Extract complianceportal package from trust and probo

Split the compliance portal into an admin-facing management side and a
public-facing visitor side under pkg/complianceportal. Trust-center CRUD,
domains, custom links, frameworks, files and accesses move out of
pkg/probo, and the visitor read logic moves out of pkg/trust. IAM actions
migrate onto compliance-portal scopes.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/complianceportal/visitor/portal_access_service.go

@@ -0,0 +1,830 @@
+// Copyright (c) 2025-2026 Probo Inc <hello@probo.com>.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+package visitor
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"go.gearno.de/kit/log"
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/packages/emails"
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/mail"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type PortalAccessRequest struct {
+	TrustCenterID      gid.GID
+	IdentityID         gid.GID
+	DocumentIDs        []gid.GID
+	ReportIDs          []gid.GID
+	TrustCenterFileIDs []gid.GID
+}
+
+const (
+	PortalAccessURLFormat = "https://%s/organizations/%s/trust-center/access"
+)
+
+func (s *Service) RequestPortalAccess(
+	ctx context.Context,
+	scope coredata.Scoper,
+	req *PortalAccessRequest,
+) (*coredata.TrustCenterAccess, error) {
+	var (
+		now    = time.Now()
+		access *coredata.TrustCenterAccess
+	)
+
+	err := s.pg.WithTx(
+		ctx,
+		func(ctx context.Context, tx pg.Tx) error {
+			trustCenter := &coredata.TrustCenter{}
+			if err := trustCenter.LoadByID(ctx, tx, scope, req.TrustCenterID); err != nil {
+				return fmt.Errorf("cannot load trust center: %w", err)
+			}
+
+			access = &coredata.TrustCenterAccess{}
+			if err := access.LoadByTrustCenterIDAndIdentityID(ctx, tx, scope, req.TrustCenterID, req.IdentityID); err != nil {
+				return fmt.Errorf("cannot load compliance page membership: %w", err)
+			}
+
+			organizationID := trustCenter.OrganizationID
+
+			documentIDs := req.DocumentIDs
+			if req.DocumentIDs == nil {
+				filter := coredata.NewDocumentTrustCenterFilter()
+
+				allDocuments, err := page.LoadAll(
+					ctx,
+					page.OrderBy[coredata.DocumentOrderField]{
+						Field:     coredata.DocumentOrderFieldTitle,
+						Direction: page.OrderDirectionAsc,
+					},
+					func(ctx context.Context, cursor *page.Cursor[coredata.DocumentOrderField]) ([]*coredata.Document, error) {
+						var batch coredata.Documents
+						if err := batch.LoadByOrganizationID(ctx, tx, scope, organizationID, cursor, filter); err != nil {
+							return nil, fmt.Errorf("cannot list documents: %w", err)
+						}
+
+						return batch, nil
+					},
+				)
+				if err != nil {
+					return err
+				}
+
+				for _, doc := range allDocuments {
+					documentIDs = append(documentIDs, doc.ID)
+				}
+			}
+
+			reportIDs := req.ReportIDs
+			if req.ReportIDs == nil {
+				auditFilter := coredata.NewAuditTrustCenterFilter()
+
+				allAudits, err := page.LoadAll(
+					ctx,
+					page.OrderBy[coredata.AuditOrderField]{
+						Field:     coredata.AuditOrderFieldCreatedAt,
+						Direction: page.OrderDirectionAsc,
+					},
+					func(ctx context.Context, cursor *page.Cursor[coredata.AuditOrderField]) ([]*coredata.Audit, error) {
+						var batch coredata.Audits
+						if err := batch.LoadByOrganizationID(ctx, tx, scope, organizationID, cursor, auditFilter); err != nil {
