Replace the old snapshot-based system for vendors with the publish document system, mirroring the prior processing activity / DPIA / TIA migration. Includes the GraphQL mutation, MCP tool, CLI command, n8n operation, frontend publish dialog, e2e tests, and a prosemirror register template covering vendor profile fields plus per-vendor sections for services, contacts, risk assessments, compliance reports, BAA and DPA agreements. The vendor register lives as a generated DocumentTypeRegister document on the organization, reused across publishes (the major version bumps on every republish). Approvers can be passed in to create a draft pending approval; otherwise the version is published immediately. The frontend Vendors page exposes a Publish button and a Document link button when the document exists, and pre-fills the previous default approvers. Remove snapshot mode entirely from vendors and their sub-entities: drop snapshotId/sourceId from GraphQL Vendor type and VendorFilter; remove SnapshotsTypeVendors from the snapshot registry and delete Vendors.Snapshot, VendorSnapshotter interface and all *.InsertVendorSnapshots methods on contacts, services, risk assessments, compliance reports, BAA and DPA. Drop the snapshot routes and banner from the frontend. The snapshot_id columns remain in the database but are now filtered out with snapshot_id IS NULL. Add Get/Upsert/Clear GeneratedDocumentID methods on Vendor backed by a new vendors_document_id column on generated_documents, matching the ProcessingActivity/Finding/Obligation pattern. Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
330 lines
6.8 KiB
Go
330 lines
6.8 KiB
Go
// Copyright (c) 2025-2026 Probo Inc <hello@getprobo.com>.
|
|
//
|
|
// Permission to use, copy, modify, and/or distribute this software for any
|
|
// purpose with or without fee is hereby granted, provided that the above
|
|
// copyright notice and this permission notice appear in all copies.
|
|
//
|
|
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
|
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
|
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
|
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
|
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
|
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
|
// PERFORMANCE OF THIS SOFTWARE.
|
|
|
|
package coredata
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"fmt"
|
|
"maps"
|
|
"time"
|
|
|
|
"github.com/jackc/pgx/v5"
|
|
"go.gearno.de/kit/pg"
|
|
"go.probo.inc/probo/pkg/gid"
|
|
"go.probo.inc/probo/pkg/page"
|
|
)
|
|
|
|
type (
|
|
VendorService struct {
|
|
ID gid.GID `db:"id"`
|
|
OrganizationID gid.GID `db:"organization_id"`
|
|
VendorID gid.GID `db:"vendor_id"`
|
|
Name string `db:"name"`
|
|
Description *string `db:"description"`
|
|
CreatedAt time.Time `db:"created_at"`
|
|
UpdatedAt time.Time `db:"updated_at"`
|
|
}
|
|
|
|
VendorServices []*VendorService
|
|
)
|
|
|
|
func (vs VendorService) CursorKey(orderBy VendorServiceOrderField) page.CursorKey {
|
|
switch orderBy {
|
|
case VendorServiceOrderFieldCreatedAt:
|
|
