Add assets

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
2025-05-30 15:07:57 -07:00
parent b315be96bc
commit fa1cd6fb51
38 changed files with 9121 additions and 7 deletions
--- a/pkg/coredata/asset.go
+++ b/pkg/coredata/asset.go
@@ -0,0 +1,427 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/page"
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+)
+
+type Asset struct {
+	ID              gid.GID        `db:"id"`
+	Name            string         `db:"name"`
+	Amount          int            `db:"amount"`
+	OwnerID         gid.GID        `db:"owner_id"`
+	OrganizationID  gid.GID        `db:"organization_id"`
+	Criticity       CriticityLevel `db:"criticity"`
+	AssetType       AssetType      `db:"asset_type"`
+	DataTypesStored string         `db:"data_types_stored"`
+	CreatedAt       time.Time      `db:"created_at"`
+	UpdatedAt       time.Time      `db:"updated_at"`
+}
+
+func (a *Asset) CursorKey(field AssetOrderField) page.CursorKey {
+	switch field {
+	case AssetOrderFieldCreatedAt:
+		return page.NewCursorKey(a.ID, a.CreatedAt)
+	case AssetOrderFieldAmount:
+		return page.NewCursorKey(a.ID, a.Amount)
+	case AssetOrderFieldCriticity:
+		return page.NewCursorKey(a.ID, a.Criticity)
+	}
+
+	panic(fmt.Sprintf("unsupported order by: %s", field))
+}
+
+type Assets []*Asset
+
+func (a *Asset) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	assetID gid.GID,
+) error {
+	q := `
+SELECT
+	id,
+	name,
+	organization_id,
+	owner_id,
+	amount,
+	criticity,
+	asset_type,
+	data_types_stored,
+	created_at,
+	updated_at
+FROM
+	assets
+WHERE
+	%s
+	AND id = @asset_id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"asset_id": assetID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query assets: %w", err)
+	}
+
+	asset, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Asset])
+	if err != nil {
+		return fmt.Errorf("cannot collect asset: %w", err)
+	}
+
+	*a = asset
+
+	return nil
+}
+
+func (a *Asset) LoadByOwnerID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+SELECT
+	id,
+	name,
+	organization_id,
+	owner_id,
+	amount,
+	criticity,
+	asset_type,
+	data_types_stored,
+	created_at,
+	updated_at
+FROM
+	assets
+WHERE
+	%s
+	AND owner_id = @owner_id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"owner_id": a.OwnerID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query assets: %w", err)
+	}
+
+	asset, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Asset])
+	if err != nil {
+		return fmt.Errorf("cannot collect asset: %w", err)
+	}
+
+	*a = asset
+
+	return nil
+}
+
+func (a *Assets) LoadByOrganizationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+	cursor *page.Cursor[AssetOrderField],
+) error {
+	q := `
+SELECT
+	id,
+	name,
+	organization_id,
+	owner_id,
+	amount,
+	criticity,
+	asset_type,
+	data_types_stored,
+	created_at,
+	updated_at
+FROM
+	assets
+WHERE
+	%s
+	AND organization_id = @organization_id
+	AND %s
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"organization_id": organizationID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query assets: %w", err)
+	}
+
+	assets, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Asset])
+	if err != nil {
+		return fmt.Errorf("cannot collect assets: %w", err)
+	}
+
+	*a = assets
+
+	return nil
+}
+
+func (a *Asset) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO assets (
+	id,
+	tenant_id,
+	name,
+	organization_id,
+	owner_id,
+	amount,
+	criticity,
+	asset_type,
