fix

Author: callicles

README.md

@@ -8,7 +8,7 @@ It gives org admins a place to manage CLA text and signing history, and gives co
 
 - If a contributor has signed a non-current CLA version, they must re-sign before being considered compliant.
 - Contributor compliance status is evaluated per org using the contributor's latest signed version for that org.
-- Admins can define an org-scoped bypass list of GitHub accounts that should always receive a passing CLA check.
+- Admins can define org-scoped bypass lists for both GitHub users and GitHub Apps/system bots that should always receive a passing CLA check.
 - If a contributor has open pull requests and their signature becomes outdated after a CLA update, checks may need to be re-opened/re-evaluated and set to failing until re-signing is completed.
 - After a contributor signs/re-signs the latest CLA, the app schedules an async workflow that updates their open PR CLA checks to success and removes stale CLA prompt comments.
 - When an org is activated/deactivated, the app schedules an async workflow to re-check open PRs for that org so checks converge to the new enforcement mode.
@@ -110,7 +110,7 @@ This section is the behavior contract for UI routes.
 | `/auth/signin` | Start sign-in flow | Shows GitHub sign-in CTA | Same | Sends user to `/api/auth/github?returnTo=...`; `returnTo` is sanitized to internal paths only |
 | `/dashboard` | Mode selector page | Public page | Same + session shown in header | Navigate to `/admin` or `/contributor` |
 | `/admin` | Org admin overview | Shows "Sign in required" card | Lists organizations user can administer; shows install CTA when none are authorized | Install app (`/api/github/install`), open org manage pages |
-| `/admin/[orgSlug]` | Org CLA management | If data unavailable, shows "Organization not found" UI | Shows org details, CLA version, signers, archives, bypass list, branch-protection reminder | Edit/save CLA text with live markdown preview modes (`Edit`, `Split`, `Preview`), activate/deactivate bot, copy signing link, inspect signers/archives, manage bypass usernames, download current/archived CLA text, share tab links via `?tab=cla|signers|archives|bypass` |
+| `/admin/[orgSlug]` | Org CLA management | If data unavailable, shows "Organization not found" UI | Shows org details, CLA version, signers, archives, bypass list, branch-protection reminder | Edit/save CLA text with live markdown preview modes (`Edit`, `Split`, `Preview`), activate/deactivate bot, copy signing link, inspect signers/archives, manage bypass users and app/bot slugs, download current/archived CLA text, share tab links via `?tab=cla|signers|archives|bypass` |
 | `/contributor` | Contributor agreement dashboard | Shows "Sign in required" card | Lists signed CLA history grouped by org status | Re-sign prompts for outdated orgs, links to `/sign/[orgSlug]`, download previously signed CLA records |
 | `/sign/[orgSlug]` | CLA read/sign page | Shows sign-in required (or org not found) | Shows signed state, or sign/re-sign workflow | Requires scroll-to-bottom before sign button enables; handles inactive org warning |
 | `/terms` | Legal terms page | Public page | Same | Documents signing/enforcement terms and branch-protection requirement |
@@ -156,7 +156,7 @@ This section amends your scenario list and adds missing scenarios.
 
 - Org member: check passes, no CLA comment.
 - Personal-account repository owner: check passes, no CLA comment.
-- User on org bypass list: check passes, no CLA comment.
+- User or app/bot on org bypass list: check passes, no CLA comment.
 - Non-member + current signature: check passes, no CLA comment.
 - Non-member + outdated signature: check fails, re-sign comment posted.
 - Non-member + never signed: check fails, sign prompt comment posted.
@@ -182,7 +182,7 @@ This section amends your scenario list and adds missing scenarios.
 
 - Org deactivated/uninstalled: signing blocked; webhook events set passing CLA checks and remove managed CLA prompts so PRs are not blocked by CLA while inactive.
 - Activating or deactivating an org schedules an async open-PR recheck workflow so existing PR checks/comments converge automatically.
-- Updating bypass list schedules async open-PR recheck so existing PRs converge to the latest policy.
+- Updating either bypass section (users or app/bots) schedules async open-PR recheck so existing PRs converge to the latest policy.
 - `/recheck` authorization: allowed for PR author, org member, or maintainer; unauthorized users are blocked.
 - OAuth and install redirects sanitize `returnTo` to prevent open redirects.
 - Webhook hardening: production signature verification and delivery de-duplication.
@@ -227,9 +227,10 @@ This section amends your scenario list and adds missing scenarios.
 - Contributor dashboard status uses the latest stored signature per org to determine current/outdated state in UI.
 - Outcomes:
   - Org member: passing check, no CLA comment.
-  - Bypass-listed account: passing check, no CLA comment.
+  - Bypass-listed user/app/bot: passing check, no CLA comment.
   - Signed current CLA: passing check, no CLA comment.
   - Unsigned/outdated signature: failing check + bot comment with signing URL.
+- App/bot bypass matching is slug-based and treats `<slug>` and `<slug>[bot]` as equivalent actor forms.
 - When CLA text changes, contributors on older signatures are marked as requiring re-sign; open PRs may require check re-evaluation and failure until re-signing.
 - After signing/re-signing, an async workflow updates signer-authored open PR CLA checks to success and removes stale CLA prompt comments.
 - Activating/deactivating CLA enforcement schedules async open-PR rechecks; inactive mode converges CLA checks to success and clears managed CLA prompt comments.

