Add dpa on vendors

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/server/api/console/v1/schema.graphql

@@ -942,6 +942,7 @@ type Vendor implements Node {
   ): VendorComplianceReportConnection! @goField(forceResolver: true)
 
   businessAssociateAgreement: VendorBusinessAssociateAgreement @goField(forceResolver: true)
+  dataPrivacyAgreement: VendorDataPrivacyAgreement @goField(forceResolver: true)
 
   contacts(
     first: Int
@@ -1015,6 +1016,18 @@ type VendorContact implements Node {
   updatedAt: Datetime!
 }
 
+type VendorDataPrivacyAgreement implements Node {
+  id: ID!
+  vendor: Vendor! @goField(forceResolver: true)
+  validFrom: Datetime
+  validUntil: Datetime
+  fileName: String!
+  fileUrl: String! @goField(forceResolver: true)
+  fileSize: Int!
+  createdAt: Datetime!
+  updatedAt: Datetime!
+}
+
 type Framework implements Node {
   id: ID!
   name: String!
@@ -1678,6 +1691,17 @@ type Mutation {
     input: DeleteVendorBusinessAssociateAgreementInput!
   ): DeleteVendorBusinessAssociateAgreementPayload!
 
+  # Vendor Data Privacy Agreement mutations
+  uploadVendorDataPrivacyAgreement(
+    input: UploadVendorDataPrivacyAgreementInput!
+  ): UploadVendorDataPrivacyAgreementPayload!
+  updateVendorDataPrivacyAgreement(
+    input: UpdateVendorDataPrivacyAgreementInput!
+  ): UpdateVendorDataPrivacyAgreementPayload!
+  deleteVendorDataPrivacyAgreement(
+    input: DeleteVendorDataPrivacyAgreementInput!
+  ): DeleteVendorDataPrivacyAgreementPayload!
+
   # Document mutations
   createDocument(input: CreateDocumentInput!): CreateDocumentPayload!
   updateDocument(input: UpdateDocumentInput!): UpdateDocumentPayload!
@@ -2071,6 +2095,24 @@ input DeleteVendorBusinessAssociateAgreementInput {
   vendorId: ID!
 }
 
+input UploadVendorDataPrivacyAgreementInput {
+  vendorId: ID!
+  validFrom: Datetime
+  validUntil: Datetime
+  fileName: String!
+  file: Upload!
+}
+
+input UpdateVendorDataPrivacyAgreementInput {
+  vendorId: ID!
+  validFrom: Datetime
+  validUntil: Datetime
+}
+
+input DeleteVendorDataPrivacyAgreementInput {
+  vendorId: ID!
+}
+
 input CreateDocumentInput {
   organizationId: ID!
   title: String!
@@ -2375,6 +2417,18 @@ type DeleteVendorBusinessAssociateAgreementPayload {
   deletedVendorId: ID!
 }
 
+type UploadVendorDataPrivacyAgreementPayload {
+  vendorDataPrivacyAgreement: VendorDataPrivacyAgreement!
+}
+
+type UpdateVendorDataPrivacyAgreementPayload {
+  vendorDataPrivacyAgreement: VendorDataPrivacyAgreement!
+}
+
+type DeleteVendorDataPrivacyAgreementPayload {
+  deletedVendorId: ID!
+}
+
 type CreateDocumentPayload {
   documentEdge: DocumentEdge!
   documentVersionEdge: DocumentVersionEdge!

pkg/server/api/console/v1/types/types.go

@@ -631,6 +631,14 @@ type DeleteVendorContactPayload struct {
 	DeletedVendorContactID gid.GID `json:"deletedVendorContactId"`
 }
 
+type DeleteVendorDataPrivacyAgreementInput struct {
+	VendorID gid.GID `json:"vendorId"`
+}
+
+type DeleteVendorDataPrivacyAgreementPayload struct {
+	DeletedVendorID gid.GID `json:"deletedVendorId"`
+}
+
 type DeleteVendorInput struct {
 	VendorID gid.GID `json:"vendorId"`
 }
@@ -1306,6 +1314,16 @@ type UpdateVendorContactPayload struct {
 	VendorContact *VendorContact `json:"vendorContact"`
 }
 
