@flink-app/github-app-plugin 0.12.1-alpha.39 → 0.12.1-alpha.42

package/README.md

@@ -417,10 +417,63 @@ const issue = await client.createIssue("facebook", "react", {
     body: "Found a bug...",
 });
 
+// Remove repository from installation
+await client.removeRepository(987654321);
+
 // Generic API call
 const response = await client.request("GET", "/rate_limit");
 ```
 
+### Removing Repositories from Installation
+
+You can remove a repository from a GitHub App installation to revoke access to that specific repository while keeping the installation active for other repositories:
+
+```typescript
+const client = await ctx.plugins.githubApp.getClient(installationId);
+
+// Remove repository by ID (numeric ID, not name)
+await client.removeRepository(987654321);
+```
+
+**Important Notes:**
+- Use the numeric repository ID, not the repository name or full_name
+- This only removes the repository from the installation; it does not delete the repository itself
+- The installation remains active for other repositories
+- If the repository was already removed manually, the API will return a 404 error
+- Requires appropriate installation permissions
+
+**Example: Repository Disconnect Handler**
+
+```typescript
+// In a Flink handler (e.g., DeleteRepository.ts)
+const DeleteRepository: Handler = async ({ ctx, req }) => {
+    const { id } = req.params;
+
+    // Fetch repository from database
+    const repository = await ctx.repos.repositoryRepo.getById(id);
+    if (!repository) {
+        return notFound(`Repository with id ${id} not found`);
+    }
+
+    // Remove repository from GitHub App installation
+    try {
+        const client = await ctx.plugins.githubApp.getClient(
+            repository.githubInstallationId
+        );
+        await client.removeRepository(repository.githubRepoId);
+    } catch (error) {
+        console.error('Failed to remove repository from GitHub:', error);
+        // Continue with local cleanup even if GitHub API call fails
+        // (repository may have already been removed manually)
+    }
+
+    // Update database status
+    await ctx.repos.repositoryRepo.updateStatus(id, "disconnected");
+
+    return { data: { success: true } };
+};
+```
+
 ## Authentication Integration
 
 This plugin is **auth-agnostic** and works with any authentication system. You implement your own installation callback handler with your own auth logic.

package/dist/services/GitHubAPIClient.d.ts

@@ -125,6 +125,27 @@ export declare class GitHubAPIClient {
      * @returns Created issue
      */
     createIssue(owner: string, repo: string, params: CreateIssueParams): Promise<Issue>;
+    /**
+     * Remove a repository from this installation
+     *
+     * Revokes the GitHub App's access to a specific repository while keeping
+     * the installation active for other repositories.
+     *
+     * Note: This requires the installation to have been granted access to the
+     * repository. If the app was installed at the account level with access
+     * to all repositories, this method can be used to selectively revoke
+     * access to specific repositories.
+     *
+     * @param repositoryId - GitHub repository ID (numeric ID, not full_name)
+     * @throws Error if repository not found or access cannot be revoked
+     *
+     * @example
+     * ```typescript
+     * const client = await ctx.plugins.githubApp.getClient(12345);
+     * await client.removeRepository(987654321);
+     * ```
+     */
+    removeRepository(repositoryId: number): Promise<void>;
     /**
      * Sleep utility for retry delays
      *

package/dist/services/GitHubAPIClient.js

@@ -76,6 +76,10 @@ class GitHubAPIClient {
                 error.message = errorBody;
                 throw error;
             }
+            // Handle 204 No Content (void response)
+            if (response.status === 204) {
+                return undefined;
+            }
             // Parse and return response
             const responseData = await response.json();
             return responseData;
@@ -132,6 +136,29 @@ class GitHubAPIClient {
     async createIssue(owner, repo, params) {
         return this.request("POST", `/repos/${owner}/${repo}/issues`, params);
     }
+    /**
+     * Remove a repository from this installation
+     *
+     * Revokes the GitHub App's access to a specific repository while keeping
+     * the installation active for other repositories.
+     *
+     * Note: This requires the installation to have been granted access to the
+     * repository. If the app was installed at the account level with access
+     * to all repositories, this method can be used to selectively revoke
+     * access to specific repositories.
