[alliscode]

Why

GitHub sign-in proves who a user is, but it should not make repository permissions Hub's hard-coded authority. Teams need an explicit way to synchronize qualifying GitHub access while keeping Hub administrators in control and preserving the current repository-based behavior only as an opt-in compatibility mode.

What changes

Hub now stores linked GitHub repositories by immutable repository ID and records synchronized user baselines separately from manual Hub grants and denies. Admission and prototype synchronization are both explicit choices. The earlier repository-scanning behavior remains available as a compatibility mode rather than the default.

Effective prototype access follows one order: explicit Hub deny, explicit prototype or workspace role, a fresh GitHub-synchronized baseline, then no access. Decision explanations identify the source and include the confirmed repository permission when GitHub supplies the baseline. Synchronization never rewrites manual Hub overrides.

Verified GitHub App webhooks mark repository state dirty or removed, while manual and periodic reconciliation use the separately configured installation credentials to confirm current metadata and permissions. Generation checks prevent stale in-flight reconciliation from resurrecting removed access or replacing newer results. During an outage, Hub can use a bounded last-known-good baseline only for the same repository whose live check failed; stale access eventually fails closed.

Artifact ingestion and production OIDC remain separate later layers.

[Copilot]

🟡 Changes recommended

Unresolved critical authorization flaws can reactivate suspended memberships, grant access through the wrong repository, and leave sessions usable after repository deletion.

15 open issues

• Prevent GitHub sign-in from reactivating suspended memberships · New
• Use the active transaction client for baseline lookups · New
• Reject stale sign-in grants after newer permission loss · New
• Preserve legacy admissions during linked-repository reconciliation · New
• Enforce administrator continuity during synchronized membership removal · New
• Serialize membership revocation with sign-in and administration · New
• Resolve linked repositories by immutable GitHub repository ID · New
• Revoke synchronized state immediately for deleted repositories · New
• Preserve and normalize GitHub collaborator role names · New
• Record credential and configuration failures during reconciliation · New
• Bound GitHub reconciliation concurrency and transaction work · New
• Isolate identity mismatches during repository reconciliation · New
• Preserve admissionEnabled when relinking existing sources · New
• Avoid baseline lookup when Hub rules already decide access · New
• Bound catalog scans for members without workspace access · New

What changed in this PR

Adds opt-in GitHub authorization synchronization to Hub’s existing sign-in and prototype-access system, storing repository baselines separately from manual Hub grants and denies.

Changes:

• Adds persistent repository sources, synchronized permissions, webhook deliveries, and audit provenance.
• Connects admission and prototype policies to verified webhooks and manual or periodic reconciliation.
• Adds administration APIs, authorization tests, configuration examples, and operating documentation.

File	Description
hub/​server/​routes/​types.ts	Adds the GitHub authorization route dependency.
hub/​server/​routes/​product/​index.ts	Adds the prototype authorization-policy handler.
hub/​server/​routes/​index.ts	Registers repository, webhook, and policy endpoints.
hub/​server/​routes/​github-authorization/​index.ts	Implements repository administration and webhook handlers.
hub/​server/​routes/​github-authorization/​index.test.ts	Covers session forwarding, CSRF, and webhook responses.
hub/​server/​repositories/​security-audits/​types.ts	Adds repository-source audit references.
hub/​server/​repositories/​security-audits/​save-audit/​index.ts	Persists repository-source audit references.
hub/​server/​integrations/​github/​check-repository-admission/​constants.ts	Expands GitHub repository response schemas.
hub/​server/​index.ts	Schedules periodic reconciliation.
hub/​server/​domains/​prototype-authorization/​evaluate-access/​types.ts	Defines synchronized baseline decision details.
hub/​server/​domains/​prototype-authorization/​evaluate-access/​index.ts	Includes GitHub baseline provenance in decisions.
hub/​server/​domains/​prototype-authorization/​evaluate-access/​index.test.ts	Tests baseline precedence and explanations.
hub/​server/​domains/​prototype-authorization/​create-service/​types.ts	Extends policy mutation and baseline contracts.
hub/​server/​domains/​prototype-authorization/​create-service/​index.ts	Integrates baselines, discovery, and policy changes.
hub/​server/​domains/​prototype-authorization/​create-service/​index.db.test.ts	Updates baseline fixtures and listing assertions.
hub/​server/​domains/​github-authorization/​map-permission/​index.ts	Maps GitHub permissions to Hub baseline roles.
hub/​server/​domains/​github-authorization/​map-permission/​index.test.ts	Tests permission mapping and denial.
hub/​server/​domains/​github-authorization/​create-service/​types.ts	Defines synchronization service contracts.
hub/​server/​domains/​github-authorization/​create-service/​index.ts	Implements admission, reconciliation, webhooks, and repository lifecycle.
hub/​server/​domains/​github-authorization/​create-service/​index.db.test.ts	Covers synchronization, isolation, races, outages, and rollback.
hub/​server/​domains/​authentication/​create-service/​types.ts	Extends admission policies with baseline persistence.
hub/​server/​domains/​authentication/​create-service/​membership.test.ts	Updates the no-admission fixture.
hub/​server/​domains/​authentication/​create-service/​index.db.test.ts	Updates the legacy admission fixture.
hub/​server/​domains/​authentication/​create-runtime/​index.ts	Wires synchronization into authentication and prototype access.
hub/​server/​domains/​authentication/​create-admission-policy/​index.ts	Adds the opt-in synchronized admission mode.
hub/​server/​domains/​authentication/​complete-github-authorization/​index.ts	Applies admission results and saves baselines during sign-in.
hub/​server/​domains/​administration/​create-service/​index.ts	Updates the internal no-admission dependency.
hub/​server/​create-app/​index.ts	Preserves raw webhook bodies and omits payload logging.
hub/​schema/​user.prisma	Relates users to synchronized access.
hub/​schema/​security-audit.prisma	Adds repository-source audit relations.
hub/​schema/​prototype.prisma	Stores prototype authorization mode and source.
hub/​schema/​migrations/​20261027230000_github_synchronized_authorization/​migration.sql	Creates synchronization tables, constraints, indexes, and relations.
hub/​schema/​github-webhook-delivery.prisma	Models webhook delivery deduplication.
hub/​schema/​github-synchronized-access.prisma	Models per-user repository baselines.
hub/​schema/​github-repository-source.prisma	Models linked repositories and synchronization state.
hub/​schema/​github-authorization-policy.prisma	Models the last-known-good duration.
hub/​README.md	Updates the implemented-feature overview.
hub/​docs/​testing-and-operations.md	Describes synchronization coverage and operations.
hub/​docs/​README.md	Adds the integration guide to the index.
hub/​docs/​prototype-authorization.md	Documents baseline precedence and lifecycle.
hub/​docs/​membership-and-administration.md	Documents synchronized membership and administration endpoints.
hub/​docs/​identity.md	Explains admission modes and credential separation.
hub/​docs/​github-integration.md	Documents repository synchronization and outage behavior.
hub/​docs/​database.md	Describes synchronization records and persistence boundaries.
hub/​docs/​architecture.md	Updates system capabilities and runtime composition.
hub/​.env.example	Documents admission modes and the webhook secret.

