rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Introduce access-review source snapshot and normalize naming

Browse Source 
Decouple each campaign from the live access-review sources it was started
with by introducing a per-campaign source snapshot table
(access_review_campaign_sources). The snapshot captures the source name,
category, and connector at start time, so a review remains coherent even
after the underlying source is edited or deleted. Fetch tracking becomes
an append-only log (access_review_campaign_source_fetch_attempts) that
preserves every attempt with its own status and error rather than
overwriting a single row.

Rename the shared access-review tables and enums to use a consistent
access_review_ prefix throughout:

  access_entries          → access_review_entries
  access_sources          → access_review_sources
  access_source_category  → access_review_source_category
  access_entry_*          → access_review_entry_*

The same rename propagates to every coredata type, service, GraphQL
schema, MCP specification, CLI command, frontend component, and e2e test.
The accessreview package gains dedicated actions.go and policies.go files
for its own IAM policy set, mirroring the agentrun package pattern.

Signed-off-by: Bryan Frimin <bryan@probo.com>
This commit is contained in:
Bryan Frimin
2026-06-11 15:58:30 +02:00
parent 8a53e0ec1c
commit 4b64e59da4
146 changed files with 4795 additions and 4069 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
pkg/accessreview/drivers/anthropic.go
View File

@@ -75,8 +75,8 @@ func (d *AnthropicDriver) ListAccounts(ctx context.Context) ([]AccountRecord, er
IsAdmin: u.Role == "admin",
ExternalID: u.ID,
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
}
// added_at is an RFC 3339 datetime string; ignore parse

4
pkg/accessreview/drivers/asana.go
View File

@@ -103,8 +103,8 @@ func (d *AsanaDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error)
FullName: u.Name,
ExternalID: u.GID,
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
},
)
}

4
pkg/accessreview/drivers/better_stack.go
View File

@@ -98,8 +98,8 @@ func (d *BetterStackDriver) ListAccounts(ctx context.Context) ([]AccountRecord,
Active: betterStackActive(member.Type),
IsAdmin: betterStackIsAdmin(member.Attributes.Role),
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
ExternalID: member.ID,
}

4
pkg/accessreview/drivers/bitbucket.go
View File

@@ -100,8 +100,8 @@ func (d *BitbucketDriver) ListAccounts(ctx context.Context) ([]AccountRecord, er
FullName: fullName,
ExternalID: m.User.AccountID,
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
}
records = append(records, record)

4
pkg/accessreview/drivers/brex.go
View File

@@ -72,8 +72,8 @@ func (d *BrexDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error)
IsAdmin: false,
ExternalID: u.ID,
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
}
if record.Email != "" {

8
pkg/accessreview/drivers/clerk.go
View File

@@ -94,7 +94,7 @@ func (d *ClerkDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error)
IsAdmin: false,
MFAStatus: clerkMFAStatus(u),
AuthMethod: clerkAuthMethod(u),
AccountType: coredata.AccessEntryAccountTypeUser,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
ExternalID: u.ID,
}
@@ -211,12 +211,12 @@ func clerkMFAStatus(u clerkUser) coredata.MFAStatus {
return coredata.MFAStatusDisabled
}
func clerkAuthMethod(u clerkUser) coredata.AccessEntryAuthMethod {
func clerkAuthMethod(u clerkUser) coredata.AccessReviewEntryAuthMethod {
if u.PasswordEnabled {
return coredata.AccessEntryAuthMethodPassword
return coredata.AccessReviewEntryAuthMethodPassword
}
return coredata.AccessEntryAuthMethodUnknown
return coredata.AccessReviewEntryAuthMethodUnknown
}
func clerkUnixMillisToTime(unixMillis int64) *time.Time {

