@preventive/triage 1.0.0-alpha.44 → 1.0.0-alpha.46

package/server-managed/github-app.ts

@@ -7,8 +7,10 @@ import { createHash, createSign } from 'node:crypto'
 import { createClient } from '@preventive/upstream/github.js'
 import type { ManagedConfig } from './config.ts'
 import { GithubApiError, githubUnreachable, throwGithubResponseError, upstreamGithub } from './github-errors.ts'
+import { onTokenRejected, shareGithubRead, tokenRejected } from './github-requests.ts'
 
 export { GithubApiError } from './github-errors.ts'
+export { onTokenRejected } from './github-requests.ts'
 
 const GITHUB_API = 'https://api.github.com'
 const API_VERSION = '2022-11-28'
@@ -22,12 +24,12 @@ interface InstallationTokenEntry { token: string | null; expiresAt: number; pend
 // cached here. Bound memory per transport and separate App/key/install scopes.
 const installationTokens = new WeakMap<typeof fetch, Map<string, InstallationTokenEntry>>()
 
-function discardInstallationToken(token: string | null, fetchImpl: typeof fetch): void {
-  if (!token) return
+// A token GitHub rejected (401): an installation's no longer reused.
+onTokenRejected((token, fetchImpl) => {
   const cache = installationTokens.get(fetchImpl)
   if (!cache) return
   for (const [key, entry] of cache) if (entry.token === token) cache.delete(key)
-}
+})
 
 // One listed repository. Carries the context to read its contents later:
 // `installationId` mints an App installation token (Contents: Read) for a repo
@@ -67,23 +69,29 @@ export function mergeRepos(...lists: ConnectedRepo[][]): ConnectedRepo[] {
 }
 
 // One GitHub API call returning parsed JSON, optionally Bearer-authed by a
-// user token, App JWT, or installation token. Network / non-2xx / malformed
-// fold into a GithubApiError (401 passes through for the caller to handle).
-export async function githubJson(url: string, token: string | null, fetchImpl: typeof fetch, method: 'GET' | 'POST' = 'GET'): Promise<unknown> {
+// user token, App JWT, or installation token, `body` sent as JSON (a GraphQL
+// query's, given longer to answer). Network / non-2xx / malformed fold into a
+// GithubApiError (401 passes through for the caller to handle). Identical GETs
+// share an outstanding read through its body. POSTs only opt in for read-only
+// GraphQL queries (repository-history.ts), never for mutations or token mints.
+export async function githubJson(url: string, token: string | null, fetchImpl: typeof fetch, method: 'GET' | 'POST' = 'GET', body?: unknown,
+  readOnly = method === 'GET'): Promise<unknown> {
+  if (readOnly) return shareGithubRead(fetchImpl, JSON.stringify([url, token, method, body]), () => githubJson(url, token, fetchImpl, method, body, false))
   let res: Response
   const started = Date.now()
   try {
     res = await fetchImpl(url, {
       method,
-      signal: AbortSignal.timeout(10_000),
+      signal: AbortSignal.timeout(body === undefined ? 10_000 : 20_000),
       redirect: 'error',
       headers: {
         ...(token == null ? {} : { authorization: `Bearer ${token}` }), 'accept': 'application/vnd.github+json',
-        'user-agent': USER_AGENT, 'x-github-api-version': API_VERSION,
+        ...(body === undefined ? {} : { 'content-type': 'application/json' }), 'user-agent': USER_AGENT, 'x-github-api-version': API_VERSION,
       },
+      ...(body === undefined ? {} : { body: JSON.stringify(body) }),
     })
   } catch (error) { throw githubUnreachable(error, started) }
-  if (res.status === 401) discardInstallationToken(token, fetchImpl)
+  if (res.status === 401 && token) tokenRejected(token, fetchImpl)
   if (!res.ok) await throwGithubResponseError(res)
   // The answer's body is read within the same timeout: one not read whole is
   // GitHub not reached, as one not answered is; only one that isn't JSON is
@@ -302,6 +310,9 @@ async function mapGithubRequests<T, U>(items: T[], work: (item: T) => Promise<U>
   return results
 }
 
