724,22 +750,26 @@ VALUES (
@name,
@description,
@best_practice,
@implemented,
@not_implemented_justification,
@created_at,
@updated_at
);
`
args := pgx.StrictNamedArgs{
"tenant_id": scope.GetTenantID(),
"control_id": c.ID,
"organization_id": c.OrganizationID,
"framework_id": c.FrameworkID,
"section_title": c.SectionTitle,
"name": c.Name,
"description": c.Description,
"best_practice": c.BestPractice,
"created_at": c.CreatedAt,
"updated_at": c.UpdatedAt,
"tenant_id": scope.GetTenantID(),
"control_id": c.ID,
"organization_id": c.OrganizationID,
"framework_id": c.FrameworkID,
"section_title": c.SectionTitle,
"name": c.Name,
"description": c.Description,
"best_practice": c.BestPractice,
"implemented": c.Implemented,
"not_implemented_justification": c.NotImplementedJustification,
"created_at": c.CreatedAt,
"updated_at": c.UpdatedAt,
}
_, err := conn.Exec(ctx, q, args)
@@ -789,6 +819,8 @@ UPDATE controls SET
description = @description,
section_title = @section_title,
best_practice = @best_practice,
implemented = @implemented,
not_implemented_justification = @not_implemented_justification,
updated_at = @updated_at
WHERE %s
AND id = @control_id
@@ -796,12 +828,14 @@ WHERE %s
q = fmt.Sprintf(q, scope.SQLFragment())
args := pgx.StrictNamedArgs{
"control_id": c.ID,
"name": c.Name,
"description": c.Description,
"section_title": c.SectionTitle,
"best_practice": c.BestPractice,
"updated_at": c.UpdatedAt,
"control_id": c.ID,
"name": c.Name,
"description": c.Description,
"section_title": c.SectionTitle,
"best_practice": c.BestPractice,
"implemented": c.Implemented,
"not_implemented_justification": c.NotImplementedJustification,
"updated_at": c.UpdatedAt,
}
maps.Copy(args, scope.SQLArguments())
@@ -839,6 +873,8 @@ WITH ctrl AS (
c.name,
c.description,
c.best_practice,
c.implemented,
c.not_implemented_justification,
c.created_at,
c.updated_at,
c.search_vector
@@ -857,6 +893,8 @@ SELECT
name,
description,
best_practice,
implemented,
not_implemented_justification,
created_at,
updated_at
FROM
@@ -906,6 +944,8 @@ WITH ctrl AS (
c.name,
c.description,
c.best_practice,
c.implemented,
c.not_implemented_justification,
c.created_at,
c.updated_at,
c.search_vector
@@ -924,6 +964,8 @@ SELECT
name,
description,
best_practice,
implemented,
not_implemented_justification,
created_at,
updated_at
FROM

66
pkg/coredata/control_implementation_state.go Normal file
View File

@@ -0,0 +1,66 @@
// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package coredata
import (
"database/sql/driver"
"fmt"
)
type (
ControlImplementationState string
)
const (
ControlImplementationStateImplemented ControlImplementationState = "IMPLEMENTED"
ControlImplementationStateNotImplemented ControlImplementationState = "NOT_IMPLEMENTED"
)
func (s ControlImplementationState) IsValid() bool {
switch s {
case ControlImplementationStateImplemented, ControlImplementationStateNotImplemented:
return true
}
return false
}
func (s ControlImplementationState) String() string {
return string(s)
}
func (s ControlImplementationState) MarshalText() ([]byte, error) {
return []byte(s.String()), nil
}
func (s *ControlImplementationState) UnmarshalText(data []byte) error {
val := ControlImplementationState(data)
if !val.IsValid() {
return fmt.Errorf("invalid ControlImplementationState value: %q", string(data))
}
*s = val
return nil
}
func (s *ControlImplementationState) Scan(value any) error {
val, ok := value.(string)
if !ok {
return fmt.Errorf("invalid scan source for ControlImplementationState, expected string got %T", value)
}
return s.UnmarshalText([]byte(val))
}
func (s ControlImplementationState) Value() (driver.Value, error) {
return s.String(), nil
}

