Harden compliance portal auth and TLS

Align console references and OAuth branding with the
compliance-page model, and fix certificate cache eviction,
portal OAuth handlers, and magic-link edge cases left after
the trust-center rename.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/complianceportal/management/domain.go

@@ -65,7 +65,7 @@ func (s *Service) PublicURLForCompliancePage(
 	switch {
 	case compliancePage.CustomDomainID != nil && byID[*compliancePage.CustomDomainID] != nil && active[*compliancePage.CustomDomainID]:
 		host = byID[*compliancePage.CustomDomainID].Domain
-	case compliancePage.DefaultDomainID != nil && byID[*compliancePage.DefaultDomainID] != nil:
+	case compliancePage.DefaultDomainID != nil && byID[*compliancePage.DefaultDomainID] != nil && active[*compliancePage.DefaultDomainID]:
 		host = byID[*compliancePage.DefaultDomainID].Domain
 	}
 

pkg/complianceportal/management/oauth2_scopes.go

@@ -1,16 +1,22 @@
 // Copyright (c) 2026 Probo Inc <hello@probo.com>.
 //
-// Permission to use, copy, modify, and/or distribute this software for any
-// purpose with or without fee is hereby granted, provided that the above
-// copyright notice and this permission notice appear in all copies.
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
 //
-// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
-// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
-// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
-// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-// PERFORMANCE OF THIS SOFTWARE.
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
 
 package management
 
@@ -18,16 +24,11 @@ import (
 	"go.probo.inc/probo/pkg/coredata"
 )
 
-// The compliance-page scope string values are part of the external OAuth2
-// contract and are kept stable even though the feature is named "compliance
-// portal" on the Go side.
 const (
 	ScopeV1CompliancePortalRead coredata.OAuth2Scope = "v1:compliance-page:read"
 	ScopeV1CompliancePortal     coredata.OAuth2Scope = "v1:compliance-page"
 )
 
-// OAuth2ScopeMappings maps the compliance portal OAuth2 scopes to the actions
-// they grant.
 var OAuth2ScopeMappings = map[coredata.OAuth2Scope][]string{
 	ScopeV1CompliancePortalRead: {
 		ActionCompliancePortalGet,
@@ -45,6 +46,8 @@ var OAuth2ScopeMappings = map[coredata.OAuth2Scope][]string{
 		ActionComplianceFrameworkList,
 		ActionComplianceCustomLinkList,
 		ActionCustomDomainGet,
+		ActionCompliancePortalCommitmentGroupList,
+		ActionCompliancePortalCommitmentList,
 	},
 	ScopeV1CompliancePortal: {
 		ActionCompliancePortalGet,
@@ -62,6 +65,8 @@ var OAuth2ScopeMappings = map[coredata.OAuth2Scope][]string{
 		ActionComplianceFrameworkList,
 		ActionComplianceCustomLinkList,
 		ActionCustomDomainGet,
+		ActionCompliancePortalCommitmentGroupList,
+		ActionCompliancePortalCommitmentList,
 		ActionCompliancePortalUpdate,
 		ActionCompliancePortalNonDisclosureAgreementUpload,
 		ActionCompliancePortalNonDisclosureAgreementDelete,
@@ -89,5 +94,13 @@ var OAuth2ScopeMappings = map[coredata.OAuth2Scope][]string{
 		ActionComplianceCustomLinkDelete,
 		ActionCustomDomainCreate,
 		ActionCustomDomainDelete,
+		ActionCompliancePortalCommitmentGroupCreate,
+		ActionCompliancePortalCommitmentGroupUpdate,
+		ActionCompliancePortalCommitmentGroupUpdateRank,
+		ActionCompliancePortalCommitmentGroupDelete,
+		ActionCompliancePortalCommitmentCreate,
+		ActionCompliancePortalCommitmentUpdate,
+		ActionCompliancePortalCommitmentUpdateRank,
+		ActionCompliancePortalCommitmentDelete,
 	},
 }

pkg/complianceportal/management/policies.go

@@ -44,6 +44,7 @@ var ViewerPolicy = policy.NewPolicy(
 		ActionCompliancePortalReferenceList, ActionCompliancePortalReferenceGetLogoUrl,
 		ActionCompliancePortalCommitmentGroupList, ActionCompliancePortalCommitmentList,
 		ActionComplianceFrameworkList,
+		ActionComplianceCustomLinkList,
 	).WithSID("compliance-portal-read-access").When(organizationCondition),
 ).WithDescription("Read-only compliance portal access for organization viewers")
 

pkg/complianceportal/visitor/brand.go

@@ -14,33 +14,15 @@
 
 package visitor
 
-import (
-	"fmt"
-	"net/url"
-)
-
 const (
 	BrandLogoPath     = "/brand/logo"
 	BrandDarkLogoPath = "/brand/dark-logo"
 )
 
 func BrandLogoURL(portalBaseURL string) (string, error) {
-	return brandAssetURL(portalBaseURL, BrandLogoPath)
+	return portalEndpointURL(portalBaseURL, BrandLogoPath)
 }
 
