Add measure-document linking

Introduce the ability to link measures to documents, following the existing pattern used by controls and risks. This includes: - Database migration for measures_documents join table - Coredata MeasureDocument struct with insert/delete operations - Document service methods for listing/counting by measure ID - Measure service CreateDocumentMapping/DeleteDocumentMapping methods - Cleanup of measure-document mappings on document archive - GraphQL mutations, inputs, payloads, and Measure.documents field - DocumentConnection.TotalCount support for measure resolver - MCP linkMeasure/unlinkMeasure updated to support documents - MCP listMeasureDocuments tool - Frontend MeasureDocumentsTab with LinkedDocumentsCard integration - Authorization actions for measure document mapping - E2e tests for measure document mapping Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
2026-04-03 09:38:38 +02:00
parent 8de7add203
commit ef2e99d86c
16 changed files with 903 additions and 50 deletions
--- a/pkg/coredata/document.go
+++ b/pkg/coredata/document.go
@@ -837,6 +837,103 @@ WHERE rp.risk_id = @risk_id
 	return nil
 }

+func (p *Documents) CountByMeasureID(
+	ctx context.Context,
+	conn pg.Querier,
+	scope Scoper,
+	measureID gid.GID,
+	filter *DocumentFilter,
+) (int, error) {
+	q := `
+WITH scoped_documents AS (
+	SELECT *
+	FROM documents
+	WHERE %s
+		AND deleted_at IS NULL
+		AND %s
+)
+SELECT COUNT(scoped_documents.id)
+FROM scoped_documents
+INNER JOIN measures_documents md ON scoped_documents.id = md.document_id
+WHERE md.measure_id = @measure_id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment())
+
+	args := pgx.NamedArgs{"measure_id": measureID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, filter.SQLArguments())
+
+	row := conn.QueryRow(ctx, q, args)
+	var count int
+	if err := row.Scan(&count); err != nil {
+		return 0, fmt.Errorf("cannot scan count: %w", err)
+	}
+
+	return count, nil
+}
+
+func (p *Documents) LoadByMeasureID(
+	ctx context.Context,
+	conn pg.Querier,
+	scope Scoper,
+	measureID gid.GID,
+	cursor *page.Cursor[DocumentOrderField],
+	filter *DocumentFilter,
+) error {
+	q := `
+WITH latest_versions AS (
+	SELECT DISTINCT ON (document_id) document_id, document_type
+	FROM document_versions
+	ORDER BY document_id, major DESC, minor DESC
+),
+scoped_documents AS (
+	SELECT *
+	FROM documents
+	WHERE %s
+		AND deleted_at IS NULL
+		AND %s
+		AND %s
+)
+SELECT
+	scoped_documents.id,
+	scoped_documents.organization_id,
+	scoped_documents.title,
+	scoped_documents.current_published_major,
+	scoped_documents.current_published_minor,
+	scoped_documents.trust_center_visibility,
+	scoped_documents.status,
+	scoped_documents.archived_at,
+	scoped_documents.created_at,
+	scoped_documents.updated_at,
+	COALESCE(lv.document_type, 'OTHER') AS document_type
+FROM scoped_documents
+INNER JOIN measures_documents md ON scoped_documents.id = md.document_id
+LEFT JOIN latest_versions lv ON lv.document_id = scoped_documents.id
+WHERE md.measure_id = @measure_id
+`
+	q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.NamedArgs{"measure_id": measureID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, filter.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query documents: %w", err)
+	}
+
+	documents, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Document])
+	if err != nil {
+		return fmt.Errorf("cannot collect documents: %w", err)
+	}
+
+	*p = documents
+
+	return nil
+}
+
 func (p *Documents) BulkSoftDelete(
 	ctx context.Context,
 	conn pg.Tx,
--- a/pkg/coredata/measure_document.go
+++ b/pkg/coredata/measure_document.go
@@ -0,0 +1,144 @@
+// Copyright (c) 2025-2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/gid"
+)
+
+type (
+	MeasureDocument struct {
+		MeasureID      gid.GID      `db:"measure_id"`
+		DocumentID     gid.GID      `db:"document_id"`
+		OrganizationID gid.GID      `db:"organization_id"`
