pierre-review 0.1.66 → 0.1.67

package/dist/api/routes/auth.js

@@ -1,7 +1,25 @@
 import { randomBytes } from 'node:crypto';
 import { config } from '../../config.js';
 import { encryptToken } from '../../auth/crypto.js';
-import { upsertCloudAccount } from '../../auth/account.js';
+import { getAccessToken, upsertCloudAccount } from '../../auth/account.js';
+// Revoke the OAuth App's grant for a user's token (Basic auth = the app's own id/secret). This
+// forces the NEXT authorize to re-show consent — which is what re-injects the SAML SSO step; a
+// silent re-issue would skip it and re-mint a still-de-authorized token. 404 = already gone.
+async function revokeOAuthGrant(token) {
+    const basic = Buffer.from(`${config.githubOAuthClientId}:${config.githubOAuthClientSecret}`).toString('base64');
+    const res = await fetch(`https://api.github.com/applications/${config.githubOAuthClientId}/grant`, {
+        method: 'DELETE',
+        headers: {
+            authorization: `Basic ${basic}`,
+            accept: 'application/vnd.github+json',
+            'x-github-api-version': '2022-11-28',
+        },
+        body: JSON.stringify({ access_token: token }),
+    });
+    if (!res.ok && res.status !== 404) {
+        throw new Error(`revoke grant -> ${res.status}`);
+    }
+}
 // Per-provider credential + the scope to request (empty for the GitHub App).
 function providerCredentials(provider) {
     return provider === 'app'
@@ -69,6 +87,24 @@ export async function authRoutes(app) {
         }
         return startLogin(defaultProvider, reply);
     });
+    // "Reconnect GitHub" (the SAML-block banner action): revoke this app's grant so the re-auth
+    // shows FRESH consent — forcing the SAML SSO step that a silent re-issue would skip — then
+    // clear our session (so the callback re-runs the code exchange, not the already-signed-in
+    // short-circuit) and start a fresh OAuth login. Best-effort revoke: even if it fails, the
+    // re-login can still succeed if the user's SAML session is active.
+    app.get('/api/auth/reconnect', async (req, reply) => {
+        const accountId = req.session.get('accountId');
+        if (accountId != null) {
+            try {
+                await revokeOAuthGrant(await getAccessToken(accountId));
+            }
+            catch (err) {
+                req.log.warn({ err }, 'reconnect: grant revoke failed, continuing to re-auth');
+            }
+            req.session.delete();
+        }
+        return startLogin('oauth', reply);
+    });
     // Verify state → exchange code for a token (against the state's provider) → fetch the user →
     // upsert account → set session → 302 to the app.
     app.get('/api/auth/callback', async (req, reply) => {

package/dist/api/routes/me.js

@@ -3,6 +3,7 @@ import { accountToLocalUser } from '../../auth/account.js';
 import { accountIdOf } from '../plugins/auth.js';
 import { EMPTY_CAPABILITIES, entitledProCapabilities, } from '../../pro/contract.js';
 import { getFyiProvider } from '../../feed/fyi-provider.js';
+import { getAuthNotices } from '../../sync/auth-notices.js';
 import { dismissMyTurn, getCompletedDismissals, getFeedLastSeenAt, getMyTurn, markFeedSeen, undismissMyTurn, } from '../../db/queries.js';
 const dismissSchema = {
     body: {
@@ -56,6 +57,8 @@ export async function meRoutes(app) {
             // Claude Review is now the Pro `claudeReview` capability (in `pro` below).
             deploymentMode: config.deploymentMode,
             pro: entitled,
+            // Orgs currently SAML-blocked for this account (empty in the normal case + in local).
+            authNotices: getAuthNotices(accountId),
         };
     });
     app.get('/api/my-turn', async (req) => getMyTurn(accountIdOf(req)));

package/dist/github/client.js

@@ -6,7 +6,13 @@ import { getGithubToken } from './auth.js';
 // token access to this organization." This gates PRs/checks even on PUBLIC repos of a SAML org.
 export function isSamlBlock(errors) {
     return (Array.isArray(errors) &&
-        errors.some((e) => /saml enforcement|grant your oauth token access/i.test(e.message ?? '')));
+        errors.some((e) => {
+            // GraphQL exposes a machine-readable flag on the error — the most reliable signal
+            // (docs: FORBIDDEN + extensions.saml_failure === true). Fall back to the message text.
+            if (e.extensions?.saml_failure === true)
+                return true;
+            return /saml enforcement|grant your oauth token access/i.test(e.message ?? '');
+        }));
 }
 // A parenthetical hint appended to a partial-GraphQL log. SAML enforcement gets the actionable
 // re-auth hint; otherwise, ONLY when the forbidden field is a CI-checks field (so a NOT_FOUND —

