Add OAuth client branding for trust centers

Serve CIMD logos from dedicated endpoints, expose client metadata
branding through GraphQL, and resolve branding from OAuth clients.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/complianceportal/brand.go

@@ -0,0 +1,46 @@
+// Copyright (c) 2026 Probo Inc <hello@probo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package complianceportal
+
+import (
+	"fmt"
+	"net/url"
+)
+
+const (
+	BrandLogoPath     = "/brand/logo"
+	BrandDarkLogoPath = "/brand/dark-logo"
+)
+
+func BrandLogoURL(portalBaseURL string) (string, error) {
+	return brandAssetURL(portalBaseURL, BrandLogoPath)
+}
+
+func BrandDarkLogoURL(portalBaseURL string) (string, error) {
+	return brandAssetURL(portalBaseURL, BrandDarkLogoPath)
+}
+
+func brandAssetURL(portalBaseURL string, path string) (string, error) {
+	parsed, err := url.Parse(portalBaseURL)
+	if err != nil {
+		return "", fmt.Errorf("cannot parse portal base URL: %w", err)
+	}
+
+	parsed.Path = path
+	parsed.RawQuery = ""
+	parsed.Fragment = ""
+
+	return parsed.String(), nil
+}

pkg/complianceportal/cimd.go

@@ -18,7 +18,6 @@ import (
 	"fmt"
 	"net/url"
 
-	"go.probo.inc/probo/pkg/baseurl"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/iam/oauth2"
 )
@@ -55,10 +54,10 @@ func OAuthCallbackURL(portalBaseURL string) (string, error) {
 	return parsed.String(), nil
 }
 
-func PortalBaseURLFromCIMDClientID(clientIDURL string) (string, error) {
-	parsed, err := url.Parse(clientIDURL)
+func PortalRootURL(rawURL string) (string, error) {
+	parsed, err := url.Parse(rawURL)
 	if err != nil {
-		return "", fmt.Errorf("cannot parse cimd client_id URL: %w", err)
+		return "", fmt.Errorf("cannot parse portal URL: %w", err)
 	}
 
 	parsed.Path = ""
@@ -68,6 +67,15 @@ func PortalBaseURLFromCIMDClientID(clientIDURL string) (string, error) {
 	return parsed.String(), nil
 }
 
+func PortalBaseURLFromCIMDClientID(clientIDURL string) (string, error) {
+	portalURL, err := PortalRootURL(clientIDURL)
+	if err != nil {
+		return "", fmt.Errorf("cannot parse cimd client_id URL: %w", err)
+	}
+
+	return portalURL, nil
+}
+
 func BuildClientMetadataDocument(
 	portal *coredata.TrustCenter,
 	portalBaseURL string,
@@ -82,9 +90,15 @@ func BuildClientMetadataDocument(
 		return oauth2.ClientMetadataDocument{}, fmt.Errorf("cannot build oauth callback URL: %w", err)
 	}
 
+	portalRootURL, err := PortalRootURL(portalBaseURL)
+	if err != nil {
+		return oauth2.ClientMetadataDocument{}, fmt.Errorf("cannot build cimd client_uri URL: %w", err)
+	}
+
 	doc := oauth2.ClientMetadataDocument{
 		ClientID:                clientID,
 		ClientName:              portal.Title,
+		ClientURI:               portalRootURL,
 		RedirectURIs:            []string{redirectURI},
 		TokenEndpointAuthMethod: "none",
 		GrantTypes:              []string{"authorization_code", "refresh_token"},
@@ -92,21 +106,10 @@ func BuildClientMetadataDocument(
 		Scope:                   VisitorOAuthScope,
 	}
 
-	if portal.WebsiteURL != nil && *portal.WebsiteURL != "" {
-		doc.ClientURI = *portal.WebsiteURL
-	} else {
-		doc.ClientURI = portalBaseURL
-	}
-
 	if portal.LogoFileID != nil {
-		parsedBaseURL, err := baseurl.Parse(portalBaseURL)
+		logoURI, err := BrandLogoURL(portalBaseURL)
 		if err == nil {
-			logoURI, err := parsedBaseURL.
-				WithPath("/api/files/v1/public/" + portal.LogoFileID.String()).
-				String()
-			if err == nil {
-				doc.LogoURI = logoURI
-			}
+			doc.LogoURI = logoURI
 		}
 	}
 

pkg/complianceportal/cimd_test.go

@@ -20,6 +20,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/gid"
 )
 
 func TestCIMDClientIDURL(t *testing.T) {
@@ -48,20 +49,50 @@ func TestPortalBaseURLFromCIMDClientID(t *testing.T) {
 	assert.Equal(t, "https://acme.example.com", baseURL)
 }
 
+func TestBrandLogoURL(t *testing.T) {
+	t.Parallel()
+
+	logoURL, err := BrandLogoURL("https://acme.example.com/page")
+	require.NoError(t, err)
+	assert.Equal(t, "https://acme.example.com/brand/logo", logoURL)
+
+	darkLogoURL, err := BrandDarkLogoURL("https://acme.example.com/")
+	require.NoError(t, err)
+	assert.Equal(t, "https://acme.example.com/brand/dark-logo", darkLogoURL)
+}
+
 func TestBuildClientMetadataDocument(t *testing.T) {
 	t.Parallel()
 
-	websiteURL := "https://acme.example.com"
+	websiteURL := "https://www.acme.com"
 	portal := &coredata.TrustCenter{
 		Title:      "Acme Trust Center",
 		WebsiteURL: &websiteURL,
 	}
 
-	doc, err := BuildClientMetadataDocument(portal, "https://acme.example.com")
+	doc, err := BuildClientMetadataDocument(
+		portal,
+		"https://acme.example.com/.well-known/oauth-client-metadata",
+	)
 	require.NoError(t, err)
 	assert.Equal(t, "https://acme.example.com/.well-known/oauth-client-metadata", doc.ClientID)
 	assert.Equal(t, "Acme Trust Center", doc.ClientName)
 	assert.Equal(t, []string{"https://acme.example.com/callback"}, doc.RedirectURIs)
-	assert.Equal(t, websiteURL, doc.ClientURI)
+	assert.Equal(t, "https://acme.example.com", doc.ClientURI)
 	assert.Equal(t, VisitorOAuthScope, doc.Scope)
+	assert.Empty(t, doc.LogoURI)
+}
+
+func TestBuildClientMetadataDocument_LogoURIUsesBrandLogoEndpoint(t *testing.T) {
+	t.Parallel()
+
+	logoFileID := gid.MustParseGID("WR-qMrB5AAEAGQAAAZ9mIO8B8vDFQ-i3")
+	portal := &coredata.TrustCenter{
+		Title:      "Acme Trust Center",
+		LogoFileID: &logoFileID,
+	}
+
+	doc, err := BuildClientMetadataDocument(portal, "https://acme.example.com")
+	require.NoError(t, err)
+	assert.Equal(t, "https://acme.example.com/brand/logo", doc.LogoURI)
 }