rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add five API-key access-review connectors

Browse Source 
Add Mercury, Apollo.io, Deepgram, ClickHouse Cloud, and Langfuse as
access-review connectors. All are API-key, single-tenant providers
(Pattern 3): the key identifies one tenant, so there is no OAuth flow,
picker UI, or bootstrap/helm configuration.

- Mercury: Bearer token, GET /api/v1/users, cursor pagination.
- Apollo.io: x-api-key header, GET /api/v1/users/search (teammates).
- Deepgram: Token scheme; lists members across every project and
  dedupes by member_id, unioning per-project scopes.
- ClickHouse Cloud: HTTP Basic (keyId:keySecret); discovers the org
  via GET /v1/organizations, then lists its members.
- Langfuse: HTTP Basic (publicKey:secretKey); a base-URL setting
  selects the regional cloud host or a self-hosted instance.

Each adds the enum value, migration, GraphQL binding, provider
Registration, a driver with a cassette-driven test, and a brand logo.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
This commit is contained in:
Aurélien Sibiril
2026-06-12 19:53:13 +02:00
parent bd6a470d6d
commit 6a285a59b9
41 changed files with 2245 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

51
pkg/connector/provider/apollo.go Normal file
View File

@@ -0,0 +1,51 @@
// Copyright (c) 2026 Probo Inc <hello@probo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package provider
import (
"context"
"net/http"
"go.gearno.de/kit/log"
"go.probo.inc/probo/pkg/accessreview/drivers"
"go.probo.inc/probo/pkg/coredata"
)
func apolloRegistration() *Registration {
return &Registration{
Provider: coredata.ConnectorProviderApollo,
DisplayName: "Apollo.io",
SupportsAPIKey: true,
// Apollo's REST API authenticates with a master API key in the
// x-api-key header; it rejects Authorization: Bearer (and, since
// Sept 2024, query/body key params). APIKeyHeader makes the
// APIKeyConnection send x-api-key instead of Bearer. There is no
// OAuth2 flow needed: the customer supplies a master key, which is
// bound to one Apollo account, so there is nothing to pick
// (Pattern 3): no settings struct, no picker.
APIKeyHeader: "x-api-key",
// ProbeURL lets the connection-status check confirm the key with a
// lightweight GET; the transport attaches x-api-key, and a missing,
// dead, or non-master key returns 401/403.
ProbeURL: "https://api.apollo.io/api/v1/users/search?page=1&per_page=1",
//
// No NewNameResolver: Apollo exposes no stable account-name
// endpoint reachable with the master key, so the source keeps its
// generic name.
NewDriver: func(_ context.Context, c *http.Client, _ *coredata.Connector, _ *log.Logger) (drivers.Driver, error) {
return drivers.NewApolloDriver(c), nil
},
}
}

5
pkg/connector/provider/builtin.go
View File

@@ -23,15 +23,18 @@ func NewBuiltinRegistry() *Registry {
r := NewRegistry()
for _, reg := range []*Registration{
anthropicRegistration(),
apolloRegistration(),
asanaRegistration(),
betterStackRegistration(),
bitbucketRegistration(),
brexRegistration(),
clerkRegistration(),
clickhouseRegistration(),
clickupRegistration(),
cloudflareRegistration(),
cursorRegistration(),
datadogRegistration(),
deepgramRegistration(),
docusignRegistration(),
grafanaRegistration(),
githubRegistration(),
@@ -40,7 +43,9 @@ func NewBuiltinRegistry() *Registry {
herokuRegistration(),
hubspotRegistration(),
intercomRegistration(),
langfuseRegistration(),
linearRegistration(),
mercuryRegistration(),
metabaseRegistration(),
microsoft365Registration(),
mondayRegistration(),

