rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add risk assessment boundary model

Browse Source 
Introduce RiskAssessmentBoundary as a first-class, self-nesting entity that
groups nodes within a risk assessment scope, and thread it through every
surface.

- coredata: new risk_assessment_boundaries table + migration, boundary_id on
  nodes, self-referential parent_boundary_id, entity type registration
- riskmanagement: boundary CRUD service methods, boundary_id wiring on node
  create/update, scope-membership and self-parent validation, nested-subgraph
  Mermaid rendering
- IAM: core:risk-assessment-boundary:{get,list,create,update,delete} actions
  and viewer/auditor read policies
- console GraphQL: RiskAssessmentBoundary type, connection, order enum, CRUD
  mutations, boundaries field on scope, boundaryId on nodes
- CLI: risk-assessment boundary command group and --boundary-id on nodes
- MCP: boundary tools and boundary_id on node tools
- n8n: boundary operations and boundary fields on node operations
- console UI: boundary list/create/edit, boundary selector on nodes, diagram
  refetch on boundary changes

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
This commit is contained in:
Sacha Al Himdani
2026-06-08 15:37:56 +02:00
parent b643c8eb6d
commit dbf915047d
44 changed files with 3620 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
pkg/server/api/console/v1/base_resolvers.go
View File

@@ -170,6 +170,16 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
return types.NewRiskAssessmentScope(s), nil
}
case coredata.RiskAssessmentBoundaryEntityType:
action = probo.ActionRiskAssessmentBoundaryGet
loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) {
b, err := r.riskManagement.GetBoundary(ctx, scope, id)
if err != nil {
return nil, err
}
return types.NewRiskAssessmentBoundary(b), nil
}
case coredata.RiskAssessmentScenarioEntityType:
action = probo.ActionRiskAssessmentScenarioGet
loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) {

