@realiizlabs/admin 0.16.0 → 0.17.0

package/dist/studio/index.d.cts

@@ -1,7 +1,7 @@
 import { c as ImagePayload } from '../validate-C84Ll1cD.cjs';
 export { I as IMAGE_ERRORS, a as IMAGE_LIMITS, b as ImageLimits, V as ValidatedImages, d as decodedSize, v as validateImages } from '../validate-C84Ll1cD.cjs';
 import { a as IdentityUser, f as SiteRole, C as CookieStore, d as SiteMember, I as IdentityClient, c as SiteBranding } from '../members-nhbRSYyr.cjs';
-import { a as PullRequestStatus } from '../types-BP5G1myE.cjs';
+import { a as PullRequestStatus } from '../types-Cy9UDz--.cjs';
 import { C as ContentTypeEntry } from '../types-DeHdasdP.cjs';
 import * as zod from 'zod';
 import * as zod_v4_core from 'zod/v4/core';
@@ -15,10 +15,15 @@ import '@supabase/supabase-js';
  * arrives here, lazily, so `next build` with no env set still succeeds.
  */
 
+/** The site's repo and how Studio reaches it — the GitHub App (preferred) or a personal access token. */
 interface RepoConfig {
     owner: string;
     repo: string;
-    token: string;
+    app?: {
+        appId: string;
+        privateKey: string;
+    } | null;
+    token?: string | null;
 }
 interface IdentityConfig {
     url: string;

package/dist/studio/index.d.ts

@@ -1,7 +1,7 @@
 import { c as ImagePayload } from '../validate-C84Ll1cD.js';
 export { I as IMAGE_ERRORS, a as IMAGE_LIMITS, b as ImageLimits, V as ValidatedImages, d as decodedSize, v as validateImages } from '../validate-C84Ll1cD.js';
 import { a as IdentityUser, f as SiteRole, C as CookieStore, d as SiteMember, I as IdentityClient, c as SiteBranding } from '../members-nhbRSYyr.js';
-import { a as PullRequestStatus } from '../types-BP5G1myE.js';
+import { a as PullRequestStatus } from '../types-Cy9UDz--.js';
 import { C as ContentTypeEntry } from '../types-DeHdasdP.js';
 import * as zod from 'zod';
 import * as zod_v4_core from 'zod/v4/core';
@@ -15,10 +15,15 @@ import '@supabase/supabase-js';
  * arrives here, lazily, so `next build` with no env set still succeeds.
  */
 
+/** The site's repo and how Studio reaches it — the GitHub App (preferred) or a personal access token. */
 interface RepoConfig {
     owner: string;
     repo: string;
-    token: string;
+    app?: {
+        appId: string;
+        privateKey: string;
+    } | null;
+    token?: string | null;
 }
 interface IdentityConfig {
     url: string;

package/dist/studio/index.js

@@ -1,6 +1,7 @@
 import 'server-only';
 import { redirect } from 'next/navigation';
 import { createServerClient } from '@supabase/ssr';
+import { createSign } from 'crypto';
 import matter from 'gray-matter';
 import { unified } from 'unified';
 import remarkParse from 'remark-parse';
@@ -171,15 +172,15 @@ var ChecksFailedError = class extends Error {
   }
 };
 
