nhi: emit APP_REGISTRATION on Okta apps (K3), excluding BOOKMARK/SWA

[c1-squire-dev]

What

Emit the NHI Phase-1 K3 resource signal on the Okta app AppResource so c1 can classify federated/OIDC Okta apps as non-human identity app-registrations.

This is the Class-A K3 mod from NHI RFC §6 (Okta row 5): app :327 → ➕APP_REGISTRATION (mod; exclude BOOKMARK/SWA). Separate from the K1 credential PR #170 (nhi/emit-credential-type).

Change (pkg/connector/app.go, in appResource)

appResource already receives the full *okta.Application (fetched by listApps → client.Application.ListApplications). It now reads the already-present SignOnMode field and attaches an NHI annotation:

if detail, ok := nhiAppDetail(app.SignOnMode); ok {
    resourceOpts = append(resourceOpts,
        sdkResource.WithNHIType(v2.NonHumanIdentityTrait_NHI_TYPE_APP_REGISTRATION, detail))
}

No new API calls — pure read of an already-fetched field (a "mod" per §6).

Exclusion logic (BOOKMARK + SWA)

Per §6 this is a mod that excludes BOOKMARK and SWA apps — those are human-facing launchers with no machine credentials, not NHI app-registrations. The discriminator is signOnMode, whose values are taken authoritatively from the okta-sdk-golang/v2 app constructors the connector uses:

Excluded signOnMode	Okta app type (SDK model)
BOOKMARK	bookmarkApplication.go
BROWSER_PLUGIN	swaApplication / swaThreeFieldApplication / browserPluginApplication
AUTO_LOGIN	autoLoginApplication.go
BASIC_AUTH	basicAuthApplication.go
SECURE_PASSWORD_STORE	securePasswordStoreApplication.go

Everything else (OPENID_CONNECT, SAML_2_0, WS_FEDERATION, …) is emitted as APP_REGISTRATION. This is a denylist, matching the RFC's "exclude BOOKMARK/SWA" framing.

Scope guard: SignOnMode is present on the synced okta.Application (okta-sdk-golang/v2/okta/application.go), so the BOOKMARK/SWA exclusion is fully supported — no limitation, no fabrication.

Detail string (RFC §2.8)

The axis-2 detail follows the <platform>.<object>.<purpose> convention (dotted lowercase, D-346): okta.app.<signOnMode lowercased> — e.g. okta.app.openid_connect, okta.app.saml_2_0, okta.app.ws_federation — or okta.app when signOnMode is empty. The real signOnMode is the honest discriminator; okta.app.oauth_service (the §2.8 example) is only one of several modes and isn't forced onto SAML/WS-Fed apps.

baton-sdk bump (interim self-bump, RFC D-345)

WithNHIType and the NonHumanIdentityTrait_NhiType enum (NHI_TYPE_APP_REGISTRATION = 1) land in baton-sdk v0.11.0, so this PR bumps:

go get github.com/conductorone/baton-sdk@v0.11.0   # v0.10.0 -> v0.11.0

Per D-345 this is an interim self-bump; rebases onto the baton-admin fleet bump once it lands. (The RFC's WithNHISubtype name is stale — the real v0.11.0 helper is WithNHIType(NhiType, detail), verified against the vendored SDK.)

Verification

• go build ./... — pass
• go test ./... — pass (pkg/connector ok; added TestAppResource_NHIType covering all 9 modes incl. the 5 exclusions)
• golangci-lint run ./pkg/connector/... — 0 issues

---

🛰️ Built with pqprime.

[github-actions]

Connector PR Review: nhi: emit APP_REGISTRATION on Okta apps (K3), excluding BOOKMARK/SWA

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Review mode: full
View review run

Review Summary

This PR adds a NonHumanIdentityTrait annotation with NHI_TYPE_APP_REGISTRATION to Okta app resources, excluding BOOKMARK and SWA sign-on modes that represent human-facing launchers. The implementation is a clean additive change — nhiAppDetail uses a denylist of excluded sign-on modes and produces a dotted-lowercase detail string from the existing SignOnMode field with no new API calls. The CI workflow adds a pre-install step for the baton CLI from baton-sdk releases to work around the archived conductorone/baton repo. Tests cover all 9 sign-on mode cases including the 5 exclusions. No issues found.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

[github-actions]

No blocking issues found.

[github-actions]

No blocking issues found.

[github-actions]

No blocking issues found.

[github-actions]

No blocking issues found.