Best GitHub Phone Validation API & Developer Security Integration 2025

// Repository access control with phone validation
const { Octokit } = require('@octokit/rest');

class GitHubPhoneValidator {
  constructor(githubToken, lookupApiKey) {
    this.octokit = new Octokit({ auth: githubToken });
    this.lookupApiKey = lookupApiKey;
  }

  async validateRepositoryAccess(owner, repo, username) {
    try {
      // Get user's phone validation status
      const phoneValidation = await this.getUserPhoneValidation(username);
      
      if (!phoneValidation) {
        // Request phone validation
        await this.requestPhoneValidation(username, owner, repo);
        return { access: 'pending', reason: 'Phone validation required' };
      }
      
      // Determine access level based on validation
      const accessLevel = this.determineAccessLevel(phoneValidation);
      
      // Apply repository permissions
      if (accessLevel === 'full') {
        await this.grantFullAccess(owner, repo, username);
      } else if (accessLevel === 'limited') {
        await this.grantLimitedAccess(owner, repo, username);
      } else {
        await this.denyAccess(owner, repo, username);
      }
      
      return { 
        access: accessLevel, 
        phoneValidation,
        permissions: await this.getRepositoryPermissions(owner, repo, username)
      };
      
    } catch (error) {
      console.error('Repository access validation error:', error);
      throw error;
    }
  }

  determineAccessLevel(phoneValidation) {
    if (!phoneValidation.isValid) return 'denied';
    if (phoneValidation.fraudScore > 80) return 'denied';
    if (phoneValidation.fraudScore > 50) return 'limited';
    if (phoneValidation.carrierType === 'VOIP') return 'limited';
    return 'full';
  }

  async grantFullAccess(owner, repo, username) {
    // Add user as collaborator with push access
    await this.octokit.rest.repos.addCollaborator({
      owner,
      repo,
      username,
      permission: 'push'
    });
    
    // Add to relevant teams
    const teams = await this.getRelevantTeams(owner, repo);
    for (const team of teams) {
      await this.octokit.rest.teams.addOrUpdateMembershipForUserInOrg({
        org: owner,
        team_slug: team.slug,
        username,
        role: 'member'
      });
    }
    
    console.log(`Granted full access to ${username} for ${owner}/${repo}`);
  }

  async grantLimitedAccess(owner, repo, username) {
    // Add user as collaborator with read access only
    await this.octokit.rest.repos.addCollaborator({
      owner,
      repo,
      username,
      permission: 'pull'
    });
    
    // Create issue explaining limited access
    await this.octokit.rest.issues.create({
      owner,
      repo,
      title: `Limited Repository Access - @${username}`,
      body: `
@${username}, you have been granted limited access to this repository.

**Reason:** Phone validation indicates medium risk level.

**Current Permissions:**
- ✅ Clone and pull repository
- ✅ Create issues and comments
- ❌ Push to branches
- ❌ Merge pull requests

To gain full access, please:
1. Update your phone number to a verified mobile number
2. Contact the repository maintainers for review

If you believe this is an error, please reach out to the security team.
      `,
      labels: ['access-control', 'phone-validation']
    });
    
    console.log(`Granted limited access to ${username} for ${owner}/${repo}`);
  }

  async denyAccess(owner, repo, username) {
    // Remove user if they were previously added
    try {
      await this.octokit.rest.repos.removeCollaborator({
        owner,
        repo,
        username
      });
    } catch (error) {
      // User might not be a collaborator yet
    }
    
    // Create issue explaining denial
    await this.octokit.rest.issues.create({
      owner,
      repo,
      title: `Repository Access Denied - @${username}`,
      body: `
@${username}, access to this repository has been denied due to phone validation concerns.

**Reason:** High risk phone number detected or invalid phone number.

**Next Steps:**
1. Verify your identity with repository maintainers
2. Provide alternative verification methods
3. Update your contact information

For security reasons, this repository requires verified contact information for all contributors.

Please contact the security team if you need assistance.
      `,
      labels: ['access-denied', 'security', 'phone-validation']
    });
    
    console.log(`Denied access to ${username} for ${owner}/${repo}`);
  }

  async getUserPhoneValidation(username) {
    // Check internal database for existing validation
    const existingValidation = await this.db.getPhoneValidation(username);
    if (existingValidation && this.isValidationCurrent(existingValidation)) {
      return existingValidation;
    }
    
    // Get user's public profile for phone number
    const { data: user } = await this.octokit.rest.users.getByUsername({
      username
    });
    
    const phoneNumber = this.extractPhoneFromProfile(user);
    if (!phoneNumber) return null;
    
    // Validate phone number
    const validation = await this.validatePhoneNumber(phoneNumber);
    
    // Store validation result
    await this.db.storePhoneValidation(username, phoneNumber, validation);
    
    return {
      isValid: validation.is_valid,
      fraudScore: validation.spam_score,
      carrierType: validation.carrier_type,
      country: validation.country,
      phoneNumber,
      validatedAt: new Date()
    };
  }

  extractPhoneFromProfile(user) {
    if (!user.bio) return null;
    
    // Look for phone number patterns in bio
    const phonePatterns = [
      /(?:phone|tel|mobile|contact):\s*([+\d\s-()]+)/i,
      /\+?[1-9]\d{1,14}/
    ];
    
    for (const pattern of phonePatterns) {
      const match = user.bio.match(pattern);
      if (match) {
        return match[1] || match[0];
      }
    }
    
    return null;
  }
}

// Usage example
const validator = new GitHubPhoneValidator(
  process.env.GITHUB_TOKEN,
  process.env.ONELOOKUP_API_KEY
);

// Validate access for a new contributor
const accessResult = await validator.validateRepositoryAccess(
  'myorg', 
  'sensitive-repo', 
  'new-contributor'
);

console.log('Access result:', accessResult);