5
pkg/coredata/migrations/20260316T120000Z.sql Normal file
View File

@@ -0,0 +1,5 @@
-- Add implemented state and not_implemented_justification columns to controls table
CREATE TYPE control_implementation_state AS ENUM ('IMPLEMENTED', 'NOT_IMPLEMENTED');
ALTER TABLE controls ADD COLUMN implemented control_implementation_state NOT NULL DEFAULT 'IMPLEMENTED';
ALTER TABLE controls ADD COLUMN not_implemented_justification text;
ALTER TABLE controls ALTER COLUMN implemented DROP DEFAULT;

26
pkg/docgen/generator.go
View File

@@ -65,6 +65,12 @@ var (
}
return "no"
},
"derefString": func(s *string) string {
if s == nil {
return ""
}
return *s
},
"boolToYesNoDash": func(b *bool) string {
if b == nil {
return "-"
@@ -312,15 +318,17 @@ type (
}
ControlData struct {
FrameworkName string
SectionTitle string
Name string
Applicability *bool
Justification *string
BestPractice *bool
Regulatory *bool
Contractual *bool
RiskAssessment *bool
FrameworkName string
SectionTitle string
Name string
Applicability *bool
Justification *string
BestPractice *bool
Implemented *string
NotImplementedJustification *string
Regulatory *bool
Contractual *bool
RiskAssessment *bool
}
)

72
pkg/docgen/soa_template.html
View File

@@ -297,15 +297,17 @@
<tr>
<th rowspan="2" style="width: 12%;">Framework</th>
<th rowspan="2" style="width: 24%;">Control</th>
<th rowspan="2" style="width: 9%;">Applicability</th>
<th rowspan="2" style="width: 17%;">Justification</th>
<th colspan="4" style="width: 38%; text-align: center;">Justification for inclusion</th>
<th rowspan="2" style="width: 8%;">Applicability</th>
<th rowspan="2" style="width: 14%;">Justification for non-applicability</th>
<th rowspan="2" style="width: 8%;">Implemented</th>
<th rowspan="2" style="width: 10%;">Justification for non-implementation</th>
<th colspan="4" style="width: 24%; text-align: center;">Justification for inclusion</th>
</tr>
<tr>
<th style="width: 8%;">Regulatory</th>
<th style="width: 8%;">Contractual</th>
<th style="width: 10%;">Best Practice</th>
<th style="width: 12%;">Risk Assessment</th>
<th style="width: 6%;">Regulatory</th>
<th style="width: 6%;">Contractual</th>
<th style="width: 6%;">Best Practice</th>
<th style="width: 6%;">Risk Assessment</th>
</tr>
</thead>
<tbody>
@@ -325,12 +327,37 @@
{{- end}}
</td>
<td>
{{- if .Justification}}
{{- $appStateJ := boolToYesNo .Applicability}}
{{- if and (eq $appStateJ "no") .Justification}}
{{.Justification}}
{{- else}}
-
{{- end}}
</td>
<td>
{{- $appState := boolToYesNo .Applicability}}
{{- if eq $appState "no"}}
<span class="state-tag">-</span>
{{- else if .Implemented}}
{{- if eq (derefString .Implemented) "IMPLEMENTED"}}
<span class="state-tag state-tag-success">Yes</span>
{{- else}}
<span class="state-tag state-tag-danger">No</span>
{{- end}}
{{- else}}
<span class="state-tag">-</span>
{{- end}}
</td>
<td>
{{- $appState2 := boolToYesNo .Applicability}}
{{- if eq $appState2 "no"}}
-
{{- else if and .Implemented (eq (derefString .Implemented) "NOT_IMPLEMENTED") .NotImplementedJustification}}
{{.NotImplementedJustification}}
{{- else}}
-
{{- end}}
</td>
<td>{{boolToYesNoDash .Regulatory}}</td>
<td>{{boolToYesNoDash .Contractual}}</td>
<td>{{boolToYesNoDash .BestPractice}}</td>
@@ -383,7 +410,7 @@
</div>
<div class="annex-section">
<div class="annex-subsection-title">Justification</div>
<div class="annex-subsection-title">Justification for non-applicability</div>
<ul class="annex-enum-list">
<li class="annex-enum-item">
<span class="annex-enum-description">Provides the rationale when a control is not applicable. This field is empty for applicable controls.</span>
@@ -391,6 +418,33 @@
</ul>
</div>
<div class="annex-section">
<div class="annex-subsection-title">Implemented</div>
<ul class="annex-enum-list">
<li class="annex-enum-item">
<span class="annex-enum-name">Yes:</span>
<span class="annex-enum-description">The control has been implemented by the organization.</span>
</li>
<li class="annex-enum-item">
<span class="annex-enum-name">No:</span>
<span class="annex-enum-description">The control has not been implemented (with justification provided).</span>
</li>
<li class="annex-enum-item">
<span class="annex-enum-name">-:</span>
<span class="annex-enum-description">Not applicable (control is not applicable).</span>
</li>
</ul>
</div>
<div class="annex-section">
<div class="annex-subsection-title">Justification for non-implementation</div>
<ul class="annex-enum-list">
<li class="annex-enum-item">
<span class="annex-enum-description">Provides the rationale when a control is not implemented. This field is empty for implemented controls or when the control is not applicable.</span>
</li>
</ul>
</div>
<div class="annex-section">
<div class="annex-subsection-title">Justification for inclusion</div>
<div class="annex-enum-description" style="margin-bottom: 12px;">