6
pkg/accessreview/drivers/clerk_test.go
View File

@@ -40,11 +40,11 @@ func TestClerkDriver(t *testing.T) {
assert.Equal(t, "user_3EfkCEWmtIsoMD3rRxIpDsBOPzv", first.ExternalID)
assert.Equal(t, "c@example.com", first.Email)
assert.Equal(t, "c c", first.FullName)
assert.Equal(t, coredata.AccessEntryAccountTypeUser, first.AccountType)
assert.Equal(t, coredata.AccessReviewEntryAccountTypeUser, first.AccountType)
require.NotNil(t, first.Active)
assert.True(t, *first.Active)
assert.Equal(t, coredata.MFAStatusDisabled, first.MFAStatus)
assert.Equal(t, coredata.AccessEntryAuthMethodPassword, first.AuthMethod)
assert.Equal(t, coredata.AccessReviewEntryAuthMethodPassword, first.AuthMethod)
assert.NotNil(t, first.CreatedAt)
assert.Nil(t, first.LastLogin)
@@ -60,7 +60,7 @@ func TestClerkDriver(t *testing.T) {
assert.Equal(t, "a a", third.FullName)
require.NotNil(t, third.Active)
assert.False(t, *third.Active)
assert.Equal(t, coredata.AccessEntryAuthMethodPassword, third.AuthMethod)
assert.Equal(t, coredata.AccessReviewEntryAuthMethodPassword, third.AuthMethod)
}
func TestClerkPrimaryEmail(t *testing.T) {

4
pkg/accessreview/drivers/clickup.go
View File

@@ -111,8 +111,8 @@ func (d *ClickUpDriver) ListAccounts(ctx context.Context) ([]AccountRecord, erro
IsAdmin: isAdmin,
ExternalID: m.User.ID.String(),
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
}
if m.InvitePending != nil {

4
pkg/accessreview/drivers/cloudflare.go
View File

@@ -197,8 +197,8 @@ func (d *CloudflareDriver) queryAllMembers(ctx context.Context, accountID string
IsAdmin: isAdmin,
ExternalID: m.ID,
MFAStatus: mfaStatus,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
}
if record.Email != "" {

6
pkg/accessreview/drivers/csv.go
View File

@@ -70,8 +70,8 @@ func (d *CSVDriver) ListAccounts(_ context.Context) ([]AccountRecord, error) {
record := AccountRecord{
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
}
if idx, ok := colIndex["email"]; ok && idx < len(row) {
@@ -104,7 +104,7 @@ func (d *CSVDriver) ListAccounts(_ context.Context) ([]AccountRecord, error) {
if idx, ok := colIndex["account_type"]; ok && idx < len(row) {
if strings.TrimSpace(strings.ToUpper(row[idx])) == "SERVICE_ACCOUNT" {
record.AccountType = coredata.AccessEntryAccountTypeServiceAccount
record.AccountType = coredata.AccessReviewEntryAccountTypeServiceAccount
}
}

6
pkg/accessreview/drivers/datadog.go
View File

@@ -123,9 +123,9 @@ func (d *DatadogDriver) ListAccounts(ctx context.Context) ([]AccountRecord, erro
}
}
accountType := coredata.AccessEntryAccountTypeUser
accountType := coredata.AccessReviewEntryAccountTypeUser
if u.Attributes.ServiceAccount {
accountType = coredata.AccessEntryAccountTypeServiceAccount
accountType = coredata.AccessReviewEntryAccountTypeServiceAccount
}
mfaStatus := coredata.MFAStatusDisabled
@@ -144,7 +144,7 @@ func (d *DatadogDriver) ListAccounts(ctx context.Context) ([]AccountRecord, erro
// Datadog's /api/v2/users does not expose the login method
// used (no allowed_login_methods in the schema), so the
// auth method is unknown.
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: accountType,
ExternalID: u.ID,
CreatedAt: parseRFC3339Ptr(u.Attributes.CreatedAt),

