Function enrichWithGithubAge

web/src/server/free-session/abuse-detection.ts:407–470

(
  suspects: BotSuspect[],
  now: Date,
  logger: Logger,
)

}

async function enrichWithGithubAge(
  suspects: BotSuspect[],
  now: Date,
  logger: Logger,
): Promise<void> {
  const targets = suspects.filter((s) => s.githubId)
  if (targets.length === 0) return

  const queue = [...targets]
  let failures = 0
  let rateLimited = 0

  const worker = async () => {
    while (queue.length > 0) {
      const s = queue.shift()
      if (!s?.githubId) continue
      const result = await fetchGithubCreatedAt(s.githubId)
      if (result === 'rate-limited') {
        rateLimited++
        continue
      }
      if (result === null) {
        failures++
        continue
      }
      const ageDays = (now.getTime() - result.getTime()) / 86400_000
      s.githubAgeDays = ageDays
      if (ageDays < 7) {
        s.flags.push(`gh-new<7d:${ageDays.toFixed(1)}d`)
        s.score += 60
      } else if (ageDays < 30) {
        s.flags.push(`gh-new<30d:${ageDays.toFixed(0)}d`)
        s.score += 30
      } else if (ageDays < 90) {
        s.flags.push(`gh-new<90d:${ageDays.toFixed(0)}d`)
        s.score += 10
      } else if (ageDays >= 365 * 3) {
        // Established GitHub accounts are a strong counter-signal: buying
        // a 3+ year old account is rare at our abuse scale. Subtract enough
        // to pull a day-1 heavy user (new-acct<1d + very-heavy = 90) back
        // below the high-tier threshold without fully clearing them —
        // genuine 24/7 patterns still surface.
        s.counterSignals.push(`gh-established:${(ageDays / 365).toFixed(1)}y`)
        s.score -= 40
      } else if (ageDays >= 365) {
        s.counterSignals.push(`gh-established:${(ageDays / 365).toFixed(1)}y`)
        s.score -= 20
      }
    }
  }

  await Promise.all(
    Array.from({ length: Math.min(GITHUB_API_CONCURRENCY, targets.length) }, () =>
      worker(),
    ),
  )

  if (failures > 0 || rateLimited > 0) {