Use user GitHub OAuth token for repochecker API calls by Copilot · Pull Request #203 · ioBroker/dev-portal

Copilot · 2026-09-02T15:00:45Z

SET AS STABLE could fail with a GitHub API 403. The repochecker made unauthenticated requests and ran into the shared limit of 60 requests per hour. With this change, checks run with the logged-in user's GitHub token, so they get authenticated rate limits.

Backend /api/repochecker/
- Reads the user's token from the existing gh-token session cookie, the same way /api/user/ does, and passes it as queryStringParameters.githubToken. That parameter is supported by @iobroker/repochecker ≥ 5.21.0; the backend uses 5.22.4.
- Requires login: a request without the cookie gets 401.
- Concurrency: one check runs at a time and up to 10 more wait in a queue. When the queue is full, new requests get 429. Each user can have only one check running or queued at a time; a second one also gets 429.
- Errors return a generic 500 without the error details or the token.
Frontend: no changes. The cookie is sent automatically, and both places that run a check already require a logged-in user.
Tests: npm test in express/backend (node:test) covers passing the token, the login requirement, the per-user limit, the queue and its cap, and error redaction.

Why only one check at a time: repochecker still keeps a module-level Axios instance and log redaction state in lib/common.js. Parallel checks could therefore use another user's token or log it unredacted. This is tracked upstream in ioBroker/ioBroker.repochecker#1193. A TODO at MAX_PARALLEL_CHECKS says to raise the limit to 3 once that is fixed.

Fixes [Bug] Unauthenticated GitHub API requests cause 403 Rate Limit errors when clicking "SET AS STABLE" #196

🤖 Generated with Claude Code

https://claude.ai/code/session_01BSR3invYVCrhJk7Swpp9qn

Co-authored-by: Apollon77 <11976694+Apollon77@users.noreply.github.com>

Copilot

🟡 Changes recommended

The installed repochecker version ignores the forwarded header, leaving GitHub requests unauthenticated.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Attempts to authenticate repochecker GitHub API calls with the logged-in user’s OAuth token.

Changes:

Passes the token from both frontend check flows.
Adds the token as an authorization header.
Forwards and types the header in the backend.

File summaries

File	Description
`express/frontend/src/tools/AdapterCheck.tsx`	Passes the user token.
`express/frontend/src/tools/adapter/releases/UpdateRepositoriesDialog.tsx`	Passes the token during releases.
`express/frontend/src/lib/ioBroker.ts`	Adds the authorization header.
`express/backend/src/api/repochecker.ts`	Forwards the header to repochecker.
`express/backend/src/@types/iobroker__repochecker/index.d.ts`	Extends request typing.

Review details

Files reviewed: 4/5 changed files
Comments generated: 1
Review effort level: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Co-authored-by: Apollon77 <11976694+Apollon77@users.noreply.github.com>

Copilot

🟡 Changes recommended

IPC results can be dropped and unbounded worker creation creates a resource-exhaustion risk.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Files reviewed: 5/5 changed files
Comments generated: 3
Review effort level: Balanced

Apollon77 · 2026-09-02T15:55:47Z

Ok, STOP here, we go to draft ... the env variable will not work here ... I do not like to fork that many processes ... We should adjust the repo checker library that we get this as a lib parameter

UncleSamSwiss · 2026-09-03T07:22:09Z

on hold: waiting for changes to repochecker according to @Apollon77

mcm1957 · 2026-09-05T17:16:54Z

@Apollon77 @UncleSamSwiss

Repochecker 5.21.0 accepts a new paramater githubToken. If request.queryStringParameters.githubToken is set this string will be used as github token to authenticate for axios calls. The token will NOT be loaded into the environment but only store within code.

Feel free to test.

Apollon77 · 2026-10-08T06:39:20Z

@copilot Update the PR and use the new parameter in the

Repochecker 5.21.0 accepts a new paramater githubToken. If request.queryStringParameters.githubToken is set this string will be used as github token to authenticate for axios calls. The token will NOT be loaded into the environment but only store within code.

Co-authored-by: Apollon77 <11976694+Apollon77@users.noreply.github.com>

Copilot

🟢 Approval recommended

The authenticated token flow is correctly wired and tested; the only finding is a non-blocking stale version reference.

1 open finding

Avoid stale version reference in Axios serialization rationale · New

3 resolved since last review

This publicly reachable route now creates a full Node process for every request, with neither a…
process.send() is asynchronous, but the worker exits immediately after calling it. The result can…
The PR description still says the authorization header is added to the repochecker handler input…

Files not reviewed (1)

express/backend/package-lock.json: Generated file

🧠 Review effort: Balanced

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

UncleSamSwiss

Thanks a lot for the PR!
The I would change to simply use the cookie that is already in every request (see attached screenshot in the second comment).
See also my first comment about the (IMHO) overly restrictive access check (i.e. single repo check at any time).

mcm1957 · 2026-10-10T21:48:22Z

@Apollon77 @UncleSamSwiss

Any reason to wait?
Something needs a fix?