6
pkg/accessreview/drivers/datadog_test.go
View File

@@ -44,9 +44,9 @@ func TestDatadogDriver(t *testing.T) {
assert.True(t, r.IsAdmin)
assert.Equal(t, "Datadog Admin Role", r.Role)
assert.Equal(t, "Security Engineer", r.JobTitle)
assert.Equal(t, coredata.AccessEntryAccountTypeUser, r.AccountType)
assert.Equal(t, coredata.AccessReviewEntryAccountTypeUser, r.AccountType)
assert.Equal(t, coredata.MFAStatusEnabled, r.MFAStatus)
assert.Equal(t, coredata.AccessEntryAuthMethodUnknown, r.AuthMethod)
assert.Equal(t, coredata.AccessReviewEntryAuthMethodUnknown, r.AuthMethod)
// Second record exercises the inactive, non-admin, and service-account
// (MFA-disabled) branches.
@@ -57,6 +57,6 @@ func TestDatadogDriver(t *testing.T) {
assert.False(t, *r2.Active)
assert.False(t, r2.IsAdmin)
assert.Equal(t, "Datadog Standard Role", r2.Role)
assert.Equal(t, coredata.AccessEntryAccountTypeServiceAccount, r2.AccountType)
assert.Equal(t, coredata.AccessReviewEntryAccountTypeServiceAccount, r2.AccountType)
assert.Equal(t, coredata.MFAStatusDisabled, r2.MFAStatus)
}

4
pkg/accessreview/drivers/docusign.go
View File

@@ -99,8 +99,8 @@ func (d *DocuSignDriver) ListAccounts(ctx context.Context) ([]AccountRecord, err
IsAdmin: strings.EqualFold(u.IsAdmin, "True"),
ExternalID: u.UserID,
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
}
if u.LastLogin != "" {

4
pkg/accessreview/drivers/driver.go
View File

@@ -42,8 +42,8 @@ type AccountRecord struct {
Active *bool
IsAdmin bool
MFAStatus coredata.MFAStatus
AuthMethod coredata.AccessEntryAuthMethod
AccountType coredata.AccessEntryAccountType
AuthMethod coredata.AccessReviewEntryAuthMethod
AccountType coredata.AccessReviewEntryAccountType
LastLogin *time.Time
CreatedAt *time.Time
ExternalID string // system-specific user ID

6
pkg/accessreview/drivers/github.go
View File

@@ -108,9 +108,9 @@ func (d *GitHubDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error
fullName = m.Login
}
accountType := coredata.AccessEntryAccountTypeUser
accountType := coredata.AccessReviewEntryAccountTypeUser
if m.Type == "Bot" {
accountType = coredata.AccessEntryAccountTypeServiceAccount
accountType = coredata.AccessReviewEntryAccountTypeServiceAccount
}
mfaStatus := coredata.MFAStatusUnknown
@@ -130,7 +130,7 @@ func (d *GitHubDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error
Active: new(membership.State == "active"),
IsAdmin: membership.Role == "admin",
MFAStatus: mfaStatus,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: accountType,
ExternalID: strconv.FormatInt(m.ID, 10),
}

4
pkg/accessreview/drivers/gitlab.go
View File

@@ -105,8 +105,8 @@ func (d *GitLabDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error
Active: &active,
IsAdmin: m.AccessLevel >= 50, // 50 = Owner
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
ExternalID: strconv.FormatInt(m.ID, 10),
}

4
pkg/accessreview/drivers/google_workspace.go
View File

@@ -120,8 +120,8 @@ func (d *GoogleWorkspaceDriver) ListAccounts(ctx context.Context) ([]AccountReco
IsAdmin: u.IsAdmin,
ExternalID: u.Id,
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodSSO,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodSSO,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
}
if u.IsEnrolledIn2Sv {

4
pkg/accessreview/drivers/grafana.go
View File

@@ -81,8 +81,8 @@ func (d *GrafanaDriver) ListAccounts(ctx context.Context) ([]AccountRecord, erro
Role: strings.TrimSpace(u.Role),
IsAdmin: strings.EqualFold(strings.TrimSpace(u.Role), "Admin"),
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
ExternalID: strconv.Itoa(u.UserID),
}

