Stage 1：多 AP 基礎建設 — 設計規格

{
  "code": 1,
  "data": [
    {
      "uid": "string",
      "name": "string",
      "round_number": 1,
      "status": "preparing | in_progress | auditing | remediation | closed",
      "created_at": "2025-03-15T00:00:00"
    }
  ]
}

session.query(OscalAssessmentPlan)
    .join(ProjectAssessmentPlanMapping)
    .join(Project)
    .filter(Project.uid == project_uid)
    .order_by(OscalAssessmentPlan.created_at.desc())
    .all()

# 舊
class ProjectControlGroupListResource(MethodResource):
    def post(self, project_uid: str, ...):
        result = service.list_control_groups(project_uid=project_uid, ...)

# 新
class ProjectControlGroupListResource(MethodResource):
    def post(self, project_uid: str, ap_uid: str, ...):
        result = service.list_control_groups(ap_uid=ap_uid, ...)

# 舊
def list_control_groups(self, user_id, is_admin, project_uid, pager, sorts, **filters):

# 新
def list_control_groups(self, user_id, is_admin, ap_uid, pager, sorts, **filters):

# 舊：從 project_uid 推導 ap_id（假設 1:1）
mapping = session.query(ProjectAssessmentPlanMapping) \
    .join(Project) \
    .filter(Project.uid == project_uid) \
    .first()
ap_id = mapping.assessment_plan_id

# 新：直接用 ap_uid 查
ap = session.query(OscalAssessmentPlan) \
    .filter(OscalAssessmentPlan.uid == ap_uid) \
    .first()
if not ap:
    raise NotFound(GrcErrorCode.GRC_AP_NOT_FOUND)
ap_id = ap.id

# 取最新 AP（created_at 最大的那筆）
latest_mapping = session.query(ProjectAssessmentPlanMapping) \
    .filter(ProjectAssessmentPlanMapping.project_id == project_id) \
    .join(OscalAssessmentPlan) \
    .order_by(OscalAssessmentPlan.created_at.desc()) \
    .first()

# common/code/grc_error_code.py
GRC_AP_NOT_FOUND = ("稽核計畫不存在", "GRC_404015")