@goodfellow-cms/github 0.2.0 → 0.4.0

package/dist/testing.js

@@ -1,3 +1,4 @@
+import { n as openSealedSecret } from "./deploy-keys-DAj2oX-N.js";
 import { decodeBase64, encodeBase64Bytes } from "@goodfellow-cms/core";
 import { FakeConflictError, FakeRepo, fakeFileBytes, fakeFileFromBytes } from "@goodfellow-cms/core/testing";
 //#region src/testing.ts
@@ -6,6 +7,28 @@ import { FakeConflictError, FakeRepo, fakeFileBytes, fakeFileFromBytes } from "@
 * an in-memory repository. For tests only: pass `fake.fetch` as the backend's
 * `fetch`, or route browser requests to `fake.handle` in end-to-end tests.
 */
+/** GitHub's number for an account, worked out from its login when a test doesn't give one. */
+function accountId(login) {
+	let hash = 7;
+	for (const char of login.toLowerCase()) hash = (hash * 31 + char.charCodeAt(0)) % 9e6;
+	return 1e6 + hash;
+}
+function same(a, b) {
+	return a.toLowerCase() === b.toLowerCase();
+}
+function covers(installation, fullName) {
+	const [owner = ""] = fullName.split("/");
+	if (!same(installation.account, owner)) return false;
+	return installation.repositories === "all" || installation.repositories.some((repo) => same(repo, fullName));
+}
+function decodeJwtPart(part) {
+	try {
+		const base64 = part.replace(/-/g, "+").replace(/_/g, "/");
+		return JSON.parse(atob(base64 + "=".repeat((4 - base64.length % 4) % 4)));
+	} catch {
+		return;
+	}
+}
 function json(body, status = 200) {
 	return new Response(JSON.stringify(body), {
 		status,
@@ -18,10 +41,22 @@ function fakeGitHub(options) {
 		login: "editor",
 		name: "Test Editor"
 	} };
+	/** Every token that works: the test's own, and those apps' sign-ins make. */
+	const principals = new Map(Object.entries(tokens));
+	const apps = options.apps ?? [];
+	const issued = [];
+	/** OAuth codes waiting to be exchanged, and refresh tokens, by the app and person they're for. */
+	const codes = /* @__PURE__ */ new Map();
+	const refreshTokens = /* @__PURE__ */ new Map();
+	/** Who each commit made through the REST API names as its author. */
+	const commitAuthors = /* @__PURE__ */ new Map();
+	let nextToken = 1;
+	let nextRepoId = 100;
 	const deployments = [];
 	const runs = [];
 	const requests = [];
 	let nextDeployment = 1;
+	let graphqlReads = 0;
 	const created = /* @__PURE__ */ new Map();
 	const [owner = "", name = ""] = options.repo.split("/");
 	const pages = { current: options.pages ? {
@@ -60,6 +95,24 @@ function fakeGitHub(options) {
 				permissions: invitation.permission
 			})));
 		}
+		const permission = rest.match(/^\/collaborators\/([^/]+)\/permission$/);
+		if (permission && request.method === "GET") {
+			const login = decodeURIComponent(permission[1] ?? "");
+			if (!accounts.has(login)) return json({ message: "Not Found" }, 404);
+			const role = collaborators.get(login);
+			const level = role === "admin" ? "admin" : role === "push" ? "write" : role === "read" ? "read" : "none";
+			return json({
+				permission: level,
+				user: {
+					login,
+					permissions: {
+						admin: level === "admin",
+						push: level === "admin" || level === "write",
+						pull: level !== "none"
+					}
+				}
+			});
+		}
 		const collaborator = rest.match(/^\/collaborators\/([^/]+)$/);
 		if (collaborator) {
 			if (!canManage) return forbidden();
@@ -140,11 +193,28 @@ function fakeGitHub(options) {
 		const [invitation] = index === -1 ? [] : invitations.splice(index, 1);
 		if (invitation) collaborators.set(login, invitation.permission === "admin" ? "admin" : "push");
 	}
+	/** Adds another repository, as if someone had made it, such as a site's code repository beside its content's. */
+	function addRepo(fullName, repoOptions = {}) {
+		const added = {
+			id: nextRepoId++,
+			fullName,
+			private: repoOptions.private === true,
+			repo: new FakeRepo(repoOptions.files ?? {}, "main"),
+			rulesets: [],
+			deployKeys: [],
+			secrets: /* @__PURE__ */ new Map(),
+			collaborators: new Map(Object.entries(repoOptions.collaborators ?? {}))
+		};
+		created.set(fullName, added);
+		return added;
+	}
 	/** Repository creation and the Git data API, for repositories created through the fake. */
-	async function handleCreated(request, path, login) {
+	async function handleCreated(request, path, principal) {
+		const login = principal.login;
 		if (path === "/user/orgs") return json((options.orgs ?? []).map((org) => ({ login: org })));
 		const create = path === "/user/repos" ? login : path.match(/^\/orgs\/([^/]+)\/repos$/)?.[1];
