Add Google Analytics, Dotfile, Segment and Square access-review connectors

Two OAuth2 and two API-key connectors:

- Google Analytics (GA4): OAuth2 with both analytics.readonly and
  analytics.manage.users.readonly (readonly alone 403s on the accounts
  list); v1alpha accessBindings enumerated at account and property level
  and merged by email; manual account picker (Pattern 1) with a
  per-connection probe and name resolver; distinct from Google Workspace.
- Dotfile: API key in the X-DOTFILE-API-KEY header (Pattern 3); GET
  /v1/users (owner/admin, suspended_at) with a static probe.
- Segment (Twilio): Public API token as Bearer with a required Region
  setting (US or EU) mapped to the regional host; GET /users plus per-user
  GET /users/{id} for roles and /invites for pending members; per-connection
  BuildProbeURL.
- Square: OAuth2 (EMPLOYEES_READ) or a personal access token (Pattern 3);
  POST /v2/team-members/search returns email/status/is_owner directly, so no
  role resolution; custom probe and name resolver.

Google Analytics and Square are confidential OAuth clients, wired into the
bootstrap OAuth provider list and .env.example. Segment carries a required
extra setting, so the console add-source dialog maps region onto its
segmentRegion API-key input; without that mapping the value is silently
dropped and the create is rejected.

Cassette-backed driver tests plus unit tests for the Segment probe URL and
the bootstrap OAuth provider list.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/connector/provider/builtin.go

@@ -43,9 +43,11 @@ func NewBuiltinRegistry() *Registry {
 		datadogRegistration(),
 		deepgramRegistration(),
 		docusignRegistration(),
+		dotfileRegistration(),
 		grafanaRegistration(),
 		githubRegistration(),
 		gitlabRegistration(),
+		googleAnalyticsRegistration(),
 		googleWorkspaceRegistration(),
 		herokuRegistration(),
 		hubspotRegistration(),
@@ -72,10 +74,12 @@ func NewBuiltinRegistry() *Registry {
 		renderRegistration(),
 		resendRegistration(),
 		scalewayRegistration(),
+		segmentRegistration(),
 		sendgridRegistration(),
 		sentryRegistration(),
 		signozRegistration(),
 		slackRegistration(),
+		squareRegistration(),
 		supabaseRegistration(),
 		tailscaleRegistration(),
 		tallyRegistration(),

pkg/connector/provider/dotfile.go

@@ -0,0 +1,48 @@
+// Copyright (c) 2026 Probo Inc <hello@probo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package provider
+
+import (
+	"context"
+	"net/http"
+
+	"go.gearno.de/kit/log"
+
+	"go.probo.inc/probo/pkg/accessreview/drivers"
+	"go.probo.inc/probo/pkg/coredata"
+)
+
+func dotfileRegistration() *Registration {
+	return &Registration{
+		Provider:       coredata.ConnectorProviderDotfile,
+		DisplayName:    "Dotfile",
+		SupportsAPIKey: true,
+		// Dotfile authenticates with the API key in the X-DOTFILE-API-KEY
+		// header rather than Authorization: Bearer. APIKeyHeader makes the
+		// APIKeyConnection send that header and omit Authorization. The key is
+		// bound to one workspace, so there is nothing to pick (Pattern 3): no
+		// settings struct, no picker.
+		APIKeyHeader: "X-DOTFILE-API-KEY",
+		// ProbeURL lets the connection-status check confirm the key with a
+		// lightweight GET; the transport attaches X-DOTFILE-API-KEY and a dead
+		// key returns 401.
+		ProbeURL: "https://api.dotfile.com/v1/users?limit=1",
+		// No NewNameResolver: the users endpoint carries no workspace name, so
+		// the source keeps its generic name.
+		NewDriver: func(_ context.Context, c *http.Client, _ *coredata.Connector, _ *log.Logger) (drivers.Driver, error) {
+			return drivers.NewDotfileDriver(c), nil
+		},
+	}
+}

