Rewire server and probod for compliance portal API

Mount the compliance portal mux on trust center hosts, drop the
legacy trust web server, and share response header helpers.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/probod/probod.go

@@ -79,6 +79,7 @@ import (
 	"go.probo.inc/probo/pkg/riskmanagement"
 	"go.probo.inc/probo/pkg/securecookie"
 	"go.probo.inc/probo/pkg/server"
+	complianceportal_v1 "go.probo.inc/probo/pkg/server/api/complianceportal/v1"
 	"go.probo.inc/probo/pkg/server/gqlutils"
 	"go.probo.inc/probo/pkg/server/trustedproxy"
 	"go.probo.inc/probo/pkg/slack"
@@ -687,6 +688,21 @@ func (impl *Implm) Run(
 		resourceAliasService,
 	)
 
+	staticCIMDAllow := oauth2.CIMDAllowFromClientIDs(impl.cfg.Auth.OAuth2Server.CIMDAllowedClientIDs)
+	iamService.OAuth2ServerService.SetCIMDAllow(
+		func(ctx context.Context, clientIDURL string) (oauth2.CIMDAllowance, error) {
+			host, ok := oauth2.CIMDClientIDHost(clientIDURL)
+			if ok {
+				_, err := trustService.GetPortalByDomainName(ctx, host)
+				if err == nil {
+					return oauth2.CIMDAllowanceAllowedSkipConsent, nil
+				}
+			}
+
+			return staticCIMDAllow(ctx, clientIDURL)
+		},
+	)
+
 	accessReviewService := accessreview.NewService(
 		pgClient,
 		encryptionKey,
@@ -752,6 +768,40 @@ func (impl *Implm) Run(
 		return fmt.Errorf("cannot create server: %w", err)
 	}
 
+	compliancePortalHandler, err := complianceportal_v1.NewMux(
+		complianceportal_v1.MuxConfig{
+			BaseURL:           baseURL,
+			ExtraHeaderFields: impl.cfg.Api.ExtraHeaderFields,
+			Logger:            l.Named("compliance-portal"),
+			IAM:               iamService,
+			Visitor:           trustService,
+			ResourceAlias:     resourceAliasService,
+			File:              fileManagerService,
+			ESign:             esignService,
+			Mailman:           mailmanService,
+			Cookie: securecookie.Config{
+				Name:     impl.cfg.Auth.Cookie.Name,
+				Domain:   impl.cfg.Auth.Cookie.Domain,
+				Path:     "/",
+				MaxAge:   int(time.Duration(impl.cfg.Auth.Cookie.Duration) * time.Hour),
+				Secret:   impl.cfg.Auth.Cookie.Secret,
+				Secure:   impl.cfg.Auth.Cookie.Secure,
+				HTTPOnly: true,
+				SameSite: http.SameSiteLaxMode,
+			},
+			TokenSecret: impl.cfg.Auth.Cookie.Secret,
+			GraphQLLimits: gqlutils.Limits{
+				ParserTokenLimit:  impl.cfg.Api.GraphQL.ParserTokenLimit,
+				ComplexityLimit:   impl.cfg.Api.GraphQL.ComplexityLimit,
+				QueryCacheSize:    impl.cfg.Api.GraphQL.QueryCacheSize,
+				DisableSuggestion: impl.cfg.Api.GraphQL.DisableSuggestion,
+			},
+		},
+	)
+	if err != nil {
+		return fmt.Errorf("cannot create trust center handler: %w", err)
+	}
+
 	apiServerCtx, stopApiServer := context.WithCancel(context.Background())
 	defer stopApiServer()
 
@@ -1095,7 +1145,7 @@ func (impl *Implm) Run(
 				r,
 				tp,
 				pgClient,
-				serverHandler.TrustCenterHandler(),
+				compliancePortalHandler,
 				trustService,
 				encryptionKey,
 			); err != nil {
@@ -1517,9 +1567,5 @@ func oauth2ServerOptions(cfg OAuth2ServerConfig) []oauth2.Option {
 		opts = append(opts, oauth2.WithDeviceCodeDuration(time.Duration(cfg.DeviceCodeDuration)*time.Second))
 	}
 
