Migrate business and security owners into a shared administrators list across GraphQL, MCP, CLI, n8n, and the console.
Signed-off-by: Sacha Al Himdani <sacha@probo.com>
Add MCP tools and filters for mailing lists, detected trackers, compliance
portal frameworks, and document/control/framework mutations that were
available in the console but missing from MCP.
Signed-off-by: Sacha Al Himdani <sacha@probo.com>
AuditLog.Read.All is not available on every tenant. Keep importing
accounts with MFA unknown and log the error instead of failing the
whole source fetch.
Signed-off-by: Sacha Al Himdani <sacha@probo.com>
Partial grants completed without feedback, leaving Reconnect
required unexplained. Keep the token and toast the backend
missing-scopes error after the OAuth callback redirect.
Signed-off-by: Sacha Al Himdani <sacha@probo.com>
Visitors have no Identity.locale, so the banner now falls
back to a supported navigator language match and omits the
persist action. Unsupported browser languages stay silent
instead of pretending English is preferred.
Signed-off-by: Émile Ré <emile@probo.com>
Repo-wide /releases/latest pointed at the wrong
assets when other tracks published more recently.
Point users at probo-agent/v* releases and split
download vs enroll into separate copy blocks with
placeholder URLs they fill in.
Signed-off-by: Ludovic Vielle <ludovic@probo.com>
Rename button-styled Link/Anchor to ButtonLink/
ButtonAnchor and add underlined text Link/Anchor
so names match look and element. Hero meta uses
plain Anchors for contact and custom links.
Signed-off-by: Émile Ré <emile@probo.com>
Device create was left off the ITAM surfaces because enrollment
returns a one-shot token. Add createDevice so automations can issue
PENDING devices with the enrollment payload.
Signed-off-by: Ludovic Vielle <ludovic@probo.com>
Devices were only available through GraphQL and the agent API. Add
list/get/revoke/delete/set-owner across MCP, prb, and n8n, with latest
postures nested on list and get responses.
Signed-off-by: Ludovic Vielle <ludovic@probo.com>
SCIM event CSV exports failed with "cannot parse address :
mail: no address" because this query selected a placeholder
empty string for email_address instead of the real address, and
scanning it into mail.Addr tried to parse it as one.
Join identities the same way every other MembershipProfile query
already does, and drop the redundant identity lookup in the SCIM
export path now that profiles carry their real email address.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Wire the Connect mutation through IAM so owners and admins
can clear an organization horizontal logo. Soft-delete the
underlying public file so existing download URLs stop serving
the image, and expose the operation in the n8n organization
node.
Signed-off-by: Sacha Al Himdani <sacha@probo.com>
ENG-646: requesting private resources must not hit the
NDA gate; keep requireCompletedNDA on protected exports
only.
Signed-off-by: Émile Ré <emile@probo.com>
Export and request-access already know visibility and
auth; a shared requireCompletedNDA call keeps NDA
enforcement there and drops GraphQL PUBLIC probing.
Signed-off-by: Émile Ré <emile@probo.com>
Prefer the saved locale as the primary CTA, soften secondary
and NDA actions, tint dismiss hovers to the banner palette,
and center the leading icon with the message.
Signed-off-by: Émile Ré <emile@probo.com>
The button is on the review page itself, so Review and sign
is redundant. Console keeps its own reviewAndSign key.
Signed-off-by: Émile Ré <emile@probo.com>
OAuth continue-URL rewriting shares path/locale utilities with
SEO, so keep those in locale.go and leave seo.go for
SEOFromRequest only.
Signed-off-by: Émile Ré <emile@probo.com>
Guests who authenticate from a shared-locale URL were landing
on that URL with a mismatch banner. Adopt Identity.locale on
the OAuth callback redirect instead.
Signed-off-by: Émile Ré <emile@probo.com>
Locale and NDA notices shared layout chrome but were not kit
Callouts. Pull the full-bleed band into Banner and rename the
feature wrappers so the names match the role.
Signed-off-by: Émile Ré <emile@probo.com>
When both banners stack they read as one band if they share
gold. Use sky (info) for locale and amber (warning) for NDA,
and keep content inside the same max-w-5xl column as TopBar.
Signed-off-by: Émile Ré <emile@probo.com>
Match the unsigned-NDA banner layout: keep layout classes in
tv slots so the callout shell stays free of raw utilities.
Signed-off-by: Émile Ré <emile@probo.com>
Signed-in users with an incomplete portal NDA need a clear
path to review and sign without waiting for a private
document export to fail the gate.
Signed-off-by: Émile Ré <emile@probo.com>
Signed-in users exporting a PUBLIC doc, report, or file
should not be forced through the NDA. Keep the gate on
private targets and always on bulk requestAccesses.
Signed-off-by: Émile Ré <emile@probo.com>
Match the document viewer header so users can leave without
signing, returning to the list instead of the continue URL
that would re-trigger the gate.
Signed-off-by: Émile Ré <emile@probo.com>
Mutations never reach route error boundaries, so each call
site reimplemented sign-in / full-name / NDA redirects.
Consume those gates in the shared useMutation notifier and
drop the duplicated handlers.
Signed-off-by: Émile Ré <emile@probo.com>
Document export is a mutation, so NDA_SIGNATURE_REQUIRED never
reaches the route boundary. Catch it in the export hook, stop
re-firing on mutate identity churn, and match gate errors by
name when instanceof fails across package copies.
Signed-off-by: Émile Ré <emile@probo.com>
Signed-in users should browse the compliance portal the
same way visitors do. Keep @nda on export and access
mutations so signatures are only required when loading a
document.
Signed-off-by: Émile Ré <emile@probo.com>
Delete and DeleteExpired omitted Scoper, breaking the
tenant-isolation pattern used elsewhere in coredata. Pass a
tenant scope from ExchangeEnrollmentToken and NewNoScope from
the ITAM GC so cross-tenant cleanup stays explicit.
Signed-off-by: Ludovic Vielle <ludovic@probo.com>
Reminders that fall due on Saturday or Sunday no longer send
over the weekend or spend the escalation ladder unused. SQL
keeps calendar cadence and rolls weekend due times to Monday
at the same clock hour. The first debounced notice is unchanged.
Co-authored-by: Sacha Al Himdani <sacha@probo.com>
Signed-off-by: Cursor Agent <cursoragent@cursor.com>
ITAM GraphQL actions were never registered in the shared OAuth2
scope registry, so bearer-token callers failed closed even when
role policies allowed them. Add v1:itam / v1:itam:read mappings,
register them in probod, and sync the CLI client scopes.
Signed-off-by: Ludovic Vielle <ludovic@probo.com>
Admins could only revoke devices, so never-enrolled and revoked
inventory rows piled up with no way to remove them. Soft-delete
is limited to REVOKED devices (revoke first), and ITAM GC now
hard-deletes PENDING/REVOKED orphans with no API key, postures,
or valid enrollment token—including user tombstones without
history.
Signed-off-by: Ludovic Vielle <ludovic@probo.com>
Omit level to return direct third parties; pass level to filter
by hierarchy depth. Documented on the tool and filter field.
Signed-off-by: Sacha Al Himdani <sacha@probo.com>
Bump transitive brace-expansion to patched releases (5.0.9 / 2.1.3 / 1.1.17) so expand() cannot OOM the process on crafted brace patterns.
Signed-off-by: Sacha Al Himdani <sacha@probo.com>
