@bongos/core 1.21.94 → 1.21.96

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.94",
+  "version": "1.21.96",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.94",
+      "version": "1.21.96",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.94",
+  "version": "1.21.96",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9394,5 +9394,17 @@
       "id": "1004649",
       "text": "Connecting GitHub to a new project is now one trip. The founder clicks \"Connect GitHub\", approves the project's app on GitHub, and GitHub carries straight on to installing it on their repo (already picked when the repo is publ"
     }
+  ],
+  "1.21.95": [
+    {
+      "id": "1004650",
+      "text": "Connecting GitHub no longer depends on staying in one browser tab. After you approve on GitHub, even on your phone or in another window, you land back on your own project's GitHub checklist. Our server remembers which project"
+    }
+  ],
+  "1.21.96": [
+    {
+      "id": "1004651",
+      "text": "Founders can now put a new project under a GitHub organisation, not only their own account. When connecting GitHub, they choose \"On my account\" or \"On an organisation\". Their organisations are listed; one they only belong to ("
+    }
   ]
 }

package/src/bongos/github-repos.js

@@ -103,6 +103,134 @@ async function createUserRepo(token, { name, fetchImpl = fetch } = {}) {
   throw new GithubApiError(`GitHub create-repo failed (${res.status})`, { status: res.status, code: 'github_error' });
 }
 
