From e4f247a20da8b2c4467bcd57a190cbb24cc01800 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Aur=C3=A9lien=20Sibiril?=
 <81782+aureliensibiril@users.noreply.github.com>
Date: Fri, 29 May 2026 13:57:37 +0200
Subject: [PATCH] Share PostHog region mapping and tidy pagination
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The us/eu host strings lived in the driver and were duplicated in the
connector-settings resolver. Expose drivers.PostHogRegionBaseURL as the
single source and call it from the resolver.

Also parse the base URL only inside the absolute-next branch of
resolveNextURL, where it is actually used for the host check.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
---
 pkg/accessreview/drivers/posthog.go           | 25 +++++++++++++++----
 .../api/console/v1/connector_settings.go      | 17 ++-----------
 2 files changed, 22 insertions(+), 20 deletions(-)

diff --git a/pkg/accessreview/drivers/posthog.go b/pkg/accessreview/drivers/posthog.go
index 9f4943239..27b1f0da0 100644
--- a/pkg/accessreview/drivers/posthog.go
+++ b/pkg/accessreview/drivers/posthog.go
@@ -169,12 +169,12 @@ func (d *PostHogDriver) resolveNextURL(next string) (string, error) {
 		return "", fmt.Errorf("cannot parse posthog next page URL: %w", err)
 	}
 
-	base, err := url.Parse(d.baseURL)
-	if err != nil {
-		return "", fmt.Errorf("cannot parse posthog base URL: %w", err)
-	}
-
 	if nextURL.IsAbs() {
+		base, err := url.Parse(d.baseURL)
+		if err != nil {
+			return "", fmt.Errorf("cannot parse posthog base URL: %w", err)
+		}
+
 		// Pin pagination to the resolved data host. The connection's bearer
 		// token is attached to every request, so an absolute `next` pointing
 		// at a different host (a compromised or spoofed API response) would
@@ -200,6 +200,21 @@ func (d *PostHogDriver) resolveNextURL(next string) (string, error) {
 	return baseURL.ResolveReference(nextURL).String(), nil
 }
 
+// PostHogRegionBaseURL maps a PostHog Cloud region ("US"/"EU",
+// case-insensitive) to its data-API host. It is the single source of truth for
+// the regional hosts, shared with the connector-settings resolver so the two
+// never drift. Self-hosted instances use a full instance URL instead.
+func PostHogRegionBaseURL(region string) (string, bool) {
+	switch strings.ToLower(region) {
+	case "us":
+		return posthogUSBaseURL, true
+	case "eu":
+		return posthogEUBaseURL, true
+	default:
+		return "", false
+	}
+}
+
 // resolvePostHogRegion probes the PostHog Cloud region hosts with the given
 // token-bearing client and returns the first that answers 2xx on the @current
 // organization endpoint. OAuth connections authenticate via the region-agnostic
diff --git a/pkg/server/api/console/v1/connector_settings.go b/pkg/server/api/console/v1/connector_settings.go
index a636a389e..45c3d8e60 100644
--- a/pkg/server/api/console/v1/connector_settings.go
+++ b/pkg/server/api/console/v1/connector_settings.go
@@ -19,6 +19,7 @@ import (
 	"fmt"
 	"net/url"
 
+	"go.probo.inc/probo/pkg/accessreview/drivers"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/server/api/console/v1/types"
 )
@@ -98,7 +99,7 @@ func apiKeyConnectorSettings(input types.CreateAPIKeyConnectorInput) (json.RawMe
 			return nil, fmt.Errorf("cannot create posthog connector: posthogRegion is required")
 		}
 
-		baseURL, ok := posthogRegionBaseURL(*input.PosthogRegion)
+		baseURL, ok := drivers.PostHogRegionBaseURL(*input.PosthogRegion)
 		if !ok {
 			return nil, fmt.Errorf("cannot create posthog connector: posthogRegion must be US or EU")
 		}
@@ -120,20 +121,6 @@ func apiKeyConnectorSettings(input types.CreateAPIKeyConnectorInput) (json.RawMe
 	return nil, nil
 }
 
-// posthogRegionBaseURL maps a PostHog Cloud region selector to its data-API
-// base host. Only US and EU clouds exist; self-hosted instances use the
-// dedicated POSTHOG_SELF_HOSTED provider with a full instance URL instead.
-func posthogRegionBaseURL(region string) (string, bool) {
-	switch region {
-	case "US", "us":
-		return "https://us.posthog.com", true
-	case "EU", "eu":
-		return "https://eu.posthog.com", true
-	default:
-		return "", false
-	}
-}
-
 // clientCredentialsConnectorSettings marshals the provider-specific
 // extra settings for a client-credentials connector. See
 // apiKeyConnectorSettings for the error contract.