rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Make gdpr assessment snapshottable

Browse Source 
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
This commit is contained in:
Sacha Al Himdani
2025-12-18 17:49:23 +01:00
parent 91b42c6cd1
commit dccd186eb7
22 changed files with 975 additions and 192 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
pkg/coredata/migrations/20251216T153357Z.sql
View File

@@ -12,6 +12,8 @@ CREATE TYPE processing_activity_dpia_residual_risk AS ENUM ('LOW', 'MEDIUM', 'HI
CREATE TABLE processing_activity_data_protection_impact_assessments (
id TEXT PRIMARY KEY,
tenant_id TEXT NOT NULL,
snapshot_id TEXT REFERENCES snapshots(id) ON UPDATE CASCADE ON DELETE CASCADE,
source_id TEXT,
organization_id TEXT NOT NULL,
processing_activity_id TEXT NOT NULL,
description TEXT,
@@ -32,12 +34,17 @@ CREATE TABLE processing_activity_data_protection_impact_assessments (
FOREIGN KEY (processing_activity_id)
REFERENCES processing_activities(id)
ON UPDATE CASCADE
ON DELETE CASCADE
ON DELETE CASCADE,
CONSTRAINT processing_activity_dpias_source_id_snapshot_id_key
UNIQUE (source_id, snapshot_id)
);
CREATE TABLE processing_activity_transfer_impact_assessments (
id TEXT PRIMARY KEY,
tenant_id TEXT NOT NULL,
snapshot_id TEXT REFERENCES snapshots(id) ON UPDATE CASCADE ON DELETE CASCADE,
source_id TEXT,
organization_id TEXT NOT NULL,
processing_activity_id TEXT NOT NULL,
data_subjects TEXT,
@@ -58,5 +65,8 @@ CREATE TABLE processing_activity_transfer_impact_assessments (
FOREIGN KEY (processing_activity_id)
REFERENCES processing_activities(id)
ON UPDATE CASCADE
ON DELETE CASCADE
ON DELETE CASCADE,
CONSTRAINT processing_activity_tias_source_id_snapshot_id_key
UNIQUE (source_id, snapshot_id)
);

2
pkg/coredata/processing_activities.go
View File

@@ -427,7 +427,7 @@ WHERE
}
func (pas ProcessingActivities) Snapshot(ctx context.Context, conn pg.Conn, scope Scoper, organizationID, snapshotID gid.GID) error {
snapshotters := []ProcessingActivitySnapshotter{ProcessingActivities{}, Vendors{}, ProcessingActivityVendors{}}
snapshotters := []ProcessingActivitySnapshotter{ProcessingActivities{}, Vendors{}, ProcessingActivityVendors{}, ProcessingActivityDPIAs{}, ProcessingActivityTIAs{}}
for _, snapshotter := range snapshotters {
if err := snapshotter.InsertProcessingActivitySnapshots(ctx, conn, scope, organizationID, snapshotID); err != nil {

