Consolidate connector provider dispatch behind a typed *Registry

The console previously dispatched per-provider logic through a fan of
init()-side-effect maps (driver names, OAuth2 metadata, probe URLs,
display names, settings switches), spread across pkg/connector,
pkg/accessreview/drivers and the console v1 resolvers. Adding a new
provider required edits in every one of those places and a corresponding
switch arm in CreateConnectorRequest. The same per-provider knowledge
also leaked into Helm templates as hand-rolled environment-variable
blocks per connector.

This commit collapses the dispatch surface into a single typed
*provider.Registry. The registry is constructed once by
NewBuiltinRegistry at probod startup and threaded as an explicit
dependency into every consumer (accessreview service, console v1
resolver, OAuth2 wiring). There is no package-level state. Each
provider lives in one file under pkg/connector/provider/ that exposes
a private xxxRegistration() *Registration constructor; NewBuiltinRegistry
enumerates them.

CreateConnectorRequest loses its per-provider settings fields and
takes a single RawSettings json.RawMessage produced by the
per-provider MarshalSettings closure. The 1Password SCIM bridge URL
is validated at create time (http(s) scheme + non-empty host) so a
malformed value fails fast at the resolver boundary. The Helm chart
gains probo.connectorEnv and probo.connectorSecretEntries templates
so adding a connector requires zero Helm changes. Access-review name
resolution moves into the same Registration value to keep one
authoritative dispatch table.

Tests cover every Registration (DisplayName, NewDriver wired),
Register error paths (nil, empty Provider, empty DisplayName,
duplicate), All / ProviderDisplayName / ProviderOAuth2Scopes /
ProbeURL hit and miss paths, the ApplyOAuth2Defaults templating and
PKCE branches, and ConnectorSettings[T] round-trip plus malformed-JSON
error path. The pre-refactor ApplyProviderDefaults test in
pkg/connector is replaced by the equivalent in
pkg/connector/provider.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/accessreview/access_source_service.go

@@ -22,6 +22,7 @@ import (
 
 	"go.gearno.de/kit/pg"
 	"go.probo.inc/probo/pkg/connector"
+	"go.probo.inc/probo/pkg/connector/provider"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/crypto/cipher"
 	"go.probo.inc/probo/pkg/gid"
@@ -39,6 +40,7 @@ type (
 		scope             coredata.Scoper
 		encryptionKey     cipher.EncryptionKey
 		connectorRegistry *connector.ConnectorRegistry
+		providerRegistry  *provider.Registry
 	}
 
 	CreateAccessSourceRequest struct {
@@ -383,75 +385,15 @@ func (s AccessSourceService) ConfigureAccessSource(
 				return fmt.Errorf("cannot load connector: %w", err)
 			}
 
-			switch dbConnector.Provider {
-			case coredata.ConnectorProviderGitHub:
-				if err := dbConnector.SetSettings(
-					&coredata.GitHubConnectorSettings{
-						Organization: req.OrganizationSlug,
-					},
-				); err != nil {
-					return fmt.Errorf("cannot set github settings: %w", err)
-				}
-			case coredata.ConnectorProviderSentry:
-				if err := dbConnector.SetSettings(
-					&coredata.SentryConnectorSettings{
-						OrganizationSlug: req.OrganizationSlug,
-					},
-				); err != nil {
-					return fmt.Errorf("cannot set sentry settings: %w", err)
-				}
-			case coredata.ConnectorProviderGitLab:
-				if err := dbConnector.SetSettings(
-					&coredata.GitLabConnectorSettings{
-						GroupID: req.OrganizationSlug,
-					},
-				); err != nil {
-					return fmt.Errorf("cannot set gitlab settings: %w", err)
-				}
-			case coredata.ConnectorProviderBitbucket:
-				if err := dbConnector.SetSettings(
-					&coredata.BitbucketConnectorSettings{
-						Workspace: req.OrganizationSlug,
-					},
-				); err != nil {
-					return fmt.Errorf("cannot set bitbucket settings: %w", err)
-				}
-			case coredata.ConnectorProviderHeroku:
-				if err := dbConnector.SetSettings(
-					&coredata.HerokuConnectorSettings{
-						TeamID: req.OrganizationSlug,
-					},
-				); err != nil {
-					return fmt.Errorf("cannot set heroku settings: %w", err)
-				}
-			case coredata.ConnectorProviderAsana:
-				if err := dbConnector.SetSettings(
-					&coredata.AsanaConnectorSettings{
-						WorkspaceGID: req.OrganizationSlug,
-					},
-				); err != nil {
-					return fmt.Errorf("cannot set asana settings: %w", err)
-				}
-			case coredata.ConnectorProviderNetlify:
-				if err := dbConnector.SetSettings(
-					&coredata.NetlifyConnectorSettings{
-						AccountSlug: req.OrganizationSlug,
-					},
-				); err != nil {
-					return fmt.Errorf("cannot set netlify settings: %w", err)
-				}
-			case coredata.ConnectorProviderClickUp:
-				if err := dbConnector.SetSettings(
-					&coredata.ClickUpConnectorSettings{
-						TeamID: req.OrganizationSlug,
-					},
-				); err != nil {
-					return fmt.Errorf("cannot set clickup settings: %w", err)
-				}
-			default:
+			reg, ok := s.providerRegistry.Get(dbConnector.Provider)
+			if !ok || reg.SetOrganizationSettings == nil {
 				return fmt.Errorf("cannot configure access source: provider %s does not support organization configuration", dbConnector.Provider)
 			}
 
