@app-vitals/agent-admin 1.16.0 → 1.18.0

package/src/user-repo-access-resolver.integration.test.ts

@@ -0,0 +1,156 @@
+/**
+ * admin/src/user-repo-access-resolver.integration.test.ts
+ * UserRepoAccessResolver driven through the real GithubLookupClient replaying
+ * the GHE-2.2 cassettes (injected fetchFn; no global overrides).
+ */
+
+import { describe, expect, it } from "bun:test";
+import { generateKeyPairSync } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { GithubLookupClient } from "./github-lookup-client.ts";
+import { UserRepoAccessResolver } from "./user-repo-access-resolver.ts";
+
+interface CassetteEntry {
+  status: number;
+  headers?: Record<string, string>;
+  body: unknown;
+}
+const cassette: Record<string, CassetteEntry> = JSON.parse(
+  readFileSync(
+    new URL("./fixtures/github-lookup-cassette.json", import.meta.url).pathname,
+    "utf-8",
+  ),
+);
+const { privateKey } = generateKeyPairSync("rsa", {
+  modulusLength: 2048,
+  privateKeyEncoding: { type: "pkcs8", format: "pem" },
+  publicKeyEncoding: { type: "spki", format: "pem" },
+});
+
+const NOW = new Date("2026-11-09T12:00:00Z");
+const BASE: Record<string, string> = {
+  "GET /orgs/acme-eng/installation": "org_installation_success",
+  "POST /app/installations/7001/access_tokens": "lookup_token_success",
+  "GET /installation/repositories": "repos_success",
+  "GET /users/octocat": "user_success",
+};
+
+function setup(routes: Record<string, string>) {
+  const all = { ...BASE, ...routes };
+  const calls: string[] = [];
+  const fetchFn = (async (input: RequestInfo | URL, init?: RequestInit) => {
+    const u = new URL(input.toString());
+    const key = `${init?.method ?? "GET"} ${u.pathname}`;
+    calls.push(key);
+    const name = all[key];
+    if (!name) throw new Error(`no route for ${key}`);
+    const e = cassette[name];
+    if (!e) throw new Error(`cassette key not found: ${name}`);
+    return new Response(
+      e.status === 204 || e.status === 302 ? null : JSON.stringify(e.body),
+      {
+        status: e.status,
+        headers: { "Content-Type": "application/json", ...(e.headers ?? {}) },
+      },
+    );
+  }) as typeof fetch;
+  const lookup = new GithubLookupClient({
+    appId: "555",
+    privateKey,
+    apiBase: "https://ghe.test",
+    fetchFn,
+    now: () => NOW,
+  });
+  const resolver = new UserRepoAccessResolver({
+    installer: {
+      listInstallableOrganizations: async () => [{ id: 11, login: "acme-eng" }],
+    },
+    lookup,
+    now: () => NOW,
+    concurrency: 1,
+  });
+  return { resolver, calls };
+}
+
+const API = "GET /repos/acme-eng/api/collaborators/octocat/permission";
+const WEB = "GET /repos/acme-eng/web/collaborators/octocat/permission";
+
+describe("UserRepoAccessResolver against GHE-2.2 cassettes", () => {
+  it("complete run", async () => {
+    const { resolver } = setup({
+      [API]: "permission_maintain",
+      [WEB]: "permission_triage",
+    });
+    const res = await resolver.resolve("octocat");
+    expect(res.complete).toBe(true);
+    expect(res.outcome).toBe("ok");
+    expect(res.unresolved).toBe(0);
+    expect(res.orgs).toEqual([
+      {
+        org: "acme-eng",
+        status: "ok",
+        repos: [
+          { fullName: "acme-eng/api", level: "maintain", canPush: true },
+          { fullName: "acme-eng/web", level: "triage", canPush: false },
+        ],
+        unresolved: 0,
+      },
+    ]);
+  });
+
+  it("partial run: 429 mid-org keeps resolved and stops further calls", async () => {
