fix(webhook): reconcile org identity by immutable account id, not slug

Org rows were looked up and mutated by githubOrgSlug (mutable) everywhere,
so a GitHub org rename or installation remove/re-add couldn't be reconciled:
the old row became unreachable and a duplicate empty org row was created
on the next installation webhook, orphaning its CLA text/signatures/bypass
list.

Add an `organization` webhook handler for action:"renamed" and harden
handleInstallation/handleInstallationRepositories to resolve orgs by the
existing (but unused) immutable githubAccountId first, reconciling a stale
slug before any slug-keyed read/write.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: tonythethompson

app/api/webhook/github/route.ts

@@ -11,6 +11,8 @@ import { type NextRequest, NextResponse } from "next/server"
 import { getGitHubClient, upsertMockPullRequest } from "@/lib/github"
 import {
   getOrganizationBySlug,
+  getOrganizationByGithubAccountId,
+  updateOrganizationSlug,
   isBypassAccountForOrg,
   getSignatureStatusByGithubId,
   getSignatureStatusByUsername,
@@ -116,6 +118,14 @@ type CheckSuitePayload = {
   }
 }
 
+type OrganizationPayload = {
+  action?: string
+  organization?: {
+    id?: number
+    login?: string
+  }
+}
+
 type PingPayload = {
   zen?: string
   hook_id?: number
@@ -178,6 +188,10 @@ export async function POST(request: NextRequest) {
     return handleInstallationRepositories(payload as InstallationPayload)
   }
 
+  if (event === "organization") {
+    return handleOrganization(payload as OrganizationPayload)
+  }
+
   if (event === "pull_request") {
     const prPayload = payload as PullRequestPayload
     const action = prPayload.action
@@ -894,6 +908,15 @@ async function handleInstallation(payload: InstallationPayload) {
     return NextResponse.json({ error: "Missing installation account login" }, { status: 400 })
   }
 
+  // Reconcile a renamed account before doing any slug-keyed lookup below --
+  // the account id is immutable, the login/slug is not.
+  const existingByAccountId = accountId
+    ? await getOrganizationByGithubAccountId(String(accountId))
+    : undefined
+  if (existingByAccountId && existingByAccountId.githubOrgSlug !== orgSlug) {
+    await updateOrganizationSlug(existingByAccountId.id, orgSlug)
+  }
+
   if (payload.action === "created" || payload.action === "unsuspend") {
     let adminUserId = "user_1"
     if (payload.sender?.login && payload.sender?.id) {
@@ -909,7 +932,7 @@ async function handleInstallation(payload: InstallationPayload) {
       return NextResponse.json({ error: "Missing installation sender info" }, { status: 400 })
     }
 
-    const existing = await getOrganizationBySlug(orgSlug)
+    const existing = existingByAccountId ?? (await getOrganizationBySlug(orgSlug))
     if (existing) {
       await setOrganizationActive(orgSlug, true)
       const updated = await updateOrganizationInstallationId(orgSlug, installationId ?? null, {
@@ -966,6 +989,13 @@ async function handleInstallationRepositories(payload: InstallationPayload) {
     return NextResponse.json({ error: "Missing installation account login" }, { status: 400 })
   }
 
+  if (accountId) {
+    const existing = await getOrganizationByGithubAccountId(String(accountId))
+    if (existing && existing.githubOrgSlug !== orgSlug) {
+      await updateOrganizationSlug(existing.id, orgSlug)
+    }
+  }
+
   await updateOrganizationInstallationId(orgSlug, installationId ?? null, {
     githubAccountType: accountType,
     githubAccountId: accountId,
@@ -977,6 +1007,35 @@ async function handleInstallationRepositories(payload: InstallationPayload) {
   })
 }
 
+async function handleOrganization(payload: OrganizationPayload) {
+  if (payload.action !== "renamed") {
+    return NextResponse.json({ message: `Ignored organization action: ${payload.action}` })
+  }
+
+  const accountId = payload.organization?.id
+  const newSlug = payload.organization?.login
+  if (!accountId || !newSlug) {
+    return NextResponse.json({ error: "Missing organization id/login" }, { status: 400 })
+  }
+
+  const existing = await getOrganizationByGithubAccountId(String(accountId))
+  if (!existing) {
+    return NextResponse.json({
+      message: `No org record for account id ${accountId}, ignoring rename`,
+    })
+  }
+
+  if (existing.githubOrgSlug === newSlug) {
+    return NextResponse.json({ message: "Org slug already up to date" })
+  }
+
+  const updated = await updateOrganizationSlug(existing.id, newSlug)
+  return NextResponse.json({
+    message: `Renamed org slug ${existing.githubOrgSlug} -> ${newSlug}`,
+    org: updated,
+  })
+}
+
 export async function GET(request: NextRequest) {
   if (process.env.NODE_ENV === "production") {
     return NextResponse.json({ error: "Not found" }, { status: 404 })

lib/db/queries.ts

@@ -252,6 +252,33 @@ export async function getOrganizationById(id: string) {
   return rows[0] ?? undefined
 }
 
