rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add first risk assememnt implementation

Browse Source 
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
This commit is contained in:
Bryan Frimin
2025-04-21 12:49:58 -07:00
parent f403d5ad9e
commit f038642ece
22 changed files with 3168 additions and 654 deletions
Download Patch File Download Diff File Expand all files Collapse all files

60
pkg/coredata/business_impact.go Normal file
View File

@@ -0,0 +1,60 @@
// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package coredata
import (
"database/sql/driver"
"fmt"
)
func (bi BusinessImpact) MarshalText() ([]byte, error) {
return []byte(bi.String()), nil
}
func (bi *BusinessImpact) UnmarshalText(data []byte) error {
val := string(data)
switch val {
case BusinessImpactLow.String():
*bi = BusinessImpactLow
case BusinessImpactMedium.String():
*bi = BusinessImpactMedium
case BusinessImpactHigh.String():
*bi = BusinessImpactHigh
case BusinessImpactCritical.String():
*bi = BusinessImpactCritical
default:
return fmt.Errorf("invalid BusinessImpact value: %q", val)
}
return nil
}
func (bi BusinessImpact) String() string {
return string(bi)
}
func (bi *BusinessImpact) Scan(value any) error {
val, ok := value.(string)
if !ok {
return fmt.Errorf("invalid scan source for BusinessImpact, expected string got %T", value)
}
return bi.UnmarshalText([]byte(val))
}
func (bi BusinessImpact) Value() (driver.Value, error) {
return bi.String(), nil
}

62
pkg/coredata/data_sensitivity.go Normal file
View File

@@ -0,0 +1,62 @@
// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package coredata
import (
"database/sql/driver"
"fmt"
)
func (ds DataSensitivity) MarshalText() ([]byte, error) {
return []byte(ds.String()), nil
}
func (ds *DataSensitivity) UnmarshalText(data []byte) error {
val := string(data)
switch val {
case DataSensitivityNone.String():
*ds = DataSensitivityNone
case DataSensitivityLow.String():
*ds = DataSensitivityLow
case DataSensitivityMedium.String():
*ds = DataSensitivityMedium
case DataSensitivityHigh.String():
*ds = DataSensitivityHigh
case DataSensitivityCritical.String():
*ds = DataSensitivityCritical
default:
return fmt.Errorf("invalid DataSensitivity value: %q", val)
}
return nil
}
func (ds DataSensitivity) String() string {
return string(ds)
}
func (ds *DataSensitivity) Scan(value any) error {
val, ok := value.(string)
if !ok {
return fmt.Errorf("invalid scan source for DataSensitivity, expected string got %T", value)
}
return ds.UnmarshalText([]byte(val))
}
func (ds DataSensitivity) Value() (driver.Value, error) {
return ds.String(), nil
}

2
pkg/coredata/entity_type_reg.go
View File

@@ -21,7 +21,7 @@ const (
TaskEntityType
EvidenceEntityType
ConnectorEntityType
_TaskStateTransitionEntityType // UNUSED
VendorRiskAssessmentEntityType
VendorEntityType
PeopleEntityType
VendorComplianceReportEntityType

1
pkg/coredata/migrations/20240421T032700Z.sql Normal file
View File

@@ -0,0 +1 @@
ALTER TABLE peoples DROP COLUMN version;

