@mastra/factory 0.1.0-alpha.6 → 0.1.0-alpha.7

package/dist/integrations/github/integration.js

@@ -130,6 +130,48 @@ function getGithubFeatureDiagnostics(options) {
   };
 }
 
+// src/integrations/github/pat.ts
+var PAT_SETTINGS_USER_ID = "__github_org_settings__";
+var FIELD_FOR_KIND = {
+  default: "pat",
+  reviewer: "reviewerPat"
+};
+function asToken(value) {
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+async function getGithubPat(getStorage, orgId, kind = "default") {
+  try {
+    const settings = await getStorage().settings.get(orgId, PAT_SETTINGS_USER_ID);
+    if (!settings) return null;
+    if (kind === "reviewer") return asToken(settings.reviewerPat) ?? asToken(settings.pat);
+    return asToken(settings.pat);
+  } catch {
+    return null;
+  }
+}
+async function getGithubPatStatus(getStorage, orgId) {
+  try {
+    const settings = await getStorage().settings.get(orgId, PAT_SETTINGS_USER_ID);
+    return {
+      configured: asToken(settings?.pat) !== null,
+      reviewerConfigured: asToken(settings?.reviewerPat) !== null
+    };
+  } catch {
+    return { configured: false, reviewerConfigured: false };
+  }
+}
+async function setGithubPat(storage, orgId, pat, kind = "default") {
+  const existing = await storage.settings.get(orgId, PAT_SETTINGS_USER_ID) ?? {};
+  await storage.settings.save(orgId, PAT_SETTINGS_USER_ID, { ...existing, [FIELD_FOR_KIND[kind]]: pat });
+}
+async function clearGithubPat(storage, orgId, kind = "default") {
+  const existing = await storage.settings.get(orgId, PAT_SETTINGS_USER_ID);
+  const field = FIELD_FOR_KIND[kind];
+  if (!existing?.[field]) return;
+  const { [field]: _removed, ...rest } = existing;
+  await storage.settings.save(orgId, PAT_SETTINGS_USER_ID, rest);
+}
+
 // src/integrations/github/project-lock.ts
 import { createHash } from "crypto";
 var inProcessLocks = /* @__PURE__ */ new Map();
@@ -1439,6 +1481,56 @@ function buildGithubRoutes(options) {
       }
     })
   );
+  const parsePatKind = (value) => {
+    if (value === void 0 || value === null || value === "default") return "default";
+    if (value === "reviewer") return "reviewer";
+    return null;
+  };
+  routes.push(
+    registerApiRoute("/web/github/pat", {
+      method: "GET",
+      requiresAuth: false,
+      handler: async (c) => {
+        const resolved = await resolveOrgTenant(loose(c), auth);
+        if ("response" in resolved) return resolved.response;
+        return c.json(await getGithubPatStatus(() => github.integrationStorage, resolved.tenant.orgId));
+      }
+    }),
+    registerApiRoute("/web/github/pat", {
+      method: "POST",
+      requiresAuth: false,
+      handler: async (c) => {
+        const resolved = await resolveOrgTenant(loose(c), auth);
+        if ("response" in resolved) return resolved.response;
+        let body;
+        try {
+          body = await c.req.json();
+        } catch {
+          return c.json({ error: "Invalid JSON body" }, 400);
+        }
+        const kind = parsePatKind(body.kind);
+        if (!kind) return c.json({ error: "kind must be 'default' or 'reviewer'" }, 400);
+        const token = typeof body.token === "string" ? body.token.trim() : "";
+        if (!token) return c.json({ error: "A token is required" }, 400);
+        if (token.length > 500) return c.json({ error: "Token too long (max 500 characters)" }, 400);
+        if (/\s/.test(token)) return c.json({ error: "Token must not contain whitespace" }, 400);
+        await setGithubPat(github.integrationStorage, resolved.tenant.orgId, token, kind);
+        return c.json(await getGithubPatStatus(() => github.integrationStorage, resolved.tenant.orgId));
+      }
+    }),
+    registerApiRoute("/web/github/pat", {
+      method: "DELETE",
+      requiresAuth: false,
+      handler: async (c) => {
+        const resolved = await resolveOrgTenant(loose(c), auth);
+        if ("response" in resolved) return resolved.response;
+        const kind = parsePatKind(c.req.query("kind"));
+        if (!kind) return c.json({ error: "kind must be 'default' or 'reviewer'" }, 400);
+        await clearGithubPat(github.integrationStorage, resolved.tenant.orgId, kind);
+        return c.json(await getGithubPatStatus(() => github.integrationStorage, resolved.tenant.orgId));
+      }
+    })
+  );
   routes.push(...buildProjectGitRoutes({ github, auth, fleet, storage, emitAudit }));
   return routes;
 }
@@ -1481,11 +1573,12 @@ async function prepareProject(options) {
   if (!access.authorization) {
     throw new MaterializeError("Repository access did not include a bearer token.", "clone-failed");
   }
+  const ghCliToken = await getGithubPat(() => github.integrationStorage, project.installation.orgId) ?? access.authorization.token;
   const sandbox = await ensureProjectSandbox({
     fleet,
     row: sandboxRow,
     storage: github.sourceControlStorage.sandboxes,
-    token: access.authorization.token,
+    token: ghCliToken,
     onProgress
   });
   const fresh = await github.sourceControlStorage.sandboxes.getById({ id: sandboxRow.id });
@@ -1923,6 +2016,11 @@ import { z } from "zod";
 
 // src/integrations/github/token-refresh.ts
 var GITHUB_TOKEN_INJECTOR_CONTEXT_KEY = "factoryGithubTokenInjector";
+var GITHUB_PAT_KIND_CONTEXT_KEY = "factoryGithubPatKind";
+function getRegisteredGithubPatKind(requestContext) {
+  const kind = requestContext.get(GITHUB_PAT_KIND_CONTEXT_KEY);
+  return kind === "reviewer" ? "reviewer" : "default";
+}
 function injectGithubToken(requestContext, token) {
   const injector = requestContext.get(GITHUB_TOKEN_INJECTOR_CONTEXT_KEY);
   if (!injector) {
@@ -2020,6 +2118,15 @@ async function unsubscribeCurrentSessionFromPullRequest(requestContext, pullRequ
 }
 async function refreshGithubToken(requestContext, github) {
   const target = await resolveSessionTarget(requestContext, github);
+  const pat = await getGithubPat(
+    () => github.integrationStorage,
+    target.orgId,
+    getRegisteredGithubPatKind(requestContext)
+  );
+  if (pat) {
+    injectGithubToken(requestContext, pat);
+    return;
+  }
   const access = await github.versionControl.getRepositoryAccess({
     orgId: target.orgId,
     repositoryId: target.repository.id