+							return nil, fmt.Errorf("cannot list audits: %w", err)
+						}
+
+						return batch, nil
+					},
+				)
+				if err != nil {
+					return err
+				}
+
+				for _, audit := range allAudits {
+					if audit.ReportFileID != nil {
+						reportIDs = append(reportIDs, *audit.ReportFileID)
+					}
+				}
+			}
+
+			trustCenterFileIDs := req.TrustCenterFileIDs
+			if req.TrustCenterFileIDs == nil {
+				filter := coredata.NewTrustCenterFileFilter(
+					coredata.WithTrustCenterFileVisibilities(coredata.TrustCenterVisibilityPrivate, coredata.TrustCenterVisibilityNone),
+				)
+
+				allTrustCenterFiles, err := page.LoadAll(
+					ctx,
+					page.OrderBy[coredata.TrustCenterFileOrderField]{
+						Field:     coredata.TrustCenterFileOrderFieldCreatedAt,
+						Direction: page.OrderDirectionDesc,
+					},
+					func(ctx context.Context, cursor *page.Cursor[coredata.TrustCenterFileOrderField]) ([]*coredata.TrustCenterFile, error) {
+						var batch coredata.TrustCenterFiles
+						if err := batch.LoadByOrganizationID(ctx, tx, scope, organizationID, cursor, filter); err != nil {
+							return nil, fmt.Errorf("cannot list trust center files: %w", err)
+						}
+
+						return batch, nil
+					},
+				)
+				if err != nil {
+					return err
+				}
+
+				for _, file := range allTrustCenterFiles {
+					trustCenterFileIDs = append(trustCenterFileIDs, file.ID)
+				}
+			}
+
+			existingAccesses, err := page.LoadAll(
+				ctx,
+				page.OrderBy[coredata.TrustCenterDocumentAccessOrderField]{
+					Field:     coredata.TrustCenterDocumentAccessOrderFieldCreatedAt,
+					Direction: page.OrderDirectionAsc,
+				},
+				func(ctx context.Context, cursor *page.Cursor[coredata.TrustCenterDocumentAccessOrderField]) ([]*coredata.TrustCenterDocumentAccess, error) {
+					var batch coredata.TrustCenterDocumentAccesses
+					if err := batch.LoadByTrustCenterAccessID(ctx, tx, scope, access.ID, cursor); err != nil {
+						return nil, fmt.Errorf("cannot load existing access records: %w", err)
+					}
+
+					return batch, nil
+				},
+			)
+			if err != nil {
+				return err
+			}
+
+			existingDocumentIDs, existingReportIDs, existingTrustCenterFileIDs := extractExistingIDs(existingAccesses)
+			newDocumentIDs := filterExistingIDs(documentIDs, existingDocumentIDs)
+			newReportIDs := filterExistingIDs(reportIDs, existingReportIDs)
+			newTrustCenterFileIDs := filterExistingIDs(trustCenterFileIDs, existingTrustCenterFileIDs)
+
+			var accesses coredata.TrustCenterDocumentAccesses
+
+			if err := accesses.BulkInsertDocumentAccesses(
+				ctx,
+				tx,
+				scope,
+				access.ID,
+				access.OrganizationID,
+				newDocumentIDs,
+				coredata.TrustCenterDocumentAccessStatusRequested,
+				now,
+			); err != nil {
+				return fmt.Errorf("cannot bulk insert trust center document accesses: %w", err)
+			}
+
+			if err := accesses.BulkInsertReportFileAccesses(
+				ctx,
+				tx,
+				scope,
+				access.ID,
+				access.OrganizationID,
+				newReportIDs,
+				coredata.TrustCenterDocumentAccessStatusRequested,
+				now,
+			); err != nil {
+				return fmt.Errorf("cannot bulk insert trust center report accesses: %w", err)
+			}
+
+			if err := accesses.BulkInsertTrustCenterFileAccesses(
+				ctx,
+				tx,
+				scope,
+				access.ID,
+				access.OrganizationID,
+				newTrustCenterFileIDs,
+				coredata.TrustCenterDocumentAccessStatusRequested,
+				now,
+			); err != nil {
