Add audits

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
2025-07-22 17:34:43 +02:00
parent 95caa4b630
commit e85a7b4955
37 changed files with 8775 additions and 2 deletions
--- a/pkg/coredata/audit.go
+++ b/pkg/coredata/audit.go
@@ -0,0 +1,297 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/page"
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+)
+
+type (
+	Audit struct {
+		ID             gid.GID    `db:"id"`
+		OrganizationID gid.GID    `db:"organization_id"`
+		FrameworkID    gid.GID    `db:"framework_id"`
+		ReportID       *gid.GID   `db:"report_id"`
+		ValidFrom      *time.Time `db:"valid_from"`
+		ValidUntil     *time.Time `db:"valid_until"`
+		State          AuditState `db:"state"`
+		CreatedAt      time.Time  `db:"created_at"`
+		UpdatedAt      time.Time  `db:"updated_at"`
+	}
+
+	Audits []*Audit
+)
+
+func (a *Audit) CursorKey(field AuditOrderField) page.CursorKey {
+	switch field {
+	case AuditOrderFieldCreatedAt:
+		return page.NewCursorKey(a.ID, a.CreatedAt)
+	case AuditOrderFieldValidFrom:
+		return page.NewCursorKey(a.ID, a.ValidFrom)
+	case AuditOrderFieldValidUntil:
+		return page.NewCursorKey(a.ID, a.ValidUntil)
+	case AuditOrderFieldState:
+		return page.NewCursorKey(a.ID, a.State)
+	}
+
+	panic(fmt.Sprintf("unsupported order by: %s", field))
+}
+
+func (a *Audit) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	auditID gid.GID,
+) error {
+	q := `
+SELECT
+	id,
+	organization_id,
+	framework_id,
+	report_id,
+	valid_from,
+	valid_until,
+	state,
+	created_at,
+	updated_at
+FROM
+	audits
+WHERE
+	%s
+	AND id = @audit_id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"audit_id": auditID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query audit: %w", err)
+	}
+
+	audit, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Audit])
+	if err != nil {
+		return fmt.Errorf("cannot collect audit: %w", err)
+	}
+
+	*a = audit
+
+	return nil
+}
+
+func (a *Audits) CountByOrganizationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+) (int, error) {
+	q := `
+SELECT
+	COUNT(id)
+FROM
+	audits
+WHERE
+	%s
+	AND organization_id = @organization_id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"organization_id": organizationID}
+	maps.Copy(args, scope.SQLArguments())
+
+	row := conn.QueryRow(ctx, q, args)
+
+	var count int
+	err := row.Scan(&count)
+	if err != nil {
+		return 0, fmt.Errorf("cannot count audits: %w", err)
+	}
+
+	return count, nil
+}
+
+func (a *Audits) LoadByOrganizationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+	cursor *page.Cursor[AuditOrderField],
+) error {
+	q := `
+SELECT
+	id,
+	organization_id,
+	framework_id,
+	report_id,
+	valid_from,
+	valid_until,
+	state,
+	created_at,
+	updated_at
+FROM
+	audits
+WHERE
+	%s
+	AND organization_id = @organization_id
+	AND %s
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"organization_id": organizationID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query audits: %w", err)
+	}
+
+	audits, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Audit])
+	if err != nil {
+		return fmt.Errorf("cannot collect audits: %w", err)
+	}
+
+	*a = audits
+
+	return nil
+}
+
+func (a *Audit) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO audits (
+	id,
+	tenant_id,
+	organization_id,
+	framework_id,
+	report_id,
+	valid_from,
+	valid_until,
+	state,
+	created_at,
+	updated_at
+) VALUES (
+	@id,
+	@tenant_id,
+	@organization_id,
+	@framework_id,
+	@report_id,
+	@valid_from,
+	@valid_until,
+	@state,
+	@created_at,
+	@updated_at
+)
+`
+
+	args := pgx.StrictNamedArgs{
+		"id":              a.ID,
+		"tenant_id":       scope.GetTenantID(),
+		"organization_id": a.OrganizationID,
+		"framework_id":    a.FrameworkID,
+		"report_id":       a.ReportID,
+		"valid_from":      a.ValidFrom,
+		"valid_until":     a.ValidUntil,
+		"state":           a.State,
+		"created_at":      a.CreatedAt,
