probo/e2e/console/obligation_test.go

// Copyright (c) 2025-2026 Probo Inc <hello@probo.com>.
//
// Permission is hereby granted, free of charge, to any person obtaining a copy
// of this software and associated documentation files (the "Software"), to deal
// in the Software without restriction, including without limitation the rights
// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
// copies of the Software, and to permit persons to whom the Software is
// furnished to do so, subject to the following conditions:
//
// The above copyright notice and this permission notice shall be included in
// all copies or substantial portions of the Software.
//
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
// SOFTWARE.

package console_test

import (
	"testing"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
	"go.probo.inc/probo/e2e/internal/factory"
	"go.probo.inc/probo/e2e/internal/testutil"
)

func TestObligation_Create(t *testing.T) {
	t.Parallel()
	owner := testutil.NewClient(t, testutil.RoleOwner)
	profileID := factory.CreateUser(owner)

	query := `
		mutation CreateObligation($input: CreateObligationInput!) {
			createObligation(input: $input) {
				obligationEdge {
					node {
						id
						area
						source
						requirement
						regulator
						status
						type
					}
				}
			}
		}
	`

	var result struct {
		CreateObligation struct {
			ObligationEdge struct {
				Node struct {
					ID          string `json:"id"`
					Area        string `json:"area"`
					Source      string `json:"source"`
					Requirement string `json:"requirement"`
					Regulator   string `json:"regulator"`
					Status      string `json:"status"`
					Type        string `json:"type"`
				} `json:"node"`
			} `json:"obligationEdge"`
		} `json:"createObligation"`
	}

	err := owner.Execute(query, map[string]any{
		"input": map[string]any{
			"organizationId": owner.GetOrganizationID().String(),
			"area":           "Data Protection",
			"source":         "GDPR Article 5",
			"requirement":    "Data must be processed lawfully",
			"regulator":      "ICO",
			"ownerId":        profileID,
			"status":         "NON_COMPLIANT",
			"type":           "LEGAL",
		},
	}, &result)
	require.NoError(t, err)

	assert.NotEmpty(t, result.CreateObligation.ObligationEdge.Node.ID)
	assert.Equal(t, "Data Protection", result.CreateObligation.ObligationEdge.Node.Area)
	assert.Equal(t, "GDPR Article 5", result.CreateObligation.ObligationEdge.Node.Source)
	assert.Equal(t, "Data must be processed lawfully", result.CreateObligation.ObligationEdge.Node.Requirement)
	assert.Equal(t, "ICO", result.CreateObligation.ObligationEdge.Node.Regulator)
	assert.Equal(t, "NON_COMPLIANT", result.CreateObligation.ObligationEdge.Node.Status)
	assert.Equal(t, "LEGAL", result.CreateObligation.ObligationEdge.Node.Type)
}

func TestObligation_Update(t *testing.T) {
	t.Parallel()
	owner := testutil.NewClient(t, testutil.RoleOwner)
	profileID := factory.CreateUser(owner)

	// Create an obligation to update
	createQuery := `
		mutation CreateObligation($input: CreateObligationInput!) {
			createObligation(input: $input) {
				obligationEdge {
					node {
						id
					}
				}
			}
		}
	`

	var createResult struct {
		CreateObligation struct {
			ObligationEdge struct {
				Node struct {
					ID string `json:"id"`
				} `json:"node"`
			} `json:"obligationEdge"`
		} `json:"createObligation"`
	}

	err := owner.Execute(createQuery, map[string]any{
		"input": map[string]any{
			"organizationId": owner.GetOrganizationID().String(),
			"area":           "Original Area",
			"ownerId":        profileID,
			"status":         "NON_COMPLIANT",
			"type":           "LEGAL",
		},
	}, &createResult)
	require.NoError(t, err)

	obligationID := createResult.CreateObligation.ObligationEdge.Node.ID

	query := `
		mutation UpdateObligation($input: UpdateObligationInput!) {
			updateObligation(input: $input) {
				obligation {
					id
					area
					status
					type
				}
			}
		}
	`

	var result struct {
		UpdateObligation struct {
			Obligation struct {
				ID     string `json:"id"`
				Area   string `json:"area"`
				Status string `json:"status"`
				Type   string `json:"type"`
			} `json:"obligation"`
		} `json:"updateObligation"`
	}

	err = owner.Execute(query, map[string]any{
		"input": map[string]any{
			"id":     obligationID,
			"area":   "Updated Area",
			"status": "COMPLIANT",
			"type":   "CONTRACTUAL",
		},
	}, &result)
	require.NoError(t, err)

	assert.Equal(t, obligationID, result.UpdateObligation.Obligation.ID)
	assert.Equal(t, "Updated Area", result.UpdateObligation.Obligation.Area)
	assert.Equal(t, "COMPLIANT", result.UpdateObligation.Obligation.Status)
	assert.Equal(t, "CONTRACTUAL", result.UpdateObligation.Obligation.Type)
}

func TestObligation_Delete(t *testing.T) {
	t.Parallel()
	owner := testutil.NewClient(t, testutil.RoleOwner)
	profileID := factory.CreateUser(owner)

