fix(orb): degrade a thrown OAuth self-enrollment network error to the clean identity page

[bitfathers94]

fix(orb): degrade a thrown OAuth self-enrollment network error to the clean identity page

handleOrbEnrollment's three GitHub network calls -- exchangeOrbOAuthCode,
fetchOrbOAuthUser, and verifyInstallationAdmin -- handled every non-OK or
malformed response cleanly but none was wrapped in try/catch. A thrown network
error (DNS failure, or a timeout past timeoutFetch's own retry budget) escaped
handleOrbOAuthCallback as an uncaught framework 500 instead of the module's own
"Couldn't verify your GitHub identity" landing page.

Wrap each of the three calls so a rejected fetch degrades to that clean 400
page, mirroring the failure-doesn't-escape convention already used in
webhook.ts/relay.ts/ingest.ts. Cover each call's new catch path with an
integration test that rejects the corresponding fetch.

Closes #8881

Validation

Verified locally on this branch before opening:

• npm run typecheck
• npx turbo run build:tsc build:verify
• npm run test:coverage — patch coverage 100.0% of changed lines

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.57%. Comparing base (8a3d2c9) to head (f7aa64e).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8919      +/-   ##
==========================================
- Coverage   93.84%   90.57%   -3.28%     
==========================================
  Files         803       97     -706     
  Lines       80084    22539   -57545     
  Branches    24277     3904   -20373     
==========================================
- Hits        75157    20415   -54742     
+ Misses       3562     1945    -1617     
+ Partials     1365      179    -1186     

Flag	Coverage Δ
backend	97.95% <100.00%> (+2.82%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/orb/oauth.ts	97.95% <100.00%> (+0.34%)	⬆️

... and 706 files with indirect coverage changes

[loopover-orb]

Tip

✅ LoopOver review result - approve/merge recommended

_{Review updated: 2026-07-26 13:35:38 UTC}

2 files · 1 AI reviewer · no blockers · readiness 77/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This PR wraps each of handleOrbEnrollment's three sequential GitHub network calls (exchangeOrbOAuthCode, fetchOrbOAuthUser, verifyInstallationAdmin) in individual try/catch blocks, degrading a thrown network error to the existing 400 identity-error landing page instead of letting it escape as an uncaught 500. The fix is correctly scoped: each call is wrapped separately rather than with one enclosing try/catch, so a throw is never mistaken for the DB/broker error handled separately later in the function (the issueOrbEnrollment error path stays untouched). Three new integration tests each spy on timeoutFetch to reject exactly one of the three calls, confirming the 400 response and that no enrollment/registration side effect occurs — this directly exercises the new catch paths rather than fabricating an unreachable scenario.

Nits — 4 non-blocking

• The identityError() closure and the three `try { ... } catch { return identityError(); }` blocks are structurally repetitive; a small helper like `async function guarded<T>(fn: () => Promise<T>): Promise<T | typeof IDENTITY_ERROR>` could reduce duplication, though the current explicit form is arguably clearer given only three call sites.
• src/orb/oauth.ts: the `400` status code passed to identityError's `c.html(...)` call is a repeated literal already used elsewhere in the function for the same category of error, so naming it isn't strictly necessary but could aid consistency if more callers appear.
• Consider a small `tryOrIdentityError` helper if a fourth network call is added later, to avoid the try/catch boilerplate growing further.
• The comment block above handleOrbEnrollment is thorough — good practice for a security-sensitive path — no change needed.

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ✅ Gate result — Passing (No configured blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#8881
Related work	⚠️ 1 scoped overlap	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 41 registered-repo PR(s), 32 merged, 0 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	bitfathers94; Gittensor profile; 41 PR(s), 0 issue(s).
Improvement	✅ Minor	risk: clean · value: minor · LLM: moderate

Linked issue satisfaction

Addressed
The diff wraps all three GitHub network calls (exchangeOrbOAuthCode, fetchOrbOAuthUser, verifyInstallationAdmin) in try/catch, each degrading to the same clean 'Couldn't verify your GitHub identity' 400 landing page, and adds three integration tests that reject the corresponding fetchImpl for each call and assert the clean error page is returned.

Review context

• Author: bitfathers94
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: TypeScript
• Official Gittensor activity: 41 PR(s), 0 issue(s).
• Related work: Titles/paths share 3 meaningful terms. (PR #8912)

Contributor next steps

• Start here: Review top overlaps.
• Then work through the remaining 3 steps in the Signals table above.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[loopover-orb]

LoopOver approves — the gate is satisfied and CI is green.