CountByRiskID and CountByControlID CTEs did not include m.category in their SELECT
lists, causing "column category does not exist" errors when MeasureFilter applied
category constraints. Added m.category to both CTEs.
Also add comprehensive e2e tests for measure filtering by category at organization,
risk, and control levels.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
The CountActiveOwnerByOrganizationID query joins iam_membership_profiles with
iam_memberships, but used an unqualified tenant_id = @tenant_id in the WHERE
clause. Since both tables have a tenant_id column, PostgreSQL raised an
"ambiguous column" error when deleting an owner. Fixed by prefixing with the
table alias (p.tenant_id) to match the pattern used in CountByOrganizationID.
Added TestUser_RemoveOwner e2e test to verify one owner can remove another.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
When creating an organization, the owner's membership profile was being set with the organization name as the full name instead of the owner's actual full name. Fetch the identity's full name and use it for the profile.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Enforce minimum (25) and maximum (100) bounds on cursor size to prevent negative values or excessively large page sizes. All three API surfaces (GraphQL, MCP, CLI) funnel through NewCursor, so the fix belongs here.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Support distinguishing between minor and major non-conformities in findings. Rename the existing NONCONFORMITY enum value to MINOR_NONCONFORMITY and add a new MAJOR_NONCONFORMITY value across all API layers (GraphQL, MCP, CLI) and the database.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Replace the client-side grouped-by-category view (fetching 500 items)
with a flat table using server-side filtering and cursor-based
pagination. Colocate GraphQL queries, fragments, and mutations in the
component file per console CLAUDE.md conventions.
Backend changes add a category filter to the measure list endpoints
(GraphQL, MCP) and a new measureCategories field on Organization.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Use the trust center's logo as favicon via the public file API URL,
falling back to the default favicon when no logo is configured.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Render dynamic file content into a bytes.Buffer first so that
renderer errors return 500 instead of a partial 200 response.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Implement server-side rendering of trust center page `<head>` with dynamic organization name and OG meta tags. Adds generic `FileRenderer` mechanism to statichandler for dynamic file rendering, allowing the trust server to inject templated content at request time.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Implements native Go 1.26 cross-origin protection to block state-changing cross-origin browser requests. Registers configured AllowedOrigins as trusted origins and wraps the API router to check all incoming requests. Non-browser clients (MCP, Slack webhooks) are unaffected as they lack the browser-only Sec-Fetch-Site header.
Signed-off-by: gearnode <gearnode@probo.inc>
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
- Hold SELECT FOR UPDATE lock within transaction by using tx directly instead of separate WithConn, ensuring mutual exclusion when multiple requests race to verify the same token
- Fix "resouce" → "resource" typo in authentication error messages
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Adds a visibility enum to files with PRIVATE (default) and PUBLIC states.
PUBLIC files are accessible via an unauthenticated /api/files/v1/{fileID}
endpoint that redirects to a presigned S3 URL. Introduces pkg/file service
to manage file operations. Logo uploads (trust centers, organizations,
frameworks, references) are marked PUBLIC; other files are PRIVATE.
Includes database migration and backfill for existing logos.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
URI schemes are case-insensitive per RFC 3986, so HTTP:// and HTTPS://
must also be recognized when checking for existing schemes.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
The browse command and config loading were incorrectly prepending https:// to hosts that already had a scheme, resulting in malformed URLs like https://http://localhost:8080. Added normalizeHost() function to strip URL schemes when loading config, and added scheme detection in the browse command before prepending https://.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Replace gopkg.in/yaml.v3 with sigs.k8s.io/yaml in write_test.go to match
the marshaling library used by WriteConfig. The sigs.k8s.io/yaml library
uses JSON struct tags, enabling proper round-trip serialization of configs
with custom unmarshaling logic like ConnectorConfig.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Replace three instances of leftover %T format verbs in logger.ErrorCtx() calls with proper structured logging fields. Add alphabetically-sorted reference documentation for six new contrib/claude/ guides and reorder the existing list.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Add a make target for probod-bootstrap and integrate it into the sandbox provisioning workflow. During VM provisioning, generate /etc/probod/config.yml with the Lima VM IP as the cookie domain, secure=false for HTTP access, and correct CORS origins. Also generate .env files for console and trust apps pointing to the VM IP. Update sandbox documentation to explain the auto-generated configuration.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
All panic(fmt.Errorf(...)) calls in the console and trust center
GraphQL resolvers are replaced with structured error logging via
r.logger.ErrorCtx and gqlutils.Internal(ctx) returns.
