Compliance Portal Refactor

[gearnode]

Summary by cubic

Moves the public trust center to a dedicated compliance portal with OAuth-based auth and a host-root /graphql, replacing magic links and slug routing. Adds a trust center base domain and per-portal domains, extracts certificate management into a worker-driven certificates flow, and switches local ACME to step-ca with a Caddy HTTP-01 proxy; also verifies OAuth2 ID tokens.

App: console +2623 -1885

• Unified sign-in for portal authorize; added OAuth client branding and magic-link fallback pages; preserved authorize continue across methods.
• Split brand into profile, domains (with managed default), visual identity, and custom links; removed the legacy External URLs and domain page; redirected the route to brand.
• Renamed trust-center graphs and permissions to compliance-portal; added #/lib/relay/useMutation; migrated dialogs/lists, connection keys, and visibility helpers.
• Moved frameworks and NDA UI into overview components; updated files and third‑parties to new permission strings.

App: trust +67 -414

• Served from host root and pointed Relay to /graphql; removed path-prefix helpers and the magic-link verify route; simplified connect flow.
• Read profile/title from the trust center; updated continue-URL handling and navigation.

Other +132 -108

• Renamed Trust API to pkg/server/api/complianceportal/v1; updated workflows/configs and pointed frontends to /graphql.
• Introduced a trust center base-domain config and Postgres defaults; moved custom domains onto trust centers with a managed default; extracted SSL state to a certificates table and added a certmanager worker service.
• Replaced Pebble with step-ca; added a Caddy port-80 proxy for HTTP-01; set default HTTPS to :443 and updated .env/compose.
• Verified OAuth2 ID tokens (RS256 signature, issuer, audience, expiry) and threaded JWKS/issuer/client ID through handlers.

^{Written for commit 601182d. Summary will update on new commits.}

[gearnode]

Bad naming.

[gearnode]

style

[gearnode]

bad alias name

[gearnode]

bad alias name

[gearnode]

bad alias name

[codenem]

trust center vs compliance page vs compliance portal

[codenem]

no new hooks graph file

[codenem]

why do we get portal sign in from console?

[cubic-dev-ai]

23 issues found across 299 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="pkg/server/api/mcp/v1/types/organization.go">

<violation number="1" location="pkg/server/api/mcp/v1/types/organization.go:23">
P2: NewOrganization no longer maps Description from the coredata Organization. If the API Organization struct retains a Description field, callers will receive an empty string instead of the actual value. Either restore the mapping or also remove the field from the struct if it's intentionally being dropped.</violation>
</file>

<file name="apps/console/src/pages/iam/auth/MagicLinkAlreadyUsedPage.tsx">

<violation number="1" location="apps/console/src/pages/iam/auth/MagicLinkAlreadyUsedPage.tsx:38">
P2: Users arriving directly from a stale email link may have no SPA history to go back to. `navigate(-1)` would then navigate outside the app entirely. A safer approach: fall back to a known route like `/login` when `window.history.length` is too shallow, or always navigate to the login/home page.</violation>
</file>

<file name="apps/console/src/pages/organizations/compliance-page/brand/_components/CompliancePageCustomLinkDialog.tsx">

<violation number="1" location="apps/console/src/pages/organizations/compliance-page/brand/_components/CompliancePageCustomLinkDialog.tsx:184">
P2: Editing a URL after manually choosing a Name replaces that Name with the detected social-network name. Clear `nameAutoDetected` when the Name field receives a user edit, so auto-fill only owns untouched names.</violation>
</file>

<file name="pkg/server/api/complianceportal/v1/mux.go">

<violation number="1" location="pkg/server/api/complianceportal/v1/mux.go:122">
P3: Unknown portal paths are always dispatched to `webServer`; `handleCustomDomain404` is unreachable because `/*` matches them first. Route unmatched paths through the custom 404 handler (or remove the unused handler) so the intended error response can be produced.</violation>
</file>

