probo/pkg/server/api/mcp/v1/schema.resolvers.go

package mcp_v1

// This file will be automatically regenerated based on the schema, any resolver implementations
// will be copied through when generating and any unknown code will be moved to the end.
// Code generated by mcpgen. DO NOT EDIT.

import (
	"context"
	"fmt"

	"github.com/modelcontextprotocol/go-sdk/mcp"
	"go.probo.inc/probo/pkg/authz"
	"go.probo.inc/probo/pkg/coredata"
	"go.probo.inc/probo/pkg/page"
	"go.probo.inc/probo/pkg/probo"
	"go.probo.inc/probo/pkg/server/api/mcp/v1/types"
	serverauth "go.probo.inc/probo/pkg/server/auth"
)

// ListOrganizationsTool handles the listOrganizations tool
// List all organizations the user has access to
func (r *Resolver) ListOrganizationsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListOrganizationsInput) (*mcp.CallToolResult, types.ListOrganizationsOutput, error) {
	user := serverauth.UserFromContext(ctx)
	if user == nil {
		return nil, types.ListOrganizationsOutput{}, fmt.Errorf("authentication required")
	}

	organizations, err := r.authzSvc.GetAllUserOrganizations(ctx, user.ID)
	if err != nil {
		return nil, types.ListOrganizationsOutput{}, fmt.Errorf("failed to list organizations: %w", err)
	}

	result := types.ListOrganizationsOutput{
		Organizations: make([]*types.Organization, 0, len(organizations)),
	}

	for _, org := range organizations {
		result.Organizations = append(result.Organizations, types.NewOrganization(org))
	}

	return nil, result, nil
}

// ListVendorsTool handles the listVendors tool
// List all vendors for the organization
func (r *Resolver) ListVendorsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListVendorsInput) (*mcp.CallToolResult, types.ListVendorsOutput, error) {
	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListVendors)

	prb := r.ProboService(ctx, input.OrganizationID)

	pageOrderBy := page.OrderBy[coredata.VendorOrderField]{
		Field:     coredata.VendorOrderFieldCreatedAt,
		Direction: page.OrderDirectionDesc,
	}
	if input.OrderBy != nil {
		pageOrderBy = page.OrderBy[coredata.VendorOrderField]{
			Field:     input.OrderBy.Field,
			Direction: input.OrderBy.Direction,
		}
	}

	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)

	var vendorFilter = coredata.NewVendorFilter(nil, nil)
	if input.Filter != nil {
		vendorFilter = coredata.NewVendorFilter(&input.Filter.SnapshotID, nil)
	}

	page, err := prb.Vendors.ListForOrganizationID(ctx, input.OrganizationID, cursor, vendorFilter)
	if err != nil {
		panic(fmt.Errorf("cannot list organization vendors: %w", err))
	}

	return nil, types.NewListVendorsOutput(page), nil
}

// AddVendorTool handles the addVendor tool
// Add a new vendor to the organization
func (r *Resolver) AddVendorTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddVendorInput) (*mcp.CallToolResult, types.AddVendorOutput, error) {
	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreateAsset)

	svc := r.ProboService(ctx, input.OrganizationID)

	vendor, err := svc.Vendors.Create(
		ctx,
		probo.CreateVendorRequest{
			OrganizationID: input.OrganizationID,
			Name:           input.Name,
			Description:    input.Description,
			// HeadquarterAddress:            input.HeadquarterAddress,
			// LegalName:                     input.LegalName,
			// WebsiteURL:                    input.WebsiteURL,
			// Category:                      input.Category,
			// PrivacyPolicyURL:              input.PrivacyPolicyURL,
			// ServiceLevelAgreementURL:      input.ServiceLevelAgreementURL,
			// DataProcessingAgreementURL:    input.DataProcessingAgreementURL,
			// BusinessAssociateAgreementURL: input.BusinessAssociateAgreementURL,
			// SubprocessorsListURL:          input.SubprocessorsListURL,
			// Certifications:                input.Certifications,
			// Countries:                     input.Countries,
			// SecurityPageURL:               input.SecurityPageURL,
			// TrustPageURL:                  input.TrustPageURL,
			// TermsOfServiceURL:             input.TermsOfServiceURL,
			// StatusPageURL:                 input.StatusPageURL,
			// BusinessOwnerID:               input.BusinessOwnerID,
			// SecurityOwnerID:               input.SecurityOwnerID,
		},
	)
	if err != nil {
		return nil, types.AddVendorOutput{}, fmt.Errorf("failed to create vendor: %w", err)
	}

	return nil, types.NewAddVendorOutput(vendor), nil
}

// UpdateVendorTool handles the updateVendor tool
// Update an existing vendor
func (r *Resolver) UpdateVendorTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateVendorInput) (*mcp.CallToolResult, types.UpdateVendorOutput, error) {

	return nil, types.UpdateVendorOutput{}, fmt.Errorf("updateVendor not implemented")
}

func (r *Resolver) ListPeopleTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListPeopleInput) (*mcp.CallToolResult, types.ListPeopleOutput, error) {
	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListPeople)

	prb := r.ProboService(ctx, input.OrganizationID)

	pageOrderBy := page.OrderBy[coredata.PeopleOrderField]{
		Field:     coredata.PeopleOrderFieldCreatedAt,
		Direction: page.OrderDirectionDesc,
	}
	if input.OrderBy != nil {
		pageOrderBy = page.OrderBy[coredata.PeopleOrderField]{
			Field:     input.OrderBy.Field,
			Direction: input.OrderBy.Direction,
		}
	}

	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)

	var peopleFilter = coredata.NewPeopleFilter(nil)
	if input.Filter != nil {
		peopleFilter = coredata.NewPeopleFilter(input.Filter.ExcludeContractEnded)
	}

	page, err := prb.Peoples.ListForOrganizationID(ctx, input.OrganizationID, cursor, peopleFilter)
	if err != nil {
		panic(fmt.Errorf("cannot list organization people: %w", err))
	}

	return nil, types.NewListPeopleOutput(page), nil
}

func (r *Resolver) GetPeopleTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetPeopleInput) (*mcp.CallToolResult, types.GetPeopleOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)

	prb := r.ProboService(ctx, input.ID)

	people, err := prb.Peoples.Get(ctx, input.ID)
	if err != nil {
		return nil, types.GetPeopleOutput{}, fmt.Errorf("failed to get people: %w", err)
	}

	return nil, types.GetPeopleOutput{
		People: types.NewPeople(people),
	}, nil
}

func (r *Resolver) AddPeopleTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddPeopleInput) (*mcp.CallToolResult, types.AddPeopleOutput, error) {
	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreatePeople)

	svc := r.ProboService(ctx, input.OrganizationID)

	people, err := svc.Peoples.Create(
		ctx,
		probo.CreatePeopleRequest{
			OrganizationID:           input.OrganizationID,
			FullName:                 input.FullName,
			PrimaryEmailAddress:      input.PrimaryEmailAddress,
			AdditionalEmailAddresses: input.AdditionalEmailAddresses,
			Kind:                     input.Kind,
			Position:                 input.Position,
			ContractStartDate:        input.ContractStartDate,
			ContractEndDate:          input.ContractEndDate,
		},
	)
	if err != nil {
		return nil, types.AddPeopleOutput{}, fmt.Errorf("failed to create people: %w", err)
	}

	return nil, types.AddPeopleOutput{
		People: types.NewPeople(people),
	}, nil
}

func (r *Resolver) UpdatePeopleTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdatePeopleInput) (*mcp.CallToolResult, types.UpdatePeopleOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionUpdatePeople)

	svc := r.ProboService(ctx, input.ID)

	people, err := svc.Peoples.Update(
		ctx,
		probo.UpdatePeopleRequest{
			ID:                       input.ID,
			FullName:                 input.FullName,
			PrimaryEmailAddress:      input.PrimaryEmailAddress,
			AdditionalEmailAddresses: input.AdditionalEmailAddresses,
			Kind:                     input.Kind,
			Position:                 UnwrapOmittable(input.Position),
			ContractStartDate:        UnwrapOmittable(input.ContractStartDate),
			ContractEndDate:          UnwrapOmittable(input.ContractEndDate),
		},
	)
	if err != nil {
		panic(fmt.Errorf("cannot update people: %w", err))
	}

	return nil, types.UpdatePeopleOutput{
		People: types.NewPeople(people),
	}, nil
}

func (r *Resolver) ListRisksTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListRisksInput) (*mcp.CallToolResult, types.ListRisksOutput, error) {
	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListRisks)

	prb := r.ProboService(ctx, input.OrganizationID)

	pageOrderBy := page.OrderBy[coredata.RiskOrderField]{
		Field:     coredata.RiskOrderFieldCreatedAt,
		Direction: page.OrderDirectionDesc,
	}
	if input.OrderBy != nil {
		pageOrderBy = page.OrderBy[coredata.RiskOrderField]{
			Field:     input.OrderBy.Field,
			Direction: input.OrderBy.Direction,
		}
	}

