Register Okta connector and wire API-key settings

Register the Okta provider (SupportsAPIKey, APIKeyAuthScheme SSWS, a
required "domain" extra setting, and the driver/name-resolver
factories) and add it to the builtin registry.

The create-API-key resolver normalizes and validates oktaDomain into
OktaConnectorSettings, returning a static INVALID error that never
echoes operator input, and stamps the SSWS scheme onto the
connection. No picker, OAuth metadata, or probe URL: the token plus
domain identify exactly one org and the host is per-connection.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/server/api/console/v1/connector_resolvers.go

@@ -44,6 +44,7 @@ func (r *mutationResolver) CreateAPIKeyConnector(ctx context.Context, input type
 			APIKey:    input.APIKey,
 			Header:    r.providerRegistry.APIKeyHeader(input.Provider),
 			BasicAuth: r.providerRegistry.APIKeyUsesBasicAuth(input.Provider),
+			Scheme:    r.providerRegistry.APIKeyAuthScheme(input.Provider),
 		},
 	}
 

pkg/server/api/console/v1/connector_settings.go

@@ -20,6 +20,7 @@ import (
 	"net/url"
 
 	"go.probo.inc/probo/pkg/accessreview/drivers"
+	"go.probo.inc/probo/pkg/connector"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/server/api/console/v1/types"
 )
@@ -127,6 +128,21 @@ func apiKeyConnectorSettings(input types.CreateAPIKeyConnectorInput) (json.RawMe
 		default:
 			return nil, fmt.Errorf("cannot create posthog connector: posthogRegion or posthogInstanceUrl is required")
 		}
+	case coredata.ConnectorProviderOkta:
+		if input.OktaDomain == nil || *input.OktaDomain == "" {
+			return nil, fmt.Errorf("cannot create okta connector: oktaDomain is required")
+		}
+
+		// NormalizeOktaDomain strips scheme/path and validates the host; the
+		// stored value is the bare org domain (e.g. "acme.okta.com"). Use a
+		// static error message — this string is surfaced verbatim to the
+		// client and must never echo the operator-supplied input.
+		domain, err := connector.NormalizeOktaDomain(*input.OktaDomain)
+		if err != nil {
+			return nil, fmt.Errorf("cannot create okta connector: oktaDomain must be a valid Okta domain (e.g. acme.okta.com)")
+		}
+
+		return json.Marshal(&coredata.OktaConnectorSettings{Domain: domain})
 	}
 
 	return nil, nil