fix: stop embedding OAuth token in Inngest audit event payload

[anshul23102]

Fixes #204

Problem

bootstrapProfile was passing the user's live GitHub OAuth provider token as accessToken inside the inngest.send() payload for the audit/run event. Inngest persists event payloads to its own cloud storage, so a long-lived OAuth credential was leaving the application's trust boundary every time a new user completed sign-in.

Root cause

// before
const providerToken = (await sb.auth.getSession()).data.session?.provider_token;
if (providerToken) {
  await inngest.send({
    name: 'audit/run',
    data: { userId, githubHandle, githubId, accessToken: providerToken },
  });
}

The OAuth token has a lifespan measured in hours or days. Once it lands in Inngest event storage it persists indefinitely and cannot be rotated from the application side.

Fix

The audit-run function already supports two safer auth paths:

1. installationId in event -- the function mints a short-lived GitHub App installation token at execution time. These tokens expire in one hour and are never stored anywhere.
2. Live DB lookup -- if no installationId is provided, the function queries github_installations at execution time and mints an install token from whatever it finds.

bootstrapProfile now:

1. Queries github_installations for the user's active install at event-send time and passes installationId if found.
2. If no install exists yet (common on first login, before the install webhook arrives), installationId is omitted. The function performs its own DB lookup at execution time, by which point the webhook will typically have landed.
3. Removes the sb.auth.getSession() call entirely since the token is no longer needed.
4. Queues the audit unconditionally instead of gating on token existence -- the function exits cleanly with { skipped: true, reason: 'no_auth_source' } in the rare case where neither path finds auth.

The accessToken field is retained in AuditEvent and in the function's fallback path to handle any events already in the queue, but is marked @deprecated so no new code reaches for it.

Files changed

File	Change
src/app/actions/profile.ts	Replace token retrieval + conditional send with install lookup + unconditional send
src/inngest/functions/audit-run.ts	Update JSDoc to reflect new auth precedence; mark accessToken as deprecated
src/app/actions/recommendations.ts	Fix TS strict-null false positive on rows[0] after explicit length guard (caught by tsc --noEmit)

Testing

• tsc --noEmit passes with zero errors.
• Existing audit-run fallback logic is unchanged; only the call site is modified.
• Users who sign in before installing the GitHub App will still get audited once the install webhook fires (the DB lookup in audit-run covers this).

[vercel]

@anshul23102 is attempting to deploy a commit to the codersogs-3057's projects Team on Vercel.

A member of the Team first needs to authorize it.

[anshul23102]

Ready for review. The fix removes the GitHub OAuth token from the Inngest event payload entirely and replaces it with an installation ID lookup. TypeScript passes clean with tsc --noEmit.

[anshul23102]

Closing in favour of #222, which supersedes this with a complete unit test suite (3 tests covering the installationId path, the no-install skip path, and the already-audited path) and a cleaner implementation that avoids the unconditional send.