feat(db): add user_github_app_tokens schema and migration

apps/web/.env.development.local.example

@@ -52,3 +52,6 @@ NEXT_PUBLIC_KILO_CHAT_URL=http://localhost:8808
 
 # @url event-service
 NEXT_PUBLIC_EVENT_SERVICE_URL=ws://localhost:8809
+
+# Encryption key for GitHub App user-to-server tokens (AES-256-GCM, base64-encoded 32 bytes)
+USER_GH_APP_TOKEN_ENCRYPTION_KEY=

apps/web/src/lib/config.server.ts

@@ -96,6 +96,12 @@ export const USER_DEPLOYMENTS_GIT_TOKEN_ENCRYPTION_KEY = getEnvVariable(
   'USER_DEPLOYMENTS_GIT_TOKEN_ENCRYPTION_KEY'
 );
 
+// Dedicated encryption key for GitHub App user-to-server tokens.
+// Do NOT reuse USER_DEPLOYMENTS_GIT_TOKEN_ENCRYPTION_KEY.
+export const USER_GH_APP_TOKEN_ENCRYPTION_KEY = getEnvVariable(
+  'USER_GH_APP_TOKEN_ENCRYPTION_KEY'
+);
+
 /**
  * AES-256 encryption key for BYOK API keys.
  * Must be a base64-encoded 32-byte (256-bit) key.

apps/web/src/lib/user.test.ts

@@ -64,6 +64,7 @@ import {
   impact_advocate_reward_redemptions,
   impact_conversion_reports,
   github_branch_pull_requests,
+  user_github_app_tokens,
 } from '@kilocode/db/schema';
 import { eq, count } from 'drizzle-orm';
 import {
@@ -154,6 +155,7 @@ describe('User', () => {
     await db.delete(agent_environment_profile_mcp_servers);
     await db.delete(agent_environment_profiles);
     await db.delete(github_branch_pull_requests);
+    await db.delete(user_github_app_tokens);
     await db.delete(organizations);
     await db.delete(kilocode_users);
   });
@@ -1542,6 +1544,46 @@ describe('User', () => {
       expect(rows).toHaveLength(0);
     });
 
+    it('should delete user_github_app_tokens for the user', async () => {
+      const user = await insertTestUser();
+      const otherUser = await insertTestUser();
+
+      await db.insert(user_github_app_tokens).values([
+        {
+          kilo_user_id: user.id,
+          github_app_type: 'standard',
+          github_user_id: '123',
+          github_login: 'testuser',
+          github_email: 'test@example.com',
+          access_token_encrypted: 'enc-token-1',
+          access_token_expires_at: new Date(Date.now() + 3600_000),
+        },
+        {
+          kilo_user_id: otherUser.id,
+          github_app_type: 'standard',
+          github_user_id: '456',
+          github_login: 'otheruser',
+          github_email: 'other@example.com',
+          access_token_encrypted: 'enc-token-2',
+          access_token_expires_at: new Date(Date.now() + 3600_000),
+        },
+      ]);
+
+      await softDeleteUser(user.id);
+
+      const userTokens = await db
+        .select()
+        .from(user_github_app_tokens)
+        .where(eq(user_github_app_tokens.kilo_user_id, user.id));
+      expect(userTokens).toHaveLength(0);
+
+      const otherTokens = await db
+        .select()
+        .from(user_github_app_tokens)
+        .where(eq(user_github_app_tokens.kilo_user_id, otherUser.id));
+      expect(otherTokens).toHaveLength(1);
+    });
+
     it('should nullify free_model_usage FK', async () => {
       const user = await insertTestUser();
 

apps/web/src/lib/user.ts

@@ -73,6 +73,7 @@ import {
   impact_advocate_reward_redemptions,
   impact_conversion_reports,
   github_branch_pull_requests,
+  user_github_app_tokens,
 } from '@kilocode/db/schema';
 import { eq, and, inArray, isNotNull, isNull, sql, or, gte, count } from 'drizzle-orm';
 import { allow_fake_login, IS_DEVELOPMENT } from './constants';
@@ -984,6 +985,9 @@ export async function softDeleteUser(userId: string) {
     await tx
       .delete(github_branch_pull_requests)
       .where(eq(github_branch_pull_requests.owned_by_user_id, userId));
+    await tx
+      .delete(user_github_app_tokens)
+      .where(eq(user_github_app_tokens.kilo_user_id, userId));
 
     // Code indexing data
     await tx.delete(source_embeddings).where(eq(source_embeddings.kilo_user_id, userId));

packages/db/src/migrations/0124_past_domino.sql

@@ -0,0 +1,21 @@
+CREATE TYPE "public"."github_app_type" AS ENUM('standard', 'lite');--> statement-breakpoint
+CREATE TYPE "public"."revocation_reason" AS ENUM('user_revoked', 'refresh_failed', 'admin');--> statement-breakpoint
+CREATE TABLE "user_github_app_tokens" (
+	"id" uuid PRIMARY KEY DEFAULT pg_catalog.gen_random_uuid() NOT NULL,
+	"kilo_user_id" text NOT NULL,
+	"github_app_type" "github_app_type" DEFAULT 'standard' NOT NULL,
+	"github_user_id" text NOT NULL,
+	"github_login" text NOT NULL,
+	"github_email" text,
+	"access_token_encrypted" text NOT NULL,
+	"access_token_expires_at" timestamp with time zone NOT NULL,
+	"revoked_at" timestamp with time zone,
+	"revocation_reason" "revocation_reason",
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"last_used_at" timestamp with time zone
+);
+--> statement-breakpoint
+ALTER TABLE "user_github_app_tokens" ADD CONSTRAINT "user_github_app_tokens_kilo_user_id_kilocode_users_id_fk" FOREIGN KEY ("kilo_user_id") REFERENCES "public"."kilocode_users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "user_github_app_tokens_user_app_uidx" ON "user_github_app_tokens" USING btree ("kilo_user_id","github_app_type");--> statement-breakpoint
+CREATE INDEX "user_github_app_tokens_github_user_id_idx" ON "user_github_app_tokens" USING btree ("github_user_id");