# fix\(server\): load PR uploads from SSO organizations · PR \#21632 · pingdotgg/t3code

[View on GitCafe](https://git.cafe/pingdotgg/t3code/pull/21632)

Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code)

Visibility: public

State: open

Source repository: pingdotgg/t3code

Source branch: batch-07-pr-media/sso

Target branch: batch-07-pr-media/context

Head commit: 5ebb9aa198f9d91824f6cc723c649421520ede6b

[Discussion and reviews](https://git.cafe/pingdotgg/t3code/pull/21632)

[Commits](https://git.cafe/pingdotgg/t3code/pull/21632/commits?format=markdown)

[Files changed](https://git.cafe/pingdotgg/t3code/pull/21632/diffs?format=markdown)

## Description

---

GitHub returns an HTML sign-in page for some PR uploads in organizations enforcing SAML SSO. The media proxy rejects that response, leaving images and videos unavailable.

Resolve GitHub upload media in an asset-domain Effect service. On the HTML response, render the upload through GitHub's Markdown API in its repository context and fetch the returned signed URL without a bearer token. Use the upload's repository for legacy URLs, otherwise the PR context carried by the lower layer, with checkout fallback for older clients. Cache successful signed URLs within the service, bounded by time and size and keyed by account, repository, and upload; refresh a cached 403. Preserve media bytes, ranges, response policy, and login behavior. Supply the service through request middleware once per application router.

Rebuilt from @cbangera2's signed-URL fallback in [#19191](https://github.com/pingdotgg/t3code/pull/19191). Its endpoint, signed-host handling, HTML decoding, legacy URL support, and bounded cache intent are retained. The global URL-only cache and checkout-only enterprise-context assumption were replaced to match current architecture and the human EMU finding.

Depends on [#21631](https://github.com/pingdotgg/t3code/pull/21631).

Independent Opus and Sol reviews completed two full-stack rounds; the final round found no code defects.

Verification: 44 passing / 4 expected SSO failures became 48 passing server tests; the 3 mobile preview tests also pass. Related service suites and scoped server types pass, as do targeted lint/format with one existing test warning. Scoped Knip has unrelated existing export findings and none in changed files. Independent reviews found a request-provider regression and legacy context precedence issue; both are addressed without adding redundant test cases.

[Before/after protocol and runtime proof](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9e586f3e0990c326/19191-proof.txt): the full production dev server, including actual server.ts composition and the asset GET route, returns exact binary bytes with 200 and a cached range request with 206, one Markdown render, and no authorization on signed-host requests. The RPC schema and capability minting/resolution are real; only external GitHub responses are mocked. The initial wrong request-provider composition reproduced HTTP 500 and was corrected.

A real SAML/EMU account and GitHub's signed response remain unverified. Also unverified: full app media UI, macOS, Windows, Electron desktop, iOS, Android, native playback, and remote/relay/tunnel execution. No layout change. Human approval of the authentication-sensitive external calls and live enterprise-account verification remain merge gates. No merge is planned.

CI/review status: All executed current-head CI jobs passed, including lint, build/types, package tests, all eight server shards and the latest native fingerprint job. Web and release smoke were skipped for this layer; an earlier redundant fingerprint job was cancelled, then superseded by success. [CI run](https://github.com/pingdotgg/t3code/actions/runs/39233020708). Macroscope requires human approval of the authenticated Markdown call and signed-URL cache; this remains a merge gate. No unresolved review threads at the current snapshot.

Implemented with GPT-6 Astra and GPT-6.1 Sol on Codex through T3 Code; independently reviewed by Claude Opus 5.5 and GPT-6 Sol.