rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Rewire IAM, mailman, and probod for the portal

Browse Source 
Wire the certificate manager and trust center base domain into IAM so
organization creation provisions a managed default domain and certificate
atomically. Email presenters in IAM and mailman resolve public URLs
through the compliance portal resolver and read profile fields from the
trust center. probod initializes the certmanager service and injects the
new management and visitor services.

Signed-off-by: Bryan Frimin <bryan@probo.com>
This commit is contained in:
Bryan Frimin
2026-07-10 15:13:46 +02:00
parent 44ad34561e
commit a9a126899e
7 changed files with 234 additions and 208 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
pkg/server/api/api.go
View File

@@ -34,6 +34,8 @@ import (
"go.probo.inc/probo/pkg/accessreview"
"go.probo.inc/probo/pkg/agentrun"
"go.probo.inc/probo/pkg/baseurl"
"go.probo.inc/probo/pkg/complianceportal/management"
trust "go.probo.inc/probo/pkg/complianceportal/visitor"
"go.probo.inc/probo/pkg/connector"
"go.probo.inc/probo/pkg/connector/provider"
"go.probo.inc/probo/pkg/cookiebanner"
@@ -56,7 +58,6 @@ import (
"go.probo.inc/probo/pkg/server/gqlutils"
"go.probo.inc/probo/pkg/slack"
"go.probo.inc/probo/pkg/thirdparty"
"go.probo.inc/probo/pkg/trust"
)
type (
@@ -69,6 +70,7 @@ type (
IAM *iam.Service
Trust *trust.Service
ESign *esign.Service
CustomDomain *management.Service
AccessReview *accessreview.Service
AgentRun *agentrun.Service
Slack *slack.Service
@@ -204,6 +206,7 @@ func NewServer(cfg Config) (*Server, error) {
cfg.ResourceAlias,
cfg.IAM,
cfg.ESign,
cfg.CustomDomain,
cfg.AccessReview,
cfg.AgentRun,
cfg.Mailman,
@@ -236,6 +239,7 @@ func NewServer(cfg Config) (*Server, error) {
mcpHandler: mcp_v1.NewMux(
cfg.Logger.Named("mcp.v1"),
cfg.Probo,
cfg.CustomDomain,
cfg.ResourceAlias,
cfg.ThirdParty,
cfg.IAM,
@@ -263,12 +267,12 @@ func NewServer(cfg Config) (*Server, error) {
return true
}
_, err := cfg.Trust.GetByDomainName(ctx, host)
_, err := cfg.Trust.GetPortalByDomainName(ctx, host)
return err == nil
},
func(ctx context.Context, host string) bool {
_, err := cfg.Trust.GetByDomainName(ctx, host)
_, err := cfg.Trust.GetPortalByDomainName(ctx, host)
return err == nil
},
cfg.GraphQLLimits,
@@ -314,7 +318,6 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
r.Mount("/console/v1", http.StripPrefix("/console/v1", s.consoleHandler))
r.Mount("/connect/v1", http.StripPrefix("/connect/v1", s.connectHandler))
r.Mount("/files/v1", http.StripPrefix("/files/v1", s.filesHandler))
r.Mount("/trust/v1", http.StripPrefix("/trust/v1", s.compliancePageHandler))
r.Mount("/mcp/v1", http.StripPrefix("/mcp/v1", s.mcpHandler))
r.Mount("/slack/v1", http.StripPrefix("/slack/v1", s.slackHandler))
})