<file name="pkg/certmanager/renew_worker.go">

<violation number="1" location="pkg/certmanager/renew_worker.go:94">
P0: Certificates selected for renewal are never renewed: `Process` succeeds without performing work after `Claim` marks them `Renewing`. Implement renewal and persist the resulting certificate/status, or avoid claiming this worker until processing exists.</violation>
</file>

<file name="pkg/coredata/migrations/20260706T132923Z.sql">

<violation number="1" location="pkg/coredata/migrations/20260706T132923Z.sql:26">
P1: Organizations without a trust center lose their configured custom domain during this migration. Preserve or explicitly migrate these rows instead of deleting all domains that have no `trust_centers` reference.</violation>
</file>

<file name="pkg/server/response_headers.go">

<violation number="1" location="pkg/server/response_headers.go:19">
P2: HSTS preload directive is present but `includeSubDomains` is missing. For the `preload` directive to be effective for browser preload-list submission, `includeSubDomains` is required per hstspreload.org requirements. Either add `includeSubDomains` if all subdomains should enforce HTTPS, or remove the `preload` directive if subdomain coverage is not intended.</violation>
</file>

<file name="apps/compliance-portal/src/components/TopBar/TopBar.tsx">

<violation number="1" location="apps/compliance-portal/src/components/TopBar/TopBar.tsx:114">
P2: Access login returns visitors to the route but drops its query/hash state. Preserve the full in-app location in `continue` so links with parameters resume exactly after OAuth.</violation>
</file>

<file name="contrib/lima/provision.sh">

<violation number="1" location="contrib/lima/provision.sh:242">
P2: The `.env` file for the compliance portal dev server is written to `apps/trust/.env` (line 192), but the npm workspace was renamed from `@probo/trust` to `@probo/compliance-portal`. If the source directory was also renamed, this `.env` won't be picked up by the compliance-portal dev server and `VITE_API_URL` will be unset. Update the path to match the new workspace directory.</violation>
</file>

<file name="pkg/crypto/jose/jose.go">

<violation number="1" location="pkg/crypto/jose/jose.go:120">
P3: Oversized JWK exponents are silently narrowed, so this function can return a key that does not represent the source JWK. Validate that `e` is positive and fits `int` before converting; return an error otherwise.</violation>

<violation number="2" location="pkg/crypto/jose/jose.go:126">
P2: A missing JWKS crashes token verification instead of rejecting the token. Return an error before dereferencing `jwks` so a failed or uninitialized OAuth key-set configuration cannot take down the callback request.</violation>
</file>

<file name="apps/console/src/pages/organizations/compliance-page/brand/_components/CompliancePageCustomLinkList.tsx">

<violation number="1" location="apps/console/src/pages/organizations/compliance-page/brand/_components/CompliancePageCustomLinkList.tsx:33">
P2: Organizations with more than 100 custom links cannot view, edit, or reorder links after the first page, because this list silently requests only the default page. Suggest loading all allowed links or add pagination before making the list management surface depend on this connection.</violation>
</file>

<file name="apps/console/src/pages/iam/auth/MagicLinkExpiredPage.tsx">

<violation number="1" location="apps/console/src/pages/iam/auth/MagicLinkExpiredPage.tsx:38">
P2: `navigate(-1)` on this page can leave users stranded. Users arriving from an expired email link in a new tab have no history to go back to — `navigate(-1)` will either do nothing or exit the app entirely. The page says "Please request a new one" but offers no direct way to do so. Consider navigating to the login/sign-in route as a fallback (e.g., `navigate('/login')`) so users can retry authentication, or provide a "Request new link" action instead.</violation>
</file>

<file name="pkg/server/api/complianceportal/sni_middleware.go">

<violation number="1" location="pkg/server/api/complianceportal/sni_middleware.go:88">
P1: GraphQL mutations submitted through a secondary portal domain can be retried as body-less GET requests after this 301, rather than reaching the canonical `/graphql` endpoint. Use a method-preserving permanent redirect (308) for this host canonicalization.</violation>
</file>