+// A GitHub account, as GitHub's /user tells it.
+export interface GithubIdentity { id: number; login: string }
+
 // The login App and repository App are separate: /user/repos with the login
 // token is not evidence of private-repo access. Ask the repository App for the
 // user's effective GitHub permission (including teams/org/enterprise grants).
@@ -310,23 +321,32 @@ async function mapGithubRequests<T, U>(items: T[], work: (item: T) => Promise<U>
 // https://docs.github.com/en/rest/collaborators/collaborators#get-repository-permissions-for-a-user
 // Resolve the current login from /user so renamed handles cannot check someone
 // else's access. All repo paths come from GitHub's installation catalogue.
-export async function githubUserIdentity(userToken: string, fetchImpl: typeof fetch = globalThis.fetch): Promise<{ id: number; login: string }> {
+export async function githubUserIdentity(userToken: string, fetchImpl: typeof fetch = globalThis.fetch): Promise<GithubIdentity> {
   const identity = await githubJson(`${GITHUB_API}/user`, userToken, fetchImpl) as { id?: unknown; login?: unknown }
   if (typeof identity?.login !== 'string' || !identity.login || typeof identity.id !== 'number' || !Number.isSafeInteger(identity.id) || identity.id <= 0) throw new GithubApiError(502, 'github-malformed')
   return { id: identity.id, login: identity.login }
 }
 
-export async function githubRepoReadPermission(fullName: string, token: string, identity: { id: number; login: string }, fetchImpl: typeof fetch = globalThis.fetch): Promise<boolean> {
+// The permission's level (`admin`, `write`, `read`), as GitHub tells it of
+// `identity` alone; `none` where it tells of none, or of another account.
+export async function githubRepoPermission(fullName: string, token: string, identity: GithubIdentity, fetchImpl: typeof fetch = globalThis.fetch): Promise<string> {
   const path = fullName.split('/').map(encodeURIComponent).join('/')
   try {
     const body = await githubJson(`${GITHUB_API}/repos/${path}/collaborators/${encodeURIComponent(identity.login)}/permission`, token, fetchImpl) as { permission?: unknown; user?: { id?: unknown } }
-    return body?.user?.id === identity.id && ['read', 'write', 'admin'].includes(String(body?.permission))
+    return body?.user?.id === identity.id && typeof body.permission === 'string' ? body.permission : 'none'
   } catch (err) {
-    if (err instanceof GithubApiError && err.status === 404) return false
+    if (err instanceof GithubApiError && err.status === 404) return 'none'
     throw err // Never broaden access when GitHub cannot verify permission.
   }
 }
 
+// The levels that read a repository.
+export const READ_PERMISSIONS: ReadonlySet<string> = new Set(['read', 'write', 'admin'])
+
+export async function githubRepoReadPermission(fullName: string, token: string, identity: GithubIdentity, fetchImpl: typeof fetch = globalThis.fetch): Promise<boolean> {
+  return READ_PERMISSIONS.has(await githubRepoPermission(fullName, token, identity, fetchImpl))
+}
+
 export async function filterInstalledRepos(config: ManagedConfig, repositories: ConnectedRepo[], userToken: string, fetchImpl: typeof fetch = globalThis.fetch): Promise<ConnectedRepo[]> {
   const identity = await githubUserIdentity(userToken, fetchImpl)
   const tokens = new Map<number, Promise<string | null>>()

package/server-managed/github-errors.ts

@@ -50,6 +50,8 @@ export async function throwGithubResponseError(res: Response): Promise<never> {
 export async function upstreamGithub<T>(request: () => Promise<T>): Promise<T> {
   const started = Date.now()
   try { return await request() } catch (error) {
+    // Already told as the router surfaces it.
+    if (error instanceof GithubApiError) throw error
     if (error instanceof HttpError) {
       // The upstream error includes GitHub's response text. Retain managed
       // status handling, including rate limits, without exposing that text.

