rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Require CLIENT_SECRET for new access-review connectors → Drop Snyk, Ramp, Lever, Deel access-review providers

Browse Source 
- Require CLIENT_SECRET for new access-review connectors
- Use Heroku account UUID as ExternalID
- Bump GitHub orgs picker to per_page=100
- Drop Snyk, Ramp, Lever, Deel access-review providers

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
This commit is contained in:
Aurélien Sibiril
2026-05-17 17:22:50 +02:00
parent ceacaea34e
commit c2db47e698
40 changed files with 29 additions and 1367 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
pkg/connector/oauth2_test.go
View File

@@ -882,12 +882,12 @@ func TestGeneratePKCEVerifier(t *testing.T) {
}
// TestApplyProviderDefaults_PKCEDefaults asserts that the registered
// PAGERDUTY and SNYK provider defaults flip RequiresPKCE on so the
// downstream Initiate/Complete flow generates a verifier and replays it.
// PAGERDUTY provider defaults flip RequiresPKCE on so the downstream
// Initiate/Complete flow generates a verifier and replays it.
func TestApplyProviderDefaults_PKCEDefaults(t *testing.T) {
t.Parallel()
for _, provider := range []string{"PAGERDUTY", "SNYK"} {
for _, provider := range []string{"PAGERDUTY"} {
t.Run(provider, func(t *testing.T) {
t.Parallel()
@@ -899,31 +899,6 @@ func TestApplyProviderDefaults_PKCEDefaults(t *testing.T) {
}
}
// TestApplyProviderDefaults_TokenExtraParamsDeepCopy guards against the
// shared-map aliasing bug class. Two connectors using the same provider
// (LEVER carries a non-empty TokenExtraParams) must not share the
// underlying map; mutating one must not be observable on the other or
// in the package-level providerDefinitions.
func TestApplyProviderDefaults_TokenExtraParamsDeepCopy(t *testing.T) {
t.Parallel()
c1 := &OAuth2Connector{ClientID: "id1", ClientSecret: "s1"}
c2 := &OAuth2Connector{ClientID: "id2", ClientSecret: "s2"}
ApplyProviderDefaults("LEVER", "https://example.com/cb", c1)
ApplyProviderDefaults("LEVER", "https://example.com/cb", c2)
require.NotNil(t, c1.TokenExtraParams)
require.NotNil(t, c2.TokenExtraParams)
require.Equal(t, "https://api.lever.co/v1/", c1.TokenExtraParams["audience"])
c1.TokenExtraParams["sentinel"] = "mutated"
assert.NotContains(t, c2.TokenExtraParams, "sentinel",
"second connector must not see mutations on the first")
assert.NotContains(t, providerDefinitions["LEVER"].TokenExtraParams, "sentinel",
"shared providerDefinitions map must remain pristine")
}
// TestCompleteWithState_PKCEMismatch confirms that a token endpoint
// rejecting a stale or mismatched code_verifier (the standard PKCE
// failure path) surfaces as an error from CompleteWithState rather