+				return fmt.Errorf("cannot bulk insert trust center file accesses: %w", err)
+			}
+
+			return nil
+		},
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := s.slack.QueueSlackNotification(ctx, scope, req.IdentityID, req.TrustCenterID); err != nil {
+		s.logger.ErrorCtx(ctx, "cannot queue slack notification", log.Error(err))
+	}
+
+	return access, nil
+}
+
+func (s *Service) GetPortalAccess(
+	ctx context.Context,
+	scope coredata.Scoper,
+	trustCenterID gid.GID,
+	identityID gid.GID,
+) (coredata.TrustCenterAccess, error) {
+	var access coredata.TrustCenterAccess
+
+	err := s.pg.WithConn(
+		ctx,
+		func(ctx context.Context, conn pg.Querier) error {
+			return access.LoadByTrustCenterIDAndIdentityID(ctx, conn, scope, trustCenterID, identityID)
+		},
+	)
+
+	return access, err
+}
+
+func (s *Service) GetPortalDocumentAccess(
+	ctx context.Context,
+	scope coredata.Scoper,
+	trustCenterID gid.GID,
+	identityID gid.GID,
+	documentID gid.GID,
+) (*coredata.TrustCenterDocumentAccess, error) {
+	var documentAccess *coredata.TrustCenterDocumentAccess
+
+	err := s.pg.WithConn(
+		ctx,
+		func(ctx context.Context, conn pg.Querier) error {
+			access := &coredata.TrustCenterAccess{}
+
+			err := access.LoadByTrustCenterIDAndIdentityID(ctx, conn, scope, trustCenterID, identityID)
+			if err != nil {
+				if errors.Is(err, coredata.ErrResourceNotFound) {
+					return ErrMembershipNotFound
+				}
+
+				return fmt.Errorf("cannot load trust center access: %w", err)
+			}
+
+			profile := &coredata.MembershipProfile{}
+			if err := profile.LoadByIdentityIDAndOrganizationID(ctx, conn, scope, identityID, access.OrganizationID); err != nil {
+				if errors.Is(err, coredata.ErrResourceNotFound) {
+					return ErrUserNotFound
+				}
+			}
+
+			if profile.State != coredata.ProfileStateActive {
+				return ErrUserInactive
+			}
+
+			documentAccess = &coredata.TrustCenterDocumentAccess{}
+
+			err = documentAccess.LoadByTrustCenterAccessIDAndDocumentID(ctx, conn, scope, access.ID, documentID)
+			if err != nil {
+				if errors.Is(err, coredata.ErrResourceNotFound) {
+					return ErrDocumentAccessNotFound
+				}
+
+				return fmt.Errorf("cannot load document access: %w", err)
+			}
+
+			return nil
+		},
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return documentAccess, nil
+}
+
+func (s *Service) GetPortalReportFileAccess(
+	ctx context.Context,
+	scope coredata.Scoper,
+	trustCenterID gid.GID,
+	identityID gid.GID,
+	reportFileID gid.GID,
+) (*coredata.TrustCenterDocumentAccess, error) {
+	var reportAccess *coredata.TrustCenterDocumentAccess
+
+	err := s.pg.WithConn(
+		ctx,
+		func(ctx context.Context, conn pg.Querier) error {
+			access := &coredata.TrustCenterAccess{}
+
+			err := access.LoadByTrustCenterIDAndIdentityID(ctx, conn, scope, trustCenterID, identityID)
+			if err != nil {
+				if errors.Is(err, coredata.ErrResourceNotFound) {
+					return ErrMembershipNotFound
+				}
+
+				return fmt.Errorf("cannot load trust center access: %w", err)
+			}
+
+			profile := &coredata.MembershipProfile{}
+			if err := profile.LoadByIdentityIDAndOrganizationID(ctx, conn, scope, identityID, access.OrganizationID); err != nil {
+				if errors.Is(err, coredata.ErrResourceNotFound) {
+					return ErrUserNotFound
+				}
+			}
+
+			if profile.State != coredata.ProfileStateActive {
+				return ErrUserInactive
+			}
+
+			reportAccess = &coredata.TrustCenterDocumentAccess{}
+
