rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Verify Crisp website ownership before connecting

Browse Source 
Crisp is a managed (Model B) connector: Probo holds one plugin token
server-side and each connection carries only a Website ID. Nothing
stops one organization from entering another organization's Website
ID, so prove control of the website before creating the connection.

Probo derives a per-(organization, website) verification code as an
HMAC over the token secret and exposes it through a new
crispVerificationCode query. The customer pastes it into the Probo
plugin's per-website settings; at connect time the resolver reads the
setting back through the managed plugin token and requires a
constant-time match before any row is written. The managed key and
plugin ID come from bootstrap, so the connector stays hidden until the
deployment configures them.

The settings fetch is injected so the create-time gate's branch wiring
is unit-tested (mismatch and not-subscribed reject, internal errors
stay generic, a matching code passes), and the managed-versus-client
key resolution is covered too.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
This commit is contained in:
Aurélien Sibiril
2026-07-11 16:50:32 +02:00
parent 6435a52f47
commit 37121e7bac
24 changed files with 1294 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
pkg/server/api/console/v1/base_resolvers.go
View File

@@ -574,10 +574,16 @@ func (r *queryResolver) AccessReviewDrivers(ctx context.Context) ([]*types.Conne
apiKeySupported := reg.SupportsAPIKey
clientCredentialsSupported := reg.SupportsClientCredentials
// ManagedAPIKey (Model B, e.g. Crisp) providers are connectable only
// once the operator configures the Probo-held key; until then they
// stay hidden, so such a provider ships deactivated.
_, hasManaged := r.providerRegistry.ManagedAPIKey(provider)
apiKeyManaged := reg.ManagedAPIKey && hasManaged
// Skip providers that cannot be connected in this deployment: no
// OAuth client credentials configured and no key-based fallback
// (API key or client credentials) supported.
if !oauthConfigured && !apiKeySupported && !clientCredentialsSupported {
// (API key, managed API key, or client credentials) supported.
if !oauthConfigured && !apiKeySupported && !clientCredentialsSupported && !apiKeyManaged {
continue
}
@@ -603,6 +609,7 @@ func (r *queryResolver) AccessReviewDrivers(ctx context.Context) ([]*types.Conne
DisplayName: reg.DisplayName,
OauthConfigured: oauthConfigured,
APIKeySupported: apiKeySupported,
APIKeyManaged: apiKeyManaged,
ClientCredentialsSupported: clientCredentialsSupported,
Oauth2Scopes: scopes,
ExtraSettings: extraSettings,
@@ -619,6 +626,25 @@ func (r *queryResolver) AccessReviewDrivers(ctx context.Context) ([]*types.Conne
return infos, nil
}
// CrispVerificationCode is the resolver for the crispVerificationCode field. It
// returns the deterministic ownership-verification code the customer must paste
// into the Probo plugin's per-website settings in their Crisp dashboard before
// connecting that website. Authorized against the organization with the same
// action as the create mutation because the code is organization-bound. This is
// a UI-only helper; MCP/CLI/n8n are intentionally not extended.
func (r *queryResolver) CrispVerificationCode(ctx context.Context, organizationID gid.GID, websiteID string) (string, error) {
if _, err := r.authorize(ctx, organizationID, probo.ActionConnectorCreate); err != nil {
return "", err
}
websiteID = strings.TrimSpace(websiteID)
if websiteID == "" {
return "", gqlutils.Invalidf(ctx, "websiteId is required")
}
return computeCrispVerificationCode(r.tokenSecret, organizationID.String(), websiteID), nil
}
// Mutation returns schema.MutationResolver implementation.
func (r *Resolver) Mutation() schema.MutationResolver { return &mutationResolver{r} }