[Copilot]

Why

GitHub authentication proves who a person is, but it should not decide whether that person may enter a Hub installation. Hub needs its own durable membership boundary so installation access and administration remain stable when repository permissions change.

What changes

Hub now admits a signed-in identity only when it has an active membership, matches a usable invitation, or completes authorized bootstrap or recovery enrollment. Administrators can invite immutable provider identities, assign member or administrator roles, move memberships through active, suspended, and removed states, and page through retained membership and invitation history.

Suspending or removing a member ends that person's Hub sessions. Hub prevents concurrent changes from removing the final active administrator, supports one-use bootstrap and no-administrator recovery, and records successful and denied administration outcomes as structured security audits. State-changing APIs enforce the Hub origin, CSRF protection, membership checks, and private no-store responses.

The minimal interface adds first-administrator enrollment, recovery, invitation management, and membership administration. This layer does not add prototype authorization, GitHub membership synchronization, artifact ingestion, or production OIDC.

Storybook screenshots

Hub/Pages/Identity/Membership administration / Default — dark theme, 1280 × 720

Hub/Pages/Identity/Membership administration / More Records Available — dark theme, 1280 × 720

Hub/Pages/Identity/Membership administration / Invitation History — dark theme, 1280 × 720

Hub/Pages/Identity/Sign in / Signed Out — enrollment and recovery expanded, dark theme, 1280 × 720

Hub/Pages/Identity/Sign in / Signed In — dark theme, 1280 × 720

Hub/Pages/Identity/Sign in / Unconfigured — dark theme, 1280 × 720

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill.

An enterprise owner can allow the organization to be billed for reviews like this by enabling Copilot code review for users without a license.

[Copilot]

🟡 Changes recommended

Bootstrap and recovery callbacks fail at runtime, the administration page fails type checking, and unresolved admission and audit defects affect access control and accountability.

17 open issues

• Use a supported Primer Button variant · New
• Allow bootstrap and recovery authorization attempts · New
• Restart verification after fresh authorization expires · New
• Clear cached administration state after authorization failure · New
• Default invitations to the least-privileged member role · New
• Test migrations and update lifecycle fixtures · New
• Backfill existing audit outcomes after adding success default · New
• Reject future authorization timestamps · New
• Validate invitation IDs before querying · New
• Validate membership IDs before querying · New
• Audit denied administration requests · New
• Preserve suspension time during role changes · New
• Audit both role and status changes · New
• Check Hub admission before calling external repository policy · New
• Do not skip invitation lookup after repository admission · New
• Paginate membership administration results · New
• Paginate invitation history or separate pending invitations · New

_{Review effort: Max}

[Copilot]

🟡 Changes recommended

Administrative mutations can exceed session-freshness limits, invitation replacement can fail at expiry boundaries, and critical enrollment and membership behaviors lack test coverage.

11 open issues

• Display authentication callback failure messages · New
• Clear stale administration state after authorization failures · New
• Distinguish expired invitations from revoked invitations · New
• Revalidate authorization freshness inside mutation transactions · New
• Add successful invitation flow database coverage · New
• Use one timestamp for invitation expiry cleanup and lookup · New
• Verify member removal revokes sessions and blocks restoration · New
• Verify bootstrap completion prevents repeat enrollment · New
• Audit legacy repository membership grants · New
• Add invitation activation boundary coverage · New
• Add enrollment route security and cookie coverage · New

17 resolved since last review

• Allow bootstrap and recovery authorization attempts
• Use a supported Primer Button variant
• Paginate invitation history or separate pending invitations
• Paginate membership administration results
• Do not skip invitation lookup after repository admission
• Check Hub admission before calling external repository policy
• Audit both role and status changes
• Preserve suspension time during role changes
• Audit denied administration requests
• Validate membership IDs before querying
• Validate invitation IDs before querying
• Reject future authorization timestamps
• Backfill existing audit outcomes after adding success default
• Test migrations and update lifecycle fixtures
• Default invitations to the least-privileged member role
• Clear cached administration state after authorization failure
• Restart verification after fresh authorization expires

_{Review effort: Max}

[Copilot]

🟡 Changes recommended

Outstanding invitations can restore removed users’ access, and startup with invalid secrets can commit a provider revision that breaks authentication callbacks for the running instance.

4 open issues

• Revoke invitations when removing a user's identities · New
• Validate credentials before committing provider revisions · New
• Use a controlled invitation expiry in time-sensitive tests · New
• Extract administration operations into standalone functions · New

11 resolved since last review

• Add enrollment route security and cookie coverage
• Add invitation activation boundary coverage
• Audit legacy repository membership grants
• Verify bootstrap completion prevents repeat enrollment
• Verify member removal revokes sessions and blocks restoration
• Use one timestamp for invitation expiry cleanup and lookup
• Add successful invitation flow database coverage
• Revalidate authorization freshness inside mutation transactions
• Distinguish expired invitations from revoked invitations
• Clear stale administration state after authorization failures
• Display authentication callback failure messages

_{Review effort: Max}

[nshki]

Thanks for adding this layer, @alliscode! Just based on screenshots alone, this PR would benefit a lot from visual cleanup. Buttons aren't aligned in some places and I believe there are more standard patterns we can be using for the actual user management views.

Happy to discuss if needed.