pierre-review 0.1.65 → 0.1.67

package/dist/api/routes/auth.js

@@ -1,7 +1,25 @@
 import { randomBytes } from 'node:crypto';
 import { config } from '../../config.js';
 import { encryptToken } from '../../auth/crypto.js';
-import { upsertCloudAccount } from '../../auth/account.js';
+import { getAccessToken, upsertCloudAccount } from '../../auth/account.js';
+// Revoke the OAuth App's grant for a user's token (Basic auth = the app's own id/secret). This
+// forces the NEXT authorize to re-show consent — which is what re-injects the SAML SSO step; a
+// silent re-issue would skip it and re-mint a still-de-authorized token. 404 = already gone.
+async function revokeOAuthGrant(token) {
+    const basic = Buffer.from(`${config.githubOAuthClientId}:${config.githubOAuthClientSecret}`).toString('base64');
+    const res = await fetch(`https://api.github.com/applications/${config.githubOAuthClientId}/grant`, {
+        method: 'DELETE',
+        headers: {
+            authorization: `Basic ${basic}`,
+            accept: 'application/vnd.github+json',
+            'x-github-api-version': '2022-11-28',
+        },
+        body: JSON.stringify({ access_token: token }),
+    });
+    if (!res.ok && res.status !== 404) {
+        throw new Error(`revoke grant -> ${res.status}`);
+    }
+}
 // Per-provider credential + the scope to request (empty for the GitHub App).
 function providerCredentials(provider) {
     return provider === 'app'
@@ -60,8 +78,33 @@ export async function authRoutes(app) {
         const provider = req.params.provider === 'app' ? 'app' : 'oauth';
         return startLogin(provider, reply);
     });
-    // Back-compat bare login (landing/billing CTAs) → the default provider.
-    app.get('/api/auth/login', async (_req, reply) => startLogin(defaultProvider, reply));
+    // Bare login (landing / billing CTAs). When BOTH providers are configured, don't silently
+    // pick one — bounce to the in-app sign-in gate so the user explicitly chooses OAuth App vs
+    // GitHub App. When only one is configured there's no choice to make, so go straight to it.
+    app.get('/api/auth/login', async (_req, reply) => {
+        if (config.oauthProviderEnabled && config.appProviderEnabled) {
+            return reply.redirect('/app');
+        }
+        return startLogin(defaultProvider, reply);
+    });
+    // "Reconnect GitHub" (the SAML-block banner action): revoke this app's grant so the re-auth
+    // shows FRESH consent — forcing the SAML SSO step that a silent re-issue would skip — then
+    // clear our session (so the callback re-runs the code exchange, not the already-signed-in
+    // short-circuit) and start a fresh OAuth login. Best-effort revoke: even if it fails, the
+    // re-login can still succeed if the user's SAML session is active.
+    app.get('/api/auth/reconnect', async (req, reply) => {
+        const accountId = req.session.get('accountId');
+        if (accountId != null) {
+            try {
+                await revokeOAuthGrant(await getAccessToken(accountId));
+            }
+            catch (err) {
+                req.log.warn({ err }, 'reconnect: grant revoke failed, continuing to re-auth');
+            }
+            req.session.delete();
+        }
+        return startLogin('oauth', reply);
+    });
     // Verify state → exchange code for a token (against the state's provider) → fetch the user →
     // upsert account → set session → 302 to the app.
     app.get('/api/auth/callback', async (req, reply) => {

