RUMBO R2 GitHub App custody setup

This creates one private GitHub App with only Contents read, Pull requests write, and Administration read.

GitHub will show the final permissions before creation. No billing or plan change is performed.

\n `);\n});\n\napp.get(\"/github/manifest/callback\",async c=>{\n const code=String(c.req.query(\"code\")||\"\");\n const state=String(c.req.query(\"state\")||\"\");\n if(!code||!state)return c.text(\"Missing code/state\",400);\n\n const rs=await sqlite.execute(\"SELECT * FROM setup_sessions WHERE status='CREATED' ORDER BY created_at DESC LIMIT 20\");\n let matched:any=null;\n for(const row of rs.rows as any[]){\n if(Date.parse(String(row.expires_at))<=Date.now())continue;\n const expected=await setupState(String(row.session_id));\n if(ct(expected,state)){matched=row;break;}\n }\n if(!matched)return c.text(\"Invalid or expired setup state\",403);\n\n const existing=await sqlite.execute(\"SELECT app_id FROM app_custody WHERE singleton_id=1 LIMIT 1\");\n if(existing.rows.length)return c.text(\"App custody already initialized\",409);\n\n const res=await fetch(`https://api.github.com/app-manifests/${encodeURIComponent(code)}/conversions`,{\n method:\"POST\",\n headers:{Accept:\"application/vnd.github+json\",\"X-GitHub-Api-Version\":API_VERSION,\"User-Agent\":\"rumbo-r2-github-app-broker/1\"}\n });\n const text=await res.text();\n let data:any=null;try{data=text?JSON.parse(text):null;}catch{}\n if(res.status!==201||!data?.id||!data?.slug||!data?.pem){\n await sqlite.execute({sql:\"UPDATE setup_sessions SET status='FAILED',failure_reason=? WHERE session_id=?\",args:[`MANIFEST_CONVERSION_${res.status}`,matched.session_id]});\n return c.text(\"GitHub App manifest conversion failed\",502);\n }\n\n const encrypted=await encryptSecret(String(data.pem));\n const keySha=await sha256Text(String(data.pem));\n const now=new Date();\n await sqlite.execute({sql:`INSERT INTO app_custody(singleton_id,app_id,app_slug,encrypted_private_key,private_key_sha256,created_at)\n VALUES(1,?,?,?,?,?)`,args:[Number(data.id),String(data.slug),encrypted,keySha,now.toISOString()]});\n await sqlite.execute({sql:\"UPDATE setup_sessions SET status='APP_CREATED',app_id=?,app_slug=?,expires_at=? WHERE session_id=?\",\n args:[Number(data.id),String(data.slug),new Date(now.getTime()+MAX_INSTALL_AGE_MS).toISOString(),matched.session_id]});\n await appendAudit(\"GITHUB_APP_MANIFEST_CONVERTED\",String(data.id),keySha);\n\n const install=`https://github.com/apps/${encodeURIComponent(String(data.slug))}/installations/new?state=${encodeURIComponent(state)}`;\n return c.html(`Install RUMBO R2 App\n

GitHub App created and private key sealed

Install it on exactly ${REPO_FULL}. The broker will reject any other repository.

