@sentry/junior-github 0.74.1 → 0.76.0

package/index.d.ts

@@ -1,4 +1,4 @@
-import type { JuniorPluginRegistration } from "@sentry/junior-plugin-api";
+import type { PluginRegistration } from "@sentry/junior-plugin-api";
 
 export type GitHubAppPermissionLevel = "read" | "write" | "admin";
 
@@ -46,6 +46,4 @@ export interface GitHubPluginOptions {
 }
 
 /** Register GitHub manifest content and runtime hooks. */
-export function githubPlugin(
-  options?: GitHubPluginOptions,
-): JuniorPluginRegistration;
+export function githubPlugin(options?: GitHubPluginOptions): PluginRegistration;

package/index.js

@@ -13,6 +13,7 @@ const GITHUB_AUTH_TOKEN_ENV = "GITHUB_TOKEN";
 const GITHUB_AUTH_TOKEN_PLACEHOLDER = "ghp_host_managed_credential";
 const MAX_LEASE_MS = 60 * 60 * 1000;
 const REFRESH_BUFFER_MS = 5 * 60 * 1000;
+const USER_REFRESH_TIMEOUT_MS = 20_000;
 const GITHUB_GRAPHQL_RESPONSE_BODY_LIMIT_BYTES = 64 * 1024;
 const HTTP_READ_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
 const USER_TOKEN_GRANTS = new Set(["user-read", "user-write"]);
@@ -290,20 +291,27 @@ function buildOAuthTokenRequest(input) {
   };
 }
 
-function parseOAuthError(text) {
-  if (!text.trim()) {
+function parseOAuthResponseJson(responseText) {
+  if (!responseText.trim()) {
     return undefined;
   }
   try {
-    const parsed = JSON.parse(text);
-    return isRecord(parsed) && typeof parsed.error === "string"
-      ? parsed.error
-      : undefined;
+    return JSON.parse(responseText);
   } catch {
     return undefined;
   }
 }
 
+function oauthErrorCode(data) {
+  return isRecord(data) && typeof data.error === "string"
+    ? data.error
+    : undefined;
+}
+
+function isRejectedRefreshError(errorCode) {
+  return errorCode === "bad_refresh_token" || errorCode === "invalid_grant";
+}
+
 function parseOAuthTokenResponse(data, requestedScope) {
   if (!isRecord(data)) {
     throw new Error("OAuth token response is invalid");
@@ -326,20 +334,30 @@ function parseOAuthTokenResponse(data, requestedScope) {
     refreshToken: data.refresh_token,
     ...(scope ? { scope } : {}),
   };
-  if (data.expires_in === undefined) {
-    return result;
+  if (data.expires_in !== undefined) {
+    if (
+      typeof data.expires_in !== "number" ||
+      !Number.isFinite(data.expires_in) ||
+      data.expires_in <= 0
+    ) {
+      throw new Error("OAuth token response returned invalid expires_in");
+    }
+    result.expiresAt = Date.now() + data.expires_in * 1000;
   }
-  if (
-    typeof data.expires_in !== "number" ||
-    !Number.isFinite(data.expires_in) ||
-    data.expires_in <= 0
-  ) {
-    throw new Error("OAuth token response returned invalid expires_in");
+  if (data.refresh_token_expires_in !== undefined) {
+    if (
+      typeof data.refresh_token_expires_in !== "number" ||
+      !Number.isFinite(data.refresh_token_expires_in) ||
+      data.refresh_token_expires_in <= 0
+    ) {
+      throw new Error(
+        "OAuth token response returned invalid refresh_token_expires_in",
+      );
+    }
+    result.refreshTokenExpiresAt =
+      Date.now() + data.refresh_token_expires_in * 1000;
   }
-  return {
-    ...result,
-    expiresAt: Date.now() + data.expires_in * 1000,
-  };
+  return result;
 }
 
 async function refreshUserAccessToken(input) {
@@ -357,19 +375,32 @@ async function refreshUserAccessToken(input) {
     method: "POST",
     headers: request.headers,
     body: request.body,
+    signal: AbortSignal.timeout(USER_REFRESH_TIMEOUT_MS),
   });
-  if (!response.ok) {
-    const errorCode = parseOAuthError(await response.text());
-    if (errorCode === "bad_refresh_token" || errorCode === "invalid_grant") {
-      throw new GitHubUserRefreshRejectedError(
-        `GitHub user token refresh rejected: ${errorCode}`,
-      );
-    }
+  const responseText = await response.text();
+  const responseData = parseOAuthResponseJson(responseText);
+  const errorCode = oauthErrorCode(responseData);
+  if (isRejectedRefreshError(errorCode)) {
+    throw new GitHubUserRefreshRejectedError(
+      `GitHub user token refresh rejected: ${errorCode}`,
+    );
+  }
+  if (!response.ok || errorCode) {
     throw new Error(
       `GitHub user token refresh failed: ${response.status}${errorCode ? ` ${errorCode}` : ""}`,
     );
   }
-  return parseOAuthTokenResponse(await response.json(), input.requestedScope);
+  try {
+    return parseOAuthTokenResponse(responseData, input.requestedScope);
+  } catch (error) {
+    if (
+      error instanceof Error &&
+      error.message === "OAuth token response missing access_token"
+    ) {
+      throw new GitHubUserRefreshRejectedError(error.message);
+    }
+    throw error;
+  }
 }
 
 function leaseExpiry(expiresAt) {
@@ -509,6 +540,83 @@ async function tokensWithAccount(tokenSlot, stored, scope) {
   return { ok: true, tokens: updated };
 }
 
