Merge branch 'main' into v5

brendan-kellam · brendan-kellam · commit 2093f5f33df3 · 2026-05-05T15:21:47.000-07:00
diff --git a/.github/workflows/_build.yml b/.github/workflows/_build.yml
@@ -104,7 +104,7 @@ jobs:
 
       - name: Build Docker image
         id: build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           build-args: |
diff --git a/.github/workflows/pr-gate.yml b/.github/workflows/pr-gate.yml
@@ -19,6 +19,6 @@ jobs:
 
       - name: Build Docker image
         id: build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -11,6 +11,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Redesigned the app layout with a new collapsible sidebar navigation, replacing the previous top navigation bar. [#1097](https://github.com/sourcebot-dev/sourcebot/pull/1097)
 - Expired offline license keys no longer crash the process. An expired key now degrades to the unlicensed state. [#1109](https://github.com/sourcebot-dev/sourcebot/pull/1109)
 
+## [4.17.1] - 2026-05-04
+
+### Added
+- Added three new audit actions covering the full org membership lifecycle: `org.member_added`, `org.member_removed`, and `org.member_left`. [#1165](https://github.com/sourcebot-dev/sourcebot/pull/1165)
+- Added per-user JWT session versioning so admin-driven member removals (and voluntary leaves) invalidate the removed user's active JWT cookies, personal API keys, and OAuth tokens atomically on their next request. [#1168](https://github.com/sourcebot-dev/sourcebot/pull/1168)
+
+### Fixed
+- Fixed Azure DevOps connection schema to allow spaces in project and repository names. [#1170](https://github.com/sourcebot-dev/sourcebot/pull/1170)
+
 ## [4.17.0] - 2026-04-30
 
 ### Added
diff --git a/README.md b/README.md
@@ -8,7 +8,7 @@
 <div align="center">
    <div>
       <h3>
-         <a href="https://docs.sourcebot.dev/self-hosting/overview">
+         <a href="https://docs.sourcebot.dev">
             <strong>Self Host</strong>
          </a> · 
          <a href="https://app.sourcebot.dev">
diff --git a/docs/api-reference/sourcebot-public.openapi.json b/docs/api-reference/sourcebot-public.openapi.json
@@ -2,7 +2,7 @@
   "openapi": "3.0.3",
   "info": {
     "title": "Sourcebot Public API",
-    "version": "v4.17.0",
+    "version": "v4.17.1",
     "description": "OpenAPI description for the public Sourcebot REST endpoints used for search, repository listing, and file browsing. Authentication is instance-dependent: API keys are the standard integration mechanism, OAuth bearer tokens are EE-only, and some instances may allow anonymous access."
   },
   "tags": [
diff --git a/docs/docs/configuration/audit-logs.mdx b/docs/docs/configuration/audit-logs.mdx
@@ -145,6 +145,9 @@ curl --request GET '$SOURCEBOT_URL/api/ee/audit' \
 | `user.signed_out`                     | `user` | `user` |
 | `org.member_promoted_to_owner`        | `user` | `user` |
 | `org.owner_demoted_to_member`         | `user` | `user` |
+| `org.member_added`                    | `user` | `user` |
+| `org.member_removed`                  | `user` | `user` |
+| `org.member_left`                     | `user` | `user` |
 