 		if (create !== void 0 && request.method === "POST") {
+			if (principal.bot || principal.app && principal.permissions?.administration !== "write") return json({ message: "Resource not accessible by integration" }, 403);
 			if (path !== "/user/repos" && !options.orgs?.includes(create)) return json({ message: "Not Found" }, 404);
 			const body = await request.json();
 			if (!/^[\w.-]+$/.test(body.name)) return json({ message: "Repository creation failed." }, 422);
@@ -154,14 +224,19 @@ function fakeGitHub(options) {
 				errors: [{ message: "name already exists on this account" }]
 			}, 422);
 			const repo = new FakeRepo({ "README.md": `# ${body.name}\n` }, options.newRepoBranch ?? "main");
+			const id = nextRepoId++;
 			created.set(fullName, {
+				id,
 				fullName,
 				private: body.private === true,
 				description: body.description,
 				repo,
-				rulesets: []
+				rulesets: [],
+				deployKeys: [],
+				secrets: /* @__PURE__ */ new Map()
 			});
 			return json({
+				id,
 				full_name: fullName,
 				html_url: `https://github.com/${fullName}`,
 				default_branch: repo.defaultBranch
@@ -170,14 +245,55 @@ function fakeGitHub(options) {
 		const match = path.match(/^\/repos\/([^/]+\/[^/]+)(\/.*)?$/);
 		const site = created.get(decodeURIComponent(match?.[1] ?? ""));
 		if (!match || !site) return void 0;
+		if (!canSee(principal, site.fullName)) return json({ message: "Not Found" }, 404);
 		const { repo } = site;
 		const rest = match[2] ?? "";
 		const method = request.method;
 		if (rest === "" && method === "GET") return json({
+			id: site.id,
 			full_name: site.fullName,
+			private: site.private,
 			default_branch: repo.defaultBranch,
-			permissions: { push: true }
+			permissions: {
+				push: true,
+				admin: true
+			}
 		});
+		const tree = rest.match(/^\/git\/trees\/([0-9a-f]{40})$/);
+		if (tree && method === "GET" && repo.commitAt(tree[1] ?? "")) {
+			const entries = [...repo.files(tree[1] ?? "")].map(([file, content]) => ({
+				path: file,
+				type: "blob",
+				sha: repo.blobSha(content),
+				size: fakeFileBytes(content).length
+			}));
+			return json({
+				sha: tree[1],
+				tree: entries,
+				truncated: false
+			});
+		}
+		const blob = rest.match(/^\/git\/blobs\/([0-9a-f]{40})$/);
+		if (blob && method === "GET") {
+			const content = repo.blobs.get(blob[1] ?? "");
+			if (content === void 0) return json({ message: "Not Found" }, 404);
+			return new Response(fakeFileBytes(content));
+		}
+		const contents = rest.match(/^\/contents\/(.+)$/);
+		if (contents && method === "GET") {
+			if (principal.app && !principal.permissions?.contents) return json({ message: "Resource not accessible" }, 403);
+			const file = repo.files().get(decodeURIComponent(contents[1] ?? ""));
+			if (file === void 0) return json({ message: "Not Found" }, 404);
+			return new Response(typeof file === "string" ? file : fakeFileBytes(file));
+		}
+		const permission = rest.match(/^\/collaborators\/([^/]+)\/permission$/);
+		if (permission && method === "GET") {
+			const login = decodeURIComponent(permission[1] ?? "");
+			return json({
+				permission: site.collaborators?.get(login) ?? "none",
+				user: { login }
+			});
+		}
 		if (rest === "" && method === "PATCH") {
 			const body = await request.json();
 			if (body.default_branch) {
@@ -198,17 +314,6 @@ function fakeGitHub(options) {
 			repo.branches.delete(decodeURIComponent(ref[1] ?? ""));
 			return new Response(null, { status: 204 });
 		}
-		if (ref && method === "PATCH") {
-			const body = await request.json();
-			const branch = decodeURIComponent(ref[1] ?? "");
-			const commit = repo.commitAt(body.sha);
-			if (!commit || !repo.branches.has(branch)) return json({ message: "Reference does not exist" }, 422);
-			if (!body.force && commit.parent !== repo.branches.get(branch)) return json({ message: "Update is not a fast forward" }, 422);
-			if (site.rulesets.length > 0 && commit.parent !== repo.branches.get(branch)) return json({ message: "Cannot force-push to this branch" }, 422);
-			repo.branches.set(branch, body.sha);
-			deploy(body.sha);
-			return json({ object: { sha: body.sha } });
-		}
 		if (rest === "/git/refs" && method === "POST") {
 			const body = await request.json();
 			repo.branches.set(body.ref.replace(/^refs\/heads\//, ""), body.sha);
@@ -217,20 +322,104 @@ function fakeGitHub(options) {
 				object: { sha: body.sha }
 			}, 201);
 		}
+		const data = await handleGitData(request, rest, repo, principal, site.rulesets.length > 0);
+		if (data) return data;
