Rename visitor import and management wiring

Drop the misleading trust alias for complianceportal/visitor
and rename the CustomDomain config field to Management so
service wiring matches the package it points at.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/probod/probod.go

@@ -54,7 +54,7 @@ import (
 	"go.probo.inc/probo/pkg/certmanager"
 	"go.probo.inc/probo/pkg/complianceportal"
 	"go.probo.inc/probo/pkg/complianceportal/management"
-	trust "go.probo.inc/probo/pkg/complianceportal/visitor"
+	"go.probo.inc/probo/pkg/complianceportal/visitor"
 	"go.probo.inc/probo/pkg/connector"
 	"go.probo.inc/probo/pkg/connector/provider"
 	"go.probo.inc/probo/pkg/cookiebanner"
@@ -672,7 +672,7 @@ func (impl *Implm) Run(
 		l.Named("compliance-portal-management"),
 	)
 
-	trustService := trust.NewService(
+	trustService := visitor.NewService(
 		pgClient,
 		s3Client,
 		impl.cfg.AWS.Bucket,
@@ -731,7 +731,7 @@ func (impl *Implm) Run(
 			IAM:               iamService,
 			Trust:             trustService,
 			ESign:             esignService,
-			CustomDomain:      managementService,
+			Management:        managementService,
 			AccessReview:      accessReviewService,
 			AgentRun:          agentRunService,
 			Mailman:           mailmanService,
@@ -1299,7 +1299,7 @@ func (impl *Implm) runApiServer(
 	return ctx.Err()
 }
 
-func newTrustCenterHTTPRedirectHandler(trustService *trust.Service, l *log.Logger) http.Handler {
+func newTrustCenterHTTPRedirectHandler(trustService *visitor.Service, l *log.Logger) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		ctx := r.Context()
 
@@ -1317,7 +1317,7 @@ func newTrustCenterHTTPRedirectHandler(trustService *trust.Service, l *log.Logge
 
 		// Check if this domain is a trust center custom domain
 		if _, err := trustService.GetPortalByDomainName(ctx, domain); err != nil {
-			if errors.Is(err, trust.ErrPageNotFound) || errors.Is(err, coredata.ErrResourceNotFound) {
+			if errors.Is(err, visitor.ErrPageNotFound) || errors.Is(err, coredata.ErrResourceNotFound) {
 				// Not a trust center domain, return 404
 				httpserver.RenderError(w, http.StatusNotFound, errors.New("not found"))
 				return
@@ -1353,7 +1353,7 @@ func (impl *Implm) runTrustCenterServer(
 	tp trace.TracerProvider,
 	pgClient *pg.Client,
 	trustRouter http.Handler,
-	trustService *trust.Service,
+	trustService *visitor.Service,
 	encryptionKey cipher.EncryptionKey,
 ) error {
 	tracer := tp.Tracer("go.probo.inc/probo/pkg/probod")

pkg/server/api/api.go

@@ -35,7 +35,7 @@ import (
 	"go.probo.inc/probo/pkg/agentrun"
 	"go.probo.inc/probo/pkg/baseurl"
 	"go.probo.inc/probo/pkg/complianceportal/management"
-	trust "go.probo.inc/probo/pkg/complianceportal/visitor"
+	"go.probo.inc/probo/pkg/complianceportal/visitor"
 	"go.probo.inc/probo/pkg/connector"
 	"go.probo.inc/probo/pkg/connector/provider"
 	"go.probo.inc/probo/pkg/cookiebanner"
@@ -67,9 +67,9 @@ type (
 		ResourceAlias     *resourcealias.Service
 		File              *filemanager.Service
 		IAM               *iam.Service
-		Trust             *trust.Service
+		Trust             *visitor.Service
 		ESign             *esign.Service
-		CustomDomain      *management.Service
+		Management        *management.Service
 		AccessReview      *accessreview.Service
 		AgentRun          *agentrun.Service
 		Slack             *slack.Service
@@ -191,7 +191,7 @@ func NewServer(cfg Config) (*Server, error) {
 			cfg.ResourceAlias,
 			cfg.IAM,
 			cfg.ESign,
-			cfg.CustomDomain,
+			cfg.Management,
 			cfg.AccessReview,
 			cfg.AgentRun,
 			cfg.Mailman,
@@ -224,7 +224,7 @@ func NewServer(cfg Config) (*Server, error) {
 		mcpHandler: mcp_v1.NewMux(
 			cfg.Logger.Named("mcp.v1"),
 			cfg.Probo,
-			cfg.CustomDomain,
+			cfg.Management,
 			cfg.ResourceAlias,
 			cfg.ThirdParty,
 			cfg.IAM,