+type UpdateVendorDataPrivacyAgreementInput struct {
+	VendorID   gid.GID    `json:"vendorId"`
+	ValidFrom  *time.Time `json:"validFrom,omitempty"`
+	ValidUntil *time.Time `json:"validUntil,omitempty"`
+}
+
+type UpdateVendorDataPrivacyAgreementPayload struct {
+	VendorDataPrivacyAgreement *VendorDataPrivacyAgreement `json:"vendorDataPrivacyAgreement"`
+}
+
 type UpdateVendorInput struct {
 	ID                            gid.GID                  `json:"id"`
 	Name                          *string                  `json:"name,omitempty"`
@@ -1384,6 +1402,18 @@ type UploadVendorComplianceReportPayload struct {
 	VendorComplianceReportEdge *VendorComplianceReportEdge `json:"vendorComplianceReportEdge"`
 }
 
+type UploadVendorDataPrivacyAgreementInput struct {
+	VendorID   gid.GID        `json:"vendorId"`
+	ValidFrom  *time.Time     `json:"validFrom,omitempty"`
+	ValidUntil *time.Time     `json:"validUntil,omitempty"`
+	FileName   string         `json:"fileName"`
+	File       graphql.Upload `json:"file"`
+}
+
+type UploadVendorDataPrivacyAgreementPayload struct {
+	VendorDataPrivacyAgreement *VendorDataPrivacyAgreement `json:"vendorDataPrivacyAgreement"`
+}
+
 type User struct {
 	ID        gid.GID   `json:"id"`
 	FullName  string    `json:"fullName"`
@@ -1414,6 +1444,7 @@ type Vendor struct {
 	Organization                  *Organization                     `json:"organization"`
 	ComplianceReports             *VendorComplianceReportConnection `json:"complianceReports"`
 	BusinessAssociateAgreement    *VendorBusinessAssociateAgreement `json:"businessAssociateAgreement,omitempty"`
+	DataPrivacyAgreement          *VendorDataPrivacyAgreement       `json:"dataPrivacyAgreement,omitempty"`
 	Contacts                      *VendorContactConnection          `json:"contacts"`
 	RiskAssessments               *VendorRiskAssessmentConnection   `json:"riskAssessments"`
 	BusinessOwner                 *People                           `json:"businessOwner,omitempty"`
@@ -1503,6 +1534,21 @@ type VendorContactEdge struct {
 	Node   *VendorContact `json:"node"`
 }
 
+type VendorDataPrivacyAgreement struct {
+	ID         gid.GID    `json:"id"`
+	Vendor     *Vendor    `json:"vendor"`
+	ValidFrom  *time.Time `json:"validFrom,omitempty"`
+	ValidUntil *time.Time `json:"validUntil,omitempty"`
+	FileName   string     `json:"fileName"`
+	FileURL    string     `json:"fileUrl"`
+	FileSize   int        `json:"fileSize"`
+	CreatedAt  time.Time  `json:"createdAt"`
+	UpdatedAt  time.Time  `json:"updatedAt"`
+}
+
+func (VendorDataPrivacyAgreement) IsNode()             {}
+func (this VendorDataPrivacyAgreement) GetID() gid.GID { return this.ID }
+
 type VendorEdge struct {
 	Cursor page.CursorKey `json:"cursor"`
 	Node   *Vendor        `json:"node"`

pkg/server/api/console/v1/types/vendor_data_privacy_agreement.go

@@ -0,0 +1,31 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"github.com/getprobo/probo/pkg/coredata"
+)
+
+func NewVendorDataPrivacyAgreement(v *coredata.VendorDataPrivacyAgreement, file *coredata.File) *VendorDataPrivacyAgreement {
+	return &VendorDataPrivacyAgreement{
+		ID:         v.ID,
+		ValidFrom:  v.ValidFrom,
+		ValidUntil: v.ValidUntil,
+		FileName:   file.FileName,
+		FileSize:   file.FileSize,
+		CreatedAt:  v.CreatedAt,
+		UpdatedAt:  v.UpdatedAt,
+	}
+}

pkg/server/api/console/v1/v1_resolver.go

@@ -2022,6 +2022,64 @@ func (r *mutationResolver) DeleteVendorBusinessAssociateAgreement(ctx context.Co
 	}, nil
 }
 
