Drop dead OAuth2 TokenExtraParams plumbing → Reject non-numeric ClickUp timestamps via strconv

- Drop dead OAuth2 TokenExtraParams plumbing
- Drop Deel-only x-client-id header from basic-form
- Follow Bitbucket workspace pagination cursor
- Reject non-numeric ClickUp timestamps via strconv

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/connector/oauth2.go

@@ -23,7 +23,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"maps"
 	"net/http"
 	"net/url"
 	"strings"
@@ -58,11 +57,6 @@ type (
 		// to the authorize URL; CompleteWithState replays the verifier
 		// on the token exchange.
 		RequiresPKCE bool
-		// TokenExtraParams are merged into the token-exchange request
-		// body (form-encoded for post-form / basic-form, JSON for
-		// basic-json). Used for provider-specific extras such as
-		// Lever's `audience` parameter.
-		TokenExtraParams map[string]string
 		// AuthURLParams are operator-supplied placeholders substituted
 		// into the static provider AuthURL by ApplyProviderDefaults
 		// (for example Vercel's "{integration_slug}"). Empty for the
@@ -344,8 +338,7 @@ func basicAuthHeader(clientID, clientSecret string) string {
 // buildTokenRequest creates the HTTP request for the token exchange, branching
 // on c.TokenEndpointAuth to support different provider requirements. When
 // codeVerifier is non-empty (PKCE-enabled providers), it is replayed as
-// `code_verifier` in the request body. TokenExtraParams are merged into the
-// body in every branch.
+// `code_verifier` in the request body.
 func (c *OAuth2Connector) buildTokenRequest(ctx context.Context, code, redirectURI, codeVerifier string) (*http.Request, error) {
 	switch c.TokenEndpointAuth {
 	case "basic-json":
@@ -358,7 +351,6 @@ func (c *OAuth2Connector) buildTokenRequest(ctx context.Context, code, redirectU
 		if codeVerifier != "" {
 			body["code_verifier"] = codeVerifier
 		}
-		maps.Copy(body, c.TokenExtraParams)
 		jsonBody, err := json.Marshal(body)
 		if err != nil {
 			return nil, fmt.Errorf("cannot marshal token request body: %w", err)
@@ -389,9 +381,6 @@ func (c *OAuth2Connector) buildTokenRequest(ctx context.Context, code, redirectU
 		if codeVerifier != "" {
 			formData.Set("code_verifier", codeVerifier)
 		}
-		for k, v := range c.TokenExtraParams {
-			formData.Set(k, v)
-		}
 
 		req, err := http.NewRequestWithContext(
 			ctx,
@@ -407,12 +396,6 @@ func (c *OAuth2Connector) buildTokenRequest(ctx context.Context, code, redirectU
 		req.Header.Set("Accept", "application/json")
 		req.Header.Set("User-Agent", "Probo Connector")
 		req.Header.Set("Authorization", basicAuthHeader(c.ClientID, c.ClientSecret))
-		// Deel rejects token-exchange requests that omit the x-client-id
-		// header even when the credentials are correctly Base64-encoded
-		// in the Authorization header. Sending it for every basic-form
-		// provider is harmless — providers that don't expect it ignore
-		// the header.
-		req.Header.Set("x-client-id", c.ClientID)
 		return req, nil
 
 	default:
@@ -426,9 +409,6 @@ func (c *OAuth2Connector) buildTokenRequest(ctx context.Context, code, redirectU
 		if codeVerifier != "" {
 			formData.Set("code_verifier", codeVerifier)
 		}
-		for k, v := range c.TokenExtraParams {
-			formData.Set(k, v)
-		}
 
 		req, err := http.NewRequestWithContext(
 			ctx,