feat(hub): establish provider-neutral identity persistence by Copilot · Pull Request #118 · github/replica

Copilot · 2026-10-26T20:06:30Z

Why

Hub needs a durable identity foundation that does not make one sign-in provider or GitHub integration the definition of a user. This layer gives later authentication and authorization work stable records while keeping provider-specific behavior outside the core identity model. Refs #116.

What changes

Hub now persists users, external identities, installation membership, versioned authentication-provider configuration, sessions, one-use authorization attempts, and security audit records. Repository and domain interfaces keep those records provider-neutral and support transactional updates under a shared store lock.

GitHub source access remains a separate optional integration. Operators can use encrypted database credentials or complete read-only environment settings without coupling GitHub credentials to user identity or session context.

flowchart LR
  Provider[Authentication provider] --> External[External identity]
  External --> User[Hub user]
  User --> Membership[Installation membership]
  External --> Session[Session]
  Provider --> Session
  GitHub[Optional GitHub integration] --> Source[Source access]
  Source -. separate boundary .-> User

The change also retains automatic redacted request logging from the current Hub baseline. It adds persistence only: there are no sign-in routes, product authorization rules, membership synchronization, or UI changes in this layer.

Copilot

Copilot was unable to review this pull request because there is no eligible user to bill.

An enterprise owner can allow the organization to be billed for reviews like this by enabling Copilot code review for users without a license.

Add encrypted database and read-only environment credential providers for one GitHub installation, transactional identity repositories, and their storage contracts. Co-authored-by: Ben Thomas <ben.thomas@microsoft.com> Co-authored-by: Nishiki <hello@nshki.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

🟡 Changes recommended

The read interface exposes mutations outside locked transactions, allowing callers to bypass serialization and leave partial updates when an operation fails.

6 open issues

_{Review effort: Max}

+
+export function createIdentityStore(client: PrismaClient): IdentityStore {
+  return {
+    read: createIdentityRecords(client),


+      store.lock(async (records) => {
+        await records.saveGitHubIntegrationCredentials("replacement-encrypted-fixture")
+        await records.advanceGitHubIntegrationGeneration()
+        await records.deleteSessions()


+    const { store } = await database()
+    await store.lock(() => Promise.resolve())
+    let entered!: () => void
+    let release!: () => void
+    const started = new Promise<void>((resolve) => {
+      entered = resolve
+    })
+    const gate = new Promise<void>((resolve) => {
+      release = resolve
+    })
+    const first = store.lock(async (records) => {
+      await records.advanceGitHubIntegrationGeneration()
+      entered()
+      await gate
+    })
+    await started
+    const second = store.lock(async (records) => {
+      const state = await records.githubIntegrationState()
+      await records.advanceGitHubIntegrationGeneration()
+      return state.generation
+    })
+    release()


+  try {
+    const data = Buffer.from(encryptedCredentials, "base64")
+    const decipher = createDecipheriv("aes-256-gcm", key, data.subarray(0, 12))
+    decipher.setAAD(credentialContext)
+    decipher.setAuthTag(data.subarray(12, 28))
+    const plaintext = Buffer.concat([decipher.update(data.subarray(28)), decipher.final()])
+    return validateGitHubCredentials(JSON.parse(plaintext.toString("utf8")))
+  } catch {
+    throw new Error("Cannot decrypt GitHub App credentials. Restore the configured encryption key.")
+  }


@@ -0,0 +1,34 @@
+# Hub identity
+
+Hub persists a provider-neutral identity foundation. User authentication proves an external identity. Hub installation membership decides whether that user belongs to this Hub and whether they are an administrator. Later authorization work will let Hub own prototype access independently of repository permissions.


+- `AuthenticationProvider` and its versioned revisions store provider-neutral authentication configuration. An OIDC-only configuration does not require GitHub source-integration credentials.
+- `Session` records the Hub user, external identity, and authentication-provider revision that established it. GitHub source-integration credential rotation does not change session identity context.
+- `AuthorizationAttempt` stores digested state and browser bindings, a PKCE verifier, an optional OIDC nonce, provider revision, purpose, optional originating session, and expiry. Consumption deletes the record in the same transaction so concurrent callbacks cannot reuse it.
+- `SecurityAudit` stores the event and minimal optional identity context. Audit records do not create the future prototype authorization model.


nshki · 2026-10-28T23:12:13Z

Nit: the added documentation here has AI writing artifacts like a bunch of hyphenated phrases. Could be worth running it all through the repo's documentation conventions to see if that produces clearer and more concise writing.

nshki · 2026-10-29T00:13:09Z


 Tests must release resources they create, such as servers, files, sockets, and event listeners. Use `try/finally` or register disposal with Vitest's `onTestFinished` when creating the resource. Clearing the module cache only affects subsequent imports. Reset any deliberately shared fixture state before each case.