+// ---- organisations (task 1004651) ----
+// A founder can put the project under a GitHub organisation instead of their personal
+// account: the empty repo (createOrgRepo) and the project's sign-in app (the manifest
+// flow's /organizations/<org>/settings/apps/new, built by the provisioning module).
+//
+// THE SCOPE LIMIT, said once. The hub's sign-in asks for `read:user repo` (ADR 0155/0364)
+// and not `read:org`, so GitHub may refuse the membership reads below for this token.
+// Widening the sign-in scope is auth-config.js's call, not this file's, so every read
+// here DEGRADES rather than fails: the role-carrying membership list when GitHub allows
+// it, else the organisations the founder's repos sit in (role unknown), and always a
+// typed name the founder can have checked. A role we could not read is said as such,
+// never guessed as "owner", and GitHub's own page still refuses a non-owner.
+
+// A GitHub login: 1-39 chars, letters/digits and single inner hyphens. The gate every
+// org name passes before it reaches a GitHub URL (the page's copy is never trusted).
+const GITHUB_LOGIN_RE = /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/;
+function validGithubLogin(s) { return typeof s === 'string' && GITHUB_LOGIN_RE.test(s); }
+
+// GitHub's refusal when the org restricts which OAuth apps may act for it. Matched on
+// the message because GitHub gives it no code of its own.
+function isAppRestricted(body) {
+  return /OAuth App access restrictions|third-party application access/i.test(String((body && body.message) || ''));
+}
+async function readBody(res) {
+  try { return await res.json(); } catch (_) { return {}; }
+}
+function unauthorized() {
+  return new GithubApiError('GitHub rejected the stored token', { status: 401, code: 'github_unauthorized' });
+}
+
+// One membership → what the page shows. Only an ACTIVE admin (an org owner) can make
+// an app on the org; anyone else gets the reason in words. role null = unknown. PURE.
+function orgAccess({ login, role = null, state = null }) {
+  if (role === 'admin' && state === 'active') return { login, role, can_create_apps: true, reason: null };
+  if (role && state === 'pending') {
+    return { login, role, can_create_apps: false, reason: `Your invitation to ${login} is still waiting. Accept it on GitHub first.` };
+  }
+  if (role) {
+    return { login, role, can_create_apps: false, reason: `You're a member of ${login}, not an owner. Only its owners can make apps there.` };
+  }
+  return {
+    login, role: null, can_create_apps: null,
+    reason: `GitHub didn't tell us your role in ${login}. Only its owners can make the app there; if you aren't one, GitHub will say so on its own page.`,
+  };
+}
+
+// The founder's organisations: { orgs: [orgAccess...], listed: 'memberships'|'repos'|'none' }.
+// 'memberships' carries real roles; 'repos' is the fallback for a token GitHub will not
+// show memberships to (the orgs the founder's repos live in, roles unknown); 'none' means
+// GitHub showed neither, and the page offers only the typed name. Sorted by login.
+async function listUserOrgs(token, { fetchImpl = fetch } = {}) {
+  const byLogin = (a, b) => a.login.toLowerCase().localeCompare(b.login.toLowerCase());
+  const res = await fetchImpl(`${GH_API}/user/memberships/orgs?per_page=${PER_PAGE}`, { headers: ghHeaders(token) });
+  if (res.status === 401) throw unauthorized();
+  if (res.ok) {
+    const rows = await readBody(res);
+    const orgs = (Array.isArray(rows) ? rows : [])
+      .map((m) => ({ login: m && m.organization && m.organization.login, role: m && m.role, state: m && m.state }))
+      .filter((m) => validGithubLogin(m.login))
+      .map(orgAccess)
+      .sort(byLogin);
+    return { orgs, listed: 'memberships' };
+  }
+  // No membership read for this token: the organisations its repos sit in. One page,
+  // a hint list and never a gate; the typed name covers the rest.
+  const r2 = await fetchImpl(`${GH_API}/user/repos?per_page=${PER_PAGE}&sort=updated&affiliation=organization_member`, { headers: ghHeaders(token) });
+  if (r2.status === 401) throw unauthorized();
+  if (!r2.ok) return { orgs: [], listed: 'none' };
+  const repos = await readBody(r2);
+  const seen = new Map();
+  for (const r of Array.isArray(repos) ? repos : []) {
+    const o = r && r.owner;
+    if (o && o.type === 'Organization' && validGithubLogin(o.login) && !seen.has(o.login.toLowerCase())) {
+      seen.set(o.login.toLowerCase(), orgAccess({ login: o.login }));
+    }
+  }
+  return { orgs: [...seen.values()].sort(byLogin), listed: 'repos' };
+}
+
+// Check ONE organisation the founder typed: its orgAccess, or a typed org_not_found when
+// GitHub has no organisation by that name (a personal account's login included). The
+// membership read answers with the role when this token may read it; otherwise the
+// public org read proves the org exists and the role stays unknown.
+async function getOrgAccess(token, { org, fetchImpl = fetch } = {}) {
+  if (!validGithubLogin(org)) throw new GithubApiError('Not a GitHub organisation name', { status: 400, code: 'bad_org' });
+  const res = await fetchImpl(`${GH_API}/user/memberships/orgs/${encodeURIComponent(org)}`, { headers: ghHeaders(token) });
+  if (res.status === 401) throw unauthorized();
+  if (res.ok) {
+    const m = await readBody(res);
+    const login = m && m.organization && validGithubLogin(m.organization.login) ? m.organization.login : org;
+    return orgAccess({ login, role: (m && m.role) || null, state: (m && m.state) || null });
+  }
+  const r2 = await fetchImpl(`${GH_API}/orgs/${encodeURIComponent(org)}`, { headers: ghHeaders(token) });
+  if (r2.status === 401) throw unauthorized();
+  if (r2.status === 404) throw new GithubApiError('GitHub has no organisation by that name', { status: 404, code: 'org_not_found' });
+  if (!r2.ok) throw new GithubApiError(`GitHub /orgs read failed (${r2.status})`, { status: r2.status, code: 'github_error' });
+  const o = await readBody(r2);
+  if (o && o.type && o.type !== 'Organization') throw new GithubApiError('That name is a personal account', { status: 404, code: 'org_not_found' });
+  return orgAccess({ login: o && validGithubLogin(o.login) ? o.login : org });
+}
+
+// Create an EMPTY repo under an organisation: the org twin of createUserRepo, with the
+// same fixed body (private, no first commit; ADR 0370). GitHub decides who may, and a
+// refusal is typed so the page can say WHY:
+//   org_app_restricted - the org limits which OAuth apps may act for it
+//   org_forbidden      - this member may not create repos there
+//   org_not_found      - no such org, or this account cannot see it
+async function createOrgRepo(token, { org, name, fetchImpl = fetch } = {}) {
+  if (!validGithubLogin(org)) throw new GithubApiError('Not a GitHub organisation name', { status: 400, code: 'bad_org' });
+  const res = await fetchImpl(`${GH_API}/orgs/${encodeURIComponent(org)}/repos`, {
+    method: 'POST',
+    headers: ghHeaders(token, { 'Content-Type': 'application/json' }),
+    body: JSON.stringify({ name, private: true, auto_init: false }),
+  });
+  if (res.status === 201) {
+    const r = await res.json();
+    return { full_name: r.full_name, html_url: r.html_url };
+  }
+  if (res.status === 401) throw unauthorized();
+  if (res.status === 422) throw new GithubApiError('A repository with that name already exists in the organisation', { status: 422, code: 'name_taken' });
+  if (res.status === 403) {
+    const body = await readBody(res);
+    throw new GithubApiError('GitHub refused the org repo', { status: 403, code: isAppRestricted(body) ? 'org_app_restricted' : 'org_forbidden' });
+  }
+  if (res.status === 404) throw new GithubApiError('GitHub answered 404 for that organisation', { status: 404, code: 'org_not_found' });
+  throw new GithubApiError(`GitHub create-org-repo failed (${res.status})`, { status: res.status, code: 'github_error' });
+}
+
 // Read one repo as GitHub answers it FOR THIS TOKEN — the manage page's
 // visibility read (task 1003045). GitHub's own 404 covers both "no such repo"
 // and "no access", which is exactly the no-leak shape the caller wants to
@@ -252,6 +380,7 @@ async function deleteDeployKey(token, { owner, name, keyId, fetchImpl = fetch }
 
