Verify Crisp website ownership before connecting

Crisp is a managed (Model B) connector: Probo holds one plugin token
server-side and each connection carries only a Website ID. Nothing
stops one organization from entering another organization's Website
ID, so prove control of the website before creating the connection.

Probo derives a per-(organization, website) verification code as an
HMAC over the token secret and exposes it through a new
crispVerificationCode query. The customer pastes it into the Probo
plugin's per-website settings; at connect time the resolver reads the
setting back through the managed plugin token and requires a
constant-time match before any row is written. The managed key and
plugin ID come from bootstrap, so the connector stays hidden until the
deployment configures them.

The settings fetch is injected so the create-time gate's branch wiring
is unit-tested (mismatch and not-subscribed reject, internal errors
stay generic, a matching code passes), and the managed-versus-client
key resolution is covered too.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/accessreview/drivers/crisp.go

@@ -17,6 +17,7 @@ package drivers
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/http"
 	"net/url"
@@ -25,6 +26,32 @@ import (
 	"go.probo.inc/probo/pkg/coredata"
 )
 
+// ErrCrispPluginNotSubscribed is returned by GetCrispSubscriptionSettings when
+// Crisp answers 404: the plugin is not subscribed to the given website, so no
+// per-website settings exist yet. It is an expected verification state (the
+// customer has not installed/configured the plugin on that website) rather than
+// a failure, and callers distinguish it with errors.Is.
+var ErrCrispPluginNotSubscribed = errors.New("crisp plugin not subscribed to website")
+
+// CrispSubscriptionSettings is the schema-defined, per-website configuration of
+// the Probo Crisp plugin. Only the field Probo relies on for ownership
+// verification is modeled; unknown schema properties are ignored on decode.
+type CrispSubscriptionSettings struct {
+	ProboVerificationCode string `json:"probo_verification_code"`
+}
+
+// crispSubscriptionSettingsResponse is the envelope of
+// GET /v1/plugins/subscription/{website_id}/{plugin_id}/settings. The active
+// per-website configuration lives at data.settings; data itself also carries
+// subscription metadata (ids, secret token, JSONSchema, form/callback URLs)
+// that verification does not need.
+type crispSubscriptionSettingsResponse struct {
+	Error bool `json:"error"`
+	Data  struct {
+		Settings CrispSubscriptionSettings `json:"settings"`
+	} `json:"data"`
+}
+
 const (
 	crispAPIBaseURL = "https://api.crisp.chat/v1"
 	// crispTierHeader selects the token tier on every Crisp request. A Probo
@@ -124,6 +151,65 @@ func (d *CrispDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error)
 	return records, nil
 }
 
+// GetCrispSubscriptionSettings reads the Probo plugin's per-website
+// subscription settings so the create-connector resolver can verify website
+// ownership (matching probo_verification_code). The httpClient must already
+// attach the plugin Basic credential (identifier:key); this helper only sets
+// the Accept and X-Crisp-Tier headers, mirroring ListAccounts. A 404 (plugin
+// not subscribed to the website) is reported as ErrCrispPluginNotSubscribed so
+// callers can message it distinctly from a hard failure.
+func GetCrispSubscriptionSettings(
+	ctx context.Context,
+	httpClient *http.Client,
+	websiteID string,
+	pluginID string,
+) (*CrispSubscriptionSettings, error) {
+	endpoint, err := url.JoinPath(
+		crispAPIBaseURL,
+		"plugins", "subscription",
+		url.PathEscape(websiteID),
+		url.PathEscape(pluginID),
+		"settings",
+	)
+	if err != nil {
+		return nil, fmt.Errorf("cannot build crisp subscription settings URL: %w", err)
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	if err != nil {
+		return nil, fmt.Errorf("cannot create crisp subscription settings request: %w", err)
+	}
+
+	req.Header.Set("Accept", "application/json")
+	req.Header.Set(crispTierHeader, crispTierValue)
+
+	httpResp, err := httpClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("cannot execute crisp subscription settings request: %w", err)
+	}
+
+	defer func() { _ = httpResp.Body.Close() }()
+
+	if httpResp.StatusCode == http.StatusNotFound {
+		return nil, ErrCrispPluginNotSubscribed
+	}
+
+	if httpResp.StatusCode < 200 || httpResp.StatusCode >= 300 {
+		return nil, fmt.Errorf("cannot fetch crisp subscription settings: unexpected status %d", httpResp.StatusCode)
+	}
+
+	var resp crispSubscriptionSettingsResponse
+	if err := json.NewDecoder(httpResp.Body).Decode(&resp); err != nil {
+		return nil, fmt.Errorf("cannot decode crisp subscription settings response: %w", err)
+	}
+
+	if resp.Error {
+		return nil, fmt.Errorf("cannot fetch crisp subscription settings: crisp reported an error")
+	}
+
+	return &resp.Data.Settings, nil
+}
+
 func crispFullName(details crispOperatorDetails, fallback string) string {
 	if name := strings.TrimSpace(details.FirstName + " " + details.LastName); name != "" {
 		return name