feat(orb): broker foundation — real token expiry, enrollments table, flag - #1330
Merged
Conversation
…flag
First piece of the Orb token-broker (the red-team-approved design). All default-off until ORB_BROKER_ENABLED.
- createOrbInstallationToken now returns { token, expiresAt } — surfaces GitHub's real ~1h expiry instead of
a future invented one (red-team fix; the fn had no callers yet, so widening it is safe).
- migration 0068 adds orb_enrollments: the enrollment ledger that binds a maintainer-authorized installation to
a HASHED one-time secret (SHA-256, never plaintext), so a container can only ever mint tokens for the
installation it was bound to server-side at OAuth time.
- ORB_BROKER_ENABLED flag (env.d.ts), default-off — the enrollment OAuth + /v1/orb/token endpoints (next PRs)
early-404 until set, so the deploy stays byte-identical.
Advances #1255 (the central Orb data layer).
Contributor
|
Superagent didn't find any vulnerabilities or security issues in this PR. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1330 +/- ##
=======================================
Coverage 95.23% 95.23%
=======================================
Files 185 185
Lines 20259 20259
Branches 7285 7286 +1
=======================================
Hits 19294 19294
Misses 378 378
Partials 587 587
🚀 New features to boost your workflow:
|
3 tasks
JSONbored
added a commit
that referenced
this pull request
Jun 25, 2026
) Completes the Orb token broker end-to-end (server: #1330/#1332). A brokered self-host holds no GitHub App private key — it installs the central Orb App and sets the operator-issued ORB_ENROLLMENT_SECRET. createInstallationToken now sources tokens from the central Orb (POST /v1/orb/token) when that secret is present, caching them in the same in-isolate token cache as the App-key path (~1 mint/hour/install). Cloud never sets the secret, so the branch is inert there → byte-identical. - src/orb/broker-client.ts: isOrbBrokerMode (secret-presence gate) + fetchBrokeredInstallationToken (exchange secret → {token, installationId, expiresAt}; injectable fetch + 10s timeout; throws on non-OK / tokenless body). - src/github/app.ts: the broker branch slots in at the single token chokepoint, right after the cache check. - No App-key fallback by design (a brokered self-host has none) — a broker outage fails the request exactly like an App-key mint failure, and the queue's retry/dead-letter handling covers a transient blip. The secret is sent as a Bearer over the https default and never logged (errors carry only the status). Advances #1255. (Maintainer-OAuth self-enrollment remains a follow-up; today enrollments are operator-issued.)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
First piece of the Orb token-broker (the red-team-vetted design). Everything default-off until
ORB_BROKER_ENABLED="true".createOrbInstallationTokennow returns{ token, expiresAt }— surfaces GitHub's real ~1hexpires_atinstead of an invented future time (red-team fix feat(scoring): add situational score projections #3). The function had no callers yet, so widening the return is safe.0068_orb_enrollments— the enrollment ledger: binds a maintainer-authorizedinstallation_idto a hashed one-time secret (SHA-256, never plaintext). A container can only ever mint tokens for the installation it was bound to server-side at OAuth time;installation_idis never read from the token-exchange request.ORB_BROKER_ENABLEDflag (env.d.ts), default-off — the enrollment OAuth flow +/v1/orb/token(the next two PRs) early-404 until set, so the deploy is byte-identical.Validation
npm run test:cigreen (incl.db:migrations:check→ contiguous to 0068)expires_at).Advances #1255 (the central Orb data layer).