Add SigNoz access review driver
Add a SigNoz connector so its organization members can be pulled into access-review campaign snapshots. SigNoz authenticates with a SIGNOZ-API-KEY admin service-account key and a customer-supplied base URL (a SigNoz Cloud region/tenant host or a self-hosted instance). The driver lists users via GET /api/v1/user, which returns the role (ADMIN/EDITOR/VIEWER) inline so admin detection works in a single call, and maps the SigNoz user status (active / pending_invite / deleted) to the account active flag. The name resolver reads the organization display name from GET /api/v2/orgs/me to title the access source. Wire the provider through the coredata enum and settings, the connector-provider registry (driver and name-resolver factories), the console API-key input schema and validation, the access-review source label, and the SigNoz brand logo. Co-authored-by: Bryan FRIMIN <bryan@frimin.fr> Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
This commit is contained in:
Aurélien Sibiril
@@ -53,6 +53,7 @@ func NewBuiltinRegistry() *Registry {
|
||||
resendRegistration(),
|
||||
sendgridRegistration(),
|
||||
sentryRegistration(),
|
||||
signozRegistration(),
|
||||
slackRegistration(),
|
||||
supabaseRegistration(),
|
||||
tailscaleRegistration(),
|
||||
|
||||
89
pkg/connector/provider/signoz.go
Normal file
89
pkg/connector/provider/signoz.go
Normal file
@@ -0,0 +1,89 @@
|
||||
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
|
||||
//
|
||||
// Permission to use, copy, modify, and/or distribute this software for any
|
||||
// purpose with or without fee is hereby granted, provided that the above
|
||||
// copyright notice and this permission notice appear in all copies.
|
||||
//
|
||||
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
||||
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
||||
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
// PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
package provider
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"strings"
|
||||
|
||||
"go.gearno.de/kit/log"
|
||||
"go.probo.inc/probo/pkg/accessreview/drivers"
|
||||
"go.probo.inc/probo/pkg/coredata"
|
||||
)
|
||||
|
||||
func signozRegistration() *Registration {
|
||||
return &Registration{
|
||||
Provider: coredata.ConnectorProviderSigNoz,
|
||||
DisplayName: "SigNoz",
|
||||
SupportsAPIKey: true,
|
||||
APIKeyHeader: "SIGNOZ-API-KEY",
|
||||
ExtraSettings: []ExtraSetting{
|
||||
{Key: "baseUrl", Label: "Base URL", Required: true},
|
||||
},
|
||||
NewDriver: func(_ context.Context, c *http.Client, conn *coredata.Connector, _ *log.Logger) (drivers.Driver, error) {
|
||||
settings, err := coredata.ConnectorSettings[coredata.SigNozConnectorSettings](conn)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("cannot read signoz connector settings: %w", err)
|
||||
}
|
||||
|
||||
baseURL, err := normalizeSigNozBaseURL(settings.BaseURL)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("cannot create signoz driver: %w", err)
|
||||
}
|
||||
|
||||
return drivers.NewSigNozDriver(c, baseURL), nil
|
||||
},
|
||||
NewNameResolver: func(ctx context.Context, c *http.Client, conn *coredata.Connector, logger *log.Logger) drivers.NameResolver {
|
||||
settings, err := coredata.ConnectorSettings[coredata.SigNozConnectorSettings](conn)
|
||||
if err != nil {
|
||||
logger.ErrorCtx(ctx, "cannot read signoz connector settings", log.Error(err))
|
||||
return nil
|
||||
}
|
||||
|
||||
baseURL, err := normalizeSigNozBaseURL(settings.BaseURL)
|
||||
if err != nil {
|
||||
logger.ErrorCtx(ctx, "invalid signoz base url in connector settings", log.Error(err))
|
||||
return nil
|
||||
}
|
||||
|
||||
return drivers.NewSigNozNameResolver(c, baseURL)
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func normalizeSigNozBaseURL(raw string) (string, error) {
|
||||
baseURL := strings.TrimSpace(raw)
|
||||
if baseURL == "" {
|
||||
return "", fmt.Errorf("base_url is required")
|
||||
}
|
||||
|
||||
u, err := url.Parse(baseURL)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("base_url must be a valid URL: %w", err)
|
||||
}
|
||||
|
||||
if (u.Scheme != "http" && u.Scheme != "https") || u.Host == "" {
|
||||
return "", fmt.Errorf("base_url must be an http(s) URL")
|
||||
}
|
||||
|
||||
u.Path = strings.TrimRight(u.Path, "/")
|
||||
u.RawQuery = ""
|
||||
u.Fragment = ""
|
||||
|
||||
return u.String(), nil
|
||||
}
|
||||
130
pkg/connector/provider/signoz_test.go
Normal file
130
pkg/connector/provider/signoz_test.go
Normal file
@@ -0,0 +1,130 @@
|
||||
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
|
||||
//
|
||||
// Permission to use, copy, modify, and/or distribute this software for any
|
||||
// purpose with or without fee is hereby granted, provided that the above
|
||||
// copyright notice and this permission notice appear in all copies.