	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)

	var riskFilter = coredata.NewRiskFilter(nil, nil)
	if input.Filter != nil {
		riskFilter = coredata.NewRiskFilter(input.Filter.Query, &input.Filter.SnapshotID)
	}

	page, err := prb.Risks.ListForOrganizationID(ctx, input.OrganizationID, cursor, riskFilter)
	if err != nil {
		panic(fmt.Errorf("cannot list organization risks: %w", err))
	}

	return nil, types.NewListRisksOutput(page), nil
}

func (r *Resolver) GetRiskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetRiskInput) (*mcp.CallToolResult, types.GetRiskOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)

	prb := r.ProboService(ctx, input.ID)

	risk, err := prb.Risks.Get(ctx, input.ID)
	if err != nil {
		return nil, types.GetRiskOutput{}, fmt.Errorf("failed to get risk: %w", err)
	}

	return nil, types.GetRiskOutput{
		Risk: types.NewRisk(risk),
	}, nil
}

func (r *Resolver) AddRiskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddRiskInput) (*mcp.CallToolResult, types.AddRiskOutput, error) {
	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreateRisk)

	svc := r.ProboService(ctx, input.OrganizationID)

	risk, err := svc.Risks.Create(
		ctx,
		probo.CreateRiskRequest{
			OrganizationID:     input.OrganizationID,
			Name:               input.Name,
			Description:        input.Description,
			Category:           input.Category,
			Treatment:          input.Treatment,
			InherentLikelihood: input.InherentLikelihood,
			InherentImpact:     input.InherentImpact,
			ResidualLikelihood: input.ResidualLikelihood,
			ResidualImpact:     input.ResidualImpact,
		},
	)
	if err != nil {
		return nil, types.AddRiskOutput{}, fmt.Errorf("failed to create risk: %w", err)
	}

	return nil, types.AddRiskOutput{
		Risk: types.NewRisk(risk),
	}, nil
}

func (r *Resolver) UpdateRiskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateRiskInput) (*mcp.CallToolResult, types.UpdateRiskOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionUpdateRisk)

	svc := r.ProboService(ctx, input.ID)

	risk, err := svc.Risks.Update(
		ctx,
		probo.UpdateRiskRequest{
			ID:                 input.ID,
			Name:               input.Name,
			Description:        UnwrapOmittable(input.Description),
			Category:           input.Category,
			Treatment:          input.Treatment,
			OwnerID:            UnwrapOmittable(input.OwnerID),
			InherentLikelihood: input.InherentLikelihood,
			InherentImpact:     input.InherentImpact,
			ResidualLikelihood: input.ResidualLikelihood,
			ResidualImpact:     input.ResidualImpact,
		},
	)
	if err != nil {
		return nil, types.UpdateRiskOutput{}, fmt.Errorf("failed to update risk: %w", err)
	}

	return nil, types.UpdateRiskOutput{
		Risk: types.NewRisk(risk),
	}, nil
}

func (r *Resolver) ListMeasuresTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListMeasuresInput) (*mcp.CallToolResult, types.ListMeasuresOutput, error) {
	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListMeasures)

	prb := r.ProboService(ctx, input.OrganizationID)

	pageOrderBy := page.OrderBy[coredata.MeasureOrderField]{
		Field:     coredata.MeasureOrderFieldCreatedAt,
		Direction: page.OrderDirectionDesc,
	}
	if input.OrderBy != nil {
		pageOrderBy = page.OrderBy[coredata.MeasureOrderField]{
			Field:     input.OrderBy.Field,
			Direction: input.OrderBy.Direction,
		}
	}

	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)

	var measureFilter = coredata.NewMeasureFilter(nil, nil)
	if input.Filter != nil {
		measureFilter = coredata.NewMeasureFilter(input.Filter.Query, input.Filter.State)
	}

	page, err := prb.Measures.ListForOrganizationID(ctx, input.OrganizationID, cursor, measureFilter)
	if err != nil {
		panic(fmt.Errorf("cannot list organization measures: %w", err))
	}

	return nil, types.NewListMeasuresOutput(page), nil
}

func (r *Resolver) GetMeasureTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetMeasureInput) (*mcp.CallToolResult, types.GetMeasureOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)

	prb := r.ProboService(ctx, input.ID)

	measure, err := prb.Measures.Get(ctx, input.ID)
	if err != nil {
		return nil, types.GetMeasureOutput{}, fmt.Errorf("failed to get measure: %w", err)
	}

	return nil, types.GetMeasureOutput{
		Measure: types.NewMeasure(measure),
	}, nil
}

func (r *Resolver) AddMeasureTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddMeasureInput) (*mcp.CallToolResult, types.AddMeasureOutput, error) {
	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreateMeasure)

	svc := r.ProboService(ctx, input.OrganizationID)

	measure, err := svc.Measures.Create(
		ctx,
		probo.CreateMeasureRequest{
			OrganizationID: input.OrganizationID,
			Name:           input.Name,
			Description:    input.Description,
			Category:       input.Category,
		},
	)
	if err != nil {
		return nil, types.AddMeasureOutput{}, fmt.Errorf("failed to create measure: %w", err)
	}

	return nil, types.AddMeasureOutput{
		Measure: types.NewMeasure(measure),
	}, nil
}

func (r *Resolver) UpdateMeasureTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateMeasureInput) (*mcp.CallToolResult, types.UpdateMeasureOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionUpdateMeasure)

	svc := r.ProboService(ctx, input.ID)

	measure, err := svc.Measures.Update(
		ctx,
		probo.UpdateMeasureRequest{
			ID:          input.ID,
			Name:        input.Name,
			Description: UnwrapOmittable(input.Description),
			Category:    input.Category,
			State:       input.State,
		},
	)
	if err != nil {
		return nil, types.UpdateMeasureOutput{}, fmt.Errorf("failed to update measure: %w", err)
	}

	return nil, types.UpdateMeasureOutput{
		Measure: types.NewMeasure(measure),
	}, nil
}

func (r *Resolver) ListFrameworksTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListFrameworksInput) (*mcp.CallToolResult, types.ListFrameworksOutput, error) {
	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListFrameworks)

	prb := r.ProboService(ctx, input.OrganizationID)

	pageOrderBy := page.OrderBy[coredata.FrameworkOrderField]{
		Field:     coredata.FrameworkOrderFieldCreatedAt,
		Direction: page.OrderDirectionDesc,
	}
	if input.OrderBy != nil {
		pageOrderBy = page.OrderBy[coredata.FrameworkOrderField]{
			Field:     input.OrderBy.Field,
			Direction: input.OrderBy.Direction,
		}
	}

