♻️ Extract GitHub API utilities and integrate token refresh

.env.template

@@ -24,3 +24,15 @@ SENTRY_ORG=""
 SENTRY_PROJECT=""
 SUPABASE_SERVICE_ROLE_KEY=""
 NEXT_PUBLIC_ALLOWED_DOMAINS=""
+
+# GitHub OAuth token encryption keyring
+# LIAM_GITHUB_OAUTH_KEYRING
+# Usage: AES-256-GCM keyring for encrypting GitHub OAuth tokens in HttpOnly cookies.
+# Format: comma-separated entries "<kid>:<base64key>" — first entry is the current key.
+# - <kid>: recommended format is a readable version like "kYYYY-MM" (e.g., k2025-01)
+# - <base64key>: 32-byte random key, base64-encoded
+# Generate 32-byte key (Node.js):
+#   node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
+# Example (current key first, with a rotated fallback):
+#   LIAM_GITHUB_OAUTH_KEYRING="k2025-01:BASE64_KEY_FOR_2025_01,k2024-12:BASE64_KEY_FOR_2024_12"
+LIAM_GITHUB_OAUTH_KEYRING=""

frontend/apps/app/app/api/github/token/refresh/route.ts

@@ -0,0 +1,143 @@
+import {
+  fromPromise,
+  fromValibotSafeParse,
+  type Result,
+} from '@liam-hq/neverthrow'
+import * as Sentry from '@sentry/nextjs'
+import type { ResultAsync as NeverthrowResultAsync } from 'neverthrow'
+import { err, ok, ResultAsync } from 'neverthrow'
+import { NextResponse } from 'next/server'
+import * as v from 'valibot'
+import type { TokenPayload } from '../../../../../libs/github/cookie'
+import {
+  readRefreshToken,
+  writeAccessToken,
+  writeRefreshToken,
+} from '../../../../../libs/github/cookie'
+
+const getClientCredentials = (): Result<
+  { clientId: string; clientSecret: string },
+  Error
+> => {
+  const clientId = process.env.GITHUB_CLIENT_ID
+  const clientSecret = process.env.GITHUB_CLIENT_SECRET
+  if (!clientId || !clientSecret) {
+    return err(new Error('Missing GitHub OAuth client credentials'))
+  }
+  return ok({ clientId, clientSecret })
+}
+
+type RefreshAccessTokenResult = {
+  accessToken: string
+  refreshToken: string
+  refreshTokenExpiresIn: number
+  newExpiresAt: string
+}
+
+// GitHub OAuth token refresh response schema
+const GitHubTokenRefreshResponseSchema = v.object({
+  access_token: v.string(),
+  token_type: v.string(),
+  scope: v.optional(v.string()),
+  expires_in: v.number(),
+  refresh_token: v.string(),
+  refresh_token_expires_in: v.number(),
+})
+
+function refreshAccessToken(
+  refreshToken: string,
+  clientId: string,
+  clientSecret: string,
+): ResultAsync<RefreshAccessTokenResult, Error> {
+  const body = new URLSearchParams({
+    client_id: clientId,
+    client_secret: clientSecret,
+    grant_type: 'refresh_token',
+    refresh_token: refreshToken,
+  }).toString()
+
+  return ResultAsync.fromPromise(
+    fetch('https://github.com/login/oauth/access_token', {
+      method: 'POST',
+      headers: {
+        Accept: 'application/json',
+        'Content-Type': 'application/x-www-form-urlencoded',
+      },
+      body,
+    }),
+    (e) => (e instanceof Error ? e : new Error(String(e))),
+  )
+    .andThen((res) => {
+      if (!res.ok) {
+        return err(new Error(`GitHub token refresh failed: ${res.status}`))
+      }
+      return ResultAsync.fromPromise<unknown, Error>(res.json(), (e) =>
+        e instanceof Error ? e : new Error(String(e)),
+      )
+    })
+    .andThen((data) =>
+      fromValibotSafeParse(GitHubTokenRefreshResponseSchema, data),
+    )
+    .map((data) => {
+      const now = Date.now()
+      const newExpiresAt = new Date(
+        now + Math.max(0, data.expires_in) * 1000,
+      ).toISOString()
+      const refreshTokenExpiresIn = data.refresh_token_expires_in
+
+      return {
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token,
+        refreshTokenExpiresIn,
+        newExpiresAt,
+      }
+    })
+}
+
+async function handler(): Promise<NextResponse> {
+  // 1) Load client credentials
+  const creds = getClientCredentials()
+  if (creds.isErr()) {
+    Sentry.captureException(creds.error, { tags: { area: 'refresh_api' } })
+    return NextResponse.json(
+      { ok: false, error: 'server_misconfigured' },
+      { status: 500 },
+    )
+  }
+  const { clientId, clientSecret } = creds.value
+
+  // 2) Read refresh token and refresh via GitHub
+  const refreshTokenResult: NeverthrowResultAsync<TokenPayload, Error> =
+    readRefreshToken()
+  const result = await refreshTokenResult
+    .andThen(({ token }: TokenPayload) =>
+      refreshAccessToken(token, clientId, clientSecret),
+    )
+    .andThen((refreshed: RefreshAccessTokenResult) => {
+      const rtei = refreshed.refreshTokenExpiresIn
+      const refreshTtlMs = rtei * 1000
+      const refreshExpiresAt = new Date(Date.now() + refreshTtlMs).toISOString()
+
+      // Ensure cookie writes complete and propagate failures
+      return fromPromise(
+        Promise.all([
+          writeAccessToken(refreshed.accessToken, refreshed.newExpiresAt),
+          writeRefreshToken(refreshed.refreshToken, refreshExpiresAt),
+        ]),
+      ).map(() => NextResponse.json({ ok: true }))
+    })
+
+  if (result.isErr()) {
+    Sentry.captureException(result.error, { tags: { area: 'refresh_api' } })
+    return NextResponse.json(
+      { ok: false, error: 'refresh_failed' },
+      { status: 401 },
+    )
+  }
+
+  return result.value
+}
+
+export async function POST() {
+  return handler()
+}