return page.CursorKey{ID: vs.ID, Value: vs.CreatedAt}
|
|
case VendorServiceOrderFieldName:
|
|
return page.CursorKey{ID: vs.ID, Value: vs.Name}
|
|
}
|
|
|
|
panic(fmt.Sprintf("unsupported order by: %s", orderBy))
|
|
}
|
|
|
|
func (vs *VendorService) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
|
|
q := `SELECT organization_id FROM vendor_services WHERE id = $1 LIMIT 1;`
|
|
|
|
var organizationID gid.GID
|
|
if err := conn.QueryRow(ctx, q, vs.ID).Scan(&organizationID); err != nil {
|
|
if errors.Is(err, pgx.ErrNoRows) {
|
|
return nil, ErrResourceNotFound
|
|
}
|
|
return nil, fmt.Errorf("cannot query vendor service authorization attributes: %w", err)
|
|
}
|
|
|
|
return map[string]string{"organization_id": organizationID.String()}, nil
|
|
}
|
|
|
|
func (vs *VendorService) LoadByID(
|
|
ctx context.Context,
|
|
conn pg.Querier,
|
|
scope Scoper,
|
|
vendorServiceID gid.GID,
|
|
) error {
|
|
q := `
|
|
SELECT
|
|
id,
|
|
organization_id,
|
|
vendor_id,
|
|
name,
|
|
description,
|
|
created_at,
|
|
updated_at
|
|
FROM
|
|
vendor_services
|
|
WHERE
|
|
%s
|
|
AND id = @vendor_service_id
|
|
LIMIT 1;
|
|
`
|
|
|
|
q = fmt.Sprintf(q, scope.SQLFragment())
|
|
|
|
args := pgx.StrictNamedArgs{"vendor_service_id": vendorServiceID}
|
|
maps.Copy(args, scope.SQLArguments())
|
|
|
|
rows, err := conn.Query(ctx, q, args)
|
|
if err != nil {
|
|
return fmt.Errorf("cannot query vendor service: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
|
|
vendorService, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[VendorService])
|
|
if err != nil {
|
|
if errors.Is(err, pgx.ErrNoRows) {
|
|
return ErrResourceNotFound
|
|
}
|
|
|
|
return fmt.Errorf("cannot collect vendor service: %w", err)
|
|
}
|
|
|
|
*vs = vendorService
|
|
|
|
return nil
|
|
}
|
|
|
|
func (vs *VendorServices) LoadByVendorID(
|
|
ctx context.Context,
|
|
conn pg.Querier,
|
|
scope Scoper,
|
|
vendorID gid.GID,
|
|
cursor *page.Cursor[VendorServiceOrderField],
|
|
) error {
|
|
q := `
|
|
SELECT
|
|
id,
|
|
organization_id,
|
|
vendor_id,
|
|
name,
|
|
description,
|
|
created_at,
|
|
updated_at
|
|
FROM
|
|
vendor_services
|
|
WHERE
|
|
%s
|
|
AND vendor_id = @vendor_id
|
|
AND snapshot_id IS NULL
|
|
AND %s
|
|
`
|
|
q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
|
|
|
|
args := pgx.StrictNamedArgs{
|
|
"vendor_id": vendorID,
|
|
}
|
|
maps.Copy(args, scope.SQLArguments())
|
|
maps.Copy(args, cursor.SQLArguments())
|
|
|
|
rows, err := conn.Query(ctx, q, args)
|
|
if err != nil {
|
|
return fmt.Errorf("cannot query vendor services: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
|
|
vendorServices, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[VendorService])
|
|
if err != nil {
|
|
return fmt.Errorf("cannot collect vendor services: %w", err)
|
|
}
|
|
|
|
*vs = vendorServices
|
|
|
|
return nil
|
|
}
|
|
|
|
func (vs *VendorServices) LoadByVendorIDs(
|
|
ctx context.Context,
|
|
conn pg.Querier,
|
|
scope Scoper,
|
|
vendorIDs []gid.GID,
|
|
) error {
|
|
if len(vendorIDs) == 0 {
|
|
*vs = VendorServices{}
|
|
return nil
|
|
}
|
|
|
|
q := `
|
|
SELECT
|
|
id,
|
|
organization_id,
