rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add CMMI maturity level to compliance controls

Browse Source 
Adds an optional CMMI 0-5 maturity level field to Control to support
ISO 27001 clause 9.1 effectiveness measurement and HITRUST CSF maturity
requirements. The field is nullable, framework-agnostic, and exposed
across all four API surfaces (GraphQL, MCP, CLI, n8n) plus the
generated SoA document.

Signed-off-by: Alejandro Juan <alejandrojuan@alejandrojuan.com>
This commit is contained in:
Alejandro Juan
2026-04-20 13:26:19 +02:00
committed by Sacha Al Himdani
parent 98487953b9
commit da91afc2a7
31 changed files with 919 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
pkg/coredata/control.go
View File

@@ -39,6 +39,7 @@ type (
BestPractice bool `db:"best_practice"`
Implemented ControlImplementationState `db:"implemented"`
NotImplementedJustification *string `db:"not_implemented_justification"`
MaturityLevel *ControlMaturityLevel `db:"maturity_level"`
CreatedAt time.Time `db:"created_at"`
UpdatedAt time.Time `db:"updated_at"`
}
@@ -135,6 +136,7 @@ WITH ctrl AS (
c.best_practice,
c.implemented,
c.not_implemented_justification,
c.maturity_level,
c.created_at,
c.updated_at,
c.search_vector
@@ -155,6 +157,7 @@ SELECT
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
updated_at
FROM
@@ -248,6 +251,7 @@ WITH ctrl AS (
c.best_practice,
c.implemented,
c.not_implemented_justification,
c.maturity_level,
c.created_at,
c.updated_at,
c.search_vector
@@ -268,6 +272,7 @@ SELECT
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
updated_at
FROM
@@ -367,6 +372,7 @@ WITH ctrl AS (
c.best_practice,
c.implemented,
c.not_implemented_justification,
c.maturity_level,
c.created_at,
c.updated_at,
c.search_vector
@@ -393,6 +399,7 @@ SELECT
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
updated_at
FROM
@@ -474,6 +481,7 @@ SELECT
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
updated_at
FROM
@@ -570,6 +578,7 @@ WITH ctrl AS (
c.best_practice,
c.implemented,
c.not_implemented_justification,
c.maturity_level,
c.created_at,
c.updated_at,
c.search_vector
@@ -590,6 +599,7 @@ SELECT
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
updated_at
FROM
@@ -638,6 +648,7 @@ SELECT
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
updated_at
FROM
@@ -688,6 +699,7 @@ SELECT
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
updated_at
FROM
@@ -737,6 +749,7 @@ SELECT
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
updated_at
FROM
@@ -783,6 +796,7 @@ INSERT INTO
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
updated_at
)
@@ -797,6 +811,7 @@ VALUES (
@best_practice,
@implemented,
@not_implemented_justification,
@maturity_level,
@created_at,
@updated_at
);
@@ -813,6 +828,7 @@ VALUES (
"best_practice": c.BestPractice,
"implemented": c.Implemented,
"not_implemented_justification": c.NotImplementedJustification,
"maturity_level": c.MaturityLevel,
"created_at": c.CreatedAt,
"updated_at": c.UpdatedAt,
}
@@ -866,6 +882,7 @@ UPDATE controls SET
best_practice = @best_practice,
implemented = @implemented,
not_implemented_justification = @not_implemented_justification,
maturity_level = @maturity_level,
updated_at = @updated_at
WHERE %s
AND id = @control_id
@@ -880,6 +897,7 @@ WHERE %s
"best_practice": c.BestPractice,
"implemented": c.Implemented,
"not_implemented_justification": c.NotImplementedJustification,
"maturity_level": c.MaturityLevel,
"updated_at": c.UpdatedAt,
}
@@ -920,6 +938,7 @@ WITH ctrl AS (
c.best_practice,
c.implemented,
c.not_implemented_justification,
c.maturity_level,
c.created_at,
c.updated_at,
c.search_vector
@@ -940,6 +959,7 @@ SELECT
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
updated_at
FROM
@@ -991,6 +1011,7 @@ WITH ctrl AS (
c.best_practice,
c.implemented,
c.not_implemented_justification,
c.maturity_level,
c.created_at,
c.updated_at,
c.search_vector
@@ -1011,6 +1032,7 @@ SELECT
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
updated_at
FROM

75
pkg/coredata/control_maturity_level.go Normal file
View File

@@ -0,0 +1,75 @@
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package coredata
import (
"database/sql/driver"
"fmt"
)
type (
ControlMaturityLevel string
)
const (
ControlMaturityLevelNone ControlMaturityLevel = "NONE"
ControlMaturityLevelInitial ControlMaturityLevel = "INITIAL"
ControlMaturityLevelManaged ControlMaturityLevel = "MANAGED"
ControlMaturityLevelDefined ControlMaturityLevel = "DEFINED"
ControlMaturityLevelQuantitativelyManaged ControlMaturityLevel = "QUANTITATIVELY_MANAGED"
ControlMaturityLevelOptimizing ControlMaturityLevel = "OPTIMIZING"
)
func (l ControlMaturityLevel) IsValid() bool {
switch l {
case ControlMaturityLevelNone,
ControlMaturityLevelInitial,
ControlMaturityLevelManaged,
ControlMaturityLevelDefined,
ControlMaturityLevelQuantitativelyManaged,
ControlMaturityLevelOptimizing:
return true
}
return false
}
func (l ControlMaturityLevel) String() string {
return string(l)
}
func (l ControlMaturityLevel) MarshalText() ([]byte, error) {
return []byte(l.String()), nil
}
func (l *ControlMaturityLevel) UnmarshalText(data []byte) error {
val := ControlMaturityLevel(data)
if !val.IsValid() {
return fmt.Errorf("invalid ControlMaturityLevel value: %q", string(data))
}
*l = val
return nil
}
func (l *ControlMaturityLevel) Scan(value any) error {
val, ok := value.(string)
if !ok {
return fmt.Errorf("invalid scan source for ControlMaturityLevel, expected string got %T", value)
}
return l.UnmarshalText([]byte(val))
}
func (l ControlMaturityLevel) Value() (driver.Value, error) {
return l.String(), nil
}

