Repository navigation
feat: GitHub App connect, follows, webhooks and reconcile - #115
Merged
Merged
Conversation
- internal/github: app JWT, installation tokens, OAuth, REST, webhook parsing - internal/githubsync: account-bound OAuth, sealed tokens, follow access rules, delivery dedupe, coalesced refresh intent, reconcile and resync - schema 12 integration tables; session-only management routes - DIFFX_SERVER_GITHUB_* config, all-or-nothing, secrets env-only
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stack 2/4: GitHub App connect, follows, webhooks and reconcile.
internal/github(wire adapter: app JWT, installation tokens, OAuth web flow, REST, webhook HMAC/payloads) andinternal/githubsync(rules: per-account connect, sealed user tokens, follows, delivery dedupe, coalesced refresh intent, startup reconcile and Resync).reviewstorepersists it;remoteservercomposes routes.DIFFX_SERVER_GITHUB_*is set (partial config fails startup listing missing vars; secrets env-only). Webhook is public and HMAC-authenticated; OAuth callback runs before SameOrigin and is bound to the starting account's session; management routes need a browser session + CSRF. Access = GitHub user ∩ installation, rechecked on list/follow/resync and lazily after 8h before delivery.mise run checkpasses. Service tests on the real store with a fake GitHub (dedupe mutation-checked). Real binary: forged webhook 401, signed 202, redelivery recorded once; anonymous 401, no CSRF 403. Not yet run against real GitHub.docs/architecture.md;docs/system.md"GitHub pull requests". Added Disconnect route.