 module.exports = {
   listUserRepos, createUserRepo, getUserRepo, makeRepoPublic, makeRepoPrivate,
+  listUserOrgs, getOrgAccess, createOrgRepo, validGithubLogin,
   listDeployKeys, addDeployKey, deleteDeployKey,
   GithubApiError, MAX_PAGES,
 };

package/src/bongos/routes/github.js

@@ -19,12 +19,13 @@ const express = require('express');
 const auth = require('../auth');
 const db = require('../db');
 const secretBox = require('../secret-box');
-const { listUserRepos, createUserRepo } = require('../github-repos');
+const { listUserRepos, createUserRepo, listUserOrgs, getOrgAccess, createOrgRepo, validGithubLogin } = require('../github-repos');
 // Namespace require for the visibility helpers (task 1003045): the route tests
 // stub these on the cached module object, which a load-time destructure would
 // pin to the real implementations.
 const githubRepos = require('../github-repos');
 const { validateOrRespond } = require('./_helpers');
+const log = require('../logger').logger.child({ src: 'github' });
 
 // GitHub repo names: 1–100 chars of [A-Za-z0-9._-]. We validate strictly for a clean
 // 400; anything GitHub still rejects surfaces as the 422→409 name_taken path.
@@ -33,6 +34,14 @@ const REPO_NAME_RE = /^[A-Za-z0-9._-]{1,100}$/;
 // hyphens) over a repo name. Strict for a clean 400; GitHub still owns the truth.
 const REPO_REF_RE = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})?\/[A-Za-z0-9._-]{1,100}$/;
 
+// The two org refusals the org routes share (task 1004651).
+function badOrg(res) {
+  return res.fail('bad_org', { status: 400, message: 'That isn’t a GitHub organisation name: letters, numbers and single dashes, up to 39.' });
+}
+function orgNotFound(res, org) {
+  return res.fail('org_not_found', { status: 404, message: `GitHub didn’t show your account an organisation called ${org}.` });
+}
+
 // Parse + validate the owner/name ref, or send a 400 and return null.
 function parseRepoRef(raw, res) {
   const ref = String(raw || '').trim();
@@ -92,22 +101,79 @@ module.exports = function buildGithubRouter() {
     }
   });
 
