Self-host common third party logos via S3

Fetch favicons at import time instead of calling Google's favicon
service per page load. Logos are stored as public files in S3 and
served through the existing /api/files/v1/{id} endpoint.

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/coredata/common_third_party.go

@@ -46,6 +46,7 @@ type (
 		TermsOfServiceURL             *string        `db:"terms_of_service_url"`
 		SecurityPageURL               *string        `db:"security_page_url"`
 		TrustPageURL                  *string        `db:"trust_page_url"`
+		LogoFileID                    *gid.GID       `db:"logo_file_id"`
 		CreatedAt                     time.Time      `db:"created_at"`
 		UpdatedAt                     time.Time      `db:"updated_at"`
 	}
@@ -78,6 +79,7 @@ SELECT
     terms_of_service_url,
     security_page_url,
     trust_page_url,
+    logo_file_id,
     created_at,
     updated_at
 FROM
@@ -133,6 +135,7 @@ SELECT
     terms_of_service_url,
     security_page_url,
     trust_page_url,
+    logo_file_id,
     created_at,
     updated_at
 FROM
@@ -187,6 +190,7 @@ INSERT INTO common_third_parties (
     terms_of_service_url,
     security_page_url,
     trust_page_url,
+    logo_file_id,
     created_at,
     updated_at
 ) VALUES (
@@ -208,6 +212,7 @@ INSERT INTO common_third_parties (
     @terms_of_service_url,
     @security_page_url,
     @trust_page_url,
+    @logo_file_id,
     @created_at,
     @updated_at
 )
@@ -232,6 +237,7 @@ INSERT INTO common_third_parties (
 		"terms_of_service_url":             t.TermsOfServiceURL,
 		"security_page_url":                t.SecurityPageURL,
 		"trust_page_url":                   t.TrustPageURL,
+		"logo_file_id":                     t.LogoFileID,
 		"created_at":                       t.CreatedAt,
 		"updated_at":                       t.UpdatedAt,
 	}
@@ -271,6 +277,7 @@ INSERT INTO common_third_parties (
     terms_of_service_url,
     security_page_url,
     trust_page_url,
+    logo_file_id,
     created_at,
     updated_at
 ) VALUES (
@@ -292,6 +299,7 @@ INSERT INTO common_third_parties (
     @terms_of_service_url,
     @security_page_url,
     @trust_page_url,
+    @logo_file_id,
     @created_at,
     @updated_at
 )
@@ -337,6 +345,7 @@ RETURNING (xmax = 0) AS inserted
 		"terms_of_service_url":             t.TermsOfServiceURL,
 		"security_page_url":                t.SecurityPageURL,
 		"trust_page_url":                   t.TrustPageURL,
+		"logo_file_id":                     t.LogoFileID,
 		"created_at":                       t.CreatedAt,
 		"updated_at":                       t.UpdatedAt,
 	}
@@ -401,6 +410,7 @@ SELECT
     terms_of_service_url,
     security_page_url,
     trust_page_url,
+    logo_file_id,
     created_at,
     updated_at
 FROM
@@ -430,3 +440,34 @@ LIMIT 20
 
 	return nil
 }
+
+func (t CommonThirdParty) UpdateLogoFileID(
+	ctx context.Context,
+	conn pg.Tx,
+) error {
+	q := `
+UPDATE common_third_parties
+SET
+    logo_file_id = @logo_file_id,
+    updated_at   = @updated_at
+WHERE
+    id = @id
+`
+
+	args := pgx.StrictNamedArgs{
+		"id":           t.ID,
+		"logo_file_id": t.LogoFileID,
+		"updated_at":   t.UpdatedAt,
+	}
+
+	result, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot update common third party logo: %w", err)
+	}
+
+	if result.RowsAffected() == 0 {
+		return ErrResourceNotFound
+	}
+
+	return nil
+}

pkg/coredata/migrations/20260511T081055Z.sql

@@ -0,0 +1,15 @@
+-- Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+--
+-- Permission to use, copy, modify, and/or distribute this software for any
+-- purpose with or without fee is hereby granted, provided that the above
+-- copyright notice and this permission notice appear in all copies.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+-- PERFORMANCE OF THIS SOFTWARE.
+
+ALTER TABLE common_third_parties ADD COLUMN logo_file_id TEXT REFERENCES files(id);

pkg/probod/probod.go

@@ -520,7 +520,7 @@ func (impl *Implm) Run(
 		l.Named("access-review"),
 	)
 