+		if (rest === "/pages" && method === "POST") {
+			if (site.private && !options.paidPlan) return json({ message: "Your current plan does not support GitHub Pages for this repository." }, 422);
+			site.pages = await request.json();
+			const [owner, name] = site.fullName.split("/");
+			return json({
+				html_url: `https://${owner}.github.io/${name}/`,
+				build_type: site.pages.build_type
+			}, 201);
+		}
+		const notAllowed = (permission) => principal.app ? principal.permissions?.[permission] !== "write" : principal.secrets === false;
+		if (rest === "/keys" && method === "POST") {
+			if (notAllowed("administration")) return json({ message: "Resource not accessible by integration" }, 403);
+			const body = await request.json();
+			if (!/^ssh-ed25519 [A-Za-z0-9+/=]+( |$)/.test(body.key)) return json({ message: "key is invalid" }, 422);
+			site.deployKeys.push({
+				title: body.title,
+				key: body.key,
+				read_only: body.read_only === true
+			});
+			return json({
+				id: site.deployKeys.length,
+				...body
+			}, 201);
+		}
+		if (rest === "/actions/secrets/public-key" && method === "GET") {
+			if (notAllowed("secrets")) return json({ message: "Resource not accessible by integration" }, 403);
+			site.secretKey ??= await crypto.subtle.generateKey({ name: "X25519" }, true, ["deriveBits"]);
+			const raw = new Uint8Array(await crypto.subtle.exportKey("raw", site.secretKey.publicKey));
+			return json({
+				key_id: `key-${site.id}`,
+				key: encodeBase64Bytes(raw)
+			});
+		}
+		const secret = rest.match(/^\/actions\/secrets\/([A-Z0-9_]+)$/);
+		if (secret && method === "PUT") {
+			if (notAllowed("secrets")) return json({ message: "Resource not accessible by integration" }, 403);
+			const body = await request.json();
+			if (!site.secretKey || body.key_id !== `key-${site.id}`) return json({ message: "Bad key id" }, 422);
+			try {
+				site.secrets.set(secret[1] ?? "", await openSealedSecret(decodeBase64(body.encrypted_value), site.secretKey));
+			} catch {
+				return json({ message: "Bad encrypted value" }, 422);
+			}
+			return new Response(null, { status: 201 });
+		}
+		if (rest === "/rulesets" && method === "POST") {
+			if (site.private && !options.paidPlan) return json({ message: "Upgrade to GitHub Pro" }, 403);
+			site.rulesets.push(await request.json());
+			return json({ id: site.rulesets.length }, 201);
+		}
+		return json({ message: "Not Found" }, 404);
+	}
+	/** Whether a token may see a repository: an app's only where it's installed, and an installation's only its own. */
+	function canSee(principal, fullName) {
+		if (principal.repositories) return principal.repositories.some((repo) => same(repo, fullName));
+		if (principal.app) return principal.app.installations.some((installation) => covers(installation, fullName));
+		return true;
+	}
+	function treeOf(target, commitSha) {
+		const sha = target.blobSha(`tree-of:${commitSha}`);
+		if (!trees.has(sha)) trees.set(sha, new Map(target.files(commitSha)));
+		return sha;
+	}
+	/** Git's data API on a repository: blobs, trees, commits and moving a branch, as REST commits need. */
+	async function handleGitData(request, rest, target, principal, protectedHistory) {
+		const method = request.method;
+		const commitSha = rest.match(/^\/git\/commits\/([0-9a-f]{40})$/);
+		if (commitSha && method === "GET") {
+			const found = target.commitAt(commitSha[1] ?? "");
+			if (!found) return json({ message: "Not Found" }, 404);
+			return json({
+				sha: found.sha,
+				tree: { sha: treeOf(target, found.sha) },
+				parents: found.parent ? [{ sha: found.parent }] : []
+			});
+		}
 		if (rest === "/git/blobs" && method === "POST") {
+			if (principal.push === false) return json({ message: "Resource not accessible by integration" }, 403);
 			const body = await request.json();
-			return json({ sha: repo.blobSha(body.encoding === "base64" ? fakeFileFromBytes(decodeBase64(body.content)) : body.content) }, 201);
+			return json({ sha: target.blobSha(body.encoding === "base64" ? fakeFileFromBytes(decodeBase64(body.content)) : body.content) }, 201);
 		}
 		if (rest === "/git/trees" && method === "POST") {
 			const body = await request.json();
-			const files = /* @__PURE__ */ new Map();
+			if (body.base_tree && !trees.has(body.base_tree)) return json({ message: "Tree not found" }, 422);
+			const files = new Map(body.base_tree ? trees.get(body.base_tree) : void 0);
 			for (const entry of body.tree) {