-  // rank: any-builder — creates a repo in the caller's OWN account.
+  // rank: any-builder — the caller's OWN GitHub organisations (task 1004651), for the
+  // project page's "on an organisation" choice. Each row says whether the caller can make
+  // an app there and, when not, why. `listed` says how much GitHub showed this token
+  // (github-repos.listUserOrgs): the page always offers a typed name beside the list.
+  router.get('/github/orgs', auth.requireBuilder, async (req, res) => {
+    const token = await resolveRepoToken(req, res);
+    if (!token) return;
+    try {
+      res.json(await listUserOrgs(token));
+    } catch (err) {
+      if (err && err.status === 401) {
+        await db.deleteGithubToken({ builderId: req.builder.id }).catch(() => {});
+        return res.fail('repo_scope_required', { status: 403, message: 'Your GitHub authorization expired. Reconnect to list your organisations.' });
+      }
+      log.error('[gds] GET /github/orgs', err && err.message);
+      res.fail('github_error', { status: 502, message: 'GitHub could not be reached. Try again in a moment.' });
+    }
+  });
+
+  // rank: any-builder — checks ONE organisation name the caller typed, as their own
+  // GitHub credential sees it (task 1004651). The name is checked against GitHub's login
+  // rules before it reaches a URL.
+  router.get('/github/orgs/:org', auth.requireBuilder, async (req, res) => {
+    const org = String(req.params.org || '').trim();
+    if (!validGithubLogin(org)) return badOrg(res);
+    const token = await resolveRepoToken(req, res);
+    if (!token) return;
+    try {
+      res.json({ org: await getOrgAccess(token, { org }) });
+    } catch (err) {
+      if (err && err.status === 401) {
+        await db.deleteGithubToken({ builderId: req.builder.id }).catch(() => {});
+        return res.fail('repo_scope_required', { status: 403, message: 'Your GitHub authorization expired. Reconnect to check the organisation.' });
+      }
+      if (err && err.code === 'org_not_found') return orgNotFound(res, org);
+      log.error('[gds] GET /github/orgs/:org', err && err.message);
+      res.fail('github_error', { status: 502, message: 'GitHub could not be reached. Try again in a moment.' });
+    }
+  });
+
+  // rank: any-builder — creates a repo in the caller's OWN account, or (task 1004651)
+  // under an organisation they name in `org`. GitHub decides whether they may; its
+  // refusals come back as 409s with the reason, never as a 403 (the page reads a 403 as
+  // "sign in again").
   router.post('/github/repos', auth.requireBuilder, async (req, res) => {
-    if (validateOrRespond(req, res, { name: { required: true, type: 'string', maxLength: 100 } })) return;
+    if (validateOrRespond(req, res, {
+      name: { required: true, type: 'string', maxLength: 100 },
+      org: { type: 'string', maxLength: 39 },
+    })) return;
     const name = String((req.body && req.body.name) || '').trim();
     if (!REPO_NAME_RE.test(name)) {
       return res.fail('bad_repo_name', { status: 400, message: 'Repository names use letters, numbers, and . _ - (1–100 chars).' });
     }
+    const org = req.body && req.body.org != null ? String(req.body.org).trim() : '';
+    if (org && !validGithubLogin(org)) return badOrg(res);
     const token = await resolveRepoToken(req, res);
     if (!token) return;
     try {
-      const repo = await createUserRepo(token, { name });
+      const repo = org ? await createOrgRepo(token, { org, name }) : await createUserRepo(token, { name });
       res.status(201).json({ repo });
     } catch (err) {
       if (err && err.code === 'name_taken') {
-        return res.fail('name_taken', { status: 409, message: 'You already have a repository with that name. Pick another, or adopt the existing one.' });
+        return res.fail('name_taken', { status: 409, message: org
+          ? `${org} already has a repository with that name. Pick another, or adopt the existing one.`
+          : 'You already have a repository with that name. Pick another, or adopt the existing one.' });
+      }
+      if (org && err && err.code === 'org_app_restricted') {
+        return res.fail('org_app_restricted', { status: 409, message: `${org} only lets apps its owners have approved act for it. An owner can approve this platform in the organisation's settings (Third-party access), or create the repo yourself.` });
+      }
+      if (org && err && err.code === 'org_forbidden') {
+        return res.fail('org_forbidden', { status: 409, message: `GitHub didn't let your account create a repository in ${org}. Ask one of its owners, or put the project on your own account.` });
       }
+      if (org && err && err.code === 'org_not_found') return orgNotFound(res, org);
       if (err && err.status === 401) {
         await db.deleteGithubToken({ builderId: req.builder.id }).catch(() => {});
         return res.fail('repo_scope_required', { status: 403, message: 'Your GitHub authorization expired. Reconnect to create the repo.' });

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.94'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.96'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');