+			if err := reg.SetOrganizationSettings(dbConnector, req.OrganizationSlug); err != nil {
+				return fmt.Errorf("cannot set %s settings: %w", dbConnector.Provider, err)
+			}
+
 			dbConnector.UpdatedAt = time.Now()
 
 			if err := dbConnector.Update(ctx, conn, s.scope, s.encryptionKey); err != nil {

pkg/accessreview/drivers/name_resolver.go

@@ -23,7 +23,6 @@ import (
 	"net/url"
 
 	"go.probo.inc/probo/pkg/connector"
-	"go.probo.inc/probo/pkg/coredata"
 	admin "google.golang.org/api/admin/directory/v1"
 	"google.golang.org/api/option"
 )
@@ -34,44 +33,6 @@ type NameResolver interface {
 	ResolveInstanceName(ctx context.Context) (string, error)
 }
 
-var providerDisplayNames = map[coredata.ConnectorProvider]string{
-	coredata.ConnectorProviderSlack:           "Slack",
-	coredata.ConnectorProviderGoogleWorkspace: "Google Workspace",
-	coredata.ConnectorProviderLinear:          "Linear",
-	coredata.ConnectorProviderOnePassword:     "1Password",
-	coredata.ConnectorProviderHubSpot:         "HubSpot",
-	coredata.ConnectorProviderDocuSign:        "DocuSign",
-	coredata.ConnectorProviderNotion:          "Notion",
-	coredata.ConnectorProviderBrex:            "Brex",
-	coredata.ConnectorProviderTally:           "Tally",
-	coredata.ConnectorProviderCloudflare:      "Cloudflare",
-	coredata.ConnectorProviderOpenAI:          "OpenAI",
-	coredata.ConnectorProviderSentry:          "Sentry",
-	coredata.ConnectorProviderSupabase:        "Supabase",
-	coredata.ConnectorProviderGitHub:          "GitHub",
-	coredata.ConnectorProviderIntercom:        "Intercom",
-	coredata.ConnectorProviderResend:          "Resend",
-	coredata.ConnectorProviderMicrosoft365:    "Microsoft 365",
-	coredata.ConnectorProviderGitLab:          "GitLab",
-	coredata.ConnectorProviderBitbucket:       "Bitbucket",
-	coredata.ConnectorProviderHeroku:          "Heroku",
-	coredata.ConnectorProviderPagerDuty:       "PagerDuty",
-	coredata.ConnectorProviderAsana:           "Asana",
-	coredata.ConnectorProviderNetlify:         "Netlify",
-	coredata.ConnectorProviderClickUp:         "ClickUp",
-	coredata.ConnectorProviderVercel:          "Vercel",
-	coredata.ConnectorProviderMonday:          "Monday.com",
-}
-
-// ProviderDisplayName returns the human-readable label for a connector provider.
-func ProviderDisplayName(provider coredata.ConnectorProvider) string {
-	if name, ok := providerDisplayNames[provider]; ok {
-		return name
-	}
-
-	return string(provider)
-}
-
 // slackNameResolver resolves the Slack workspace name via auth.test.
 type slackNameResolver struct {
 	httpClient *http.Client