+// UploadVendorDataPrivacyAgreement is the resolver for the uploadVendorDataPrivacyAgreement field.
+func (r *mutationResolver) UploadVendorDataPrivacyAgreement(ctx context.Context, input types.UploadVendorDataPrivacyAgreementInput) (*types.UploadVendorDataPrivacyAgreementPayload, error) {
+	prb := r.ProboService(ctx, input.VendorID.TenantID())
+
+	vendorDataPrivacyAgreement, file, err := prb.VendorDataPrivacyAgreements.Upload(
+		ctx,
+		input.VendorID,
+		&probo.VendorDataPrivacyAgreementCreateRequest{
+			File:       input.File.File,
+			ValidFrom:  input.ValidFrom,
+			ValidUntil: input.ValidUntil,
+			FileName:   input.FileName,
+		},
+	)
+	if err != nil {
+		return nil, fmt.Errorf("failed to upload vendor data privacy agreement: %w", err)
+	}
+
+	return &types.UploadVendorDataPrivacyAgreementPayload{
+		VendorDataPrivacyAgreement: types.NewVendorDataPrivacyAgreement(vendorDataPrivacyAgreement, file),
+	}, nil
+}
+
+// UpdateVendorDataPrivacyAgreement is the resolver for the updateVendorDataPrivacyAgreement field.
+func (r *mutationResolver) UpdateVendorDataPrivacyAgreement(ctx context.Context, input types.UpdateVendorDataPrivacyAgreementInput) (*types.UpdateVendorDataPrivacyAgreementPayload, error) {
+	prb := r.ProboService(ctx, input.VendorID.TenantID())
+
+	vendorDataPrivacyAgreement, file, err := prb.VendorDataPrivacyAgreements.Update(
+		ctx,
+		input.VendorID,
+		&probo.VendorDataPrivacyAgreementUpdateRequest{
+			ValidFrom:  &input.ValidFrom,
+			ValidUntil: &input.ValidUntil,
+		},
+	)
+	if err != nil {
+		return nil, fmt.Errorf("failed to update vendor data privacy agreement: %w", err)
+	}
+
+	return &types.UpdateVendorDataPrivacyAgreementPayload{
+		VendorDataPrivacyAgreement: types.NewVendorDataPrivacyAgreement(vendorDataPrivacyAgreement, file),
+	}, nil
+}
+
+// DeleteVendorDataPrivacyAgreement is the resolver for the deleteVendorDataPrivacyAgreement field.
+func (r *mutationResolver) DeleteVendorDataPrivacyAgreement(ctx context.Context, input types.DeleteVendorDataPrivacyAgreementInput) (*types.DeleteVendorDataPrivacyAgreementPayload, error) {
+	prb := r.ProboService(ctx, input.VendorID.TenantID())
+
+	err := prb.VendorDataPrivacyAgreements.DeleteByVendorID(ctx, input.VendorID)
+	if err != nil {
+		return nil, fmt.Errorf("failed to delete vendor data privacy agreement: %w", err)
+	}
+
+	return &types.DeleteVendorDataPrivacyAgreementPayload{
+		DeletedVendorID: input.VendorID,
+	}, nil
+}
+
 // CreateDocument is the resolver for the createDocument field.
 func (r *mutationResolver) CreateDocument(ctx context.Context, input types.CreateDocumentInput) (*types.CreateDocumentPayload, error) {
 	prb := r.ProboService(ctx, input.OrganizationID.TenantID())
@@ -3469,6 +3527,22 @@ func (r *vendorResolver) BusinessAssociateAgreement(ctx context.Context, obj *ty
 	return types.NewVendorBusinessAssociateAgreement(vendorBusinessAssociateAgreement, file), nil
 }
 