app/admin/[orgSlug]/actions.ts

@@ -8,14 +8,17 @@ import {
   addBypassAccount,
   countBypassAccountsByOrg,
   createAuditEvent,
+  getBypassAccountByOrgAndActorSlug,
   getBypassAccountByOrgAndGithubId,
+  getBypassAccountByOrgAndGithubUsername,
   removeBypassAccount,
   setOrganizationActive,
   updateOrganizationCla,
 } from "@/lib/db/queries"
 import { authorizeOrgAccess } from "@/lib/server/org-access"
 import { getBaseUrlFromHeaders } from "@/lib/cla/signing"
 import { runClaRecheckWorkflow } from "@/workflows/cla-recheck"
+import { formatBypassActorLogin, normalizeBypassActorSlug } from "@/lib/bypass"
 
 const MAX_ORG_BYPASS_ACCOUNTS = 50
 
@@ -31,13 +34,28 @@ const toggleActiveSchema = z.object({
 
 const addBypassSchema = z.object({
   orgSlug: z.string().min(1),
+})
+
+const addUserBypassSchema = addBypassSchema.extend({
+  bypassKind: z.literal("user"),
   githubUserId: z.string().trim().min(1, "GitHub user is required"),
   githubUsername: z.string().trim().min(1, "GitHub username is required"),
 })
 
+const addAppBotBypassSchema = addBypassSchema.extend({
+  bypassKind: z.literal("app_bot"),
+  actorSlug: z.string().trim().min(1, "App or bot slug is required"),
+  githubUsername: z.string().trim().optional(),
+})
+
+const addBypassInputSchema = z.discriminatedUnion("bypassKind", [
+  addUserBypassSchema,
+  addAppBotBypassSchema,
+])
+
 const removeBypassSchema = z.object({
   orgSlug: z.string().min(1),
-  githubUserId: z.string().trim().min(1, "GitHub user ID is required"),
+  bypassAccountId: z.string().trim().min(1, "Bypass account ID is required"),
 })
 
 type ActionResult = {
@@ -152,33 +170,88 @@ export async function toggleOrganizationActiveAction(input: unknown): Promise<Ac
 }
 
 export async function addBypassAccountAction(input: unknown): Promise<ActionResult> {
-  const parsed = addBypassSchema.safeParse(input)
+  const parsed = addBypassInputSchema.safeParse(input)
   if (!parsed.success) {
     return { ok: false, error: parsed.error.issues[0]?.message ?? "Invalid input" }
   }
 
-  const { orgSlug, githubUserId, githubUsername } = parsed.data
+  const { orgSlug } = parsed.data
   const access = await authorizeOrgAccess(orgSlug)
   if (!access.ok) {
     return { ok: false, error: access.message }
   }
 
-  const existing = await getBypassAccountByOrgAndGithubId(access.org.id, githubUserId)
-  if (existing) {
-    return { ok: false, error: `@${existing.githubUsername} is already on the bypass list` }
-  }
-
   const count = await countBypassAccountsByOrg(access.org.id)
   if (count >= MAX_ORG_BYPASS_ACCOUNTS) {
     return { ok: false, error: `Bypass list limit reached (${MAX_ORG_BYPASS_ACCOUNTS})` }
   }
 