+			err = reportAccess.LoadByTrustCenterAccessIDAndReportFileID(ctx, conn, scope, access.ID, reportFileID)
+			if err != nil {
+				if errors.Is(err, coredata.ErrResourceNotFound) {
+					return ErrDocumentAccessNotFound
+				}
+
+				return fmt.Errorf("cannot load report access: %w", err)
+			}
+
+			return nil
+		},
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return reportAccess, nil
+}
+
+func (s *Service) GetPortalFileAccess(
+	ctx context.Context,
+	scope coredata.Scoper,
+	trustCenterID gid.GID,
+	identityID gid.GID,
+	trustCenterFileID gid.GID,
+) (*coredata.TrustCenterDocumentAccess, error) {
+	var fileAccess *coredata.TrustCenterDocumentAccess
+
+	err := s.pg.WithConn(
+		ctx,
+		func(ctx context.Context, conn pg.Querier) error {
+			access := &coredata.TrustCenterAccess{}
+
+			err := access.LoadByTrustCenterIDAndIdentityID(ctx, conn, scope, trustCenterID, identityID)
+			if err != nil {
+				if errors.Is(err, coredata.ErrResourceNotFound) {
+					return ErrMembershipNotFound
+				}
+
+				return fmt.Errorf("cannot load trust center access: %w", err)
+			}
+
+			profile := &coredata.MembershipProfile{}
+			if err := profile.LoadByIdentityIDAndOrganizationID(ctx, conn, scope, identityID, access.OrganizationID); err != nil {
+				if errors.Is(err, coredata.ErrResourceNotFound) {
+					return ErrUserNotFound
+				}
+			}
+
+			if profile.State != coredata.ProfileStateActive {
+				return ErrUserInactive
+			}
+
+			fileAccess = &coredata.TrustCenterDocumentAccess{}
+
+			err = fileAccess.LoadByTrustCenterAccessIDAndTrustCenterFileID(ctx, conn, scope, access.ID, trustCenterFileID)
+			if err != nil {
+				if errors.Is(err, coredata.ErrResourceNotFound) {
+					return ErrDocumentAccessNotFound
+				}
+
+				return fmt.Errorf("cannot load trust center file access: %w", err)
+			}
+
+			return nil
+		},
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return fileAccess, nil
+}
+
+func (s *Service) GrantPortalAccessByIDs(
+	ctx context.Context,
+	scope coredata.Scoper,
+	organizationID gid.GID,
+	email mail.Addr,
+	documentIDs []gid.GID,
+	reportIDs []gid.GID,
+	fileIDs []gid.GID,
+) error {
+	return s.pg.WithTx(
+		ctx,
+		func(ctx context.Context, tx pg.Tx) error {
+			trustCenter := &coredata.TrustCenter{}
+			if err := trustCenter.LoadByOrganizationID(ctx, tx, scope, organizationID); err != nil {
+				return fmt.Errorf("cannot load trust center: %w", err)
+			}
+
+			identity := &coredata.Identity{}
+			if err := identity.LoadByEmail(ctx, tx, email); err != nil {
+				return fmt.Errorf("cannot load identity: %w", err)
+			}
+
+			access := &coredata.TrustCenterAccess{}
+			if err := access.LoadByTrustCenterIDAndIdentityID(ctx, tx, scope, trustCenter.ID, identity.ID); err != nil {
+				return fmt.Errorf("cannot load trust center access: %w", err)
+			}
+
+			profile := &coredata.MembershipProfile{}
+			if err := profile.LoadByIdentityIDAndOrganizationID(ctx, tx, scope, identity.ID, access.OrganizationID); err != nil {
+				if errors.Is(err, coredata.ErrResourceNotFound) {
+					return ErrUserNotFound
+				}
+			}
+
+			if profile.State != coredata.ProfileStateActive {
+				return ErrUserInactive
+			}
+
+			shouldSendEmail := profile.State != coredata.ProfileStateActive
+			now := time.Now()
+
+			if len(documentIDs) > 0 {
+				if err := coredata.GrantByDocumentIDs(ctx, tx, scope, access.ID, documentIDs, now); err != nil {
