Consolidate connector provider dispatch behind a typed *Registry

The console previously dispatched per-provider logic through a fan of
init()-side-effect maps (driver names, OAuth2 metadata, probe URLs,
display names, settings switches), spread across pkg/connector,
pkg/accessreview/drivers and the console v1 resolvers. Adding a new
provider required edits in every one of those places and a corresponding
switch arm in CreateConnectorRequest. The same per-provider knowledge
also leaked into Helm templates as hand-rolled environment-variable
blocks per connector.

This commit collapses the dispatch surface into a single typed
*provider.Registry. The registry is constructed once by
NewBuiltinRegistry at probod startup and threaded as an explicit
dependency into every consumer (accessreview service, console v1
resolver, OAuth2 wiring). There is no package-level state. Each
provider lives in one file under pkg/connector/provider/ that exposes
a private xxxRegistration() *Registration constructor; NewBuiltinRegistry
enumerates them.

CreateConnectorRequest loses its per-provider settings fields and
takes a single RawSettings json.RawMessage produced by the
per-provider MarshalSettings closure. The 1Password SCIM bridge URL
is validated at create time (http(s) scheme + non-empty host) so a
malformed value fails fast at the resolver boundary. The Helm chart
gains probo.connectorEnv and probo.connectorSecretEntries templates
so adding a connector requires zero Helm changes. Access-review name
resolution moves into the same Registration value to keep one
authoritative dispatch table.

Tests cover every Registration (DisplayName, NewDriver wired),
Register error paths (nil, empty Provider, empty DisplayName,
duplicate), All / ProviderDisplayName / ProviderOAuth2Scopes /
ProbeURL hit and miss paths, the ApplyOAuth2Defaults templating and
PKCE branches, and ConnectorSettings[T] round-trip plus malformed-JSON
error path. The pre-refactor ApplyProviderDefaults test in
pkg/connector is replaced by the equivalent in
pkg/connector/provider.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/server/api/api.go

@@ -28,6 +28,7 @@ import (
 	"go.probo.inc/probo/pkg/accessreview"
 	"go.probo.inc/probo/pkg/baseurl"
 	"go.probo.inc/probo/pkg/connector"
+	"go.probo.inc/probo/pkg/connector/provider"
 	"go.probo.inc/probo/pkg/cookiebanner"
 	"go.probo.inc/probo/pkg/esign"
 	"go.probo.inc/probo/pkg/file"
@@ -68,6 +69,7 @@ type (
 		Cookie            securecookie.Config
 		TokenSecret       string
 		ConnectorRegistry *connector.ConnectorRegistry
+		ProviderRegistry  *provider.Registry
 		CustomDomainCname string
 		Logger            *log.Logger
 	}
@@ -192,6 +194,7 @@ func NewServer(cfg Config) (*Server, error) {
 			cfg.Cookie,
 			cfg.TokenSecret,
 			cfg.ConnectorRegistry,
+			cfg.ProviderRegistry,
 			cfg.BaseURL,
 			cfg.CustomDomainCname,
 			cfg.ThirdParty,

pkg/server/api/console/v1/access_review_campaign_resolvers.go

@@ -450,7 +450,7 @@ func (r *accessSourceResolver) ConnectionStatus(ctx context.Context, obj *types.
 	// Creating an HTTP client may succeed even with an expired token
 	// (e.g. no refresh token available). Make a lightweight probe
 	// request to verify the token is actually valid.
-	probeURL := r.connectorRegistry.GetProbeURL(string(dbConnector.Provider))
+	probeURL := r.providerRegistry.ProbeURL(string(dbConnector.Provider))
 	if err := probeConnection(ctx, httpClient, probeURL); err != nil {
 		return types.AccessSourceConnectionStatusDisconnected, nil
 	}

pkg/server/api/console/v1/connector_provider_info.go

@@ -15,66 +15,44 @@
 package console_v1
 
 import (
-	"go.probo.inc/probo/pkg/accessreview/drivers"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/server/api/console/v1/types"
 )
 
