fix(backend): widen and encrypt github_installations.githubToken (#2347)

GitHub installation access tokens have grown beyond 255 characters,
overflowing the varchar(255) "githubToken" column and throwing
"value too long for type character varying(255)" on patch.

Widen the column to text and encrypt it at rest (random IV), matching
GithubAccount.accessToken. The Model base is retro-compatible: writes
always encrypt, and reads fall back to plaintext for not-yet-migrated
values, so the migration can deploy before the code. Short-lived tokens
re-encrypt naturally on refresh, so no backfill is needed.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: gregberge

apps/backend/db/migrations/20260709120000_github-installation-token-text.js

@@ -0,0 +1,19 @@
+/**
+ * @param { import("knex").Knex } knex
+ */
+export async function up(knex) {
+  // GitHub installation access tokens have grown beyond 255 characters, which
+  // overflowed the default varchar(255) column. Widen it to text.
+  await knex.schema.alterTable("github_installations", (table) => {
+    table.text("githubToken").alter();
+  });
+}
+
+/**
+ * @param { import("knex").Knex } knex
+ */
+export async function down(knex) {
+  await knex.schema.alterTable("github_installations", (table) => {
+    table.string("githubToken").alter();
+  });
+}

apps/backend/db/structure.sql

@@ -944,7 +944,7 @@ CREATE TABLE public.github_installations (
     "updatedAt" timestamp with time zone NOT NULL,
     "githubId" integer NOT NULL,
     deleted boolean DEFAULT false NOT NULL,
-    "githubToken" character varying(255),
+    "githubToken" text,
     "githubTokenExpiresAt" timestamp with time zone,
     app text DEFAULT 'main'::text NOT NULL,
     proxy boolean DEFAULT false NOT NULL,
@@ -5199,4 +5199,5 @@ INSERT INTO public.knex_migrations(name, batch, migration_time) VALUES ('2026061
 INSERT INTO public.knex_migrations(name, batch, migration_time) VALUES ('20260620120000_pending-review-unique.js', 1, NOW());
 INSERT INTO public.knex_migrations(name, batch, migration_time) VALUES ('20260625120000_project-ignore-config.js', 1, NOW());
 INSERT INTO public.knex_migrations(name, batch, migration_time) VALUES ('20260627120000_add-screenshots-has-parent-index.js', 1, NOW());
-INSERT INTO public.knex_migrations(name, batch, migration_time) VALUES ('20260628120000_build-review-automatic.js', 1, NOW());
+INSERT INTO public.knex_migrations(name, batch, migration_time) VALUES ('20260628120000_build-review-automatic.js', 1, NOW());
+INSERT INTO public.knex_migrations(name, batch, migration_time) VALUES ('20260709120000_github-installation-token-text.js', 1, NOW());

apps/backend/src/database/models/GithubInstallation.ts

@@ -4,6 +4,8 @@ import { timestampsSchema } from "../util/schemas";
 export class GithubInstallation extends Model {
   static override tableName = "github_installations";
 
+  static override encryptedAttributes = ["githubToken"];
+
   static override jsonSchema = {
     allOf: [
       timestampsSchema,