rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add Google Analytics, Dotfile, Segment and Square access-review connectors

Browse Source 
Two OAuth2 and two API-key connectors:

- Google Analytics (GA4): OAuth2 with both analytics.readonly and
  analytics.manage.users.readonly (readonly alone 403s on the accounts
  list); v1alpha accessBindings enumerated at account and property level
  and merged by email; manual account picker (Pattern 1) with a
  per-connection probe and name resolver; distinct from Google Workspace.
- Dotfile: API key in the X-DOTFILE-API-KEY header (Pattern 3); GET
  /v1/users (owner/admin, suspended_at) with a static probe.
- Segment (Twilio): Public API token as Bearer with a required Region
  setting (US or EU) mapped to the regional host; GET /users plus per-user
  GET /users/{id} for roles and /invites for pending members; per-connection
  BuildProbeURL.
- Square: OAuth2 (EMPLOYEES_READ) or a personal access token (Pattern 3);
  POST /v2/team-members/search returns email/status/is_owner directly, so no
  role resolution; custom probe and name resolver.

Google Analytics and Square are confidential OAuth clients, wired into the
bootstrap OAuth provider list and .env.example. Segment carries a required
extra setting, so the console add-source dialog maps region onto its
segmentRegion API-key input; without that mapping the value is silently
dropped and the create is rejected.

Cassette-backed driver tests plus unit tests for the Segment probe URL and
the bootstrap OAuth provider list.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
This commit is contained in:
Aurélien Sibiril
2026-07-11 23:15:03 +02:00
parent 724c169876
commit 60628645ae
31 changed files with 2124 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
pkg/accessreview/drivers/testdata/dotfile.yaml vendored Normal file
View File

@@ -0,0 +1,41 @@
---
# Hand-authored cassette for GET /v1/users (Dotfile, X-DOTFILE-API-KEY header,
# stripped by the recorder). include_suspended=true returns active and suspended
# users in one page; count=3 terminates pagination. Three synthetic users cover
# owner/admin/member and active vs suspended (suspended_at set → inactive). The
# User shape (id, first_name, last_name, email, role, created_at, suspended_at)
# mirrors the documented schema.
version: 2
interactions:
- id: 0
request:
proto: HTTP/1.1
proto_major: 1
proto_minor: 1
content_length: 0
host: api.dotfile.com
form:
include_suspended:
- "true"
limit:
- "100"
page:
- "1"
headers:
Accept:
- application/json
url: https://api.dotfile.com/v1/users?include_suspended=true&limit=100&page=1
method: GET
response:
proto: HTTP/2.0
proto_major: 2
proto_minor: 0
content_length: -1
uncompressed: true
body: '{"data":[{"id":"a1b2c3d4-0000-4000-8000-000000000001","first_name":"Alice","last_name":"Martin","email":"alice.martin@example.com","role":"owner","created_at":"2023-01-31T13:30:00.000Z","suspended_at":null},{"id":"a1b2c3d4-0000-4000-8000-000000000002","first_name":"Bob","last_name":"Durand","email":"bob.durand@example.com","role":"admin","created_at":"2023-02-15T09:00:00.000Z","suspended_at":null},{"id":"a1b2c3d4-0000-4000-8000-000000000003","first_name":"Carla","last_name":"Petit","email":"carla.petit@example.com","role":"member","created_at":"2023-03-01T11:45:00.000Z","suspended_at":"2024-12-11T08:00:00.000Z"}],"pagination":{"page":1,"limit":100,"count":3}}'
headers:
Content-Type:
- application/json
status: 200 OK
code: 200
duration: 100ms

96
pkg/accessreview/drivers/testdata/google_analytics.yaml vendored Normal file
View File