package/dist/api/routes/me.js

@@ -3,6 +3,7 @@ import { accountToLocalUser } from '../../auth/account.js';
 import { accountIdOf } from '../plugins/auth.js';
 import { EMPTY_CAPABILITIES, entitledProCapabilities, } from '../../pro/contract.js';
 import { getFyiProvider } from '../../feed/fyi-provider.js';
+import { getAuthNotices } from '../../sync/auth-notices.js';
 import { dismissMyTurn, getCompletedDismissals, getFeedLastSeenAt, getMyTurn, markFeedSeen, undismissMyTurn, } from '../../db/queries.js';
 const dismissSchema = {
     body: {
@@ -56,6 +57,8 @@ export async function meRoutes(app) {
             // Claude Review is now the Pro `claudeReview` capability (in `pro` below).
             deploymentMode: config.deploymentMode,
             pro: entitled,
+            // Orgs currently SAML-blocked for this account (empty in the normal case + in local).
+            authNotices: getAuthNotices(accountId),
         };
     });
     app.get('/api/my-turn', async (req) => getMyTurn(accountIdOf(req)));

package/dist/github/client.js

@@ -1,11 +1,26 @@
 import { graphql, GraphqlResponseError } from '@octokit/graphql';
 import { getGithubToken } from './auth.js';
-// A parenthetical hint appended to a partial-GraphQL log, ONLY when the forbidden field is
-// actually a CI-checks field — so a NOT_FOUND (deleted/inaccessible PR) isn't mislabelled as a
-// checks-access problem. Empty otherwise (the raw errors still get logged). Cloud sign-in is an
-// OAuth App (needs the `public_repo` scope for checks) and/or a GitHub App (needs installing on
-// the repo's org with "Checks" read); either way public-repo checks read once that's in place.
+// True when the partial errors are GitHub's SAML-SSO wall: the token authenticates but isn't
+// authorized for the repo owner's org, so the whole `repository` node is forbidden. GitHub's
+// message is "Resource protected by organization SAML enforcement. You must grant your OAuth
+// token access to this organization." This gates PRs/checks even on PUBLIC repos of a SAML org.
+export function isSamlBlock(errors) {
+    return (Array.isArray(errors) &&
+        errors.some((e) => {
+            // GraphQL exposes a machine-readable flag on the error — the most reliable signal
+            // (docs: FORBIDDEN + extensions.saml_failure === true). Fall back to the message text.
+            if (e.extensions?.saml_failure === true)
+                return true;
+            return /saml enforcement|grant your oauth token access/i.test(e.message ?? '');
+        }));
+}
+// A parenthetical hint appended to a partial-GraphQL log. SAML enforcement gets the actionable
+// re-auth hint; otherwise, ONLY when the forbidden field is a CI-checks field (so a NOT_FOUND —
+// deleted/inaccessible PR — isn't mislabelled). Empty otherwise (the raw errors still get logged).
 export function graphqlChecksHint(errors) {
+    if (isSamlBlock(errors)) {
+        return " — the sign-in token isn't authorized for this org's SAML SSO; re-authorize it inside an active SAML session for the org (see docs/GITHUB-AUTH-SETUP.md)";
+    }
     const mentionsChecks = Array.isArray(errors) &&
         errors.some((e) => {
             const path = e.path;

package/dist/sync/auth-notices.js

@@ -0,0 +1,36 @@
+// Process-local record of orgs whose sync is currently BLOCKED by SAML SSO for an account — the
+// sign-in token authenticates but isn't SSO-authorized for that org (see docs/GITHUB-AUTH-SETUP.md
+// "the SAML wall"). Populated by the sync (recordSamlBlock when a repo's fetch is SAML-forbidden,
+// cleared when any repo of that org next syncs cleanly), read by /api/me to drive the global
+// "Reconnect GitHub" banner.
+//
+// Deliberately IN-MEMORY, not persisted: it's a rare, self-healing state. After a restart it
+// simply repopulates on the next sync tick, and it clears itself once the user re-authorizes and
+// the org reads cleanly again — so a DB column + dual-dialect migration would be overkill. (Cloud
+// runs a single Fastify process, so the sync that writes this and the /api/me that reads it share
+// the same map.) Local mode never watches SAML orgs / never populates this.
+const blockedOrgsByAccount = new Map();
+// Mark `org` (a repo owner login) as SAML-blocked for this account.
+export function recordSamlBlock(accountId, org) {
+    let set = blockedOrgsByAccount.get(accountId);
+    if (!set) {
+        set = new Set();
+        blockedOrgsByAccount.set(accountId, set);
+    }
+    set.add(org);
+}
+// Clear `org` for this account — called when any of its repos syncs cleanly (a SAML block is
+// org-wide, so one clean read proves the token is authorized for the whole org again).
+export function clearSamlBlock(accountId, org) {
+    const set = blockedOrgsByAccount.get(accountId);
+    if (!set)
+        return;
+    if (set.delete(org) && set.size === 0)
+        blockedOrgsByAccount.delete(accountId);
+}
+// The account's current auth notices (one per blocked org), for /api/me.
+export function getAuthNotices(accountId) {
+    const set = blockedOrgsByAccount.get(accountId);
+    return set ? [...set].map((org) => ({ kind: 'saml_sso', org })) : [];
+}
+//# sourceMappingURL=auth-notices.js.map