pkg/server/api/complianceportal/markdown_handler.go

@@ -23,15 +23,15 @@ package complianceportal
 import (
 	"net/http"
 
-	trust "go.probo.inc/probo/pkg/complianceportal/visitor"
+	"go.probo.inc/probo/pkg/complianceportal/visitor"
 	"go.probo.inc/probo/pkg/coredata"
 )
 
 type Handler struct {
-	trustService *trust.Service
+	trustService *visitor.Service
 }
 
-func NewHandler(trustService *trust.Service) *Handler {
+func NewHandler(trustService *visitor.Service) *Handler {
 	return &Handler{trustService: trustService}
 }
 

pkg/server/api/complianceportal/member_provisioning_middleware.go

@@ -27,12 +27,12 @@ import (
 	"github.com/vektah/gqlparser/v2/gqlerror"
 	"go.gearno.de/kit/httpserver"
 	"go.gearno.de/kit/log"
-	trust "go.probo.inc/probo/pkg/complianceportal/visitor"
+	"go.probo.inc/probo/pkg/complianceportal/visitor"
 	"go.probo.inc/probo/pkg/server/api/authn"
 	"go.probo.inc/probo/pkg/server/gqlutils"
 )
 
-func NewMemberProvisioningMiddleware(trustSvc *trust.Service, logger *log.Logger) func(next http.Handler) http.Handler {
+func NewMemberProvisioningMiddleware(trustSvc *visitor.Service, logger *log.Logger) func(next http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(
 			func(w http.ResponseWriter, r *http.Request) {

pkg/server/api/complianceportal/sni_middleware.go

@@ -30,11 +30,11 @@ import (
 	"github.com/99designs/gqlgen/graphql"
 	"github.com/vektah/gqlparser/v2/gqlerror"
 	"go.gearno.de/kit/httpserver"
-	trust "go.probo.inc/probo/pkg/complianceportal/visitor"
+	"go.probo.inc/probo/pkg/complianceportal/visitor"
 	"go.probo.inc/probo/pkg/server/gqlutils"
 )
 
-func NewSNIMiddleware(trustSvc *trust.Service) func(next http.Handler) http.Handler {
+func NewSNIMiddleware(trustSvc *visitor.Service) func(next http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			ctx := r.Context()
@@ -46,7 +46,7 @@ func NewSNIMiddleware(trustSvc *trust.Service) func(next http.Handler) http.Hand
 
 			compliancePage, err := trustSvc.GetPortalByDomainName(ctx, r.TLS.ServerName)
 			if err != nil {
-				if errors.Is(err, trust.ErrPageNotFound) {
+				if errors.Is(err, visitor.ErrPageNotFound) {
 					next.ServeHTTP(w, r)
 					return
 				}
@@ -91,7 +91,7 @@ func NewSNIMiddleware(trustSvc *trust.Service) func(next http.Handler) http.Hand
 						RawQuery: r.URL.RawQuery,
 					}
 
-					http.Redirect(w, r, target.String(), http.StatusMovedPermanently)
+					http.Redirect(w, r, target.String(), http.StatusPermanentRedirect)
 
 					return
 				}

pkg/server/api/complianceportal/v1/base_resolvers.go

@@ -11,7 +11,7 @@ import (
 	"strings"
 
