@app-vitals/agent-admin 1.13.0 → 1.15.0

package/src/github-enterprise-client.integration.test.ts

@@ -124,6 +124,7 @@ describe("getInstallationToken", () => {
       token: "ghs_cassetteInstallationToken0000000000",
       expiresAt: "2026-11-09T13:00:00Z",
       installationId: 4242,
+      permissions: { enterprise_organization_installations: "write", metadata: "read" },
     });
     expect(calls.map((c) => `${c.method} ${c.path}`)).toEqual([ENT, MINT]);
     for (const c of calls) {

package/src/github-enterprise-client.ts

@@ -157,6 +157,8 @@ export interface EnterpriseInstallationToken {
   token: string;
   expiresAt: string;
   installationId: number;
+  /** Permissions granted to the minted token, as reported by GitHub (when present). */
+  permissions?: Record<string, string>;
 }
 
 export interface GithubEnterpriseClientOptions {
@@ -220,7 +222,11 @@ export class GithubEnterpriseClient {
         "GitHub enterprise installation lookup: response missing id",
       );
     }
-    const minted = await this.request<{ token?: string; expires_at?: string }>(
+    const minted = await this.request<{
+      token?: string;
+      expires_at?: string;
+      permissions?: Record<string, string>;
+    }>(
       "POST",
       `/app/installations/${inst.data.id}/access_tokens`,
       jwt,
@@ -236,6 +242,9 @@ export class GithubEnterpriseClient {
       token: minted.data.token,
       expiresAt: minted.data.expires_at,
       installationId: inst.data.id,
+      ...(minted.data.permissions && typeof minted.data.permissions === "object"
+        ? { permissions: minted.data.permissions }
+        : {}),
     };
     return this.cached;
   }

package/src/github-enterprise-isolation.unit.test.ts

@@ -0,0 +1,84 @@
+/**
+ * admin/src/github-enterprise-isolation.unit.test.ts
+ * Isolation exception guard (GHE-1.3): the GitHub Enterprise App private key
+ * is reachable only from the enterprise service, its admin API and the boot
+ * wiring. Agent config bundle, agent-bearer routes and env serialization must
+ * never import the service, touch its table or call getPrivateKey().
+ */
+
+import { describe, expect, it } from "bun:test";
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { join, relative } from "node:path";
+
+const REPO = new URL("../../", import.meta.url).pathname;
+
+/** Non-test source files that may reference the key-bearing service/table. */
+const ALLOWED = new Set([
+  "admin/src/github-enterprise-apps.ts",
+  "admin/src/github-enterprise-api.ts",
+  "admin/src/admin-boot.ts",
+]);
+
+function sources(dir: string, out: string[] = []): string[] {
+  for (const name of readdirSync(dir)) {
+    if (name === "node_modules" || name === "client" || name.startsWith(".")) {
+      continue;
+    }
+    const p = join(dir, name);
+    if (statSync(p).isDirectory()) sources(p, out);
+    else if (
+      /\.(ts|tsx)$/.test(name) &&
+      !/\.(unit|integration|smoke|fixtures)\.test\.ts$|\.test\.ts$|\.fixtures\.ts$/.test(
+        name,
+      )
+    ) {
+      out.push(p);
+    }
+  }
+  return out;
+}
+
+describe("GitHub Enterprise key isolation", () => {
+  const files = ["admin/src", "runtime", "lib", "chat", "index.ts"].flatMap(
+    (d) => {
+      const p = join(REPO, d);
+      return statSync(p).isDirectory() ? sources(p) : [p];
+    },
+  );
+
+  it("scans a non-trivial set of files", () => {
+    expect(files.length).toBeGreaterThan(50);
+  });
+
+  it("only the allowlisted modules touch the key-bearing service or table", () => {
+    const offenders = files
+      .map((f) => relative(REPO, f))
+      .filter((rel) => !ALLOWED.has(rel))
+      .filter((rel) => {
+        const src = readFileSync(join(REPO, rel), "utf-8");
+        return (
+          /github-enterprise-apps/.test(src) ||
+          /gitHubEnterpriseApp\b/.test(src) ||
+          /GitHubEnterpriseApp\b/.test(src) ||
+          /privateKeyEncrypted/.test(src)
+        );
+      });
+    expect(offenders).toEqual([]);
+  });
+
+  it("getPrivateKey() is only called by the enterprise API", () => {
+    const callers = files
+      .map((f) => relative(REPO, f))
+      .filter((rel) =>
+        /\.getPrivateKey\(/.test(readFileSync(join(REPO, rel), "utf-8")),
+      );
+    expect(callers).toEqual(["admin/src/github-enterprise-api.ts"]);
+  });
+
+  it("the config bundle and env serializers never read the enterprise table", () => {
+    for (const rel of ["admin/src/agent-envs.ts", "admin/src/api.ts"]) {
+      const src = readFileSync(join(REPO, rel), "utf-8");
+      expect(src).not.toMatch(/enterprise/i);
+    }
+  });
+});