@goodfellow-cms/github 0.1.0 → 0.3.0

package/dist/testing.js

@@ -1,11 +1,33 @@
 import { decodeBase64, encodeBase64Bytes } from "@goodfellow-cms/core";
-import { FakeConflictError, FakeRepo, fakeFileBytes } from "@goodfellow-cms/core/testing";
+import { FakeConflictError, FakeRepo, fakeFileBytes, fakeFileFromBytes } from "@goodfellow-cms/core/testing";
 //#region src/testing.ts
 /**
 * A fake of the parts of GitHub's API that `@goodfellow-cms/github` uses, backed by
 * an in-memory repository. For tests only: pass `fake.fetch` as the backend's
 * `fetch`, or route browser requests to `fake.handle` in end-to-end tests.
 */
+/** GitHub's number for an account, worked out from its login when a test doesn't give one. */
+function accountId(login) {
+	let hash = 7;
+	for (const char of login.toLowerCase()) hash = (hash * 31 + char.charCodeAt(0)) % 9e6;
+	return 1e6 + hash;
+}
+function same(a, b) {
+	return a.toLowerCase() === b.toLowerCase();
+}
+function covers(installation, fullName) {
+	const [owner = ""] = fullName.split("/");
+	if (!same(installation.account, owner)) return false;
+	return installation.repositories === "all" || installation.repositories.some((repo) => same(repo, fullName));
+}
+function decodeJwtPart(part) {
+	try {
+		const base64 = part.replace(/-/g, "+").replace(/_/g, "/");
+		return JSON.parse(atob(base64 + "=".repeat((4 - base64.length % 4) % 4)));
+	} catch {
+		return;
+	}
+}
 function json(body, status = 200) {
 	return new Response(JSON.stringify(body), {
 		status,
@@ -18,9 +40,322 @@ function fakeGitHub(options) {
 		login: "editor",
 		name: "Test Editor"
 	} };
+	/** Every token that works: the test's own, and those apps' sign-ins make. */
+	const principals = new Map(Object.entries(tokens));
+	const apps = options.apps ?? [];
+	const issued = [];
+	/** OAuth codes waiting to be exchanged, and refresh tokens, by the app and person they're for. */
+	const codes = /* @__PURE__ */ new Map();
+	const refreshTokens = /* @__PURE__ */ new Map();
+	/** Who each commit made through the REST API names as its author. */
+	const commitAuthors = /* @__PURE__ */ new Map();
+	let nextToken = 1;
+	let nextRepoId = 100;
 	const deployments = [];
+	const runs = [];
 	const requests = [];
 	let nextDeployment = 1;
+	let graphqlReads = 0;
+	const created = /* @__PURE__ */ new Map();
+	const [owner = "", name = ""] = options.repo.split("/");
+	const pages = { current: options.pages ? {
+		html_url: `https://${owner.toLowerCase()}.github.io/${name}/`,
+		cname: null,
+		https_enforced: false
+	} : void 0 };
+	const trees = /* @__PURE__ */ new Map();
+	/** The repository's collaborators and their permission. Every token's user is one. */
+	const collaborators = new Map(Object.values(tokens).map((user) => [user.login, user.admin ? "admin" : user.push === false ? "read" : "push"]));
+	const invitations = [];
+	const accounts = /* @__PURE__ */ new Set([...Object.values(tokens).map((user) => user.login), ...options.accounts ?? []]);
+	let nextInvitation = 1;
+	/** Collaborators and invitations, which only owners' tokens with the Administration permission can change. */
+	async function handleCollaborators(request, rest, user) {
+		const forbidden = () => json({ message: "Resource not accessible by personal access token" }, 403);
+		const canManage = user.admin === true && user.administration === true;
+		if (rest === "/collaborators" && request.method === "GET") return json([...collaborators].map(([login, permission]) => ({
+			login,
+			avatar_url: `https://avatars.example/${login}`,
+			permissions: {
+				admin: permission === "admin",
+				maintain: false,
+				push: permission !== "read",
+				pull: true
+			}
+		})));
+		if (rest === "/invitations" && request.method === "GET") {
+			if (!canManage) return forbidden();
+			return json(invitations.map((invitation) => ({
+				id: invitation.id,
+				invitee: {
+					login: invitation.login,
+					avatar_url: `https://avatars.example/${invitation.login}`
+				},
+				permissions: invitation.permission
+			})));
+		}
+		const permission = rest.match(/^\/collaborators\/([^/]+)\/permission$/);
+		if (permission && request.method === "GET") {
+			const login = decodeURIComponent(permission[1] ?? "");
+			if (!accounts.has(login)) return json({ message: "Not Found" }, 404);
+			const role = collaborators.get(login);
+			const level = role === "admin" ? "admin" : role === "push" ? "write" : role === "read" ? "read" : "none";
+			return json({
+				permission: level,
+				user: {
+					login,
+					permissions: {
+						admin: level === "admin",
+						push: level === "admin" || level === "write",
+						pull: level !== "none"
+					}
+				}
+			});
+		}
+		const collaborator = rest.match(/^\/collaborators\/([^/]+)$/);
+		if (collaborator) {
+			if (!canManage) return forbidden();
