Make grant minting idempotent too; centralize the trigger-name string

Gates mintRepoGrant on a new hasRepoGrant port, checked independently
of hasWebhookTrigger, so a retry after a failure between the two steps
mints only whichever one the failed attempt didn't finish rather than
re-minting a grant that already exists. apps/hub's hasRepoGrant binds
to a read against the same grant table mintRepoGrant inserts into.

Also pulls the "<repo> pull-request-opened" trigger-name convention
into one exported webhookTriggerName helper, used by both the create
and the lookup in apps/hub, so they read the same string by
construction instead of by two hand-kept copies of it.

Documents, rather than changes, that a trigger is never disabled or
deleted on GitHub disconnect: re-adding a repo after a reconnect finds
its old trigger still live and is skipped, not re-created.

Fixes CL-7134.

Author: TheGreatAxios

apps/hub/src/index.ts

@@ -174,6 +174,7 @@ import {
   isAutomatableWorkflowName,
   isConversationalWorkflowName,
   validateTriggerFieldsAtCreate,
+  webhookTriggerName,
   workflowCatalogEntry,
   workflowDisplayName,
   workbenchTemplateLibraryEntries,
@@ -2172,6 +2173,17 @@ export async function createHub(config: HubConfig) {
         });
         return row?.id;
       },
+      hasRepoGrant: async (tenantId, repo) => {
+        const existing = await db.query.grant.findFirst({
+          where: and(
+            eq(grantTable.tenantId, tenantId),
+            eq(grantTable.resource, `repo:${repo.name}`),
+            eq(grantTable.action, "read"),
+          ),
+          columns: { id: true },
+        });
+        return existing !== undefined;
+      },
       mintRepoGrant: async (tenantId, repo) => {
         const memberRole = await db.query.role.findFirst({
           where: and(
@@ -2207,7 +2219,7 @@ export async function createHub(config: HubConfig) {
         const row = await webhookTriggerStore.create({
           id: generateId("workflowRun"),
           tenantId,
-          name: `${repo.name} pull-request-opened`,
+          name: webhookTriggerName(repo),
           workflowDefinitionId: codeReviewDefinitionId,
           inputTemplate: `Review the pull request at {{pull_request.html_url}}`,
           secret: generateWebhookSecret(),
@@ -2217,7 +2229,7 @@ export async function createHub(config: HubConfig) {
       },
       hasWebhookTrigger: async (tenantId, codeReviewDefinitionId, repo) => {
         const triggers = await webhookTriggerStore.list(tenantId);
-        const triggerName = `${repo.name} pull-request-opened`;
+        const triggerName = webhookTriggerName(repo);
         return triggers.some(
           (trigger) =>
             trigger.workflowDefinitionId === codeReviewDefinitionId &&

packages/workflow-catalog/src/connect-github-routes.ts

@@ -84,6 +84,11 @@ export type ConnectGithubRoutesDeps = {
    * `undefined` when the template's own workflow was never deployed for
    * this tenant (a create-flow bug, not something this route can fix). */
   resolveCodeReviewDefinitionId(tenantId: string): Promise<string | undefined>;
+  /** True once this repo already has the `repo:<owner/name>` grant — see
+   * `./connect-github-setup.ts`'s `ConnectGithubSetupPorts.hasRepoGrant`
+   * for why this makes a retry between minting the grant and creating
+   * the trigger safe. */
+  hasRepoGrant(tenantId: string, repo: GitHubRepoSummary): Promise<boolean>;
   /** Mints the `repo:<owner/name>`-scoped grant a launched review run
    * needs to read this repo — see `./connect-github-setup.ts`'s
    * `ConnectGithubSetupPorts.mintRepoGrant` for the exact resource shape. */
@@ -281,6 +286,7 @@ export function createConnectGithubRoutes(
         const introductionsAlreadyPosted =
           settingsBefore.selectedRepos.length > 0;
         const result = await startReviewingRepos(body.repoIds, state.repos, {
+          hasRepoGrant: (repo) => deps.hasRepoGrant(tenant.id, repo),
           mintRepoGrant: (repo) => deps.mintRepoGrant(tenant.id, repo),
           createWebhookTrigger: (repo) =>
             deps.createWebhookTrigger(