305
pkg/coredata/migrations/20250420T120000Z.sql Normal file
View File

@@ -0,0 +1,305 @@
CREATE EXTENSION IF NOT EXISTS pgcrypto;
-- PostgreSQL implementation of the GID generation system
-- 1. First, create functions for TenantID generation
CREATE OR REPLACE FUNCTION generate_machine_id()
RETURNS bytea AS $func$
DECLARE
machine_id bytea;
BEGIN
-- Generate 3 random bytes for machine ID
machine_id := decode(encode(gen_random_bytes(3), 'hex'), 'hex');
RETURN machine_id;
END;
$func$ LANGUAGE plpgsql STABLE;
-- Store machine ID as a database-wide setting (run once)
DO $block$
BEGIN
-- Check if the setting exists
IF NOT EXISTS (SELECT 1 FROM pg_settings WHERE name = 'app.machine_id') THEN
-- Create custom parameter in postgresql.conf or via ALTER SYSTEM
PERFORM set_config('app.machine_id', encode(generate_machine_id(), 'hex'), false);
END IF;
END $block$;
-- Counter for tenant ID generation (used atomically)
CREATE SEQUENCE IF NOT EXISTS tenant_id_counter_seq;
-- Function to generate a TenantID
CREATE OR REPLACE FUNCTION generate_tenant_id()
RETURNS bytea AS $func$
DECLARE
id bytea;
machine_id bytea;
timestamp_bytes bytea;
counter_bytes bytea;
counter_val int;
BEGIN
-- 1. Get machine ID (3 bytes)
machine_id := decode(current_setting('app.machine_id'), 'hex');
-- 2. Get timestamp bytes (3 bytes - Unix time in seconds)
timestamp_bytes := substring(int8send(extract(epoch from now())::bigint) from 6 for 3);
-- 3. Get counter (2 bytes)
counter_val := nextval('tenant_id_counter_seq') % 65536; -- 2^16
counter_bytes := substring(int4send(counter_val) from 3 for 2);
-- 4. Combine all parts
id := machine_id || timestamp_bytes || counter_bytes;
RETURN id;
END;
$func$ LANGUAGE plpgsql VOLATILE;
-- Function to convert TenantID to string
CREATE OR REPLACE FUNCTION tenant_id_to_string(tenant_id bytea)
RETURNS text AS $func$
BEGIN
-- Make sure to handle padding properly - remove trailing '=' characters
RETURN rtrim(translate(encode(tenant_id, 'base64'), '+/', '-_'), '=');
END;
$func$ LANGUAGE plpgsql IMMUTABLE;
-- Function to parse tenant ID from string
CREATE OR REPLACE FUNCTION parse_tenant_id(encoded text)
RETURNS bytea AS $func$
DECLARE
decoded bytea;
padded_input text;
padding_needed int;
BEGIN
-- Add proper padding for base64 decoding
padding_needed := (4 - (length(encoded) % 4)) % 4;
padded_input := encoded || repeat('=', padding_needed);
-- Replace URL-safe chars and decode
BEGIN
decoded := decode(translate(padded_input, '-_', '+/'), 'base64');
EXCEPTION WHEN OTHERS THEN
RAISE EXCEPTION 'Invalid base64 encoding in tenant ID';
END;
-- Validate length
IF octet_length(decoded) != 8 THEN
RAISE EXCEPTION 'Invalid tenant ID length: got %, want 8', octet_length(decoded);
END IF;
RETURN decoded;
END;
$func$ LANGUAGE plpgsql IMMUTABLE;
-- 2. Now create functions for full GID generation
-- Function to generate a GID
CREATE OR REPLACE FUNCTION generate_gid(tenant_id bytea, entity_type int)
RETURNS bytea AS $func$
DECLARE
id bytea;
timestamp_ms_bytes bytea;
entity_type_bytes bytea;
random_bytes bytea;
BEGIN
-- Validate tenant_id
IF tenant_id IS NULL OR octet_length(tenant_id) != 8 THEN
RAISE EXCEPTION 'Invalid tenant ID: must be 8 bytes';
END IF;
-- 1. Start with tenant ID (8 bytes)
id := tenant_id;
-- 2. Add entity type (2 bytes)
entity_type_bytes := substring(int4send(entity_type) from 3 for 2);
id := id || entity_type_bytes;
-- 3. Add timestamp in milliseconds (8 bytes)
-- Extract milliseconds since epoch
timestamp_ms_bytes := int8send(
(extract(epoch from now()) * 1000)::bigint
);
id := id || timestamp_ms_bytes;
-- 4. Add random bytes for uniqueness (6 bytes)
random_bytes := gen_random_bytes(6);
id := id || random_bytes;
RETURN id;
END;
$func$ LANGUAGE plpgsql VOLATILE;
-- Note: removed the single-parameter overload - tenant_id must be explicitly provided
-- Function to convert GID to string
CREATE OR REPLACE FUNCTION gid_to_string(gid bytea)
RETURNS text AS $func$
BEGIN
-- Make sure to handle padding properly - remove trailing '=' characters
RETURN rtrim(translate(encode(gid, 'base64'), '+/', '-_'), '=');
END;
$func$ LANGUAGE plpgsql IMMUTABLE;
-- Function to parse GID from string
CREATE OR REPLACE FUNCTION parse_gid(encoded text)
