Verify Crisp website ownership before connecting

Crisp is a managed (Model B) connector: Probo holds one plugin token
server-side and each connection carries only a Website ID. Nothing
stops one organization from entering another organization's Website
ID, so prove control of the website before creating the connection.

Probo derives a per-(organization, website) verification code as an
HMAC over the token secret and exposes it through a new
crispVerificationCode query. The customer pastes it into the Probo
plugin's per-website settings; at connect time the resolver reads the
setting back through the managed plugin token and requires a
constant-time match before any row is written. The managed key and
plugin ID come from bootstrap, so the connector stays hidden until the
deployment configures them.

The settings fetch is injected so the create-time gate's branch wiring
is unit-tested (mismatch and not-subscribed reject, internal errors
stay generic, a matching code passes), and the managed-versus-client
key resolution is covered too.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/accessreview/drivers/crisp_settings_test.go

@@ -0,0 +1,124 @@
+// Copyright (c) 2026 Probo Inc <hello@probo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package drivers
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetCrispSubscriptionSettings(t *testing.T) {
+	t.Parallel()
+
+	const (
+		websiteID = "e8592878-c0d0-4632-b2f7-7d882f288d43"
+		pluginID  = "e979a1c3-2c41-4e93-a8ed-410ace27318e"
+	)
+
+	t.Run("200 returns the verification code from data.settings", func(t *testing.T) {
+		t.Parallel()
+
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			// The plugin subscription-settings endpoint is plugins (plural)
+			// with both website_id and plugin_id in the path.
+			assert.Equal(t, http.MethodGet, r.Method)
+			assert.Equal(t, "/v1/plugins/subscription/"+websiteID+"/"+pluginID+"/settings", r.URL.Path)
+			assert.Equal(t, "plugin", r.Header.Get("X-Crisp-Tier"))
+
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = w.Write([]byte(`{"error":false,"reason":"resolved","data":{"plugin_id":"` + pluginID + `","settings":{"probo_verification_code":"ABC234DEF567"}}}`))
+		}))
+		defer srv.Close()
+
+		client := &http.Client{Transport: &hostRewriter{target: srv.URL}}
+
+		settings, err := GetCrispSubscriptionSettings(context.Background(), client, websiteID, pluginID)
+		require.NoError(t, err)
+		require.NotNil(t, settings)
+		assert.Equal(t, "ABC234DEF567", settings.ProboVerificationCode)
+	})
+
+	t.Run("200 without the code returns empty (mismatch handled by caller)", func(t *testing.T) {
+		t.Parallel()
+
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = w.Write([]byte(`{"error":false,"data":{"settings":{}}}`))
+		}))
+		defer srv.Close()
+
+		client := &http.Client{Transport: &hostRewriter{target: srv.URL}}
+
+		settings, err := GetCrispSubscriptionSettings(context.Background(), client, websiteID, pluginID)
+		require.NoError(t, err)
+		require.NotNil(t, settings)
+		assert.Empty(t, settings.ProboVerificationCode)
+	})
+
+	t.Run("404 reports the plugin is not subscribed", func(t *testing.T) {
+		t.Parallel()
+
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusNotFound)
+			_, _ = w.Write([]byte(`{"error":true,"reason":"subscription_not_found"}`))
+		}))
+		defer srv.Close()
+
+		client := &http.Client{Transport: &hostRewriter{target: srv.URL}}
+
+		settings, err := GetCrispSubscriptionSettings(context.Background(), client, websiteID, pluginID)
+		require.ErrorIs(t, err, ErrCrispPluginNotSubscribed)
+		assert.Nil(t, settings)
+	})
+
+	t.Run("non-2xx returns an error", func(t *testing.T) {
+		t.Parallel()
+
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusInternalServerError)
+			_, _ = w.Write([]byte(`{"error":true,"reason":"server_error"}`))
+		}))
+		defer srv.Close()
+
+		client := &http.Client{Transport: &hostRewriter{target: srv.URL}}
+
+		settings, err := GetCrispSubscriptionSettings(context.Background(), client, websiteID, pluginID)
+		require.Error(t, err)
+		assert.False(t, errors.Is(err, ErrCrispPluginNotSubscribed))
+		assert.Nil(t, settings)
+	})
+
+	t.Run("2xx with error:true returns an error", func(t *testing.T) {
+		t.Parallel()
+
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = w.Write([]byte(`{"error":true,"reason":"route_forbidden","data":{}}`))
+		}))
+		defer srv.Close()
+
+		client := &http.Client{Transport: &hostRewriter{target: srv.URL}}
+
+		settings, err := GetCrispSubscriptionSettings(context.Background(), client, websiteID, pluginID)
+		require.Error(t, err)
+		assert.Nil(t, settings)
+	})
+}