feat: verify organization GitHub profiles (#3169)

Author: Patrick-Erichsen

.github/workflows/ci.yml

@@ -163,6 +163,7 @@ jobs:
             specs: |
               e2e/local-auth/header-profile-link.pw.test.ts
               e2e/local-auth/manage-context-proof.pw.test.ts
+              e2e/local-auth/publisher-github-profile.pw.test.ts
           - name: moderation-malicious
             specs: e2e/local-auth/malicious-skill-ban-flow.pw.test.ts
           - name: star-sync

convex/_generated/api.d.ts

@@ -27,6 +27,7 @@ import type * as functions from "../functions.js";
 import type * as githubAccountAgeBackfill from "../githubAccountAgeBackfill.js";
 import type * as githubIdentity from "../githubIdentity.js";
 import type * as githubImport from "../githubImport.js";
+import type * as githubOrgMemberships from "../githubOrgMemberships.js";
 import type * as githubSkillSources from "../githubSkillSources.js";
 import type * as githubSkillSync from "../githubSkillSync.js";
 import type * as githubSkillSyncNode from "../githubSkillSyncNode.js";
@@ -70,6 +71,7 @@ import type * as lib_githubAuth from "../lib/githubAuth.js";
 import type * as lib_githubHandoff from "../lib/githubHandoff.js";
 import type * as lib_githubIdentity from "../lib/githubIdentity.js";
 import type * as lib_githubImport from "../lib/githubImport.js";
+import type * as lib_githubOrgMemberships from "../lib/githubOrgMemberships.js";
 import type * as lib_githubProfileSync from "../lib/githubProfileSync.js";
 import type * as lib_githubSkillScans from "../lib/githubSkillScans.js";
 import type * as lib_githubSkillSync from "../lib/githubSkillSync.js";
@@ -194,6 +196,7 @@ declare const fullApi: ApiFromModules<{
   githubAccountAgeBackfill: typeof githubAccountAgeBackfill;
   githubIdentity: typeof githubIdentity;
   githubImport: typeof githubImport;
+  githubOrgMemberships: typeof githubOrgMemberships;
   githubSkillSources: typeof githubSkillSources;
   githubSkillSync: typeof githubSkillSync;
   githubSkillSyncNode: typeof githubSkillSyncNode;
@@ -237,6 +240,7 @@ declare const fullApi: ApiFromModules<{
   "lib/githubHandoff": typeof lib_githubHandoff;
   "lib/githubIdentity": typeof lib_githubIdentity;
   "lib/githubImport": typeof lib_githubImport;
+  "lib/githubOrgMemberships": typeof lib_githubOrgMemberships;
   "lib/githubProfileSync": typeof lib_githubProfileSync;
   "lib/githubSkillScans": typeof lib_githubSkillScans;
   "lib/githubSkillSync": typeof lib_githubSkillSync;

convex/auth.test.ts

@@ -156,6 +156,14 @@ describe("handleDeletedUserSignIn", () => {
 });
 
 describe("GitHub auth provider", () => {
+  it("requests read-only GitHub organization membership access", () => {
+    const provider = createGitHubAuthProvider() as {
+      options?: { authorization?: { params?: { scope?: string } } };
+    };
+
+    expect(provider.options?.authorization?.params?.scope?.split(" ")).toContain("read:org");
+  });
+
   it("does not link ClawHub accounts by GitHub profile email", () => {
     const provider = createGitHubAuthProvider() as {
       options?: { allowDangerousEmailAccountLinking?: boolean };
@@ -181,19 +189,74 @@ describe("GitHub auth provider", () => {
     );
   });
 
-  it("fails closed when the GitHub provider receives a malformed profile", () => {
+  it("fails closed when the GitHub provider receives a malformed profile", async () => {
     const provider = createGitHubAuthProvider() as {
-      options?: { profile?: (profile: Record<string, unknown>) => Record<string, unknown> };
+      options?: {
+        profile?: (
+          profile: Record<string, unknown>,
+          tokens: { access_token?: string },
+        ) => Promise<Record<string, unknown>>;
+      };
     };
 
-    expect(() => provider.options?.profile?.({ message: "Bad credentials" })).toThrow(
+    await expect(provider.options?.profile?.({ message: "Bad credentials" }, {})).rejects.toThrow(
       "GitHub OAuth profile is missing a valid numeric id",
     );
-    expect(provider.options?.profile?.({ id: 123456, login: "fixture-user" })).toEqual({
+    await expect(
+      provider.options?.profile?.({ id: 123456, login: "fixture-user" }, {}),
+    ).resolves.toEqual({
+      id: "123456",
+      name: "fixture-user",
+      email: undefined,
+      image: undefined,
+    });
+  });
+
+  it("adds a verified GitHub organization snapshot to the OAuth profile", async () => {
+    const fetchMock = vi.spyOn(globalThis, "fetch").mockResolvedValueOnce(
+      new Response(
+        JSON.stringify([
+          {
+            state: "active",
+            role: "member",
+            organization: { id: 42, login: "trycua" },
+          },
+        ]),
+        { status: 200 },
+      ),
+    );
+    const provider = createGitHubAuthProvider() as {
+      options?: {
+        profile?: (
+          profile: Record<string, unknown>,
+          tokens: { access_token?: string },
+        ) => Promise<Record<string, unknown>>;
+      };
+    };
+
+    await expect(
+      provider.options?.profile?.(
+        { id: 123456, login: "fixture-user" },
+        { access_token: "test-token-placeholder" },
+      ),
+    ).resolves.toEqual({
       id: "123456",
       name: "fixture-user",
       email: undefined,
       image: undefined,
+      githubOrgMembershipSync: {
+        memberships: [
+          {
+            githubOrgId: "42",
+            login: "trycua",
+            avatarUrl: undefined,
+            role: "member",
+          },
+        ],
+        syncedAt: expect.any(Number),
+        truncated: false,
+      },
     });
+    fetchMock.mockRestore();
   });
 });

