feat(relay): additive account_id re-keying for GitHub + Linear integrations#821
Conversation
…ations Keys the GitHub-App install + Linear workspace to the Clerk account so any signed-in machine auto-subscribes and revocation is single-place. Strictly additive: nullable account_id columns (NULL = legacy, routes as today); an optional JWKS-verified x-ade-account-token authorizes when the mapping's account_id matches the token sub, layered on top of the unchanged assertGitHubRepoAuthorized / Linear token-org gates (dual-key, either authorizes); coalesce stamping never nulls an association; account-scoped revocation leaves the legacy path untouched. No route/PK/token/secret/ fan-out replaced; ade_proj_ retained. 43 legacy tests unchanged + a byte-identical NULL-legacy test; 46/46 relay + 91/91 ingress + 13/13 account green. Deploy needs 3 Clerk Worker vars (README). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
📝 WalkthroughWalkthroughThe change adds signed-in account-token retrieval, propagates account credentials through CLI and desktop relay clients, and enables Clerk-authenticated account ownership, authorization, listing, unlinking, and persistence in the webhook relay while preserving legacy authentication paths. ChangesAccount-token integration
Estimated code review effort: 5 (Critical) | ~120 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@copilot review but do not make fixes |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7d6c8bd553
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
Codex Review: Didn't find any major issues. Bravo. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/webhook-relay/src/relay.ts`:
- Around line 1318-1323: The account-authenticated event and cursor queries in
apps/webhook-relay/src/relay.ts lines 1318-1323 and 1931-1935 must retain the
fallback account ID and filter by account_id; preserve unfiltered queries only
for successful legacy authorization. Update the fake database in
apps/webhook-relay/test/account.test.ts lines 109-135 to enforce account
predicates, and extend lines 436-458 with same-repository/organization events
owned by another account, asserting those events are excluded.
- Around line 2016-2028: Make account unlinking durable across all affected
sites: in apps/webhook-relay/src/relay.ts lines 2016-2028, persist an unlink
tombstone or use an explicit unlink operation when handling DELETE; in relay.ts
lines 1560-1562 and 1770-1775, prevent automatic GitHub repository and Linear
registration from reclaiming explicitly unlinked accounts; in
apps/webhook-relay/README.md lines 94-96, document the durable unlink behavior;
and in apps/webhook-relay/test/account.test.ts lines 479-498, repeat status and
registration with both credentials after DELETE and assert ownership remains
revoked.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 66bb24aa-d608-4781-8b3c-254cea0ba5aa
⛔ Files ignored due to path filters (1)
apps/webhook-relay/package-lock.jsonis excluded by!**/package-lock.json,!**/package-lock.json
📒 Files selected for processing (17)
apps/ade-cli/src/bootstrap.tsapps/ade-cli/src/headlessLinearServices.tsapps/ade-cli/src/services/account/accountAuthService.test.tsapps/ade-cli/src/services/account/accountAuthService.tsapps/desktop/src/main/main.tsapps/desktop/src/main/services/automations/automationIngressService.test.tsapps/desktop/src/main/services/automations/automationIngressService.tsapps/desktop/src/main/services/automations/linearIngressService.test.tsapps/desktop/src/main/services/automations/linearIngressService.tsapps/desktop/src/main/services/github/githubRelayConfig.tsapps/desktop/src/main/services/github/githubService.test.tsapps/desktop/src/main/services/github/githubService.tsapps/webhook-relay/README.mdapps/webhook-relay/migrations/0005_account_integration_rekey.sqlapps/webhook-relay/package.jsonapps/webhook-relay/src/relay.tsapps/webhook-relay/test/account.test.ts
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2ea7b8c7c7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8a54da5222
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
Codex Review: Didn't find any major issues. What shall we delve into next? Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
Integration re-keying under the Clerk account (additive / dual-key)
Keys the GitHub-App install + Linear workspace to the Clerk account so any signed-in machine auto-subscribes and revocation is single-place. Strictly additive — the live webhook relay's behavior is unchanged for every existing caller.