+					return fmt.Errorf("cannot grant document accesses: %w", err)
+				}
+			}
+
+			if len(reportIDs) > 0 {
+				if err := coredata.GrantByReportFileIDs(ctx, tx, scope, access.ID, reportIDs, now); err != nil {
+					return fmt.Errorf("cannot grant report accesses: %w", err)
+				}
+			}
+
+			if len(fileIDs) > 0 {
+				if err := coredata.GrantByTrustCenterFileIDs(ctx, tx, scope, access.ID, fileIDs, now); err != nil {
+					return fmt.Errorf("cannot grant trust center file accesses: %w", err)
+				}
+			}
+
+			if shouldSendEmail {
+				profile.State = coredata.ProfileStateActive
+
+				profile.UpdatedAt = now
+				if err := profile.Update(ctx, tx, scope); err != nil {
+					return fmt.Errorf("cannot update profile: %w", err)
+				}
+
+				if err := s.sendPortalAccessEmail(ctx, tx, scope, access, profile); err != nil {
+					return fmt.Errorf("cannot send access email: %w", err)
+				}
+			}
+
+			return nil
+		},
+	)
+}
+
+func (s *Service) sendPortalAccessEmail(
+	ctx context.Context,
+	tx pg.Tx,
+	scope coredata.Scoper,
+	access *coredata.TrustCenterAccess,
+	profile *coredata.MembershipProfile,
+) error {
+	organization := &coredata.Organization{}
+	if err := organization.LoadByID(ctx, tx, scope, access.OrganizationID); err != nil {
+		return fmt.Errorf("cannot load organization: %w", err)
+	}
+
+	now := time.Now()
+	access.UpdatedAt = now
+
+	if err := access.Update(ctx, tx, scope); err != nil {
+		return fmt.Errorf("cannot update trust center access with expiration: %w", err)
+	}
+
+	emailPresenterCfg, err := s.GetPortalEmailPresenterConfig(ctx, scope, access.TrustCenterID)
+	if err != nil {
+		return fmt.Errorf("cannot get compliance page email presenter config: %w", err)
+	}
+
+	emailPresenter := emails.NewPresenterFromConfig(emailPresenterCfg, profile.FullName)
+
+	subject, textBody, htmlBody, err := emailPresenter.RenderTrustCenterAccess(ctx, organization.Name)
+	if err != nil {
+		return fmt.Errorf("cannot render trust center access email: %w", err)
+	}
+
+	accessEmail := coredata.NewEmail(
+		profile.FullName,
+		profile.EmailAddress,
+		subject,
+		textBody,
+		htmlBody,
+		&coredata.EmailOptions{
+			SenderName: new(organization.Name),
+		},
+	)
+
+	if err := accessEmail.Insert(ctx, tx); err != nil {
+		return fmt.Errorf("cannot insert access email: %w", err)
+	}
+
+	return nil
+}
+
+func (s *Service) RejectOrRevokePortalAccessByIDs(
+	ctx context.Context,
+	scope coredata.Scoper,
+	organizationID gid.GID,
+	email mail.Addr,
+	documentIDs []gid.GID,
+	reportIDs []gid.GID,
+	fileIDs []gid.GID,
+) error {
+	return s.pg.WithTx(
+		ctx,
+		func(ctx context.Context, tx pg.Tx) error {
+			trustCenter := &coredata.TrustCenter{}
+			if err := trustCenter.LoadByOrganizationID(ctx, tx, scope, organizationID); err != nil {
+				return fmt.Errorf("cannot load trust center: %w", err)
+			}
+
+			identity := &coredata.Identity{}
+			if err := identity.LoadByEmail(ctx, tx, email); err != nil {
+				return fmt.Errorf("cannot load identity: %w", err)
+			}
+
+			access := &coredata.TrustCenterAccess{}
+			if err := access.LoadByTrustCenterIDAndIdentityID(ctx, tx, scope, trustCenter.ID, identity.ID); err != nil {
+				return fmt.Errorf("cannot load trust center access: %w", err)
+			}
+
+			profile := &coredata.MembershipProfile{}
+			if err := profile.LoadByIdentityIDAndOrganizationID(ctx, tx, scope, identity.ID, access.OrganizationID); err != nil {
