feat: platform-default GitHub Copilot connection + first-run AI lockout - #1063
Merged
Conversation
Adds the deferred Part A of plan item 10: - New PlatformDefaultCopilotBindingService (parallel to, does not modify, the existing project-scoped ProjectCopilotBindingService): lets a PlatformAdmin explicitly connect one deployment-wide GitHub Copilot account via a real OAuth flow to the existing Copilot App, isolated callback route/cookie/state from the per-project flow. - New singleton PlatformDefaultCopilotBindingRecord + dual (SQLite + Postgres) EF migrations. - New PlatformAdmin-gated endpoints: begin/callback/status/disconnect. - /api/auth/session now reports ai_configured (BYOK config OR a usable platform-default Copilot binding). - App.tsx: signed-in users are blocked behind a full-page setup screen until AI is configured platform-wide. A PlatformAdmin sees the Platform Settings page (to fix it); everyone else sees a plain 'contact your administrator' message. Also adds a related fix: a signed-in user with zero platform roles now sees a clear 'access denied' message instead of a broken, permission-less app shell. - PlatformSettingsPage.tsx: adds a connect/status/disconnect UI for the platform-default Copilot account, alongside the existing BYOK form. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16
sabbour
enabled auto-merge (squash)
August 31, 2026 19:31
sabbour
added a commit
that referenced
this pull request
Aug 31, 2026
PR #1063 added new platform-default Copilot docs using the generic phrase 'GitHub OAuth app', which trips the fleet-oauth-surfaces legacy-terminology guard test. Reworded to 'Copilot App' (matches the rest of the doc's terminology) with no meaning change. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16
sabbour
added a commit
that referenced
this pull request
Aug 31, 2026
…cs (#1065) PR #1063 added new platform-default Copilot docs using the generic phrase 'GitHub OAuth app', which trips the fleet-oauth-surfaces legacy-terminology guard test (Node toolchain tests were skipped on that PR due to path-based CI gating, so this wasn't caught until the release promotion PR ran the full suite). Reworded to 'Copilot App' with no meaning change. Co-authored-by: sabbour <sabbour@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Ships the deferred Part A of plan item 10 (github-onboarding-ux-plan.md): a way for a Platform Admin to connect one deployment-wide GitHub Copilot account, plus a first-run lockout screen so the app doesn't run in a half-configured state.
Changes
Verification
pm run build\ (web): clean.
Note on a known, bounded trade-off
The OAuth completion for the platform-default connection does not re-check the caller still holds the PlatformAdmin role at completion time (the project-scoped equivalent does re-check ownership at completion, because project ownership is a persisted, revocable DB row). Platform roles here come from Entra App Role claims, and there is no persisted platform-role-assignment store anywhere in this codebase to re-check against without adding a live Entra Graph call — so this mirrors the codebase's existing trust model for that kind of check. This leaves a narrow (bounded to the ~10-minute OAuth transaction lifetime) race if a PlatformAdmin is demoted mid-flow. Flagging for visibility, not blocking.