-				if (entry.path.startsWith(".github/workflows/") && user(request)?.workflow === false) return json({ message: "Resource not accessible by personal access token" }, 404);
-				const content = entry.content ?? repo.blobs.get(entry.sha ?? "");
+				if (entry.path.startsWith(".github/workflows/") && principal.workflow === false) return json({ message: "Resource not accessible by personal access token" }, 404);
+				if (entry.sha === null) {
+					files.delete(entry.path);
+					continue;
+				}
+				const content = entry.content ?? target.blobs.get(entry.sha ?? "");
 				if (content === void 0) return json({ message: `No blob ${entry.sha}` }, 422);
 				files.set(entry.path, content);
 			}
-			const sha = repo.blobSha(`tree:${[...files.keys()].join(",")}:${trees.size}`);
+			const sha = target.blobSha(`tree:${[...files.keys()].join(",")}:${trees.size}`);
 			trees.set(sha, files);
 			return json({ sha }, 201);
 		}
@@ -238,26 +427,24 @@ function fakeGitHub(options) {
 			const body = await request.json();
 			const files = trees.get(body.tree);
 			if (!files) return json({ message: "Tree not found" }, 422);
-			return json({ sha: repo.addCommit(body.parents[0], body.message, new Map(files)) }, 201);
-		}
-		if (rest === "/pages" && method === "POST") {
-			if (site.private && !options.paidPlan) return json({ message: "Your current plan does not support GitHub Pages for this repository." }, 422);
-			site.pages = await request.json();
-			const [owner, name] = site.fullName.split("/");
-			return json({
-				html_url: `https://${owner}.github.io/${name}/`,
-				build_type: site.pages.build_type
-			}, 201);
+			const author = body.author?.name ?? (principal.bot ? principal.login : principal.name ?? principal.login);
+			const sha = target.addCommit(body.parents[0], body.message, new Map(files), author);
+			commitAuthors.set(sha, body.author ?? { name: author });
+			return json({ sha }, 201);
 		}
-		if (rest === "/rulesets" && method === "POST") {
-			if (site.private && !options.paidPlan) return json({ message: "Upgrade to GitHub Pro" }, 403);
-			site.rulesets.push(await request.json());
-			return json({ id: site.rulesets.length }, 201);
+		const ref = rest.match(/^\/git\/refs?\/heads\/(.+)$/);
+		if (ref && method === "PATCH") {
+			if (principal.push === false) return json({ message: "Resource not accessible by integration" }, 403);
+			const body = await request.json();
+			const branch = decodeURIComponent(ref[1] ?? "");
+			const found = target.commitAt(body.sha);
+			if (!found || !target.branches.has(branch)) return json({ message: "Reference does not exist" }, 422);
+			if (!body.force && found.parent !== target.branches.get(branch)) return json({ message: "Update is not a fast forward" }, 422);
+			if (protectedHistory && found.parent !== target.branches.get(branch)) return json({ message: "Cannot force-push to this branch" }, 422);
+			target.branches.set(branch, body.sha);
+			if (branch === target.defaultBranch) deploy(body.sha);
+			return json({ object: { sha: body.sha } });
 		}
-		return json({ message: "Not Found" }, 404);
-	}
-	function user(request) {
-		return tokens[request.headers.get("authorization")?.replace(/^Bearer /, "") ?? ""];
 	}
 	function deploy(sha) {
 		if (options.deployAfterChecks === void 0) return;
@@ -268,26 +455,251 @@ function fakeGitHub(options) {
 			checks: 0
 		});
 	}
-	function commit(changes, message, expectedHead, author) {
+	function commit(changes, message, expectedHead, author, branch = repo.defaultBranch) {
 		const sha = repo.commit(changes, message, {
 			expectedHead,
-			author
+			author,
+			branch
 		});
-		deploy(sha);
+		if (branch === repo.defaultBranch) deploy(sha);
 		return sha;
 	}
+	/** The person a login belongs to, as the test's tokens describe them. */
+	function person(login) {
+		return Object.values(tokens).find((candidate) => same(candidate.login, login)) ?? { login };
+	}
+	/** Simulates someone signing in to an app on GitHub's page: the code GitHub sends back to the app's callback. */
+	function authorize(login, clientId) {
+		const app = apps.find((candidate) => candidate.clientId === clientId);
+		if (!app) throw new Error(`No app with client ID ${clientId}`);
+		const code = `code-${nextToken++}`;
+		codes.set(code, {
+			app,
+			login
+		});
+		return code;
+	}
+	/**
+	* Simulates someone installing an app on GitHub's install page, choosing
+	* these repositories, or adding them to its installation on the account,
+	* and being signed in as they go: the code GitHub sends back to the app's callback.