+    const { resolver, calls } = setup({
+      [API]: "permission_write",
+      [WEB]: "permission_429",
+    });
+    const res = await resolver.resolve("octocat");
+    expect(res.complete).toBe(false);
+    expect(res.orgs[0].status).toBe("partial");
+    expect(res.orgs[0].repos).toEqual([
+      { fullName: "acme-eng/api", level: "write", canPush: true },
+    ]);
+    expect(res.orgs[0].unresolved).toBe(1);
+    expect(res.unresolved).toBe(1);
+    expect(calls.filter((c) => c.includes("/permission"))).toEqual([API, WEB]);
+  });
+
+  it("rate-limited run: 429 before anything resolved", async () => {
+    const { resolver } = setup({
+      [API]: "permission_429",
+      [WEB]: "permission_read",
+    });
+    const res = await resolver.resolve("octocat");
+    expect(res.orgs[0].status).toBe("rate_limited");
+    expect(res.orgs[0].repos).toEqual([]);
+    expect(res.orgs[0].unresolved).toBe(2);
+    expect(res.complete).toBe(false);
+  });
+
+  it("missing-user run", async () => {
+    const { resolver, calls } = setup({
+      "GET /users/octocat": "user_nonexistent",
+    });
+    const res = await resolver.resolve("octocat");
+    expect(res.outcome).toBe("user_not_found");
+    expect(res.orgs).toEqual([]);
+    expect(calls.some((c) => c.includes("/permission"))).toBe(false);
+  });
+
+  it("org without the lookup app", async () => {
+    const { resolver } = setup({
+      "GET /orgs/acme-eng/installation": "org_installation_404",
+    });
+    const res = await resolver.resolve("octocat");
+    expect(res.orgs[0].status).toBe("lookup_app_not_installed");
+    expect(res.complete).toBe(false);
+  });
+
+  it("never leaks the installation token", async () => {
+    const { resolver } = setup({
+      [API]: "permission_503",
+      [WEB]: "permission_503",
+    });
+    const res = await resolver.resolve("octocat");
+    expect(JSON.stringify(res)).not.toContain("ghs_lookup");
+  });
+});

package/src/user-repo-access-resolver.ts

@@ -0,0 +1,257 @@
+/**
+ * admin/src/user-repo-access-resolver.ts
+ * UserRepoAccessResolver: the single place that answers "what can GitHub user
+ * X do on which repos" through the lookup App (GHE-2.2 client) across the orgs
+ * the installer App (GHE-1.1) can install on.
+ *
+ * Completeness contract (reused by later phases):
+ * - Unknown is never none. A repo that could not be checked is absent from
+ *   `repos` and counted in `unresolved`. Only a level GitHub actually returned
+ *   (including an explicit "none") appears in `repos`.
+ * - `complete` is true only when the user exists, was verified, and every org
+ *   is "ok".
+ *
+ * 403/429 mapping rule:
+ * - Org level (getOrgToken / listing repos): 404 on the installation ->
+ *   lookup_app_not_installed; rate limit (429, or 403 rate limit) ->
+ *   rate_limited; anything else (incl. a plain 403) -> error.
+ * - Mid-org (per-repo permission call): a rate limit or 403 stops the org's
+ *   remaining calls (in-flight ones may finish and are kept). With at least
+ *   one repo resolved the org is "partial"; with none resolved a rate limit is
+ *   "rate_limited" and a plain 403 is "error".
+ * - Any other per-repo failure (404, 5xx, network, unknown role) leaves that
+ *   repo unresolved without stopping the org; the org is "partial" if some repo
+ *   resolved, else "error".
+ *
+ * Ports are injected (no DB, no global state); time and concurrency too.
+ * Outputs carry no tokens and error messages are never copied into results.
