Add Zendesk access-review connector

Zendesk is a multi-tenant OAuth connector keyed by the customer
subdomain. The customer enters it at connect time; it rides the signed
state to the callback, is re-validated, and is stored on the connector
settings to build the API host.

List staff (agents and admins) via GET /api/v2/users.json with cursor
pagination, mapping role, active/suspended, and 2FA status; end-users
are excluded. The subdomain is validated as a single DNS label at every
trust boundary to close the SSRF vector, and the data client keeps the
SSRF-protected transport.

Zendesk OAuth across customer subdomains requires a Zendesk-approved
global OAuth client; the connector goes live once those credentials are
supplied via bootstrap.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/connector/provider/apply_test.go

@@ -152,3 +152,37 @@ func TestApplyOAuth2Defaults_CopiesSiteClosures(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, "https://api.us3.datadoghq.com/oauth2/v1/token", tokenURL)
 }
+
+// TestApplyOAuth2Defaults_CopiesTokenURLForSiteClosure verifies the
+// site-carried-in-state token-URL closure (BuildTokenURLForSite) is copied
+// from the Registration onto the OAuth2Connector — the Zendesk shape, where
+// both the authorize and token hosts are the customer subdomain.
+func TestApplyOAuth2Defaults_CopiesTokenURLForSiteClosure(t *testing.T) {
+	t.Parallel()
+
+	r := provider.NewRegistry()
+	require.NoError(t, r.Register(&provider.Registration{
+		Provider:             coredata.ConnectorProviderZendesk,
+		DisplayName:          "Zendesk",
+		OAuth2Scopes:         []string{"users:read"},
+		BuildAuthURLForSite:  connector.ZendeskAuthorizeURL,
+		BuildTokenURLForSite: connector.ZendeskTokenURL,
+		NewDriver: func(context.Context, *http.Client, *coredata.Connector, *log.Logger) (drivers.Driver, error) {
+			return nil, nil
+		},
+	}))
+
+	var c connector.OAuth2Connector
+	require.NoError(t, r.ApplyOAuth2Defaults("ZENDESK", "https://probo.example/cb", &c))
+	require.NotNil(t, c.BuildAuthURLForSite)
+	require.NotNil(t, c.BuildTokenURLForSite)
+	require.Nil(t, c.BuildTokenURLForDomain)
+
+	authURL, err := c.BuildAuthURLForSite("acme")
+	require.NoError(t, err)
+	assert.Equal(t, "https://acme.zendesk.com/oauth/authorizations/new", authURL)
+
+	tokenURL, err := c.BuildTokenURLForSite("acme")
+	require.NoError(t, err)
+	assert.Equal(t, "https://acme.zendesk.com/oauth/tokens", tokenURL)
+}

pkg/connector/provider/builtin.go

@@ -58,6 +58,7 @@ func NewBuiltinRegistry() *Registry {
 		tailscaleRegistration(),
 		tallyRegistration(),
 		vercelRegistration(),
+		zendeskRegistration(),
 	} {
 		if err := r.Register(reg); err != nil {
 			panic(err)

pkg/connector/provider/zendesk.go

@@ -0,0 +1,75 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package provider
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+
+	"go.gearno.de/kit/log"
+	"go.probo.inc/probo/pkg/accessreview/drivers"
+	"go.probo.inc/probo/pkg/connector"
+	"go.probo.inc/probo/pkg/coredata"
+)
+
+func zendeskRegistration() *Registration {
+	// Zendesk is multi-tenant via per-customer subdomain
+	// (<subdomain>.zendesk.com). The subdomain is collected at initiate (the
+	// customer types it; it drives the authorize host) and rides the signed
+	// OAuth state to the callback, where it builds the token host and is
+	// persisted on the connector settings for the driver's API host. Unlike
+	// Datadog, Zendesk does NOT echo a host back on the callback, so
+	// BuildTokenURLForSite reads the subdomain from the state rather than a
+	// query param. AuthURL, TokenURL, and ProbeURL are therefore empty: the
+	// closures build the per-customer hosts, and a static probe URL is
+	// impossible for a per-subdomain host (an empty probe is skipped; a dead
+	// token surfaces on the first ListAccounts). The global confidential
+	// client carries a client_secret, which both authenticates the token
+	// exchange (default post-form) and signs the state.
+	return &Registration{
+		Provider:             coredata.ConnectorProviderZendesk,
+		DisplayName:          "Zendesk",
+		OAuth2Scopes:         []string{"users:read"},
+		BuildAuthURLForSite:  connector.ZendeskAuthorizeURL,
+		BuildTokenURLForSite: connector.ZendeskTokenURL,
+		NewDriver: func(_ context.Context, c *http.Client, conn *coredata.Connector, _ *log.Logger) (drivers.Driver, error) {
+			s, err := coredata.ConnectorSettings[coredata.ZendeskConnectorSettings](conn)
+			if err != nil {
+				return nil, fmt.Errorf("cannot read zendesk connector settings: %w", err)
+			}
+
+			// Re-validate the stored subdomain at the construction site
+			// (defense-in-depth). The OAuth callback validates on write, but
+			// pinning the SSRF invariant here keeps the driver safe regardless
+			// of how the connector row was populated. An empty subdomain also
+			// fails this check.
+			if !connector.IsValidZendeskSubdomain(s.Subdomain) {
+				return nil, fmt.Errorf("cannot create zendesk driver: invalid or missing subdomain")
+			}
+
+			return drivers.NewZendeskDriver(c, s.Subdomain), nil
+		},
+		NewNameResolver: func(ctx context.Context, _ *http.Client, conn *coredata.Connector, logger *log.Logger) drivers.NameResolver {
+			s, err := coredata.ConnectorSettings[coredata.ZendeskConnectorSettings](conn)
+			if err != nil {
+				logger.ErrorCtx(ctx, "cannot read zendesk connector settings", log.Error(err))
+				return nil
+			}
+
+			return drivers.NewZendeskNameResolver(s.Subdomain)
+		},
+	}
+}