feat: several Git repositories per project

A project keeps a list of repositories (api, web, admin…), each with its
own secret, instead of a single webhook secret. They all call the same
URL; the secret that verifies the signature tells which one it was, and
every commit, branch or pull request is linked with its repository's
name (shown on the ticket and in the MCP). Rotating or removing one
leaves the others alone, and what it linked stays.

A project that had turned the single webhook on keeps its secret, as a
repository named "principal".

API: the enable/disable endpoints and mutations give way to adding a
repository, rotating its secret and removing it (REST and GraphQL). The
web settings card lists the repositories. Docs, Word and PDF updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/application/src/lib/git/git.ts

@@ -1,4 +1,4 @@
-import { randomBytes } from 'node:crypto';
+import { randomBytes, randomUUID } from 'node:crypto';
 import {
   Command,
   CommandHandler,
@@ -7,6 +7,7 @@ import {
   Query,
   QueryHandler,
 } from '@nestjs/cqrs';
+import { NotFoundError, assertThat } from '@task-stream/api/shared/domain';
 import {
   Issue,
   ProjectRole,
@@ -15,30 +16,61 @@ import {
 } from '@task-stream/api/tracker/domain';
 import { WriteAccess } from '../commands/write-access';
 import { FindIssuesRepository } from '../ports/find-issues.repository';
-import { GitIntegrationsRepository } from '../ports/git-integrations.repository';
+import {
+  GitIntegrationsRepository,
+  GitRepositoryConfig,
+} from '../ports/git-integrations.repository';
 import { ReadAccess } from '../queries/read-access';
 import { GitMention } from './git-payloads';
 
-export interface GitIntegration {
-  enabled: boolean;
+export interface GitRepository {
+  id: string;
+  /** The project's name for it: api, web, admin… */
+  name: string;
   /** Only for whoever manages the project. */
   secret: string | null;
+  createdAt: string;
 }
 
-/** Turns the integration on with a new secret (or rotates it). */
-export class EnableGitIntegrationCommand extends Command<GitIntegration> {
+export interface GitIntegration {
+  /** On while there is at least one repository. */
+  enabled: boolean;
+  repositories: GitRepository[];
+}
+
+/** A project takes this many repositories at most. */
+export const MAX_GIT_REPOSITORIES = 20;
+
+const newSecret = () => randomBytes(24).toString('hex');
+
+/** Adds a repository with its own secret (turning the integration on). */
+export class AddGitRepositoryCommand extends Command<GitRepository> {
   constructor(
     public readonly actorId: string,
     public readonly projectId: string,
+    public readonly name: string,
   ) {
     super();
   }
 }
 
-export class DisableGitIntegrationCommand extends Command<void> {
+/** A new secret for one repository; the old one stops working at once. */
+export class RotateGitRepositorySecretCommand extends Command<GitRepository> {
   constructor(
     public readonly actorId: string,
     public readonly projectId: string,
+    public readonly repositoryId: string,
+  ) {
+    super();
+  }
+}
+
+/** Its webhooks are refused from then on; what it linked stays. */
+export class RemoveGitRepositoryCommand extends Command<void> {
+  constructor(
+    public readonly actorId: string,
+    public readonly projectId: string,
+    public readonly repositoryId: string,
   ) {
     super();
   }
@@ -48,6 +80,8 @@ export class DisableGitIntegrationCommand extends Command<void> {
 export class RecordGitMentionsCommand extends Command<number> {
   constructor(
     public readonly projectId: string,
+    /** Name of the repository whose secret signed the delivery. */
+    public readonly repository: string,
     public readonly mentions: GitMention[],
   ) {
     super();
@@ -63,39 +97,100 @@ export class GetGitIntegrationQuery extends Query<GitIntegration> {
   }
 }
 
-@CommandHandler(EnableGitIntegrationCommand)
-export class EnableGitIntegrationCommandHandler
-  implements ICommandHandler<EnableGitIntegrationCommand>
+@CommandHandler(AddGitRepositoryCommand)
+export class AddGitRepositoryCommandHandler
+  implements ICommandHandler<AddGitRepositoryCommand>
 {
   constructor(
     private readonly access: WriteAccess,
     private readonly integrations: GitIntegrationsRepository,
   ) {}
 