+	data_types_stored,
+	created_at,
+	updated_at
+) VALUES (
+	@id,
+	@tenant_id,
+	@name,
+	@organization_id,
+	@owner_id,
+	@amount,
+	@criticity,
+	@asset_type,
+	@data_types_stored,
+	@created_at,
+	@updated_at
+)
+`
+
+	args := pgx.StrictNamedArgs{
+		"id":                a.ID,
+		"tenant_id":         scope.GetTenantID(),
+		"organization_id":   a.OrganizationID,
+		"name":              a.Name,
+		"owner_id":          a.OwnerID,
+		"amount":            a.Amount,
+		"criticity":         a.Criticity,
+		"asset_type":        a.AssetType,
+		"data_types_stored": a.DataTypesStored,
+		"created_at":        a.CreatedAt,
+		"updated_at":        a.UpdatedAt,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot insert asset: %w", err)
+	}
+
+	return nil
+}
+
+func (a *Asset) Update(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+UPDATE assets
+SET
+	name = @name,
+	owner_id = @owner_id,
+	amount = @amount,
+	criticity = @criticity,
+	asset_type = @asset_type,
+	data_types_stored = @data_types_stored,
+	updated_at = @updated_at
+WHERE
+	%s
+	AND id = @id
+RETURNING
+	id,
+	name,
+	organization_id,
+	owner_id,
+	amount,
+	criticity,
+	asset_type,
+	data_types_stored,
+	created_at,
+	updated_at
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"id":                a.ID,
+		"name":              a.Name,
+		"owner_id":          a.OwnerID,
+		"amount":            a.Amount,
+		"criticity":         a.Criticity,
+		"asset_type":        a.AssetType,
+		"data_types_stored": a.DataTypesStored,
+		"updated_at":        time.Now(),
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot update asset: %w", err)
+	}
+
+	asset, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Asset])
+	if err != nil {
+		return fmt.Errorf("cannot collect updated asset: %w", err)
+	}
+
+	*a = asset
+
+	return nil
+}
+
+func (a *Asset) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+DELETE FROM assets
+WHERE
+	%s
+	AND id = @id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": a.ID}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot delete asset: %w", err)
+	}
+
+	return nil
+}
+
+type AssetVendor struct {
+	AssetID   int64     `db:"asset_id"`
+	VendorID  int64     `db:"vendor_id"`
+	CreatedAt time.Time `db:"created_at"`
+}
+
+func (a *Asset) CreateWithVendors(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organization *Organization,
+	vendorIDs []gid.GID,
+	now time.Time,
+) error {
+	if err := organization.LoadByID(ctx, conn, scope, a.OrganizationID); err != nil {
+		return fmt.Errorf("cannot load organization %q: %w", a.OrganizationID, err)
+	}
+
+	if err := a.Insert(ctx, conn, scope); err != nil {
+		return fmt.Errorf("cannot insert asset: %w", err)
+	}
+
+	if len(vendorIDs) > 0 {
+		for _, vendorID := range vendorIDs {
+			_, err := conn.Exec(ctx, `
+				INSERT INTO asset_vendors (tenant_id, asset_id, vendor_id, created_at)
+				VALUES ($1, $2, $3, $4)
+			`, scope.GetTenantID(), a.ID, vendorID, now)
+			if err != nil {
+				return fmt.Errorf("cannot insert asset vendor: %w", err)
+			}
+		}
+	}
+
+	return nil
+}
+
+func (a *Asset) UpdateWithVendors(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	vendorIDs []gid.GID,
+	now time.Time,
+) error {
+	existing := &Asset{}
+	if err := existing.LoadByID(ctx, conn, scope, a.ID); err != nil {
+		return fmt.Errorf("cannot load asset: %w", err)
+	}
+
+	a.OrganizationID = existing.OrganizationID
+	a.CreatedAt = existing.CreatedAt
+	a.UpdatedAt = now