-	if len(cfg.CIMDAllowedClientIDs) > 0 {
-		opts = append(opts, oauth2.WithCIMDAllowedClientIDs(cfg.CIMDAllowedClientIDs))
-	}
-
 	return opts
 }

pkg/server/api/api.go

@@ -54,7 +54,6 @@ import (
 	files_v1 "go.probo.inc/probo/pkg/server/api/files/v1"
 	mcp_v1 "go.probo.inc/probo/pkg/server/api/mcp/v1"
 	slack_v1 "go.probo.inc/probo/pkg/server/api/slack/v1"
-	trust_v1 "go.probo.inc/probo/pkg/server/api/trust/v1"
 	"go.probo.inc/probo/pkg/server/gqlutils"
 	"go.probo.inc/probo/pkg/slack"
 	"go.probo.inc/probo/pkg/thirdparty"
@@ -95,15 +94,14 @@ type (
 	}
 
 	Server struct {
-		cfg                   Config
+		cfg                 Config
-		csrf                  *http.CrossOriginProtection
+		csrf                *http.CrossOriginProtection
-		compliancePageHandler http.Handler
+		consoleHandler      http.Handler
-		consoleHandler        http.Handler
+		cookieBannerHandler http.Handler
-		cookieBannerHandler   http.Handler
+		filesHandler        http.Handler
-		filesHandler          http.Handler
+		mcpHandler          http.Handler
-		mcpHandler            http.Handler
+		slackHandler        http.Handler
-		slackHandler          http.Handler
+		connectHandler      http.Handler
-		connectHandler        http.Handler
 	}
 )
 
@@ -187,19 +185,6 @@ func NewServer(cfg Config) (*Server, error) {
 	return &Server{
 		cfg:  cfg,
 		csrf: csrf,
-		compliancePageHandler: trust_v1.NewMux(
-			cfg.Logger.Named("trust.v1"),
-			cfg.IAM,
-			cfg.Trust,
-			cfg.ResourceAlias,
-			cfg.File,
-			cfg.ESign,
-			cfg.Mailman,
-			cfg.Cookie,
-			cfg.TokenSecret,
-			cfg.BaseURL,
-			cfg.GraphQLLimits,
-		),
 		consoleHandler: console_v1.NewMux(
 			cfg.Logger.Named("console.v1"),
 			cfg.Probo,
@@ -258,6 +243,7 @@ func NewServer(cfg Config) (*Server, error) {
 		connectHandler: connect_v1.NewMux(
 			cfg.Logger.Named("connect.v1"),
 			cfg.IAM,
+			cfg.Trust,
 			cfg.Cookie,
 			cfg.TokenSecret,
 			cfg.File,
@@ -271,19 +257,11 @@ func NewServer(cfg Config) (*Server, error) {
 
 				return err == nil
 			},
-			func(ctx context.Context, host string) bool {
-				_, err := cfg.Trust.GetPortalByDomainName(ctx, host)
-				return err == nil
-			},
 			cfg.GraphQLLimits,
 		),
 	}, nil
 }
 
-func (s *Server) CompliancePageHandler() http.Handler {
-	return s.compliancePageHandler
-}
-
 func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	corsOpts := cors.Options{
 		AllowedOrigins:     s.cfg.AllowedOrigins,

pkg/server/response_headers.go

@@ -0,0 +1,36 @@
+// Copyright (c) 2026 Probo Inc <hello@probo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package server
+
+import "net/http"
+
+const strictTransportSecurityValue = "max-age=31536000; preload"
+
+func ApplyExtraHeaders(w http.ResponseWriter, extraHeaderFields map[string]string) {
+	for key, value := range extraHeaderFields {
+		w.Header().Set(key, value)
+	}
+}
+
+func NewSecurityHeadersMiddleware(extraHeaderFields map[string]string) func(next http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			w.Header().Set("Strict-Transport-Security", strictTransportSecurityValue)
+			ApplyExtraHeaders(w, extraHeaderFields)
+
+			next.ServeHTTP(w, r)
+		})
+	}
+}

pkg/server/server.go

@@ -21,13 +21,11 @@
 package server
 
 import (
-	"errors"
 	"net/http"
 
