Replace hand-rolled polling loops, semaphores, and WaitGroups
in all 7 background workers with go.gearno.de/kit/worker. Each
worker now implements Handler[T] (Claim/Process) and optionally
StaleRecoverer, gaining automatic Prometheus metrics and
OpenTelemetry tracing. Bumps kit from v0.3.0 to v0.5.0.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
The NewDatum type conversion helper was not mapping the OwnerID field
from the coredata struct, causing MCP responses for data resources to
return a zero-value owner_id.
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
Now that title lives on document_versions, the full-text search vector
belongs there too. Drop the generated column and GIN index from
documents, recreate them on document_versions, and update the document
filter to query the latest version's search_vector.
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
The description field on Document and EmployeeDocument was never
populated. Remove it from the database, GraphQL schema, and Go types.
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
Title is now owned by document_versions, following the same pattern as
classification and document_type. The documents.title column is made
nullable with a TODO to drop it. Backend loads title from a
latest_versions CTE for ordering purposes only. The frontend resolves
title from the latest version, and DocumentTitleForm now operates on
DocumentVersion using UpdateDocumentVersion mutation.
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
The signUpEnabled field used @session(required: NONE) which rejects
authenticated users. Change it to OPTIONAL so the query works regardless
of authentication state, fixing a crash on the sign-up page for
already-logged-in users.
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
Instead of showing the signup form and returning an internal error on
submit, the SignUpPage now queries signUpEnabled upfront and displays a
friendly message explaining that registration is not available, with a
link back to login.
Adds a signUpEnabled GraphQL query field on the connect/v1 API and
handles ErrSignupDisabled as a FORBIDDEN error in the SignUp resolver.
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
Replace the per-approver add/remove model with a quorum-based approval
system. Documents now have default approvers that are pre-populated when
requesting approval, and the publish dialog lets users adjust the list
before submitting.
Key changes:
- Add PENDING_APPROVAL document version status with dedicated transitions
- Introduce approval quorums with request/approve/reject/void lifecycle
- Add default approvers per document (stored in document_default_approvers)
with MERGE-based upsert for efficient sync
- Add NoDuplicates validator for slice fields
- Split ALTER TYPE ADD VALUE migrations into separate files (required by
PostgreSQL when run inside transactions)
- Use VOIDED consistently for both quorum status and decision state enums
- Expose void/approve/reject through GraphQL and MCP, with e2e tests
- Add approval management UI: publish dialog with approver selection,
approval list with void support, and external approve/reject page
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
Rename the entity across the full stack: database table
(states_of_applicability → statements_of_applicability), Go model,
GraphQL types, MCP specification, CLI commands, frontend components,
routes, and display labels. Includes a migration to rename the table
and its foreign key column.
Widen sidebar from 260px to 280px to fit the longer label.
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
Use utf8.RuneCountInString so multi-byte characters like é count as one
character. Add a unicode test case to cover this.
Signed-off-by: Émile Ré <emile@getprobo.com>
Add Node.TextLength() to walk the ProseMirror tree and sum actual user
text. Introduce ProseMirrorDocumentMaxTextLength validator that enforces
a 50k character limit on extracted text, paired with a 500k byte safety
cap on the raw JSON string. Extend e2e tests for content length.
Signed-off-by: Émile Ré <emile@getprobo.com>
The MCP UpdateRiskTool resolver was not passing the Note field
to the UpdateRiskRequest, causing note updates via MCP to be
silently ignored. The GraphQL resolver already forwarded it
correctly.
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
A Google-Workspace-specific field on the generic Organization type
was future-hostile: each new SCIM bridge type would need its own
top-level field. Replace with a generic SCIMBridgeTypeInfo type
queried through Organization.scimBridgeTypes, parallel to the
ConnectorProviderInfo pattern in console/v1.
ConnectorList looks up the Google Workspace entry from the list
and passes its scopes to GoogleWorkspaceConnector as before.
Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
The AccessSource.oauth2Scopes field duplicated knowledge that
naturally belongs on the Connector object that AccessSource
already exposes via its connector field. Move it to Connector so
every type that holds a connector (AccessSource, SCIMBridge, etc.)
can reach the scopes through the connector relationship.
AccessSourceRow now queries accessSource.connector { oauth2Scopes }
in its reconnect flow.
Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
Add per-context fields so the frontend can read scopes from the
type that owns each connection:
- ConnectorProviderInfo.oauth2Scopes: access review providers
- AccessSource.oauth2Scopes: access review reconnect flow
- Organization.slackOAuth2Scopes (console): compliance page Slack
- Organization.googleWorkspaceOAuth2Scopes (connect): SCIM bridge
Resolvers delegate to the constants declared in each owning Go
module. The Google Workspace field lives on Organization, not on
SCIMConfiguration, so the Connect button can read it before any
SCIM configuration exists.
Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
Each module that initiates an OAuth2 flow now declares its scopes
in its own package instead of duplicating them in the frontend or
in shared connector config:
- pkg/accessreview/drivers: per-provider scopes for the access
review drivers
- pkg/slack: scopes for the compliance page integration
- pkg/iam/scim/bridge/provider/googleworkspace: scopes for the
SCIM provisioning bridge
These constants are surfaced to the frontend via GraphQL fields
so the frontend never hardcodes scope strings.
Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
Add an InitiateOptions struct to the Connector interface so each
caller can declare the scopes it needs instead of having them baked
into the connector at registration. The HTTP handler reads repeated
?scope= query parameters from /connectors/initiate and forwards them.
Also restore GOOGLE_WORKSPACE and LINEAR provider definitions which
were silently dropped from the bootstrap config refactor.
Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
Use the ContinueURL from the state token so the user is redirected
back to where they initiated the flow instead of the root URL.
The redirect is safe because safeRedirect validates the host.
Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
When a provider returns an error (e.g. user denies consent), the
callback now logs the error with provider name and redirects to
the base URL with error and error_description query parameters
instead of falling through to the code exchange.
Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
Reduce closure size in NewMux by extracting the /connectors/complete
handler into a dedicated handleConnectorComplete function. Cache
r.URL.Query() into a local variable to avoid repeated parsing.
Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
Drop RedirectURI, AuthURL, TokenURL, Scopes, ExtraAuthParams, and
TokenEndpointAuth from all connector config blocks. Remove
REDIRECT_URI from env var validation. Fix error wrapping in SAML
credential helpers.
Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
Compute the OAuth2 redirect URI from the base URL using the
CallbackPath constant and apply provider defaults before
registering each connector.
Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
All other OAuth2 properties (redirect URI, auth URL, token URL,
scopes, extra params, token endpoint auth) now come from the
connector package provider definitions at wiring time.
Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
Remove provider-default mutation from Register; defaults are now
applied via ApplyProviderDefaults before registration. Rename
receiver from cr to r. Fix error messages to follow the cannot
convention. Wrap providerProbeURLs in var () block.
Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
Centralise static OAuth2 properties (auth URL, token URL, scopes,
extra params, token endpoint auth) per provider in a single map.
This removes the need to duplicate these values in deployment
config; only ClientID and ClientSecret remain configurable.
Introduces ApplyProviderDefaults to set redirect URI and provider
defaults onto an OAuth2Connector at wiring time.
Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
The NewTask type helper was not copying OrganizationID from the
coredata Task, causing it to serialize as a zero-value GID.
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
Introduce the ability to link measures to documents, following the
existing pattern used by controls and risks. This includes:
- Database migration for measures_documents join table
- Coredata MeasureDocument struct with insert/delete operations
- Document service methods for listing/counting by measure ID
- Measure service CreateDocumentMapping/DeleteDocumentMapping methods
- Cleanup of measure-document mappings on document archive
- GraphQL mutations, inputs, payloads, and Measure.documents field
- DocumentConnection.TotalCount support for measure resolver
- MCP linkMeasure/unlinkMeasure updated to support documents
- MCP listMeasureDocuments tool
- Frontend MeasureDocumentsTab with LinkedDocumentsCard integration
- Authorization actions for measure document mapping
- E2e tests for measure document mapping
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
Filter out approval decisions where state is APPROVED but
electronic_signature_id is NULL, removing historical approved
entries that lack an electronic signature from the employee
approvals page.
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
Allow publishing a document version even when the content and title
are identical to the current published version.
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
Replace the monolithic agents config with a cleaner structure:
- llm: holds provider credentials and default model settings
- probo-agent: LLM overrides for the probo agent
- evidence-describer: worker config (interval, stale-after,
max-concurrency) alongside LLM overrides
This makes worker tuning configurable via YAML and env vars
instead of being hardcoded in Go, and separates provider
credentials from per-consumer model settings.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