+		TenantID       gid.TenantID `db:"tenant_id"`
+		CreatedAt      time.Time    `db:"created_at"`
+	}
+
+	MeasureDocuments []*MeasureDocument
+)
+
+func (md MeasureDocument) Insert(
+	ctx context.Context,
+	conn pg.Tx,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO
+    measures_documents (
+        measure_id,
+        document_id,
+        organization_id,
+        tenant_id,
+        created_at
+    )
+VALUES (
+    @measure_id,
+    @document_id,
+    @organization_id,
+    @tenant_id,
+    @created_at
+);
+`
+
+	args := pgx.StrictNamedArgs{
+		"measure_id":      md.MeasureID,
+		"document_id":     md.DocumentID,
+		"organization_id": md.OrganizationID,
+		"tenant_id":       scope.GetTenantID(),
+		"created_at":      md.CreatedAt,
+	}
+	_, err := conn.Exec(ctx, q, args)
+
+	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "measures_documents_pkey" {
+				return ErrResourceAlreadyExists
+			}
+		}
+
+		return fmt.Errorf("cannot insert measure document: %w", err)
+	}
+
+	return nil
+}
+
+func (md MeasureDocument) Delete(
+	ctx context.Context,
+	conn pg.Tx,
+	scope Scoper,
+	measureID gid.GID,
+	documentID gid.GID,
+) error {
+	q := `
+DELETE
+FROM
+    measures_documents
+WHERE
+    %s
+    AND measure_id = @measure_id
+    AND document_id = @document_id;
+`
+
+	args := pgx.StrictNamedArgs{
+		"measure_id":  measureID,
+		"document_id": documentID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}
+
+func (md MeasureDocument) DeleteByDocumentIDs(
+	ctx context.Context,
+	conn pg.Tx,
+	scope Scoper,
+	documentIDs []gid.GID,
+) error {
+	q := `
+DELETE
+FROM
+    measures_documents
+WHERE
+    %s
+    AND document_id = ANY(@document_ids);
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"document_ids": documentIDs,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	if _, err := conn.Exec(ctx, q, args); err != nil {
+		return fmt.Errorf("cannot delete measure document mappings by document ids: %w", err)
+	}
+
+	return nil
+}
--- a/pkg/coredata/migrations/20260403T120000Z.sql
+++ b/pkg/coredata/migrations/20260403T120000Z.sql
@@ -0,0 +1,22 @@
+-- Copyright (c) 2025-2026 Probo Inc <hello@getprobo.com>.
+--
+-- Permission to use, copy, modify, and/or distribute this software for any
+-- purpose with or without fee is hereby granted, provided that the above
+-- copyright notice and this permission notice appear in all copies.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+-- PERFORMANCE OF THIS SOFTWARE.
+
+CREATE TABLE measures_documents (
+    measure_id TEXT NOT NULL REFERENCES measures(id) ON DELETE CASCADE,
+    document_id TEXT NOT NULL REFERENCES documents(id),
+    organization_id TEXT NOT NULL,
+    tenant_id TEXT NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    PRIMARY KEY (measure_id, document_id)
+);
--- a/pkg/probo/actions.go
+++ b/pkg/probo/actions.go
@@ -154,13 +154,15 @@ const (
 	ActionControlObligationMappingDelete = "core:control:delete-obligation-mapping"

 	// Measure actions
-	ActionMeasureGet            = "core:measure:get"
-	ActionMeasureList           = "core:measure:list"
-	ActionMeasureCreate         = "core:measure:create"
-	ActionMeasureUpdate         = "core:measure:update"
-	ActionMeasureDelete         = "core:measure:delete"
-	ActionMeasureEvidenceUpload = "core:measure:upload-evidence"
-	ActionMeasureImport         = "core:measure:import"
+	ActionMeasureGet                   = "core:measure:get"
+	ActionMeasureList                  = "core:measure:list"
+	ActionMeasureCreate                = "core:measure:create"
+	ActionMeasureUpdate                = "core:measure:update"
+	ActionMeasureDelete                = "core:measure:delete"
+	ActionMeasureEvidenceUpload        = "core:measure:upload-evidence"
+	ActionMeasureImport                = "core:measure:import"
+	ActionMeasureDocumentMappingCreate = "core:measure:create-document-mapping"
+	ActionMeasureDocumentMappingDelete = "core:measure:delete-document-mapping"

