Leave Segment members' active status unknown

Segment's /users API exposes no active/suspended field, so reporting every
confirmed member as Active=true fabricated a status the source never
provides, contrary to the AccountRecord contract (nil = no explicit signal).
Leave Active nil for confirmed members; pending invites keep Active=false,
which is a real signal from /invites.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/accessreview/drivers/segment.go

@@ -123,13 +123,15 @@ func (d *SegmentDriver) ListAccounts(ctx context.Context) ([]AccountRecord, erro
 		}
 
 		roles, isAdmin := segmentRolesAndAdmin(perms)
-		active := true
 
+		// Segment's user API exposes no active/suspended status field, so
+		// leave Active nil (unknown) rather than fabricate a value, per the
+		// AccountRecord contract.
 		records = append(records, AccountRecord{
 			Email:       email,
 			FullName:    segmentFullName(u.Name, email),
 			Roles:       roles,
-			Active:      &active,
+			Active:      nil,
 			IsAdmin:     isAdmin,
 			MFAStatus:   coredata.MFAStatusUnknown,
 			AuthMethod:  coredata.AccessReviewEntryAuthMethodUnknown,

pkg/accessreview/drivers/segment_test.go

@@ -41,8 +41,9 @@ func TestSegmentDriver(t *testing.T) {
 	assert.Equal(t, "papi@example.com", owner.FullName)
 	assert.True(t, owner.IsAdmin)
 	assert.Equal(t, []string{"Workspace Owner"}, owner.Roles)
-	require.NotNil(t, owner.Active)
-	assert.True(t, *owner.Active)
+	// Segment exposes no active/suspended status, so confirmed members carry
+	// no Active signal (nil), unlike pending invites below.
+	assert.Nil(t, owner.Active)
 
 	// Second user: named; resource-scoped read-only role ⇒ not admin.
 	member := records[1]
@@ -50,8 +51,7 @@ func TestSegmentDriver(t *testing.T) {
 	assert.Equal(t, "Sloth", member.FullName)
 	assert.False(t, member.IsAdmin)
 	assert.Equal(t, []string{"Source Read-only"}, member.Roles)
-	require.NotNil(t, member.Active)
-	assert.True(t, *member.Active)
+	assert.Nil(t, member.Active)
 
 	// Pending invite: inactive, no roles, keyed by email.
 	invite := records[2]