 	"go.gearno.de/kit/log"
-	trust "go.probo.inc/probo/pkg/complianceportal/visitor"
+	"go.probo.inc/probo/pkg/complianceportal/visitor"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/gid"
 	"go.probo.inc/probo/pkg/page"
@@ -51,11 +51,11 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 
 		document, err := trustService.GetDocument(ctx, scope, trustCenter.OrganizationID, id)
 		if err != nil {
-			if errors.Is(err, trust.ErrDocumentNotFound) || errors.Is(err, trust.ErrDocumentNotVisible) || errors.Is(err, coredata.ErrResourceNotFound) {
+			if errors.Is(err, visitor.ErrDocumentNotFound) || errors.Is(err, visitor.ErrDocumentNotVisible) || errors.Is(err, coredata.ErrResourceNotFound) {
 				return nil, gqlutils.NotFoundf(ctx, "node %q not found", id)
 			}
 
-			if _, ok := errors.AsType[*trust.ErrDocumentArchived](err); ok {
+			if _, ok := errors.AsType[*visitor.ErrDocumentArchived](err); ok {
 				return nil, gqlutils.NotFoundf(ctx, "node %q not found", id)
 			}
 
@@ -80,7 +80,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 
 		file, err := trustService.GetReport(ctx, scope, trustCenter.OrganizationID, id)
 		if err != nil {
-			if errors.Is(err, trust.ErrReportNotFound) || errors.Is(err, coredata.ErrResourceNotFound) {
+			if errors.Is(err, visitor.ErrReportNotFound) || errors.Is(err, coredata.ErrResourceNotFound) {
 				return nil, gqlutils.NotFoundf(ctx, "node %q not found", id)
 			}
 
@@ -132,7 +132,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 
 		trustCenterFile, err := trustService.GetPortalFile(ctx, scope, trustCenter.OrganizationID, id)
 		if err != nil {
-			if errors.Is(err, trust.ErrTrustCenterFileNotFound) || errors.Is(err, trust.ErrTrustCenterFileNotVisible) {
+			if errors.Is(err, visitor.ErrTrustCenterFileNotFound) || errors.Is(err, visitor.ErrTrustCenterFileNotVisible) {
 				return nil, gqlutils.NotFoundf(ctx, "node %q not found", id)
 			}
 

pkg/server/api/complianceportal/v1/graphql_handler.go

@@ -25,7 +25,7 @@ import (
 
 	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/baseurl"
-	trust "go.probo.inc/probo/pkg/complianceportal/visitor"
+	"go.probo.inc/probo/pkg/complianceportal/visitor"
 	"go.probo.inc/probo/pkg/esign"
 	"go.probo.inc/probo/pkg/filemanager"
 	"go.probo.inc/probo/pkg/iam"
@@ -41,7 +41,7 @@ import (
 
 func NewGraphQLHandler(
 	iamSvc *iam.Service,
-	trustSvc *trust.Service,
+	trustSvc *visitor.Service,
 	resourceAliasSvc *resourcealias.Service,
 	fileManagerSvc *filemanager.Service,
 	esignSvc *esign.Service,

pkg/server/api/complianceportal/v1/nda_directive.go

@@ -25,7 +25,7 @@ import (
 
 	"github.com/99designs/gqlgen/graphql"
 	"go.gearno.de/kit/log"
-	trust "go.probo.inc/probo/pkg/complianceportal/visitor"
+	"go.probo.inc/probo/pkg/complianceportal/visitor"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/esign"
 	"go.probo.inc/probo/pkg/server/api/authn"
@@ -35,7 +35,7 @@ import (
 
 func newNDADirective(
 	logger *log.Logger,
-	trustSvc *trust.Service,
+	trustSvc *visitor.Service,
 	esignSvc *esign.Service,
 ) func(ctx context.Context, obj any, next graphql.Resolver) (any, error) {
 	return func(ctx context.Context, obj any, next graphql.Resolver) (any, error) {