	// Create an obligation to delete
	createQuery := `
		mutation CreateObligation($input: CreateObligationInput!) {
			createObligation(input: $input) {
				obligationEdge {
					node {
						id
					}
				}
			}
		}
	`

	var createResult struct {
		CreateObligation struct {
			ObligationEdge struct {
				Node struct {
					ID string `json:"id"`
				} `json:"node"`
			} `json:"obligationEdge"`
		} `json:"createObligation"`
	}

	err := owner.Execute(createQuery, map[string]any{
		"input": map[string]any{
			"organizationId": owner.GetOrganizationID().String(),
			"area":           "Obligation to Delete",
			"ownerId":        profileID,
			"status":         "NON_COMPLIANT",
			"type":           "LEGAL",
		},
	}, &createResult)
	require.NoError(t, err)

	obligationID := createResult.CreateObligation.ObligationEdge.Node.ID

	deleteQuery := `
		mutation DeleteObligation($input: DeleteObligationInput!) {
			deleteObligation(input: $input) {
				deletedObligationId
			}
		}
	`

	var deleteResult struct {
		DeleteObligation struct {
			DeletedObligationID string `json:"deletedObligationId"`
		} `json:"deleteObligation"`
	}

	err = owner.Execute(deleteQuery, map[string]any{
		"input": map[string]any{
			"obligationId": obligationID,
		},
	}, &deleteResult)
	require.NoError(t, err)
	assert.Equal(t, obligationID, deleteResult.DeleteObligation.DeletedObligationID)
}

func TestObligation_List(t *testing.T) {
	t.Parallel()
	owner := testutil.NewClient(t, testutil.RoleOwner)
	profileID := factory.CreateUser(owner)

	// Create multiple obligations
	areas := []string{"Area A", "Area B", "Area C"}
	for _, area := range areas {
		query := `
			mutation CreateObligation($input: CreateObligationInput!) {
				createObligation(input: $input) {
					obligationEdge {
						node {
							id
						}
					}
				}
			}
		`

		var result struct {
			CreateObligation struct {
				ObligationEdge struct {
					Node struct {
						ID string `json:"id"`
					} `json:"node"`
				} `json:"obligationEdge"`
			} `json:"createObligation"`
		}

		err := owner.Execute(query, map[string]any{
			"input": map[string]any{
				"organizationId": owner.GetOrganizationID().String(),
				"area":           area,
				"ownerId":        profileID,
				"status":         "NON_COMPLIANT",
				"type":           "LEGAL",
			},
		}, &result)
		require.NoError(t, err)
	}

	query := `
		query GetObligations($id: ID!) {
			node(id: $id) {
				... on Organization {
					obligations(first: 10) {
						edges {
							node {
								id
								area
								status
							}
						}
						totalCount
					}
				}
			}
		}
	`

	var result struct {
		Node struct {
			Obligations struct {
				Edges []struct {
					Node struct {
						ID     string `json:"id"`
						Area   string `json:"area"`
						Status string `json:"status"`
					} `json:"node"`
				} `json:"edges"`
				TotalCount int `json:"totalCount"`
			} `json:"obligations"`
		} `json:"node"`
	}

	err := owner.Execute(query, map[string]any{
		"id": owner.GetOrganizationID().String(),
	}, &result)
	require.NoError(t, err)

	assert.GreaterOrEqual(t, result.Node.Obligations.TotalCount, 3)
}

func TestObligation_StatusValues(t *testing.T) {
	t.Parallel()
	owner := testutil.NewClient(t, testutil.RoleOwner)
	profileID := factory.CreateUser(owner)

	statuses := []string{"NON_COMPLIANT", "PARTIALLY_COMPLIANT", "COMPLIANT"}

	for _, status := range statuses {
		t.Run(status, func(t *testing.T) {
			query := `
				mutation CreateObligation($input: CreateObligationInput!) {
					createObligation(input: $input) {
						obligationEdge {
							node {
								id
								status
							}
						}
					}
				}
			`