 
 ## Response schema
diff --git a/docs/snippets/schemas/v3/azuredevops.schema.mdx b/docs/snippets/schemas/v3/azuredevops.schema.mdx
@@ -82,7 +82,7 @@
       "type": "array",
       "items": {
         "type": "string",
-        "pattern": "^[\\w.-]+\\/[\\w.-]+$"
+        "pattern": "^[\\w.-]+\\/[\\w. -]+$"
       },
       "default": [],
       "examples": [
@@ -97,7 +97,7 @@
       "type": "array",
       "items": {
         "type": "string",
-        "pattern": "^[\\w.-]+\\/[\\w.-]+\\/[\\w.-]+$"
+        "pattern": "^[\\w.-]+\\/[\\w. -]+\\/[\\w. -]+$"
       },
       "default": [],
       "examples": [
diff --git a/packages/db/prisma/migrations/20260501170139_add_user_session_version/migration.sql b/packages/db/prisma/migrations/20260501170139_add_user_session_version/migration.sql
@@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "User" ADD COLUMN     "sessionVersion" INTEGER NOT NULL DEFAULT 0;
diff --git a/packages/db/prisma/schema.prisma b/packages/db/prisma/schema.prisma
@@ -403,6 +403,11 @@ model User {
   oauthAuthCodes     OAuthAuthorizationCode[]
   oauthRefreshTokens OAuthRefreshToken[]
 
+  /// Per-user JWT version. Incremented to invalidate every active session for
+  /// this user on their next request. Compared against the `sessionVersion`
+  /// claim baked into the JWT cookie at mint time.
+  sessionVersion Int @default(0)
+
   createdAt DateTime @default(now())
   updatedAt DateTime @updatedAt
 
diff --git a/packages/schemas/src/v3/azuredevops.schema.ts b/packages/schemas/src/v3/azuredevops.schema.ts
@@ -81,7 +81,7 @@ const schema = {
       "type": "array",
       "items": {
         "type": "string",
-        "pattern": "^[\\w.-]+\\/[\\w.-]+$"
+        "pattern": "^[\\w.-]+\\/[\\w. -]+$"
       },
       "default": [],
       "examples": [
@@ -96,7 +96,7 @@ const schema = {
       "type": "array",
       "items": {
         "type": "string",
-        "pattern": "^[\\w.-]+\\/[\\w.-]+\\/[\\w.-]+$"
+        "pattern": "^[\\w.-]+\\/[\\w. -]+\\/[\\w. -]+$"
       },
       "default": [],
       "examples": [
diff --git a/packages/shared/src/version.ts b/packages/shared/src/version.ts
@@ -1,2 +1,2 @@
 // This file is auto-generated by .github/workflows/release-sourcebot.yml
-export const SOURCEBOT_VERSION = "v4.17.0";
+export const SOURCEBOT_VERSION = "v4.17.1";
diff --git a/packages/web/src/__mocks__/prisma.ts b/packages/web/src/__mocks__/prisma.ts
@@ -42,6 +42,7 @@ export const MOCK_USER_WITH_ACCOUNTS: User & { accounts: Account[] } = {
     hashedPassword: null,
     emailVerified: null,
     image: null,
+    sessionVersion: 0,
     accounts: [],
 }
 
diff --git a/packages/web/src/app/invite/actions.ts b/packages/web/src/app/invite/actions.ts
@@ -54,6 +54,16 @@ export const joinOrganization = async (inviteLinkId?: string) => sew(async () =>
         return addUserToOrgRes;
     }
 
+    await createAudit({
+        action: "org.member_added",
+        actor: { id: user.id, type: "user" },
+        target: { id: user.id, type: "user" },
+        orgId: org.id,
+        metadata: {
+            message: `${user.id} joined the organization via invite link`,
+        },
+    });
+
     return {
         success: true,
     }
@@ -133,6 +143,16 @@ export const redeemInvite = async (inviteId: string): Promise<{ success: boolean
         }
     });
 