 	"github.com/go-chi/chi/v5"
 	"go.gearno.de/kit/httpserver"
 	"go.gearno.de/kit/log"
-	"go.gearno.de/x/ref"
 	"go.probo.inc/probo/pkg/accessreview"
 	"go.probo.inc/probo/pkg/agentrun"
 	"go.probo.inc/probo/pkg/baseurl"
@@ -40,17 +38,15 @@ import (
 	"go.probo.inc/probo/pkg/filemanager"
 	"go.probo.inc/probo/pkg/geoloc"
 	"go.probo.inc/probo/pkg/iam"
-	"go.probo.inc/probo/pkg/iam/oauth2"
 	"go.probo.inc/probo/pkg/mailman"
 	"go.probo.inc/probo/pkg/probo"
 	"go.probo.inc/probo/pkg/resourcealias"
 	"go.probo.inc/probo/pkg/riskmanagement"
 	"go.probo.inc/probo/pkg/securecookie"
 	"go.probo.inc/probo/pkg/server/api"
-	"go.probo.inc/probo/pkg/server/api/complianceportal"
+	connect_v1 "go.probo.inc/probo/pkg/server/api/connect/v1"
 	"go.probo.inc/probo/pkg/server/gqlutils"
 	"go.probo.inc/probo/pkg/server/mailactions"
-	trust_web "go.probo.inc/probo/pkg/server/trust"
 	console_web "go.probo.inc/probo/pkg/server/web"
 	"go.probo.inc/probo/pkg/slack"
 	"go.probo.inc/probo/pkg/thirdparty"
@@ -86,16 +82,15 @@ type Config struct {
 }
 
 type Server struct {
+	cfg                Config
 	apiServer          *api.Server
 	mailActionsHandler http.Handler
 	consoleWebServer   *console_web.Server
-	trustWebServer     *trust_web.Server
 	router             *chi.Mux
 	extraHeaderFields  map[string]string
 	baseURL            string
 	proboService       *probo.Service
 	iamService         *iam.Service
-	trustService       *trust.Service
 	logger             *log.Logger
 }
 
@@ -137,24 +132,18 @@ func NewServer(cfg Config) (*Server, error) {
 		return nil, err
 	}
 
-	trustWebServer, err := trust_web.NewServer(compliancePageHeadData(cfg.BaseURL))
-	if err != nil {
-		return nil, err
-	}
-
 	router := chi.NewRouter()
 
 	server := &Server{
+		cfg:                cfg,
 		apiServer:          apiServer,
 		mailActionsHandler: mailactions.NewMux(cfg.Mailman, cfg.TokenSecret),
 		consoleWebServer:   consoleWebServer,
-		trustWebServer:     trustWebServer,
 		router:             router,
 		extraHeaderFields:  cfg.ExtraHeaderFields,
 		baseURL:            cfg.BaseURL.String(),
 		proboService:       cfg.Probo,
 		iamService:         cfg.IAM,
-		trustService:       cfg.Trust,
 		logger:             cfg.Logger,
 	}
 
