probo/pkg/server/api/console/v1/risk_resolvers.go

package console_v1

// This file will be automatically regenerated based on the schema, any resolver
// implementations
// will be copied through when generating and any unknown code will be moved to the end.
// Code generated by github.com/99designs/gqlgen version v0.17.90

import (
	"context"
	"errors"

	"github.com/vikstrous/dataloadgen"
	"go.gearno.de/kit/log"
	"go.probo.inc/probo/pkg/coredata"
	"go.probo.inc/probo/pkg/iam"
	"go.probo.inc/probo/pkg/page"
	"go.probo.inc/probo/pkg/probo"
	"go.probo.inc/probo/pkg/server/api/console/v1/dataloader"
	"go.probo.inc/probo/pkg/server/api/console/v1/schema"
	"go.probo.inc/probo/pkg/server/api/console/v1/types"
	"go.probo.inc/probo/pkg/server/gqlutils"
	"go.probo.inc/probo/pkg/validator"
)

// CreateRisk is the resolver for the createRisk field.
func (r *mutationResolver) CreateRisk(ctx context.Context, input types.CreateRiskInput) (*types.CreateRiskPayload, error) {
	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionRiskCreate)
	if err != nil {
		return nil, err
	}

	risk, err := r.probo.Risks.Create(
		ctx, scope,
		probo.CreateRiskRequest{
			OrganizationID:     input.OrganizationID,
			Name:               input.Name,
			Description:        input.Description,
			Category:           input.Category,
			Treatment:          input.Treatment,
			OwnerID:            input.OwnerID,
			InherentLikelihood: input.InherentLikelihood,
			InherentImpact:     input.InherentImpact,
			ResidualLikelihood: input.ResidualLikelihood,
			ResidualImpact:     input.ResidualImpact,
			Note:               input.Note,
		},
	)
	if err != nil {
		if errors.Is(err, coredata.ErrResourceAlreadyExists) {
			return nil, gqlutils.Conflict(ctx, err)
		}

		if validationErrors, ok := errors.AsType[validator.ValidationErrors](err); ok {
			return nil, gqlutils.InvalidValidationErrors(ctx, validationErrors)
		}

		r.logger.ErrorCtx(ctx, "cannot create risk", log.Error(err))

		return nil, gqlutils.Internal(ctx)
	}

	return &types.CreateRiskPayload{
		RiskEdge: types.NewRiskEdge(risk, coredata.RiskOrderFieldCreatedAt),
	}, nil
}

// UpdateRisk is the resolver for the updateRisk field.
func (r *mutationResolver) UpdateRisk(ctx context.Context, input types.UpdateRiskInput) (*types.UpdateRiskPayload, error) {
	scope, err := r.authorize(ctx, input.ID, probo.ActionRiskUpdate)
	if err != nil {
		return nil, err
	}

	risk, err := r.probo.Risks.Update(
		ctx, scope,
		probo.UpdateRiskRequest{
			ID:                 input.ID,
			Name:               input.Name,
			Description:        gqlutils.UnwrapOmittable(input.Description),
			Category:           input.Category,
			Treatment:          input.Treatment,
			OwnerID:            gqlutils.UnwrapOmittable(input.OwnerID),
			InherentLikelihood: input.InherentLikelihood,
			InherentImpact:     input.InherentImpact,
			ResidualLikelihood: input.ResidualLikelihood,
			ResidualImpact:     input.ResidualImpact,
			Note:               input.Note,
		},
	)
	if err != nil {
		if validationErrors, ok := errors.AsType[validator.ValidationErrors](err); ok {
			return nil, gqlutils.InvalidValidationErrors(ctx, validationErrors)
		}

		r.logger.ErrorCtx(ctx, "cannot update risk", log.Error(err))

		return nil, gqlutils.Internal(ctx)
	}

	return &types.UpdateRiskPayload{
		Risk: types.NewRisk(risk),
	}, nil
}

// DeleteRisk is the resolver for the deleteRisk field.
func (r *mutationResolver) DeleteRisk(ctx context.Context, input types.DeleteRiskInput) (*types.DeleteRiskPayload, error) {
	scope, err := r.authorize(ctx, input.RiskID, probo.ActionRiskDelete)
	if err != nil {
		return nil, err
	}