package/dist/sync/hydrate-detail.js

@@ -17,7 +17,7 @@ import { eq } from 'drizzle-orm';
 import { db, schema } from '../db/client.js';
 import { config } from '../config.js';
 import { getAccessToken } from '../auth/account.js';
-import { getGraphqlClientFor, graphqlChecksHint, graphqlTolerant, summarizeGraphqlErrors, } from '../github/client.js';
+import { getGraphqlClientFor, graphqlChecksHint, graphqlTolerant, isSamlBlock, summarizeGraphqlErrors, } from '../github/client.js';
 import { PR_DETAIL_QUERY } from '../github/queries.js';
 import { checkRunsFrom } from './upsert.js';
 const { reviews, reviewComments, prComments, reviewThreads, pullRequests, repos } = schema;
@@ -32,26 +32,34 @@ function splitRepoFullName(fullName) {
         return { owner: fullName, name: '' };
     return { owner: fullName.slice(0, slash), name: fullName.slice(slash + 1) };
 }
-// Fetch the single PR's text from GitHub. Returns null on any failure (deleted PR,
-// lost access, network) so callers degrade gracefully to the stored metadata.
+// Fetch the single PR's text from GitHub. `data` is null on any failure (deleted PR, lost
+// access, network) so callers degrade gracefully to the stored metadata. `samlBlocked` is true
+// when the failure was GitHub's SAML-SSO wall — the token isn't authorized for the repo owner's
+// org — which the callers surface to the SPA (it's an authorization gap, not a bug).
 async function fetchGhPrText(owner, name, number, accountId) {
     let resp;
+    let samlBlocked = false;
     try {
         const token = await getAccessToken(accountId);
         const client = getGraphqlClientFor(token);
         // Tolerate partial errors: if the token is FORBIDDEN one sub-field (e.g. `statusCheckRollup`
         // check runs on a private repo it can't reach), that used to throw away the ENTIRE hydration
         // (PR body, comments, diff hunks, commit messages) even though all of those came back fine.
-        // Now we keep them; only the forbidden field (CI checks) stays empty (and we log why).
-        resp = await graphqlTolerant(client, PR_DETAIL_QUERY, { owner, name, number }, (errors) => console.warn(`[hydrate] partial GraphQL for ${owner}/${name}#${number} — continuing with available fields${graphqlChecksHint(errors)}. ${summarizeGraphqlErrors(errors)}`));
+        // Now we keep them; only the forbidden field (CI checks) stays empty (and we log why). A SAML
+        // block forbids the whole `repository` node, so `data` ends up null but we flag it.
+        resp = await graphqlTolerant(client, PR_DETAIL_QUERY, { owner, name, number }, (errors) => {
+            if (isSamlBlock(errors))
+                samlBlocked = true;
+            console.warn(`[hydrate] partial GraphQL for ${owner}/${name}#${number} — continuing with available fields${graphqlChecksHint(errors)}. ${summarizeGraphqlErrors(errors)}`);
+        });
     }
     catch (err) {
         console.error(`[hydrate] PR detail fetch failed for ${owner}/${name}#${number}; returning stored metadata. ${err instanceof Error ? err.message : String(err)}`);
-        return null;
+        return { data: null, samlBlocked: false };
     }
     const pr = resp.repository?.pullRequest;
