From 5dd8769d190677285b066407d7201b6670d19782 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Aur=C3=A9lien=20Sibiril?=
 <81782+aureliensibiril@users.noreply.github.com>
Date: Thu, 4 Jun 2026 14:44:44 +0200
Subject: [PATCH] Add OKTA connector provider enum and settings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce the OKTA value to the connector_provider enum (Go const,
ConnectorProviders slice, IsValid switch, GraphQL @goEnum, and the
Postgres ALTER TYPE migration) and an OktaConnectorSettings struct
holding the customer's Okta org domain.

Okta is a per-tenant IdP with no central API gateway, so the
connector is keyed on the org domain rather than a shared host. The
oktaDomain field on CreateAPIKeyConnectorInput lets the API-key flow
carry it.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
---
 pkg/coredata/connector_provider.go                |  5 ++++-
 pkg/coredata/connector_settings.go                | 11 +++++++++++
 pkg/coredata/migrations/20260604T418207Z.sql      | 15 +++++++++++++++
 .../api/console/v1/graphql/connector.graphql      |  2 ++
 4 files changed, 32 insertions(+), 1 deletion(-)
 create mode 100644 pkg/coredata/migrations/20260604T418207Z.sql

diff --git a/pkg/coredata/connector_provider.go b/pkg/coredata/connector_provider.go
index a8741a826..a862150ae 100644
--- a/pkg/coredata/connector_provider.go
+++ b/pkg/coredata/connector_provider.go
@@ -58,6 +58,7 @@ const (
 	ConnectorProviderAnthropic    ConnectorProvider = "ANTHROPIC"
 	ConnectorProviderCursor       ConnectorProvider = "CURSOR"
 	ConnectorProviderDatadog      ConnectorProvider = "DATADOG"
+	ConnectorProviderOkta         ConnectorProvider = "OKTA"
 )
 
 var (
@@ -103,6 +104,7 @@ func ConnectorProviders() []ConnectorProvider {
 		ConnectorProviderAnthropic,
 		ConnectorProviderCursor,
 		ConnectorProviderDatadog,
+		ConnectorProviderOkta,
 	}
 }
 
@@ -143,7 +145,8 @@ func (v ConnectorProvider) IsValid() bool {
 		ConnectorProviderTailscale,
 		ConnectorProviderAnthropic,
 		ConnectorProviderCursor,
-		ConnectorProviderDatadog:
+		ConnectorProviderDatadog,
+		ConnectorProviderOkta:
 		return true
 	}
 
diff --git a/pkg/coredata/connector_settings.go b/pkg/coredata/connector_settings.go
index 6fc56912f..7450ba690 100644
--- a/pkg/coredata/connector_settings.go
+++ b/pkg/coredata/connector_settings.go
@@ -111,6 +111,17 @@ type (
 		Region string `json:"region"`
 		Domain string `json:"domain"`
 	}
+
+	// OktaConnectorSettings holds the customer's Okta org domain (the bare
+	// host, e.g. "acme.okta.com") supplied with the API token. It is the
+	// single-tenant identifier the driver and name resolver use to build
+	// the per-org API host (https://<domain>/api/v1/...). Okta has no
+	// central API gateway — every org authenticates against its own
+	// domain — so the host is operator-supplied and validated (see
+	// connector.NormalizeOktaDomain) before it reaches URL construction.
+	OktaConnectorSettings struct {
+		Domain string `json:"domain"`
+	}
 )
 
 // GrantType returns the OAuth2 grant type recorded on the connector's
diff --git a/pkg/coredata/migrations/20260604T418207Z.sql b/pkg/coredata/migrations/20260604T418207Z.sql
new file mode 100644
index 000000000..a64598ac8
--- /dev/null
+++ b/pkg/coredata/migrations/20260604T418207Z.sql
@@ -0,0 +1,15 @@
+-- Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+--
+-- Permission to use, copy, modify, and/or distribute this software for any
+-- purpose with or without fee is hereby granted, provided that the above
+-- copyright notice and this permission notice appear in all copies.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+-- PERFORMANCE OF THIS SOFTWARE.
+
+ALTER TYPE connector_provider ADD VALUE IF NOT EXISTS 'OKTA';
diff --git a/pkg/server/api/console/v1/graphql/connector.graphql b/pkg/server/api/console/v1/graphql/connector.graphql
index 7135871ed..dd41a6258 100644
--- a/pkg/server/api/console/v1/graphql/connector.graphql
+++ b/pkg/server/api/console/v1/graphql/connector.graphql
@@ -60,6 +60,7 @@ enum ConnectorProvider
         )
     CURSOR @goEnum(value: "go.probo.inc/probo/pkg/coredata.ConnectorProviderCursor")
     DATADOG @goEnum(value: "go.probo.inc/probo/pkg/coredata.ConnectorProviderDatadog")
+    OKTA @goEnum(value: "go.probo.inc/probo/pkg/coredata.ConnectorProviderOkta")
 }
 
 type ConnectorProviderInfo {
@@ -135,6 +136,7 @@ input CreateAPIKeyConnectorInput {
     metabaseInstanceUrl: String
     posthogRegion: String
     posthogInstanceUrl: String
+    oktaDomain: String
 }
 
 type CreateAPIKeyConnectorPayload {