Add Zendesk access-review connector

Zendesk is a multi-tenant OAuth connector keyed by the customer
subdomain. The customer enters it at connect time; it rides the signed
state to the callback, is re-validated, and is stored on the connector
settings to build the API host.

List staff (agents and admins) via GET /api/v2/users.json with cursor
pagination, mapping role, active/suspended, and 2FA status; end-users
are excluded. The subdomain is validated as a single DNS label at every
trust boundary to close the SSRF vector, and the data client keeps the
SSRF-protected transport.

Zendesk OAuth across customer subdomains requires a Zendesk-approved
global OAuth client; the connector goes live once those credentials are
supplied via bootstrap.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/accessreview/drivers/name_resolver.go

@@ -951,6 +951,23 @@ func (r *oktaNameResolver) ResolveInstanceName(ctx context.Context) (string, err
 	return resp.Subdomain, nil
 }
 
+// zendeskNameResolver returns the Zendesk subdomain stored in connector
+// settings (e.g. "acme" for acme.zendesk.com), captured at connect time. No
+// HTTP call is required; the AccessSource title becomes "Zendesk <subdomain>".
+// Account-name resolution is intentionally omitted to keep the scope to
+// users:read (Zendesk exposes no human account name on that scope).
+type zendeskNameResolver struct {
+	subdomain string
+}
+
+func NewZendeskNameResolver(subdomain string) NameResolver {
+	return &zendeskNameResolver{subdomain: subdomain}
+}
+
+func (r *zendeskNameResolver) ResolveInstanceName(_ context.Context) (string, error) {
+	return r.subdomain, nil
+}
+
 // asanaNameResolver resolves the Asana workspace name.
 type asanaNameResolver struct {
 	httpClient   *http.Client

pkg/accessreview/drivers/testdata/zendesk.yaml

@@ -0,0 +1,82 @@
+---
+version: 2
+interactions:
+    - id: 0
+      request:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        content_length: 0
+        transfer_encoding: []
+        trailer: {}
+        host: acme.zendesk.com
+        remote_addr: ""
+        request_uri: ""
+        body: ""
+        form:
+            page[size]:
+                - "100"
+            role[]:
+                - agent
+                - admin
+        headers:
+            Accept:
+                - application/json
+        url: https://acme.zendesk.com/api/v2/users.json?page%5Bsize%5D=100&role%5B%5D=agent&role%5B%5D=admin
+        method: GET
+      response:
+        proto: HTTP/2.0
+        proto_major: 2
+        proto_minor: 0
+        transfer_encoding: []
+        trailer: {}
+        content_length: -1
+        uncompressed: true
+        body: |
+            {
+              "users": [
+                {
+                  "id": 12345,
+                  "email": "alice@example.com",
+                  "name": "Alice Example",
+                  "role": "admin",
+                  "suspended": false,
+                  "active": true,
+                  "two_factor_auth_enabled": true,
+                  "last_login_at": "2025-06-01T10:00:00Z",
+                  "created_at": "2025-01-02T03:04:05Z"
+                },
+                {
+                  "id": 67890,
+                  "email": "bob@example.com",
+                  "name": "Bob Example",
+                  "role": "agent",
+                  "suspended": false,
+                  "active": true,
+                  "two_factor_auth_enabled": false,
+                  "last_login_at": null,
+                  "created_at": "2025-02-01T00:00:00Z"
+                },
+                {
+                  "id": 99999,
+                  "email": "carol@example.com",
+                  "name": "Carol Customer",
+                  "role": "end-user",
+                  "suspended": false,
+                  "active": true,
+                  "two_factor_auth_enabled": false,
+                  "last_login_at": null,
+                  "created_at": "2025-03-01T00:00:00Z"
+                }
+              ],
+              "meta": {
+                "has_more": false,
+                "after_cursor": null
+              }
+            }
+        headers:
+            Content-Type:
+                - application/json
+        status: 200 OK
+        code: 200
+        duration: 1ms