+	*/
+	function install(slug, login, repositories, account = repositories[0]?.split("/")[0] ?? login) {
+		const app = apps.find((candidate) => candidate.slug === slug);
+		if (!app) throw new Error(`No app ${slug}`);
+		let installation = app.installations.find((candidate) => same(candidate.account, account));
+		if (!installation) {
+			installation = {
+				id: 1e3 + nextToken++,
+				account,
+				repositories: []
+			};
+			app.installations.push(installation);
+		}
+		const chosen = installation.repositories;
+		if (chosen !== "all") {
+			for (const repo of repositories) if (!chosen.some((name) => same(name, repo))) chosen.push(repo);
+		}
+		return {
+			code: authorize(login, app.clientId),
+			installation: installation.id
+		};
+	}
+	function userToken(app, login) {
+		const access = `ghu_fake${nextToken++}`;
+		const refresh = `ghr_fake${nextToken++}`;
+		const base = person(login);
+		principals.set(access, {
+			...base,
+			app,
+			permissions: app.permissions,
+			administration: app.permissions.administration === "write",
+			pages: app.permissions.pages === "write",
+			workflow: app.permissions.workflows === "write",
+			actions: app.permissions.actions !== void 0,
+			actionsWrite: app.permissions.actions === "write"
+		});
+		refreshTokens.set(refresh, {
+			app,
+			login
+		});
+		issued.push({
+			token: access,
+			kind: "user",
+			app: app.slug,
+			login,
+			permissions: app.permissions
+		});
+		return json({
+			access_token: access,
+			token_type: "bearer",
+			scope: "",
+			expires_in: 28800,
+			refresh_token: refresh,
+			refresh_token_expires_in: 15897600
+		});
+	}
+	async function appFromJwt(jwt) {
+		const [header, payload, signature] = jwt.split(".");
+		const claims = decodeJwtPart(payload ?? "");
+		if (!header || !claims || !signature || decodeJwtPart(header)?.alg !== "RS256") return void 0;
+		const app = apps.find((candidate) => String(candidate.id) === String(claims.iss));
+		if (!app || typeof claims.exp !== "number" || claims.exp * 1e3 < Date.now()) return void 0;
+		if (app.publicKey) {
+			const base64 = signature.replace(/-/g, "+").replace(/_/g, "/");
+			const bytes = Uint8Array.from(atob(base64 + "=".repeat((4 - base64.length % 4) % 4)), (char) => char.charCodeAt(0));
+			if (!await crypto.subtle.verify("RSASSA-PKCS1-v1_5", app.publicKey, bytes, new TextEncoder().encode(`${header}.${payload}`))) return void 0;
+		}
+		return app;
+	}
+	/** What GitHub Apps call: OAuth's token exchange, revoking, and the app's own endpoints, which take its JWT. */
+	async function handleApps(request, path) {
+		const authorization = request.headers.get("authorization") ?? "";
+		if (path === "/login/oauth/access_token" && request.method === "POST") {
+			const body = await request.json();
+			const app = apps.find((candidate) => candidate.clientId === body.client_id);
+			if (!app || app.clientSecret !== body.client_secret) return json({ error: "incorrect_client_credentials" });
+			if (body.grant_type === "refresh_token") {
+				const found = refreshTokens.get(body.refresh_token ?? "");
+				if (!found || found.app !== app) return json({ error: "bad_refresh_token" });
+				refreshTokens.delete(body.refresh_token ?? "");
+				return userToken(app, found.login);
+			}
+			const found = codes.get(body.code ?? "");
+			if (!found || found.app !== app) return json({ error: "bad_verification_code" });
+			codes.delete(body.code ?? "");
+			return userToken(app, found.login);
+		}
+		const revoke = path.match(/^\/applications\/([^/]+)\/token$/);
+		if (revoke && request.method === "DELETE") {
+			const [id, secret] = atob(authorization.replace(/^Basic /, "")).split(":");
+			const app = apps.find((candidate) => candidate.clientId === decodeURIComponent(revoke[1] ?? ""));
+			if (!app || app.clientId !== id || app.clientSecret !== secret) return json({ message: "Not Found" }, 404);
+			const { access_token: token } = await request.json();
+			principals.delete(token);
+			for (const item of issued) if (item.token === token) item.revoked = true;
+			return new Response(null, { status: 204 });
+		}
+		if (path === "/installation/token" && request.method === "DELETE") {
+			const token = authorization.replace(/^Bearer /, "");
+			if (!principals.get(token)?.bot) return json({ message: "Bad credentials" }, 401);
+			principals.delete(token);
+			for (const item of issued) if (item.token === token) item.revoked = true;
+			return new Response(null, { status: 204 });
+		}
+		if (!/^Bearer ey/.test(authorization)) return void 0;
+		const app = await appFromJwt(authorization.slice(7));
+		if (!app) return json({ message: "A JSON web token could not be decoded" }, 401);
+		const installed = path.match(/^\/repos\/([^/]+\/[^/]+)\/installation$/);
+		if (installed) {
+			const fullName = decodeURIComponent(installed[1] ?? "");