98
pkg/server/api/console/v1/graphql/risk_assessment.graphql
View File

@@ -50,10 +50,6 @@ enum RiskAssessmentNodeType
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.RiskAssessmentNodeTypeEntity"
)
BOUNDARY
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.RiskAssessmentNodeTypeBoundary"
)
ASSET
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.RiskAssessmentNodeTypeAsset"
@@ -78,6 +74,20 @@ enum RiskAssessmentNodeOrderField
)
}
enum RiskAssessmentBoundaryOrderField
@goModel(
model: "go.probo.inc/probo/pkg/coredata.RiskAssessmentBoundaryOrderField"
) {
CREATED_AT
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.RiskAssessmentBoundaryOrderFieldCreatedAt"
)
NAME
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.RiskAssessmentBoundaryOrderFieldName"
)
}
enum RiskAssessmentProcessOrderField
@goModel(
model: "go.probo.inc/probo/pkg/coredata.RiskAssessmentProcessOrderField"
@@ -146,6 +156,14 @@ input RiskAssessmentNodeOrder
field: RiskAssessmentNodeOrderField!
}
input RiskAssessmentBoundaryOrder
@goModel(
model: "go.probo.inc/probo/pkg/server/api/console/v1/types.RiskAssessmentBoundaryOrderBy"
) {
direction: OrderDirection!
field: RiskAssessmentBoundaryOrderField!
}
input RiskAssessmentProcessOrder
@goModel(
model: "go.probo.inc/probo/pkg/server/api/console/v1/types.RiskAssessmentProcessOrderBy"
@@ -204,6 +222,14 @@ type RiskAssessmentScope implements Node {
orderBy: RiskAssessmentNodeOrder
): RiskAssessmentNodeConnection @goField(forceResolver: true)
boundaries(
first: Int
after: CursorKey
last: Int
before: CursorKey
orderBy: RiskAssessmentBoundaryOrder
): RiskAssessmentBoundaryConnection @goField(forceResolver: true)
processes(
first: Int
after: CursorKey
@@ -237,12 +263,22 @@ type RiskAssessmentScope implements Node {
type RiskAssessmentNode implements Node {
id: ID!
riskAssessmentScopeId: ID!
boundaryId: ID
nodeType: RiskAssessmentNodeType!
name: String!
createdAt: Datetime!
updatedAt: Datetime!
}
type RiskAssessmentBoundary implements Node {
id: ID!
riskAssessmentScopeId: ID!
parentBoundaryId: ID
name: String!
createdAt: Datetime!
updatedAt: Datetime!
}
type RiskAssessmentProcess implements Node {
id: ID!
riskAssessmentScopeId: ID!
@@ -334,6 +370,20 @@ type RiskAssessmentNodeConnectionEdge {
node: RiskAssessmentNode!
}
type RiskAssessmentBoundaryConnection
@goModel(
model: "go.probo.inc/probo/pkg/server/api/console/v1/types.RiskAssessmentBoundaryConnection"
) {
totalCount: Int @goField(forceResolver: true)
edges: [RiskAssessmentBoundaryConnectionEdge!]!
pageInfo: PageInfo!
}
type RiskAssessmentBoundaryConnectionEdge {
cursor: CursorKey!
node: RiskAssessmentBoundary!
}
type RiskAssessmentProcessConnection
@goModel(
model: "go.probo.inc/probo/pkg/server/api/console/v1/types.RiskAssessmentProcessConnection"
@@ -409,6 +459,16 @@ extend type Mutation {
input: DeleteRiskAssessmentNodeInput!
): DeleteRiskAssessmentNodePayload!
createRiskAssessmentBoundary(
input: CreateRiskAssessmentBoundaryInput!
): CreateRiskAssessmentBoundaryPayload!
updateRiskAssessmentBoundary(
input: UpdateRiskAssessmentBoundaryInput!
): UpdateRiskAssessmentBoundaryPayload!
deleteRiskAssessmentBoundary(
input: DeleteRiskAssessmentBoundaryInput!
): DeleteRiskAssessmentBoundaryPayload!
createRiskAssessmentProcess(
input: CreateRiskAssessmentProcessInput!
): CreateRiskAssessmentProcessPayload!
@@ -512,12 +572,14 @@ type DeleteRiskAssessmentScopePayload {
input CreateRiskAssessmentNodeInput {
riskAssessmentScopeId: ID!
boundaryId: ID
nodeType: RiskAssessmentNodeType!
name: String!
}
input UpdateRiskAssessmentNodeInput {
id: ID!
boundaryId: ID @goField(omittable: true)
nodeType: RiskAssessmentNodeType
name: String
}
@@ -538,6 +600,34 @@ type DeleteRiskAssessmentNodePayload {
deletedRiskAssessmentNodeId: ID!
}
input CreateRiskAssessmentBoundaryInput {
riskAssessmentScopeId: ID!
parentBoundaryId: ID
name: String!
}
input UpdateRiskAssessmentBoundaryInput {
id: ID!
parentBoundaryId: ID @goField(omittable: true)
name: String
}
input DeleteRiskAssessmentBoundaryInput {
riskAssessmentBoundaryId: ID!
}
type CreateRiskAssessmentBoundaryPayload {
riskAssessmentBoundaryEdge: RiskAssessmentBoundaryConnectionEdge!
}
type UpdateRiskAssessmentBoundaryPayload {
riskAssessmentBoundary: RiskAssessmentBoundary!
}
type DeleteRiskAssessmentBoundaryPayload {
deletedRiskAssessmentBoundaryId: ID!
}
input CreateRiskAssessmentProcessInput {
riskAssessmentScopeId: ID!
sourceNodeId: ID!