+     *
+     * @param repositoryId - GitHub repository ID (numeric ID, not full_name)
+     * @throws Error if repository not found or access cannot be revoked
+     *
+     * @example
+     * ```typescript
+     * const client = await ctx.plugins.githubApp.getClient(12345);
+     * await client.removeRepository(987654321);
+     * ```
+     */
+    async removeRepository(repositoryId) {
+        await this.request("DELETE", `/user/installations/${this.installationId}/repositories/${repositoryId}`);
+    }
     /**
      * Sleep utility for retry delays
      *

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@flink-app/github-app-plugin",
-    "version": "0.12.1-alpha.39",
+    "version": "0.12.1-alpha.42",
     "description": "Flink plugin for GitHub App integration with installation management and webhook handling",
     "scripts": {
         "test": "node --preserve-symlinks -r ts-node/register -- node_modules/jasmine/bin/jasmine --config=./spec/support/jasmine.json",
@@ -23,8 +23,8 @@
         "jsonwebtoken": "^9.0.2"
     },
     "devDependencies": {
-        "@flink-app/flink": "^0.12.1-alpha.35",
-        "@flink-app/test-utils": "^0.12.1-alpha.38",
+        "@flink-app/flink": "^0.12.1-alpha.40",
+        "@flink-app/test-utils": "^0.12.1-alpha.40",
         "@types/jasmine": "^3.7.1",
         "@types/jsonwebtoken": "^9.0.5",
         "@types/node": "22.13.10",
@@ -37,5 +37,5 @@
         "tsc-watch": "^4.2.9",
         "typescript": "5.4.5"
     },
-    "gitHead": "5be6cf2e80d665d08d380bc5e495bf9e20ff7b6e"
+    "gitHead": "e7a3e35c85ee9cd1eaa9629664460a1936f0698a"
 }

package/spec/services.spec.ts

@@ -52,6 +52,172 @@ describe("Services", () => {
             expect(apiClient).toBeTruthy();
         });
 
+        describe("removeRepository", () => {
+            it("should construct correct DELETE request", () => {
+                const appId = "123456";
+                const installationId = 12345;
+                const repositoryId = 987654321;
+                const authService = new GitHubAuthService(appId, testPrivateKeyBase64, "https://api.github.com");
+                const apiClient = new GitHubAPIClient(installationId, authService);
+
+                // Test that the method exists and has the correct signature
+                expect(typeof apiClient.removeRepository).toBe("function");
+                expect(apiClient.removeRepository.length).toBe(1);
+            });
+
+            // Note: Testing actual API calls with mocked responses
+            it("should handle successful removal (204 No Content)", async () => {
+                const appId = "123456";
+                const installationId = 12345;
+                const repositoryId = 987654321;
+                const authService = new GitHubAuthService(appId, testPrivateKeyBase64, "https://api.github.com");
+                const apiClient = new GitHubAPIClient(installationId, authService);
+
+                // Mock successful installation token retrieval
+                spyOn(authService, "getInstallationToken").and.returnValue(Promise.resolve("test-token"));
+
+                // Mock fetch to return 204 No Content
+                const originalFetch = global.fetch;
+                global.fetch = jasmine.createSpy("fetch").and.returnValue(
+                    Promise.resolve({
+                        ok: true,
+                        status: 204,
+                        headers: new Headers(),
+                    } as Response)
+                );
+
+                try {
+                    await apiClient.removeRepository(repositoryId);
+                    expect(global.fetch).toHaveBeenCalledWith(
+                        `https://api.github.com/user/installations/${installationId}/repositories/${repositoryId}`,
+                        jasmine.objectContaining({
+                            method: "DELETE",
+                            headers: jasmine.objectContaining({
+                                Authorization: "Bearer test-token",
+                            }),
+                        })
+                    );
+                } finally {
+                    global.fetch = originalFetch;
+                }
+            });
+
+            it("should handle repository not found error (404)", async () => {
+                const appId = "123456";
+                const installationId = 12345;
+                const repositoryId = 999999999;
+                const authService = new GitHubAuthService(appId, testPrivateKeyBase64, "https://api.github.com");
+                const apiClient = new GitHubAPIClient(installationId, authService);
+
+                // Mock installation token retrieval
+                spyOn(authService, "getInstallationToken").and.returnValue(Promise.resolve("test-token"));
+
+                // Mock fetch to return 404
+                const originalFetch = global.fetch;
+                global.fetch = jasmine.createSpy("fetch").and.returnValue(
+                    Promise.resolve({
+                        ok: false,
+                        status: 404,
+                        statusText: "Not Found",
+                        text: () => Promise.resolve(JSON.stringify({ message: "Repository not found" })),
+                        headers: new Headers(),
+                    } as any)
+                );
+
+                try {
+                    let errorThrown = false;
+                    try {
+                        await apiClient.removeRepository(repositoryId);
+                    } catch (error) {
+                        errorThrown = true;
+                    }
+                    expect(errorThrown).toBe(true);
+                } finally {
