Consolidate connector provider dispatch behind a typed *Registry
The console previously dispatched per-provider logic through a fan of init()-side-effect maps (driver names, OAuth2 metadata, probe URLs, display names, settings switches), spread across pkg/connector, pkg/accessreview/drivers and the console v1 resolvers. Adding a new provider required edits in every one of those places and a corresponding switch arm in CreateConnectorRequest. The same per-provider knowledge also leaked into Helm templates as hand-rolled environment-variable blocks per connector. This commit collapses the dispatch surface into a single typed *provider.Registry. The registry is constructed once by NewBuiltinRegistry at probod startup and threaded as an explicit dependency into every consumer (accessreview service, console v1 resolver, OAuth2 wiring). There is no package-level state. Each provider lives in one file under pkg/connector/provider/ that exposes a private xxxRegistration() *Registration constructor; NewBuiltinRegistry enumerates them. CreateConnectorRequest loses its per-provider settings fields and takes a single RawSettings json.RawMessage produced by the per-provider MarshalSettings closure. The 1Password SCIM bridge URL is validated at create time (http(s) scheme + non-empty host) so a malformed value fails fast at the resolver boundary. The Helm chart gains probo.connectorEnv and probo.connectorSecretEntries templates so adding a connector requires zero Helm changes. Access-review name resolution moves into the same Registration value to keep one authoritative dispatch table. Tests cover every Registration (DisplayName, NewDriver wired), Register error paths (nil, empty Provider, empty DisplayName, duplicate), All / ProviderDisplayName / ProviderOAuth2Scopes / ProbeURL hit and miss paths, the ApplyOAuth2Defaults templating and PKCE branches, and ConnectorSettings[T] round-trip plus malformed-JSON error path. The pre-refactor ApplyProviderDefaults test in pkg/connector is replaced by the equivalent in pkg/connector/provider. Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
This commit is contained in:
Aurélien Sibiril
@@ -14,170 +14,5 @@
|
||||
|
||||
package connector
|
||||
|
||||
import (
|
||||
"maps"
|
||||
"strings"
|
||||
|
||||
"go.gearno.de/kit/httpclient"
|
||||
)
|
||||
|
||||
// CallbackPath is the HTTP path for the OAuth2 callback endpoint.
|
||||
const CallbackPath = "/api/console/v1/connectors/complete"
|
||||
|
||||
// providerDefinition holds the static OAuth2 properties for a provider.
|
||||
// These are intrinsic to the provider and do not vary between deployments.
|
||||
// Scopes are not part of this — they are passed by the caller at
|
||||
// initiate time via InitiateOptions, since the same provider may be used
|
||||
// in multiple contexts requiring different scope sets.
|
||||
type providerDefinition struct {
|
||||
AuthURL string
|
||||
TokenURL string
|
||||
ExtraAuthParams map[string]string
|
||||
TokenEndpointAuth string // "post-form" (default), "basic-form", or "basic-json"
|
||||
SupportsIncrementalAuth bool
|
||||
// RequiresPKCE enables RFC 7636 PKCE (S256) on the authorization
|
||||
// request and replays the verifier on the token exchange. Default
|
||||
// false; existing providers are unaffected.
|
||||
RequiresPKCE bool
|
||||
}
|
||||
|
||||
// providerDefinitions maps provider names to their static OAuth2 definitions.
|
||||
// Only ClientID and ClientSecret come from deployment config.
|
||||
var (
|
||||
providerDefinitions = map[string]providerDefinition{
|
||||
"SLACK": {
|
||||
AuthURL: "https://slack.com/oauth/v2/authorize",
|
||||
TokenURL: "https://slack.com/api/oauth.v2.access",
|
||||
},
|
||||
"HUBSPOT": {
|
||||
AuthURL: "https://app.hubspot.com/oauth/authorize",
|
||||
TokenURL: "https://api.hubapi.com/oauth/v1/token",
|
||||
},
|
||||
"DOCUSIGN": {
|
||||
AuthURL: "https://account.docusign.com/oauth/auth",
|
||||
TokenURL: "https://account.docusign.com/oauth/token",
|
||||
TokenEndpointAuth: "basic-form",
|
||||
},
|
||||
"NOTION": {
|
||||
AuthURL: "https://api.notion.com/v1/oauth/authorize",
|
||||
TokenURL: "https://api.notion.com/v1/oauth/token",
|
||||
ExtraAuthParams: map[string]string{"owner": "user"},
|
||||
TokenEndpointAuth: "basic-json",
|
||||
},
|
||||
"GITHUB": {
|
||||
AuthURL: "https://github.com/login/oauth/authorize",
|
||||
TokenURL: "https://github.com/login/oauth/access_token",
|
||||
},
|
||||
"SENTRY": {
|
||||
AuthURL: "https://sentry.io/oauth/authorize/",
|
||||
TokenURL: "https://sentry.io/oauth/token/",
|
||||
},
|
||||
"INTERCOM": {
|
||||
AuthURL: "https://app.intercom.com/oauth",
|
||||
TokenURL: "https://api.intercom.io/auth/eagle/token",
|
||||
},
|
||||
"BREX": {
|
||||
AuthURL: "https://accounts-api.brex.com/oauth2/default/v1/authorize",
|
||||
TokenURL: "https://accounts-api.brex.com/oauth2/default/v1/token",
|
||||
},
|
||||
"GOOGLE_WORKSPACE": {
|
||||
AuthURL: "https://accounts.google.com/o/oauth2/v2/auth",
|
||||
TokenURL: "https://oauth2.googleapis.com/token",
|
||||
ExtraAuthParams: map[string]string{
|
||||
"access_type": "offline",
|
||||
"prompt": "consent",
|
||||
},
|
||||
SupportsIncrementalAuth: true,
|
||||
},
|
||||
"MICROSOFT_365": {
|
||||
AuthURL: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
|
||||
TokenURL: "https://login.microsoftonline.com/common/oauth2/v2.0/token",
|
||||
ExtraAuthParams: map[string]string{
|
||||
"prompt": "consent",
|
||||
},
|
||||
},
|
||||
"LINEAR": {
|
||||
AuthURL: "https://linear.app/oauth/authorize",
|
||||
TokenURL: "https://api.linear.app/oauth/token",
|
||||
},
|
||||
"GITLAB": {
|
||||
AuthURL: "https://gitlab.com/oauth/authorize",
|
||||
TokenURL: "https://gitlab.com/oauth/token",
|
||||
},
|
||||
// Bitbucket scopes are pinned on the OAuth consumer at registration
|
||||
// time (`account` for workspace membership). They are not passed in
|
||||
// the authorize URL and not configured here.
