ITAM GraphQL actions were never registered in the shared OAuth2
scope registry, so bearer-token callers failed closed even when
role policies allowed them. Add v1:itam / v1:itam:read mappings,
register them in probod, and sync the CLI client scopes.
Signed-off-by: Ludovic Vielle <ludovic@probo.com>
The source headers, LICENSE files, and license metadata had drifted
apart. Align the entire project to MIT:
- Convert every source-file header to the MIT text across all comment
styles (Go, TS, TSX, JS, MJS, SQL, CSS, GraphQL, shell), including
SPDX-License-Identifier tags
- Set the root and cookie-banner LICENSE files to the MIT text with a
"MIT License" title line
- Switch the package.json license fields, Docker image label, and
cookie-banner README to MIT
- Update docs and the genmodels header generator accordingly
- Normalize copyright lines to a single format
(Copyright (c) <year(s)> Probo Inc <hello@probo.com>.): unify the
hello@getprobo.com and hello@probo.inc emails to hello@probo.com and
the comma-separated years to a hyphenated range
Genuine third-party references are intentionally left untouched: the
Lucide icon attributions (Lucide is ISC) and the trivy dependency
license allowlist.
Signed-off-by: Sacha Al Himdani <sacha@probo.com>
Device logins only requested OIDC scopes while the authorizer now
gates API calls on v1:* scopes. Register the full scope set on the
well-known prb client, request it at login via CLIClientScopes, and
cover the device flow in e2e.
Collapse API scopes under an accordion on the consent screen and
document scope sync for future namespace additions.
Signed-off-by: Ludovic Vielle <ludovic@probo.com>
Apply five style rules: convert iota string enums to typed
string constants, replace errors.As with errors.AsType,
merge three-group imports into two groups, fix multiline
parameter/argument formatting, and replace fmt.Sprintf URL
construction with net/url.
Signed-off-by: Émile Ré <emile@probo.com>
Audit all three API surfaces against the console GraphQL schema and add
missing resources: asset, audit, datum, dpia, evidence upload, measure,
obligation, processing activity, rights request, snapshot, task, tia,
trust center (with references/files), and vendor management CLI
commands; MCP tools for deletes, rights requests, trust center, vendor
contacts/services, and compliance external URLs; n8n nodes for
obligation, finding, task, evidence, processing activity, dpia, tia,
rights request, snapshot, audit log, access review, organization
context, trust center, and additional control/measure/vendor operations.
Include MCP e2e test infrastructure (testutil MCP client with API key
auth and JSON-RPC session management) and tests covering all new MCP
tools.
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
Implement a full OAuth2 2.0 and OpenID Connect 1.0 authorization
server with support for authorization code flow (with PKCE),
refresh token rotation, device authorization grant, dynamic
client registration, token introspection, and token revocation.
Includes database schema, coredata layer, service logic, HTTP
handlers, OIDC discovery endpoint, and JWKS publishing.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
URI schemes are case-insensitive per RFC 3986, so HTTP:// and HTTPS://
must also be recognized when checking for existing schemes.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
The browse command and config loading were incorrectly prepending https:// to hosts that already had a scheme, resulting in malformed URLs like https://http://localhost:8080. Added normalizeHost() function to strip URL schemes when loading config, and added scheme detection in the browse command before prepending https://.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
The CLI client was hardcoding https:// scheme, which prevents local dev with http://localhost. Add support for bare hostnames (auto-prepend https) while preserving http:// and https:// prefixes when explicitly provided.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Add __typename to GraphQL queries and type guards in risk view,
risk list, user view, and user list commands to prevent silent
garbage output when a wrong node type ID is passed. Wrap
standalone var declarations in var () blocks per style guide.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Introduce the proboctl CLI entry point, root command, version,
completion, iostreams, shared cmdutil helpers (flags, table, JSON,
time formatting), API client with pagination, config management,
goreleaser configuration, and build system integration.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