 	// Task actions
 	ActionTaskGet      = "core:task:get"
--- a/pkg/probo/document_service.go
+++ b/pkg/probo/document_service.go
@@ -1133,6 +1133,11 @@ func (s *DocumentService) BulkArchive(
 				return fmt.Errorf("cannot delete risk mappings: %w", err)
 			}

+			measureDocument := coredata.MeasureDocument{}
+			if err := measureDocument.DeleteByDocumentIDs(ctx, tx, s.svc.scope, documentIDs); err != nil {
+				return fmt.Errorf("cannot delete measure mappings: %w", err)
+			}
+
 			return documents.BulkArchive(ctx, tx, s.svc.scope)
 		},
 	)
@@ -1532,6 +1537,58 @@ func (s *DocumentService) ListForRiskID(
 	return page.NewPage(documents, cursor), nil
 }

+func (s *DocumentService) CountForMeasureID(
+	ctx context.Context,
+	measureID gid.GID,
+	filter *coredata.DocumentFilter,
+) (int, error) {
+	var count int
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(ctx context.Context, conn pg.Querier) (err error) {
+			documents := &coredata.Documents{}
+			count, err = documents.CountByMeasureID(ctx, conn, s.svc.scope, measureID, filter)
+			if err != nil {
+				return fmt.Errorf("cannot count documents: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return 0, err
+	}
+
+	return count, nil
+}
+
+func (s *DocumentService) ListForMeasureID(
+	ctx context.Context,
+	measureID gid.GID,
+	cursor *page.Cursor[coredata.DocumentOrderField],
+	filter *coredata.DocumentFilter,
+) (*page.Page[*coredata.Document, coredata.DocumentOrderField], error) {
+	var documents coredata.Documents
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(ctx context.Context, conn pg.Querier) error {
+			if err := documents.LoadByMeasureID(ctx, conn, s.svc.scope, measureID, cursor, filter); err != nil {
+				return fmt.Errorf("cannot list documents for measure: %w", err)
+			}
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(documents, cursor), nil
+}
+
 func (s *DocumentService) Update(
 	ctx context.Context,
 	req UpdateDocumentRequest,
@@ -1618,6 +1675,11 @@ func (s *DocumentService) Archive(
 				return fmt.Errorf("cannot delete risk mappings: %w", err)
 			}

