rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Rewire server and probod for compliance portal API

Browse Source 
Mount the compliance portal mux on trust center hosts, drop the
legacy trust web server, and share response header helpers.

Signed-off-by: Bryan Frimin <bryan@probo.com>
This commit is contained in:
Bryan Frimin
2026-07-15 10:59:20 +02:00
parent c4a30e3b95
commit b73780f818
4 changed files with 104 additions and 135 deletions
Download Patch File Download Diff File Expand all files Collapse all files

56
pkg/probod/probod.go
View File

@@ -79,6 +79,7 @@ import (
"go.probo.inc/probo/pkg/riskmanagement"
"go.probo.inc/probo/pkg/securecookie"
"go.probo.inc/probo/pkg/server"
complianceportal_v1 "go.probo.inc/probo/pkg/server/api/complianceportal/v1"
"go.probo.inc/probo/pkg/server/gqlutils"
"go.probo.inc/probo/pkg/server/trustedproxy"
"go.probo.inc/probo/pkg/slack"
@@ -687,6 +688,21 @@ func (impl *Implm) Run(
resourceAliasService,
)
staticCIMDAllow := oauth2.CIMDAllowFromClientIDs(impl.cfg.Auth.OAuth2Server.CIMDAllowedClientIDs)
iamService.OAuth2ServerService.SetCIMDAllow(
func(ctx context.Context, clientIDURL string) (oauth2.CIMDAllowance, error) {
host, ok := oauth2.CIMDClientIDHost(clientIDURL)
if ok {
_, err := trustService.GetPortalByDomainName(ctx, host)
if err == nil {
return oauth2.CIMDAllowanceAllowedSkipConsent, nil
}
}
return staticCIMDAllow(ctx, clientIDURL)
},
)
accessReviewService := accessreview.NewService(
pgClient,
encryptionKey,
@@ -752,6 +768,40 @@ func (impl *Implm) Run(
return fmt.Errorf("cannot create server: %w", err)
}
compliancePortalHandler, err := complianceportal_v1.NewMux(
complianceportal_v1.MuxConfig{
BaseURL: baseURL,
ExtraHeaderFields: impl.cfg.Api.ExtraHeaderFields,
Logger: l.Named("compliance-portal"),
IAM: iamService,
Visitor: trustService,
ResourceAlias: resourceAliasService,
File: fileManagerService,
ESign: esignService,
Mailman: mailmanService,
Cookie: securecookie.Config{
Name: impl.cfg.Auth.Cookie.Name,
Domain: impl.cfg.Auth.Cookie.Domain,
Path: "/",
MaxAge: int(time.Duration(impl.cfg.Auth.Cookie.Duration) * time.Hour),
Secret: impl.cfg.Auth.Cookie.Secret,
Secure: impl.cfg.Auth.Cookie.Secure,
HTTPOnly: true,
SameSite: http.SameSiteLaxMode,
},
TokenSecret: impl.cfg.Auth.Cookie.Secret,
GraphQLLimits: gqlutils.Limits{
ParserTokenLimit: impl.cfg.Api.GraphQL.ParserTokenLimit,
ComplexityLimit: impl.cfg.Api.GraphQL.ComplexityLimit,
QueryCacheSize: impl.cfg.Api.GraphQL.QueryCacheSize,
DisableSuggestion: impl.cfg.Api.GraphQL.DisableSuggestion,
},
},
)
if err != nil {
return fmt.Errorf("cannot create trust center handler: %w", err)
}
apiServerCtx, stopApiServer := context.WithCancel(context.Background())
defer stopApiServer()
@@ -1095,7 +1145,7 @@ func (impl *Implm) Run(
r,
tp,
pgClient,
serverHandler.TrustCenterHandler(),
compliancePortalHandler,
trustService,
encryptionKey,
); err != nil {
@@ -1517,9 +1567,5 @@ func oauth2ServerOptions(cfg OAuth2ServerConfig) []oauth2.Option {
opts = append(opts, oauth2.WithDeviceCodeDuration(time.Duration(cfg.DeviceCodeDuration)*time.Second))
}
if len(cfg.CIMDAllowedClientIDs) > 0 {
opts = append(opts, oauth2.WithCIMDAllowedClientIDs(cfg.CIMDAllowedClientIDs))
}
return opts
}

