rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Replace implemented column with CMMI maturity level

Browse Source 
Drop the boolean implemented/not-implemented state in favor of a
mandatory CMMI maturity level enum (NONE, INITIAL, MANAGED, DEFINED,
QUANTITATIVELY_MANAGED, OPTIMIZING) stored as a Postgres enum type.

The migration backfills existing rows (NOT_IMPLEMENTED → NONE,
IMPLEMENTED → INITIAL), makes the column NOT NULL, and drops the old
implemented column and its enum type.

- maturityLevel is required on CreateControlInput and non-nullable (!)
  in the GraphQL schema
- CLI displays human-readable CMMI labels instead of raw enum tokens
- SOA table and published document use a single Maturity column in
  place of the old Implemented + Maturity columns
- Remove ControlImplementationState type and all implemented references
  across backend, frontend, CLI, MCP, n8n, and E2E tests

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
This commit is contained in:
Sacha Al Himdani
2026-04-20 20:48:23 +02:00
parent da91afc2a7
commit e1148f812e
32 changed files with 271 additions and 586 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
pkg/cmd/control/create/create.go
View File

@@ -33,7 +33,6 @@ mutation($input: CreateControlInput!) {
name
description
bestPractice
implemented
notImplementedJustification
maturityLevel
}
@@ -60,9 +59,8 @@ type createResponse struct {
Name string `json:"name"`
Description *string `json:"description"`
BestPractice bool `json:"bestPractice"`
Implemented string `json:"implemented"`
NotImplementedJustification *string `json:"notImplementedJustification"`
MaturityLevel *string `json:"maturityLevel"`
MaturityLevel string `json:"maturityLevel"`
} `json:"node"`
} `json:"controlEdge"`
} `json:"createControl"`
@@ -75,16 +73,15 @@ func NewCmdCreate(f *cmdutil.Factory) *cobra.Command {
flagName string
flagDescription string
flagBestPractice bool
flagNotImplemented bool
flagNotImplementedJustification string
flagMaturityLevel string
flagNotImplementedJustification string
)
cmd := &cobra.Command{
Use: "create",
Short: "Create a new control",
Example: ` # Create a control
prb control create --framework FW_ID --section-title "A.5" --name "Information security policies"`,
prb control create --framework FW_ID --section-title "A.5" --name "Information security policies" --maturity-level INITIAL`,
Args: cobra.NoArgs,
RunE: func(cmd *cobra.Command, args []string) error {
cfg, err := f.Config()
@@ -105,34 +102,26 @@ func NewCmdCreate(f *cmdutil.Factory) *cobra.Command {
cmdutil.TokenRefreshOption(cfg, host, hc),
)
implemented := "IMPLEMENTED"
if flagNotImplemented {
implemented = "NOT_IMPLEMENTED"
if err := cmdutil.ValidateEnum("maturity-level", flagMaturityLevel, maturityLevelValues); err != nil {
return err
}
input := map[string]any{
"frameworkId": flagFramework,
"sectionTitle": flagSectionTitle,
"name": flagName,
"bestPractice": flagBestPractice,
"implemented": implemented,
"frameworkId": flagFramework,
"sectionTitle": flagSectionTitle,
"name": flagName,
"bestPractice": flagBestPractice,
"maturityLevel": flagMaturityLevel,
}
if flagDescription != "" {
input["description"] = flagDescription
}
if flagNotImplemented && flagNotImplementedJustification != "" {
if flagMaturityLevel == "NONE" && flagNotImplementedJustification != "" {
input["notImplementedJustification"] = flagNotImplementedJustification
}
if flagMaturityLevel != "" {
if err := cmdutil.ValidateEnum("maturity-level", flagMaturityLevel, maturityLevelValues); err != nil {
return err
}
input["maturityLevel"] = flagMaturityLevel
}
data, err := client.Do(
createMutation,
map[string]any{"input": input},
@@ -163,9 +152,8 @@ func NewCmdCreate(f *cmdutil.Factory) *cobra.Command {
cmd.Flags().StringVar(&flagName, "name", "", "Control name (required)")
cmd.Flags().StringVar(&flagDescription, "description", "", "Control description")
cmd.Flags().BoolVar(&flagBestPractice, "best-practice", false, "Mark as best practice")
cmd.Flags().BoolVar(&flagNotImplemented, "not-implemented", false, "Mark as not implemented")
cmd.Flags().StringVar(&flagNotImplementedJustification, "not-implemented-justification", "", "Justification for non-implementation")
cmd.Flags().StringVar(&flagMaturityLevel, "maturity-level", "", "CMMI maturity level (NONE, INITIAL, MANAGED, DEFINED, QUANTITATIVELY_MANAGED, OPTIMIZING)")
cmd.Flags().StringVar(&flagMaturityLevel, "maturity-level", "INITIAL", "CMMI maturity level (NONE, INITIAL, MANAGED, DEFINED, QUANTITATIVELY_MANAGED, OPTIMIZING)")
cmd.Flags().StringVar(&flagNotImplementedJustification, "not-implemented-justification", "", "Justification when maturity level is NONE")
_ = cmd.MarkFlagRequired("framework")
_ = cmd.MarkFlagRequired("section-title")

