@ripla/godd-mcp 1.0.4-canary.8 → 1.0.4

package/{notes-api → notes/api}/.env.example

@@ -1,6 +1,11 @@
-# GitHub API token (omitted for mock mode)
+# GitHub API token (PAT — omitted for mock mode; superseded by GitHub App below)
 # GITHUB_TOKEN=
 
+# GitHub App credentials (recommended over PAT for bot authorship of PRs/Issues)
+# GITHUB_APP_ID=
+# GITHUB_APP_PRIVATE_KEY=-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----
+# GITHUB_APP_INSTALLATION_ID=
+
 # Repository settings
 GITHUB_OWNER=ripla
 GITHUB_REPO=GoDD

package/{notes-api → notes/api}/README.md

@@ -39,10 +39,10 @@ uv run python -m app.main
 
 | 変数 | 必須 | デフォルト | 説明 |
 |------|------|-----------|------|
-| GITHUB_TOKEN | - | (未設定=Mock) | GitHub API PAT（GitHub App 未設定時のフォールバック） |
-| GITHUB_APP_ID | - | - | GitHub App ID。`GITHUB_APP_PRIVATE_KEY` / `GITHUB_APP_INSTALLATION_ID` と揃う場合は App token を優先 |
-| GITHUB_APP_PRIVATE_KEY | - | - | GitHub App private key PEM |
-| GITHUB_APP_INSTALLATION_ID | - | - | GitHub App installation ID |
+| GITHUB_TOKEN | - | (未設定=Mock) | GitHub API PAT（任意。GitHub App 未設定時の write 操作フォールバック） |
+| GITHUB_APP_ID | **Yes** (write) | - | GitHub App ID。PR / Issue 作成時の Bot author に必須 |
+| GITHUB_APP_PRIVATE_KEY | **Yes** (write) | - | GitHub App private key PEM |
+| GITHUB_APP_INSTALLATION_ID | **Yes** (write) | - | GitHub App installation ID |
 | GITHUB_OWNER | - | ripla-inc | リポジトリオーナー |
 | GITHUB_REPO | - | GoDD | リポジトリ名 |
 | GITHUB_BRANCH | - | main | ベースブランチ |
@@ -54,7 +54,8 @@ uv run python -m app.main
 
 ## API
 
-- `GET /api/health` - ヘルスチェック
+- `GET /api/health` - ヘルスチェック（`github_app_configured`, `github_write_author`）
+- `GET /api/health/github-app` - GitHub App installation token refresh 検証（運用 #829）
 - `POST /api/auth/login` - ログイン
 - `GET /api/tree` - ファイルツリー
 - `GET /api/files/{path}` - ファイル内容取得

package/{notes-api → notes/api}/app/main.py

@@ -3,7 +3,7 @@
 from collections.abc import AsyncIterator
 from contextlib import asynccontextmanager
 
-from fastapi import FastAPI, Request, Response
+from fastapi import FastAPI, HTTPException, Request, Response
 from fastapi.middleware.cors import CORSMiddleware
 from starlette.middleware.base import BaseHTTPMiddleware
 
@@ -11,6 +11,11 @@ from app.config import settings
 from app.http_client import close_github_client
 from app.routers import auth, collab, comments, files, issues, pr, tree, upload, users
 from app.routers import settings as settings_router
+from app.services.github_app_token import (
+    get_installation_token,
+    github_write_author_mode,
+    is_app_configured,
+)
 from app.startup import ensure_tables_and_seed
 
 
@@ -70,7 +75,29 @@ app.include_router(comments.router)
 @app.get("/api/health")
 async def health_check():
     """Health check endpoint."""
-    return {"status": "ok"}
+    return {
+        "status": "ok",
+        "github_app_configured": is_app_configured(),
+        "github_write_author": github_write_author_mode(),
+    }
+
+
+@app.get("/api/health/github-app")
+async def github_app_health_check():
+    """Verify GitHub App credentials by refreshing an installation token (#829 ops)."""
+    if not is_app_configured():
+        raise HTTPException(
+            status_code=503,
+            detail="GitHub App credentials are not fully configured",
+        )
+    try:
+        await get_installation_token()
+    except Exception as exc:
+        raise HTTPException(
+            status_code=503,
+            detail=f"GitHub App installation token refresh failed: {exc}",
+        ) from exc
+    return {"status": "ok", "github_write_author": "bot", "token_refresh": "success"}
 
