Strip email local-part from cassette guard failure → Wire 13 access-review connectors in Helm chart

- Strip email local-part from cassette guard failure
- Drop dead src/components/connectors vite include
- Cover all 13 access-review providers in builder test
- Wire 13 access-review connectors in Helm chart

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

apps/console/vite.config.ts

@@ -25,10 +25,7 @@ const require = createRequire(import.meta.url);
 export default defineConfig({
   plugins: [
     react({
-      exclude: [
+      exclude: ["src/pages/iam/**/*"],
-        "src/pages/iam/**/*",
-        "src/components/connectors/**/*",
-      ],
       babel: {
         plugins: [
           [
@@ -42,10 +39,7 @@ export default defineConfig({
       },
     }),
     react({
-      include: [
+      include: ["src/pages/iam/**/*"],
-        "src/pages/iam/**/*",
-        "src/components/connectors/**/*",
-      ],
       babel: {
         plugins: [
           [
@@ -61,6 +55,7 @@ export default defineConfig({
     tailwindcss(),
   ],
   server: {
+    allowedHosts: true,
     proxy: {
       "/api": {
         target: "http://localhost:8080",

contrib/helm/charts/probo/templates/deployment.yaml

@@ -281,6 +281,32 @@ spec:
             {{- end }}
             {{- end }}
             {{- end }}
+            # Connectors (access-review OAuth2 providers added 2026)
+            {{- range .Values.probo.connectors }}
+            {{- $accessReviewProviders := list "gitlab" "bitbucket" "heroku" "pagerduty" "asana" "snyk" "netlify" "ramp" "clickup" "vercel" "monday" "lever" "deel" }}
+            {{- if has .name $accessReviewProviders }}
+            {{- $envPrefix := printf "CONNECTOR_%s" (.name | upper) }}
+            {{- $secretPrefix := printf "connector-%s" .name }}
+            - name: {{ $envPrefix }}_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "probo.fullname" $ }}
+                  key: {{ $secretPrefix }}-client-id
+            - name: {{ $envPrefix }}_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "probo.fullname" $ }}
+                  key: {{ $secretPrefix }}-client-secret
+            {{- if .config.redirectUri }}
+            - name: {{ $envPrefix }}_REDIRECT_URI
+              value: {{ .config.redirectUri | quote }}
+            {{- end }}
+            {{- if and (eq .name "vercel") .config.integrationSlug }}
+            - name: CONNECTOR_VERCEL_INTEGRATION_SLUG
+              value: {{ .config.integrationSlug | quote }}
+            {{- end }}
+            {{- end }}
+            {{- end }}
           ports:
             - name: http
               containerPort: {{ .Values.service.httpPort }}

contrib/helm/charts/probo/templates/secret.yaml

@@ -56,4 +56,13 @@ stringData:
   connector-slack-signing-secret: {{ .config.signingSecret | quote }}
   {{- end }}
   {{- end }}
+  {{- $accessReviewProviders := list "gitlab" "bitbucket" "heroku" "pagerduty" "asana" "snyk" "netlify" "ramp" "clickup" "vercel" "monday" "lever" "deel" }}
+  {{- if has .name $accessReviewProviders }}
+  {{- if .config.clientId }}
+  connector-{{ .name }}-client-id: {{ .config.clientId | quote }}
+  {{- end }}
+  {{- if .config.clientSecret }}
+  connector-{{ .name }}-client-secret: {{ .config.clientSecret | quote }}
+  {{- end }}
+  {{- end }}
   {{- end }}

pkg/accessreview/drivers/cassette_safety_test.go

@@ -96,14 +96,19 @@ func TestCassettesUseSyntheticEmails(t *testing.T) {
 					}
 				}
 
+				// Log the domain (actionable) but never the local-part
+				// — a failed assertion ends up in CI logs, and the whole
+				// point of this guard is to keep PII out of those logs.
+				// Operators can grep the cassette locally to identify the
+				// offending row.
 				assert.Truef(
 					t,
 					ok,
-					"cassette %s contains email %q with non-synthetic domain %q; "+
+					"cassette %s contains an email with non-synthetic domain %q; "+
 						"either replace with a synthetic *.example.com address or "+
 						"add the domain to allowedExactDomains in cassette_safety_test.go "+
 						"with a justification",
-					filepath.Base(cassette), email, domain,
+					filepath.Base(cassette), domain,
 				)
 			}
 		})

pkg/bootstrap/builder_test.go

@@ -17,6 +17,7 @@ package bootstrap
 import (
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -436,15 +437,20 @@ func TestBuilder_Build_Microsoft365Connector(t *testing.T) {
 }
 
 func TestBuilder_Build_AccessReviewConnectors(t *testing.T) {
+	// All non-Vercel access-review providers added by this PR. Vercel
+	// has its own dedicated test because it carries an additional
+	// CONNECTOR_VERCEL_INTEGRATION_SLUG env var.
+	providers := []string{
+		"GITLAB", "BITBUCKET", "HEROKU", "PAGERDUTY",
+		"ASANA", "SNYK", "NETLIFY", "RAMP", "CLICKUP",
+		"MONDAY", "LEVER", "DEEL",
+	}
+
 	env := requiredEnv()
-	env["CONNECTOR_GITLAB_CLIENT_ID"] = "gitlab-id"
+	for _, provider := range providers {
-	env["CONNECTOR_GITLAB_CLIENT_SECRET"] = "gitlab-secret"
+		env["CONNECTOR_"+provider+"_CLIENT_ID"] = strings.ToLower(provider) + "-id"
-	env["CONNECTOR_BITBUCKET_CLIENT_ID"] = "bitbucket-id"
+		env["CONNECTOR_"+provider+"_CLIENT_SECRET"] = strings.ToLower(provider) + "-secret"
-	env["CONNECTOR_BITBUCKET_CLIENT_SECRET"] = "bitbucket-secret"
+	}
-	env["CONNECTOR_PAGERDUTY_CLIENT_ID"] = "pagerduty-id"
-	env["CONNECTOR_PAGERDUTY_CLIENT_SECRET"] = "pagerduty-secret"
-	env["CONNECTOR_DEEL_CLIENT_ID"] = "deel-id"
-	env["CONNECTOR_DEEL_CLIENT_SECRET"] = "deel-secret"
 
 	b := NewBuilder(mockEnv(env))
 	b.samlCertificate = "test-cert"
@@ -453,13 +459,13 @@ func TestBuilder_Build_AccessReviewConnectors(t *testing.T) {
 	cfg, err := b.Build()
 	require.NoError(t, err)
 
-	require.Len(t, cfg.Probod.Connectors, 4)
+	require.Len(t, cfg.Probod.Connectors, len(providers))
 	byProvider := make(map[string]probodconfig.ConnectorConfig, len(cfg.Probod.Connectors))
 	for _, c := range cfg.Probod.Connectors {
 		byProvider[c.Provider] = c
 	}
 
-	for _, provider := range []string{"GITLAB", "BITBUCKET", "PAGERDUTY", "DEEL"} {
+	for _, provider := range providers {
 		c, ok := byProvider[provider]
 		require.True(t, ok, "missing %s connector", provider)
 		assert.Equal(t, "oauth2", string(c.Protocol))