     if (!pr)
-        return null;
+        return { data: null, samlBlocked };
     const reviewBodyByNode = new Map();
     for (const r of pr.reviews.nodes)
         reviewBodyByNode.set(r.id, r.body);
@@ -68,20 +76,23 @@ async function fetchGhPrText(owner, name, number, accountId) {
     for (const c of pr.commits.nodes)
         commitMessageBySha.set(c.commit.oid, c.commit.message);
     return {
-        prBody: pr.body,
-        checkRuns: checkRunsFrom(pr.headCommit?.nodes[0]?.commit),
-        reviewBodyByNode,
-        reviewCommentByNode,
-        prCommentBodyByNode,
-        commitMessageBySha,
-        additions: pr.additions ?? 0,
-        deletions: pr.deletions ?? 0,
-        changedFiles: pr.changedFiles ?? 0,
-        files: (pr.files?.nodes ?? []).map((f) => ({
-            path: f.path,
-            additions: f.additions ?? 0,
-            deletions: f.deletions ?? 0,
-        })),
+        data: {
+            prBody: pr.body,
+            checkRuns: checkRunsFrom(pr.headCommit?.nodes[0]?.commit),
+            reviewBodyByNode,
+            reviewCommentByNode,
+            prCommentBodyByNode,
+            commitMessageBySha,
+            additions: pr.additions ?? 0,
+            deletions: pr.deletions ?? 0,
+            changedFiles: pr.changedFiles ?? 0,
+            files: (pr.files?.nodes ?? []).map((f) => ({
+                path: f.path,
+                additions: f.additions ?? 0,
+                deletions: f.deletions ?? 0,
+            })),
+        },
+        samlBlocked,
     };
 }
 // localId -> githubNodeId for a set of rows of the given table on this PR.
@@ -102,9 +113,14 @@ export async function hydratePrDetail(detail, accountId) {
     if (config.persistBodies)
         return detail;
     const { owner, name } = splitRepoFullName(detail.repoFullName);
-    const gh = await fetchGhPrText(owner, name, detail.number, accountId);
+    const { data: gh, samlBlocked } = await fetchGhPrText(owner, name, detail.number, accountId);
+    const authNotice = samlBlocked
+        ? { kind: 'saml_sso', org: owner }
+        : null;
+    // Blocked or otherwise unfetchable → keep the stored metadata, but tell the SPA WHY the
+    // description/checks are blank when it was an org authorization wall (so it can guide the fix).
     if (!gh)
-        return detail;
+        return authNotice ? { ...detail, authNotice } : detail;
     const [reviewNodes, reviewCommentNodes, prCommentNodes] = await Promise.all([
         nodeIdMap(reviews, detail.id),
         nodeIdMap(reviewComments, detail.id),
@@ -154,6 +170,7 @@ export async function hydratePrDetail(detail, accountId) {
         deletions: gh.deletions,
         changedFilesCount: gh.changedFiles,
         files: filesOut,
+        authNotice,
     };
 }
 /**
@@ -179,7 +196,7 @@ export async function hydrateThreadDetail(thread, accountId) {
         .execute())[0];
     if (!ctx)
         return thread;
-    const gh = await fetchGhPrText(ctx.owner, ctx.name, ctx.number, accountId);
+    const { data: gh } = await fetchGhPrText(ctx.owner, ctx.name, ctx.number, accountId);
     if (!gh)
         return thread;
     const commentNodes = await nodeIdMap(reviewComments, thread.prId);