+ */
+
+import {
+  GithubEnterpriseError,
+  type InstallableOrganization,
+} from "./github-enterprise-client.ts";
+import type {
+  LookupRepository,
+  LookupToken,
+  LookupUser,
+  RepoRole,
+} from "./github-lookup-client.ts";
+
+export type OrgAccessStatus =
+  | "ok"
+  | "lookup_app_not_installed"
+  | "rate_limited"
+  | "partial"
+  | "error";
+
+export interface ResolvedRepoAccess {
+  fullName: string;
+  level: RepoRole;
+  canPush: boolean;
+}
+
+export interface OrgAccessResult {
+  org: string;
+  status: OrgAccessStatus;
+  /** Only repos whose level was actually resolved. */
+  repos: ResolvedRepoAccess[];
+  /** Repos that could not be checked. Never reported as "none". */
+  unresolved: number;
+}
+
+export interface UserRepoAccessResult {
+  username: string;
+  outcome: "ok" | "user_not_found";
+  /** False when no org could verify the user exists (e.g. rate limited). */
+  userVerified: boolean;
+  orgs: OrgAccessResult[];
+  /** Sum of per-org unresolved counts. */
+  unresolved: number;
+  /** True only when the user is verified and every org is "ok". */
+  complete: boolean;
+  checkedAt: string;
+}
+
+/** Installer-side port: GithubEnterpriseClient satisfies this. */
+export interface InstallerPort {
+  listInstallableOrganizations(): Promise<InstallableOrganization[]>;
+}
+
+/** Lookup-side port: GithubLookupClient satisfies this. */
+export interface LookupPort {
+  getOrgToken(org: string): Promise<LookupToken>;
+  getUser(org: string, login: string): Promise<LookupUser>;
+  listInstallationRepositories(org: string): Promise<LookupRepository[]>;
+  getCollaboratorPermission(
+    owner: string,
+    repo: string,
+    username: string,
+  ): Promise<RepoRole>;
+}
+
+export interface UserRepoAccessResolverOptions {
+  installer: InstallerPort;
+  lookup: LookupPort;
+  now?: () => Date;
+  /** Max concurrent per-repo permission calls (default 5). */
+  concurrency?: number;
+}
+
+export const DEFAULT_CONCURRENCY = 5;
+
+const PUSH_ROLES: ReadonlySet<RepoRole> = new Set([
+  "admin",
+  "maintain",
+  "write",
+]);
+
+/** admin, maintain and write can push; triage, read and none cannot. */
+export function canPushForRole(role: RepoRole): boolean {
+  return PUSH_ROLES.has(role);
+}
+
+function kindOf(e: unknown): string | undefined {
+  return e instanceof GithubEnterpriseError ? e.kind : undefined;
+}
+
+export class UserRepoAccessResolver {
+  private readonly installer: InstallerPort;
+  private readonly lookup: LookupPort;
+  private readonly now: () => Date;
+  private readonly concurrency: number;
+
+  constructor(opts: UserRepoAccessResolverOptions) {
+    this.installer = opts.installer;
+    this.lookup = opts.lookup;
+    this.now = opts.now ?? (() => new Date());
+    this.concurrency = Math.max(
+      1,
+      Math.floor(opts.concurrency ?? DEFAULT_CONCURRENCY),
+    );
+  }
+
+  async resolve(username: string): Promise<UserRepoAccessResult> {
+    const candidates = (
+      await this.installer.listInstallableOrganizations()
+    ).map((o) => o.login);
+    const verdict = await this.verifyUser(candidates, username);
+    if (verdict === "not_found") {
+      return this.result(username, "user_not_found", true, []);
+    }
+    const orgs: OrgAccessResult[] = [];
+    for (const org of candidates) {
+      orgs.push(await this.resolveOrg(org, username));
+    }
+    return this.result(username, "ok", verdict === "verified", orgs);
+  }
+
+  /** One getUser check up front, on the first org that can mint a token. */
+  private async verifyUser(
+    orgs: string[],
+    username: string,
+  ): Promise<"verified" | "not_found" | "unverified"> {
+    for (const org of orgs) {
+      try {
+        await this.lookup.getOrgToken(org);
+      } catch {
+        continue; // Not installed / rate limited / other: try the next org.
+      }
+      try {
+        await this.lookup.getUser(org, username);
+        return "verified";
+      } catch (e) {
+        // The token minted, so a 404 here means "no such user".
+        if (kindOf(e) === "not_found") return "not_found";
+      }
+    }
+    return "unverified";
+  }
+
+  private async resolveOrg(
+    org: string,
+    username: string,
+  ): Promise<OrgAccessResult> {
+    let repos: LookupRepository[];
+    try {
+      await this.lookup.getOrgToken(org);
+      repos = await this.lookup.listInstallationRepositories(org);
+    } catch (e) {
+      return orgLevelFailure(org, e);
+    }
+
+    const resolved = new Map<string, ResolvedRepoAccess>();
+    let stop: "rate_limit" | "permission" | undefined;
+    let next = 0;
+
+    const worker = async () => {
+      while (!stop && next < repos.length) {
+        const repo = repos[next++];
+        try {
+          const level = await this.lookup.getCollaboratorPermission(
+            org,
+            repo.name,
+            username,
+          );
+          resolved.set(repo.fullName, {
+            fullName: repo.fullName,
+            level,
+            canPush: canPushForRole(level),
+          });
+        } catch (e) {
+          const kind = kindOf(e);
+          if (kind === "rate_limit" || kind === "permission") {
+            stop = stop === "rate_limit" ? stop : kind;
+          }
+          // Other failures: repo stays unresolved, org keeps going.