80
pkg/probo/control_service.go
View File

@@ -32,20 +32,24 @@ type (
}
CreateControlRequest struct {
ID gid.GID
FrameworkID gid.GID
Name string
Description *string
SectionTitle string
BestPractice bool
ID gid.GID
FrameworkID gid.GID
Name string
Description *string
SectionTitle string
BestPractice bool
Implemented coredata.ControlImplementationState
NotImplementedJustification *string
}
UpdateControlRequest struct {
ID gid.GID
Name *string
Description **string
SectionTitle *string
BestPractice *bool
ID gid.GID
Name *string
Description **string
SectionTitle *string
BestPractice *bool
Implemented *coredata.ControlImplementationState
NotImplementedJustification **string
}
)
@@ -56,6 +60,17 @@ func (ccr *CreateControlRequest) Validate() error {
v.Check(ccr.Name, "name", validator.Required(), validator.SafeTextNoNewLine(TitleMaxLength))
v.Check(ccr.Description, "description", validator.Required(), validator.SafeText(ContentMaxLength))
v.Check(ccr.SectionTitle, "section_title", validator.Required(), validator.SafeTextNoNewLine(TitleMaxLength))
v.Check(ccr.NotImplementedJustification, "not_implemented_justification", validator.SafeText(ContentMaxLength))
v.Check(
ccr.Implemented,
"implemented",
validator.Required(),
validator.OneOfSlice([]string{
string(coredata.ControlImplementationStateImplemented),
string(coredata.ControlImplementationStateNotImplemented),
}),
)
return v.Error()
}
@@ -67,6 +82,15 @@ func (ucr *UpdateControlRequest) Validate() error {
v.Check(ucr.Name, "name", validator.SafeTextNoNewLine(TitleMaxLength))
v.Check(ucr.Description, "description", validator.SafeText(ContentMaxLength))
v.Check(ucr.SectionTitle, "section_title", validator.SafeTextNoNewLine(TitleMaxLength))
v.Check(ucr.NotImplementedJustification, "not_implemented_justification", validator.SafeText(ContentMaxLength))
v.Check(
ucr.Implemented,
"implemented",
validator.OneOfSlice([]string{
string(coredata.ControlImplementationStateImplemented),
string(coredata.ControlImplementationStateNotImplemented),
}),
)
return v.Error()
}
@@ -830,15 +854,22 @@ func (s ControlService) Create(
now := time.Now()
framework := &coredata.Framework{}
notImplementedJustification := req.NotImplementedJustification
if req.Implemented == coredata.ControlImplementationStateImplemented {
notImplementedJustification = nil
}
control := &coredata.Control{
ID: gid.New(s.svc.scope.GetTenantID(), coredata.ControlEntityType),
FrameworkID: req.FrameworkID,
Name: req.Name,
Description: req.Description,
SectionTitle: req.SectionTitle,
BestPractice: req.BestPractice,
CreatedAt: now,
UpdatedAt: now,
ID: gid.New(s.svc.scope.GetTenantID(), coredata.ControlEntityType),
FrameworkID: req.FrameworkID,
Name: req.Name,
Description: req.Description,
SectionTitle: req.SectionTitle,
BestPractice: req.BestPractice,
Implemented: req.Implemented,
NotImplementedJustification: notImplementedJustification,
CreatedAt: now,
UpdatedAt: now,
}
err := s.svc.pg.WithTx(
@@ -915,6 +946,17 @@ func (s ControlService) Update(
control.BestPractice = *req.BestPractice
}
if req.Implemented != nil {
control.Implemented = *req.Implemented
if *req.Implemented == coredata.ControlImplementationStateImplemented {
control.NotImplementedJustification = nil
}
}
if req.NotImplementedJustification != nil && control.Implemented == coredata.ControlImplementationStateNotImplemented {
control.NotImplementedJustification = *req.NotImplementedJustification
}
control.UpdatedAt = time.Now()
return control.Update(ctx, conn, s.svc.scope)

