Add resourcealias application service

Introduce a standalone resourcealias package with its own service,
IAM policies, and OAuth2 scopes so alias management no longer lives
inside the trust center services. Remove the trust-center-specific
alias services from probo and trust, and wire the new service into
probod, the server, and the API layer.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/resourcealias/service.go

@@ -0,0 +1,185 @@
+// Copyright (c) 2025-2026 Probo Inc <hello@probo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package resourcealias
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/validator"
+)
+
+const aliasMaxLength = 100
+
+type (
+	Service struct {
+		pg *pg.Client
+	}
+
+	CreateRequest struct {
+		ResourceID gid.GID
+		Alias      string
+	}
+)
+
+func NewService(pgClient *pg.Client) *Service {
+	return &Service{
+		pg: pgClient,
+	}
+}
+
+func (req *CreateRequest) Validate() error {
+	v := validator.New()
+
+	v.Check(req.ResourceID, "resource_id", validator.Required(), validator.GID())
+	v.Check(req.Alias, "alias", validator.Required(), validator.Slug(aliasMaxLength))
+
+	return v.Error()
+}
+
+func (s *Service) ResolveAlias(
+	ctx context.Context,
+	scope coredata.Scoper,
+	alias string,
+) (gid.GID, error) {
+	record := &coredata.ResourceAlias{}
+
+	err := s.pg.WithConn(
+		ctx,
+		func(ctx context.Context, conn pg.Querier) error {
+			if err := record.LoadByAlias(ctx, conn, scope, alias); err != nil {
+				return fmt.Errorf("cannot load resource alias: %w", err)
+			}
+
+			return nil
+		},
+	)
+	if err != nil {
+		return gid.Nil, err
+	}
+
+	return record.ResourceID, nil
+}
+
+func (s *Service) Create(
+	ctx context.Context,
+	scope coredata.Scoper,
+	req CreateRequest,
+) (*coredata.ResourceAlias, error) {
+	if err := req.Validate(); err != nil {
+		return nil, err
+	}
+
+	alias := &coredata.ResourceAlias{}
+
+	err := s.pg.WithConn(
+		ctx,
+		func(ctx context.Context, conn pg.Querier) error {
+			if err := alias.Upsert(ctx, conn, scope, req.ResourceID, req.Alias); err != nil {
+				return fmt.Errorf("cannot create resource alias: %w", err)
+			}
+
+			return nil
+		},
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return alias, nil
+}
+
+func (s *Service) Remove(
+	ctx context.Context,
+	scope coredata.Scoper,
+	resourceID gid.GID,
+) error {
+	return s.pg.WithConn(
+		ctx,
+		func(ctx context.Context, conn pg.Querier) error {
+			alias := &coredata.ResourceAlias{ResourceID: resourceID}
+			if err := alias.Delete(ctx, conn, scope); err != nil {
+				return fmt.Errorf("cannot remove resource alias: %w", err)
+			}
+
+			return nil
+		},
+	)
+}
+
+func (s *Service) GetByResourceID(
+	ctx context.Context,
+	scope coredata.Scoper,
+	resourceID gid.GID,
+) (*string, error) {
+	record := &coredata.ResourceAlias{}
+
+	err := s.pg.WithConn(
+		ctx,
+		func(ctx context.Context, conn pg.Querier) error {
+			if err := record.LoadByResourceID(ctx, conn, scope, resourceID); err != nil {
+				return fmt.Errorf("cannot load resource alias: %w", err)
+			}
+
+			return nil
+		},
+	)
+	if err != nil {
+		if errors.Is(err, coredata.ErrResourceNotFound) {
+			return nil, nil
+		}
+
+		return nil, err
+	}
+
+	return &record.Alias, nil
+}
+
+func (s *Service) LoadByResourceIDs(
+	ctx context.Context,
+	scope coredata.Scoper,
+	resourceIDs []gid.GID,
+) (map[gid.GID]string, error) {
+	if len(resourceIDs) == 0 {
+		return map[gid.GID]string{}, nil
+	}
+
+	var aliases coredata.ResourceAliases
+
+	err := s.pg.WithConn(
+		ctx,
+		func(ctx context.Context, conn pg.Querier) error {
+			if err := aliases.LoadByResourceIDs(ctx, conn, scope, resourceIDs); err != nil {
+				return fmt.Errorf("cannot load resource aliases: %w", err)
+			}
+
+			return nil
+		},
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	result := make(map[gid.GID]string, len(aliases))
+	for _, alias := range aliases {
+		result[alias.ResourceID] = alias.Alias
+	}
+
+	return result, nil
+}