pkg/accessreview/drivers/oauth2_scopes.go

@@ -1,63 +0,0 @@
-// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
-//
-// Permission to use, copy, modify, and/or distribute this software for any
-// purpose with or without fee is hereby granted, provided that the above
-// copyright notice and this permission notice appear in all copies.
-//
-// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
-// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
-// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
-// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-// PERFORMANCE OF THIS SOFTWARE.
-
-package drivers
-
-import "go.probo.inc/probo/pkg/coredata"
-
-// providerOAuth2Scopes maps each access review provider to the OAuth2 scopes
-// the corresponding driver requires to list user accounts. The map is the
-// single source of truth for access-review OAuth2 scopes — surfaced via
-// GraphQL so the frontend never hardcodes scope strings.
-var providerOAuth2Scopes = map[coredata.ConnectorProvider][]string{
-	coredata.ConnectorProviderHubSpot:  {"settings.users.read"},
-	coredata.ConnectorProviderGitHub:   {"read:org"},
-	coredata.ConnectorProviderSentry:   {"org:read", "member:read"},
-	coredata.ConnectorProviderBrex:     {"openid", "offline_access"},
-	coredata.ConnectorProviderDocuSign: {"signature"},
-	coredata.ConnectorProviderLinear:   {"read"},
-	coredata.ConnectorProviderSlack:    {"users:read", "users:read.email"},
-	coredata.ConnectorProviderGoogleWorkspace: {
-		"https://www.googleapis.com/auth/admin.directory.user.readonly",
-		"https://www.googleapis.com/auth/admin.directory.group.member.readonly",
-		"https://www.googleapis.com/auth/admin.directory.customer.readonly",
-	},
-	coredata.ConnectorProviderMicrosoft365: {
-		"openid",
-		"profile",
-		"offline_access",
-		"https://graph.microsoft.com/User.Read.All",
-		"https://graph.microsoft.com/Directory.Read.All",
-		"https://graph.microsoft.com/RoleManagement.Read.Directory",
-	},
-	coredata.ConnectorProviderGitLab:    {"read_api"},
-	coredata.ConnectorProviderHeroku:    {"read"},
-	coredata.ConnectorProviderPagerDuty: {"users.read"},
-	coredata.ConnectorProviderAsana:     {"workspaces:read", "users:read"},
-	coredata.ConnectorProviderMonday:    {"users:read", "account:read"},
-	// Notion and Intercom have no scopes here: Notion authorizes via
-	// extra-auth-params (owner=user), Intercom configures scopes at the app
-	// level. Bitbucket scopes are pinned on the OAuth consumer at
-	// registration time, not passed via the authorize URL. Netlify and
-	// ClickUp OAuth flows have no scope granularity, so they are also
-	// omitted. Vercel pins capabilities on the integration registration
-	// in the Vercel dashboard, so no scopes are passed here.
-}
-
-// ProviderOAuth2Scopes returns the OAuth2 scopes the access review driver
-// for the given provider needs. Returns nil for providers that do not need
-// any scopes (Notion, Intercom) or for non-access-review providers.
-func ProviderOAuth2Scopes(provider coredata.ConnectorProvider) []string {
-	return providerOAuth2Scopes[provider]
-}

pkg/accessreview/review_engine.go

@@ -26,6 +26,7 @@ import (
 	"go.gearno.de/kit/pg"
 	"go.probo.inc/probo/pkg/accessreview/drivers"
 	"go.probo.inc/probo/pkg/connector"
+	"go.probo.inc/probo/pkg/connector/provider"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/crypto/cipher"
 	"go.probo.inc/probo/pkg/gid"
@@ -38,6 +39,7 @@ type ReviewEngine struct {
 	scope             coredata.Scoper
 	encryptionKey     cipher.EncryptionKey
 	connectorRegistry *connector.ConnectorRegistry
+	providerRegistry  *provider.Registry
 	logger            *log.Logger
 }
 