38
pkg/probo/framework_service.go
View File

@@ -68,10 +68,12 @@ type (
Dark string `json:"dark"`
} `json:"logo,omitempty"`
Controls []struct {
ID string `json:"id"`
Name string `json:"name"`
Description string `json:"description"`
BestPractice *bool `json:"best_practice,omitempty"`
ID string `json:"id"`
Name string `json:"name"`
Description string `json:"description"`
BestPractice *bool `json:"best_practice,omitempty"`
Implemented string `json:"implemented,omitempty"`
NotImplementedJustification *string `json:"not_implemented_justification,omitempty"`
} `json:"controls"`
}
}
@@ -573,16 +575,26 @@ func (s FrameworkService) Import(
if control.BestPractice != nil {
bestPractice = *control.BestPractice
}
implemented := coredata.ControlImplementationState(control.Implemented)
if !implemented.IsValid() {
implemented = coredata.ControlImplementationStateImplemented
}
var notImplementedJustification *string
if implemented == coredata.ControlImplementationStateNotImplemented {
notImplementedJustification = control.NotImplementedJustification
}
control := &coredata.Control{
ID: controlID,
FrameworkID: frameworkID,
OrganizationID: organization.ID,
SectionTitle: control.ID,
Name: control.Name,
Description: &description,
BestPractice: bestPractice,
CreatedAt: now,
UpdatedAt: now,
ID: controlID,
FrameworkID: frameworkID,
OrganizationID: organization.ID,
SectionTitle: control.ID,
Name: control.Name,
Description: &description,
BestPractice: bestPractice,
Implemented: implemented,
NotImplementedJustification: notImplementedJustification,
CreatedAt: now,
UpdatedAt: now,
}
if err := control.Insert(ctx, tx, s.svc.scope); err != nil {

20
pkg/probo/state_of_applicability_service.go
View File

@@ -569,15 +569,23 @@ func (s StateOfApplicabilityService) ExportPDF(
applicability := stmt.Applicability
implemented := control.Implemented.String()
frameworkControlsMap[framework.Name] = append(
frameworkControlsMap[framework.Name],
docgen.ControlData{
FrameworkName: framework.Name,
SectionTitle: control.SectionTitle,
Name: control.Name,
Applicability: &applicability,
Justification: stmt.Justification,
BestPractice: bestPractice,
FrameworkName: framework.Name,
SectionTitle: control.SectionTitle,
Name: control.Name,
Applicability: &applicability,
Justification: stmt.Justification,
BestPractice: bestPractice,
Implemented: &implemented,
NotImplementedJustification: func() *string {
if control.Implemented == coredata.ControlImplementationStateImplemented {
return nil
}
return control.NotImplementedJustification
}(),
Regulatory: regulatory,
Contractual: contractual,
RiskAssessment: riskAssessment,