-var apiKeyProviders = map[coredata.ConnectorProvider]bool{
-	coredata.ConnectorProviderHubSpot:     true,
-	coredata.ConnectorProviderDocuSign:    true,
-	coredata.ConnectorProviderNotion:      true,
-	coredata.ConnectorProviderGitHub:      true,
-	coredata.ConnectorProviderSentry:      true,
-	coredata.ConnectorProviderIntercom:    true,
-	coredata.ConnectorProviderBrex:        true,
-	coredata.ConnectorProviderTally:       true,
-	coredata.ConnectorProviderCloudflare:  true,
-	coredata.ConnectorProviderOpenAI:      true,
-	coredata.ConnectorProviderSupabase:    true,
-	coredata.ConnectorProviderResend:      true,
-	coredata.ConnectorProviderOnePassword: true,
+func (r *Resolver) providerDisplayName(p coredata.ConnectorProvider) string {
+	return r.providerRegistry.ProviderDisplayName(p)
 }
 
-var clientCredentialsProviders = map[coredata.ConnectorProvider]bool{
-	coredata.ConnectorProviderOnePassword: true,
-}
-
-var providerExtraSettingsMap = map[coredata.ConnectorProvider][]*types.ConnectorProviderSettingInfo{
-	coredata.ConnectorProviderGitHub: {
-		{Key: "organization", Label: "Organization", Required: true},
-	},
-	coredata.ConnectorProviderSentry: {
-		{Key: "organizationSlug", Label: "Organization Slug", Required: true},
-	},
-	coredata.ConnectorProviderTally: {
-		{Key: "organizationId", Label: "Organization ID", Required: true},
-	},
-	coredata.ConnectorProviderSupabase: {
-		{Key: "organizationSlug", Label: "Organization Slug", Required: true},
-	},
-	coredata.ConnectorProviderOnePassword: {
-		{Key: "accountId", Label: "Account ID", Required: true},
-		{Key: "region", Label: "Region", Required: true},
-	},
-}
-
-func providerDisplayName(provider coredata.ConnectorProvider) string {
-	return drivers.ProviderDisplayName(provider)
-}
-
-func providerSupportsAPIKey(provider coredata.ConnectorProvider) bool {
-	return apiKeyProviders[provider]
-}
-
-func providerSupportsClientCredentials(provider coredata.ConnectorProvider) bool {
-	return clientCredentialsProviders[provider]
-}
-
-func providerExtraSettings(provider coredata.ConnectorProvider) []*types.ConnectorProviderSettingInfo {
-	if settings, ok := providerExtraSettingsMap[provider]; ok {
-		return settings
+func (r *Resolver) providerSupportsAPIKey(p coredata.ConnectorProvider) bool {
+	if reg, ok := r.providerRegistry.Get(p); ok {
+		return reg.SupportsAPIKey
 	}
 
-	return []*types.ConnectorProviderSettingInfo{}
+	return false
+}
+
+func (r *Resolver) providerSupportsClientCredentials(p coredata.ConnectorProvider) bool {
+	if reg, ok := r.providerRegistry.Get(p); ok {
+		return reg.SupportsClientCredentials
+	}
+
+	return false
+}
+
+func (r *Resolver) providerExtraSettings(p coredata.ConnectorProvider) []*types.ConnectorProviderSettingInfo {
+	reg, ok := r.providerRegistry.Get(p)
+	if !ok || len(reg.ExtraSettings) == 0 {
+		return []*types.ConnectorProviderSettingInfo{}
+	}
+
+	out := make([]*types.ConnectorProviderSettingInfo, 0, len(reg.ExtraSettings))
+	for _, s := range reg.ExtraSettings {
+		out = append(out, &types.ConnectorProviderSettingInfo{
+			Key:      s.Key,
+			Label:    s.Label,
+			Required: s.Required,
+		})
+	}
+
+	return out
 }

pkg/server/api/console/v1/connector_resolvers.go

@@ -11,8 +11,8 @@ import (
 	"fmt"
 