	if err := r.probo.Risks.Delete(ctx, scope, input.RiskID); err != nil {
		r.logger.ErrorCtx(ctx, "cannot delete risk", log.Error(err))
		return nil, gqlutils.Internal(ctx)
	}

	return &types.DeleteRiskPayload{
		DeletedRiskID: input.RiskID,
	}, nil
}

// CreateRiskMeasureMapping is the resolver for the createRiskMeasureMapping field.
func (r *mutationResolver) CreateRiskMeasureMapping(ctx context.Context, input types.CreateRiskMeasureMappingInput) (*types.CreateRiskMeasureMappingPayload, error) {
	scope, err := r.authorize(ctx, input.RiskID, probo.ActionRiskMeasureMappingCreate)
	if err != nil {
		return nil, err
	}

	risk, measure, err := r.probo.Risks.CreateMeasureMapping(ctx, scope, input.RiskID, input.MeasureID)
	if err != nil {
		r.logger.ErrorCtx(ctx, "cannot create risk measure mapping", log.Error(err))
		return nil, gqlutils.Internal(ctx)
	}

	return &types.CreateRiskMeasureMappingPayload{
		RiskEdge:    types.NewRiskEdge(risk, coredata.RiskOrderFieldCreatedAt),
		MeasureEdge: types.NewMeasureEdge(measure, coredata.MeasureOrderFieldCreatedAt),
	}, nil
}

// DeleteRiskMeasureMapping is the resolver for the deleteRiskMeasureMapping field.
func (r *mutationResolver) DeleteRiskMeasureMapping(ctx context.Context, input types.DeleteRiskMeasureMappingInput) (*types.DeleteRiskMeasureMappingPayload, error) {
	scope, err := r.authorize(ctx, input.RiskID, probo.ActionRiskMeasureMappingDelete)
	if err != nil {
		return nil, err
	}

	risk, measure, err := r.probo.Risks.DeleteMeasureMapping(ctx, scope, input.RiskID, input.MeasureID)
	if err != nil {
		r.logger.ErrorCtx(ctx, "cannot delete risk measure mapping", log.Error(err))
		return nil, gqlutils.Internal(ctx)
	}

	return &types.DeleteRiskMeasureMappingPayload{
		DeletedRiskID:    risk.ID,
		DeletedMeasureID: measure.ID,
	}, nil
}

// CreateRiskDocumentMapping is the resolver for the createRiskDocumentMapping field.
func (r *mutationResolver) CreateRiskDocumentMapping(ctx context.Context, input types.CreateRiskDocumentMappingInput) (*types.CreateRiskDocumentMappingPayload, error) {
	scope, err := r.authorize(ctx, input.RiskID, probo.ActionRiskDocumentMappingCreate)
	if err != nil {
		return nil, err
	}

	risk, document, err := r.probo.Risks.CreateDocumentMapping(ctx, scope, input.RiskID, input.DocumentID)
	if err != nil {
		r.logger.ErrorCtx(ctx, "cannot create risk document mapping", log.Error(err))
		return nil, gqlutils.Internal(ctx)
	}

	return &types.CreateRiskDocumentMappingPayload{
		RiskEdge:     types.NewRiskEdge(risk, coredata.RiskOrderFieldCreatedAt),
		DocumentEdge: types.NewDocumentEdge(document, coredata.DocumentOrderFieldTitle),
	}, nil
}

// DeleteRiskDocumentMapping is the resolver for the deleteRiskDocumentMapping field.
func (r *mutationResolver) DeleteRiskDocumentMapping(ctx context.Context, input types.DeleteRiskDocumentMappingInput) (*types.DeleteRiskDocumentMappingPayload, error) {
	scope, err := r.authorize(ctx, input.RiskID, probo.ActionRiskDocumentMappingDelete)
	if err != nil {
		return nil, err
	}

	risk, document, err := r.probo.Risks.DeleteDocumentMapping(ctx, scope, input.RiskID, input.DocumentID)
	if err != nil {
		r.logger.ErrorCtx(ctx, "cannot delete risk document mapping", log.Error(err))
		return nil, gqlutils.Internal(ctx)
	}

	return &types.DeleteRiskDocumentMappingPayload{
		DeletedRiskID:     risk.ID,
		DeletedDocumentID: document.ID,
	}, nil
}