pkg/connector/provider/google_analytics.go

@@ -0,0 +1,74 @@
+// Copyright (c) 2026 Probo Inc <hello@probo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package provider
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+
+	"go.gearno.de/kit/log"
+
+	"go.probo.inc/probo/pkg/accessreview/drivers"
+	"go.probo.inc/probo/pkg/coredata"
+)
+
+func googleAnalyticsRegistration() *Registration {
+	return &Registration{
+		Provider:    coredata.ConnectorProviderGoogleAnalytics,
+		DisplayName: "Google Analytics",
+		AuthURL:     "https://accounts.google.com/o/oauth2/v2/auth",
+		TokenURL:    "https://oauth2.googleapis.com/token",
+		ExtraAuthParams: map[string]string{
+			"access_type": "offline",
+			"prompt":      "consent",
+		},
+		SupportsIncrementalAuth: true,
+		// analytics.readonly is required to LIST accounts and properties (the
+		// picker and the probe); analytics.manage.users.readonly is required to
+		// read the access bindings. The manage.users scope alone cannot list
+		// accounts (it returns 403), so both are requested.
+		OAuth2Scopes: []string{
+			"https://www.googleapis.com/auth/analytics.readonly",
+			"https://www.googleapis.com/auth/analytics.manage.users.readonly",
+		},
+		ProbeURL: "https://analyticsadmin.googleapis.com/v1alpha/accounts?pageSize=1",
+		NewDriver: func(_ context.Context, c *http.Client, conn *coredata.Connector, _ *log.Logger) (drivers.Driver, error) {
+			s, err := coredata.ConnectorSettings[coredata.GoogleAnalyticsConnectorSettings](conn)
+			if err != nil {
+				return nil, fmt.Errorf("cannot read google analytics connector settings: %w", err)
+			}
+
+			if s.AccountID == "" {
+				return nil, fmt.Errorf("cannot create google analytics driver: account_id is required")
+			}
+
+			return drivers.NewGoogleAnalyticsDriver(c, s.AccountID), nil
+		},
+		NewNameResolver: func(ctx context.Context, c *http.Client, conn *coredata.Connector, logger *log.Logger) drivers.NameResolver {
+			s, err := coredata.ConnectorSettings[coredata.GoogleAnalyticsConnectorSettings](conn)
+			if err != nil {
+				logger.ErrorCtx(ctx, "cannot read google analytics connector settings", log.Error(err))
+
+				return nil
+			}
+
+			return drivers.NewGoogleAnalyticsNameResolver(c, s.AccountID)
+		},
+		SetOrganizationSettings: func(c *coredata.Connector, accountID string) error {
+			return c.SetSettings(&coredata.GoogleAnalyticsConnectorSettings{AccountID: accountID})
+		},
+	}
+}

pkg/connector/provider/probe.go

@@ -48,6 +48,8 @@ const (
 	crispAPIBaseURL           = "https://api.crisp.chat/v1"
 	crispTierHeader           = "X-Crisp-Tier"
 	crispTierValue            = "plugin"
+	squareVersion             = "2026-05-20"
+	squareMerchantProbeURL    = "https://connect.squareup.com/v2/merchants/me"
 )
 
 // ProbeConnection verifies that the connector credential is accepted by the
@@ -615,3 +617,47 @@ func probePostHog(
 
 	return nil
 }
+
+// buildSegmentProbeURL builds the Segment users probe URL from the connector's
+// stored base URL (the region-resolved host). GET /users returns 401 on a dead
+// or under-scoped Public API token.
+func buildSegmentProbeURL(conn *coredata.Connector) (string, error) {
+	s, err := coredata.ConnectorSettings[coredata.SegmentConnectorSettings](conn)
+	if err != nil {
+		return "", fmt.Errorf("cannot read segment connector settings: %w", err)
+	}
+
+	if s.BaseURL == "" {
+		return "", fmt.Errorf("missing segment base URL")
+	}
+
+	u, err := url.Parse(s.BaseURL)
+	if err != nil {
+		return "", fmt.Errorf("cannot parse segment base URL: %w", err)
+	}
+
+	u.Path = "/users"
+	u.RawQuery = "pagination.count=1"
+
+	return u.String(), nil
+}
+
+// probeSquare checks a Square credential (OAuth Bearer token or Personal Access
+// Token) with a GET /v2/merchants/me, sending the required Square-Version
+// header. The endpoint returns 401 on a dead token and works for both OAuth and
+// PAT connections, which are always scoped to a single merchant.
+func probeSquare(
+	ctx context.Context,
+	httpClient *http.Client,
+	_ *coredata.Connector,
+) error {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, squareMerchantProbeURL, nil)
+	if err != nil {
+		return fmt.Errorf("cannot create probe request: %w", err)
+	}
+
+	req.Header.Set("Accept", "application/json")
+	req.Header.Set("Square-Version", squareVersion)
+
+	return doProbeRequest(httpClient, req)
+}