+		"updated_at":      a.UpdatedAt,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot insert audit: %w", err)
+	}
+
+	return nil
+}
+
+func (a *Audit) Update(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+UPDATE audits
+SET
+	report_id = @report_id,
+	valid_from = @valid_from,
+	valid_until = @valid_until,
+	state = @state,
+	updated_at = @updated_at
+WHERE
+	%s
+	AND id = @id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"id":          a.ID,
+		"report_id":   a.ReportID,
+		"valid_from":  a.ValidFrom,
+		"valid_until": a.ValidUntil,
+		"state":       a.State,
+		"updated_at":  a.UpdatedAt,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot update audit: %w", err)
+	}
+
+	return nil
+}
+
+func (a *Audit) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+DELETE FROM audits
+WHERE
+	%s
+	AND id = @id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": a.ID}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot delete audit: %w", err)
+	}
+
+	return nil
+}
--- a/pkg/coredata/audit_order_field.go
+++ b/pkg/coredata/audit_order_field.go
@@ -0,0 +1,53 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"fmt"
+)
+
+type AuditOrderField string
+
+const (
+	AuditOrderFieldCreatedAt  AuditOrderField = "CREATED_AT"
+	AuditOrderFieldValidFrom  AuditOrderField = "VALID_FROM"
+	AuditOrderFieldValidUntil AuditOrderField = "VALID_UNTIL"
+	AuditOrderFieldState      AuditOrderField = "STATE"
+)
+
+func (p AuditOrderField) Column() string {
+	return string(p)
+}
+
+func (p AuditOrderField) String() string {
+	return string(p)
+}
+
+func (p AuditOrderField) MarshalText() ([]byte, error) {
+	return []byte(p.String()), nil
+}
+
+func (p *AuditOrderField) UnmarshalText(text []byte) error {
+	val := string(text)
+	switch val {
+	case string(AuditOrderFieldCreatedAt),
+		string(AuditOrderFieldValidFrom),
+		string(AuditOrderFieldValidUntil),
+		string(AuditOrderFieldState):
+		*p = AuditOrderField(val)
+		return nil
+	}
+	return fmt.Errorf("invalid AuditOrderField value: %q", val)
+}
--- a/pkg/coredata/audit_state.go
+++ b/pkg/coredata/audit_state.go
@@ -0,0 +1,66 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"database/sql/driver"
+	"fmt"
+)
+
+type AuditState string
+
+const (
+	AuditStateNotStarted AuditState = "NOT_STARTED"
+	AuditStateInProgress AuditState = "IN_PROGRESS"
+	AuditStateCompleted  AuditState = "COMPLETED"
+	AuditStateRejected   AuditState = "REJECTED"
+	AuditStateOutdated   AuditState = "OUTDATED"
+)
+
+func (as AuditState) String() string {
+	return string(as)
+}
+
+func (as *AuditState) Scan(value any) error {
+	var s string
+	switch v := value.(type) {
+	case string:
+		s = v
+	case []byte:
+		s = string(v)
+	default:
+		return fmt.Errorf("unsupported type for AuditState: %T", value)
+	}
+
+	switch s {
+	case "NOT_STARTED":
+		*as = AuditStateNotStarted
+	case "IN_PROGRESS":
+		*as = AuditStateInProgress
+	case "COMPLETED":
+		*as = AuditStateCompleted
+	case "REJECTED":
+		*as = AuditStateRejected
+	case "OUTDATED":
+		*as = AuditStateOutdated
+	default:
+		return fmt.Errorf("invalid AuditState value: %q", s)
+	}
+	return nil
+}
+
+func (as AuditState) Value() (driver.Value, error) {
+	return as.String(), nil
+}
--- a/pkg/coredata/entity_type_reg.go
+++ b/pkg/coredata/entity_type_reg.go
@@ -35,4 +35,6 @@ const (
 	DocumentVersionSignatureEntityType
 	AssetEntityType
 	DatumEntityType
+	AuditEntityType
+	ReportEntityType
 )
--- a/pkg/coredata/migrations/20250722T151525Z.sql
+++ b/pkg/coredata/migrations/20250722T151525Z.sql
@@ -0,0 +1,34 @@
+-- Create audit state enum
+CREATE TYPE audit_state AS ENUM (
+    'NOT_STARTED',
+    'IN_PROGRESS',
+    'COMPLETED',
+    'REJECTED',
+    'OUTDATED'
+);
+
+-- Create reports table
+CREATE TABLE reports (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    object_key TEXT NOT NULL,
+    mime_type TEXT NOT NULL,
+    filename TEXT NOT NULL,
