Merge pull request #349 from mean-weasel/codex/installation-deletion-safeguard

Add installation deletion safeguards

Author: neonwatty

src/index.ts

@@ -2,7 +2,9 @@ import { Hono } from 'hono';
 import { logger } from 'hono/logger';
 import type { Env } from './types';
 import api from './routes/api';
+import githubWebhook from './routes/github-webhook';
 import { createBoardDogfoodToken } from './lib/boardDogfood';
+import { sweepInstallationRecords } from './lib/installation-retention';
 
 const app = new Hono<{ Bindings: Env }>();
 
@@ -45,6 +47,7 @@ app.use('*', logger());
 
 // Mount API routes
 app.route('/api', api);
+app.route('/api', githubWebhook);
 
 export function isWeakAuthTokenSecret(secret?: string): boolean {
   return typeof secret === 'string' && secret.length > 0 && secret.length < 32;
@@ -141,4 +144,15 @@ function serveAsset(c: { env: Env; req: { raw: Request } }, pathname: string): P
   return c.env.ASSETS.fetch(new Request(url, c.req.raw));
 }
 
-export default app;
+export async function scheduled(
+  _controller: ScheduledController,
+  env: Env,
+  _ctx: ExecutionContext
+): Promise<void> {
+  await sweepInstallationRecords(env);
+}
+
+export default {
+  fetch: app.fetch,
+  scheduled,
+};

src/lib/github.ts

@@ -1,7 +1,7 @@
 import { generateGitHubAppJWT } from './jwt';
 import type { Env, FeedbackAttachment, GitHubIssue } from '../types';
 
-const GITHUB_API = 'https://api.github.com';
+export const GITHUB_API = 'https://api.github.com';
 
 /**
  * Thrown when GitHub rejects an issue creation specifically due to invalid
@@ -18,7 +18,7 @@ export class GitHubLabelError extends Error {
   }
 }
 
-const headers = (token: string) => ({
+export const githubHeaders = (token: string) => ({
   Authorization: `Bearer ${token}`,
   Accept: 'application/vnd.github+json',
   'Content-Type': 'application/json',
@@ -38,7 +38,7 @@ async function getInstallationId(env: Env, owner: string, repo: string): Promise
   const jwt = await generateGitHubAppJWT(env.GITHUB_APP_ID, env.GITHUB_PRIVATE_KEY);
 
   const response = await fetch(`${GITHUB_API}/repos/${owner}/${repo}/installation`, {
-    headers: headers(jwt),
+    headers: githubHeaders(jwt),
   });
 
   if (!response.ok) {
@@ -65,7 +65,7 @@ export async function getInstallationToken(
 
   const response = await fetch(`${GITHUB_API}/app/installations/${installationId}/access_tokens`, {
     method: 'POST',
-    headers: headers(jwt),
+    headers: githubHeaders(jwt),
   });
 
   if (!response.ok) {
@@ -90,7 +90,7 @@ export async function createIssue(
 ): Promise<GitHubIssue> {
   const response = await fetch(`${GITHUB_API}/repos/${owner}/${repo}/issues`, {
     method: 'POST',
-    headers: headers(token),
+    headers: githubHeaders(token),
     body: JSON.stringify({ title, body, labels }),
   });
 
@@ -128,7 +128,7 @@ function isLabelValidationFailure(body: string): boolean {
 export async function isRepoPublic(token: string, owner: string, repo: string): Promise<boolean> {
   try {
     const response = await fetch(`${GITHUB_API}/repos/${owner}/${repo}`, {
-      headers: headers(token),
+      headers: githubHeaders(token),
     });
 
     if (!response.ok) {
@@ -151,7 +151,7 @@ async function ensureScreenshotBranch(token: string, owner: string, repo: string
   // Check if branch already exists
   const check = await fetch(
     `${GITHUB_API}/repos/${owner}/${repo}/git/ref/heads/${SCREENSHOT_BRANCH}`,
-    { headers: headers(token) }
+    { headers: githubHeaders(token) }
   );
   if (check.ok) return;
   if (check.status !== 404) {
@@ -160,7 +160,7 @@ async function ensureScreenshotBranch(token: string, owner: string, repo: string
 
   // Get default branch SHA
   const repoRes = await fetch(`${GITHUB_API}/repos/${owner}/${repo}`, {
-    headers: headers(token),
+    headers: githubHeaders(token),
   });
   if (!repoRes.ok) {
     throw new Error(`Failed to get repo info: ${repoRes.status}`);
@@ -169,7 +169,7 @@ async function ensureScreenshotBranch(token: string, owner: string, repo: string
 
