From 4313930ae9dea02be58e2fe17774e75dc9e91aa7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89mile=20R=C3=A9?= <emile@getprobo.com>
Date: Wed, 22 Apr 2026 15:41:11 +0400
Subject: [PATCH] Add global branding config field to control cookie banner
 default
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduces a BRANDING boolean config (default true) propagated through
the standard config pipeline. Cookie banners now initialize their
show_branding column from this config instead of hardcoding true.

Signed-off-by: Émile Ré <emile@getprobo.com>
---
 contrib/helm/charts/probo/templates/deployment.yaml | 2 ++
 contrib/helm/charts/probo/values.yaml               | 3 +++
 pkg/bootstrap/builder.go                            | 1 +
 pkg/bootstrap/builder_test.go                       | 7 +++++++
 pkg/cookiebanner/service.go                         | 9 +++++----
 pkg/probod/probod.go                                | 4 +++-
 6 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/contrib/helm/charts/probo/templates/deployment.yaml b/contrib/helm/charts/probo/templates/deployment.yaml
index 3e86bf420..5e664987e 100644
--- a/contrib/helm/charts/probo/templates/deployment.yaml
+++ b/contrib/helm/charts/probo/templates/deployment.yaml
@@ -66,6 +66,8 @@ spec:
                   key: encryption-key
             - name: CHROME_DP_ADDR
               value: {{ include "probo.chrome.addr" . | quote }}
+            - name: BRANDING
+              value: {{ .Values.probo.branding | quote }}
             # API Configuration
             - name: API_ADDR
               value: ":{{ .Values.service.port }}"
diff --git a/contrib/helm/charts/probo/values.yaml b/contrib/helm/charts/probo/values.yaml
index 91b3c366f..fb2a7f647 100644
--- a/contrib/helm/charts/probo/values.yaml
+++ b/contrib/helm/charts/probo/values.yaml
@@ -196,6 +196,9 @@ probo:
       - "https://probo.example.com"
       - "http://probo.example.com"
 
+  # Show Probo branding on cookie banners
+  branding: true
+
   # Extra HTTP headers to add to responses
   extraHeaderFields: {}
 
diff --git a/pkg/bootstrap/builder.go b/pkg/bootstrap/builder.go
index c47b18ea3..097e3f21d 100644
--- a/pkg/bootstrap/builder.go
+++ b/pkg/bootstrap/builder.go
@@ -225,6 +225,7 @@ func (b *Builder) Build() (*probod.FullConfig, error) {
 			ESign: probod.ESignConfig{
 				TSAURL: b.getEnvOrDefault("ESIGN_TSA_URL", "http://timestamp.digicert.com"),
 			},
+			Branding: b.getEnvBoolOrDefault("BRANDING", true),
 		},
 	}
 
diff --git a/pkg/bootstrap/builder_test.go b/pkg/bootstrap/builder_test.go
index 12fe7733f..e72976063 100644
--- a/pkg/bootstrap/builder_test.go
+++ b/pkg/bootstrap/builder_test.go
@@ -207,6 +207,9 @@ func TestBuilder_Build_Defaults(t *testing.T) {
 	// ESign config
 	assert.Equal(t, "http://timestamp.digicert.com", cfg.Probod.ESign.TSAURL)
 
+	// Branding
+	assert.True(t, cfg.Probod.Branding)
+
 	// No connectors by default
 	assert.Empty(t, cfg.Probod.Connectors)
 }
@@ -280,6 +283,8 @@ func TestBuilder_Build_CustomValues(t *testing.T) {
 	env["SCIM_BRIDGE_POLL_INTERVAL"] = "60"
 	// ESign
 	env["ESIGN_TSA_URL"] = "http://custom.tsa.example.com"
+	// Branding
+	env["BRANDING"] = "false"
 
 	b := NewBuilder(mockEnv(env))
 	b.samlCertificate = "test-cert"
@@ -361,6 +366,8 @@ func TestBuilder_Build_CustomValues(t *testing.T) {
 	assert.Equal(t, 60, cfg.Probod.SCIMBridge.PollInterval)
 	// ESign
 	assert.Equal(t, "http://custom.tsa.example.com", cfg.Probod.ESign.TSAURL)
+	// Branding
+	assert.False(t, cfg.Probod.Branding)
 }
 
 func TestBuilder_Build_SlackConnector(t *testing.T) {
diff --git a/pkg/cookiebanner/service.go b/pkg/cookiebanner/service.go
index 25111ae29..88218f072 100644
--- a/pkg/cookiebanner/service.go
+++ b/pkg/cookiebanner/service.go
@@ -31,11 +31,12 @@ import (
 )
 
 type Service struct {
-	pg *pg.Client
+	pg           *pg.Client
+	showBranding bool
 }
 
-func NewService(pgClient *pg.Client) *Service {
-	return &Service{pg: pgClient}
+func NewService(pgClient *pg.Client, showBranding bool) *Service {
+	return &Service{pg: pgClient, showBranding: showBranding}
 }
 
 var defaultCategories = []struct {
@@ -413,7 +414,7 @@ func (s *Service) CreateCookieBanner(
 				PrivacyPolicyURL:  req.PrivacyPolicyURL,
 				ConsentExpiryDays: req.ConsentExpiryDays,
 				ConsentMode:       req.ConsentMode,
-				ShowBranding:      true,
+				ShowBranding:      s.showBranding,
 				CreatedAt:         now,
 				UpdatedAt:         now,
 			}
diff --git a/pkg/probod/probod.go b/pkg/probod/probod.go
index 31af1f518..28e4e9437 100644
--- a/pkg/probod/probod.go
+++ b/pkg/probod/probod.go
@@ -128,6 +128,7 @@ type (
 		CustomDomains     CustomDomainsConfig     `json:"custom-domains"`
 		SCIMBridge        SCIMBridgeConfig        `json:"scim-bridge"`
 		ESign             ESignConfig             `json:"esign"`
+		Branding          bool                    `json:"branding"`
 	}
 
 	// TrustCenterConfig contains trust center server configuration.
@@ -223,6 +224,7 @@ func New() *Implm {
 			ESign: ESignConfig{
 				TSAURL: "http://timestamp.digicert.com",
 			},
+			Branding: true,
 			EvidenceDescriber: EvidenceDescriberConfig{
 				Interval:       10,
 				StaleAfter:     300,
@@ -517,7 +519,7 @@ func (impl *Implm) Run(
 
 	mailmanService := mailman.NewService(pgClient, fileManagerService, impl.cfg.Auth.Cookie.Secret, baseURL, impl.cfg.AWS.Bucket, encryptionKey, l)
 
-	cookieBannerService := cookiebanner.NewService(pgClient)
+	cookieBannerService := cookiebanner.NewService(pgClient, impl.cfg.Branding)
 
 	proboService, err := probo.NewService(
 		ctx,