-// src/git/client.ts
-var API = "https://api.github.com";
+// src/git/http.ts
+var GITHUB_API = "https://api.github.com";
 var GITHUB_TIMEOUT_MS = 1e4;
-async function ghFetch(ctx, method, path, body) {
-  const res = await fetch(API + path, {
+async function githubRequest(method, path, authorization, body, fetchImpl = fetch) {
+  const res = await fetchImpl(GITHUB_API + path, {
     method,
     signal: AbortSignal.timeout(GITHUB_TIMEOUT_MS),
     headers: {
-      Authorization: `Bearer ${ctx.token}`,
+      Authorization: authorization,
       Accept: "application/vnd.github+json",
       "X-GitHub-Api-Version": "2022-11-28",
       "User-Agent": "realiizlabs-admin",
@@ -198,6 +199,65 @@ async function ghFetch(ctx, method, path, body) {
   }
   return { ok: res.ok, status: res.status, json };
 }
+
+// src/git/app-auth.ts
+var JWT_TTL_S = 9 * 60;
+var REFRESH_BEFORE_MS = 5 * 6e4;
+var cache = /* @__PURE__ */ new Map();
+function b64url(input) {
+  return Buffer.from(input).toString("base64").replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function appJwt(creds, now = Math.floor(Date.now() / 1e3)) {
+  const header = b64url(JSON.stringify({ alg: "RS256", typ: "JWT" }));
+  const payload = b64url(JSON.stringify({ iat: now - 60, exp: now + JWT_TTL_S, iss: creds.appId }));
+  const signer = createSign("RSA-SHA256");
+  signer.update(`${header}.${payload}`);
+  const signature = signer.sign(creds.privateKey.replace(/\\n/g, "\n"));
+  return `${header}.${payload}.${b64url(signature)}`;
+}
+function forgetInstallationToken(creds, owner, repo) {
+  cache.delete(`${creds.appId}:${owner}/${repo}`);
+}
+async function installationToken(creds, owner, repo, fetchImpl = fetch) {
+  const key = `${creds.appId}:${owner}/${repo}`;
+  const hit = cache.get(key);
+  if (hit && hit.expiresAt - Date.now() > REFRESH_BEFORE_MS) return hit.token;
+  const bearer = `Bearer ${appJwt(creds)}`;
+  const repoPath2 = `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`;
+  const found = await githubRequest("GET", `${repoPath2}/installation`, bearer, void 0, fetchImpl);
+  if (found.status === 404) {
+    throw new GitHubError(
+      `The Realiiz Studio GitHub App isn't installed on ${owner}/${repo}. The repository's owner installs it once \u2014 ask your web team for the link.`,
+      { status: 404, path: `${repoPath2}/installation`, body: found.json }
+    );
+  }
+  if (!found.ok) throw new GitHubError(`GitHub ${found.status} looking up the app installation`, { status: found.status, path: `${repoPath2}/installation`, body: found.json });
+  const minted = await githubRequest(
+    "POST",
+    `/app/installations/${found.json.id}/access_tokens`,
+    bearer,
+    void 0,
+    fetchImpl
+  );
+  if (!minted.ok) throw new GitHubError(`GitHub ${minted.status} minting an installation token`, { status: minted.status, path: "/app/installations/\u2026/access_tokens", body: minted.json });
+  cache.set(key, { token: minted.json.token, expiresAt: Date.parse(minted.json.expires_at) });
+  return minted.json.token;
+}
+
+// src/git/client.ts
+async function credentialFor(ctx) {
+  if (ctx.app) return installationToken(ctx.app, ctx.owner, ctx.repo);
+  if (ctx.token) return ctx.token;
+  throw new GitHubError(`No GitHub credential for ${ctx.owner}/${ctx.repo}: set GITHUB_APP_ID + GITHUB_APP_PRIVATE_KEY, or GITHUB_CONTENT_TOKEN.`, { status: 0, path: "", body: null });
+}
+async function ghFetch(ctx, method, path, body) {
+  const res = await githubRequest(method, path, `Bearer ${await credentialFor(ctx)}`, body);
+  if (res.status === 401 && ctx.app) {
+    forgetInstallationToken(ctx.app, ctx.owner, ctx.repo);
+    return githubRequest(method, path, `Bearer ${await credentialFor(ctx)}`, body);
+  }
+  return res;
+}
 async function ghFetchOrThrow(ctx, method, path, body) {
   const res = await ghFetch(ctx, method, path, body);
   if (!res.ok) throw toError(res, path);
@@ -1111,7 +1171,7 @@ function makeHandlers(ctx) {
 }
 
 // src/version.ts
-var ADMIN_VERSION = "0.16.0" ;
+var ADMIN_VERSION = "0.17.0" ;
 
 // src/studio/update.ts
 var PACKAGE_NAME = "@realiizlabs/admin";