Fix(Rbac, Front, guard, github_hooks) limit github account to be linked to only one user account#1098
Open
adbatista wants to merge 30 commits into
Open
Fix(Rbac, Front, guard, github_hooks) limit github account to be linked to only one user account#1098adbatista wants to merge 30 commits into
adbatista wants to merge 30 commits into
Conversation
adbatista
changed the title
adbatista
marked this pull request as ready for review
July 9, 2026 19:18
adbatista
requested review from
DamjanBecirovic,
dexyk,
loadez and
skipi
as code owners
July 9, 2026 19:18
adbatista
force-pushed
the
adb/github_account
branch
from
July 9, 2026 19:19
b24b174 to
08bc939
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b24b174bb4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
adbatista
force-pushed
the
adb/github_account
branch
from
July 20, 2026 19:00
7d88e11 to
ac41550
Compare
# Conflicts: # auth/.mix-audit.txt # guard/config/config.exs # guard/lib/guard/application.ex
Fixes CVE-2026-59869: quadratic CPU blowup parsing YAML with chained merge keys in js-yaml <3.15.0. Drop-in upgrade within the existing semver range; the safeLoad/safeDump API used by the workflow editor is unchanged.
A claim's Keycloak sync was fire-and-forget: a restart between the claim commit and task completion lost it, a push that failed past retries left the GitHub identity attached to nobody, and a failed removal left login routed to the old owner - with nothing to repair any of it. Every claim now writes a federated_identity_sync_requests outbox row in the same transaction that releases the losing rows. The row is deleted only when the sync fully succeeds; failures and crashes leave it for the FederatedIdentitySyncDrainer (Quantum, every minute) to lease with SKIP LOCKED and retry with exponential backoff. Removals are uid-aware so a retried sync never detaches an identity the loser has since reconnected, and the push is skipped when a later claim superseded the row. Identity pushes derived from repo_host_accounts skip uids with a pending outbox row, closing the path that could attach the same GitHub identity to two Keycloak users while removals are unconfirmed.
Claims made through rbac write the same federated_identity_sync_requests outbox rows (in the transaction that releases the losing rows) and mark completion or failure on them; guard's drainer processes the shared table, so rbac needs no scheduler of its own. Removals are uid-aware and identity pushes derived from repo_host_accounts skip uids with a pending outbox row, mirroring guard.
Collapse the two Credentials stubs into a single receive_messages call; rubocop failed the Lint job on them.
The floating registry.semaphoreci.com/ruby:3 tag now resolves to ruby 3.4, whose toolchain cannot compile the forked grpc gem's boringssl extension during the scan's bundle install, so Check dependencies fails for any change touching github_hooks. Pin the scan to the ruby line the app actually runs (Dockerfile base ruby:3.3.11, CI prologue sem-version ruby 3.3) - the configuration that passed when the fork landed in #1114.
Bump loofah 2.25.1 -> 2.25.2 (GHSA-5qhf-9phg-95m2, GHSA-8whx-365g-h9vv, GHSA-9wjq-cp2p-hrgf) and rails-html-sanitizer 1.7.0 -> 1.7.1 (GHSA-cj75-f6xr-r4g7); both are patch releases inside the existing Gemfile ranges, lockfile-only change. Waive GHSA-4phc-fq33-39gx (selenium-webdriver < 4.14.0): test-only dependency pinned to ~> 2.53; the 4.x move is a breaking Capybara-stack upgrade tracked separately. bundle-audit check --update: no vulnerabilities found.
adbatista
changed the title
Resolves the JS dependency scan findings: CVE-2026-59887 (linkify-it mailto: validator quadratic DoS) and CVE-2026-13676 / CVE-2026-16221 (fast-uri host canonicalization parser differentials). Both are transitive patch bumps inside the existing semver ranges (markdown-it ^5.0.0, ajv ^3.0.1), lockfile-only; exports verified unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📝 Description
PR description as bullets:
Problem
repo_host_accounts, causing nondeterministic user lookups by provider UID, broken login flows, and duplicate users created during OIDC signup.Changes
guard(mirrored inee/rbac) that rejects connecting a GitHub account already linked to another user, covering the OAuth connect callback and user-creation paths.account_takenOAuth error code.User.Createfails withinvalid_argumentand rolls back.✅ Checklist