collavre_github 0.6.1 → 0.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 82dd93990d2dc692575a20c51b26144b69c9af885b36e60b4868fa7559c76363
-  data.tar.gz: b929db48adbbdcb8c56d8cb72efb171bac40cf852721aa98927af101ee41d82b
+  metadata.gz: 3c290ca646f38dca20fc5579da040eb6afe437b763298b130b4cfdf33528b53b
+  data.tar.gz: 42b03d3de6dc5b1e7c3150b0acbf42400d1057f0c3dc0281ede2e91f13e9e70e
 SHA512:
-  metadata.gz: e2d9681cdc7f1872a0b821b1288886c575207d3370c373d062f630ed23015e5fef8ad5c8c76b6e48ecbb7fd7c6dde99788ff3b5c68bbd690a2bcd4b7ed6c8d6e
-  data.tar.gz: 67382060fae2662cee2481f0cef2ae6fb979f4b4653f3ef63db141cdfb95d35347f845259c9ca205b9e90c81efaac419470b75e48969579abac86bf5e0fdaa01
+  metadata.gz: d5a7fd65770ca4b23ad127dacef54e615300a1fa7b695ff2e7cbb071cef667457fec581d469d893c5a7c3e41be844fe24f9f32ee4c42034738fbb46b08c41448
+  data.tar.gz: 0c011cec94b20d833d185df0eb5666309f68814700a55a94c1ec41fe1be5d6105639c0b79f6b4c577275a81c36a047dbb17c71cb3272d7559a96ec93453804f8

data/app/javascript/__tests__/github_wizard_state.test.js

@@ -0,0 +1,57 @@
+import { deriveConnectState, shouldShowConnectNext } from '../github_wizard_state.js';
+
+describe('deriveConnectState', () => {
+  test('connected user with selected repos: connected + existing', () => {
+    expect(deriveConnectState({ connected: true, selected_repositories: ['a/b'] }))
+      .toEqual({ userConnected: true, hasExistingIntegration: true });
+  });
+
+  test('connected user with no selected repos: connected, no existing', () => {
+    expect(deriveConnectState({ connected: true, selected_repositories: [] }))
+      .toEqual({ userConnected: true, hasExistingIntegration: false });
+  });
+
+  test('connected user ignores all_repositories for existing flag', () => {
+    // A connected user's existing state comes from their own selection,
+    // never from other members' all_repositories.
+    expect(deriveConnectState({ connected: true, selected_repositories: [], all_repositories: ['x/y', 'x/z'] }))
+      .toEqual({ userConnected: true, hasExistingIntegration: false });
+  });
+
+  test('unconnected user with repos linked by others: not connected but existing', () => {
+    expect(deriveConnectState({ connected: false, all_repositories: ['x/y', 'x/z', 'x/w'] }))
+      .toEqual({ userConnected: false, hasExistingIntegration: true });
+  });
+
+  test('unconnected user with no repos: not connected, no existing', () => {
+    expect(deriveConnectState({ connected: false, all_repositories: [] }))
+      .toEqual({ userConnected: false, hasExistingIntegration: false });
+  });
+
+  test('tolerates missing/empty payload', () => {
+    expect(deriveConnectState()).toEqual({ userConnected: false, hasExistingIntegration: false });
+    expect(deriveConnectState({})).toEqual({ userConnected: false, hasExistingIntegration: false });
+  });
+});
+
+describe('shouldShowConnectNext', () => {
+  test('shows Next only when the current user is connected AND repos exist', () => {
+    expect(shouldShowConnectNext({ hasExistingIntegration: true, userConnected: true })).toBe(true);
+  });
+
+  test('hides Next for an unconnected user even when repos exist (regression)', () => {
+    // Repos linked by other members must not let an unauthenticated user
+    // advance into an empty organization list — they must log in first.
+    expect(shouldShowConnectNext({ hasExistingIntegration: true, userConnected: false })).toBe(false);
+  });
+
+  test('hides Next when there is no existing integration', () => {
+    expect(shouldShowConnectNext({ hasExistingIntegration: false, userConnected: true })).toBe(false);
+    expect(shouldShowConnectNext({ hasExistingIntegration: false, userConnected: false })).toBe(false);
+  });
+
+  test('tolerates missing state', () => {
+    expect(shouldShowConnectNext()).toBe(false);
+    expect(shouldShowConnectNext({})).toBe(false);
+  });
+});

data/app/javascript/collavre_github.js

@@ -1,5 +1,6 @@
 import { csrfToken, showError, clearError, updateStepVisibility, openOAuthPopup, fetchWithCsrf, setupModalClose } from 'collavre/modules/integration_wizard';
 import { alertDialog, confirmDialog } from 'collavre/lib/utils/dialog';
+import { deriveConnectState, shouldShowConnectNext } from './github_wizard_state.js';
 
 let githubIntegrationInitialized = false;
 