147
pkg/server/api/console/v1/risk_assessment_resolvers.go
View File

@@ -200,6 +200,7 @@ func (r *mutationResolver) CreateRiskAssessmentNode(ctx context.Context, input t
scope,
riskmanagement.CreateRiskAssessmentNodeRequest{
RiskAssessmentScopeID: input.RiskAssessmentScopeID,
BoundaryID: input.BoundaryID,
NodeType: input.NodeType,
Name: input.Name,
},
@@ -237,9 +238,10 @@ func (r *mutationResolver) UpdateRiskAssessmentNode(ctx context.Context, input t
ctx,
scope,
riskmanagement.UpdateRiskAssessmentNodeRequest{
ID: input.ID,
NodeType: input.NodeType,
Name: input.Name,
ID: input.ID,
BoundaryID: gqlutils.UnwrapOmittable(input.BoundaryID),
NodeType: input.NodeType,
Name: input.Name,
},
)
if err != nil {
@@ -275,6 +277,97 @@ func (r *mutationResolver) DeleteRiskAssessmentNode(ctx context.Context, input t
return &types.DeleteRiskAssessmentNodePayload{DeletedRiskAssessmentNodeID: input.RiskAssessmentNodeID}, nil
}
// CreateRiskAssessmentBoundary is the resolver for the createRiskAssessmentBoundary field.
func (r *mutationResolver) CreateRiskAssessmentBoundary(ctx context.Context, input types.CreateRiskAssessmentBoundaryInput) (*types.CreateRiskAssessmentBoundaryPayload, error) {
scope, err := r.authorize(ctx, input.RiskAssessmentScopeID, probo.ActionRiskAssessmentBoundaryCreate)
if err != nil {
return nil, err
}
boundary, err := r.riskManagement.CreateBoundary(
ctx,
scope,
riskmanagement.CreateRiskAssessmentBoundaryRequest{
RiskAssessmentScopeID: input.RiskAssessmentScopeID,
ParentBoundaryID: input.ParentBoundaryID,
Name: input.Name,
},
)
if err != nil {
if errors.Is(err, coredata.ErrResourceAlreadyExists) {
return nil, gqlutils.Conflict(ctx, err)
}
if validationErrors, ok := errors.AsType[validator.ValidationErrors](err); ok {
return nil, gqlutils.InvalidValidationErrors(ctx, validationErrors)
}
r.logger.ErrorCtx(ctx, "cannot create risk assessment boundary", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
return &types.CreateRiskAssessmentBoundaryPayload{
RiskAssessmentBoundaryEdge: &types.RiskAssessmentBoundaryConnectionEdge{
Cursor: boundary.CursorKey(coredata.RiskAssessmentBoundaryOrderFieldCreatedAt),
Node: types.NewRiskAssessmentBoundary(boundary),
},
}, nil
}
// UpdateRiskAssessmentBoundary is the resolver for the updateRiskAssessmentBoundary field.
func (r *mutationResolver) UpdateRiskAssessmentBoundary(ctx context.Context, input types.UpdateRiskAssessmentBoundaryInput) (*types.UpdateRiskAssessmentBoundaryPayload, error) {
scope, err := r.authorize(ctx, input.ID, probo.ActionRiskAssessmentBoundaryUpdate)
if err != nil {
return nil, err
}
boundary, err := r.riskManagement.UpdateBoundary(
ctx,
scope,
riskmanagement.UpdateRiskAssessmentBoundaryRequest{
ID: input.ID,
ParentBoundaryID: gqlutils.UnwrapOmittable(input.ParentBoundaryID),
Name: input.Name,
},
)
if err != nil {
if errors.Is(err, coredata.ErrResourceAlreadyExists) {
return nil, gqlutils.Conflict(ctx, err)
}
if validationErrors, ok := errors.AsType[validator.ValidationErrors](err); ok {
return nil, gqlutils.InvalidValidationErrors(ctx, validationErrors)
}
r.logger.ErrorCtx(ctx, "cannot update risk assessment boundary", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
return &types.UpdateRiskAssessmentBoundaryPayload{RiskAssessmentBoundary: types.NewRiskAssessmentBoundary(boundary)}, nil
}
// DeleteRiskAssessmentBoundary is the resolver for the deleteRiskAssessmentBoundary field.
func (r *mutationResolver) DeleteRiskAssessmentBoundary(ctx context.Context, input types.DeleteRiskAssessmentBoundaryInput) (*types.DeleteRiskAssessmentBoundaryPayload, error) {
scope, err := r.authorize(ctx, input.RiskAssessmentBoundaryID, probo.ActionRiskAssessmentBoundaryDelete)
if err != nil {
return nil, err
}
if err := r.riskManagement.DeleteBoundary(ctx, scope, input.RiskAssessmentBoundaryID); err != nil {
if errors.Is(err, coredata.ErrResourceNotFound) {
return nil, gqlutils.NotFound(ctx, err)
}
r.logger.ErrorCtx(ctx, "cannot delete risk assessment boundary", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
return &types.DeleteRiskAssessmentBoundaryPayload{DeletedRiskAssessmentBoundaryID: input.RiskAssessmentBoundaryID}, nil
