099543dfa9
account/list marks the contract's primary account "main" on the live API, not "mymain" as the published docs example shows, so matching the documented spelling reported every account as a non-admin, including the contract owner. Roles cannot stand in: a main account carries the same technical/billing values a sub-account can hold. Classify off "sub" instead, the one value the docs and the API agree on. The fixture copied the docs example, so the test passed on the same wrong assumption. Its bodies now mirror a live capture, anonymized: the main account carries no main_account or allow_gui, sub-accounts add them plus the access lists, and the primary account's type is "main". A table test pins both spellings. A review keys accounts on email plus external ID. Email came only from account/details, and any failure blanked it while still emitting the record, so a transient 5xx moved an account to a different key and surfaced it as one account removed and another added. Only the stable answers now degrade: UpCloud returns 403 ACCOUNT_FORBIDDEN, not 404, for an account outside the token's reach, and both keep the list-only fields. Anything else aborts the run. A blank username no longer discards every account already collected, matching the sibling drivers. Resolve the source name from GET /1.3/account so sources read "UpCloud <username>" rather than staying generic, and link the connector to its documentation page. Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
60 lines
2.6 KiB
Go
60 lines
2.6 KiB
Go
// Copyright (c) 2026 Probo Inc <hello@probo.com>.
|
|
//
|
|
// Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
// of this software and associated documentation files (the "Software"), to deal
|
|
// in the Software without restriction, including without limitation the rights
|
|
// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
// copies of the Software, and to permit persons to whom the Software is
|
|
// furnished to do so, subject to the following conditions:
|
|
//
|
|
// The above copyright notice and this permission notice shall be included in
|
|
// all copies or substantial portions of the Software.
|
|
//
|
|
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
// SOFTWARE.
|
|
|
|
package provider
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
|
|
"go.gearno.de/kit/log"
|
|
"go.probo.inc/probo/pkg/accessreview/drivers"
|
|
"go.probo.inc/probo/pkg/coredata"
|
|
)
|
|
|
|
func upcloudRegistration() *Registration {
|
|
return &Registration{
|
|
Provider: coredata.ConnectorProviderUpCloud,
|
|
DisplayName: "UpCloud",
|
|
DocumentationURL: accessReviewDocsURL("upcloud"),
|
|
SupportsAPIKey: true,
|
|
// UpCloud API tokens ("ucat_...", created under Account > API
|
|
// tokens) authenticate as a standard Bearer token, so the default
|
|
// APIKeyConnection mode applies; no Header/Scheme/BasicAuth
|
|
// override is needed. There is no OAuth2 flow, and account/list
|
|
// already returns the main account plus every sub-account the token
|
|
// reaches, so there is nothing to pick: no settings struct, no
|
|
// picker.
|
|
//
|
|
// ProbeURL lets the connection-status check confirm the token with
|
|
// the same lightweight GET the driver uses; a bad token returns 401.
|
|
// account/list is main-account-only, so it also rejects a
|
|
// sub-account token, which authenticates but sees nothing.
|
|
ProbeURL: "https://api.upcloud.com/1.3/account/list",
|
|
NewDriver: func(_ context.Context, c *http.Client, _ *coredata.Connector, logger *log.Logger) (drivers.Driver, error) {
|
|
return drivers.NewUpCloudDriver(c, logger.Named("upcloud")), nil
|
|
},
|
|
// GET /1.3/account names the source after the token's own account.
|
|
NewNameResolver: func(_ context.Context, c *http.Client, _ *coredata.Connector, _ *log.Logger) drivers.NameResolver {
|
|
return drivers.NewUpCloudNameResolver(c)
|
|
},
|
|
}
|
|
}
|