feat(hub): add Copilot connection administration by alliscode · Pull Request #232 · github/replica

alliscode · 2026-11-12T20:45:02Z

Why

Hub needs one deployment-level Copilot connection that administrators can verify and control without storing the operator's token. The rebuilt Hub retained the page but did not have real APIs, durable state, fresh authorization, or audit behavior behind it.

What changes

Administrators can inspect, connect, recheck, and disconnect Copilot through /settings/copilot. Each change requires explicit confirmation and fresh authorization through the current GitHub, Entra, or local session provider.

Hub checks REPLICA_COPILOT_TOKEN through the Copilot SDK, stores only its digest and connection provenance, and rejects stale overlapping changes. Losing the connector's final effective administrator source disconnects the connection in the same authority transaction. No rebuilt Hub product feature consumes the connection yet.

Storybook screenshots

Hub/Pages/Security/Copilot / Not Connected — dark theme, 1280×720

Hub/Pages/Security/Copilot / No Token — dark theme, 1280×720

Hub/Pages/Security/Copilot / Connected — dark theme, 1280×720

Hub/Pages/Security/Copilot / Refused — dark theme, 1280×720

Hub/Pages/Security/Copilot / Access Removed — dark theme, 1280×720

Copilot

🟡 Changes recommended

Unresolved critical flaws can bypass Copilot authorization freshness and generation safeguards and leave connections active after administrator authority is lost.

11 open issues

1 file not reviewed

hub/package-lock.json: Generated file

What changed in this PR

Adds deployment-level Copilot connection administration to Hub’s existing settings and fresh-authorization flows. This establishes connection readiness for future features; no rebuilt Hub product feature consumes the connection yet.

Changes:

Adds connection APIs, SDK token checks, durable provenance, generation guards and security audits.
Connects /settings/copilot to live APIs and provider authorization, with confirmation and cancellation.
Extends authority-loss cleanup, database coverage, stories and operator documentation.