+// DataPrivacyAgreement is the resolver for the dataPrivacyAgreement field.
+func (r *vendorResolver) DataPrivacyAgreement(ctx context.Context, obj *types.Vendor) (*types.VendorDataPrivacyAgreement, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	vendorDataPrivacyAgreement, file, err := prb.VendorDataPrivacyAgreements.GetByVendorID(ctx, obj.ID)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, nil
+		}
+
+		return nil, fmt.Errorf("failed to get vendor data privacy agreement: %w", err)
+	}
+
+	return types.NewVendorDataPrivacyAgreement(vendorDataPrivacyAgreement, file), nil
+}
+
 // Contacts is the resolver for the contacts field.
 func (r *vendorResolver) Contacts(ctx context.Context, obj *types.Vendor, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.VendorContactOrderBy) (*types.VendorContactConnection, error) {
 	prb := r.ProboService(ctx, obj.ID.TenantID())
@@ -3654,6 +3728,30 @@ func (r *vendorContactResolver) Vendor(ctx context.Context, obj *types.VendorCon
 	return types.NewVendor(vendor), nil
 }
 
+// Vendor is the resolver for the vendor field.
+func (r *vendorDataPrivacyAgreementResolver) Vendor(ctx context.Context, obj *types.VendorDataPrivacyAgreement) (*types.Vendor, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	vendor, err := prb.Vendors.Get(ctx, obj.ID)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get vendor: %w", err)
+	}
+
+	return types.NewVendor(vendor), nil
+}
+
+// FileURL is the resolver for the fileUrl field.
+func (r *vendorDataPrivacyAgreementResolver) FileURL(ctx context.Context, obj *types.VendorDataPrivacyAgreement) (string, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	fileURL, err := prb.VendorDataPrivacyAgreements.GenerateFileURL(ctx, obj.ID, 1*time.Hour)
+	if err != nil {
+		return "", fmt.Errorf("failed to generate file URL: %w", err)
+	}
+
+	return fileURL, nil
+}
+
 // Vendor is the resolver for the vendor field.
 func (r *vendorRiskAssessmentResolver) Vendor(ctx context.Context, obj *types.VendorRiskAssessment) (*types.Vendor, error) {
 	prb := r.ProboService(ctx, obj.ID.TenantID())
@@ -3838,6 +3936,11 @@ func (r *Resolver) VendorConnection() schema.VendorConnectionResolver {
 // VendorContact returns schema.VendorContactResolver implementation.
 func (r *Resolver) VendorContact() schema.VendorContactResolver { return &vendorContactResolver{r} }
 
+// VendorDataPrivacyAgreement returns schema.VendorDataPrivacyAgreementResolver implementation.
+func (r *Resolver) VendorDataPrivacyAgreement() schema.VendorDataPrivacyAgreementResolver {
+	return &vendorDataPrivacyAgreementResolver{r}
+}
+
 // VendorRiskAssessment returns schema.VendorRiskAssessmentResolver implementation.
 func (r *Resolver) VendorRiskAssessment() schema.VendorRiskAssessmentResolver {
 	return &vendorRiskAssessmentResolver{r}
@@ -3880,5 +3983,6 @@ type vendorBusinessAssociateAgreementResolver struct{ *Resolver }
 type vendorComplianceReportResolver struct{ *Resolver }
 type vendorConnectionResolver struct{ *Resolver }
 type vendorContactResolver struct{ *Resolver }
+type vendorDataPrivacyAgreementResolver struct{ *Resolver }
 type vendorRiskAssessmentResolver struct{ *Resolver }
 type viewerResolver struct{ *Resolver }