rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Flatten compliance portal package layout

Browse Source 
Remove the root complianceportal package and the resolver
facade that existed only to break an IAM import cycle. Admin
policies, domain URL helpers, and actions live under
management; visitor OAuth metadata, brand URLs, and public
read paths live under visitor. Drop the duplicate trust API
magic-link mutations now that Connect handles portal auth, and
stop IAM from owning compliance page email branding.

Signed-off-by: Bryan Frimin <bryan@probo.com>
This commit is contained in:
Bryan Frimin
2026-07-17 16:19:39 +02:00
parent 4cec74c1a1
commit 7e0d187dcf
57 changed files with 737 additions and 1061 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
pkg/iam/auth_service.go
View File

@@ -65,10 +65,6 @@ type (
Email mail.Addr
URLPath string
Continue *string
// If users tries to connect to compliance page, we must brand the emails accordingly
CompliancePageID *gid.GID
// OrganizationID brands compliance portal magic-link emails.
OrganizationID *gid.GID
// OAuth2ClientIDRaw brands connect authorize magic-link emails.
OAuth2ClientIDRaw *string
MagicLinkBaseURL *string
@@ -621,27 +617,10 @@ func (s AuthService) SendMagicLink(ctx context.Context, req *SendMagicLinkReques
if branding != nil {
senderName = branding.Name
}
} else if req.OrganizationID != nil {
organization := &coredata.Organization{}
if err := organization.LoadByID(ctx, tx, coredata.NewNoScope(), *req.OrganizationID); err != nil {
return fmt.Errorf("cannot load organization: %w", err)
}
senderName = organization.Name
}
emailPresenterCfg := emails.DefaultPresenterConfig(s.baseURL)
if req.CompliancePageID != nil {
var err error
emailPresenterCfg, err = s.CompliancePageService.EmailPresenterConfig(ctx, *req.CompliancePageID)
if err != nil {
return fmt.Errorf("cannot get compliance page email presenter config: %w", err)
}
}
if req.MagicLinkBaseURL != nil {
emailPresenterCfg.BaseURL = *req.MagicLinkBaseURL
}
@@ -659,20 +638,13 @@ func (s AuthService) SendMagicLink(ctx context.Context, req *SendMagicLinkReques
return fmt.Errorf("cannot render magic link email: %w", err)
}
var emailOpts *coredata.EmailOptions
if req.CompliancePageID != nil {
emailOpts = &coredata.EmailOptions{
SenderName: &senderName,
}
}
magicLinkEmail := coredata.NewEmail(
fullName,
req.Email,
subject,
textBody,
htmlBody,
emailOpts,
nil,
)
if err := magicLinkEmail.Insert(ctx, tx); err != nil {