@@ -46,6 +48,7 @@ func NewReviewEngine(
 	scope coredata.Scoper,
 	encryptionKey cipher.EncryptionKey,
 	connectorRegistry *connector.ConnectorRegistry,
+	providerRegistry *provider.Registry,
 	logger *log.Logger,
 ) *ReviewEngine {
 	return &ReviewEngine{
@@ -53,6 +56,7 @@ func NewReviewEngine(
 		scope:             scope,
 		encryptionKey:     encryptionKey,
 		connectorRegistry: connectorRegistry,
+		providerRegistry:  providerRegistry,
 		logger:            logger,
 	}
 }
@@ -307,181 +311,10 @@ func (e *ReviewEngine) resolveDriver(
 		}
 	}
 
-	switch dbConnector.Provider {
-	case coredata.ConnectorProviderGoogleWorkspace:
-		return drivers.NewGoogleWorkspaceDriver(httpClient), nil
-	case coredata.ConnectorProviderLinear:
-		return drivers.NewLinearDriver(httpClient), nil
-	case coredata.ConnectorProviderSlack:
-		return drivers.NewSlackDriver(httpClient), nil
-	case coredata.ConnectorProviderOnePassword:
-		// Client credentials grant -> Users API driver (to be created in Phase 5).
-		// Authorization code / SCIM grant -> existing SCIM-based driver.
-		if oauth2Conn, ok := dbConnector.Connection.(*connector.OAuth2Connection); ok && oauth2Conn.GrantType == connector.OAuth2GrantTypeClientCredentials {
-			settings, err := coredata.ConnectorSettings[coredata.OnePasswordUsersAPISettings](dbConnector)
-			if err != nil {
-				return nil, fmt.Errorf("cannot read 1password users api settings: %w", err)
-			}
-
-			return drivers.NewOnePasswordUsersAPIDriver(httpClient, settings.AccountID, settings.Region), nil
-		}
-
-		onePasswordSettings, err := coredata.ConnectorSettings[coredata.OnePasswordConnectorSettings](dbConnector)
-		if err != nil {
-			return nil, fmt.Errorf("cannot read 1password connector settings: %w", err)
-		}
-
-		if onePasswordSettings.SCIMBridgeURL == "" {
-			return nil, fmt.Errorf("1password connector requires scim_bridge_url in settings")
-		}
-
-		return drivers.NewOnePasswordDriver(httpClient, onePasswordSettings.SCIMBridgeURL), nil
-	case coredata.ConnectorProviderHubSpot:
-		return drivers.NewHubSpotDriver(httpClient), nil
-	case coredata.ConnectorProviderDocuSign:
-		return drivers.NewDocuSignDriver(httpClient), nil
-	case coredata.ConnectorProviderNotion:
-		return drivers.NewNotionDriver(httpClient), nil
-	case coredata.ConnectorProviderBrex:
-		return drivers.NewBrexDriver(httpClient), nil
-	case coredata.ConnectorProviderTally:
-		tallySettings, err := coredata.ConnectorSettings[coredata.TallyConnectorSettings](dbConnector)
-		if err != nil {
-			return nil, fmt.Errorf("cannot read tally connector settings: %w", err)
-		}
-
-		if tallySettings.OrganizationID == "" {
-			return nil, fmt.Errorf("tally connector requires organization_id in settings")
-		}
-
-		return drivers.NewTallyDriver(httpClient, tallySettings.OrganizationID), nil
-	case coredata.ConnectorProviderCloudflare:
-		return drivers.NewCloudflareDriver(httpClient), nil
-	case coredata.ConnectorProviderOpenAI:
-		return drivers.NewOpenAIDriver(httpClient), nil
-	case coredata.ConnectorProviderSentry:
-		sentrySettings, err := coredata.ConnectorSettings[coredata.SentryConnectorSettings](dbConnector)
-		if err != nil {
-			return nil, fmt.Errorf("cannot read sentry connector settings: %w", err)
-		}
-
-		// OrganizationSlug may be empty for OAuth connections; the driver auto-discovers it.
-		return drivers.NewSentryDriver(httpClient, sentrySettings.OrganizationSlug), nil
-	case coredata.ConnectorProviderSupabase:
-		supabaseSettings, err := coredata.ConnectorSettings[coredata.SupabaseConnectorSettings](dbConnector)
-		if err != nil {
-			return nil, fmt.Errorf("cannot read supabase connector settings: %w", err)
-		}
-
-		if supabaseSettings.OrganizationSlug == "" {
-			return nil, fmt.Errorf("supabase connector requires organization_slug in settings")
-		}
-
-		return drivers.NewSupabaseDriver(httpClient, supabaseSettings.OrganizationSlug), nil
-	case coredata.ConnectorProviderGitHub:
-		githubSettings, err := coredata.ConnectorSettings[coredata.GitHubConnectorSettings](dbConnector)
-		if err != nil {
-			return nil, fmt.Errorf("cannot read github connector settings: %w", err)
-		}
-
-		if githubSettings.Organization == "" {
-			return nil, fmt.Errorf("github connector requires organization in settings")
-		}
-
-		return drivers.NewGitHubDriver(httpClient, githubSettings.Organization, e.logger.Named("github")), nil
