@preventive/triage 1.0.0-alpha.43 → 1.0.0-alpha.45

package/server-managed/dependency-reviews.ts

@@ -25,6 +25,14 @@ export interface DependencyReviewStore {
   listDependencyReviews(context: ReviewContext, user: string, allBases?: boolean): Promise<DependencyReview[]>
   getLatestOwnDependencyReview(user: string, target: Pick<ReviewContext, 'ecosystem' | 'package' | 'version' | 'integrity'>): Promise<DependencyReview | null>
   listOwnDependencyReviews(user: string, before: { time: number; id: string } | null): Promise<{ reviews: DependencyReview[]; next: { time: number; id: string } | null }>
+  // `user`'s own reviews of `ids`, none another's.
+  listOwnDependencyReviewsById(user: string, ids: string[]): Promise<DependencyReview[]>
+  // The reviews published to team `teamId`, revoked ones too, the latest
+  // published first, a page on from `before` (when it was published, and
+  // its id), for one who reads them there (reviewsIn); null for another.
+  listTeamDependencyReviews(teamId: string, user: string, before: { time: number; id: string } | null): Promise<{ reviews: DependencyReview[]; next: { time: number; id: string } | null } | null>
+  // Whether `user` reads the reviews published to team `teamId` (reviewsIn).
+  readsTeamDependencyReviews(teamId: string, user: string): Promise<boolean>
   listDependencyReviewTeams(user: string): Promise<ReviewTeam[]>
   listDependencyReviewEnabledTeams(): Promise<string[]>
   setTeamDependencyReview(sessionId: string, teamId: string, enabled: boolean): Promise<boolean>
@@ -62,6 +70,7 @@ CREATE TABLE IF NOT EXISTS managed_dependency_review_team (
   team_id TEXT NOT NULL REFERENCES managed_team(id) ON DELETE CASCADE,
   PRIMARY KEY (review_id, team_id)
 ) STRICT;
+CREATE INDEX IF NOT EXISTS managed_dependency_review_team_idx ON managed_dependency_review_team(team_id, review_id);
 `
 const values = (c: ReviewContext) => [c.ecosystem, c.package, c.version, c.integrity, c.basePackage ?? '', c.baseVersion ?? '', c.baseIntegrity ?? '']
 const targetWhere = 'ecosystem = ? AND package = ? AND version = ? AND integrity = ?'
@@ -71,6 +80,16 @@ const columns = `id, user_id AS user, user_login AS userLogin, ecosystem, packag
   time, revision, published_at AS publishedAt, revoked_at AS revokedAt, files, status, comment`
 const conflict = () => { throw new ManagedMutationError(409, 'review-conflict') }
 
+// Who reviews dependencies in team `t`, user `u` as the query joins them: an
+// admin, in any team; a member who manages, in theirs; a member who triages,
+// in theirs whose dependencies they may see (`view_dependencies`). Publishing
+// (`publishing`) needs the team to review dependencies; reading what was
+// published there, not, so what it published stays read once it stops. A
+// hidden team is no one's.
+export const reviewsIn = (publishing: boolean) => `t.hidden = 0${publishing ? ' AND t.dependency_review = 1' : ''} AND (u.role = 'admin' OR EXISTS (
+  SELECT 1 FROM managed_team_user m WHERE m.team_id = t.id AND m.user_id = u.id
+    AND (u.role = 'manage' OR (u.role = 'triage' AND m.view_dependencies = 1))))`
+
 // Fold legacy multi-note files into one text field without changing a frozen
 // snapshot's stored rows. Continuing or saving uses one row per file.
 function fileEntries(entries: ReviewEntry[]): ReviewEntry[] {
@@ -93,11 +112,18 @@ async function actor(db: ManagedSql, sessionId: string, admin = false) {
   if (!(admin ? ['admin'] : ['triage', 'manage', 'admin']).includes(user.role)) throw new ManagedMutationError(403, 'forbidden')
   return user
 }
+// The teams `user` publishes reviews to (reviewsIn).
 async function teams(db: ManagedSql, user: string): Promise<ReviewTeam[]> {
-  return await db.prepare(`SELECT t.id, t.name FROM managed_team t
-    JOIN managed_team_user m ON m.team_id = t.id AND m.user_id = ?
-    WHERE t.hidden = 0 AND t.dependency_review = 1 ORDER BY t.name, t.id`).all(user) as ReviewTeam[]
+  return await db.prepare(`SELECT t.id, t.name FROM managed_team t JOIN managed_user u ON u.id = ?
+    WHERE ${reviewsIn(true)} ORDER BY t.name, t.id`).all(user) as ReviewTeam[]
+}
+// A draft is begun or edited by one who publishes to some team; their own
+// published review revoked, or published to more teams, as `publish` checks
+// each, whoever they are now.
+async function requireReviewer(db: ManagedSql, user: string) {
+  if ((await teams(db, user)).length === 0) throw new ManagedMutationError(403, 'review-access-required')
 }
+
 async function expandReviews(db: ManagedSql, rows: unknown[], user: string): Promise<DependencyReview[]> {
   const reviews = rows as (Omit<DependencyReview, 'files'> & { files: string | null })[]
   if (reviews.length === 0) return []
@@ -105,10 +131,9 @@ async function expandReviews(db: ManagedSql, rows: unknown[], user: string): Pro
   const entries = await db.prepare(`SELECT review_id AS reviewId, id, file, comment, status, time
     FROM managed_dependency_file_review WHERE review_id IN (${placeholders}) ORDER BY time, id`).all(...ids) as (ReviewEntry & { reviewId: string })[]
   const linked = await db.prepare(`SELECT rt.review_id AS reviewId, t.id, t.name FROM managed_dependency_review_team rt
-    JOIN managed_dependency_review r ON r.id = rt.review_id JOIN managed_team t ON t.id = rt.team_id
-    WHERE rt.review_id IN (${placeholders}) AND (r.user_id = ? OR (t.hidden = 0 AND EXISTS (
-      SELECT 1 FROM managed_team_user m WHERE m.team_id = t.id AND m.user_id = ?)))
-    ORDER BY t.name, t.id`).all(...ids, user, user) as (ReviewTeam & { reviewId: string })[]
+    JOIN managed_dependency_review r ON r.id = rt.review_id JOIN managed_team t ON t.id = rt.team_id JOIN managed_user u ON u.id = ?
+    WHERE rt.review_id IN (${placeholders}) AND (r.user_id = u.id OR (${reviewsIn(false)}))
+    ORDER BY t.name, t.id`).all(user, ...ids) as (ReviewTeam & { reviewId: string })[]
   return reviews.map(review => {
     const snapshot = review.files === null ? null : JSON.parse(review.files) as string[] | { paths: string[]; nonTextFiles: string[] }
     const files = Array.isArray(snapshot) ? snapshot : snapshot?.paths ?? null
@@ -147,6 +172,30 @@ async function listOwn(db: ManagedSql, user: string, before: { time: number; id:
   return { reviews: await expandReviews(db, page, user), next: rows.length > 50 && last ? { time: last.time, id: last.id } : null }
 }
 
