Resolve custom domain SSL via certificate

Replace flattened SSL fields with a certificate
relation loaded through certmanager, and resolve
domain slots from IDs already on the trust center
instead of reloading the compliance page.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/server/api/mcp/v1/schema.resolvers.go

@@ -5306,15 +5306,20 @@ func (r *Resolver) DeleteCustomDomainTool(ctx context.Context, req *mcp.CallTool
 		return nil, types.DeleteCustomDomainOutput{}, err
 	}
 
-	domain, err := r.management.GetCustomDomain(ctx, scope, input.TrustCenterID)
+	compliancePage, err := r.management.Get(ctx, scope, input.TrustCenterID)
 	if err != nil {
-		return nil, types.DeleteCustomDomainOutput{}, fmt.Errorf("cannot get custom domain: %w", err)
+		return nil, types.DeleteCustomDomainOutput{}, fmt.Errorf("cannot load compliance page: %w", err)
 	}
 
-	if domain == nil {
+	if compliancePage.CustomDomainID == nil {
 		return nil, types.DeleteCustomDomainOutput{}, fmt.Errorf("compliance page has no custom domain")
 	}
 
+	domain, err := r.management.GetDomain(ctx, scope, *compliancePage.CustomDomainID)
+	if err != nil {
+		return nil, types.DeleteCustomDomainOutput{}, fmt.Errorf("cannot get custom domain: %w", err)
+	}
+
 	var cert *coredata.Certificate
 	if domain.CertificateID != nil {
 		cert, err = r.certManager.Get(ctx, scope, *domain.CertificateID)

pkg/server/api/mcp/v1/specification.yaml

@@ -8737,7 +8737,7 @@ components:
         - RENEWING
         - EXPIRED
         - FAILED
-      go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.CustomDomainSSLStatus
+      go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.CertificateStatus
 
     TrustCenterReferenceOrderField:
       type: string
@@ -8968,6 +8968,26 @@ components:
           type: string
           format: date-time
 
+    Certificate:
+      type: object
+      required:
+        - id
+        - status
+      properties:
+        id:
+          $ref: "#/components/schemas/GID"
+        status:
+          $ref: "#/components/schemas/SSLStatus"
+        expires_at:
+          anyOf:
+            - type: string
+              format: date-time
+            - type: "null"
+        provisioning_error:
+          anyOf:
+            - type: string
+            - type: "null"
+
     CustomDomain:
       type: object
       required:
@@ -8975,7 +8995,6 @@ components:
         - organization_id
         - domain
         - managed
-        - ssl_status
         - created_at
         - updated_at
       properties:
@@ -8988,12 +9007,9 @@ components:
         managed:
           type: boolean
           description: Whether this domain is a Probo-managed probopage subdomain
-        ssl_status:
-          $ref: "#/components/schemas/SSLStatus"
-        ssl_expires_at:
+        certificate:
           anyOf:
-            - type: string
-              format: date-time
+            - $ref: "#/components/schemas/Certificate"
             - type: "null"
         created_at:
           type: string

pkg/server/api/mcp/v1/types/custom_domain.go

@@ -24,24 +24,24 @@ import (
 	"go.probo.inc/probo/pkg/coredata"
 )
 
-// NewCustomDomain builds the MCP CustomDomain type. The TLS lifecycle now lives
-// on the linked certificate; when cert is nil (certificate not yet created) the
-// domain reports a pending SSL status.
 func NewCustomDomain(d *coredata.CustomDomain, cert *coredata.Certificate) *CustomDomain {
-	result := &CustomDomain{
+	domain := &CustomDomain{
 		ID:             d.ID,
 		OrganizationID: d.OrganizationID,
 		Domain:         d.Domain,
 		Managed:        d.Managed,
-		SslStatus:      coredata.CustomDomainSSLStatusPending,
 		CreatedAt:      d.CreatedAt,
 		UpdatedAt:      d.UpdatedAt,
 	}
 
 	if cert != nil {
-		result.SslStatus = coredata.CustomDomainSSLStatus(cert.Status)
-		result.SslExpiresAt = cert.SSLExpiresAt
+		domain.Certificate = &Certificate{
+			ID:                cert.ID,
+			Status:            cert.Status,
+			ExpiresAt:         cert.SSLExpiresAt,
+			ProvisioningError: cert.ProvisioningError,
+		}
 	}
 
-	return result
+	return domain
 }