8
pkg/accessreview/drivers/heroku.go
View File

@@ -159,8 +159,8 @@ func (d *HerokuDriver) listTeamMembers(ctx context.Context) ([]AccountRecord, er
Role: m.Role,
IsAdmin: isAdmin,
MFAStatus: mfaStatus,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
ExternalID: externalID,
}
@@ -268,8 +268,8 @@ func herokuPersonalRecord(externalID, email, role string, isAdmin bool) AccountR
Role: role,
IsAdmin: isAdmin,
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
ExternalID: externalID,
}
}

4
pkg/accessreview/drivers/hubspot.go
View File

@@ -115,8 +115,8 @@ func (d *HubSpotDriver) ListAccounts(ctx context.Context) ([]AccountRecord, erro
IsAdmin: u.SuperAdmin,
ExternalID: u.ID,
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
}
if record.Email != "" || record.ExternalID != "" {

4
pkg/accessreview/drivers/intercom.go
View File

@@ -71,8 +71,8 @@ func (d *IntercomDriver) ListAccounts(ctx context.Context) ([]AccountRecord, err
IsAdmin: false, // Intercom API does not expose admin role information
ExternalID: a.ID,
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
}
if record.Email != "" || record.FullName != "" {

6
pkg/accessreview/drivers/linear.go
View File

@@ -88,9 +88,9 @@ func (d *LinearDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error
}
for _, u := range resp.Data.Users.Nodes {
accountType := coredata.AccessEntryAccountTypeUser
accountType := coredata.AccessReviewEntryAccountTypeUser
if strings.HasSuffix(u.Email, ".linear.app") {
accountType = coredata.AccessEntryAccountTypeServiceAccount
accountType = coredata.AccessReviewEntryAccountTypeServiceAccount
}
record := AccountRecord{
@@ -101,7 +101,7 @@ func (d *LinearDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error
IsAdmin: u.Admin,
ExternalID: u.ID,
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: accountType,
}

4
pkg/accessreview/drivers/metabase.go
View File

@@ -83,8 +83,8 @@ func (d *MetabaseDriver) ListAccounts(ctx context.Context) ([]AccountRecord, err
IsAdmin: u.IsSuperuser,
ExternalID: strconv.Itoa(u.ID),
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
}
if t, ok := parseMetabaseTimestamp(u.LastLogin); ok {

4
pkg/accessreview/drivers/microsoft_365.go
View File

@@ -178,8 +178,8 @@ func (d *Microsoft365Driver) ListAccounts(ctx context.Context) ([]AccountRecord,
Active: &active,
IsAdmin: isAdmin,
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodSSO,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodSSO,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
ExternalID: u.ID,
}

4
pkg/accessreview/drivers/monday.go
View File

@@ -100,8 +100,8 @@ func (d *MondayDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error
Active: &active,
IsAdmin: u.IsAdmin,
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
ExternalID: u.ID,
}