12
pkg/cmd/control/list/list.go
View File

@@ -21,6 +21,8 @@ import (
"github.com/spf13/cobra"
"go.probo.inc/probo/pkg/cli/api"
"go.probo.inc/probo/pkg/cmd/cmdutil"
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/docgen"
)
const listQuery = `
@@ -37,7 +39,6 @@ query($id: ID!, $first: Int, $after: CursorKey, $orderBy: ControlOrder, $filter:
name
description
bestPractice
implemented
maturityLevel
}
}
@@ -57,8 +58,7 @@ type control struct {
Name string `json:"name"`
Description *string `json:"description"`
BestPractice bool `json:"bestPractice"`
Implemented string `json:"implemented"`
MaturityLevel *string `json:"maturityLevel"`
MaturityLevel string `json:"maturityLevel"`
}
func NewCmdList(f *cmdutil.Factory) *cobra.Command {
@@ -167,16 +167,12 @@ func NewCmdList(f *cmdutil.Factory) *cobra.Command {
if c.BestPractice {
bp = "Yes"
}
maturity := "-"
if c.MaturityLevel != nil {
maturity = *c.MaturityLevel
}
rows = append(rows, []string{
c.ID,
c.SectionTitle,
c.Name,
bp,
maturity,
docgen.MaturityLabel(coredata.ControlMaturityLevel(c.MaturityLevel)),
})
}

31
pkg/cmd/control/update/update.go
View File

@@ -32,7 +32,6 @@ mutation($input: UpdateControlInput!) {
name
description
bestPractice
implemented
notImplementedJustification
maturityLevel
}
@@ -48,9 +47,8 @@ type updateResponse struct {
Name string `json:"name"`
Description *string `json:"description"`
BestPractice bool `json:"bestPractice"`
Implemented string `json:"implemented"`
NotImplementedJustification *string `json:"notImplementedJustification"`
MaturityLevel *string `json:"maturityLevel"`
MaturityLevel string `json:"maturityLevel"`
} `json:"control"`
} `json:"updateControl"`
}
@@ -70,9 +68,8 @@ func NewCmdUpdate(f *cmdutil.Factory) *cobra.Command {
flagName string
flagDescription string
flagBestPractice bool
flagNotImplemented bool
flagNotImplementedJustification string
flagMaturityLevel string
flagNotImplementedJustification string
)
cmd := &cobra.Command{
@@ -118,12 +115,11 @@ func NewCmdUpdate(f *cmdutil.Factory) *cobra.Command {
if cmd.Flags().Changed("best-practice") {
input["bestPractice"] = flagBestPractice
}
if cmd.Flags().Changed("not-implemented") {
if flagNotImplemented {
input["implemented"] = "NOT_IMPLEMENTED"
} else {
input["implemented"] = "IMPLEMENTED"
if cmd.Flags().Changed("maturity-level") {
if err := cmdutil.ValidateEnum("maturity-level", flagMaturityLevel, maturityLevelValues); err != nil {
return err
}
input["maturityLevel"] = flagMaturityLevel
}
if cmd.Flags().Changed("not-implemented-justification") {
if flagNotImplementedJustification == "" {
@@ -132,16 +128,6 @@ func NewCmdUpdate(f *cmdutil.Factory) *cobra.Command {
input["notImplementedJustification"] = flagNotImplementedJustification
}
}
if cmd.Flags().Changed("maturity-level") {
if flagMaturityLevel == "" {
input["maturityLevel"] = nil
} else {
if err := cmdutil.ValidateEnum("maturity-level", flagMaturityLevel, maturityLevelValues); err != nil {
return err
}
input["maturityLevel"] = flagMaturityLevel
}
}
if len(input) == 1 {
return fmt.Errorf("at least one field must be specified for update")
@@ -176,9 +162,8 @@ func NewCmdUpdate(f *cmdutil.Factory) *cobra.Command {
cmd.Flags().StringVar(&flagName, "name", "", "Control name")
cmd.Flags().StringVar(&flagDescription, "description", "", "Control description")
cmd.Flags().BoolVar(&flagBestPractice, "best-practice", false, "Mark as best practice")
cmd.Flags().BoolVar(&flagNotImplemented, "not-implemented", false, "Mark as not implemented")
cmd.Flags().StringVar(&flagNotImplementedJustification, "not-implemented-justification", "", "Justification for non-implementation")
cmd.Flags().StringVar(&flagMaturityLevel, "maturity-level", "", "CMMI maturity level (NONE, INITIAL, MANAGED, DEFINED, QUANTITATIVELY_MANAGED, OPTIMIZING). Empty string clears the value.")
cmd.Flags().StringVar(&flagMaturityLevel, "maturity-level", "", "CMMI maturity level (NONE, INITIAL, MANAGED, DEFINED, QUANTITATIVELY_MANAGED, OPTIMIZING)")
cmd.Flags().StringVar(&flagNotImplementedJustification, "not-implemented-justification", "", "Justification when maturity level is NONE")
return cmd
}