+			measureDocument := coredata.MeasureDocument{}
+			if err := measureDocument.DeleteByDocumentIDs(ctx, tx, s.svc.scope, []gid.GID{documentID}); err != nil {
+				return fmt.Errorf("cannot delete measure mappings: %w", err)
+			}
+
 			document.Status = coredata.DocumentStatusArchived
 			document.ArchivedAt = &now
 			document.UpdatedAt = now
--- a/pkg/probo/measure_service.go
+++ b/pkg/probo/measure_service.go
@@ -601,3 +601,80 @@ func (s MeasureService) Delete(
 		return nil
 	})
 }
+
+func (s MeasureService) CreateDocumentMapping(
+	ctx context.Context,
+	measureID gid.GID,
+	documentID gid.GID,
+) (*coredata.Measure, *coredata.Document, error) {
+	measure := &coredata.Measure{}
+	document := &coredata.Document{}
+
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(ctx context.Context, tx pg.Tx) error {
+			if err := measure.LoadByID(ctx, tx, s.svc.scope, measureID); err != nil {
+				return fmt.Errorf("cannot load measure: %w", err)
+			}
+
+			if err := document.LoadByID(ctx, tx, s.svc.scope, documentID); err != nil {
+				return fmt.Errorf("cannot load document: %w", err)
+			}
+
+			measureDocument := &coredata.MeasureDocument{
+				MeasureID:      measure.ID,
+				DocumentID:     document.ID,
+				OrganizationID: measure.OrganizationID,
+				TenantID:       s.svc.scope.GetTenantID(),
+				CreatedAt:      time.Now(),
+			}
+
+			if err := measureDocument.Insert(ctx, tx, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot insert measure document: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return measure, document, nil
+}
+
+func (s MeasureService) DeleteDocumentMapping(
+	ctx context.Context,
+	measureID gid.GID,
+	documentID gid.GID,
+) (*coredata.Measure, *coredata.Document, error) {
+	measure := &coredata.Measure{}
+	document := &coredata.Document{}
+
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(ctx context.Context, tx pg.Tx) error {
+			if err := measure.LoadByID(ctx, tx, s.svc.scope, measureID); err != nil {
+				return fmt.Errorf("cannot load measure: %w", err)
+			}
+
+			if err := document.LoadByID(ctx, tx, s.svc.scope, documentID); err != nil {
+				return fmt.Errorf("cannot load document: %w", err)
+			}
+
+			measureDocument := &coredata.MeasureDocument{}
+			if err := measureDocument.Delete(ctx, tx, s.svc.scope, measure.ID, document.ID); err != nil {
+				return fmt.Errorf("cannot delete measure document mapping: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return measure, document, nil
+}
--- a/pkg/server/api/console/v1/schema.graphql
+++ b/pkg/server/api/console/v1/schema.graphql
@@ -2492,6 +2492,15 @@ type Measure implements Node {
        filter: ControlFilter
    ): ControlConnection! @goField(forceResolver: true)

+    documents(
+        first: Int
+        after: CursorKey
+        last: Int
+        before: CursorKey
+        orderBy: DocumentOrder
+        filter: DocumentFilter
+    ): DocumentConnection! @goField(forceResolver: true)
+
    createdAt: Datetime!
    updatedAt: Datetime!

@@ -3830,6 +3839,12 @@ type Mutation {
    deleteRiskDocumentMapping(
        input: DeleteRiskDocumentMappingInput!
    ): DeleteRiskDocumentMappingPayload!
+    createMeasureDocumentMapping(
+        input: CreateMeasureDocumentMappingInput!
+    ): CreateMeasureDocumentMappingPayload!
+    deleteMeasureDocumentMapping(
+        input: DeleteMeasureDocumentMappingInput!
+    ): DeleteMeasureDocumentMappingPayload!
    createRiskObligationMapping(
        input: CreateRiskObligationMappingInput!
    ): CreateRiskObligationMappingPayload!
@@ -4571,6 +4586,16 @@ input DeleteRiskDocumentMappingInput {
    documentId: ID!
 }

+input CreateMeasureDocumentMappingInput {
+    measureId: ID!
+    documentId: ID!
+}
+
+input DeleteMeasureDocumentMappingInput {
+    measureId: ID!
+    documentId: ID!
+}
+
 input CreateRiskObligationMappingInput {
    riskId: ID!
    obligationId: ID!
@@ -5331,6 +5356,16 @@ type DeleteRiskDocumentMappingPayload {
    deletedDocumentId: ID!
 }

+type CreateMeasureDocumentMappingPayload {
+    measureEdge: MeasureEdge!
+    documentEdge: DocumentEdge!
+}
+
+type DeleteMeasureDocumentMappingPayload {
+    deletedMeasureId: ID!
+    deletedDocumentId: ID!
+}
+
 type CreateRiskObligationMappingPayload {
    riskEdge: RiskEdge!
    obligationEdge: ObligationEdge!
--- a/pkg/server/api/console/v1/v1_resolver.go
+++ b/pkg/server/api/console/v1/v1_resolver.go
@@ -1601,6 +1601,13 @@ func (r *documentConnectionResolver) TotalCount(ctx context.Context, obj *types.
 			return 0, gqlutils.Internal(ctx)
 		}
 		return count, nil
+	case *measureResolver:
+		count, err := prb.Documents.CountForMeasureID(ctx, obj.ParentID, obj.Filters)
+		if err != nil {
+			r.logger.ErrorCtx(ctx, "cannot count documents", log.Error(err))
+			return 0, gqlutils.Internal(ctx)
+		}
+		return count, nil
 	}

 	r.logger.ErrorCtx(ctx, "unsupported resolver")
@@ -2811,6 +2818,43 @@ func (r *measureResolver) Controls(ctx context.Context, obj *types.Measure, firs
 	return types.NewControlConnection(page, r, obj.ID, controlFilter), nil
 }