File	Description
`hub/test/database/reset-database/index.ts`	Seeds connection state during database resets.
`hub/server/routes/index.ts`	Registers connection and authorization endpoints.
`hub/server/routes/api/security-audits/present-security-audit/index.ts`	Presents Copilot audit records.
`hub/server/routes/api/copilot-connection/index.test.ts`	Covers administrator-only connection APIs.
`hub/server/routes/api/copilot-connection/get/index.ts`	Returns connection status and provenance.
`hub/server/routes/api/copilot-connection/authorizations/start/post/index.ts`	Starts confirmed provider authorization.
`hub/server/routes/api/copilot-connection/authorizations/get/index.ts`	Returns verified confirmation details.
`hub/server/routes/api/copilot-connection/authorizations/continue/post/index.ts`	Applies changes and maps domain errors.
`hub/server/routes/api/copilot-connection/authorizations/cancel/post/index.ts`	Cancels session-bound authorizations.
`hub/server/routes/api/auth/types.ts`	Defines Copilot route dependency contracts.
`hub/server/routes/api/auth/index.test.ts`	Checks Copilot callback redirection.
`hub/server/routes/api/auth/create-authentication-route-dependencies/index.ts`	Wires token checks, state and auditing.
`hub/server/routes/api/auth/callback/get/index.ts`	Directs verified changes to Copilot confirmation.
`hub/server/routes/api/administrators/read-administrator-session/index.ts`	Shares administrator session lookup.
`hub/server/routes/api/administrators/authorizations/start/rate-limit/index.ts`	Reuses authorization-start rate limiting.
`hub/server/repositories/sensitive-authorizations/verify-sensitive-authorization/index.ts`	Recognizes Copilot authorization operations.
`hub/server/repositories/sensitive-authorizations/lock-sensitive-authorization/index.ts`	Reads expected generation under lock.
`hub/server/repositories/sensitive-authorizations/get-sensitive-authorization/index.ts`	Reads connection-generation metadata.
`hub/server/repositories/sensitive-authorizations/get-sensitive-authorization-audit-data/index.ts`	Supports Copilot authorization audit data.
`hub/server/repositories/sensitive-authorizations/create-sensitive-authorization/index.ts`	Stores generation-bound authorizations.
`hub/server/repositories/sensitive-authorizations/cancel-sensitive-authorization/index.ts`	Scopes cancellation by operation family.
`hub/server/repositories/security-audits/parse-security-audit-event/types.ts`	Includes parsed Copilot audit events.
`hub/server/repositories/security-audits/parse-security-audit-event/index.ts`	Validates Copilot audit payloads.
`hub/server/repositories/security-audits/get-security-audit-data/index.ts`	Maps Copilot events to stored audits.
`hub/server/repositories/security-audits/create-security-audit/types.ts`	Defines Copilot audit contracts.
`hub/server/repositories/copilot-connection-state/save-copilot-connection-state/index.ts`	Saves changes and advances generation.
`hub/server/repositories/copilot-connection-state/lock-copilot-connection-state/index.ts`	Locks global connection state.
`hub/server/repositories/copilot-connection-state/get-copilot-connection-state/index.ts`	Reads connector identity and verification data.
`hub/server/repositories/copilot-connection-state/disconnect-copilot-connection-without-effective-administrator/index.ts`	Clears connections without administrator authority.
`hub/server/repositories/copilot-connection-state/disconnect-copilot-connection-for-membership/index.ts`	Disconnects a specified connector membership.
`hub/server/integrations/copilot/check-copilot-token/index.ts`	Checks configured credentials through the SDK.
`hub/server/integrations/copilot/check-copilot-token/errors.ts`	Distinguishes refusal from unavailable checks.
`hub/server/domains/identity/run-provider-revision-transaction/types.ts`	Adds reconciliation cleanup dependency.
`hub/server/domains/identity/run-provider-revision-transaction/index.ts`	Wires cleanup into provider reconciliation.
`hub/server/domains/identity/reconcile-authentication-providers/index.ts`	Audits authority-loss disconnections.
`hub/server/domains/identity/reconcile-authentication-providers/index.test.ts`	Covers reconciliation cleanup orchestration.
`hub/server/domains/copilot-connection/errors.ts`	Defines connection denial and outage errors.
`hub/server/domains/copilot-connection/copilot-connection.db.test.ts`	Covers persistence, conflicts and one-use authorization.
`hub/server/domains/copilot-connection/continue-copilot-authorization/index.ts`	Coordinates verification and guarded connection changes.
`hub/server/domains/admission/run-admission-transaction/types.ts`	Adds connection cleanup dependency.
`hub/server/domains/admission/run-admission-transaction/index.ts`	Wires membership-scoped connection cleanup.
`hub/server/domains/admission/provider-role-loss.db.test.ts`	Covers connector authority-loss outcomes.
`hub/server/domains/admission/apply-provider-assignment-evidence/index.ts`	Adds cleanup after administrator-source loss.
`hub/server/domains/administrator-management/run-administrator-management-transaction/types.ts`	Adds connector cleanup contract.
`hub/server/domains/administrator-management/revoke-hub-administrator-with-repositories/index.ts`	Disconnects when connector authority ends.
`hub/server/domains/administrator-management/create-administrator-management-repositories/index.ts`	Wires cleanup into administrator management.
`hub/server/domains/administrator-management/administrator-management.db.test.ts`	Tests disconnection and retained authority.
`hub/server/domains/administrator-authorization/verify-administrator-authorization/index.ts`	Returns verified operations for callback routing.
`hub/server/domains/administrator-authorization/administrator-authorization.db.test.ts`	Updates verification and cancellation expectations.
`hub/schema/sensitive-authorization.prisma`	Adds expected connection generation.
`hub/schema/sensitive-authorization-operation.enum.prisma`	Adds connect and disconnect operations.
`hub/schema/migrations/20261112170100_copilot_connection_state/migration.sql`	Creates global state and generation constraints.
`hub/schema/migrations/20261112170000_copilot_connection/migration.sql`	Extends the authorization operation enum.
`hub/schema/membership.prisma`	Relates memberships to connection provenance.
`hub/schema/copilot-connection-state.prisma`	Models durable deployment-level connection state.
`hub/package.json`	Moves the SDK to runtime dependencies.
`hub/package-lock.json`	Aligns SDK runtime dependency metadata.
`hub/docs/README.md`	Links the connection administration guide.
`hub/docs/copilot.md`	Documents configuration, lifecycle and credential safety.
`hub/docs/authentication.md`	Documents Copilot authorization endpoints and flow.
`hub/docs/architecture.md`	Describes the connection foundation and non-goals.
`hub/client/pages/copilot-connection-page/stories.tsx`	Refreshes connection states and confirmation copy.
`hub/client/pages/copilot-connection-page/index.tsx`	Supports disabling actions while authorization starts.
`hub/client/pages/copilot-connection-page/index.test.tsx`	Updates confirmation and status assertions.
`hub/client/application/hub/view-models/administrator-workspace/index.ts`	Adds Copilot navigation and section selection.
`hub/client/application/hub/routes/settings-routes.ts`	Adds the callback confirmation route.
`hub/client/application/hub/routes/settings-copilot/index.tsx`	Loads live state and starts confirmed changes.
`hub/client/application/hub/routes/settings-copilot-authorization/index.tsx`	Continues or cancels verified changes.
`hub/client/application/hub/routes/administrator-flow.test.tsx`	Exercises frontend connection API integration.
`hub/client/application/hub/requests/start-copilot-authorization/index.ts`	Posts confirmed authorization requests.
`hub/client/application/hub/requests/get-copilot-connection/index.ts`	Fetches typed connection state.
`hub/client/application/hub/requests/get-copilot-authorization/index.ts`	Fetches typed confirmation details.
`hub/client/application/hub/requests/continue-copilot-authorization/index.ts`	Posts verified connection changes.
`hub/client/application/hub/requests/cancel-copilot-authorization/index.ts`	Posts authorization cancellation.
`hub/client/application/hub/copilot-connection-contracts/index.ts`	Validates connection and authorization responses.
`hub/.env.example`	Documents the optional operator-provided token.

_{Review effort: Max (auto)}

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

alliscode requested review from a team and nshki as code owners November 12, 2026 20:45

Copilot AI dynamic review requested due to automatic review settings November 12, 2026 20:45

Copilot started reviewing on behalf of alliscode November 12, 2026 20:45

View session

Copilot AI reviewed Nov 12, 2026

View reviewed changes

Ben Thomas and others added 7 commits November 12, 2026 15:57

feat(hub): add Copilot connection administration

0752666

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

test(hub): cover Copilot connection administration

c82c1f9

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

test(hub): reset Copilot connection database state

3c7cd83

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

refactor(hub): use Prisma for Copilot state writes

398d760

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

fix(hub): support local Copilot authorization

54127aa

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

fix(hub): align Copilot connection lifecycle

a0dd978

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

fix(hub): address Copilot connection review

2662192

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

alliscode force-pushed the alliscode-copilot-connections branch from b162e19 to 2662192 Compare November 13, 2026 00:07

Navigation Menu

Repository navigation

feat(hub): add Copilot connection administration - #232

feat(hub): add Copilot connection administration#232
alliscode wants to merge 7 commits into
build/hub/newfrom
alliscode-copilot-connections

alliscode commented Nov 12, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

alliscode commented Nov 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What changes

Storybook screenshots

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

alliscode commented Nov 12, 2026 •

edited

Loading