// CreateRiskObligationMapping is the resolver for the createRiskObligationMapping field.
func (r *mutationResolver) CreateRiskObligationMapping(ctx context.Context, input types.CreateRiskObligationMappingInput) (*types.CreateRiskObligationMappingPayload, error) {
	scope, err := r.authorize(ctx, input.RiskID, probo.ActionRiskObligationMappingCreate)
	if err != nil {
		return nil, err
	}

	risk, obligation, err := r.probo.Risks.CreateObligationMapping(ctx, scope, input.RiskID, input.ObligationID)
	if err != nil {
		r.logger.ErrorCtx(ctx, "cannot create risk obligation mapping", log.Error(err))
		return nil, gqlutils.Internal(ctx)
	}

	return &types.CreateRiskObligationMappingPayload{
		RiskEdge:       types.NewRiskEdge(risk, coredata.RiskOrderFieldCreatedAt),
		ObligationEdge: types.NewObligationEdge(obligation, coredata.ObligationOrderFieldCreatedAt),
	}, nil
}

// DeleteRiskObligationMapping is the resolver for the deleteRiskObligationMapping field.
func (r *mutationResolver) DeleteRiskObligationMapping(ctx context.Context, input types.DeleteRiskObligationMappingInput) (*types.DeleteRiskObligationMappingPayload, error) {
	scope, err := r.authorize(ctx, input.RiskID, probo.ActionRiskObligationMappingDelete)
	if err != nil {
		return nil, err
	}

	risk, obligation, err := r.probo.Risks.DeleteObligationMapping(ctx, scope, input.RiskID, input.ObligationID)
	if err != nil {
		r.logger.ErrorCtx(ctx, "cannot delete risk obligation mapping", log.Error(err))
		return nil, gqlutils.Internal(ctx)
	}

	return &types.DeleteRiskObligationMappingPayload{
		DeletedRiskID:       risk.ID,
		DeletedObligationID: obligation.ID,
	}, nil
}

// PublishRiskList is the resolver for the publishRiskList field.
func (r *mutationResolver) PublishRiskList(ctx context.Context, input types.PublishRiskListInput) (*types.PublishRiskListPayload, error) {
	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionRiskPublish)
	if err != nil {
		return nil, err
	}

	document, documentVersion, err := r.probo.GeneratedDocuments.PublishRiskList(ctx, scope, input.OrganizationID, input.ApproverIds, input.Minor)
	if err != nil {
		if errors.Is(err, coredata.ErrResourceAlreadyExists) {
			return nil, gqlutils.Conflict(ctx, err)
		}

		r.logger.ErrorCtx(ctx, "cannot publish risk list", log.Error(err))

		return nil, gqlutils.Internal(ctx)
	}

	return &types.PublishRiskListPayload{
		DocumentEdge:        types.NewDocumentEdge(document, coredata.DocumentOrderFieldCreatedAt),
		DocumentVersionEdge: types.NewDocumentVersionEdge(documentVersion, coredata.DocumentVersionOrderFieldCreatedAt),
	}, nil
}

// Owner is the resolver for the owner field.
func (r *riskResolver) Owner(ctx context.Context, obj *types.Risk) (*types.Profile, error) {
	if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
		return nil, err
	}

	if obj.Owner == nil {
		return nil, nil
	}

	loaders := dataloader.FromContext(ctx)

	owner, err := loaders.Profile.Load(ctx, obj.Owner.ID)
	if err != nil {
		if errors.Is(err, coredata.ErrResourceNotFound) || errors.Is(err, dataloadgen.ErrNotFound) {
			return nil, gqlutils.NotFound(ctx, err)
		}

		r.logger.ErrorCtx(ctx, "cannot get owner", log.Error(err))

		return nil, gqlutils.Internal(ctx)
	}

	return types.NewProfile(owner), nil
}

// Organization is the resolver for the organization field.
func (r *riskResolver) Organization(ctx context.Context, obj *types.Risk) (*types.Organization, error) {
	if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
		return nil, err
	}

	loaders := dataloader.FromContext(ctx)

	organization, err := loaders.Organization.Load(ctx, obj.Organization.ID)
	if err != nil {
		if errors.Is(err, coredata.ErrResourceNotFound) || errors.Is(err, dataloadgen.ErrNotFound) {
			return nil, gqlutils.NotFound(ctx, err)
		}

		r.logger.ErrorCtx(ctx, "cannot get organization", log.Error(err))