RETURNS bytea AS $func$
DECLARE
decoded bytea;
padded_input text;
padding_needed int;
BEGIN
-- Add proper padding for base64 decoding
padding_needed := (4 - (length(encoded) % 4)) % 4;
padded_input := encoded || repeat('=', padding_needed);
-- Replace URL-safe chars and decode
BEGIN
decoded := decode(translate(padded_input, '-_', '+/'), 'base64');
EXCEPTION WHEN OTHERS THEN
RAISE EXCEPTION 'Invalid base64 encoding in GID';
END;
-- Validate length
IF octet_length(decoded) != 24 THEN
RAISE EXCEPTION 'Invalid GID length: got %, want 24', octet_length(decoded);
END IF;
RETURN decoded;
END;
$func$ LANGUAGE plpgsql IMMUTABLE;
-- Extract tenant ID from GID
CREATE OR REPLACE FUNCTION extract_tenant_id(gid bytea)
RETURNS bytea AS $func$
BEGIN
RETURN substring(gid from 1 for 8);
END;
$func$ LANGUAGE plpgsql IMMUTABLE;
-- Extract entity type from GID
CREATE OR REPLACE FUNCTION extract_entity_type(gid bytea)
RETURNS int AS $func$
BEGIN
RETURN get_byte(gid, 8) * 256 + get_byte(gid, 9);
END;
$func$ LANGUAGE plpgsql IMMUTABLE;
-- Extract timestamp from GID
CREATE OR REPLACE FUNCTION extract_timestamp(gid bytea)
RETURNS timestamp AS $func$
DECLARE
ms bigint;
BEGIN
ms := (get_byte(gid, 10)::bigint << 56) |
(get_byte(gid, 11)::bigint << 48) |
(get_byte(gid, 12)::bigint << 40) |
(get_byte(gid, 13)::bigint << 32) |
(get_byte(gid, 14)::bigint << 24) |
(get_byte(gid, 15)::bigint << 16) |
(get_byte(gid, 16)::bigint << 8) |
get_byte(gid, 17)::bigint;
RETURN to_timestamp(ms / 1000.0);
END;
$func$ LANGUAGE plpgsql IMMUTABLE;
-- Example usage:
-- Generate a new GID for entity type 42 with a specific tenant ID
-- SELECT gid_to_string(generate_gid(generate_tenant_id(), 42));
-- Parse a GID from string
-- SELECT parse_gid('your-base64-encoded-gid-here');
-- Extract components
-- SELECT
-- gid_to_string(gid) as gid_string,
-- tenant_id_to_string(extract_tenant_id(gid)) as tenant_id,
-- extract_entity_type(gid) as entity_type,
-- extract_timestamp(gid) as created_at
-- FROM (SELECT generate_gid(generate_tenant_id(), 42) as gid) t;
CREATE OR REPLACE FUNCTION decode_base64_unpadded(input_text text)
RETURNS bytea AS $$
DECLARE
padded_text text;
mod_length integer;
BEGIN
-- Calculate how many padding characters we need to add
mod_length := length(input_text) % 4;
-- Add the required padding
IF mod_length = 0 THEN
padded_text := input_text;
ELSIF mod_length = 1 THEN
-- Invalid base64 - length mod 4 can't be 1
RAISE EXCEPTION 'Invalid base64 length';
ELSIF mod_length = 2 THEN
padded_text := input_text || '==';
ELSIF mod_length = 3 THEN
padded_text := input_text || '=';
END IF;
-- Decode the padded base64
RETURN decode(padded_text, 'base64');
END;
$$ LANGUAGE plpgsql;
CREATE TYPE data_sensitivity AS ENUM ('NONE', 'LOW', 'MEDIUM', 'HIGH', 'CRITICAL');
CREATE TYPE business_impact AS ENUM ('LOW', 'MEDIUM', 'HIGH', 'CRITICAL');
CREATE TABLE risk_assessments (
tenant_id TEXT NOT NULL,
id TEXT PRIMARY KEY,
vendor_id TEXT NOT NULL REFERENCES vendors(id) ON DELETE CASCADE,
accessed_at TIMESTAMP WITH TIME ZONE NOT NULL,
accessed_by TEXT NOT NULL REFERENCES peoples(id) ON DELETE SET NULL,
approved_at TIMESTAMP WITH TIME ZONE NOT NULL,
approved_by TEXT NOT NULL REFERENCES peoples(id) ON DELETE SET NULL,
expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
data_sensitivity data_sensitivity NOT NULL,
business_impact business_impact NOT NULL,
notes TEXT,
created_at TIMESTAMP WITH TIME ZONE NOT NULL,
updated_at TIMESTAMP WITH TIME ZONE NOT NULL
);
ALTER TABLE peoples ADD COLUMN user_id TEXT NOT NULL REFERENCES users(id) ON DELETE SET NULL;
UPDATE peoples p
SET user_id = u.id
FROM users u
WHERE u.email_address = p.primary_email_address;
INSERT INTO peoples (
tenant_id,
id,
organization_id,
full_name,
primary_email_address,
kind,
user_id,
additional_email_addresses,
created_at,
updated_at,
version
)
SELECT
o.tenant_id,
encode(generate_gid(decode_base64_unpadded(o.tenant_id), 8), 'base64'),
o.id,
u.fullname,
u.email_address,
'CONTRACTOR',
u.id,
ARRAY[]::TEXT[],
NOW(),
NOW(),
1
FROM users u
JOIN users_organizations uo ON u.id = uo.user_id
JOIN organizations o ON uo.organization_id = o.id
LEFT JOIN peoples p ON u.email_address = p.primary_email_address
WHERE p.id IS NULL;

