Add OAuth client branding for trust centers

Serve CIMD logos from dedicated endpoints, expose client metadata
branding through GraphQL, and resolve branding from OAuth clients.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/server/api/complianceportal/oauth.go

@@ -22,6 +22,8 @@ const (
 	VisitorOAuthScope = portal.VisitorOAuthScope
 	GraphQLPath       = "/graphql"
 	CIMDMetadataPath  = portal.CIMDMetadataPath
+	BrandLogoPath     = portal.BrandLogoPath
+	BrandDarkLogoPath = portal.BrandDarkLogoPath
 	OAuthInitiatePath = "/initiate"
 	OAuthCallbackPath = portal.OAuthCallbackPath
 )

pkg/server/api/complianceportal/v1/brand_logo_handler.go

@@ -0,0 +1,93 @@
+// Copyright (c) 2026 Probo Inc <hello@probo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package complianceportal_v1
+
+import (
+	"errors"
+	"net/http"
+
+	"go.gearno.de/kit/httpserver"
+	"go.gearno.de/kit/log"
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/filemanager"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/server/api/complianceportal"
+)
+
+type brandLogoVariant int
+
+const (
+	brandLogoVariantLogo brandLogoVariant = iota
+	brandLogoVariantDarkLogo
+)
+
+type brandLogoHandler struct {
+	logger      *log.Logger
+	fileManager *filemanager.Service
+	variant     brandLogoVariant
+}
+
+func NewBrandLogoHandler(logger *log.Logger, fileManager *filemanager.Service) http.Handler {
+	return &brandLogoHandler{
+		logger:      logger,
+		fileManager: fileManager,
+		variant:     brandLogoVariantLogo,
+	}
+}
+
+func NewBrandDarkLogoHandler(logger *log.Logger, fileManager *filemanager.Service) http.Handler {
+	return &brandLogoHandler{
+		logger:      logger,
+		fileManager: fileManager,
+		variant:     brandLogoVariantDarkLogo,
+	}
+}
+
+func (h *brandLogoHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	compliancePage := complianceportal.CompliancePageFromContext(r.Context())
+	if compliancePage == nil {
+		httpserver.RenderError(w, http.StatusNotFound, errNotFound)
+		return
+	}
+
+	var fileID *gid.GID
+	switch h.variant {
+	case brandLogoVariantLogo:
+		fileID = compliancePage.LogoFileID
+	case brandLogoVariantDarkLogo:
+		fileID = compliancePage.DarkLogoFileID
+	}
+
+	if fileID == nil {
+		httpserver.RenderError(w, http.StatusNotFound, errNotFound)
+		return
+	}
+
+	file, err := h.fileManager.GetPublicFile(r.Context(), *fileID)
+	if errors.Is(err, coredata.ErrResourceNotFound) {
+		httpserver.RenderError(w, http.StatusNotFound, errNotFound)
+		return
+	}
+
+	if err != nil {
+		h.logger.ErrorCtx(r.Context(), "cannot load compliance page brand logo", log.Error(err))
+		httpserver.RenderError(w, http.StatusInternalServerError, errInternal)
+
+		return
+	}
+
+	w.Header().Set("Cache-Control", "no-store")
+	http.Redirect(w, r, h.fileManager.GenerateFileURL(file), http.StatusTemporaryRedirect)
+}

pkg/server/api/complianceportal/v1/mux.go

@@ -24,6 +24,7 @@ import (
 	"go.gearno.de/kit/log"
 	"go.gearno.de/x/ref"
 	"go.probo.inc/probo/pkg/baseurl"
+	page "go.probo.inc/probo/pkg/complianceportal"
 	visitor "go.probo.inc/probo/pkg/complianceportal/visitor"
 	"go.probo.inc/probo/pkg/esign"
 	"go.probo.inc/probo/pkg/filemanager"
@@ -53,7 +54,7 @@ type MuxConfig struct {
 }
 
 func NewMux(cfg MuxConfig) (http.Handler, error) {
-	webServer, err := NewServer(compliancePageHeadData(cfg.BaseURL))
+	webServer, err := NewServer(compliancePageHeadData())
 	if err != nil {
 		return nil, err
 	}
@@ -107,6 +108,8 @@ func NewMux(cfg MuxConfig) (http.Handler, error) {
 			r.Use(complianceportal.NewCompliancePagePresenceMiddleware())
 
 			r.Method(http.MethodGet, complianceportal.CIMDMetadataPath, NewOAuthClientMetadataHandler())
+			r.Method(http.MethodGet, complianceportal.BrandLogoPath, NewBrandLogoHandler(cfg.Logger, cfg.File))
+			r.Method(http.MethodGet, complianceportal.BrandDarkLogoPath, NewBrandDarkLogoHandler(cfg.Logger, cfg.File))
 			r.Method(http.MethodGet, complianceportal.OAuthInitiatePath, oauthInitiateHandler)
 			r.Method(http.MethodGet, complianceportal.OAuthCallbackPath, oauthCallbackHandler)
 
