The PR lint path was running `npx eslint .` for the n8n-node package,
which uses a different config than `npx n8n-node lint` used on push.
This caused lint to pass on PRs but fail on push to main.
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
The root brace-expansion@5 override broke minimatch@3 (used by
@eslint/config-array) because v5 changed the export API. Add a
scoped override so minimatch@3 gets brace-expansion@1.
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
When a magic link token expires, the user now sees a specific
error message ("This magic link has expired. Please request a
new one.") instead of the generic "Failed to connect" error.
This adds ErrExpiredToken to the IAM error types, checks for
statelesstoken.ErrExpiredToken in both GetMagicLinkEmail and
OpenSessionWithMagicLink, and handles it in the trust resolver
and frontend.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Previously the worker reset failed descriptions back to PENDING,
causing infinite retry loops for permanently broken evidence.
Add a FAILED status so these items stop cycling and can be
investigated.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
GetFileBase64 read the MIME type from the S3 response header,
which can be application/octet-stream for files uploaded without
an explicit content type. Use file.GetMimeType() from the
database instead, which stores the correct MIME type captured
at upload time. This fixes evidence description failures when
calling the OpenAI API with PDF files.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Introduce a background worker that automatically generates
compliance-focused descriptions for uploaded evidence files
using configurable LLM providers. Descriptions are surfaced
across all interfaces: GraphQL API, MCP API, CLI, and the
console UI.
Key changes:
- Multi-provider LLM config with per-agent settings (pointer
types for Temperature/MaxTokens to preserve zero values)
- Evidence description worker with bounded concurrency
- EvidenceDescriptionStatus typed enum with PostgreSQL enum type
- New `prb evidence` CLI commands (list, view, delete)
- Evidence description displayed in console table and preview
- Migration only marks evidences without files as completed
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Add --max-warnings 0 to every eslint lint script so that any warning
causes a non-zero exit code. This makes `make lint` and CI fail on
warnings, not just hard errors.
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
- Remove unused `rank` field from CompliancePageReferenceListItemFragment;
the parent list fragment already fetches it for drag-and-drop reordering.
Thread `rank` through the onEdit call chain so the edit dialog can still
pre-populate the field via a dedicated parameter instead of the fragment.
- Add missing `documentTypeFilter` dependency to the refetch useEffect in
DocumentList so stale closure values are never used on tab change.
- Break overlong line in DocumentList (canSendAnySignatureNotifications).
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
Trust centers were created without setting SearchEngineIndexing,
defaulting to an empty string in the database. This caused scan
errors when loading trust centers.
Add a migration to fix corrupted rows, set a DEFAULT on the
column, and add a CHECK constraint. Also set the field explicitly
when creating new trust centers.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Introduce dataloadgen-based dataloaders to batch individual
record-by-ID fetches in GraphQL resolvers into single SQL
queries. Each entity type (organization, framework, control,
vendor, document, risk, measure, task, file, report, profile)
gets a LoadByIDs method in coredata and a GetByIDs service
method with variadic arguments and dedicated collection return
types. Resolvers now use dataloader.FromContext instead of
direct service calls for single-record lookups.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
CAA issue records may contain parameters after a semicolon per
RFC 8659 (e.g. "letsencrypt.org; accounturi=..."). Split on ";"
and compare only the issuer domain so these records are accepted.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Before requesting a certificate from the ACME provider, verify
that CAA DNS records for the domain permit issuance by the
configured CA. This avoids wasting ACME attempts on domains
whose CAA policy would reject the request.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Without an explicit AuthStyle, the oauth2 library uses
auto-detection which tries Basic auth first. Microsoft
rejects this, and since PKCE codes are single-use, the
retry with the correct style fails.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
The SCIM client User struct had json:"-" tags on most fields
(GivenName, FamilyName, ExternalID, Department, etc.), so
ListUsers never populated them from the JSON response. The
bridge comparison always saw empty strings on the SCIM side
vs actual values from the provider, making needsUpdate true
for every user on every sync cycle.
Add custom UnmarshalJSON on User to properly parse nested
SCIM JSON (name object, enterprise extension) into the flat
struct, so the existing diff logic correctly skips unchanged
users.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
When CompleteHTTPChallenge fails, the challenge is already marked
invalid by Let's Encrypt. Retrying Accept on the same challenge
always fails with "authorization must be pending". Reset the
domain to pending with cleared challenge data so each retry
creates a new ACME order.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Contract start and end dates are never synced by SCIM, so they
should remain editable even when a profile is SCIM-managed.
The backend now skips overwriting SCIM-synced fields (fullName,
kind, position, additionalEmailAddresses) for SCIM profiles,
and the frontend disables only those fields instead of the
entire form.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Add search engine indexing toggle, robots.txt, and sitemap.xml
generation for compliance pages. Replace checkboxes with toggle
components in the compliance page UI and add an "Open" button
in the page header to quickly access the live compliance page.
The search engine indexing toggle is disabled when the compliance
page is inactive.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
The SignInPage now shows OIDC, SSO, and email buttons instead of
embedding the email/password form directly. Users clicking "Sign in
with email" are taken to the existing PasswordSignInPage.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
- Add blank line between import groups (import-x/order)
- Use Relay fragment in OIDCButtons to colocate field queries (relay/unused-fields)
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
- Remove inline password form from SignInPage (use PasswordSignInPage)
- Extract Divider and OIDCButtons to _components folder
- Move OIDC providers into page queries instead of lazy-loaded queries
- Create useSafeContinueUrl hook for trust app using getPathPrefix
- Use safeContinueUrl.toString() for continue URL parameter
- Fix wg.Go style in IAM service Run method
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
The OIDC provider is already tracked in iam_oidc_states.provider, so
there is no need for provider-specific session auth methods (GOOGLE,
MICROSOFT). Replace them with a single OIDC auth method.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
EnabledProviders() iterated a map, producing nondeterministic order.
Sort the slice before returning to ensure stable UI and test behavior.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Add Google and Microsoft sign-in buttons to the trust center connect
page, matching the console sign-in experience. The backend OIDC flow
already supports flexible continue URLs, so only the GraphQL schema
and frontend needed changes.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
- Remove sensitive nonce values from error messages to prevent logging leaks
- Guard ticker intervals against non-positive durations in SAML domain
verifier and garbage collector to prevent panics
- Require both client ID and client secret for Google/Microsoft OIDC
providers to be marked as enabled
- Replace http.DefaultClient with kit/httpclient for JWKS fetching to
ensure proper timeouts
- Fix eslint indentation in SignInPage OIDC button click handler
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