frontend/apps/app/app/api/logout/route.ts

@@ -0,0 +1,44 @@
+import { fromAsyncThrowable } from '@liam-hq/neverthrow'
+import * as Sentry from '@sentry/nextjs'
+import { NextResponse } from 'next/server'
+import { clearOrganizationIdCookie } from '../../../features/organizations/services/clearOrganizationIdCookie'
+import { createClient } from '../../../libs/db/server'
+import { clearTokens } from '../../../libs/github/cookie'
+
+export async function POST() {
+  const opClearOrg = await fromAsyncThrowable(clearOrganizationIdCookie)()
+  const opClearTokens = await fromAsyncThrowable(clearTokens)()
+  const opSupabaseSignout = await fromAsyncThrowable(async () => {
+    const supabase = await createClient()
+    await supabase.auth.signOut({ scope: 'global' })
+  })()
+
+  let hasError = false
+  if (opClearOrg.isErr()) {
+    hasError = true
+    Sentry.captureException(opClearOrg.error, {
+      tags: { area: 'logout_api', step: 'clear_org_cookie' },
+    })
+  }
+  if (opClearTokens.isErr()) {
+    hasError = true
+    Sentry.captureException(opClearTokens.error, {
+      tags: { area: 'logout_api', step: 'clear_tokens' },
+    })
+  }
+  if (opSupabaseSignout.isErr()) {
+    hasError = true
+    Sentry.captureException(opSupabaseSignout.error, {
+      tags: { area: 'logout_api', step: 'supabase_signout' },
+    })
+  }
+
+  if (hasError) {
+    return NextResponse.json(
+      { ok: false, error: 'logout_failed' },
+      { status: 500 },
+    )
+  }
+
+  return NextResponse.json({ ok: true })
+}

frontend/apps/app/app/auth/callback/[provider]/route.ts

@@ -1,7 +1,13 @@
+import { fromAsyncThrowable } from '@liam-hq/neverthrow'
+import * as Sentry from '@sentry/nextjs'
 import { NextResponse } from 'next/server'
 import { ensureUserHasOrganization } from '../../../../components/LoginPage/services/ensureUserHasOrganization'
 import { sanitizeReturnPath } from '../../../../components/LoginPage/services/validateReturnPath'
 import { createClient } from '../../../../libs/db/server'
+import {
+  writeAccessToken,
+  writeRefreshToken,
+} from '../../../../libs/github/cookie'
 
 export async function GET(request: Request) {
   const { searchParams, origin } = new URL(request.url)
@@ -11,9 +17,44 @@ export async function GET(request: Request) {
 
   if (code) {
     const supabase = await createClient()
-    const { error } = await supabase.auth.exchangeCodeForSession(code)
+    const { data, error } = await supabase.auth.exchangeCodeForSession(code)
     if (!error) {
       await ensureUserHasOrganization()
+      // Persist provider tokens into encrypted HttpOnly cookies (best-effort)
+      const { session } = data
+      const access = session?.provider_token ?? ''
+      const refresh = session?.provider_refresh_token ?? ''
+      // received provider tokens for cookie write
+      // Access token expiration: 8 hours.
+      // GitHub's OAuth access tokens typically expire after 8 hours. See: https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps#step-3-github-redirects-back-to-your-site
+      const EIGHT_HOURS_MS = 8 * 60 * 60 * 1000
+      const THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1000
+
+      await fromAsyncThrowable(async () => {
+        if (access) {
+          const accessExpiresAt = new Date(
+            Date.now() + EIGHT_HOURS_MS,
+          ).toISOString()
+          await writeAccessToken(access, accessExpiresAt)
+        }
+        if (refresh) {
+          const refreshExpiresAt = new Date(
+            Date.now() + THIRTY_DAYS_MS,
+          ).toISOString()
+          await writeRefreshToken(refresh, refreshExpiresAt)
+        }
+      })().match(
+        () => undefined,
+        (e) => {
+          const err = e instanceof Error ? e : new Error(String(e))
+          Sentry.captureException(err, {
+            tags: {
+              area: 'auth_cookie_write',
+            },
+          })
+          return undefined
+        },
+      )
 
