…ession (#8)

* Initial plan

* Add GitHub OAuth identity layer with developer/admin roles

Co-authored-by: robpitcher <13648061+robpitcher@users.noreply.github.com>

* Handle OAuth denial and add try/catch to login route

Address PR #8 review:
- callback: validate CSRF state first, then handle GitHub's �rror
  query param (e.g. access_denied) explicitly with an accurate
  identity_login_denied audit entry and 401 response, and report a
  distinct identity_login_missing_code case instead of mislabeling
  cancelled logins as invalid state.
- login: wrap handler in try/catch with console.error and a generic
  500 JSON response, matching the repo API route convention.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Revert unrelated next-env.d.ts churn

This auto-generated file (managed by Next.js, 'should not be edited')
was changed in the PR's base commit only because the authoring
environment ran `next build` (writes .next/types/) while main and
local `next dev` produce .next/dev/types/. Restore main's version so
PR #8 contains only the intentional identity changes.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: robpitcher <13648061+robpitcher@users.noreply.github.com>
Co-authored-by: robpitcher <robpitcher@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

… row-level scoping (#11)

* Initial plan

* Persist per-user AI credit rows via async report export + server-side row-level scoping

Co-authored-by: robpitcher <13648061+robpitcher@users.noreply.github.com>

* Revert unrelated next-env.d.ts build-artifact churn

Co-authored-by: robpitcher <13648061+robpitcher@users.noreply.github.com>

* feat(settings): update GitHub token requirements and enhance documentation

Updated the required scopes for GitHub Personal Access Tokens to include 'manage_billing:enterprise'. Enhanced documentation to reflect these changes and added details about the AI credit usage report export functionality.

* feat(auth, api, db, etl): enhance user scope handling and error reporting

Refactor user scope resolution to ensure consistent case-insensitive matching. Update API routes to enforce row-level security for developer roles. Improve error handling in ETL processes to prevent silent failures when reports complete without download URLs.

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: robpitcher <13648061+robpitcher@users.noreply.github.com>
Co-authored-by: robpitcher <robpitcher@microsoft.com>

…(#12)

* Initial plan

* Add My Usage page, session endpoint, role-based nav gating, i18n

Co-authored-by: robpitcher <13648061+robpitcher@users.noreply.github.com>

* Document auth modes + billing source in README; add session endpoint test

Co-authored-by: robpitcher <13648061+robpitcher@users.noreply.github.com>

* Restore dev next-env.d.ts (revert build artifact change)

Co-authored-by: robpitcher <13648061+robpitcher@users.noreply.github.com>

* feat(sidebar, translations): add user session display and translations

Implement user session display in the sidebar for signed-in users.
Add translations for "signed in as" in Arabic, English, Spanish, and French to support localization.

* Address PR #12 review: locale-aware My Usage formatting + nav gating polish

- My Usage: format currency/numbers and the month label with the active locale (Intl.NumberFormat/DateTimeFormat) instead of hardcoded en-US, so they follow the LocaleProvider language (en/ar/es/fr).

- My Usage: clamp month navigation to the API's supported lower bound (year >= 2020) and disable the Prev button at the floor, avoiding an error state from out-of-range requests.

- Sidebar: track session load state and render a nav skeleton (and defer the Settings link) until /api/auth/session resolves, preventing identity-mode developers from briefly seeing org-wide links.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: robpitcher <13648061+robpitcher@users.noreply.github.com>
Co-authored-by: robpitcher <robpitcher@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>