76
pkg/coredata/processing_activity_dpia.go
View File

@@ -38,6 +38,8 @@ func (e ErrProcessingActivityDPIANotFound) Error() string {
type (
ProcessingActivityDPIA struct {
ID gid.GID `db:"id"`
SnapshotID *gid.GID `db:"snapshot_id"`
SourceID *gid.GID `db:"source_id"`
OrganizationID gid.GID `db:"organization_id"`
ProcessingActivityID gid.GID `db:"processing_activity_id"`
Description *string `db:"description"`
@@ -66,6 +68,7 @@ func (dpias *ProcessingActivityDPIAs) CountByOrganizationID(
conn pg.Conn,
scope Scoper,
organizationID gid.GID,
filter *ProcessingActivityDPIAFilter,
) (int, error) {
q := `
SELECT
@@ -75,12 +78,14 @@ FROM
WHERE
%s
AND organization_id = @organization_id
AND %s
`
q = fmt.Sprintf(q, scope.SQLFragment())
q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment())
args := pgx.StrictNamedArgs{"organization_id": organizationID}
maps.Copy(args, scope.SQLArguments())
maps.Copy(args, filter.SQLArguments())
row := conn.QueryRow(ctx, q, args)
@@ -99,10 +104,13 @@ func (dpias *ProcessingActivityDPIAs) LoadByOrganizationID(
scope Scoper,
organizationID gid.GID,
cursor *page.Cursor[ProcessingActivityDPIAOrderField],
filter *ProcessingActivityDPIAFilter,
) error {
q := `
SELECT
id,
snapshot_id,
source_id,
organization_id,
processing_activity_id,
description,
@@ -118,12 +126,14 @@ WHERE
%s
AND organization_id = @organization_id
AND %s
AND %s
`
q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment(), cursor.SQLFragment())
args := pgx.StrictNamedArgs{"organization_id": organizationID}
maps.Copy(args, scope.SQLArguments())
maps.Copy(args, filter.SQLArguments())
maps.Copy(args, cursor.SQLArguments())
rows, err := conn.Query(ctx, q, args)
@@ -150,6 +160,8 @@ func (dpia *ProcessingActivityDPIA) LoadByID(
q := `
SELECT
id,
snapshot_id,
source_id,
organization_id,
processing_activity_id,
description,
@@ -199,6 +211,8 @@ func (dpia *ProcessingActivityDPIA) LoadByProcessingActivityID(
q := `
SELECT
id,
snapshot_id,
source_id,
organization_id,
processing_activity_id,
description,
@@ -357,3 +371,61 @@ WHERE
return nil
}
func (dpias ProcessingActivityDPIAs) InsertProcessingActivitySnapshots(
ctx context.Context,
conn pg.Conn,
scope Scoper,
organizationID gid.GID,
snapshotID gid.GID,
) error {
query := `
INSERT INTO processing_activity_data_protection_impact_assessments (
id,
tenant_id,
snapshot_id,
source_id,
organization_id,
processing_activity_id,
description,
necessity_and_proportionality,
potential_risk,
mitigations,
residual_risk,
created_at,
updated_at
)
SELECT
generate_gid(decode_base64_unpadded(@tenant_id), @dpia_entity_type),
@tenant_id,
@snapshot_id,
dpia.id,
dpia.organization_id,
pa_snapshot.id,
dpia.description,
dpia.necessity_and_proportionality,
dpia.potential_risk,
dpia.mitigations,
dpia.residual_risk,
dpia.created_at,
dpia.updated_at
FROM processing_activity_data_protection_impact_assessments dpia
INNER JOIN processing_activities pa_source ON dpia.processing_activity_id = pa_source.id AND pa_source.snapshot_id IS NULL
INNER JOIN processing_activities pa_snapshot ON pa_source.id = pa_snapshot.source_id AND pa_snapshot.snapshot_id = @snapshot_id
WHERE dpia.tenant_id = @tenant_id AND dpia.organization_id = @organization_id AND dpia.snapshot_id IS NULL
`
args := pgx.StrictNamedArgs{
"tenant_id": scope.GetTenantID(),
"snapshot_id": snapshotID,
"organization_id": organizationID,
"dpia_entity_type": ProcessingActivityDPIAEntityType,
}
_, err := conn.Exec(ctx, query, args)
if err != nil {
return fmt.Errorf("cannot insert processing activity dpia snapshots: %w", err)
}
return nil
}

54
pkg/coredata/processing_activity_dpia_filter.go Normal file
View File

@@ -0,0 +1,54 @@
// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package coredata
import (
"github.com/jackc/pgx/v5"
"go.probo.inc/probo/pkg/gid"
)
type (
ProcessingActivityDPIAFilter struct {
snapshotID **gid.GID
}
)
func NewProcessingActivityDPIAFilter(snapshotID **gid.GID) *ProcessingActivityDPIAFilter {
return &ProcessingActivityDPIAFilter{
snapshotID: snapshotID,
}
}
func (f *ProcessingActivityDPIAFilter) SQLArguments() pgx.NamedArgs {
args := pgx.NamedArgs{}
if f.snapshotID != nil && *f.snapshotID != nil {
args["filter_snapshot_id"] = **f.snapshotID
}
return args
}
func (f *ProcessingActivityDPIAFilter) SQLFragment() string {
if f.snapshotID == nil {
return "TRUE"
}
if *f.snapshotID == nil {
return "snapshot_id IS NULL"
} else {
return "snapshot_id = @filter_snapshot_id"
}
}