40
pkg/server/api/api.go
View File

@@ -54,7 +54,6 @@ import (
files_v1 "go.probo.inc/probo/pkg/server/api/files/v1"
mcp_v1 "go.probo.inc/probo/pkg/server/api/mcp/v1"
slack_v1 "go.probo.inc/probo/pkg/server/api/slack/v1"
trust_v1 "go.probo.inc/probo/pkg/server/api/trust/v1"
"go.probo.inc/probo/pkg/server/gqlutils"
"go.probo.inc/probo/pkg/slack"
"go.probo.inc/probo/pkg/thirdparty"
@@ -95,15 +94,14 @@ type (
}
Server struct {
cfg Config
csrf *http.CrossOriginProtection
compliancePageHandler http.Handler
consoleHandler http.Handler
cookieBannerHandler http.Handler
filesHandler http.Handler
mcpHandler http.Handler
slackHandler http.Handler
connectHandler http.Handler
cfg Config
csrf *http.CrossOriginProtection
consoleHandler http.Handler
cookieBannerHandler http.Handler
filesHandler http.Handler
mcpHandler http.Handler
slackHandler http.Handler
connectHandler http.Handler
}
)
@@ -187,19 +185,6 @@ func NewServer(cfg Config) (*Server, error) {
return &Server{
cfg: cfg,
csrf: csrf,
compliancePageHandler: trust_v1.NewMux(
cfg.Logger.Named("trust.v1"),
cfg.IAM,
cfg.Trust,
cfg.ResourceAlias,
cfg.File,
cfg.ESign,
cfg.Mailman,
cfg.Cookie,
cfg.TokenSecret,
cfg.BaseURL,
cfg.GraphQLLimits,
),
consoleHandler: console_v1.NewMux(
cfg.Logger.Named("console.v1"),
cfg.Probo,
@@ -258,6 +243,7 @@ func NewServer(cfg Config) (*Server, error) {
connectHandler: connect_v1.NewMux(
cfg.Logger.Named("connect.v1"),
cfg.IAM,
cfg.Trust,
cfg.Cookie,
cfg.TokenSecret,
cfg.File,
@@ -271,19 +257,11 @@ func NewServer(cfg Config) (*Server, error) {
return err == nil
},
func(ctx context.Context, host string) bool {
_, err := cfg.Trust.GetPortalByDomainName(ctx, host)
return err == nil
},
cfg.GraphQLLimits,
),
}, nil
}
func (s *Server) CompliancePageHandler() http.Handler {
return s.compliancePageHandler
}
func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
corsOpts := cors.Options{
AllowedOrigins: s.cfg.AllowedOrigins,

36
pkg/server/response_headers.go Normal file
View File

@@ -0,0 +1,36 @@
// Copyright (c) 2026 Probo Inc <hello@probo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package server
import "net/http"
const strictTransportSecurityValue = "max-age=31536000; preload"
func ApplyExtraHeaders(w http.ResponseWriter, extraHeaderFields map[string]string) {
for key, value := range extraHeaderFields {
w.Header().Set(key, value)
}
}
func NewSecurityHeadersMiddleware(extraHeaderFields map[string]string) func(next http.Handler) http.Handler {
return func(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Strict-Transport-Security", strictTransportSecurityValue)
ApplyExtraHeaders(w, extraHeaderFields)
next.ServeHTTP(w, r)
})
}
}