			var result struct {
				CreateObligation struct {
					ObligationEdge struct {
						Node struct {
							ID     string `json:"id"`
							Status string `json:"status"`
						} `json:"node"`
					} `json:"obligationEdge"`
				} `json:"createObligation"`
			}

			err := owner.Execute(query, map[string]any{
				"input": map[string]any{
					"organizationId": owner.GetOrganizationID().String(),
					"area":           "Status Test " + status,
					"ownerId":        profileID,
					"status":         status,
					"type":           "LEGAL",
				},
			}, &result)
			require.NoError(t, err)

			assert.Equal(t, status, result.CreateObligation.ObligationEdge.Node.Status)
		})
	}
}

func TestObligation_TenantIsolation(t *testing.T) {
	t.Parallel()

	org1Owner := testutil.NewClient(t, testutil.RoleOwner)
	org2Owner := testutil.NewClient(t, testutil.RoleOwner)

	profileID := factory.CreateUser(org1Owner)

	var createResult struct {
		CreateObligation struct {
			ObligationEdge struct {
				Node struct {
					ID string `json:"id"`
				} `json:"node"`
			} `json:"obligationEdge"`
		} `json:"createObligation"`
	}

	err := org1Owner.Execute(`
		mutation($input: CreateObligationInput!) {
			createObligation(input: $input) {
				obligationEdge { node { id } }
			}
		}
	`, map[string]any{
		"input": map[string]any{
			"organizationId": org1Owner.GetOrganizationID().String(),
			"area":           "Risk Management",
			"requirement":    "Org1 Obligation",
			"ownerId":        profileID,
			"status":         "NON_COMPLIANT",
			"type":           "LEGAL",
		},
	}, &createResult)
	require.NoError(t, err)

	obligationID := createResult.CreateObligation.ObligationEdge.Node.ID

	t.Run("cannot read obligation from another organization", func(t *testing.T) {
		query := `
			query($id: ID!) {
				node(id: $id) {
					... on Obligation {
						id
						requirement
					}
				}
			}
		`

		var result struct {
			Node *struct {
				ID          string `json:"id"`
				Requirement string `json:"requirement"`
			} `json:"node"`
		}

		err := org2Owner.Execute(query, map[string]any{"id": obligationID}, &result)
		testutil.AssertNodeNotAccessible(t, err, result.Node == nil, "obligation")
	})

	t.Run("cannot update obligation from another organization", func(t *testing.T) {
		_, err := org2Owner.Do(`
			mutation($input: UpdateObligationInput!) {
				updateObligation(input: $input) {
					obligation { id }
				}
			}
		`, map[string]any{
			"input": map[string]any{
				"id":   obligationID,
				"area": "Hijacked Obligation",
			},
		})
		require.Error(t, err, "Should not be able to update obligation from another org")
	})

	t.Run("cannot delete obligation from another organization", func(t *testing.T) {
		_, err := org2Owner.Do(`
			mutation($input: DeleteObligationInput!) {
				deleteObligation(input: $input) {
					deletedObligationId
				}
			}
		`, map[string]any{
			"input": map[string]any{
				"obligationId": obligationID,
			},
		})
		require.Error(t, err, "Should not be able to delete obligation from another org")
	})

	t.Run("cannot create obligation referencing an owner from another organization", func(t *testing.T) {
		org2ProfileID := factory.CreateUser(org2Owner)

		_, err := org1Owner.Do(`
			mutation($input: CreateObligationInput!) {
				createObligation(input: $input) {
					obligationEdge { node { id } }
				}
			}
		`, map[string]any{
			"input": map[string]any{
				"organizationId": org1Owner.GetOrganizationID().String(),
				"area":           "Risk Management",
				"requirement":    factory.SafeName("Obligation"),
				"ownerId":        org2ProfileID,
				"status":         "NON_COMPLIANT",
				"type":           "LEGAL",
			},
		})
		require.Error(t, err, "must not accept an ownerId belonging to another organization")
	})

	t.Run("cannot update obligation to reference an owner from another organization", func(t *testing.T) {
		org2ProfileID := factory.CreateUser(org2Owner)

		_, err := org1Owner.Do(`
			mutation($input: UpdateObligationInput!) {
				updateObligation(input: $input) {
					obligation { id }
				}
			}
		`, map[string]any{
			"input": map[string]any{
				"id":      obligationID,
				"ownerId": org2ProfileID,
			},
		})
		require.Error(t, err, "must not accept an ownerId belonging to another organization")
	})
}