3
pkg/coredata/migrations/20250420T120001Z.sql Normal file
View File

@@ -0,0 +1,3 @@
ALTER TABLE vendors
DROP COLUMN service_criticality,
DROP COLUMN risk_tier;

1
pkg/coredata/migrations/20250421T032000Z.sql Normal file
View File

@@ -0,0 +1 @@
ALTER TABLE peoples ALTER COLUMN user_id DROP NOT NULL;

88
pkg/coredata/people.go
View File

@@ -31,23 +31,15 @@ type (
ID gid.GID `db:"id"`
OrganizationID gid.GID `db:"organization_id"`
Kind PeopleKind `db:"kind"`
UserID *gid.GID `db:"user_id"`
FullName string `db:"full_name"`
PrimaryEmailAddress string `db:"primary_email_address"`
AdditionalEmailAddresses []string `db:"additional_email_addresses"`
CreatedAt time.Time `db:"created_at"`
UpdatedAt time.Time `db:"updated_at"`
Version int `db:"version"`
}
Peoples []*People
UpdatePeopleParams struct {
ExpectedVersion int
FullName *string
PrimaryEmailAddress *string
AdditionalEmailAddresses *[]string
Kind *PeopleKind
}
)
func (p People) CursorKey(orderBy PeopleOrderField) page.CursorKey {
@@ -72,12 +64,12 @@ SELECT
id,
organization_id,
kind,
user_id,
full_name,
primary_email_address,
additional_email_addresses,
created_at,
updated_at,
version
updated_at
FROM
peoples
WHERE
@@ -117,25 +109,25 @@ INSERT INTO
tenant_id,
id,
organization_id,
user_id,
kind,
full_name,
primary_email_address,
additional_email_addresses,
created_at,
updated_at,
version
updated_at
)
VALUES (
@tenant_id,
@people_id,
@organization_id,
@user_id,
@kind,
@full_name,
@primary_email_address,
@additional_email_addresses,
@created_at,
@updated_at,
@version
@updated_at
)
`
@@ -143,13 +135,13 @@ VALUES (
"tenant_id": scope.GetTenantID(),
"people_id": p.ID,
"organization_id": p.OrganizationID,
"user_id": p.UserID,
"kind": p.Kind,
"full_name": p.FullName,
"primary_email_address": p.PrimaryEmailAddress,
"additional_email_addresses": p.AdditionalEmailAddresses,
"created_at": p.CreatedAt,
"updated_at": p.UpdatedAt,
"version": p.Version,
}
_, err := conn.Exec(ctx, q, args)
return err
@@ -180,18 +172,17 @@ func (p *Peoples) LoadByOrganizationID(
organizationID gid.GID,
cursor *page.Cursor[PeopleOrderField],
) error {
// Base query
q := `
SELECT
id,
organization_id,
kind,
user_id,
full_name,
primary_email_address,
additional_email_addresses,
created_at,
updated_at,
version
updated_at
FROM
peoples
WHERE
@@ -225,64 +216,35 @@ func (p *People) Update(
ctx context.Context,
conn pg.Conn,
scope Scoper,
params UpdatePeopleParams,
) error {
q := `
UPDATE peoples SET
full_name = COALESCE(@full_name, full_name),
primary_email_address = COALESCE(@primary_email_address, primary_email_address),
additional_email_addresses = COALESCE(@additional_email_addresses, additional_email_addresses),
kind = COALESCE(@kind, kind),
updated_at = @updated_at,
version = version + 1
user_id = @user_id,
full_name = @full_name,
primary_email_address = @primary_email_address,
additional_email_addresses = @additional_email_addresses,
kind = @kind,
updated_at = @updated_at
WHERE %s
AND id = @people_id
AND version = @expected_version
RETURNING
id,
organization_id,
kind,
full_name,
primary_email_address,
additional_email_addresses,
created_at,
updated_at,
version
`
q = fmt.Sprintf(q, scope.SQLFragment())
args := pgx.StrictNamedArgs{
"people_id": p.ID,
"expected_version": params.ExpectedVersion,
"updated_at": time.Now(),
"people_id": p.ID,
"user_id": p.UserID,
"full_name": p.FullName,
"primary_email_address": p.PrimaryEmailAddress,
"additional_email_addresses": p.AdditionalEmailAddresses,
"kind": p.Kind,
"updated_at": p.UpdatedAt,
}
if params.FullName != nil {
args["full_name"] = *params.FullName
}
if params.PrimaryEmailAddress != nil {
args["primary_email_address"] = *params.PrimaryEmailAddress
}
if params.AdditionalEmailAddresses != nil {
args["additional_email_addresses"] = *params.AdditionalEmailAddresses
}
if params.Kind != nil {
args["kind"] = *params.Kind
}
maps.Copy(args, scope.SQLArguments())
rows, err := conn.Query(ctx, q, args)
_, err := conn.Exec(ctx, q, args)
if err != nil {
return fmt.Errorf("cannot query people: %w", err)
return fmt.Errorf("cannot update people: %w", err)
}
people, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[People])
if err != nil {
return fmt.Errorf("cannot collect people: %w", err)
}
*p = people
return nil
}