52
pkg/connector/provider/clickhouse.go Normal file
View File

@@ -0,0 +1,52 @@
// Copyright (c) 2026 Probo Inc <hello@probo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package provider
import (
"context"
"net/http"
"go.gearno.de/kit/log"
"go.probo.inc/probo/pkg/accessreview/drivers"
"go.probo.inc/probo/pkg/coredata"
)
func clickhouseRegistration() *Registration {
return &Registration{
Provider: coredata.ConnectorProviderClickHouse,
DisplayName: "ClickHouse Cloud",
SupportsAPIKey: true,
// ClickHouse Cloud's control-plane API authenticates with HTTP Basic
// auth where the credential is keyId:keySecret. APIKeyBasicAuthUserPass
// makes the APIKeyConnection base64 the verbatim "keyId:keySecret"
// the operator pastes (the empty-password APIKeyBasicAuth cannot
// carry the secret). There is no OAuth2 flow; a key/secret pair is
// scoped to exactly one organization, which the driver discovers via
// GET /v1/organizations, so there is nothing to pick or configure
// (Pattern 3): no settings struct, no picker.
APIKeyBasicAuthUserPass: true,
// ProbeURL lets the connection-status check confirm the key/secret
// with a lightweight GET; the transport attaches the Basic
// credential and a dead key/secret returns 401/403.
ProbeURL: "https://api.clickhouse.cloud/v1/organizations",
//
// No NewNameResolver: the organization name is available but would
// duplicate the driver's discovery call; the source keeps its
// generic name.
NewDriver: func(_ context.Context, c *http.Client, _ *coredata.Connector, _ *log.Logger) (drivers.Driver, error) {
return drivers.NewClickHouseDriver(c), nil
},
}
}

49
pkg/connector/provider/deepgram.go Normal file
View File

@@ -0,0 +1,49 @@
// Copyright (c) 2026 Probo Inc <hello@probo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package provider
import (
"context"
"net/http"
"go.gearno.de/kit/log"
"go.probo.inc/probo/pkg/accessreview/drivers"
"go.probo.inc/probo/pkg/coredata"
)
func deepgramRegistration() *Registration {
return &Registration{
Provider: coredata.ConnectorProviderDeepgram,
DisplayName: "Deepgram",
SupportsAPIKey: true,
// Deepgram authenticates with an API key under the `Token` scheme
// (`Authorization: Token <key>`), not Bearer. APIKeyAuthScheme makes
// the APIKeyConnection use that scheme. There is no third-party
// OAuth2 flow; the customer supplies an owner/admin key bound to one
// account, so there is nothing to pick (Pattern 3): no settings
// struct, no picker.
APIKeyAuthScheme: "Token",
// ProbeURL lets the connection-status check confirm the key with a
// lightweight GET; the transport attaches the `Token` credential and
// a dead key returns 401/403.
ProbeURL: "https://api.deepgram.com/v1/projects",
//
// No NewNameResolver: an account may span several projects, so there
// is no single instance name; the source keeps its generic name.
NewDriver: func(_ context.Context, c *http.Client, _ *coredata.Connector, _ *log.Logger) (drivers.Driver, error) {
return drivers.NewDeepgramDriver(c), nil
},
}
}

89
pkg/connector/provider/langfuse.go Normal file
View File

@@ -0,0 +1,89 @@
// Copyright (c) 2026 Probo Inc <hello@probo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package provider
import (
"context"
"fmt"
"net/http"
"net/url"
"strings"
"go.gearno.de/kit/log"
"go.probo.inc/probo/pkg/accessreview/drivers"
"go.probo.inc/probo/pkg/coredata"
)
func langfuseRegistration() *Registration {
return &Registration{
Provider: coredata.ConnectorProviderLangfuse,
DisplayName: "Langfuse",
SupportsAPIKey: true,
// Langfuse's organization-scoped public API authenticates with HTTP
// Basic auth where the credential is publicKey:secretKey.
// APIKeyBasicAuthUserPass base64s the verbatim "publicKey:secretKey" the
// operator pastes (the empty-password APIKeyBasicAuth cannot carry
// the secret). The org API key is bound to one organization, so
// there is nothing to pick; only the regional/self-hosted base URL
// is per-tenant and is surfaced as an extra setting.
APIKeyBasicAuthUserPass: true,
ExtraSettings: []ExtraSetting{
{Key: "baseUrl", Label: "Base URL", Required: true},
},
// BuildProbeURL derives the probe endpoint from the per-connection
// base URL (the host is regional/self-hosted, so a static ProbeURL
// cannot express it); the transport attaches the Basic credential
// and a dead key returns 401/403.
BuildProbeURL: buildLangfuseProbeURL,
//
// No NewNameResolver: the memberships endpoint carries no
// organization name, so the source keeps its generic name.
NewDriver: func(_ context.Context, c *http.Client, conn *coredata.Connector, _ *log.Logger) (drivers.Driver, error) {
settings, err := coredata.ConnectorSettings[coredata.LangfuseConnectorSettings](conn)
if err != nil {
return nil, fmt.Errorf("cannot read langfuse connector settings: %w", err)
}
baseURL, err := normalizeLangfuseBaseURL(settings.BaseURL)
if err != nil {
return nil, fmt.Errorf("cannot create langfuse driver: %w", err)
}
return drivers.NewLangfuseDriver(c, baseURL), nil
},
}
}
func normalizeLangfuseBaseURL(raw string) (string, error) {
baseURL := strings.TrimSpace(raw)
if baseURL == "" {
return "", fmt.Errorf("base_url is required")
}
u, err := url.Parse(baseURL)
if err != nil {
return "", fmt.Errorf("base_url must be a valid URL: %w", err)
}
if (u.Scheme != "http" && u.Scheme != "https") || u.Host == "" {
return "", fmt.Errorf("base_url must be an http(s) URL")
}
u.Path = strings.TrimRight(u.Path, "/")
u.RawQuery = ""
u.Fragment = ""
return u.String(), nil
}