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Apollon77

@copilot Address the comments

…checks - Use the existing gh-token cookie instead of a separate Authorization header; revert the frontend changes that sent the token explicitly. - Replace the global single-check lock (503) with a small queue that runs up to 3 checks in parallel, plus one in-flight check per user (429). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BSR3invYVCrhJk7Swpp9qn

Copilot

🟡 Changes recommended

Parallel execution can mix user credentials upstream, and the public queue is unbounded.

1 open finding

Unbounded unauthenticated queue enables memory exhaustion · New

1 resolved since last review

Avoid stale version reference in Axios serialization rationale

Files not reviewed (1)

express/backend/package-lock.json: Generated file

🧠 Review effort: Balanced

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BSR3invYVCrhJk7Swpp9qn

Requests without the gh-token cookie now get 401. Both frontend flows already require a logged-in user, so the UI is unaffected. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BSR3invYVCrhJk7Swpp9qn

Copilot

🟡 Changes recommended

Client-controlled cookies bypass authentication, and parallel checks can use another user's OAuth token through repochecker's shared Axios state.

1 open finding

Concurrent checks share OAuth credentials across users · New

1 resolved since last review

Unbounded unauthenticated queue enables memory exhaustion

Files not reviewed (1)

express/backend/package-lock.json: Generated file

🧠 Review effort: Balanced

repochecker still shares a module-level Axios instance and redaction state between checks, so parallel checks could use or log another user's token. Checks are queued instead of rejected; raise the limit once ioBroker/ioBroker.repochecker#1193 is fixed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BSR3invYVCrhJk7Swpp9qn

Copilot

🟡 Changes recommended

A stalled repochecker request can permanently occupy the sole execution slot and disable subsequent checks.

1 open finding

Add cancellable deadline to prevent permanently hung checks · New

1 resolved since last review

Concurrent checks share OAuth credentials across users

Files not reviewed (1)

express/backend/package-lock.json: Generated file

🧠 Review effort: Balanced

+function runRepochecker(request: CheckRequest): Promise<CheckResult> {
+	return new Promise((resolve, reject) => {
+		handler(request, null, (error, result) => {


Copilot

🔵 Needs a closer look

A stalled repochecker request can permanently occupy the sole execution slot and disable the endpoint.

1 open finding

Add cancellable deadline to prevent permanently hung checks

Files not reviewed (1)

express/backend/package-lock.json: Generated file

🧠 Review effort: Balanced

Initial plan

2e2a8be

Copilot AI assigned Copilot and Apollon77 Sep 2, 2026

Copilot started work on behalf of Apollon77 September 2, 2026 15:01 View session

Copilot AI linked an issue Sep 2, 2026 that may be closed by this pull request

[Bug] Unauthenticated GitHub API requests cause 403 Rate Limit errors when clicking "SET AS STABLE" #196

Closed

fix: forward github auth to repochecker endpoint

dfbff16

Co-authored-by: Apollon77 <11976694+Apollon77@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix 403 rate limit errors on unauthenticated API requests~~ Use user GitHub OAuth token for repochecker API calls Sep 2, 2026

Copilot finished work on behalf of Apollon77 September 2, 2026 15:06

Copilot AI requested a review from Apollon77 September 2, 2026 15:06

Apollon77 requested a balanced review from Copilot September 2, 2026 15:07

Copilot started reviewing on behalf of Apollon77 September 2, 2026 15:07 View session

Apollon77 requested a review from UncleSamSwiss September 2, 2026 15:07

Apollon77 marked this pull request as ready for review September 2, 2026 15:08

Copilot AI reviewed Sep 2, 2026

View reviewed changes

Comment thread express/backend/src/api/repochecker.ts Outdated

Copilot started work on behalf of Apollon77 September 2, 2026 15:23 View session

Copilot AI and others added 3 commits September 2, 2026 15:26

fix: run repochecker with request token

24977d9

Co-authored-by: Apollon77 <11976694+Apollon77@users.noreply.github.com>

fix: sanitize repochecker auth handling

0c3dec3

Co-authored-by: Apollon77 <11976694+Apollon77@users.noreply.github.com>

fix: hide repochecker backend errors

afd7f98

Co-authored-by: Apollon77 <11976694+Apollon77@users.noreply.github.com>

Copilot finished work on behalf of Apollon77 September 2, 2026 15:30

Apollon77 requested a balanced review from Copilot September 2, 2026 15:37

Copilot started reviewing on behalf of Apollon77 September 2, 2026 15:38 View session

