rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Strip email local-part from cassette guard failure → Wire 13 access-review connectors in Helm chart

Browse Source 
- Strip email local-part from cassette guard failure
- Drop dead src/components/connectors vite include
- Cover all 13 access-review providers in builder test
- Wire 13 access-review connectors in Helm chart

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
This commit is contained in:
Aurélien Sibiril
2026-05-17 17:22:48 +02:00
parent 8f6ecd9f81
commit 7504099507
5 changed files with 61 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
apps/console/vite.config.ts
View File

@@ -25,10 +25,7 @@ const require = createRequire(import.meta.url);
export default defineConfig({
plugins: [
react({
exclude: [
"src/pages/iam/**/*",
"src/components/connectors/**/*",
],
exclude: ["src/pages/iam/**/*"],
babel: {
plugins: [
[
@@ -42,10 +39,7 @@ export default defineConfig({
},
}),
react({
include: [
"src/pages/iam/**/*",
"src/components/connectors/**/*",
],
include: ["src/pages/iam/**/*"],
babel: {
plugins: [
[
@@ -61,6 +55,7 @@ export default defineConfig({
tailwindcss(),
],
server: {
allowedHosts: true,
proxy: {
"/api": {
target: "http://localhost:8080",

26
contrib/helm/charts/probo/templates/deployment.yaml
View File

@@ -281,6 +281,32 @@ spec:
{{- end }}
{{- end }}
{{- end }}
# Connectors (access-review OAuth2 providers added 2026)
{{- range .Values.probo.connectors }}
{{- $accessReviewProviders := list "gitlab" "bitbucket" "heroku" "pagerduty" "asana" "snyk" "netlify" "ramp" "clickup" "vercel" "monday" "lever" "deel" }}
{{- if has .name $accessReviewProviders }}
{{- $envPrefix := printf "CONNECTOR_%s" (.name | upper) }}
{{- $secretPrefix := printf "connector-%s" .name }}
- name: {{ $envPrefix }}_CLIENT_ID
valueFrom:
secretKeyRef:
name: {{ include "probo.fullname" $ }}
key: {{ $secretPrefix }}-client-id
- name: {{ $envPrefix }}_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: {{ include "probo.fullname" $ }}
key: {{ $secretPrefix }}-client-secret
{{- if .config.redirectUri }}
- name: {{ $envPrefix }}_REDIRECT_URI
value: {{ .config.redirectUri | quote }}
{{- end }}
{{- if and (eq .name "vercel") .config.integrationSlug }}
- name: CONNECTOR_VERCEL_INTEGRATION_SLUG
value: {{ .config.integrationSlug | quote }}
{{- end }}
{{- end }}
{{- end }}
ports:
- name: http
containerPort: {{ .Values.service.httpPort }}

9
contrib/helm/charts/probo/templates/secret.yaml
View File

@@ -56,4 +56,13 @@ stringData:
connector-slack-signing-secret: {{ .config.signingSecret | quote }}
{{- end }}
{{- end }}
{{- $accessReviewProviders := list "gitlab" "bitbucket" "heroku" "pagerduty" "asana" "snyk" "netlify" "ramp" "clickup" "vercel" "monday" "lever" "deel" }}
{{- if has .name $accessReviewProviders }}
{{- if .config.clientId }}
connector-{{ .name }}-client-id: {{ .config.clientId | quote }}
{{- end }}
{{- if .config.clientSecret }}
connector-{{ .name }}-client-secret: {{ .config.clientSecret | quote }}
{{- end }}
{{- end }}
{{- end }}

9
pkg/accessreview/drivers/cassette_safety_test.go
View File

@@ -96,14 +96,19 @@ func TestCassettesUseSyntheticEmails(t *testing.T) {
}
}
// Log the domain (actionable) but never the local-part
// — a failed assertion ends up in CI logs, and the whole
// point of this guard is to keep PII out of those logs.
// Operators can grep the cassette locally to identify the
// offending row.
assert.Truef(
t,
ok,
"cassette %s contains email %q with non-synthetic domain %q; "+
"cassette %s contains an email with non-synthetic domain %q; "+
"either replace with a synthetic *.example.com address or "+
"add the domain to allowedExactDomains in cassette_safety_test.go "+
"with a justification",
filepath.Base(cassette), email, domain,
filepath.Base(cassette), domain,
)
}
})

26
pkg/bootstrap/builder_test.go
View File

@@ -17,6 +17,7 @@ package bootstrap
import (
"os"
"path/filepath"
"strings"
"testing"
"github.com/stretchr/testify/assert"
@@ -436,15 +437,20 @@ func TestBuilder_Build_Microsoft365Connector(t *testing.T) {
}
func TestBuilder_Build_AccessReviewConnectors(t *testing.T) {
// All non-Vercel access-review providers added by this PR. Vercel
// has its own dedicated test because it carries an additional
// CONNECTOR_VERCEL_INTEGRATION_SLUG env var.
providers := []string{
"GITLAB", "BITBUCKET", "HEROKU", "PAGERDUTY",
"ASANA", "SNYK", "NETLIFY", "RAMP", "CLICKUP",
"MONDAY", "LEVER", "DEEL",
}
env := requiredEnv()
env["CONNECTOR_GITLAB_CLIENT_ID"] = "gitlab-id"
env["CONNECTOR_GITLAB_CLIENT_SECRET"] = "gitlab-secret"
env["CONNECTOR_BITBUCKET_CLIENT_ID"] = "bitbucket-id"
env["CONNECTOR_BITBUCKET_CLIENT_SECRET"] = "bitbucket-secret"
env["CONNECTOR_PAGERDUTY_CLIENT_ID"] = "pagerduty-id"
env["CONNECTOR_PAGERDUTY_CLIENT_SECRET"] = "pagerduty-secret"
env["CONNECTOR_DEEL_CLIENT_ID"] = "deel-id"
env["CONNECTOR_DEEL_CLIENT_SECRET"] = "deel-secret"
for _, provider := range providers {
env["CONNECTOR_"+provider+"_CLIENT_ID"] = strings.ToLower(provider) + "-id"
env["CONNECTOR_"+provider+"_CLIENT_SECRET"] = strings.ToLower(provider) + "-secret"
}
b := NewBuilder(mockEnv(env))
b.samlCertificate = "test-cert"
@@ -453,13 +459,13 @@ func TestBuilder_Build_AccessReviewConnectors(t *testing.T) {
cfg, err := b.Build()
require.NoError(t, err)
require.Len(t, cfg.Probod.Connectors, 4)
require.Len(t, cfg.Probod.Connectors, len(providers))
byProvider := make(map[string]probodconfig.ConnectorConfig, len(cfg.Probod.Connectors))
for _, c := range cfg.Probod.Connectors {
byProvider[c.Provider] = c
}
for _, provider := range []string{"GITLAB", "BITBUCKET", "PAGERDUTY", "DEEL"} {
for _, provider := range providers {
c, ok := byProvider[provider]
require.True(t, ok, "missing %s connector", provider)
assert.Equal(t, "oauth2", string(c.Protocol))