+function shouldRefreshUserToken(stored, now = Date.now()) {
+  return (
+    stored.expiresAt !== undefined && stored.expiresAt - now < REFRESH_BUFFER_MS
+  );
+}
+
+function canUseStoredUserToken(stored) {
+  return (
+    stored.expiresAt === undefined ||
+    (stored.expiresAt > Date.now() && !shouldRefreshUserToken(stored))
+  );
+}
+
+/** Re-read under the token-slot refresh gate so concurrent callers reuse the winner's rotated tokens. */
+async function refreshUserTokensWithLock(tokenSlot, scope, options) {
+  return await tokenSlot.withRefresh(async () => {
+    const latest = await tokenSlot.get();
+    if (!latest) {
+      return {
+        ok: false,
+        result: credentialNeeded("Connect your GitHub account.", scope),
+      };
+    }
+    if (!hasRequiredOAuthScope(latest.scope, scope)) {
+      return {
+        ok: false,
+        result: credentialNeeded(
+          "Your GitHub authorization needs to be refreshed.",
+          scope,
+        ),
+      };
+    }
+    if (canUseStoredUserToken(latest)) {
+      return { ok: true, tokens: latest };
+    }
+
+    let refreshed;
+    try {
+      refreshed = await refreshUserAccessToken({
+        clientIdEnv: options.clientIdEnv,
+        clientSecretEnv: options.clientSecretEnv,
+        refreshToken: latest.refreshToken,
+        requestedScope: latest.scope ?? scope,
+      });
+    } catch (error) {
+      if (!(error instanceof GitHubUserRefreshRejectedError)) {
+        throw error;
+      }
+      return {
+        ok: false,
+        result: credentialNeeded(
+          "Your GitHub authorization has expired.",
+          scope,
+        ),
+      };
+    }
+    if (!hasRequiredOAuthScope(refreshed.scope, scope)) {
+      return {
+        ok: false,
+        result: credentialNeeded(
+          "Your GitHub authorization needs to be refreshed.",
+          scope,
+        ),
+      };
+    }
+    const refreshedTokens = {
+      ...(latest.refreshTokenExpiresAt
+        ? { refreshTokenExpiresAt: latest.refreshTokenExpiresAt }
+        : {}),
+      ...refreshed,
+      ...(latest.account ? { account: latest.account } : {}),
+    };
+    await tokenSlot.set(refreshedTokens);
+    return { ok: true, tokens: refreshedTokens };
+  });
+}
+
 async function issueUserCredential(ctx, options) {
   const scope = options.userScope;
   const tokenSlot = ctx.tokens.currentUser ?? ctx.tokens.credentialSubject;
@@ -539,34 +647,17 @@ async function issueUserCredential(ctx, options) {
     stored.expiresAt !== undefined &&
     stored.expiresAt - now < REFRESH_BUFFER_MS
   ) {
-    let refreshed;
-    try {
-      refreshed = await refreshUserAccessToken({
-        clientIdEnv: options.clientIdEnv,
-        clientSecretEnv: options.clientSecretEnv,
-        refreshToken: stored.refreshToken,
-        requestedScope: stored.scope ?? scope,
-      });
-    } catch (error) {
-      if (!(error instanceof GitHubUserRefreshRejectedError)) {
-        throw error;
-      }
-      return credentialNeeded("Your GitHub authorization has expired.", scope);
-    }
-    if (!hasRequiredOAuthScope(refreshed.scope, scope)) {
-      return credentialNeeded(
-        "Your GitHub authorization needs to be refreshed.",
-        scope,
-      );
+    const refreshResult = await refreshUserTokensWithLock(
+      tokenSlot,
+      scope,
+      options,
+    );
+    if (!refreshResult.ok) {
+      return refreshResult.result;
     }
-    const refreshedTokens = {
-      ...refreshed,
-      ...(stored.account ? { account: stored.account } : {}),
-    };
-    await tokenSlot.set(refreshedTokens);
     const withAccount = await tokensWithAccount(
       tokenSlot,
-      refreshedTokens,
+      refreshResult.tokens,
       scope,
     );
     if (!withAccount.ok) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior-github",
-  "version": "0.74.1",
+  "version": "0.76.0",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -25,6 +25,6 @@
     "SETUP.md"
   ],
   "dependencies": {
-    "@sentry/junior-plugin-api": "0.74.1"
+    "@sentry/junior-plugin-api": "0.76.0"
   }
 }