Add Zendesk access-review connector

Zendesk is a multi-tenant OAuth connector keyed by the customer
subdomain. The customer enters it at connect time; it rides the signed
state to the callback, is re-validated, and is stored on the connector
settings to build the API host.

List staff (agents and admins) via GET /api/v2/users.json with cursor
pagination, mapping role, active/suspended, and 2FA status; end-users
are excluded. The subdomain is validated as a single DNS label at every
trust boundary to close the SSRF vector, and the data client keeps the
SSRF-protected transport.

Zendesk OAuth across customer subdomains requires a Zendesk-approved
global OAuth client; the connector goes live once those credentials are
supplied via bootstrap.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/connector/oauth2_test.go

@@ -858,6 +858,133 @@ func TestCompleteWithState_InvalidDomainRejected(t *testing.T) {
 	require.Error(t, err)
 }
 
+// TestInitiateWithState_PersistsSiteInState verifies that opts.Site is signed
+// into the state token so it survives the round-trip to the callback — the
+// mechanism multi-site providers (e.g. Zendesk) rely on when the provider does
+// not echo the host back.
+func TestInitiateWithState_PersistsSiteInState(t *testing.T) {
+	t.Parallel()
+
+	c := &OAuth2Connector{
+		ClientID:     "cid",
+		ClientSecret: "secret",
+		RedirectURI:  "https://probo.example/cb",
+		BuildAuthURLForSite: func(site string) (string, error) {
+			return "https://" + site + ".zendesk.com/oauth/authorizations/new", nil
+		},
+	}
+
+	authURL, err := c.InitiateWithState(context.Background(),
+		OAuth2State{OrganizationID: "org", Provider: ZendeskProvider},
+		InitiateOptions{Site: "acme"},
+	)
+	require.NoError(t, err)
+
+	u, err := url.Parse(authURL)
+	require.NoError(t, err)
+	assert.Equal(t, "acme.zendesk.com", u.Host)
+
+	payload, err := DecodeOAuth2StatePayload(u.Query().Get("state"))
+	require.NoError(t, err)
+	assert.Equal(t, "acme", payload.Data.Site)
+}
+
+// TestCompleteWithState_PerSiteTokenURL exercises the site-carried-in-state
+// token-URL path: the subdomain comes from the signed state (no callback
+// param), and the per-connection token URL is persisted for refresh.
+func TestCompleteWithState_PerSiteTokenURL(t *testing.T) {
+	t.Parallel()
+
+	var gotPath string
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotPath = r.URL.Path
+
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"access_token":"at","token_type":"Bearer"}`))
+	}))
+	defer srv.Close()
+
+	c := &OAuth2Connector{
+		ClientID:     "cid",
+		ClientSecret: "secret",
+		RedirectURI:  "https://probo.example/cb",
+		HTTPClient:   httpclient.DefaultClient(httpclient.WithSSRFProtection(), httpclient.WithSSRFAllowLoopback()),
+		BuildTokenURLForSite: func(site string) (string, error) {
+			if site != "acme" {
+				return "", fmt.Errorf("unknown site")
+			}
+
+			return srv.URL + "/oauth/tokens", nil
+		},
+	}
+
+	state, err := statelesstoken.NewToken(c.ClientSecret, OAuth2TokenType, OAuth2TokenTTL,
+		OAuth2State{OrganizationID: validOrgGID(t), Provider: ZendeskProvider, Site: "acme"})
+	require.NoError(t, err)
+
+	req := httptest.NewRequest(http.MethodGet,
+		"https://probo.example/cb?code=abc&state="+state, nil)
+
+	conn, _, err := c.CompleteWithState(context.Background(), req)
+	require.NoError(t, err)
+	assert.Equal(t, "/oauth/tokens", gotPath)
+
+	oc, ok := conn.(*OAuth2Connection)
+	require.True(t, ok)
+	assert.Equal(t, srv.URL+"/oauth/tokens", oc.TokenURL)
+}
+
+// TestCompleteWithState_MissingSiteForSiteTokenURL ensures a multi-site
+// provider whose state carries no site fails before any credential POST.
+func TestCompleteWithState_MissingSiteForSiteTokenURL(t *testing.T) {
+	t.Parallel()
+
+	c := &OAuth2Connector{
+		ClientID:             "cid",
+		ClientSecret:         "secret",
+		RedirectURI:          "https://probo.example/cb",
+		HTTPClient:           httpclient.DefaultClient(httpclient.WithSSRFProtection(), httpclient.WithSSRFAllowLoopback()),
+		BuildTokenURLForSite: func(string) (string, error) { return "", fmt.Errorf("unused") },
+	}
+
+	state, err := statelesstoken.NewToken(c.ClientSecret, OAuth2TokenType, OAuth2TokenTTL,
+		OAuth2State{OrganizationID: validOrgGID(t), Provider: ZendeskProvider})
+	require.NoError(t, err)
+
+	req := httptest.NewRequest(http.MethodGet,
+		"https://probo.example/cb?code=abc&state="+state, nil)
+
+	_, _, err = c.CompleteWithState(context.Background(), req)
+	require.Error(t, err)
+}
+
+// TestCompleteWithState_InvalidSiteRejected exercises the SSRF guard on the
+// site-in-state path: a signed state carrying a malformed subdomain must fail
+// (ZendeskTokenURL rejects it) before any credential POST. Mirrors
+// TestCompleteWithState_InvalidDomainRejected for Datadog.
+func TestCompleteWithState_InvalidSiteRejected(t *testing.T) {
+	t.Parallel()
+
+	c := &OAuth2Connector{
+		ClientID:             "cid",
+		ClientSecret:         "secret",
+		RedirectURI:          "https://probo.example/cb",
+		HTTPClient:           httpclient.DefaultClient(httpclient.WithSSRFProtection(), httpclient.WithSSRFAllowLoopback()),
+		BuildTokenURLForSite: ZendeskTokenURL,
+	}
+
+	state, err := statelesstoken.NewToken(c.ClientSecret, OAuth2TokenType, OAuth2TokenTTL,
+		OAuth2State{OrganizationID: validOrgGID(t), Provider: ZendeskProvider, Site: "evil.example"})
+	require.NoError(t, err)
+
+	req := httptest.NewRequest(http.MethodGet,
+		"https://probo.example/cb?code=abc&state="+state, nil)
+
+	_, _, err = c.CompleteWithState(context.Background(), req)
+	require.Error(t, err)
+}
+
 func TestRefreshableClient_PrefersConnectionTokenURL(t *testing.T) {
 	t.Parallel()
 

