probo/pkg/accessreview/drivers/linear.go

// Copyright (c) 2026 Probo Inc <hello@probo.com>.
//
// Permission is hereby granted, free of charge, to any person obtaining a copy
// of this software and associated documentation files (the "Software"), to deal
// in the Software without restriction, including without limitation the rights
// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
// copies of the Software, and to permit persons to whom the Software is
// furnished to do so, subject to the following conditions:
//
// The above copyright notice and this permission notice shall be included in
// all copies or substantial portions of the Software.
//
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
// SOFTWARE.

package drivers

import (
	"bytes"
	"context"
	"encoding/json"
	"fmt"
	"net/http"
	"strings"
	"time"

	"go.probo.inc/probo/pkg/coredata"
)

// LinearDriver fetches workspace users from Linear via OAuth2-authenticated
// GraphQL requests.
type LinearDriver struct {
	httpClient *http.Client
}

var _ Driver = (*LinearDriver)(nil)

type linearUsersRequest struct {
	Query     string               `json:"query"`
	Variables linearUsersVariables `json:"variables"`
}

type linearUsersVariables struct {
	After *string `json:"after"`
}

type linearUsersResponse struct {
	Data struct {
		Users struct {
			Nodes []struct {
				ID        string `json:"id"`
				Email     string `json:"email"`
				Name      string `json:"name"`
				Active    bool   `json:"active"`
				Admin     bool   `json:"admin"`
				Guest     bool   `json:"guest"`
				LastSeen  string `json:"lastSeen"`
				CreatedAt string `json:"createdAt"`
			} `json:"nodes"`
			PageInfo struct {
				HasNextPage bool   `json:"hasNextPage"`
				EndCursor   string `json:"endCursor"`
			} `json:"pageInfo"`
		} `json:"users"`
	} `json:"data"`
	Errors []struct {
		Message string `json:"message"`
	} `json:"errors"`
}

const linearGraphQLEndpoint = "https://api.linear.app/graphql"

func NewLinearDriver(httpClient *http.Client) *LinearDriver {
	return &LinearDriver{
		httpClient: httpClient,
	}
}

func (d *LinearDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error) {
	var (
		records []AccountRecord
		after   *string
	)

	for range maxPaginationPages {
		resp, err := d.queryUsers(ctx, after)
		if err != nil {
			return nil, err
		}

		for _, u := range resp.Data.Users.Nodes {
			accountType := coredata.AccessReviewEntryAccountTypeUser
			if strings.HasSuffix(u.Email, ".linear.app") {
				accountType = coredata.AccessReviewEntryAccountTypeServiceAccount
			}

			record := AccountRecord{
				Email:       u.Email,
				FullName:    u.Name,
				Roles:       linearRoles(u.Admin, u.Guest),
				Active:      new(u.Active),
				IsAdmin:     u.Admin,
				ExternalID:  u.ID,
				MFAStatus:   coredata.MFAStatusUnknown,
				AuthMethod:  coredata.AccessReviewEntryAuthMethodUnknown,
				AccountType: accountType,
			}

			if u.LastSeen != "" {
				if t, err := time.Parse(time.RFC3339, u.LastSeen); err == nil {
					record.LastLogin = &t
				}
			}

			if u.CreatedAt != "" {
				if t, err := time.Parse(time.RFC3339, u.CreatedAt); err == nil {
					record.CreatedAt = &t
				}
			}

			if record.Email != "" {
				records = append(records, record)
			}
		}

		if !resp.Data.Users.PageInfo.HasNextPage || resp.Data.Users.PageInfo.EndCursor == "" {
			return records, nil
		}

		nextCursor := resp.Data.Users.PageInfo.EndCursor
		after = &nextCursor
	}

	return nil, fmt.Errorf("cannot list all linear accounts: %w", ErrPaginationLimitReached)
}

func (d *LinearDriver) queryUsers(ctx context.Context, after *string) (*linearUsersResponse, error) {
	const query = `
query AccessReviewLinearUsers($after: String) {
  users(first: 100, after: $after) {
    nodes {
      id
      email
      name
      active
      admin
      guest
      lastSeen
      createdAt
    }
    pageInfo {
      hasNextPage
      endCursor
    }
  }
}
`

	body := linearUsersRequest{
		Query: query,
		Variables: linearUsersVariables{
			After: after,
		},
	}

	payload, err := json.Marshal(body)
	if err != nil {
		return nil, fmt.Errorf("cannot marshal linear users query: %w", err)
	}

	req, err := http.NewRequestWithContext(ctx, http.MethodPost, linearGraphQLEndpoint, bytes.NewReader(payload))
	if err != nil {
		return nil, fmt.Errorf("cannot create linear users request: %w", err)
	}

	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Accept", "application/json")

	httpResp, err := d.httpClient.Do(req)
	if err != nil {
		return nil, fmt.Errorf("cannot execute linear users request: %w", err)
	}

	defer func() {
		_ = httpResp.Body.Close()
	}()

	if httpResp.StatusCode < 200 || httpResp.StatusCode >= 300 {
		return nil, fmt.Errorf("cannot fetch linear users: unexpected status %d", httpResp.StatusCode)
	}

	var resp linearUsersResponse
	if err := json.NewDecoder(httpResp.Body).Decode(&resp); err != nil {
		return nil, fmt.Errorf("cannot decode linear users response: %w", err)
	}

	if len(resp.Errors) > 0 {
		return nil, fmt.Errorf("linear graphql error: %s", resp.Errors[0].Message)
	}

	return &resp, nil
}

func linearRoles(admin, guest bool) []string {
	switch {
	case admin:
		return []string{"Admin"}
	case guest:
		return []string{"Guest"}
	default:
		return []string{"Member"}
	}
}