}
// CreateRiskAssessmentProcess is the resolver for the createRiskAssessmentProcess field.
func (r *mutationResolver) CreateRiskAssessmentProcess(ctx context.Context, input types.CreateRiskAssessmentProcessInput) (*types.CreateRiskAssessmentProcessPayload, error) {
scope, err := r.authorize(ctx, input.RiskAssessmentScopeID, probo.ActionRiskAssessmentProcessCreate)
@@ -744,6 +837,22 @@ func (r *riskAssessmentResolver) Permission(ctx context.Context, obj *types.Risk
return r.Resolver.Permission(ctx, obj, action)
}
// TotalCount is the resolver for the totalCount field.
func (r *riskAssessmentBoundaryConnectionResolver) TotalCount(ctx context.Context, obj *types.RiskAssessmentBoundaryConnection) (*int, error) {
scope, err := r.authorize(ctx, obj.ParentID, probo.ActionRiskAssessmentBoundaryList)
if err != nil {
return nil, err
}
count, err := r.riskManagement.CountBoundariesForScopeID(ctx, scope, obj.ParentID)
if err != nil {
r.logger.ErrorCtx(ctx, "cannot count risk assessment boundaries", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
return &count, nil
}
// TotalCount is the resolver for the totalCount field.
func (r *riskAssessmentConnectionResolver) TotalCount(ctx context.Context, obj *types.RiskAssessmentConnection) (*int, error) {
scope, err := r.authorize(ctx, obj.ParentID, probo.ActionRiskAssessmentList)
@@ -921,6 +1030,32 @@ func (r *riskAssessmentScopeResolver) Nodes(ctx context.Context, obj *types.Risk
return types.NewRiskAssessmentNodeConnection(p, r, obj.ID), nil
}
// Boundaries is the resolver for the boundaries field.
func (r *riskAssessmentScopeResolver) Boundaries(ctx context.Context, obj *types.RiskAssessmentScope, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskAssessmentBoundaryOrderBy) (*types.RiskAssessmentBoundaryConnection, error) {
scope, err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentBoundaryList)
if err != nil {
return nil, err
}
pageOrderBy := page.OrderBy[coredata.RiskAssessmentBoundaryOrderField]{
Field: coredata.RiskAssessmentBoundaryOrderFieldCreatedAt,
Direction: page.OrderDirectionDesc,
}
if orderBy != nil {
pageOrderBy = page.OrderBy[coredata.RiskAssessmentBoundaryOrderField]{Field: orderBy.Field, Direction: orderBy.Direction}
}
cursor := types.NewCursor(first, after, last, before, pageOrderBy)
p, err := r.riskManagement.ListBoundariesForScopeID(ctx, scope, obj.ID, cursor)
if err != nil {
r.logger.ErrorCtx(ctx, "cannot list risk assessment boundaries", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
return types.NewRiskAssessmentBoundaryConnection(p, r, obj.ID), nil
}
// Processes is the resolver for the processes field.
func (r *riskAssessmentScopeResolver) Processes(ctx context.Context, obj *types.RiskAssessmentScope, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskAssessmentProcessOrderBy) (*types.RiskAssessmentProcessConnection, error) {
scope, err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentProcessList)
@@ -1061,6 +1196,11 @@ func (r *riskAssessmentThreatConnectionResolver) TotalCount(ctx context.Context,
// RiskAssessment returns schema.RiskAssessmentResolver implementation.
func (r *Resolver) RiskAssessment() schema.RiskAssessmentResolver { return &riskAssessmentResolver{r} }
// RiskAssessmentBoundaryConnection returns schema.RiskAssessmentBoundaryConnectionResolver implementation.
func (r *Resolver) RiskAssessmentBoundaryConnection() schema.RiskAssessmentBoundaryConnectionResolver {
return &riskAssessmentBoundaryConnectionResolver{r}
}
// RiskAssessmentConnection returns schema.RiskAssessmentConnectionResolver implementation.
func (r *Resolver) RiskAssessmentConnection() schema.RiskAssessmentConnectionResolver {
return &riskAssessmentConnectionResolver{r}
@@ -1102,6 +1242,7 @@ func (r *Resolver) RiskAssessmentThreatConnection() schema.RiskAssessmentThreatC
}
type riskAssessmentResolver struct{ *Resolver }
type riskAssessmentBoundaryConnectionResolver struct{ *Resolver }
type riskAssessmentConnectionResolver struct{ *Resolver }
type riskAssessmentNodeConnectionResolver struct{ *Resolver }
type riskAssessmentProcessConnectionResolver struct{ *Resolver }