 
 if __name__ == "__main__":

package/{notes-api → notes/api}/app/routers/auth.py

@@ -11,7 +11,12 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from app.config import settings
 from app.database import get_db
 from app.models import NotesSetting, NotesUser
-from app.schemas.auth import ChangePasswordRequest, LoginRequest, TokenResponse, UserInfo
+from app.schemas.auth import (
+    ChangePasswordRequest,
+    LoginRequest,
+    TokenResponse,
+    UserInfo,
+)
 from app.security import (
     auth_dependency,
     create_access_token,

package/{notes-api → notes/api}/app/routers/issues.py

@@ -13,11 +13,15 @@ from app.security import auth_dependency, require_role
 from app.services.github import get_github_config
 from app.services.github_issues import (
     create_issue,
+    create_issue_comment,
     create_label,
+    delete_label,
     get_issue,
+    list_issue_comments,
     list_issue_labels,
     list_issues,
     update_issue,
+    update_label,
 )
 
 logger = logging.getLogger(__name__)
@@ -29,6 +33,7 @@ MAX_BODY_LENGTH = 65_536
 MAX_LABEL_NAME_LENGTH = 50
 MAX_LABEL_DESCRIPTION_LENGTH = 200
 _HEX_COLOR_RE = r"^[0-9a-fA-F]{6}$"
+_GITHUB_LOGIN_RE = r"^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$"
 
 
 class LabelCreateBody(BaseModel):
@@ -39,6 +44,14 @@ class LabelCreateBody(BaseModel):
     description: str = Field(default="", max_length=MAX_LABEL_DESCRIPTION_LENGTH)
 
 
+class LabelUpdateBody(BaseModel):
+    """Label update request (at least one field required)."""
+
+    new_name: str | None = Field(None, min_length=1, max_length=MAX_LABEL_NAME_LENGTH)
+    color: str | None = Field(None, pattern=_HEX_COLOR_RE)
+    description: str | None = Field(None, max_length=MAX_LABEL_DESCRIPTION_LENGTH)
+
+
 class IssueCreateBody(BaseModel):
     """Issue creation request."""
 
@@ -56,10 +69,17 @@ class IssueUpdateBody(BaseModel):
     labels: list[str] | None = None
 
 
+class IssueCommentCreateBody(BaseModel):
+    """Issue comment creation request."""
+
+    body: str = Field(..., min_length=1, max_length=MAX_BODY_LENGTH)
+
+
 @router.get("")
 async def list_issues_endpoint(
     state: str = Query("open", pattern=r"^(open|closed|all)$"),
     labels: str | None = Query(None),
+    assignee: str | None = Query(None, pattern=rf"^(none|{_GITHUB_LOGIN_RE[1:-1]})$"),
     page: int = Query(1, ge=1),
     per_page: int = Query(30, ge=1, le=100),
     _payload: dict = Depends(auth_dependency),
@@ -70,7 +90,12 @@ async def list_issues_endpoint(
     try:
         config = get_github_config()
         items = await list_issues(
-            config, state=state, labels=labels, per_page=per_page, page=page,
+            config,
+            state=state,
+            labels=labels,
+            assignee=assignee,
+            per_page=per_page,
+            page=page,
         )
         return {"issues": items}
     except httpx.HTTPStatusError as e:
@@ -141,6 +166,75 @@ async def create_label_endpoint(
         raise HTTPException(status_code=500, detail="Internal server error") from None
 