+    await createAudit({
+        action: "org.member_added",
+        actor: { id: user.id, type: "user" },
+        target: { id: user.id, type: "user" },
+        orgId: invite.org.id,
+        metadata: {
+            message: `${user.id} joined the organization by accepting invite ${inviteId}`,
+        },
+    });
+
     return {
         success: true,
     };
diff --git a/packages/web/src/auth.ts b/packages/web/src/auth.ts
@@ -1,5 +1,6 @@
 import 'next-auth/jwt';
-import NextAuth, { DefaultSession, User as AuthJsUser } from "next-auth"
+import { cache } from "react";
+import NextAuth, { DefaultSession, Session, User as AuthJsUser } from "next-auth"
 import Credentials from "next-auth/providers/credentials"
 import EmailProvider from "next-auth/providers/nodemailer";
 import { __unsafePrisma } from "@/prisma";
@@ -37,12 +38,17 @@ export type SessionUser = {
 declare module 'next-auth' {
     interface Session {
         user: SessionUser;
+        sessionVersion?: number;
+    }
+    interface User {
+        sessionVersion?: number;
     }
 }
 
 declare module 'next-auth/jwt' {
     interface JWT {
         userId: string;
+        sessionVersion?: number;
     }
 }
 
@@ -115,6 +121,7 @@ export const getProviders = async () => {
                         const authJsUser: AuthJsUser = {
                             id: newUser.id,
                             email: newUser.email,
+                            sessionVersion: newUser.sessionVersion,
                         }
 
                         onCreateUser({ user: authJsUser });
@@ -135,6 +142,7 @@ export const getProviders = async () => {
                             email: user.email,
                             name: user.name ?? undefined,
                             image: user.image ?? undefined,
+                            sessionVersion: user.sessionVersion,
                         };
                     }
                 }
@@ -145,7 +153,7 @@ export const getProviders = async () => {
     return providers;
 }
 
-export const { handlers, signIn, signOut, auth } = NextAuth({
+const nextAuthResult = NextAuth({
     secret: env.AUTH_SECRET,
     adapter: EncryptedPrismaAdapter(__unsafePrisma),
     session: {
@@ -272,6 +280,7 @@ export const { handlers, signIn, signOut, auth } = NextAuth({
             // Cache the userId in the JWT for later use.
             if (user) {
                 token.userId = user.id;
+                token.sessionVersion = user.sessionVersion ?? 0;
             }
 
             // @note The following performs a lazy migration of the issuerUrl
@@ -312,6 +321,7 @@ export const { handlers, signIn, signOut, auth } = NextAuth({
                 // Propagate the userId to the session.
                 id: token.userId,
             }
+            session.sessionVersion = token.sessionVersion;
 
             return session;
         },
@@ -324,6 +334,40 @@ export const { handlers, signIn, signOut, auth } = NextAuth({
     }
 });
 
+export const { handlers, signIn, signOut } = nextAuthResult;
+
+/**
+ * Wrapped session resolver that enforces JWT versioning at the auth layer.
+ *
+ * Every JWT cookie carries the `sessionVersion` it was minted with. This
+ * wrapper compares it against the user's current `sessionVersion` in the
+ * database; if the user's version has been bumped (e.g., they were removed
+ * from the org), we return null so every caller of `auth()` sees the
+ * session as logged out.
+ */
+export const auth = cache(async (): Promise<Session | null> => {
+    const session = await nextAuthResult.auth();
+    if (!session) {
+        return null;
+    }
+
+    const dbUser = await __unsafePrisma.user.findUnique({
+        where: { id: session.user.id },
+        select: { sessionVersion: true },
+    });
+
+    if (!dbUser) {
+        return null;
+    }
+
+    const tokenVersion = session.sessionVersion ?? 0;
+    if (tokenVersion !== dbUser.sessionVersion) {
+        return null;
+    }
+
+    return session;
+});
+
 /**
  * Returns the issuer URL for a given auth.js account
  */
diff --git a/packages/web/src/features/userManagement/actions.ts b/packages/web/src/features/userManagement/actions.ts
diff --git a/packages/web/src/lib/authUtils.ts b/packages/web/src/lib/authUtils.ts
diff --git a/schemas/v3/azuredevops.json b/schemas/v3/azuredevops.json

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+-- AlterTable`
	`2`	`+ALTER TABLE "User" ADD COLUMN "sessionVersion" INTEGER NOT NULL DEFAULT 0;`