fix(webapp): scope GitHub App installation update to the caller's org (#58)

* fix(webapp): scope GitHub App installation update to the caller's org

* fix(webapp): make GitHub App install session single-use

Invalidate the GitHub App installation state cookie once a callback
consumes an installation_id, so a single install initiation cannot be
replayed against other installation_ids.

Author: carderne

.server-changes/scope-github-app-update-to-org.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Updating a GitHub App installation from the callback flow is now scoped to your own organization, so an installation ID belonging to another organization can no longer be used to refresh that organization's installation record. The GitHub App installation session is also now single-use, so completing an installation callback invalidates its state and it can no longer be replayed.

apps/webapp/app/routes/_app.github.callback/route.tsx

@@ -1,6 +1,9 @@
 import { type LoaderFunctionArgs } from "@remix-run/node";
 import { z } from "zod";
-import { validateGitHubAppInstallSession } from "~/services/gitHubSession.server";
+import {
+  destroyGitHubAppInstallSession,
+  validateGitHubAppInstallSession,
+} from "~/services/gitHubSession.server";
 import { linkGitHubAppInstallation, updateGitHubAppInstallation } from "~/services/gitHub.server";
 import { logger } from "~/services/logger.server";
 import { redirectWithErrorMessage, redirectWithSuccessMessage } from "~/models/message.server";
@@ -75,6 +78,15 @@ export async function loader({ request }: LoaderFunctionArgs) {
     return redirectWithErrorMessage(redirectTo, request, "Failed to install GitHub app");
   }
 
+  // The install session is single-use: once a callback consumes an
+  // installation_id, invalidate the state cookie so the same initiation
+  // cannot be replayed against other installation_ids.
+  const clearInstallSession = await destroyGitHubAppInstallSession(cookieHeader);
+  const consumingSession = (response: Response) => {
+    response.headers.append("Set-Cookie", clearInstallSession);
+    return response;
+  };
+
   switch (callbackData.setup_action) {
     case "install": {
       const [error] = await tryCatch(
@@ -85,23 +97,33 @@ export async function loader({ request }: LoaderFunctionArgs) {
         logger.error("Failed to link GitHub App installation", {
           error,
         });
-        return redirectWithErrorMessage(redirectTo, request, "Failed to install GitHub app");
+        return consumingSession(
+          await redirectWithErrorMessage(redirectTo, request, "Failed to install GitHub app")
+        );
       }
 
-      return redirectWithSuccessMessage(redirectTo, request, "GitHub App installed successfully");
+      return consumingSession(
+        await redirectWithSuccessMessage(redirectTo, request, "GitHub App installed successfully")
+      );
     }
 
     case "update": {
-      const [error] = await tryCatch(updateGitHubAppInstallation(callbackData.installation_id));
+      const [error] = await tryCatch(
+        updateGitHubAppInstallation(callbackData.installation_id, organizationId)
+      );
 
       if (error) {
         logger.error("Failed to update GitHub App installation", {
           error,
         });
-        return redirectWithErrorMessage(redirectTo, request, "Failed to update GitHub App");
+        return consumingSession(
+          await redirectWithErrorMessage(redirectTo, request, "Failed to update GitHub App")
+        );
       }
 
-      return redirectWithSuccessMessage(redirectTo, request, "GitHub App updated successfully");
+      return consumingSession(
+        await redirectWithSuccessMessage(redirectTo, request, "GitHub App updated successfully")
+      );
     }
 
     case "request": {

apps/webapp/app/services/gitHub.server.ts

@@ -58,26 +58,32 @@ export async function linkGitHubAppInstallation(
 }
 
 /**
- * Links a GitHub App installation to a Trigger organization
+ * Updates a GitHub App installation owned by the given Trigger organization
  */
-export async function updateGitHubAppInstallation(installationId: number): Promise<void> {
+export async function updateGitHubAppInstallation(
+  installationId: number,
+  organizationId: string
+): Promise<void> {
   if (!githubApp) {
     throw new Error("GitHub App is not enabled");
   }
 
-  const octokit = await githubApp.getInstallationOctokit(installationId);
-  const { data: installation } = await octokit.rest.apps.getInstallation({
-    installation_id: installationId,
-  });
-
+  // Scope the lookup to the caller's organization so a cross-tenant
+  // installation_id cannot update another org's record. Resolve ownership
+  // before calling GitHub to avoid burning the victim's API rate limit.
   const existingInstallation = await prisma.githubAppInstallation.findFirst({
-    where: { appInstallationId: installationId },
+    where: { appInstallationId: installationId, organizationId },
   });
 
   if (!existingInstallation) {
     throw new Error("GitHub App installation not found");
   }
 
+  const octokit = await githubApp.getInstallationOctokit(installationId);
+  const { data: installation } = await octokit.rest.apps.getInstallation({
+    installation_id: installationId,
+  });
+
   const repositorySelection = installation.repository_selection === "all" ? "ALL" : "SELECTED";
 
   // repos are updated asynchronously via webhook events