8
pkg/accessreview/drivers/name_resolver.go
View File

@@ -353,7 +353,7 @@ func (r *qoveryNameResolver) ResolveInstanceName(ctx context.Context) (string, e
}
// renderNameResolver resolves the Render workspace (owner) name from
// GET /v1/owners/{ownerId}, used to title the AccessSource "Render <name>".
// GET /v1/owners/{ownerId}, used to title the AccessReviewSource "Render <name>".
type renderNameResolver struct {
httpClient *http.Client
ownerID string
@@ -651,7 +651,7 @@ func (r *anthropicNameResolver) ResolveInstanceName(ctx context.Context) (string
}
// sendGridNameResolver resolves the SendGrid account's company name from
// the user profile endpoint, used as the AccessSource instance label.
// the user profile endpoint, used as the AccessReviewSource instance label.
type sendGridNameResolver struct {
httpClient *http.Client
}
@@ -1062,7 +1062,7 @@ func (r *pagerdutyNameResolver) ResolveInstanceName(_ context.Context) (string,
// datadogNameResolver returns the Datadog site/region label stored in
// connector settings (e.g. "US3"), captured during the OAuth callback. No
// HTTP call is required; the AccessSource title becomes "Datadog <region>".
// HTTP call is required; the AccessReviewSource title becomes "Datadog <region>".
// Org-name resolution is intentionally omitted to keep scopes to
// user_access_read (the org name endpoint needs org_management).
type datadogNameResolver struct {
@@ -1132,7 +1132,7 @@ func (r *oktaNameResolver) ResolveInstanceName(ctx context.Context) (string, err
// zendeskNameResolver returns the Zendesk subdomain stored in connector
// settings (e.g. "acme" for acme.zendesk.com), captured at connect time. No
// HTTP call is required; the AccessSource title becomes "Zendesk <subdomain>".
// HTTP call is required; the AccessReviewSource title becomes "Zendesk <subdomain>".
// Account-name resolution is intentionally omitted to keep the scope to
// users:read (Zendesk exposes no human account name on that scope).
type zendeskNameResolver struct {

4
pkg/accessreview/drivers/neon.go
View File

@@ -95,8 +95,8 @@ func (d *NeonDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error)
Active: new(m.User.DeactivatedAt == ""),
IsAdmin: neonIsAdmin(m.Member.Role),
MFAStatus: neonMFAStatus(m.User.HasMFA),
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
ExternalID: neonExternalID(m),
CreatedAt: parseRFC3339Ptr(m.Member.JoinedAt),
})

4
pkg/accessreview/drivers/netlify.go
View File

@@ -84,8 +84,8 @@ func (d *NetlifyDriver) ListAccounts(ctx context.Context) ([]AccountRecord, erro
Role: m.Role,
ExternalID: m.ID,
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
}
records = append(records, record)
}

6
pkg/accessreview/drivers/notion.go
View File

@@ -67,9 +67,9 @@ func (d *NotionDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error
}
for _, u := range resp.Results {
accountType := coredata.AccessEntryAccountTypeUser
accountType := coredata.AccessReviewEntryAccountTypeUser
if u.Type == "bot" {
accountType = coredata.AccessEntryAccountTypeServiceAccount
accountType = coredata.AccessReviewEntryAccountTypeServiceAccount
}
var email string
@@ -84,7 +84,7 @@ func (d *NotionDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error
IsAdmin: false,
ExternalID: u.ID,
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: accountType,
}

4
pkg/accessreview/drivers/okta.go
View File

@@ -100,8 +100,8 @@ func (d *OktaDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error)
JobTitle: u.Profile.Title,
Active: oktaActive(u.Status),
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
ExternalID: u.ID,
}

4
pkg/accessreview/drivers/onepassword.go
View File

@@ -97,8 +97,8 @@ func (d *OnePasswordDriver) ListAccounts(ctx context.Context) ([]AccountRecord,
Active: new(u.Active),
ExternalID: u.ID,
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
}
if record.FullName == "" && u.Name.Formatted != "" {

4
pkg/accessreview/drivers/onepassword_users_api.go
View File

@@ -89,8 +89,8 @@ func (d *OnePasswordUsersAPIDriver) ListAccounts(ctx context.Context) ([]Account
Active: new(u.State == "ACTIVE"),
ExternalID: u.ID,
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
}
if u.CreateTime != "" {

4
pkg/accessreview/drivers/openai.go
View File

@@ -72,8 +72,8 @@ func (d *OpenAIDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error
IsAdmin: u.Role == "owner",
ExternalID: u.ID,
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
}
if u.AddedAt != 0 {