package/server-managed/github-issue-links.ts

@@ -52,6 +52,15 @@ function readPage(job: Job, item: Issue | Pull, metadata: Map<string, Metadata>)
 
 function issueUpdates(jobs: Job[], issues: ManagedIssue[], allowed: Map<string, Repository>, checkedAt: number, metadata: Map<string, Metadata>) {
   const updates: IssueFixUpdate[] = []
+  // The issues each job's issue is, by repository and number, read once.
+  const byIssue = new Map<string, ManagedIssue[]>()
+  for (const issue of issues) {
+    const ref = parseGithubFixUrl(issue.issueUrl)
+    if (ref?.kind !== 'issue') continue
+    const key = `${issue.repoId}:${ref.number}`, same = byIssue.get(key)
+    if (same) same.push(issue)
+    else byIssue.set(key, [issue])
+  }
   for (const job of jobs) {
     if (!job.linked || !job.complete) continue
     // "Last" means the newest PR by creation time, never its latest comment.
@@ -62,11 +71,8 @@ function issueUpdates(jobs: Job[], issues: ManagedIssue[], allowed: Map<string,
     if (latest && (!repo || repo.repoId !== latest.repository.databaseId)) continue
     const next = latest ? `https://github.com/${repo!.github}/pull/${latest.number}` : null
     if (latest && next) metadata.set(next, { url: next, ...itemMetadata(latest, 'pull')! })
-    for (const issue of issues) {
-      const ref = parseGithubFixUrl(issue.issueUrl)
-      if (ref?.kind === 'issue' && ref.number === job.number && issue.repoId === job.repo.repoId) {
-        updates.push({ findingId: issue.findingId, issueUrl: issue.issueUrl!, previous: issue.autoFixUrl, next, checkedAt })
-      }
+    for (const issue of byIssue.get(`${job.repo.repoId}:${job.number}`) ?? []) {
+      updates.push({ findingId: issue.findingId, issueUrl: issue.issueUrl!, previous: issue.autoFixUrl, next, checkedAt })
     }
   }
   return updates

package/server-managed/github-link-oauth.ts

@@ -0,0 +1,69 @@
+// Linking another GitHub account to the signed-in user (github-links.ts): the
+// App's user authorization again, completed by the account to link. GitHub is
+// asked for its account picker, as the browser is usually signed in to the
+// account the user signs in here with. The token GitHub grants reads the
+// account's identity and avatar; it is never stored.
+import type { AvatarStore } from './avatar-store.ts'
+import type { ManagedConfig } from './config.ts'
+import type { ManagedDb, ManagedSession } from './db.ts'
+import { randomToken, safeEqual } from './crypto.ts'
+import { LINK_STATE_COOKIE, buildCookie, clearCookie, cookieName, parseCookies } from './session.ts'
+import { OAuthError, cacheAvatar, exchangeCode, fetchIdentity } from './github-oauth.ts'
+import { ManagedMutationError } from './management.ts'
+
+export const LINK_LOGIN_PATH = '/api/oauth/github/link'
+// The profile page, where linking starts and its callback lands.
+const PROFILE_PATH = '/my/profile'
+const STATE_TTL_MS = 600_000
+
+export function isLinkOAuthCallback(config: ManagedConfig, query: URLSearchParams, cookie: string | undefined): boolean {
+  const expected = parseCookies(cookie).get(cookieName(config, LINK_STATE_COOKIE))?.split('.')[0]
+  return !!expected && safeEqual(query.get('state') ?? '', expected)
+}
+
+// The state is bound to the session that started linking, so the account
+// links to the user who asked, never to whoever is signed in on return.
+export function linkLoginRedirect(config: ManagedConfig, session: ManagedSession, now = Date.now()): { location: string; setCookie: string } {
+  const state = randomToken()
+  const url = new URL('https://github.com/login/oauth/authorize')
+  url.searchParams.set('client_id', config.githubClientId)
+  url.searchParams.set('redirect_uri', config.oauthCallbackUrl)
+  url.searchParams.set('state', state)
+  url.searchParams.set('allow_signup', 'false')
+  url.searchParams.set('prompt', 'select_account')
+  return { location: url.href, setCookie: buildCookie(cookieName(config, LINK_STATE_COOKIE), `${state}.${session.id}.${now}`,
+    { secure: config.cookieSecure, maxAgeS: STATE_TTL_MS / 1000, sameSite: 'Lax' }) }
+}
+
+// Back from GitHub: link the account that authorized, then land on the
+// profile, naming the refusal (`link-error`) when it was refused.
+// `linked` is the login of an account linked anew.
+export async function linkOAuthCallback(config: ManagedConfig, db: ManagedDb, session: ManagedSession,
+  query: URLSearchParams, cookie: string | undefined,
+  { avatarStore, fetchImpl = fetch, now = Date.now() }: { avatarStore?: AvatarStore; fetchImpl?: typeof fetch; now?: number } = {},
+): Promise<{ location: string; setCookie: string; linked: string | null }> {
+  const setCookie = clearCookie(cookieName(config, LINK_STATE_COOKIE), config.cookieSecure)
+  try {
+    const [expected, sessionId, timestamp] = (parseCookies(cookie).get(cookieName(config, LINK_STATE_COOKIE)) ?? '').split('.')
+    const code = query.get('code'), started = Number(timestamp), state = query.get('state')
+    if (!state || !expected || !safeEqual(state, expected) || sessionId !== session.id
+      || !timestamp || !Number.isFinite(started) || now < started || now - started > STATE_TTL_MS) {
+      throw new OAuthError(400, 'invalid-oauth-state')
+    }
+    // Declined on GitHub's side, which sends an error in place of a code.
+    if (!code) throw new OAuthError(400, query.get('error') ? 'github-authorization-declined' : 'invalid-oauth-state')
+    const tokens = await exchangeCode(config, code, now, fetchImpl)
+    const account = await fetchIdentity(tokens.accessToken, fetchImpl)
+    const link = await db.linkGithubAccount(session.id, account, now)
+    // Best-effort, as at sign-in: the avatar falls back to an initial.
+    if (avatarStore != null && account.avatarUrl != null) {
+      await cacheAvatar(avatarStore, link.id, account.avatarUrl, fetchImpl).catch((err) => {
+        console.warn('managed: linked avatar cache failed:', err)
+      })
+    }
+    return { location: PROFILE_PATH, setCookie, linked: link.created ? account.login : null }
+  } catch (err) {
+    if (!(err instanceof OAuthError || err instanceof ManagedMutationError)) throw err
+    return { location: `${PROFILE_PATH}?${new URLSearchParams({ 'link-error': err.message })}`, setCookie, linked: null }
+  }
+}