+			const login = decodeURIComponent(collaborator[1] ?? "");
+			if (request.method === "DELETE") {
+				collaborators.delete(login);
+				return new Response(null, { status: 204 });
+			}
+			if (request.method === "PUT") {
+				if (!accounts.has(login)) return json({ message: "Not Found" }, 404);
+				const { permission = "push" } = await request.json();
+				if (collaborators.has(login)) {
+					collaborators.set(login, permission);
+					return new Response(null, { status: 204 });
+				}
+				const existing = invitations.find((invitation) => invitation.login === login);
+				const invitation = existing ?? {
+					id: nextInvitation++,
+					login,
+					permission: "write"
+				};
+				invitation.permission = permission === "admin" ? "admin" : "write";
+				if (!existing) invitations.push(invitation);
+				return json({
+					id: invitation.id,
+					invitee: { login },
+					permissions: invitation.permission
+				}, 201);
+			}
+		}
+		const invitation = rest.match(/^\/invitations\/(\d+)$/);
+		if (invitation) {
+			if (!canManage) return forbidden();
+			const index = invitations.findIndex((candidate) => candidate.id === Number(invitation[1]));
+			if (index === -1) return json({ message: "Not Found" }, 404);
+			if (request.method === "DELETE") {
+				invitations.splice(index, 1);
+				return new Response(null, { status: 204 });
+			}
+			if (request.method === "PATCH") {
+				const { permissions } = await request.json();
+				invitations[index].permission = permissions;
+				return json({
+					id: invitations[index]?.id,
+					permissions
+				});
+			}
+		}
+	}
+	/**
+	* Simulates the deploy workflow failing for a commit at a step, such as
+	* `"Run npm ci"`, in the `build` job or another, or before any step ran.
+	*/
+	function failBuild(sha, step, job = "build") {
+		const run = {
+			id: runs.length + 1,
+			sha,
+			status: "completed",
+			conclusion: "failure",
+			jobs: [{
+				name: job,
+				conclusion: "failure",
+				steps: step ? [{
+					name: "Set up job",
+					conclusion: "success"
+				}, {
+					name: step,
+					conclusion: "failure"
+				}] : []
+			}]
+		};
+		runs.push(run);
+		return run;
+	}
+	/** Simulates an invited person accepting the invitation. */
+	function accept(login) {
+		const index = invitations.findIndex((invitation) => invitation.login === login);
+		const [invitation] = index === -1 ? [] : invitations.splice(index, 1);
+		if (invitation) collaborators.set(login, invitation.permission === "admin" ? "admin" : "push");
+	}
+	/** Repository creation and the Git data API, for repositories created through the fake. */
+	async function handleCreated(request, path, principal) {
+		const login = principal.login;
+		if (path === "/user/orgs") return json((options.orgs ?? []).map((org) => ({ login: org })));
+		const create = path === "/user/repos" ? login : path.match(/^\/orgs\/([^/]+)\/repos$/)?.[1];
+		if (create !== void 0 && request.method === "POST") {
+			if (principal.bot || principal.app && principal.permissions?.administration !== "write") return json({ message: "Resource not accessible by integration" }, 403);
+			if (path !== "/user/repos" && !options.orgs?.includes(create)) return json({ message: "Not Found" }, 404);
+			const body = await request.json();
+			if (!/^[\w.-]+$/.test(body.name)) return json({ message: "Repository creation failed." }, 422);
+			const fullName = `${create}/${body.name}`;
+			if (created.has(fullName) || fullName === options.repo) return json({
+				message: "Repository creation failed.",
+				errors: [{ message: "name already exists on this account" }]
+			}, 422);
+			const repo = new FakeRepo({ "README.md": `# ${body.name}\n` }, options.newRepoBranch ?? "main");
+			const id = nextRepoId++;
+			created.set(fullName, {
+				id,
+				fullName,
+				private: body.private === true,
+				description: body.description,
+				repo,
+				rulesets: []
+			});
+			return json({
+				id,
+				full_name: fullName,
+				html_url: `https://github.com/${fullName}`,
+				default_branch: repo.defaultBranch
+			}, 201);
+		}
+		const match = path.match(/^\/repos\/([^/]+\/[^/]+)(\/.*)?$/);
+		const site = created.get(decodeURIComponent(match?.[1] ?? ""));
+		if (!match || !site) return void 0;
+		if (!canSee(principal, site.fullName)) return json({ message: "Not Found" }, 404);
+		const { repo } = site;
+		const rest = match[2] ?? "";
+		const method = request.method;
+		if (rest === "" && method === "GET") return json({
+			id: site.id,
+			full_name: site.fullName,
+			default_branch: repo.defaultBranch,
+			permissions: {
+				push: true,
+				admin: true
+			}
+		});
+		if (rest === "" && method === "PATCH") {
+			const body = await request.json();
+			if (body.default_branch) {
+				if (!repo.branches.has(body.default_branch)) return json({ message: "Not Found" }, 422);
