Export and request-access already know visibility and
auth; a shared requireCompletedNDA call keeps NDA
enforcement there and drops GraphQL PUBLIC probing.
Signed-off-by: Émile Ré <emile@probo.com>
Prefer the saved locale as the primary CTA, soften secondary
and NDA actions, tint dismiss hovers to the banner palette,
and center the leading icon with the message.
Signed-off-by: Émile Ré <emile@probo.com>
The button is on the review page itself, so Review and sign
is redundant. Console keeps its own reviewAndSign key.
Signed-off-by: Émile Ré <emile@probo.com>
OAuth continue-URL rewriting shares path/locale utilities with
SEO, so keep those in locale.go and leave seo.go for
SEOFromRequest only.
Signed-off-by: Émile Ré <emile@probo.com>
Guests who authenticate from a shared-locale URL were landing
on that URL with a mismatch banner. Adopt Identity.locale on
the OAuth callback redirect instead.
Signed-off-by: Émile Ré <emile@probo.com>
Locale and NDA notices shared layout chrome but were not kit
Callouts. Pull the full-bleed band into Banner and rename the
feature wrappers so the names match the role.
Signed-off-by: Émile Ré <emile@probo.com>
When both banners stack they read as one band if they share
gold. Use sky (info) for locale and amber (warning) for NDA,
and keep content inside the same max-w-5xl column as TopBar.
Signed-off-by: Émile Ré <emile@probo.com>
Match the unsigned-NDA banner layout: keep layout classes in
tv slots so the callout shell stays free of raw utilities.
Signed-off-by: Émile Ré <emile@probo.com>
Signed-in users with an incomplete portal NDA need a clear
path to review and sign without waiting for a private
document export to fail the gate.
Signed-off-by: Émile Ré <emile@probo.com>
Signed-in users exporting a PUBLIC doc, report, or file
should not be forced through the NDA. Keep the gate on
private targets and always on bulk requestAccesses.
Signed-off-by: Émile Ré <emile@probo.com>
Match the document viewer header so users can leave without
signing, returning to the list instead of the continue URL
that would re-trigger the gate.
Signed-off-by: Émile Ré <emile@probo.com>
Mutations never reach route error boundaries, so each call
site reimplemented sign-in / full-name / NDA redirects.
Consume those gates in the shared useMutation notifier and
drop the duplicated handlers.
Signed-off-by: Émile Ré <emile@probo.com>
Document export is a mutation, so NDA_SIGNATURE_REQUIRED never
reaches the route boundary. Catch it in the export hook, stop
re-firing on mutate identity churn, and match gate errors by
name when instanceof fails across package copies.
Signed-off-by: Émile Ré <emile@probo.com>
Signed-in users should browse the compliance portal the
same way visitors do. Keep @nda on export and access
mutations so signatures are only required when loading a
document.
Signed-off-by: Émile Ré <emile@probo.com>
Delete and DeleteExpired omitted Scoper, breaking the
tenant-isolation pattern used elsewhere in coredata. Pass a
tenant scope from ExchangeEnrollmentToken and NewNoScope from
the ITAM GC so cross-tenant cleanup stays explicit.
Signed-off-by: Ludovic Vielle <ludovic@probo.com>
Reminders that fall due on Saturday or Sunday no longer send
over the weekend or spend the escalation ladder unused. SQL
keeps calendar cadence and rolls weekend due times to Monday
at the same clock hour. The first debounced notice is unchanged.
Co-authored-by: Sacha Al Himdani <sacha@probo.com>
Signed-off-by: Cursor Agent <cursoragent@cursor.com>
ITAM GraphQL actions were never registered in the shared OAuth2
scope registry, so bearer-token callers failed closed even when
role policies allowed them. Add v1:itam / v1:itam:read mappings,
register them in probod, and sync the CLI client scopes.
Signed-off-by: Ludovic Vielle <ludovic@probo.com>
Admins could only revoke devices, so never-enrolled and revoked
inventory rows piled up with no way to remove them. Soft-delete
is limited to REVOKED devices (revoke first), and ITAM GC now
hard-deletes PENDING/REVOKED orphans with no API key, postures,
or valid enrollment token—including user tombstones without
history.
Signed-off-by: Ludovic Vielle <ludovic@probo.com>
Omit level to return direct third parties; pass level to filter
by hierarchy depth. Documented on the tool and filter field.
Signed-off-by: Sacha Al Himdani <sacha@probo.com>
Bump transitive brace-expansion to patched releases (5.0.9 / 2.1.3 / 1.1.17) so expand() cannot OOM the process on crafted brace patterns.
Signed-off-by: Sacha Al Himdani <sacha@probo.com>
LoadExistingByIDs scanned into MembershipProfile without
activated_at/deactivated_at after the profile-state split, so
SCIM_EVENT CSV exports failed collecting rows by ID.
Signed-off-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>
WriteRow was a variadic alias for Write(SanitizeRecord(...))
with no extra safety or column checks. Export call sites already
use []string headers; matching encoding/csv keeps one API surface.
Signed-off-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>
SCIM events store user_name, not identity_id; profile GIDs
in /Users/{id} paths drive LoadExistingByIDs and identity
email lookup instead of batching by user_name.
Signed-off-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>
Email comes from identity when a profile matches; empty
email only when the event has no profile row to join.
Signed-off-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>
Drop the doc-only source file; keep export guidance on the
main Writer entry point.
Signed-off-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>
Trim-based formula detection skipped the old rule for
leading control characters; check those bytes before trim.
Signed-off-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>
Ignore leading Unicode space when detecting formula cells,
extend starter runes, and document export usage in package
doc.
Signed-off-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>
Wrap encoding/csv with formula-safe cell sanitization and
use it from log export streaming.
Signed-off-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>
Load SCIM profile emails via Identities in the export
layer, drop the cross-table join, sanitize formula-leading
cells, and fall back to validated userName when profile email
is missing. Drop redundant gid array casts in LoadByIDs.
Signed-off-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>
Replace full Identity and PersonalAPIKey batch loads with
rows that select only id, email, name fields used in export.
Signed-off-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>
The batch loader no longer scans into MembershipProfile with
placeholder email and organization name columns from dropped
identity and organization joins.
Signed-off-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>
ANY(@ids) with an empty array is valid in Postgres and
CollectRows already yields an empty slice; the early nil
assignments added noise without changing callers.
Signed-off-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>
WalkAll now accepts loaders and callbacks typed as S ~[]T so
exports can use AuditLogEntries and SCIMEvents directly. Pass the
trimmed page slice to walk, not the over-fetched loader result.
Signed-off-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>