4
pkg/accessreview/drivers/pagerduty.go
View File

@@ -83,8 +83,8 @@ func (d *PagerDutyDriver) ListAccounts(ctx context.Context) ([]AccountRecord, er
Role: u.Role,
IsAdmin: isAdmin,
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
ExternalID: u.ID,
}

4
pkg/accessreview/drivers/posthog.go
View File

@@ -296,8 +296,8 @@ func posthogAccountRecord(member posthogMember) AccountRecord {
IsAdmin: posthogIsAdmin(member.Level),
ExternalID: member.User.UUID,
MFAStatus: posthogMFAStatus(member.Is2FAEnabled),
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
}
if record.ExternalID == "" {

4
pkg/accessreview/drivers/probo_memberships.go
View File

@@ -76,8 +76,8 @@ func (d *ProboMembershipsDriver) ListAccounts(ctx context.Context) ([]AccountRec
ExternalID: account.ID.String(),
CreatedAt: &createdAt,
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
},
)
}

4
pkg/accessreview/drivers/qovery.go
View File

@@ -104,8 +104,8 @@ func (d *QoveryDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error
Role: qoveryRole(member.Role),
IsAdmin: qoveryIsAdmin(member.Role),
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
ExternalID: member.ID,
}

4
pkg/accessreview/drivers/render.go
View File

@@ -103,8 +103,8 @@ func (d *RenderDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error
Active: renderActive(member.Status),
IsAdmin: renderIsAdmin(member.Role),
MFAStatus: renderMFAStatus(member.MFAEnabled),
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
ExternalID: member.UserID,
})
}

4
pkg/accessreview/drivers/render_test.go
View File

@@ -54,8 +54,8 @@ func TestRenderDriverListAccounts(t *testing.T) {
assert.Equal(t, "Admin", records[0].Role)
assert.True(t, records[0].IsAdmin)
assert.Equal(t, coredata.MFAStatusEnabled, records[0].MFAStatus)
assert.Equal(t, coredata.AccessEntryAccountTypeUser, records[0].AccountType)
assert.Equal(t, coredata.AccessEntryAuthMethodUnknown, records[0].AuthMethod)
assert.Equal(t, coredata.AccessReviewEntryAccountTypeUser, records[0].AccountType)
assert.Equal(t, coredata.AccessReviewEntryAuthMethodUnknown, records[0].AuthMethod)
assert.Equal(t, "usr-000000000000000000a1", records[0].ExternalID)
require.NotNil(t, records[0].Active)
assert.True(t, *records[0].Active)

4
pkg/accessreview/drivers/resend.go
View File

@@ -61,8 +61,8 @@ func (d *ResendDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error
IsAdmin: false,
ExternalID: k.ID,
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeServiceAccount,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeServiceAccount,
}
if k.CreatedAt != "" {

2
pkg/accessreview/drivers/resend_test.go
View File

@@ -38,5 +38,5 @@ func TestResendDriver(t *testing.T) {
r := records[0]
assert.NotEmpty(t, r.FullName)
assert.NotEmpty(t, r.ExternalID)
assert.Equal(t, coredata.AccessEntryAccountTypeServiceAccount, r.AccountType)
assert.Equal(t, coredata.AccessReviewEntryAccountTypeServiceAccount, r.AccountType)
}

8
pkg/accessreview/drivers/sendgrid.go
View File

@@ -110,7 +110,7 @@ func (d *SendGridDriver) ListAccounts(ctx context.Context) ([]AccountRecord, err
ExternalID: strings.TrimSpace(teammate.Username),
MFAStatus: mfaStatus,
AuthMethod: sendGridAuthMethod(teammate),
AccountType: coredata.AccessEntryAccountTypeUser,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
})
}
@@ -232,12 +232,12 @@ func sendGridRole(userType string, isAdmin bool) string {
// authenticated through SSO (native or partner) is SSO; otherwise they sign in
// with SendGrid's own credentials. Both flags are always present on the
// teammate payload, so this is a definitive signal.
func sendGridAuthMethod(t sendGridTeammate) coredata.AccessEntryAuthMethod {
func sendGridAuthMethod(t sendGridTeammate) coredata.AccessReviewEntryAuthMethod {
if t.IsSSO || t.IsPartnerSSO {
return coredata.AccessEntryAuthMethodSSO
return coredata.AccessReviewEntryAuthMethodSSO
}
return coredata.AccessEntryAuthMethodPassword
return coredata.AccessReviewEntryAuthMethodPassword
}
// sendGridMFAStatus derives a teammate's MFA status from the auto-set 2fa