16
pkg/cmd/control/view/view.go
View File

@@ -22,6 +22,8 @@ import (
"github.com/spf13/cobra"
"go.probo.inc/probo/pkg/cli/api"
"go.probo.inc/probo/pkg/cmd/cmdutil"
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/docgen"
)
const viewQuery = `
@@ -34,7 +36,6 @@ query($id: ID!) {
name
description
bestPractice
implemented
notImplementedJustification
maturityLevel
framework {
@@ -56,9 +57,8 @@ type viewResponse struct {
Name string `json:"name"`
Description *string `json:"description"`
BestPractice bool `json:"bestPractice"`
Implemented string `json:"implemented"`
NotImplementedJustification *string `json:"notImplementedJustification"`
MaturityLevel *string `json:"maturityLevel"`
MaturityLevel string `json:"maturityLevel"`
Framework struct {
ID string `json:"id"`
Name string `json:"name"`
@@ -144,17 +144,11 @@ func NewCmdView(f *cmdutil.Factory) *cobra.Command {
bp = "Yes"
}
_, _ = fmt.Fprintf(out, "%s%s\n", label.Render("Best Practice:"), bp)
_, _ = fmt.Fprintf(out, "%s%s\n", label.Render("Implemented:"), c.Implemented)
if c.Implemented == "NOT_IMPLEMENTED" && c.NotImplementedJustification != nil && *c.NotImplementedJustification != "" {
_, _ = fmt.Fprintf(out, "%s%s\n", label.Render("Maturity:"), docgen.MaturityLabel(coredata.ControlMaturityLevel(c.MaturityLevel)))
if c.MaturityLevel == "NONE" && c.NotImplementedJustification != nil && *c.NotImplementedJustification != "" {
_, _ = fmt.Fprintf(out, "%s%s\n", label.Render("Justification:"), *c.NotImplementedJustification)
}
maturity := "Not set"
if c.MaturityLevel != nil {
maturity = *c.MaturityLevel
}
_, _ = fmt.Fprintf(out, "%s%s\n", label.Render("Maturity:"), maturity)
_, _ = fmt.Fprintln(out)
_, _ = fmt.Fprintf(out, "%s%s\n", label.Render("Created:"), cmdutil.FormatTime(c.CreatedAt))
_, _ = fmt.Fprintf(out, "%s%s\n", label.Render("Updated:"), cmdutil.FormatTime(c.UpdatedAt))

44
pkg/coredata/control.go
View File

@@ -30,18 +30,17 @@ import (
type (
Control struct {
ID gid.GID `db:"id"`
OrganizationID gid.GID `db:"organization_id"`
SectionTitle string `db:"section_title"`
FrameworkID gid.GID `db:"framework_id"`
Name string `db:"name"`
Description *string `db:"description"`
BestPractice bool `db:"best_practice"`
Implemented ControlImplementationState `db:"implemented"`
NotImplementedJustification *string `db:"not_implemented_justification"`
MaturityLevel *ControlMaturityLevel `db:"maturity_level"`
CreatedAt time.Time `db:"created_at"`
UpdatedAt time.Time `db:"updated_at"`
ID gid.GID `db:"id"`
OrganizationID gid.GID `db:"organization_id"`
SectionTitle string `db:"section_title"`
FrameworkID gid.GID `db:"framework_id"`
Name string `db:"name"`
Description *string `db:"description"`
BestPractice bool `db:"best_practice"`
NotImplementedJustification *string `db:"not_implemented_justification"`
MaturityLevel ControlMaturityLevel `db:"maturity_level"`
CreatedAt time.Time `db:"created_at"`
UpdatedAt time.Time `db:"updated_at"`
}
Controls []*Control
@@ -134,7 +133,6 @@ WITH ctrl AS (
c.name,
c.description,
c.best_practice,
c.implemented,
c.not_implemented_justification,
c.maturity_level,
c.created_at,
@@ -155,7 +153,6 @@ SELECT
name,
description,
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
@@ -249,7 +246,6 @@ WITH ctrl AS (
c.name,
c.description,
c.best_practice,
c.implemented,
c.not_implemented_justification,
c.maturity_level,
c.created_at,
@@ -270,7 +266,6 @@ SELECT
name,
description,
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
@@ -370,7 +365,6 @@ WITH ctrl AS (
c.name,
c.description,
c.best_practice,
c.implemented,
c.not_implemented_justification,
c.maturity_level,
c.created_at,
@@ -397,7 +391,6 @@ SELECT
name,
description,
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
@@ -479,7 +472,6 @@ SELECT
name,
description,
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
@@ -576,7 +568,6 @@ WITH ctrl AS (
c.name,
c.description,
c.best_practice,
c.implemented,
c.not_implemented_justification,
c.maturity_level,
c.created_at,
@@ -597,7 +588,6 @@ SELECT
name,
description,
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
@@ -646,7 +636,6 @@ SELECT
name,
description,
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
@@ -697,7 +686,6 @@ SELECT
name,
description,
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
@@ -747,7 +735,6 @@ SELECT
name,
description,
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
@@ -794,7 +781,6 @@ INSERT INTO
name,
description,
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
@@ -809,7 +795,6 @@ VALUES (
@name,
@description,
@best_practice,
@implemented,
@not_implemented_justification,
@maturity_level,
@created_at,
@@ -826,7 +811,6 @@ VALUES (
"name": c.Name,
"description": c.Description,
"best_practice": c.BestPractice,
"implemented": c.Implemented,
"not_implemented_justification": c.NotImplementedJustification,
"maturity_level": c.MaturityLevel,
"created_at": c.CreatedAt,
@@ -880,7 +864,6 @@ UPDATE controls SET
description = @description,
section_title = @section_title,
best_practice = @best_practice,
implemented = @implemented,
not_implemented_justification = @not_implemented_justification,
maturity_level = @maturity_level,
updated_at = @updated_at
@@ -895,7 +878,6 @@ WHERE %s
"description": c.Description,
"section_title": c.SectionTitle,
"best_practice": c.BestPractice,
"implemented": c.Implemented,
"not_implemented_justification": c.NotImplementedJustification,
"maturity_level": c.MaturityLevel,
"updated_at": c.UpdatedAt,
@@ -936,7 +918,6 @@ WITH ctrl AS (
c.name,
c.description,
c.best_practice,
c.implemented,
c.not_implemented_justification,
c.maturity_level,
c.created_at,
@@ -957,7 +938,6 @@ SELECT
name,
description,
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
@@ -1009,7 +989,6 @@ WITH ctrl AS (
c.name,
c.description,
c.best_practice,
c.implemented,
c.not_implemented_justification,
c.maturity_level,
c.created_at,
@@ -1030,7 +1009,6 @@ SELECT
name,
description,
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,