@@ -0,0 +1,96 @@
---
# Hand-authored cassette for the GA4 Admin API v1alpha (Bearer token stripped by
# the recorder). The driver lists account-level accessBindings, then the
# properties beneath the account, then each property's accessBindings, merging a
# user's roles across levels by email. alice appears at both levels (admin +
# viewer) to exercise the merge; carol appears only at the property level. The
# AccessBinding shape (name, user, roles[]) and property list shape mirror the
# live API.
version: 2
interactions:
- id: 0
request:
proto: HTTP/1.1
proto_major: 1
proto_minor: 1
content_length: 0
host: analyticsadmin.googleapis.com
form:
pageSize:
- "200"
headers:
Accept:
- application/json
url: https://analyticsadmin.googleapis.com/v1alpha/accounts/123456/accessBindings?pageSize=200
method: GET
response:
proto: HTTP/2.0
proto_major: 2
proto_minor: 0
content_length: -1
uncompressed: true
body: '{"accessBindings":[{"name":"accounts/123456/accessBindings/abc123","user":"alice@example.com","roles":["predefinedRoles/admin"]},{"name":"accounts/123456/accessBindings/def456","user":"bob@example.com","roles":["predefinedRoles/analyst"]}]}'
headers:
Content-Type:
- application/json
status: 200 OK
code: 200
duration: 100ms
- id: 1
request:
proto: HTTP/1.1
proto_major: 1
proto_minor: 1
content_length: 0
host: analyticsadmin.googleapis.com
form:
filter:
- parent:accounts/123456
pageSize:
- "200"
headers:
Accept:
- application/json
url: https://analyticsadmin.googleapis.com/v1alpha/properties?filter=parent%3Aaccounts%2F123456&pageSize=200
method: GET
response:
proto: HTTP/2.0
proto_major: 2
proto_minor: 0
content_length: -1
uncompressed: true
body: '{"properties":[{"name":"properties/67890","displayName":"Acme Website","parent":"accounts/123456"}]}'
headers:
Content-Type:
- application/json
status: 200 OK
code: 200
duration: 100ms
- id: 2
request:
proto: HTTP/1.1
proto_major: 1
proto_minor: 1
content_length: 0
host: analyticsadmin.googleapis.com
form:
pageSize:
- "200"
headers:
Accept:
- application/json
url: https://analyticsadmin.googleapis.com/v1alpha/properties/67890/accessBindings?pageSize=200
method: GET
response:
proto: HTTP/2.0
proto_major: 2
proto_minor: 0
content_length: -1
uncompressed: true
body: '{"accessBindings":[{"name":"properties/67890/accessBindings/ghi789","user":"alice@example.com","roles":["predefinedRoles/viewer"]},{"name":"properties/67890/accessBindings/jkl012","user":"carol@example.com","roles":["predefinedRoles/analyst"]}]}'
headers:
Content-Type:
- application/json
status: 200 OK
code: 200
duration: 100ms

116
pkg/accessreview/drivers/testdata/segment.yaml vendored Normal file
View File

