Function stepInstallation

scripts/dev-github-reconcile.cjs:120–169

(client)

}

async function stepInstallation(client) {
  const secret = need('RUNNING_SECRET');
  const org = await orgUuid(client);
  const live = await listInstallations();
  const liveIds = new Set((Array.isArray(live) ? live : []).map((i) => String(i.id)));

  const existing = await client.query(
    "SELECT encode(encrypted_installation_id,'hex') AS hex FROM github_app_installations WHERE organization_uuid=$1", [org]);
  if (existing.rows.length) {
    try {
      const cur = decrypt(Buffer.from(existing.rows[0].hex, 'hex'), secret);
      if (liveIds.has(String(cur))) {
        console.log(`OK: installation row already valid (id=${cur}, decrypts, live)`);
        return;
      }
      console.log(`reconcile: stored id ${cur} is stale (not a live installation) — refreshing`);
    } catch (_) {
      console.log('reconcile: stored installation id will not decrypt with the running secret — refreshing');
    }
  } else {
    console.log('reconcile: no installation row for this org — creating');
  }

  const inst = await pickInstallation();
  const id = String(inst.id);
  const enc = encrypt(id, secret);
  if (decrypt(enc, secret) !== id) throw new Error('round-trip check failed');

  if (existing.rows.length) {
    await client.query(
      'UPDATE github_app_installations SET encrypted_installation_id=$1, updated_at=now() WHERE organization_uuid=$2',
      [enc, org]);
  } else {
    const u = await client.query(
      "SELECT u.user_uuid FROM users u JOIN emails e ON e.user_id=u.user_id WHERE e.email='demo@lightdash.com' LIMIT 1");
    const userUuid = u.rows[0] && u.rows[0].user_uuid;
    if (!userUuid) throw new Error('demo user not found for created_by');
    // auth_token/refresh_token are varchar (NOT NULL) and only affect PR authorship,
    // never the token mint — a plain string placeholder is correct here. Binding an
    // encrypted Buffer would send binary bytes into a UTF8 text column and fail.
    const placeholder = 'placeholder';
    await client.query(
      `INSERT INTO github_app_installations
         (organization_uuid, encrypted_installation_id, auth_token, refresh_token,
          created_by_user_uuid, updated_by_user_uuid, created_at, updated_at)
       VALUES ($1,$2,$3,$3,$4,$4,now(),now())`,
      [org, enc, placeholder, userUuid]);
  }
  console.log(`OK: installation row set to id=${id} (account=${inst.account && inst.account.login}, repos=${inst.repository_selection})`);
}

async function stepOrgSettings(client, kvs) {
  const org = await orgUuid(client);