@@ -51,6 +52,10 @@ if (!githubIntegrationInitialized) {
     let webhookDetails = {};
 
     let hasExistingIntegration = false;
+    // Whether the *current* user has their own connected GitHub account.
+    // hasExistingIntegration can be true from other members' linked repos while
+    // this user is still unauthenticated, so the two must be tracked separately.
+    let userConnected = false;
     let selectedReposForDeletion = new Set();
 
     const markdownSyncList = document.getElementById('github-markdown-sync-list');
@@ -64,6 +69,7 @@ if (!githubIntegrationInitialized) {
       webhookDetails = {};
 
       hasExistingIntegration = false;
+      userConnected = false;
       selectedReposForDeletion = new Set();
       statusEl.textContent = '';
       errorEl.style.display = 'none';
@@ -101,7 +107,10 @@ if (!githubIntegrationInitialized) {
 
       if (currentStep === 'connect') {
         prevBtn.style.display = 'none';
-        if (hasExistingIntegration) {
+        // Only surface "Next" when the current user is actually connected. When
+        // existing repos come solely from other members, the user must log in
+        // first — otherwise Next leads to an empty (0 org) dead end.
+        if (shouldShowConnectNext({ hasExistingIntegration, userConnected })) {
           nextBtn.style.display = 'block';
           nextBtn.disabled = false;
         } else {
@@ -198,18 +207,19 @@ if (!githubIntegrationInitialized) {
       fetch(`/github/creatives/${creativeId}/integration`, { headers: { Accept: 'application/json' } })
         .then(function (response) { return response.json(); })
         .then(function (data) {
+          var connectState = deriveConnectState(data);
+          userConnected = connectState.userConnected;
+          hasExistingIntegration = connectState.hasExistingIntegration;
+
           if (!data.connected) {
-            var allRepos = data.all_repositories || [];
-            if (allRepos.length > 0) {
+            if (hasExistingIntegration) {
               // Other users have linked repositories to this creative
               statusEl.textContent = existingMessage;
-              hasExistingIntegration = true;
-              renderExistingConnections(allRepos, true);
+              renderExistingConnections(data.all_repositories || [], true);
               if (connectMessage) connectMessage.style.display = 'none';
               if (loginBtn) loginBtn.style.display = 'inline-block';
             } else {
               statusEl.textContent = '';
-              hasExistingIntegration = false;
               renderExistingConnections([]);
               if (connectMessage) connectMessage.style.display = '';
               if (loginBtn) loginBtn.style.display = 'inline-block';
@@ -230,8 +240,7 @@ if (!githubIntegrationInitialized) {
             }
           });
 
-          hasExistingIntegration = selectedRepos.size > 0;
-          
+          // hasExistingIntegration was derived above from selected_repositories.
           if (loginBtn) loginBtn.style.display = 'none';
           renderExistingConnections(Array.from(selectedRepos));
 

data/app/javascript/github_wizard_state.js

@@ -0,0 +1,40 @@
+/**
+ * Pure-logic helpers for the GitHub integration wizard's connect step.
+ * Extracted so the "can this user advance past the connect step" decision
+ * can be unit-tested without the full DOM wizard.
+ */
+
+/**
+ * Derive connect-step flags from the integration status payload.
+ *
+ * `userConnected` reflects whether the *current* user has their own linked
+ * GitHub account. `hasExistingIntegration` reflects whether the creative
+ * already has repositories linked — by this user when connected, or by *any*
+ * member (all_repositories) when the current user is not yet connected.
+ *
+ * @param {{connected?:boolean, all_repositories?:string[], selected_repositories?:string[]}} status
+ * @returns {{userConnected:boolean, hasExistingIntegration:boolean}}
+ */
+export function deriveConnectState(status) {
+  const s = status || {};
+  const userConnected = !!s.connected;
+  const repos = userConnected ? s.selected_repositories : s.all_repositories;
+  const hasExistingIntegration = (repos || []).length > 0;
+  return { userConnected, hasExistingIntegration };
+}
+
+/**
+ * Whether the connect step's "Next" button should be shown.
+ *
+ * Existing repositories linked by *other* members must not let an
+ * unauthenticated user advance: organization lookup requires the user's own
+ * connected GitHub account, so advancing would dead-end on an empty
+ * organization list. Such a user must log in first.
+ *
+ * @param {{hasExistingIntegration?:boolean, userConnected?:boolean}} state
+ * @returns {boolean}
+ */
+export function shouldShowConnectNext(state) {
+  const s = state || {};
+  return !!(s.hasExistingIntegration && s.userConnected);
+}