package/server-managed/github-links.ts

@@ -0,0 +1,204 @@
+// GitHub accounts a user links to their own on the profile page. A linked
+// account's identity is reserved for that user: it can neither sign in nor
+// register (upsertUser refuses it in the transaction that would create the
+// user), and an account that has registered cannot be linked. The user's
+// login and GitHub id stay the sign-in account's; the displayed name and
+// avatar may come from any of their accounts.
+import { randomUUID } from 'node:crypto'
+import type { ManagedUser } from './db-methods.ts'
+import { ManagedMutationError } from './management.ts'
+import type { ManagedSql } from './sql.ts'
+
+// login/name are snapshots of the account as it was last linked; linking it
+// again refreshes them. Its avatar is cached under the link id (avatar-store.ts).
+export const GITHUB_LINK_SCHEMA = `
+CREATE TABLE IF NOT EXISTS managed_github_link (
+  id             TEXT PRIMARY KEY,
+  user_id        TEXT NOT NULL REFERENCES managed_user(id) ON DELETE CASCADE,
+  github_user_id INTEGER NOT NULL UNIQUE,
+  login          TEXT NOT NULL,
+  name           TEXT,
+  linked_at      INTEGER NOT NULL
+) STRICT;
+
+CREATE INDEX IF NOT EXISTS managed_github_link_user_idx ON managed_github_link(user_id);
+`
+
+// managed_user columns added with the table. managed_user.name is the
+// displayed name; github_name keeps the sign-in account's own. name_link and
+// avatar_link name the linked account each comes from, NULL the sign-in one.
+export const GITHUB_LINK_USER_COLUMNS: readonly (readonly [string, string])[] = [
+  ['github_name', 'TEXT'],
+  ['name_link', 'TEXT REFERENCES managed_github_link(id) ON DELETE SET NULL'],
+  ['avatar_link', 'TEXT REFERENCES managed_github_link(id) ON DELETE SET NULL'],
+]
+
+export interface LinkedGithubAccount {
+  id: string
+  // Its GitHub account's numeric id, which GitHub never gives another.
+  githubId: number
+  login: string
+  name: string | null
+  linkedAt: number
+}
+
+export interface ManagedProfile {
+  // Always the sign-in account's.
+  login: string
+  // The displayed name, and the sign-in account's own GitHub name.
+  name: string | null
+  githubName: string | null
+  // The linked account the displayed name or avatar comes from, null the sign-in one.
+  nameAccount: string | null
+  avatarAccount: string | null
+  accounts: LinkedGithubAccount[]
+}
+
+// A user as the app shows them where a GitHub login of theirs is named: by
+// their id, whose avatar /api/avatar/<id> serves (the one they chose), their
+// sign-in login and the name they chose.
+export interface AppUser {
+  id: string
+  login: string
+  name: string | null
+}
+
+// Which account the displayed name and avatar each come from: a linked
+// account's id, or null for the sign-in account. An absent key is unchanged.
+export interface ProfileChoice {
+  name?: string | null
+  avatar?: string | null
+}
+
+export interface GithubLinkStore {
+  getProfile(userId: string): Promise<ManagedProfile | null>
+  // Link `account` to the session's own user, or refresh the snapshot of one
+  // they linked before. Refused for the sign-in account itself, an account
+  // another user linked, and any account that has registered.
+  linkGithubAccount(sessionId: string, account: ManagedUser, now: number): Promise<{ id: string; created: boolean }>
+  // Unlink one of the session user's accounts, which may then sign in or
+  // register again; a name or avatar it gave falls back to the sign-in
+  // account's. Null when the user has no such link.
+  unlinkGithubAccount(sessionId: string, id: string, now: number): Promise<LinkedGithubAccount | null>
+  setProfileChoice(sessionId: string, choice: ProfileChoice, now: number): Promise<void>
+  // The avatar to serve for `id`: a user's chosen linked account's, else `id`'s own.