 
+@router.patch("/labels/{name}")
+async def update_label_endpoint(
+    name: str,
+    body: LabelUpdateBody,
+    _payload: dict = Depends(auth_dependency),
+    __: dict = Depends(require_role("admin", "editor")),
+):
+    """Update an existing repository label."""
+    if not any(
+        field is not None for field in (body.new_name, body.color, body.description)
+    ):
+        raise HTTPException(status_code=422, detail="At least one field must be provided")
+    if settings.is_mock_mode():
+        raise HTTPException(status_code=400, detail="Mock mode: label update disabled")
+    try:
+        config = get_github_config()
+        return await update_label(
+            config,
+            name,
+            new_name=body.new_name,
+            color=body.color,
+            description=body.description,
+        )
+    except ValueError as e:
+        raise HTTPException(status_code=422, detail=str(e)) from None
+    except httpx.HTTPStatusError as e:
+        if e.response.status_code == 404:
+            raise HTTPException(status_code=404, detail="Label not found") from None
+        if e.response.status_code in (401, 403):
+            raise HTTPException(
+                status_code=e.response.status_code,
+                detail="GitHub token is invalid or expired",
+            ) from None
+        if e.response.status_code == 422:
+            raise HTTPException(
+                status_code=422, detail="Label name already exists or invalid data",
+            ) from None
+        raise HTTPException(status_code=502, detail="GitHub API error") from e
+    except Exception:
+        logger.exception("Failed to update label %s", name)
+        raise HTTPException(status_code=500, detail="Internal server error") from None
+
+
+@router.delete("/labels/{name}", status_code=204)
+async def delete_label_endpoint(
+    name: str,
+    _payload: dict = Depends(auth_dependency),
+    __: dict = Depends(require_role("admin", "editor")),
+):
+    """Delete a repository label."""
+    if settings.is_mock_mode():
+        raise HTTPException(status_code=400, detail="Mock mode: label deletion disabled")
+    try:
+        config = get_github_config()
+        await delete_label(config, name)
+    except httpx.HTTPStatusError as e:
+        if e.response.status_code == 404:
+            raise HTTPException(status_code=404, detail="Label not found") from None
+        if e.response.status_code in (401, 403):
+            raise HTTPException(
+                status_code=e.response.status_code,
+                detail="GitHub token is invalid or expired",
+            ) from None
+        raise HTTPException(status_code=502, detail="GitHub API error") from e
+    except Exception:
+        logger.exception("Failed to delete label %s", name)
+        raise HTTPException(status_code=500, detail="Internal server error") from None
+
+
 @router.get("/{number}")
 async def get_issue_endpoint(
     number: int,
@@ -233,3 +327,65 @@ async def update_issue_endpoint(
     except Exception:
         logger.exception("Failed to update issue #%d", number)
         raise HTTPException(status_code=500, detail="Internal server error") from None
+
+
+@router.get("/{number}/comments")
+async def list_issue_comments_endpoint(
+    number: int,
+    _payload: dict = Depends(auth_dependency),
+):
+    """List comments on an issue (chronological)."""
+    if settings.is_mock_mode():
+        return {"comments": []}
+    try:
+        config = get_github_config()
+        comments = await list_issue_comments(config, number)
+        return {"comments": comments}
+    except ValueError as e:
+        raise HTTPException(status_code=404, detail=str(e)) from None
+    except httpx.HTTPStatusError as e:
+        if e.response.status_code == 404:
+            raise HTTPException(status_code=404, detail="Issue not found") from None
+        if e.response.status_code in (401, 403):
+            raise HTTPException(
+                status_code=e.response.status_code,
+                detail="GitHub token is invalid or expired",
+            ) from None
+        raise HTTPException(status_code=502, detail="GitHub API error") from e
+    except Exception:
+        logger.exception("Failed to list comments for issue #%d", number)
+        raise HTTPException(status_code=500, detail="Internal server error") from None
+
+
+@router.post("/{number}/comments", status_code=201)
+async def create_issue_comment_endpoint(
+    number: int,
+    body: IssueCommentCreateBody,
+    _payload: dict = Depends(auth_dependency),
+    __: dict = Depends(require_role("admin", "editor")),
+):
+    """Post a comment on an issue."""
+    if settings.is_mock_mode():
+        raise HTTPException(
+            status_code=400,
+            detail="Mock mode: issue comment posting disabled",
+        )
+    try:
+        config = get_github_config()
+        return await create_issue_comment(config, number, body=body.body)
+    except ValueError as e:
+        raise HTTPException(status_code=404, detail=str(e)) from None
+    except httpx.HTTPStatusError as e:
+        if e.response.status_code == 404:
+            raise HTTPException(status_code=404, detail="Issue not found") from None
+        if e.response.status_code in (401, 403):
+            raise HTTPException(
+                status_code=e.response.status_code,
+                detail="GitHub token is invalid or expired",
+            ) from None
+        if e.response.status_code == 422:
+            raise HTTPException(status_code=422, detail="Invalid comment data") from None
+        raise HTTPException(status_code=502, detail="GitHub API error") from e
+    except Exception:
+        logger.exception("Failed to create comment on issue #%d", number)
+        raise HTTPException(status_code=500, detail="Internal server error") from None