-	case coredata.ConnectorProviderIntercom:
-		return drivers.NewIntercomDriver(httpClient), nil
-	case coredata.ConnectorProviderResend:
-		return drivers.NewResendDriver(httpClient), nil
-	case coredata.ConnectorProviderMicrosoft365:
-		return drivers.NewMicrosoft365Driver(httpClient), nil
-	case coredata.ConnectorProviderGitLab:
-		gitlabSettings, err := coredata.ConnectorSettings[coredata.GitLabConnectorSettings](dbConnector)
-		if err != nil {
-			return nil, fmt.Errorf("cannot read gitlab connector settings: %w", err)
-		}
-
-		if gitlabSettings.GroupID == "" {
-			return nil, fmt.Errorf("gitlab connector requires group_id in settings")
-		}
-
-		return drivers.NewGitLabDriver(httpClient, gitlabSettings.GroupID), nil
-	case coredata.ConnectorProviderBitbucket:
-		bitbucketSettings, err := coredata.ConnectorSettings[coredata.BitbucketConnectorSettings](dbConnector)
-		if err != nil {
-			return nil, fmt.Errorf("cannot read bitbucket connector settings: %w", err)
-		}
-
-		if bitbucketSettings.Workspace == "" {
-			return nil, fmt.Errorf("bitbucket connector requires workspace in settings")
-		}
-
-		return drivers.NewBitbucketDriver(httpClient, bitbucketSettings.Workspace), nil
-	case coredata.ConnectorProviderHeroku:
-		herokuSettings, err := coredata.ConnectorSettings[coredata.HerokuConnectorSettings](dbConnector)
-		if err != nil {
-			return nil, fmt.Errorf("cannot read heroku connector settings: %w", err)
-		}
-
-		if herokuSettings.TeamID == "" {
-			return nil, fmt.Errorf("heroku connector requires team_id in settings")
-		}
-
-		return drivers.NewHerokuDriver(httpClient, herokuSettings.TeamID), nil
-	case coredata.ConnectorProviderPagerDuty:
-		// PagerDuty's REST API uses the regional api.pagerduty.com host;
-		// the driver does not consume the per-tenant subdomain. Subdomain
-		// is read only by the name resolver, which returns empty when
-		// missing — that surfaces as a blank source name but does not
-		// block access review.
-		return drivers.NewPagerDutyDriver(httpClient), nil
-	case coredata.ConnectorProviderAsana:
-		asanaSettings, err := coredata.ConnectorSettings[coredata.AsanaConnectorSettings](dbConnector)
-		if err != nil {
-			return nil, fmt.Errorf("cannot read asana connector settings: %w", err)
-		}
-
-		if asanaSettings.WorkspaceGID == "" {
-			return nil, fmt.Errorf("asana connector requires workspace_gid in settings")
-		}
-
-		return drivers.NewAsanaDriver(httpClient, asanaSettings.WorkspaceGID), nil
-	case coredata.ConnectorProviderNetlify:
-		netlifySettings, err := coredata.ConnectorSettings[coredata.NetlifyConnectorSettings](dbConnector)
-		if err != nil {
-			return nil, fmt.Errorf("cannot read netlify connector settings: %w", err)
-		}
-
-		if netlifySettings.AccountSlug == "" {
-			return nil, fmt.Errorf("netlify connector requires account_slug in settings")
-		}
-
-		return drivers.NewNetlifyDriver(httpClient, netlifySettings.AccountSlug), nil
-	case coredata.ConnectorProviderClickUp:
-		clickupSettings, err := coredata.ConnectorSettings[coredata.ClickUpConnectorSettings](dbConnector)
-		if err != nil {
-			return nil, fmt.Errorf("cannot read clickup connector settings: %w", err)
-		}
-
-		if clickupSettings.TeamID == "" {
-			return nil, fmt.Errorf("clickup connector requires team_id in settings")
-		}
-
-		return drivers.NewClickUpDriver(httpClient, clickupSettings.TeamID), nil
-	case coredata.ConnectorProviderVercel:
-		vercelSettings, err := coredata.ConnectorSettings[coredata.VercelConnectorSettings](dbConnector)
-		if err != nil {
-			return nil, fmt.Errorf("cannot read vercel connector settings: %w", err)
-		}
-
-		if vercelSettings.TeamID == "" {
-			return nil, fmt.Errorf("vercel connector requires team_id in settings")
-		}
-
-		return drivers.NewVercelDriver(httpClient, vercelSettings.TeamID), nil
-	case coredata.ConnectorProviderMonday:
-		return drivers.NewMondayDriver(httpClient), nil
-	default:
-		return nil, fmt.Errorf("unsupported connector provider %q for access source driver", dbConnector.Provider)
+	reg, ok := e.providerRegistry.Get(dbConnector.Provider)
+	if !ok || reg.NewDriver == nil {
+		return nil, fmt.Errorf("cannot resolve driver: unsupported provider %q", dbConnector.Provider)
 	}
+
+	return reg.NewDriver(ctx, httpClient, dbConnector, e.logger)
 }

