release: v0.22.1

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.22.1
+
+### Patch Changes
+
+- 7dd046c: Harden GitHub Copilot platform-connection handling so malformed saved configuration does not block recovery, platform/default and project-scoped bindings safely clean up or preserve shared credentials, and SQLite-to-Postgres migration carries the platform-default binding forward reliably.
+
 ## 0.22.0
 
 ### Minor Changes

VERSION

@@ -1 +1 @@
-0.22.0
+0.22.1

apps/Agentweaver.Api/Auth/ByokProviderConfigurationService.cs

@@ -1,47 +1,73 @@
-using System.Text.Json;
-using Agentweaver.Domain;
-
-namespace Agentweaver.Api.Auth;
-
-public sealed class ByokProviderConfigurationService(ISecretStore secretStore)
-    : IByokProviderConfigurationProvider
-{
-    private const string SecretName = "byok-provider-configuration";
-
-    public async Task<ByokProviderConfiguration?> GetAsync(CancellationToken ct)
-    {
-        var secret = await secretStore.GetSecretAsync(SecretName, ct).ConfigureAwait(false);
-        return secret.Found && !string.IsNullOrWhiteSpace(secret.Value)
-            ? JsonSerializer.Deserialize<ByokProviderConfiguration>(secret.Value)
-            : null;
-    }
-
-    public async Task SetAsync(ByokProviderConfiguration configuration, CancellationToken ct)
-    {
-        Validate(configuration);
-        await secretStore.SetSecretAsync(
-            SecretName,
-            JsonSerializer.Serialize(configuration),
-            ct: ct).ConfigureAwait(false);
-    }
-
-    public Task ClearAsync(CancellationToken ct) =>
-        secretStore.DeleteSecretAsync(SecretName, ct);
-
-    private static void Validate(ByokProviderConfiguration configuration)
-    {
-        ArgumentNullException.ThrowIfNull(configuration);
-        if (configuration.Type is not ("openai" or "azure" or "anthropic"))
-            throw new ArgumentException("Provider type must be openai, azure, or anthropic.");
-        if (!Uri.TryCreate(configuration.BaseUrl, UriKind.Absolute, out var baseUri) ||
-            baseUri.Scheme != Uri.UriSchemeHttps)
-            throw new ArgumentException("Provider base URL must be an HTTPS URL.");
-        if (configuration.Type == "azure" &&
-            (!string.IsNullOrEmpty(baseUri.PathAndQuery.Trim('/')) || !string.IsNullOrEmpty(baseUri.Fragment)))
-            throw new ArgumentException("Azure provider base URL must be its HTTPS host without an API path.");
-        if (string.IsNullOrWhiteSpace(configuration.Model))
-            throw new ArgumentException("Provider model is required.");
-        if (string.IsNullOrWhiteSpace(configuration.ApiKey))
-            throw new ArgumentException("Provider API key is required.");
-    }
-}
+using System.Text.Json;
+using Agentweaver.Domain;
+
+namespace Agentweaver.Api.Auth;
+
+public sealed class ByokProviderConfigurationService(ISecretStore secretStore)
+    : IByokProviderConfigurationProvider
+{
+    private const string SecretName = "byok-provider-configuration";
+    private static readonly JsonSerializerOptions ReadJsonOptions = new() { PropertyNameCaseInsensitive = true };
+
+    public async Task<ByokProviderConfiguration?> GetAsync(CancellationToken ct)
+    {
+        var secret = await secretStore.GetSecretAsync(SecretName, ct).ConfigureAwait(false);
+        if (!secret.Found || string.IsNullOrWhiteSpace(secret.Value))
+            return null;
+        try
+        {
+            var configuration = JsonSerializer.Deserialize<ByokProviderConfiguration>(secret.Value, ReadJsonOptions);
+            return IsValid(configuration) ? configuration : null;
+        }
+        catch (JsonException)
+        {
+            return null;
+        }
+    }
+
+    public async Task SetAsync(ByokProviderConfiguration configuration, CancellationToken ct)
+    {
+        Validate(configuration);
+        await secretStore.SetSecretAsync(
+            SecretName,
+            JsonSerializer.Serialize(configuration),
+            ct: ct).ConfigureAwait(false);
+    }
+
+    public Task ClearAsync(CancellationToken ct) =>
+        secretStore.DeleteSecretAsync(SecretName, ct);
+
+    private static void Validate(ByokProviderConfiguration configuration)
+    {
+        ArgumentNullException.ThrowIfNull(configuration);
+        if (configuration.Type is not ("openai" or "azure" or "anthropic"))
+            throw new ArgumentException("Provider type must be openai, azure, or anthropic.");
+        if (!Uri.TryCreate(configuration.BaseUrl, UriKind.Absolute, out var baseUri) ||
+            baseUri.Scheme != Uri.UriSchemeHttps)
+            throw new ArgumentException("Provider base URL must be an HTTPS URL.");
+        if (configuration.Type == "azure" &&
+            (!string.IsNullOrEmpty(baseUri.PathAndQuery.Trim('/')) || !string.IsNullOrEmpty(baseUri.Fragment)))
+            throw new ArgumentException("Azure provider base URL must be its HTTPS host without an API path.");
+        if (string.IsNullOrWhiteSpace(configuration.Model))
+            throw new ArgumentException("Provider model is required.");
+        if (string.IsNullOrWhiteSpace(configuration.ApiKey))
+            throw new ArgumentException("Provider API key is required.");
+    }
+
+    private static bool IsValid(ByokProviderConfiguration? configuration)
+    {
+        try
+        {
+            Validate(configuration!);
+            return true;
+        }
+        catch (ArgumentNullException)
+        {
+            return false;
+        }
+        catch (ArgumentException)
+        {
+            return false;
+        }
+    }
+}