+    size BIGINT NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    updated_at TIMESTAMP WITH TIME ZONE NOT NULL
+);
+
+-- Create audits table
+CREATE TABLE audits (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+    framework_id TEXT NOT NULL REFERENCES frameworks(id) ON DELETE CASCADE,
+    report_id TEXT REFERENCES reports(id) ON DELETE SET NULL,
+    valid_from DATE,
+    valid_until DATE,
+    state audit_state NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    updated_at TIMESTAMP WITH TIME ZONE NOT NULL
+);
--- a/pkg/coredata/report.go
+++ b/pkg/coredata/report.go
@@ -0,0 +1,202 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/page"
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+)
+
+type (
+	Report struct {
+		ID        gid.GID   `db:"id"`
+		ObjectKey string    `db:"object_key"`
+		MimeType  string    `db:"mime_type"`
+		Filename  string    `db:"filename"`
+		Size      int64     `db:"size"`
+		CreatedAt time.Time `db:"created_at"`
+		UpdatedAt time.Time `db:"updated_at"`
+	}
+
+	Reports []*Report
+)
+
+func (r *Report) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	reportID gid.GID,
+) error {
+	q := `
+SELECT
+	id,
+	object_key,
+	mime_type,
+	filename,
+	size,
+	created_at,
+	updated_at
+FROM
+	reports
+WHERE
+	%s
+	AND id = @report_id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"report_id": reportID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query report: %w", err)
+	}
+
+	report, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Report])
+	if err != nil {
+		return fmt.Errorf("cannot collect report: %w", err)
+	}
+
+	*r = report
+
+	return nil
+}
+
+func (r *Report) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO reports (
+	id,
+	tenant_id,
+	object_key,
+	mime_type,
+	filename,
+	size,
+	created_at,
+	updated_at
+) VALUES (
+	@id,
+	@tenant_id,
+	@object_key,
+	@mime_type,
+	@filename,
+	@size,
+	@created_at,
+	@updated_at
+)
+`
+
+	args := pgx.StrictNamedArgs{
+		"id":         r.ID,
+		"tenant_id":  scope.GetTenantID(),
+		"object_key": r.ObjectKey,
+		"mime_type":  r.MimeType,
+		"filename":   r.Filename,
+		"size":       r.Size,
+		"created_at": r.CreatedAt,
+		"updated_at": r.UpdatedAt,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot insert report: %w", err)
+	}
+
+	return nil
+}
+
+func (r *Report) Update(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+UPDATE reports
+SET
+	object_key = @object_key,
+	mime_type = @mime_type,
+	filename = @filename,
+	size = @size,
+	updated_at = @updated_at
+WHERE
+	%s
+	AND id = @id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"id":         r.ID,
+		"object_key": r.ObjectKey,
+		"mime_type":  r.MimeType,
+		"filename":   r.Filename,
+		"size":       r.Size,
+		"updated_at": r.UpdatedAt,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot update report: %w", err)
+	}
+
+	return nil
+}
+
+func (r *Report) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+DELETE FROM reports
+WHERE
+	%s
+	AND id = @id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": r.ID}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot delete report: %w", err)
+	}
+
+	return nil
+}
+
+func (r *Report) CursorKey(orderBy ReportOrderField) page.CursorKey {
+	switch orderBy {
+	case ReportOrderFieldID:
+		return page.NewCursorKey(r.ID, r.ID)
+	default:
+		return page.NewCursorKey(r.ID, r.ID)
+	}
+}
--- a/pkg/coredata/report_order_field.go
+++ b/pkg/coredata/report_order_field.go
@@ -0,0 +1,40 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+type (
+	ReportOrderField string
+)
+
+const (
+	ReportOrderFieldID ReportOrderField = "ID"
+)
+
+func (p ReportOrderField) Column() string {
+	return string(p)
+}
+
+func (p ReportOrderField) String() string {
+	return string(p)
+}
+
+func (p ReportOrderField) MarshalText() ([]byte, error) {
+	return []byte(p.String()), nil
+}
+
+func (p *ReportOrderField) UnmarshalText(text []byte) error {
+	*p = ReportOrderField(text)
+	return nil
+}