@@ -131,7 +134,7 @@ func handleCustomDomain404(w http.ResponseWriter, r *http.Request) {
 	httpserver.RenderError(w, http.StatusNotFound, errors.New("not found"))
 }
 
-func compliancePageHeadData(baseURL *baseurl.BaseURL) HeadDataFunc {
+func compliancePageHeadData() HeadDataFunc {
 	return func(r *http.Request) HeadData {
 		tc := complianceportal.CompliancePageFromContext(r.Context())
 		if tc == nil {
@@ -151,8 +154,8 @@ func compliancePageHeadData(baseURL *baseurl.BaseURL) HeadDataFunc {
 			OGURL:       ref.UnrefOrZero(compliancePageBaseURL),
 		}
 
-		if tc.LogoFileID != nil {
-			faviconURL, err := baseURL.WithPath("/api/files/v1/public/" + tc.LogoFileID.String()).String()
+		if tc.LogoFileID != nil && compliancePageBaseURL != nil {
+			faviconURL, err := page.BrandLogoURL(*compliancePageBaseURL)
 			if err == nil {
 				headData.FaviconURL = faviconURL
 			}

pkg/server/api/connect/v1/base_resolvers.go

@@ -271,6 +271,21 @@ func (r *queryResolver) Oauth2ScopesSupported(ctx context.Context) ([]coredata.O
 	return r.scopeRegistry.RegisteredScopes(), nil
 }
 
+// OauthClientBranding is the resolver for the oauthClientBranding field.
+func (r *queryResolver) OauthClientBranding(ctx context.Context, clientID *string) (*types.OAuthClientBranding, error) {
+	if clientID == nil || *clientID == "" {
+		return nil, nil
+	}
+
+	branding, err := oauthClientBranding(ctx, r.Resolver, *clientID)
+	if err != nil {
+		r.logger.WarnCtx(ctx, "cannot resolve oauth client branding", log.Error(err))
+		return nil, nil
+	}
+
+	return branding, nil
+}
+
 // Mutation returns schema.MutationResolver implementation.
 func (r *Resolver) Mutation() schema.MutationResolver { return &mutationResolver{r} }
 

pkg/server/api/connect/v1/graphql/base.graphql

@@ -38,6 +38,15 @@ type Query {
   oauth2ScopesSupported: [OAuth2Scope!]!
     @goField(forceResolver: true)
     @authentication(required: OPTIONAL)
+  oauthClientBranding(clientId: String): OAuthClientBranding
+    @goField(forceResolver: true)
+    @authentication(required: OPTIONAL)
+}
+
+type OAuthClientBranding {
+  name: String!
+  logo: File
+  clientURL: String
 }
 
 type OIDCProviderInfo {

pkg/server/api/connect/v1/oauth_client_branding.go

@@ -0,0 +1,56 @@
+// Copyright (c) 2026 Probo Inc <hello@probo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package connect_v1
+
+import (
+	"context"
+
+	"go.probo.inc/probo/pkg/iam/oauth2"
+	"go.probo.inc/probo/pkg/server/api/connect/v1/types"
+)
+
+func oauthClientBranding(
+	ctx context.Context,
+	r *Resolver,
+	clientID string,
+) (*types.OAuthClientBranding, error) {
+	branding, err := r.iam.OAuth2ServerService.ClientBranding(ctx, clientID)
+	if err != nil {
+		return nil, err
+	}
+
+	if branding == nil {
+		return nil, nil
+	}
+
+	return oauthClientBrandingFromIAM(branding)
+}
+
+func oauthClientBrandingFromIAM(
+	branding *oauth2.ClientBranding,
+) (*types.OAuthClientBranding, error) {
+	result := &types.OAuthClientBranding{
+		Name:      branding.Name,
+		ClientURL: branding.ClientURL,
+	}
+
+	if branding.LogoURL != nil {
+		result.Logo = &types.File{
+			DownloadURL: *branding.LogoURL,
+		}
+	}
+
+	return result, nil
+}