+  getAvatarKey(id: string): Promise<string>
+  // The approved users signing in with, or having linked, each of
+  // `accounts`, by the login as asked: by the account's numeric id where it
+  // is known, which GitHub never gives another; else by its login (matched
+  // regardless of case, as GitHub matches them), one more than one user
+  // claims, renamed on GitHub since another signed in with it or linked it,
+  // left out. No access users are left out.
+  listUsersByAccount(accounts: readonly GithubAccount[]): Promise<Record<string, AppUser>>
+}
+
+// A GitHub account a repository's activity names: by its login, and its
+// numeric id where GitHub told it.
+export interface GithubAccount { login: string; githubId: number | null }
+
+type LinkRow = { id: string; githubId: number; login: string; name: string | null; linkedAt: number }
+const accountOf = (row: LinkRow): LinkedGithubAccount => ({ id: row.id, githubId: row.githubId, login: row.login, name: row.name, linkedAt: row.linkedAt })
+
+// GithubLinkStore.listUsersByAccount.
+async function usersByAccount(db: ManagedSql, accounts: readonly GithubAccount[]): Promise<Record<string, AppUser>> {
+  if (accounts.length === 0) return {}
+  const ids = accounts.flatMap(account => account.githubId ?? [])
+  const logins = accounts.flatMap(account => account.githubId === null ? [account.login] : [])
+  const rows = await db.prepare(`SELECT a.login, a.githubId, u.id, u.login AS appLogin, u.name, u.role FROM (
+      SELECT login, github_user_id AS githubId, id AS claimant FROM managed_user
+      UNION ALL SELECT login, github_user_id AS githubId, user_id AS claimant FROM managed_github_link
+    ) a JOIN managed_user u ON u.id = a.claimant
+    WHERE a.githubId IN (SELECT CAST(value AS BIGINT) FROM json_each(?)) OR lower(a.login) IN (SELECT lower(value) FROM json_each(?))`)
+    .all(JSON.stringify(ids), JSON.stringify(logins)) as { login: string; githubId: number; id: string; appLogin: string; name: string | null; role: string }[]
+  const byId = new Map(rows.map(row => [row.githubId, row]))
+  const claims = new Map<string, typeof rows>()
+  for (const row of rows) claims.set(row.login.toLowerCase(), [...claims.get(row.login.toLowerCase()) ?? [], row])
+  const users: Record<string, AppUser> = {}
+  for (const { login, githubId } of accounts) {
+    const [user, ...others] = githubId === null ? claims.get(login.toLowerCase()) ?? [] : byId.has(githubId) ? [byId.get(githubId)!] : []
+    if (!user || user.role === 'none' || others.some(other => other.id !== user.id)) continue
+    users[login] = { id: user.id, login: user.appLogin, name: user.name }
+  }
+  return users
+}
+
+export function githubLinkMethods(db: ManagedSql): GithubLinkStore {
+  // Linking is the session user's own act: never an admin's view as them,
+  // nor an account that has not been approved for the workspace.
+  async function sessionUser(sessionId: string, now: number): Promise<{ id: string; githubId: number }> {
+    const row = await db.prepare(`SELECT u.id, u.github_user_id AS githubId, u.role FROM managed_session s JOIN managed_user u ON u.id = s.user_id
+      WHERE s.id = ? AND s.expires_at > ? AND s.viewer_session IS NULL`).get(sessionId, now) as { id: string; githubId: number; role: string } | undefined
+    if (!row) throw new ManagedMutationError(401, 'unauthenticated')
+    if (row.role === 'none') throw new ManagedMutationError(403, 'forbidden')
+    return row
+  }
+  const linkOf = (userId: string, id: string) => db.prepare(`SELECT id, github_user_id AS githubId, login, name, linked_at AS linkedAt FROM managed_github_link
+    WHERE id = ? AND user_id = ?`).get(id, userId) as Promise<LinkRow | undefined>
+
+  return {
+    async getProfile(userId) {
+      const user = await db.prepare(`SELECT login, name, github_name AS githubName, name_link AS nameAccount, avatar_link AS avatarAccount