-  async execute(command: EnableGitIntegrationCommand): Promise<GitIntegration> {
+  async execute(command: AddGitRepositoryCommand): Promise<GitRepository> {
     (await this.access.project(command.projectId)).assertCanManage(
       command.actorId,
     );
-    const secret = randomBytes(24).toString('hex');
-    await this.integrations.save(command.projectId, secret);
-    return { enabled: true, secret };
+    const name = command.name.trim();
+    assertThat(
+      name.length > 0 && name.length <= 40,
+      'A repository needs a name of 1 to 40 characters',
+    );
+    const repositories = await this.integrations.repositoriesOf(
+      command.projectId,
+    );
+    assertThat(
+      repositories.length < MAX_GIT_REPOSITORIES,
+      `A project takes ${MAX_GIT_REPOSITORIES} repositories at most`,
+    );
+    assertThat(
+      !repositories.some((r) => r.name.toLowerCase() === name.toLowerCase()),
+      `There is already a repository named "${name}"`,
+    );
+    const added: GitRepositoryConfig = {
+      id: randomUUID(),
+      name,
+      secret: newSecret(),
+      createdAt: new Date().toISOString(),
+    };
+    await this.integrations.saveAll(command.projectId, [
+      ...repositories,
+      added,
+    ]);
+    return added;
   }
 }
 
-@CommandHandler(DisableGitIntegrationCommand)
-export class DisableGitIntegrationCommandHandler
-  implements ICommandHandler<DisableGitIntegrationCommand>
+@CommandHandler(RotateGitRepositorySecretCommand)
+export class RotateGitRepositorySecretCommandHandler
+  implements ICommandHandler<RotateGitRepositorySecretCommand>
 {
   constructor(
     private readonly access: WriteAccess,
     private readonly integrations: GitIntegrationsRepository,
   ) {}
 
-  async execute(command: DisableGitIntegrationCommand): Promise<void> {
+  async execute(
+    command: RotateGitRepositorySecretCommand,
+  ): Promise<GitRepository> {
     (await this.access.project(command.projectId)).assertCanManage(
       command.actorId,
     );
-    await this.integrations.remove(command.projectId);
+    const repositories = await this.integrations.repositoriesOf(
+      command.projectId,
+    );
+    const found = repositories.find((r) => r.id === command.repositoryId);
+    if (!found) throw new NotFoundError('Repository', command.repositoryId);
+    const rotated = { ...found, secret: newSecret() };
+    await this.integrations.saveAll(
+      command.projectId,
+      repositories.map((r) => (r.id === found.id ? rotated : r)),
+    );
+    return rotated;
+  }
+}
+
+@CommandHandler(RemoveGitRepositoryCommand)
+export class RemoveGitRepositoryCommandHandler
+  implements ICommandHandler<RemoveGitRepositoryCommand>
+{
+  constructor(
+    private readonly access: WriteAccess,
+    private readonly integrations: GitIntegrationsRepository,
+  ) {}
+
+  async execute(command: RemoveGitRepositoryCommand): Promise<void> {
+    (await this.access.project(command.projectId)).assertCanManage(
+      command.actorId,
+    );
+    const repositories = await this.integrations.repositoriesOf(
+      command.projectId,
+    );
+    if (!repositories.some((r) => r.id === command.repositoryId))
+      throw new NotFoundError('Repository', command.repositoryId);
+    await this.integrations.saveAll(
+      command.projectId,
+      repositories.filter((r) => r.id !== command.repositoryId),
+    );
   }
 }
 
@@ -119,7 +214,10 @@ export class RecordGitMentionsCommandHandler
         const issue = await this.access.live(found.id, Issue);
         if (!issue) continue;
         const before = issue.getUncommittedEvents().length;
-        issue.recordDevLink(SYSTEM_ACTOR_ID, mention.link);
+        issue.recordDevLink(SYSTEM_ACTOR_ID, {
+          ...mention.link,
+          repository: command.repository,
+        });
         if (issue.getUncommittedEvents().length === before) continue;
         await issue.commitAndWait();
         recorded++;
@@ -143,15 +241,24 @@ export class GetGitIntegrationQueryHandler
       query.projectId,
       query.viewerId,
     );
-    const secret = await this.integrations.secretOf(query.projectId);
+    const repositories = await this.integrations.repositoriesOf(
+      query.projectId,
+    );
     const manages = role === ProjectRole.OWNER || role === ProjectRole.ADMIN;
-    return { enabled: !!secret, secret: manages ? secret : null };
+    return {
+      enabled: repositories.length > 0,
+      repositories: repositories.map((r) => ({
+        ...r,
+        secret: manages ? r.secret : null,
+      })),
+    };
   }
 }
 
 export const GIT_HANDLERS = [
-  EnableGitIntegrationCommandHandler,
-  DisableGitIntegrationCommandHandler,
+  AddGitRepositoryCommandHandler,
+  RotateGitRepositorySecretCommandHandler,
+  RemoveGitRepositoryCommandHandler,
   RecordGitMentionsCommandHandler,
   GetGitIntegrationQueryHandler,
 ];