From b73780f818b938a501b49a0d358677b8f9bca1df Mon Sep 17 00:00:00 2001 From: Bryan Frimin Date: Wed, 15 Jul 2026 10:59:20 +0200 Subject: [PATCH] Rewire server and probod for compliance portal API Mount the compliance portal mux on trust center hosts, drop the legacy trust web server, and share response header helpers. Signed-off-by: Bryan Frimin --- pkg/probod/probod.go | 56 +++++++++++++++-- pkg/server/api/api.go | 40 +++--------- pkg/server/response_headers.go | 36 +++++++++++ pkg/server/server.go | 107 +++------------------------------ 4 files changed, 104 insertions(+), 135 deletions(-) create mode 100644 pkg/server/response_headers.go diff --git a/pkg/probod/probod.go b/pkg/probod/probod.go index d4ef82d35..ad1e528e4 100644 --- a/pkg/probod/probod.go +++ b/pkg/probod/probod.go @@ -79,6 +79,7 @@ import ( "go.probo.inc/probo/pkg/riskmanagement" "go.probo.inc/probo/pkg/securecookie" "go.probo.inc/probo/pkg/server" + complianceportal_v1 "go.probo.inc/probo/pkg/server/api/complianceportal/v1" "go.probo.inc/probo/pkg/server/gqlutils" "go.probo.inc/probo/pkg/server/trustedproxy" "go.probo.inc/probo/pkg/slack" @@ -687,6 +688,21 @@ func (impl *Implm) Run( resourceAliasService, ) + staticCIMDAllow := oauth2.CIMDAllowFromClientIDs(impl.cfg.Auth.OAuth2Server.CIMDAllowedClientIDs) + iamService.OAuth2ServerService.SetCIMDAllow( + func(ctx context.Context, clientIDURL string) (oauth2.CIMDAllowance, error) { + host, ok := oauth2.CIMDClientIDHost(clientIDURL) + if ok { + _, err := trustService.GetPortalByDomainName(ctx, host) + if err == nil { + return oauth2.CIMDAllowanceAllowedSkipConsent, nil + } + } + + return staticCIMDAllow(ctx, clientIDURL) + }, + ) + accessReviewService := accessreview.NewService( pgClient, encryptionKey, @@ -752,6 +768,40 @@ func (impl *Implm) Run( return fmt.Errorf("cannot create server: %w", err) } + compliancePortalHandler, err := complianceportal_v1.NewMux( + complianceportal_v1.MuxConfig{ + BaseURL: baseURL, + ExtraHeaderFields: impl.cfg.Api.ExtraHeaderFields, + Logger: l.Named("compliance-portal"), + IAM: iamService, + Visitor: trustService, + ResourceAlias: resourceAliasService, + File: fileManagerService, + ESign: esignService, + Mailman: mailmanService, + Cookie: securecookie.Config{ + Name: impl.cfg.Auth.Cookie.Name, + Domain: impl.cfg.Auth.Cookie.Domain, + Path: "/", + MaxAge: int(time.Duration(impl.cfg.Auth.Cookie.Duration) * time.Hour), + Secret: impl.cfg.Auth.Cookie.Secret, + Secure: impl.cfg.Auth.Cookie.Secure, + HTTPOnly: true, + SameSite: http.SameSiteLaxMode, + }, + TokenSecret: impl.cfg.Auth.Cookie.Secret, + GraphQLLimits: gqlutils.Limits{ + ParserTokenLimit: impl.cfg.Api.GraphQL.ParserTokenLimit, + ComplexityLimit: impl.cfg.Api.GraphQL.ComplexityLimit, + QueryCacheSize: impl.cfg.Api.GraphQL.QueryCacheSize, + DisableSuggestion: impl.cfg.Api.GraphQL.DisableSuggestion, + }, + }, + ) + if err != nil { + return fmt.Errorf("cannot create trust center handler: %w", err) + } + apiServerCtx, stopApiServer := context.WithCancel(context.Background()) defer stopApiServer() @@ -1095,7 +1145,7 @@ func (impl *Implm) Run( r, tp, pgClient, - serverHandler.TrustCenterHandler(), + compliancePortalHandler, trustService, encryptionKey, ); err != nil { @@ -1517,9 +1567,5 @@ func oauth2ServerOptions(cfg OAuth2ServerConfig) []oauth2.Option { opts = append(opts, oauth2.WithDeviceCodeDuration(time.Duration(cfg.DeviceCodeDuration)*time.Second)) } - if len(cfg.CIMDAllowedClientIDs) > 0 { - opts = append(opts, oauth2.WithCIMDAllowedClientIDs(cfg.CIMDAllowedClientIDs)) - } - return opts } diff --git a/pkg/server/api/api.go b/pkg/server/api/api.go index 9efff5709..c2c48a437 100644 --- a/pkg/server/api/api.go +++ b/pkg/server/api/api.go @@ -54,7 +54,6 @@ import ( files_v1 "go.probo.inc/probo/pkg/server/api/files/v1" mcp_v1 "go.probo.inc/probo/pkg/server/api/mcp/v1" slack_v1 "go.probo.inc/probo/pkg/server/api/slack/v1" - trust_v1 "go.probo.inc/probo/pkg/server/api/trust/v1" "go.probo.inc/probo/pkg/server/gqlutils" "go.probo.inc/probo/pkg/slack" "go.probo.inc/probo/pkg/thirdparty" @@ -95,15 +94,14 @@ type ( } Server struct { - cfg Config - csrf *http.CrossOriginProtection - compliancePageHandler http.Handler - consoleHandler http.Handler - cookieBannerHandler http.Handler - filesHandler http.Handler - mcpHandler http.Handler - slackHandler http.Handler - connectHandler http.Handler + cfg Config + csrf *http.CrossOriginProtection + consoleHandler http.Handler + cookieBannerHandler http.Handler + filesHandler http.Handler + mcpHandler http.Handler + slackHandler http.Handler + connectHandler http.Handler } ) @@ -187,19 +185,6 @@ func NewServer(cfg Config) (*Server, error) { return &Server{ cfg: cfg, csrf: csrf, - compliancePageHandler: trust_v1.NewMux( - cfg.Logger.Named("trust.v1"), - cfg.IAM, - cfg.Trust, - cfg.ResourceAlias, - cfg.File, - cfg.ESign, - cfg.Mailman, - cfg.Cookie, - cfg.TokenSecret, - cfg.BaseURL, - cfg.GraphQLLimits, - ), consoleHandler: console_v1.NewMux( cfg.Logger.Named("console.v1"), cfg.Probo, @@ -258,6 +243,7 @@ func NewServer(cfg Config) (*Server, error) { connectHandler: connect_v1.NewMux( cfg.Logger.Named("connect.v1"), cfg.IAM, + cfg.Trust, cfg.Cookie, cfg.TokenSecret, cfg.File, @@ -271,19 +257,11 @@ func NewServer(cfg Config) (*Server, error) { return err == nil }, - func(ctx context.Context, host string) bool { - _, err := cfg.Trust.GetPortalByDomainName(ctx, host) - return err == nil - }, cfg.GraphQLLimits, ), }, nil } -func (s *Server) CompliancePageHandler() http.Handler { - return s.compliancePageHandler -} - func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) { corsOpts := cors.Options{ AllowedOrigins: s.cfg.AllowedOrigins, diff --git a/pkg/server/response_headers.go b/pkg/server/response_headers.go new file mode 100644 index 000000000..55d9084c1 --- /dev/null +++ b/pkg/server/response_headers.go @@ -0,0 +1,36 @@ +// Copyright (c) 2026 Probo Inc . +// +// Permission to use, copy, modify, and/or distribute this software for any +// purpose with or without fee is hereby granted, provided that the above +// copyright notice and this permission notice appear in all copies. +// +// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH +// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, +// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR +// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +// PERFORMANCE OF THIS SOFTWARE. + +package server + +import "net/http" + +const strictTransportSecurityValue = "max-age=31536000; preload" + +func ApplyExtraHeaders(w http.ResponseWriter, extraHeaderFields map[string]string) { + for key, value := range extraHeaderFields { + w.Header().Set(key, value) + } +} + +func NewSecurityHeadersMiddleware(extraHeaderFields map[string]string) func(next http.Handler) http.Handler { + return func(next http.Handler) http.Handler { + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + w.Header().Set("Strict-Transport-Security", strictTransportSecurityValue) + ApplyExtraHeaders(w, extraHeaderFields) + + next.ServeHTTP(w, r) + }) + } +} diff --git a/pkg/server/server.go b/pkg/server/server.go index 9333543ea..dfc314663 100644 --- a/pkg/server/server.go +++ b/pkg/server/server.go @@ -21,13 +21,11 @@ package server import ( - "errors" "net/http" "github.com/go-chi/chi/v5" "go.gearno.de/kit/httpserver" "go.gearno.de/kit/log" - "go.gearno.de/x/ref" "go.probo.inc/probo/pkg/accessreview" "go.probo.inc/probo/pkg/agentrun" "go.probo.inc/probo/pkg/baseurl" @@ -40,17 +38,15 @@ import ( "go.probo.inc/probo/pkg/filemanager" "go.probo.inc/probo/pkg/geoloc" "go.probo.inc/probo/pkg/iam" - "go.probo.inc/probo/pkg/iam/oauth2" "go.probo.inc/probo/pkg/mailman" "go.probo.inc/probo/pkg/probo" "go.probo.inc/probo/pkg/resourcealias" "go.probo.inc/probo/pkg/riskmanagement" "go.probo.inc/probo/pkg/securecookie" "go.probo.inc/probo/pkg/server/api" - "go.probo.inc/probo/pkg/server/api/complianceportal" + connect_v1 "go.probo.inc/probo/pkg/server/api/connect/v1" "go.probo.inc/probo/pkg/server/gqlutils" "go.probo.inc/probo/pkg/server/mailactions" - trust_web "go.probo.inc/probo/pkg/server/trust" console_web "go.probo.inc/probo/pkg/server/web" "go.probo.inc/probo/pkg/slack" "go.probo.inc/probo/pkg/thirdparty" @@ -86,16 +82,15 @@ type Config