66
pkg/coredata/risk_tier.go
View File

@@ -1,66 +0,0 @@
// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package coredata
import (
"database/sql/driver"
"fmt"
)
type RiskTier string
const (
RiskTierCritical RiskTier = "CRITICAL" // Handles sensitive data, critical for platform operation
RiskTierSignificant RiskTier = "SIGNIFICANT" // No user data access, but important for platform management
RiskTierGeneral RiskTier = "GENERAL" // General vendor with minimal risk
)
func (rt RiskTier) MarshalText() ([]byte, error) {
return []byte(rt.String()), nil
}
func (rt *RiskTier) UnmarshalText(data []byte) error {
val := string(data)
switch val {
case RiskTierCritical.String():
*rt = RiskTierCritical
case RiskTierSignificant.String():
*rt = RiskTierSignificant
case RiskTierGeneral.String():
*rt = RiskTierGeneral
default:
return fmt.Errorf("invalid RiskTier value: %q", val)
}
return nil
}
func (rt RiskTier) String() string {
return string(rt)
}
func (rt *RiskTier) Scan(value any) error {
val, ok := value.(string)
if !ok {
return fmt.Errorf("invalid scan source for RiskTier, expected string got %T", value)
}
return rt.UnmarshalText([]byte(val))
}
func (rt RiskTier) Value() (driver.Value, error) {
return rt.String(), nil
}

66
pkg/coredata/service_criticality.go
View File

@@ -1,66 +0,0 @@
// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package coredata
import (
"database/sql/driver"
"fmt"
)
type ServiceCriticality string
const (
ServiceCriticalityLow ServiceCriticality = "LOW"
ServiceCriticalityMedium ServiceCriticality = "MEDIUM"
ServiceCriticalityHigh ServiceCriticality = "HIGH"
)
func (sc ServiceCriticality) MarshalText() ([]byte, error) {
return []byte(sc.String()), nil
}
func (sc *ServiceCriticality) UnmarshalText(data []byte) error {
val := string(data)
switch val {
case ServiceCriticalityLow.String():
*sc = ServiceCriticalityLow
case ServiceCriticalityMedium.String():
*sc = ServiceCriticalityMedium
case ServiceCriticalityHigh.String():
*sc = ServiceCriticalityHigh
default:
return fmt.Errorf("invalid ServiceCriticality value: %q", val)
}
return nil
}
func (sc ServiceCriticality) String() string {
return string(sc)
}
func (sc *ServiceCriticality) Scan(value any) error {
val, ok := value.(string)
if !ok {
return fmt.Errorf("invalid scan source for ServiceCriticality, expected string got %T", value)
}
return sc.UnmarshalText([]byte(val))
}
func (sc ServiceCriticality) Value() (driver.Value, error) {
return sc.String(), nil
}

