Add access review campaigns

[aureliensibiril]

Summary

Add access review campaigns with full lifecycle management (create, start, close, cancel) and a source fetch worker that pulls account data from connected providers.

Access source drivers (18 providers)

Provider	Connection	Fields
Google Workspace	OAuth2	Email, name, role, admin, MFA, last login, created at
Slack	OAuth2	Email, name, role, job title, admin, MFA, bot support
Linear	OAuth2	Email, name, role, admin, active, created at
Cloudflare	API key	Email, name, roles (concatenated), MFA, active
Brex	API key	Email, name, role, active
Tally	API key	Email, name, role
1Password	API key	Email, name, role, active, MFA, created at
DocuSign	OAuth2	Email, name, role, job title, admin, active, created at
HubSpot	OAuth2	Email, name, role (resolved via roles endpoint)
Notion	OAuth2	Email, name, role, bot support (ServiceAccount)
Figma	OAuth2	Email, name
OpenAI	API key	Email, name, role, MFA
Sentry	API key	Email, name, role, MFA, active
GitHub	OAuth2	Email, name, role, admin, MFA, 2FA status
Supabase	API key	Email, name, role, MFA, active
Intercom	OAuth2	Email, name, role
Resend	API key	Email, name, role
Probo memberships	Internal	Email, name, role, admin, active, created at
CSV	File upload	Email, name, role, job title, admin, active, external ID

API surface (GraphQL + MCP + CLI)

• Campaign CRUD, start, close, cancel
• Access source CRUD with OAuth2 and API key connector support
• Campaign scope source management (add/remove)
• Access entry listing, flagging, and decision recording (approve/revoke)
• Bulk decide-all for batch processing

Console UI

• Campaign list with pagination and status badges
• Campaign detail page with entry table (flag, decision columns)
• Access source creation page with OAuth2 flow and API key dialog
• CSV upload source creation
• Vendor icon components for all supported providers

Bug fixes included

• Fix source name worker retry on resolution failure
• Fix React hooks ordering in access source page (lint)
• Fix connector dropdown showing non-unique labels
• Fix OAuth callback retry when mutation fails
• Handle DocuSign pagination parse errors
• Return error when driver pagination limit is reached
• Accept variable-length rows in CSV driver
• Fix scope sources query returning all org sources after removal

Test plan

• make test passes
• make lint passes (0 errors)
• make test-e2e — access review e2e tests pass
• Create a campaign via CLI, add a source, start it, verify source fetch completes
• Verify campaign lifecycle transitions (draft → in_progress → pending_actions → completed)
• Test cancel and delete flows

[cubic-dev-ai]

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="pkg/accessreview/drivers/github.go">

<violation number="1" location="pkg/accessreview/drivers/github.go:63">
P1: Custom agent: **Avoid Logging Sensitive Information**

Avoid logging member identifiers (`m.Login`) in warnings; this exposes PII in logs and violates the Avoid Logging Sensitive Information rule.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}