6
pkg/accessreview/drivers/sendgrid_test.go
View File

@@ -46,9 +46,9 @@ func TestSendGridDriver(t *testing.T) {
assert.Equal(t, "Owner", owner.Role)
assert.True(t, owner.IsAdmin)
assert.Equal(t, "owner@example.com", owner.ExternalID)
assert.Equal(t, coredata.AccessEntryAccountTypeUser, owner.AccountType)
assert.Equal(t, coredata.AccessReviewEntryAccountTypeUser, owner.AccountType)
// is_sso=false on the owner -> authenticates with SendGrid credentials.
assert.Equal(t, coredata.AccessEntryAuthMethodPassword, owner.AuthMethod)
assert.Equal(t, coredata.AccessReviewEntryAuthMethodPassword, owner.AuthMethod)
// The owner is a full-access user whose scope catalog contains BOTH
// 2fa_exempt and 2fa_required, so the MFA signal is ambiguous and the
// driver reports Unknown rather than guessing from scope ordering.
@@ -66,7 +66,7 @@ func TestSendGridDriver(t *testing.T) {
assert.False(t, teammate.IsAdmin)
// Non-unified teammate: username is a handle distinct from the email.
assert.Equal(t, "taylor-teammate", teammate.ExternalID)
assert.Equal(t, coredata.AccessEntryAuthMethodSSO, teammate.AuthMethod)
assert.Equal(t, coredata.AccessReviewEntryAuthMethodSSO, teammate.AuthMethod)
assert.Equal(t, coredata.MFAStatusEnabled, teammate.MFAStatus)
}

10
pkg/accessreview/drivers/sentry.go
View File

@@ -143,7 +143,7 @@ func (d *SentryDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error
ExternalID: m.ID,
MFAStatus: mfaStatus,
AuthMethod: authMethod,
AccountType: coredata.AccessEntryAccountTypeUser,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
}
if m.User != nil && m.User.LastLogin != "" {
@@ -216,14 +216,14 @@ func sentryNextLink(header string) string {
return ""
}
func sentryAuthMethod(flags map[string]bool, user *sentryUser) coredata.AccessEntryAuthMethod {
func sentryAuthMethod(flags map[string]bool, user *sentryUser) coredata.AccessReviewEntryAuthMethod {
if flags["sso:linked"] {
return coredata.AccessEntryAuthMethodSSO
return coredata.AccessReviewEntryAuthMethodSSO
}
if user != nil && user.HasPasswordAuth {
return coredata.AccessEntryAuthMethodPassword
return coredata.AccessReviewEntryAuthMethodPassword
}
return coredata.AccessEntryAuthMethodUnknown
return coredata.AccessReviewEntryAuthMethodUnknown
}

4
pkg/accessreview/drivers/signoz.go
View File

@@ -86,8 +86,8 @@ func (d *SigNozDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error
Active: sigNozActiveStatus(u.Status),
IsAdmin: u.IsRoot || strings.EqualFold(role, "Admin"),
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
ExternalID: strings.TrimSpace(u.ID),
}