		return nil, gqlutils.Internal(ctx)
	}

	return types.NewOrganization(organization), nil
}

// Measures is the resolver for the measures field.
func (r *riskResolver) Measures(ctx context.Context, obj *types.Risk, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.MeasureOrderBy, filter *types.MeasureFilter) (*types.MeasureConnection, error) {
	scope, err := r.authorize(ctx, obj.ID, probo.ActionMeasureList)
	if err != nil {
		return nil, err
	}

	pageOrderBy := page.OrderBy[coredata.MeasureOrderField]{
		Field:     coredata.MeasureOrderFieldCreatedAt,
		Direction: page.OrderDirectionDesc,
	}

	if orderBy != nil {
		pageOrderBy = page.OrderBy[coredata.MeasureOrderField]{
			Field:     orderBy.Field,
			Direction: orderBy.Direction,
		}
	}

	cursor := types.NewCursor(first, after, last, before, pageOrderBy)

	var measureFilter = coredata.NewMeasureFilter(nil, nil, nil)
	if filter != nil {
		measureFilter = coredata.NewMeasureFilter(filter.Query, filter.State, filter.Category)
	}

	page, err := r.probo.Measures.ListForRiskID(ctx, scope, obj.ID, cursor, measureFilter)
	if err != nil {
		r.logger.ErrorCtx(ctx, "cannot list risk measures", log.Error(err))
		return nil, gqlutils.Internal(ctx)
	}

	return types.NewMeasureConnection(page, r, obj.ID, measureFilter), nil
}

// Documents is the resolver for the documents field.
func (r *riskResolver) Documents(ctx context.Context, obj *types.Risk, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentOrderBy, filter *types.DocumentFilter) (*types.DocumentConnection, error) {
	scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentList)
	if err != nil {
		return nil, err
	}

	pageOrderBy := page.OrderBy[coredata.DocumentOrderField]{
		Field:     coredata.DocumentOrderFieldCreatedAt,
		Direction: page.OrderDirectionDesc,
	}

	if orderBy != nil {
		pageOrderBy = page.OrderBy[coredata.DocumentOrderField]{
			Field:     orderBy.Field,
			Direction: orderBy.Direction,
		}
	}

	cursor := types.NewCursor(first, after, last, before, pageOrderBy)

	var documentFilter = coredata.NewDocumentFilter(nil)
	if filter != nil {
		documentFilter = coredata.NewDocumentFilter(filter.Query).
			WithWriteModes(filter.WriteModes).
			WithDocumentTypes(filter.DocumentTypes).
			WithClassifications(filter.Classifications)
	}

	page, err := r.probo.Documents.ListForRiskID(ctx, scope, obj.ID, cursor, documentFilter)
	if err != nil {
		r.logger.ErrorCtx(ctx, "cannot list risk documents", log.Error(err))
		return nil, gqlutils.Internal(ctx)
	}

	return types.NewDocumentConnection(page, r, obj.ID, documentFilter), nil
}

// Controls is the resolver for the controls field.
func (r *riskResolver) Controls(ctx context.Context, obj *types.Risk, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy, filter *types.ControlFilter) (*types.ControlConnection, error) {
	scope, err := r.authorize(ctx, obj.ID, probo.ActionControlList)
	if err != nil {
		return nil, err
	}

	pageOrderBy := page.OrderBy[coredata.ControlOrderField]{
		Field:     coredata.ControlOrderFieldCreatedAt,
		Direction: page.OrderDirectionDesc,
	}

	if orderBy != nil {
		pageOrderBy = page.OrderBy[coredata.ControlOrderField]{
			Field:     orderBy.Field,
			Direction: orderBy.Direction,
		}
	}

	cursor := types.NewCursor(first, after, last, before, pageOrderBy)

	var filters = coredata.NewControlFilter(nil)
	if filter != nil {
		filters = coredata.NewControlFilter(filter.Query)
	}

	page, err := r.probo.Controls.ListForRiskID(ctx, scope, obj.ID, cursor, filters)
	if err != nil {
		r.logger.ErrorCtx(ctx, "cannot list risk controls", log.Error(err))
		return nil, gqlutils.Internal(ctx)
	}

