@app-vitals/agent-admin 1.15.0 → 1.17.0

package/src/github-username.ts

@@ -0,0 +1,20 @@
+/**
+ * GHE-2.1: GitHub login syntax validation. Syntax only — never calls GitHub.
+ * A login is 1-39 chars of alphanumerics and single hyphens, with no leading
+ * or trailing hyphen (consecutive hyphens are invalid).
+ */
+const GITHUB_LOGIN_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/i;
+const GITHUB_LOGIN_MAX_LENGTH = 39;
+
+export function isValidGithubUsername(value: string): boolean {
+  return (
+    value.length > 0 &&
+    value.length <= GITHUB_LOGIN_MAX_LENGTH &&
+    GITHUB_LOGIN_PATTERN.test(value)
+  );
+}
+
+/** Returns the lower-cased login, or null when the syntax is invalid. */
+export function normalizeGithubUsername(value: string): string | null {
+  return isValidGithubUsername(value) ? value.toLowerCase() : null;
+}

package/src/github-username.unit.test.ts

@@ -0,0 +1,34 @@
+import { describe, expect, it } from "bun:test";
+import {
+  isValidGithubUsername,
+  normalizeGithubUsername,
+} from "./github-username.ts";
+
+describe("github username syntax (GHE-2.1)", () => {
+  it("accepts valid logins", () => {
+    for (const ok of [
+      "a",
+      "octocat",
+      "Octo-Cat",
+      "a-b-c",
+      "a1",
+      "a".repeat(39),
+    ])
+      expect(isValidGithubUsername(ok)).toBe(true);
+  });
+
+  it("rejects leading/trailing/consecutive hyphens", () => {
+    for (const bad of ["-a", "a-", "a--b", "-"])
+      expect(isValidGithubUsername(bad)).toBe(false);
+  });
+
+  it("rejects too long, empty and illegal characters", () => {
+    for (const bad of ["a".repeat(40), "", "a_b", "a b", "a.b", "é"])
+      expect(isValidGithubUsername(bad)).toBe(false);
+  });
+
+  it("normalize lower-cases valid input and returns null otherwise", () => {
+    expect(normalizeGithubUsername("Octo-Cat")).toBe("octo-cat");
+    expect(normalizeGithubUsername("-bad")).toBeNull();
+  });
+});

package/src/openapi-schemas.ts

@@ -114,6 +114,16 @@ export const PatchAgentBodySchema = z
       .nullable()
       .optional()
       .openapi({ example: "agent-pod-sa" }),
+    /**
+     * GHE-2.1: GitHub account whose repo access caps the agent (cap applied
+     * later). Platform admin only; `null` clears it. Lower-cased on save;
+     * syntax-checked (422) with no GitHub call.
+     */
+    githubUsername: z
+      .string()
+      .nullable()
+      .optional()
+      .openapi({ example: "octocat" }),
     /**
      * ATE-1.1: trial expiry timestamp. Nullable so it can also be explicitly
      * cleared. trialExpiryWarnedAt is intentionally NOT part of this schema —