Drop dead OAuth2 TokenExtraParams plumbing → Reject non-numeric ClickUp timestamps via strconv

- Drop dead OAuth2 TokenExtraParams plumbing
- Drop Deel-only x-client-id header from basic-form
- Follow Bitbucket workspace pagination cursor
- Reject non-numeric ClickUp timestamps via strconv

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/connector/oauth2_test.go

@@ -694,106 +694,6 @@ func TestInitiateWithState_PKCE(t *testing.T) {
 	})
 }
 
-// TestBuildTokenRequest_TokenExtraParams verifies that TokenExtraParams are
-// merged into the token-exchange body in all three auth branches. This
-// powers Lever's required `audience=https://api.lever.co/v1/` parameter
-// without any per-provider branching in the OAuth2 core.
-func TestBuildTokenRequest_TokenExtraParams(t *testing.T) {
-	t.Parallel()
-
-	t.Run("post-form merges audience into form body", func(t *testing.T) {
-		t.Parallel()
-
-		c := &OAuth2Connector{
-			ClientID:     "lever-client-id",
-			ClientSecret: "lever-client-secret",
-			TokenURL:     "https://auth.lever.co/oauth/token",
-			TokenExtraParams: map[string]string{
-				"audience": "https://api.lever.co/v1/",
-			},
-		}
-
-		req, err := c.buildTokenRequest(
-			context.Background(),
-			"the-code",
-			"https://example.com/cb",
-			"",
-		)
-		require.NoError(t, err)
-
-		body, err := io.ReadAll(req.Body)
-		require.NoError(t, err)
-
-		// Raw body check: the URL-encoded value must be present
-		// verbatim (catches any double-encoding regressions).
-		assert.Contains(t, string(body), "audience=https%3A%2F%2Fapi.lever.co%2Fv1%2F")
-
-		form, err := url.ParseQuery(string(body))
-		require.NoError(t, err)
-		assert.Equal(t, "https://api.lever.co/v1/", form.Get("audience"))
-		assert.Equal(t, "the-code", form.Get("code"))
-		assert.Equal(t, "authorization_code", form.Get("grant_type"))
-	})
-
-	t.Run("basic-form merges extra params into form body", func(t *testing.T) {
-		t.Parallel()
-
-		c := &OAuth2Connector{
-			ClientID:          "id",
-			ClientSecret:      "secret",
-			TokenURL:          "https://provider.example.com/oauth/token",
-			TokenEndpointAuth: "basic-form",
-			TokenExtraParams: map[string]string{
-				"audience": "https://api.lever.co/v1/",
-			},
-		}
-
-		req, err := c.buildTokenRequest(
-			context.Background(),
-			"the-code",
-			"https://example.com/cb",
-			"",
-		)
-		require.NoError(t, err)
-
-		body, err := io.ReadAll(req.Body)
-		require.NoError(t, err)
-
-		form, err := url.ParseQuery(string(body))
-		require.NoError(t, err)
-		assert.Equal(t, "https://api.lever.co/v1/", form.Get("audience"))
-	})
-
-	t.Run("basic-json merges extra params into JSON body", func(t *testing.T) {
-		t.Parallel()
-
-		c := &OAuth2Connector{
-			ClientID:          "id",
-			ClientSecret:      "secret",
-			TokenURL:          "https://provider.example.com/oauth/token",
-			TokenEndpointAuth: "basic-json",
-			TokenExtraParams: map[string]string{
-				"audience": "https://api.lever.co/v1/",
-			},
-		}
-
-		req, err := c.buildTokenRequest(
-			context.Background(),
-			"the-code",
-			"https://example.com/cb",
-			"",
-		)
-		require.NoError(t, err)
-
-		body, err := io.ReadAll(req.Body)
-		require.NoError(t, err)
-
-		var jsonBody map[string]string
-		require.NoError(t, json.Unmarshal(body, &jsonBody))
-		assert.Equal(t, "https://api.lever.co/v1/", jsonBody["audience"])
-	})
-}
-
 // TestApplyProviderDefaults_AuthURLTemplating verifies that operator-supplied
 // AuthURLParams (for example Vercel's "{integration_slug}") are substituted
 // into the static provider AuthURL when the connector is initialized.