From f7085f98bee241971a5887ed8716c16ce7513fb4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Aur=C3=A9lien=20Sibiril?=
 <81782+aureliensibiril@users.noreply.github.com>
Date: Mon, 6 Apr 2026 20:20:46 +0200
Subject: [PATCH] Add OAuth2 provider definitions to connector package
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Centralise static OAuth2 properties (auth URL, token URL, scopes,
extra params, token endpoint auth) per provider in a single map.
This removes the need to duplicate these values in deployment
config; only ClientID and ClientSecret remain configurable.

Introduces ApplyProviderDefaults to set redirect URI and provider
defaults onto an OAuth2Connector at wiring time.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
---
 pkg/connector/providers.go | 96 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 96 insertions(+)
 create mode 100644 pkg/connector/providers.go

diff --git a/pkg/connector/providers.go b/pkg/connector/providers.go
new file mode 100644
index 000000000..4d1a12aef
--- /dev/null
+++ b/pkg/connector/providers.go
@@ -0,0 +1,96 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package connector
+
+const (
+	// CallbackPath is the HTTP path for the OAuth2 callback endpoint.
+	CallbackPath = "/api/console/v1/connectors/complete"
+)
+
+type (
+	// providerDefinition holds the static OAuth2 properties for a provider.
+	// These are intrinsic to the provider and do not vary between deployments.
+	providerDefinition struct {
+		AuthURL           string
+		TokenURL          string
+		Scopes            []string
+		ExtraAuthParams   map[string]string
+		TokenEndpointAuth string // "post-form" (default), "basic-form", or "basic-json"
+	}
+)
+
+// providerDefinitions maps provider names to their static OAuth2 definitions.
+// Only ClientID and ClientSecret come from deployment config.
+var (
+	providerDefinitions = map[string]providerDefinition{
+		"SLACK": {
+			AuthURL:  "https://slack.com/oauth/v2/authorize",
+			TokenURL: "https://slack.com/api/oauth.v2.access",
+			Scopes:   []string{"chat:write", "channels:join", "incoming-webhook"},
+		},
+		"HUBSPOT": {
+			AuthURL:  "https://app.hubspot.com/oauth/authorize",
+			TokenURL: "https://api.hubapi.com/oauth/v1/token",
+			Scopes:   []string{"settings.users.read"},
+		},
+		"DOCUSIGN": {
+			AuthURL:           "https://account.docusign.com/oauth/auth",
+			TokenURL:          "https://account.docusign.com/oauth/token",
+			Scopes:            []string{"signature"},
+			TokenEndpointAuth: "basic-form",
+		},
+		"NOTION": {
+			AuthURL:           "https://api.notion.com/v1/oauth/authorize",
+			TokenURL:          "https://api.notion.com/v1/oauth/token",
+			ExtraAuthParams:   map[string]string{"owner": "user"},
+			TokenEndpointAuth: "basic-json",
+		},
+		"GITHUB": {
+			AuthURL:  "https://github.com/login/oauth/authorize",
+			TokenURL: "https://github.com/login/oauth/access_token",
+			Scopes:   []string{"read:org"},
+		},
+		"SENTRY": {
+			AuthURL:  "https://sentry.io/oauth/authorize/",
+			TokenURL: "https://sentry.io/oauth/token/",
+			Scopes:   []string{"org:read", "member:read"},
+		},
+		"INTERCOM": {
+			AuthURL:  "https://app.intercom.com/oauth",
+			TokenURL: "https://api.intercom.io/auth/eagle/token",
+			// Scopes configured at app level in Intercom Developer Hub.
+		},
+		"BREX": {
+			AuthURL:  "https://accounts-api.brex.com/oauth2/default/v1/authorize",
+			TokenURL: "https://accounts-api.brex.com/oauth2/default/v1/token",
+			Scopes:   []string{"openid", "offline_access"},
+		},
+	}
+)
+
+// ApplyProviderDefaults sets the redirect URI and applies static provider
+// defaults (auth URL, token URL, scopes, extra params, token endpoint auth)
+// onto an OAuth2Connector. Call this before registering the connector.
+func ApplyProviderDefaults(provider string, redirectURI string, c *OAuth2Connector) {
+	c.RedirectURI = redirectURI
+
+	if def, ok := providerDefinitions[provider]; ok {
+		c.AuthURL = def.AuthURL
+		c.TokenURL = def.TokenURL
+		c.Scopes = def.Scopes
+		c.ExtraAuthParams = def.ExtraAuthParams
+		c.TokenEndpointAuth = def.TokenEndpointAuth
+	}
+}