+				return fmt.Errorf("cannot load profile: %w", err)
+			}
+
+			shouldSendEmail := false
+			now := time.Now()
+
+			if len(documentIDs) > 0 {
+				shouldSendEmail = true
+
+				if err := coredata.RejectOrRevokeByDocumentIDs(ctx, tx, scope, access.ID, documentIDs, now); err != nil {
+					return fmt.Errorf("cannot reject/revoke document accesses: %w", err)
+				}
+			}
+
+			if len(reportIDs) > 0 {
+				shouldSendEmail = true
+
+				if err := coredata.RejectOrRevokeByReportFileIDs(ctx, tx, scope, access.ID, reportIDs, now); err != nil {
+					return fmt.Errorf("cannot reject/revoke report accesses: %w", err)
+				}
+			}
+
+			if len(fileIDs) > 0 {
+				shouldSendEmail = true
+
+				if err := coredata.RejectOrRevokeByTrustCenterFileIDs(ctx, tx, scope, access.ID, fileIDs, now); err != nil {
+					return fmt.Errorf("cannot reject/revoke trust center file accesses: %w", err)
+				}
+			}
+
+			if shouldSendEmail {
+				if err := s.sendPortalDocumentAccessRejectedEmail(ctx, tx, scope, access, profile, documentIDs, reportIDs, fileIDs); err != nil {
+					return fmt.Errorf("cannot send access email: %w", err)
+				}
+			}
+
+			return nil
+		},
+	)
+}
+
+func (s *Service) sendPortalDocumentAccessRejectedEmail(
+	ctx context.Context,
+	tx pg.Tx,
+	scope coredata.Scoper,
+	access *coredata.TrustCenterAccess,
+	profile *coredata.MembershipProfile,
+	documentIDs []gid.GID,
+	reportIDs []gid.GID,
+	fileIDs []gid.GID,
+) error {
+	organization := &coredata.Organization{}
+	if err := organization.LoadByID(ctx, tx, scope, access.OrganizationID); err != nil {
+		return fmt.Errorf("cannot load organization: %w", err)
+	}
+
+	var (
+		fileNames []string
+		documents coredata.Documents
+	)
+
+	if len(documentIDs) > 0 {
+		if err := documents.LoadByIDs(ctx, tx, scope, documentIDs); err != nil && !errors.Is(err, coredata.ErrResourceNotFound) {
+			return fmt.Errorf("cannot load documents by IDs: %w", err)
+		}
+
+		for _, d := range documents {
+			fileNames = append(fileNames, d.Title)
+		}
+	}
+
+	if len(reportIDs) > 0 {
+		reportLabels, err := reportAccessLabels(ctx, tx, scope, reportIDs)
+		if err != nil {
+			return fmt.Errorf("cannot build report access labels: %w", err)
+		}
+
+		fileNames = append(fileNames, reportLabels...)
+	}
+
+	var files coredata.TrustCenterFiles
+	if len(fileIDs) > 0 {
+		if err := files.LoadByIDs(ctx, tx, scope, fileIDs); err != nil && !errors.Is(err, coredata.ErrResourceNotFound) {
+			return fmt.Errorf("cannot load files by IDs: %w", err)
+		}
+
+		for _, f := range files {
+			fileNames = append(fileNames, f.Name)
+		}
+	}
+
+	emailPresenterCfg, err := s.GetPortalEmailPresenterConfig(ctx, scope, access.TrustCenterID)
+	if err != nil {
+		return fmt.Errorf("cannot get compliance page email presenter config: %w", err)
+	}
+
+	emailPresenter := emails.NewPresenterFromConfig(emailPresenterCfg, profile.FullName)
+
+	subject, textBody, htmlBody, err := emailPresenter.RenderTrustCenterDocumentAccessRejected(
+		ctx,
+		fileNames,
+		organization.Name,
+	)
+	if err != nil {
+		return fmt.Errorf("cannot render trust center documents access rejected email: %w", err)
+	}
+
+	accessEmail := coredata.NewEmail(
+		profile.FullName,
+		profile.EmailAddress,
+		subject,
+		textBody,
+		htmlBody,
+		&coredata.EmailOptions{
+			SenderName: new(organization.Name),
+		},
+	)
+
+	if err := accessEmail.Insert(ctx, tx); err != nil {
+		return fmt.Errorf("cannot insert access email: %w", err)