20
pkg/server/api/console/v1/schema.graphql
View File

@@ -127,6 +127,20 @@ enum TrustCenterVisibility
)
}
enum ControlImplementationState
@goModel(
model: "go.probo.inc/probo/pkg/coredata.ControlImplementationState"
) {
IMPLEMENTED
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.ControlImplementationStateImplemented"
)
NOT_IMPLEMENTED
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.ControlImplementationStateNotImplemented"
)
}
enum TrustCenterDocumentAccessStatus
@goModel(
model: "go.probo.inc/probo/pkg/coredata.TrustCenterDocumentAccessStatus"
@@ -2221,6 +2235,8 @@ type Control implements Node {
name: String!
description: String
bestPractice: Boolean!
implemented: ControlImplementationState!
notImplementedJustification: String
regulatory: Boolean! @goField(forceResolver: true)
contractual: Boolean! @goField(forceResolver: true)
riskAssessment: Boolean! @goField(forceResolver: true)
@@ -4468,6 +4484,8 @@ input CreateControlInput {
name: String!
description: String
bestPractice: Boolean!
implemented: ControlImplementationState!
notImplementedJustification: String
}
input UpdateControlInput {
@@ -4476,6 +4494,8 @@ input UpdateControlInput {
name: String
description: String @goField(omittable: true)
bestPractice: Boolean
implemented: ControlImplementationState
notImplementedJustification: String @goField(omittable: true)
}
input DeleteControlInput {

14
pkg/server/api/console/v1/types/control.go
View File

@@ -57,11 +57,13 @@ func NewControl(control *coredata.Control) *Control {
Framework: &Framework{
ID: control.FrameworkID,
},
SectionTitle: control.SectionTitle,
Name: control.Name,
Description: control.Description,
BestPractice: control.BestPractice,
CreatedAt: control.CreatedAt,
UpdatedAt: control.UpdatedAt,
SectionTitle: control.SectionTitle,
Name: control.Name,
Description: control.Description,
BestPractice: control.BestPractice,
Implemented: control.Implemented,
NotImplementedJustification: control.NotImplementedJustification,
CreatedAt: control.CreatedAt,
UpdatedAt: control.UpdatedAt,
}
}

24
pkg/server/api/console/v1/v1_resolver.go
View File

@@ -2945,11 +2945,13 @@ func (r *mutationResolver) CreateControl(ctx context.Context, input types.Create
control, err := prb.Controls.Create(
ctx,
probo.CreateControlRequest{
FrameworkID: input.FrameworkID,
Name: input.Name,
Description: input.Description,
SectionTitle: input.SectionTitle,
BestPractice: input.BestPractice,
FrameworkID: input.FrameworkID,
Name: input.Name,
Description: input.Description,
SectionTitle: input.SectionTitle,
BestPractice: input.BestPractice,
Implemented: input.Implemented,
NotImplementedJustification: input.NotImplementedJustification,
},
)
if err != nil {
@@ -2977,11 +2979,13 @@ func (r *mutationResolver) UpdateControl(ctx context.Context, input types.Update
control, err := prb.Controls.Update(
ctx,
probo.UpdateControlRequest{
ID: input.ID,
Name: input.Name,
Description: gqlutils.UnwrapOmittable(input.Description),
SectionTitle: input.SectionTitle,
BestPractice: input.BestPractice,
ID: input.ID,
Name: input.Name,
Description: gqlutils.UnwrapOmittable(input.Description),
SectionTitle: input.SectionTitle,
BestPractice: input.BestPractice,
Implemented: input.Implemented,
NotImplementedJustification: gqlutils.UnwrapOmittable(input.NotImplementedJustification),
},
)

