Allow GitHub login before the first repository exists

Allow GitHub login before the first repository exists

Remove the obsolete initial-repository membership step from OAuth login and cover the empty-production state with a callback regression test.

Changelog: GitHub login now succeeds before you import your first repository.

Changelog-Category: fix

Changelog-Visibility: public

Changelog: GitHub login now succeeds before you import your first repository.
Changelog-Category: fix
Changelog-Visibility: public

Deploy story

What this commit did to the running system — joined from the forge receipt chain, the part a commit page elsewhere cannot show.

Not deployed through the forge lane

No push, promotion, build, or deploy receipt references this commit (receipts are scanned over a bounded recent window). Changes shipped by full node replacement carry their proof in the release gate receipt instead.

Changed files

modified docs/2026-08-21-posthog-integration-runbook.md
modified lib/openagents_web/controllers/auth_controller.ex
modified test/openagents_web/auth_controller_test.exs

Diff

3 files changed, +17 -3

| `user_signed_in` | `AuthController.callback` on returning user | `github_login` |
| `user_logged_out` | `AuthController.logout` | none |

Chat and Sarah:
Chat and delegated work:

| Event | Where | Properties |
| --- | --- | --- |

           GitHubOAuth.exchange_and_fetch(code, verifier),
         {:ok, user} <- Accounts.upsert_github_user(profile),
         {:ok, active_user} <- Accounts.get_active_user(user.id),
         {:ok, _membership} <- Repositories.ensure_initial_membership(active_user),
         {:ok, _namespace} <- Repositories.ensure_user_namespace(active_user),
         {:ok, _stored} <-
           Accounts.store_github_token(active_user, access_token, granted_scopes) do

  use OpenAgentsWeb.ConnCase, async: false
  import Phoenix.LiveViewTest

  alias OpenAgents.{Accounts, Conversations}
  alias OpenAgents.{Accounts, Conversations, Repo, Repositories}

  setup {Req.Test, :verify_on_exit!}


    assert attempt["id"]
  end

  test "GitHub callback authenticates before the first repository exists", %{conn: conn} do
    conn = start_login(conn)
    {_attempt, state} = attempt_and_state(conn)
    expect_github(502, "empty-repository-person")
    Repositories.initial_repository!() |> Repo.delete!()

    authenticated =
      conn
      |> recycle()
      |> get(~p"/auth/github/callback?code=valid-code&state=#{state}")

    assert redirected_to(authenticated) == ~p"/chat"
    assert {:ok, _user} = authenticated |> get_session("user_id") |> Accounts.get_active_user()
  end

  test "mismatched state never reaches GitHub", %{conn: conn} do
    conn = start_login(conn)


234	234		\| `user_signed_in` \| `AuthController.callback` on returning user \| `github_login` \|
235	235		\| `user_logged_out` \| `AuthController.logout` \| none \|
236	236
237		-	`Chat and Sarah:`
	237	+	`Chat and delegated work:`
238	238
239	239		`\| Event \| Where \| Properties \|`
240	240		`\| --- \| --- \| --- \|`

30	30		`GitHubOAuth.exchange_and_fetch(code, verifier),`
31	31		`{:ok, user} <- Accounts.upsert_github_user(profile),`
32	32		`{:ok, active_user} <- Accounts.get_active_user(user.id),`
33		-	`{:ok, _membership} <- Repositories.ensure_initial_membership(active_user),`
34	33		`{:ok, _namespace} <- Repositories.ensure_user_namespace(active_user),`
35	34		`{:ok, _stored} <-`
36	35		`Accounts.store_github_token(active_user, access_token, granted_scopes) do`

2	2		`use OpenAgentsWeb.ConnCase, async: false`
3	3		`import Phoenix.LiveViewTest`
4	4
5		-	`alias OpenAgents.{Accounts, Conversations}`
	5	+	`alias OpenAgents.{Accounts, Conversations, Repo, Repositories}`
6	6
7	7		`setup {Req.Test, :verify_on_exit!}`
8	8

72	72		`assert attempt["id"]`
73	73		`end`
74	74
	75	+	`test "GitHub callback authenticates before the first repository exists", %{conn: conn} do`
	76	+	`conn = start_login(conn)`
	77	+	`{_attempt, state} = attempt_and_state(conn)`
	78	+	`expect_github(502, "empty-repository-person")`
	79	+	`Repositories.initial_repository!() \|> Repo.delete!()`
	80	+
	81	+	`authenticated =`
	82	+	`conn`
	83	+	`\|> recycle()`
	84	+	`\|> get(~p"/auth/github/callback?code=valid-code&state=#{state}")`
	85	+
	86	+	`assert redirected_to(authenticated) == ~p"/chat"`
	87	+	`assert {:ok, _user} = authenticated \|> get_session("user_id") \|> Accounts.get_active_user()`
	88	+	`end`
	89	+
75	90		`test "mismatched state never reaches GitHub", %{conn: conn} do`
76	91		`conn = start_login(conn)`
77	92