apps/Agentweaver.Api/Auth/GitHubConnectionsCredentialVault.cs

@@ -1,85 +1,87 @@
-using System.Text.Json;
-
-namespace Agentweaver.Api.Auth;
-
-/// <summary>Opaque, vault-owned locator for reserved GitHub connections credential material.</summary>
-internal sealed record GitHubConnectionsCredentialLocator
-{
-    private GitHubConnectionsCredentialLocator(string key) => Key = key;
-
-    internal string Key { get; }
-
-    internal static GitHubConnectionsCredentialLocator ForRepoAppUser(string credentialReference) =>
-        Create(credentialReference, "repo-app-user-credential-");
-
-    internal static GitHubConnectionsCredentialLocator ForCopilotProject(string credentialReference) =>
-        Create(credentialReference, "copilot-app-project-");
-
-    internal static GitHubConnectionsCredentialLocator ForCopilotBinding(string credentialReference)
-    {
-        if (string.IsNullOrWhiteSpace(credentialReference) ||
-            (!credentialReference.StartsWith("copilot-app-project-", StringComparison.Ordinal) &&
-             !credentialReference.StartsWith("copilot-app-platform-default-", StringComparison.Ordinal)))
-            throw new ArgumentException("Credential reference is not a reserved GitHub connections locator.", nameof(credentialReference));
-        return new(credentialReference);
-    }
-
-    private static GitHubConnectionsCredentialLocator Create(string credentialReference, string requiredPrefix)
-    {
-        if (string.IsNullOrWhiteSpace(credentialReference) ||
-            !credentialReference.StartsWith(requiredPrefix, StringComparison.Ordinal))
-            throw new ArgumentException("Credential reference is not a reserved GitHub connections locator.", nameof(credentialReference));
-        return new(credentialReference);
-    }
-}
-
-internal interface IGitHubConnectionsCredentialVault
-{
-    Task<SecretGetResult> ReadCurrentAsync(GitHubConnectionsCredentialLocator locator, CancellationToken ct = default);
-    Task WriteAsync(GitHubConnectionsCredentialLocator locator, string value, CancellationToken ct = default);
-    Task TombstoneAndDeleteAsync(GitHubConnectionsCredentialLocator locator, CancellationToken ct = default);
-}
-
-/// <summary>
-/// The sole GitHub connections authority allowed to bridge reserved credential locators to generic secret
-/// storage. Reads are current-version only and tombstones cannot be treated as a credential.
-/// </summary>
-internal sealed class GitHubConnectionsCredentialVault(ISecretStore secretStore) : IGitHubConnectionsCredentialVault
-{
-    private const string Tombstone = """{"status":"revoked"}""";
-
-    public async Task<SecretGetResult> ReadCurrentAsync(GitHubConnectionsCredentialLocator locator, CancellationToken ct = default)
-    {
-        var result = await secretStore.GetSecretAsync(locator.Key, ct).ConfigureAwait(false);
-        return !result.Found || IsTombstone(result.Value) ? SecretGetResult.NotFound : result;
-    }
-
-    public async Task WriteAsync(GitHubConnectionsCredentialLocator locator, string value, CancellationToken ct = default)
-    {
-        if (string.IsNullOrWhiteSpace(value) || IsTombstone(value))
-            throw new ArgumentException("The vault cannot write empty or tombstone credential material.", nameof(value));
-        await secretStore.SetSecretAsync(locator.Key, value, ct: ct).ConfigureAwait(false);
-    }
-
-    public async Task TombstoneAndDeleteAsync(GitHubConnectionsCredentialLocator locator, CancellationToken ct = default)
-    {
-        await secretStore.SetSecretAsync(locator.Key, Tombstone, ct: ct).ConfigureAwait(false);
-        await secretStore.DeleteSecretAsync(locator.Key, ct).ConfigureAwait(false);
-    }
-
-    private static bool IsTombstone(string? value)
-    {
-        if (string.IsNullOrWhiteSpace(value))
-            return false;
-        try
-        {
-            using var document = JsonDocument.Parse(value);
-            return document.RootElement.TryGetProperty("status", out var status) &&
-                   string.Equals(status.GetString(), "revoked", StringComparison.Ordinal);
-        }
-        catch (JsonException)
-        {
-            return false;
-        }
-    }
-}
+using System.Text.Json;
+
+namespace Agentweaver.Api.Auth;
