@effected/github 0.25.0 → 0.26.0

package/internal/requestOptions.js

@@ -0,0 +1,84 @@
+// src/internal/requestOptions.ts
+/**
+* The options `@octokit/endpoint`'s `parse` reads off the flat parameter
+* object, plus `data`, which replaces the body.
+*
+* @internal
+*/
+const OCTOKIT_REQUEST_OPTION_KEYS = /* @__PURE__ */ new Set([
+	"method",
+	"baseUrl",
+	"url",
+	"headers",
+	"request",
+	"mediaType",
+	"data"
+]);
+/**
+* The template parameters of `PATCH /repos/{owner}/{repo}`, which octokit
+* consumes as the path and never sends.
+*
+* @internal
+*/
+const REPOSITORY_PATCH_ROUTE_PARAMS = /* @__PURE__ */ new Set(["owner", "repo"]);
+/**
+* The template parameters of
+* `PUT /repos/{owner}/{repo}/environments/{environment_name}`, which octokit
+* consumes as the path and never sends.
+*
+* @internal
+*/
+const ENVIRONMENT_PUT_ROUTE_PARAMS = /* @__PURE__ */ new Set([
+	"owner",
+	"repo",
+	"environment_name"
+]);
+/**
+* Why a key of an open body map may not be sent on a route whose template
+* names `routeParams`, or `undefined` when it may.
+*
+* @remarks
+* `noun` names what the map holds, with its article ("a repository setting",
+* "an environment setting"), in the reason. `__proto__` is refused for a different reason:
+* assigning it to a body object sets the object's prototype instead of a
+* field, so the key would vanish from the wire while being reported sent.
+*
+* @internal
+*/
+const reservedBodyKey = (key, routeParams, noun) => OCTOKIT_REQUEST_OPTION_KEYS.has(key) ? `is an octokit request option, not ${noun}` : routeParams.has(key) ? `is the route's own path parameter, not ${noun}` : key === "__proto__" ? "would set the body's prototype instead of a field" : void 0;
+/**
+* Why a repository-settings key may not be sent, or `undefined` when it may.
+*
+* @internal
+*/
+const reservedSettingKey = (key) => reservedBodyKey(key, REPOSITORY_PATCH_ROUTE_PARAMS, "a repository setting");
+/**
+* The request options the raw surface (`request`, `requestDecoded`,
+* `paginate`, `paginateStream`) lets a caller pass: the two typed
+* `Rest.RequestExtras`, and `data`, which replaces the body but cannot move
+* the request.
+*
+* @internal
+*/
+const RAW_PASSTHROUGH_OPTION_KEYS = /* @__PURE__ */ new Set([
+	"headers",
+	"mediaType",
+	"data"
+]);
+/**
+* Why a parameter of a raw-surface call may not be sent, or `undefined` when
+* it may.
+*
+* @remarks
+* The rest of {@link OCTOKIT_REQUEST_OPTION_KEYS}: `baseUrl` and `url` pick
+* the host the token goes to, `request` swaps the fetch that receives it, and
+* `method` overrides the route's verb. None is in the raw surface's type, so
+* one arriving here came through a cast or an untyped object. A route whose
+* own body has a field called `url` (a webhook's configuration) sends it
+* inside `data`, where octokit never reads it as an option.
+*
+* @internal
+*/
+const reservedRawParam = (key) => OCTOKIT_REQUEST_OPTION_KEYS.has(key) && !RAW_PASSTHROUGH_OPTION_KEYS.has(key) ? key === "url" ? "is read by octokit as the request URL; send a body field called url inside data" : "is an octokit request option the raw surface does not accept" : void 0;
+
+export { ENVIRONMENT_PUT_ROUTE_PARAMS, OCTOKIT_REQUEST_OPTION_KEYS, RAW_PASSTHROUGH_OPTION_KEYS, REPOSITORY_PATCH_ROUTE_PARAMS, reservedBodyKey, reservedRawParam, reservedSettingKey };