66
pkg/coredata/control_implementation_state.go
View File

@@ -1,66 +0,0 @@
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package coredata
import (
"database/sql/driver"
"fmt"
)
type (
ControlImplementationState string
)
const (
ControlImplementationStateImplemented ControlImplementationState = "IMPLEMENTED"
ControlImplementationStateNotImplemented ControlImplementationState = "NOT_IMPLEMENTED"
)
func (s ControlImplementationState) IsValid() bool {
switch s {
case ControlImplementationStateImplemented, ControlImplementationStateNotImplemented:
return true
}
return false
}
func (s ControlImplementationState) String() string {
return string(s)
}
func (s ControlImplementationState) MarshalText() ([]byte, error) {
return []byte(s.String()), nil
}
func (s *ControlImplementationState) UnmarshalText(data []byte) error {
val := ControlImplementationState(data)
if !val.IsValid() {
return fmt.Errorf("invalid ControlImplementationState value: %q", string(data))
}
*s = val
return nil
}
func (s *ControlImplementationState) Scan(value any) error {
val, ok := value.(string)
if !ok {
return fmt.Errorf("invalid scan source for ControlImplementationState, expected string got %T", value)
}
return s.UnmarshalText([]byte(val))
}
func (s ControlImplementationState) Value() (driver.Value, error) {
return s.String(), nil
}

11
pkg/coredata/control_maturity_level.go
View File

@@ -32,6 +32,17 @@ const (
ControlMaturityLevelOptimizing ControlMaturityLevel = "OPTIMIZING"
)
func ControlMaturityLevels() []ControlMaturityLevel {
return []ControlMaturityLevel{
ControlMaturityLevelNone,
ControlMaturityLevelInitial,
ControlMaturityLevelManaged,
ControlMaturityLevelDefined,
ControlMaturityLevelQuantitativelyManaged,
ControlMaturityLevelOptimizing,
}
}
func (l ControlMaturityLevel) IsValid() bool {
switch l {
case ControlMaturityLevelNone,

23
pkg/coredata/migrations/20260419T172808Z.sql
View File

@@ -12,4 +12,25 @@
-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-- PERFORMANCE OF THIS SOFTWARE.
ALTER TABLE controls ADD COLUMN maturity_level TEXT;
CREATE TYPE control_maturity_level AS ENUM (
'NONE',
'INITIAL',
'MANAGED',
'DEFINED',
'QUANTITATIVELY_MANAGED',
'OPTIMIZING'
);
ALTER TABLE controls ADD COLUMN maturity_level control_maturity_level;
UPDATE controls SET maturity_level = CASE
WHEN implemented = 'NOT_IMPLEMENTED' THEN 'NONE'::control_maturity_level
ELSE 'INITIAL'::control_maturity_level
END;
ALTER TABLE controls ALTER COLUMN maturity_level SET NOT NULL;
ALTER TABLE controls ALTER COLUMN implemented DROP NOT NULL;
-- TODO: drop column and type in a future migration
-- ALTER TABLE controls DROP COLUMN implemented;
-- DROP TYPE control_implementation_state;

10
pkg/docgen/generator.go
View File

@@ -289,9 +289,8 @@ type (
ControlName string
Applicability string
Justification string
Implemented string
NotImplJustification string
MaturityLevel string
NotImplJustification string
Regulatory string
Contractual string
BestPractice string
@@ -321,11 +320,8 @@ func BoolLabel(v bool) string {
return "No"
}
func MaturityLabel(l *coredata.ControlMaturityLevel) string {
if l == nil {
return "Not set"
}
switch *l {
func MaturityLabel(l coredata.ControlMaturityLevel) string {
switch l {
case coredata.ControlMaturityLevelNone:
return "0 - None"
case coredata.ControlMaturityLevelInitial:

