security: reject dryRun:false with empty syncedGoalIds (GLA-1077 MED-3)

Guard against accidental full-company mirror: POST /integrations/github
now returns 422 when dryRun is disabled but syncedGoalIds is empty.
Matches the safe-default requirement from the GLA-38 threat model.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Author: jqueguiner

server/src/__tests__/github-integration-handshake.test.ts

@@ -190,6 +190,52 @@ describe("POST /integrations/github — token-to-repo handshake", () => {
     expect(mockRegistry.upsertCompanySettings).toHaveBeenCalledOnce();
   });
 
+  it("accepts dryRun:true with empty syncedGoalIds (onboarding path)", async () => {
+    mockFetch.mockResolvedValue(makeFetchResponse(200));
+
+    const app = await createApp();
+    const res = await post(app, {
+      repo: "owner/new-repo",
+      secretRef: SECRET_ID,
+      syncedGoalIds: [],
+      dryRun: true,
+    });
+
+    expect(res.status).toBe(200);
+    expect(mockRegistry.upsertCompanySettings).toHaveBeenCalledOnce();
+  });
+
+  it("accepts dryRun:false when syncedGoalIds is non-empty", async () => {
+    const goalId = "cccccccc-cccc-cccc-cccc-cccccccccccc";
+    mockGoals.list.mockResolvedValue([{ id: goalId }]);
+    mockFetch.mockResolvedValue(makeFetchResponse(200));
+
+    const app = await createApp();
+    const res = await post(app, {
+      repo: "owner/new-repo",
+      secretRef: SECRET_ID,
+      syncedGoalIds: [goalId],
+      dryRun: false,
+    });
+
+    expect(res.status).toBe(200);
+    expect(mockRegistry.upsertCompanySettings).toHaveBeenCalledOnce();
+  });
+
+  it("returns 422 and does not persist when dryRun:false and syncedGoalIds is empty", async () => {
+    const app = await createApp();
+    const res = await post(app, {
+      repo: "owner/new-repo",
+      secretRef: SECRET_ID,
+      syncedGoalIds: [],
+      dryRun: false,
+    });
+
+    expect(res.status).toBe(422);
+    expect(res.body.error).toMatch(/syncedGoalIds must list at least one goal/i);
+    expect(mockRegistry.upsertCompanySettings).not.toHaveBeenCalled();
+  });
+
   it("redacts token from 401 error body before surfacing", async () => {
     const leakyBody = `{"message":"Bad credentials for token ${FAKE_TOKEN}"}`;
     mockFetch.mockResolvedValue(makeFetchResponse(401, leakyBody));

server/src/routes/github-integration.ts

@@ -166,6 +166,12 @@ export function githubIntegrationRoutes(db: Db) {
       dryRun: body["dryRun"] !== false,
     };
 
+    if (configToSave.dryRun === false && configToSave.syncedGoalIds.length === 0) {
+      throw unprocessable(
+        "syncedGoalIds must list at least one goal when dryRun is disabled — leaving it empty would mirror every issue in the company. Either pick the goal subtrees you want to sync, or keep dryRun enabled.",
+      );
+    }
+
     // Validate that the configured token is authorised on the target repo whenever
     // the repo value changes.  Skipped when repo is unchanged to avoid an extra
     // GitHub round-trip on every config save.