       const forwardedHost = request.headers.get('x-forwarded-host')
       const isLocalEnv = process.env.NODE_ENV === 'development'

frontend/apps/app/app/projects/new/page.tsx

@@ -1,8 +1,10 @@
 import { getInstallations } from '@liam-hq/github'
+import { fromPromise } from '@liam-hq/neverthrow'
 import { redirect } from 'next/navigation'
 import { ProjectNewPage } from '../../../components/ProjectNewPage'
 import { getOrganizationId } from '../../../features/organizations/services/getOrganizationId'
 import { createClient } from '../../../libs/db/server'
+import { getUserAccessToken } from '../../../libs/github/token'
 import { urlgen } from '../../../libs/routes'
 
 export default async function NewProjectPage() {
@@ -25,18 +27,36 @@ export default async function NewProjectPage() {
     redirect(urlgen('login'))
   }
 
-  const { data } = await supabase.auth.getSession()
-
-  if (data.session === null) {
-    redirect(urlgen('login'))
-  }
-
-  const { installations } = await getInstallations(data.session)
+  const tokenResult = await getUserAccessToken()
+
+  const { installations, needsRefresh } = await tokenResult
+    .asyncAndThen((token) => {
+      if (!token) {
+        return fromPromise(
+          Promise.resolve({
+            installations: [],
+            needsRefresh: true,
+          }),
+        )
+      }
+      return getInstallations(token).map((result) => ({
+        installations: result.installations,
+        needsRefresh: false,
+      }))
+    })
+    .match(
+      (v) => v,
+      (e) => {
+        console.error('Failed to get token or installations:', e)
+        return { installations: [], needsRefresh: true }
+      },
+    )
 
   return (
     <ProjectNewPage
       installations={installations}
       organizationId={organizationId}
+      needsRefresh={needsRefresh}
     />
   )
 }

frontend/apps/app/components/CommonLayout/AppBar/UserDropdown.tsx

@@ -1,5 +1,5 @@
 'use client'
-
+import { fromAsyncThrowable } from '@liam-hq/neverthrow'
 import {
   Avatar,
   AvatarWithImage,
@@ -13,7 +13,6 @@ import {
 } from '@liam-hq/ui'
 import { useRouter } from 'next/navigation'
 import { type FC, useCallback } from 'react'
-import { createClient } from '../../../libs/db/client'
 
 function getUserInitial({
   userName,
@@ -40,38 +39,28 @@ type Props = {
   userEmail?: string | null
 }
 
-// Helper function to delete cookie
-const deleteCookie = (name: string) => {
-  const expires = 'Thu, 01 Jan 1970 00:00:00 UTC'
-  const cookie = `${name}=; expires=${expires}; path=/;`
-  // biome-ignore lint/suspicious/noDocumentCookie: Required for cookie deletion
-  document.cookie = cookie
-}
-
 export const UserDropdown: FC<Props> = ({ avatarUrl, userName, userEmail }) => {
   const toast = useToast()
   const router = useRouter()
 
   const userInitial = getUserInitial({ userName, userEmail })
 
   const handleLogout = useCallback(async () => {
-    // Perform logout on client side
-    const supabase = createClient()
-    const { error } = await supabase.auth.signOut()
+    const result = await fromAsyncThrowable(async () =>
+      fetch('/api/logout', { method: 'POST', cache: 'no-store' }),
+    )()
 
-    if (!error) {
-      // Delete organizationId cookie
-      deleteCookie('organizationId')
-
-      // Redirect with success parameter
+    if (result.isOk() && result.value.ok) {
       router.push('/login?logout=success')
-    } else {
-      toast({
-        title: 'Logout failed',
-        description: error.message || 'An error occurred during logout.',
-        status: 'error',
-      })
+      return
     }
+
+    // If fetch failed or response not OK, show error
+    toast({
+      title: 'Logout failed',
+      description: 'Unable to complete logout. Please try again.',
+      status: 'error',
+    })
   }, [toast, router])
 
   return (