 	"go.gearno.de/kit/log"
-	"go.probo.inc/probo/pkg/accessreview/drivers"
 	"go.probo.inc/probo/pkg/connector"
+	"go.probo.inc/probo/pkg/connector/provider"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/probo"
 	"go.probo.inc/probo/pkg/server/api/console/v1/schema"
@@ -22,7 +22,7 @@ import (
 
 // Oauth2Scopes is the resolver for the oauth2Scopes field.
 func (r *connectorResolver) Oauth2Scopes(ctx context.Context, obj *types.Connector) ([]string, error) {
-	scopes := drivers.ProviderOAuth2Scopes(obj.Provider)
+	scopes := r.providerRegistry.ProviderOAuth2Scopes(obj.Provider)
 	if scopes == nil {
 		return []string{}, nil
 	}
@@ -44,34 +44,20 @@ func (r *mutationResolver) CreateAPIKeyConnector(ctx context.Context, input type
 		Connection:     &connector.APIKeyConnection{APIKey: input.APIKey},
 	}
 
-	if input.TallyOrganizationID != nil {
-		req.TallySettings = &coredata.TallyConnectorSettings{
-			OrganizationID: *input.TallyOrganizationID,
-		}
+	in := &provider.SettingsInput{
+		TallyOrganizationID:      input.TallyOrganizationID,
+		SentryOrganizationSlug:   input.SentryOrganizationSlug,
+		SupabaseOrganizationSlug: input.SupabaseOrganizationSlug,
+		GitHubOrganization:       input.GithubOrganization,
+		OnePasswordSCIMBridgeURL: input.OnePasswordScimBridgeURL,
 	}
-
-	if input.SentryOrganizationSlug != nil {
-		req.SentrySettings = &coredata.SentryConnectorSettings{
-			OrganizationSlug: *input.SentryOrganizationSlug,
+	if reg, ok := r.providerRegistry.Get(input.Provider); ok && reg.MarshalSettings != nil {
+		raw, err := reg.MarshalSettings(in)
+		if err != nil {
+			return nil, gqlutils.Invalid(ctx, err)
 		}
-	}
 
-	if input.SupabaseOrganizationSlug != nil {
-		req.SupabaseSettings = &coredata.SupabaseConnectorSettings{
-			OrganizationSlug: *input.SupabaseOrganizationSlug,
-		}
-	}
-
-	if input.GithubOrganization != nil {
-		req.GitHubSettings = &coredata.GitHubConnectorSettings{
-			Organization: *input.GithubOrganization,
-		}
-	}
-
-	if input.OnePasswordScimBridgeURL != nil {
-		req.OnePasswordSettings = &coredata.OnePasswordConnectorSettings{
-			SCIMBridgeURL: *input.OnePasswordScimBridgeURL,
-		}
+		req.RawSettings = raw
 	}
 
 	cnnctr, err := r.probo.Connectors.Create(ctx, scope, req)
@@ -80,7 +66,9 @@ func (r *mutationResolver) CreateAPIKeyConnector(ctx context.Context, input type
 			return nil, gqlutils.Conflict(ctx, err)
 		}
 
-		panic(fmt.Errorf("cannot create API key connector: %w", err))
+		r.logger.ErrorCtx(ctx, "cannot create API key connector", log.Error(err))
+
+		return nil, gqlutils.Internal(ctx)
 	}
 
 	return &types.CreateAPIKeyConnectorPayload{
@@ -113,11 +101,17 @@ func (r *mutationResolver) CreateClientCredentialsConnector(ctx context.Context,
 		Connection:     oauth2Conn,
 	}
 