pkg/accessreview/service.go

@@ -23,6 +23,7 @@ import (
 	"go.gearno.de/kit/pg"
 	"go.gearno.de/kit/worker"
 	"go.probo.inc/probo/pkg/connector"
+	"go.probo.inc/probo/pkg/connector/provider"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/crypto/cipher"
 	"go.probo.inc/probo/pkg/gid"
@@ -34,6 +35,7 @@ type (
 		pg                *pg.Client
 		encryptionKey     cipher.EncryptionKey
 		connectorRegistry *connector.ConnectorRegistry
+		providerRegistry  *provider.Registry
 		logger            *log.Logger
 
 		fetchWorker      *worker.Worker[coredata.AccessReviewCampaignSourceFetch]
@@ -57,6 +59,7 @@ func NewService(
 	pgClient *pg.Client,
 	encryptionKey cipher.EncryptionKey,
 	connectorRegistry *connector.ConnectorRegistry,
+	providerRegistry *provider.Registry,
 	logger *log.Logger,
 	opts ...Option,
 ) *Service {
@@ -69,6 +72,7 @@ func NewService(
 		pg:                pgClient,
 		encryptionKey:     encryptionKey,
 		connectorRegistry: connectorRegistry,
+		providerRegistry:  providerRegistry,
 		logger:            logger,
 	}
 
@@ -91,6 +95,7 @@ func NewService(
 		pgClient,
 		encryptionKey,
 		connectorRegistry,
+		providerRegistry,
 		logger.Named("source-name"),
 	)
 
@@ -104,6 +109,7 @@ func (s *Service) Sources(scope coredata.Scoper) *AccessSourceService {
 		scope:             scope,
 		encryptionKey:     s.encryptionKey,
 		connectorRegistry: s.connectorRegistry,
+		providerRegistry:  s.providerRegistry,
 	}
 }
 
@@ -124,6 +130,7 @@ func (s *Service) Engine(scope coredata.Scoper) *ReviewEngine {
 		scope,
 		s.encryptionKey,
 		s.connectorRegistry,
+		s.providerRegistry,
 		s.logger.Named("review_engine"),
 	)
 }

pkg/accessreview/source_name_worker.go

@@ -26,6 +26,7 @@ import (
 	"go.gearno.de/kit/worker"
 	"go.probo.inc/probo/pkg/accessreview/drivers"
 	"go.probo.inc/probo/pkg/connector"
+	"go.probo.inc/probo/pkg/connector/provider"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/crypto/cipher"
 )
@@ -36,6 +37,7 @@ type sourceNameHandler struct {
 	pg                *pg.Client
 	encryptionKey     cipher.EncryptionKey
 	connectorRegistry *connector.ConnectorRegistry
+	providerRegistry  *provider.Registry
 	logger            *log.Logger
 }
 
