Harden compliance portal auth and TLS

Align console references and OAuth branding with the
compliance-page model, and fix certificate cache eviction,
portal OAuth handlers, and magic-link edge cases left after
the trust-center rename.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/server/api/connect/v1/graphql/base.graphql

@@ -45,7 +45,7 @@ type Query {
 
 type OAuthClientBranding {
   name: String!
-  logo: File
+  logoUrl: String
   clientURL: String
 }
 

pkg/server/api/connect/v1/graphql_handler.go

@@ -25,7 +25,6 @@ import (
 
 	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/baseurl"
-	"go.probo.inc/probo/pkg/complianceportal/visitor"
 	"go.probo.inc/probo/pkg/filemanager"
 	"go.probo.inc/probo/pkg/iam"
 	"go.probo.inc/probo/pkg/securecookie"
@@ -39,7 +38,6 @@ import (
 
 func NewGraphQLHandler(
 	svc *iam.Service,
-	trustSvc *visitor.Service,
 	logger *log.Logger,
 	fileManagerSvc *filemanager.Service,
 	baseURL *baseurl.BaseURL,
@@ -52,7 +50,6 @@ func NewGraphQLHandler(
 			batchAuthorize: authz.NewBatchAuthorizeFunc(svc, logger),
 			logger:         logger,
 			iam:            svc,
-			trust:          trustSvc,
 			scopeRegistry:  svc.OAuth2ScopeRegistry,
 			fileManager:    fileManagerSvc,
 			baseURL:        baseURL,

pkg/server/api/connect/v1/oauth_client_branding.go

@@ -47,9 +47,7 @@ func oauthClientBrandingFromIAM(
 	}
 
 	if branding.LogoURL != nil {
-		result.Logo = &types.File{
-			DownloadURL: *branding.LogoURL,
-		}
+		result.LogoURL = branding.LogoURL
 	}
 
 	return result, nil

pkg/server/api/connect/v1/resolver.go

@@ -68,7 +68,6 @@ type (
 		batchAuthorize authz.BatchAuthorizeFunc
 		logger         *log.Logger
 		iam            *iam.Service
-		trust          *visitor.Service
 		scopeRegistry  *oauth2scope.Registry
 		fileManager    *filemanager.Service
 		baseURL        *baseurl.BaseURL
@@ -93,7 +92,7 @@ func NewMux(
 	apiKeyMiddleware := authn.NewAPIKeyMiddleware(svc, tokenSecret)
 	oauth2Middleware := authn.NewOAuth2AccessTokenMiddleware(svc)
 	identityPresenceMiddleware := authn.NewIdentityPresenceMiddleware(baseURL)
-	graphqlHandler := NewGraphQLHandler(svc, trustSvc, logger, fileManagerSvc, baseURL, cookieConfig, graphqlLimits)
+	graphqlHandler := NewGraphQLHandler(svc, logger, fileManagerSvc, baseURL, cookieConfig, graphqlLimits)
 	samlHandler := NewSAMLHandler(svc, cookieConfig, baseURL, logger)
 	scimHandler := NewSCIMHandler(svc, logger.Named("scim"))