+// Documents is the resolver for the documents field.
+func (r *measureResolver) Documents(ctx context.Context, obj *types.Measure, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentOrderBy, filter *types.DocumentFilter) (*types.DocumentConnection, error) {
+	if err := r.authorize(ctx, obj.ID, probo.ActionDocumentList); err != nil {
+		return nil, err
+	}
+
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	pageOrderBy := page.OrderBy[coredata.DocumentOrderField]{
+		Field:     coredata.DocumentOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.DocumentOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	var documentFilter = coredata.NewDocumentFilter(nil)
+	if filter != nil {
+		documentFilter = coredata.NewDocumentFilter(filter.Query).
+			WithDocumentTypes(filter.DocumentTypes).
+			WithClassifications(filter.Classifications)
+	}
+
+	pg, err := prb.Documents.ListForMeasureID(ctx, obj.ID, cursor, documentFilter)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot list documents", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewDocumentConnection(pg, r, obj.ID, documentFilter), nil
+}
+
 // Permission is the resolver for the permission field.
 func (r *measureResolver) Permission(ctx context.Context, obj *types.Measure, action string) (bool, error) {
 	return r.Resolver.Permission(ctx, obj, action)
@@ -4826,6 +4870,50 @@ func (r *mutationResolver) DeleteRiskDocumentMapping(ctx context.Context, input
 	}, nil
 }

