Add Zendesk access-review connector

Zendesk is a multi-tenant OAuth connector keyed by the customer
subdomain. The customer enters it at connect time; it rides the signed
state to the callback, is re-validated, and is stored on the connector
settings to build the API host.

List staff (agents and admins) via GET /api/v2/users.json with cursor
pagination, mapping role, active/suspended, and 2FA status; end-users
are excluded. The subdomain is validated as a single DNS label at every
trust boundary to close the SSRF vector, and the data client keeps the
SSRF-protected transport.

Zendesk OAuth across customer subdomains requires a Zendesk-approved
global OAuth client; the connector goes live once those credentials are
supplied via bootstrap.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
This commit is contained in:
Aurélien Sibiril
2026-06-04 18:32:55 +02:00
parent 1c40121591
commit dbd920dc24
19 changed files with 891 additions and 14 deletions

View File

@@ -59,6 +59,7 @@ const (
ConnectorProviderCursor ConnectorProvider = "CURSOR"
ConnectorProviderDatadog ConnectorProvider = "DATADOG"
ConnectorProviderOkta ConnectorProvider = "OKTA"
ConnectorProviderZendesk ConnectorProvider = "ZENDESK"
)
var (
@@ -105,6 +106,7 @@ func ConnectorProviders() []ConnectorProvider {
ConnectorProviderCursor,
ConnectorProviderDatadog,
ConnectorProviderOkta,
ConnectorProviderZendesk,
}
}
@@ -146,7 +148,8 @@ func (v ConnectorProvider) IsValid() bool {
ConnectorProviderAnthropic,
ConnectorProviderCursor,
ConnectorProviderDatadog,
ConnectorProviderOkta:
ConnectorProviderOkta,
ConnectorProviderZendesk:
return true
}