@@ -182,26 +171,14 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 }
 
 func (s *Server) setExtraHeaders(w http.ResponseWriter) {
-	for key, value := range s.extraHeaderFields {
+	ApplyExtraHeaders(w, s.extraHeaderFields)
-		w.Header().Set(key, value)
-	}
 }
 
 func (s *Server) oidcDiscoveryHandler(w http.ResponseWriter, r *http.Request) {
-	api := s.baseURL + "/api/connect/v1"
+	metadata := connect_v1.OAuth2ServerMetadata(
-
+		s.cfg.BaseURL,
-	endpoints := oauth2.Endpoints{
+		s.iamService.OAuth2ScopeRegistry.RegisteredScopes(),
-		Authorization:       uri.URI(api + "/oauth2/authorize"),
+	)
-		Token:               uri.URI(api + "/oauth2/token"),
-		Userinfo:            uri.URI(api + "/oauth2/userinfo"),
-		JWKS:                uri.URI(api + "/oauth2/jwks"),
-		Registration:        uri.URI(api + "/oauth2/register"),
-		Introspection:       uri.URI(api + "/oauth2/introspect"),
-		Revocation:          uri.URI(api + "/oauth2/revoke"),
-		DeviceAuthorization: uri.URI(api + "/oauth2/device"),
-	}
-
-	metadata := s.iamService.OAuth2ServerMetadata(endpoints)
 
 	w.Header().Set("Cache-Control", "public, max-age=3600")
 	httpserver.RenderJSON(w, http.StatusOK, metadata)
@@ -214,71 +191,3 @@ func (s *Server) protectedResourceMetadataHandler(w http.ResponseWriter, r *http
 	w.Header().Set("Cache-Control", "public, max-age=3600")
 	httpserver.RenderJSON(w, http.StatusOK, metadata)
 }
-
-func (s *Server) handleCustomDomain404(w http.ResponseWriter, r *http.Request) {
-	httpserver.RenderError(w, http.StatusNotFound, errors.New("not found"))
-}
-
-func (s *Server) trustCenterRouter() chi.Router {
-	r := chi.NewRouter()
-
-	h := complianceportal.NewHandler(s.trustService)
-
-	r.Mount("/api/trust/v1", s.apiServer.CompliancePageHandler())
-	r.Get("/llms.txt", h.HandleLLMsTxt)
-	r.Get("/robots.txt", h.HandleRobotsTxt)
-	r.Get("/sitemap.xml", h.HandleSitemap)
-	r.Handle("/*", s.trustWebServer)
-
-	return r
-}
-
-func (s *Server) TrustCenterHandler() http.Handler {
-	r := chi.NewRouter()
-
-	r.Use(complianceportal.NewSNIMiddleware(s.trustService))
-	r.Use(func(next http.Handler) http.Handler {
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			w.Header().Set("Strict-Transport-Security", "max-age=31536000; preload")
-			s.setExtraHeaders(w)
-			next.ServeHTTP(w, r)
-		})
-	})
-
-	r.NotFound(s.handleCustomDomain404)
-
-	r.Mount("/", s.trustCenterRouter())
-
-	return r
-}
-
-func compliancePageHeadData(baseURL *baseurl.BaseURL) trust_web.HeadDataFunc {
-	return func(r *http.Request) trust_web.HeadData {
-		tc := complianceportal.CompliancePageFromContext(r.Context())
-		if tc == nil {
-			return trust_web.HeadData{Title: "Compliance Page"}
-		}
-
-		compliancePageBaseURL := complianceportal.CompliancePageBaseURLFromContext(r.Context())
-
-		description := tc.Title + " Compliance Page"
-		if tc.Description != nil && *tc.Description != "" {
-			description = *tc.Description
-		}
-
-		headData := trust_web.HeadData{
-			Title:       tc.Title,
-			Description: description,
-			OGURL:       ref.UnrefOrZero(compliancePageBaseURL),
-		}
-
-		if tc.LogoFileID != nil {
-			faviconURL, err := baseURL.WithPath("/api/files/v1/public/" + tc.LogoFileID.String()).String()
-			if err == nil {
-				headData.FaviconURL = faviconURL
-			}
-		}
-
-		return headData
-	}
-}