68
pkg/probo/control_service.go
View File

@@ -38,9 +38,8 @@ type (
Description *string
SectionTitle string
BestPractice bool
Implemented coredata.ControlImplementationState
MaturityLevel coredata.ControlMaturityLevel
NotImplementedJustification *string
MaturityLevel *coredata.ControlMaturityLevel
}
UpdateControlRequest struct {
@@ -49,9 +48,8 @@ type (
Description **string
SectionTitle *string
BestPractice *bool
Implemented *coredata.ControlImplementationState
MaturityLevel *coredata.ControlMaturityLevel
NotImplementedJustification **string
MaturityLevel **coredata.ControlMaturityLevel
}
)
@@ -65,30 +63,12 @@ func (ccr *CreateControlRequest) Validate() error {
v.Check(ccr.NotImplementedJustification, "not_implemented_justification", validator.SafeText(ContentMaxLength))
v.Check(
ccr.Implemented,
"implemented",
ccr.MaturityLevel,
"maturity_level",
validator.Required(),
validator.OneOfSlice([]string{
string(coredata.ControlImplementationStateImplemented),
string(coredata.ControlImplementationStateNotImplemented),
}),
validator.OneOfSlice(coredata.ControlMaturityLevels()),
)
if ccr.MaturityLevel != nil {
v.Check(
*ccr.MaturityLevel,
"maturity_level",
validator.OneOfSlice([]string{
string(coredata.ControlMaturityLevelNone),
string(coredata.ControlMaturityLevelInitial),
string(coredata.ControlMaturityLevelManaged),
string(coredata.ControlMaturityLevelDefined),
string(coredata.ControlMaturityLevelQuantitativelyManaged),
string(coredata.ControlMaturityLevelOptimizing),
}),
)
}
return v.Error()
}
@@ -100,27 +80,12 @@ func (ucr *UpdateControlRequest) Validate() error {
v.Check(ucr.Description, "description", validator.SafeText(ContentMaxLength))
v.Check(ucr.SectionTitle, "section_title", validator.SafeTextNoNewLine(TitleMaxLength))
v.Check(ucr.NotImplementedJustification, "not_implemented_justification", validator.SafeText(ContentMaxLength))
v.Check(
ucr.Implemented,
"implemented",
validator.OneOfSlice([]string{
string(coredata.ControlImplementationStateImplemented),
string(coredata.ControlImplementationStateNotImplemented),
}),
)
if ucr.MaturityLevel != nil && *ucr.MaturityLevel != nil {
if ucr.MaturityLevel != nil {
v.Check(
**ucr.MaturityLevel,
*ucr.MaturityLevel,
"maturity_level",
validator.OneOfSlice([]string{
string(coredata.ControlMaturityLevelNone),
string(coredata.ControlMaturityLevelInitial),
string(coredata.ControlMaturityLevelManaged),
string(coredata.ControlMaturityLevelDefined),
string(coredata.ControlMaturityLevelQuantitativelyManaged),
string(coredata.ControlMaturityLevelOptimizing),
}),
validator.OneOfSlice(coredata.ControlMaturityLevels()),
)
}
@@ -887,7 +852,7 @@ func (s ControlService) Create(
framework := &coredata.Framework{}
notImplementedJustification := req.NotImplementedJustification
if req.Implemented == coredata.ControlImplementationStateImplemented {
if req.MaturityLevel != coredata.ControlMaturityLevelNone {
notImplementedJustification = nil
}
@@ -898,9 +863,8 @@ func (s ControlService) Create(
Description: req.Description,
SectionTitle: req.SectionTitle,
BestPractice: req.BestPractice,
Implemented: req.Implemented,
NotImplementedJustification: notImplementedJustification,
MaturityLevel: req.MaturityLevel,
NotImplementedJustification: notImplementedJustification,
CreatedAt: now,
UpdatedAt: now,
}
@@ -1007,21 +971,17 @@ func (s ControlService) Update(
control.BestPractice = *req.BestPractice
}
if req.Implemented != nil {
control.Implemented = *req.Implemented
if *req.Implemented == coredata.ControlImplementationStateImplemented {
if req.MaturityLevel != nil {
control.MaturityLevel = *req.MaturityLevel
if *req.MaturityLevel != coredata.ControlMaturityLevelNone {
control.NotImplementedJustification = nil
}
}
if req.NotImplementedJustification != nil && control.Implemented == coredata.ControlImplementationStateNotImplemented {
if req.NotImplementedJustification != nil && control.MaturityLevel == coredata.ControlMaturityLevelNone {
control.NotImplementedJustification = *req.NotImplementedJustification
}
if req.MaturityLevel != nil {
control.MaturityLevel = *req.MaturityLevel
}
control.UpdatedAt = time.Now()
return control.Update(ctx, conn, s.svc.scope)