+// A version's reviews, of its base (`context`), or of any (`allBases`), that
+// `user` reads: their own, and those published to a team they read in.
+async function listContext(db: ManagedSql, context: ReviewContext, user: string, allBases: boolean) {
+  const rows = await db.prepare(`SELECT ${columns} FROM managed_dependency_review r WHERE ${allBases ? targetWhere : contextWhere}
+    AND (user_id = ? OR (published_at IS NOT NULL AND EXISTS (
+      SELECT 1 FROM managed_dependency_review_team rt JOIN managed_team t ON t.id = rt.team_id JOIN managed_user u ON u.id = ?
+      WHERE rt.review_id = r.id AND ${reviewsIn(false)})))
+    ORDER BY time, id`).all(...values(context).slice(0, allBases ? 4 : 7), user, user)
+  return expandReviews(db, rows, user)
+}
+
+const readsTeam = async (db: ManagedSql, teamId: string, user: string) =>
+  Boolean(await db.prepare(`SELECT 1 FROM managed_team t JOIN managed_user u ON u.id = ? WHERE t.id = ? AND ${reviewsIn(false)}`).get(user, teamId))
+
+async function listTeam(db: ManagedSql, teamId: string, user: string, before: { time: number; id: string } | null) {
+  if (!await readsTeam(db, teamId, user)) return null
+  const rows = await db.prepare(`SELECT ${columns} FROM managed_dependency_review r JOIN managed_dependency_review_team rt ON rt.review_id = r.id
+    WHERE rt.team_id = ? AND r.published_at IS NOT NULL ${before ? 'AND (r.published_at < ? OR (r.published_at = ? AND r.id < ?))' : ''}
+    ORDER BY r.published_at DESC, r.id DESC LIMIT 51`).all(teamId, ...before ? [before.time, before.time, before.id] : []) as DependencyReview[]
+  const page = rows.slice(0, 50)
+  const last = page.at(-1)
+  return { reviews: await expandReviews(db, page, user), next: rows.length > 50 && last ? { time: Number(last.publishedAt), id: last.id } : null }
+}
+
 async function saveFile(db: ManagedSql, reviewId: string, entry: ReviewInput, requestedId: string | null, now: number) {
   const existing = await db.prepare(`SELECT id FROM managed_dependency_file_review
     WHERE review_id = ? AND file = ? ORDER BY time, id`).all(reviewId, entry.file) as { id: string }[]
@@ -171,6 +220,13 @@ export function dependencyReviewMethods(db: ManagedSql): DependencyReviewStore {
   const read = (id: string) => db.prepare(`SELECT ${columns} FROM managed_dependency_review WHERE id = ?`).get(id)
   return {
     listOwnDependencyReviews: (user, before) => listOwn(db, user, before),
+    async listOwnDependencyReviewsById(user, ids) {
+      if (ids.length === 0) return []
+      return expandReviews(db, await db.prepare(`SELECT ${columns} FROM managed_dependency_review WHERE user_id = ? AND id IN (${ids.map(() => '?').join(',')})
+        ORDER BY time, id`).all(user, ...ids), user)
+    },
+    listTeamDependencyReviews: (teamId, user, before) => listTeam(db, teamId, user, before),
+    readsTeamDependencyReviews: (teamId, user) => readsTeam(db, teamId, user),
     async getLatestOwnDependencyReview(user, target) {
       const row = await db.prepare(`SELECT ${columns} FROM managed_dependency_review
         WHERE user_id = ? AND ecosystem = ? AND package = ? AND version = ? AND integrity = ? ORDER BY time DESC, id DESC LIMIT 1`)
@@ -191,16 +247,10 @@ export function dependencyReviewMethods(db: ManagedSql): DependencyReviewStore {
       return true
     },
     listDependencyReviewTeams: user => teams(db, user),
-    async listDependencyReviews(context, user, allBases = false) {
-      const rows = await db.prepare(`SELECT ${columns} FROM managed_dependency_review r WHERE ${allBases ? targetWhere : contextWhere}
-        AND (user_id = ? OR (published_at IS NOT NULL AND EXISTS (
-          SELECT 1 FROM managed_dependency_review_team rt JOIN managed_team t ON t.id = rt.team_id AND t.hidden = 0
-          JOIN managed_team_user m ON m.team_id = rt.team_id WHERE rt.review_id = r.id AND m.user_id = ?)))
-        ORDER BY time, id`).all(...values(context).slice(0, allBases ? 4 : 7), user, user)
-      return expandReviews(db, rows, user)
-    },
+    listDependencyReviews: (context, user, allBases = false) => listContext(db, context, user, allBases),
     async changeDependencyReview(context, sessionId, change, now) {
       const user = await actor(db, sessionId)
+      if (change.action !== 'revoke' && change.action !== 'publish') await requireReviewer(db, user.id)
       let id = change.reviewId
       let current: DependencyReview | undefined
       if (id) {