+// CreateMeasureDocumentMapping is the resolver for the createMeasureDocumentMapping field.
+func (r *mutationResolver) CreateMeasureDocumentMapping(ctx context.Context, input types.CreateMeasureDocumentMappingInput) (*types.CreateMeasureDocumentMappingPayload, error) {
+	if err := r.authorize(ctx, input.MeasureID, probo.ActionMeasureDocumentMappingCreate); err != nil {
+		return nil, err
+	}
+
+	prb := r.ProboService(ctx, input.MeasureID.TenantID())
+
+	measure, document, err := prb.Measures.CreateDocumentMapping(ctx, input.MeasureID, input.DocumentID)
+	if err != nil {
+		if errors.Is(err, coredata.ErrResourceAlreadyExists) {
+			return nil, gqlutils.Conflict(ctx, err)
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot create measure document mapping", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return &types.CreateMeasureDocumentMappingPayload{
+		MeasureEdge:  types.NewMeasureEdge(measure, coredata.MeasureOrderFieldCreatedAt),
+		DocumentEdge: types.NewDocumentEdge(document, coredata.DocumentOrderFieldTitle),
+	}, nil
+}
+
+// DeleteMeasureDocumentMapping is the resolver for the deleteMeasureDocumentMapping field.
+func (r *mutationResolver) DeleteMeasureDocumentMapping(ctx context.Context, input types.DeleteMeasureDocumentMappingInput) (*types.DeleteMeasureDocumentMappingPayload, error) {
+	if err := r.authorize(ctx, input.MeasureID, probo.ActionMeasureDocumentMappingDelete); err != nil {
+		return nil, err
+	}
+
+	prb := r.ProboService(ctx, input.MeasureID.TenantID())
+
+	measure, document, err := prb.Measures.DeleteDocumentMapping(ctx, input.MeasureID, input.DocumentID)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot delete measure document mapping", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return &types.DeleteMeasureDocumentMappingPayload{
+		DeletedMeasureID:  measure.ID,
+		DeletedDocumentID: document.ID,
+	}, nil
+}
+
 // CreateRiskObligationMapping is the resolver for the createRiskObligationMapping field.
 func (r *mutationResolver) CreateRiskObligationMapping(ctx context.Context, input types.CreateRiskObligationMappingInput) (*types.CreateRiskObligationMappingPayload, error) {
 	if err := r.authorize(ctx, input.RiskID, probo.ActionRiskObligationMappingCreate); err != nil {
--- a/pkg/server/api/mcp/v1/schema.resolvers.go
+++ b/pkg/server/api/mcp/v1/schema.resolvers.go
@@ -2597,6 +2597,11 @@ func (r *Resolver) LinkMeasureTool(ctx context.Context, req *mcp.CallToolRequest
 		if _, _, err := svc.Risks.CreateMeasureMapping(ctx, input.ResourceID, input.MeasureID); err != nil {
 			return nil, types.LinkMeasureOutput{}, fmt.Errorf("failed to link measure to risk: %w", err)
 		}
+	case coredata.DocumentEntityType:
+		r.MustAuthorize(ctx, input.MeasureID, probo.ActionMeasureDocumentMappingCreate)
+		if _, _, err := svc.Measures.CreateDocumentMapping(ctx, input.MeasureID, input.ResourceID); err != nil {
+			return nil, types.LinkMeasureOutput{}, fmt.Errorf("failed to link measure to document: %w", err)
+		}
 	default:
 		return nil, types.LinkMeasureOutput{}, fmt.Errorf("unsupported resource type for measure linking: entity type %d", input.ResourceID.EntityType())
 	}
@@ -2618,6 +2623,11 @@ func (r *Resolver) UnlinkMeasureTool(ctx context.Context, req *mcp.CallToolReque
 		if _, _, err := svc.Risks.DeleteMeasureMapping(ctx, input.ResourceID, input.MeasureID); err != nil {
 			return nil, types.UnlinkMeasureOutput{}, fmt.Errorf("failed to unlink measure from risk: %w", err)
 		}
+	case coredata.DocumentEntityType:
+		r.MustAuthorize(ctx, input.MeasureID, probo.ActionMeasureDocumentMappingDelete)
+		if _, _, err := svc.Measures.DeleteDocumentMapping(ctx, input.MeasureID, input.ResourceID); err != nil {
+			return nil, types.UnlinkMeasureOutput{}, fmt.Errorf("failed to unlink measure from document: %w", err)
+		}
 	default:
 		return nil, types.UnlinkMeasureOutput{}, fmt.Errorf("unsupported resource type for measure unlinking: entity type %d", input.ResourceID.EntityType())
 	}
@@ -3873,3 +3883,29 @@ func (r *Resolver) PublishMinorDocumentVersionTool(ctx context.Context, req *mcp
 		DocumentVersion: types.NewDocumentVersion(documentVersion),
 	}, nil
 }
+
+func (r *Resolver) ListMeasureDocumentsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListMeasureDocumentsInput) (*mcp.CallToolResult, types.ListMeasureDocumentsOutput, error) {
+	r.MustAuthorize(ctx, input.MeasureID, probo.ActionMeasureGet)
+
+	prb := r.ProboService(ctx, input.MeasureID)
+
+	pageOrderBy := page.OrderBy[coredata.DocumentOrderField]{
+		Field:     coredata.DocumentOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if input.OrderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.DocumentOrderField]{
+			Field:     input.OrderBy.Field,
+			Direction: input.OrderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)
+
+	docPage, err := prb.Documents.ListForMeasureID(ctx, input.MeasureID, cursor, coredata.NewDocumentFilter(nil))
+	if err != nil {
+		return nil, types.ListMeasureDocumentsOutput{}, fmt.Errorf("failed to list measure documents: %w", err)
+	}
+
+	return nil, types.NewListMeasureDocumentsOutput(docPage), nil
+}
--- a/pkg/server/api/mcp/v1/specification.yaml
+++ b/pkg/server/api/mcp/v1/specification.yaml
@@ -1515,6 +1515,37 @@ components:
          items:
            $ref: "#/components/schemas/Control"