<file name="pkg/coredata/migrations/20260710T085314Z.sql">

<violation number="1" location="pkg/coredata/migrations/20260710T085314Z.sql:31">
P1: Organizations without an existing trust center lose their profile data during this migration: they are excluded from the copy, then their source columns are dropped. Preserve those rows by creating/migrating a trust center first, or retain the organization fields until that backfill can occur.</violation>
</file>

<file name="apps/console/src/pages/organizations/compliance-page/domain/_components/NewCompliancePageDomainDialog.tsx">

<violation number="1" location="apps/console/src/pages/organizations/compliance-page/domain/_components/NewCompliancePageDomainDialog.tsx:153">
P3: Domain help renders the same example twice, reducing the usefulness of the examples list. Restore a distinct second example such as `trust.example.com`.</violation>
</file>

<file name="packages/n8n-node/nodes/Probo/actions/trustCenter/update.operation.ts">

<violation number="1" location="packages/n8n-node/nodes/Probo/actions/trustCenter/update.operation.ts:176">
P2: Clearing a previously-set string field (title, description, websiteUrl, email, headquarterAddress) to empty is silently ignored — the old value persists. The truthy guard (`if (fieldName)`) used here matches `searchEngineIndexing`'s pattern, but that field uses empty string as a distinct '(Unchanged)' sentinel. These new free-form content strings have no such semantic: emptying the input is a valid clear intent. Since n8n provides no way to distinguish untouched-from-cleared for a `default: ''` string parameter, the safest fix is to always include these fields in the input so the API receives the current user intent.</violation>
</file>

<file name="pkg/complianceportal/resolver/resolver.go">

<violation number="1" location="pkg/complianceportal/resolver/resolver.go:81">
P1: A trust center with an inactive custom-domain certificate but no loaded default-domain row publishes that unready custom host as its canonical URL. Fall back to the slug-derived default host instead, so links do not direct users to a domain that cannot yet serve HTTPS.</violation>
</file>

<file name="pkg/coredata/migrations/20260709T090905Z.sql">

<violation number="1" location="pkg/coredata/migrations/20260709T090905Z.sql:98">
P2: Cross-tenant certificate associations are currently valid at the database layer, so a mistaken or insufficiently scoped update can attach another tenant's key/certificate to this domain. Preserve the tenant invariant with a composite tenant-aware reference (or equivalent constraint) when adding this relationship.</violation>
</file>

<file name="GNUmakefile">

<violation number="1" location="GNUmakefile:389">
P1: Production builds omit the compliance portal bundle: `EMBEDDED` and `WITH_APPS` still target `apps/trust`, so the new portal can be deleted by `clean` but never built or embedded. Update those build inputs to the compliance-portal workspace alongside this rename.</violation>
</file>

<file name="pkg/coredata/compliance_framework.go">

<violation number="1" location="pkg/coredata/compliance_framework.go:386">
P1: `LoadWithHiddenByTrustCenterID` now assigns `ROW_NUMBER()` as rank for every row, ignoring the persisted `cf.rank` values that `UpdateRank` and `Insert` store. Any custom ordering set via `UpdateRank` will be silently lost when loading frameworks with this method. If any consumer paginates by `COMPLIANCE_FRAMEWORK_ORDER_RANK` or uses the returned rank for display, the behavior regresses. Consider preserving `cf.rank` for existing linked frameworks (`cf.id IS NOT NULL`) and only generating sequential ranks for unlinked ones, similar to the original logic.</violation>
</file>

<file name="apps/console/src/pages/organizations/compliance-page/domain/_components/DeleteCompliancePageDomainDialog.tsx">

<violation number="1" location="apps/console/src/pages/organizations/compliance-page/domain/_components/DeleteCompliancePageDomainDialog.tsx:43">
P3: `compliancePageId` is a required but unused prop, so callers must supply data this dialog never consumes. Remove it from the prop contract unless it is needed for cache updates.</violation>
</file>

<file name="pkg/iam/oauth2/discovery.go">

<violation number="1" location="pkg/iam/oauth2/discovery.go:86">
P2: Authorization endpoints with provider-required query parameters lose them here, causing their OAuth redirects to fail or select the wrong tenant. Merge generated parameters into `u.Query()` instead of replacing the endpoint query.</violation>
</file>

<sub>Note: This PR contains a large number of files. cubic only reviews up to 200 files per PR, so some files may not have been reviewed. cubic prioritizes the most important files to review.