75
pkg/coredata/vendor.go
View File

@@ -16,7 +16,6 @@ package coredata
import (
"context"
"errors"
"fmt"
"maps"
"time"
@@ -27,34 +26,30 @@ import (
"go.gearno.de/kit/pg"
)
var ErrConcurrentModification = errors.New("concurrent modification")
type (
Vendor struct {
ID gid.GID `db:"id"`
OrganizationID gid.GID `db:"organization_id"`
Name string `db:"name"`
Description *string `db:"description"`
Category string `db:"category"`
ServiceStartAt time.Time `db:"service_start_at"`
ServiceTerminationAt *time.Time `db:"service_termination_at"`
HeadquarterAddress *string `db:"headquarter_address"`
LegalName *string `db:"legal_name"`
WebsiteURL *string `db:"website_url"`
PrivacyPolicyURL *string `db:"privacy_policy_url"`
ServiceLevelAgreementURL *string `db:"service_level_agreement_url"`
DataProcessingAgreementURL *string `db:"data_processing_agreement_url"`
Certifications []string `db:"certifications"`
ServiceCriticality ServiceCriticality `db:"service_criticality"`
RiskTier RiskTier `db:"risk_tier"`
BusinessOwnerID *gid.GID `db:"business_owner_id"`
SecurityOwnerID *gid.GID `db:"security_owner_id"`
StatusPageURL *string `db:"status_page_url"`
TermsOfServiceURL *string `db:"terms_of_service_url"`
SecurityPageURL *string `db:"security_page_url"`
TrustPageURL *string `db:"trust_page_url"`
CreatedAt time.Time `db:"created_at"`
UpdatedAt time.Time `db:"updated_at"`
ID gid.GID `db:"id"`
OrganizationID gid.GID `db:"organization_id"`
Name string `db:"name"`
Description *string `db:"description"`
Category string `db:"category"`
ServiceStartAt time.Time `db:"service_start_at"`
ServiceTerminationAt *time.Time `db:"service_termination_at"`
HeadquarterAddress *string `db:"headquarter_address"`
LegalName *string `db:"legal_name"`
WebsiteURL *string `db:"website_url"`
PrivacyPolicyURL *string `db:"privacy_policy_url"`
ServiceLevelAgreementURL *string `db:"service_level_agreement_url"`
DataProcessingAgreementURL *string `db:"data_processing_agreement_url"`
Certifications []string `db:"certifications"`
BusinessOwnerID *gid.GID `db:"business_owner_id"`
SecurityOwnerID *gid.GID `db:"security_owner_id"`
StatusPageURL *string `db:"status_page_url"`
TermsOfServiceURL *string `db:"terms_of_service_url"`
SecurityPageURL *string `db:"security_page_url"`
TrustPageURL *string `db:"trust_page_url"`
CreatedAt time.Time `db:"created_at"`
UpdatedAt time.Time `db:"updated_at"`
}
Vendors []*Vendor
@@ -93,10 +88,8 @@ SELECT
service_level_agreement_url,
data_processing_agreement_url,
certifications,
service_criticality,
risk_tier,
business_owner_id,
security_owner_id,
business_owner_id,
security_owner_id,
status_page_url,
terms_of_service_url,
security_page_url,
@@ -155,10 +148,8 @@ INSERT INTO
certifications,
service_start_at,
service_termination_at,
service_criticality,
risk_tier,
business_owner_id,
security_owner_id,
security_owner_id,
status_page_url,
terms_of_service_url,
security_page_url,
@@ -182,10 +173,8 @@ VALUES (
@certifications,
@service_start_at,
@service_termination_at,
@service_criticality,
@risk_tier,
@business_owner_id,
@security_owner_id,
@security_owner_id,
@status_page_url,
@terms_of_service_url,
@security_page_url,
@@ -211,8 +200,6 @@ VALUES (
"certifications": v.Certifications,
"service_start_at": v.ServiceStartAt,
"service_termination_at": v.ServiceTerminationAt,
"service_criticality": v.ServiceCriticality,
"risk_tier": v.RiskTier,
"business_owner_id": v.BusinessOwnerID,
"security_owner_id": v.SecurityOwnerID,
"status_page_url": v.StatusPageURL,
@@ -267,10 +254,8 @@ SELECT
certifications,
service_start_at,
service_termination_at,
service_criticality,
risk_tier,
business_owner_id,
security_owner_id,
business_owner_id,
security_owner_id,
status_page_url,
terms_of_service_url,
security_page_url,
@@ -317,8 +302,6 @@ SET
description = @description,
service_start_at = @service_start_at,
service_termination_at = @service_termination_at,
service_criticality = @service_criticality,
risk_tier = @risk_tier,
category = @category,
headquarter_address = @headquarter_address,
legal_name = @legal_name,
@@ -346,8 +329,6 @@ WHERE %s
"description": v.Description,
"service_start_at": v.ServiceStartAt,
"service_termination_at": v.ServiceTerminationAt,
"service_criticality": v.ServiceCriticality,
"risk_tier": v.RiskTier,
"category": v.Category,
"headquarter_address": v.HeadquarterAddress,
"legal_name": v.LegalName,