76
pkg/coredata/processing_activity_tia.go
View File

@@ -38,6 +38,8 @@ func (e ErrProcessingActivityTIANotFound) Error() string {
type (
ProcessingActivityTIA struct {
ID gid.GID `db:"id"`
SnapshotID *gid.GID `db:"snapshot_id"`
SourceID *gid.GID `db:"source_id"`
OrganizationID gid.GID `db:"organization_id"`
ProcessingActivityID gid.GID `db:"processing_activity_id"`
DataSubjects *string `db:"data_subjects"`
@@ -66,6 +68,7 @@ func (tias *ProcessingActivityTIAs) CountByOrganizationID(
conn pg.Conn,
scope Scoper,
organizationID gid.GID,
filter *ProcessingActivityTIAFilter,
) (int, error) {
q := `
SELECT
@@ -75,12 +78,14 @@ FROM
WHERE
%s
AND organization_id = @organization_id
AND %s
`
q = fmt.Sprintf(q, scope.SQLFragment())
q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment())
args := pgx.StrictNamedArgs{"organization_id": organizationID}
maps.Copy(args, scope.SQLArguments())
maps.Copy(args, filter.SQLArguments())
row := conn.QueryRow(ctx, q, args)
@@ -99,10 +104,13 @@ func (tias *ProcessingActivityTIAs) LoadByOrganizationID(
scope Scoper,
organizationID gid.GID,
cursor *page.Cursor[ProcessingActivityTIAOrderField],
filter *ProcessingActivityTIAFilter,
) error {
q := `
SELECT
id,
snapshot_id,
source_id,
organization_id,
processing_activity_id,
data_subjects,
@@ -118,12 +126,14 @@ WHERE
%s
AND organization_id = @organization_id
AND %s
AND %s
`
q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment(), cursor.SQLFragment())
args := pgx.StrictNamedArgs{"organization_id": organizationID}
maps.Copy(args, scope.SQLArguments())
maps.Copy(args, filter.SQLArguments())
maps.Copy(args, cursor.SQLArguments())
rows, err := conn.Query(ctx, q, args)
@@ -150,6 +160,8 @@ func (tia *ProcessingActivityTIA) LoadByID(
q := `
SELECT
id,
snapshot_id,
source_id,
organization_id,
processing_activity_id,
data_subjects,
@@ -199,6 +211,8 @@ func (tia *ProcessingActivityTIA) LoadByProcessingActivityID(
q := `
SELECT
id,
snapshot_id,
source_id,
organization_id,
processing_activity_id,
data_subjects,
@@ -357,3 +371,61 @@ WHERE
return nil
}
func (tias ProcessingActivityTIAs) InsertProcessingActivitySnapshots(
ctx context.Context,
conn pg.Conn,
scope Scoper,
organizationID gid.GID,
snapshotID gid.GID,
) error {
query := `
INSERT INTO processing_activity_transfer_impact_assessments (
id,
tenant_id,
snapshot_id,
source_id,
organization_id,
processing_activity_id,
data_subjects,
legal_mechanism,
transfer,
local_law_risk,
supplementary_measures,
created_at,
updated_at
)
SELECT
generate_gid(decode_base64_unpadded(@tenant_id), @tia_entity_type),
@tenant_id,
@snapshot_id,
tia.id,
tia.organization_id,
pa_snapshot.id,
tia.data_subjects,
tia.legal_mechanism,
tia.transfer,
tia.local_law_risk,
tia.supplementary_measures,
tia.created_at,
tia.updated_at
FROM processing_activity_transfer_impact_assessments tia
INNER JOIN processing_activities pa_source ON tia.processing_activity_id = pa_source.id AND pa_source.snapshot_id IS NULL
INNER JOIN processing_activities pa_snapshot ON pa_source.id = pa_snapshot.source_id AND pa_snapshot.snapshot_id = @snapshot_id
WHERE tia.tenant_id = @tenant_id AND tia.organization_id = @organization_id AND tia.snapshot_id IS NULL
`
args := pgx.StrictNamedArgs{
"tenant_id": scope.GetTenantID(),
"snapshot_id": snapshotID,
"organization_id": organizationID,
"tia_entity_type": ProcessingActivityTIAEntityType,
}
_, err := conn.Exec(ctx, query, args)
if err != nil {
return fmt.Errorf("cannot insert processing activity tia snapshots: %w", err)
}
return nil
}

54
pkg/coredata/processing_activity_tia_filter.go Normal file
View File

@@ -0,0 +1,54 @@
// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package coredata
import (
"github.com/jackc/pgx/v5"
"go.probo.inc/probo/pkg/gid"
)
type (
ProcessingActivityTIAFilter struct {
snapshotID **gid.GID
}
)
func NewProcessingActivityTIAFilter(snapshotID **gid.GID) *ProcessingActivityTIAFilter {
return &ProcessingActivityTIAFilter{
snapshotID: snapshotID,
}
}
func (f *ProcessingActivityTIAFilter) SQLArguments() pgx.NamedArgs {
args := pgx.NamedArgs{}
if f.snapshotID != nil && *f.snapshotID != nil {
args["filter_snapshot_id"] = **f.snapshotID
}
return args
}
func (f *ProcessingActivityTIAFilter) SQLFragment() string {
if f.snapshotID == nil {
return "TRUE"
}
if *f.snapshotID == nil {
return "snapshot_id IS NULL"
} else {
return "snapshot_id = @filter_snapshot_id"
}
}