\n Install RUMBO R2 App on the repository`);\n});\n\napp.get(\"/github/install/setup\",async c=>{\n const installationId=Number(c.req.query(\"installation_id\")||\"\");\n const state=String(c.req.query(\"state\")||\"\");\n if(!Number.isSafeInteger(installationId)||installationId<=0)return c.text(\"Missing installation_id\",400);\n\n const rs=await sqlite.execute(\"SELECT * FROM setup_sessions WHERE status='APP_CREATED' ORDER BY created_at DESC LIMIT 20\");\n let matched:any=null;\n for(const row of rs.rows as any[]){\n if(Date.parse(String(row.expires_at))<=Date.now())continue;\n if(state){\n const expected=await setupState(String(row.session_id));\n if(ct(expected,state)){matched=row;break;}\n }else if(!matched){\n matched=row;\n }\n }\n if(!matched)return c.text(\"No live pending installation session\",403);\n\n const cust=await custody();\n if(!cust||cust.app_id!==Number(matched.app_id))return c.text(\"Custody/app mismatch\",409);\n\n const appValidation=await validateAppConfiguration(cust);\n if(!appValidation.ok)return c.text(`GitHub App configuration rejected: ${appValidation.error}`,403);\n\n const installValidation=await validateInstallationMetadata(cust,installationId);\n if(!installValidation.ok)return c.text(`GitHub App installation rejected: ${installValidation.error}`,403);\n\n const tokenRes=await githubAppRequest(cust.app_id,cust.pem,`/app/installations/${installationId}/access_tokens`,\"POST\",{\n repository_ids:[REPOSITORY_ID],\n permissions:{contents:\"read\",pull_requests:\"read\",administration:\"read\"}\n });\n if(tokenRes.status!==201||!tokenRes.json?.token)return c.text(\"Could not mint verification token\",502);\n\n const verificationToken=String(tokenRes.json.token);\n const scopeValidation=await validateInstallationTokenRepoScope(verificationToken);\n await revokeInstallationToken(verificationToken);\n if(!scopeValidation.ok){\n return c.text(`Installation repository scope rejected: ${scopeValidation.error}`,403);\n }\n\n const accountId=Number(installValidation.json?.account?.id||0);\n const accountLogin=String(installValidation.json?.account?.login||\"\");\n const verifiedAt=new Date().toISOString();\n await sqlite.execute({sql:`INSERT INTO app_installation(singleton_id,installation_id,account_id,account_login,repository_id,verified_at)\n VALUES(1,?,?,?,?,?)\n ON CONFLICT(singleton_id) DO UPDATE SET installation_id=excluded.installation_id,account_id=excluded.account_id,\n account_login=excluded.account_login,repository_id=excluded.repository_id,verified_at=excluded.verified_at`,\n args:[installationId,accountId,accountLogin,REPOSITORY_ID,verifiedAt]});\n await sqlite.execute({sql:\"UPDATE setup_sessions SET status='INSTALLED',installation_id=? WHERE session_id=?\",args:[installationId,matched.session_id]});\n await appendAudit(\"GITHUB_APP_INSTALLATION_VERIFIED\",String(installationId),await sha256Text(canonical({installationId,accountId,accountLogin,repositoryId:REPOSITORY_ID})));\n\n const autopilot=await runPostInstallAutopilot(\"GITHUB_APP_INSTALL_CALLBACK\");\n const autopilotSummary=htmlEscape(JSON.stringify({\n run_id:autopilot.run_id,\n status:autopilot.status,\n pr_number:autopilot.pr_number||null,\n observer_receipt_sha256:autopilot.observer_receipt_sha256||null,\n observer_status:autopilot.observer_status||null,\n observer_blocking_count:Number.isSafeInteger(autopilot.observer_blocking_count)?autopilot.observer_blocking_count:null,\n merge_authorized:false,\n deploy_enabled:false,\n production_go:false\n },null,2));\n\n return c.html(`RUMBO R2 Ready\n

Dedicated GitHub App custody is ready

The private key is encrypted at rest. Installation tokens are minted just-in-time and are never persisted.

Repository identity verified: ${REPO_FULL}.

Post-install fail-closed autopilot

${autopilotSummary}

No merge, deploy, billing, visibility or product-production authority is granted by this automation.

