fix(connector): Okta activate param, Mailchimp upsert endpoint

Okta: always pass ?activate=<bool> — omitting it when false causes Okta
to activate the user by default, triggering unintended provisioning side effects.

Mailchimp: switch add_member from POST /members to PUT /members/{hash}
(MD5 of lowercased email). The POST endpoint returns a duplicate-member
error on reruns; the PUT upsert endpoint is idempotent.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 2 people

packages/engine/internal/connector/mailchimp.go

@@ -3,6 +3,8 @@ package connector
 import (
 	"bytes"
 	"context"
+	"crypto/md5"
+	"encoding/hex"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -122,8 +124,11 @@ func (c *MailchimpAddMemberConnector) Execute(ctx context.Context, params map[st
 		return nil, fmt.Errorf("mailchimp/add_member: marshaling request: %w", err)
 	}
 
-	req, err := http.NewRequestWithContext(ctx, "POST",
-		c.apiURL(dc, fmt.Sprintf("/lists/%s/members", listID)),
+	hash := md5.Sum([]byte(strings.ToLower(email)))
+	subscriberHash := hex.EncodeToString(hash[:])
+
+	req, err := http.NewRequestWithContext(ctx, "PUT",
+		c.apiURL(dc, fmt.Sprintf("/lists/%s/members/%s", listID, subscriberHash)),
 		bytes.NewReader(reqJSON),
 	)
 	if err != nil {

packages/engine/internal/connector/mailchimp_test.go

@@ -73,8 +73,10 @@ func TestMailchimpListMembersConnector_InvalidAPIKeyFormat(t *testing.T) {
 }
 
 func TestMailchimpAddMemberConnector_AddsMember(t *testing.T) {
+	// md5("bob@example.com") = 4b9bb80620f03eb3719e0a061c14283d
+	const wantPath = "/3.0/lists/list1/members/4b9bb80620f03eb3719e0a061c14283d"
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method != "POST" || r.URL.Path != "/3.0/lists/list1/members" {
+		if r.Method != "PUT" || r.URL.Path != wantPath {
 			t.Errorf("unexpected %s %s", r.Method, r.URL.Path)
 		}
 		var body map[string]any

packages/engine/internal/connector/okta.go

@@ -121,10 +121,7 @@ func (c *OktaCreateUserConnector) Execute(ctx context.Context, params map[string
 		return nil, fmt.Errorf("okta/create_user: marshaling request: %w", err)
 	}
 
-	endpoint := c.apiURL(domain, "/api/v1/users")
-	if activate {
-		endpoint += "?activate=true"
-	}
+	endpoint := fmt.Sprintf("%s?activate=%v", c.apiURL(domain, "/api/v1/users"), activate)
 
 	req, err := http.NewRequestWithContext(ctx, "POST", endpoint, bytes.NewReader(reqJSON))
 	if err != nil {

packages/engine/internal/connector/okta_test.go

@@ -78,6 +78,9 @@ func TestOktaCreateUserConnector_CreatesUser(t *testing.T) {
 		if r.Method != "POST" {
 			t.Errorf("expected POST, got %s", r.Method)
 		}
+		if r.URL.Query().Get("activate") != "true" {
+			t.Errorf("expected activate=true, got %q", r.URL.Query().Get("activate"))
+		}
 		var body map[string]any
 		json.NewDecoder(r.Body).Decode(&body)
 		profile, _ := body["profile"].(map[string]any)
@@ -108,6 +111,31 @@ func TestOktaCreateUserConnector_CreatesUser(t *testing.T) {
 	}
 }
 
+func TestOktaCreateUserConnector_ActivateFalse(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Query().Get("activate") != "false" {
+			t.Errorf("expected activate=false, got %q", r.URL.Query().Get("activate"))
+		}
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		json.NewEncoder(w).Encode(map[string]any{"id": "00u2", "status": "STAGED"})
+	}))
+	defer srv.Close()
+
+	c := &OktaCreateUserConnector{baseURL: srv.URL}
+	out, err := c.Execute(t.Context(), map[string]any{
+		"_credential": map[string]string{"domain": "dev.okta.com", "token": "tok"},
+		"activate":    false,
+		"profile":     map[string]any{"login": "staged@example.com", "email": "staged@example.com"},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if out["id"] != "00u2" {
+		t.Errorf("expected id=00u2, got %v", out["id"])
+	}
+}
+
 func TestOktaCreateUserConnector_MissingProfile(t *testing.T) {
 	c := &OktaCreateUserConnector{baseURL: "http://unused"}
 	_, err := c.Execute(t.Context(), map[string]any{