package/internal/scrub.js

@@ -0,0 +1,113 @@
+import { HttpRedaction } from "@effected/crypto";
+
+// src/internal/scrub.ts
+const REDACTED = "REDACTED";
+const MAX_DEPTH = 8;
+const asRecord = (value) => typeof value === "object" && value !== null ? value : void 0;
+const define = (target, key, value) => {
+	Object.defineProperty(target, key, {
+		value,
+		enumerable: true,
+		writable: true,
+		configurable: true
+	});
+};
+/** Strings through `HttpRedaction.text`, numbers and booleans as they are, everything else dropped. */
+const primitive = (value) => typeof value === "string" ? HttpRedaction.text(value) : typeof value === "number" || typeof value === "boolean" ? value : void 0;
+/** A header record minus cookies, every sensitive value `REDACTED`. */
+const headers = (input) => {
+	const record = asRecord(input);
+	if (record === void 0) return void 0;
+	const out = {};
+	for (const [name, value] of Object.entries(record)) {
+		const lower = name.toLowerCase();
+		if (lower === "set-cookie" || lower === "cookie") continue;
+		const kept = primitive(value);
+		if (kept === void 0) continue;
+		out[name] = HttpRedaction.isSensitiveHeader(lower) ? REDACTED : kept;
+	}
+	return out;
+};
+/** The top-level primitive fields of a record (`message`, `documentation_url`, `status`); nested values dropped. */
+const primitives = (input) => {
+	const record = asRecord(input);
+	if (record === void 0) return void 0;
+	const out = {};
+	for (const [key, value] of Object.entries(record)) {
+		const kept = primitive(value);
+		if (kept !== void 0) out[key] = kept;
+	}
+	return out;
+};
+const optional = (key, value) => value === void 0 ? {} : { [key]: value };
+const copy = (value, depth) => {
+	if (typeof value === "string") return HttpRedaction.text(value);
+	if (value === null || typeof value !== "object") return value;
+	if (depth >= MAX_DEPTH) return void 0;
+	const source = value;
+	const out = value instanceof Error ? Object.create(Object.getPrototypeOf(value)) : new Error(HttpRedaction.text(typeof source.message === "string" ? source.message : Object.prototype.toString.call(value)));
+	if (value instanceof Error) {
+		Object.defineProperty(out, "message", {
+			value: HttpRedaction.text(value.message),
+			writable: true,
+			configurable: true
+		});
+		if (value.stack !== void 0) Object.defineProperty(out, "stack", {
+			value: HttpRedaction.text(value.stack),
+			writable: true,
+			configurable: true
+		});
+	}
+	for (const [key, field] of Object.entries(source)) {
+		if (key === "message" || key === "stack" || key === "cause") continue;
+		const kept = primitive(field);
+		if (kept !== void 0) define(out, key, kept);
+	}
+	const request = asRecord(source.request);
+	if (request !== void 0) define(out, "request", {
+		...optional("method", typeof request.method === "string" ? request.method : void 0),
+		...optional("url", typeof request.url === "string" ? HttpRedaction.url(request.url) : void 0),
+		...optional("headers", headers(request.headers))
+	});
+	const response = asRecord(source.response);
+	if (response !== void 0) define(out, "response", {
+		...optional("url", typeof response.url === "string" ? HttpRedaction.url(response.url) : void 0),
+		...optional("status", typeof response.status === "number" ? response.status : void 0),
+		...optional("headers", headers(response.headers)),
+		...optional("data", primitives(response.data))
+	});
+	if (source.headers !== void 0) {
+		const kept = headers(source.headers);
+		if (kept !== void 0) define(out, "headers", kept);
+	}
+	if (source.cause !== void 0) {
+		const nested = copy(source.cause, depth + 1);
+		if (nested !== void 0) define(out, "cause", nested);
+	}
+	return out;
+};
+/**
+* Sanitize what octokit threw before keeping it as a cause.
+*
+* @remarks
+* A value carrying a `request`, `response` or `headers` field — octokit's
+* `RequestError`, a `GraphqlResponseError`, the transport's own GraphQL throw
+* — becomes a copy on the same prototype that keeps `name`, `message`,
+* `status` and the other primitive fields, the request's method, redacted url
+* and headers, and the response's redacted url, status, headers minus
+* `set-cookie` and the top-level primitive fields of its body (`message`,
+* `documentation_url`). Every sensitive header value reads `REDACTED`. The
+* request body, the per-request options, the GraphQL variables and partial
+* `data`, and the nested `errors` arrays are dropped: the facts a caller
+* routes on (`validation`, `errors`) were already read off the original.
+*
+* Anything else — an `AbortError`, a kit error, a plain object a test throws
+* — is returned unchanged, by identity.
+*/
+const scrubThrowable = (error) => {
+	const record = asRecord(error);
+	if (record === void 0) return error;
+	return record.request !== void 0 || record.response !== void 0 || record.headers !== void 0 ? copy(error, 0) : error;
+};
+
+export { scrubThrowable };

