feat(controls): add endpoints to link policies, tasks, and requirements to controls

- Implemented new API endpoints in ControlsController for linking existing policies, tasks, and requirements to a control.
- Added corresponding DTOs: LinkPoliciesDto, LinkTasksDto, and LinkRequirementsToControlDto.
- Enhanced ControlsService with methods to handle linking logic and validation.
- Updated UI components to support linking actions, including LinkPolicySheet, LinkTaskSheet, and LinkRequirementForControlSheet.
- Improved data fetching with useControlOptions hook for better management of linked items.

This update enhances the control management capabilities, allowing users to effectively link existing resources to controls.

Author: carhartlewis

apps/api/src/controls/controls.controller.ts

@@ -20,6 +20,9 @@ import { RequirePermission } from '../auth/require-permission.decorator';
 import { OrganizationId } from '../auth/auth-context.decorator';
 import { ControlsService } from './controls.service';
 import { CreateControlDto } from './dto/create-control.dto';
+import { LinkPoliciesDto } from './dto/link-policies.dto';
+import { LinkTasksDto } from './dto/link-tasks.dto';
+import { LinkRequirementsToControlDto } from './dto/link-requirements.dto';
 
 @ApiTags('Controls')
 @ApiBearerAuth()
@@ -92,6 +95,47 @@ export class ControlsController {
     return this.controlsService.create(organizationId, dto);
   }
 
+  @Post(':id/policies/link')
+  @RequirePermission('control', 'update')
+  @ApiOperation({ summary: 'Link existing policies to a control' })
+  async linkPolicies(
+    @OrganizationId() organizationId: string,
+    @Param('id') id: string,
+    @Body() dto: LinkPoliciesDto,
+  ) {
+    return this.controlsService.linkPolicies(
+      id,
+      organizationId,
+      dto.policyIds,
+    );
+  }
+
+  @Post(':id/tasks/link')
+  @RequirePermission('control', 'update')
+  @ApiOperation({ summary: 'Link existing tasks to a control' })
+  async linkTasks(
+    @OrganizationId() organizationId: string,
+    @Param('id') id: string,
+    @Body() dto: LinkTasksDto,
+  ) {
+    return this.controlsService.linkTasks(id, organizationId, dto.taskIds);
+  }
+
+  @Post(':id/requirements/link')
+  @RequirePermission('control', 'update')
+  @ApiOperation({ summary: 'Link existing requirements to a control' })
+  async linkRequirements(
+    @OrganizationId() organizationId: string,
+    @Param('id') id: string,
+    @Body() dto: LinkRequirementsToControlDto,
+  ) {
+    return this.controlsService.linkRequirements(
+      id,
+      organizationId,
+      dto.requirements,
+    );
+  }
+
   @Delete(':id')
   @RequirePermission('control', 'delete')
   @ApiOperation({ summary: 'Delete a control' })

apps/api/src/controls/controls.service.ts

@@ -1,4 +1,8 @@
-import { Injectable, NotFoundException } from '@nestjs/common';
+import {
+  BadRequestException,
+  Injectable,
+  NotFoundException,
+} from '@nestjs/common';
 import { db, Prisma } from '@db';
 import { CreateControlDto } from './dto/create-control.dto';
 