+        }
+      }
+    };
+    await Promise.all(
+      Array.from({ length: Math.min(this.concurrency, repos.length) }, worker),
+    );
+
+    // Preserve listing order regardless of completion order.
+    const list = repos
+      .map((r) => resolved.get(r.fullName))
+      .filter((r): r is ResolvedRepoAccess => r !== undefined);
+    const unresolved = repos.length - list.length;
+    let status: OrgAccessStatus;
+    if (unresolved === 0) status = "ok";
+    else if (list.length > 0) status = "partial";
+    else if (stop === "rate_limit") status = "rate_limited";
+    else status = "error";
+    return { org, status, repos: list, unresolved };
+  }
+
+  private result(
+    username: string,
+    outcome: "ok" | "user_not_found",
+    userVerified: boolean,
+    orgs: OrgAccessResult[],
+  ): UserRepoAccessResult {
+    return {
+      username,
+      outcome,
+      userVerified,
+      orgs,
+      unresolved: orgs.reduce((n, o) => n + o.unresolved, 0),
+      complete:
+        outcome === "ok" &&
+        userVerified &&
+        orgs.every((o) => o.status === "ok"),
+      checkedAt: this.now().toISOString(),
+    };
+  }
+}
+
+function orgLevelFailure(org: string, e: unknown): OrgAccessResult {
+  const kind = kindOf(e);
+  const status: OrgAccessStatus =
+    kind === "not_found"
+      ? "lookup_app_not_installed"
+      : kind === "rate_limit"
+        ? "rate_limited"
+        : "error";
+  return { org, status, repos: [], unresolved: 0 };
+}

package/src/user-repo-access-resolver.unit.test.ts

@@ -0,0 +1,287 @@
+/**
+ * admin/src/user-repo-access-resolver.unit.test.ts
+ * Unit tests for UserRepoAccessResolver with in-memory ports (no network, no DB).
+ */
+
+import { describe, expect, it } from "bun:test";
+import { GithubEnterpriseError } from "./github-enterprise-client.ts";
+import type { RepoRole } from "./github-lookup-client.ts";
+import {
+  canPushForRole,
+  UserRepoAccessResolver,
+  type LookupPort,
+} from "./user-repo-access-resolver.ts";
+
+const NOW = new Date("2026-11-09T12:00:00Z");
+const err = (kind: ConstructorParameters<typeof GithubEnterpriseError>[0]) =>
+  new GithubEnterpriseError(kind, `boom ${kind} ghs_secret`);
+
+function repo(org: string, name: string) {
+  return {
+    id: 1,
+    name,
+    fullName: `${org}/${name}`,
+    private: false,
+    archived: false,
+  };
+}
+
+interface FakeOpts {
+  repos?: Record<string, string[]>;
+  perm?: (owner: string, repo: string) => RepoRole | Error | Promise<RepoRole>;
+  token?: Record<string, Error>;
+  user?: Error;
+}
+
+function fake(o: FakeOpts = {}) {
+  const repos = o.repos ?? { acme: ["a", "b", "c"] };
+  const calls: string[] = [];
+  const lookup: LookupPort = {
+    async getOrgToken(org) {
+      const e = o.token?.[org];
+      if (e) throw e;
+      return { token: "ghs_secret", expiresAt: "x", installationId: 1 };
+    },
+    async getUser(_org, login) {
+      if (o.user) throw o.user;
+      return { id: 1, login, type: "User" };
+    },
+    async listInstallationRepositories(org) {
+      return (repos[org] ?? []).map((n) => repo(org, n));
+    },
+    async getCollaboratorPermission(owner, r) {
+      calls.push(`${owner}/${r}`);
+      const v = await (o.perm ?? (() => "write" as RepoRole))(owner, r);
+      if (v instanceof Error) throw v;
+      return v;
+    },
+  };
+  const installer = {
+    async listInstallableOrganizations() {
+      return Object.keys(repos).map((login, id) => ({ id, login }));
+    },
+  };
+  const resolver = new UserRepoAccessResolver({
+    installer,
+    lookup,
+    now: () => NOW,
+    concurrency: 1,
+  });
+  return { resolver, calls };
+}
+
+describe("canPushForRole", () => {
+  const cases: Array<[RepoRole, boolean]> = [
+    ["admin", true],
+    ["maintain", true],