pkg/connector/provider/apply_test.go

@@ -152,3 +152,37 @@ func TestApplyOAuth2Defaults_CopiesSiteClosures(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, "https://api.us3.datadoghq.com/oauth2/v1/token", tokenURL)
 }
+
+// TestApplyOAuth2Defaults_CopiesTokenURLForSiteClosure verifies the
+// site-carried-in-state token-URL closure (BuildTokenURLForSite) is copied
+// from the Registration onto the OAuth2Connector — the Zendesk shape, where
+// both the authorize and token hosts are the customer subdomain.
+func TestApplyOAuth2Defaults_CopiesTokenURLForSiteClosure(t *testing.T) {
+	t.Parallel()
+
+	r := provider.NewRegistry()
+	require.NoError(t, r.Register(&provider.Registration{
+		Provider:             coredata.ConnectorProviderZendesk,
+		DisplayName:          "Zendesk",
+		OAuth2Scopes:         []string{"users:read"},
+		BuildAuthURLForSite:  connector.ZendeskAuthorizeURL,
+		BuildTokenURLForSite: connector.ZendeskTokenURL,
+		NewDriver: func(context.Context, *http.Client, *coredata.Connector, *log.Logger) (drivers.Driver, error) {
+			return nil, nil
+		},
+	}))
+
+	var c connector.OAuth2Connector
+	require.NoError(t, r.ApplyOAuth2Defaults("ZENDESK", "https://probo.example/cb", &c))
+	require.NotNil(t, c.BuildAuthURLForSite)
+	require.NotNil(t, c.BuildTokenURLForSite)
+	require.Nil(t, c.BuildTokenURLForDomain)
+
+	authURL, err := c.BuildAuthURLForSite("acme")
+	require.NoError(t, err)
+	assert.Equal(t, "https://acme.zendesk.com/oauth/authorizations/new", authURL)
+
+	tokenURL, err := c.BuildTokenURLForSite("acme")
+	require.NoError(t, err)
+	assert.Equal(t, "https://acme.zendesk.com/oauth/tokens", tokenURL)
+}

