Move range, ETag, and cache handling out of the files API handler
so brand logos and other public assets can reuse the same code path.
Signed-off-by: Bryan Frimin <bryan@probo.com>
The compliance portal OAuth callback accepted ID tokens after only
parsing claims, without checking the signature, issuer, audience, or
expiry. Add RS256 verification helpers to the JOSE package, enforce
those checks in ParseIDTokenIdentity, and thread JWKS, issuer, and
client ID through the token response and callback handler.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Compliance portal OAuth must call the configured Probo base URL
during connect flows; in local dev that endpoint is loopback and
was blocked by default SSRF protection on the initiate HTTP client.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Update generated test config, loopback HTTPS client, and workflow
root CA wiring for the step-ca ACME directory and port-443 trust
center listener introduced by the new compose stack.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Pebble skipped real HTTP-01 validation, which hid integration gaps
for compliance-page custom domains. step-ca with a Caddy port-80
proxy exercises the same path production uses while keeping issued
certs persistent across compose restarts.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Add the complianceportal Go embed target, wire it into CI and
release workflows, and document the new build entry point.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Extend test helpers for portal OAuth flows and cover connect,
callback, and NDA signing against the compliance portal API.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Update Relay schema paths and HTTP endpoints so the portal app
talks to the compliance portal GraphQL and OAuth routes.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Surface dedicated routes when a portal magic link is expired or
already used, and add the portal login entry point in console.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Redirect visitors through the compliance portal OAuth initiate
endpoint and remove the verify-magic-link page and routes.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Mount the compliance portal mux on trust center hosts, drop the
legacy trust web server, and share response header helpers.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Create IAM sessions from OAuth callbacks with the portal hostname
and consent data needed by the compliance portal API.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Relocate the public trust center GraphQL surface, OAuth handlers,
and SPA serving into the compliance portal API package and remove
the legacy trust v1 server tree.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Drop the one-time session handoff flow now that trust center
visitors authenticate through OAuth against the compliance portal.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Handle OAuth initiation, callback exchange, and session creation
for anonymous trust center visitors through the portal package.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Persist portal hostname and OAuth state on session records so the
callback can bind an authorization code to the correct trust center.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Build and validate client metadata documents for trust center
hostnames so OAuth initiation can publish the correct redirect URIs.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Teach CIMD registration and discovery about per-portal client
metadata, and carry portal context through token and ID token
issuance for downstream session creation.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Register the new provider enum value so compliance portal OAuth
clients can be stored and resolved like other IAM OIDC providers.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Store website, email, and headquarters on the trust center so
public and admin surfaces read branding from one place. Drop the
trust API organization type and wire console, MCP, CLI, and apps
through the updated schema.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Stop relying on the /trust/{id} path prefix in the public trust app and
serve it from the host root, reading contact and profile data from the
trust center instead of the organization. Mirror the same fragment
ownership change in the compliance portal hero.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Decompose the brand page into profile, domains, visual identity, and
custom link sections, and move frameworks and the NDA card onto the
overview page as dedicated fragment components. Remove the standalone
domain page and redirect its route to brand, where domains now live.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Introduce the app-bound useMutation primitive and rename the trust center
graph and reference hooks to compliance page, moving the shared reference
dialogs alongside them. Sweep the compliance page subpages onto the new
mutation hook and the compliance-portal permission strings, and strip the
profile fields from the organization settings form.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Follow the new domain model in tests: drop organization profile
assertions, add a trust center profile test, and hit the dedicated HTTPS