+    ["write", true],
+    ["triage", false],
+    ["read", false],
+    ["none", false],
+  ];
+  for (const [role, expected] of cases) {
+    it(`${role} -> ${expected}`, () =>
+      expect(canPushForRole(role)).toBe(expected));
+  }
+});
+
+describe("unknown is never none", () => {
+  it("a repo that errors is absent from resolved and counted unresolved", async () => {
+    const { resolver } = fake({
+      perm: (_o, r) => (r === "b" ? err("server") : "read"),
+    });
+    const res = await resolver.resolve("octocat");
+    const org = res.orgs[0];
+    expect(org.repos.map((r) => r.fullName)).toEqual(["acme/a", "acme/c"]);
+    expect(org.repos.some((r) => r.level === "none")).toBe(false);
+    expect(org.unresolved).toBe(1);
+    expect(org.status).toBe("partial");
+    expect(res.complete).toBe(false);
+    expect(res.unresolved).toBe(1);
+  });
+
+  it("an unknown role (custom role error) is unresolved, not none", async () => {
+    const { resolver } = fake({
+      perm: (_o, r) => (r === "a" ? err("unexpected") : "write"),
+    });
+    const res = await resolver.resolve("octocat");
+    expect(res.orgs[0].repos.map((r) => r.fullName)).toEqual([
+      "acme/b",
+      "acme/c",
+    ]);
+    expect(res.orgs[0].unresolved).toBe(1);
+  });
+
+  it("an explicit none from GitHub is a resolved none (known, not unknown)", async () => {
+    const { resolver } = fake({ perm: () => "none" });
+    const res = await resolver.resolve("octocat");
+    expect(
+      res.orgs[0].repos.every((r) => r.level === "none" && !r.canPush),
+    ).toBe(true);
+    expect(res.complete).toBe(true);
+  });
+
+  it("all repos failing individually yields error, not an empty ok list", async () => {
+    const { resolver } = fake({ perm: () => err("server") });
+    const res = await resolver.resolve("octocat");
+    expect(res.orgs[0].status).toBe("error");
+    expect(res.orgs[0].unresolved).toBe(3);
+    expect(res.complete).toBe(false);
+  });
+});
+
+describe("403/429 mapping rule", () => {
+  it("mid-org 429 with some resolved -> partial, stops further calls", async () => {
+    const { resolver, calls } = fake({
+      perm: (_o, r) => (r === "b" ? err("rate_limit") : "admin"),
+    });
+    const res = await resolver.resolve("octocat");
+    expect(res.orgs[0].status).toBe("partial");
+    expect(res.orgs[0].repos.map((r) => r.fullName)).toEqual(["acme/a"]);
+    expect(res.orgs[0].unresolved).toBe(2);
+    expect(calls).toEqual(["acme/a", "acme/b"]);
+    expect(res.complete).toBe(false);
+  });
+
+  it("mid-org 403 with some resolved -> partial", async () => {
+    const { resolver } = fake({
+      perm: (_o, r) => (r === "c" ? err("permission") : "read"),
+    });
+    const res = await resolver.resolve("octocat");
+    expect(res.orgs[0].status).toBe("partial");
+    expect(res.orgs[0].repos).toHaveLength(2);
+  });
+
+  it("429 with nothing resolved -> rate_limited; 403 with nothing resolved -> error", async () => {
+    const a = await fake({ perm: () => err("rate_limit") }).resolver.resolve(
+      "o",
+    );
+    expect(a.orgs[0].status).toBe("rate_limited");
+    expect(a.orgs[0].unresolved).toBe(3);
+    const b = await fake({ perm: () => err("permission") }).resolver.resolve(
+      "o",
+    );
+    expect(b.orgs[0].status).toBe("error");
+  });
+
+  it("token mint: 404 -> lookup_app_not_installed, 429 -> rate_limited, 403 -> error", async () => {
+    const r404 = await fake({
+      token: { acme: err("not_found") },
+    }).resolver.resolve("o");
+    expect(r404.orgs[0].status).toBe("lookup_app_not_installed");
+    const r429 = await fake({
+      token: { acme: err("rate_limit") },
+    }).resolver.resolve("o");
+    expect(r429.orgs[0].status).toBe("rate_limited");
+    const r403 = await fake({
+      token: { acme: err("permission") },