-  const created = await addBypassAccount({
-    orgId: access.org.id,
-    githubUserId,
-    githubUsername,
-    createdByUserId: access.user.id,
-  })
+  let created: Awaited<ReturnType<typeof addBypassAccount>> | undefined | null = null
+  let payload: Record<string, unknown> = {}
+
+  if (parsed.data.bypassKind === "user") {
+    const { githubUserId, githubUsername } = parsed.data
+    const existingById = await getBypassAccountByOrgAndGithubId(access.org.id, githubUserId, "user")
+    if (existingById) {
+      return { ok: false, error: `@${existingById.githubUsername} is already on the bypass list` }
+    }
+
+    const existingByUsername = await getBypassAccountByOrgAndGithubUsername(
+      access.org.id,
+      githubUsername,
+      "user"
+    )
+    if (existingByUsername) {
+      return {
+        ok: false,
+        error: `@${existingByUsername.githubUsername} is already on the bypass list`,
+      }
+    }
+
+    created = await addBypassAccount({
+      orgId: access.org.id,
+      bypassKind: "user",
+      githubUserId,
+      githubUsername,
+      createdByUserId: access.user.id,
+    })
+    payload = {
+      bypassKind: "user",
+      githubUserId,
+      githubUsername,
+    }
+  } else {
+    const normalizedActorSlug = normalizeBypassActorSlug(parsed.data.actorSlug)
+    if (!normalizedActorSlug) {
+      return { ok: false, error: "App or bot slug is required" }
+    }
+    const actorLogin = formatBypassActorLogin(normalizedActorSlug)
+
+    const existingByActorSlug = await getBypassAccountByOrgAndActorSlug(
+      access.org.id,
+      normalizedActorSlug
+    )
+    if (existingByActorSlug) {
+      return {
+        ok: false,
+        error: `@${existingByActorSlug.githubUsername} is already on the app/bot bypass list`,
+      }
+    }
+
+    created = await addBypassAccount({
+      orgId: access.org.id,
+      bypassKind: "app_bot",
+      actorSlug: normalizedActorSlug,
+      githubUsername: actorLogin,
+      createdByUserId: access.user.id,
+    })
+    payload = {
+      bypassKind: "app_bot",
+      actorSlug: normalizedActorSlug,
+      githubUsername: actorLogin,
+    }
+  }
+
   if (!created) {
     return { ok: false, error: "Bypass account already exists" }
   }
@@ -204,8 +277,8 @@ export async function addBypassAccountAction(input: unknown): Promise<ActionResu
     actorGithubId: access.user.githubId ?? null,
     actorGithubUsername: access.user.githubUsername,
     payload: {
-      githubUserId,
-      githubUsername,
+      bypassAccountId: created.id,
+      ...payload,
       recheckScheduled: recheck.recheckScheduled,
       recheckRunId: recheck.recheckRunId,
       recheckScheduleError: recheck.recheckScheduleError,
@@ -224,15 +297,15 @@ export async function removeBypassAccountAction(input: unknown): Promise<ActionR
     return { ok: false, error: parsed.error.issues[0]?.message ?? "Invalid input" }
   }
 
-  const { orgSlug, githubUserId } = parsed.data
+  const { orgSlug, bypassAccountId } = parsed.data
   const access = await authorizeOrgAccess(orgSlug)
   if (!access.ok) {
     return { ok: false, error: access.message }
   }
 
   const removed = await removeBypassAccount({
     orgId: access.org.id,
-    githubUserId,
+    bypassAccountId,
   })
   if (!removed) {
     return { ok: false, error: "Bypass account not found" }
@@ -259,6 +332,9 @@ export async function removeBypassAccountAction(input: unknown): Promise<ActionR
     actorGithubId: access.user.githubId ?? null,
     actorGithubUsername: access.user.githubUsername,
     payload: {
+      bypassAccountId: removed.id,
+      bypassKind: removed.bypassKind,
+      actorSlug: removed.actorSlug,
       githubUserId: removed.githubUserId,
       githubUsername: removed.githubUsername,
       recheckScheduled: recheck.recheckScheduled,

app/api/admin/orgs/[orgSlug]/bypass/suggest/route.ts

@@ -3,6 +3,12 @@ import { getBypassAccountsByOrg } from "@/lib/db/queries"
 import { searchGitHubUsersWithOAuth } from "@/lib/github/oauth-user-search"
 import { authorizeOrgAccess } from "@/lib/server/org-access"
 import { decryptSecret } from "@/lib/security/encryption"
+import {
+  formatBypassActorLogin,
+  isLikelyAppBotActor,
+  normalizeBypassActorSlug,
+  parseBypassKind,
+} from "@/lib/bypass"
 
 const MIN_QUERY_LENGTH = 2
 const MAX_SUGGESTIONS = 8
@@ -18,38 +24,120 @@ export async function GET(
   }
 
   const query = request.nextUrl.searchParams.get("q")?.trim() ?? ""
+  const bypassKind = parseBypassKind(request.nextUrl.searchParams.get("kind")) ?? "user"
   if (query.length < MIN_QUERY_LENGTH) {
     return NextResponse.json({ suggestions: [] })
   }
 