package/server-managed/github-accounts.ts

@@ -0,0 +1,33 @@
+// GitHub accounts as GitHub's REST and GraphQL APIs name them, where a
+// repository's activity names its authors (repository-history.ts and the
+// Commits, Issues, Agents and Pulse tabs' readers).
+const LOGIN = /^[A-Za-z\d][A-Za-z\d-]{0,38}(?:\[bot\])?$/u
+
+// An account as GitHub names it: its login, else null, and its numeric id
+// where GitHub names one with it.
+export interface NamedAccount { login: string | null; id: number | null }
+export function accountOf(account: { login?: unknown; id?: unknown } | null | undefined): NamedAccount {
+  const login = typeof account?.login === 'string' && LOGIN.test(account.login) ? account.login : null
+  const id = account?.id
+  return { login, id: login && Number.isSafeInteger(id) && (id as number) > 0 ? id as number : null }
+}
+
+// An actor (the author of an issue or a pull request, one who merged one) as
+// GitHub's GraphQL API names it: its login, and its account's numeric id, a
+// user's or a GitHub App's bot's.
+export const ACTOR = 'login ... on User { databaseId } ... on Bot { databaseId }'
+export type GraphAccount = { login?: unknown; databaseId?: unknown } | null | undefined
+export const actorOf = (actor: GraphAccount) => accountOf({ login: actor?.login, id: actor?.databaseId })
+
+// A commit's author's account, as GitHub's GraphQL API names it: the user
+// GitHub knows its address for; else, as GitHub's REST API does, the account
+// whose noreply address its address is, `<id>+<login>@users.noreply.github.com`:
+// a GitHub App's bot's, which is no user (GraphQL's `user` is a User's, never
+// a bot's).
+const NOREPLY = /^([1-9]\d{0,11})\+([^@]+)@users\.noreply\.github\.com$/iu
+export type GraphActor = { email?: unknown; user?: GraphAccount | null }
+export function commitAccount(author: GraphActor | null | undefined): NamedAccount {
+  const user = actorOf(author?.user)
+  const noreply = user.id === null && typeof author?.email === 'string' ? NOREPLY.exec(author.email) : null
+  return noreply ? accountOf({ login: noreply[2], id: Number(noreply[1]) }) : user
+}

