Fix Heroku connection probe Accept header

Heroku's connection-status probe used a static ProbeURL, which the
generic probe issues with `Accept: application/json`. Heroku negotiates
the API version through the Accept media type and returns 400 for an
unversioned request, which doProbeRequest reads as "connected" -- so the
probe never caught a revoked token (it only surfaced at the first
ListAccounts).

Probe via a probeHeroku closure that sends
`Accept: application/vnd.heroku+json; version=3` instead. Verified live:
a dead token returns 400 with application/json but 401 with the
versioned header, which doProbeRequest correctly maps to rejected.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
This commit is contained in:
Aurélien Sibiril
2026-06-15 23:17:52 +02:00
parent 6a285a59b9
commit 0de4216ce6
3 changed files with 81 additions and 5 deletions

View File

@@ -26,11 +26,14 @@ import (
func herokuRegistration() *Registration {
return &Registration{
Provider: coredata.ConnectorProviderHeroku,
DisplayName: "Heroku",
AuthURL: "https://id.heroku.com/oauth/authorize",
TokenURL: "https://id.heroku.com/oauth/token",
ProbeURL: "https://api.heroku.com/account",
Provider: coredata.ConnectorProviderHeroku,
DisplayName: "Heroku",
AuthURL: "https://id.heroku.com/oauth/authorize",
TokenURL: "https://id.heroku.com/oauth/token",
// Heroku requires the versioned Accept header; a plain ProbeURL GET
// (Accept: application/json) returns 400 and would read as connected,
// so probe via a closure that sends application/vnd.heroku+json.
Probe: probeHeroku,
OAuth2Scopes: []string{"read"},
NewDriver: func(_ context.Context, c *http.Client, conn *coredata.Connector, _ *log.Logger) (drivers.Driver, error) {
s, err := coredata.ConnectorSettings[coredata.HerokuConnectorSettings](conn)