@@ -193,6 +197,115 @@ export class ControlsService {
     return control;
   }
 
+  private async ensureControl(controlId: string, organizationId: string) {
+    const control = await db.control.findUnique({
+      where: { id: controlId, organizationId },
+      select: { id: true },
+    });
+    if (!control) {
+      throw new NotFoundException('Control not found');
+    }
+    return control;
+  }
+
+  async linkPolicies(
+    controlId: string,
+    organizationId: string,
+    policyIds: string[],
+  ) {
+    await this.ensureControl(controlId, organizationId);
+
+    const policies = await db.policy.findMany({
+      where: { id: { in: policyIds }, organizationId },
+      select: { id: true },
+    });
+    if (policies.length === 0) {
+      throw new BadRequestException('No valid policies to link');
+    }
+
+    await db.control.update({
+      where: { id: controlId },
+      data: { policies: { connect: policies.map((p) => ({ id: p.id })) } },
+    });
+
+    return { count: policies.length };
+  }
+
+  async linkTasks(
+    controlId: string,
+    organizationId: string,
+    taskIds: string[],
+  ) {
+    await this.ensureControl(controlId, organizationId);
+
+    const tasks = await db.task.findMany({
+      where: { id: { in: taskIds }, organizationId },
+      select: { id: true },
+    });
+    if (tasks.length === 0) {
+      throw new BadRequestException('No valid tasks to link');
+    }
+
+    await db.control.update({
+      where: { id: controlId },
+      data: { tasks: { connect: tasks.map((t) => ({ id: t.id })) } },
+    });
+
+    return { count: tasks.length };
+  }
+
+  async linkRequirements(
+    controlId: string,
+    organizationId: string,
+    mappings: { requirementId: string; frameworkInstanceId: string }[],
+  ) {
+    await this.ensureControl(controlId, organizationId);
+
+    const frameworkInstanceIds = Array.from(
+      new Set(mappings.map((m) => m.frameworkInstanceId)),
+    );
+    const instances = await db.frameworkInstance.findMany({
+      where: { id: { in: frameworkInstanceIds }, organizationId },
+      select: { id: true, frameworkId: true },
+    });
+    const instanceByfId = new Map(instances.map((i) => [i.id, i.frameworkId]));
+
+    const requirementIds = Array.from(
+      new Set(mappings.map((m) => m.requirementId)),
+    );
+    const requirements = await db.frameworkEditorRequirement.findMany({
+      where: {
+        id: { in: requirementIds },
+        OR: [{ organizationId: null }, { organizationId }],
+      },
+      select: { id: true, frameworkId: true },
+    });
+    const reqFrameworkById = new Map(
+      requirements.map((r) => [r.id, r.frameworkId]),
+    );
+
+    const validMappings = mappings.filter((m) => {
+      const instanceFwId = instanceByfId.get(m.frameworkInstanceId);
+      const reqFwId = reqFrameworkById.get(m.requirementId);
+      return Boolean(instanceFwId) && instanceFwId === reqFwId;
+    });
+
+    if (validMappings.length === 0) {
+      throw new BadRequestException('No valid requirements to link');
+    }
+
+    await db.requirementMap.createMany({
+      data: validMappings.map((m) => ({
+        controlId,
+        requirementId: m.requirementId,
+        frameworkInstanceId: m.frameworkInstanceId,
+      })),
+      skipDuplicates: true,
+    });
+
+    return { count: validMappings.length };
+  }
+
   async delete(controlId: string, organizationId: string) {
     const control = await db.control.findUnique({
       where: {

apps/api/src/controls/dto/link-policies.dto.ts

@@ -0,0 +1,10 @@
+import { ArrayMinSize, IsArray, IsString } from 'class-validator';
+import { ApiProperty } from '@nestjs/swagger';
+
+export class LinkPoliciesDto {
+  @ApiProperty({ description: 'Policy IDs to link to the control', type: [String] })
+  @IsArray()
+  @ArrayMinSize(1)
+  @IsString({ each: true })
+  policyIds: string[];
+}

apps/api/src/controls/dto/link-requirements.dto.ts

@@ -0,0 +1,30 @@
+import {
+  ArrayMinSize,
+  IsArray,
+  IsString,
+  ValidateNested,
+} from 'class-validator';
+import { Type } from 'class-transformer';
+import { ApiProperty } from '@nestjs/swagger';
+
+export class LinkRequirementMappingDto {
+  @ApiProperty({ description: 'Requirement ID' })
+  @IsString()
+  requirementId: string;
+
+  @ApiProperty({ description: 'Framework instance ID' })
+  @IsString()
+  frameworkInstanceId: string;
+}
+
+export class LinkRequirementsToControlDto {
+  @ApiProperty({
+    description: 'Requirement + framework instance pairs to link',
+    type: [LinkRequirementMappingDto],
+  })
+  @IsArray()
+  @ArrayMinSize(1)
+  @ValidateNested({ each: true })
+  @Type(() => LinkRequirementMappingDto)
+  requirements: LinkRequirementMappingDto[];
+}

apps/api/src/controls/dto/link-tasks.dto.ts

@@ -0,0 +1,10 @@
+import { ArrayMinSize, IsArray, IsString } from 'class-validator';
+import { ApiProperty } from '@nestjs/swagger';
+
+export class LinkTasksDto {
+  @ApiProperty({ description: 'Task IDs to link to the control', type: [String] })
+  @IsArray()
+  @ArrayMinSize(1)
+  @IsString({ each: true })
+  taskIds: string[];
+}

