Harden compliance portal auth and TLS

Align console references and OAuth branding with the
compliance-page model, and fix certificate cache eviction,
portal OAuth handlers, and magic-link edge cases left after
the trust-center rename.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/filemanager/s3_test.go

@@ -33,6 +33,7 @@ import (
 	awss3 "github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/filemanager"
 )
@@ -54,7 +55,7 @@ func newTestS3Service(t *testing.T, handler http.HandlerFunc) *filemanager.Servi
 		},
 	)
 
-	return filemanager.NewService(nil, nil, s3Client)
+	return filemanager.NewService(nil, nil, s3Client, log.NewLogger(log.WithOutput(io.Discard)))
 }
 
 func TestOpenFile_StreamsBody(t *testing.T) {

pkg/filemanager/serve_public.go

@@ -28,6 +28,7 @@ import (
 	"net/http"
 	"strconv"
 
+	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/gid"
 )
@@ -62,7 +63,7 @@ func (s *Service) ServePublicFile(
 
 	obj, err := s.OpenFile(ctx, file, conds)
 	if err != nil {
-		return err
+		return fmt.Errorf("cannot open public file: %w", err)
 	}
 
 	w.Header().Set("Cache-Control", "public, max-age=31536000, immutable")
@@ -99,7 +100,12 @@ func (s *Service) ServePublicFile(
 	}
 
 	if _, err := io.Copy(w, obj.Body); err != nil {
-		return err
+		// The response status and headers are already written at this point,
+		// so returning the error would make the caller render a JSON 500
+		// body into an already-started (and possibly partial) response.
+		// Log it and stop instead.
+		s.logger.ErrorCtx(ctx, "cannot stream public file", log.Error(err), log.String("file_id", fileID.String()))
+		return nil
 	}
 
 	return nil

pkg/filemanager/service.go

@@ -22,6 +22,7 @@ package filemanager
 
 import (
 	awss3 "github.com/aws/aws-sdk-go-v2/service/s3"
+	"go.gearno.de/kit/log"
 	"go.gearno.de/kit/pg"
 	"go.probo.inc/probo/pkg/baseurl"
 )
@@ -30,16 +31,19 @@ type Service struct {
 	pg       *pg.Client
 	baseURL  *baseurl.BaseURL
 	s3Client *awss3.Client
+	logger   *log.Logger
 }
 
 func NewService(
 	pgClient *pg.Client,
 	baseURL *baseurl.BaseURL,
 	s3Client *awss3.Client,
+	logger *log.Logger,
 ) *Service {
 	return &Service{
 		pg:       pgClient,
 		baseURL:  baseURL,
 		s3Client: s3Client,
+		logger:   logger,
 	}
 }

pkg/filemanager/url_test.go

@@ -22,6 +22,7 @@ package filemanager_test
 
 import (
 	"context"
+	"io"
 	"net/url"
 	"testing"
 	"time"
@@ -31,6 +32,7 @@ import (
 	awss3 "github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/baseurl"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/filemanager"
@@ -45,7 +47,7 @@ func TestGenerateFileURL_PublicFile(t *testing.T) {
 		t.Fatalf("cannot parse base URL: %v", err)
 	}
 
-	svc := filemanager.NewService(nil, base, nil)
+	svc := filemanager.NewService(nil, base, nil, log.NewLogger(log.WithOutput(io.Discard)))
 	file := &coredata.File{
 		ID:         gid.New(gid.NilTenant, coredata.FileEntityType),
 		Visibility: coredata.FileVisibilityPublic,
@@ -66,7 +68,7 @@ func TestGenerateFileURL_PrivateFile(t *testing.T) {
 		t.Fatalf("cannot parse base URL: %v", err)
 	}
 
-	svc := filemanager.NewService(nil, base, nil)
+	svc := filemanager.NewService(nil, base, nil, log.NewLogger(log.WithOutput(io.Discard)))
 	file := &coredata.File{
 		ID:         gid.New(gid.NilTenant, coredata.FileEntityType),
 		Visibility: coredata.FileVisibilityPrivate,
@@ -88,7 +90,7 @@ func TestGeneratePresignedURL_EscapesContentDispositionFilename(t *testing.T) {
 			Credentials: credentials.NewStaticCredentialsProvider("access-key", "secret-key", ""),
 		},
 	)
-	svc := filemanager.NewService(nil, nil, s3Client)
+	svc := filemanager.NewService(nil, nil, s3Client, log.NewLogger(log.WithOutput(io.Discard)))
 	file := &coredata.File{
 		BucketName: "uploads",
 		FileKey:    "tenant/file",