+				repo.defaultBranch = body.default_branch;
+			}
+			return json({
+				full_name: site.fullName,
+				default_branch: repo.defaultBranch
+			});
+		}
+		const ref = rest.match(/^\/git\/refs?\/heads\/(.+)$/);
+		if (ref && method === "GET") {
+			const sha = repo.branches.get(decodeURIComponent(ref[1] ?? ""));
+			return sha ? json({ object: { sha } }) : json({ message: "Not Found" }, 404);
+		}
+		if (ref && method === "DELETE") {
+			repo.branches.delete(decodeURIComponent(ref[1] ?? ""));
+			return new Response(null, { status: 204 });
+		}
+		if (rest === "/git/refs" && method === "POST") {
+			const body = await request.json();
+			repo.branches.set(body.ref.replace(/^refs\/heads\//, ""), body.sha);
+			return json({
+				ref: body.ref,
+				object: { sha: body.sha }
+			}, 201);
+		}
+		const data = await handleGitData(request, rest, repo, principal, site.rulesets.length > 0);
+		if (data) return data;
+		if (rest === "/pages" && method === "POST") {
+			if (site.private && !options.paidPlan) return json({ message: "Your current plan does not support GitHub Pages for this repository." }, 422);
+			site.pages = await request.json();
+			const [owner, name] = site.fullName.split("/");
+			return json({
+				html_url: `https://${owner}.github.io/${name}/`,
+				build_type: site.pages.build_type
+			}, 201);
+		}
+		if (rest === "/rulesets" && method === "POST") {
+			if (site.private && !options.paidPlan) return json({ message: "Upgrade to GitHub Pro" }, 403);
+			site.rulesets.push(await request.json());
+			return json({ id: site.rulesets.length }, 201);
+		}
+		return json({ message: "Not Found" }, 404);
+	}
+	/** Whether a token may see a repository: an app's only where it's installed, and an installation's only its own. */
+	function canSee(principal, fullName) {
+		if (principal.repositories) return principal.repositories.some((repo) => same(repo, fullName));
+		if (principal.app) return principal.app.installations.some((installation) => covers(installation, fullName));
+		return true;
+	}
+	function treeOf(target, commitSha) {
+		const sha = target.blobSha(`tree-of:${commitSha}`);
+		if (!trees.has(sha)) trees.set(sha, new Map(target.files(commitSha)));
+		return sha;
+	}
+	/** Git's data API on a repository: blobs, trees, commits and moving a branch, as REST commits need. */
+	async function handleGitData(request, rest, target, principal, protectedHistory) {
+		const method = request.method;
+		const commitSha = rest.match(/^\/git\/commits\/([0-9a-f]{40})$/);
+		if (commitSha && method === "GET") {
+			const found = target.commitAt(commitSha[1] ?? "");
+			if (!found) return json({ message: "Not Found" }, 404);
+			return json({
+				sha: found.sha,
+				tree: { sha: treeOf(target, found.sha) },
+				parents: found.parent ? [{ sha: found.parent }] : []
+			});
+		}
+		if (rest === "/git/blobs" && method === "POST") {
+			if (principal.push === false) return json({ message: "Resource not accessible by integration" }, 403);
+			const body = await request.json();
+			return json({ sha: target.blobSha(body.encoding === "base64" ? fakeFileFromBytes(decodeBase64(body.content)) : body.content) }, 201);
+		}
+		if (rest === "/git/trees" && method === "POST") {
+			const body = await request.json();
+			if (body.base_tree && !trees.has(body.base_tree)) return json({ message: "Tree not found" }, 422);
+			const files = new Map(body.base_tree ? trees.get(body.base_tree) : void 0);
+			for (const entry of body.tree) {
+				if (entry.path.startsWith(".github/workflows/") && principal.workflow === false) return json({ message: "Resource not accessible by personal access token" }, 404);
+				if (entry.sha === null) {
+					files.delete(entry.path);
+					continue;
+				}
+				const content = entry.content ?? target.blobs.get(entry.sha ?? "");
+				if (content === void 0) return json({ message: `No blob ${entry.sha}` }, 422);
+				files.set(entry.path, content);
+			}
+			const sha = target.blobSha(`tree:${[...files.keys()].join(",")}:${trees.size}`);
+			trees.set(sha, files);
+			return json({ sha }, 201);
+		}
+		if (rest === "/git/commits" && method === "POST") {
+			const body = await request.json();
+			const files = trees.get(body.tree);
+			if (!files) return json({ message: "Tree not found" }, 422);
+			const author = body.author?.name ?? (principal.bot ? principal.login : principal.name ?? principal.login);
+			const sha = target.addCommit(body.parents[0], body.message, new Map(files), author);
+			commitAuthors.set(sha, body.author ?? { name: author });
+			return json({ sha }, 201);
+		}
+		const ref = rest.match(/^\/git\/refs?\/heads\/(.+)$/);
+		if (ref && method === "PATCH") {
+			if (principal.push === false) return json({ message: "Resource not accessible by integration" }, 403);
