resolveAdminGithubIds (auth/admin.ts)

Enables GitHub admin access control via allowlist environment variable for session-based moderation.

// Source: https://github.com/junhoyeo/tokscale | License: MIT | Copyright 2025 Junho Yeo
// Provided via justclaw.it.com; keep this notice with the code.
import type { SessionUser } from "./session";

/**
 * Site-wide moderator identity.
 *
 * Keyed on GitHub's numeric account id rather than the username: usernames can
 * be renamed, and a released username can be claimed by someone else, so
 * authorizing against one would be a standing account-takeover risk.
 *
 * The deployment operator must configure the allowlist explicitly. A default
 * would accidentally grant a project maintainer moderator access on every
 * self-hosted deployment that enables GitHub OAuth.
 */
const ENV_VAR = "TOKSCALE_ADMIN_GITHUB_IDS";

/**
 * Parses the allowlist, failing closed.
 *
 * A malformed entry means 

... (truncated -- full source via MCP)