+			const installation = app.installations.find((candidate) => covers(candidate, fullName));
+			return installation ? json({
+				id: installation.id,
+				account: { login: installation.account },
+				app_slug: app.slug
+			}) : json({ message: "Not Found" }, 404);
+		}
+		const mint = path.match(/^\/app\/installations\/(\d+)\/access_tokens$/);
+		if (mint && request.method === "POST") {
+			const installation = app.installations.find((candidate) => candidate.id === Number(mint[1]));
+			if (!installation) return json({ message: "Not Found" }, 404);
+			const body = await request.json();
+			const repositories = (body.repositories ?? []).map((name) => `${installation.account}/${name}`);
+			if (repositories.some((repo) => !covers(installation, repo))) return json({ message: "There is at least one repository that does not exist or is not accessible" }, 422);
+			const permissions = body.permissions ?? app.permissions;
+			for (const [name, level] of Object.entries(permissions)) {
+				const allowed = app.permissions[name];
+				if (!allowed || level === "write" && allowed !== "write") return json({ message: `The permissions requested are not granted to this installation.` }, 422);
+			}
+			const token = `ghs_fake${nextToken++}`;
+			principals.set(token, {
+				login: `${app.slug}[bot]`,
+				bot: true,
+				app,
+				repositories,
+				permissions,
+				push: permissions.contents === "write",
+				workflow: permissions.workflows === "write",
+				pages: permissions.pages === "write",
+				administration: permissions.administration === "write",
+				admin: permissions.administration === "write",
+				actions: permissions.actions !== void 0,
+				actionsWrite: permissions.actions === "write"
+			});
+			issued.push({
+				token,
+				kind: "installation",
+				app: app.slug,
+				repositories,
+				permissions
+			});
+			return json({
+				token,
+				expires_at: new Date(Date.now() + 36e5).toISOString(),
+				permissions
+			}, 201);
+		}
+		return json({ message: "Not Found" }, 404);
+	}
 	async function handle(request) {
 		requests.push(request.clone());
 		const url = new URL(request.url);
 		const path = url.pathname;
-		const user = tokens[request.headers.get("authorization")?.replace(/^Bearer /, "") ?? ""];
+		const fromApp = await handleApps(request, path);
+		if (fromApp) return fromApp;
+		const user = principals.get(request.headers.get("authorization")?.replace(/^Bearer /, "") ?? "");
 		if (!user) return json({ message: "Bad credentials" }, 401);
-		if (path === "/user") return json({
-			login: user.login,
-			name: user.name ?? null,
-			avatar_url: `https://avatars.example/${user.login}`
-		});
-		const setup = await handleCreated(request, path, user.login);
+		if (path === "/user") {
+			if (user.bot) return json({ message: "Resource not accessible by integration" }, 403);
+			return json({
+				id: user.id ?? accountId(user.login),
+				login: user.login,
+				name: user.name ?? null,
+				avatar_url: `https://avatars.example/${user.login}`
+			});
+		}
+		if (path === "/user/installations" && user.app && !user.bot) {
+			const mine = user.app.installations.filter((installation) => same(installation.account, user.login) || (options.orgs ?? []).some((org) => same(org, installation.account)));
+			return json({
+				total_count: mine.length,
+				installations: mine.map((installation) => ({
+					id: installation.id,
+					account: {
+						login: installation.account,
+						type: installation.accountType ?? "User"
+					},
+					repository_selection: installation.repositories === "all" ? "all" : "selected"
+				}))
+			});
+		}
+		const listRepos = path.match(/^\/user\/installations\/(\d+)\/repositories$/);
+		if (listRepos && request.method === "GET" && user.app && !user.bot) {
+			const installation = user.app.installations.find((candidate) => candidate.id === Number(listRepos[1]));
+			if (!installation) return json({ message: "Not Found" }, 404);
+			const repositories = (installation.repositories === "all" ? [options.repo, ...created.keys()].filter((name) => same(name.split("/")[0] ?? "", installation.account)) : installation.repositories).map((name) => ({
+				full_name: name,
+				default_branch: same(name, options.repo) ? repo.defaultBranch : created.get(name)?.repo.defaultBranch ?? "main",
+				permissions: {
+					admin: user.admin === true,
+					push: user.push !== false,
+					pull: true
+				}
+			}));
+			return json({
+				total_count: repositories.length,
+				repositories
+			});
+		}
+		const addRepo = path.match(/^\/user\/installations\/(\d+)\/repositories\/(\d+)$/);
+		if (addRepo && request.method === "PUT" && user.app && !user.bot) {
+			const installation = user.app.installations.find((candidate) => candidate.id === Number(addRepo[1]));
+			const target = [...created.values()].find((candidate) => candidate.id === Number(addRepo[2]));