data/app/models/collavre_github/repository_link.rb

@@ -6,6 +6,14 @@ module CollavreGithub
     belongs_to :github_account, class_name: "CollavreGithub::Account"
     belongs_to :markdown_root_creative, class_name: "Collavre::Creative", optional: true
 
+    # HMAC secret GitHub signs webhook deliveries with. Encrypted at rest so a
+    # DB/backup leak can't forge webhooks (mirrors CollavreGithub::Account#token
+    # and CollavreLinear::ProjectLink#webhook_secret). Non-deterministic: the
+    # value is only ever read back decrypted (WebhooksController, provisioner),
+    # never queried by ciphertext. A backfill migration re-encrypts pre-existing
+    # plaintext rows.
+    encrypts :webhook_secret, deterministic: false
+
     validates :repository_full_name, presence: true
     validates :webhook_secret, presence: true
 

data/app/services/collavre_github/markdown_sync/incremental_sync_service.rb

@@ -73,7 +73,7 @@ module CollavreGithub
             "sha" => @tree_cache[path]
           )
           source.delete("rendered_html")
-          creative.skip_github_validation = true
+          creative.skip_read_only_source_validation = true
           creative.update!(data: creative.data.merge("source" => source))
 
           processed, blobs = processor.process(content, path)
@@ -107,7 +107,7 @@ module CollavreGithub
               }
             }
           )
-          creative.skip_github_validation = true
+          creative.skip_read_only_source_validation = true
           creative.save!
           @synced_creatives[path] = creative
 
@@ -130,15 +130,18 @@ module CollavreGithub
         branch == @link.markdown_sync_branch
       end
 
-      # Load all synced creatives for this repository link, indexed by path
+      # Load all synced creatives for this repository link, indexed by path.
+      #
+      # The `->`/`->>` JSON operators are portable: both PostgreSQL and modern
+      # SQLite (bundled by the `sqlite3` gem used here) support them, so a
+      # single expression works on both adapters without an
+      # `adapter_name == "PostgreSQL"` branch. Wrapping in `CAST(... AS
+      # INTEGER)` (ANSI SQL, supported by both) avoids relying on Postgres's
+      # `::integer` cast syntax, which SQLite doesn't understand.
       def load_synced_creatives
-        scope = Collavre::Creative.where(archived_at: nil)
-
-        if scope.connection.adapter_name == "PostgreSQL"
-          scope = scope.where("(data->'source'->>'repository_link_id')::integer = ?", @link.id)
-        else
-          scope = scope.where("json_extract(data, '$.source.repository_link_id') = ?", @link.id)
-        end
+        scope = Collavre::Creative
+          .where(archived_at: nil)
+          .where("CAST(data -> 'source' ->> 'repository_link_id' AS INTEGER) = ?", @link.id)
 
         scope.each_with_object({}) { |c, h| h[c.data.dig("source", "path")] = c }
       end
@@ -216,7 +219,7 @@ module CollavreGithub
                 }
               }
             )
-            dir_creative.skip_github_validation = true
+            dir_creative.skip_read_only_source_validation = true
             dir_creative.save!
             @synced_creatives[dir_path] = dir_creative
             new_dirs << dir_creative

data/app/services/collavre_github/markdown_sync/initial_import_service.rb

@@ -63,7 +63,7 @@ module CollavreGithub
               }
             }
           )
-          creative.skip_github_validation = true
+          creative.skip_read_only_source_validation = true
           creative.save!
           file_creatives << creative
           created << creative
@@ -114,7 +114,7 @@ module CollavreGithub
             }
           }
         )
-        creative.skip_github_validation = true
+        creative.skip_read_only_source_validation = true
         creative.save!
         creative
       end
@@ -175,7 +175,7 @@ module CollavreGithub
                 }
               }
             )
-            dir_creative.skip_github_validation = true
+            dir_creative.skip_read_only_source_validation = true
             dir_creative.save!
             dir_map[current_path] = dir_creative
             created << dir_creative