apps/app/src/app/(app)/[orgId]/controls/[controlId]/components/PoliciesTable.tsx

@@ -87,7 +87,14 @@ export function PoliciesTable({ policies, orgId }: PoliciesTableProps) {
                   }
                 }}
               >
-                <TableCell>{policy.name}</TableCell>
+                <TableCell>
+                  <span
+                    className="block max-w-[420px] truncate text-sm"
+                    title={policy.name}
+                  >
+                    {policy.name}
+                  </span>
+                </TableCell>
                 <TableCell>{new Date(policy.createdAt).toLocaleDateString()}</TableCell>
                 <TableCell>
                   <StatusIndicator status={policy.status} />

apps/app/src/app/(app)/[orgId]/controls/[controlId]/components/RequirementsTable.tsx

@@ -74,46 +74,61 @@ export function RequirementsTable({ requirements, orgId }: RequirementsTableProp
       <Table variant="bordered">
         <TableHeader>
           <TableRow>
+            <TableHead>Identifier</TableHead>
             <TableHead>Name</TableHead>
             <TableHead>Description</TableHead>
           </TableRow>
         </TableHeader>
         <TableBody>
           {filteredRequirements.length === 0 ? (
             <TableRow>
-              <TableCell colSpan={2}>
+              <TableCell colSpan={3}>
                 <Text size="sm" variant="muted">
                   No requirements found.
                 </Text>
               </TableCell>
             </TableRow>
           ) : (
-            filteredRequirements.map((requirement) => (
-              <TableRow
-                key={requirement.id}
-                role="button"
-                tabIndex={0}
-                style={{ cursor: 'pointer' }}
-                onClick={() => handleRowClick(requirement)}
-                onKeyDown={(event) => {
-                  if (event.key === 'Enter' || event.key === ' ') {
-                    event.preventDefault();
-                    handleRowClick(requirement);
-                  }
-                }}
-              >
-                <TableCell>
-                  <span className="line-clamp-2 h-10 max-w-[600px] truncate text-wrap">
-                    {requirement.requirement.name}
-                  </span>
-                </TableCell>
-                <TableCell>
-                  <span className="line-clamp-2 h-10 max-w-[600px] truncate text-wrap">
-                    {requirement.requirement.description}
-                  </span>
-                </TableCell>
-              </TableRow>
-            ))
+            filteredRequirements.map((requirement) => {
+              const identifier = requirement.requirement.identifier?.trim();
+              const name = requirement.requirement.name;
+              const description = requirement.requirement.description;
+              return (
+                <TableRow
+                  key={requirement.id}
+                  role="button"
+                  tabIndex={0}
+                  style={{ cursor: 'pointer' }}
+                  onClick={() => handleRowClick(requirement)}
+                  onKeyDown={(event) => {
+                    if (event.key === 'Enter' || event.key === ' ') {
+                      event.preventDefault();
+                      handleRowClick(requirement);
+                    }
+                  }}
+                >
+                  <TableCell>
+                    <span className="text-sm">{identifier || '—'}</span>
+                  </TableCell>
+                  <TableCell>
+                    <span
+                      className="block max-w-[280px] truncate text-sm"
+                      title={name}
+                    >
+                      {name}
+                    </span>
+                  </TableCell>
+                  <TableCell>
+                    <span
+                      className="block max-w-[420px] truncate text-sm"
+                      title={description}
+                    >
+                      {description}
+                    </span>
+                  </TableCell>
+                </TableRow>
+              );
+            })
           )}
         </TableBody>
       </Table>

apps/app/src/app/(app)/[orgId]/controls/[controlId]/components/TasksTable.tsx

@@ -89,9 +89,21 @@ export function TasksTable({ tasks, orgId }: TasksTableProps) {
                   }
                 }}
               >
-                <TableCell>{task.title}</TableCell>
                 <TableCell>
-                  <span className="line-clamp-1 capitalize">{task.description}</span>
+                  <span
+                    className="block max-w-[280px] truncate text-sm"
+                    title={task.title}
+                  >
+                    {task.title}
+                  </span>
+                </TableCell>
+                <TableCell>
+                  <span
+                    className="block max-w-[420px] truncate text-sm"
+                    title={task.description}
+                  >
+                    {task.description}
+                  </span>
                 </TableCell>
                 <TableCell>
                   <StatusIndicator status={task.status} />