	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)

	page, err := prb.Frameworks.ListForOrganizationID(ctx, input.OrganizationID, cursor)
	if err != nil {
		panic(fmt.Errorf("cannot list organization frameworks: %w", err))
	}

	return nil, types.NewListFrameworksOutput(page), nil
}

func (r *Resolver) GetFrameworkTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetFrameworkInput) (*mcp.CallToolResult, types.GetFrameworkOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)

	prb := r.ProboService(ctx, input.ID)

	framework, err := prb.Frameworks.Get(ctx, input.ID)
	if err != nil {
		return nil, types.GetFrameworkOutput{}, fmt.Errorf("failed to get framework: %w", err)
	}

	return nil, types.GetFrameworkOutput{
		Framework: types.NewFramework(framework),
	}, nil
}

func (r *Resolver) AddFrameworkTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddFrameworkInput) (*mcp.CallToolResult, types.AddFrameworkOutput, error) {
	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreateFramework)

	svc := r.ProboService(ctx, input.OrganizationID)

	framework, err := svc.Frameworks.Create(
		ctx,
		probo.CreateFrameworkRequest{
			OrganizationID: input.OrganizationID,
			Name:           input.Name,
			Description:    input.Description,
		},
	)
	if err != nil {
		return nil, types.AddFrameworkOutput{}, fmt.Errorf("failed to create framework: %w", err)
	}

	return nil, types.AddFrameworkOutput{
		Framework: types.NewFramework(framework),
	}, nil
}

func (r *Resolver) UpdateFrameworkTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateFrameworkInput) (*mcp.CallToolResult, types.UpdateFrameworkOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionUpdateFramework)

	svc := r.ProboService(ctx, input.ID)

	framework, err := svc.Frameworks.Update(
		ctx,
		probo.UpdateFrameworkRequest{
			ID:          input.ID,
			Name:        input.Name,
			Description: UnwrapOmittable(input.Description),
		},
	)
	if err != nil {
		return nil, types.UpdateFrameworkOutput{}, fmt.Errorf("failed to update framework: %w", err)
	}

	return nil, types.UpdateFrameworkOutput{
		Framework: types.NewFramework(framework),
	}, nil
}

func (r *Resolver) ListAssetsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListAssetsInput) (*mcp.CallToolResult, types.ListAssetsOutput, error) {
	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListAssets)

	prb := r.ProboService(ctx, input.OrganizationID)

	pageOrderBy := page.OrderBy[coredata.AssetOrderField]{
		Field:     coredata.AssetOrderFieldCreatedAt,
		Direction: page.OrderDirectionDesc,
	}
	if input.OrderBy != nil {
		pageOrderBy = page.OrderBy[coredata.AssetOrderField]{
			Field:     input.OrderBy.Field,
			Direction: input.OrderBy.Direction,
		}
	}

	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)

	var assetFilter = coredata.NewAssetFilter(nil)
	if input.Filter != nil {
		assetFilter = coredata.NewAssetFilter(&input.Filter.SnapshotID)
	}

	page, err := prb.Assets.ListForOrganizationID(ctx, input.OrganizationID, cursor, assetFilter)
	if err != nil {
		panic(fmt.Errorf("cannot list organization assets: %w", err))
	}

	return nil, types.NewListAssetsOutput(page), nil
}

func (r *Resolver) GetAssetTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetAssetInput) (*mcp.CallToolResult, types.GetAssetOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)

	prb := r.ProboService(ctx, input.ID)

	asset, err := prb.Assets.Get(ctx, input.ID)
	if err != nil {
		return nil, types.GetAssetOutput{}, fmt.Errorf("failed to get asset: %w", err)
	}

	return nil, types.GetAssetOutput{
		Asset: types.NewAsset(asset),
	}, nil
}

func (r *Resolver) AddAssetTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddAssetInput) (*mcp.CallToolResult, types.AddAssetOutput, error) {
	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreateAsset)

	svc := r.ProboService(ctx, input.OrganizationID)

	asset, err := svc.Assets.Create(
		ctx,
		probo.CreateAssetRequest{
			OrganizationID:  input.OrganizationID,
			Name:            input.Name,
			Amount:          input.Amount,
			OwnerID:         input.OwnerID,
			AssetType:       input.AssetType,
			DataTypesStored: input.DataTypesStored,
			VendorIDs:       input.VendorIds,
		},
	)
	if err != nil {
		return nil, types.AddAssetOutput{}, fmt.Errorf("failed to create asset: %w", err)
	}

	return nil, types.AddAssetOutput{
		Asset: types.NewAsset(asset),
	}, nil
}

func (r *Resolver) UpdateAssetTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateAssetInput) (*mcp.CallToolResult, types.UpdateAssetOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionUpdateAsset)

	svc := r.ProboService(ctx, input.ID)

	asset, err := svc.Assets.Update(
		ctx,
		probo.UpdateAssetRequest{
			ID:              input.ID,
			Name:            input.Name,
			Amount:          input.Amount,
			OwnerID:         input.OwnerID,
			AssetType:       input.AssetType,
			DataTypesStored: input.DataTypesStored,
			VendorIDs:       input.VendorIds,
		},
	)
	if err != nil {
		return nil, types.UpdateAssetOutput{}, fmt.Errorf("failed to update asset: %w", err)
	}

	return nil, types.UpdateAssetOutput{
		Asset: types.NewAsset(asset),
	}, nil
}

func (r *Resolver) ListDataTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListDataInput) (*mcp.CallToolResult, types.ListDataOutput, error) {
	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListData)

	prb := r.ProboService(ctx, input.OrganizationID)

	pageOrderBy := page.OrderBy[coredata.DatumOrderField]{
		Field:     coredata.DatumOrderFieldCreatedAt,
		Direction: page.OrderDirectionDesc,
	}
	if input.OrderBy != nil {
		pageOrderBy = page.OrderBy[coredata.DatumOrderField]{
			Field:     input.OrderBy.Field,
			Direction: input.OrderBy.Direction,
		}
	}

	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)

	var datumFilter = coredata.NewDatumFilter(nil)
	if input.Filter != nil {
		datumFilter = coredata.NewDatumFilter(&input.Filter.SnapshotID)
	}

	page, err := prb.Data.ListForOrganizationID(ctx, input.OrganizationID, cursor, datumFilter)
	if err != nil {
		panic(fmt.Errorf("cannot list organization data: %w", err))
	}

	return nil, types.NewListDataOutput(page), nil
}

func (r *Resolver) GetDatumTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetDatumInput) (*mcp.CallToolResult, types.GetDatumOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)

	prb := r.ProboService(ctx, input.ID)

	datum, err := prb.Data.Get(ctx, input.ID)
	if err != nil {
		return nil, types.GetDatumOutput{}, fmt.Errorf("failed to get datum: %w", err)
	}

	return nil, types.GetDatumOutput{
		Datum: types.NewDatum(datum),
	}, nil
}

func (r *Resolver) AddDatumTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddDatumInput) (*mcp.CallToolResult, types.AddDatumOutput, error) {
	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreateDatum)

	svc := r.ProboService(ctx, input.OrganizationID)

	datum, err := svc.Data.Create(
		ctx,
		probo.CreateDatumRequest{
			OrganizationID:     input.OrganizationID,
			Name:               input.Name,
			DataClassification: input.DataClassification,
			OwnerID:            input.OwnerID,
			VendorIDs:          input.VendorIds,
		},
	)
	if err != nil {
		return nil, types.AddDatumOutput{}, fmt.Errorf("failed to create datum: %w", err)
	}

	return nil, types.AddDatumOutput{
		Datum: types.NewDatum(datum),
	}, nil
}

func (r *Resolver) UpdateDatumTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateDatumInput) (*mcp.CallToolResult, types.UpdateDatumOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionUpdateDatum)

	svc := r.ProboService(ctx, input.ID)

	datum, err := svc.Data.Update(
		ctx,
		probo.UpdateDatumRequest{
			ID:                 input.ID,
			Name:               input.Name,
			DataClassification: input.DataClassification,
			OwnerID:            input.OwnerID,
			VendorIDs:          input.VendorIds,
		},
	)
	if err != nil {
		return nil, types.UpdateDatumOutput{}, fmt.Errorf("failed to update datum: %w", err)
	}

	return nil, types.UpdateDatumOutput{
		Datum: types.NewDatum(datum),
	}, nil
}

func (r *Resolver) ListNonconformitiesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListNonconformitiesInput) (*mcp.CallToolResult, types.ListNonconformitiesOutput, error) {
	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListNonconformities)

	prb := r.ProboService(ctx, input.OrganizationID)

	pageOrderBy := page.OrderBy[coredata.NonconformityOrderField]{
		Field:     coredata.NonconformityOrderFieldCreatedAt,
		Direction: page.OrderDirectionDesc,
	}
	if input.OrderBy != nil {
		pageOrderBy = page.OrderBy[coredata.NonconformityOrderField]{
			Field:     input.OrderBy.Field,
			Direction: input.OrderBy.Direction,
		}
	}