+			const body = await request.json();
+			const branch = decodeURIComponent(ref[1] ?? "");
+			const found = target.commitAt(body.sha);
+			if (!found || !target.branches.has(branch)) return json({ message: "Reference does not exist" }, 422);
+			if (!body.force && found.parent !== target.branches.get(branch)) return json({ message: "Update is not a fast forward" }, 422);
+			if (protectedHistory && found.parent !== target.branches.get(branch)) return json({ message: "Cannot force-push to this branch" }, 422);
+			target.branches.set(branch, body.sha);
+			if (branch === target.defaultBranch) deploy(body.sha);
+			return json({ object: { sha: body.sha } });
+		}
+	}
 	function deploy(sha) {
 		if (options.deployAfterChecks === void 0) return;
 		deployments.unshift({
@@ -30,23 +365,281 @@ function fakeGitHub(options) {
 			checks: 0
 		});
 	}
-	function commit(changes, message, expectedHead) {
-		const sha = repo.commit(changes, message, { expectedHead });
-		deploy(sha);
+	function commit(changes, message, expectedHead, author, branch = repo.defaultBranch) {
+		const sha = repo.commit(changes, message, {
+			expectedHead,
+			author,
+			branch
+		});
+		if (branch === repo.defaultBranch) deploy(sha);
 		return sha;
 	}
+	/** The person a login belongs to, as the test's tokens describe them. */
+	function person(login) {
+		return Object.values(tokens).find((candidate) => same(candidate.login, login)) ?? { login };
+	}
+	/** Simulates someone signing in to an app on GitHub's page: the code GitHub sends back to the app's callback. */
+	function authorize(login, clientId) {
+		const app = apps.find((candidate) => candidate.clientId === clientId);
+		if (!app) throw new Error(`No app with client ID ${clientId}`);
+		const code = `code-${nextToken++}`;
+		codes.set(code, {
+			app,
+			login
+		});
+		return code;
+	}
+	/**
+	* Simulates someone installing an app on GitHub's install page, choosing
+	* these repositories, or adding them to its installation on the account,
+	* and being signed in as they go: the code GitHub sends back to the app's callback.
+	*/
+	function install(slug, login, repositories, account = repositories[0]?.split("/")[0] ?? login) {
+		const app = apps.find((candidate) => candidate.slug === slug);
+		if (!app) throw new Error(`No app ${slug}`);
+		let installation = app.installations.find((candidate) => same(candidate.account, account));
+		if (!installation) {
+			installation = {
+				id: 1e3 + nextToken++,
+				account,
+				repositories: []
+			};
+			app.installations.push(installation);
+		}
+		const chosen = installation.repositories;
+		if (chosen !== "all") {
+			for (const repo of repositories) if (!chosen.some((name) => same(name, repo))) chosen.push(repo);
+		}
+		return {
+			code: authorize(login, app.clientId),
+			installation: installation.id
+		};
+	}
+	function userToken(app, login) {
+		const access = `ghu_fake${nextToken++}`;
+		const refresh = `ghr_fake${nextToken++}`;
+		const base = person(login);
+		principals.set(access, {
+			...base,
+			app,
+			permissions: app.permissions,
+			administration: app.permissions.administration === "write",
+			pages: app.permissions.pages === "write",
+			workflow: app.permissions.workflows === "write",
+			actions: app.permissions.actions !== void 0,
+			actionsWrite: app.permissions.actions === "write"
+		});
+		refreshTokens.set(refresh, {
+			app,
+			login
+		});
+		issued.push({
+			token: access,
+			kind: "user",
+			app: app.slug,
+			login,
+			permissions: app.permissions
+		});
+		return json({
+			access_token: access,
+			token_type: "bearer",
+			scope: "",
+			expires_in: 28800,
+			refresh_token: refresh,
+			refresh_token_expires_in: 15897600
+		});
+	}
+	async function appFromJwt(jwt) {
+		const [header, payload, signature] = jwt.split(".");
+		const claims = decodeJwtPart(payload ?? "");
+		if (!header || !claims || !signature || decodeJwtPart(header)?.alg !== "RS256") return void 0;
+		const app = apps.find((candidate) => String(candidate.id) === String(claims.iss));
+		if (!app || typeof claims.exp !== "number" || claims.exp * 1e3 < Date.now()) return void 0;
+		if (app.publicKey) {
+			const base64 = signature.replace(/-/g, "+").replace(/_/g, "/");
+			const bytes = Uint8Array.from(atob(base64 + "=".repeat((4 - base64.length % 4) % 4)), (char) => char.charCodeAt(0));
+			if (!await crypto.subtle.verify("RSASSA-PKCS1-v1_5", app.publicKey, bytes, new TextEncoder().encode(`${header}.${payload}`))) return void 0;
+		}
+		return app;
+	}
+	/** What GitHub Apps call: OAuth's token exchange, revoking, and the app's own endpoints, which take its JWT. */
+	async function handleApps(request, path) {
+		const authorization = request.headers.get("authorization") ?? "";
+		if (path === "/login/oauth/access_token" && request.method === "POST") {