package/{notes-api → notes/api}/app/routers/pr.py

@@ -45,10 +45,10 @@ router = APIRouter(prefix="/api/pr", tags=["pr"], dependencies=[Depends(auth_dep
 
 @router.get("/sessions")
 async def list_sessions(
-    _: dict = Depends(require_role("admin")),
+    _: dict = Depends(auth_dependency),
     db: AsyncSession = Depends(get_db),
 ):
-    """Get all active sessions (admin only)."""
+    """Get all active sessions for authenticated users (FileInfoPanel branch tab)."""
     if settings.is_mock_mode():
         return {"sessions": [], "mock": True}
     sessions = await get_all_active_sessions(db)

package/{notes-api → notes/api}/app/services/github_app_token.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import logging
 import time
+from typing import Literal
 
 import httpx
 import jwt
@@ -12,6 +13,8 @@ from app.config import settings
 
 logger = logging.getLogger(__name__)
 
+GitHubWriteAuthor = Literal["bot", "pat", "mock"]
+
 _TOKEN_BUFFER_SECONDS = 300
 _JWT_EXPIRY_SECONDS = 600
 
@@ -28,12 +31,40 @@ def is_app_configured() -> bool:
     )
 
 
+def github_write_author_mode() -> GitHubWriteAuthor:
+    """How PR/Issue creation will attribute authorship."""
+    if is_app_configured():
+        return "bot"
+    if settings.github_token:
+        return "pat"
+    return "mock"
+
+
+def warn_if_pat_used_for_write(operation: str) -> None:
+    """Warn when a GitHub write will fall back to PAT instead of GitHub App."""
+    if is_app_configured():
+        return
+    if settings.github_token:
+        logger.warning(
+            "GitHub App is not configured. %s will be created under the "
+            "personal account of the GITHUB_TOKEN owner. "
+            "Set GITHUB_APP_ID, GITHUB_APP_PRIVATE_KEY, and "
+            "GITHUB_APP_INSTALLATION_ID to use the Bot account as author.",
+            operation,
+        )
+        return
+    logger.warning(
+        "GitHub App is not configured and GITHUB_TOKEN is empty. %s may fail.",
+        operation,
+    )
+
+
 def _generate_jwt() -> str:
     now = int(time.time())
     payload = {
         "iat": now - 60,
         "exp": now + _JWT_EXPIRY_SECONDS,
-        "iss": settings.github_app_id,
+        "iss": str(settings.github_app_id),
     }
     private_key = settings.github_app_private_key.replace("\\n", "\n")
     return jwt.encode(payload, private_key, algorithm="RS256")

package/{notes-api → notes/api}/app/services/github_issues.py

@@ -3,9 +3,11 @@
 from __future__ import annotations
 
 import logging
+from urllib.parse import quote
 
 from app.http_client import get_github_client
 from app.services.github import _auth_headers, parse_link_next, resolve_token
+from app.services.github_app_token import warn_if_pat_used_for_write
 
 logger = logging.getLogger(__name__)
 
@@ -21,6 +23,7 @@ async def list_issues(
     *,
     state: str = "open",
     labels: str | None = None,
+    assignee: str | None = None,
     per_page: int = 30,
     page: int = 1,
 ) -> list[dict]:
@@ -35,6 +38,8 @@ async def list_issues(
     }
     if labels:
         params["labels"] = labels
+    if assignee:
+        params["assignee"] = assignee
     token = await resolve_token(config)
     resp = await client.get(
         f"{_repo_url(config)}/issues",
@@ -71,6 +76,7 @@ async def create_issue(
     labels: list[str] | None = None,
 ) -> dict:
     """Create a new issue."""
+    warn_if_pat_used_for_write("Issue")
     client = await get_github_client()
     payload: dict = {"title": title, "body": body}
     if labels:
@@ -134,13 +140,62 @@ async def create_label(
     )
     resp.raise_for_status()
     data = resp.json()
+    return _format_label(data)
+
+
+def _format_label(raw: dict) -> dict:
     return {
-        "name": data["name"],
-        "color": data.get("color", ""),
-        "description": data.get("description", ""),
+        "name": raw["name"],
+        "color": raw.get("color", ""),
+        "description": raw.get("description", ""),
     }
 