struct { } type Server struct { + cfg Config apiServer *api.Server mailActionsHandler http.Handler consoleWebServer *console_web.Server - trustWebServer *trust_web.Server router *chi.Mux extraHeaderFields map[string]string baseURL string proboService *probo.Service iamService *iam.Service - trustService *trust.Service logger *log.Logger } @@ -137,24 +132,18 @@ func NewServer(cfg Config) (*Server, error) { return nil, err } - trustWebServer, err := trust_web.NewServer(compliancePageHeadData(cfg.BaseURL)) - if err != nil { - return nil, err - } - router := chi.NewRouter() server := &Server{ + cfg: cfg, apiServer: apiServer, mailActionsHandler: mailactions.NewMux(cfg.Mailman, cfg.TokenSecret), consoleWebServer: consoleWebServer, - trustWebServer: trustWebServer, router: router, extraHeaderFields: cfg.ExtraHeaderFields, baseURL: cfg.BaseURL.String(), proboService: cfg.Probo, iamService: cfg.IAM, - trustService: cfg.Trust, logger: cfg.Logger, } @@ -182,26 +171,14 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) { } func (s *Server) setExtraHeaders(w http.ResponseWriter) { - for key, value := range s.extraHeaderFields { - w.Header().Set(key, value) - } + ApplyExtraHeaders(w, s.extraHeaderFields) } func (s *Server) oidcDiscoveryHandler(w http.ResponseWriter, r *http.Request) { - api := s.baseURL + "/api/connect/v1" - - endpoints := oauth2.Endpoints{ - Authorization: uri.URI(api + "/oauth2/authorize"), - Token: uri.URI(api + "/oauth2/token"), - Userinfo: uri.URI(api + "/oauth2/userinfo"), - JWKS: uri.URI(api + "/oauth2/jwks"), - Registration: uri.URI(api + "/oauth2/register"), - Introspection: uri.URI(api + "/oauth2/introspect"), - Revocation: uri.URI(api + "/oauth2/revoke"), - DeviceAuthorization: uri.URI(api + "/oauth2/device"), - } - - metadata := s.iamService.OAuth2ServerMetadata(endpoints) + metadata := connect_v1.OAuth2ServerMetadata( + s.cfg.BaseURL, + s.iamService.OAuth2ScopeRegistry.RegisteredScopes(), + ) w.Header().Set("Cache-Control", "public, max-age=3600") httpserver.RenderJSON(w, http.StatusOK, metadata) @@ -214,71 +191,3 @@ func (s *Server) protectedResourceMetadataHandler(w http.ResponseWriter, r *http w.Header().Set("Cache-Control", "public, max-age=3600") httpserver.RenderJSON(w, http.StatusOK, metadata) } - -func (s *Server) handleCustomDomain404(w http.ResponseWriter, r *http.Request) { - httpserver.RenderError(w, http.StatusNotFound, errors.New("not found")) -} - -func (s *Server) trustCenterRouter() chi.Router { - r := chi.NewRouter() - - h := complianceportal.NewHandler(s.trustService) - - r.Mount("/api/trust/v1", s.apiServer.CompliancePageHandler()) - r.Get("/llms.txt", h.HandleLLMsTxt) - r.Get("/robots.txt", h.HandleRobotsTxt) - r.Get("/sitemap.xml", h.HandleSitemap) - r.Handle("/*", s.trustWebServer) - - return r -} - -func (s *Server) TrustCenterHandler() http.Handler { - r := chi.NewRouter() - - r.Use(complianceportal.NewSNIMiddleware(s.trustService)) - r.Use(func(next http.Handler) http.Handler { - return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - w.Header().Set("Strict-Transport-Security", "max-age=31536000; preload") - s.setExtraHeaders(w) - next.ServeHTTP(w, r) - }) - }) - - r.NotFound(s.handleCustomDomain404) - - r.Mount("/", s.trustCenterRouter()) - - return r -} - -func compliancePageHeadData(baseURL *baseurl.BaseURL) trust_web.HeadDataFunc { - return func(r *http.Request) trust_web.HeadData { - tc := complianceportal.CompliancePageFromContext(r.Context()) - if tc == nil { - return trust_web.HeadData{Title: "Compliance Page"} - } - - compliancePageBaseURL := complianceportal.CompliancePageBaseURLFromContext(r.Context()) - - description := tc.Title + " Compliance Page" - if tc.Description != nil && *tc.Description != "" { - description = *tc.Description - } - - headData := trust_web.HeadData{ - Title: tc.Title, - Description: description, - OGURL: ref.UnrefOrZero(compliancePageBaseURL), - } - - if tc.LogoFileID != nil { - faviconURL, err := baseURL.WithPath("/api/files/v1/public/" + tc.LogoFileID.String()).String() - if err == nil { - headData.FaviconURL = faviconURL - } - } - - return headData - } -}