+			const body = await request.json();
+			const app = apps.find((candidate) => candidate.clientId === body.client_id);
+			if (!app || app.clientSecret !== body.client_secret) return json({ error: "incorrect_client_credentials" });
+			if (body.grant_type === "refresh_token") {
+				const found = refreshTokens.get(body.refresh_token ?? "");
+				if (!found || found.app !== app) return json({ error: "bad_refresh_token" });
+				refreshTokens.delete(body.refresh_token ?? "");
+				return userToken(app, found.login);
+			}
+			const found = codes.get(body.code ?? "");
+			if (!found || found.app !== app) return json({ error: "bad_verification_code" });
+			codes.delete(body.code ?? "");
+			return userToken(app, found.login);
+		}
+		const revoke = path.match(/^\/applications\/([^/]+)\/token$/);
+		if (revoke && request.method === "DELETE") {
+			const [id, secret] = atob(authorization.replace(/^Basic /, "")).split(":");
+			const app = apps.find((candidate) => candidate.clientId === decodeURIComponent(revoke[1] ?? ""));
+			if (!app || app.clientId !== id || app.clientSecret !== secret) return json({ message: "Not Found" }, 404);
+			const { access_token: token } = await request.json();
+			principals.delete(token);
+			for (const item of issued) if (item.token === token) item.revoked = true;
+			return new Response(null, { status: 204 });
+		}
+		if (path === "/installation/token" && request.method === "DELETE") {
+			const token = authorization.replace(/^Bearer /, "");
+			if (!principals.get(token)?.bot) return json({ message: "Bad credentials" }, 401);
+			principals.delete(token);
+			for (const item of issued) if (item.token === token) item.revoked = true;
+			return new Response(null, { status: 204 });
+		}
+		if (!/^Bearer ey/.test(authorization)) return void 0;
+		const app = await appFromJwt(authorization.slice(7));
+		if (!app) return json({ message: "A JSON web token could not be decoded" }, 401);
+		const installed = path.match(/^\/repos\/([^/]+\/[^/]+)\/installation$/);
+		if (installed) {
+			const fullName = decodeURIComponent(installed[1] ?? "");
+			const installation = app.installations.find((candidate) => covers(candidate, fullName));
+			return installation ? json({
+				id: installation.id,
+				account: { login: installation.account },
+				app_slug: app.slug
+			}) : json({ message: "Not Found" }, 404);
+		}
+		const mint = path.match(/^\/app\/installations\/(\d+)\/access_tokens$/);
+		if (mint && request.method === "POST") {
+			const installation = app.installations.find((candidate) => candidate.id === Number(mint[1]));
+			if (!installation) return json({ message: "Not Found" }, 404);
+			const body = await request.json();
+			const repositories = (body.repositories ?? []).map((name) => `${installation.account}/${name}`);
+			if (repositories.some((repo) => !covers(installation, repo))) return json({ message: "There is at least one repository that does not exist or is not accessible" }, 422);
+			const permissions = body.permissions ?? app.permissions;
+			for (const [name, level] of Object.entries(permissions)) {
+				const allowed = app.permissions[name];
+				if (!allowed || level === "write" && allowed !== "write") return json({ message: `The permissions requested are not granted to this installation.` }, 422);
+			}
+			const token = `ghs_fake${nextToken++}`;
+			principals.set(token, {
+				login: `${app.slug}[bot]`,
+				bot: true,
+				app,
+				repositories,
+				permissions,
+				push: permissions.contents === "write",
+				workflow: permissions.workflows === "write",
+				pages: permissions.pages === "write",
+				administration: permissions.administration === "write",
+				admin: permissions.administration === "write",
+				actions: permissions.actions !== void 0,
+				actionsWrite: permissions.actions === "write"
+			});
+			issued.push({
+				token,
+				kind: "installation",
+				app: app.slug,
+				repositories,
+				permissions
+			});
+			return json({
+				token,
+				expires_at: new Date(Date.now() + 36e5).toISOString(),
+				permissions
+			}, 201);
+		}
+		return json({ message: "Not Found" }, 404);
+	}
 	async function handle(request) {
 		requests.push(request.clone());
 		const url = new URL(request.url);
 		const path = url.pathname;
-		const user = tokens[request.headers.get("authorization")?.replace(/^Bearer /, "") ?? ""];
+		const fromApp = await handleApps(request, path);
+		if (fromApp) return fromApp;
+		const user = principals.get(request.headers.get("authorization")?.replace(/^Bearer /, "") ?? "");
 		if (!user) return json({ message: "Bad credentials" }, 401);
-		if (path === "/user") return json({
-			login: user.login,
-			name: user.name ?? null,
-			avatar_url: `https://avatars.example/${user.login}`
-		});
+		if (path === "/user") {
