Add support for custom actions.

examples/postgres-test.yml

@@ -8,6 +8,36 @@ connect:
   # Data Source Name (DSN) for our test PostgreSQL instance
   dsn: "postgres://${DB_USER}:${DB_PASSWORD}@${DB_HOST}:${DB_PORT}/${DB_DATABASE}?sslmode=disable"
 
+actions:
+  enable_user:
+    name: Enable User
+    description: Enable a disabled user account
+    action_type:
+      - account_enable
+    arguments:
+      user_id:
+        name: User ID
+        type: string
+        required: true
+        description: The ID of the user to enable
+    query: |
+      UPDATE users SET status = 'active' WHERE username = ?<user_id>
+  disable_user:
+    name: Disable User
+    description: Disable a user account
+    action_type:
+      - account_disable
+    arguments:
+      user_id:
+        name: User ID
+        type: string
+        required: true
+        description: The ID of the user to disable
+    # vars:
+    #   username: "input.user_id"
+    query: |
+      UPDATE users SET status = 'disabled' WHERE username = ?<user_id>
+
 # Definition of different resource types managed by this connector
 resource_types:
   # Configuration for "user" resources in PostgreSQL

go.mod

@@ -3,7 +3,7 @@ module github.com/conductorone/baton-sql
 go 1.25
 
 require (
-	github.com/conductorone/baton-sdk v0.4.5
+	github.com/conductorone/baton-sdk v0.4.6
 	github.com/elliotchance/phpserialize v1.4.0
 	github.com/ennyjfrick/ruleguard-logfatal v0.0.2
 	github.com/go-sql-driver/mysql v1.9.2
@@ -14,9 +14,10 @@ require (
 	github.com/quasilyte/go-ruleguard/dsl v0.3.22
 	github.com/sijms/go-ora/v2 v2.8.24
 	github.com/spf13/viper v1.20.1
-	github.com/stretchr/testify v1.10.0
+	github.com/stretchr/testify v1.11.1
 	go.uber.org/zap v1.27.0
 	golang.org/x/text v0.24.0
+	google.golang.org/grpc v1.71.1
 	google.golang.org/protobuf v1.36.6
 	gopkg.in/yaml.v3 v3.0.1
 )
@@ -58,6 +59,7 @@ require (
 	github.com/dolthub/maphash v0.1.0 // indirect
 	github.com/doug-martin/goqu/v9 v9.19.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/ebitengine/purego v0.8.4 // indirect
 	github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/gammazero/deque v1.0.0 // indirect
@@ -93,8 +95,7 @@ require (
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/sagikazarmark/locafero v0.9.0 // indirect
 	github.com/segmentio/ksuid v1.0.4 // indirect
-	github.com/shirou/gopsutil/v3 v3.24.5 // indirect
-	github.com/shoenig/go-m1cpu v0.1.6 // indirect
+	github.com/shirou/gopsutil/v4 v4.25.8 // indirect
 	github.com/sourcegraph/conc v0.3.0 // indirect
 	github.com/spf13/afero v1.14.0 // indirect
 	github.com/spf13/cast v1.7.1 // indirect
@@ -125,11 +126,10 @@ require (
 	golang.org/x/net v0.39.0 // indirect
 	golang.org/x/oauth2 v0.29.0 // indirect
 	golang.org/x/sync v0.13.0 // indirect
-	golang.org/x/sys v0.32.0 // indirect
+	golang.org/x/sys v0.35.0 // indirect
 	golang.org/x/term v0.31.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20250414145226-207652e42e2e // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250414145226-207652e42e2e // indirect
-	google.golang.org/grpc v1.71.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	modernc.org/libc v1.62.1 // indirect
 	modernc.org/mathutil v1.7.1 // indirect