listener with SNI for the visitor API. Mirror the custom link rename and
profile field moves in the n8n node operations.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Rewire the console and visitor resolvers onto the management and visitor
services with compliance-portal authorization. Rename the GraphQL and MCP
ComplianceExternalURL type to ComplianceCustomLink, expose trust center
profile fields, default and custom domains, public URL, and the managed
flag, and drop the profile fields from the organization surface.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Rename the compliancepage HTTP package to complianceportal and drop the
slug-based id middleware. Compliance pages are now served exclusively
over SNI-based custom-domain HTTPS, with the SNI middleware resolving the
page by TLS server name and redirecting secondary domains to the
canonical host.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Wire the certificate manager and trust center base domain into IAM so
organization creation provisions a managed default domain and certificate
atomically. Email presenters in IAM and mailman resolve public URLs
through the compliance portal resolver and read profile fields from the
trust center. probod initializes the certmanager service and injects the
new management and visitor services.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Split the compliance portal into an admin-facing management side and a
public-facing visitor side under pkg/complianceportal. Trust-center CRUD,
domains, custom links, frameworks, files and accesses move out of
pkg/probo, and the visitor read logic moves out of pkg/trust. IAM actions
migrate onto compliance-portal scopes.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Rename the compliance external URL concept to compliance custom links,
and move the public-facing profile fields (description, website, email,
headquarter address) off the organization onto the trust center. Backfill
managed default domains for pages that lack them.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Replace the Provisioner and Renewer with poll-based provision and renew
workers orchestrated by a certmanager Service. Certificate operations are
now hostname-centric and driven by the certificates table, decoupled from
custom-domain business logic.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Pull SSL/ACME state out of custom_domains into a dedicated hostname-keyed
certificates table, and repoint cached certificates from the domain to
the certificate. Custom domains now reference a certificate id, keeping
certificate provisioning decoupled from domain business logic.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Custom domains previously hung off the organization. Attach them to the
trust center instead, adding default and custom domain references plus a
managed flag, and backfill existing rows. Domains now belong to a
compliance page rather than the whole organization.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Introduce the trust center base domain setting (default probopage.com)
so managed default domains can be minted for every compliance page.
This configuration is a prerequisite for the domain-ownership migration
and the default-domain provisioning that happens at organization
creation.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Emit lifecycle events for rights requests created through either the
console or compliance portal. Keep webhook subscription choices in sync
across every API and client surface.
Signed-off-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Sacha Al Himdani <SachaProbo@users.noreply.github.com>
Signed-off-by: Cursor Agent <cursoragent@cursor.com>
pkg/iam exports IAMOAuth2ScopeMappings, not OAuth2ScopeMappings.
Call out that exception in the agent docs so IAM actions are not
left unregistered for OAuth2 callers.
Signed-off-by: Émile Ré <emile@probo.com>
OAuth2 tokens with v1:compliance-page could not create commitment
groups or items because the IAM actions were never listed in
OAuth2ScopeMappings. Document the mapping step so MCP/API work
does not skip it again.
Signed-off-by: Émile Ré <emile@probo.com>
Size desktop pages to HeaderBand's max-w-5xl column so
they line up with the title and toolbar. Mobile gutter is
unchanged.
Signed-off-by: Émile Ré <emile@probo.com>
Fit-to-width at 100% used a phone-sized inset on all
viewports. Use the HeaderBand px-8 gutter on desktop so
the page aligns with the hero; keep mobile unchanged.
Signed-off-by: Émile Ré <emile@probo.com>
ListItemSkeleton reused a sand-2 fill that read as a
different card; use the real row shell with pulse bars
instead, and shrink the updates skeleton to five rows.
Signed-off-by: Émile Ré <emile@probo.com>
Introduce a v2 z-1…z-6 stacking scale so portaled
menus sit above in-page media, and redirect the
legacy /overview trust-app URL to home.
Signed-off-by: Émile Ré <emile@probo.com>
Sync GraphQL commitment group and item operations
to the remaining API surfaces so automation can
manage compliance portal commitments end to end.
Signed-off-by: Émile Ré <emile@probo.com>
Embed and build @probo/compliance-portal for the
/trust path and custom-domain SPA so production
ships the v2 portal. Keep apps/trust in the repo
for local use on port 5175; portal takes 5174.
Signed-off-by: Émile Ré <emile@probo.com>