package/server-managed/github-actions.ts

@@ -0,0 +1,71 @@
+// GitHub as a risk scan resolves actions with (risk ActionsSource), read with
+// an admin's own token, or none for public repositories alone: what GitHub
+// has none of reads as none, anything else is thrown as a GithubApiError.
+import { createClient } from '@preventive/upstream/github.js'
+import type { ActionsSource } from '../risk/index.js'
+import { GithubApiError, upstreamGithub } from './github-errors.ts'
+import { githubJson } from './github-app.ts'
+
+// How many pages of 100 tags are listed; a repository with more is told by
+// its tags one at a time.
+const MAX_TAG_PAGES = 10
+const BRANCHES_PAGE = 100
+
+const api = (name: string, suffix: string) => `https://api.github.com/repos/${name.split('/').map(encodeURIComponent).join('/')}${suffix}`
+
+// Whether upstream refused what it was asked before asking GitHub, as a ref
+// git wouldn't take: its arguments' checks say what each must be.
+const isRefused = (error: unknown) => error instanceof Error && error.name === 'AssertionError' && / must be /u.test(error.message)
+
+// What `read` answers, null where GitHub has none (a 404), or upstream
+// refused to ask.
+async function orNone<T>(read: () => Promise<T>): Promise<T | null> {
+  try {
+    return await upstreamGithub(() => read().catch((error: unknown) => { throw isRefused(error) ? new GithubApiError(404, 'github-not-found') : error }))
+  } catch (error) {
+    if (error instanceof GithubApiError && error.status === 404) return null
+    throw error
+  }
+}
+
+interface RepoObject { full_name?: unknown; default_branch?: unknown; fork?: unknown; parent?: { full_name?: unknown }; archived?: unknown; private?: unknown }
+
+export function githubActionsSource(token: string | null, fetchImpl: typeof fetch = globalThis.fetch): ActionsSource {
+  const client = createClient({ token })
+  return {
+    async repo(name) {
+      const info = await orNone(() => client.getRepo({ repo: name, followRedirect: true })) as RepoObject | null
+      if (!info) return null
+      if (typeof info.full_name !== 'string' || typeof info.default_branch !== 'string') throw new GithubApiError(502, 'github-malformed')
+      return { fullName: info.full_name, defaultBranch: info.default_branch, archived: info.archived === true, private: info.private !== false,
+        fork: info.fork === true ? (typeof info.parent?.full_name === 'string' ? info.parent.full_name : '') : null }
+    },
+    tags(name) {
+      // More than MAX_TAG_PAGES pages, which upstream refuses to list whole.
+      return upstreamGithub(() => client.listRepoTags({ repo: name, maxPages: MAX_TAG_PAGES })
+        .catch((error: unknown) => { if (error instanceof Error && /more than \d+ pages/u.test(error.message)) return null; throw error }))
+    },
+    tag: async (name, tag) => (await orNone(() => client.getRepoTag({ repo: name, tag })))?.oid ?? null,
+    branch: async (name, branch) => (await orNone(() => client.getRepoHead({ repo: name, branch })))?.oid ?? null,
+    async branches(name) {
+      const listed = await githubJson(api(name, `/branches?per_page=${BRANCHES_PAGE}`), token, fetchImpl)
+      if (!Array.isArray(listed)) throw new GithubApiError(502, 'github-malformed')
+      const branches = (listed as { name?: unknown; commit?: { sha?: unknown } }[]).flatMap(item => typeof item?.name === 'string'
+        && typeof item.commit?.sha === 'string' && /^[\da-f]{40}$/u.test(item.commit.sha) ? [{ branch: item.name, oid: item.commit.sha }] : [])
+      return { branches, complete: listed.length < BRANCHES_PAGE }
+    },
+    // `base...sha`: `sha` is `base` or in its history where GitHub tells it
+    // behind or identical, a commit of a fork in the same network too.
+    async contains(name, base, sha) {
+      if (!/^[\da-f]{40}$/u.test(sha)) return null
+      let compared
+      try { compared = await githubJson(api(name, `/compare/${base.split('/').map(encodeURIComponent).join('/')}...${sha}?per_page=1`), token, fetchImpl) as { status?: unknown } } catch (error) {
+        if (error instanceof GithubApiError && (error.status === 404 || error.message === 'github-status-422')) return null
+        throw error
+      }
+      if (typeof compared?.status !== 'string') throw new GithubApiError(502, 'github-malformed')
+      return compared.status === 'behind' || compared.status === 'identical'
+    },
+    file: (name, path, commit) => orNone(() => client.getRepoFile({ repo: name, path, ref: commit })),
+  }
+}

package/server-managed/github-app.ts

@@ -67,20 +67,22 @@ export function mergeRepos(...lists: ConnectedRepo[][]): ConnectedRepo[] {
 }
 
 // One GitHub API call returning parsed JSON, optionally Bearer-authed by a
-// user token, App JWT, or installation token. Network / non-2xx / malformed
-// fold into a GithubApiError (401 passes through for the caller to handle).
-export async function githubJson(url: string, token: string | null, fetchImpl: typeof fetch, method: 'GET' | 'POST' = 'GET'): Promise<unknown> {
+// user token, App JWT, or installation token, `body` sent as JSON (a GraphQL
+// query's, given longer to answer). Network / non-2xx / malformed fold into a
+// GithubApiError (401 passes through for the caller to handle).
+export async function githubJson(url: string, token: string | null, fetchImpl: typeof fetch, method: 'GET' | 'POST' = 'GET', body?: unknown): Promise<unknown> {
   let res: Response
   const started = Date.now()
   try {
     res = await fetchImpl(url, {
       method,
-      signal: AbortSignal.timeout(10_000),
+      signal: AbortSignal.timeout(body === undefined ? 10_000 : 20_000),
       redirect: 'error',
       headers: {
         ...(token == null ? {} : { authorization: `Bearer ${token}` }), 'accept': 'application/vnd.github+json',
-        'user-agent': USER_AGENT, 'x-github-api-version': API_VERSION,
+        ...(body === undefined ? {} : { 'content-type': 'application/json' }), 'user-agent': USER_AGENT, 'x-github-api-version': API_VERSION,
       },
+      ...(body === undefined ? {} : { body: JSON.stringify(body) }),
     })
   } catch (error) { throw githubUnreachable(error, started) }
   if (res.status === 401) discardInstallationToken(token, fetchImpl)
@@ -302,6 +304,9 @@ async function mapGithubRequests<T, U>(items: T[], work: (item: T) => Promise<U>
   return results
 }
 