108
pkg/connector/provider/langfuse_test.go Normal file
View File

@@ -0,0 +1,108 @@
// Copyright (c) 2026 Probo Inc <hello@probo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package provider_test
import (
"context"
"encoding/json"
"testing"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"go.gearno.de/kit/httpclient"
"go.probo.inc/probo/pkg/accessreview/drivers"
"go.probo.inc/probo/pkg/connector/provider"
"go.probo.inc/probo/pkg/coredata"
)
func TestLangfuseRegistrationMetadata(t *testing.T) {
t.Parallel()
r := provider.NewBuiltinRegistry()
reg, ok := r.Get(coredata.ConnectorProviderLangfuse)
require.True(t, ok, "langfuse provider must be registered")
assert.Equal(t, "Langfuse", reg.DisplayName)
assert.True(t, reg.SupportsAPIKey)
// Langfuse presents publicKey:secretKey as a full HTTP Basic credential.
assert.True(t, reg.APIKeyBasicAuthUserPass)
assert.Empty(t, reg.APIKeyHeader)
assert.Empty(t, reg.APIKeyAuthScheme)
require.Len(t, reg.ExtraSettings, 1)
assert.Equal(t, "baseUrl", reg.ExtraSettings[0].Key)
assert.Equal(t, "Base URL", reg.ExtraSettings[0].Label)
assert.True(t, reg.ExtraSettings[0].Required)
// Single-tenant API-key provider: no picker, no name resolver.
assert.Nil(t, reg.NewNameResolver, "langfuse must not wire a name resolver")
assert.Nil(t, reg.SetOrganizationSettings, "langfuse must not wire a picker store")
}
func TestLangfuseNewDriver(t *testing.T) {
t.Parallel()
r := provider.NewBuiltinRegistry()
reg, ok := r.Get(coredata.ConnectorProviderLangfuse)
require.True(t, ok, "langfuse provider must be registered")
require.NotNil(t, reg.NewDriver, "langfuse NewDriver closure must be wired")
t.Run("creates driver with valid base_url", func(t *testing.T) {
t.Parallel()
raw, err := json.Marshal(&coredata.LangfuseConnectorSettings{
BaseURL: "https://cloud.langfuse.com",
})
require.NoError(t, err)
conn := &coredata.Connector{
Provider: coredata.ConnectorProviderLangfuse,
RawSettings: raw,
}
drv, err := reg.NewDriver(context.Background(), httpclient.DefaultClient(httpclient.WithSSRFProtection()), conn, nil)
require.NoError(t, err)
assert.IsType(t, &drivers.LangfuseDriver{}, drv)
})
t.Run("errors when base_url is missing", func(t *testing.T) {
t.Parallel()
conn := &coredata.Connector{
Provider: coredata.ConnectorProviderLangfuse,
RawSettings: []byte(`{}`),
}
_, err := reg.NewDriver(context.Background(), httpclient.DefaultClient(httpclient.WithSSRFProtection()), conn, nil)
require.Error(t, err)
assert.Contains(t, err.Error(), "base_url is required")
})
t.Run("errors when base_url is invalid", func(t *testing.T) {
t.Parallel()
raw, err := json.Marshal(&coredata.LangfuseConnectorSettings{
BaseURL: "ftp://cloud.langfuse.com",
})
require.NoError(t, err)
conn := &coredata.Connector{
Provider: coredata.ConnectorProviderLangfuse,
RawSettings: raw,
}
_, err = reg.NewDriver(context.Background(), httpclient.DefaultClient(httpclient.WithSSRFProtection()), conn, nil)
require.Error(t, err)
assert.Contains(t, err.Error(), "base_url must be an http(s) URL")
})
}

