fix(profile): remove OAuth token from audit/run Inngest event payload

[anshul23102]

Summary

Fixes #204.

`bootstrapProfile` was placing the user's live GitHub OAuth `provider_token` directly in the `audit/run` Inngest event payload under the `accessToken` key. Inngest retains event payloads in its cloud infrastructure for replay and debugging. This meant every user's GitHub access token was being persisted in a third-party service for an indefinite retention period.

Root cause

```typescript
// before — token transmitted through Inngest
await inngest.send({
name: 'audit/run',
data: {
userId: profile.id,
githubHandle: profile.github_handle,
githubId,
accessToken: providerToken, // live OAuth token in event payload
},
});
```

Fix

The handler now looks up the user's active GitHub App installation and passes only the `installationId`:

```typescript
// after — installation ID only, no token in transit
const { data: install } = await service
.from('github_installations')
.select('id')
.eq('user_id', profile.id)
.is('uninstalled_at', null)
.order('installed_at', { ascending: false })
.limit(1)
.maybeSingle();

if (install?.id) {
await inngest.send({
name: 'audit/run',
data: {
userId: profile.id,
githubHandle: profile.github_handle,
githubId,
installationId: install.id, // safe to transmit
},
});
auditQueued = true;
}
```

The `audit-run` function already has a complete installation-token path. If no installation exists at bootstrap time, the audit is not queued; the install webhook handler fires its own `audit/run` with the `installationId` once the user installs the app, so no audit window is missed.

Changes

• `src/app/actions/profile.ts`: replaces `accessToken` field with `installationId` lookup
• `src/app/actions/profile.test.ts` (new): tests that `installationId` is sent, `accessToken` is absent, and audit is correctly skipped when no installation exists or audit is already complete

Test plan

• `npx vitest run src/app/actions/profile.test.ts` - 3/3 pass
• `npx tsc --noEmit` - no errors
• `npx eslint src/app/actions/profile.ts src/app/actions/profile.test.ts` - no errors

[vercel]

@anshul23102 is attempting to deploy a commit to the codersogs-3057's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

Hey @anshul23102

You have 4 open PRs right now. The limit is 3 at a time.

Please get your existing PRs merged or closed before opening new ones:

• fix(webhook): return generic 500 instead of leaking Supabase error fields #221 - fix(webhook): return generic 500 instead of leaking Supabase error fields
• fix: stop embedding OAuth token in Inngest audit event payload #212 - fix: stop embedding OAuth token in Inngest audit event payload
• fix: close TOCTOU race condition in claimRecommendation #211 - fix: close TOCTOU race condition in claimRecommendation

This PR will remain open but won't be reviewed until you're under the limit. See our Contributing Guidelines for details.

[anshul23102]

Closed the two older duplicate PRs (#211, #212) and one PR that was temporarily queued (#223). Down to 3 open PRs now. This PR is ready for review.