6
pkg/accessreview/drivers/slack.go
View File

@@ -91,9 +91,9 @@ func (d *SlackDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error)
continue
}
accountType := coredata.AccessEntryAccountTypeUser
accountType := coredata.AccessReviewEntryAccountTypeUser
if m.IsBot || m.IsAppUser {
accountType = coredata.AccessEntryAccountTypeServiceAccount
accountType = coredata.AccessReviewEntryAccountTypeServiceAccount
}
record := AccountRecord{
@@ -105,7 +105,7 @@ func (d *SlackDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error)
IsAdmin: m.IsAdmin || m.IsOwner || m.IsPrimaryOwner,
ExternalID: m.ID,
MFAStatus: slackMFAStatus(m.Has2FA),
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: accountType,
}

4
pkg/accessreview/drivers/supabase.go
View File

@@ -69,8 +69,8 @@ func (d *SupabaseDriver) ListAccounts(ctx context.Context) ([]AccountRecord, err
IsAdmin: isAdmin,
ExternalID: m.UserID,
MFAStatus: mfaStatus,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
}
records = append(records, record)

4
pkg/accessreview/drivers/tailscale.go
View File

@@ -86,8 +86,8 @@ func (d *TailscaleDriver) ListAccounts(ctx context.Context) ([]AccountRecord, er
// Tailscale has no local credentials; it always delegates
// authentication to an upstream identity provider, so every
// account is SSO regardless of which IdP backs the tailnet.
AuthMethod: coredata.AccessEntryAuthMethodSSO,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodSSO,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
}
if u.Created != "" {

8
pkg/accessreview/drivers/tally.go
View File

@@ -120,8 +120,8 @@ func (d *TallyDriver) listUsers(ctx context.Context) ([]AccountRecord, error) {
Active: new(!u.IsDeleted),
ExternalID: u.ID,
MFAStatus: mfaStatus,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
CreatedAt: new(u.CreatedAt),
}
@@ -176,8 +176,8 @@ func (d *TallyDriver) listInvites(ctx context.Context) ([]AccountRecord, error)
Active: new(false),
ExternalID: inv.ID,
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
Role: "Invited",
}

4
pkg/accessreview/drivers/vercel.go
View File

@@ -100,8 +100,8 @@ func (d *VercelDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error
Active: &confirmed,
IsAdmin: m.Role == "OWNER" || m.Role == "owner",
MFAStatus: coredata.MFAStatusUnknown,
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
ExternalID: m.UID,
}

4
pkg/accessreview/drivers/zendesk.go
View File

@@ -138,8 +138,8 @@ func zendeskRecord(u zendeskUser) AccountRecord {
MFAStatus: mfaStatus,
// Zendesk's users API does not expose the sign-in method
// (password / SSO / social), so the auth method is unknown.
AuthMethod: coredata.AccessEntryAuthMethodUnknown,
AccountType: coredata.AccessEntryAccountTypeUser,
AuthMethod: coredata.AccessReviewEntryAuthMethodUnknown,
AccountType: coredata.AccessReviewEntryAccountTypeUser,
ExternalID: strconv.FormatInt(u.ID, 10),
LastLogin: parseRFC3339Ptr(lastLogin),
CreatedAt: parseRFC3339Ptr(u.CreatedAt),

4
pkg/accessreview/drivers/zendesk_test.go
View File

@@ -45,9 +45,9 @@ func TestZendeskDriver(t *testing.T) {
assert.True(t, *r.Active)
assert.True(t, r.IsAdmin)
assert.Equal(t, "admin", r.Role)
assert.Equal(t, coredata.AccessEntryAccountTypeUser, r.AccountType)
assert.Equal(t, coredata.AccessReviewEntryAccountTypeUser, r.AccountType)
assert.Equal(t, coredata.MFAStatusEnabled, r.MFAStatus)
assert.Equal(t, coredata.AccessEntryAuthMethodUnknown, r.AuthMethod)
assert.Equal(t, coredata.AccessReviewEntryAuthMethodUnknown, r.AuthMethod)
require.NotNil(t, r.LastLogin)
require.NotNil(t, r.CreatedAt)