20
pkg/probo/framework_service.go
View File

@@ -72,7 +72,6 @@ type (
Name string `json:"name"`
Description string `json:"description"`
BestPractice *bool `json:"best_practice,omitempty"`
Implemented string `json:"implemented,omitempty"`
NotImplementedJustification *string `json:"not_implemented_justification,omitempty"`
MaturityLevel *string `json:"maturity_level,omitempty"`
} `json:"controls"`
@@ -605,21 +604,17 @@ func (s FrameworkService) Import(
if control.BestPractice != nil {
bestPractice = *control.BestPractice
}
implemented := coredata.ControlImplementationState(control.Implemented)
if !implemented.IsValid() {
implemented = coredata.ControlImplementationStateImplemented
}
var notImplementedJustification *string
if implemented == coredata.ControlImplementationStateNotImplemented {
notImplementedJustification = control.NotImplementedJustification
}
var maturityLevel *coredata.ControlMaturityLevel
maturityLevel := coredata.ControlMaturityLevelInitial
if control.MaturityLevel != nil {
ml := coredata.ControlMaturityLevel(*control.MaturityLevel)
if ml.IsValid() {
maturityLevel = &ml
maturityLevel = ml
}
}
var notImplementedJustification *string
if maturityLevel == coredata.ControlMaturityLevelNone {
notImplementedJustification = control.NotImplementedJustification
}
control := &coredata.Control{
ID: controlID,
FrameworkID: frameworkID,
@@ -628,9 +623,8 @@ func (s FrameworkService) Import(
Name: control.Name,
Description: &description,
BestPractice: bestPractice,
Implemented: implemented,
NotImplementedJustification: notImplementedJustification,
MaturityLevel: maturityLevel,
NotImplementedJustification: notImplementedJustification,
CreatedAt: now,
UpdatedAt: now,
}

14
pkg/probo/generated_document_service.go
View File

@@ -289,17 +289,8 @@ func (s *GeneratedDocumentService) buildStatementOfApplicabilityDocumentData(
justification = *stmt.Justification
}
implemented := "-"
if applicable {
if control.Implemented == coredata.ControlImplementationStateImplemented {
implemented = "Yes"
} else {
implemented = "No"
}
}
notImplJustification := "-"
if applicable && control.Implemented != coredata.ControlImplementationStateImplemented && control.NotImplementedJustification != nil {
if applicable && control.MaturityLevel == coredata.ControlMaturityLevelNone && control.NotImplementedJustification != nil {
notImplJustification = *control.NotImplementedJustification
}
@@ -328,9 +319,8 @@ func (s *GeneratedDocumentService) buildStatementOfApplicabilityDocumentData(
ControlName: control.Name,
Applicability: docgen.BoolLabel(applicable),
Justification: justification,
Implemented: implemented,
NotImplJustification: notImplJustification,
MaturityLevel: maturityLevel,
NotImplJustification: notImplJustification,
Regulatory: regulatory,
Contractual: contractual,
BestPractice: bestPractice,

38
pkg/probo/templates/statement_of_applicability.json.tmpl
View File

@@ -26,9 +26,8 @@
{ "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 2, "colwidth": [250] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Control", "marks": [{ "type": "bold" }] }] }] },
{ "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 2, "colwidth": [70] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Applicability", "marks": [{ "type": "bold" }] }] }] },
{ "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 2, "colwidth": [130] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Justification for non-applicability", "marks": [{ "type": "bold" }] }] }] },
{ "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 2, "colwidth": [70] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Implemented", "marks": [{ "type": "bold" }] }] }] },
{ "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 2, "colwidth": [110] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Justification for non-implementation", "marks": [{ "type": "bold" }] }] }] },
{ "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 2, "colwidth": [90] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Maturity", "marks": [{ "type": "bold" }] }] }] },
{ "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 2, "colwidth": [110] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Justification for non-implementation", "marks": [{ "type": "bold" }] }] }] },
{ "type": "tableHeader", "attrs": { "colspan": 4, "rowspan": 1 }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Justification for inclusion", "marks": [{ "type": "bold" }] }] }] }
]
},
@@ -48,9 +47,8 @@
{ "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [250] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json (printf "[%s] " .ControlSection)}}, "marks": [{ "type": "code" }] }, { "type": "text", "text": {{json .ControlName}} }] }] },
{ "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [70] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .Applicability}} }] }] },
{ "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [130] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .Justification}} }] }] },
{ "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [70] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .Implemented}} }] }] },
{ "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [110] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .NotImplJustification}} }] }] },
{ "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [90] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .MaturityLevel}} }] }] },
{ "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [110] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .NotImplJustification}} }] }] },
{ "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [60] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .Regulatory}} }] }] },
{ "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [60] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .Contractual}} }] }] },
{ "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [60] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .BestPractice}} }] }] },
@@ -104,28 +102,6 @@
"type": "paragraph",
"content": [{ "type": "text", "text": "Provides the rationale when a control is not applicable. This field is empty for applicable controls." }]
},
{
"type": "heading",
"attrs": { "level": 3 },
"content": [{ "type": "text", "text": "Implemented" }]
},
{
"type": "bulletList",
"content": [
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Yes: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "The control has been implemented by the organization." }] }] },
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "No: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "The control has not been implemented (with justification provided)." }] }] },
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "-: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "Not applicable (control is not applicable)." }] }] }
]
},
{
"type": "heading",
"attrs": { "level": 3 },
"content": [{ "type": "text", "text": "Justification for non-implementation" }]
},
{
"type": "paragraph",
"content": [{ "type": "text", "text": "Provides the rationale when a control is not implemented. This field is empty for implemented controls or when the control is not applicable." }]
},
{
"type": "heading",
"attrs": { "level": 3 },
@@ -144,10 +120,18 @@
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "3 - Defined: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "documented, standardized and integrated into the organization." }] }] },
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "4 - Quantitatively Managed: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "measured, controlled with metrics and statistical objectives." }] }] },
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "5 - Optimizing: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "continuous improvement based on quantitative analysis." }] }] },
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Not set: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "the maturity level has not yet been assessed." }] }] },
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "-: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "Not applicable (control is not applicable)." }] }] }
]
},
{
"type": "heading",
"attrs": { "level": 3 },
"content": [{ "type": "text", "text": "Justification for non-implementation" }]
},
{
"type": "paragraph",
"content": [{ "type": "text", "text": "Provides the rationale when a control has a maturity level of 0 - None. This field is empty for controls with higher maturity levels or when the control is not applicable." }]
},
{
"type": "heading",
"attrs": { "level": 3 },

