[fix] sync hardening: cross-tenant repo mounts, prune wipes, forged webhooks

[yui0303]

Three independent problems in the GitHub sync path. None is reachable today only because the App is not registered yet — which is also why this is the moment to fix them. Refs #1.

1. Any member could mount another workspace's private repo

GET /api/github/installations returned every installation of the App to any signed-in user, along with the repo names inside each. POST /api/sources then accepted whatever repo + installationId it was handed, validating neither.

list installations  ->  see installation 42 (another tenant) + its private repos
POST /api/sources   ->  { org: <mine>, repo: <theirs/private>, installationId: "42" }
                    ->  synced into my workspace, readable by me

Nothing in the schema binds an installation to a workspace, and adding that binding is a migration. So installations are now claimed first-come by the workspace that first mounts through them:

• installationOwner() — rejects a second workspace claiming an installation already in use
• installationCanSee() — rejects a repo the installation genuinely cannot read
• the installations list is filtered to exactly what POST would accept, so the picker stops leaking other tenants' repo names

This is a containment fix, not the ideal one. A real organization_id column on the installation is better and should replace it — deliberately deferred so this ships without a schema change.

2. A sync that matched nothing deleted everything

seen.length ? notInArray(schema.document.path, seen) : sql`true`

When a sync produced no files, the prune's predicate became true — deleting every document the source owned. A mistyped folder, a branch with no .html, or a truncated tree all trigger it. Data loss, silent, no error.

An empty result is now treated as the misconfiguration it nearly always is: the prune is skipped and reported back as prunedSkipped. A sync that legitimately finds files still prunes normally.

Related, and its own data-loss path: GitHub sets truncated on trees too large for one call, and the flag was never read. A partial listing fed a prune that deletes whatever the listing omits — so a big repo would delete real documents. It now throws.

3. An unset webhook secret accepted forged pushes

new TextEncoder().encode(process.env.GITHUB_APP_WEBHOOK_SECRET ?? "")

With the secret unset, the HMAC was computed with an empty key — a signature anyone can reproduce, so /api/github/webhook accepted forged pushes and would sync on them. Per issue #1 the secret is not yet set in production, so this is the live configuration.

Now refuses outright when the secret is missing, and compares with crypto.subtle.verify (constant time) instead of string equality.

Scope

No schema change, no migration. tsc --noEmit clean, next build clean.

Not verifiable end-to-end until the GitHub App exists — these paths need an installation to exercise. Reviewed by reading; the prune guard and the webhook rejection are both straightforward to re-check by inspection.

[github-actions]

❌ SonarQube Quality Gate ERROR — pathorsAI_pensieve

failed condition	value	threshold
new_violations	3	≤ 0

3 open issues on this PR:

• MINOR typescript:S1128 — Remove this unused import of 'eq'. (app/api/github/installations/route.ts:2)
• CRITICAL typescript:S3776 — Refactor this function to reduce its Cognitive Complexity from 18 to the 15 allowed. (app/api/sources/route.ts:20)
• MINOR typescript:S7773 — Prefer Number.parseInt over parseInt. (lib/github.ts:155)