pkg/accessreview/drivers/zendesk.go

@@ -0,0 +1,218 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package drivers
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strconv"
+	"time"
+
+	"go.probo.inc/probo/pkg/coredata"
+)
+
+// ZendeskDriver lists a Zendesk account's staff (agents and admins) via GET
+// /api/v2/users.json. The API host is per-customer (<subdomain>.zendesk.com),
+// captured at connect time and stored on the connector settings. End-users
+// (ticket submitters) are excluded — they are customers, not access subjects.
+type ZendeskDriver struct {
+	httpClient *http.Client
+	subdomain  string // e.g. "acme" for acme.zendesk.com
+}
+
+var _ Driver = (*ZendeskDriver)(nil)
+
+// NewZendeskDriver wraps the connection's SSRF-protected transport with a
+// retrying transport for transient 5xx, matching the canonical sibling
+// drivers (datadog.go, heroku.go). The caller's *http.Client is not mutated.
+func NewZendeskDriver(httpClient *http.Client, subdomain string) *ZendeskDriver {
+	return &ZendeskDriver{
+		httpClient: &http.Client{
+			Transport: &retryRoundTripper{
+				next:       httpClient.Transport,
+				maxRetries: 3,
+			},
+		},
+		subdomain: subdomain,
+	}
+}
+
+const zendeskPageSize = 100
+
+type zendeskUser struct {
+	ID                   int64   `json:"id"`
+	Email                string  `json:"email"`
+	Name                 string  `json:"name"`
+	Role                 string  `json:"role"` // "end-user", "agent", "admin"
+	Suspended            bool    `json:"suspended"`
+	Active               bool    `json:"active"`
+	TwoFactorAuthEnabled *bool   `json:"two_factor_auth_enabled"`
+	LastLoginAt          *string `json:"last_login_at"`
+	CreatedAt            string  `json:"created_at"`
+}
+
+// zendeskUsersResponse is the GET /api/v2/users.json payload. Zendesk uses
+// cursor pagination: meta.has_more signals more pages and meta.after_cursor is
+// the token for the next page.
+type zendeskUsersResponse struct {
+	Users []zendeskUser `json:"users"`
+	Meta  struct {
+		HasMore     bool   `json:"has_more"`
+		AfterCursor string `json:"after_cursor"`
+	} `json:"meta"`
+}
+
+func (d *ZendeskDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error) {
+	var (
+		records     []AccountRecord
+		afterCursor string
+	)
+
+	for range maxPaginationPages {
+		resp, err := d.queryUsers(ctx, afterCursor)
+		if err != nil {
+			return nil, err
+		}
+
+		for _, u := range resp.Users {
+			// The query already filters to agents + admins, but guard here
+			// too: end-users are ticket submitters, not staff with access.
+			if u.Role == "end-user" {
+				continue
+			}
+
+			records = append(records, zendeskRecord(u))
+		}
+
+		if !resp.Meta.HasMore || resp.Meta.AfterCursor == "" {
+			return records, nil
+		}
+
+		afterCursor = resp.Meta.AfterCursor
+	}
+
+	return nil, fmt.Errorf("cannot list all zendesk users: %w", ErrPaginationLimitReached)
+}
+
+func zendeskRecord(u zendeskUser) AccountRecord {
+	active := u.Active && !u.Suspended
+	isAdmin := u.Role == "admin"
+
+	// Zendesk reports 2FA per user; map it to the MFA status. A null value
+	// (absent on some plans) stays unknown rather than asserting "disabled".
+	mfaStatus := coredata.MFAStatusUnknown
+
+	if u.TwoFactorAuthEnabled != nil {
+		if *u.TwoFactorAuthEnabled {
+			mfaStatus = coredata.MFAStatusEnabled
+		} else {
+			mfaStatus = coredata.MFAStatusDisabled
+		}
+	}
+
+	lastLogin := ""
+	if u.LastLoginAt != nil {
+		lastLogin = *u.LastLoginAt
+	}
+
+	return AccountRecord{
+		Email:     u.Email,
+		FullName:  u.Name,
+		Role:      zendeskRole(u.Role),
+		Active:    &active,
+		IsAdmin:   isAdmin,
+		MFAStatus: mfaStatus,
+		// Zendesk's users API does not expose the sign-in method
+		// (password / SSO / social), so the auth method is unknown.
+		AuthMethod:  coredata.AccessEntryAuthMethodUnknown,
+		AccountType: coredata.AccessEntryAccountTypeUser,
+		ExternalID:  strconv.FormatInt(u.ID, 10),
+		LastLogin:   parseZendeskTime(lastLogin),
+		CreatedAt:   parseZendeskTime(u.CreatedAt),
+	}
+}
+
+// zendeskRole title-cases the two staff roles for display; any other value
+// (custom role names) passes through unchanged.
+func zendeskRole(role string) string {
+	switch role {
+	case "admin":
+		return "Admin"
+	case "agent":
+		return "Agent"
+	default:
+		return role
+	}
+}
+
+func (d *ZendeskDriver) queryUsers(ctx context.Context, afterCursor string) (*zendeskUsersResponse, error) {
+	q := url.Values{}
+	q.Set("page[size]", strconv.Itoa(zendeskPageSize))
+	// Restrict to staff (agents + admins); end-users are ticket submitters.
+	q.Add("role[]", "agent")
+	q.Add("role[]", "admin")
+
+	if afterCursor != "" {
+		q.Set("page[after]", afterCursor)
+	}
+
+	endpoint := url.URL{
+		Scheme:   "https",
+		Host:     d.subdomain + ".zendesk.com",
+		Path:     "/api/v2/users.json",
+		RawQuery: q.Encode(),
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint.String(), nil)
+	if err != nil {
+		return nil, fmt.Errorf("cannot create zendesk users request: %w", err)
+	}
+
+	req.Header.Set("Accept", "application/json")
+
+	resp, err := d.httpClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("cannot list zendesk users: %w", err)
+	}
+
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("cannot list zendesk users: unexpected status %d", resp.StatusCode)
+	}
+
+	var out zendeskUsersResponse
+	if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
+		return nil, fmt.Errorf("cannot decode zendesk users response: %w", err)
+	}
+
+	return &out, nil
+}
+
+func parseZendeskTime(s string) *time.Time {
+	if s == "" {
+		return nil
+	}
+
+	t, err := time.Parse(time.RFC3339, s)
+	if err != nil {
+		return nil
+	}
+
+	return &t
+}

