Add Google Analytics, Dotfile, Segment and Square access-review connectors

[aureliensibiril]

Summary

Adds four access-review connectors — two OAuth2 and two API-key — plus their logos. Continues the connector-provider Registry pattern (one file per provider in pkg/connector/provider/); every provider declares a connection probe.

• Google Analytics (GA4) — OAuth2 with both analytics.readonly and analytics.manage.users.readonly (readonly alone 403s on the accounts list). Enumerates v1alpha access bindings at the account level and per property, merging entries by lowercased email so a user with account- and property-scoped roles appears once. Manual account picker (Pattern 1) with SetOrganizationSettings, a live account fetch, a name resolver, and a per-connection probe. Distinct from the Google Workspace connector.
• Dotfile — API key in the X-DOTFILE-API-KEY header (Pattern 3). Lists members via GET /v1/users (page pagination, include_suspended=true); owner/admin ⇒ admin, suspended_at ⇒ inactive. Static probe.
• Segment (Twilio) — Public API token as Bearer (Pattern 3) plus a required Region setting (US or EU) resolved to the regional host (api.segmentapis.com / eu1.api.segmentapis.com) and stored as SegmentConnectorSettings.BaseURL. Lists members via GET /users, then a per-user GET /users/{id} for roles (an unavoidable N+1), and GET /invites for pending members surfaced as inactive. Workspace Owner ⇒ admin. Per-connection BuildProbeURL.
• Square — OAuth2 (EMPLOYEES_READ) or a personal access token (Pattern 3). POST /v2/team-members/search with the Square-Version header and cursor pagination returns email/status/is_owner directly, so is_owner ⇒ admin with no role resolution. Custom probe (/v2/merchants/me) and name resolver.

Surfaces touched

• coredata — provider enum values (+ IsValid/ConnectorProviders), SegmentConnectorSettings{base_url} and GoogleAnalyticsConnectorSettings{account_id} (Dotfile/Square are Pattern 3, no settings struct), one migration adding the four ADD VALUEs.
• connector/provider — four Registrations + builtin.go wiring; buildSegmentProbeURL and probeSquare in probe.go; Square and GA4 name resolvers; GA4 organizations fetch + providerOrgConfigs picker entry.
• GraphQL — ConnectorProvider enum @goEnum lines + a segmentRegion input on CreateAPIKeyConnectorInput, validated and mapped to the regional base URL server-side.
• Bootstrap — GA4 and Square added to the confidential-OAuth provider loop and validateRequired; .env.example documents their CLIENT_ID/CLIENT_SECRET.
• Frontend — four brand logos wired into ThirdPartyLogo; the add-source dialog maps Segment's region onto the segmentRegion API-key input (without the mapping the required setting is silently dropped and the create is rejected).

Tests

Cassette-backed driver tests for all four (synthetic *.example.com fixtures), plus unit tests for the Segment probe URL and the bootstrap OAuth provider list. The probe-coverage test walks the registry asserting every provider declares a probe.

Notes for reviewers

• Frontend generated artifacts (schema.graphql, Relay __generated__) are gitignored; CI's make generate + Relay compile regenerate them from the committed connector.graphql source (which carries segmentRegion and the four @goEnum enum values).
• GA4 and Square each need a registered OAuth app; credentials are supplied per-deployment via the bootstrap env vars in .env.example.

---

Summary by cubic

Adds four access-review connectors: Google Analytics (GA4), Dotfile, Segment, and Square. Improves reliability and safety: Dotfile retries transient errors; GA4/Segment escape path segments; GA4 reviews include subproperties; Segment members keep unknown active status.

Service +1755 -0

• Added drivers:
  • GA4 (OAuth): merges account- and property-level bindings by email; includes subproperties; name resolver; organizations picker; path segments escaped.
  • Dotfile (API key X-DOTFILE-API-KEY): lists users; owner/admin ⇒ admin; suspended ⇒ inactive; retries transient 5xx.
  • Segment (Bearer + region base URL): lists users, per-user roles (/users/{id}), and pending invites (inactive). Confirmed members have unknown active status. Path segments escaped.
  • Square (OAuth or PAT): searches team members with Square-Version; is_owner ⇒ admin; custom probe; name resolver.
• Provider registry: registrations for all four; Segment BuildProbeURL; Square probe; GA4 and Square name resolvers.
• Bootstrap: GA4 and Square added to the confidential OAuth provider list and required-secret checks.

Coredata +102 -53

• Providers added: DOTFILE, SEGMENT, SQUARE, GOOGLE_ANALYTICS (enum, IsValid, ConnectorProviders), with migration.
• New settings: SegmentConnectorSettings{base_url}, GoogleAnalyticsConnectorSettings{account_id}.

GraphQL API +39 -0

• Exposes new providers in ConnectorProvider.
• Adds segmentRegion to CreateAPIKeyConnectorInput; server maps US/EU to base URL.
• GA4 picker: list accounts (status checked before decode) and return selected account id.

Tests +399 -1

• Cassette-backed driver tests for GA4, Dotfile, Segment, and Square.
• Unit tests for Segment probe URL, and Square and GA4 name resolvers.
• VCR scrubs X-Dotfile-Api-Key from recorded cassettes.

App: console +3 -0

• Maps Segment “region” UI field to segmentRegion API input.

Package: ui +87 -0

• Adds logos and ThirdPartyLogo wiring for Dotfile, Google Analytics, Segment, and Square.

Other +5 -0

• .env.example: GA4 and Square OAuth client variables.

^{Written for commit 04459e7. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 37 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>