Mutation resolvers for Create, Update, Upload, Import, and Assess
operations now check for validator.ValidationErrors before returning
an internal error, surfacing field-level INVALID errors to clients
via gqlutils.InvalidValidationErrors.
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
Expand mixed inline/multiline function calls so each argument
is on its own line, matching the one-argument-per-line rule.
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
The Organization.TrustCenter and Node resolvers were not loading the NDA file from the database, causing ndaFileName to be null on page reload even though the file was uploaded. Now the resolvers fetch the file when NonDisclosureAgreementFileID is set.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Add prb finding subcommands: create, list, view, update, and delete.
Register the finding command group in the root command and update
the factory to expose FindingService.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Replace nonconformity and continual improvement MCP tools with
unified finding tools: list_findings, get_finding, create_finding,
update_finding, delete_finding, link_finding_to_audit, and
unlink_finding_from_audit.
Update specification and resolvers to use the new finding types.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Replace nonconformity and continual improvement GraphQL types with a
unified Finding type supporting kind, status, priority, and audit
associations. Update schema, resolver, and type mappings.
Add mutations for createFinding, updateFinding, deleteFinding,
linkFindingToAudit, and unlinkFindingFromAudit.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Introduce FindingService with create, update, delete, get, and list
operations including audit association management. Update the probo
service orchestration, actions, and policies to use findings.
Remove the old NonconformityService and ContinualImprovementService.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Introduce the Finding, FindingAudit, FindingKind, FindingStatus,
FindingPriority, FindingFilter, and FindingOrderField types in the
coredata layer. Add CRUD operations, list with filtering/pagination,
and audit association queries.
Remove the now-replaced nonconformity and continual_improvement
coredata types. Update entity type registry and snapshot types
to reference the new findings type.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Merge nonconformities and continual_improvements tables into a
unified findings table with kind (NONCONFORMITY, OBSERVATION,
EXCEPTION), status, and priority enums. Create findings_audits
junction table for the many-to-many audit relationship.
The migration generates new FND-XXX reference IDs per organization,
migrates both live and snapshot records preserving source_id links,
and carries over audit associations to the junction table.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Auditors should not see the meetings menu in the navigation bar since they lack the necessary permissions to access meetings.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Introduce `implemented` enum (IMPLEMENTED/NOT_IMPLEMENTED) and
`not_implemented_justification` (nullable text) fields on the Control
entity across all API surfaces (GraphQL, MCP, CLI), database, frontend,
and SOA export.
The database stores implementation state as a PostgreSQL enum
`control_implementation_state`. Controls default to IMPLEMENTED during
migration. The SOA list and PDF export show implementation status
alongside applicability, with "-" for non-applicable controls.
Justification columns are renamed for clarity: "Justification for
non-applicability" and "Justification for non-implementation".
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
The CLI client was hardcoding https:// scheme, which prevents local dev with http://localhost. Add support for bare hostnames (auto-prepend https) while preserving http:// and https:// prefixes when explicitly provided.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Move document download/view to a dedicated viewer page with PDF preview,
access request flow, and a proper 404 error boundary when documents are
not found. The backend now returns NOT_FOUND instead of INTERNAL for
missing documents and reports.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Run make generate in CI lint and test jobs since generated files are
now gitignored. Also include Relay codegen for frontend apps in the
generate target.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Add __typename to GraphQL queries and type guards in risk view,
risk list, user view, and user list commands to prevent silent
garbage output when a wrong node type ID is passed. Wrap
standalone var declarations in var () blocks per style guide.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
When logging out of the active host while other hosts exist,
the stale ActiveHost reference caused DefaultHost() to silently
fall through to the first alphabetical host instead of treating
the user as logged out.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Add CRUD commands for statements of applicability and their
applicability statements (add, list, remove, update).
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Introduce the proboctl CLI entry point, root command, version,
completion, iostreams, shared cmdutil helpers (flags, table, JSON,
time formatting), API client with pagination, config management,
goreleaser configuration, and build system integration.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