   const refRes = await fetch(
     `${GITHUB_API}/repos/${owner}/${repo}/git/ref/heads/${repoData.default_branch}`,
-    { headers: headers(token) }
+    { headers: githubHeaders(token) }
   );
   if (!refRes.ok) {
     throw new Error(`Failed to get default branch ref: ${refRes.status}`);
@@ -179,7 +179,7 @@ async function ensureScreenshotBranch(token: string, owner: string, repo: string
   // Create the screenshot branch
   const createRes = await fetch(`${GITHUB_API}/repos/${owner}/${repo}/git/refs`, {
     method: 'POST',
-    headers: headers(token),
+    headers: githubHeaders(token),
     body: JSON.stringify({
       ref: `refs/heads/${SCREENSHOT_BRANCH}`,
       sha: refData.object.sha,
@@ -190,7 +190,7 @@ async function ensureScreenshotBranch(token: string, owner: string, repo: string
     if (createRes.status === 422 && isExistingReferenceError(error)) {
       const recheck = await fetch(
         `${GITHUB_API}/repos/${owner}/${repo}/git/ref/heads/${SCREENSHOT_BRANCH}`,
-        { headers: headers(token) }
+        { headers: githubHeaders(token) }
       );
       if (recheck.ok) return;
     }
@@ -271,7 +271,7 @@ async function uploadBase64Asset(
 
   const response = await fetch(`${GITHUB_API}/repos/${owner}/${repo}/contents/${filename}`, {
     method: 'PUT',
-    headers: headers(token),
+    headers: githubHeaders(token),
     body: JSON.stringify({
       message,
       content: content,

src/lib/installation-cleanup-state.ts

@@ -0,0 +1,127 @@
+export interface InstallationCleanupAudit {
+  schemaVersion: 1;
+  completedAt: string;
+  scannedCount: number;
+  activeCount: number;
+  deletedCount: number;
+}
+
+interface InstallationScanningCheckpoint {
+  schemaVersion: 1;
+  phase: 'scanning';
+  cursor: string;
+  startedAt: string;
+  scannedCount: number;
+  deletedCount: number;
+}
+
+interface InstallationFinalizingCheckpoint {
+  schemaVersion: 1;
+  phase: 'finalizing';
+  audit: InstallationCleanupAudit;
+}
+
+export type InstallationStableCheckpoint =
+  InstallationScanningCheckpoint | InstallationFinalizingCheckpoint;
+
+export interface InstallationDeletingCheckpoint {
+  schemaVersion: 1;
+  phase: 'deleting';
+  installationIds: number[];
+  next: InstallationStableCheckpoint;
+}
+
+export type InstallationCleanupCheckpoint =
+  InstallationStableCheckpoint | InstallationDeletingCheckpoint;
+
+export function parseInstallationCleanupCheckpoint(
+  value: string | null
+): InstallationCleanupCheckpoint | null {
+  if (!value) return null;
+  try {
+    const parsed = JSON.parse(value) as Record<string, unknown>;
+    if (parsed.schemaVersion !== 1) throw new Error('invalid schema');
+
+    const stableCheckpoint = parseStableCheckpoint(parsed);
+    if (stableCheckpoint) return stableCheckpoint;
+
+    if (
+      parsed.phase === 'deleting' &&
+      Array.isArray(parsed.installationIds) &&
+      parsed.installationIds.length > 0 &&
+      parsed.installationIds.every(isInstallationId) &&
+      parsed.next &&
+      typeof parsed.next === 'object'
+    ) {
+      const next = parseStableCheckpoint(parsed.next as Record<string, unknown>);
+      if (next) {
+        return {
+          schemaVersion: 1,
+          phase: 'deleting',
+          installationIds: parsed.installationIds,
+          next,
+        };
+      }
+    }
+
+    throw new Error('invalid checkpoint fields');
+  } catch {
+    throw new Error('Malformed installation cleanup checkpoint');
+  }
+}
+
+function parseStableCheckpoint(
+  parsed: Record<string, unknown>
+): InstallationStableCheckpoint | null {
+  if (parsed.schemaVersion !== 1) return null;
+
+  if (parsed.phase === 'finalizing' && isAudit(parsed.audit)) {
+    return {
+      schemaVersion: 1,
+      phase: 'finalizing',
+      audit: parsed.audit,
+    };
+  }
+
+  if (
+    parsed.phase === 'scanning' &&
+    typeof parsed.cursor === 'string' &&
+    parsed.cursor &&
+    typeof parsed.startedAt === 'string' &&
+    isCount(parsed.scannedCount) &&
+    isCount(parsed.deletedCount) &&
+    parsed.deletedCount <= parsed.scannedCount
+  ) {
+    return {
+      schemaVersion: 1,
+      phase: 'scanning',
+      cursor: parsed.cursor,
+      startedAt: parsed.startedAt,
+      scannedCount: parsed.scannedCount,
+      deletedCount: parsed.deletedCount,
+    };
+  }
+
+  return null;
+}
+
+function isAudit(value: unknown): value is InstallationCleanupAudit {
+  if (!value || typeof value !== 'object') return false;
+  const audit = value as Record<string, unknown>;
+  return (
+    audit.schemaVersion === 1 &&
+    typeof audit.completedAt === 'string' &&
+    isCount(audit.scannedCount) &&
+    isCount(audit.activeCount) &&
+    isCount(audit.deletedCount) &&
+    audit.deletedCount <= audit.scannedCount
+  );
+}
+
+function isCount(value: unknown): value is number {
+  return Number.isSafeInteger(value) && (value as number) >= 0;
+}
+
+function isInstallationId(value: unknown): value is number {
+  return Number.isSafeInteger(value) && (value as number) > 0;
+}