+			if (user.bot) return json({ message: "Resource not accessible by integration" }, 403);
+			return json({
+				id: user.id ?? accountId(user.login),
+				login: user.login,
+				name: user.name ?? null,
+				avatar_url: `https://avatars.example/${user.login}`
+			});
+		}
+		if (path === "/user/installations" && user.app && !user.bot) {
+			const mine = user.app.installations.filter((installation) => same(installation.account, user.login) || (options.orgs ?? []).some((org) => same(org, installation.account)));
+			return json({
+				total_count: mine.length,
+				installations: mine.map((installation) => ({
+					id: installation.id,
+					account: {
+						login: installation.account,
+						type: installation.accountType ?? "User"
+					},
+					repository_selection: installation.repositories === "all" ? "all" : "selected"
+				}))
+			});
+		}
+		const listRepos = path.match(/^\/user\/installations\/(\d+)\/repositories$/);
+		if (listRepos && request.method === "GET" && user.app && !user.bot) {
+			const installation = user.app.installations.find((candidate) => candidate.id === Number(listRepos[1]));
+			if (!installation) return json({ message: "Not Found" }, 404);
+			const repositories = (installation.repositories === "all" ? [options.repo, ...created.keys()].filter((name) => same(name.split("/")[0] ?? "", installation.account)) : installation.repositories).map((name) => ({
+				full_name: name,
+				default_branch: same(name, options.repo) ? repo.defaultBranch : created.get(name)?.repo.defaultBranch ?? "main",
+				permissions: {
+					admin: user.admin === true,
+					push: user.push !== false,
+					pull: true
+				}
+			}));
+			return json({
+				total_count: repositories.length,
+				repositories
+			});
+		}
+		const addRepo = path.match(/^\/user\/installations\/(\d+)\/repositories\/(\d+)$/);
+		if (addRepo && request.method === "PUT" && user.app && !user.bot) {
+			const installation = user.app.installations.find((candidate) => candidate.id === Number(addRepo[1]));
+			const target = [...created.values()].find((candidate) => candidate.id === Number(addRepo[2]));
+			if (!installation || !target) return json({ message: "Not Found" }, 404);
+			if (installation.repositories !== "all" && !installation.repositories.includes(target.fullName)) installation.repositories.push(target.fullName);
+			return new Response(null, { status: 204 });
+		}
+		const setup = await handleCreated(request, path, user);
+		if (setup) return setup;
+		const account = path.match(/^\/users\/([^/]+)$/);
+		if (account) {
+			const login = decodeURIComponent(account[1] ?? "");
+			return accounts.has(login) ? json({ login }) : json({ message: "Not Found" }, 404);
+		}
 		if (path === "/graphql" && request.method === "POST") {
+			const body = await request.clone().json();
+			if (body.query.trimStart().startsWith("query")) {
+				if (`${body.variables?.owner}/${body.variables?.name}` !== options.repo) return json({
+					data: { repository: null },
+					errors: [{
+						type: "NOT_FOUND",
+						message: "Could not resolve"
+					}]
+				});
+				const repository = {};
+				for (const [, alias, oid] of body.query.matchAll(/(\w+): object\(oid: "([0-9a-f]{40})"\)/g)) {
+					const content = repo.blobs.get(oid ?? "");
+					repository[alias ?? ""] = content === void 0 ? null : typeof content === "string" ? {
+						text: content,
+						isBinary: false
+					} : {
+						text: null,
+						isBinary: true
+					};
+				}
+				graphqlReads += 1;
+				return json({ data: { repository } });
+			}
 			const { variables } = await request.json();
 			const { input } = variables;
 			if (input.branch.repositoryNameWithOwner !== options.repo) return json({ errors: [{
@@ -66,7 +659,7 @@ function fakeGitHub(options) {
 				})), ...(input.fileChanges.deletions ?? []).map((deletion) => ({
 					path: deletion.path,
 					delete: true
-				}))], input.message.headline, input.expectedHeadOid) } } } });
+				}))], input.message.headline, input.expectedHeadOid, user.name ?? user.login, input.branch.branchName) } } } });
 			} catch (error) {
 				if (error instanceof FakeConflictError) return json({
 					data: { createCommitOnBranch: null },
@@ -80,12 +673,97 @@ function fakeGitHub(options) {
 		}
 		const match = path.match(/^\/repos\/([^/]+\/[^/]+)(\/.*)?$/);
 		if (!match || decodeURIComponent(match[1] ?? "") !== options.repo) return json({ message: "Not Found" }, 404);
+		if (!canSee(user, options.repo)) return json({ message: "Not Found" }, 404);
 		const rest = match[2] ?? "";
+		const contents = rest.match(/^\/contents\/(.+)$/);
+		if (contents && request.method === "GET") {
+			if (user.bot && !user.permissions?.contents) return json({ message: "Resource not accessible by integration" }, 403);