+        FROM managed_user WHERE id = ?`).get(userId) as Omit<ManagedProfile, 'accounts'> | undefined
+      if (!user) return null
+      const accounts = await db.prepare(`SELECT id, github_user_id AS githubId, login, name, linked_at AS linkedAt FROM managed_github_link
+        WHERE user_id = ? ORDER BY linked_at, id`).all(userId) as LinkRow[]
+      return { ...user, accounts: accounts.map(accountOf) }
+    },
+    async linkGithubAccount(sessionId, account, now) {
+      const user = await sessionUser(sessionId, now)
+      if (account.githubUserId === user.githubId) throw new ManagedMutationError(409, 'github-account-own')
+      if (await db.prepare('SELECT 1 AS found FROM managed_user WHERE github_user_id = ?').get(account.githubUserId)) {
+        throw new ManagedMutationError(409, 'github-account-registered')
+      }
+      const existing = await db.prepare('SELECT id, user_id AS userId FROM managed_github_link WHERE github_user_id = ?')
+        .get(account.githubUserId) as { id: string; userId: string } | undefined
+      if (existing && existing.userId !== user.id) throw new ManagedMutationError(409, 'github-account-linked')
+      if (existing) {
+        await db.prepare('UPDATE managed_github_link SET login = ?, name = ? WHERE id = ?').run(account.login, account.name, existing.id)
+        await db.prepare('UPDATE managed_user SET name = ?, updated_at = ? WHERE id = ? AND name_link = ?').run(account.name, now, user.id, existing.id)
+        return { id: existing.id, created: false }
+      }
+      const id = randomUUID()
+      await db.prepare(`INSERT INTO managed_github_link (id, user_id, github_user_id, login, name, linked_at)
+        VALUES (?, ?, ?, ?, ?, ?)`).run(id, user.id, account.githubUserId, account.login, account.name, now)
+      return { id, created: true }
+    },
+    async unlinkGithubAccount(sessionId, id, now) {
+      const user = await sessionUser(sessionId, now)
+      const link = await linkOf(user.id, id)
+      if (!link) return null
+      await db.prepare(`UPDATE managed_user SET
+          name = CASE WHEN name_link = :link THEN github_name ELSE name END,
+          name_link = CASE WHEN name_link = :link THEN NULL ELSE name_link END,
+          avatar_link = CASE WHEN avatar_link = :link THEN NULL ELSE avatar_link END,
+          updated_at = :now
+        WHERE id = :user`).run({ link: id, now, user: user.id })
+      await db.prepare('DELETE FROM managed_github_link WHERE id = ?').run(id)
+      return accountOf(link)
+    },
+    async setProfileChoice(sessionId, choice, now) {
+      const user = await sessionUser(sessionId, now)
+      const links = new Map<string, LinkRow>()
+      for (const id of [choice.name, choice.avatar]) {
+        if (id == null || links.has(id)) continue
+        const link = await linkOf(user.id, id)
+        if (!link) throw new ManagedMutationError(404, 'no-account')
+        links.set(id, link)
+      }
+      if (choice.name !== undefined) {
+        // A linked account without a name leaves the user without one too.
+        await db.prepare(`UPDATE managed_user SET name_link = :link,
+            name = CASE WHEN :link IS NULL THEN github_name ELSE :name END, updated_at = :now
+          WHERE id = :user`).run({ link: choice.name, name: choice.name === null ? null : links.get(choice.name)!.name, now, user: user.id })
+      }
+      if (choice.avatar !== undefined) {
+        await db.prepare('UPDATE managed_user SET avatar_link = ?, updated_at = ? WHERE id = ?').run(choice.avatar, now, user.id)
+      }
+    },
+    async getAvatarKey(id) {
+      const row = await db.prepare('SELECT avatar_link AS link FROM managed_user WHERE id = ?').get(id) as { link: string | null } | undefined
+      return row?.link ?? id
+    },
+    listUsersByAccount: accounts => usersByAccount(db, accounts),
+  }
+}