	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)

	var nonconformityFilter = coredata.NewNonconformityFilter(nil)
	if input.Filter != nil {
		nonconformityFilter = coredata.NewNonconformityFilter(&input.Filter.SnapshotID)
	}

	page, err := prb.Nonconformities.ListForOrganizationID(ctx, input.OrganizationID, cursor, nonconformityFilter)
	if err != nil {
		panic(fmt.Errorf("cannot list organization nonconformities: %w", err))
	}

	return nil, types.NewListNonconformitiesOutput(page), nil
}

func (r *Resolver) GetNonconformityTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetNonconformityInput) (*mcp.CallToolResult, types.GetNonconformityOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)

	prb := r.ProboService(ctx, input.ID)

	nonconformity, err := prb.Nonconformities.Get(ctx, input.ID)
	if err != nil {
		return nil, types.GetNonconformityOutput{}, fmt.Errorf("failed to get nonconformity: %w", err)
	}

	return nil, types.GetNonconformityOutput{
		Nonconformity: types.NewNonconformity(nonconformity),
	}, nil
}

func (r *Resolver) AddNonconformityTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddNonconformityInput) (*mcp.CallToolResult, types.AddNonconformityOutput, error) {
	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreateNonconformity)

	svc := r.ProboService(ctx, input.OrganizationID)

	nonconformity, err := svc.Nonconformities.Create(
		ctx,
		&probo.CreateNonconformityRequest{
			OrganizationID:     input.OrganizationID,
			ReferenceID:        input.ReferenceID,
			Description:        input.Description,
			AuditID:            input.AuditID,
			DateIdentified:     input.DateIdentified,
			RootCause:          input.RootCause,
			CorrectiveAction:   input.CorrectiveAction,
			OwnerID:            input.OwnerID,
			DueDate:            input.DueDate,
			Status:             input.Status,
			EffectivenessCheck: input.EffectivenessCheck,
		},
	)
	if err != nil {
		return nil, types.AddNonconformityOutput{}, fmt.Errorf("failed to create nonconformity: %w", err)
	}

	return nil, types.AddNonconformityOutput{
		Nonconformity: types.NewNonconformity(nonconformity),
	}, nil
}

func (r *Resolver) UpdateNonconformityTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateNonconformityInput) (*mcp.CallToolResult, types.UpdateNonconformityOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionUpdateNonconformity)

	svc := r.ProboService(ctx, input.ID)

	nonconformity, err := svc.Nonconformities.Update(
		ctx,
		&probo.UpdateNonconformityRequest{
			ID:                 input.ID,
			ReferenceID:        input.ReferenceID,
			Description:        UnwrapOmittable(input.Description),
			DateIdentified:     UnwrapOmittable(input.DateIdentified),
			RootCause:          input.RootCause,
			CorrectiveAction:   UnwrapOmittable(input.CorrectiveAction),
			OwnerID:            input.OwnerID,
			AuditID:            input.AuditID,
			DueDate:            UnwrapOmittable(input.DueDate),
			Status:             input.Status,
			EffectivenessCheck: UnwrapOmittable(input.EffectivenessCheck),
		},
	)
	if err != nil {
		return nil, types.UpdateNonconformityOutput{}, fmt.Errorf("failed to update nonconformity: %w", err)
	}

	return nil, types.UpdateNonconformityOutput{
		Nonconformity: types.NewNonconformity(nonconformity),
	}, nil
}

func (r *Resolver) ListObligationsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListObligationsInput) (*mcp.CallToolResult, types.ListObligationsOutput, error) {
	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListObligations)

	prb := r.ProboService(ctx, input.OrganizationID)

	pageOrderBy := page.OrderBy[coredata.ObligationOrderField]{
		Field:     coredata.ObligationOrderFieldCreatedAt,
		Direction: page.OrderDirectionDesc,
	}
	if input.OrderBy != nil {
		pageOrderBy = page.OrderBy[coredata.ObligationOrderField]{
			Field:     input.OrderBy.Field,
			Direction: input.OrderBy.Direction,
		}
	}

	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)

	var obligationFilter = coredata.NewObligationFilter(nil)
	if input.Filter != nil {
		obligationFilter = coredata.NewObligationFilter(&input.Filter.SnapshotID)
	}

	page, err := prb.Obligations.ListForOrganizationID(ctx, input.OrganizationID, cursor, obligationFilter)
	if err != nil {
		panic(fmt.Errorf("cannot list organization obligations: %w", err))
	}

	return nil, types.NewListObligationsOutput(page), nil
}

func (r *Resolver) GetObligationTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetObligationInput) (*mcp.CallToolResult, types.GetObligationOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)

	prb := r.ProboService(ctx, input.ID)

	obligation, err := prb.Obligations.Get(ctx, input.ID)
	if err != nil {
		return nil, types.GetObligationOutput{}, fmt.Errorf("failed to get obligation: %w", err)
	}

	return nil, types.GetObligationOutput{
		Obligation: types.NewObligation(obligation),
	}, nil
}

func (r *Resolver) AddObligationTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddObligationInput) (*mcp.CallToolResult, types.AddObligationOutput, error) {
	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreateObligation)

	svc := r.ProboService(ctx, input.OrganizationID)

	obligation, err := svc.Obligations.Create(
		ctx,
		&probo.CreateObligationRequest{
			OrganizationID:         input.OrganizationID,
			Area:                   input.Area,
			Source:                 input.Source,
			Requirement:            input.Requirement,
			ActionsToBeImplemented: input.ActionsToBeImplemented,
			Regulator:              input.Regulator,
			OwnerID:                input.OwnerID,
			LastReviewDate:         input.LastReviewDate,
			DueDate:                input.DueDate,
			Status:                 input.Status,
		},
	)
	if err != nil {
		return nil, types.AddObligationOutput{}, fmt.Errorf("failed to create obligation: %w", err)
	}

	return nil, types.AddObligationOutput{
		Obligation: types.NewObligation(obligation),
	}, nil
}

func (r *Resolver) UpdateObligationTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateObligationInput) (*mcp.CallToolResult, types.UpdateObligationOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionUpdateObligation)

	svc := r.ProboService(ctx, input.ID)

	obligation, err := svc.Obligations.Update(
		ctx,
		&probo.UpdateObligationRequest{
			ID:                     input.ID,
			Area:                   UnwrapOmittable(input.Area),
			Source:                 UnwrapOmittable(input.Source),
			Requirement:            UnwrapOmittable(input.Requirement),
			ActionsToBeImplemented: UnwrapOmittable(input.ActionsToBeImplemented),
			Regulator:              UnwrapOmittable(input.Regulator),
			OwnerID:                input.OwnerID,
			LastReviewDate:         UnwrapOmittable(input.LastReviewDate),
			DueDate:                UnwrapOmittable(input.DueDate),
			Status:                 input.Status,
		},
	)
	if err != nil {
		return nil, types.UpdateObligationOutput{}, fmt.Errorf("failed to update obligation: %w", err)
	}

	return nil, types.UpdateObligationOutput{
		Obligation: types.NewObligation(obligation),
	}, nil
}

func (r *Resolver) ListContinualImprovementsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListContinualImprovementsInput) (*mcp.CallToolResult, types.ListContinualImprovementsOutput, error) {
	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListContinualImprovements)

	prb := r.ProboService(ctx, input.OrganizationID)

	pageOrderBy := page.OrderBy[coredata.ContinualImprovementOrderField]{
		Field:     coredata.ContinualImprovementOrderFieldCreatedAt,
		Direction: page.OrderDirectionDesc,
	}
	if input.OrderBy != nil {
		pageOrderBy = page.OrderBy[coredata.ContinualImprovementOrderField]{
			Field:     input.OrderBy.Field,
			Direction: input.OrderBy.Direction,
		}
	}

