Add Render access review driver support

Register Render as an API-key connector provider and add an access
review driver that fetches workspace members from the Render API
(GET /v1/owners/{ownerId}/members).

Render exposes no partner OAuth program, so the connector authenticates
with a read-scoped API key (Authorization: Bearer) plus the customer's
Workspace ID. The flat members endpoint reports an explicit account
status and MFA flag, surfaced as the Active and MFAStatus fields; the
stable "usr-" id becomes ExternalID. There is no picker -- the
workspace is captured up front via ExtraSettings -- so
SetOrganizationSettings is omitted.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/accessreview/drivers/render.go

@@ -0,0 +1,175 @@
+// Copyright (c) 2026 Probo Inc <hello@probo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package drivers
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"go.probo.inc/probo/pkg/coredata"
+)
+
+const renderAPIBaseURL = "https://api.render.com/v1"
+
+type RenderDriver struct {
+	httpClient *http.Client
+	ownerID    string
+}
+
+var _ Driver = (*RenderDriver)(nil)
+
+// renderMember mirrors one element of the flat array returned by
+// GET /v1/owners/{ownerId}/members. The endpoint takes no query parameters
+// and is not paginated: it returns every workspace member (active and
+// inactive) in a single response.
+type renderMember struct {
+	UserID     string `json:"userId"`
+	Name       string `json:"name"`
+	Email      string `json:"email"`
+	Status     string `json:"status"` // "active" | "inactive"
+	Role       string `json:"role"`   // always uppercase
+	MFAEnabled bool   `json:"mfaEnabled"`
+}
+
+func NewRenderDriver(httpClient *http.Client, ownerID string) *RenderDriver {
+	return &RenderDriver{
+		httpClient: httpClient,
+		ownerID:    ownerID,
+	}
+}
+
+func (d *RenderDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error) {
+	endpoint, err := url.JoinPath(
+		renderAPIBaseURL,
+		"owners",
+		url.PathEscape(d.ownerID),
+		"members",
+	)
+	if err != nil {
+		return nil, fmt.Errorf("cannot build render members URL: %w", err)
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	if err != nil {
+		return nil, fmt.Errorf("cannot create render members request: %w", err)
+	}
+
+	req.Header.Set("Accept", "application/json")
+
+	httpResp, err := d.httpClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("cannot execute render members request: %w", err)
+	}
+
+	defer func() {
+		_ = httpResp.Body.Close()
+	}()
+
+	if httpResp.StatusCode < 200 || httpResp.StatusCode >= 300 {
+		return nil, fmt.Errorf("cannot fetch render members: unexpected status %d", httpResp.StatusCode)
+	}
+
+	var members []renderMember
+	if err := json.NewDecoder(httpResp.Body).Decode(&members); err != nil {
+		return nil, fmt.Errorf("cannot decode render members response: %w", err)
+	}
+
+	records := make([]AccountRecord, 0, len(members))
+	for _, member := range members {
+		if member.Email == "" {
+			continue
+		}
+
+		records = append(records, AccountRecord{
+			Email:       member.Email,
+			FullName:    renderFullName(member),
+			Role:        renderRole(member.Role),
+			Active:      renderActive(member.Status),
+			IsAdmin:     renderIsAdmin(member.Role),
+			MFAStatus:   renderMFAStatus(member.MFAEnabled),
+			AuthMethod:  coredata.AccessEntryAuthMethodUnknown,
+			AccountType: coredata.AccessEntryAccountTypeUser,
+			ExternalID:  member.UserID,
+		})
+	}
+
+	return records, nil
+}
+
+func renderFullName(member renderMember) string {
+	if member.Name != "" {
+		return member.Name
+	}
+
+	return member.Email
+}
+
+// renderRole maps Render's uppercase role enum to a human-readable label.
+// Render documents ADMIN, DEVELOPER, WORKSPACE_CONTRIBUTOR,
+// WORKSPACE_BILLING, and WORKSPACE_VIEWER; unknown future roles fall through
+// to the raw value.
+func renderRole(role string) string {
+	switch strings.ToUpper(role) {
+	case "ADMIN":
+		return "Admin"
+	case "DEVELOPER":
+		return "Developer"
+	case "WORKSPACE_CONTRIBUTOR":
+		return "Contributor"
+	case "WORKSPACE_BILLING":
+		return "Billing"
+	case "WORKSPACE_VIEWER":
+		return "Viewer"
+	default:
+		return role
+	}
+}
+
+// renderIsAdmin reports whether a Render role grants workspace
+// administration. Only ADMIN does (it also covers the workspace owner, who
+// is reported with the ADMIN role).
+func renderIsAdmin(role string) bool {
+	return strings.EqualFold(role, "ADMIN")
+}
+
+func renderMFAStatus(enabled bool) coredata.MFAStatus {
+	if enabled {
+		return coredata.MFAStatusEnabled
+	}
+
+	return coredata.MFAStatusDisabled
+}
+
+// renderActive maps Render's documented status enum to the three-valued
+// Active signal. Only the documented "active"/"inactive" values are an
+// explicit signal; an empty or unrecognized status leaves Active nil
+// (unknown) rather than fabricating a deactivated state, per the
+// AccountRecord contract.
+func renderActive(status string) *bool {
+	switch strings.ToLower(status) {
+	case "active":
+		active := true
+		return &active
+	case "inactive":
+		inactive := false
+		return &inactive
+	default:
+		return nil
+	}
+}