 
+def _label_url(config: dict, name: str) -> str:
+    return f"{_repo_url(config)}/labels/{quote(name, safe='')}"
+
+
+async def update_label(
+    config: dict,
+    name: str,
+    *,
+    new_name: str | None = None,
+    color: str | None = None,
+    description: str | None = None,
+) -> dict:
+    """Update an existing repository label (rename, color, description)."""
+    payload: dict[str, str] = {}
+    if new_name is not None:
+        payload["new_name"] = new_name
+    if color is not None:
+        payload["color"] = color.lstrip("#")
+    if description is not None:
+        payload["description"] = description
+    if not payload:
+        raise ValueError("At least one field must be provided to update a label")
+
+    client = await get_github_client()
+    token = await resolve_token(config)
+    resp = await client.patch(
+        _label_url(config, name),
+        headers=_auth_headers(token),
+        json=payload,
+    )
+    resp.raise_for_status()
+    return _format_label(resp.json())
+
+
+async def delete_label(config: dict, name: str) -> None:
+    """Delete a repository label."""
+    client = await get_github_client()
+    token = await resolve_token(config)
+    resp = await client.delete(
+        _label_url(config, name),
+        headers=_auth_headers(token),
+    )
+    resp.raise_for_status()
+
+
 async def list_issue_labels(config: dict) -> list[dict]:
     """List all labels for the repository (auto-paginates via Link header)."""
     token = await resolve_token(config)
@@ -156,14 +211,7 @@ async def list_issue_labels(config: dict) -> list[dict]:
         data = resp.json()
         if not isinstance(data, list):
             break
-        all_labels.extend(
-            {
-                "name": label["name"],
-                "color": label.get("color", ""),
-                "description": label.get("description", ""),
-            }
-            for label in data
-        )
+        all_labels.extend(_format_label(label) for label in data)
         url = parse_link_next(resp.headers.get("link"))
         params = {}
 
@@ -194,3 +242,45 @@ def _format_issue_detail(raw: dict) -> dict:
     result["body"] = raw.get("body") or ""
     result["url"] = raw.get("html_url", "")
     return result
+
+
+async def list_issue_comments(config: dict, number: int) -> list[dict]:
+    """List comments on an issue (chronological)."""
+    token = await resolve_token(config)
+    client = await get_github_client()
+    resp = await client.get(
+        f"{_repo_url(config)}/issues/{number}/comments",
+        headers=_auth_headers(token),
+        params={"per_page": 100, "sort": "created", "direction": "asc"},
+    )
+    resp.raise_for_status()
+    data = resp.json()
+    if not isinstance(data, list):
+        return []
+    return [_format_issue_comment(c) for c in data]
+
+
+async def create_issue_comment(config: dict, number: int, *, body: str) -> dict:
+    """Post a comment on an issue."""
+    warn_if_pat_used_for_write("Issue comment")
+    client = await get_github_client()
+    token = await resolve_token(config)
+    resp = await client.post(
+        f"{_repo_url(config)}/issues/{number}/comments",
+        headers=_auth_headers(token),
+        json={"body": body},
+    )
+    resp.raise_for_status()
+    return _format_issue_comment(resp.json())
+
+
+def _format_issue_comment(raw: dict) -> dict:
+    """GitHub issue comment for API responses."""
+    return {
+        "id": raw["id"],
+        "body": raw.get("body") or "",
+        "author": (raw.get("user") or {}).get("login", ""),
+        "createdAt": raw.get("created_at", ""),
+        "updatedAt": raw.get("updated_at", ""),
+        "url": raw.get("html_url", ""),
+    }

package/{notes-api → notes/api}/app/services/github_pr.py

@@ -8,7 +8,11 @@ from urllib.parse import quote
 from app.config import settings
 from app.http_client import get_github_client
 from app.services.github import parse_link_next
-from app.services.github_app_token import get_installation_token, is_app_configured
+from app.services.github_app_token import (
+    get_installation_token,
+    is_app_configured,
+    warn_if_pat_used_for_write,
+)
 
 logger = logging.getLogger(__name__)
 