package/dist/sync/sync-repo.js

@@ -1,7 +1,8 @@
 import { performance } from 'node:perf_hooks';
 import { eq } from 'drizzle-orm';
 import { db, schema } from '../db/client.js';
-import { getGraphqlClientFor, graphqlChecksHint, graphqlTolerant, summarizeGraphqlErrors, } from '../github/client.js';
+import { getGraphqlClientFor, graphqlChecksHint, graphqlTolerant, isSamlBlock, summarizeGraphqlErrors, } from '../github/client.js';
+import { clearSamlBlock, recordSamlBlock } from './auth-notices.js';
 import { REPO_ACTIVITY_QUERY } from '../github/queries.js';
 import { ensureCommitFiles } from './commit-files.js';
 import { createUserResolver, persistPr, upsertRepo } from './upsert.js';
@@ -20,6 +21,9 @@ export async function syncRepo(opts) {
     const log = opts.log ?? consoleLogger;
     const client = getGraphqlClientFor(opts.token);
     const resolver = createUserResolver();
+    // Set if any page's fetch is SAML-forbidden (token not authorized for the owner's org) — the
+    // owner org is then flagged for the "Reconnect GitHub" banner (see sync/auth-notices.ts).
+    let samlBlocked = false;
     let cursor = opts.startCursor ?? null;
     // The `after` value used to fetch the page currently being processed. When we
     // stop at the `since` cutoff mid-page, this (not the page's endCursor) is what a
@@ -66,7 +70,11 @@ export async function syncRepo(opts) {
             // a private repo the token can't reach, or a token minted before its scope covered checks)
             // doesn't abort the whole sync — the PRs, reviews, comments and review REQUESTS still
             // persist; only CI check detail is dropped (the `ciStatus` rollup, when readable, is kept).
-            const resp = await graphqlTolerant(client, REPO_ACTIVITY_QUERY, { owner, name, cursor }, (errors) => log.warn(`sync ${owner}/${name}: partial GraphQL — continuing without forbidden fields${graphqlChecksHint(errors)}. ${summarizeGraphqlErrors(errors)}`));
+            const resp = await graphqlTolerant(client, REPO_ACTIVITY_QUERY, { owner, name, cursor }, (errors) => {
+                if (isSamlBlock(errors))
+                    samlBlocked = true;
+                log.warn(`sync ${owner}/${name}: partial GraphQL — continuing without forbidden fields${graphqlChecksHint(errors)}. ${summarizeGraphqlErrors(errors)}`);
+            });
             graphqlMs += performance.now() - tPage;
             pages += 1;
             // `rateLimit` is a top-level sibling of `repository`, so it survives a partial
@@ -76,10 +84,21 @@ export async function syncRepo(opts) {
             totalCost += resp.rateLimit?.cost ?? 0;
             lastRemaining = resp.rateLimit?.remaining ?? lastRemaining;
             if (!resp.repository) {
+                // A SAML wall forbids the whole `repository` node → flag the owner's org for the
+                // "Reconnect GitHub" banner (an authorization gap the user can self-fix), then fail
+                // this repo's sync as usual.
+                if (samlBlocked)
+                    recordSamlBlock(accountId, owner);
                 const err = new Error(`Repository ${owner}/${name} not found or inaccessible`);
                 err.statusCode = 404;
                 throw err;
             }
+            // Repository read cleanly (no SAML error anywhere in this response) → the token IS
+            // authorized for this owner's org; clear any prior flag so the "Reconnect" banner
+            // self-dismisses on recovery. Guard on !samlBlocked so a partial SAML error can't
+            // erroneously self-dismiss. Idempotent per page.
+            if (!samlBlocked)
+                clearSamlBlock(accountId, owner);
             if (repoId == null) {
                 repoId = await upsertRepo(owner, name, resp.repository.id, resp.repository.defaultBranchRef?.name ?? null, accountId, resp.repository.viewerPermission ?? null);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pierre-review",
-  "version": "0.1.65",
+  "version": "0.1.67",
   "description": "Dashboard for tracking your team's GitHub PR activity across repos — local (SQLite + gh) or self-hosted multi-tenant cloud (Postgres + GitHub App).",
   "type": "module",
   "author": "Alex Wakeman",