_{Review effort: Max (auto)}

[Copilot]

🟡 Changes recommended

Critical authorization flaws permit access through disproved, expired, or installation-mismatched grants, while migration defects can break compatibility sign-in and remove existing memberships and sessions.

11 open issues

• Allow and backfill legacy-synchronized memberships · New
• Skip only superseded user updates during reconciliation · New
• Match both configured IDs in cached token fallback · New
• Persist negative confirmations to invalidate cached grants · New
• Enforce admission freshness during session validation · New
• Prevent overlapping scheduled reconciliations · New
• Check Hub invitations before applying GitHub baseline · New
• Preserve manual admission on source credential failures · New
• Do not require fresh verification for repository listing · New
• Mark all installation sources dirty only without repository IDs · New
• Allow reads for workspaces accessible through prototypes · New

15 resolved since last review

• Revoke synchronized state immediately for deleted repositories
• Resolve linked repositories by immutable GitHub repository ID
• Serialize membership revocation with sign-in and administration
• Enforce administrator continuity during synchronized membership removal
• Preserve legacy admissions during linked-repository reconciliation
• Reject stale sign-in grants after newer permission loss
• Use the active transaction client for baseline lookups
• Prevent GitHub sign-in from reactivating suspended memberships
• Bound catalog scans for members without workspace access
• Avoid baseline lookup when Hub rules already decide access
• Preserve admissionEnabled when relinking existing sources
• Isolate identity mismatches during repository reconciliation
• Bound GitHub reconciliation concurrency and transaction work
• Record credential and configuration failures during reconciliation
• Preserve and normalize GitHub collaborator role names

_{Review effort: Max (auto)}

[Copilot]

🟡 Changes recommended

Critical authorization-baseline flaws can preserve disproved repository grants through outages and restore revoked access when overlapping sign-ins complete out of order.

7 open issues

• Invalidate baselines after repository 404 · New
• Order permission requests before saving baselines · New
• Allow valid Hub invitations during source outages · New
• Translate GitHub link failures into stable Hub errors · New
• Compare signature byte lengths before timing-safe comparison · New
• Ignore initial ping before installation validation · New
• Preserve suspended links and resume on unsuspend · New

11 resolved since last review

• Prevent overlapping scheduled reconciliations
• Enforce admission freshness during session validation
• Persist negative confirmations to invalidate cached grants
• Match both configured IDs in cached token fallback
• Skip only superseded user updates during reconciliation
• Allow and backfill legacy-synchronized memberships
• Allow reads for workspaces accessible through prototypes
• Mark all installation sources dirty only without repository IDs
• Do not require fresh verification for repository listing
• Preserve manual admission on source credential failures
• Check Hub invitations before applying GitHub baseline

_{Review effort: Max (auto)}

[Copilot]

🟡 Changes recommended

Public repositories with admission enabled can admit any GitHub user, while shared generation tracking allows concurrent sign-ins to invalidate reconciliation scans and delay unrelated permission revocations.

