Require fresh GitHub organization evidence

[admdly]

Summary

Require a still-valid central-auth expiry before using stored GitHub organization memberships for developer ownership verification.

Root cause

The API previously treated any parseable users.github_orgs JSON as current evidence. That allowed a copied organization list to remain usable after the auth service could no longer vouch for its freshness.

Changes

• Extend the read-only external users table definition with github_orgs_expires_at.
• Return organization memberships only when the absolute expiry parses and is in the future.
• Treat missing, malformed, or expired organization metadata as an empty membership list.
• Keep github_login independent so username verification continues to work.
• Update the D1 test schema and fixtures.
• Add regressions for fresh organization evidence, expired/missing expiry, fresh confirmed-empty lists, and unaffected username verification.

Historical developers.github_org_verified rows are not automatically expired by this change; only new verification and existing re-verification paths use fresh organization evidence.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	api	65a7172	Commit Preview URL Branch Preview URL	Jul 31 2026, 08:27 AM

[cubic-dev-ai]

All reported issues were addressed across 5 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[admdly]

Follow-up: malformed expiry validation

Validated the reported issue. Before the fix, the new regression using github_orgs_expires_at: "2099" received HTTP 200 because Date.parse("2099") returns a future timestamp.

Fix in 65a7172:

• Require the expiry string to match the RFC3339 date-time shape before parsing.
• Keep the existing future-time check.
• Add the malformed-"2099" regression alongside expired and missing expiry cases.

[cubic-dev-ai]

0 issues found across 2 files (changes from recent commits).

<sub>Auto-approved: Adds expiry check to GitHub org membership evidence, requiring future RFC3339 timestamp. Fixes stale data reuse; bounded and clearly beneficial.

Re-trigger cubic</sub>