57
pkg/server/server.go
View File

@@ -23,8 +23,6 @@ package server
import (
"errors"
"net/http"
"path"
"strings"
"github.com/go-chi/chi/v5"
"go.gearno.de/kit/httpserver"
@@ -33,6 +31,8 @@ import (
"go.probo.inc/probo/pkg/accessreview"
"go.probo.inc/probo/pkg/agentrun"
"go.probo.inc/probo/pkg/baseurl"
"go.probo.inc/probo/pkg/complianceportal/management"
trust "go.probo.inc/probo/pkg/complianceportal/visitor"
"go.probo.inc/probo/pkg/connector"
"go.probo.inc/probo/pkg/connector/provider"
"go.probo.inc/probo/pkg/cookiebanner"
@@ -47,14 +47,13 @@ import (
"go.probo.inc/probo/pkg/riskmanagement"
"go.probo.inc/probo/pkg/securecookie"
"go.probo.inc/probo/pkg/server/api"
"go.probo.inc/probo/pkg/server/api/compliancepage"
"go.probo.inc/probo/pkg/server/api/complianceportal"
"go.probo.inc/probo/pkg/server/gqlutils"
"go.probo.inc/probo/pkg/server/mailactions"
trust_web "go.probo.inc/probo/pkg/server/trust"
console_web "go.probo.inc/probo/pkg/server/web"
"go.probo.inc/probo/pkg/slack"
"go.probo.inc/probo/pkg/thirdparty"
"go.probo.inc/probo/pkg/trust"
"go.probo.inc/probo/pkg/uri"
)
@@ -68,6 +67,7 @@ type Config struct {
IAM *iam.Service
Trust *trust.Service
ESign *esign.Service
CustomDomain *management.Service
AccessReview *accessreview.Service
AgentRun *agentrun.Service
Slack *slack.Service
@@ -109,6 +109,7 @@ func NewServer(cfg Config) (*Server, error) {
IAM: cfg.IAM,
Trust: cfg.Trust,
ESign: cfg.ESign,
CustomDomain: cfg.CustomDomain,
AccessReview: cfg.AccessReview,
AgentRun: cfg.AgentRun,
Slack: cfg.Slack,
@@ -157,12 +158,12 @@ func NewServer(cfg Config) (*Server, error) {
logger: cfg.Logger,
}
server.setupRoutes(cfg.BaseURL.String())
server.setupRoutes()
return server, nil
}
func (s *Server) setupRoutes(baseURL string) {
func (s *Server) setupRoutes() {
// OIDC Discovery 1.0 §4 and RFC 8414 §3 both require the metadata
// document at the issuer root under well-known paths.
s.router.Get("/.well-known/openid-configuration", s.oidcDiscoveryHandler)
@@ -172,12 +173,6 @@ func (s *Server) setupRoutes(baseURL string) {
s.router.Mount("/api", http.StripPrefix("/api", s.apiServer))
s.router.Mount("/mail-actions", http.StripPrefix("/mail-actions", s.mailActionsHandler))
s.router.Route("/trust/{slugOrId}", func(r chi.Router) {
r.Use(compliancepage.NewIDMiddleware(s.trustService, baseURL))
r.Use(s.stripTrustPrefix)
r.Mount("/", s.trustCenterRouter())
})
s.router.Mount("/", s.consoleWebServer)
}
@@ -224,31 +219,10 @@ func (s *Server) handleCustomDomain404(w http.ResponseWriter, r *http.Request) {
httpserver.RenderError(w, http.StatusNotFound, errors.New("not found"))
}
func (s *Server) stripTrustPrefix(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
slugOrId := chi.URLParam(r, "slugOrId")
prefix := "/trust/" + slugOrId
if r.URL.Path == prefix {
cleanPath := path.Clean(prefix) + "/"
http.Redirect(w, r, cleanPath, http.StatusMovedPermanently)
return
}
r.URL.Path = strings.TrimPrefix(r.URL.Path, prefix)
if r.URL.Path == "" {
r.URL.Path = "/"
}
next.ServeHTTP(w, r)
})
}
func (s *Server) trustCenterRouter() chi.Router {
r := chi.NewRouter()
h := compliancepage.NewHandler(s.trustService)
h := complianceportal.NewHandler(s.trustService)
r.Mount("/api/trust/v1", s.apiServer.CompliancePageHandler())
r.Get("/llms.txt", h.HandleLLMsTxt)
@@ -262,7 +236,7 @@ func (s *Server) trustCenterRouter() chi.Router {
func (s *Server) TrustCenterHandler() http.Handler {
r := chi.NewRouter()
r.Use(compliancepage.NewSNIMiddleware(s.trustService))
r.Use(complianceportal.NewSNIMiddleware(s.trustService))
r.Use(func(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Strict-Transport-Security", "max-age=31536000; preload")
@@ -280,21 +254,26 @@ func (s *Server) TrustCenterHandler() http.Handler {
func compliancePageHeadData(baseURL *baseurl.BaseURL, trustService *trust.Service) trust_web.HeadDataFunc {
return func(r *http.Request) trust_web.HeadData {
tc := compliancepage.CompliancePageFromContext(r.Context())
tc := complianceportal.CompliancePageFromContext(r.Context())
if tc == nil {
return trust_web.HeadData{Title: "Compliance Page"}
}
org, err := trustService.GetOrganizationByTrustCenterID(r.Context(), tc.ID)
org, err := trustService.GetPortalOrganization(r.Context(), tc.ID)
if err != nil || org == nil {
return trust_web.HeadData{Title: "Compliance Page"}
}
compliancePageBaseURL := compliancepage.CompliancePageBaseURLFromContext(r.Context())
compliancePageBaseURL := complianceportal.CompliancePageBaseURLFromContext(r.Context())
description := org.Name + " Compliance Page"
if tc.Description != nil && *tc.Description != "" {
description = *tc.Description
}
headData := trust_web.HeadData{
Title: org.Name + " — Compliance",
Description: org.Name + " Compliance Page",
Description: description,
OGURL: ref.UnrefOrZero(compliancePageBaseURL),
}