Replace the monolithic agents config with a cleaner structure:
- llm: holds provider credentials and default model settings
- probo-agent: LLM overrides for the probo agent
- evidence-describer: worker config (interval, stale-after,
max-concurrency) alongside LLM overrides
This makes worker tuning configurable via YAML and env vars
instead of being hardcoded in Go, and separates provider
credentials from per-consumer model settings.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Add API key connector protocol, OAuth2 client credentials
grant, token refresh config, provider info endpoint,
ConnectorProviders helper, and bootstrap configs for all
OAuth providers. Move OAuth2 state decode near type.
Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
Introduce a background worker that automatically generates
compliance-focused descriptions for uploaded evidence files
using configurable LLM providers. Descriptions are surfaced
across all interfaces: GraphQL API, MCP API, CLI, and the
console UI.
Key changes:
- Multi-provider LLM config with per-agent settings (pointer
types for Temperature/MaxTokens to preserve zero values)
- Evidence description worker with bounded concurrency
- EvidenceDescriptionStatus typed enum with PostgreSQL enum type
- New `prb evidence` CLI commands (list, view, delete)
- Evidence description displayed in console table and preview
- Migration only marks evidences without files as completed
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Before requesting a certificate from the ACME provider, verify
that CAA DNS records for the domain permit issuance by the
configured CA. This avoids wasting ACME attempts on domains
whose CAA policy would reject the request.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
- Remove sensitive nonce values from error messages to prevent logging leaks
- Guard ticker intervals against non-positive durations in SAML domain
verifier and garbage collector to prevent panics
- Require both client ID and client secret for Google/Microsoft OIDC
providers to be marked as enabled
- Replace http.DefaultClient with kit/httpclient for JWKS fetching to
ensure proper timeouts
- Fix eslint indentation in SignInPage OIDC button click handler
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Implements OpenID Connect authentication flow with PKCE, JWT verification, and enterprise-only account restrictions. Adds OIDC service with JWKS caching and state management, HTTP handlers for login/callback flows, GraphQL query for available providers, and sign-in UI integration.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Replace gopkg.in/yaml.v3 with sigs.k8s.io/yaml in write_test.go to match
the marshaling library used by WriteConfig. The sigs.k8s.io/yaml library
uses JSON struct tags, enabling proper round-trip serialization of configs
with custom unmarshaling logic like ConnectorConfig.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Add a make target for probod-bootstrap and integrate it into the sandbox provisioning workflow. During VM provisioning, generate /etc/probod/config.yml with the Lima VM IP as the cookie domain, secure=false for HTTP access, and correct CORS origins. Also generate .env files for console and trust apps pointing to the VM IP. Update sandbox documentation to explain the auto-generated configuration.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
