Replace vendor JSON with common third parties API

The CreateVendorDialog previously loaded the entire @probo/vendors
JSON bundle client-side and used MiniSearch for fuzzy search. This
replaces it with a GraphQL query against the common_third_parties
database table, searched server-side via ILIKE filtering.

Backend: adds CommonThirdParty GraphQL type, a pkg/thirdparty
service, and a commonThirdParties(name) root query. Frontend:
splits into CommonThirdPartyCombobox (display) and an @inline
fragment read on selection via readInlineData.

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/server/api/console/v1/base_resolvers.go

@@ -408,6 +408,22 @@ func (r *queryResolver) Viewer(ctx context.Context) (*types.Viewer, error) {
 	return &types.Viewer{ID: viewerID}, nil
 }
 
+// CommonThirdParties is the resolver for the commonThirdParties field.
+func (r *queryResolver) CommonThirdParties(ctx context.Context, name string) ([]*types.CommonThirdParty, error) {
+	parties, err := r.thirdParty.Search(ctx, name)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot search common third parties", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	result := make([]*types.CommonThirdParty, len(parties))
+	for i, p := range parties {
+		result[i] = types.NewCommonThirdParty(p)
+	}
+
+	return result, nil
+}
+
 // Mutation returns schema.MutationResolver implementation.
 func (r *Resolver) Mutation() schema.MutationResolver { return &mutationResolver{r} }
 

pkg/server/api/console/v1/graphql/base.graphql

@@ -25,6 +25,7 @@ interface Node {
 type Query {
     node(id: ID!): Node!
     viewer: Viewer!
+    commonThirdParties(name: String!): [CommonThirdParty!]!
 }
 
 type Mutation

pkg/server/api/console/v1/graphql/common_third_party.graphql

@@ -0,0 +1,34 @@
+# Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+# OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+type CommonThirdParty
+    @goModel(
+        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.CommonThirdParty"
+    ) {
+    id: ID!
+    name: String!
+    description: String
+    category: VendorCategory!
+    websiteUrl: String
+    headquarterAddress: String
+    legalName: String
+    privacyPolicyUrl: String
+    serviceLevelAgreementUrl: String
+    dataProcessingAgreementUrl: String
+    certifications: [String!]!
+    securityPageUrl: String
+    trustPageUrl: String
+    statusPageUrl: String
+    termsOfServiceUrl: String
+}

pkg/server/api/console/v1/graphql_handler.go

@@ -28,9 +28,21 @@ import (
 	"go.probo.inc/probo/pkg/server/api/authz"
 	"go.probo.inc/probo/pkg/server/api/console/v1/schema"
 	"go.probo.inc/probo/pkg/server/gqlutils"
+	"go.probo.inc/probo/pkg/thirdparty"
 )
 
-func NewGraphQLHandler(iamSvc *iam.Service, proboSvc *probo.Service, esignSvc *esign.Service, accessReviewSvc *accessreview.Service, mailmanSvc *mailman.Service, cookieBannerSvc *cookiebanner.Service, connectorRegistry *connector.ConnectorRegistry, customDomainCname string, logger *log.Logger) http.Handler {
+func NewGraphQLHandler(
+	iamSvc *iam.Service,
+	proboSvc *probo.Service,
+	esignSvc *esign.Service,
+	accessReviewSvc *accessreview.Service,
+	mailmanSvc *mailman.Service,
+	cookieBannerSvc *cookiebanner.Service,
+	connectorRegistry *connector.ConnectorRegistry,
+	customDomainCname string,
+	logger *log.Logger,
+	thirdPartySvc *thirdparty.Service,
+) http.Handler {
 	config := schema.Config{
 		Resolvers: &Resolver{
 			authorize:         authz.NewAuthorizeFunc(iamSvc, logger),
@@ -41,6 +53,7 @@ func NewGraphQLHandler(iamSvc *iam.Service, proboSvc *probo.Service, esignSvc *e
 			mailman:           mailmanSvc,
 			cookieBanner:      cookieBannerSvc,
 			connectorRegistry: connectorRegistry,
+			thirdParty:        thirdPartySvc,
 			customDomainCname: customDomainCname,
 			logger:            logger,
 		},

pkg/server/api/console/v1/resolver.go

@@ -41,6 +41,7 @@ import (
 	"go.probo.inc/probo/pkg/server/api/authz"
 	"go.probo.inc/probo/pkg/server/api/console/v1/dataloader"
 	"go.probo.inc/probo/pkg/server/api/console/v1/types"
+	"go.probo.inc/probo/pkg/thirdparty"
 )
 
 type (
@@ -53,6 +54,7 @@ type (
 		mailman           *mailman.Service
 		cookieBanner      *cookiebanner.Service
 		connectorRegistry *connector.ConnectorRegistry
+		thirdParty        *thirdparty.Service
 		logger            *log.Logger
 		customDomainCname string
 	}
@@ -71,6 +73,7 @@ func NewMux(
 	connectorRegistry *connector.ConnectorRegistry,
 	baseURL *baseurl.BaseURL,
 	customDomainCname string,
+	thirdPartySvc *thirdparty.Service,
 ) *chi.Mux {
 	r := chi.NewMux()
 
@@ -86,6 +89,7 @@ func NewMux(
 		connectorRegistry,
 		customDomainCname,
 		logger,
+		thirdPartySvc,
 	)
 
 	r.Group(func(r chi.Router) {

pkg/server/api/console/v1/types/common_third_party.go

@@ -0,0 +1,58 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/gid"
+)
+
+type CommonThirdParty struct {
+	ID                         gid.GID                 `json:"id"`
+	Name                       string                  `json:"name"`
+	Description                *string                 `json:"description,omitempty"`
+	Category                   coredata.VendorCategory `json:"category"`
+	WebsiteURL                 *string                 `json:"websiteUrl,omitempty"`
+	HeadquarterAddress         *string                 `json:"headquarterAddress,omitempty"`
+	LegalName                  *string                 `json:"legalName,omitempty"`
+	PrivacyPolicyURL           *string                 `json:"privacyPolicyUrl,omitempty"`
+	ServiceLevelAgreementURL   *string                 `json:"serviceLevelAgreementUrl,omitempty"`
+	DataProcessingAgreementURL *string                 `json:"dataProcessingAgreementUrl,omitempty"`
+	Certifications             []string                `json:"certifications"`
+	SecurityPageURL            *string                 `json:"securityPageUrl,omitempty"`
+	TrustPageURL               *string                 `json:"trustPageUrl,omitempty"`
+	StatusPageURL              *string                 `json:"statusPageUrl,omitempty"`
+	TermsOfServiceURL          *string                 `json:"termsOfServiceUrl,omitempty"`
+}
+
+func NewCommonThirdParty(c *coredata.CommonThirdParty) *CommonThirdParty {
+	return &CommonThirdParty{
+		ID:                         c.ID,
+		Name:                       c.Name,
+		Description:                c.Description,
+		Category:                   c.Category,
+		WebsiteURL:                 c.WebsiteURL,
+		HeadquarterAddress:         c.HeadquarterAddress,
+		LegalName:                  c.LegalName,
+		PrivacyPolicyURL:           c.PrivacyPolicyURL,
+		ServiceLevelAgreementURL:   c.ServiceLevelAgreementURL,
+		DataProcessingAgreementURL: c.DataProcessingAgreementURL,
+		Certifications:             c.Certifications,
+		SecurityPageURL:            c.SecurityPageURL,
+		TrustPageURL:               c.TrustPageURL,
+		StatusPageURL:              c.StatusPageURL,
+		TermsOfServiceURL:          c.TermsOfServiceURL,
+	}
+}