Re-trigger cubic</sub>

[cubic-dev-ai]

P0: Certificates selected for renewal are never renewed: Process succeeds without performing work after Claim marks them Renewing. Implement renewal and persist the resulting certificate/status, or avoid claiming this worker until processing exists.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/certmanager/renew_worker.go, line 94:

<comment>Certificates selected for renewal are never renewed: `Process` succeeds without performing work after `Claim` marks them `Renewing`. Implement renewal and persist the resulting certificate/status, or avoid claiming this worker until processing exists.</comment>

<file context>
@@ -0,0 +1,127 @@
+	return certificate, nil
+}
+
+func (h *renewHandler) Process(_ context.Context, _ coredata.Certificate) error {
+	return nil
+}
</file context>

[cubic-dev-ai]

P1: Organizations without a trust center lose their configured custom domain during this migration. Preserve or explicitly migrate these rows instead of deleting all domains that have no trust_centers reference.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/coredata/migrations/20260706T132923Z.sql, line 26:

<comment>Organizations without a trust center lose their configured custom domain during this migration. Preserve or explicitly migrate these rows instead of deleting all domains that have no `trust_centers` reference.</comment>

<file context>
@@ -0,0 +1,33 @@
+FROM organizations o
+WHERE o.id = tc.organization_id AND o.custom_domain_id IS NOT NULL;
+
+DELETE FROM custom_domains cd
+WHERE NOT EXISTS (
+    SELECT 1 FROM trust_centers tc
</file context>

[cubic-dev-ai]

P1: GraphQL mutations submitted through a secondary portal domain can be retried as body-less GET requests after this 301, rather than reaching the canonical /graphql endpoint. Use a method-preserving permanent redirect (308) for this host canonicalization.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/server/api/complianceportal/sni_middleware.go, line 88:

<comment>GraphQL mutations submitted through a secondary portal domain can be retried as body-less GET requests after this 301, rather than reaching the canonical `/graphql` endpoint. Use a method-preserving permanent redirect (308) for this host canonicalization.</comment>

<file context>
@@ -57,16 +58,50 @@ func NewSNIMiddleware(trustSvc *trust.Service) func(next http.Handler) http.Hand
+						RawQuery: r.URL.RawQuery,
+					}
+
+					http.Redirect(w, r, target.String(), http.StatusMovedPermanently)
+
+					return
</file context>

Suggested change

	http.Redirect(w, r, target.String(), http.StatusMovedPermanently)
	http.Redirect(w, r, target.String(), http.StatusPermanentRedirect)

[cubic-dev-ai]

P1: Organizations without an existing trust center lose their profile data during this migration: they are excluded from the copy, then their source columns are dropped. Preserve those rows by creating/migrating a trust center first, or retain the organization fields until that backfill can occur.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/coredata/migrations/20260710T085314Z.sql, line 31:

<comment>Organizations without an existing trust center lose their profile data during this migration: they are excluded from the copy, then their source columns are dropped. Preserve those rows by creating/migrating a trust center first, or retain the organization fields until that backfill can occur.</comment>

<file context>
@@ -0,0 +1,34 @@
+WHERE tc.organization_id = o.id;
+
+ALTER TABLE organizations
+    DROP COLUMN description,
+    DROP COLUMN website_url,
+    DROP COLUMN email,
</file context>

[cubic-dev-ai]

P1: A trust center with an inactive custom-domain certificate but no loaded default-domain row publishes that unready custom host as its canonical URL. Fall back to the slug-derived default host instead, so links do not direct users to a domain that cannot yet serve HTTPS.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/complianceportal/resolver/resolver.go, line 81:

<comment>A trust center with an inactive custom-domain certificate but no loaded default-domain row publishes that unready custom host as its canonical URL. Fall back to the slug-derived default host instead, so links do not direct users to a domain that cannot yet serve HTTPS.</comment>

<file context>
@@ -0,0 +1,146 @@
+		host = byID[*trustCenter.CustomDomainID].Domain
+	case trustCenter.DefaultDomainID != nil && byID[*trustCenter.DefaultDomainID] != nil:
+		host = byID[*trustCenter.DefaultDomainID].Domain
+	case trustCenter.CustomDomainID != nil && byID[*trustCenter.CustomDomainID] != nil:
+		host = byID[*trustCenter.CustomDomainID].Domain
+	}
</file context>

[cubic-dev-ai]

P3: Unknown portal paths are always dispatched to webServer; handleCustomDomain404 is unreachable because /* matches them first. Route unmatched paths through the custom 404 handler (or remove the unused handler) so the intended error response can be produced.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/server/api/complianceportal/v1/mux.go, line 122:

<comment>Unknown portal paths are always dispatched to `webServer`; `handleCustomDomain404` is unreachable because `/*` matches them first. Route unmatched paths through the custom 404 handler (or remove the unused handler) so the intended error response can be produced.</comment>

<file context>
@@ -0,0 +1,163 @@
+				},
+			)
+
+			r.Handle("/*", webServer)
+			r.NotFound(handleCustomDomain404)
+		},
</file context>

[cubic-dev-ai]

P3: Oversized JWK exponents are silently narrowed, so this function can return a key that does not represent the source JWK. Validate that e is positive and fits int before converting; return an error otherwise.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/crypto/jose/jose.go, line 120:

<comment>Oversized JWK exponents are silently narrowed, so this function can return a key that does not represent the source JWK. Validate that `e` is positive and fits `int` before converting; return an error otherwise.</comment>

<file context>
@@ -97,3 +98,106 @@ func SignJWT(privateKey *rsa.PrivateKey, kid string, claims any) (string, error)
+
+	return &rsa.PublicKey{
+		N: new(big.Int).SetBytes(nBytes),
+		E: int(new(big.Int).SetBytes(eBytes).Int64()),
+	}, nil
+}
</file context>

[cubic-dev-ai]

P3: compliancePageId is a required but unused prop, so callers must supply data this dialog never consumes. Remove it from the prop contract unless it is needed for cache updates.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/console/src/pages/organizations/compliance-page/domain/_components/DeleteCompliancePageDomainDialog.tsx, line 43:

<comment>`compliancePageId` is a required but unused prop, so callers must supply data this dialog never consumes. Remove it from the prop contract unless it is needed for cache updates.</comment>

<file context>
@@ -40,39 +39,36 @@ const deleteCustomDomainMutation = graphql`
 type DeleteCompliancePageDomainDialogProps = PropsWithChildren<{
   domain: string;
+  customDomainId: string;
+  compliancePageId: string;
 }>;
 
</file context>

[cubic-dev-ai]

P3: Domain help renders the same example twice, reducing the usefulness of the examples list. Restore a distinct second example such as trust.example.com.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/console/src/pages/organizations/compliance-page/domain/_components/NewCompliancePageDomainDialog.tsx, line 153:

<comment>Domain help renders the same example twice, reducing the usefulness of the examples list. Restore a distinct second example such as `trust.example.com`.</comment>

<file context>
@@ -154,7 +150,7 @@ export function NewCompliancePageDomainDialog(props: PropsWithChildren) {
               {" "}
               compliance.example.com,
-              trust.example.com
+              compliance.example.com
             </p>
           </div>
</file context>

Suggested change

	compliance.example.com
	trust.example.com

[codenem]

is this used?

[codenem]

maybe we clean the route and update the links instead

[codenem]

why not use pg function that generates gid?

[codenem]

use pg functions that we have already to manipulate gids

[codenem]

not sure we want this for self managed instances

[codenem]

Be minded that this used to be org name, which was used in headings like "{{name}}'s trust center", but now could be a full title

[codenem]

naming looks weird both Field and value