6
pkg/server/api/console/v1/control_resolvers.go
View File

@@ -415,9 +415,8 @@ func (r *mutationResolver) CreateControl(ctx context.Context, input types.Create
Description: input.Description,
SectionTitle: input.SectionTitle,
BestPractice: input.BestPractice,
Implemented: input.Implemented,
NotImplementedJustification: input.NotImplementedJustification,
MaturityLevel: input.MaturityLevel,
NotImplementedJustification: input.NotImplementedJustification,
},
)
if err != nil {
@@ -453,9 +452,8 @@ func (r *mutationResolver) UpdateControl(ctx context.Context, input types.Update
Description: gqlutils.UnwrapOmittable(input.Description),
SectionTitle: input.SectionTitle,
BestPractice: input.BestPractice,
Implemented: input.Implemented,
MaturityLevel: input.MaturityLevel,
NotImplementedJustification: gqlutils.UnwrapOmittable(input.NotImplementedJustification),
MaturityLevel: gqlutils.UnwrapOmittable(input.MaturityLevel),
},
)

23
pkg/server/api/console/v1/graphql/control.graphql
View File

@@ -1,17 +1,3 @@
enum ControlImplementationState
@goModel(
model: "go.probo.inc/probo/pkg/coredata.ControlImplementationState"
) {
IMPLEMENTED
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.ControlImplementationStateImplemented"
)
NOT_IMPLEMENTED
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.ControlImplementationStateNotImplemented"
)
}
enum ControlMaturityLevel
@goModel(model: "go.probo.inc/probo/pkg/coredata.ControlMaturityLevel") {
NONE
@@ -113,9 +99,8 @@ type Control implements Node {
name: String!
description: String
bestPractice: Boolean!
implemented: ControlImplementationState!
notImplementedJustification: String
maturityLevel: ControlMaturityLevel
maturityLevel: ControlMaturityLevel!
regulatory: Boolean! @goField(forceResolver: true)
contractual: Boolean! @goField(forceResolver: true)
riskAssessment: Boolean! @goField(forceResolver: true)
@@ -307,9 +292,8 @@ input CreateControlInput {
name: String!
description: String
bestPractice: Boolean!
implemented: ControlImplementationState!
maturityLevel: ControlMaturityLevel!
notImplementedJustification: String
maturityLevel: ControlMaturityLevel
}
input UpdateControlInput {
@@ -318,9 +302,8 @@ input UpdateControlInput {
name: String
description: String @goField(omittable: true)
bestPractice: Boolean
implemented: ControlImplementationState
maturityLevel: ControlMaturityLevel
notImplementedJustification: String @goField(omittable: true)
maturityLevel: ControlMaturityLevel @goField(omittable: true)
}
input DeleteControlInput {

1
pkg/server/api/console/v1/types/control.go
View File

@@ -75,7 +75,6 @@ func NewControl(control *coredata.Control) *Control {
Name: control.Name,
Description: control.Description,
BestPractice: control.BestPractice,
Implemented: control.Implemented,
NotImplementedJustification: control.NotImplementedJustification,
MaturityLevel: control.MaturityLevel,
CreatedAt: control.CreatedAt,

30
pkg/server/api/mcp/v1/schema.resolvers.go
View File

@@ -1473,12 +1473,6 @@ func (r *Resolver) AddControlTool(ctx context.Context, req *mcp.CallToolRequest,
svc := r.ProboService(ctx, input.FrameworkID)
var maturityLevel *coredata.ControlMaturityLevel
if input.MaturityLevel != nil {
v := coredata.ControlMaturityLevel(*input.MaturityLevel)
maturityLevel = &v
}
control, err := svc.Controls.Create(
ctx,
probo.CreateControlRequest{
@@ -1487,9 +1481,8 @@ func (r *Resolver) AddControlTool(ctx context.Context, req *mcp.CallToolRequest,
Description: input.Description,
SectionTitle: input.SectionTitle,
BestPractice: input.BestPractice,
Implemented: coredata.ControlImplementationState(input.Implemented),
MaturityLevel: coredata.ControlMaturityLevel(input.MaturityLevel),
NotImplementedJustification: input.NotImplementedJustification,
MaturityLevel: maturityLevel,
},
)
if err != nil {
@@ -1506,20 +1499,10 @@ func (r *Resolver) UpdateControlTool(ctx context.Context, req *mcp.CallToolReque
svc := r.ProboService(ctx, input.ID)
var implemented *coredata.ControlImplementationState
if input.Implemented != nil {
v := coredata.ControlImplementationState(*input.Implemented)
implemented = &v
}
var maturityLevel **coredata.ControlMaturityLevel
if rawMaturity := UnwrapOmittable(input.MaturityLevel); rawMaturity != nil {
var inner *coredata.ControlMaturityLevel
if *rawMaturity != nil {
v := coredata.ControlMaturityLevel(**rawMaturity)
inner = &v
}
maturityLevel = &inner
var maturityLevel *coredata.ControlMaturityLevel
if input.MaturityLevel != nil {
v := coredata.ControlMaturityLevel(*input.MaturityLevel)
maturityLevel = &v
}
control, err := svc.Controls.Update(
@@ -1530,9 +1513,8 @@ func (r *Resolver) UpdateControlTool(ctx context.Context, req *mcp.CallToolReque
Description: UnwrapOmittable(input.Description),
SectionTitle: input.SectionTitle,
BestPractice: input.BestPractice,
Implemented: implemented,
NotImplementedJustification: UnwrapOmittable(input.NotImplementedJustification),
MaturityLevel: maturityLevel,
NotImplementedJustification: UnwrapOmittable(input.NotImplementedJustification),
},
)
if err != nil {