28
pkg/server/api/mcp/v1/schema.resolvers.go
View File

@@ -1550,10 +1550,13 @@ func (r *Resolver) AddControlTool(ctx context.Context, req *mcp.CallToolRequest,
control, err := svc.Controls.Create(
ctx,
probo.CreateControlRequest{
FrameworkID: input.FrameworkID,
Name: input.Name,
Description: input.Description,
SectionTitle: input.SectionTitle,
FrameworkID: input.FrameworkID,
Name: input.Name,
Description: input.Description,
SectionTitle: input.SectionTitle,
BestPractice: input.BestPractice,
Implemented: coredata.ControlImplementationState(input.Implemented),
NotImplementedJustification: input.NotImplementedJustification,
},
)
if err != nil {
@@ -1570,13 +1573,22 @@ func (r *Resolver) UpdateControlTool(ctx context.Context, req *mcp.CallToolReque
svc := r.ProboService(ctx, input.ID)
var implemented *coredata.ControlImplementationState
if input.Implemented != nil {
v := coredata.ControlImplementationState(*input.Implemented)
implemented = &v
}
control, err := svc.Controls.Update(
ctx,
probo.UpdateControlRequest{
ID: input.ID,
Name: input.Name,
Description: UnwrapOmittable(input.Description),
SectionTitle: input.SectionTitle,
ID: input.ID,
Name: input.Name,
Description: UnwrapOmittable(input.Description),
SectionTitle: input.SectionTitle,
BestPractice: input.BestPractice,
Implemented: implemented,
NotImplementedJustification: UnwrapOmittable(input.NotImplementedJustification),
},
)
if err != nil {

42
pkg/server/api/mcp/v1/specification.yaml
View File

@@ -4219,6 +4219,8 @@ components:
- framework_id
- section_title
- name
- best_practice
- implemented
- created_at
- updated_at
properties:
@@ -4242,6 +4244,19 @@ components:
- string
- "null"
description: Control description
best_practice:
type: boolean
description: Whether control is a best practice
implemented:
type: string
enum: [IMPLEMENTED, NOT_IMPLEMENTED]
description: Control implementation state
go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ControlImplementationState
not_implemented_justification:
type:
- string
- "null"
description: Justification for non-implementation
created_at:
type: string
format: date-time
@@ -4315,6 +4330,8 @@ components:
- framework_id
- section_title
- name
- best_practice
- implemented
properties:
organization_id:
$ref: "#/components/schemas/GID"
@@ -4331,6 +4348,19 @@ components:
description:
type: string
description: Control description
best_practice:
type: boolean
description: Whether control is a best practice
implemented:
type: string
enum: [IMPLEMENTED, NOT_IMPLEMENTED]
description: Control implementation state
go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ControlImplementationState
not_implemented_justification:
type:
- string
- "null"
description: Justification for non-implementation
AddControlOutput:
type: object
@@ -4358,6 +4388,18 @@ components:
type: ["string", "null"]
description: Control description
go.probo.inc/mcpgen/omittable: true
best_practice:
type: boolean
description: Whether control is a best practice
implemented:
type: string
enum: [IMPLEMENTED, NOT_IMPLEMENTED]
description: Control implementation state
go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ControlImplementationState
not_implemented_justification:
type: ["string", "null"]
description: Justification for non-implementation
go.probo.inc/mcpgen/omittable: true
UpdateControlOutput:
type: object

19
pkg/server/api/mcp/v1/types/control.go
View File

@@ -20,14 +20,17 @@ import (
func NewControl(c *coredata.Control) *Control {
return &Control{
ID: c.ID,
OrganizationID: c.OrganizationID,
SectionTitle: c.SectionTitle,
FrameworkID: c.FrameworkID,
Name: c.Name,
Description: c.Description,
CreatedAt: c.CreatedAt,
UpdatedAt: c.UpdatedAt,
ID: c.ID,
OrganizationID: c.OrganizationID,
SectionTitle: c.SectionTitle,
FrameworkID: c.FrameworkID,
Name: c.Name,
Description: c.Description,
BestPractice: c.BestPractice,
Implemented: ControlImplemented(c.Implemented),
NotImplementedJustification: c.NotImplementedJustification,
CreatedAt: c.CreatedAt,
UpdatedAt: c.UpdatedAt,
}
}