convex/auth.ts

@@ -6,6 +6,12 @@ import { ConvexError } from "convex/values";
 import { internal } from "./_generated/api";
 import type { DataModel, Id } from "./_generated/dataModel";
 import { isLocalDevAuthEnabled } from "./lib/devAuth";
+import {
+  GITHUB_ORG_MEMBERSHIP_SYNC_PROFILE_KEY,
+  fetchActiveGitHubOrgMemberships,
+  readGitHubOrgMembershipSync,
+  replaceGitHubOrgMemberships,
+} from "./lib/githubOrgMemberships";
 import { shouldScheduleGitHubProfileSync } from "./lib/githubProfileSync";
 
 export const BANNED_REAUTH_MESSAGE =
@@ -39,15 +45,34 @@ export function createGitHubAuthProvider() {
   return GitHub({
     clientId: process.env.AUTH_GITHUB_ID ?? "",
     clientSecret: process.env.AUTH_GITHUB_SECRET ?? "",
+    authorization: {
+      params: { scope: "read:user user:email read:org" },
+    },
     // GitHub's OAuth email must not be treated as a ClawHub account key. The
     // immutable GitHub provider account id is the only account-linking key.
     allowDangerousEmailAccountLinking: false,
-    profile(profile) {
+    async profile(profile, tokens) {
+      let githubOrgMembershipSync;
+      const accessToken = tokens.access_token?.trim();
+      if (accessToken) {
+        try {
+          githubOrgMembershipSync = await fetchActiveGitHubOrgMemberships(accessToken);
+        } catch (error) {
+          console.warn(
+            `[auth] GitHub organization membership sync failed: ${
+              error instanceof Error ? error.message : String(error)
+            }`,
+          );
+        }
+      }
       return {
         id: normalizeGitHubProfileId(profile.id),
         name: profile.login,
         email: profile.email ?? undefined,
         image: profile.avatar_url,
+        ...(githubOrgMembershipSync
+          ? { [GITHUB_ORG_MEMBERSHIP_SYNC_PROFILE_KEY]: githubOrgMembershipSync }
+          : {}),
       };
     },
   });
@@ -120,6 +145,7 @@ function userDataFromAuthProfile(args: {
   const {
     emailVerified: profileEmailVerified,
     phoneVerified: profilePhoneVerified,
+    [GITHUB_ORG_MEMBERSHIP_SYNC_PROFILE_KEY]: _githubOrgMembershipSync,
     ...profile
   } = args.profile;
   const emailVerified =
@@ -187,18 +213,25 @@ export const { auth, signIn, signOut, store, isAuthenticated } = convexAuth({
      */
     async createOrUpdateUser(ctx, args) {
       const userData = userDataFromAuthProfile(args);
+      const githubOrgMembershipSync = readGitHubOrgMembershipSync(args.profile);
       if (args.existingUserId !== null) {
         const userId = args.existingUserId as Id<"users">;
         const existingUser = await ctx.db.get(userId);
         if (existingUser?.deletedAt || existingUser?.deactivatedAt) {
           return userId;
         }
         await ctx.db.patch(userId, userData);
+        if (githubOrgMembershipSync) {
+          await replaceGitHubOrgMemberships(ctx, userId, githubOrgMembershipSync);
+        }
         await schedulePostUserCreatedOrUpdated(ctx, userId, existingUser);
         return userId;
       }
 
       const userId = await ctx.db.insert("users", userData);
+      if (githubOrgMembershipSync) {
+        await replaceGitHubOrgMemberships(ctx, userId, githubOrgMembershipSync);
+      }
       const user = await ctx.db.get(userId);
       await schedulePostUserCreatedOrUpdated(ctx, userId, user);
       return userId;