163
pkg/iam/compliance_page_service.go
View File

@@ -1,163 +0,0 @@
// Copyright (c) 2026 Probo Inc <hello@probo.com>.
//
// Permission is hereby granted, free of charge, to any person obtaining a copy
// of this software and associated documentation files (the "Software"), to deal
// in the Software without restriction, including without limitation the rights
// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
// copies of the Software, and to permit persons to whom the Software is
// furnished to do so, subject to the following conditions:
//
// The above copyright notice and this permission notice shall be included in
// all copies or substantial portions of the Software.
//
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
// SOFTWARE.
package iam
import (
"context"
"fmt"
"path/filepath"
"time"
"go.gearno.de/kit/pg"
"go.probo.inc/probo/packages/emails"
"go.probo.inc/probo/pkg/complianceportal/resolver"
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/gid"
)
type (
CompliancePageService struct {
*Service
}
)
func NewCompliancePageService(svc *Service) *CompliancePageService {
return &CompliancePageService{Service: svc}
}
func (s *CompliancePageService) GenerateLogoURL(
ctx context.Context,
compliancePageID gid.GID,
expiresIn time.Duration,
) (*string, error) {
file := &coredata.File{}
compliancePage := &coredata.TrustCenter{}
scope := coredata.NewScopeFromObjectID(compliancePageID)
err := s.pg.WithConn(
ctx,
func(ctx context.Context, conn pg.Querier) error {
if err := compliancePage.LoadByID(ctx, conn, scope, compliancePageID); err != nil {
return fmt.Errorf("cannot load compliance page: %w", err)
}
if compliancePage.LogoFileID == nil {
return nil
}
if err := file.LoadByID(ctx, conn, scope, *compliancePage.LogoFileID); err != nil {
return fmt.Errorf("cannot load file: %w", err)
}
return nil
},
)
if err != nil {
return nil, err
}
if compliancePage.LogoFileID == nil {
return nil, nil
}
if file.FileKey == "" {
return nil, nil
}
presignedURL, err := s.fm.GeneratePresignedURL(ctx, file, expiresIn)
if err != nil {
return nil, fmt.Errorf("cannot generate file URL: %w", err)
}
return &presignedURL, nil
}
func (s *CompliancePageService) EmailPresenterConfig(ctx context.Context, compliancePageID gid.GID) (emails.PresenterConfig, error) {
var (
compliancePage = &coredata.TrustCenter{}
organization = &coredata.Organization{}
compliancePageURL string
logoFile = &coredata.File{}
emailPresenterCfg = emails.DefaultPresenterConfig(s.baseURL)
)
scope := coredata.NewScopeFromObjectID(compliancePageID)
err := s.pg.WithConn(
ctx,
func(ctx context.Context, conn pg.Querier) error {
if err := compliancePage.LoadByID(ctx, conn, scope, compliancePageID); err != nil {
return fmt.Errorf("cannot load compliance page: %w", err)
}
if compliancePage.LogoFileID != nil {
if err := logoFile.LoadByID(ctx, conn, scope, *compliancePage.LogoFileID); err != nil {
return fmt.Errorf("cannot load logoFile: %w", err)
}
}
if err := organization.LoadByID(ctx, conn, scope, compliancePage.OrganizationID); err != nil {
return fmt.Errorf("cannot load organization: %w", err)
}
publicURL, err := resolver.PublicURLForTrustCenter(
ctx,
conn,
scope,
compliancePage,
s.trustCenterBaseDomain,
)
if err != nil {
return fmt.Errorf("cannot resolve compliance page URL: %w", err)
}
compliancePageURL = publicURL
return nil
},
)
if err != nil {
return emailPresenterCfg, err
}
emailPresenterCfg.BaseURL = compliancePageURL
if compliancePage.LogoFileID != nil {
if logoFile.FileKey == "" {
return emailPresenterCfg, nil
}
// If logo exists, then we will brand the emails with the org as a sender
emailPresenterCfg.SenderCompanyLogoPath = filepath.Join("/api/files/v1/public/", logoFile.ID.String())
emailPresenterCfg.SenderCompanyName = organization.Name
if compliancePage.WebsiteURL != nil {
emailPresenterCfg.SenderCompanyWebsiteURL = *compliancePage.WebsiteURL
}
if compliancePage.HeadquarterAddress != nil {
emailPresenterCfg.SenderCompanyHeadquarterAddress = *compliancePage.HeadquarterAddress
}
}
return emailPresenterCfg, nil
}

2
pkg/iam/organization_service.go
View File

@@ -613,7 +613,7 @@ func (s *OrganizationService) CreateOrganization(
OrganizationID: organization.ID,
TenantID: organization.TenantID,
Active: false,
Slug: slug.Make(organization.Name),
Slug: slug.MakeWithEntropy(organization.Name),
Title: organization.Name,
SearchEngineIndexing: coredata.SearchEngineIndexingNotIndexable,
MailingListID: &mailingList.ID,

24
pkg/iam/service.go
View File

@@ -69,18 +69,17 @@ type (
privateKey *rsa.PrivateKey
logger *log.Logger
AccountService *AccountService
OrganizationService *OrganizationService
CompliancePageService *CompliancePageService
SessionService *SessionService
AuthService *AuthService
SAMLService *saml.Service
OIDCService *oidc.Service
SCIMService *scim.Service
APIKeyService *APIKeyService
OAuth2ServerService *oauth2.Service
Authorizer *Authorizer
OAuth2ScopeRegistry *oauth2scope.Registry
AccountService *AccountService
OrganizationService *OrganizationService
SessionService *SessionService
AuthService *AuthService
SAMLService *saml.Service
OIDCService *oidc.Service
SCIMService *scim.Service
APIKeyService *APIKeyService
OAuth2ServerService *oauth2.Service
Authorizer *Authorizer
OAuth2ScopeRegistry *oauth2scope.Registry
samlDomainVerifier *SAMLDomainVerifier
}
@@ -174,7 +173,6 @@ func NewService(
svc.AccountService = NewAccountService(svc)
svc.OrganizationService = NewOrganizationService(svc)
svc.CompliancePageService = NewCompliancePageService(svc)
svc.SessionService = NewSessionService(svc)
svc.AuthService = NewAuthService(svc)
svc.APIKeyService = NewAPIKeyService(svc)