-	if input.OnePasswordAccountID != nil && input.OnePasswordRegion != nil {
-		req.OnePasswordUsersAPISettings = &coredata.OnePasswordUsersAPISettings{
-			AccountID: *input.OnePasswordAccountID,
-			Region:    *input.OnePasswordRegion,
+	in := &provider.SettingsInput{
+		OnePasswordAccountID: input.OnePasswordAccountID,
+		OnePasswordRegion:    input.OnePasswordRegion,
+	}
+	if reg, ok := r.providerRegistry.Get(input.Provider); ok && reg.MarshalSettings != nil {
+		raw, err := reg.MarshalSettings(in)
+		if err != nil {
+			return nil, gqlutils.Invalid(ctx, err)
 		}
+
+		req.RawSettings = raw
 	}
 
 	cnnctr, err := r.probo.Connectors.Create(ctx, scope, req)
@@ -126,7 +120,9 @@ func (r *mutationResolver) CreateClientCredentialsConnector(ctx context.Context,
 			return nil, gqlutils.Conflict(ctx, err)
 		}
 
-		panic(fmt.Errorf("cannot create client credentials connector: %w", err))
+		r.logger.ErrorCtx(ctx, "cannot create client credentials connector", log.Error(err))
+
+		return nil, gqlutils.Internal(ctx)
 	}
 
 	return &types.CreateClientCredentialsConnectorPayload{

pkg/server/api/console/v1/graphql_handler.go

@@ -20,6 +20,7 @@ import (
 	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/accessreview"
 	"go.probo.inc/probo/pkg/connector"
+	"go.probo.inc/probo/pkg/connector/provider"
 	"go.probo.inc/probo/pkg/cookiebanner"
 	"go.probo.inc/probo/pkg/esign"
 	"go.probo.inc/probo/pkg/iam"
@@ -41,6 +42,7 @@ func NewGraphQLHandler(
 	mailmanSvc *mailman.Service,
 	cookieBannerSvc *cookiebanner.Service,
 	connectorRegistry *connector.ConnectorRegistry,
+	providerRegistry *provider.Registry,
 	customDomainCname string,
 	logger *log.Logger,
 	thirdPartySvc *thirdparty.Service,
@@ -57,6 +59,7 @@ func NewGraphQLHandler(
 			mailman:           mailmanSvc,
 			cookieBanner:      cookieBannerSvc,
 			connectorRegistry: connectorRegistry,
+			providerRegistry:  providerRegistry,
 			riskManagement:    riskManagementSvc,
 			thirdParty:        thirdPartySvc,
 			customDomainCname: customDomainCname,

pkg/server/api/console/v1/organization_resolvers.go

@@ -12,7 +12,6 @@ import (
 	"time"
 
 	"go.gearno.de/kit/log"
-	"go.probo.inc/probo/pkg/accessreview/drivers"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/gid"
 	"go.probo.inc/probo/pkg/iam"
@@ -548,22 +547,22 @@ func (r *organizationResolver) ConnectorProviderInfos(ctx context.Context, obj *
 
 	var infos []*types.ConnectorProviderInfo
 
-	for _, provider := range coredata.ConnectorProviders() {
-		_, oauthErr := r.connectorRegistry.Get(string(provider))
+	for _, p := range coredata.ConnectorProviders() {
+		_, oauthErr := r.connectorRegistry.Get(string(p))
 
-		scopes := drivers.ProviderOAuth2Scopes(provider)
+		scopes := r.providerRegistry.ProviderOAuth2Scopes(p)
 		if scopes == nil {
 			scopes = []string{}
 		}
 
 		info := &types.ConnectorProviderInfo{
-			Provider:                   provider,
-			DisplayName:                providerDisplayName(provider),
+			Provider:                   p,
+			DisplayName:                r.providerDisplayName(p),
 			OauthConfigured:            oauthErr == nil,
-			APIKeySupported:            providerSupportsAPIKey(provider),
-			ClientCredentialsSupported: providerSupportsClientCredentials(provider),
+			APIKeySupported:            r.providerSupportsAPIKey(p),
+			ClientCredentialsSupported: r.providerSupportsClientCredentials(p),
 			Oauth2Scopes:               scopes,
-			ExtraSettings:              providerExtraSettings(provider),
+			ExtraSettings:              r.providerExtraSettings(p),
 		}
 		infos = append(infos, info)
 	}