+Keep shared server test helpers under the owning function's `test/` directory. TypeScript checks them, but the API build excludes them.


Suggested change

Keep shared server test helpers under the owning function's `test/` directory. TypeScript checks them, but the API build excludes them.

Keep project-wide test helpers in the appropriate `test/` directory and function-specific helpers beside their owning function. TypeScript checks both, but the API build excludes them.

For better clarity.

nshki · 2026-10-29T00:13:58Z

+  @@map("authentication_providers")
+}
+
+model AuthenticationProviderRevision {


We should break individual model definitions into their own files so we don't overload any one Prisma file.

nshki · 2026-10-29T00:20:42Z

Just by the model name alone, it's unclear as to what this is. We should consider renaming to something like GitHubAppInstallation to make it clearer what this is.

nshki · 2026-10-29T00:22:14Z

+  id String @id @db.Uuid
+
+  // Attribute columns
+  generation           Int     @default(0)


generation is currently an incremental counter that seems to only get bumped in tests. If there is a way to refactor it out completely, that would be ideal since there is no production use case for this column.

Copilot AI requested review from a team and nshki as code owners October 26, 2026 20:06

Copilot AI max review requested due to automatic review settings October 26, 2026 20:06

Copilot AI reviewed Oct 26, 2026

Copilot AI changed the title ~~feat(hub): add GitHub identity and credential providers~~ feat(hub): persist identity records and credentials Oct 26, 2026

Copilot AI force-pushed the copilot/hub-identity-system branch from 4924f22 to 0473854 Compare October 26, 2026 23:31

Copilot AI mentioned this pull request Oct 26, 2026

feat(hub): add GitHub user authentication #120

Open

Copilot AI added this pull request to stack #122 October 26, 2026 23:31

Ben Thomas and others added 4 commits October 27, 2026 11:51

merge: reconcile latest Hub baseline

41943d5

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

feat(hub): establish provider-neutral identity persistence

8762ec5

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

fix(hub): harden authentication state handling

9e734c9

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

fix(hub): evaluate attempt expiry after lock

d6a6ebf

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

alliscode changed the title ~~feat(hub): persist identity records and credentials~~ feat(hub): establish provider-neutral identity persistence Oct 28, 2026

alliscode requested a max review from Copilot October 28, 2026 21:42

Copilot started reviewing on behalf of alliscode October 28, 2026 21:42

View session

Copilot AI reviewed Oct 28, 2026

View reviewed changes

nshki requested changes Oct 29, 2026

View reviewed changes

Navigation Menu

Repository navigation

feat(hub): establish provider-neutral identity persistence - #118

feat(hub): establish provider-neutral identity persistence#118
Copilot wants to merge 5 commits into
build/hub/newfrom
copilot/hub-identity-system

Copilot AI commented Oct 26, 2026 •

edited by alliscode

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

nshki Oct 28, 2026

Uh oh!

nshki Oct 29, 2026

Uh oh!

nshki Oct 29, 2026

Uh oh!

nshki Oct 29, 2026

Uh oh!

nshki Oct 29, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		@@ -0,0 +1,34 @@
		# Hub identity

		Hub persists a provider-neutral identity foundation. User authentication proves an external identity. Hub installation membership decides whether that user belongs to this Hub and whether they are an administrator. Later authorization work will let Hub own prototype access independently of repository permissions.


		Tests must release resources they create, such as servers, files, sockets, and event listeners. Use `try/finally` or register disposal with Vitest's `onTestFinished` when creating the resource. Clearing the module cache only affects subsequent imports. Reset any deliberately shared fixture state before each case.

		Keep shared server test helpers under the owning function's `test/` directory. TypeScript checks them, but the API build excludes them.

	Keep shared server test helpers under the owning function's `test/` directory. TypeScript checks them, but the API build excludes them.
	Keep project-wide test helpers in the appropriate `test/` directory and function-specific helpers beside their owning function. TypeScript checks both, but the API build excludes them.

Conversation

Copilot AI commented Oct 26, 2026 • edited by alliscode Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

nshki Oct 28, 2026

Choose a reason for hiding this comment

Uh oh!

nshki Oct 29, 2026

Choose a reason for hiding this comment

Uh oh!

nshki Oct 29, 2026

Choose a reason for hiding this comment

Uh oh!

nshki Oct 29, 2026

Choose a reason for hiding this comment

Uh oh!

nshki Oct 29, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Oct 26, 2026 •

edited by alliscode

Loading