pkg/server/api/complianceportal/v1/resolver.go

@@ -21,7 +21,7 @@ import (
 
 	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/baseurl"
-	trust "go.probo.inc/probo/pkg/complianceportal/visitor"
+	"go.probo.inc/probo/pkg/complianceportal/visitor"
 	"go.probo.inc/probo/pkg/esign"
 	"go.probo.inc/probo/pkg/filemanager"
 	"go.probo.inc/probo/pkg/iam"
@@ -43,7 +43,7 @@ type (
 	}
 
 	Resolver struct {
-		trust         *trust.Service
+		trust         *visitor.Service
 		resourceAlias *resourcealias.Service
 		fileManager   *filemanager.Service
 		esign         *esign.Service

pkg/server/api/complianceportal/v1/trust_center_resolvers.go

@@ -12,7 +12,7 @@ import (
 	"fmt"
 
 	"go.gearno.de/kit/log"
-	trust "go.probo.inc/probo/pkg/complianceportal/visitor"
+	"go.probo.inc/probo/pkg/complianceportal/visitor"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/gid"
 	"go.probo.inc/probo/pkg/page"
@@ -106,10 +106,10 @@ func (r *auditReportResolver) IsUserAuthorized(ctx context.Context, obj *types.A
 		obj.ID,
 	)
 	if err != nil {
-		if errors.Is(err, trust.ErrMembershipNotFound) ||
+		if errors.Is(err, visitor.ErrMembershipNotFound) ||
-			errors.Is(err, trust.ErrUserNotFound) ||
+			errors.Is(err, visitor.ErrUserNotFound) ||
-			errors.Is(err, trust.ErrUserInactive) ||
+			errors.Is(err, visitor.ErrUserInactive) ||
-			errors.Is(err, trust.ErrDocumentAccessNotFound) {
+			errors.Is(err, visitor.ErrDocumentAccessNotFound) {
 			return false, nil
 		}
 
@@ -139,13 +139,13 @@ func (r *auditReportResolver) Access(ctx context.Context, obj *types.AuditReport
 		obj.ID,
 	)
 	if err != nil {
-		if errors.Is(err, trust.ErrMembershipNotFound) ||
+		if errors.Is(err, visitor.ErrMembershipNotFound) ||
-			errors.Is(err, trust.ErrUserNotFound) ||
+			errors.Is(err, visitor.ErrUserNotFound) ||
-			errors.Is(err, trust.ErrDocumentAccessNotFound) {
+			errors.Is(err, visitor.ErrDocumentAccessNotFound) {
 			return nil, nil
 		}
 
-		if errors.Is(err, trust.ErrUserInactive) {
+		if errors.Is(err, visitor.ErrUserInactive) {
 			return nil, gqlutils.Forbidden(ctx, err)
 		}
 
@@ -193,11 +193,11 @@ func (r *documentResolver) IsUserAuthorized(ctx context.Context, obj *types.Docu
 
 	document, err := trustService.GetDocument(ctx, scope, trustCenter.OrganizationID, obj.ID)
 	if err != nil {
-		if errors.Is(err, trust.ErrDocumentNotFound) || errors.Is(err, trust.ErrDocumentNotVisible) || errors.Is(err, coredata.ErrResourceNotFound) {
+		if errors.Is(err, visitor.ErrDocumentNotFound) || errors.Is(err, visitor.ErrDocumentNotVisible) || errors.Is(err, coredata.ErrResourceNotFound) {
 			return false, gqlutils.NotFoundf(ctx, "document %q not found", obj.ID)
 		}
 
-		if _, ok := errors.AsType[*trust.ErrDocumentArchived](err); ok {
+		if _, ok := errors.AsType[*visitor.ErrDocumentArchived](err); ok {
 			return false, gqlutils.NotFoundf(ctx, "document %q not found", obj.ID)
 		}
 
