rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix Clerk user list decoding and add logo

Browse Source 
GET /v1/users returns a bare JSON array, not a {"data":[...]} envelope
(total_count is a separate endpoint), so decode directly into a slice.
The previous envelope-first decode errored on the array and never
reached the fallback, so ListAccounts failed against the real API.

Treat deprovisioned users as inactive. Add the missing Clerk
third-party logo and its wiring, and document why the registration
sets no probe URL or name resolver.

Record the driver-test cassette against a live Clerk development
instance, scrubbed of PII and instance identifiers (emails to
example.com, image_url payloads and CF transport headers dropped).
A locked account verifies the inactive path.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
This commit is contained in:
Aurélien Sibiril
2026-06-04 14:21:21 +02:00
parent e3cf1c7e48
commit 900b0608c1
7 changed files with 66 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
pkg/connector/provider/clerk.go
View File

@@ -28,9 +28,22 @@ func clerkRegistration() *Registration {
Provider: coredata.ConnectorProviderClerk,
DisplayName: "Clerk",
SupportsAPIKey: true,
// Clerk's Backend API is authenticated with a server-side secret key
// via Authorization: Bearer <sk_...>; there is no third-party OAuth2
// flow for account-listing access reviews.
// Clerk's Backend API authenticates with a server-side secret key
// (sk_...) presented as Authorization: Bearer, the default
// APIKeyConnection scheme. There is no third-party OAuth2 flow for
// account-listing: Clerk's OAuth is an end-user IdP (scoped consent
// to a single user's profile), not a partner grant over the Backend
// API. The secret key is bound to one Clerk instance, so there is
// nothing to pick (Pattern 3): no settings struct, no picker, no
// SetOrganizationSettings.
//
// ProbeURL is intentionally empty: the connection probe runs only
// for OAuth2 connections, so it would be dead config for an API-key
// provider; a dead key surfaces on the first ListAccounts instead.
//
// No NewNameResolver: the Backend API exposes no instance/application
// name endpoint reachable with a secret key, so the source keeps its
// generic name (the source-name worker degrades gracefully).
NewDriver: func(_ context.Context, c *http.Client, _ *coredata.Connector, _ *log.Logger) (drivers.Driver, error) {
return drivers.NewClerkDriver(c), nil
},