Add OAuth client branding for trust centers

Serve CIMD logos from dedicated endpoints, expose client metadata
branding through GraphQL, and resolve branding from OAuth clients.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/server/api/connect/v1/base_resolvers.go

@@ -271,6 +271,21 @@ func (r *queryResolver) Oauth2ScopesSupported(ctx context.Context) ([]coredata.O
 	return r.scopeRegistry.RegisteredScopes(), nil
 }
 
+// OauthClientBranding is the resolver for the oauthClientBranding field.
+func (r *queryResolver) OauthClientBranding(ctx context.Context, clientID *string) (*types.OAuthClientBranding, error) {
+	if clientID == nil || *clientID == "" {
+		return nil, nil
+	}
+
+	branding, err := oauthClientBranding(ctx, r.Resolver, *clientID)
+	if err != nil {
+		r.logger.WarnCtx(ctx, "cannot resolve oauth client branding", log.Error(err))
+		return nil, nil
+	}
+
+	return branding, nil
+}
+
 // Mutation returns schema.MutationResolver implementation.
 func (r *Resolver) Mutation() schema.MutationResolver { return &mutationResolver{r} }
 

pkg/server/api/connect/v1/graphql/base.graphql

@@ -38,6 +38,15 @@ type Query {
   oauth2ScopesSupported: [OAuth2Scope!]!
     @goField(forceResolver: true)
     @authentication(required: OPTIONAL)
+  oauthClientBranding(clientId: String): OAuthClientBranding
+    @goField(forceResolver: true)
+    @authentication(required: OPTIONAL)
+}
+
+type OAuthClientBranding {
+  name: String!
+  logo: File
+  clientURL: String
 }
 
 type OIDCProviderInfo {

pkg/server/api/connect/v1/oauth_client_branding.go

@@ -0,0 +1,56 @@
+// Copyright (c) 2026 Probo Inc <hello@probo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package connect_v1
+
+import (
+	"context"
+
+	"go.probo.inc/probo/pkg/iam/oauth2"
+	"go.probo.inc/probo/pkg/server/api/connect/v1/types"
+)
+
+func oauthClientBranding(
+	ctx context.Context,
+	r *Resolver,
+	clientID string,
+) (*types.OAuthClientBranding, error) {
+	branding, err := r.iam.OAuth2ServerService.ClientBranding(ctx, clientID)
+	if err != nil {
+		return nil, err
+	}
+
+	if branding == nil {
+		return nil, nil
+	}
+
+	return oauthClientBrandingFromIAM(branding)
+}
+
+func oauthClientBrandingFromIAM(
+	branding *oauth2.ClientBranding,
+) (*types.OAuthClientBranding, error) {
+	result := &types.OAuthClientBranding{
+		Name:      branding.Name,
+		ClientURL: branding.ClientURL,
+	}
+
+	if branding.LogoURL != nil {
+		result.Logo = &types.File{
+			DownloadURL: *branding.LogoURL,
+		}
+	}
+
+	return result, nil
+}