package/internal/uploads.js

@@ -0,0 +1,70 @@
+// src/internal/uploads.ts
+/** The upload host on github.com. @internal */
+const DOTCOM_UPLOADS_BASE_URL = "https://uploads.github.com";
+/** The REST root on github.com, and the base of a client configured with none. @internal */
+const DOTCOM_API_BASE_URL = "https://api.github.com";
+const GHES_REST_SUFFIX = "/api/v3";
+/**
+* The upload channel, carried on the client shape under a key only this
+* package can name.
+*
+* @remarks
+* A symbol rather than a `WeakMap` keyed on the shape: a property survives a
+* consumer's `{ ...client, request: wrapped }` spread, a map entry does not.
+* It is not on `GitHubClientShape`, so the public surface does not grow, and a
+* module-private `Symbol` (not `Symbol.for`) cannot be forged from outside.
+*/
+const UPLOAD_CHANNEL = Symbol("@effected/github/uploadChannel");
+/**
+* Mark a client shape built by this package with its upload channel.
+*
+* @internal
+*/
+const withUploadChannel = (shape, channel) => Object.assign(shape, { [UPLOAD_CHANNEL]: channel });
+/**
+* The upload channel of a client this package built, or `undefined` for a
+* shape built elsewhere (a hand-written double, `GitHubClient.makeTest`, a
+* fixture). A channel whose `baseUrl` is `undefined` means "built here, for
+* github.com", which is not the same as "not built here".
+*
+* @internal
+*/
+const uploadChannelOf = (client) => client[UPLOAD_CHANNEL];
+/** `url` with every trailing slash removed — a loop, not a regex. */
+const trimTrailingSlashes = (url) => {
+	let end = url.length;
+	while (end > 0 && url.charCodeAt(end - 1) === 47) end--;
+	return url.slice(0, end);
+};
+/**
+* The release-asset upload base for a configured REST base URL.
+*
+* @remarks
+* - absent, or `https://api.github.com` → `https://uploads.github.com`;
+* - a GHES root `https://<host>/api/v3` → `https://<host>/api/uploads`;
+* - anything else (a proxy, a test server) → the configured base itself, so
+*   the token still only goes to the host the caller configured.
+*
+* @internal
+*/
+const uploadsBaseUrlFor = (baseUrl) => {
+	if (baseUrl === void 0) return DOTCOM_UPLOADS_BASE_URL;
+	const trimmed = trimTrailingSlashes(baseUrl);
+	if (trimmed === "https://api.github.com") return DOTCOM_UPLOADS_BASE_URL;
+	if (trimmed.endsWith(GHES_REST_SUFFIX)) return `${trimmed.slice(0, -7)}/api/uploads`;
+	return trimmed;
+};
+/**
+* The origin of `url`, or `undefined` when it does not parse as an absolute URL.
+*
+* @internal
+*/
+const originOf = (url) => {
+	try {
+		return new URL(url).origin;
+	} catch {
+		return;
+	}
+};
+
+export { DOTCOM_API_BASE_URL, DOTCOM_UPLOADS_BASE_URL, originOf, uploadChannelOf, uploadsBaseUrlFor, withUploadChannel };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@effected/github",
-	"version": "0.25.0",
+	"version": "0.26.0",
 	"private": false,
 	"description": "Typed GitHub REST and GraphQL services over the octokit core request surface, with app auth and resource helpers.",
 	"keywords": [
@@ -38,10 +38,11 @@
 		"./package.json": "./package.json"
 	},
 	"dependencies": {
-		"@effected/github-references": "^0.11.0",
-		"@effected/jwt": "^0.6.0",
-		"@effected/oidc": "^0.1.2",
-		"@effected/semver": "^0.18.0",
+		"@effected/crypto": "^0.3.0",
+		"@effected/github-references": "^0.12.0",
+		"@effected/jwt": "^0.7.0",
+		"@effected/oidc": "^0.2.0",
+		"@effected/semver": "^0.19.0",
 		"@octokit/core": "^7.0.6",
 		"@octokit/plugin-paginate-rest": "^16.0.0",
 		"@octokit/types": "^18.0.0",

package/tsdoc-metadata.json

@@ -5,7 +5,7 @@
   "toolPackages": [
     {
       "packageName": "@microsoft/api-extractor",
-      "packageVersion": "7.59.1"
+      "packageVersion": "7.59.4"
     }
   ]
 }