158
pkg/coredata/control_maturity_level_test.go Normal file
View File

@@ -0,0 +1,158 @@
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package coredata
import "testing"
func TestControlMaturityLevelIsValid(t *testing.T) {
t.Parallel()
tests := []struct {
name string
level ControlMaturityLevel
want bool
}{
{name: "none", level: ControlMaturityLevelNone, want: true},
{name: "initial", level: ControlMaturityLevelInitial, want: true},
{name: "managed", level: ControlMaturityLevelManaged, want: true},
{name: "defined", level: ControlMaturityLevelDefined, want: true},
{name: "quantitatively managed", level: ControlMaturityLevelQuantitativelyManaged, want: true},
{name: "optimizing", level: ControlMaturityLevelOptimizing, want: true},
{name: "empty string", level: "", want: false},
{name: "unknown value", level: "BOGUS", want: false},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
t.Parallel()
if got := tt.level.IsValid(); got != tt.want {
t.Fatalf("IsValid() = %v, want %v", got, tt.want)
}
})
}
}
func TestControlMaturityLevelScan(t *testing.T) {
t.Parallel()
tests := []struct {
name string
input any
want ControlMaturityLevel
wantErr bool
}{
{name: "none string", input: "NONE", want: ControlMaturityLevelNone},
{name: "initial string", input: "INITIAL", want: ControlMaturityLevelInitial},
{name: "managed string", input: "MANAGED", want: ControlMaturityLevelManaged},
{name: "defined string", input: "DEFINED", want: ControlMaturityLevelDefined},
{name: "quantitatively managed string", input: "QUANTITATIVELY_MANAGED", want: ControlMaturityLevelQuantitativelyManaged},
{name: "optimizing string", input: "OPTIMIZING", want: ControlMaturityLevelOptimizing},
{name: "invalid value", input: "BOGUS", wantErr: true},
{name: "unsupported type", input: 42, wantErr: true},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
t.Parallel()
var got ControlMaturityLevel
err := got.Scan(tt.input)
if tt.wantErr {
if err == nil {
t.Fatalf("Scan(%v) expected error", tt.input)
}
return
}
if err != nil {
t.Fatalf("Scan(%v) returned error: %v", tt.input, err)
}
if got != tt.want {
t.Fatalf("Scan(%v) = %q, want %q", tt.input, got, tt.want)
}
})
}
}
func TestControlMaturityLevelValue(t *testing.T) {
t.Parallel()
tests := []struct {
name string
level ControlMaturityLevel
want string
}{
{name: "none", level: ControlMaturityLevelNone, want: "NONE"},
{name: "initial", level: ControlMaturityLevelInitial, want: "INITIAL"},
{name: "managed", level: ControlMaturityLevelManaged, want: "MANAGED"},
{name: "defined", level: ControlMaturityLevelDefined, want: "DEFINED"},
{name: "quantitatively managed", level: ControlMaturityLevelQuantitativelyManaged, want: "QUANTITATIVELY_MANAGED"},
{name: "optimizing", level: ControlMaturityLevelOptimizing, want: "OPTIMIZING"},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
t.Parallel()
got, err := tt.level.Value()
if err != nil {
t.Fatalf("Value() returned error: %v", err)
}
if got != tt.want {
t.Fatalf("Value() = %q, want %q", got, tt.want)
}
})
}
}
func TestControlMaturityLevelMarshalUnmarshalText(t *testing.T) {
t.Parallel()
for _, level := range []ControlMaturityLevel{
ControlMaturityLevelNone,
ControlMaturityLevelInitial,
ControlMaturityLevelManaged,
ControlMaturityLevelDefined,
ControlMaturityLevelQuantitativelyManaged,
ControlMaturityLevelOptimizing,
} {
t.Run(string(level), func(t *testing.T) {
t.Parallel()
data, err := level.MarshalText()
if err != nil {
t.Fatalf("MarshalText() returned error: %v", err)
}
var roundtrip ControlMaturityLevel
if err := roundtrip.UnmarshalText(data); err != nil {
t.Fatalf("UnmarshalText(%q) returned error: %v", string(data), err)
}
if roundtrip != level {
t.Fatalf("roundtrip = %q, want %q", roundtrip, level)
}
})
}
t.Run("invalid", func(t *testing.T) {
t.Parallel()
var l ControlMaturityLevel
if err := l.UnmarshalText([]byte("BOGUS")); err == nil {
t.Fatal("UnmarshalText(BOGUS) expected error")
}
})
}

15
pkg/coredata/migrations/20260419T172808Z.sql Normal file
View File

@@ -0,0 +1,15 @@
-- Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
--
-- Permission to use, copy, modify, and/or distribute this software for any
-- purpose with or without fee is hereby granted, provided that the above
-- copyright notice and this permission notice appear in all copies.
--
-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-- PERFORMANCE OF THIS SOFTWARE.
ALTER TABLE controls ADD COLUMN maturity_level TEXT;