pkg/connector/provider/builtin.go

@@ -58,6 +58,7 @@ func NewBuiltinRegistry() *Registry {
 		tailscaleRegistration(),
 		tallyRegistration(),
 		vercelRegistration(),
+		zendeskRegistration(),
 	} {
 		if err := r.Register(reg); err != nil {
 			panic(err)

pkg/connector/provider/zendesk.go

@@ -0,0 +1,75 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package provider
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+
+	"go.gearno.de/kit/log"
+	"go.probo.inc/probo/pkg/accessreview/drivers"
+	"go.probo.inc/probo/pkg/connector"
+	"go.probo.inc/probo/pkg/coredata"
+)
+
+func zendeskRegistration() *Registration {
+	// Zendesk is multi-tenant via per-customer subdomain
+	// (<subdomain>.zendesk.com). The subdomain is collected at initiate (the
+	// customer types it; it drives the authorize host) and rides the signed
+	// OAuth state to the callback, where it builds the token host and is
+	// persisted on the connector settings for the driver's API host. Unlike
+	// Datadog, Zendesk does NOT echo a host back on the callback, so
+	// BuildTokenURLForSite reads the subdomain from the state rather than a
+	// query param. AuthURL, TokenURL, and ProbeURL are therefore empty: the
+	// closures build the per-customer hosts, and a static probe URL is
+	// impossible for a per-subdomain host (an empty probe is skipped; a dead
+	// token surfaces on the first ListAccounts). The global confidential
+	// client carries a client_secret, which both authenticates the token
+	// exchange (default post-form) and signs the state.
+	return &Registration{
+		Provider:             coredata.ConnectorProviderZendesk,
+		DisplayName:          "Zendesk",
+		OAuth2Scopes:         []string{"users:read"},
+		BuildAuthURLForSite:  connector.ZendeskAuthorizeURL,
+		BuildTokenURLForSite: connector.ZendeskTokenURL,
+		NewDriver: func(_ context.Context, c *http.Client, conn *coredata.Connector, _ *log.Logger) (drivers.Driver, error) {
+			s, err := coredata.ConnectorSettings[coredata.ZendeskConnectorSettings](conn)
+			if err != nil {
+				return nil, fmt.Errorf("cannot read zendesk connector settings: %w", err)
+			}
+
+			// Re-validate the stored subdomain at the construction site
+			// (defense-in-depth). The OAuth callback validates on write, but
+			// pinning the SSRF invariant here keeps the driver safe regardless
+			// of how the connector row was populated. An empty subdomain also
+			// fails this check.
+			if !connector.IsValidZendeskSubdomain(s.Subdomain) {
+				return nil, fmt.Errorf("cannot create zendesk driver: invalid or missing subdomain")
+			}
+
+			return drivers.NewZendeskDriver(c, s.Subdomain), nil
+		},
+		NewNameResolver: func(ctx context.Context, _ *http.Client, conn *coredata.Connector, logger *log.Logger) drivers.NameResolver {
+			s, err := coredata.ConnectorSettings[coredata.ZendeskConnectorSettings](conn)
+			if err != nil {
+				logger.ErrorCtx(ctx, "cannot read zendesk connector settings", log.Error(err))
+				return nil
+			}
+
+			return drivers.NewZendeskNameResolver(s.Subdomain)
+		},
+	}
+}