+
+/// <summary>Opaque, vault-owned locator for reserved GitHub connections credential material.</summary>
+internal sealed record GitHubConnectionsCredentialLocator
+{
+    private GitHubConnectionsCredentialLocator(string key) => Key = key;
+
+    internal string Key { get; }
+
+    internal static GitHubConnectionsCredentialLocator ForRepoAppUser(string credentialReference) =>
+        Create(credentialReference, "repo-app-user-credential-");
+
+    internal static GitHubConnectionsCredentialLocator ForCopilotProject(string credentialReference) =>
+        Create(credentialReference, "copilot-app-project-");
+
+    internal static GitHubConnectionsCredentialLocator ForCopilotBinding(string credentialReference)
+    {
+        if (string.IsNullOrWhiteSpace(credentialReference) ||
+            (!credentialReference.StartsWith("copilot-app-project-", StringComparison.Ordinal) &&
+             !credentialReference.StartsWith("copilot-app-platform-default-", StringComparison.Ordinal)))
+            throw new ArgumentException("Credential reference is not a reserved GitHub connections locator.", nameof(credentialReference));
+        return new(credentialReference);
+    }
+
+    private static GitHubConnectionsCredentialLocator Create(string credentialReference, string requiredPrefix)
+    {
+        if (string.IsNullOrWhiteSpace(credentialReference) ||
+            !credentialReference.StartsWith(requiredPrefix, StringComparison.Ordinal))
+            throw new ArgumentException("Credential reference is not a reserved GitHub connections locator.", nameof(credentialReference));
+        return new(credentialReference);
+    }
+}
+
+internal interface IGitHubConnectionsCredentialVault
+{
+    Task<SecretGetResult> ReadCurrentAsync(GitHubConnectionsCredentialLocator locator, CancellationToken ct = default);
+    Task WriteAsync(GitHubConnectionsCredentialLocator locator, string value, CancellationToken ct = default);
+    Task TombstoneAndDeleteAsync(GitHubConnectionsCredentialLocator locator, CancellationToken ct = default);
+}
+
+/// <summary>
+/// The sole GitHub connections authority allowed to bridge reserved credential locators to generic secret
+/// storage. Reads are current-version only and tombstones cannot be treated as a credential.
+/// </summary>
+internal sealed class GitHubConnectionsCredentialVault(ISecretStore secretStore) : IGitHubConnectionsCredentialVault
+{
+    private const string Tombstone = """{"status":"revoked"}""";
+
+    public async Task<SecretGetResult> ReadCurrentAsync(GitHubConnectionsCredentialLocator locator, CancellationToken ct = default)
+    {
+        var result = await secretStore.GetSecretAsync(locator.Key, ct).ConfigureAwait(false);
+        return !result.Found || IsTombstone(result.Value) ? SecretGetResult.NotFound : result;
+    }
+
+    public async Task WriteAsync(GitHubConnectionsCredentialLocator locator, string value, CancellationToken ct = default)
+    {
+        if (string.IsNullOrWhiteSpace(value) || IsTombstone(value))
+            throw new ArgumentException("The vault cannot write empty or tombstone credential material.", nameof(value));
+        await secretStore.SetSecretAsync(locator.Key, value, ct: ct).ConfigureAwait(false);
+    }
+
+    public async Task TombstoneAndDeleteAsync(GitHubConnectionsCredentialLocator locator, CancellationToken ct = default)
+    {
+        await secretStore.SetSecretAsync(locator.Key, Tombstone, ct: ct).ConfigureAwait(false);
+        await secretStore.DeleteSecretAsync(locator.Key, ct).ConfigureAwait(false);
+    }
+
+    private static bool IsTombstone(string? value)
+    {
+        if (string.IsNullOrWhiteSpace(value))
+            return false;
+        try
+        {
+            using var document = JsonDocument.Parse(value);
+            return document.RootElement.ValueKind == JsonValueKind.Object &&
+                   document.RootElement.TryGetProperty("status", out var status) &&
+                   status.ValueKind == JsonValueKind.String &&
+                   string.Equals(status.GetString(), "revoked", StringComparison.Ordinal);
+        }
+        catch (Exception ex) when (ex is JsonException or InvalidOperationException)
+        {
+            return false;
+        }
+    }
+}