 func BrandDarkLogoURL(portalBaseURL string) (string, error) {
-	return brandAssetURL(portalBaseURL, BrandDarkLogoPath)
-}
-
-func brandAssetURL(portalBaseURL string, path string) (string, error) {
-	parsed, err := url.Parse(portalBaseURL)
-	if err != nil {
-		return "", fmt.Errorf("cannot parse portal base URL: %w", err)
-	}
-
-	parsed.Path = path
-	parsed.RawQuery = ""
-	parsed.Fragment = ""
-
-	return parsed.String(), nil
+	return portalEndpointURL(portalBaseURL, BrandDarkLogoPath)
 }

pkg/complianceportal/visitor/cimd.go

@@ -29,38 +29,26 @@ const (
 )
 
 func CIMDClientIDURL(portalBaseURL string) (string, error) {
-	parsed, err := url.Parse(portalBaseURL)
-	if err != nil {
-		return "", err
-	}
-
-	parsed.Path = CIMDMetadataPath
-	parsed.RawQuery = ""
-	parsed.Fragment = ""
-
-	return parsed.String(), nil
+	return portalEndpointURL(portalBaseURL, CIMDMetadataPath)
 }
 
 func OAuthCallbackURL(portalBaseURL string) (string, error) {
-	parsed, err := url.Parse(portalBaseURL)
-	if err != nil {
-		return "", err
-	}
-
-	parsed.Path = OAuthCallbackPath
-	parsed.RawQuery = ""
-	parsed.Fragment = ""
-
-	return parsed.String(), nil
+	return portalEndpointURL(portalBaseURL, OAuthCallbackPath)
 }
 
 func PortalRootURL(rawURL string) (string, error) {
-	parsed, err := url.Parse(rawURL)
+	return portalEndpointURL(rawURL, "")
+}
+
+// portalEndpointURL replaces the path on a portal base URL and clears
+// query/fragment. Shared by CIMD, OAuth callback, and brand asset URLs.
+func portalEndpointURL(portalBaseURL string, path string) (string, error) {
+	parsed, err := url.Parse(portalBaseURL)
 	if err != nil {
 		return "", fmt.Errorf("cannot parse portal URL: %w", err)
 	}
 
-	parsed.Path = ""
+	parsed.Path = path
 	parsed.RawQuery = ""
 	parsed.Fragment = ""
 

pkg/complianceportal/visitor/compliance_portal_commitment_group_service.go

@@ -55,28 +55,3 @@ func (s *Service) ListCommitmentGroupsForPortalID(
 
 	return page.NewPage(groups, cursor), nil
 }
-
-func (s *Service) GetCommitmentGroup(
-	ctx context.Context,
-	scope coredata.Scoper,
-	groupID gid.GID,
-) (*coredata.CompliancePortalCommitmentGroup, error) {
-	group := &coredata.CompliancePortalCommitmentGroup{}
-
-	err := s.pg.WithConn(
-		ctx,
-		func(ctx context.Context, conn pg.Querier) error {
-			err := group.LoadByID(ctx, conn, scope, groupID)
-			if err != nil {
-				return fmt.Errorf("cannot load compliance portal commitment group: %w", err)
-			}
-
-			return nil
-		},
-	)
-	if err != nil {
-		return nil, err
-	}
-
-	return group, nil
-}

pkg/complianceportal/visitor/service.go

@@ -24,6 +24,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"net/url"
 	"time"
 
 	"github.com/aws/aws-sdk-go-v2/service/s3"
@@ -153,6 +154,38 @@ func (s *Service) GetPortalEffectiveCanonicalHost(ctx context.Context, complianc
 	return host, nil
 }
 
+// GetPortalCanonicalBaseURL rewrites currentBaseURL to the compliance page's
+// canonical host, if one is set. OAuth client_id and redirect_uri values must
+// always be derived from the canonical base URL: the SNI middleware only
+// redirects secondary domains to the canonical host for non-well-known
+// paths, so a client_id fetched from /.well-known/oauth-client-metadata on a
+// secondary domain must already advertise the canonical redirect_uri to stay
+// consistent with what /callback uses at token exchange time. When no
+// canonical host can be determined, currentBaseURL is returned unchanged.
+func (s *Service) GetPortalCanonicalBaseURL(
+	ctx context.Context,
+	compliancePageID gid.GID,
+	currentBaseURL string,
+) (string, error) {
+	canonicalHost, err := s.GetPortalEffectiveCanonicalHost(ctx, compliancePageID)
+	if err != nil {
+		return "", fmt.Errorf("cannot resolve canonical host: %w", err)
+	}
+
+	if canonicalHost == "" {
+		return currentBaseURL, nil
+	}
+
+	parsed, err := url.Parse(currentBaseURL)
+	if err != nil {
+		return "", fmt.Errorf("cannot parse portal base URL: %w", err)
+	}
+
+	parsed.Host = canonicalHost
+
+	return parsed.String(), nil
+}
+
 func (s *Service) GetPortalByDomainName(ctx context.Context, domain string) (*coredata.TrustCenter, error) {
 	compliancePage := &coredata.TrustCenter{}