Copilot AI reviewed Sep 2, 2026

View reviewed changes

Comment thread express/backend/src/api/repochecker-worker.js Outdated

Comment thread express/backend/src/api/repochecker.ts Outdated

Comment thread express/backend/src/api/repochecker.ts Outdated

Apollon77 marked this pull request as draft September 2, 2026 15:55

UncleSamSwiss added the on hold label Sep 3, 2026

Copilot started work on behalf of Apollon77 October 8, 2026 06:42 View session

fix: use repochecker 5.21.0 githubToken parameter

7796961

Co-authored-by: Apollon77 <11976694+Apollon77@users.noreply.github.com>

Copilot AI reviewed Oct 8, 2026

View reviewed changes

Comment thread express/backend/src/api/repochecker.ts Outdated

UncleSamSwiss removed the on hold label Oct 9, 2026

UncleSamSwiss requested changes Oct 9, 2026

View reviewed changes

Comment thread express/backend/src/api/repochecker.ts Outdated

Comment thread express/backend/src/api/repochecker.ts Outdated

Comment thread express/frontend/src/lib/ioBroker.ts Outdated

Update comment for Axios instance usage

a277f3b

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Apollon77 reviewed Oct 12, 2026

View reviewed changes

Comment thread express/backend/src/api/repochecker.ts Outdated

Comment thread express/backend/src/api/repochecker.ts Outdated

Comment thread express/frontend/src/lib/ioBroker.ts Outdated

Copilot started work on behalf of Apollon77 October 12, 2026 20:04 View session

Copilot stopped work on behalf of Apollon77 due to an error October 12, 2026 20:04
Execution failed: CAPIError: 400 validating image item: image media type is required (Request ID: E80A:2028AF:BB04CC:DCB834:6ACD3D57)

Copilot AI requested a review from Apollon77 October 12, 2026 20:04

Apollon77 requested a balanced review from Copilot October 13, 2026 06:40

Copilot started reviewing on behalf of Apollon77 October 13, 2026 06:40 View session

Copilot AI reviewed Oct 13, 2026

View reviewed changes

Comment thread express/backend/src/api/repochecker.ts

claude added 2 commits October 13, 2026 06:53

Bound the repochecker queue and reject excess checks with 429

faa53ab

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BSR3invYVCrhJk7Swpp9qn

Apollon77 requested a balanced review from Copilot and removed request for Apollon77 October 13, 2026 06:59

Copilot started reviewing on behalf of Apollon77 October 13, 2026 06:59 View session

Copilot AI reviewed Oct 13, 2026

View reviewed changes

Comment thread express/backend/src/api/repochecker.ts Outdated

Apollon77 mentioned this pull request Oct 13, 2026

[BUG] githubToken is not isolated per check: module-level axiosInstance and redaction state are shared ioBroker/ioBroker.repochecker#1193

Closed

Apollon77 requested a balanced review from Copilot October 13, 2026 07:24

Copilot started reviewing on behalf of Apollon77 October 13, 2026 07:24 View session

Copilot AI reviewed Oct 13, 2026

View reviewed changes

Comment thread express/backend/src/api/repochecker.ts

Comment on lines +50 to +52

function runRepochecker(request: CheckRequest): Promise<CheckResult> {

return new Promise((resolve, reject) => {

handler(request, null, (error, result) => {

Apollon77 requested a balanced review from Copilot October 13, 2026 07:36

Copilot started reviewing on behalf of Apollon77 October 13, 2026 07:36 View session

Copilot AI reviewed Oct 13, 2026

View reviewed changes

Apollon77 merged commit 8bbb6e1 into main Oct 13, 2026
3 checks passed

This was referenced Oct 14, 2026

fix: isolate axios instance and token redaction per check ioBroker/ioBroker.repochecker#1198

Merged

fix: isolate axios instance and token redaction per check ioBroker/ioBroker.repochecker#1199

Merged

Conversation

Copilot AI commented Sep 2, 2026 • edited by Apollon77 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Apollon77 commented Sep 2, 2026

Uh oh!

UncleSamSwiss commented Sep 3, 2026

Uh oh!

mcm1957 commented Sep 5, 2026

Uh oh!

Apollon77 commented Oct 8, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Uh oh!

UncleSamSwiss left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mcm1957 commented Oct 10, 2026

Uh oh!

Apollon77 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Copilot AI commented Sep 2, 2026 •

edited by Apollon77

Loading