+/**
+ * Look up an org by its immutable GitHub account id. Slugs (org logins) are
+ * mutable -- an org can be renamed on GitHub -- so any code path that needs
+ * to survive a rename must resolve through this first and reconcile
+ * `githubOrgSlug` via `updateOrganizationSlug` before falling back to
+ * slug-keyed lookups/mutations.
+ */
+export async function getOrganizationByGithubAccountId(accountId: string) {
+  const db = await ensureDbReady()
+  const rows = await db
+    .select()
+    .from(organizations)
+    .where(eq(organizations.githubAccountId, accountId))
+    .limit(1)
+  return rows[0] ?? undefined
+}
+
+export async function updateOrganizationSlug(orgId: string, newSlug: string) {
+  const db = await ensureDbReady()
+  const rows = await db
+    .update(organizations)
+    .set({ githubOrgSlug: newSlug })
+    .where(eq(organizations.id, orgId))
+    .returning()
+  return rows[0] ?? undefined
+}
+
 export async function getBypassAccountsByOrg(orgId: string) {
   const db = await ensureDbReady()
   return db

tests/integration/api-suite.test.ts

@@ -1842,6 +1842,93 @@ test("Webhook: installation suspend and unsuspend toggles active state", async (
   assertEqual(orgAfterUnsuspend.org.isActive, true, "org is active after unsuspend")
 })
 
+test("Webhook: organization renamed reconciles slug in place", async (baseUrl) => {
+  await resetDb(baseUrl)
+
+  const before = await fetch(`${baseUrl}/api/orgs/fiveonefour`).then((r) => r.json())
+
+  const { res, data } = await sendWebhook(baseUrl, "organization", {
+    action: "renamed",
+    organization: { id: 2001, login: "fiveonefour-renamed" },
+  })
+  assertEqual(res.status, 200, "status")
+  assert(data.message.includes("fiveonefour -> fiveonefour-renamed"), "rename message")
+
+  const oldSlugRes = await fetch(`${baseUrl}/api/orgs/fiveonefour`)
+  assertEqual(oldSlugRes.status, 404, "old slug no longer resolves")
+
+  const after = await fetch(`${baseUrl}/api/orgs/fiveonefour-renamed`).then((r) => r.json())
+  assertEqual(after.org.id, before.org.id, "same underlying org row, not a duplicate")
+  assertEqual(after.org.isActive, true, "org still active after rename")
+  assertEqual(after.signers.length, before.signers.length, "signatures preserved across rename")
+})
+
+test("Webhook: organization renamed for unknown account id is a no-op", async (baseUrl) => {
+  await resetDb(baseUrl)
+
+  const { res, data } = await sendWebhook(baseUrl, "organization", {
+    action: "renamed",
+    organization: { id: 999999, login: "someone-elses-org" },
+  })
+  assertEqual(res.status, 200, "status")
+  assert(data.message.includes("No org record"), "ignored: no matching account id")
+
+  const orgRes = await fetch(`${baseUrl}/api/orgs/someone-elses-org`)
+  assertEqual(orgRes.status, 404, "no org created for unrelated rename")
+})
+
+test("Webhook: installation created after external rename reconciles slug instead of duplicating", async (baseUrl) => {
+  await resetDb(baseUrl)
+
+  // Simulates a rename GitHub delivered as an `installation` event (e.g. a
+  // re-sent/backfilled `created` delivery) without a prior `organization`
+  // webhook having reconciled the slug yet.
+  const { res, data } = await sendWebhook(baseUrl, "installation", {
+    action: "created",
+    installation: {
+      id: 10001,
+      account: { login: "fiveonefour-new-name", id: 2001, type: "Organization" },
+    },
+    sender: { id: 1, login: "orgadmin" },
+  })
+  assertEqual(res.status, 200, "status")
+  assert(data.message.includes("fiveonefour-new-name"), "message references new slug")
+
+  const orgsRes = await fetch(`${baseUrl}/api/orgs`)
+  const orgsData = await orgsRes.json()
+  const matching = orgsData.orgs.filter((org: { githubOrgSlug: string }) =>
+    org.githubOrgSlug.startsWith("fiveonefour")
+  )
+  assertEqual(matching.length, 1, "no duplicate org row created for the renamed account")
+
+  const oldSlugRes = await fetch(`${baseUrl}/api/orgs/fiveonefour`)
+  assertEqual(oldSlugRes.status, 404, "old slug no longer resolves")
+})
+
+test("Webhook: installation_repositories after external rename reconciles slug", async (baseUrl) => {
+  await resetDb(baseUrl)
+
+  const { res, data } = await sendWebhook(baseUrl, "installation_repositories", {
+    action: "added",
+    installation: {
+      id: 10001,
+      account: { login: "fiveonefour-repos-renamed", id: 2001, type: "Organization" },
+    },
+  })
+  assertEqual(res.status, 200, "status")
+  assert(data.message.includes("fiveonefour-repos-renamed"), "message references new slug")
+
+  const renamedOrgRes = await fetch(`${baseUrl}/api/orgs/fiveonefour-repos-renamed`)
+  assertEqual(renamedOrgRes.status, 200, "org reachable under new slug")
+
+  const orgsRes = await fetch(`${baseUrl}/api/orgs`)
+  const orgsData = await orgsRes.json()
+  const matching = orgsData.orgs.filter((org: { githubOrgSlug: string }) =>
+    org.githubOrgSlug.startsWith("fiveonefour")
+  )
+  assertEqual(matching.length, 1, "no duplicate org row created")
+})
+
 test("Webhook: ping event is acknowledged", async (baseUrl) => {
   await resetDb(baseUrl)
   const { res, data } = await sendWebhook(baseUrl, "ping", {