@@ -0,0 +1,116 @@
---
# Hand-authored cassette for the Segment Public API (US host; Bearer token
# stripped by the recorder). GET /users returns members without roles, so each
# member's roles are fetched via GET /users/{id} (the N+1); GET /invites adds a
# pending invite as an inactive member. Two synthetic users cover the
# Workspace Owner (admin) and a resource-scoped read-only role; the envelope
# (data.users / data.user.permissions / data.invites, data.pagination.next) and
# the UserV1 / PermissionV1 shapes mirror the live API.
version: 2
interactions:
- id: 0
request:
proto: HTTP/1.1
proto_major: 1
proto_minor: 1
content_length: 0
host: api.segmentapis.com
form:
pagination.count:
- "200"
headers:
Accept:
- application/json
url: https://api.segmentapis.com/users?pagination.count=200
method: GET
response:
proto: HTTP/2.0
proto_major: 2
proto_minor: 0
content_length: -1
uncompressed: true
body: '{"data":{"users":[{"id":"sgJDWk3K21k6LE3tLU9nRK","name":"","email":"papi@example.com"},{"id":"i2VTJURQprNfqdwjLFPWYx","name":"Sloth","email":"sloth@example.com"}],"pagination":{"current":"MA=="}}}'
headers:
Content-Type:
- application/json
status: 200 OK
code: 200
duration: 100ms
- id: 1
request:
proto: HTTP/1.1
proto_major: 1
proto_minor: 1
content_length: 0
host: api.segmentapis.com
headers:
Accept:
- application/json
url: https://api.segmentapis.com/users/sgJDWk3K21k6LE3tLU9nRK
method: GET
response:
proto: HTTP/2.0
proto_major: 2
proto_minor: 0
content_length: -1
uncompressed: true
body: '{"data":{"user":{"id":"sgJDWk3K21k6LE3tLU9nRK","name":"","email":"papi@example.com","permissions":[{"roleId":"1WDUuRLxv84rrfCNUwvkrRtkxnS","roleName":"Workspace Owner","resources":[{"id":"9aQ1Lj62S4bomZKLF4DPqW","type":"WORKSPACE","labels":[]}]}]}}}'
headers:
Content-Type:
- application/json
status: 200 OK
code: 200
duration: 100ms
- id: 2
request:
proto: HTTP/1.1
proto_major: 1
proto_minor: 1
content_length: 0
host: api.segmentapis.com
headers:
Accept:
- application/json
url: https://api.segmentapis.com/users/i2VTJURQprNfqdwjLFPWYx
method: GET
response:
proto: HTTP/2.0
proto_major: 2
proto_minor: 0
content_length: -1
uncompressed: true
body: '{"data":{"user":{"id":"i2VTJURQprNfqdwjLFPWYx","name":"Sloth","email":"sloth@example.com","permissions":[{"roleId":"2ABxYz84rrfCNUwvkrRtkxnT","roleName":"Source Read-only","resources":[{"id":"src_1a2b3c","type":"SOURCE","labels":[]}]}]}}}'
headers:
Content-Type:
- application/json
status: 200 OK
code: 200
duration: 100ms
- id: 3
request:
proto: HTTP/1.1
proto_major: 1
proto_minor: 1
content_length: 0
host: api.segmentapis.com
form:
pagination.count:
- "200"
headers:
Accept:
- application/json
url: https://api.segmentapis.com/invites?pagination.count=200
method: GET
response:
proto: HTTP/2.0
proto_major: 2
proto_minor: 0
content_length: -1
uncompressed: true
body: '{"data":{"invites":["foo@example.com"],"pagination":{"current":"MA=="}}}'
headers:
Content-Type:
- application/json
status: 200 OK
code: 200
duration: 100ms

39
pkg/accessreview/drivers/testdata/square.yaml vendored Normal file
View File

@@ -0,0 +1,39 @@
---
# Hand-authored cassette for POST /v2/team-members/search (Square, Bearer token
# stripped by the recorder). No query filter is sent, so the request body is the
# minimal {"limit":200}; an absent response cursor terminates pagination. Three
# synthetic team members cover owner/non-owner and ACTIVE/INACTIVE. The
# team_member shape (id, is_owner, status, given_name, family_name,
# email_address, created_at) mirrors the SearchTeamMembers response.
version: 2
interactions:
- id: 0
request:
proto: HTTP/1.1
proto_major: 1
proto_minor: 1
content_length: 13
host: connect.squareup.com
body: '{"limit":200}'
headers:
Accept:
- application/json
Content-Type:
- application/json
Square-Version:
- "2026-05-20"
url: https://connect.squareup.com/v2/team-members/search
method: POST
response:
proto: HTTP/2.0
proto_major: 2
proto_minor: 0
content_length: -1
uncompressed: true
body: '{"team_members":[{"id":"-3oZQKPKVk6gUXU_V5Qa","is_owner":false,"status":"ACTIVE","given_name":"Sherlock","family_name":"Holmes","email_address":"sherlock.holmes@example.com","created_at":"2020-03-24T18:14:26Z"},{"id":"Pw67AzUomYUdF04AN17i","is_owner":true,"status":"ACTIVE","given_name":"John","family_name":"Watson","email_address":"john.watson@example.com","created_at":"2020-03-24T18:14:26Z"},{"id":"Xk92LmQ0pRsTuvWxYz01","is_owner":false,"status":"INACTIVE","given_name":"Martha","family_name":"Hudson","email_address":"martha.hudson@example.com","created_at":"2021-06-10T09:00:00Z"}]}'
headers:
Content-Type:
- application/json
status: 200 OK
code: 200
duration: 100ms