@@ -43,6 +45,7 @@ func NewSourceNameWorker(
 	pgClient *pg.Client,
 	encryptionKey cipher.EncryptionKey,
 	connectorRegistry *connector.ConnectorRegistry,
+	providerRegistry *provider.Registry,
 	logger *log.Logger,
 	opts ...worker.Option,
 ) *worker.Worker[coredata.AccessSource] {
@@ -50,6 +53,7 @@ func NewSourceNameWorker(
 		pg:                pgClient,
 		encryptionKey:     encryptionKey,
 		connectorRegistry: connectorRegistry,
+		providerRegistry:  providerRegistry,
 		logger:            logger,
 	}
 
@@ -130,7 +134,7 @@ func (h *sourceNameHandler) Process(ctx context.Context, source coredata.AccessS
 				}
 			}
 
-			resolver = h.buildResolver(&dbConnector, httpClient)
+			resolver = h.buildResolver(ctx, &dbConnector, httpClient)
 
 			return nil
 		},
@@ -184,7 +188,7 @@ func (h *sourceNameHandler) Process(ctx context.Context, source coredata.AccessS
 		return h.markNameSynced(ctx, &source)
 	}
 
-	displayName := drivers.ProviderDisplayName(dbConnector.Provider)
+	displayName := h.providerRegistry.ProviderDisplayName(dbConnector.Provider)
 	newName := displayName + " " + instanceName
 
 	h.logger.InfoCtx(
@@ -246,133 +250,14 @@ func (h *sourceNameHandler) connectorHTTPClient(
 }
 