+// A GitHub account, as GitHub's /user tells it.
+export interface GithubIdentity { id: number; login: string }
+
 // The login App and repository App are separate: /user/repos with the login
 // token is not evidence of private-repo access. Ask the repository App for the
 // user's effective GitHub permission (including teams/org/enterprise grants).
@@ -310,23 +315,32 @@ async function mapGithubRequests<T, U>(items: T[], work: (item: T) => Promise<U>
 // https://docs.github.com/en/rest/collaborators/collaborators#get-repository-permissions-for-a-user
 // Resolve the current login from /user so renamed handles cannot check someone
 // else's access. All repo paths come from GitHub's installation catalogue.
-export async function githubUserIdentity(userToken: string, fetchImpl: typeof fetch = globalThis.fetch): Promise<{ id: number; login: string }> {
+export async function githubUserIdentity(userToken: string, fetchImpl: typeof fetch = globalThis.fetch): Promise<GithubIdentity> {
   const identity = await githubJson(`${GITHUB_API}/user`, userToken, fetchImpl) as { id?: unknown; login?: unknown }
   if (typeof identity?.login !== 'string' || !identity.login || typeof identity.id !== 'number' || !Number.isSafeInteger(identity.id) || identity.id <= 0) throw new GithubApiError(502, 'github-malformed')
   return { id: identity.id, login: identity.login }
 }
 
-export async function githubRepoReadPermission(fullName: string, token: string, identity: { id: number; login: string }, fetchImpl: typeof fetch = globalThis.fetch): Promise<boolean> {
+// The permission's level (`admin`, `write`, `read`), as GitHub tells it of
+// `identity` alone; `none` where it tells of none, or of another account.
+export async function githubRepoPermission(fullName: string, token: string, identity: GithubIdentity, fetchImpl: typeof fetch = globalThis.fetch): Promise<string> {
   const path = fullName.split('/').map(encodeURIComponent).join('/')
   try {
     const body = await githubJson(`${GITHUB_API}/repos/${path}/collaborators/${encodeURIComponent(identity.login)}/permission`, token, fetchImpl) as { permission?: unknown; user?: { id?: unknown } }
-    return body?.user?.id === identity.id && ['read', 'write', 'admin'].includes(String(body?.permission))
+    return body?.user?.id === identity.id && typeof body.permission === 'string' ? body.permission : 'none'
   } catch (err) {
-    if (err instanceof GithubApiError && err.status === 404) return false
+    if (err instanceof GithubApiError && err.status === 404) return 'none'
     throw err // Never broaden access when GitHub cannot verify permission.
   }
 }
 
+// The levels that read a repository.
+export const READ_PERMISSIONS: ReadonlySet<string> = new Set(['read', 'write', 'admin'])
+
+export async function githubRepoReadPermission(fullName: string, token: string, identity: GithubIdentity, fetchImpl: typeof fetch = globalThis.fetch): Promise<boolean> {
+  return READ_PERMISSIONS.has(await githubRepoPermission(fullName, token, identity, fetchImpl))
+}
+
 export async function filterInstalledRepos(config: ManagedConfig, repositories: ConnectedRepo[], userToken: string, fetchImpl: typeof fetch = globalThis.fetch): Promise<ConnectedRepo[]> {
   const identity = await githubUserIdentity(userToken, fetchImpl)
   const tokens = new Map<number, Promise<string | null>>()

package/server-managed/github-errors.ts

@@ -50,6 +50,8 @@ export async function throwGithubResponseError(res: Response): Promise<never> {
 export async function upstreamGithub<T>(request: () => Promise<T>): Promise<T> {
   const started = Date.now()
   try { return await request() } catch (error) {
+    // Already told as the router surfaces it.
+    if (error instanceof GithubApiError) throw error
     if (error instanceof HttpError) {
       // The upstream error includes GitHub's response text. Retain managed
       // status handling, including rate limits, without exposing that text.

