feat(connector): scope-preserving OAuth2 reconnect

[aureliensibiril]

Summary

• Reconnecting an OAuth2 connector now requests the union of previously granted and newly requested scopes, so a SCIM reconnect never drops the access-review scopes (and vice versa). Portable across every provider.
• The widest-scope row wins when multiple connectors exist for the same (org, provider) pair — tiebreak by most recent updated_at. Fixes the latent "oldest wins" bug in the Slack sender where re-installing Slack to switch channels silently did nothing.
• Defense-in-depth validation on reconnect: ConnectorService.Reconnect takes a ReconnectConnectorRequest and verifies the loaded row's organization, provider and protocol inside the same transaction, blocking cross-org/cross-provider corruption via a crafted connector_id in the initiate URL.
• Google Workspace reuse flows now carry include_granted_scopes=true and skip prompt=consent, so the user sees the delta consent screen instead of a full re-consent. Refresh tokens and Slack webhook settings are preserved through reconnect when the provider omits them.

Why

Users re-connecting Google Workspace for a new SCIM scope were silently losing the access-review scopes (and the reverse). Slack re-installs to switch channels silently broke because pkg/slack/sender.go picked connectors[0] ordered by created_at ASC. A stale connector_id in the initiate URL could target a connector in a sibling organization inside the same tenant.

All three are fixed at the runtime entry points (initiate handler, Slack sender, ConnectorService.GetByOrganizationIDAndProvider) without a DB schema change. Legacy duplicate rows remain in place and are consolidated forward via auto-reconnect.

Commits

Small, buildable, conventional commits:

1. feat(connector): add scope parsing utilities — ParseScopeString/FormatScopeString/UnionScopes/ScopesCover, tolerant of GitHub's comma-separated form.
2. fix(connector): relax Slack incoming webhook requirement — access-review Slack flows no longer fail at token parsing.
3. feat(connector): support OAuth2 scope preservation and incremental auth — Connection.Scopes(), OAuth2State.RequestedScopes fallback, SupportsIncrementalAuth, conditional include_granted_scopes/prompt=consent.
4. feat(coredata): add widest-scope connector loader — LoadOneByOrganizationIDAndProvider with Scopes()-driven selection.
5. feat(probo): validate reconnects and preserve dropped token fields — ReconnectConnectorRequest + in-tx validation + preserveConnectionFields for refresh token and Slack webhook.
6. refactor(console): rewrite /connectors/initiate to union scopes — extracted handler, scope union, InitiateOptions.ConnectorID passed explicitly instead of mutating r.URL.
7. fix(slack): select widest-scope connector in sender — replaces LoadAll[0] with the widest-scope loader in sendMessage and updateMessage.

The earlier commit Add Slack access review scopes (1-line fix to the providerOAuth2Scopes map) is carried along — it was not in the squash-merged state of #997.

Test plan

• go build ./... clean
• go vet ./... clean
• go test ./pkg/connector/... ./pkg/coredata/... — all passing (scopes_test.go, slack_test.go, new oauth2_test.go subtests, connector_test.go for connectorScopeCount)
• Manual smoke — Google Workspace SCIM + access review: connect Google Workspace for SCIM (4 scopes), then click "Add Access Source → Google Workspace". Expect the user to go through the full OAuth flow with include_granted_scopes=true and a delta consent screen, and a single connector row updated in place.
• Manual smoke — Slack re-install to switch channels: connect Slack to #general, then reconnect to #audit. Expect subsequent compliance events to route to #audit (the latent "oldest wins" bug being fixed).
• Manual smoke — explicit reconnect on a revoked token: revoke the Google token at the provider, click Reconnect on the access source. Expect a fresh token exchange (no short-circuit on stored scope coverage).
• Manual smoke — cross-org connector_id blocked: craft organization_id=OrgA&connector_id=<OrgB's id> in the initiate URL. Expect a 400 at callback time (caught inside Reconnect).

Out of scope

• Broader createAccessSource/updateAccessSource cross-org connector_id validation — flagged as a follow-up security PR (see design decision §6 in the plan).
• Consolidating Organization.slackConnections resolver duplicates — the sender picks the right row but the compliance page UI may still list legacy duplicates.

---

Summary by cubic

Adds scope‑preserving OAuth2 reconnects with an initiate flow that unions scopes and supports incremental auth; Slack now picks the correct connector and validates token responses. Handlers return clean HTTP errors, and cookie category queries are tenant‑scoped.

• New Features

  • Initiate unions stored + requested scopes and supports explicit reconnect via connector_id; InitiateOptions.IncludeGrantedScopes enables incremental auth (Google adds include_granted_scopes=true and skips prompt=consent).
  • If a token response omits scope, we fall back to requested scopes from state; added Connection.Scopes() and scope helpers (ParseScopeString, FormatScopeString, UnionScopes), plus a widest‑scope connector selector used by GetByOrganizationIDAndProvider and the Slack sender.
  • ReconnectConnectorRequest validates org/provider/protocol in‑transaction and preserves missing fields (refresh token, Slack webhook settings) during reconnect.

• Bug Fixes

  • Slack: added access‑review scopes, made incoming_webhook optional, validated ok/error, required access token, and selected the widest‑scope/most‑recent connector with clearer errors.
  • Connector handlers no longer panic and now log + return generic 4xx/5xx responses (no leaked internals); cookie categories loading is tenant‑scoped; cfg/dev.yaml drops redundant OAuth2 fields; Console uses useMutation + useToast.

^{Written for commit d990d56. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 16 files