+			const file = repo.files(url.searchParams.get("ref") ?? repo.defaultBranch).get(decodeURIComponent(contents[1] ?? ""));
+			if (file === void 0) return json({ message: "Not Found" }, 404);
+			return request.headers.get("accept")?.includes("raw") ? new Response(fakeFileBytes(file)) : json({
+				content: encodeBase64Bytes(fakeFileBytes(file)),
+				encoding: "base64"
+			});
+		}
+		const data = await handleGitData(request, rest, repo, user, false);
+		if (data) return data;
+		if (rest === "/git/refs" && request.method === "POST") {
+			if (user.push === false) return json({ message: "Resource not accessible by integration" }, 403);
+			const body = await request.json();
+			const branch = body.ref.replace(/^refs\/heads\//, "");
+			if (repo.branches.has(branch)) return json({ message: "Reference already exists" }, 422);
+			if (!repo.commitAt(body.sha)) return json({ message: "Object does not exist" }, 422);
+			repo.branches.set(branch, body.sha);
+			return json({
+				ref: body.ref,
+				object: { sha: body.sha }
+			}, 201);
+		}
+		const branchRef = rest.match(/^\/git\/refs\/heads\/(.+)$/);
+		if (branchRef && request.method === "DELETE") {
+			if (user.push === false) return json({ message: "Resource not accessible by integration" }, 403);
+			const branch = decodeURIComponent(branchRef[1] ?? "");
+			if (!repo.branches.has(branch)) return json({ message: "Reference does not exist" }, 422);
+			repo.branches.delete(branch);
+			return new Response(null, { status: 204 });
+		}
+		if (rest === "/pulls" && request.method === "POST") {
+			if (user.bot && user.permissions?.pull_requests !== "write") return json({ message: "Resource not accessible by integration" }, 403);
+			const body = await request.json();
+			if (!repo.branches.has(body.head) || !repo.branches.has(body.base)) return json({ message: "Validation Failed" }, 422);
+			if (repo.reviews.some((review) => review.branch === body.head && review.state === "open")) return json({ message: "A pull request already exists" }, 422);
+			const review = repo.openReview(body.head, body.title, body.body ?? "", body.base);
+			return json({
+				number: review.number,
+				html_url: `https://github.com/${options.repo}/pull/${review.number}`
+			}, 201);
+		}
+		if (rest === "/pulls" && request.method === "GET") {
+			const head = url.searchParams.get("head")?.split(":")[1];
+			return json(repo.reviews.filter((review) => review.state === "open" && (!head || review.branch === head)).map((review) => ({
+				number: review.number,
+				html_url: `https://github.com/${options.repo}/pull/${review.number}`
+			})));
+		}
+		if (rest === "/pages" && request.method === "GET") {
+			const site = pages.current;
+			if (!site) return json({ message: "Not Found" }, 404);
+			return json({
+				html_url: site.cname ? `https://${site.cname}/` : site.html_url,
+				cname: site.cname,
+				https_enforced: site.https_enforced,
+				https_certificate: site.cname ? {
+					state: site.certificate ?? "new",
+					domains: [site.cname]
+				} : null
+			});
+		}
+		if (rest === "/pages" && request.method === "PUT") {
+			const site = pages.current;
+			if (!site) return json({ message: "Not Found" }, 404);
+			if (user.pages === false) return json({ message: "Resource not accessible by personal access token" }, 403);
+			const body = await request.json();
+			if (body.cname && options.takenDomains?.includes(body.cname)) return json({ message: `The CNAME \`${body.cname}\` is already taken.` }, 422);
+			if (body.https_enforced && !["approved", "issued"].includes(site.certificate ?? "")) return json({ message: "The certificate does not exist yet" }, 422);
+			if (body.cname !== void 0) {
+				site.cname = body.cname;
+				site.certificate = body.cname ? "new" : void 0;
+				if (!body.cname) site.https_enforced = false;
+			}
+			if (body.https_enforced !== void 0) site.https_enforced = body.https_enforced;
+			return new Response(null, { status: 204 });
+		}
 		if (rest === "") return json({
+			id: 1,
 			full_name: options.repo,
 			default_branch: repo.defaultBranch,
-			permissions: { push: user.push !== false }
+			permissions: {
+				push: user.push !== false,
+				admin: user.admin === true
+			}
 		});
+		const people = await handleCollaborators(request, rest, user);
+		if (people) return people;
 		const ref = rest.match(/^\/git\/ref\/heads\/(.+)$/);
 		if (ref) {
 			const sha = repo.branches.get(decodeURIComponent(ref[1] ?? ""));
@@ -103,7 +781,8 @@ function fakeGitHub(options) {
 				tree: [...repo.files(commitSha)].map(([file, content]) => ({
 					path: file,
 					type: "blob",
-					sha: repo.blobSha(content)
+					sha: repo.blobSha(content),
+					size: fakeFileBytes(content).length
 				})),
 				truncated: false
 			});
@@ -117,8 +796,91 @@ function fakeGitHub(options) {
 				encoding: "base64"
 			});
 		}