@@ -222,10 +222,10 @@ func (r *documentResolver) IsUserAuthorized(ctx context.Context, obj *types.Docu
 		obj.ID,
 	)
 	if err != nil {
-		if errors.Is(err, trust.ErrMembershipNotFound) ||
+		if errors.Is(err, visitor.ErrMembershipNotFound) ||
-			errors.Is(err, trust.ErrUserNotFound) ||
+			errors.Is(err, visitor.ErrUserNotFound) ||
-			errors.Is(err, trust.ErrUserInactive) ||
+			errors.Is(err, visitor.ErrUserInactive) ||
-			errors.Is(err, trust.ErrDocumentAccessNotFound) {
+			errors.Is(err, visitor.ErrDocumentAccessNotFound) {
 			return false, nil
 		}
 
@@ -255,13 +255,13 @@ func (r *documentResolver) Access(ctx context.Context, obj *types.Document) (*ty
 		obj.ID,
 	)
 	if err != nil {
-		if errors.Is(err, trust.ErrMembershipNotFound) ||
+		if errors.Is(err, visitor.ErrMembershipNotFound) ||
-			errors.Is(err, trust.ErrUserNotFound) ||
+			errors.Is(err, visitor.ErrUserNotFound) ||
-			errors.Is(err, trust.ErrDocumentAccessNotFound) {
+			errors.Is(err, visitor.ErrDocumentAccessNotFound) {
 			return nil, nil
 		}
 
-		if errors.Is(err, trust.ErrUserInactive) {
+		if errors.Is(err, visitor.ErrUserInactive) {
 			return nil, gqlutils.Forbidden(ctx, err)
 		}
 
@@ -321,7 +321,7 @@ func (r *mutationResolver) RequestAllAccesses(ctx context.Context) (*types.Reque
 
 	access, err := trustService.RequestPortalAccess(
 		ctx, scope,
-		&trust.PortalAccessRequest{
+		&visitor.PortalAccessRequest{
 			TrustCenterID: trustCenter.ID,
 			IdentityID:    identity.ID,
 			DocumentIDs:   nil,
@@ -350,11 +350,11 @@ func (r *mutationResolver) ExportDocumentPDF(ctx context.Context, input types.Ex
 
 	document, err := trustService.GetDocument(ctx, scope, trustCenter.OrganizationID, input.DocumentID)
 	if err != nil {
-		if errors.Is(err, trust.ErrDocumentNotFound) || errors.Is(err, trust.ErrDocumentNotVisible) || errors.Is(err, coredata.ErrResourceNotFound) {
+		if errors.Is(err, visitor.ErrDocumentNotFound) || errors.Is(err, visitor.ErrDocumentNotVisible) || errors.Is(err, coredata.ErrResourceNotFound) {
 			return nil, gqlutils.NotFoundf(ctx, "document %q not found", input.DocumentID)
 		}
 
-		if _, ok := errors.AsType[*trust.ErrDocumentArchived](err); ok {
+		if _, ok := errors.AsType[*visitor.ErrDocumentArchived](err); ok {
 			return nil, gqlutils.NotFoundf(ctx, "document %q not found", input.DocumentID)
 		}
 
@@ -467,7 +467,7 @@ func (r *mutationResolver) ExportTrustCenterFile(ctx context.Context, input type
 
 	trustCenterFile, err := trustService.GetPortalFile(ctx, scope, trustCenter.OrganizationID, input.TrustCenterFileID)
 	if err != nil {
-		if errors.Is(err, trust.ErrTrustCenterFileNotFound) || errors.Is(err, trust.ErrTrustCenterFileNotVisible) {
+		if errors.Is(err, visitor.ErrTrustCenterFileNotFound) || errors.Is(err, visitor.ErrTrustCenterFileNotVisible) {
 			return nil, gqlutils.NotFoundf(ctx, "trust center file %q not found", input.TrustCenterFileID)
 		}
 