pkg/connector/provider/probe_test.go

@@ -223,6 +223,19 @@ func TestBuildScalewayProbeURL(t *testing.T) {
 	)
 }
 
+func TestBuildSegmentProbeURL(t *testing.T) {
+	t.Parallel()
+
+	conn := &coredata.Connector{Provider: coredata.ConnectorProviderSegment}
+	require.NoError(t, conn.SetSettings(&coredata.SegmentConnectorSettings{
+		BaseURL: "https://eu1.api.segmentapis.com",
+	}))
+
+	probeURL, err := buildSegmentProbeURL(conn)
+	require.NoError(t, err)
+	assert.Equal(t, "https://eu1.api.segmentapis.com/users?pagination.count=1", probeURL)
+}
+
 func TestProbeOpenRouter(t *testing.T) {
 	t.Parallel()
 

pkg/connector/provider/segment.go

@@ -0,0 +1,58 @@
+// Copyright (c) 2026 Probo Inc <hello@probo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package provider
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+
+	"go.gearno.de/kit/log"
+
+	"go.probo.inc/probo/pkg/accessreview/drivers"
+	"go.probo.inc/probo/pkg/coredata"
+)
+
+func segmentRegistration() *Registration {
+	return &Registration{
+		Provider:       coredata.ConnectorProviderSegment,
+		DisplayName:    "Segment",
+		SupportsAPIKey: true,
+		// Segment authenticates with a Public API token as the default
+		// Authorization: Bearer scheme, so no APIKeyHeader. The token is bound
+		// to one workspace, but the workspace's region selects the API host
+		// (US vs EU) and is not discoverable from the token, so it is captured
+		// as an extra setting and resolved to a base URL (Pattern 3 + region);
+		// there is nothing to pick.
+		ExtraSettings: []ExtraSetting{
+			{Key: "region", Label: "Region (US or EU)", Required: true},
+		},
+		BuildProbeURL: buildSegmentProbeURL,
+		// No NewNameResolver: the Public API exposes no read-only workspace-name
+		// endpoint on the token's scope, so the source keeps its generic name.
+		NewDriver: func(_ context.Context, c *http.Client, conn *coredata.Connector, _ *log.Logger) (drivers.Driver, error) {
+			s, err := coredata.ConnectorSettings[coredata.SegmentConnectorSettings](conn)
+			if err != nil {
+				return nil, fmt.Errorf("cannot read segment connector settings: %w", err)
+			}
+
+			if s.BaseURL == "" {
+				return nil, fmt.Errorf("cannot create segment driver: base URL is required")
+			}
+
+			return drivers.NewSegmentDriver(c, s.BaseURL), nil
+		},
+	}
+}

pkg/connector/provider/square.go

@@ -0,0 +1,53 @@
+// Copyright (c) 2026 Probo Inc <hello@probo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package provider
+
+import (
+	"context"
+	"net/http"
+
+	"go.gearno.de/kit/log"
+
+	"go.probo.inc/probo/pkg/accessreview/drivers"
+	"go.probo.inc/probo/pkg/coredata"
+)
+
+func squareRegistration() *Registration {
+	return &Registration{
+		Provider:    coredata.ConnectorProviderSquare,
+		DisplayName: "Square",
+		AuthURL:     "https://connect.squareup.com/oauth2/authorize",
+		TokenURL:    "https://connect.squareup.com/oauth2/token",
+		// EMPLOYEES_READ lists team members; MERCHANT_PROFILE_READ is needed
+		// for the merchant-name resolver and the /v2/merchants/me probe.
+		// Square's confidential token endpoint accepts client credentials in
+		// the form body (the default post-form scheme) and rejects HTTP Basic,
+		// so no TokenEndpointAuth override is set.
+		OAuth2Scopes: []string{"EMPLOYEES_READ", "MERCHANT_PROFILE_READ"},
+		Probe:        probeSquare,
+		// SupportsAPIKey enables the Personal Access Token fallback, which
+		// authenticates with the same Authorization: Bearer scheme as the OAuth
+		// token. A Square token — OAuth or PAT — is always scoped to one
+		// merchant, so there is nothing to pick (Pattern 3): no settings
+		// struct, no picker, no OAuth-callback capture.
+		SupportsAPIKey: true,
+		NewDriver: func(_ context.Context, c *http.Client, _ *coredata.Connector, _ *log.Logger) (drivers.Driver, error) {
+			return drivers.NewSquareDriver(c), nil
+		},
+		NewNameResolver: func(_ context.Context, c *http.Client, _ *coredata.Connector, _ *log.Logger) drivers.NameResolver {
+			return drivers.NewSquareNameResolver(c)
+		},
+	}
+}