299
pkg/coredata/vendor_risk_assessment.go Normal file
View File

@@ -0,0 +1,299 @@
// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package coredata
import (
"context"
"fmt"
"maps"
"time"
"github.com/getprobo/probo/pkg/gid"
"github.com/getprobo/probo/pkg/page"
"github.com/jackc/pgx/v5"
"go.gearno.de/kit/pg"
)
type (
// RiskAssessment represents a point-in-time risk assessment for a vendor
VendorRiskAssessment struct {
ID gid.GID `db:"id"`
VendorID gid.GID `db:"vendor_id"`
AssessedAt time.Time `db:"assessed_at"`
AssessedBy gid.GID `db:"assessed_by"`
AccessedAt time.Time `db:"accessed_at"`
ApprovedBy gid.GID `db:"approved_by"`
ApprovedAt time.Time `db:"approved_at"`
ExpiresAt time.Time `db:"expires_at"`
DataSensitivity DataSensitivity `db:"data_sensitivity"`
BusinessImpact BusinessImpact `db:"business_impact"`
Notes *string `db:"notes"`
CreatedAt time.Time `db:"created_at"`
UpdatedAt time.Time `db:"updated_at"`
}
// DataSensitivity represents the level of data sensitivity handled by a vendor
DataSensitivity string
// BusinessImpact represents the impact level the vendor has on business operations
BusinessImpact string
// RiskAssessments is a collection of RiskAssessment objects
VendorRiskAssessments []*VendorRiskAssessment
)
// Constants for DataSensitivity
const (
DataSensitivityNone DataSensitivity = "NONE" // No sensitive data
DataSensitivityLow DataSensitivity = "LOW" // Public or non-sensitive data
DataSensitivityMedium DataSensitivity = "MEDIUM" // Internal/restricted data
DataSensitivityHigh DataSensitivity = "HIGH" // Confidential data
DataSensitivityCritical DataSensitivity = "CRITICAL" // Regulated/PII/financial data
)
// Constants for BusinessImpact
const (
BusinessImpactLow BusinessImpact = "LOW" // Minimal impact on business
BusinessImpactMedium BusinessImpact = "MEDIUM" // Moderate impact on business
BusinessImpactHigh BusinessImpact = "HIGH" // Significant business impact
BusinessImpactCritical BusinessImpact = "CRITICAL" // Critical to business operations
)
func (v VendorRiskAssessment) CursorKey(orderBy VendorRiskAssessmentOrderField) page.CursorKey {
switch orderBy {
case VendorRiskAssessmentOrderFieldCreatedAt:
return page.NewCursorKey(v.ID, v.CreatedAt)
case VendorRiskAssessmentOrderFieldExpiresAt:
return page.NewCursorKey(v.ID, v.ExpiresAt)
}
panic(fmt.Sprintf("unsupported order by: %s", orderBy))
}
// Insert adds a new risk assessment to the database
func (r VendorRiskAssessment) Insert(
ctx context.Context,
conn pg.Conn,
scope Scoper,
) error {
q := `
INSERT INTO
risk_assessments (
tenant_id,
id,
vendor_id,
assessed_at,
assessed_by,
accessed_at,
approved_by,
approved_at,
expires_at,
data_sensitivity,
business_impact,
notes,
created_at,
updated_at
)
VALUES (
@tenant_id,
@id,
@vendor_id,
@assessed_at,
@assessed_by,
@expires_at,
@data_sensitivity,
@business_impact,
@notes,
@attachments,
@created_at,
@updated_at
)
`
args := pgx.StrictNamedArgs{
"tenant_id": scope.GetTenantID(),
"id": r.ID,
"vendor_id": r.VendorID,
"assessed_at": r.AssessedAt,
"assessed_by": r.AssessedBy,
"accessed_at": r.AccessedAt,
"approved_by": r.ApprovedBy,
"approved_at": r.ApprovedAt,
"expires_at": r.ExpiresAt,
"data_sensitivity": r.DataSensitivity,
"business_impact": r.BusinessImpact,
"notes": r.Notes,
"created_at": r.CreatedAt,
"updated_at": r.UpdatedAt,
}
_, err := conn.Exec(ctx, q, args)
return err
}
// LoadByID loads a risk assessment by its ID
func (r *VendorRiskAssessment) LoadByID(