107
pkg/server/server.go
View File

@@ -21,13 +21,11 @@
package server
import (
"errors"
"net/http"
"github.com/go-chi/chi/v5"
"go.gearno.de/kit/httpserver"
"go.gearno.de/kit/log"
"go.gearno.de/x/ref"
"go.probo.inc/probo/pkg/accessreview"
"go.probo.inc/probo/pkg/agentrun"
"go.probo.inc/probo/pkg/baseurl"
@@ -40,17 +38,15 @@ import (
"go.probo.inc/probo/pkg/filemanager"
"go.probo.inc/probo/pkg/geoloc"
"go.probo.inc/probo/pkg/iam"
"go.probo.inc/probo/pkg/iam/oauth2"
"go.probo.inc/probo/pkg/mailman"
"go.probo.inc/probo/pkg/probo"
"go.probo.inc/probo/pkg/resourcealias"
"go.probo.inc/probo/pkg/riskmanagement"
"go.probo.inc/probo/pkg/securecookie"
"go.probo.inc/probo/pkg/server/api"
"go.probo.inc/probo/pkg/server/api/complianceportal"
connect_v1 "go.probo.inc/probo/pkg/server/api/connect/v1"
"go.probo.inc/probo/pkg/server/gqlutils"
"go.probo.inc/probo/pkg/server/mailactions"
trust_web "go.probo.inc/probo/pkg/server/trust"
console_web "go.probo.inc/probo/pkg/server/web"
"go.probo.inc/probo/pkg/slack"
"go.probo.inc/probo/pkg/thirdparty"
@@ -86,16 +82,15 @@ type Config struct {
}
type Server struct {
cfg Config
apiServer *api.Server
mailActionsHandler http.Handler
consoleWebServer *console_web.Server
trustWebServer *trust_web.Server
router *chi.Mux
extraHeaderFields map[string]string
baseURL string
proboService *probo.Service
iamService *iam.Service
trustService *trust.Service
logger *log.Logger
}
@@ -137,24 +132,18 @@ func NewServer(cfg Config) (*Server, error) {
return nil, err
}
trustWebServer, err := trust_web.NewServer(compliancePageHeadData(cfg.BaseURL))
if err != nil {
return nil, err
}
router := chi.NewRouter()
server := &Server{
cfg: cfg,
apiServer: apiServer,
mailActionsHandler: mailactions.NewMux(cfg.Mailman, cfg.TokenSecret),
consoleWebServer: consoleWebServer,
trustWebServer: trustWebServer,
router: router,
extraHeaderFields: cfg.ExtraHeaderFields,
baseURL: cfg.BaseURL.String(),
proboService: cfg.Probo,
iamService: cfg.IAM,
trustService: cfg.Trust,
logger: cfg.Logger,
}
@@ -182,26 +171,14 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
}
func (s *Server) setExtraHeaders(w http.ResponseWriter) {
for key, value := range s.extraHeaderFields {
w.Header().Set(key, value)
}
ApplyExtraHeaders(w, s.extraHeaderFields)
}
func (s *Server) oidcDiscoveryHandler(w http.ResponseWriter, r *http.Request) {
api := s.baseURL + "/api/connect/v1"
endpoints := oauth2.Endpoints{
Authorization: uri.URI(api + "/oauth2/authorize"),
Token: uri.URI(api + "/oauth2/token"),
Userinfo: uri.URI(api + "/oauth2/userinfo"),
JWKS: uri.URI(api + "/oauth2/jwks"),
Registration: uri.URI(api + "/oauth2/register"),
Introspection: uri.URI(api + "/oauth2/introspect"),
Revocation: uri.URI(api + "/oauth2/revoke"),
DeviceAuthorization: uri.URI(api + "/oauth2/device"),
}
metadata := s.iamService.OAuth2ServerMetadata(endpoints)
metadata := connect_v1.OAuth2ServerMetadata(
s.cfg.BaseURL,
s.iamService.OAuth2ScopeRegistry.RegisteredScopes(),
)
w.Header().Set("Cache-Control", "public, max-age=3600")
httpserver.RenderJSON(w, http.StatusOK, metadata)
@@ -214,71 +191,3 @@ func (s *Server) protectedResourceMetadataHandler(w http.ResponseWriter, r *http
w.Header().Set("Cache-Control", "public, max-age=3600")
httpserver.RenderJSON(w, http.StatusOK, metadata)
}
func (s *Server) handleCustomDomain404(w http.ResponseWriter, r *http.Request) {
httpserver.RenderError(w, http.StatusNotFound, errors.New("not found"))
}
func (s *Server) trustCenterRouter() chi.Router {
r := chi.NewRouter()
h := complianceportal.NewHandler(s.trustService)
r.Mount("/api/trust/v1", s.apiServer.CompliancePageHandler())
r.Get("/llms.txt", h.HandleLLMsTxt)
r.Get("/robots.txt", h.HandleRobotsTxt)
r.Get("/sitemap.xml", h.HandleSitemap)
r.Handle("/*", s.trustWebServer)
return r
}
func (s *Server) TrustCenterHandler() http.Handler {
r := chi.NewRouter()
r.Use(complianceportal.NewSNIMiddleware(s.trustService))
r.Use(func(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Strict-Transport-Security", "max-age=31536000; preload")
s.setExtraHeaders(w)
next.ServeHTTP(w, r)
})
})
r.NotFound(s.handleCustomDomain404)
r.Mount("/", s.trustCenterRouter())
return r
}
func compliancePageHeadData(baseURL *baseurl.BaseURL) trust_web.HeadDataFunc {
return func(r *http.Request) trust_web.HeadData {
tc := complianceportal.CompliancePageFromContext(r.Context())
if tc == nil {
return trust_web.HeadData{Title: "Compliance Page"}
}
compliancePageBaseURL := complianceportal.CompliancePageBaseURLFromContext(r.Context())
description := tc.Title + " Compliance Page"
if tc.Description != nil && *tc.Description != "" {
description = *tc.Description
}
headData := trust_web.HeadData{
Title: tc.Title,
Description: description,
OGURL: ref.UnrefOrZero(compliancePageBaseURL),
}
if tc.LogoFileID != nil {
faviconURL, err := baseURL.WithPath("/api/files/v1/public/" + tc.LogoFileID.String()).String()
if err == nil {
headData.FaviconURL = faviconURL
}
}
return headData
}
}