@@ -525,11 +525,11 @@ func (r *mutationResolver) RequestDocumentAccess(ctx context.Context, input type
 
 	document, err := trustService.GetDocument(ctx, scope, trustCenter.OrganizationID, input.DocumentID)
 	if err != nil {
-		if errors.Is(err, trust.ErrDocumentNotFound) || errors.Is(err, trust.ErrDocumentNotVisible) || errors.Is(err, coredata.ErrResourceNotFound) {
+		if errors.Is(err, visitor.ErrDocumentNotFound) || errors.Is(err, visitor.ErrDocumentNotVisible) || errors.Is(err, coredata.ErrResourceNotFound) {
 			return nil, gqlutils.NotFoundf(ctx, "document %q not found", input.DocumentID)
 		}
 
-		if _, ok := errors.AsType[*trust.ErrDocumentArchived](err); ok {
+		if _, ok := errors.AsType[*visitor.ErrDocumentArchived](err); ok {
 			return nil, gqlutils.NotFoundf(ctx, "document %q not found", input.DocumentID)
 		}
 
@@ -552,7 +552,7 @@ func (r *mutationResolver) RequestDocumentAccess(ctx context.Context, input type
 
 	if _, err := trustService.RequestPortalAccess(
 		ctx, scope,
-		&trust.PortalAccessRequest{
+		&visitor.PortalAccessRequest{
 			TrustCenterID:      trustCenter.ID,
 			IdentityID:         identity.ID,
 			DocumentIDs:        []gid.GID{input.DocumentID},
@@ -595,7 +595,7 @@ func (r *mutationResolver) RequestReportAccess(ctx context.Context, input types.
 
 	if _, err := trustService.RequestPortalAccess(
 		ctx, scope,
-		&trust.PortalAccessRequest{
+		&visitor.PortalAccessRequest{
 			TrustCenterID:      trustCenter.ID,
 			IdentityID:         identity.ID,
 			DocumentIDs:        []gid.GID{},
@@ -620,7 +620,7 @@ func (r *mutationResolver) RequestTrustCenterFileAccess(ctx context.Context, inp
 
 	trustCenterFile, err := trustService.GetPortalFile(ctx, scope, trustCenter.OrganizationID, input.TrustCenterFileID)
 	if err != nil {
-		if errors.Is(err, trust.ErrTrustCenterFileNotFound) || errors.Is(err, trust.ErrTrustCenterFileNotVisible) {
+		if errors.Is(err, visitor.ErrTrustCenterFileNotFound) || errors.Is(err, visitor.ErrTrustCenterFileNotVisible) {
 			return nil, gqlutils.NotFoundf(ctx, "trust center file %q not found", input.TrustCenterFileID)
 		}
 
@@ -643,7 +643,7 @@ func (r *mutationResolver) RequestTrustCenterFileAccess(ctx context.Context, inp
 
 	if _, err := trustService.RequestPortalAccess(
 		ctx, scope,
-		&trust.PortalAccessRequest{
+		&visitor.PortalAccessRequest{
 			TrustCenterID:      trustCenter.ID,
 			IdentityID:         identity.ID,
 			DocumentIDs:        []gid.GID{},
@@ -986,7 +986,7 @@ func (r *trustCenterFileResolver) IsUserAuthorized(ctx context.Context, obj *typ
 
 	trustCenterFile, err := trustService.GetPortalFile(ctx, scope, trustCenter.OrganizationID, obj.ID)
 	if err != nil {
-		if errors.Is(err, trust.ErrTrustCenterFileNotFound) || errors.Is(err, trust.ErrTrustCenterFileNotVisible) {
+		if errors.Is(err, visitor.ErrTrustCenterFileNotFound) || errors.Is(err, visitor.ErrTrustCenterFileNotVisible) {
 			return false, gqlutils.NotFoundf(ctx, "trust center file %q not found", obj.ID)
 		}
 
