probo/pkg/coredata/migrations/20260429T150423Z.sql

-- Copyright (c) 2026 Probo Inc <hello@probo.com>.
--
-- Permission is hereby granted, free of charge, to any person obtaining a copy
-- of this software and associated documentation files (the "Software"), to deal
-- in the Software without restriction, including without limitation the rights
-- to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-- copies of the Software, and to permit persons to whom the Software is
-- furnished to do so, subject to the following conditions:
--
-- The above copyright notice and this permission notice shall be included in
-- all copies or substantial portions of the Software.
--
-- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-- IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-- FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-- AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-- LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-- OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-- SOFTWARE.

ALTER TABLE generated_documents
    ADD COLUMN risks_document_id TEXT REFERENCES documents(id) ON DELETE SET NULL;

-- Backfill controls_documents from the legacy controls_snapshots links.
-- For every snapshot type whose register is now an org-level generated
-- document, link each control that was attached to a snapshot to the
-- corresponding generated document. Best effort: skips rows whose target
-- document hasn't been created yet (the matching `cmd/migrate-*` data
-- migration must have already run). ON CONFLICT keeps the migration
-- idempotent and tolerant of pre-existing mappings.
INSERT INTO controls_documents (control_id, document_id, organization_id, tenant_id, created_at)
SELECT DISTINCT
    cs.control_id,
    CASE s.type
        WHEN 'RISKS'                 THEN gd.risks_document_id
        WHEN 'VENDORS'               THEN gd.vendors_document_id
        WHEN 'ASSETS'                THEN gd.asset_list_document_id
        WHEN 'DATA'                  THEN gd.data_document_id
        WHEN 'FINDINGS'              THEN gd.findings_document_id
        WHEN 'OBLIGATIONS'           THEN gd.obligations_document_id
        WHEN 'PROCESSING_ACTIVITIES' THEN gd.processing_activities_document_id
    END AS document_id,
    s.organization_id,
    s.tenant_id,
    NOW()
FROM controls_snapshots cs
INNER JOIN snapshots s ON s.id = cs.snapshot_id
LEFT JOIN generated_documents gd ON gd.organization_id = s.organization_id
WHERE s.type IN (
        'RISKS',
        'VENDORS',
        'ASSETS',
        'DATA',
        'FINDINGS',
        'OBLIGATIONS',
        'PROCESSING_ACTIVITIES'
    )
    AND CASE s.type
        WHEN 'RISKS'                 THEN gd.risks_document_id
        WHEN 'VENDORS'               THEN gd.vendors_document_id
        WHEN 'ASSETS'                THEN gd.asset_list_document_id
        WHEN 'DATA'                  THEN gd.data_document_id
        WHEN 'FINDINGS'              THEN gd.findings_document_id
        WHEN 'OBLIGATIONS'           THEN gd.obligations_document_id
        WHEN 'PROCESSING_ACTIVITIES' THEN gd.processing_activities_document_id
    END IS NOT NULL
ON CONFLICT DO NOTHING;

-- For STATEMENTS_OF_APPLICABILITY snapshots, the published document lives on
-- the source SOA (the live row, snapshot_id IS NULL). Link controls that
-- were attached to a SOA snapshot to that source SOA's document.
INSERT INTO controls_documents (control_id, document_id, organization_id, tenant_id, created_at)
SELECT DISTINCT
    cs.control_id,
    live_soa.document_id,
    s.organization_id,
    s.tenant_id,
    NOW()
FROM controls_snapshots cs
INNER JOIN snapshots s ON s.id = cs.snapshot_id
INNER JOIN statements_of_applicability snap_soa ON snap_soa.snapshot_id = s.id
INNER JOIN statements_of_applicability live_soa
    ON live_soa.id = snap_soa.source_id
    AND live_soa.snapshot_id IS NULL
WHERE s.type = 'STATEMENTS_OF_APPLICABILITY'
    AND live_soa.document_id IS NOT NULL
ON CONFLICT DO NOTHING;

-- Drop the trailing " List" suffix from previously published register
-- documents so the version title matches the new naming convention used by
-- the publish flow. Restricted to REGISTER document types so unrelated
-- documents that happen to share a title aren't touched.
UPDATE document_versions SET title = 'Assets'      WHERE title = 'Asset List'      AND document_type = 'REGISTER';
UPDATE document_versions SET title = 'Data'        WHERE title = 'Data List'       AND document_type = 'REGISTER';
UPDATE document_versions SET title = 'Findings'    WHERE title = 'Finding List'    AND document_type = 'REGISTER';
UPDATE document_versions SET title = 'Obligations' WHERE title = 'Obligation List' AND document_type = 'REGISTER';