|
|
vendor_id,
|
|
name,
|
|
description,
|
|
created_at,
|
|
updated_at
|
|
FROM
|
|
vendor_services
|
|
WHERE
|
|
%s
|
|
AND vendor_id = ANY(@vendor_ids)
|
|
AND snapshot_id IS NULL
|
|
ORDER BY
|
|
vendor_id, name ASC
|
|
`
|
|
q = fmt.Sprintf(q, scope.SQLFragment())
|
|
|
|
ids := make([]string, len(vendorIDs))
|
|
for i, id := range vendorIDs {
|
|
ids[i] = id.String()
|
|
}
|
|
|
|
args := pgx.StrictNamedArgs{"vendor_ids": ids}
|
|
maps.Copy(args, scope.SQLArguments())
|
|
|
|
rows, err := conn.Query(ctx, q, args)
|
|
if err != nil {
|
|
return fmt.Errorf("cannot query vendor services: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
|
|
vendorServices, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[VendorService])
|
|
if err != nil {
|
|
return fmt.Errorf("cannot collect vendor services: %w", err)
|
|
}
|
|
|
|
*vs = vendorServices
|
|
|
|
return nil
|
|
}
|
|
|
|
func (vs VendorService) Insert(
|
|
ctx context.Context,
|
|
conn pg.Tx,
|
|
scope Scoper,
|
|
) error {
|
|
q := `
|
|
INSERT INTO
|
|
vendor_services (
|
|
tenant_id,
|
|
id,
|
|
organization_id,
|
|
vendor_id,
|
|
name,
|
|
description,
|
|
created_at,
|
|
updated_at
|
|
)
|
|
VALUES (
|
|
@tenant_id,
|
|
@vendor_service_id,
|
|
@organization_id,
|
|
@vendor_id,
|
|
@name,
|
|
@description,
|
|
@created_at,
|
|
@updated_at
|
|
)
|
|
`
|
|
|
|
args := pgx.StrictNamedArgs{
|
|
"tenant_id": scope.GetTenantID(),
|
|
"vendor_service_id": vs.ID,
|
|
"organization_id": vs.OrganizationID,
|
|
"vendor_id": vs.VendorID,
|
|
"name": vs.Name,
|
|
"description": vs.Description,
|
|
"created_at": vs.CreatedAt,
|
|
"updated_at": vs.UpdatedAt,
|
|
}
|
|
|
|
_, err := conn.Exec(ctx, q, args)
|
|
if err != nil {
|
|
return fmt.Errorf("cannot insert vendor service: %w", err)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func (vs VendorService) Update(
|
|
ctx context.Context,
|
|
conn pg.Tx,
|
|
scope Scoper,
|
|
) error {
|
|
q := `
|
|
UPDATE
|
|
vendor_services
|
|
SET
|
|
name = @name,
|
|
description = @description,
|
|
updated_at = @updated_at
|
|
WHERE
|
|
%s
|
|
AND id = @vendor_service_id
|
|
AND snapshot_id IS NULL
|
|
`
|
|
|
|
q = fmt.Sprintf(q, scope.SQLFragment())
|
|
|
|
args := pgx.StrictNamedArgs{
|
|
"vendor_service_id": vs.ID,
|
|
"name": vs.Name,
|
|
"description": vs.Description,
|
|
"updated_at": vs.UpdatedAt,
|
|
}
|
|
maps.Copy(args, scope.SQLArguments())
|
|
|
|
_, err := conn.Exec(ctx, q, args)
|
|
if err != nil {
|
|
return fmt.Errorf("cannot update vendor service: %w", err)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func (vs VendorService) Delete(
|
|
ctx context.Context,
|
|
conn pg.Tx,
|
|
scope Scoper,
|
|
) error {
|
|
q := `
|
|
DELETE FROM
|
|
vendor_services
|
|
WHERE
|
|
%s
|
|
AND id = @vendor_service_id
|
|
AND snapshot_id IS NULL
|
|
`
|
|
|
|
q = fmt.Sprintf(q, scope.SQLFragment())
|
|
|
|
args := pgx.StrictNamedArgs{"vendor_service_id": vs.ID}
|
|
maps.Copy(args, scope.SQLArguments())
|
|
|
|
_, err := conn.Exec(ctx, q, args)
|
|
if err != nil {
|
|
return fmt.Errorf("cannot delete vendor service: %w", err)
|
|
}
|
|
|
|
return nil
|
|
}
|