@@ -1010,10 +1010,10 @@ func (r *trustCenterFileResolver) IsUserAuthorized(ctx context.Context, obj *typ
 		obj.ID,
 	)
 	if err != nil {
-		if errors.Is(err, trust.ErrMembershipNotFound) ||
+		if errors.Is(err, visitor.ErrMembershipNotFound) ||
-			errors.Is(err, trust.ErrUserNotFound) ||
+			errors.Is(err, visitor.ErrUserNotFound) ||
-			errors.Is(err, trust.ErrUserInactive) ||
+			errors.Is(err, visitor.ErrUserInactive) ||
-			errors.Is(err, trust.ErrDocumentAccessNotFound) {
+			errors.Is(err, visitor.ErrDocumentAccessNotFound) {
 			return false, nil
 		}
 
@@ -1043,13 +1043,13 @@ func (r *trustCenterFileResolver) Access(ctx context.Context, obj *types.TrustCe
 		obj.ID,
 	)
 	if err != nil {
-		if errors.Is(err, trust.ErrMembershipNotFound) ||
+		if errors.Is(err, visitor.ErrMembershipNotFound) ||
-			errors.Is(err, trust.ErrUserNotFound) ||
+			errors.Is(err, visitor.ErrUserNotFound) ||
-			errors.Is(err, trust.ErrDocumentAccessNotFound) {
+			errors.Is(err, visitor.ErrDocumentAccessNotFound) {
 			return nil, nil
 		}
 
-		if errors.Is(err, trust.ErrUserInactive) {
+		if errors.Is(err, visitor.ErrUserInactive) {
 			return nil, gqlutils.Forbidden(ctx, err)
 		}
 

pkg/server/api/connect/v1/graphql_handler.go

@@ -25,7 +25,7 @@ import (
 
 	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/baseurl"
-	trust "go.probo.inc/probo/pkg/complianceportal/visitor"
+	"go.probo.inc/probo/pkg/complianceportal/visitor"
 	"go.probo.inc/probo/pkg/filemanager"
 	"go.probo.inc/probo/pkg/iam"
 	"go.probo.inc/probo/pkg/securecookie"
@@ -39,7 +39,7 @@ import (
 
 func NewGraphQLHandler(
 	svc *iam.Service,
-	trustSvc *trust.Service,
+	trustSvc *visitor.Service,
 	logger *log.Logger,
 	fileManagerSvc *filemanager.Service,
 	baseURL *baseurl.BaseURL,

pkg/server/api/connect/v1/resolver.go

@@ -49,7 +49,7 @@ import (
 	"github.com/go-chi/chi/v5"
 	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/baseurl"
-	trust "go.probo.inc/probo/pkg/complianceportal/visitor"
+	"go.probo.inc/probo/pkg/complianceportal/visitor"
 	"go.probo.inc/probo/pkg/filemanager"
 	"go.probo.inc/probo/pkg/gid"
 	"go.probo.inc/probo/pkg/iam"
@@ -68,7 +68,7 @@ type (
 		batchAuthorize authz.BatchAuthorizeFunc
 		logger         *log.Logger
 		iam            *iam.Service
-		trust          *trust.Service
+		trust          *visitor.Service
 		scopeRegistry  *oauth2scope.Registry
 		fileManager    *filemanager.Service
 		baseURL        *baseurl.BaseURL
@@ -79,7 +79,7 @@ type (
 func NewMux(
 	logger *log.Logger,
 	svc *iam.Service,
-	trustSvc *trust.Service,
+	trustSvc *visitor.Service,
 	cookieConfig securecookie.Config,
 	tokenSecret string,
 	fileManagerSvc *filemanager.Service,

pkg/server/api/slack/v1/resolver.go

@@ -23,14 +23,14 @@ package slack_v1
 import (
 	"github.com/go-chi/chi/v5"
 	"go.gearno.de/kit/log"
-	trust "go.probo.inc/probo/pkg/complianceportal/visitor"
+	"go.probo.inc/probo/pkg/complianceportal/visitor"
 	"go.probo.inc/probo/pkg/slack"
 )
 
