Require CLIENT_SECRET for new access-review connectors → Drop Snyk, Ramp, Lever, Deel access-review providers

- Require CLIENT_SECRET for new access-review connectors
- Use Heroku account UUID as ExternalID
- Bump GitHub orgs picker to per_page=100
- Drop Snyk, Ramp, Lever, Deel access-review providers

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/connector/oauth2_test.go

@@ -882,12 +882,12 @@ func TestGeneratePKCEVerifier(t *testing.T) {
 }
 
 // TestApplyProviderDefaults_PKCEDefaults asserts that the registered
-// PAGERDUTY and SNYK provider defaults flip RequiresPKCE on so the
-// downstream Initiate/Complete flow generates a verifier and replays it.
+// PAGERDUTY provider defaults flip RequiresPKCE on so the downstream
+// Initiate/Complete flow generates a verifier and replays it.
 func TestApplyProviderDefaults_PKCEDefaults(t *testing.T) {
 	t.Parallel()
 
-	for _, provider := range []string{"PAGERDUTY", "SNYK"} {
+	for _, provider := range []string{"PAGERDUTY"} {
 		t.Run(provider, func(t *testing.T) {
 			t.Parallel()
 
@@ -899,31 +899,6 @@ func TestApplyProviderDefaults_PKCEDefaults(t *testing.T) {
 	}
 }
 
-// TestApplyProviderDefaults_TokenExtraParamsDeepCopy guards against the
-// shared-map aliasing bug class. Two connectors using the same provider
-// (LEVER carries a non-empty TokenExtraParams) must not share the
-// underlying map; mutating one must not be observable on the other or
-// in the package-level providerDefinitions.
-func TestApplyProviderDefaults_TokenExtraParamsDeepCopy(t *testing.T) {
-	t.Parallel()
-
-	c1 := &OAuth2Connector{ClientID: "id1", ClientSecret: "s1"}
-	c2 := &OAuth2Connector{ClientID: "id2", ClientSecret: "s2"}
-
-	ApplyProviderDefaults("LEVER", "https://example.com/cb", c1)
-	ApplyProviderDefaults("LEVER", "https://example.com/cb", c2)
-
-	require.NotNil(t, c1.TokenExtraParams)
-	require.NotNil(t, c2.TokenExtraParams)
-	require.Equal(t, "https://api.lever.co/v1/", c1.TokenExtraParams["audience"])
-
-	c1.TokenExtraParams["sentinel"] = "mutated"
-	assert.NotContains(t, c2.TokenExtraParams, "sentinel",
-		"second connector must not see mutations on the first")
-	assert.NotContains(t, providerDefinitions["LEVER"].TokenExtraParams, "sentinel",
-		"shared providerDefinitions map must remain pristine")
-}
-
 // TestCompleteWithState_PKCEMismatch confirms that a token endpoint
 // rejecting a stale or mismatched code_verifier (the standard PKCE
 // failure path) surfaces as an error from CompleteWithState rather

pkg/connector/providers.go

@@ -128,20 +128,10 @@ var (
 			AuthURL:  "https://app.asana.com/-/oauth_authorize",
 			TokenURL: "https://app.asana.com/-/oauth_token",
 		},
-		"SNYK": {
-			AuthURL:      "https://app.snyk.io/oauth2/authorize",
-			TokenURL:     "https://api.snyk.io/oauth2/token",
-			RequiresPKCE: true,
-		},
 		"NETLIFY": {
 			AuthURL:  "https://app.netlify.com/authorize",
 			TokenURL: "https://api.netlify.com/oauth/token",
 		},
-		"RAMP": {
-			AuthURL:           "https://app.ramp.com/v1/authorize",
-			TokenURL:          "https://api.ramp.com/developer/v1/token",
-			TokenEndpointAuth: "basic-form",
-		},
 		"CLICKUP": {
 			AuthURL:  "https://app.clickup.com/api",
 			TokenURL: "https://api.clickup.com/api/v2/oauth/token",
@@ -159,31 +149,6 @@ var (
 			AuthURL:  "https://auth.monday.com/oauth2/authorize",
 			TokenURL: "https://auth.monday.com/oauth2/token",
 		},
-		// Lever runs on Auth0: the `audience` parameter is required in
-		// BOTH the authorize URL and the token-exchange POST body. The
-		// trailing slash on the audience value is mandatory.
-		"LEVER": {
-			AuthURL:  "https://auth.lever.co/authorize",
-			TokenURL: "https://auth.lever.co/oauth/token",
-			ExtraAuthParams: map[string]string{
-				"audience": "https://api.lever.co/v1/",
-				"prompt":   "consent",
-			},
-			TokenExtraParams: map[string]string{
-				"audience": "https://api.lever.co/v1/",
-			},
-		},
-		// Deel: the token endpoint path is "/oauth2/tokens" (plural) —
-		// Deel's docs are inconsistent on the singular vs plural form.
-		// The API base host (api.letsdeel.com) differs from the auth host
-		// (app.deel.com). Deel's token endpoint requires HTTP Basic auth
-		// (base64(client_id:client_secret)); credentials placed in the
-		// form body are rejected with 401 invalid basic credentials.
-		"DEEL": {
-			AuthURL:           "https://app.deel.com/oauth2/authorize",
-			TokenURL:          "https://app.deel.com/oauth2/tokens",
-			TokenEndpointAuth: "basic-form",
-		},
 	}
 )
 

pkg/connector/registry.go

@@ -142,17 +142,13 @@ var (
 		"HEROKU":           "https://api.heroku.com/account",
 		"PAGERDUTY":        "https://api.pagerduty.com/users/me",
 		"ASANA":            "https://app.asana.com/api/1.0/users/me",
-		"SNYK":             "https://api.snyk.io/rest/self?version=2024-10-15",
 		"NETLIFY":          "https://api.netlify.com/api/v1/user",
-		"RAMP":             "https://api.ramp.com/developer/v1/business",
 		"CLICKUP":          "https://api.clickup.com/api/v2/user",
 		"VERCEL":           "https://api.vercel.com/v2/user",
 		// Monday's primary API is GraphQL POST, but the probe handler
 		// is GET-only. Use the OIDC userinfo endpoint as a GET probe
 		// that returns 200/401 with the same Bearer token.
 		"MONDAY": "https://auth.monday.com/oauth2/userinfo",
-		"LEVER":  "https://api.lever.co/v1/users?limit=1",
-		"DEEL":   "https://api.letsdeel.com/rest/v2/people?limit=1",
 	}
 )