go.sum

@@ -76,8 +76,8 @@ github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyY
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/conductorone/baton-sdk v0.4.5 h1:nRFtkvh45sicP1E4P/Pd7BxDthxl7aMdX7njycZY21U=
-github.com/conductorone/baton-sdk v0.4.5/go.mod h1:+huiRikMY92zOix5Cy964hk4qOu8FDyKW1MPBwSte08=
+github.com/conductorone/baton-sdk v0.4.6 h1:gsjl+/r1ZuOVS25bwAqwG62bdYa/Ob3/qIOlt1oMa1g=
+github.com/conductorone/baton-sdk v0.4.6/go.mod h1:EYZ1Hq2NCSENzFLuTPdnarSXfb7ESjeXwDvDe0TPR3s=
 github.com/conductorone/dpop v0.2.4 h1:PaiDOX1gAIXtOJPxXf08GsGkpCuT/iECEjSJzLpi0zU=
 github.com/conductorone/dpop v0.2.4/go.mod h1:gyo8TtzB9SCFCsjsICH4IaLZ7y64CcrDXMOPBwfq/3s=
 github.com/conductorone/dpop/integrations/dpop_grpc v0.2.4 h1:lYxYi9/WTSL9sE96CO0QF2BY3kehs8dTTApI134TGCA=
@@ -98,6 +98,8 @@ github.com/doug-martin/goqu/v9 v9.19.0 h1:PD7t1X3tRcUiSdc5TEyOFKujZA5gs3VSA7wxSv
 github.com/doug-martin/goqu/v9 v9.19.0/go.mod h1:nf0Wc2/hV3gYK9LiyqIrzBEVGlI8qW3GuDCEobC4wBQ=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/ebitengine/purego v0.8.4 h1:CF7LEKg5FFOsASUj0+QwaXf8Ht6TlFxg09+S9wz0omw=
+github.com/ebitengine/purego v0.8.4/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/elliotchance/phpserialize v1.4.0 h1:cAp/9+KSnEbUC8oYCE32n2n84BeW8HOY3HMDI8hG2OY=
 github.com/elliotchance/phpserialize v1.4.0/go.mod h1:gt7XX9+ETUcLXbtTKEuyrqW3lcLUAeS/AnGZ2e49TZs=
 github.com/ennyjfrick/ruleguard-logfatal v0.0.2 h1:FlNMe9+h029VZVD8n6YdFzZAQz/aA8y6WSZttg50yBM=
@@ -246,12 +248,8 @@ github.com/sagikazarmark/locafero v0.9.0 h1:GbgQGNtTrEmddYDSAH9QLRyfAHY12md+8YFT
 github.com/sagikazarmark/locafero v0.9.0/go.mod h1:UBUyz37V+EdMS3hDF3QWIiVr/2dPrx49OMO0Bn0hJqk=
 github.com/segmentio/ksuid v1.0.4 h1:sBo2BdShXjmcugAMwjugoGUdUV0pcxY5mW4xKRn3v4c=
 github.com/segmentio/ksuid v1.0.4/go.mod h1:/XUiZBD3kVx5SmUOl55voK5yeAbBNNIed+2O73XgrPE=
-github.com/shirou/gopsutil/v3 v3.24.5 h1:i0t8kL+kQTvpAYToeuiVk3TgDeKOFioZO3Ztz/iZ9pI=
-github.com/shirou/gopsutil/v3 v3.24.5/go.mod h1:bsoOS1aStSs9ErQ1WWfxllSeS1K5D+U30r2NfcubMVk=
-github.com/shoenig/go-m1cpu v0.1.6 h1:nxdKQNcEB6vzgA2E2bvzKIYRuNj7XNJ4S/aRSwKzFtM=
-github.com/shoenig/go-m1cpu v0.1.6/go.mod h1:1JJMcUBvfNwpq05QDQVAnx3gUHr9IYF7GNg9SUEw2VQ=
-github.com/shoenig/test v0.6.4 h1:kVTaSd7WLz5WZ2IaoM0RSzRsUD+m8wRR+5qvntpn4LU=
-github.com/shoenig/test v0.6.4/go.mod h1:byHiCGXqrVaflBLAMq/srcZIHynQPQgeyvkvXnjqq0k=
+github.com/shirou/gopsutil/v4 v4.25.8 h1:NnAsw9lN7587WHxjJA9ryDnqhJpFH6A+wagYWTOH970=
+github.com/shirou/gopsutil/v4 v4.25.8/go.mod h1:q9QdMmfAOVIw7a+eF86P7ISEU6ka+NLgkUxlopV4RwI=
 github.com/sijms/go-ora/v2 v2.8.24 h1:TODRWjWGwJ1VlBOhbTLat+diTYe8HXq2soJeB+HMjnw=
 github.com/sijms/go-ora/v2 v2.8.24/go.mod h1:QgFInVi3ZWyqAiJwzBQA+nbKYKH77tdp1PYoCqhR2dU=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
@@ -283,8 +281,8 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
 github.com/tklauser/go-sysconf v0.3.15 h1:VE89k0criAymJ/Os65CSn1IXaol+1wrsFHEB8Ol49K4=
@@ -389,8 +387,8 @@ golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20=
-golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
+golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.31.0 h1:erwDkOK1Msy6offm1mOgvspSkslFnIGsFnxOKoufg3o=
 golang.org/x/term v0.31.0/go.mod h1:R4BeIy7D95HzImkxGkTW1UQTtP54tio2RyHz7PwK0aw=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=

