Harden compliance portal auth and TLS

Align console references and OAuth branding with the
compliance-page model, and fix certificate cache eviction,
portal OAuth handlers, and magic-link edge cases left after
the trust-center rename.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/complianceportal/visitor/brand.go

@@ -14,33 +14,15 @@
 
 package visitor
 
-import (
-	"fmt"
-	"net/url"
-)
-
 const (
 	BrandLogoPath     = "/brand/logo"
 	BrandDarkLogoPath = "/brand/dark-logo"
 )
 
 func BrandLogoURL(portalBaseURL string) (string, error) {
-	return brandAssetURL(portalBaseURL, BrandLogoPath)
+	return portalEndpointURL(portalBaseURL, BrandLogoPath)
 }
 
 func BrandDarkLogoURL(portalBaseURL string) (string, error) {
-	return brandAssetURL(portalBaseURL, BrandDarkLogoPath)
-}
-
-func brandAssetURL(portalBaseURL string, path string) (string, error) {
-	parsed, err := url.Parse(portalBaseURL)
-	if err != nil {
-		return "", fmt.Errorf("cannot parse portal base URL: %w", err)
-	}
-
-	parsed.Path = path
-	parsed.RawQuery = ""
-	parsed.Fragment = ""
-
-	return parsed.String(), nil
+	return portalEndpointURL(portalBaseURL, BrandDarkLogoPath)
 }

pkg/complianceportal/visitor/cimd.go

@@ -29,38 +29,26 @@ const (
 )
 
 func CIMDClientIDURL(portalBaseURL string) (string, error) {
-	parsed, err := url.Parse(portalBaseURL)
-	if err != nil {
-		return "", err
-	}
-
-	parsed.Path = CIMDMetadataPath
-	parsed.RawQuery = ""
-	parsed.Fragment = ""
-
-	return parsed.String(), nil
+	return portalEndpointURL(portalBaseURL, CIMDMetadataPath)
 }
 
 func OAuthCallbackURL(portalBaseURL string) (string, error) {
-	parsed, err := url.Parse(portalBaseURL)
-	if err != nil {
-		return "", err
-	}
-
-	parsed.Path = OAuthCallbackPath
-	parsed.RawQuery = ""
-	parsed.Fragment = ""
-
-	return parsed.String(), nil
+	return portalEndpointURL(portalBaseURL, OAuthCallbackPath)
 }
 
 func PortalRootURL(rawURL string) (string, error) {
-	parsed, err := url.Parse(rawURL)
+	return portalEndpointURL(rawURL, "")
+}
+
+// portalEndpointURL replaces the path on a portal base URL and clears
+// query/fragment. Shared by CIMD, OAuth callback, and brand asset URLs.
+func portalEndpointURL(portalBaseURL string, path string) (string, error) {
+	parsed, err := url.Parse(portalBaseURL)
 	if err != nil {
 		return "", fmt.Errorf("cannot parse portal URL: %w", err)
 	}
 
-	parsed.Path = ""
+	parsed.Path = path
 	parsed.RawQuery = ""
 	parsed.Fragment = ""
 

pkg/complianceportal/visitor/compliance_portal_commitment_group_service.go

@@ -55,28 +55,3 @@ func (s *Service) ListCommitmentGroupsForPortalID(
 
 	return page.NewPage(groups, cursor), nil
 }
-
-func (s *Service) GetCommitmentGroup(
-	ctx context.Context,
-	scope coredata.Scoper,
-	groupID gid.GID,
-) (*coredata.CompliancePortalCommitmentGroup, error) {
-	group := &coredata.CompliancePortalCommitmentGroup{}
-
-	err := s.pg.WithConn(
-		ctx,
-		func(ctx context.Context, conn pg.Querier) error {
-			err := group.LoadByID(ctx, conn, scope, groupID)
-			if err != nil {
-				return fmt.Errorf("cannot load compliance portal commitment group: %w", err)
-			}
-
-			return nil
-		},
-	)
-	if err != nil {
-		return nil, err
-	}
-
-	return group, nil
-}

pkg/complianceportal/visitor/service.go

@@ -24,6 +24,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"net/url"
 	"time"
 
 	"github.com/aws/aws-sdk-go-v2/service/s3"
@@ -153,6 +154,38 @@ func (s *Service) GetPortalEffectiveCanonicalHost(ctx context.Context, complianc
 	return host, nil
 }
 
+// GetPortalCanonicalBaseURL rewrites currentBaseURL to the compliance page's
+// canonical host, if one is set. OAuth client_id and redirect_uri values must
+// always be derived from the canonical base URL: the SNI middleware only
+// redirects secondary domains to the canonical host for non-well-known
+// paths, so a client_id fetched from /.well-known/oauth-client-metadata on a
+// secondary domain must already advertise the canonical redirect_uri to stay
+// consistent with what /callback uses at token exchange time. When no
+// canonical host can be determined, currentBaseURL is returned unchanged.
+func (s *Service) GetPortalCanonicalBaseURL(
+	ctx context.Context,
+	compliancePageID gid.GID,
+	currentBaseURL string,
+) (string, error) {
+	canonicalHost, err := s.GetPortalEffectiveCanonicalHost(ctx, compliancePageID)
+	if err != nil {
+		return "", fmt.Errorf("cannot resolve canonical host: %w", err)
+	}
+
+	if canonicalHost == "" {
+		return currentBaseURL, nil
+	}
+
+	parsed, err := url.Parse(currentBaseURL)
+	if err != nil {
+		return "", fmt.Errorf("cannot parse portal base URL: %w", err)
+	}
+
+	parsed.Host = canonicalHost
+
+	return parsed.String(), nil
+}
+
 func (s *Service) GetPortalByDomainName(ctx context.Context, domain string) (*coredata.TrustCenter, error) {
 	compliancePage := &coredata.TrustCenter{}