-	thirdPartyService := thirdparty.NewService(pgClient)
+	thirdPartyService := thirdparty.NewService(pgClient, fileService)
 
 	serverHandler, err := server.NewServer(
 		server.Config{

pkg/server/api/console/v1/common_third_party_resolvers.go

@@ -0,0 +1,38 @@
+package console_v1
+
+// This file will be automatically regenerated based on the schema, any resolver
+// implementations
+// will be copied through when generating and any unknown code will be moved to the end.
+// Code generated by github.com/99designs/gqlgen version v0.17.90
+
+import (
+	"context"
+	"time"
+
+	"go.gearno.de/kit/log"
+	"go.probo.inc/probo/pkg/server/api/console/v1/schema"
+	"go.probo.inc/probo/pkg/server/api/console/v1/types"
+	"go.probo.inc/probo/pkg/server/gqlutils"
+)
+
+// LogoURL is the resolver for the logoUrl field.
+func (r *commonThirdPartyResolver) LogoURL(ctx context.Context, obj *types.CommonThirdParty) (*string, error) {
+	if obj.LogoFileID == nil {
+		return nil, nil
+	}
+
+	logoURL, err := r.thirdParty.GenerateLogoURL(ctx, *obj.LogoFileID, 1*time.Hour)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot generate common third party logo URL", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return logoURL, nil
+}
+
+// CommonThirdParty returns schema.CommonThirdPartyResolver implementation.
+func (r *Resolver) CommonThirdParty() schema.CommonThirdPartyResolver {
+	return &commonThirdPartyResolver{r}
+}
+
+type commonThirdPartyResolver struct{ *Resolver }

pkg/server/api/console/v1/graphql/common_third_party.graphql

@@ -31,4 +31,5 @@ type CommonThirdParty
     trustPageUrl: String
     statusPageUrl: String
     termsOfServiceUrl: String
+    logoUrl: String @goField(forceResolver: true)
 }

pkg/server/api/console/v1/types/common_third_party.go

@@ -35,6 +35,7 @@ type CommonThirdParty struct {
 	TrustPageURL               *string                 `json:"trustPageUrl,omitempty"`
 	StatusPageURL              *string                 `json:"statusPageUrl,omitempty"`
 	TermsOfServiceURL          *string                 `json:"termsOfServiceUrl,omitempty"`
+	LogoFileID                 *gid.GID                `json:"logoFileId,omitempty"`
 }
 
 func NewCommonThirdParty(c *coredata.CommonThirdParty) *CommonThirdParty {
@@ -54,5 +55,6 @@ func NewCommonThirdParty(c *coredata.CommonThirdParty) *CommonThirdParty {
 		TrustPageURL:               c.TrustPageURL,
 		StatusPageURL:              c.StatusPageURL,
 		TermsOfServiceURL:          c.TermsOfServiceURL,
+		LogoFileID:                 c.LogoFileID,
 	}
 }

pkg/thirdparty/service.go

@@ -17,17 +17,37 @@ package thirdparty
 import (
 	"context"
 	"fmt"
+	"time"
 
 	"go.gearno.de/kit/pg"
 	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/file"
+	"go.probo.inc/probo/pkg/gid"
 )
 
 type Service struct {
-	pg *pg.Client
+	pg   *pg.Client
+	file *file.Service
 }
 
-func NewService(pgClient *pg.Client) *Service {
-	return &Service{pg: pgClient}
+func NewService(pgClient *pg.Client, fileSvc *file.Service) *Service {
+	return &Service{
+		pg:   pgClient,
+		file: fileSvc,
+	}
+}
+
+func (s *Service) GenerateLogoURL(
+	ctx context.Context,
+	logoFileID gid.GID,
+	expiresIn time.Duration,
+) (*string, error) {
+	url, err := s.file.GetPublicFileURL(ctx, logoFileID, expiresIn)
+	if err != nil {
+		return nil, fmt.Errorf("cannot generate logo URL: %w", err)
+	}
+
+	return &url, nil
 }
 
 func (s *Service) Search(ctx context.Context, name string) ([]*coredata.CommonThirdParty, error) {