ctx context.Context,
conn pg.Conn,
scope Scoper,
id gid.GID,
) error {
q := `
SELECT
id,
vendor_id,
assessed_at,
assessed_by,
accessed_at,
approved_by,
approved_at,
expires_at,
data_sensitivity,
business_impact,
notes,
created_at,
updated_at
FROM
risk_assessments
WHERE
%s
AND id = @id
LIMIT 1;
`
q = fmt.Sprintf(q, scope.SQLFragment())
args := pgx.StrictNamedArgs{"id": id}
maps.Copy(args, scope.SQLArguments())
rows, err := conn.Query(ctx, q, args)
if err != nil {
return fmt.Errorf("cannot query risk assessment: %w", err)
}
defer rows.Close()
assessment, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[VendorRiskAssessment])
if err != nil {
return fmt.Errorf("cannot collect risk assessment: %w", err)
}
*r = assessment
return nil
}
// LoadLatestByVendorID loads the most recent risk assessment for a vendor
func (r *VendorRiskAssessment) LoadLatestByVendorID(
ctx context.Context,
conn pg.Conn,
scope Scoper,
vendorID gid.GID,
) error {
q := `
SELECT
id,
vendor_id,
assessed_at,
assessed_by,
accessed_at,
approved_by,
approved_at,
expires_at,
data_sensitivity,
business_impact,
notes,
created_at,
updated_at
FROM
risk_assessments
WHERE
%s
AND vendor_id = @vendor_id
ORDER BY
assessed_at DESC
LIMIT 1;
`
q = fmt.Sprintf(q, scope.SQLFragment())
args := pgx.StrictNamedArgs{"vendor_id": vendorID}
maps.Copy(args, scope.SQLArguments())
rows, err := conn.Query(ctx, q, args)
if err != nil {
return fmt.Errorf("cannot query risk assessment: %w", err)
}
defer rows.Close()
assessment, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[VendorRiskAssessment])
if err != nil {
return fmt.Errorf("cannot collect risk assessment: %w", err)
}
*r = assessment
return nil
}
// LoadByVendorID loads all risk assessments for a vendor, ordered by assessment date
func (r *VendorRiskAssessments) LoadByVendorID(
ctx context.Context,
conn pg.Conn,
scope Scoper,
vendorID gid.GID,
cursor *page.Cursor[VendorRiskAssessmentOrderField],
) error {
q := `
SELECT
id,
vendor_id,
assessed_at,
assessed_by,
accessed_at,
approved_by,
approved_at,
expires_at,
data_sensitivity,
business_impact,
notes,
created_at,
updated_at
FROM
risk_assessments
WHERE
%s
AND vendor_id = @vendor_id
AND %s
`
q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
args := pgx.StrictNamedArgs{"vendor_id": vendorID}
maps.Copy(args, scope.SQLArguments())
maps.Copy(args, cursor.SQLArguments())
rows, err := conn.Query(ctx, q, args)
if err != nil {
return fmt.Errorf("cannot query risk assessments: %w", err)
}
assessments, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[VendorRiskAssessment])
if err != nil {
return fmt.Errorf("cannot collect risk assessments: %w", err)
}
*r = assessments
return nil
}

41
pkg/coredata/vendor_risk_assessment_order_field.go Normal file
View File

@@ -0,0 +1,41 @@
// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package coredata
type (
VendorRiskAssessmentOrderField string
)
const (
VendorRiskAssessmentOrderFieldCreatedAt VendorRiskAssessmentOrderField = "CREATED_AT"
VendorRiskAssessmentOrderFieldExpiresAt VendorRiskAssessmentOrderField = "EXPIRES_AT"
)
func (p VendorRiskAssessmentOrderField) Column() string {
return string(p)
}
func (p VendorRiskAssessmentOrderField) String() string {
return string(p)
}
func (p VendorRiskAssessmentOrderField) MarshalText() ([]byte, error) {
return []byte(p.String()), nil
}
func (p *VendorRiskAssessmentOrderField) UnmarshalText(text []byte) error {
*p = VendorRiskAssessmentOrderField(text)
return nil
}