pkg/server/api/console/v1/resolver.go

@@ -18,6 +18,7 @@ package console_v1
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"net/http"
 	"net/url"
@@ -28,6 +29,7 @@ import (
 	"go.probo.inc/probo/pkg/accessreview"
 	"go.probo.inc/probo/pkg/baseurl"
 	"go.probo.inc/probo/pkg/connector"
+	"go.probo.inc/probo/pkg/connector/provider"
 	"go.probo.inc/probo/pkg/cookiebanner"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/esign"
@@ -56,6 +58,7 @@ type (
 		mailman           *mailman.Service
 		cookieBanner      *cookiebanner.Service
 		connectorRegistry *connector.ConnectorRegistry
+		providerRegistry  *provider.Registry
 		riskManagement    *riskmanagement.Service
 		thirdParty        *thirdparty.Service
 		logger            *log.Logger
@@ -74,6 +77,7 @@ func NewMux(
 	cookieConfig securecookie.Config,
 	tokenSecret string,
 	connectorRegistry *connector.ConnectorRegistry,
+	providerRegistry *provider.Registry,
 	baseURL *baseurl.BaseURL,
 	customDomainCname string,
 	thirdPartySvc *thirdparty.Service,
@@ -91,6 +95,7 @@ func NewMux(
 		mailmanSvc,
 		cookieBannerSvc,
 		connectorRegistry,
+		providerRegistry,
 		customDomainCname,
 		logger,
 		thirdPartySvc,
@@ -236,9 +241,17 @@ func handleConnectorComplete(
 				}
 
 				if subdomain != "" {
-					createReq.PagerDutySettings = &coredata.PagerDutyConnectorSettings{
+					raw, err := json.Marshal(&coredata.PagerDutyConnectorSettings{
 						Subdomain: subdomain,
+					})
+					if err != nil {
+						logger.ErrorCtx(r.Context(), "cannot marshal pagerduty settings", log.Error(err))
+						httpserver.RenderError(w, http.StatusInternalServerError, fmt.Errorf("internal error"))
+
+						return
 					}
+
+					createReq.RawSettings = raw
 				}
 			}
 
@@ -260,9 +273,17 @@ func handleConnectorComplete(
 				}
 
 				if teamID != "" {
-					createReq.VercelSettings = &coredata.VercelConnectorSettings{
+					raw, err := json.Marshal(&coredata.VercelConnectorSettings{
 						TeamID: teamID,
+					})
+					if err != nil {
+						logger.ErrorCtx(r.Context(), "cannot marshal vercel settings", log.Error(err))
+						httpserver.RenderError(w, http.StatusInternalServerError, fmt.Errorf("internal error"))
+
+						return
 					}
+
+					createReq.RawSettings = raw
 				}
 			}
 

pkg/server/server.go

@@ -27,6 +27,7 @@ import (
 	"go.probo.inc/probo/pkg/accessreview"
 	"go.probo.inc/probo/pkg/baseurl"
 	"go.probo.inc/probo/pkg/connector"
+	"go.probo.inc/probo/pkg/connector/provider"
 	"go.probo.inc/probo/pkg/cookiebanner"
 	"go.probo.inc/probo/pkg/esign"
 	"go.probo.inc/probo/pkg/file"
@@ -67,6 +68,7 @@ type Config struct {
 	Cookie            securecookie.Config
 	TokenSecret       string
 	ConnectorRegistry *connector.ConnectorRegistry
+	ProviderRegistry  *provider.Registry
 	CustomDomainCname string
 	Logger            *log.Logger
 }
@@ -104,6 +106,7 @@ func NewServer(cfg Config) (*Server, error) {
 		Cookie:            cfg.Cookie,
 		TokenSecret:       cfg.TokenSecret,
 		ConnectorRegistry: cfg.ConnectorRegistry,
+		ProviderRegistry:  cfg.ProviderRegistry,
 		CustomDomainCname: cfg.CustomDomainCname,
 		Logger:            cfg.Logger.Named("api"),
 	}