pkg/bsql/config.go

@@ -6,6 +6,8 @@ import (
 	"fmt"
 	"os"
 
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 	"gopkg.in/yaml.v3"
 
 	v2 "github.com/conductorone/baton-sdk/pb/c1/connector/v2"
@@ -24,6 +26,13 @@ type Config struct {
 
 	// ResourceTypes defines the set of resource types (e.g., user, role) configured in the connector.
 	ResourceTypes map[string]ResourceType `yaml:"resource_types" json:"resource_types"`
+
+	// Actions defines the set of actions configured in the connector.
+	Actions map[string]ActionConfig `yaml:"actions" json:"actions"`
+}
+
+func (c Config) HasActions() bool {
+	return len(c.Actions) > 0
 }
 
 // DatabaseConfig contains settings required to connect to the database.
@@ -400,6 +409,42 @@ type CredentialRotation struct {
 	Update *AccountCreationConfig `yaml:"update" json:"update"`
 }
 
+type ActionConfig struct {
+	Name          string                    `yaml:"name" json:"name" validate:"required"`
+	Description   string                    `yaml:"description,omitempty" json:"description,omitempty" validate:"omitempty"`
+	Arguments     map[string]ArgumentConfig `yaml:"arguments,omitempty" json:"arguments,omitempty" validate:"omitempty,dive"`
+	Vars          map[string]string         `yaml:"vars,omitempty" json:"vars,omitempty" validate:"omitempty"`
+	NoTransaction bool                      `yaml:"no_transaction,omitempty" json:"no_transaction,omitempty" validate:"omitempty"`
+	Query         string                    `yaml:"query" json:"query" validate:"required"`
+	// TODO: add validation?
+	//revive:disable-next-line:line-length-limit // because it's a long field
+	ActionType []string `yaml:"action_type,omitempty" json:"action_type,omitempty" validate:"omitempty,dive,oneof=unspecified dynamic account account_update_profile account_disable account_enable"`
+}
+
+type ArgumentConfig struct {
+	Name        string `yaml:"name" json:"name" validate:"required"`
+	DisplayName string `yaml:"display_name,omitempty" json:"display_name,omitempty" validate:"omitempty"`
+	Description string `yaml:"description,omitempty" json:"description,omitempty" validate:"omitempty"`
+	//revive:disable-next-line:line-length-limit // because it's a long field
+	Type     string `yaml:"type" json:"type" validate:"required,oneof=string boolean number string_list string_map" jsonschema:"enum=string,enum=boolean,enum=number,enum=string_list,enum=string_map"`
+	Default  any    `yaml:"default,omitempty" json:"default,omitempty" validate:"omitempty"`
+	Required bool   `yaml:"required,omitempty" json:"required,omitempty" validate:"omitempty"`
+}
+
+func (a *ActionConfig) Validate() error {
+	if a.Query == "" {
+		return status.Errorf(codes.InvalidArgument, "query is required")
+	}
+
+	for _, arg := range a.Arguments {
+		if arg.Required && arg.Default != nil {
+			return status.Errorf(codes.InvalidArgument, "action %s argument %s is required but has a default", a.Name, arg.Name)
+		}
+	}
+
+	return nil
+}
+
 func (c Config) ExtractAccountProvisioning() (string, *AccountProvisioning, error) {
 	for rtID, rt := range c.ResourceTypes {
 		if rt.AccountProvisioning != nil {