-		const compare = rest.match(/^\/compare\/([0-9a-f]{40})\.\.\.([0-9a-f]{40})$/);
-		if (compare) return json({ files: repo.changedPaths(compare[1] ?? "", compare[2] ?? "").map((filename) => ({ filename })) });
+		if (rest === "/commits") {
+			const ref = url.searchParams.get("sha") ?? repo.defaultBranch;
+			const file = url.searchParams.get("path");
+			if (!repo.commitAt(repo.branches.get(ref) ?? ref)) return json({ message: "No commit found for SHA" }, 422);
+			const perPage = Number(url.searchParams.get("per_page") ?? 30);
+			const page = Number(url.searchParams.get("page") ?? 1);
+			return json((file ? repo.history(file, ref) : []).slice((page - 1) * perPage, page * perPage).map((commit) => ({
+				sha: commit.sha,
+				commit: {
+					message: commit.message,
+					author: {
+						name: commit.author ?? "GitHub",
+						date: commit.date
+					}
+				},
+				author: null
+			})));
+		}
+		if (rest === "/actions/workflows/deploy.yml/dispatches" && request.method === "POST") {
+			if (!(user.actionsWrite ?? user.administration)) return json({ message: "Resource not accessible by personal access token" }, 403);
+			const body = await request.json();
+			runs.push({
+				id: runs.length + 1,
+				sha: repo.head(body.ref),
+				event: "workflow_dispatch",
+				inputs: body.inputs,
+				status: "queued",
+				conclusion: null,
+				jobs: []
+			});
+			return new Response(null, { status: 204 });
+		}
+		if (rest === "/actions/workflows/deploy.yml/runs") {
+			if (user.actions === false) return json({ message: "Resource not accessible by personal access token" }, 403);
+			return json({
+				total_count: runs.length,
+				workflow_runs: [...runs].reverse().map((run) => ({
+					id: run.id,
+					event: run.event ?? "push",
+					head_sha: run.sha,
+					status: run.status,
+					conclusion: run.conclusion,
+					created_at: run.createdAt ?? "2026-01-05T04:17:00Z",
+					html_url: `https://github.com/${options.repo}/actions/runs/${run.id}`
+				}))
+			});
+		}
+		if (rest === "/actions/runs" || rest.startsWith("/actions/runs/")) {
+			if (user.actions === false) return json({ message: "Resource not accessible by personal access token" }, 403);
+			const htmlUrl = (run) => `https://github.com/${options.repo}/actions/runs/${run.id}`;
+			if (rest === "/actions/runs") {
+				const sha = url.searchParams.get("head_sha");
+				const found = runs.filter((run) => !sha || run.sha === sha);
+				return json({
+					total_count: found.length,
+					workflow_runs: found.map((run) => ({
+						id: run.id,
+						head_sha: run.sha,
+						status: run.status,
+						conclusion: run.conclusion,
+						name: "Deploy to GitHub Pages",
+						path: ".github/workflows/deploy.yml",
+						html_url: htmlUrl(run)
+					}))
+				});
+			}
+			const jobs = rest.match(/^\/actions\/runs\/(\d+)\/jobs$/);
+			const run = runs.find((candidate) => candidate.id === Number(jobs?.[1]));
+			return run ? json({
+				total_count: run.jobs.length,
+				jobs: run.jobs
+			}) : json({ message: "Not Found" }, 404);
+		}
+		const compare = rest.match(/^\/compare\/(.+)\.\.\.(.+)$/);
+		if (compare) {
+			const [from, to] = [compare[1], compare[2]].map((ref) => decodeURIComponent(ref ?? ""));
+			const resolve = (ref) => repo.branches.get(ref) ?? (repo.commitAt(ref) ? ref : void 0);
+			const [a, b] = [resolve(from ?? ""), resolve(to ?? "")];
+			if (!a || !b) return json({ message: "Not Found" }, 404);
+			const base = repo.mergeBase(a, b) ?? a;
+			return json({
+				merge_base_commit: { sha: base },
+				files: repo.changedPaths(base, b).map((filename) => ({ filename }))
+			});
+		}
 		if (rest === "/deployments") {
 			const sha = url.searchParams.get("sha");
 			return json(deployments.filter((deployment) => !sha || deployment.sha === sha).slice(0, Number(url.searchParams.get("per_page") ?? 30)).map(({ id, sha }) => ({
@@ -141,7 +903,28 @@ function fakeGitHub(options) {
 	}
 	return {
 		repo,
+		/** How many GraphQL requests read files, as `readFiles()` makes. */
+		get graphqlReads() {
+			return graphqlReads;
+		},
+		/** Tokens apps' sign-ins made, in order. */
+		issued,
+		/** Who commits made through the REST API name as their author, by commit. */
+		commitAuthors,
+		authorize,
+		install,
+		/** Repositories created through the API, by `owner/name`. */
+		created,
+		/** The site's GitHub Pages settings, which tests can change, such as to issue the certificate. */
+		pages,
+		/** The repository's collaborators, by login, and invitations waiting to be accepted. */
+		collaborators,
+		invitations,
+		accept,
 		deployments,
+		/** GitHub Actions workflow runs, which tests add with `failBuild()`. */
+		runs,
+		failBuild,
 		/** Every request received, for checking what the backend sent. */
 		requests,
 		/** Simulates someone else publishing. */