From 21d6542855bc2e90fbd2ffa1bf689c18492aff12 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Aur=C3=A9lien=20Sibiril?= <81782+aureliensibiril@users.noreply.github.com> Date: Sun, 12 Jul 2026 19:42:04 +0200 Subject: [PATCH] Leave Segment members' active status unknown MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Segment's /users API exposes no active/suspended field, so reporting every confirmed member as Active=true fabricated a status the source never provides, contrary to the AccountRecord contract (nil = no explicit signal). Leave Active nil for confirmed members; pending invites keep Active=false, which is a real signal from /invites. Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com> --- pkg/accessreview/drivers/segment.go | 6 ++++-- pkg/accessreview/drivers/segment_test.go | 8 ++++---- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/pkg/accessreview/drivers/segment.go b/pkg/accessreview/drivers/segment.go index e6ab490fd..0634023c9 100644 --- a/pkg/accessreview/drivers/segment.go +++ b/pkg/accessreview/drivers/segment.go @@ -123,13 +123,15 @@ func (d *SegmentDriver) ListAccounts(ctx context.Context) ([]AccountRecord, erro } roles, isAdmin := segmentRolesAndAdmin(perms) - active := true + // Segment's user API exposes no active/suspended status field, so + // leave Active nil (unknown) rather than fabricate a value, per the + // AccountRecord contract. records = append(records, AccountRecord{ Email: email, FullName: segmentFullName(u.Name, email), Roles: roles, - Active: &active, + Active: nil, IsAdmin: isAdmin, MFAStatus: coredata.MFAStatusUnknown, AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown, diff --git a/pkg/accessreview/drivers/segment_test.go b/pkg/accessreview/drivers/segment_test.go index ad958c8f6..d3f8eb6f1 100644 --- a/pkg/accessreview/drivers/segment_test.go +++ b/pkg/accessreview/drivers/segment_test.go @@ -41,8 +41,9 @@ func TestSegmentDriver(t *testing.T) { assert.Equal(t, "papi@example.com", owner.FullName) assert.True(t, owner.IsAdmin) assert.Equal(t, []string{"Workspace Owner"}, owner.Roles) - require.NotNil(t, owner.Active) - assert.True(t, *owner.Active) + // Segment exposes no active/suspended status, so confirmed members carry + // no Active signal (nil), unlike pending invites below. + assert.Nil(t, owner.Active) // Second user: named; resource-scoped read-only role ⇒ not admin. member := records[1] @@ -50,8 +51,7 @@ func TestSegmentDriver(t *testing.T) { assert.Equal(t, "Sloth", member.FullName) assert.False(t, member.IsAdmin) assert.Equal(t, []string{"Source Read-only"}, member.Roles) - require.NotNil(t, member.Active) - assert.True(t, *member.Active) + assert.Nil(t, member.Active) // Pending invite: inactive, no roles, keyed by email. invite := records[2]