48
pkg/server/api/mcp/v1/specification.yaml
View File

@@ -4212,7 +4212,7 @@ components:
- section_title
- name
- best_practice
- implemented
- maturity_level
- created_at
- updated_at
properties:
@@ -4239,23 +4239,16 @@ components:
best_practice:
type: boolean
description: Whether control is a best practice
implemented:
maturity_level:
type: string
enum: [IMPLEMENTED, NOT_IMPLEMENTED]
description: Control implementation state
go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ControlImplementationState
enum: [NONE, INITIAL, MANAGED, DEFINED, QUANTITATIVELY_MANAGED, OPTIMIZING]
description: CMMI 0-5 maturity level of the control
go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ControlMaturityLevel
not_implemented_justification:
type:
- string
- "null"
description: Justification for non-implementation
maturity_level:
type:
- string
- "null"
enum: [NONE, INITIAL, MANAGED, DEFINED, QUANTITATIVELY_MANAGED, OPTIMIZING, null]
description: CMMI 0-5 maturity level of the control
go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ControlMaturityLevel
created_at:
type: string
format: date-time
@@ -4330,7 +4323,7 @@ components:
- section_title
- name
- best_practice
- implemented
- maturity_level
properties:
organization_id:
$ref: "#/components/schemas/GID"
@@ -4350,23 +4343,16 @@ components:
best_practice:
type: boolean
description: Whether control is a best practice
implemented:
maturity_level:
type: string
enum: [IMPLEMENTED, NOT_IMPLEMENTED]
description: Control implementation state
go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ControlImplementationState
enum: [NONE, INITIAL, MANAGED, DEFINED, QUANTITATIVELY_MANAGED, OPTIMIZING]
description: CMMI 0-5 maturity level of the control
go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ControlMaturityLevel
not_implemented_justification:
type:
- string
- "null"
description: Justification for non-implementation
maturity_level:
type:
- string
- "null"
enum: [NONE, INITIAL, MANAGED, DEFINED, QUANTITATIVELY_MANAGED, OPTIMIZING, null]
description: CMMI 0-5 maturity level of the control
go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ControlMaturityLevel
AddControlOutput:
type: object
@@ -4397,21 +4383,15 @@ components:
best_practice:
type: boolean
description: Whether control is a best practice
implemented:
maturity_level:
type: string
enum: [IMPLEMENTED, NOT_IMPLEMENTED]
description: Control implementation state
go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ControlImplementationState
enum: [NONE, INITIAL, MANAGED, DEFINED, QUANTITATIVELY_MANAGED, OPTIMIZING]
description: CMMI 0-5 maturity level of the control
go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ControlMaturityLevel
not_implemented_justification:
type: ["string", "null"]
description: Justification for non-implementation
go.probo.inc/mcpgen/omittable: true
maturity_level:
type: ["string", "null"]
enum: [NONE, INITIAL, MANAGED, DEFINED, QUANTITATIVELY_MANAGED, OPTIMIZING, null]
description: CMMI 0-5 maturity level of the control
go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ControlMaturityLevel
go.probo.inc/mcpgen/omittable: true
UpdateControlOutput:
type: object

9
pkg/server/api/mcp/v1/types/control.go
View File

@@ -19,12 +19,6 @@ import (
)
func NewControl(c *coredata.Control) *Control {
var maturityLevel *string
if c.MaturityLevel != nil {
s := string(*c.MaturityLevel)
maturityLevel = &s
}
return &Control{
ID: c.ID,
OrganizationID: c.OrganizationID,
@@ -33,9 +27,8 @@ func NewControl(c *coredata.Control) *Control {
Name: c.Name,
Description: c.Description,
BestPractice: c.BestPractice,
Implemented: ControlImplemented(c.Implemented),
NotImplementedJustification: c.NotImplementedJustification,
MaturityLevel: maturityLevel,
MaturityLevel: ControlMaturityLevel(c.MaturityLevel),
CreatedAt: c.CreatedAt,
UpdatedAt: c.UpdatedAt,
}