+  const bypassAccounts = await getBypassAccountsByOrg(access.org.id)
+
+  const appBotBypassedActorSlugs = new Set(
+    bypassAccounts
+      .filter((entry) => entry.bypassKind === "app_bot")
+      .map((entry) => normalizeBypassActorSlug(entry.actorSlug ?? entry.githubUsername))
+      .filter(Boolean)
+  )
+
+  const toManualAppBotSuggestion = () => {
+    const actorSlug = normalizeBypassActorSlug(query)
+    if (!actorSlug) return null
+    return {
+      kind: "app_bot" as const,
+      actorSlug,
+      githubUsername: formatBypassActorLogin(actorSlug),
+      avatarUrl: "",
+      type: "Bot" as const,
+      alreadyBypassed: appBotBypassedActorSlugs.has(actorSlug),
+      source: "manual" as const,
+    }
+  }
+
   const encryptedToken = access.user.githubAccessTokenEncrypted ?? null
   const accessToken = encryptedToken ? decryptSecret(encryptedToken) : null
   if (!accessToken) {
+    if (bypassKind === "app_bot") {
+      const manualSuggestion = toManualAppBotSuggestion()
+      return NextResponse.json({ suggestions: manualSuggestion ? [manualSuggestion] : [] })
+    }
+
     return NextResponse.json(
       { error: "Missing GitHub OAuth token. Sign out and sign back in to enable autocomplete." },
       { status: 400 }
     )
   }
 
   try {
-    const [suggestions, bypassAccounts] = await Promise.all([
-      searchGitHubUsersWithOAuth({
-        accessToken,
-        query,
-        limit: MAX_SUGGESTIONS,
-      }),
-      getBypassAccountsByOrg(access.org.id),
-    ])
-
-    const bypassIds = new Set(bypassAccounts.map((entry) => entry.githubUserId))
+    const suggestions = await searchGitHubUsersWithOAuth({
+      accessToken,
+      query,
+      limit: MAX_SUGGESTIONS,
+    })
+
+    if (bypassKind === "user") {
+      const bypassIds = new Set(
+        bypassAccounts
+          .filter((entry) => entry.bypassKind === "user")
+          .map((entry) => entry.githubUserId)
+          .filter((value): value is string => Boolean(value))
+      )
+
+      return NextResponse.json({
+        suggestions: suggestions
+          .filter((item) => item.type !== "Bot")
+          .map((item) => ({
+            kind: "user" as const,
+            ...item,
+            alreadyBypassed: bypassIds.has(item.githubUserId),
+          })),
+      })
+    }
+
+    const appBotSuggestionMap = new Map<
+      string,
+      {
+        kind: "app_bot"
+        actorSlug: string
+        githubUsername: string
+        avatarUrl: string
+        type: "Bot"
+        alreadyBypassed: boolean
+        source: "github" | "manual"
+      }
+    >()
+
+    for (const item of suggestions) {
+      if (!isLikelyAppBotActor({ login: item.githubUsername, type: item.type })) continue
+
+      const actorSlug = normalizeBypassActorSlug(item.githubUsername)
+      if (!actorSlug) continue
+
+      appBotSuggestionMap.set(actorSlug, {
+        kind: "app_bot",
+        actorSlug,
+        githubUsername: formatBypassActorLogin(actorSlug),
+        avatarUrl: item.avatarUrl,
+        type: "Bot",
+        alreadyBypassed: appBotBypassedActorSlugs.has(actorSlug),
+        source: "github",
+      })
+    }
+
+    const manualSuggestion = toManualAppBotSuggestion()
+    if (manualSuggestion && !appBotSuggestionMap.has(manualSuggestion.actorSlug)) {
+      appBotSuggestionMap.set(manualSuggestion.actorSlug, manualSuggestion)
+    }
+
     return NextResponse.json({
-      suggestions: suggestions.map((item) => ({
-        ...item,
-        alreadyBypassed: bypassIds.has(item.githubUserId),
-      })),
+      suggestions: Array.from(appBotSuggestionMap.values()).slice(0, MAX_SUGGESTIONS),
     })
   } catch (error) {
     console.error("GitHub bypass autocomplete failed:", error)
+    if (bypassKind === "app_bot") {
+      const manualSuggestion = toManualAppBotSuggestion()
+      if (manualSuggestion) {
+        return NextResponse.json({ suggestions: [manualSuggestion] })
+      }
+    }
     return NextResponse.json({ error: "Failed to fetch GitHub user suggestions" }, { status: 502 })
   }
 }