51
pkg/connector/provider/mercury.go Normal file
View File

@@ -0,0 +1,51 @@
// Copyright (c) 2026 Probo Inc <hello@probo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package provider
import (
"context"
"net/http"
"go.gearno.de/kit/log"
"go.probo.inc/probo/pkg/accessreview/drivers"
"go.probo.inc/probo/pkg/coredata"
)
func mercuryRegistration() *Registration {
return &Registration{
Provider: coredata.ConnectorProviderMercury,
DisplayName: "Mercury",
SupportsAPIKey: true,
// Mercury authenticates with a self-serve API token presented as
// Authorization: Bearer, the default APIKeyConnection scheme. There
// is no third-party OAuth2 flow for the Users API. The token is
// bound to one Mercury organization, so there is nothing to pick
// (Pattern 3): no settings struct, no picker, no
// SetOrganizationSettings.
//
// ProbeURL lets the connection-status check confirm the token is
// live with a lightweight GET; the transport attaches the Bearer
// token and a dead token returns 401/403.
ProbeURL: "https://api.mercury.com/api/v1/users?limit=1",
//
// No NewNameResolver: GET /api/v1/users carries no organization
// name and a read-only token may lack other scopes, so the source
// keeps its generic name (the source-name worker degrades
// gracefully).
NewDriver: func(_ context.Context, c *http.Client, _ *coredata.Connector, _ *log.Logger) (drivers.Driver, error) {
return drivers.NewMercuryDriver(c), nil
},
}
}

19
pkg/connector/provider/probe.go
View File

@@ -314,6 +314,25 @@ func buildMetabaseProbeURL(conn *coredata.Connector) (string, error) {
return endpoint.String(), nil
}
func buildLangfuseProbeURL(conn *coredata.Connector) (string, error) {
s, err := coredata.ConnectorSettings[coredata.LangfuseConnectorSettings](conn)
if err != nil {
return "", fmt.Errorf("cannot read langfuse connector settings: %w", err)
}
baseURL, err := normalizeLangfuseBaseURL(s.BaseURL)
if err != nil {
return "", err
}
u, err := url.Parse(baseURL)
if err != nil {
return "", fmt.Errorf("cannot parse langfuse base URL: %w", err)
}
return u.JoinPath("api", "public", "organizations", "memberships").String(), nil
}
func buildSigNozProbeURL(conn *coredata.Connector) (string, error) {
s, err := coredata.ConnectorSettings[coredata.SigNozConnectorSettings](conn)
if err != nil {

13
pkg/connector/provider/probe_test.go
View File

@@ -78,6 +78,19 @@ func TestBuildOktaProbeURL(t *testing.T) {
assert.Equal(t, "https://acme.okta.com/api/v1/users?limit=1", probeURL)
}
func TestBuildLangfuseProbeURL(t *testing.T) {
t.Parallel()
conn := &coredata.Connector{Provider: coredata.ConnectorProviderLangfuse}
require.NoError(t, conn.SetSettings(&coredata.LangfuseConnectorSettings{
BaseURL: "https://us.cloud.langfuse.com",
}))
probeURL, err := buildLangfuseProbeURL(conn)
require.NoError(t, err)
assert.Equal(t, "https://us.cloud.langfuse.com/api/public/organizations/memberships", probeURL)
}
func TestBuildPostHogProbeURL(t *testing.T) {
t.Parallel()