+			if (!installation || !target) return json({ message: "Not Found" }, 404);
+			if (installation.repositories !== "all" && !installation.repositories.includes(target.fullName)) installation.repositories.push(target.fullName);
+			return new Response(null, { status: 204 });
+		}
+		const setup = await handleCreated(request, path, user);
 		if (setup) return setup;
 		const account = path.match(/^\/users\/([^/]+)$/);
 		if (account) {
@@ -295,6 +707,29 @@ function fakeGitHub(options) {
 			return accounts.has(login) ? json({ login }) : json({ message: "Not Found" }, 404);
 		}
 		if (path === "/graphql" && request.method === "POST") {
+			const body = await request.clone().json();
+			if (body.query.trimStart().startsWith("query")) {
+				if (`${body.variables?.owner}/${body.variables?.name}` !== options.repo) return json({
+					data: { repository: null },
+					errors: [{
+						type: "NOT_FOUND",
+						message: "Could not resolve"
+					}]
+				});
+				const repository = {};
+				for (const [, alias, oid] of body.query.matchAll(/(\w+): object\(oid: "([0-9a-f]{40})"\)/g)) {
+					const content = repo.blobs.get(oid ?? "");
+					repository[alias ?? ""] = content === void 0 ? null : typeof content === "string" ? {
+						text: content,
+						isBinary: false
+					} : {
+						text: null,
+						isBinary: true
+					};
+				}
+				graphqlReads += 1;
+				return json({ data: { repository } });
+			}
 			const { variables } = await request.json();
 			const { input } = variables;
 			if (input.branch.repositoryNameWithOwner !== options.repo) return json({ errors: [{
@@ -314,7 +749,7 @@ function fakeGitHub(options) {
 				})), ...(input.fileChanges.deletions ?? []).map((deletion) => ({
 					path: deletion.path,
 					delete: true
-				}))], input.message.headline, input.expectedHeadOid, user.name ?? user.login) } } } });
+				}))], input.message.headline, input.expectedHeadOid, user.name ?? user.login, input.branch.branchName) } } } });
 			} catch (error) {
 				if (error instanceof FakeConflictError) return json({
 					data: { createCommitOnBranch: null },
@@ -328,7 +763,58 @@ function fakeGitHub(options) {
 		}
 		const match = path.match(/^\/repos\/([^/]+\/[^/]+)(\/.*)?$/);
 		if (!match || decodeURIComponent(match[1] ?? "") !== options.repo) return json({ message: "Not Found" }, 404);
+		if (!canSee(user, options.repo)) return json({ message: "Not Found" }, 404);
 		const rest = match[2] ?? "";
+		const contents = rest.match(/^\/contents\/(.+)$/);
+		if (contents && request.method === "GET") {
+			if (user.bot && !user.permissions?.contents) return json({ message: "Resource not accessible by integration" }, 403);
+			const file = repo.files(url.searchParams.get("ref") ?? repo.defaultBranch).get(decodeURIComponent(contents[1] ?? ""));
+			if (file === void 0) return json({ message: "Not Found" }, 404);
+			return request.headers.get("accept")?.includes("raw") ? new Response(fakeFileBytes(file)) : json({
+				content: encodeBase64Bytes(fakeFileBytes(file)),
+				encoding: "base64"
+			});
+		}
+		const data = await handleGitData(request, rest, repo, user, false);
+		if (data) return data;
+		if (rest === "/git/refs" && request.method === "POST") {
+			if (user.push === false) return json({ message: "Resource not accessible by integration" }, 403);
+			const body = await request.json();
+			const branch = body.ref.replace(/^refs\/heads\//, "");
+			if (repo.branches.has(branch)) return json({ message: "Reference already exists" }, 422);
+			if (!repo.commitAt(body.sha)) return json({ message: "Object does not exist" }, 422);
+			repo.branches.set(branch, body.sha);
+			return json({
+				ref: body.ref,
+				object: { sha: body.sha }
+			}, 201);
+		}
+		const branchRef = rest.match(/^\/git\/refs\/heads\/(.+)$/);
+		if (branchRef && request.method === "DELETE") {
+			if (user.push === false) return json({ message: "Resource not accessible by integration" }, 403);
+			const branch = decodeURIComponent(branchRef[1] ?? "");
+			if (!repo.branches.has(branch)) return json({ message: "Reference does not exist" }, 422);
+			repo.branches.delete(branch);
+			return new Response(null, { status: 204 });
+		}
+		if (rest === "/pulls" && request.method === "POST") {
+			if (user.bot && user.permissions?.pull_requests !== "write") return json({ message: "Resource not accessible by integration" }, 403);
+			const body = await request.json();
+			if (!repo.branches.has(body.head) || !repo.branches.has(body.base)) return json({ message: "Validation Failed" }, 422);
+			if (repo.reviews.some((review) => review.branch === body.head && review.state === "open")) return json({ message: "A pull request already exists" }, 422);
+			const review = repo.openReview(body.head, body.title, body.body ?? "", body.base);
+			return json({
+				number: review.number,
+				html_url: `https://github.com/${options.repo}/pull/${review.number}`
