CXP-383 Support Last Log In w/ usage event feed for the Enterprise connector

pkg/config/config.go

@@ -91,6 +91,18 @@ var (
 		field.WithDescription("Organization of your github app"),
 		field.WithRequired(true),
 	)
+
+	// syncLastActivity is hidden from this connector's GUI config and --help
+	// since it only applies to GitHub Enterprise audit-log access.
+	// baton-github-enterprise sets it directly on the shared Github struct,
+	// bypassing this CLI layer, so hiding it here doesn't affect that connector.
+	syncLastActivity = field.BoolField(
+		"sync-last-activity",
+		field.WithDisplayName("Sync users last activity"),
+		field.WithDescription("See when members were last active in your organizations."),
+		field.WithHidden(true),
+		field.WithExportTarget(field.ExportTargetCLIOnly),
+	)
 )
 
 //go:generate go run ./gen
@@ -107,6 +119,7 @@ var Config = field.NewConfiguration(
 		syncSecrets,
 		omitArchivedRepositories,
 		directCollaboratorsOnly,
+		syncLastActivity,
 	},
 	field.WithConnectorDisplayName("GitHub v2"),
 	field.WithHelpUrl("/docs/baton/github-v2"),

pkg/connector/connector.go

@@ -127,6 +127,7 @@ type GitHub struct {
 	omitArchivedRepositories bool
 	directCollaboratorsOnly  bool
 	enterprises              []string
+	syncLastActivity         bool
 }
 
 func (gh *GitHub) ResourceSyncers(ctx context.Context) []connectorbuilder.ResourceSyncerV2 {
@@ -148,6 +149,11 @@ func (gh *GitHub) ResourceSyncers(ctx context.Context) []connectorbuilder.Resour
 		resourceSyncers = append(resourceSyncers, APITokenBuilder(gh.client, gh.orgCache))
 	}
 
+	if gh.syncLastActivity {
+		// usageAppBuilder only exists to support usageEventFeed, so it's gated the same way.
+		resourceSyncers = append(resourceSyncers, newUsageAppBuilder())
+	}
+
 	if len(gh.enterprises) > 0 {
 		resourceSyncers = append(resourceSyncers,
 			EnterpriseRoleBuilder(gh.client, gh.appClient, gh.customClient, gh.enterprises),
@@ -157,8 +163,18 @@ func (gh *GitHub) ResourceSyncers(ctx context.Context) []connectorbuilder.Resour
 	return resourceSyncers
 }
 
+func (gh *GitHub) EventFeeds(_ context.Context) []connectorbuilder.EventFeed {
+	if !gh.syncLastActivity {
+		return nil
+	}
+
+	return []connectorbuilder.EventFeed{
+		newUsageEventFeed(gh.client, gh.orgs),
+	}
+}
+
 // Metadata returns metadata about the connector.
-func (gh *GitHub) Metadata(ctx context.Context) (*v2.ConnectorMetadata, error) {
+func (gh *GitHub) Metadata(_ context.Context) (*v2.ConnectorMetadata, error) {
 	return &v2.ConnectorMetadata{
 		DisplayName: "GitHub",
 		AccountCreationSchema: &v2.ConnectorAccountCreationSchema{
@@ -346,6 +362,7 @@ func newWithGithubPAT(ctx context.Context, ghc *cfg.Github) (*GitHub, error) {
 		syncSecrets:              ghc.SyncSecrets,
 		omitArchivedRepositories: ghc.OmitArchivedRepositories,
 		directCollaboratorsOnly:  ghc.DirectCollaboratorsOnly,
+		syncLastActivity:         ghc.SyncLastActivity,
 	}, nil
 }
 
@@ -452,6 +469,7 @@ func newWithGithubApp(ctx context.Context, ghc *cfg.Github) (*GitHub, error) {
 		syncSecrets:              ghc.SyncSecrets,
 		omitArchivedRepositories: ghc.OmitArchivedRepositories,
 		directCollaboratorsOnly:  ghc.DirectCollaboratorsOnly,
+		syncLastActivity:         ghc.SyncLastActivity,
 	}
 	return gh, nil
 }

pkg/connector/usage_app.go

@@ -0,0 +1,64 @@
+package connector
+
+import (
+	"context"
+
+	v2 "github.com/conductorone/baton-sdk/pb/c1/connector/v2"
+	"github.com/conductorone/baton-sdk/pkg/annotations"
+	"github.com/conductorone/baton-sdk/pkg/types/entitlement"
+	resourceSdk "github.com/conductorone/baton-sdk/pkg/types/resource"
+)
+
+const (
+	usageAppResourceID        = "github"
+	usageAppDisplayName       = "GitHub Activity"
+	usageAppAccessEntitlement = "access"
+)
+
+// resourceTypeUsageApp is a synthetic TRAIT_APP resource that usageEventFeed's
+// UsageEvents target, since GitHub's real resource types carry no entitlement
+// C1's usage uplift can key off of. Only synced when sync-last-activity is on.
+var resourceTypeUsageApp = &v2.ResourceType{
+	Id:          "usage-app",
+	DisplayName: "GitHub Activity",
+	Traits:      []v2.ResourceType_Trait{v2.ResourceType_TRAIT_APP},
+	Annotations: annotations.New(&v2.SkipGrants{}),
+}
+
+// usageAppBuilder syncs a single static App resource for usageEventFeed's
+// UsageEvents to target.
+type usageAppBuilder struct{}
+
+func newUsageAppBuilder() *usageAppBuilder {
+	return &usageAppBuilder{}
+}
+
+func (b *usageAppBuilder) ResourceType(_ context.Context) *v2.ResourceType {
+	return resourceTypeUsageApp
+}
+
+func (b *usageAppBuilder) List(_ context.Context, _ *v2.ResourceId, _ resourceSdk.SyncOpAttrs) ([]*v2.Resource, *resourceSdk.SyncOpResults, error) {
+	res, err := resourceSdk.NewAppResource(usageAppDisplayName, resourceTypeUsageApp, usageAppResourceID, nil)
+	if err != nil {
+		return nil, nil, err
+	}
+	return []*v2.Resource{res}, &resourceSdk.SyncOpResults{}, nil
+}
+
+func (b *usageAppBuilder) Entitlements(_ context.Context, resource *v2.Resource, _ resourceSdk.SyncOpAttrs) ([]*v2.Entitlement, *resourceSdk.SyncOpResults, error) {
+	return []*v2.Entitlement{
+		entitlement.NewAssignmentEntitlement(
+			resource,
+			usageAppAccessEntitlement,
+			entitlement.WithGrantableTo(resourceTypeUser),
+			entitlement.WithDisplayName("GitHub Access"),
+			entitlement.WithDescription("Has access to GitHub"),
+		),
+	}, &resourceSdk.SyncOpResults{}, nil
+}
+
+func (b *usageAppBuilder) Grants(_ context.Context, _ *v2.Resource, _ resourceSdk.SyncOpAttrs) ([]*v2.Grant, *resourceSdk.SyncOpResults, error) {
+	// Grants are intentionally not emitted: the usage uplift maps the login
+	// actor directly to a synced app user, not via a grant.
+	return nil, &resourceSdk.SyncOpResults{}, nil
+}