package/server-managed/github-link-oauth.ts

@@ -0,0 +1,69 @@
+// Linking another GitHub account to the signed-in user (github-links.ts): the
+// App's user authorization again, completed by the account to link. GitHub is
+// asked for its account picker, as the browser is usually signed in to the
+// account the user signs in here with. The token GitHub grants reads the
+// account's identity and avatar; it is never stored.
+import type { AvatarStore } from './avatar-store.ts'
+import type { ManagedConfig } from './config.ts'
+import type { ManagedDb, ManagedSession } from './db.ts'
+import { randomToken, safeEqual } from './crypto.ts'
+import { LINK_STATE_COOKIE, buildCookie, clearCookie, cookieName, parseCookies } from './session.ts'
+import { OAuthError, cacheAvatar, exchangeCode, fetchIdentity } from './github-oauth.ts'
+import { ManagedMutationError } from './management.ts'
+
+export const LINK_LOGIN_PATH = '/api/oauth/github/link'
+// The profile page, where linking starts and its callback lands.
+const PROFILE_PATH = '/my/profile'
+const STATE_TTL_MS = 600_000
+
+export function isLinkOAuthCallback(config: ManagedConfig, query: URLSearchParams, cookie: string | undefined): boolean {
+  const expected = parseCookies(cookie).get(cookieName(config, LINK_STATE_COOKIE))?.split('.')[0]
+  return !!expected && safeEqual(query.get('state') ?? '', expected)
+}
+
+// The state is bound to the session that started linking, so the account
+// links to the user who asked, never to whoever is signed in on return.
+export function linkLoginRedirect(config: ManagedConfig, session: ManagedSession, now = Date.now()): { location: string; setCookie: string } {
+  const state = randomToken()
+  const url = new URL('https://github.com/login/oauth/authorize')
+  url.searchParams.set('client_id', config.githubClientId)
+  url.searchParams.set('redirect_uri', config.oauthCallbackUrl)
+  url.searchParams.set('state', state)
+  url.searchParams.set('allow_signup', 'false')
+  url.searchParams.set('prompt', 'select_account')
+  return { location: url.href, setCookie: buildCookie(cookieName(config, LINK_STATE_COOKIE), `${state}.${session.id}.${now}`,
+    { secure: config.cookieSecure, maxAgeS: STATE_TTL_MS / 1000, sameSite: 'Lax' }) }
+}
+
+// Back from GitHub: link the account that authorized, then land on the
+// profile, naming the refusal (`link-error`) when it was refused.
+// `linked` is the login of an account linked anew.
+export async function linkOAuthCallback(config: ManagedConfig, db: ManagedDb, session: ManagedSession,
+  query: URLSearchParams, cookie: string | undefined,
+  { avatarStore, fetchImpl = fetch, now = Date.now() }: { avatarStore?: AvatarStore; fetchImpl?: typeof fetch; now?: number } = {},
+): Promise<{ location: string; setCookie: string; linked: string | null }> {
+  const setCookie = clearCookie(cookieName(config, LINK_STATE_COOKIE), config.cookieSecure)
+  try {
+    const [expected, sessionId, timestamp] = (parseCookies(cookie).get(cookieName(config, LINK_STATE_COOKIE)) ?? '').split('.')
+    const code = query.get('code'), started = Number(timestamp), state = query.get('state')
+    if (!state || !expected || !safeEqual(state, expected) || sessionId !== session.id
+      || !timestamp || !Number.isFinite(started) || now < started || now - started > STATE_TTL_MS) {
+      throw new OAuthError(400, 'invalid-oauth-state')
+    }
+    // Declined on GitHub's side, which sends an error in place of a code.
+    if (!code) throw new OAuthError(400, query.get('error') ? 'github-authorization-declined' : 'invalid-oauth-state')
+    const tokens = await exchangeCode(config, code, now, fetchImpl)
+    const account = await fetchIdentity(tokens.accessToken, fetchImpl)
+    const link = await db.linkGithubAccount(session.id, account, now)
+    // Best-effort, as at sign-in: the avatar falls back to an initial.
+    if (avatarStore != null && account.avatarUrl != null) {
+      await cacheAvatar(avatarStore, link.id, account.avatarUrl, fetchImpl).catch((err) => {
+        console.warn('managed: linked avatar cache failed:', err)
+      })
+    }
+    return { location: PROFILE_PATH, setCookie, linked: link.created ? account.login : null }
+  } catch (err) {
+    if (!(err instanceof OAuthError || err instanceof ManagedMutationError)) throw err
+    return { location: `${PROFILE_PATH}?${new URLSearchParams({ 'link-error': err.message })}`, setCookie, linked: null }
+  }
+}