	return types.NewControlConnection(page, r, obj.ID, filters), nil
}

// Obligations is the resolver for the obligations field.
func (r *riskResolver) Obligations(ctx context.Context, obj *types.Risk, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ObligationOrderBy) (*types.ObligationConnection, error) {
	scope, err := r.authorize(ctx, obj.ID, probo.ActionObligationList)
	if err != nil {
		return nil, err
	}

	pageOrderBy := page.OrderBy[coredata.ObligationOrderField]{
		Field:     coredata.ObligationOrderFieldCreatedAt,
		Direction: page.OrderDirectionDesc,
	}

	if orderBy != nil {
		pageOrderBy = page.OrderBy[coredata.ObligationOrderField]{
			Field:     orderBy.Field,
			Direction: orderBy.Direction,
		}
	}

	cursor := types.NewCursor(first, after, last, before, pageOrderBy)

	page, err := r.probo.Obligations.ListForRiskID(ctx, scope, obj.ID, cursor)
	if err != nil {
		r.logger.ErrorCtx(ctx, "cannot list risk obligations", log.Error(err))
		return nil, gqlutils.Internal(ctx)
	}

	return types.NewObligationConnection(page, r, obj.ID), nil
}

// Scenarios is the resolver for the scenarios field.
func (r *riskResolver) Scenarios(ctx context.Context, obj *types.Risk, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskAssessmentScenarioOrderBy) (*types.RiskAssessmentScenarioConnection, error) {
	scope, err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentScenarioList)
	if err != nil {
		return nil, err
	}

	pageOrderBy := page.OrderBy[coredata.RiskAssessmentScenarioOrderField]{
		Field:     coredata.RiskAssessmentScenarioOrderFieldCreatedAt,
		Direction: page.OrderDirectionDesc,
	}

	if orderBy != nil {
		pageOrderBy = page.OrderBy[coredata.RiskAssessmentScenarioOrderField]{Field: orderBy.Field, Direction: orderBy.Direction}
	}

	cursor := types.NewCursor(first, after, last, before, pageOrderBy)

	p, err := r.riskManagement.ListScenariosForRiskID(ctx, scope, obj.ID, cursor)
	if err != nil {
		r.logger.ErrorCtx(ctx, "cannot list risk scenarios", log.Error(err))
		return nil, gqlutils.Internal(ctx)
	}

	return types.NewRiskAssessmentScenarioConnection(p, r, obj.ID), nil
}

// Permission is the resolver for the permission field.
func (r *riskResolver) Permission(ctx context.Context, obj *types.Risk, action string) (bool, error) {
	return r.Resolver.Permission(ctx, obj, action)
}

// TotalCount is the resolver for the totalCount field.
func (r *riskConnectionResolver) TotalCount(ctx context.Context, obj *types.RiskConnection) (int, error) {
	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionRiskList)
	if err != nil {
		return 0, err
	}

	switch obj.Resolver.(type) {
	case *measureResolver:
		count, err := r.probo.Risks.CountForMeasureID(ctx, scope, obj.ParentID, obj.Filters)
		if err != nil {
			r.logger.ErrorCtx(ctx, "cannot count risks", log.Error(err))
			return 0, gqlutils.Internal(ctx)
		}

		return count, nil
	case *organizationResolver:
		count, err := r.probo.Risks.CountForOrganizationID(ctx, scope, obj.ParentID, obj.Filters)
		if err != nil {
			r.logger.ErrorCtx(ctx, "cannot count risks", log.Error(err))
			return 0, gqlutils.Internal(ctx)
		}

		return count, nil
	case *riskAssessmentScenarioResolver:
		count, err := r.riskManagement.CountRisksForScenarioID(ctx, scope, obj.ParentID)
		if err != nil {
			r.logger.ErrorCtx(ctx, "cannot count scenario risks", log.Error(err))
			return 0, gqlutils.Internal(ctx)
		}

		return count, nil
	}

	r.logger.ErrorCtx(ctx, "unsupported resolver")

	return 0, gqlutils.Internal(ctx)
}

// Risk returns schema.RiskResolver implementation.
func (r *Resolver) Risk() schema.RiskResolver { return &riskResolver{r} }

// RiskConnection returns schema.RiskConnectionResolver implementation.
func (r *Resolver) RiskConnection() schema.RiskConnectionResolver { return &riskConnectionResolver{r} }

type riskResolver struct{ *Resolver }
type riskConnectionResolver struct{ *Resolver }