\n `);\n});\n\napp.post(\"/v1/token/observer\",async c=>{\n if(!await roleAuthorized(c.req.raw,\"observer\"))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const token=await createInstallationToken(\"observer\");\n return c.json({...token,broker_implementation:IMPLEMENTATION,role:\"observer\",production_go:false},200,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n const msg=String(e?.message||e);\n return c.json({error:msg,production_go:false},msg===\"CUSTODY_NOT_READY\"?424:502,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v1/token/deployer\",async c=>{\n if(!await roleAuthorized(c.req.raw,\"deployer\"))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const token=await createInstallationToken(\"deployer\");\n return c.json({...token,broker_implementation:IMPLEMENTATION,role:\"deployer\",production_go:false},200,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n const msg=String(e?.message||e);\n return c.json({error:msg,production_go:false},msg===\"CUSTODY_NOT_READY\"?424:502,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.get(\"/v1/manifest-preview\",c=>{\n if(!rootAuthorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n return c.json({\n schema:\"rumbo-r2-github-app-manifest-preview/v1\",\n manifest:manifestFor(\"PREVIEW00000000\",\"STATE_PREVIEW\"),\n repository_install_scope:{mode:\"ONLY_SELECTED_REPOSITORY\",required_repository_id:REPOSITORY_ID,required_full_name:REPO_FULL},\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v1/autopilot/status\",async c=>{\n if(!rootAuthorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute(`SELECT run_id,trigger,status,started_at,completed_at,pr_number,base_sha,head_sha,\n preparation_sha256,observer_receipt_sha256,observer_status,observer_blocking_count,observer_merge_ready,result_json\n FROM autopilot_runs ORDER BY started_at DESC LIMIT 20`);\n const records=(rs.rows as any[]).map(r=>({\n ...r,\n observer_merge_ready:r.observer_merge_ready===null?null:Number(r.observer_merge_ready)===1,\n result:(()=>{try{return JSON.parse(String(r.result_json||\"{}\"));}catch{return {parse_error:true};}})()\n })).map(({result_json,...r})=>r);\n const downstream=await downstreamHealth();\n return c.json({\n schema:\"rumbo-r2-post-install-autopilot-status/v1\",\n implementation:IMPLEMENTATION,\n broker_ready:!!(await installation())&&!!(await custody()),\n service_auth_configured:!!Deno.env.get(\"R2_DEPLOYER_JIT_AUTOPILOT_TOKEN\")&&!!Deno.env.get(\"R2_OBSERVER_AUTOPILOT_TOKEN\"),\n downstream,\n merge_authorized:false,\n deploy_enabled:false,\n production_go:false,\n records\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.post(\"/v1/autopilot/retry\",async c=>{\n if(!rootAuthorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const result=await runPostInstallAutopilot(\"ROOT_RETRY\");\n return c.json({\n schema:\"rumbo-r2-post-install-autopilot-run/v1\",\n implementation:IMPLEMENTATION,\n ...result,\n merge_authorized:false,\n deploy_enabled:false,\n production_go:false\n },result.status===\"SIGNED_OBSERVER_PASS\"||result.status===\"SIGNED_OBSERVER_NO_GO\"?200:409,{\"Cache-Control\":\"no-store\"});\n});\n\napp.post(\"/v1/selftest\",async c=>{\n if(!rootAuthorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const sample=\"rumbo-r2-custody-selftest:\"+crypto.randomUUID();\n const enc=await encryptSecret(sample);\n const dec=await decryptSecret(enc);\n const {privateKey}=generateKeyPairSync(\"rsa\",{modulusLength:2048});\n const pem=privateKey.export({type:\"pkcs8\",format:\"pem\"}).toString();\n const jwt=appJwtFromPem(123456,pem);\n const jwtShape=jwt.split(\".\").length===3;\n const manifest=manifestFor(\"PREVIEW00000000\",\"STATE_PREVIEW\");\n const permissionsExact=canonical(manifest.default_permissions)===canonical({contents:\"read\",pull_requests:\"write\",administration:\"read\"});\n const expectedPermissionSet=exactAppPermissionSet({contents:\"read\",pull_requests:\"write\",administration:\"read\",metadata:\"read\"});\n const extraPermissionRejected=!exactAppPermissionSet({contents:\"read\",pull_requests:\"write\",administration:\"read\",metadata:\"read\",issues:\"read\"});\n const upgradedPermissionRejected=!exactAppPermissionSet({contents:\"write\",pull_requests:\"write\",administration:\"read\",metadata:\"read\"});\n const pass=dec===sample&&jwtShape&&permissionsExact&&expectedPermissionSet&&extraPermissionRejected&&upgradedPermissionRejected&&manifest.public===false&&manifest.hook_attributes.active===false;\n return c.json({\n selftest:pass?\"PASS\":\"FAIL\",\n aes_gcm_roundtrip:dec===sample,\n rsa_app_jwt_shape:jwtShape,\n manifest_permissions_exact:permissionsExact,\n exact_permission_set_accepts_expected:expectedPermissionSet,\n exact_permission_set_rejects_extra:extraPermissionRejected,\n exact_permission_set_rejects_upgrade:upgradedPermissionRejected,\n manifest_private:manifest.public===false,\n webhook_inactive:manifest.hook_attributes.active===false,\n tokens_persisted:false,\n production_go:false\n },pass?200:500,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v1/audit\",async c=>{\n if(!rootAuthorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute(\"SELECT * FROM broker_audit ORDER BY seq ASC\");\n let prev=\"0\".repeat(64),ok=true;\n for(const r of rs.rows as any[]){\n const ev={event_type:r.event_type,object_id:r.object_id,object_sha256:r.object_sha256,prev_event_sha256:r.prev_event_sha256,created_at:r.created_at};\n const h=await sha256Text(canonical(ev));\n if(String(r.prev_event_sha256)!==prev||String(r.event_sha256)!==h)ok=false;\n prev=String(r.event_sha256);\n }\n return c.json({schema:\"rumbo-r2-github-app-broker-audit/v1\",audit_chain_ok:ok,count:rs.rows.length,tail_sha256:prev,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.post(\"/github/webhook\",c=>c.body(null,204));\n\napp.onError((err,c)=>{\n console.error(err);\n return c.json({error:\"INTERNAL_ERROR\",production_go:false},500,{\"Cache-Control\":\"no-store\"});\n});\n\nexport default app.fetch;\n","deleted",false,"label",[14],"44ca72b5-d95b-4859-bf7a-071b0516aa36",["D",1787978449051],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","RUMBO R2 GitHub App custody broker","imageUrl","userId","d3788f19-13c5-4356-87e8-dce639626bb9","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a04116-f28c-754c-9173-77bf5814fcd6","tursoName","44ca72b5d95b4859bf7a071b0516aa36","tursoHostname","44ca72b5d95b4859bf7a071b0516aa36-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789542098478],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_105":101},"org",{"_9":10,"_98":99,"_100":101,"_55":56,"_102":103,"_104":42},"branch",{"_35":88,"_11":89,"_22":28,"_90":45,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":12,"_97":10},"isOwned",24,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","sebas","avatar","https://lh3.googleusercontent.com/a/ACg8ocJaC6uiXPmN9dvgA2XcSlzBSkPJO0GN5zKzPm3a8cbjmXC9HYA=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_81":-5,"_139":140,"_141":142,"_143":144,"_145":42,"_146":42,"_147":42,"_148":32,"_149":-5,"_150":-7,"_151":-7,"_152":62,"_153":42,"_154":42,"_155":-5,"_156":42,"_157":42,"_158":42,"_159":-5},"ENV",{"_110":111,"_112":113,"_114":89,"_115":116,"_117":118,"_119":120,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134,"_135":136,"_137":138},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]