pkg/connector/zendesk.go

@@ -0,0 +1,79 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package connector
+
+import (
+	"fmt"
+	"net/url"
+)
+
+const ZendeskProvider = "ZENDESK"
+
+// IsValidZendeskSubdomain reports whether s is a single DNS label safe to use
+// as the host component of <subdomain>.zendesk.com. The subdomain is
+// customer-supplied and feeds a URL host on every authorize, token, and API
+// request, so it MUST be validated before use to close an SSRF vector: only
+// ASCII letters, digits, and interior hyphens are allowed (no dots, slashes,
+// colons, '@', or whitespace that could escape the host position), bounded to
+// a 63-character DNS label. DNS is case-insensitive, so mixed case is accepted
+// and used verbatim.
+func IsValidZendeskSubdomain(s string) bool {
+	if len(s) == 0 || len(s) > 63 {
+		return false
+	}
+
+	// i is a byte offset; because every accepted character is single-byte
+	// ASCII, i equals the character position, so the i < len(s)-1 bound below
+	// correctly identifies the final character. A non-ASCII rune falls through
+	// to the default case and is rejected before that assumption matters.
+	for i, c := range s {
+		switch {
+		case c >= 'a' && c <= 'z':
+		case c >= 'A' && c <= 'Z':
+		case c >= '0' && c <= '9':
+		case c == '-' && i > 0 && i < len(s)-1:
+		default:
+			return false
+		}
+	}
+
+	return true
+}
+
+// ZendeskAuthorizeURL returns the OAuth2 authorize endpoint for a Zendesk
+// customer subdomain (e.g. "acme"). It errors on any subdomain that is not a
+// valid single DNS label.
+func ZendeskAuthorizeURL(subdomain string) (string, error) {
+	if !IsValidZendeskSubdomain(subdomain) {
+		return "", fmt.Errorf("cannot build authorize URL: invalid zendesk subdomain")
+	}
+
+	u := url.URL{Scheme: "https", Host: subdomain + ".zendesk.com", Path: "/oauth/authorizations/new"}
+
+	return u.String(), nil
+}
+
+// ZendeskTokenURL returns the OAuth2 token endpoint for a Zendesk customer
+// subdomain (e.g. "acme"). It errors on any subdomain that is not a valid
+// single DNS label.
+func ZendeskTokenURL(subdomain string) (string, error) {
+	if !IsValidZendeskSubdomain(subdomain) {
+		return "", fmt.Errorf("cannot build token URL: invalid zendesk subdomain")
+	}
+
+	u := url.URL{Scheme: "https", Host: subdomain + ".zendesk.com", Path: "/oauth/tokens"}
+
+	return u.String(), nil
+}

pkg/connector/zendesk_test.go

@@ -0,0 +1,81 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package connector_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/pkg/connector"
+)
+
+func TestZendeskAuthorizeURL(t *testing.T) {
+	t.Parallel()
+
+	got, err := connector.ZendeskAuthorizeURL("acme")
+	require.NoError(t, err)
+	assert.Equal(t, "https://acme.zendesk.com/oauth/authorizations/new", got)
+
+	// An invalid subdomain must error rather than build a host.
+	_, err = connector.ZendeskAuthorizeURL("evil.example")
+	require.Error(t, err)
+}
+
+func TestZendeskTokenURL(t *testing.T) {
+	t.Parallel()
+
+	got, err := connector.ZendeskTokenURL("acme")
+	require.NoError(t, err)
+	assert.Equal(t, "https://acme.zendesk.com/oauth/tokens", got)
+
+	_, err = connector.ZendeskTokenURL("acme/../evil")
+	require.Error(t, err)
+}
+
+// TestIsValidZendeskSubdomain exercises the SSRF guard that gates every Zendesk
+// URL host. Anything that could escape the host position of
+// <subdomain>.zendesk.com must be rejected.
+func TestIsValidZendeskSubdomain(t *testing.T) {
+	t.Parallel()
+
+	for _, s := range []string{
+		"acme",
+		"my-company",
+		"a",                     // single label
+		"ABC123",                // DNS is case-insensitive
+		"a--b",                  // interior double hyphen is allowed
+		strings.Repeat("a", 63), // max DNS label length
+	} {
+		assert.True(t, connector.IsValidZendeskSubdomain(s), s)
+	}
+
+	for _, s := range []string{
+		"",                      // empty
+		strings.Repeat("a", 64), // one over the 63-char label cap
+		"-acme",                 // leading hyphen
+		"acme-",                 // trailing hyphen
+		"acme.evil",             // dot — would add a host segment
+		"acme/evil",             // slash — path escape
+		"acme:1234",             // colon — port/authority escape
+		"acme@evil",             // userinfo escape
+		"acme evil",             // whitespace
+		"acme_evil",             // underscore is not a DNS label char
+		"acmé",                  // non-ASCII
+	} {
+		assert.False(t, connector.IsValidZendeskSubdomain(s), s)
+	}
+}