packages/workflow-catalog/src/connect-github-setup.ts

@@ -8,6 +8,17 @@
 import type { GitHubRepoSummary } from "@corbits/github-tools";
 
 export interface ConnectGithubSetupPorts {
+  /**
+   * True once this repo already has the `repo:<repo.name>` grant —
+   * checked before minting one, so a retry after a failure between
+   * minting the grant and creating the trigger never mints a second
+   * grant for a repo that already has one. The `grant` table
+   * (`vendor/intx/db`) carries no unique constraint over
+   * tenant/resource/action, so this read is the only thing standing
+   * between a retry and a duplicate row. A host binds this to a read
+   * against the same `grant` table `mintRepoGrant` inserts into.
+   */
+  hasRepoGrant(repo: GitHubRepoSummary): Promise<boolean>;
   /**
    * Mints one grant scoped to `repo:<repo.name>` (the `owner/name` full
    * name — the same `"<type>:<id>"` resource-string shape
@@ -28,11 +39,15 @@ export interface ConnectGithubSetupPorts {
   ): Promise<{ readonly id: string }>;
   /**
    * True once this repo already has a live webhook trigger — checked
-   * before minting anything for it, so a retry after a mid-loop failure
-   * (a repo 1..N-1 already set up, N onward not) never mints a second
-   * grant or trigger for the repos a prior attempt already finished. A
-   * host binds this to a read against `@corbits/webhook-triggers`'
-   * `WebhookTriggerStore.list`.
+   * before creating one, so a retry after a mid-loop failure (a repo
+   * 1..N-1 already set up, N onward not) never mints a second trigger
+   * for a repo a prior attempt already finished. A host binds this to a
+   * read against `@corbits/webhook-triggers`' `WebhookTriggerStore.list`.
+   *
+   * This is never cleared on GitHub disconnect: nothing here disables or
+   * deletes a trigger, so re-adding a repo after a reconnect finds its
+   * old trigger still live and skips it rather than minting a new one —
+   * intentional, not a gap this module owns closing.
    */
   hasWebhookTrigger(repo: GitHubRepoSummary): Promise<boolean>;
   /**
@@ -57,9 +72,13 @@ export interface StartReviewingReposResult {
  * is a bug in how the connect card's own selection state was built, not
  * something to silently drop.
  *
- * Idempotent by construction: a repo `ports.hasWebhookTrigger` already
- * reports true for is skipped entirely, so retrying after a mid-loop
- * failure only mints for the repos the failed attempt never reached.
+ * Idempotent by construction: the grant and the trigger are each gated
+ * on their own existence check, independently, rather than one check
+ * guarding both — a retry after a failure between minting the grant and
+ * creating the trigger must still create the trigger without re-minting
+ * the grant, and a retry after a failure before the grant was minted
+ * must still mint it. A repo both checks already report true for is
+ * skipped entirely.
  */
 export async function startReviewingRepos(
   repoIds: readonly string[],
@@ -79,10 +98,12 @@ export async function startReviewingRepos(
 
   const createdTriggerIds: string[] = [];
   for (const repo of selected) {
+    if (!(await ports.hasRepoGrant(repo))) {
+      await ports.mintRepoGrant(repo);
+    }
     if (await ports.hasWebhookTrigger(repo)) {
       continue;
     }
-    await ports.mintRepoGrant(repo);
     const trigger = await ports.createWebhookTrigger(repo);
     createdTriggerIds.push(trigger.id);
   }
@@ -91,3 +112,14 @@ export async function startReviewingRepos(
 
   return { createdTriggerIds };
 }
+
+/**
+ * The one place the `webhook_trigger.name` convention for a repo's
+ * pull-request-opened trigger is spelled out — both
+ * `createWebhookTrigger`'s insert and `hasWebhookTrigger`'s lookup bind
+ * against this, in `apps/hub`, so the two can never drift into matching
+ * different strings.
+ */
+export function webhookTriggerName(repo: GitHubRepoSummary): string {
+  return `${repo.name} pull-request-opened`;
+}

packages/workflow-catalog/src/index.ts

@@ -45,6 +45,7 @@ export {
 } from "./settings";
 export {
   startReviewingRepos,
+  webhookTriggerName,
   type ConnectGithubSetupPorts,
   type StartReviewingReposResult,
 } from "./connect-github-setup";