+	}
+
+	return nil
+}
+
+func extractExistingIDs(accesses coredata.TrustCenterDocumentAccesses) ([]gid.GID, []gid.GID, []gid.GID) {
+	var (
+		documentIDs        []gid.GID
+		reportIDs          []gid.GID
+		trustCenterFileIDs []gid.GID
+	)
+
+	for _, access := range accesses {
+		if access.DocumentID != nil {
+			documentIDs = append(documentIDs, *access.DocumentID)
+		}
+
+		if access.ReportFileID != nil {
+			reportIDs = append(reportIDs, *access.ReportFileID)
+		}
+
+		if access.TrustCenterFileID != nil {
+			trustCenterFileIDs = append(trustCenterFileIDs, *access.TrustCenterFileID)
+		}
+	}
+
+	return documentIDs, reportIDs, trustCenterFileIDs
+}
+
+func filterExistingIDs(allIDs []gid.GID, existingIDs []gid.GID) []gid.GID {
+	existingMap := make(map[gid.GID]bool)
+	for _, id := range existingIDs {
+		existingMap[id] = true
+	}
+
+	var newIDs []gid.GID
+
+	for _, id := range allIDs {
+		if !existingMap[id] {
+			newIDs = append(newIDs, id)
+		}
+	}
+
+	return newIDs
+}
+
+func reportAccessLabels(
+	ctx context.Context,
+	conn pg.Querier,
+	scope coredata.Scoper,
+	reportFileIDs []gid.GID,
+) ([]string, error) {
+	var reportFiles coredata.Files
+	if err := reportFiles.LoadByIDs(ctx, conn, scope, reportFileIDs); err != nil && !errors.Is(err, coredata.ErrResourceNotFound) {
+		return nil, fmt.Errorf("cannot load report files by IDs: %w", err)
+	}
+
+	fileByID := make(map[gid.GID]*coredata.File, len(reportFiles))
+	for _, f := range reportFiles {
+		fileByID[f.ID] = f
+	}
+
+	var audits coredata.Audits
+	if err := audits.LoadByReportFileIDs(ctx, conn, scope, reportFileIDs); err != nil {
+		return nil, fmt.Errorf("cannot load audits by report file IDs: %w", err)
+	}
+
+	auditByFileID := make(map[gid.GID]*coredata.Audit, len(audits))
+	frameworkIDSet := make(map[gid.GID]struct{})
+
+	for _, audit := range audits {
+		if audit.ReportFileID == nil {
+			continue
+		}
+
+		if _, exists := auditByFileID[*audit.ReportFileID]; exists {
+			continue
+		}
+
+		auditByFileID[*audit.ReportFileID] = audit
+		frameworkIDSet[audit.FrameworkID] = struct{}{}
+	}
+
+	frameworkIDs := make([]gid.GID, 0, len(frameworkIDSet))
+	for frameworkID := range frameworkIDSet {
+		frameworkIDs = append(frameworkIDs, frameworkID)
+	}
+
+	frameworkByID := make(map[gid.GID]*coredata.Framework, len(frameworkIDs))
+
+	if len(frameworkIDs) > 0 {
+		var frameworks coredata.Frameworks
+		if err := frameworks.LoadByIDs(ctx, conn, scope, frameworkIDs); err != nil && !errors.Is(err, coredata.ErrResourceNotFound) {
+			return nil, fmt.Errorf("cannot load frameworks by IDs: %w", err)
+		}
+
+		for _, framework := range frameworks {
+			frameworkByID[framework.ID] = framework
+		}
+	}
+
+	labels := make([]string, 0, len(reportFileIDs))
+
+	for _, fileID := range reportFileIDs {
+		file, ok := fileByID[fileID]
+		if !ok {
+			return nil, fmt.Errorf("cannot load report file %q: %w", fileID, coredata.ErrResourceNotFound)
+		}
+
+		audit, ok := auditByFileID[fileID]
+		if !ok {
+			labels = append(labels, file.FileName)
+			continue
+		}
+
+		framework, ok := frameworkByID[audit.FrameworkID]
+		if !ok {
+			labels = append(labels, file.FileName)
+			continue
+		}
+
+		if audit.Name != nil && *audit.Name != "" {
+			labels = append(labels, fmt.Sprintf("%s - %s", framework.Name, *audit.Name))
+			continue
+		}
+
+		labels = append(labels, framework.Name)
+	}
+
+	return labels, nil
+}