+
+	if err := a.Update(ctx, conn, scope); err != nil {
+		return fmt.Errorf("cannot update asset: %w", err)
+	}
+
+	_, err := conn.Exec(ctx, `
+		DELETE FROM asset_vendors
+		WHERE tenant_id = $1 AND asset_id = $2
+	`, scope.GetTenantID(), a.ID)
+	if err != nil {
+		return fmt.Errorf("cannot delete asset vendors: %w", err)
+	}
+
+	if len(vendorIDs) > 0 {
+		for _, vendorID := range vendorIDs {
+			_, err := conn.Exec(ctx, `
+				INSERT INTO asset_vendors (tenant_id, asset_id, vendor_id, created_at)
+				VALUES ($1, $2, $3, $4)
+			`, scope.GetTenantID(), a.ID, vendorID, now)
+			if err != nil {
+				return fmt.Errorf("cannot insert asset vendor: %w", err)
+			}
+		}
+	}
+
+	return nil
+}
+
+// UpdateWithVendorsTx updates an asset and its vendor relationships in a single transaction
+func (a *Asset) UpdateWithVendorsTx(
+	ctx context.Context,
+	db *pg.Client,
+	scope Scoper,
+	vendorIDs []gid.GID,
+	now time.Time,
+) error {
+	return db.WithTx(ctx, func(conn pg.Conn) error {
+		return a.UpdateWithVendors(ctx, conn, scope, vendorIDs, now)
+	})
+}
--- a/pkg/coredata/asset_order_field.go
+++ b/pkg/coredata/asset_order_field.go
@@ -0,0 +1,32 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+type AssetOrderField string
+
+const (
+	AssetOrderFieldCreatedAt AssetOrderField = "CREATED_AT"
+	AssetOrderFieldAmount    AssetOrderField = "AMOUNT"
+	AssetOrderFieldCriticity AssetOrderField = "CRITICITY"
+	AssetOrderFieldName      AssetOrderField = "NAME"
+)
+
+func (p AssetOrderField) Column() string {
+	return string(p)
+}
+
+func (p AssetOrderField) String() string {
+	return string(p)
+}
--- a/pkg/coredata/asset_type.go
+++ b/pkg/coredata/asset_type.go
@@ -0,0 +1,65 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"database/sql/driver"
+	"fmt"
+)
+
+type (
+	AssetType string
+)
+
+const (
+	AssetTypePhysical AssetType = "PHYSICAL"
+	AssetTypeVirtual  AssetType = "VIRTUAL"
+)
+
+func (at AssetType) MarshalText() ([]byte, error) {
+	return []byte(at.String()), nil
+}
+
+func (at *AssetType) UnmarshalText(data []byte) error {
+	val := string(data)
+
+	switch val {
+	case AssetTypePhysical.String():
+		*at = AssetTypePhysical
+	case AssetTypeVirtual.String():
+		*at = AssetTypeVirtual
+	default:
+		return fmt.Errorf("invalid AssetType value: %q", val)
+	}
+
+	return nil
+}
+
+func (at AssetType) String() string {
+	return string(at)
+}
+
+func (at *AssetType) Scan(value any) error {
+	val, ok := value.(string)
+	if !ok {
+		return fmt.Errorf("invalid scan source for AssetType, expected string got %T", value)
+	}
+
+	return at.UnmarshalText([]byte(val))
+}
+
+func (at AssetType) Value() (driver.Value, error) {
+	return at.String(), nil
+}
--- a/pkg/coredata/criticity_level.go
+++ b/pkg/coredata/criticity_level.go
@@ -0,0 +1,23 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+type CriticityLevel string
+
+const (
+	CriticityLevelLow    CriticityLevel = "LOW"
+	CriticityLevelMedium CriticityLevel = "MEDIUM"
+	CriticityLevelHigh   CriticityLevel = "HIGH"
+)
--- a/pkg/coredata/entity_type_reg.go
+++ b/pkg/coredata/entity_type_reg.go
@@ -33,4 +33,5 @@ const (
 	RiskEntityType
 	DocumentVersionEntityType
 	DocumentVersionSignatureEntityType
+	AssetEntityType
 )
--- a/pkg/coredata/migrations/20250530T215914Z.sql
+++ b/pkg/coredata/migrations/20250530T215914Z.sql
@@ -0,0 +1,27 @@
+-- Create enum types
+CREATE TYPE criticity_level AS ENUM ('LOW', 'MEDIUM', 'HIGH');