package/server-managed/github-links.ts

@@ -0,0 +1,204 @@
+// GitHub accounts a user links to their own on the profile page. A linked
+// account's identity is reserved for that user: it can neither sign in nor
+// register (upsertUser refuses it in the transaction that would create the
+// user), and an account that has registered cannot be linked. The user's
+// login and GitHub id stay the sign-in account's; the displayed name and
+// avatar may come from any of their accounts.
+import { randomUUID } from 'node:crypto'
+import type { ManagedUser } from './db-methods.ts'
+import { ManagedMutationError } from './management.ts'
+import type { ManagedSql } from './sql.ts'
+
+// login/name are snapshots of the account as it was last linked; linking it
+// again refreshes them. Its avatar is cached under the link id (avatar-store.ts).
+export const GITHUB_LINK_SCHEMA = `
+CREATE TABLE IF NOT EXISTS managed_github_link (
+  id             TEXT PRIMARY KEY,
+  user_id        TEXT NOT NULL REFERENCES managed_user(id) ON DELETE CASCADE,
+  github_user_id INTEGER NOT NULL UNIQUE,
+  login          TEXT NOT NULL,
+  name           TEXT,
+  linked_at      INTEGER NOT NULL
+) STRICT;
+
+CREATE INDEX IF NOT EXISTS managed_github_link_user_idx ON managed_github_link(user_id);
+`
+
+// managed_user columns added with the table. managed_user.name is the
+// displayed name; github_name keeps the sign-in account's own. name_link and
+// avatar_link name the linked account each comes from, NULL the sign-in one.
+export const GITHUB_LINK_USER_COLUMNS: readonly (readonly [string, string])[] = [
+  ['github_name', 'TEXT'],
+  ['name_link', 'TEXT REFERENCES managed_github_link(id) ON DELETE SET NULL'],
+  ['avatar_link', 'TEXT REFERENCES managed_github_link(id) ON DELETE SET NULL'],
+]
+
+export interface LinkedGithubAccount {
+  id: string
+  // Its GitHub account's numeric id, which GitHub never gives another.
+  githubId: number
+  login: string
+  name: string | null
+  linkedAt: number
+}
+
+export interface ManagedProfile {
+  // Always the sign-in account's.
+  login: string
+  // The displayed name, and the sign-in account's own GitHub name.
+  name: string | null
+  githubName: string | null
+  // The linked account the displayed name or avatar comes from, null the sign-in one.
+  nameAccount: string | null
+  avatarAccount: string | null
+  accounts: LinkedGithubAccount[]
+}
+
+// A user as the app shows them where a GitHub login of theirs is named: by
+// their id, whose avatar /api/avatar/<id> serves (the one they chose), their
+// sign-in login and the name they chose.
+export interface AppUser {
+  id: string
+  login: string
+  name: string | null
+}
+
+// Which account the displayed name and avatar each come from: a linked
+// account's id, or null for the sign-in account. An absent key is unchanged.
+export interface ProfileChoice {
+  name?: string | null
+  avatar?: string | null
+}
+
+export interface GithubLinkStore {
+  getProfile(userId: string): Promise<ManagedProfile | null>
+  // Link `account` to the session's own user, or refresh the snapshot of one
+  // they linked before. Refused for the sign-in account itself, an account
+  // another user linked, and any account that has registered.
+  linkGithubAccount(sessionId: string, account: ManagedUser, now: number): Promise<{ id: string; created: boolean }>
+  // Unlink one of the session user's accounts, which may then sign in or
+  // register again; a name or avatar it gave falls back to the sign-in
+  // account's. Null when the user has no such link.
+  unlinkGithubAccount(sessionId: string, id: string, now: number): Promise<LinkedGithubAccount | null>
+  setProfileChoice(sessionId: string, choice: ProfileChoice, now: number): Promise<void>
+  // The avatar to serve for `id`: a user's chosen linked account's, else `id`'s own.
+  getAvatarKey(id: string): Promise<string>
+  // The approved users signing in with, or having linked, each of
+  // `accounts`, by the login as asked: by the account's numeric id where it
+  // is known, which GitHub never gives another; else by its login (matched
+  // regardless of case, as GitHub matches them), one more than one user
+  // claims, renamed on GitHub since another signed in with it or linked it,
+  // left out. No access users are left out.
+  listUsersByAccount(accounts: readonly GithubAccount[]): Promise<Record<string, AppUser>>
+}
+
+// A GitHub account a repository's activity names: by its login, and its
+// numeric id where GitHub told it.
+export interface GithubAccount { login: string; githubId: number | null }
+
+type LinkRow = { id: string; githubId: number; login: string; name: string | null; linkedAt: number }
+const accountOf = (row: LinkRow): LinkedGithubAccount => ({ id: row.id, githubId: row.githubId, login: row.login, name: row.name, linkedAt: row.linkedAt })
+
+// GithubLinkStore.listUsersByAccount.
+async function usersByAccount(db: ManagedSql, accounts: readonly GithubAccount[]): Promise<Record<string, AppUser>> {
+  if (accounts.length === 0) return {}
+  const ids = accounts.flatMap(account => account.githubId ?? [])
+  const logins = accounts.flatMap(account => account.githubId === null ? [account.login] : [])
+  const rows = await db.prepare(`SELECT a.login, a.githubId, u.id, u.login AS appLogin, u.name, u.role FROM (
+      SELECT login, github_user_id AS githubId, id AS claimant FROM managed_user
+      UNION ALL SELECT login, github_user_id AS githubId, user_id AS claimant FROM managed_github_link
+    ) a JOIN managed_user u ON u.id = a.claimant
+    WHERE a.githubId IN (SELECT CAST(value AS BIGINT) FROM json_each(?)) OR lower(a.login) IN (SELECT lower(value) FROM json_each(?))`)
+    .all(JSON.stringify(ids), JSON.stringify(logins)) as { login: string; githubId: number; id: string; appLogin: string; name: string | null; role: string }[]
+  const byId = new Map(rows.map(row => [row.githubId, row]))
+  const claims = new Map<string, typeof rows>()
+  for (const row of rows) claims.set(row.login.toLowerCase(), [...claims.get(row.login.toLowerCase()) ?? [], row])
+  const users: Record<string, AppUser> = {}
+  for (const { login, githubId } of accounts) {
+    const [user, ...others] = githubId === null ? claims.get(login.toLowerCase()) ?? [] : byId.has(githubId) ? [byId.get(githubId)!] : []
+    if (!user || user.role === 'none' || others.some(other => other.id !== user.id)) continue
+    users[login] = { id: user.id, login: user.appLogin, name: user.name }
+  }
+  return users
+}
+
+export function githubLinkMethods(db: ManagedSql): GithubLinkStore {
+  // Linking is the session user's own act: never an admin's view as them,
+  // nor an account that has not been approved for the workspace.
+  async function sessionUser(sessionId: string, now: number): Promise<{ id: string; githubId: number }> {
+    const row = await db.prepare(`SELECT u.id, u.github_user_id AS githubId, u.role FROM managed_session s JOIN managed_user u ON u.id = s.user_id
+      WHERE s.id = ? AND s.expires_at > ? AND s.viewer_session IS NULL`).get(sessionId, now) as { id: string; githubId: number; role: string } | undefined
+    if (!row) throw new ManagedMutationError(401, 'unauthenticated')
+    if (row.role === 'none') throw new ManagedMutationError(403, 'forbidden')
+    return row
+  }
+  const linkOf = (userId: string, id: string) => db.prepare(`SELECT id, github_user_id AS githubId, login, name, linked_at AS linkedAt FROM managed_github_link
+    WHERE id = ? AND user_id = ?`).get(id, userId) as Promise<LinkRow | undefined>
+
+  return {
+    async getProfile(userId) {
+      const user = await db.prepare(`SELECT login, name, github_name AS githubName, name_link AS nameAccount, avatar_link AS avatarAccount
+        FROM managed_user WHERE id = ?`).get(userId) as Omit<ManagedProfile, 'accounts'> | undefined
+      if (!user) return null
+      const accounts = await db.prepare(`SELECT id, github_user_id AS githubId, login, name, linked_at AS linkedAt FROM managed_github_link
+        WHERE user_id = ? ORDER BY linked_at, id`).all(userId) as LinkRow[]
+      return { ...user, accounts: accounts.map(accountOf) }
+    },
+    async linkGithubAccount(sessionId, account, now) {
+      const user = await sessionUser(sessionId, now)
+      if (account.githubUserId === user.githubId) throw new ManagedMutationError(409, 'github-account-own')
+      if (await db.prepare('SELECT 1 AS found FROM managed_user WHERE github_user_id = ?').get(account.githubUserId)) {
+        throw new ManagedMutationError(409, 'github-account-registered')
+      }
+      const existing = await db.prepare('SELECT id, user_id AS userId FROM managed_github_link WHERE github_user_id = ?')
+        .get(account.githubUserId) as { id: string; userId: string } | undefined
+      if (existing && existing.userId !== user.id) throw new ManagedMutationError(409, 'github-account-linked')
+      if (existing) {
+        await db.prepare('UPDATE managed_github_link SET login = ?, name = ? WHERE id = ?').run(account.login, account.name, existing.id)
+        await db.prepare('UPDATE managed_user SET name = ?, updated_at = ? WHERE id = ? AND name_link = ?').run(account.name, now, user.id, existing.id)
+        return { id: existing.id, created: false }
+      }
+      const id = randomUUID()
+      await db.prepare(`INSERT INTO managed_github_link (id, user_id, github_user_id, login, name, linked_at)
+        VALUES (?, ?, ?, ?, ?, ?)`).run(id, user.id, account.githubUserId, account.login, account.name, now)
+      return { id, created: true }
+    },
+    async unlinkGithubAccount(sessionId, id, now) {
+      const user = await sessionUser(sessionId, now)
+      const link = await linkOf(user.id, id)
+      if (!link) return null
+      await db.prepare(`UPDATE managed_user SET
+          name = CASE WHEN name_link = :link THEN github_name ELSE name END,
+          name_link = CASE WHEN name_link = :link THEN NULL ELSE name_link END,
+          avatar_link = CASE WHEN avatar_link = :link THEN NULL ELSE avatar_link END,
+          updated_at = :now
+        WHERE id = :user`).run({ link: id, now, user: user.id })
+      await db.prepare('DELETE FROM managed_github_link WHERE id = ?').run(id)
+      return accountOf(link)
+    },
+    async setProfileChoice(sessionId, choice, now) {
+      const user = await sessionUser(sessionId, now)
+      const links = new Map<string, LinkRow>()
+      for (const id of [choice.name, choice.avatar]) {
+        if (id == null || links.has(id)) continue
+        const link = await linkOf(user.id, id)
+        if (!link) throw new ManagedMutationError(404, 'no-account')
+        links.set(id, link)
+      }
+      if (choice.name !== undefined) {
+        // A linked account without a name leaves the user without one too.
+        await db.prepare(`UPDATE managed_user SET name_link = :link,
+            name = CASE WHEN :link IS NULL THEN github_name ELSE :name END, updated_at = :now
+          WHERE id = :user`).run({ link: choice.name, name: choice.name === null ? null : links.get(choice.name)!.name, now, user: user.id })
+      }
+      if (choice.avatar !== undefined) {
+        await db.prepare('UPDATE managed_user SET avatar_link = ?, updated_at = ? WHERE id = ?').run(choice.avatar, now, user.id)
+      }
+    },
+    async getAvatarKey(id) {
+      const row = await db.prepare('SELECT avatar_link AS link FROM managed_user WHERE id = ?').get(id) as { link: string | null } | undefined
+      return row?.link ?? id
+    },
+    listUsersByAccount: accounts => usersByAccount(db, accounts),
+  }
+}