65
pkg/server/api/console/v1/types/risk_assessment_boundary.go Normal file
View File

@@ -0,0 +1,65 @@
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package types
import (
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/page"
)
type (
RiskAssessmentBoundaryOrderBy OrderBy[coredata.RiskAssessmentBoundaryOrderField]
RiskAssessmentBoundaryConnection struct {
TotalCount int
Edges []*RiskAssessmentBoundaryConnectionEdge
PageInfo PageInfo
Resolver any
ParentID gid.GID
}
)
func NewRiskAssessmentBoundaryConnection(
p *page.Page[*coredata.RiskAssessmentBoundary, coredata.RiskAssessmentBoundaryOrderField],
parentType any,
parentID gid.GID,
) *RiskAssessmentBoundaryConnection {
edges := make([]*RiskAssessmentBoundaryConnectionEdge, len(p.Data))
for i := range edges {
edges[i] = &RiskAssessmentBoundaryConnectionEdge{
Cursor: p.Data[i].CursorKey(p.Cursor.OrderBy.Field),
Node: NewRiskAssessmentBoundary(p.Data[i]),
}
}
return &RiskAssessmentBoundaryConnection{
Edges: edges,
PageInfo: *NewPageInfo(p),
Resolver: parentType,
ParentID: parentID,
}
}
func NewRiskAssessmentBoundary(b *coredata.RiskAssessmentBoundary) *RiskAssessmentBoundary {
return &RiskAssessmentBoundary{
ID: b.ID,
RiskAssessmentScopeID: b.RiskAssessmentScopeID,
ParentBoundaryID: b.ParentBoundaryID,
Name: b.Name,
CreatedAt: b.CreatedAt,
UpdatedAt: b.UpdatedAt,
}
}

1
pkg/server/api/console/v1/types/risk_assessment_node.go
View File

@@ -57,6 +57,7 @@ func NewRiskAssessmentNode(n *coredata.RiskAssessmentNode) *RiskAssessmentNode {
return &RiskAssessmentNode{
ID: n.ID,
RiskAssessmentScopeID: n.RiskAssessmentScopeID,
BoundaryID: n.BoundaryID,
NodeType: n.NodeType,
Name: n.Name,
CreatedAt: n.CreatedAt,