+			}, 201);
+		}
+		if (rest === "/pulls" && request.method === "GET") {
+			const head = url.searchParams.get("head")?.split(":")[1];
+			return json(repo.reviews.filter((review) => review.state === "open" && (!head || review.branch === head)).map((review) => ({
+				number: review.number,
+				html_url: `https://github.com/${options.repo}/pull/${review.number}`
+			})));
+		}
 		if (rest === "/pages" && request.method === "GET") {
 			const site = pages.current;
 			if (!site) return json({ message: "Not Found" }, 404);
@@ -358,6 +844,7 @@ function fakeGitHub(options) {
 			return new Response(null, { status: 204 });
 		}
 		if (rest === "") return json({
+			id: 1,
 			full_name: options.repo,
 			default_branch: repo.defaultBranch,
 			permissions: {
@@ -384,7 +871,8 @@ function fakeGitHub(options) {
 				tree: [...repo.files(commitSha)].map(([file, content]) => ({
 					path: file,
 					type: "blob",
-					sha: repo.blobSha(content)
+					sha: repo.blobSha(content),
+					size: fakeFileBytes(content).length
 				})),
 				truncated: false
 			});
@@ -416,7 +904,10 @@ function fakeGitHub(options) {
 				author: null
 			})));
 		}
-		if (rest === "/actions/workflows/deploy.yml/dispatches" && request.method === "POST") {
+		const workflowFile = rest.match(/^\/actions\/workflows\/([\w.-]+)\/(?:dispatches|runs)$/)?.[1];
+		const workflowPath = `.github/workflows/${workflowFile}`;
+		const ofWorkflow = (run) => (run.path ?? ".github/workflows/deploy.yml") === workflowPath;
+		if (workflowFile && rest.endsWith("/dispatches") && request.method === "POST") {
 			if (!(user.actionsWrite ?? user.administration)) return json({ message: "Resource not accessible by personal access token" }, 403);
 			const body = await request.json();
 			runs.push({
@@ -426,15 +917,17 @@ function fakeGitHub(options) {
 				inputs: body.inputs,
 				status: "queued",
 				conclusion: null,
+				path: workflowPath,
 				jobs: []
 			});
 			return new Response(null, { status: 204 });
 		}
-		if (rest === "/actions/workflows/deploy.yml/runs") {
+		if (workflowFile && rest.endsWith("/runs")) {
 			if (user.actions === false) return json({ message: "Resource not accessible by personal access token" }, 403);
+			const found = runs.filter(ofWorkflow);
 			return json({
-				total_count: runs.length,
-				workflow_runs: [...runs].reverse().map((run) => ({
+				total_count: found.length,
+				workflow_runs: [...found].reverse().map((run) => ({
 					id: run.id,
 					event: run.event ?? "push",
 					head_sha: run.sha,
@@ -458,8 +951,8 @@ function fakeGitHub(options) {
 						head_sha: run.sha,
 						status: run.status,
 						conclusion: run.conclusion,
-						name: "Deploy to GitHub Pages",
-						path: ".github/workflows/deploy.yml",
+						name: run.path ? "Rebuild on Vercel" : "Deploy to GitHub Pages",
+						path: run.path ?? ".github/workflows/deploy.yml",
 						html_url: htmlUrl(run)
 					}))
 				});
@@ -471,8 +964,18 @@ function fakeGitHub(options) {
 				jobs: run.jobs
 			}) : json({ message: "Not Found" }, 404);
 		}
-		const compare = rest.match(/^\/compare\/([0-9a-f]{40})\.\.\.([0-9a-f]{40})$/);
-		if (compare) return json({ files: repo.changedPaths(compare[1] ?? "", compare[2] ?? "").map((filename) => ({ filename })) });
+		const compare = rest.match(/^\/compare\/(.+)\.\.\.(.+)$/);
+		if (compare) {
+			const [from, to] = [compare[1], compare[2]].map((ref) => decodeURIComponent(ref ?? ""));
+			const resolve = (ref) => repo.branches.get(ref) ?? (repo.commitAt(ref) ? ref : void 0);
+			const [a, b] = [resolve(from ?? ""), resolve(to ?? "")];
+			if (!a || !b) return json({ message: "Not Found" }, 404);
+			const base = repo.mergeBase(a, b) ?? a;
+			return json({
+				merge_base_commit: { sha: base },
+				files: repo.changedPaths(base, b).map((filename) => ({ filename }))
+			});
+		}
 		if (rest === "/deployments") {
 			const sha = url.searchParams.get("sha");
 			return json(deployments.filter((deployment) => !sha || deployment.sha === sha).slice(0, Number(url.searchParams.get("per_page") ?? 30)).map(({ id, sha }) => ({
@@ -495,8 +998,19 @@ function fakeGitHub(options) {
 	}
 	return {
 		repo,
-		/** Repositories created through the API, by `owner/name`. */
+		/** How many GraphQL requests read files, as `readFiles()` makes. */
+		get graphqlReads() {
+			return graphqlReads;
+		},
+		/** Tokens apps' sign-ins made, in order. */
+		issued,
+		/** Who commits made through the REST API name as their author, by commit. */
+		commitAuthors,
+		authorize,
+		install,
+		/** Repositories created through the API, or added with `addRepo()`, by `owner/name`. */
 		created,
+		addRepo,
 		/** The site's GitHub Pages settings, which tests can change, such as to issue the certificate. */
 		pages,
 		/** The repository's collaborators, by login, and invitations waiting to be accepted. */