	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)

	var continualImprovementFilter = coredata.NewContinualImprovementFilter(nil)
	if input.Filter != nil {
		continualImprovementFilter = coredata.NewContinualImprovementFilter(&input.Filter.SnapshotID)
	}

	page, err := prb.ContinualImprovements.ListForOrganizationID(ctx, input.OrganizationID, cursor, continualImprovementFilter)
	if err != nil {
		panic(fmt.Errorf("cannot list organization continual improvements: %w", err))
	}

	return nil, types.NewListContinualImprovementsOutput(page), nil
}

func (r *Resolver) GetContinualImprovementTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetContinualImprovementInput) (*mcp.CallToolResult, types.GetContinualImprovementOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)

	prb := r.ProboService(ctx, input.ID)

	continualImprovement, err := prb.ContinualImprovements.Get(ctx, input.ID)
	if err != nil {
		return nil, types.GetContinualImprovementOutput{}, fmt.Errorf("failed to get continual improvement: %w", err)
	}

	return nil, types.GetContinualImprovementOutput{
		ContinualImprovement: types.NewContinualImprovement(continualImprovement),
	}, nil
}

func (r *Resolver) AddContinualImprovementTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddContinualImprovementInput) (*mcp.CallToolResult, types.AddContinualImprovementOutput, error) {
	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreateContinualImprovement)

	svc := r.ProboService(ctx, input.OrganizationID)

	continualImprovement, err := svc.ContinualImprovements.Create(
		ctx,
		&probo.CreateContinualImprovementRequest{
			OrganizationID: input.OrganizationID,
			ReferenceID:    input.ReferenceID,
			Description:    input.Description,
			Source:         input.Source,
			OwnerID:        input.OwnerID,
			TargetDate:     input.TargetDate,
			Status:         input.Status,
			Priority:       input.Priority,
		},
	)
	if err != nil {
		return nil, types.AddContinualImprovementOutput{}, fmt.Errorf("failed to create continual improvement: %w", err)
	}

	return nil, types.AddContinualImprovementOutput{
		ContinualImprovement: types.NewContinualImprovement(continualImprovement),
	}, nil
}

func (r *Resolver) UpdateContinualImprovementTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateContinualImprovementInput) (*mcp.CallToolResult, types.UpdateContinualImprovementOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionUpdateContinualImprovement)

	svc := r.ProboService(ctx, input.ID)

	continualImprovement, err := svc.ContinualImprovements.Update(
		ctx,
		&probo.UpdateContinualImprovementRequest{
			ID:          input.ID,
			ReferenceID: input.ReferenceID,
			Description: UnwrapOmittable(input.Description),
			Source:      UnwrapOmittable(input.Source),
			OwnerID:     input.OwnerID,
			TargetDate:  UnwrapOmittable(input.TargetDate),
			Status:      input.Status,
			Priority:    input.Priority,
		},
	)
	if err != nil {
		return nil, types.UpdateContinualImprovementOutput{}, fmt.Errorf("failed to update continual improvement: %w", err)
	}

	return nil, types.UpdateContinualImprovementOutput{
		ContinualImprovement: types.NewContinualImprovement(continualImprovement),
	}, nil
}

func (r *Resolver) ListAuditsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListAuditsInput) (*mcp.CallToolResult, types.ListAuditsOutput, error) {
	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListAudits)

	prb := r.ProboService(ctx, input.OrganizationID)

	pageOrderBy := page.OrderBy[coredata.AuditOrderField]{
		Field:     coredata.AuditOrderFieldCreatedAt,
		Direction: page.OrderDirectionDesc,
	}
	if input.OrderBy != nil {
		pageOrderBy = page.OrderBy[coredata.AuditOrderField]{
			Field:     input.OrderBy.Field,
			Direction: input.OrderBy.Direction,
		}
	}

	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)

	page, err := prb.Audits.ListForOrganizationID(ctx, input.OrganizationID, cursor)
	if err != nil {
		panic(fmt.Errorf("cannot list organization audits: %w", err))
	}

	return nil, types.NewListAuditsOutput(page), nil
}

func (r *Resolver) GetAuditTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetAuditInput) (*mcp.CallToolResult, types.GetAuditOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)

	prb := r.ProboService(ctx, input.ID)

	audit, err := prb.Audits.Get(ctx, input.ID)
	if err != nil {
		return nil, types.GetAuditOutput{}, fmt.Errorf("failed to get audit: %w", err)
	}

	return nil, types.GetAuditOutput{
		Audit: types.NewAudit(audit),
	}, nil
}

func (r *Resolver) AddAuditTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddAuditInput) (*mcp.CallToolResult, types.AddAuditOutput, error) {
	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreateAudit)

	svc := r.ProboService(ctx, input.OrganizationID)

	audit, err := svc.Audits.Create(
		ctx,
		&probo.CreateAuditRequest{
			OrganizationID: input.OrganizationID,
			Name:           input.Name,
			ValidFrom:      input.ValidFrom,
			ValidUntil:     input.ValidUntil,
			State:          input.State,
			FrameworkID:    input.FrameworkID,
		},
	)
	if err != nil {
		return nil, types.AddAuditOutput{}, fmt.Errorf("failed to create audit: %w", err)
	}

	return nil, types.AddAuditOutput{
		Audit: types.NewAudit(audit),
	}, nil
}

func (r *Resolver) UpdateAuditTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateAuditInput) (*mcp.CallToolResult, types.UpdateAuditOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionUpdateAudit)

	svc := r.ProboService(ctx, input.ID)

	audit, err := svc.Audits.Update(
		ctx,
		&probo.UpdateAuditRequest{
			ID:                    input.ID,
			Name:                  UnwrapOmittable(input.Name),
			ValidFrom:             input.ValidFrom,
			ValidUntil:            input.ValidUntil,
			State:                 input.State,
			TrustCenterVisibility: input.TrustCenterVisibility,
		},
	)
	if err != nil {
		return nil, types.UpdateAuditOutput{}, fmt.Errorf("failed to update audit: %w", err)
	}

	return nil, types.UpdateAuditOutput{
		Audit: types.NewAudit(audit),
	}, nil
}

func (r *Resolver) ListControlsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListControlsInput) (*mcp.CallToolResult, types.ListControlsOutput, error) {
	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListControls)

	prb := r.ProboService(ctx, input.OrganizationID)

	pageOrderBy := page.OrderBy[coredata.ControlOrderField]{
		Field:     coredata.ControlOrderFieldCreatedAt,
		Direction: page.OrderDirectionDesc,
	}
	if input.OrderBy != nil {
		pageOrderBy = page.OrderBy[coredata.ControlOrderField]{
			Field:     input.OrderBy.Field,
			Direction: input.OrderBy.Direction,
		}
	}

	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)

	var controlFilter = coredata.NewControlFilter(nil)
	if input.Filter != nil {
		controlFilter = coredata.NewControlFilter(input.Filter.Query)
	}

	page, err := prb.Controls.ListForOrganizationID(ctx, input.OrganizationID, cursor, controlFilter)
	if err != nil {
		panic(fmt.Errorf("cannot list organization controls: %w", err))
	}

	return nil, types.NewListControlsOutput(page), nil
}

func (r *Resolver) GetControlTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetControlInput) (*mcp.CallToolResult, types.GetControlOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)

	prb := r.ProboService(ctx, input.ID)

	control, err := prb.Controls.Get(ctx, input.ID)
	if err != nil {
		return nil, types.GetControlOutput{}, fmt.Errorf("failed to get control: %w", err)
	}

	return nil, types.GetControlOutput{
		Control: types.NewControl(control),
	}, nil
}

func (r *Resolver) AddControlTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddControlInput) (*mcp.CallToolResult, types.AddControlOutput, error) {
	r.MustBeAuthorized(ctx, input.FrameworkID, authz.ActionCreateControl)

	svc := r.ProboService(ctx, input.FrameworkID)

	control, err := svc.Controls.Create(
		ctx,
		probo.CreateControlRequest{
			FrameworkID:            input.FrameworkID,
			Name:                   input.Name,
			Description:            input.Description,
			SectionTitle:           input.SectionTitle,
			Status:                 input.Status,
			ExclusionJustification: input.ExclusionJustification,
		},
	)
	if err != nil {
		return nil, types.AddControlOutput{}, fmt.Errorf("failed to create control: %w", err)
	}

	return nil, types.AddControlOutput{
		Control: types.NewControl(control),
	}, nil
}

func (r *Resolver) UpdateControlTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateControlInput) (*mcp.CallToolResult, types.UpdateControlOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionUpdateControl)

	svc := r.ProboService(ctx, input.ID)

	control, err := svc.Controls.Update(
		ctx,
		probo.UpdateControlRequest{
			ID:                     input.ID,
			Name:                   input.Name,
			Description:            UnwrapOmittable(input.Description),
			SectionTitle:           input.SectionTitle,
			Status:                 input.Status,
			ExclusionJustification: input.ExclusionJustification,
		},
	)
	if err != nil {
		return nil, types.UpdateControlOutput{}, fmt.Errorf("failed to update control: %w", err)
	}

	return nil, types.UpdateControlOutput{
		Control: types.NewControl(control),
	}, nil
}

func (r *Resolver) LinkControlMeasureTool(ctx context.Context, req *mcp.CallToolRequest, input *types.LinkControlMeasureInput) (*mcp.CallToolResult, types.LinkControlMeasureOutput, error) {
	r.MustBeAuthorized(ctx, input.ControlID, authz.ActionCreateControlMeasureMapping)

	svc := r.ProboService(ctx, input.ControlID)