data/config/initializers/read_only_source.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+# GitHub-synced Markdown creatives are read-only in Collavre: their description
+# is owned by the upstream repository and must not be edited in-app. Register
+# the source type into the core read-only-source registry so core enforces the
+# read-only behavior (validation, attachment embedding, tree write flags)
+# without naming GitHub. Runs on boot and every reload so the registration
+# survives Zeitwerk clearing Collavre::Creative's class state.
+Rails.application.config.to_prepare do
+  if defined?(Collavre::Creative)
+    Collavre::Creative.register_read_only_source("github_markdown")
+  end
+end

data/db/migrate/20260711000000_encrypt_github_repository_link_webhook_secrets.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+# Re-encrypt pre-existing plaintext webhook_secret values in place now that
+# CollavreGithub::RepositoryLink declares `encrypts :webhook_secret`. Reads the
+# raw column with SQL (bypassing the model so we get plaintext, not a decrypt
+# attempt), skips rows already in Active Record Encryption's JSON envelope, and
+# writes the encrypted payload back with the model's own encryptor so the format
+# matches runtime reads. `support_unencrypted_data = true` keeps unmigrated rows
+# readable, so this is safe to run without downtime.
+class EncryptGithubRepositoryLinkWebhookSecrets < ActiveRecord::Migration[8.1]
+  def up
+    say_with_time "Encrypting GitHub repository link webhook secrets" do
+      encrypt_column(CollavreGithub::RepositoryLink, :webhook_secret)
+    end
+  end
+
+  def down
+    # No-op: `encrypts` decrypts transparently, and support_unencrypted_data
+    # keeps any remaining plaintext readable.
+  end
+
+  private
+
+  def encrypt_column(model, attribute)
+    table_name = model.table_name
+    connection = ActiveRecord::Base.connection
+
+    rows = connection.select_all(
+      "SELECT id, #{attribute} FROM #{table_name} WHERE #{attribute} IS NOT NULL"
+    ).to_a
+
+    encryptor = model.type_for_attribute(attribute)
+
+    rows.each do |row|
+      plaintext = row[attribute.to_s]
+      next if plaintext.nil? || encrypted?(plaintext)
+
+      encrypted = encryptor.serialize(plaintext)
+      connection.execute(
+        "UPDATE #{table_name} SET #{attribute} = #{connection.quote(encrypted)} WHERE id = #{connection.quote(row['id'])}"
+      )
+    end
+  end
+
+  # Active Record Encryption stores a JSON envelope containing a "p" (payload)
+  # key; treat anything already in that shape as encrypted and leave it alone.
+  def encrypted?(value)
+    return false unless value.is_a?(String)
+
+    value.start_with?("{") && value.include?('"p":')
+  rescue StandardError
+    false
+  end
+end

data/lib/collavre_github/version.rb

@@ -1,3 +1,3 @@
 module CollavreGithub
-  VERSION = "0.6.1"
+  VERSION = "0.6.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: collavre_github
 version: !ruby/object:Gem::Version
-  version: 0.6.1
+  version: 0.6.2
 platform: ruby
 authors:
 - Collavre
@@ -66,7 +66,9 @@ files:
 - app/controllers/collavre_github/auth_controller.rb
 - app/controllers/collavre_github/creatives/integrations_controller.rb
 - app/controllers/collavre_github/webhooks_controller.rb
+- app/javascript/__tests__/github_wizard_state.test.js
 - app/javascript/collavre_github.js
+- app/javascript/github_wizard_state.js
 - app/jobs/collavre_github/initial_markdown_sync_job.rb
 - app/jobs/collavre_github/markdown_sync_job.rb
 - app/models/collavre_github/account.rb
@@ -88,6 +90,7 @@ files:
 - app/views/collavre_github/auth/setup.html.erb
 - app/views/collavre_github/integrations/_modal.html.erb
 - config/initializers/integration_settings.rb
+- config/initializers/read_only_source.rb
 - config/locales/en.yml
 - config/locales/ko.yml
 - config/routes.rb
@@ -97,6 +100,7 @@ files:
 - db/migrate/20260219095224_remove_github_gemini_prompt_from_creatives.rb
 - db/migrate/20260412000000_add_markdown_sync_to_repository_links.rb
 - db/migrate/20260416000000_add_markdown_root_creative_index.rb
+- db/migrate/20260711000000_encrypt_github_repository_link_webhook_secrets.rb
 - db/seeds.rb
 - lib/collavre_github.rb
 - lib/collavre_github/engine.rb