package/server-managed/github-oauth.ts

@@ -63,7 +63,10 @@ export async function handleCallback(
   }
   const tokens = await exchangeCode(config, code, now, fetchImpl)
   const user = await fetchIdentity(tokens.accessToken, fetchImpl)
-  const { setCookie, userId } = await createSession(config, db, user, now)
+  const session = await createSession(config, db, user, now)
+  // Linked to another user's account on their profile (github-links.ts).
+  if (session == null) throw new OAuthError(403, 'github-account-linked')
+  const { setCookie, userId } = session
   // Persist the user token so the repositories page can list repos on demand.
   await db.setUserTokens(userId, tokens)
   // Cache the avatar for same-origin serving (the page's CSP forbids loading
@@ -216,7 +219,7 @@ function parseGithubUser(body: unknown): ManagedUser | null {
 // Fetch the user's GitHub avatar and cache it for same-origin serving. The host
 // is validated (githubusercontent.com over https) as SSRF defence-in-depth,
 // even though the URL comes from GitHub's own /user response.
-async function cacheAvatar(store: AvatarStore, id: string, avatarUrl: string, fetchImpl: typeof fetch): Promise<void> {
+export async function cacheAvatar(store: AvatarStore, id: string, avatarUrl: string, fetchImpl: typeof fetch): Promise<void> {
   if (!isGithubAvatarUrl(avatarUrl)) return
   // `redirect: 'manual'` so a 3xx off the (validated) avatars host can't bounce
   // the fetch to an internal address — an opaque-redirect / 3xx fails the

package/server-managed/github-pulls.ts

@@ -222,6 +222,6 @@ export async function lookupFixes(config: ManagedConfig, db: ManagedDb, snapshot
   })
 }
 
-export function storedFixUrls(entries: { fix: string | null }[]): string[] {
-  return [...new Set(entries.flatMap(entry => entry.fix && parseGithubFixUrl(entry.fix) ? [entry.fix] : []))].toSorted()
+export function storedFixUrls(fixes: string[]): string[] {
+  return [...new Set(fixes.filter(fix => parseGithubFixUrl(fix)))].toSorted()
 }