+                    global.fetch = originalFetch;
+                }
+            });
+
+            it("should handle forbidden error (403)", async () => {
+                const appId = "123456";
+                const installationId = 12345;
+                const repositoryId = 987654321;
+                const authService = new GitHubAuthService(appId, testPrivateKeyBase64, "https://api.github.com");
+                const apiClient = new GitHubAPIClient(installationId, authService);
+
+                // Mock installation token retrieval
+                spyOn(authService, "getInstallationToken").and.returnValue(Promise.resolve("test-token"));
+
+                let callCount = 0;
+                // Mock fetch to return 403 and track retries
+                const originalFetch = global.fetch;
+                global.fetch = jasmine.createSpy("fetch").and.callFake(() => {
+                    callCount++;
+                    return Promise.resolve({
+                        ok: false,
+                        status: 403,
+                        statusText: "Forbidden",
+                        text: () => Promise.resolve(JSON.stringify({ message: "Insufficient permissions" })),
+                        headers: new Headers({ "x-ratelimit-remaining": "100" }),
+                    } as any);
+                });
+
+                try {
+                    let errorThrown = false;
+                    try {
+                        await apiClient.removeRepository(repositoryId);
+                    } catch (error) {
+                        errorThrown = true;
+                    }
+                    expect(errorThrown).toBe(true);
+                    // Should have retried due to 403 status
+                    expect(callCount).toBeGreaterThan(1);
+                } finally {
+                    global.fetch = originalFetch;
+                }
+            }, 10000); // Increase timeout since it will retry
+
+            it("should retry on rate limit (403 with rate limit)", async () => {
+                const appId = "123456";
+                const installationId = 12345;
+                const repositoryId = 987654321;
+                const authService = new GitHubAuthService(appId, testPrivateKeyBase64, "https://api.github.com");
+                const apiClient = new GitHubAPIClient(installationId, authService);
+
+                // Mock installation token retrieval
+                spyOn(authService, "getInstallationToken").and.returnValue(Promise.resolve("test-token"));
+
+                let callCount = 0;
+                const originalFetch = global.fetch;
+                global.fetch = jasmine.createSpy("fetch").and.callFake(() => {
+                    callCount++;
+                    if (callCount === 1) {
+                        // First call: rate limited
+                        return Promise.resolve({
+                            ok: false,
+                            status: 403,
+                            statusText: "Forbidden",
+                            text: () => Promise.resolve(JSON.stringify({ message: "Rate limit exceeded" })),
+                            headers: new Headers({ "x-ratelimit-remaining": "0" }),
+                        } as Response);
+                    } else {
+                        // Second call: success
+                        return Promise.resolve({
+                            ok: true,
+                            status: 204,
+                            headers: new Headers(),
+                        } as Response);
+                    }
+                });
+
+                try {
+                    await apiClient.removeRepository(repositoryId);
+                    expect(callCount).toBe(2); // Should have retried
+                } finally {
+                    global.fetch = originalFetch;
+                }
+            }, 10000); // Increase timeout for retry delays
+        });
+
         // Note: Testing actual API calls requires mocking GitHub API
         // These are tested in integration tests instead
     });

package/src/services/GitHubAPIClient.ts

@@ -145,6 +145,11 @@ export class GitHubAPIClient {
                 throw error;
             }
 
+            // Handle 204 No Content (void response)
+            if (response.status === 204) {
+                return undefined as T;
+            }
+
             // Parse and return response
             const responseData = await response.json();
             return responseData as T;
@@ -206,6 +211,30 @@ export class GitHubAPIClient {
         return this.request<Issue>("POST", `/repos/${owner}/${repo}/issues`, params);
     }
 
+    /**
+     * Remove a repository from this installation
+     *
+     * Revokes the GitHub App's access to a specific repository while keeping
+     * the installation active for other repositories.
+     *
+     * Note: This requires the installation to have been granted access to the
+     * repository. If the app was installed at the account level with access
+     * to all repositories, this method can be used to selectively revoke
+     * access to specific repositories.
+     *
+     * @param repositoryId - GitHub repository ID (numeric ID, not full_name)
+     * @throws Error if repository not found or access cannot be revoked
+     *
+     * @example
+     * ```typescript
+     * const client = await ctx.plugins.githubApp.getClient(12345);
+     * await client.removeRepository(987654321);
+     * ```
+     */
+    async removeRepository(repositoryId: number): Promise<void> {
+        await this.request<void>("DELETE", `/user/installations/${this.installationId}/repositories/${repositoryId}`);
+    }
+
     /**
      * Sleep utility for retry delays
      *