✨(github): Add username-based installation filtering

frontend/apps/app/app/projects/new/page.tsx

@@ -1,4 +1,4 @@
-import { getInstallations } from '@liam-hq/github'
+import { getInstallationsForUsername } from '@liam-hq/github'
 import { redirect } from 'next/navigation'
 import { ProjectNewPage } from '../../../components/ProjectNewPage'
 import { getOrganizationId } from '../../../features/organizations/services/getOrganizationId'
@@ -31,7 +31,43 @@ export default async function NewProjectPage() {
     redirect(urlgen('login'))
   }
 
-  const { installations } = await getInstallations(data.session)
+  // Derive GitHub username from Supabase user metadata (GitHub provider) without using `any`
+  const isRecord = (value: unknown): value is Record<string, unknown> =>
+    typeof value === 'object' && value !== null
+
+  const usernameFromUserMetadata = (() => {
+    const userMetadata = user.user_metadata as unknown
+    if (isRecord(userMetadata)) {
+      const userNameField = userMetadata['user_name']
+      if (typeof userNameField === 'string') return userNameField
+    }
+    return undefined
+  })()
+
+  const usernameFromIdentities = (() => {
+    const identities = Array.isArray(user.identities) ? user.identities : []
+    const githubIdentity = identities.find(
+      (identity) =>
+        identity &&
+        typeof identity.provider === 'string' &&
+        identity.provider === 'github',
+    )
+    const identityData = githubIdentity?.identity_data as unknown
+    if (isRecord(identityData)) {
+      const userNameField = identityData['user_name']
+      if (typeof userNameField === 'string') return userNameField
+    }
+    return undefined
+  })()
+
+  const githubLogin = usernameFromUserMetadata ?? usernameFromIdentities
+
+  if (!githubLogin) {
+    console.error('GitHub login not found on user metadata')
+    redirect(urlgen('login'))
+  }
+
+  const { installations } = await getInstallationsForUsername(githubLogin)
 
   return (
     <ProjectNewPage

frontend/internal-packages/github/src/api.server.ts

@@ -6,7 +6,7 @@ import {
 import { createAppAuth } from '@octokit/auth-app'
 import { Octokit } from '@octokit/rest'
 import { err, type Result, type ResultAsync } from 'neverthrow'
-import type { GitHubContentItem } from './types'
+import type { GitHubContentItem, Installation } from './types'
 
 const createOctokit = async (installationId: number) => {
   const octokit = new Octokit({
@@ -21,6 +21,102 @@ const createOctokit = async (installationId: number) => {
   return octokit
 }
 
+const createAppOctokit = async () => {
+  const octokit = new Octokit({
+    authStrategy: createAppAuth,
+    auth: {
+      appId: process.env['GITHUB_APP_ID'],
+      privateKey: process.env['GITHUB_PRIVATE_KEY']?.replace(/\\n/g, '\n'),
+    },
+  })
+
+  return octokit
+}
+
+export const getInstallationsForOwners = async (
+  ownerLogins: string[],
+): Promise<{ installations: Installation[] }> => {
+  const appOctokit = await createAppOctokit()
+
+  const allInstallations = (await appOctokit.paginate(
+    appOctokit.request,
+    'GET /app/installations',
+  )) as Installation[]
+
+  if (!ownerLogins || ownerLogins.length === 0) {
+    return { installations: allInstallations as Installation[] }
+  }
+
+  const allowedOwnerLogins = new Set(
+    ownerLogins.map((login) => login.toLowerCase()),
+  )
+
+  const filteredInstallations = allInstallations.filter(
+    (installation: Installation) => {
+      const accountLogin = (
+        installation.account as { login?: string } | null
+      )?.login
+      return accountLogin
+        ? allowedOwnerLogins.has(accountLogin.toLowerCase())
+        : false
+    },
+  ) as Installation[]
+
+  return { installations: filteredInstallations }
+}
+
+export const getInstallationsForUsername = async (
+  username: string,
+): Promise<{ installations: Installation[] }> => {
+  const appOctokit = await createAppOctokit()
+
+  const allInstallations = (await appOctokit.paginate(
+    appOctokit.request,
+    'GET /app/installations',
+  )) as Installation[]
+
+  const normalizedUsername = username.toLowerCase()
+
+  const matchedInstallations: Installation[] = []
+
+  for (const installation of allInstallations) {
+    const account = installation.account as
+      | { type?: string; login?: string }
+      | null
+    const accountLogin = account?.login
+    const accountType = account?.type
+
+    if (!accountLogin || !accountType) continue
+
+    if (accountType === 'User') {
+      if (accountLogin.toLowerCase() === normalizedUsername) {
+        matchedInstallations.push(installation)
+      }
+      continue
+    }
+
+    if (accountType === 'Organization') {
+      try {
+        // Authenticate as the installation to check membership for the user directly
+        const installationOctokit = await createOctokit(installation.id)
+        await installationOctokit.request(
+          'GET /orgs/{org}/members/{username}',
+          {
+            org: accountLogin,
+            username,
+          },
+        )
+        // If the request succeeds, the user is a member
+        matchedInstallations.push(installation)
+      } catch {
+        // 404 or permission issues -> treat as not a member
+      }
+    }
+  }
+
+  return { installations: matchedInstallations }
+}
+
 export const getPullRequestDetails = async (
   installationId: number,
   owner: string,