fix(risks): CSV import of risks and assets fails silently

[alex-dembele]

Issue

migration_service.go: The CSV import for risks and assets
returns nil without actually importing anything (TODO: Implement actual risk import logic). The front-end (/risks/import page) reports success even though no
data is created.

Impact

Immediate loss of trust: the user believes they have imported their existing
inventory, sees nothing appear, and receives no error message explaining
why.

Expected Fix

• Actually implement parsing and creation of risks/assets from the CSV.
• Pending full implementation, explicitly fail the call
  (error status + clear UI message) rather than returning a silent, false success.
• Add a test verifying that CSV rows are correctly saved to the database.

Severity

Critical — silent data loss / misleading the user.

[alex-dembele]

audit — 2026-09-25

Verified: the observed state differs from the description, and the defect is broader than described.

• POST /risks/import is not mounted. No route in backend/cmd/server/main.go matches it (grep -n 'risks/import' backend/cmd/server/main.go returns nothing). MigrationHandler (internal/handler/organization_handler.go:206-284) is never constructed in main.go.
• The stub described here exists but is unreachable: internal/service/migration_service.go:258 and :285 (TODO: Implement actual risk/asset import logic).
• The page (frontend/src/pages/ImportRisks.tsx:154) posts to that non-existent route. The user therefore gets the error toast errors.failedToImportRisks, not a false success. The feature is still a façade: a menu entry that can never work.
• The downloadable template (ImportRisks.tsx, handleDownloadTemplate) gives Probability,Impact on the legacy 1-5 scale (3,4). The frozen formula takes P ∈ [0,1] and I ∈ [0,10]. A real import would need an explicit conversion, or it would produce wrong scores.

Criteria: numbered so the issue meets the Ready definition.

1. POST /risks/import is mounted, protected by risk:create and the plan cap (capRisks), and filtered by the session's tenant_id.
2. The import runs through CreateRiskUseCase (so the score comes from pkg/scoring, see fix(risk): create and update store P × I without asset criticality #792) inside one transaction: a file with an invalid row imports nothing and returns the line and column of every error.
3. The template uses the product's scales (P 0-1, I 0-10). A legacy 1-5 file is either rejected with an explicit message or converted by a documented rule, never interpreted silently.
4. The response reports created, rejected and errors[], and the UI shows exactly that. No success toast unless created > 0.
5. Tests: import Success (N rows persisted and scored), Validation (a bad row means zero rows persisted), Unauthorized (no risk:create gives 403), and cross-tenant (the rows land only in the caller's tenant).
6. If the import is not delivered by the end of Sprint 2 of the launch board, the menu entry and the route risks/import are removed from the frontend (rule 12: invent nothing).

Asset import (:285) is out of scope for launch. It gets its own issue if a pilot asks for it.

Next: Sprint 1 of the launch board.
Blocked on: nothing

---

Generated by Claude Code