pkg/accessreview/drivers/zendesk_test.go

@@ -0,0 +1,93 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package drivers
+
+import (
+	"context"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/pkg/coredata"
+)
+
+func TestZendeskDriver(t *testing.T) {
+	t.Parallel()
+
+	rec := newRecorder(t, "testdata/zendesk", "ZENDESK_TOKEN")
+	client := newVCRClient(rec, bearerAuth(os.Getenv("ZENDESK_TOKEN")))
+
+	driver := NewZendeskDriver(client, "acme")
+	records, err := driver.ListAccounts(context.Background())
+	require.NoError(t, err)
+	// The page holds three users; the end-user (carol) is filtered out so
+	// only the two staff members remain.
+	assert.Len(t, records, 2)
+
+	r := records[0]
+	assert.Equal(t, "alice@example.com", r.Email)
+	assert.Equal(t, "Alice Example", r.FullName)
+	assert.Equal(t, "12345", r.ExternalID)
+	require.NotNil(t, r.Active)
+	assert.True(t, *r.Active)
+	assert.True(t, r.IsAdmin)
+	assert.Equal(t, "Admin", r.Role)
+	assert.Equal(t, coredata.AccessEntryAccountTypeUser, r.AccountType)
+	assert.Equal(t, coredata.MFAStatusEnabled, r.MFAStatus)
+	assert.Equal(t, coredata.AccessEntryAuthMethodUnknown, r.AuthMethod)
+	require.NotNil(t, r.LastLogin)
+	require.NotNil(t, r.CreatedAt)
+
+	// Second record exercises the agent (non-admin), MFA-disabled, and
+	// never-logged-in (null last_login_at) branches.
+	r2 := records[1]
+	assert.Equal(t, "bob@example.com", r2.Email)
+	assert.Equal(t, "67890", r2.ExternalID)
+	require.NotNil(t, r2.Active)
+	assert.True(t, *r2.Active)
+	assert.False(t, r2.IsAdmin)
+	assert.Equal(t, "Agent", r2.Role)
+	assert.Equal(t, coredata.MFAStatusDisabled, r2.MFAStatus)
+	assert.Nil(t, r2.LastLogin)
+}
+
+// TestZendeskRecord_FieldMapping covers the field-mapping edge cases that the
+// cassette does not: a null 2FA flag stays unknown (not "disabled"), a
+// suspended user is inactive even when active is true, and a custom role name
+// passes through verbatim.
+func TestZendeskRecord_FieldMapping(t *testing.T) {
+	t.Parallel()
+
+	rec := zendeskRecord(zendeskUser{
+		ID:        42,
+		Email:     "dana@example.com",
+		Name:      "Dana Example",
+		Role:      "Light agent",
+		Suspended: true,
+		Active:    true,
+	})
+
+	assert.Equal(t, "dana@example.com", rec.Email)
+	assert.Equal(t, "Dana Example", rec.FullName)
+	require.NotNil(t, rec.Active)
+	assert.False(t, *rec.Active, "a suspended user must be inactive")
+	assert.Equal(t, coredata.MFAStatusUnknown, rec.MFAStatus, "null 2FA must stay unknown")
+	assert.Equal(t, "Light agent", rec.Role, "custom role names pass through")
+	assert.False(t, rec.IsAdmin)
+	assert.Equal(t, "42", rec.ExternalID)
+	assert.Nil(t, rec.LastLogin)
+	assert.Nil(t, rec.CreatedAt)
+}