account_idongithub_app_repositories/github_events/linear_organizations/linear_events(additive migrations; existing rows → NULL = legacy, routes exactly as today).x-ade-account-token(joseJWKS, RS256, exact issuer,exp,sub— same as the feat(account-directory): Clerk-verified machine directory Worker #814 directory Worker) and authorizes listing repos/orgs whose storedaccount_idmatches the token'ssub— layered on top of the unchangedassertGitHubRepoAuthorized/ Linear token↔org gates. Either path authorizes.account_idis stamped on the mapping viacoalesce(never nulls an existing association).Authorizationexactly.Legacy safety: no existing route, PK, token shape (
ade_proj_…), signing secret, webhook verification, cursor, or fan-out model was replaced; theade_proj_scheme is retained, not retired. 43 legacy relay tests unchanged + a byte-identical NULL-legacy-path test prove delivery is unaffected.Tests: 46/46 relay (JWKS verify, byte-identical NULL legacy, stamping, isolation, dual-key access, listing, revocation) + 91/91 desktop ingress + 13/13 account +
wranglerdry-run + typechecks green.Deploy (pending): the relay needs three Clerk config values set as Worker vars (documented in
apps/webhook-relay/README.md); no deploy performed here.🤖 Generated with Claude Code
Summary by CodeRabbit
Greptile Summary
This PR adds account-based relay access for GitHub and Linear integrations. The main changes are:
account_idfields and unlink tombstones for GitHub and Linear mappings.x-ade-account-tokenfrom desktop and headless clients without replacing providerAuthorizationheaders.ade_proj_, GitHub, and Linear authorization paths available.Confidence Score: 5/5
Safe to merge with low risk.
The account path is additive and the legacy provider/project-token paths remain intact. The previously reported expiration and mapping overwrite issues are addressed by required exp claims and null-only account stamping with unlink tombstones. No new blocking correctness or security issues were found in the reviewed changes.
No files require special attention.
What T-Rex did
Important Files Changed
Sequence Diagram
%%{init: {'theme': 'neutral'}}%% sequenceDiagram participant Client as ADE desktop/headless participant Account as AccountAuthService participant Relay as Webhook Relay participant Clerk as Clerk JWKS participant DB as D1 mappings/events participant Provider as GitHub/Linear API Client->>Account: getSignedInAccountAccessToken() Account-->>Client: Clerk access token or null Client->>Relay: Relay request + provider Authorization and/or x-ade-account-token Relay->>Provider: Verify legacy GitHub/Linear authorization when present Provider-->>Relay: Authorized repo or org, or auth error alt account token present Relay->>Clerk: Verify RS256 JWT via JWKS Clerk-->>Relay: Valid sub, audience, issuer, and exp Relay->>DB: Match or stamp account_id on repo/org mapping end Relay->>DB: Read account-scoped or legacy events/listings DB-->>Relay: Matching integrations/events Relay-->>Client: Status, events, integrations, or unlink result%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%% sequenceDiagram participant Client as ADE desktop/headless participant Account as AccountAuthService participant Relay as Webhook Relay participant Clerk as Clerk JWKS participant DB as D1 mappings/events participant Provider as GitHub/Linear API Client->>Account: getSignedInAccountAccessToken() Account-->>Client: Clerk access token or null Client->>Relay: Relay request + provider Authorization and/or x-ade-account-token Relay->>Provider: Verify legacy GitHub/Linear authorization when present Provider-->>Relay: Authorized repo or org, or auth error alt account token present Relay->>Clerk: Verify RS256 JWT via JWKS Clerk-->>Relay: Valid sub, audience, issuer, and exp Relay->>DB: Match or stamp account_id on repo/org mapping end Relay->>DB: Read account-scoped or legacy events/listings DB-->>Relay: Matching integrations/events Relay-->>Client: Status, events, integrations, or unlink resultReviews (6): Last reviewed commit: "ship: iteration 5 — contain account cred..." | Re-trigger Greptile