@pepys/source-github 0.4.1 → 0.4.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pepys/source-github",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "The pepys GitHub plug-in: pull requests, releases, commits and deploys",
   "license": "MIT",
   "repository": {
@@ -19,9 +19,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@pepys/api": "0.4.1",
-    "@pepys/ingest": "0.4.1",
-    "@pepys/kit": "0.4.1",
+    "@pepys/api": "0.4.3",
+    "@pepys/ingest": "0.4.3",
+    "@pepys/kit": "0.4.3",
     "@zgeoff/std": "0.4.3",
     "kysely": "0.29.8",
     "ts-pattern": "5.9.2",
@@ -31,7 +31,7 @@
     "@msw/data": "1.1.8",
     "@orpc/client": "2.0.0-beta.50",
     "@pepys/mock-network": "0.0.0",
-    "@pepys/testing": "0.4.1",
+    "@pepys/testing": "0.4.3",
     "msw": "3.0.3",
     "tiny-invariant": "1.3.3"
   }

package/src/ingest/github-app/find-app-jwt-signer.ts

@@ -0,0 +1,20 @@
+import { buildAppJWT } from './build-app-jwt.ts';
+
+// The function that signs the App's JWT, or undefined when the key cannot sign. GitHub refuses a JWT
+// ten minutes after its `iat`, and a pull can run for longer, so each call takes a JWT of its own.
+export function findAppJWTSigner(
+  env: Readonly<Record<string, string>>,
+  now: () => number,
+): (() => string) | undefined {
+  const appID = env['PEPYS_GITHUB_APP_ID'] ?? '';
+  const privateKey = env['PEPYS_GITHUB_APP_PRIVATE_KEY'] ?? '';
+
+  try {
+    // a JWT of time 0 shows that the key signs, and reads no clock
+    buildAppJWT(appID, privateKey, 0);
+  } catch {
+    return undefined;
+  }
+
+  return () => buildAppJWT(appID, privateKey, now());
+}

package/src/ingest/github-app/read-installation-token.ts

@@ -11,13 +11,17 @@ export type InstallationToken =
 const installationSchema = z.looseObject({ id: z.number().int() });
 const accessTokenSchema = z.looseObject({ token: z.string().min(1) });
 
-// The token of the App's installation on one repository, `owner/name`, from the App's JWT.
+// The token of the App's installation on one repository, `owner/name`. Each call signs its own JWT.
 export async function readInstallationToken(
   repository: string,
-  appJWT: string,
+  signAppJWT: () => string,
   call: GithubCall,
 ): Promise<InstallationToken> {
-  const installation = await requestGithubAPI(`/repos/${repository}/installation`, appJWT, call);
+  const installation = await requestGithubAPI(
+    `/repos/${repository}/installation`,
+    signAppJWT(),
+    call,
+  );
 
   if (installation.status === 404) {
     return { kind: 'not-installed' };
@@ -31,7 +35,7 @@ export async function readInstallationToken(
 
   const created = await requestGithubAPI(
     `/app/installations/${parsedInstallation.data.id}/access_tokens`,
-    appJWT,
+    signAppJWT(),
     call,
     'POST',
   );

package/src/ingest/recovery/pull-failed-deliveries.ts

@@ -2,7 +2,7 @@ import { planAppends } from '@pepys/ingest';
 import type { PendingFact, PullContext, Pulled } from '@pepys/kit';
 import { z } from 'zod';
 import { buildGithubFact } from '../build-github-fact.ts';
-import { findAppJWT } from '../github-app/find-app-jwt.ts';
+import { findAppJWTSigner } from '../github-app/find-app-jwt-signer.ts';
 import { pickPullFailure } from '../github-app/pick-pull-failure.ts';
 import { requestGithubAPI } from '../github-app/request-github-api.ts';
 import type { GithubAnswer, GithubCall } from '../github-app/request-github-api.ts';
@@ -19,15 +19,15 @@ export async function pullFailedDeliveries(
   cursor: string | null,
   context: PullContext,
 ): Promise<Pulled> {
-  const appJWT = findAppJWT(context.env, context.now());
+  const signAppJWT = findAppJWTSigner(context.env, context.now);
 
-  if (appJWT === undefined) {
+  if (signAppJWT === undefined) {
     return { kind: 'rejected', reason: 'the GitHub App private key cannot sign a token' };
   }
 
   const seenID = cursor === null ? 0n : BigInt(cursor);
 