+CREATE TYPE asset_type AS ENUM ('PHYSICAL', 'VIRTUAL');
+
+-- Create assets table
+CREATE TABLE IF NOT EXISTS assets (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    name TEXT NOT NULL,
+    amount INTEGER NOT NULL,
+    owner_id TEXT NOT NULL REFERENCES peoples(id) ON UPDATE CASCADE ON DELETE CASCADE,
+    organization_id TEXT NOT NULL REFERENCES organizations(id) ON UPDATE CASCADE ON DELETE CASCADE,
+    criticity criticity_level DEFAULT 'MEDIUM',
+    asset_type asset_type NOT NULL DEFAULT 'VIRTUAL',
+    data_types_stored TEXT,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    updated_at TIMESTAMP WITH TIME ZONE NOT NULL
+);
+
+-- Create junction table for many-to-many relationship with vendors
+CREATE TABLE IF NOT EXISTS asset_vendors (
+    asset_id TEXT REFERENCES assets(id) ON DELETE CASCADE,
+    vendor_id TEXT REFERENCES vendors(id) ON DELETE CASCADE,
+    tenant_id TEXT NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    PRIMARY KEY (asset_id, vendor_id)
+);
--- a/pkg/coredata/vendor.go
+++ b/pkg/coredata/vendor.go
@@ -29,6 +29,7 @@ import (
 type (
 	Vendor struct {
 		ID                            gid.GID        `db:"id"`
+		TenantID                      gid.TenantID   `db:"tenant_id"`
 		OrganizationID                gid.GID        `db:"organization_id"`
 		Name                          string         `db:"name"`
 		Description                   *string        `db:"description"`
@@ -77,6 +78,7 @@ func (v *Vendor) LoadByID(
 	q := `
 SELECT
    id,
+    tenant_id,
    organization_id,
    name,
    description,
@@ -243,6 +245,7 @@ func (v *Vendors) LoadByOrganizationID(
 	q := `
 SELECT
    id,
+    tenant_id,
    organization_id,
    name,
    description,
@@ -386,3 +389,93 @@ func (v Vendor) ExpireNonExpiredRiskAssessments(

 	return nil
 }
+
+func (v *Vendors) LoadByAssetID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	assetID gid.GID,
+	cursor *page.Cursor[VendorOrderField],
+) error {
+	q := `
+WITH vend AS (
+	SELECT
+		v.id,
+		v.tenant_id,
+		v.organization_id,
+		v.name,
+		v.description,
+		v.category,
+		v.headquarter_address,
+		v.legal_name,
+		v.website_url,
+		v.privacy_policy_url,
+		v.service_level_agreement_url,
+		v.data_processing_agreement_url,
+		v.business_associate_agreement_url,
+		v.subprocessors_list_url,
+		v.certifications,
+		v.business_owner_id,
+		v.security_owner_id,
+		v.status_page_url,
+		v.terms_of_service_url,
+		v.security_page_url,
+		v.trust_page_url,
+		v.created_at,
+		v.updated_at
+	FROM
+		vendors v
+	INNER JOIN
+		asset_vendors av ON v.id = av.vendor_id
+	WHERE
+		av.asset_id = @asset_id
+)
+SELECT
+	id,
+	tenant_id,
+	organization_id,
+	name,
+	description,
+	category,
+	headquarter_address,
+	legal_name,
+	website_url,
+	privacy_policy_url,
+	service_level_agreement_url,
+	data_processing_agreement_url,
+	business_associate_agreement_url,
+	subprocessors_list_url,
+	certifications,
+	business_owner_id,
+	security_owner_id,
+	status_page_url,
+	terms_of_service_url,
+	security_page_url,
+	trust_page_url,
+	created_at,
+	updated_at
+FROM
+	vend
+WHERE %s
+	AND %s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.NamedArgs{"asset_id": assetID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query vendors: %w", err)
+	}
+
+	vendors, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Vendor])
+	if err != nil {
+		return fmt.Errorf("cannot collect vendors: %w", err)
+	}
+
+	*v = vendors
+
+	return nil
+}