	_, _, err := svc.Controls.CreateMeasureMapping(ctx, input.ControlID, input.MeasureID)
	if err != nil {
		return nil, types.LinkControlMeasureOutput{}, fmt.Errorf("failed to link control measure: %w", err)
	}

	return nil, types.LinkControlMeasureOutput{}, nil
}

func (r *Resolver) UnlinkControlMeasureTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UnlinkControlMeasureInput) (*mcp.CallToolResult, types.UnlinkControlMeasureOutput, error) {
	r.MustBeAuthorized(ctx, input.ControlID, authz.ActionDeleteControlMeasureMapping)

	svc := r.ProboService(ctx, input.ControlID)

	_, _, err := svc.Controls.DeleteMeasureMapping(ctx, input.ControlID, input.MeasureID)
	if err != nil {
		return nil, types.UnlinkControlMeasureOutput{}, fmt.Errorf("failed to unlink control measure: %w", err)
	}

	return nil, types.UnlinkControlMeasureOutput{}, nil
}

func (r *Resolver) LinkControlDocumentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.LinkControlDocumentInput) (*mcp.CallToolResult, types.LinkControlDocumentOutput, error) {
	r.MustBeAuthorized(ctx, input.ControlID, authz.ActionCreateControlDocumentMapping)

	svc := r.ProboService(ctx, input.ControlID)

	_, _, err := svc.Controls.CreateDocumentMapping(ctx, input.ControlID, input.DocumentID)
	if err != nil {
		return nil, types.LinkControlDocumentOutput{}, fmt.Errorf("failed to link control document: %w", err)
	}

	return nil, types.LinkControlDocumentOutput{}, nil
}

func (r *Resolver) UnlinkControlDocumentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UnlinkControlDocumentInput) (*mcp.CallToolResult, types.UnlinkControlDocumentOutput, error) {
	r.MustBeAuthorized(ctx, input.ControlID, authz.ActionDeleteControlDocumentMapping)

	svc := r.ProboService(ctx, input.ControlID)

	_, _, err := svc.Controls.DeleteDocumentMapping(ctx, input.ControlID, input.DocumentID)
	if err != nil {
		return nil, types.UnlinkControlDocumentOutput{}, fmt.Errorf("failed to unlink control document: %w", err)
	}

	return nil, types.UnlinkControlDocumentOutput{}, nil
}

func (r *Resolver) LinkControlAuditTool(ctx context.Context, req *mcp.CallToolRequest, input *types.LinkControlAuditInput) (*mcp.CallToolResult, types.LinkControlAuditOutput, error) {
	r.MustBeAuthorized(ctx, input.ControlID, authz.ActionCreateControlAuditMapping)

	svc := r.ProboService(ctx, input.ControlID)

	_, _, err := svc.Controls.CreateAuditMapping(ctx, input.ControlID, input.AuditID)
	if err != nil {
		return nil, types.LinkControlAuditOutput{}, fmt.Errorf("failed to link control audit: %w", err)
	}

	return nil, types.LinkControlAuditOutput{}, nil
}

func (r *Resolver) UnlinkControlAuditTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UnlinkControlAuditInput) (*mcp.CallToolResult, types.UnlinkControlAuditOutput, error) {
	r.MustBeAuthorized(ctx, input.ControlID, authz.ActionDeleteControlAuditMapping)

	svc := r.ProboService(ctx, input.ControlID)

	_, _, err := svc.Controls.DeleteAuditMapping(ctx, input.ControlID, input.AuditID)
	if err != nil {
		return nil, types.UnlinkControlAuditOutput{}, fmt.Errorf("failed to unlink control audit: %w", err)
	}

	return nil, types.UnlinkControlAuditOutput{}, nil
}

func (r *Resolver) LinkControlSnapshotTool(ctx context.Context, req *mcp.CallToolRequest, input *types.LinkControlSnapshotInput) (*mcp.CallToolResult, types.LinkControlSnapshotOutput, error) {
	r.MustBeAuthorized(ctx, input.ControlID, authz.ActionCreateControlSnapshotMapping)

	svc := r.ProboService(ctx, input.ControlID)

	_, _, err := svc.Controls.CreateSnapshotMapping(ctx, input.ControlID, input.SnapshotID)
	if err != nil {
		return nil, types.LinkControlSnapshotOutput{}, fmt.Errorf("failed to link control snapshot: %w", err)
	}

	return nil, types.LinkControlSnapshotOutput{}, nil
}

func (r *Resolver) UnlinkControlSnapshotTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UnlinkControlSnapshotInput) (*mcp.CallToolResult, types.UnlinkControlSnapshotOutput, error) {
	r.MustBeAuthorized(ctx, input.ControlID, authz.ActionDeleteControlSnapshotMapping)

	svc := r.ProboService(ctx, input.ControlID)

	_, _, err := svc.Controls.DeleteSnapshotMapping(ctx, input.ControlID, input.SnapshotID)
	if err != nil {
		return nil, types.UnlinkControlSnapshotOutput{}, fmt.Errorf("failed to unlink control snapshot: %w", err)
	}

	return nil, types.UnlinkControlSnapshotOutput{}, nil
}

func (r *Resolver) ListTasksTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListTasksInput) (*mcp.CallToolResult, types.ListTasksOutput, error) {
	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListTasks)

	prb := r.ProboService(ctx, input.OrganizationID)

	pageOrderBy := page.OrderBy[coredata.TaskOrderField]{
		Field:     coredata.TaskOrderFieldCreatedAt,
		Direction: page.OrderDirectionDesc,
	}
	if input.OrderBy != nil {
		pageOrderBy = page.OrderBy[coredata.TaskOrderField]{
			Field:     input.OrderBy.Field,
			Direction: input.OrderBy.Direction,
		}
	}

	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)

	page, err := prb.Tasks.ListForOrganizationID(ctx, input.OrganizationID, cursor)
	if err != nil {
		panic(fmt.Errorf("cannot list organization tasks: %w", err))
	}

	return nil, types.NewListTasksOutput(page), nil
}

func (r *Resolver) GetTaskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetTaskInput) (*mcp.CallToolResult, types.GetTaskOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)

	prb := r.ProboService(ctx, input.ID)

	task, err := prb.Tasks.Get(ctx, input.ID)
	if err != nil {
		return nil, types.GetTaskOutput{}, fmt.Errorf("failed to get task: %w", err)
	}
	return nil, types.GetTaskOutput{
		Task: types.NewTask(task),
	}, nil
}

func (r *Resolver) AddTaskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddTaskInput) (*mcp.CallToolResult, types.AddTaskOutput, error) {
	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreateTask)

	svc := r.ProboService(ctx, input.OrganizationID)

	task, err := svc.Tasks.Create(
		ctx,
		probo.CreateTaskRequest{
			OrganizationID: input.OrganizationID,
			Name:           input.Name,
			Description:    input.Description,
			TimeEstimate:   input.TimeEstimate,
			Deadline:       input.Deadline,
			AssignedToID:   input.AssignedToID,
		},
	)
	if err != nil {
		return nil, types.AddTaskOutput{}, fmt.Errorf("failed to create task: %w", err)
	}
	return nil, types.AddTaskOutput{
		Task: types.NewTask(task),
	}, nil
}

func (r *Resolver) UpdateTaskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateTaskInput) (*mcp.CallToolResult, types.UpdateTaskOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionUpdateTask)