-  const listed = await readDeliveriesAfter(seenID, appJWT, context);
+  const listed = await readDeliveriesAfter(seenID, signAppJWT, context);
 
   if (listed.kind !== 'listed') {
     return pickPullFailure(listed.status);
@@ -36,7 +36,7 @@ export async function pullFailedDeliveries(
   const facts: PendingFact[] = [];
 
   for (const id of collectFailedIDs(listed.items)) {
-    const answer = await requestGithubAPI(`/app/hook/deliveries/${id}`, appJWT, context);
+    const answer = await requestGithubAPI(`/app/hook/deliveries/${id}`, signAppJWT(), context);
 
     const detail = deliveryDetailSchema.safeParse(answer.body);
 
@@ -89,14 +89,14 @@ type DeliveryList = { kind: 'listed'; items: DeliveryItem[] } | { kind: 'failed'
 // GitHub lists the newest delivery first, so the pages stop at the first one already seen.
 async function readDeliveriesAfter(
   seenID: bigint,
-  appJWT: string,
+  signAppJWT: () => string,
   call: GithubCall,
 ): Promise<DeliveryList> {
   const items: DeliveryItem[] = [];
   let url: string | undefined = '/app/hook/deliveries?per_page=100';
 
   while (url !== undefined) {
-    const answer: GithubAnswer = await requestGithubAPI(url, appJWT, call);
+    const answer: GithubAnswer = await requestGithubAPI(url, signAppJWT(), call);
 
     const page = deliveryListSchema.safeParse(parseDeliveryList(answer.text));
 

package/src/ingest/resync/pull-marked-objects.ts

@@ -2,7 +2,7 @@ import type { PendingFact, PullContext, Pulled } from '@pepys/kit';
 import { z } from 'zod';
 import { buildGithubFact } from '../build-github-fact.ts';
 import type { GithubFactOrigin } from '../build-github-fact.ts';
-import { findAppJWT } from '../github-app/find-app-jwt.ts';
+import { findAppJWTSigner } from '../github-app/find-app-jwt-signer.ts';
 import { pickPullFailure } from '../github-app/pick-pull-failure.ts';
 import { readInstallationToken } from '../github-app/read-installation-token.ts';
 import type { InstallationToken } from '../github-app/read-installation-token.ts';
@@ -24,9 +24,9 @@ export async function pullMarkedObjects(
     return { kind: 'batch', batch: { facts: [] }, cursor: 'resynced', isDone: true };
   }
 
-  const appJWT = findAppJWT(context.env, context.now());
+  const signAppJWT = findAppJWTSigner(context.env, context.now);
 
-  if (appJWT === undefined) {
+  if (signAppJWT === undefined) {
     return { kind: 'rejected', reason: 'the GitHub App private key cannot sign a token' };
   }
 
@@ -35,7 +35,7 @@ export async function pullMarkedObjects(
   const facts: PendingFact[] = [];
 
   for (const target of targets) {
-    const token = await readCachedToken(tokens, target.repository, appJWT, context);
+    const token = await readCachedToken(tokens, target.repository, signAppJWT, context);
 
     if (token.kind === 'failed') {
       return pickPullFailure(token.status);
@@ -63,7 +63,7 @@ export async function pullMarkedObjects(
 async function readCachedToken(
   tokens: Map<string, InstallationToken>,
   repository: string,
-  appJWT: string,
+  signAppJWT: () => string,
   call: GithubCall,
 ): Promise<InstallationToken> {
   const known = tokens.get(repository);
@@ -72,7 +72,7 @@ async function readCachedToken(
     return known;
   }
 
-  const token = await readInstallationToken(repository, appJWT, call);
+  const token = await readInstallationToken(repository, signAppJWT, call);
 
   tokens.set(repository, token);
 

package/src/ingest/github-app/find-app-jwt.ts

@@ -1,16 +0,0 @@
-import { buildAppJWT } from './build-app-jwt.ts';
-
-export function findAppJWT(
-  env: Readonly<Record<string, string>>,
-  nowMs: number,
-): string | undefined {
-  try {
-    return buildAppJWT(
-      env['PEPYS_GITHUB_APP_ID'] ?? '',
-      env['PEPYS_GITHUB_APP_PRIVATE_KEY'] ?? '',
-      nowMs,
-    );
-  } catch {
-    return undefined;
-  }
-}