package/dist/sync/auth-notices.js

@@ -0,0 +1,36 @@
+// Process-local record of orgs whose sync is currently BLOCKED by SAML SSO for an account — the
+// sign-in token authenticates but isn't SSO-authorized for that org (see docs/GITHUB-AUTH-SETUP.md
+// "the SAML wall"). Populated by the sync (recordSamlBlock when a repo's fetch is SAML-forbidden,
+// cleared when any repo of that org next syncs cleanly), read by /api/me to drive the global
+// "Reconnect GitHub" banner.
+//
+// Deliberately IN-MEMORY, not persisted: it's a rare, self-healing state. After a restart it
+// simply repopulates on the next sync tick, and it clears itself once the user re-authorizes and
+// the org reads cleanly again — so a DB column + dual-dialect migration would be overkill. (Cloud
+// runs a single Fastify process, so the sync that writes this and the /api/me that reads it share
+// the same map.) Local mode never watches SAML orgs / never populates this.
+const blockedOrgsByAccount = new Map();
+// Mark `org` (a repo owner login) as SAML-blocked for this account.
+export function recordSamlBlock(accountId, org) {
+    let set = blockedOrgsByAccount.get(accountId);
+    if (!set) {
+        set = new Set();
+        blockedOrgsByAccount.set(accountId, set);
+    }
+    set.add(org);
+}
+// Clear `org` for this account — called when any of its repos syncs cleanly (a SAML block is
+// org-wide, so one clean read proves the token is authorized for the whole org again).
+export function clearSamlBlock(accountId, org) {
+    const set = blockedOrgsByAccount.get(accountId);
+    if (!set)
+        return;
+    if (set.delete(org) && set.size === 0)
+        blockedOrgsByAccount.delete(accountId);
+}
+// The account's current auth notices (one per blocked org), for /api/me.
+export function getAuthNotices(accountId) {
+    const set = blockedOrgsByAccount.get(accountId);
+    return set ? [...set].map((org) => ({ kind: 'saml_sso', org })) : [];
+}
+//# sourceMappingURL=auth-notices.js.map

package/dist/sync/sync-repo.js

@@ -1,7 +1,8 @@
 import { performance } from 'node:perf_hooks';
 import { eq } from 'drizzle-orm';
 import { db, schema } from '../db/client.js';
-import { getGraphqlClientFor, graphqlChecksHint, graphqlTolerant, summarizeGraphqlErrors, } from '../github/client.js';
+import { getGraphqlClientFor, graphqlChecksHint, graphqlTolerant, isSamlBlock, summarizeGraphqlErrors, } from '../github/client.js';
+import { clearSamlBlock, recordSamlBlock } from './auth-notices.js';
 import { REPO_ACTIVITY_QUERY } from '../github/queries.js';
 import { ensureCommitFiles } from './commit-files.js';
 import { createUserResolver, persistPr, upsertRepo } from './upsert.js';
@@ -20,6 +21,9 @@ export async function syncRepo(opts) {
     const log = opts.log ?? consoleLogger;
     const client = getGraphqlClientFor(opts.token);
     const resolver = createUserResolver();
+    // Set if any page's fetch is SAML-forbidden (token not authorized for the owner's org) — the
+    // owner org is then flagged for the "Reconnect GitHub" banner (see sync/auth-notices.ts).
+    let samlBlocked = false;
     let cursor = opts.startCursor ?? null;
     // The `after` value used to fetch the page currently being processed. When we
     // stop at the `since` cutoff mid-page, this (not the page's endCursor) is what a
@@ -66,7 +70,11 @@ export async function syncRepo(opts) {
             // a private repo the token can't reach, or a token minted before its scope covered checks)
             // doesn't abort the whole sync — the PRs, reviews, comments and review REQUESTS still
             // persist; only CI check detail is dropped (the `ciStatus` rollup, when readable, is kept).
-            const resp = await graphqlTolerant(client, REPO_ACTIVITY_QUERY, { owner, name, cursor }, (errors) => log.warn(`sync ${owner}/${name}: partial GraphQL — continuing without forbidden fields${graphqlChecksHint(errors)}. ${summarizeGraphqlErrors(errors)}`));
+            const resp = await graphqlTolerant(client, REPO_ACTIVITY_QUERY, { owner, name, cursor }, (errors) => {
+                if (isSamlBlock(errors))
+                    samlBlocked = true;
+                log.warn(`sync ${owner}/${name}: partial GraphQL — continuing without forbidden fields${graphqlChecksHint(errors)}. ${summarizeGraphqlErrors(errors)}`);
+            });
             graphqlMs += performance.now() - tPage;
             pages += 1;
             // `rateLimit` is a top-level sibling of `repository`, so it survives a partial
@@ -76,10 +84,21 @@ export async function syncRepo(opts) {
             totalCost += resp.rateLimit?.cost ?? 0;
             lastRemaining = resp.rateLimit?.remaining ?? lastRemaining;
             if (!resp.repository) {
+                // A SAML wall forbids the whole `repository` node → flag the owner's org for the
+                // "Reconnect GitHub" banner (an authorization gap the user can self-fix), then fail
+                // this repo's sync as usual.
+                if (samlBlocked)
+                    recordSamlBlock(accountId, owner);
                 const err = new Error(`Repository ${owner}/${name} not found or inaccessible`);
                 err.statusCode = 404;
                 throw err;
             }
+            // Repository read cleanly (no SAML error anywhere in this response) → the token IS
+            // authorized for this owner's org; clear any prior flag so the "Reconnect" banner
+            // self-dismisses on recovery. Guard on !samlBlocked so a partial SAML error can't
+            // erroneously self-dismiss. Idempotent per page.
+            if (!samlBlocked)
+                clearSamlBlock(accountId, owner);
             if (repoId == null) {
                 repoId = await upsertRepo(owner, name, resp.repository.id, resp.repository.defaultBranchRef?.name ?? null, accountId, resp.repository.viewerPermission ?? null);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pierre-review",
-  "version": "0.1.66",
+  "version": "0.1.67",
   "description": "Dashboard for tracking your team's GitHub PR activity across repos — local (SQLite + gh) or self-hosted multi-tenant cloud (Postgres + GitHub App).",
   "type": "module",
   "author": "Alex Wakeman",