pkg/bsql/provisioning.go

@@ -70,7 +70,7 @@ func (s *SQLSyncer) Grant(ctx context.Context, principal *v2.Resource, entitleme
 	}
 
 	useTx := !provisioningConfig.Grant.NoTransaction
-	err = s.runProvisioningQueries(ctx, provisioningConfig.Grant.Queries, provisioningVars, useTx)
+	err = s.RunProvisioningQueries(ctx, provisioningConfig.Grant.Queries, provisioningVars, useTx)
 	if err != nil {
 		return nil, err
 	}
@@ -115,7 +115,7 @@ func (s *SQLSyncer) Revoke(ctx context.Context, grant *v2.Grant) (annotations.An
 	}
 
 	useTx := !provisioningConfig.Revoke.NoTransaction
-	err = s.runProvisioningQueries(ctx, provisioningConfig.Revoke.Queries, provisioningVars, useTx)
+	err = s.RunProvisioningQueries(ctx, provisioningConfig.Revoke.Queries, provisioningVars, useTx)
 	if err != nil {
 		return nil, err
 	}

pkg/bsql/query.go

@@ -292,7 +292,7 @@ func (s *SQLSyncer) prepareProvisioningQuery(query string, vars map[string]any)
 	return updatedQuery, qArgs, nil
 }
 
-func (s *SQLSyncer) runProvisioningQueries(ctx context.Context, queries []string, vars map[string]any, useTx bool) error {
+func (s *SQLSyncer) RunProvisioningQueries(ctx context.Context, queries []string, vars map[string]any, useTx bool) error {
 	l := ctxzap.Extract(ctx)
 
 	var committed bool
@@ -317,12 +317,12 @@ func (s *SQLSyncer) runProvisioningQueries(ctx context.Context, queries []string
 	for _, q := range queries {
 		q, qArgs, err := s.prepareProvisioningQuery(q, vars)
 		if err != nil {
-			return err
+			return fmt.Errorf("failed to prepare query: %w", err)
 		}
 
 		result, err := executor.ExecContext(ctx, q, qArgs...)
 		if err != nil {
-			return err
+			return fmt.Errorf("failed to execute query: %w", err)
 		}
 
 		rowsAffected, err := result.RowsAffected()

pkg/bsql/sql_syncer.go

@@ -58,3 +58,13 @@ func (c Config) GetSQLSyncers(ctx context.Context, db *sql.DB, dbEngine database
 
 	return ret, nil
 }
+
+func NewActionSyncer(ctx context.Context, db *sql.DB, dbEngine database.DbEngine, celEnv *bcel.Env, fullConfig Config) (*SQLSyncer, error) {
+	return &SQLSyncer{
+		resourceType: nil,
+		db:           db,
+		dbEngine:     dbEngine,
+		env:          celEnv,
+		fullConfig:   fullConfig,
+	}, nil
+}

pkg/bsql/user_syncer.go

@@ -138,7 +138,7 @@ func (s *userSyncer) CreateAccount(
 
 	// Execute account creation queries
 	useTransaction := !provisioningConfig.Create.NoTransaction
-	if err := s.runProvisioningQueries(ctx, provisioningConfig.Create.Queries, queryInputs, useTransaction); err != nil {
+	if err := s.RunProvisioningQueries(ctx, provisioningConfig.Create.Queries, queryInputs, useTransaction); err != nil {
 		return nil, nil, nil, err
 	}
 
@@ -187,7 +187,7 @@ func (s *userSyncer) Rotate(ctx context.Context, resourceId *v2.ResourceId, cred
 
 	// Execute account creation queries
 	useTransaction := !rotationConfig.Update.NoTransaction
-	if err := s.runProvisioningQueries(ctx, rotationConfig.Update.Queries, queryInputs, useTransaction); err != nil {
+	if err := s.RunProvisioningQueries(ctx, rotationConfig.Update.Queries, queryInputs, useTransaction); err != nil {
 		return nil, nil, err
 	}