convex/githubOrgMemberships.ts

@@ -0,0 +1,34 @@
+import { query } from "./functions";
+import { getOptionalActiveAuthUserId } from "./lib/access";
+
+export const listMine = query({
+  args: {},
+  handler: async (ctx) => {
+    const userId = await getOptionalActiveAuthUserId(ctx);
+    if (!userId) {
+      return { syncedAt: null, truncated: false, memberships: [] };
+    }
+    const user = await ctx.db.get(userId);
+    if (!user || user.deletedAt || user.deactivatedAt) {
+      return { syncedAt: null, truncated: false, memberships: [] };
+    }
+
+    const memberships = await ctx.db
+      .query("githubOrgMemberships")
+      .withIndex("by_user", (q) => q.eq("userId", userId))
+      .collect();
+    memberships.sort((left, right) => left.login.localeCompare(right.login));
+
+    return {
+      syncedAt: user.githubOrgMembershipsSyncedAt ?? null,
+      truncated: user.githubOrgMembershipsTruncated ?? false,
+      memberships: memberships.map(({ githubOrgId, login, avatarUrl, role, syncedAt }) => ({
+        githubOrgId,
+        login,
+        avatarUrl: avatarUrl ?? null,
+        role,
+        syncedAt,
+      })),
+    };
+  },
+});

convex/lib/githubOrgMemberships.test.ts

@@ -0,0 +1,137 @@
+import { describe, expect, it, vi } from "vitest";
+import {
+  fetchActiveGitHubOrgMemberships,
+  readGitHubOrgMembershipSync,
+} from "./githubOrgMemberships";
+
+describe("GitHub organization memberships", () => {
+  it("loads active memberships from the authenticated GitHub API", async () => {
+    const fetchImpl = vi.fn(async () => {
+      return new Response(
+        JSON.stringify([
+          {
+            state: "active",
+            role: "member",
+            organization: {
+              id: 2,
+              login: "trycua",
+              avatar_url: "https://avatars.githubusercontent.com/u/2",
+            },
+          },
+          {
+            state: "active",
+            role: "admin",
+            organization: {
+              id: 1,
+              login: "openclaw",
+              avatar_url: "https://avatars.githubusercontent.com/u/1",
+            },
+          },
+          {
+            state: "pending",
+            role: "member",
+            organization: { id: 3, login: "pending-org" },
+          },
+        ]),
+        { status: 200 },
+      );
+    });
+
+    const result = await fetchActiveGitHubOrgMemberships("github-token", {
+      fetchImpl: fetchImpl as typeof fetch,
+      now: 123,
+    });
+
+    expect(result).toEqual({
+      syncedAt: 123,
+      truncated: false,
+      memberships: [
+        {
+          githubOrgId: "1",
+          login: "openclaw",
+          avatarUrl: "https://avatars.githubusercontent.com/u/1",
+          role: "admin",
+        },
+        {
+          githubOrgId: "2",
+          login: "trycua",
+          avatarUrl: "https://avatars.githubusercontent.com/u/2",
+          role: "member",
+        },
+      ],
+    });
+    expect(fetchImpl).toHaveBeenCalledWith(
+      expect.stringContaining("/user/memberships/orgs?state=active"),
+      expect.objectContaining({
+        headers: expect.objectContaining({
+          Authorization: "Bearer github-token",
+        }),
+      }),
+    );
+  });
+
+  it("rejects GitHub API failures without accepting partial membership data", async () => {
+    const fetchImpl = vi.fn(async () => new Response("Forbidden", { status: 403 }));
+
+    await expect(
+      fetchActiveGitHubOrgMemberships("github-token", {
+        fetchImpl: fetchImpl as typeof fetch,
+      }),
+    ).rejects.toThrow("GitHub organization membership lookup failed (403)");
+  });
+
+  it("loads every GitHub organization membership page", async () => {
+    const firstPage = Array.from({ length: 100 }, (_, index) => ({
+      state: "active",
+      role: "member",
+      organization: { id: index + 1, login: `org-${index + 1}` },
+    }));
+    const fetchImpl = vi
+      .fn()
+      .mockResolvedValueOnce(new Response(JSON.stringify(firstPage), { status: 200 }))
+      .mockResolvedValueOnce(
+        new Response(
+          JSON.stringify([
+            {
+              state: "active",
+              role: "admin",
+              organization: { id: 101, login: "org-101" },
+            },
+          ]),
+          { status: 200 },
+        ),
+      );
+
+    const result = await fetchActiveGitHubOrgMemberships("github-token", {
+      fetchImpl: fetchImpl as typeof fetch,
+      now: 123,
+    });
+
+    expect(result.memberships).toHaveLength(101);
+    expect(result.truncated).toBe(false);
+    expect(fetchImpl).toHaveBeenCalledTimes(2);
+    expect(fetchImpl).toHaveBeenLastCalledWith(
+      expect.stringContaining("page=2"),
+      expect.any(Object),
+    );
+  });
+
+  it("validates membership snapshots before they reach the database", () => {
+    expect(
+      readGitHubOrgMembershipSync({
+        githubOrgMembershipSync: {
+          syncedAt: 123,
+          truncated: false,
+          memberships: [
+            { githubOrgId: "1", login: "openclaw", role: "admin" },
+            { githubOrgId: "invalid", login: "spoofed", role: "member" },
+          ],
+        },
+      }),
+    ).toEqual({
+      syncedAt: 123,
+      truncated: false,
+      memberships: [{ githubOrgId: "1", login: "openclaw", role: "admin" }],
+    });
+  });
+});