 func (h *sourceNameHandler) buildResolver(
+	ctx context.Context,
 	dbConnector *coredata.Connector,
 	httpClient *http.Client,
 ) drivers.NameResolver {
-	switch dbConnector.Provider {
-	case coredata.ConnectorProviderSlack:
-		return drivers.NewSlackNameResolver(httpClient)
-	case coredata.ConnectorProviderGoogleWorkspace:
-		return drivers.NewGoogleWorkspaceNameResolver(httpClient)
-	case coredata.ConnectorProviderLinear:
-		return drivers.NewLinearNameResolver(httpClient)
-	case coredata.ConnectorProviderCloudflare:
-		return drivers.NewCloudflareNameResolver(httpClient)
-	case coredata.ConnectorProviderBrex:
-		return drivers.NewBrexNameResolver(httpClient)
-	case coredata.ConnectorProviderTally:
-		tallySettings, err := coredata.ConnectorSettings[coredata.TallyConnectorSettings](dbConnector)
-		if err != nil {
-			h.logger.Error("cannot read tally connector settings", log.Error(err))
-			return nil
-		}
-
-		return drivers.NewTallyNameResolver(httpClient, tallySettings.OrganizationID)
-	case coredata.ConnectorProviderHubSpot:
-		return drivers.NewHubSpotNameResolver(httpClient)
-	case coredata.ConnectorProviderDocuSign:
-		return drivers.NewDocuSignNameResolver(httpClient)
-	case coredata.ConnectorProviderOpenAI:
-		return drivers.NewOpenAINameResolver(httpClient)
-	case coredata.ConnectorProviderSentry:
-		sentrySettings, err := coredata.ConnectorSettings[coredata.SentryConnectorSettings](dbConnector)
-		if err != nil {
-			h.logger.Error("cannot read sentry connector settings", log.Error(err))
-			return nil
-		}
-
-		return drivers.NewSentryNameResolver(httpClient, sentrySettings.OrganizationSlug)
-	case coredata.ConnectorProviderGitHub:
-		githubSettings, err := coredata.ConnectorSettings[coredata.GitHubConnectorSettings](dbConnector)
-		if err != nil {
-			h.logger.Error("cannot read github connector settings", log.Error(err))
-			return nil
-		}
-
-		return drivers.NewGitHubNameResolver(httpClient, githubSettings.Organization)
-	case coredata.ConnectorProviderSupabase:
-		supabaseSettings, err := coredata.ConnectorSettings[coredata.SupabaseConnectorSettings](dbConnector)
-		if err != nil {
-			h.logger.Error("cannot read supabase connector settings", log.Error(err))
-			return nil
-		}
-
-		return drivers.NewSupabaseNameResolver(supabaseSettings.OrganizationSlug)
-	case coredata.ConnectorProviderIntercom:
-		return drivers.NewIntercomNameResolver(httpClient)
-	case coredata.ConnectorProviderNotion:
-		return drivers.NewNotionNameResolver(httpClient)
-	case coredata.ConnectorProviderResend:
-		return drivers.NewResendNameResolver()
-	case coredata.ConnectorProviderMicrosoft365:
-		return drivers.NewMicrosoft365NameResolver(httpClient)
-	case coredata.ConnectorProviderGitLab:
-		gitlabSettings, err := coredata.ConnectorSettings[coredata.GitLabConnectorSettings](dbConnector)
-		if err != nil {
-			h.logger.Error("cannot read gitlab connector settings", log.Error(err))
-			return nil
-		}
-
-		return drivers.NewGitLabNameResolver(httpClient, gitlabSettings.GroupID)
-	case coredata.ConnectorProviderBitbucket:
-		bitbucketSettings, err := coredata.ConnectorSettings[coredata.BitbucketConnectorSettings](dbConnector)
-		if err != nil {
-			h.logger.Error("cannot read bitbucket connector settings", log.Error(err))
-			return nil
-		}
-
-		return drivers.NewBitbucketNameResolver(httpClient, bitbucketSettings.Workspace)
-	case coredata.ConnectorProviderHeroku:
-		herokuSettings, err := coredata.ConnectorSettings[coredata.HerokuConnectorSettings](dbConnector)
-		if err != nil {
-			h.logger.Error("cannot read heroku connector settings", log.Error(err))
-			return nil
-		}
-
-		return drivers.NewHerokuNameResolver(httpClient, herokuSettings.TeamID)
-	case coredata.ConnectorProviderPagerDuty:
-		pdSettings, err := coredata.ConnectorSettings[coredata.PagerDutyConnectorSettings](dbConnector)
-		if err != nil {
-			h.logger.Error("cannot read pagerduty connector settings", log.Error(err))
-			return nil
-		}
-
-		return drivers.NewPagerDutyNameResolver(pdSettings.Subdomain)
-	case coredata.ConnectorProviderAsana:
-		asanaSettings, err := coredata.ConnectorSettings[coredata.AsanaConnectorSettings](dbConnector)
-		if err != nil {
-			h.logger.Error("cannot read asana connector settings", log.Error(err))
-			return nil
-		}
-
-		return drivers.NewAsanaNameResolver(httpClient, asanaSettings.WorkspaceGID)
-	case coredata.ConnectorProviderNetlify:
-		netlifySettings, err := coredata.ConnectorSettings[coredata.NetlifyConnectorSettings](dbConnector)
-		if err != nil {
-			h.logger.Error("cannot read netlify connector settings", log.Error(err))
-			return nil
-		}
-
-		return drivers.NewNetlifyNameResolver(httpClient, netlifySettings.AccountSlug)
-	case coredata.ConnectorProviderClickUp:
-		clickupSettings, err := coredata.ConnectorSettings[coredata.ClickUpConnectorSettings](dbConnector)
-		if err != nil {
-			h.logger.Error("cannot read clickup connector settings", log.Error(err))
-			return nil
-		}
-
-		return drivers.NewClickUpNameResolver(httpClient, clickupSettings.TeamID)
-	case coredata.ConnectorProviderVercel:
-		vercelSettings, err := coredata.ConnectorSettings[coredata.VercelConnectorSettings](dbConnector)
-		if err != nil {
-			h.logger.Error("cannot read vercel connector settings", log.Error(err))
-			return nil
-		}
-
-		return drivers.NewVercelNameResolver(httpClient, vercelSettings.TeamID)
-	case coredata.ConnectorProviderMonday:
-		return drivers.NewMondayNameResolver(httpClient)
-	default:
+	reg, ok := h.providerRegistry.Get(dbConnector.Provider)
+	if !ok || reg.NewNameResolver == nil {
 		return nil
 	}
+
+	return reg.NewNameResolver(ctx, httpClient, dbConnector, h.logger)
 }