@@ -334,6 +338,7 @@ async def create_pr(
 
     Uses GitHub App token when configured so the PR author is the bot.
     """
+    warn_if_pat_used_for_write("Pull request")
     token = await _resolve_token(config)
     headers = _headers_with_token(token)
     url = f"https://api.github.com/repos/{config['owner']}/{config['repo']}/pulls"

package/{notes-api → notes/api}/tests/test_github_app_token.py

@@ -7,7 +7,9 @@ import pytest
 from app.services.github_app_token import (
     _generate_jwt,
     get_installation_token,
+    github_write_author_mode,
     is_app_configured,
+    warn_if_pat_used_for_write,
 )
 
 
@@ -41,6 +43,24 @@ class TestIsAppConfigured:
         assert is_app_configured() is False
 
 
+class TestGithubWriteAuthorMode:
+    @patch("app.services.github_app_token.is_app_configured", return_value=True)
+    def test_bot_when_app_configured(self, _mock_app):
+        assert github_write_author_mode() == "bot"
+
+    @patch("app.services.github_app_token.is_app_configured", return_value=False)
+    @patch("app.services.github_app_token.settings")
+    def test_pat_when_token_only(self, mock_settings, _mock_app):
+        mock_settings.github_token = "ghp_test"
+        assert github_write_author_mode() == "pat"
+
+    @patch("app.services.github_app_token.is_app_configured", return_value=False)
+    @patch("app.services.github_app_token.settings")
+    def test_mock_when_unconfigured(self, mock_settings, _mock_app):
+        mock_settings.github_token = None
+        assert github_write_author_mode() == "mock"
+
+
 class TestGenerateJwt:
     @patch("app.services.github_app_token.settings")
     @patch("app.services.github_app_token.jwt")
@@ -57,7 +77,7 @@ class TestGenerateJwt:
         assert call_args[0][1] == "fake-key"
         assert call_args[1]["algorithm"] == "RS256"
         payload = call_args[0][0]
-        assert payload["iss"] == 99
+        assert payload["iss"] == "99"
         assert "iat" in payload
         assert "exp" in payload
 
@@ -102,3 +122,31 @@ class TestGetInstallationToken:
 
         assert token == "ghs_installation_token"
         assert mod._cached_token == "ghs_installation_token"
+
+
+class TestWarnIfPatUsedForWrite:
+    @patch("app.services.github_app_token.is_app_configured", return_value=True)
+    def test_no_warning_when_app_configured(self, _mock_app):
+        with patch("app.services.github_app_token.logger") as mock_logger:
+            warn_if_pat_used_for_write("Pull request")
+        mock_logger.warning.assert_not_called()
+
+    @patch("app.services.github_app_token.is_app_configured", return_value=False)
+    @patch("app.services.github_app_token.settings")
+    def test_warns_when_pat_fallback(self, mock_settings, _mock_app):
+        mock_settings.github_token = "ghp_test"
+        with patch("app.services.github_app_token.logger") as mock_logger:
+            warn_if_pat_used_for_write("Issue")
+        mock_logger.warning.assert_called_once()
+        message = mock_logger.warning.call_args[0][0]
+        assert "GITHUB_TOKEN owner" in message
+
+    @patch("app.services.github_app_token.is_app_configured", return_value=False)
+    @patch("app.services.github_app_token.settings")
+    def test_warns_when_no_credentials(self, mock_settings, _mock_app):
+        mock_settings.github_token = ""
+        with patch("app.services.github_app_token.logger") as mock_logger:
+            warn_if_pat_used_for_write("Pull request")
+        mock_logger.warning.assert_called_once()
+        message = mock_logger.warning.call_args[0][0]
+        assert "may fail" in message