	svc := r.ProboService(ctx, input.ID)

	task, err := svc.Tasks.Update(
		ctx,
		probo.UpdateTaskRequest{
			TaskID:       input.ID,
			Name:         input.Name,
			Description:  UnwrapOmittable(input.Description),
			State:        input.State,
			TimeEstimate: UnwrapOmittable(input.TimeEstimate),
			Deadline:     UnwrapOmittable(input.Deadline),
		},
	)
	if err != nil {
		return nil, types.UpdateTaskOutput{}, fmt.Errorf("failed to update task: %w", err)
	}
	return nil, types.UpdateTaskOutput{
		Task: types.NewTask(task),
	}, nil
}

func (r *Resolver) AssignTaskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AssignTaskInput) (*mcp.CallToolResult, types.AssignTaskOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionAssignTask)

	svc := r.ProboService(ctx, input.ID)

	task, err := svc.Tasks.Assign(ctx, input.ID, input.AssignedToID)
	if err != nil {
		return nil, types.AssignTaskOutput{}, fmt.Errorf("failed to assign task: %w", err)
	}

	return nil, types.AssignTaskOutput{
		Task: types.NewTask(task),
	}, nil
}

func (r *Resolver) UnassignTaskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UnassignTaskInput) (*mcp.CallToolResult, types.UnassignTaskOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionUnassignTask)

	svc := r.ProboService(ctx, input.ID)

	task, err := svc.Tasks.Unassign(ctx, input.ID)
	if err != nil {
		return nil, types.UnassignTaskOutput{}, fmt.Errorf("failed to unassign task: %w", err)
	}
	return nil, types.UnassignTaskOutput{
		Task: types.NewTask(task),
	}, nil
}

func (r *Resolver) ListSnapshotsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListSnapshotsInput) (*mcp.CallToolResult, types.ListSnapshotsOutput, error) {
	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListSnapshots)

	prb := r.ProboService(ctx, input.OrganizationID)

	pageOrderBy := page.OrderBy[coredata.SnapshotOrderField]{
		Field:     coredata.SnapshotOrderFieldCreatedAt,
		Direction: page.OrderDirectionDesc,
	}
	if input.OrderBy != nil {
		pageOrderBy = page.OrderBy[coredata.SnapshotOrderField]{
			Field:     input.OrderBy.Field,
			Direction: input.OrderBy.Direction,
		}
	}

	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)

	page, err := prb.Snapshots.ListForOrganizationID(ctx, input.OrganizationID, cursor)
	if err != nil {
		panic(fmt.Errorf("cannot list organization snapshots: %w", err))
	}

	return nil, types.NewListSnapshotsOutput(page), nil
}

func (r *Resolver) GetSnapshotTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetSnapshotInput) (*mcp.CallToolResult, types.GetSnapshotOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)

	prb := r.ProboService(ctx, input.ID)

	snapshot, err := prb.Snapshots.Get(ctx, input.ID)
	if err != nil {
		return nil, types.GetSnapshotOutput{}, fmt.Errorf("failed to get snapshot: %w", err)
	}
	return nil, types.GetSnapshotOutput{
		Snapshot: types.NewSnapshot(snapshot),
	}, nil
}

func (r *Resolver) TakeSnapshotTool(ctx context.Context, req *mcp.CallToolRequest, input *types.TakeSnapshotInput) (*mcp.CallToolResult, types.TakeSnapshotOutput, error) {
	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreateSnapshot)

	prb := r.ProboService(ctx, input.OrganizationID)

	snapshot, err := prb.Snapshots.Create(
		ctx,
		&probo.CreateSnapshotRequest{
			OrganizationID: input.OrganizationID,
			Name:           input.Name,
			Description:    input.Description,
			Type:           input.Type,
		},
	)
	if err != nil {
		return nil, types.TakeSnapshotOutput{}, fmt.Errorf("failed to take snapshot: %w", err)
	}
	return nil, types.TakeSnapshotOutput{
		Snapshot: types.NewSnapshot(snapshot),
	}, nil
}

func (r *Resolver) ListDocumentsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListDocumentsInput) (*mcp.CallToolResult, types.ListDocumentsOutput, error) {
	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListDocuments)

	prb := r.ProboService(ctx, input.OrganizationID)

	pageOrderBy := page.OrderBy[coredata.DocumentOrderField]{
		Field:     coredata.DocumentOrderFieldCreatedAt,
		Direction: page.OrderDirectionDesc,
	}
	if input.OrderBy != nil {
		pageOrderBy = page.OrderBy[coredata.DocumentOrderField]{
			Field:     input.OrderBy.Field,
			Direction: input.OrderBy.Direction,
		}
	}

	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)

	documentFilter := coredata.NewDocumentFilter(nil)
	if input.Filter != nil {
		var query *string
		if input.Filter.Query != nil && *input.Filter.Query != "" {
			query = input.Filter.Query
		}

		documentFilter = coredata.NewDocumentFilter(query)
	}

	page, err := prb.Documents.ListByOrganizationID(ctx, input.OrganizationID, cursor, documentFilter)
	if err != nil {
		panic(fmt.Errorf("cannot list organization documents: %w", err))
	}

	return nil, types.NewListDocumentsOutput(page), nil
}

func (r *Resolver) GetDocumentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetDocumentInput) (*mcp.CallToolResult, types.GetDocumentOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)

	prb := r.ProboService(ctx, input.ID)

	document, err := prb.Documents.Get(ctx, input.ID)
	if err != nil {
		panic(fmt.Errorf("cannot get document: %w", err))
	}

	return nil, types.GetDocumentOutput{
		Document: types.NewDocument(document),
	}, nil
}

func (r *Resolver) AddDocumentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddDocumentInput) (*mcp.CallToolResult, types.AddDocumentOutput, error) {
	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreateDocument)

	svc := r.ProboService(ctx, input.OrganizationID)

	var trustCenterVisibility *coredata.TrustCenterVisibility
	if input.TrustCenterVisibility != nil {
		trustCenterVisibility = input.TrustCenterVisibility
	}

	document, documentVersion, err := svc.Documents.Create(
		ctx,
		probo.CreateDocumentRequest{
			OrganizationID:        input.OrganizationID,
			Title:                 input.Title,
			Content:               input.Content,
			OwnerID:               input.OwnerID,
			Classification:        input.Classification,
			DocumentType:          input.DocumentType,
			TrustCenterVisibility: trustCenterVisibility,
		},
	)
	if err != nil {
		panic(fmt.Errorf("cannot create document: %w", err))
	}

	return nil, types.NewAddDocumentOutput(document, documentVersion), nil
}

func (r *Resolver) UpdateDocumentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateDocumentInput) (*mcp.CallToolResult, types.UpdateDocumentOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionUpdateDocument)

	svc := r.ProboService(ctx, input.ID)

	document, err := svc.Documents.Update(
		ctx,
		probo.UpdateDocumentRequest{
			DocumentID:            input.ID,
			Title:                 input.Title,
			OwnerID:               input.OwnerID,
			Classification:        input.Classification,
			DocumentType:          input.DocumentType,
			TrustCenterVisibility: input.TrustCenterVisibility,
		},
	)
	if err != nil {
		panic(fmt.Errorf("cannot update document: %w", err))
	}

	return nil, types.UpdateDocumentOutput{
		Document: types.NewDocument(document),
	}, nil
}

func (r *Resolver) ListDocumentVersionsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListDocumentVersionsInput) (*mcp.CallToolResult, types.ListDocumentVersionsOutput, error) {
	r.MustBeAuthorized(ctx, input.DocumentID, authz.ActionDocumentVersion)

	pageOrderBy := page.OrderBy[coredata.DocumentVersionOrderField]{
		Field:     coredata.DocumentVersionOrderFieldCreatedAt,
		Direction: page.OrderDirectionDesc,
	}
	if input.OrderBy != nil {
		pageOrderBy = page.OrderBy[coredata.DocumentVersionOrderField]{
			Field:     input.OrderBy.Field,
			Direction: input.OrderBy.Direction,
		}
	}