package/server-managed/github-oauth.ts

@@ -63,7 +63,10 @@ export async function handleCallback(
   }
   const tokens = await exchangeCode(config, code, now, fetchImpl)
   const user = await fetchIdentity(tokens.accessToken, fetchImpl)
-  const { setCookie, userId } = await createSession(config, db, user, now)
+  const session = await createSession(config, db, user, now)
+  // Linked to another user's account on their profile (github-links.ts).
+  if (session == null) throw new OAuthError(403, 'github-account-linked')
+  const { setCookie, userId } = session
   // Persist the user token so the repositories page can list repos on demand.
   await db.setUserTokens(userId, tokens)
   // Cache the avatar for same-origin serving (the page's CSP forbids loading
@@ -216,7 +219,7 @@ function parseGithubUser(body: unknown): ManagedUser | null {
 // Fetch the user's GitHub avatar and cache it for same-origin serving. The host
 // is validated (githubusercontent.com over https) as SSRF defence-in-depth,
 // even though the URL comes from GitHub's own /user response.
-async function cacheAvatar(store: AvatarStore, id: string, avatarUrl: string, fetchImpl: typeof fetch): Promise<void> {
+export async function cacheAvatar(store: AvatarStore, id: string, avatarUrl: string, fetchImpl: typeof fetch): Promise<void> {
   if (!isGithubAvatarUrl(avatarUrl)) return
   // `redirect: 'manual'` so a 3xx off the (validated) avatars host can't bounce
   // the fetch to an internal address — an opaque-redirect / 3xx fails the