|
||||
"BITBUCKET": {
|
||||
AuthURL: "https://bitbucket.org/site/oauth2/authorize",
|
||||
TokenURL: "https://bitbucket.org/site/oauth2/access_token",
|
||||
},
|
||||
"HEROKU": {
|
||||
AuthURL: "https://id.heroku.com/oauth/authorize",
|
||||
TokenURL: "https://id.heroku.com/oauth/token",
|
||||
},
|
||||
"PAGERDUTY": {
|
||||
AuthURL: "https://identity.pagerduty.com/oauth/authorize",
|
||||
TokenURL: "https://identity.pagerduty.com/oauth/token",
|
||||
RequiresPKCE: true,
|
||||
},
|
||||
"ASANA": {
|
||||
AuthURL: "https://app.asana.com/-/oauth_authorize",
|
||||
TokenURL: "https://app.asana.com/-/oauth_token",
|
||||
},
|
||||
"NETLIFY": {
|
||||
AuthURL: "https://app.netlify.com/authorize",
|
||||
TokenURL: "https://api.netlify.com/oauth/token",
|
||||
},
|
||||
"CLICKUP": {
|
||||
AuthURL: "https://app.clickup.com/api",
|
||||
TokenURL: "https://api.clickup.com/api/v2/oauth/token",
|
||||
},
|
||||
// Vercel uses a templated AuthURL: the operator supplies an
|
||||
// `integration-slug` config field which is resolved into the
|
||||
// "{integration_slug}" placeholder by ApplyProviderDefaults.
|
||||
// Vercel does not use OAuth scopes — capabilities are pinned on
|
||||
// the integration registration in the Vercel dashboard.
|
||||
"VERCEL": {
|
||||
AuthURL: "https://vercel.com/integrations/{integration_slug}/new",
|
||||
TokenURL: "https://api.vercel.com/v2/oauth/access_token",
|
||||
},
|
||||
"MONDAY": {
|
||||
AuthURL: "https://auth.monday.com/oauth2/authorize",
|
||||
TokenURL: "https://auth.monday.com/oauth2/token",
|
||||
},
|
||||
}
|
||||
)
|
||||
|
||||
// ApplyProviderDefaults sets the redirect URI and applies static provider
|
||||
// defaults (auth URL, token URL, extra params, token endpoint auth) onto
|
||||
// an OAuth2Connector, and wires an SSRF-protected HTTP client for the
|
||||
// token exchange request. Call this before registering the connector.
|
||||
func ApplyProviderDefaults(provider string, redirectURI string, c *OAuth2Connector) {
|
||||
c.RedirectURI = redirectURI
|
||||
c.HTTPClient = httpclient.DefaultClient(httpclient.WithSSRFProtection())
|
||||
|
||||
if def, ok := providerDefinitions[provider]; ok {
|
||||
c.AuthURL = def.AuthURL
|
||||
c.TokenURL = def.TokenURL
|
||||
c.TokenEndpointAuth = def.TokenEndpointAuth
|
||||
c.SupportsIncrementalAuth = def.SupportsIncrementalAuth
|
||||
c.RequiresPKCE = def.RequiresPKCE
|
||||
|
||||
// Deep copy ExtraAuthParams so per-connector mutations (e.g.
|
||||
// incremental auth, scope overrides) cannot alias back into the
|
||||
// shared providerDefinitions map.
|
||||
if len(def.ExtraAuthParams) > 0 {
|
||||
extra := make(map[string]string, len(def.ExtraAuthParams))
|
||||
maps.Copy(extra, def.ExtraAuthParams)
|
||||
c.ExtraAuthParams = extra
|
||||
}
|
||||
|
||||
// Resolve operator-supplied placeholders in the static AuthURL
|
||||
// (for example Vercel's "{integration_slug}"). Providers without
|
||||
// placeholders are unaffected; the loop is a no-op when
|
||||
// AuthURLParams is empty.
|
||||
for k, v := range c.AuthURLParams {
|
||||
c.AuthURL = strings.ReplaceAll(c.AuthURL, "{"+k+"}", v)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user