	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)
	svc := r.ProboService(ctx, input.DocumentID)

	page, err := svc.Documents.ListVersions(ctx, input.DocumentID, cursor)
	if err != nil {
		panic(fmt.Errorf("cannot list document versions: %w", err))
	}

	return nil, types.NewListDocumentVersionsOutput(page), nil
}

func (r *Resolver) GetDocumentVersionTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetDocumentVersionInput) (*mcp.CallToolResult, types.GetDocumentVersionOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)

	svc := r.ProboService(ctx, input.ID)

	version, err := svc.Documents.GetVersion(ctx, input.ID)
	if err != nil {
		panic(fmt.Errorf("cannot get document version: %w", err))
	}

	return nil, types.GetDocumentVersionOutput{
		DocumentVersion: types.NewDocumentVersion(version),
	}, nil
}

func (r *Resolver) CreateDraftDocumentVersionTool(ctx context.Context, req *mcp.CallToolRequest, input *types.CreateDraftDocumentVersionInput) (*mcp.CallToolResult, types.CreateDraftDocumentVersionOutput, error) {
	r.MustBeAuthorized(ctx, input.DocumentID, authz.ActionCreateDraftDocumentVersion)

	svc := r.ProboService(ctx, input.DocumentID)

	draftVersion, err := svc.Documents.CreateDraft(ctx, input.DocumentID)
	if err != nil {
		panic(fmt.Errorf("cannot create draft document version: %w", err))
	}

	return nil, types.CreateDraftDocumentVersionOutput{
		DocumentVersion: types.NewDocumentVersion(draftVersion),
	}, nil
}

func (r *Resolver) UpdateDocumentVersionTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateDocumentVersionInput) (*mcp.CallToolResult, types.UpdateDocumentVersionOutput, error) {
	r.MustBeAuthorized(ctx, input.DocumentVersionID, authz.ActionUpdateDocumentVersion)

	svc := r.ProboService(ctx, input.DocumentVersionID)

	documentVersion, err := svc.Documents.UpdateVersion(
		ctx,
		probo.UpdateDocumentVersionRequest{
			ID:      input.DocumentVersionID,
			Content: input.Content,
		},
	)
	if err != nil {
		panic(fmt.Errorf("cannot update document version: %w", err))
	}

	return nil, types.UpdateDocumentVersionOutput{
		DocumentVersion: types.NewDocumentVersion(documentVersion),
	}, nil
}

func (r *Resolver) PublishDocumentVersionTool(ctx context.Context, req *mcp.CallToolRequest, input *types.PublishDocumentVersionInput) (*mcp.CallToolResult, types.PublishDocumentVersionOutput, error) {
	r.MustBeAuthorized(ctx, input.DocumentID, authz.ActionPublishDocumentVersion)

	svc := r.ProboService(ctx, input.DocumentID)

	user := serverauth.UserFromContext(ctx)

	document, documentVersion, err := svc.Documents.PublishVersion(ctx, input.DocumentID, user.ID, input.Changelog)
	if err != nil {
		panic(fmt.Errorf("cannot publish document version: %w", err))
	}

	return nil, types.PublishDocumentVersionOutput{
		Document:        types.NewDocument(document),
		DocumentVersion: types.NewDocumentVersion(documentVersion),
	}, nil
}

func (r *Resolver) ListDocumentVersionSignaturesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListDocumentVersionSignaturesInput) (*mcp.CallToolResult, types.ListDocumentVersionSignaturesOutput, error) {
	r.MustBeAuthorized(ctx, input.DocumentVersionID, authz.ActionDocumentVersion)

	prb := r.ProboService(ctx, input.DocumentVersionID)

	pageOrderBy := page.OrderBy[coredata.DocumentVersionSignatureOrderField]{
		Field:     coredata.DocumentVersionSignatureOrderFieldCreatedAt,
		Direction: page.OrderDirectionDesc,
	}
	if input.OrderBy != nil {
		pageOrderBy = page.OrderBy[coredata.DocumentVersionSignatureOrderField]{
			Field:     input.OrderBy.Field,
			Direction: input.OrderBy.Direction,
		}
	}

	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)

	var signatureFilter *coredata.DocumentVersionSignatureFilter
	if input.Filter != nil && input.Filter.States != nil && len(input.Filter.States) > 0 {
		signatureFilter = coredata.NewDocumentVersionSignatureFilter(input.Filter.States)
	} else {
		signatureFilter = coredata.NewDocumentVersionSignatureFilter(nil)
	}

	page, err := prb.Documents.ListSignatures(ctx, input.DocumentVersionID, cursor, signatureFilter)
	if err != nil {
		panic(fmt.Errorf("cannot list document version signatures: %w", err))
	}

	return nil, types.NewListDocumentVersionSignaturesOutput(page), nil
}

func (r *Resolver) GetDocumentVersionSignatureTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetDocumentVersionSignatureInput) (*mcp.CallToolResult, types.GetDocumentVersionSignatureOutput, error) {
	r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)

	prb := r.ProboService(ctx, input.ID)

	signature, err := prb.Documents.GetVersionSignature(ctx, input.ID)
	if err != nil {
		panic(fmt.Errorf("cannot get document version signature: %w", err))
	}

	return nil, types.GetDocumentVersionSignatureOutput{
		DocumentVersionSignature: types.NewDocumentVersionSignature(signature),
	}, nil
}

func (r *Resolver) RequestDocumentVersionSignatureTool(ctx context.Context, req *mcp.CallToolRequest, input *types.RequestDocumentVersionSignatureInput) (*mcp.CallToolResult, types.RequestDocumentVersionSignatureOutput, error) {
	r.MustBeAuthorized(ctx, input.DocumentVersionID, authz.ActionRequestSignature)

	svc := r.ProboService(ctx, input.DocumentVersionID)

	documentVersionSignature, err := svc.Documents.RequestSignature(
		ctx,
		probo.RequestSignatureRequest{
			DocumentVersionID: input.DocumentVersionID,
			Signatory:         input.SignatoryID,
		},
	)
	if err != nil {
		panic(fmt.Errorf("cannot request signature: %w", err))
	}

	return nil, types.RequestDocumentVersionSignatureOutput{
		DocumentVersionSignature: types.NewDocumentVersionSignature(documentVersionSignature),
	}, nil
}

func (r *Resolver) DeleteDraftDocumentVersionTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteDraftDocumentVersionInput) (*mcp.CallToolResult, types.DeleteDraftDocumentVersionOutput, error) {
	r.MustBeAuthorized(ctx, input.DocumentVersionID, authz.ActionDeleteDraftDocumentVersion)

	svc := r.ProboService(ctx, input.DocumentVersionID)

	err := svc.Documents.DeleteDraft(ctx, input.DocumentVersionID)
	if err != nil {
		panic(fmt.Errorf("cannot delete draft document version: %w", err))
	}

	return nil, types.DeleteDraftDocumentVersionOutput{
		DeletedDocumentVersionID: input.DocumentVersionID,
	}, nil
}

func (r *Resolver) DeleteDocumentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteDocumentInput) (*mcp.CallToolResult, types.DeleteDocumentOutput, error) {
	r.MustBeAuthorized(ctx, input.DocumentID, authz.ActionDeleteDocument)

	svc := r.ProboService(ctx, input.DocumentID)

	err := svc.Documents.SoftDelete(ctx, input.DocumentID)
	if err != nil {
		panic(fmt.Errorf("cannot soft delete document: %w", err))
	}

	return nil, types.DeleteDocumentOutput{
		DeletedDocumentID: input.DocumentID,
	}, nil
}

func (r *Resolver) CancelSignatureRequestTool(ctx context.Context, req *mcp.CallToolRequest, input *types.CancelSignatureRequestInput) (*mcp.CallToolResult, types.CancelSignatureRequestOutput, error) {
	r.MustBeAuthorized(ctx, input.DocumentVersionSignatureID, authz.ActionCancelSignatureRequest)

	svc := r.ProboService(ctx, input.DocumentVersionSignatureID)

	err := svc.Documents.CancelSignatureRequest(ctx, input.DocumentVersionSignatureID)
	if err != nil {
		panic(fmt.Errorf("cannot cancel signature request: %w", err))
	}

	return nil, types.CancelSignatureRequestOutput{
		DeletedDocumentVersionSignatureID: input.DocumentVersionSignatureID,
	}, nil
}