 func NewMux(
 	logger *log.Logger,
 	slackSvc *slack.Service,
-	trustSvc *trust.Service,
+	trustSvc *visitor.Service,
 ) *chi.Mux {
 	r := chi.NewMux()
 

pkg/server/api/slack/v1/slack_handler.go

@@ -30,7 +30,7 @@ import (
 
 	"go.gearno.de/kit/httpserver"
 	"go.gearno.de/kit/log"
-	trust "go.probo.inc/probo/pkg/complianceportal/visitor"
+	"go.probo.inc/probo/pkg/complianceportal/visitor"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/gid"
 	"go.probo.inc/probo/pkg/slack"
@@ -63,7 +63,7 @@ const (
 	StatusReject = "reject"
 )
 
-func SlackHandler(slackSvc *slack.Service, slackSigningSecret string, logger *log.Logger, trustSvc *trust.Service) http.HandlerFunc {
+func SlackHandler(slackSvc *slack.Service, slackSigningSecret string, logger *log.Logger, trustSvc *visitor.Service) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		ctx := r.Context()
 

pkg/server/response_headers.go

@@ -16,7 +16,7 @@ package server
 
 import "net/http"
 
-const strictTransportSecurityValue = "max-age=31536000; preload"
+const strictTransportSecurityValue = "max-age=31536000; includeSubDomains; preload"
 
 func ApplyExtraHeaders(w http.ResponseWriter, extraHeaderFields map[string]string) {
 	for key, value := range extraHeaderFields {
@@ -26,11 +26,13 @@ func ApplyExtraHeaders(w http.ResponseWriter, extraHeaderFields map[string]strin
 
 func NewSecurityHeadersMiddleware(extraHeaderFields map[string]string) func(next http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		return http.HandlerFunc(
-			w.Header().Set("Strict-Transport-Security", strictTransportSecurityValue)
+			func(w http.ResponseWriter, r *http.Request) {
-			ApplyExtraHeaders(w, extraHeaderFields)
+				w.Header().Set("Strict-Transport-Security", strictTransportSecurityValue)
+				ApplyExtraHeaders(w, extraHeaderFields)
 
-			next.ServeHTTP(w, r)
+				next.ServeHTTP(w, r)
-		})
+			},
+		)
 	}
 }

pkg/server/server.go

@@ -30,7 +30,7 @@ import (
 	"go.probo.inc/probo/pkg/agentrun"
 	"go.probo.inc/probo/pkg/baseurl"
 	"go.probo.inc/probo/pkg/complianceportal/management"
-	trust "go.probo.inc/probo/pkg/complianceportal/visitor"
+	"go.probo.inc/probo/pkg/complianceportal/visitor"
 	"go.probo.inc/probo/pkg/connector"
 	"go.probo.inc/probo/pkg/connector/provider"
 	"go.probo.inc/probo/pkg/cookiebanner"
@@ -61,9 +61,9 @@ type Config struct {
 	ResourceAlias     *resourcealias.Service
 	File              *filemanager.Service
 	IAM               *iam.Service
-	Trust             *trust.Service
+	Trust             *visitor.Service
 	ESign             *esign.Service
-	CustomDomain      *management.Service
+	Management        *management.Service
 	AccessReview      *accessreview.Service
 	AgentRun          *agentrun.Service
 	Slack             *slack.Service
@@ -104,7 +104,7 @@ func NewServer(cfg Config) (*Server, error) {
 		IAM:               cfg.IAM,
 		Trust:             cfg.Trust,
 		ESign:             cfg.ESign,
-		CustomDomain:      cfg.CustomDomain,
+		Management:        cfg.Management,
 		AccessReview:      cfg.AccessReview,
 		AgentRun:          cfg.AgentRun,
 		Slack:             cfg.Slack,