+    ListMeasureDocumentsInput:
+      type: object
+      required:
+        - measure_id
+      properties:
+        measure_id:
+          $ref: "#/components/schemas/GID"
+          description: Measure ID
+        cursor:
+          $ref: "#/components/schemas/CursorKey"
+          description: Page cursor
+        size:
+          type: integer
+          description: Page size
+        order_by:
+          $ref: "#/components/schemas/DocumentOrderBy"
+          description: Document order by
+
+    ListMeasureDocumentsOutput:
+      type: object
+      required:
+        - documents
+      properties:
+        next_cursor:
+          $ref: "#/components/schemas/CursorKey"
+          description: Next cursor
+        documents:
+          type: array
+          items:
+            $ref: "#/components/schemas/Document"
+
    ListMeasureTasksInput:
      type: object
      required:
@@ -1639,7 +1670,7 @@ components:
          description: Measure ID
        resource_id:
          $ref: "#/components/schemas/GID"
-          description: ID of the resource to link (control or risk)
+          description: ID of the resource to link (control, risk, or document)

    LinkMeasureOutput:
      type: object
@@ -1655,7 +1686,7 @@ components:
          description: Measure ID
        resource_id:
          $ref: "#/components/schemas/GID"
-          description: ID of the resource to unlink (control or risk)
+          description: ID of the resource to unlink (control, risk, or document)

    UnlinkMeasureOutput:
      type: object
@@ -7669,7 +7700,7 @@ tools:
    outputSchema:
      $ref: "#/components/schemas/ListMeasureEvidencesOutput"
  - name: linkMeasure
-    description: Link a measure to a resource (control or risk). The resource type is determined from the resource_id GID.
+    description: Link a measure to a resource (control, risk, or document). The resource type is determined from the resource_id GID.
    hints:
      readonly: false
    inputSchema:
@@ -7677,13 +7708,22 @@ tools:
    outputSchema:
      $ref: "#/components/schemas/LinkMeasureOutput"
  - name: unlinkMeasure
-    description: Unlink a measure from a resource (control or risk). The resource type is determined from the resource_id GID.
+    description: Unlink a measure from a resource (control, risk, or document). The resource type is determined from the resource_id GID.
    hints:
      readonly: false
    inputSchema:
      $ref: "#/components/schemas/UnlinkMeasureInput"
    outputSchema:
      $ref: "#/components/schemas/UnlinkMeasureOutput"
+  - name: listMeasureDocuments
+    description: List documents linked to a measure
+    hints:
+      readonly: true
+      idempotent: true
+    inputSchema:
+      $ref: "#/components/schemas/ListMeasureDocumentsInput"
+    outputSchema:
+      $ref: "#/components/schemas/ListMeasureDocumentsOutput"
  - name: listFrameworks
    description: List all frameworks for the organization
    hints:
--- a/pkg/server/api/mcp/v1/types/document.go
+++ b/pkg/server/api/mcp/v1/types/document.go
@@ -52,6 +52,24 @@ func NewListControlDocumentsOutput(documentPage *page.Page[*coredata.Document, c
 	}
 }

+func NewListMeasureDocumentsOutput(documentPage *page.Page[*coredata.Document, coredata.DocumentOrderField]) ListMeasureDocumentsOutput {
+	documents := make([]*Document, 0, len(documentPage.Data))
+	for _, d := range documentPage.Data {
+		documents = append(documents, NewDocument(d))
+	}
+
+	var nextCursor *page.CursorKey
+	if len(documentPage.Data) > 0 {
+		cursorKey := documentPage.Data[len(documentPage.Data)-1].CursorKey(documentPage.Cursor.OrderBy.Field)
+		nextCursor = &cursorKey
+	}
+
+	return ListMeasureDocumentsOutput{
+		NextCursor: nextCursor,
+		Documents:  documents,
+	}
+}
+
 func NewListDocumentsOutput(documentPage *page.Page[*coredata.Document, coredata.DocumentOrderField]) ListDocumentsOutput {
 	documents := make([]*Document, 0, len(documentPage.Data))
 	for _, d := range documentPage.Data {