5 open issues

• Prevent public repositories from granting universal admission · New
• Separate repository-wide invalidation from per-user ordering · New
• Retain claimed generation for outage fallback baselines · New
• Allow unlinking suspended repository sources · New
• Add endpoint tests for authorization policy mutations · New

7 resolved since last review

• Order permission requests before saving baselines
• Invalidate baselines after repository 404
• Preserve suspended links and resume on unsuspend
• Ignore initial ping before installation validation
• Compare signature byte lengths before timing-safe comparison
• Translate GitHub link failures into stable Hub errors
• Allow valid Hub invitations during source outages

_{Review effort: Max (auto)}

[Copilot]

🟡 Changes recommended

Critical authorization races can grant access through a replacement repository and restore revoked memberships after reconciliation.

9 open issues

• Order reconciliation and sign-in admission requests per user · New
• Validate source generation before claiming repository metadata · New
• Ignore baseline conflicts for independently admitted members · New
• Preserve fresh manual reconciliation results after long scans · New
• Distinguish provider failures from apply failures · New
• Avoid redundant prototype authorization queries · New
• Process suspended links during deletion and removal webhooks · New
• Batch membership enforcement during source removal · New
• Audit manual membership preservation during product grants · New

5 resolved since last review

• Separate repository-wide invalidation from per-user ordering
• Prevent public repositories from granting universal admission
• Add endpoint tests for authorization policy mutations
• Allow unlinking suspended repository sources
• Retain claimed generation for outage fallback baselines

_{Review effort: Max (auto)}

[Copilot]

🟡 Changes recommended

Reconciliation’s scan-wide timestamp can cause newer permission denials to be discarded, retaining disproved grants and dependent sessions despite confirmed permission loss.

6 open issues

• Propagate saved membership to preserve baseline conflict handling · New
• Filter fresh baselines before sweeping synchronized memberships · New
• Use database transactions instead of the global identity lock · New
• Return authorization conflict when source generation changes · New
• Preserve successful confirmations when one permission request fails · New
• Log per-source reconciliation failures before continuing · New

9 resolved since last review

• Validate source generation before claiming repository metadata
• Order reconciliation and sign-in admission requests per user
• Audit manual membership preservation during product grants
• Batch membership enforcement during source removal
• Process suspended links during deletion and removal webhooks
• Avoid redundant prototype authorization queries
• Distinguish provider failures from apply failures
• Preserve fresh manual reconciliation results after long scans
• Ignore baseline conflicts for independently admitted members

_{Review effort: Max (auto)}

[Copilot]

🟡 Changes recommended

Unresolved critical authorization flaws can preserve or restore revoked GitHub access through stale-cache fallbacks, reconciliation races, and webhook revocation blocked by unusable credentials.

10 open issues

• Revalidate cached fallback before issuing a session · New
• Track per-permission confirmation times · New
• Prevent cached admission after installation removal · New
• Allow revocation without decryptable source credentials · New
• Audit failed admission-policy evaluations · New
• Reduce permission requests for inactive identities · New
• Bound identity apply transactions during reconciliation · New
• Log permission synchronization partial failures · New
• Retry reconciliation after repository-less membership changes · New
• Expose policy fields in prototype responses · New

6 resolved since last review

• Propagate saved membership to preserve baseline conflict handling
• Log per-source reconciliation failures before continuing
• Preserve successful confirmations when one permission request fails
• Return authorization conflict when source generation changes
• Use database transactions instead of the global identity lock
• Filter fresh baselines before sweeping synchronized memberships

_{Review effort: Max (auto)}

[Copilot]

🟡 Changes recommended

Critical authorization flaws can revoke valid access through stale events and reconciliation races while leaving cached access active after confirmed installation loss.

8 open issues

• Resolve renamed GitHub accounts by immutable subject · New
• Invalidate all sources after installation token loss · New
• Lock repository rows before comparing source generations · New
• Filter repository queries by signed installation ID · New
• Keep retry guards active while draining scan batches · New
• Commit reconciliation audits with baseline changes · New
• Handle team and organization revocation events · New
• Preserve scan progress across pending dirty events · New

10 resolved since last review

• Allow revocation without decryptable source credentials
• Prevent cached admission after installation removal
• Track per-permission confirmation times
• Revalidate cached fallback before issuing a session
• Expose policy fields in prototype responses
• Retry reconciliation after repository-less membership changes
• Log permission synchronization partial failures
• Bound identity apply transactions during reconciliation
• Reduce permission requests for inactive identities
• Audit failed admission-policy evaluations

_{Review effort: Max (auto)}

[nshki]

Similar to my review for #147, if you could run some self-review rounds with your agent using our repo conventions, that would be great. There are similar violations to #147 in this layer.