+    }).resolver.resolve("o");
+    expect(r403.orgs[0].status).toBe("error");
+    expect(r403.complete).toBe(false);
+  });
+
+  it("other orgs continue after one org is rate limited", async () => {
+    const { resolver } = fake({
+      repos: { acme: ["a"], beta: ["x"] },
+      perm: (o) => (o === "acme" ? err("rate_limit") : "write"),
+    });
+    const res = await resolver.resolve("octocat");
+    expect(res.orgs.map((o) => o.status)).toEqual(["rate_limited", "ok"]);
+    expect(res.complete).toBe(false);
+  });
+});
+
+describe("user check and bounds", () => {
+  it("nonexistent user short-circuits with user_not_found and no repo calls", async () => {
+    const { resolver, calls } = fake({ user: err("not_found") });
+    const res = await resolver.resolve("ghost");
+    expect(res.outcome).toBe("user_not_found");
+    expect(res.orgs).toEqual([]);
+    expect(res.complete).toBe(false);
+    expect(calls).toEqual([]);
+  });
+
+  it("skips orgs without the lookup app when verifying the user", async () => {
+    const { resolver } = fake({
+      repos: { acme: ["a"], beta: ["x"] },
+      token: { acme: err("not_found") },
+    });
+    const res = await resolver.resolve("octocat");
+    expect(res.outcome).toBe("ok");
+    expect(res.userVerified).toBe(true);
+    expect(res.orgs.map((o) => o.status)).toEqual([
+      "lookup_app_not_installed",
+      "ok",
+    ]);
+  });
+
+  it("a rate-limited user check proceeds unverified and is incomplete", async () => {
+    const { resolver } = fake({ user: err("rate_limit") });
+    const res = await resolver.resolve("octocat");
+    expect(res.userVerified).toBe(false);
+    expect(res.complete).toBe(false);
+  });
+
+  it("concurrency never exceeds the bound", async () => {
+    let inflight = 0;
+    let max = 0;
+    const names = Array.from({ length: 12 }, (_, i) => `r${i}`);
+    const base = fake({
+      repos: { acme: names },
+      perm: async (): Promise<RepoRole> => {
+        inflight++;
+        max = Math.max(max, inflight);
+        await new Promise((r) => setTimeout(r, 2));
+        inflight--;
+        return "write";
+      },
+    });
+    const resolver = new UserRepoAccessResolver({
+      installer: {
+        listInstallableOrganizations: async () => [{ id: 1, login: "acme" }],
+      },
+      lookup: (base.resolver as unknown as { lookup: LookupPort }).lookup,
+      now: () => NOW,
+      concurrency: 3,
+    });
+    const res = await resolver.resolve("octocat");
+    expect(res.complete).toBe(true);
+    expect(res.orgs[0].repos).toHaveLength(12);
+    expect(max).toBe(3);
+  });
+
+  it("defaults concurrency to 5", async () => {
+    let inflight = 0;
+    let max = 0;
+    const base = fake({
+      repos: { acme: Array.from({ length: 20 }, (_, i) => `r${i}`) },
+      perm: async (): Promise<RepoRole> => {
+        inflight++;
+        max = Math.max(max, inflight);
+        await new Promise((r) => setTimeout(r, 2));
+        inflight--;
+        return "read";
+      },
+    });
+    const resolver = new UserRepoAccessResolver({
+      installer: {
+        listInstallableOrganizations: async () => [{ id: 1, login: "acme" }],
+      },
+      lookup: (base.resolver as unknown as { lookup: LookupPort }).lookup,
+      now: () => NOW,
+    });
+    await resolver.resolve("octocat");
+    expect(max).toBe(5);
+  });
+
+  it("never leaks tokens into output", async () => {
+    const { resolver } = fake({ perm: () => err("server") });
+    const res = await resolver.resolve("octocat");
+    expect(JSON.stringify(res)).not.toContain("ghs_");
+  });
+
+  it("stamps checkedAt from the injected clock", async () => {
+    const res = await fake().resolver.resolve("octocat");
+    expect(res.checkedAt).toBe(NOW.toISOString());
+  });
+});