Add configurable compliance portal commitment cards

The compliance portal home page rendered security-commitment cards from a hardcoded placeholder POJO. Back them with real, per-organization data that admins configure in the console and the portal loads over the trust center GraphQL API. Model two entities under the trust center: a commitment group (title, description, rank) and a commitment card (icon, eyebrow, title, description, rank). The card icon is a curated enum mapped to a Phosphor icon in the portal. New entities adopt the compliance_portal_ prefix as the start of the broader rename away from trust_center_ naming. Expose the groups and cards read-only on the public trust API and with full CRUD on the console API, add a Commitments tab to the compliance page, and replace the placeholder section with a Relay-driven one. Signed-off-by: Émile Ré <emile@probo.com>
2026-07-16 13:36:44 +02:00
parent 936162d5c7
commit 0b146a4054
39 changed files with 4079 additions and 175 deletions
--- a/pkg/trust/compliance_portal_commitment_group_service.go
+++ b/pkg/trust/compliance_portal_commitment_group_service.go
@@ -0,0 +1,83 @@
+// Copyright (c) 2026 Probo Inc <hello@probo.com>.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+package trust
+
+import (
+	"context"
+	"fmt"
+
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type CompliancePortalCommitmentGroupService struct {
+	svc *Service
+}
+
+func (s CompliancePortalCommitmentGroupService) ListForTrustCenterID(
+	ctx context.Context,
+	scope coredata.Scoper,
+	trustCenterID gid.GID,
+	cursor *page.Cursor[coredata.CompliancePortalCommitmentGroupOrderField],
+) (*page.Page[*coredata.CompliancePortalCommitmentGroup, coredata.CompliancePortalCommitmentGroupOrderField], error) {
+	var groups coredata.CompliancePortalCommitmentGroups
+
+	err := s.svc.pg.WithConn(ctx, func(ctx context.Context, conn pg.Querier) error {
+		err := groups.LoadByTrustCenterID(ctx, conn, scope, trustCenterID, cursor)
+		if err != nil {
+			return fmt.Errorf("cannot load compliance portal commitment groups: %w", err)
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(groups, cursor), nil
+}
+
+func (s CompliancePortalCommitmentGroupService) Get(
+	ctx context.Context,
+	scope coredata.Scoper,
+	groupID gid.GID,
+) (*coredata.CompliancePortalCommitmentGroup, error) {
+	group := &coredata.CompliancePortalCommitmentGroup{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(ctx context.Context, conn pg.Querier) error {
+			err := group.LoadByID(ctx, conn, scope, groupID)
+			if err != nil {
+				return fmt.Errorf("cannot load compliance portal commitment group: %w", err)
+			}
+
+			return nil
+		},
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return group, nil
+}
--- a/pkg/trust/compliance_portal_commitment_service.go
+++ b/pkg/trust/compliance_portal_commitment_service.go
@@ -0,0 +1,83 @@
+// Copyright (c) 2026 Probo Inc <hello@probo.com>.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+package trust
+
+import (
+	"context"
+	"fmt"
+
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type CompliancePortalCommitmentService struct {
+	svc *Service
+}
+
+func (s CompliancePortalCommitmentService) ListForGroupID(
+	ctx context.Context,
+	scope coredata.Scoper,
+	groupID gid.GID,
+	cursor *page.Cursor[coredata.CompliancePortalCommitmentOrderField],
+) (*page.Page[*coredata.CompliancePortalCommitment, coredata.CompliancePortalCommitmentOrderField], error) {
+	var commitments coredata.CompliancePortalCommitments
+
+	err := s.svc.pg.WithConn(ctx, func(ctx context.Context, conn pg.Querier) error {
+		err := commitments.LoadByGroupID(ctx, conn, scope, groupID, cursor)
+		if err != nil {
+			return fmt.Errorf("cannot load compliance portal commitments: %w", err)
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(commitments, cursor), nil
+}
+
+func (s CompliancePortalCommitmentService) Get(
+	ctx context.Context,
+	scope coredata.Scoper,
+	commitmentID gid.GID,
+) (*coredata.CompliancePortalCommitment, error) {
+	commitment := &coredata.CompliancePortalCommitment{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(ctx context.Context, conn pg.Querier) error {
+			err := commitment.LoadByID(ctx, conn, scope, commitmentID)
+			if err != nil {
+				return fmt.Errorf("cannot load compliance portal commitment: %w", err)
+			}
+
+			return nil
+		},
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return commitment, nil
+}
--- a/pkg/trust/service.go
+++ b/pkg/trust/service.go
@@ -45,26 +45,30 @@ const NDAConsentText = "By clicking \"Review and sign\", I consent to sign this

 type (
 	Service struct {
-		pg                     *pg.Client
-		s3                     *s3.Client
-		bucket                 string
-		proboSvc               *probo.Service
-		slackSigningSecret     string
-		baseURL                string
-		iam                    *iam.Service
-		esign                  *esign.Service
-		html2pdfConverter      *html2pdf.Converter
-		fileManager            *filemanager.Service
-		logger                 *log.Logger
-		slack                  *slack.Service
-		TrustCenters           *TrustCenterService
-		Documents              *DocumentService
-		Audits                 *AuditService
-		ThirdParties           *ThirdPartyService
-		Frameworks             *FrameworkService
-		ComplianceFrameworks   *ComplianceFrameworkService
-		TrustCenterAccesses    *TrustCenterAccessService
-		TrustCenterReferences  *TrustCenterReferenceService
+		pg                    *pg.Client
+		s3                    *s3.Client
+		bucket                string
+		proboSvc              *probo.Service
+		slackSigningSecret    string
+		baseURL               string
+		iam                   *iam.Service
+		esign                 *esign.Service
+		html2pdfConverter     *html2pdf.Converter
+		fileManager           *filemanager.Service
+		logger                *log.Logger
+		slack                 *slack.Service
+		TrustCenters          *TrustCenterService
+		Documents             *DocumentService
+		Audits                *AuditService
+		ThirdParties          *ThirdPartyService
+		Frameworks            *FrameworkService
+		ComplianceFrameworks  *ComplianceFrameworkService
+		TrustCenterAccesses   *TrustCenterAccessService
+		TrustCenterReferences *TrustCenterReferenceService
+
+		CompliancePortalCommitmentGroups *CompliancePortalCommitmentGroupService
+		CompliancePortalCommitments      *CompliancePortalCommitmentService
+
 		TrustCenterFiles       *TrustCenterFileService
 		Reports                *ReportService
 		Organizations          *OrganizationService
@@ -109,6 +113,8 @@ func NewService(
 	svc.ComplianceFrameworks = &ComplianceFrameworkService{svc: svc}
 	svc.TrustCenterAccesses = &TrustCenterAccessService{svc: svc, iamSvc: iam, logger: logger}
 	svc.TrustCenterReferences = &TrustCenterReferenceService{svc: svc}
+	svc.CompliancePortalCommitmentGroups = &CompliancePortalCommitmentGroupService{svc: svc}
+	svc.CompliancePortalCommitments = &CompliancePortalCommitmentService{svc: svc}
 	svc.TrustCenterFiles = &TrustCenterFileService{svc: svc}
 	svc.Reports = &ReportService{svc: svc}
 	svc.Organizations = &OrganizationService{svc: svc}