From 244b6390cb57ec3c5ae7ce6510e35bfa14d206e8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Aur=C3=A9lien=20Sibiril?=
 <81782+aureliensibiril@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:52:05 +0200
Subject: [PATCH] Wire accessreview.Service into server and probod
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add AccessReview field to server.Config and api.Config,
pass through to console and MCP NewMux. Create the
service in probod and run its background workers.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
---
 pkg/probod/probod.go  | 20 ++++++++++++++++++++
 pkg/server/api/api.go |  4 ++++
 pkg/server/server.go  |  3 +++
 3 files changed, 27 insertions(+)

diff --git a/pkg/probod/probod.go b/pkg/probod/probod.go
index bedd03c9e..bc6dade9a 100644
--- a/pkg/probod/probod.go
+++ b/pkg/probod/probod.go
@@ -42,6 +42,7 @@ import (
 	"go.gearno.de/kit/pg"
 	"go.gearno.de/kit/unit"
 	"go.opentelemetry.io/otel/trace"
+	"go.probo.inc/probo/pkg/accessreview"
 	"go.probo.inc/probo/pkg/awsconfig"
 	"go.probo.inc/probo/pkg/baseurl"
 	"go.probo.inc/probo/pkg/certmanager"
@@ -481,6 +482,7 @@ func (impl *Implm) Run(
 		slackService,
 		iamService,
 		esignService,
+		defaultConnectorRegistry,
 		time.Duration(impl.cfg.Auth.InvitationConfirmationTokenValidity)*time.Second,
 	)
 	if err != nil {
@@ -503,6 +505,13 @@ func (impl *Implm) Run(
 
 	fileService := file.NewService(pgClient, fileManagerService)
 
+	accessReviewService := accessreview.NewService(
+		pgClient,
+		encryptionKey,
+		defaultConnectorRegistry,
+		l.Named("access-review"),
+	)
+
 	serverHandler, err := server.NewServer(
 		server.Config{
 			AllowedOrigins:    impl.cfg.Api.Cors.AllowedOrigins,
@@ -512,6 +521,7 @@ func (impl *Implm) Run(
 			IAM:               iamService,
 			Trust:             trustService,
 			ESign:             esignService,
+			AccessReview:      accessReviewService,
 			Mailman:           mailmanService,
 			Slack:             slackService,
 			ConnectorRegistry: defaultConnectorRegistry,
@@ -605,6 +615,15 @@ func (impl *Implm) Run(
 		},
 	)
 
+	accessReviewWorkerCtx, stopAccessReviewWorker := context.WithCancel(context.Background())
+	wg.Go(
+		func() {
+			if err := accessReviewService.Run(accessReviewWorkerCtx); err != nil {
+				cancel(fmt.Errorf("access review source fetcher crashed: %w", err))
+			}
+		},
+	)
+
 	iamServiceCtx, stopIAMService := context.WithCancel(context.Background())
 	wg.Go(
 		func() {
@@ -685,6 +704,7 @@ func (impl *Implm) Run(
 	stopMailingListWorker()
 	stopEvidenceDescriptionWorker()
 	stopExportJobExporter()
+	stopAccessReviewWorker()
 	stopIAMService()
 	stopMailer()
 	stopSlackSender()
diff --git a/pkg/server/api/api.go b/pkg/server/api/api.go
index 1461648a8..aa62a8f46 100644
--- a/pkg/server/api/api.go
+++ b/pkg/server/api/api.go
@@ -25,6 +25,7 @@ import (
 	"github.com/go-chi/cors"
 	"go.gearno.de/kit/httpserver"
 	"go.gearno.de/kit/log"
+	"go.probo.inc/probo/pkg/accessreview"
 	"go.probo.inc/probo/pkg/baseurl"
 	"go.probo.inc/probo/pkg/connector"
 	"go.probo.inc/probo/pkg/esign"
@@ -52,6 +53,7 @@ type (
 		IAM               *iam.Service
 		Trust             *trust.Service
 		ESign             *esign.Service
+		AccessReview      *accessreview.Service
 		Slack             *slack.Service
 		Mailman           *mailman.Service
 		Cookie            securecookie.Config
@@ -161,6 +163,7 @@ func NewServer(cfg Config) (*Server, error) {
 			cfg.Probo,
 			cfg.IAM,
 			cfg.ESign,
+			cfg.AccessReview,
 			cfg.Mailman,
 			cfg.Cookie,
 			cfg.TokenSecret,
@@ -176,6 +179,7 @@ func NewServer(cfg Config) (*Server, error) {
 			cfg.Logger.Named("mcp.v1"),
 			cfg.Probo,
 			cfg.IAM,
+			cfg.AccessReview,
 			cfg.TokenSecret,
 		),
 		slackHandler: slack_v1.NewMux(
diff --git a/pkg/server/server.go b/pkg/server/server.go
index befda8e29..23cd8e0eb 100644
--- a/pkg/server/server.go
+++ b/pkg/server/server.go
@@ -24,6 +24,7 @@ import (
 	"go.gearno.de/kit/httpserver"
 	"go.gearno.de/kit/log"
 	"go.gearno.de/x/ref"
+	"go.probo.inc/probo/pkg/accessreview"
 	"go.probo.inc/probo/pkg/baseurl"
 	"go.probo.inc/probo/pkg/connector"
 	"go.probo.inc/probo/pkg/esign"
@@ -50,6 +51,7 @@ type Config struct {
 	IAM               *iam.Service
 	Trust             *trust.Service
 	ESign             *esign.Service
+	AccessReview      *accessreview.Service
 	Slack             *slack.Service
 	Mailman           *mailman.Service
 	Cookie            securecookie.Config
@@ -80,6 +82,7 @@ func NewServer(cfg Config) (*Server, error) {
 		IAM:               cfg.IAM,
 		Trust:             cfg.Trust,
 		ESign:             cfg.ESign,
+		AccessReview:      cfg.AccessReview,
 		Slack:             cfg.Slack,
 		Mailman:           cfg.Mailman,
 		Cookie:            cfg.Cookie,