Function fetchGithubCreatedAt

web/src/server/free-session/abuse-detection.ts:478–501

* Look up a GitHub user by numeric ID and return their `created_at`. * Returns `'rate-limited'` so callers can log it distinctly from other * failures (most likely cause at our scale). Any non-2xx is mapped to * `null` so one flaky user doesn't stall the sweep.

(
  githubId: string,
)

 * `null` so one flaky user doesn't stall the sweep.
 */
async function fetchGithubCreatedAt(
  githubId: string,
): Promise<Date | 'rate-limited' | null> {
  try {
    const headers: Record<string, string> = {
      Accept: 'application/vnd.github+json',
      'X-GitHub-Api-Version': '2022-11-28',
      'User-Agent': 'codebuff-bot-sweep',
    }
    if (env.BOT_SWEEP_GITHUB_TOKEN) {
      headers.Authorization = `Bearer ${env.BOT_SWEEP_GITHUB_TOKEN}`
    }
    const res = await fetch(`https://api.github.com/user/${githubId}`, {
      headers,
      signal: AbortSignal.timeout(GITHUB_API_TIMEOUT_MS),
    })
    if (res.status === 403 || res.status === 429) return 'rate-limited'
    if (!res.ok) return null
    const data = (await res.json()) as { created_at?: string }
    return data.created_at ? new Date(data.created_at) : null
  } catch {
    return null
  }
}

function findCreationClusters(
  rows: { email: string; createdAt: Date }[],