|
||||
//
|
||||
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
||||
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
||||
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
// PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
package provider_test
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
"go.gearno.de/kit/httpclient"
|
||||
"go.probo.inc/probo/pkg/accessreview/drivers"
|
||||
"go.probo.inc/probo/pkg/connector/provider"
|
||||
"go.probo.inc/probo/pkg/coredata"
|
||||
)
|
||||
|
||||
func TestSigNozRegistrationMetadata(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
r := provider.NewBuiltinRegistry()
|
||||
reg, ok := r.Get(coredata.ConnectorProviderSigNoz)
|
||||
require.True(t, ok, "signoz provider must be registered")
|
||||
|
||||
assert.Equal(t, "SigNoz", reg.DisplayName)
|
||||
assert.True(t, reg.SupportsAPIKey)
|
||||
assert.Equal(t, "SIGNOZ-API-KEY", reg.APIKeyHeader)
|
||||
require.Len(t, reg.ExtraSettings, 1)
|
||||
assert.Equal(t, "baseUrl", reg.ExtraSettings[0].Key)
|
||||
assert.Equal(t, "Base URL", reg.ExtraSettings[0].Label)
|
||||
assert.True(t, reg.ExtraSettings[0].Required)
|
||||
require.NotNil(t, reg.NewNameResolver, "signoz NewNameResolver closure must be wired")
|
||||
}
|
||||
|
||||
func TestSigNozNewNameResolver(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
r := provider.NewBuiltinRegistry()
|
||||
reg, ok := r.Get(coredata.ConnectorProviderSigNoz)
|
||||
require.True(t, ok, "signoz provider must be registered")
|
||||
require.NotNil(t, reg.NewNameResolver, "signoz NewNameResolver closure must be wired")
|
||||
|
||||
raw, err := json.Marshal(&coredata.SigNozConnectorSettings{
|
||||
BaseURL: "https://acme.us.signoz.cloud",
|
||||
})
|
||||
require.NoError(t, err)
|
||||
|
||||
conn := &coredata.Connector{
|
||||
Provider: coredata.ConnectorProviderSigNoz,
|
||||
RawSettings: raw,
|
||||
}
|
||||
|
||||
resolver := reg.NewNameResolver(
|
||||
context.Background(),
|
||||
httpclient.DefaultClient(httpclient.WithSSRFProtection()),
|
||||
conn,
|
||||
nil,
|
||||
)
|
||||
require.NotNil(t, resolver)
|
||||
}
|
||||
|
||||
func TestSigNozNewDriver(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
r := provider.NewBuiltinRegistry()
|
||||
reg, ok := r.Get(coredata.ConnectorProviderSigNoz)
|
||||
require.True(t, ok, "signoz provider must be registered")
|
||||
require.NotNil(t, reg.NewDriver, "signoz NewDriver closure must be wired")
|
||||
|
||||
t.Run("creates driver with valid base_url", func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
raw, err := json.Marshal(&coredata.SigNozConnectorSettings{
|
||||
BaseURL: "https://cloud.signoz.io",
|
||||
})
|
||||
require.NoError(t, err)
|
||||
|
||||
conn := &coredata.Connector{
|
||||
Provider: coredata.ConnectorProviderSigNoz,
|
||||
RawSettings: raw,
|
||||
}
|
||||
|
||||
drv, err := reg.NewDriver(context.Background(), httpclient.DefaultClient(httpclient.WithSSRFProtection()), conn, nil)
|
||||
require.NoError(t, err)
|
||||
assert.IsType(t, &drivers.SigNozDriver{}, drv)
|
||||
})
|
||||
|
||||
t.Run("errors when base_url is missing", func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
conn := &coredata.Connector{
|
||||
Provider: coredata.ConnectorProviderSigNoz,
|
||||
RawSettings: []byte(`{}`),
|
||||
}
|
||||
|
||||
_, err := reg.NewDriver(context.Background(), httpclient.DefaultClient(httpclient.WithSSRFProtection()), conn, nil)
|
||||
require.Error(t, err)
|
||||
assert.Contains(t, err.Error(), "base_url is required")
|
||||
})
|
||||
|
||||
t.Run("errors when base_url is invalid", func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
raw, err := json.Marshal(&coredata.SigNozConnectorSettings{
|
||||
BaseURL: "ftp://cloud.signoz.io",
|
||||
})
|
||||
require.NoError(t, err)
|
||||
|
||||
conn := &coredata.Connector{
|
||||
Provider: coredata.ConnectorProviderSigNoz,
|
||||
RawSettings: raw,
|
||||
}
|
||||
|
||||
_, err = reg.NewDriver(context.Background(), httpclient.DefaultClient(httpclient.WithSSRFProtection()), conn, nil)
|
||||
require.Error(t, err)
|
||||
assert.Contains(t, err.Error(), "base_url must be an http(s) URL")
|
||||
})
|
||||
}
|
||||
Reference in New Issue
Block a user