package/server-managed/github-requests.ts

@@ -0,0 +1,39 @@
+import { createHash } from 'node:crypto'
+
+// Only outstanding reads: a completed answer (or failure) is never reused.
+// Keep transports and credentials separate, including anonymous reads. When
+// full, new reads proceed normally rather than waiting for an unrelated one.
+const MAX_PENDING_READS = 1000
+type PendingRead = { promise: Promise<unknown>; shared: boolean }
+const pendingReads = new WeakMap<typeof fetch, Map<string, PendingRead>>()
+
+// Invalidate installation credentials and access verdicts when GitHub rejects
+// a token, including when several callers share the rejected request.
+const rejectedTokenListeners = new Set<(token: string, fetchImpl: typeof fetch) => void>()
+export function onTokenRejected(listener: (token: string, fetchImpl: typeof fetch) => void): void {
+  rejectedTokenListeners.add(listener)
+}
+export function tokenRejected(token: string, fetchImpl: typeof fetch): void {
+  for (const listener of rejectedTokenListeners) listener(token, fetchImpl)
+}
+
+export async function shareGithubRead<T>(fetchImpl: typeof fetch, request: string, read: () => Promise<T>): Promise<T> {
+  let pending = pendingReads.get(fetchImpl)
+  if (!pending) { pending = new Map(); pendingReads.set(fetchImpl, pending) }
+  // The request includes credentials and query variables. Retain only its hash.
+  const key = createHash('sha256').update(request).digest('hex')
+  const held = pending.get(key)
+  if (held) {
+    held.shared = true
+    return structuredClone(await held.promise) as T
+  }
+  if (pending.size >= MAX_PENDING_READS) return read()
+  const entry: PendingRead = { promise: read(), shared: false }
+  pending.set(key, entry)
+  try {
+    const value = await entry.promise
+    // Independent objects for coalesced callers, without copying large trees
+    // or histories when nobody joined the read.
+    return (entry.shared ? structuredClone(value) : value) as T
+  } finally { pending.delete(key) }
+}

package/server-managed/github-users.ts

@@ -0,0 +1,30 @@
+// The app's users and agents where a repository's activity names their
+// GitHub accounts (GET /api/admin/repositories/history, issues, item, agents
+// and pulse): of the accounts an answer names (common/managed/github-logins.ts),
+// the agents' (common/managed/github-agents.ts), and those an approved user
+// signs in with or linked to theirs (github-links.ts), each as that user
+// shows in the app, linked accounts as their user; each by its numeric id
+// where the answer names it, else by its login. Resolved as each answer is
+// sent, never kept with it, and only for the accounts it names: a reader is
+// never sent a list of users.
+import { type GithubAgentId, githubAgent } from '../common/managed/github-agents.ts'
+import { namedAccounts } from '../common/managed/github-logins.ts'
+import type { ManagedDb } from './db.ts'
+import type { AppUser } from './github-links.ts'
+
+// An agent, as the app draws it (GITHUB_AGENTS).
+export interface AppAgentUser { agent: GithubAgentId }
+
+// `answer` with the app's users and agents its accounts are (`users`, by
+// login), as a new object: what was kept of it, every reader's, is left as
+// it was. A login it names by more than one account is no one's.
+export async function withAppUsers<T extends object>(db: ManagedDb, answer: T): Promise<T & { users: Record<string, AppUser | AppAgentUser> }> {
+  const agents: Record<string, AppAgentUser> = {}
+  const accounts = [...namedAccounts(answer)].flatMap(([login, githubId]) => {
+    if (githubId === 'ambiguous') return []
+    const agent = githubAgent(login, githubId)
+    if (agent) agents[login] = { agent }
+    return agent ? [] : [{ login, githubId }]
+  })
+  return { ...answer, users: { ...await db.listUsersByAccount(accounts), ...agents } }
+}

package/server-managed/http-response.ts

@@ -15,8 +15,16 @@ export function attachmentDisposition(filename: string): string {
 // already materialized by the authorization/filtering layer before we get here.
 export function writeResponse(res: ServerResponse, body: string | Buffer): void {
   const bytes = typeof body === 'string' ? Buffer.from(body) : body
-  if (bytes.length <= UPLOAD_CHUNK_BYTES) { res.end(body); return }
-  for (let offset = 0; offset < bytes.length; offset += 64 * 1024) res.write(bytes.subarray(offset, offset + 64 * 1024))
+  writeResponseParts(res, [bytes], bytes.length)
+}
+
+// A body of `length` bytes held in parts, written as writeResponse writes
+// one without first copying them into one buffer.
+export function writeResponseParts(res: ServerResponse, parts: Buffer[], length: number): void {
+  if (length <= UPLOAD_CHUNK_BYTES) { res.end(parts.length === 1 ? parts[0] : Buffer.concat(parts, length)); return }
+  for (const part of parts) {
+    for (let offset = 0; offset < part.length; offset += 64 * 1024) res.write(part.subarray(offset, offset + 64 * 1024))
+  }
   res.end()
 }