Add Zendesk access-review connector

Zendesk is a multi-tenant OAuth connector keyed by the customer
subdomain. The customer enters it at connect time; it rides the signed
state to the callback, is re-validated, and is stored on the connector
settings to build the API host.

List staff (agents and admins) via GET /api/v2/users.json with cursor
pagination, mapping role, active/suspended, and 2FA status; end-users
are excluded. The subdomain is validated as a single DNS label at every
trust boundary to close the SSRF vector, and the data client keeps the
SSRF-protected transport.

Zendesk OAuth across customer subdomains requires a Zendesk-approved
global OAuth client; the connector goes live once those credentials are
supplied via bootstrap.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/coredata/connector_provider.go

@@ -59,6 +59,7 @@ const (
 	ConnectorProviderCursor       ConnectorProvider = "CURSOR"
 	ConnectorProviderDatadog      ConnectorProvider = "DATADOG"
 	ConnectorProviderOkta         ConnectorProvider = "OKTA"
+	ConnectorProviderZendesk      ConnectorProvider = "ZENDESK"
 )
 
 var (
@@ -105,6 +106,7 @@ func ConnectorProviders() []ConnectorProvider {
 		ConnectorProviderCursor,
 		ConnectorProviderDatadog,
 		ConnectorProviderOkta,
+		ConnectorProviderZendesk,
 	}
 }
 
@@ -146,7 +148,8 @@ func (v ConnectorProvider) IsValid() bool {
 		ConnectorProviderAnthropic,
 		ConnectorProviderCursor,
 		ConnectorProviderDatadog,
-		ConnectorProviderOkta:
+		ConnectorProviderOkta,
+		ConnectorProviderZendesk:
 		return true
 	}
 

pkg/coredata/connector_settings.go

@@ -122,6 +122,16 @@ type (
 	OktaConnectorSettings struct {
 		Domain string `json:"domain"`
 	}
+
+	// ZendeskConnectorSettings holds the per-customer Zendesk subdomain
+	// captured at connect time (the customer types it before the OAuth
+	// redirect, and it rides the signed state token to the callback —
+	// Zendesk does not echo it back). Subdomain is the <subdomain> part of
+	// <subdomain>.zendesk.com, used by the driver to build the API host and
+	// by the name resolver for the AccessSource title.
+	ZendeskConnectorSettings struct {
+		Subdomain string `json:"subdomain"`
+	}
 )
 
 // GrantType returns the OAuth2 grant type recorded on the connector's

pkg/coredata/migrations/20260604T372815Z.sql

@@ -0,0 +1,15 @@
+-- Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+--
+-- Permission to use, copy, modify, and/or distribute this software for any
+-- purpose with or without fee is hereby granted, provided that the above
+-- copyright notice and this permission notice appear in all copies.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+-- PERFORMANCE OF THIS SOFTWARE.
+
+ALTER TYPE connector_provider ADD VALUE IF NOT EXISTS 'ZENDESK';