@shivaedev/github 0.9.0 → 0.11.0

package/src/repositorySchemas.ts

@@ -0,0 +1,43 @@
+import { Schema } from "effect";
+
+export const User = Schema.Struct({
+	avatarUrl: Schema.String,
+	htmlUrl: Schema.String,
+	id: Schema.Number,
+	login: Schema.String,
+	type: Schema.String,
+}).pipe(Schema.encodeKeys({ avatarUrl: "avatar_url", htmlUrl: "html_url" }));
+
+export const Issue = Schema.Struct({
+	body: Schema.NullOr(Schema.String),
+	closedAt: Schema.NullOr(Schema.String),
+	createdAt: Schema.String,
+	htmlUrl: Schema.String,
+	id: Schema.Number,
+	labels: Schema.Array(Schema.Union([Schema.String, Schema.Struct({ name: Schema.optional(Schema.String) })])),
+	number: Schema.Number,
+	pullRequest: Schema.optional(Schema.Struct({ url: Schema.String })),
+	state: Schema.Literals(["open", "closed"]),
+	title: Schema.String,
+	updatedAt: Schema.String,
+	user: Schema.NullOr(User),
+}).pipe(
+	Schema.encodeKeys({ closedAt: "closed_at", createdAt: "created_at", htmlUrl: "html_url", pullRequest: "pull_request", updatedAt: "updated_at" }),
+);
+
+export const PullRequestFile = Schema.Struct({
+	additions: Schema.Number,
+	changes: Schema.Number,
+	deletions: Schema.Number,
+	filename: Schema.String,
+	patch: Schema.optional(Schema.String),
+	previousFilename: Schema.optional(Schema.String),
+	sha: Schema.String,
+	status: Schema.String,
+}).pipe(Schema.encodeKeys({ previousFilename: "previous_filename" }));
+
+export const CollaboratorPermission = Schema.Struct({
+	permission: Schema.String,
+	roleName: Schema.String,
+	user: User,
+}).pipe(Schema.encodeKeys({ roleName: "role_name" }));

package/src/representations.ts

@@ -3,25 +3,26 @@ import { HttpClient, HttpClientRequest, type HttpClientResponse } from "effect/h
 import type { ServiceUnavailable } from "@shivaedev/errors/taxonomy.ts";
 import { nextLink } from "@shivaedev/http/nextLink.ts";
 import { paginate } from "@shivaedev/http/paginate.ts";
+import { resolveApiUrl } from "#adapters/resolveApiUrl.ts";
 import type { CachedResponse } from "#cache.ts";
 import { jsonResponse } from "#json.ts";
 import type { requests } from "#requests.ts";
 
 export function representations(
 	apiUrl: string,
-	request: ReturnType<typeof requests>,
+	request: Effect.Success<ReturnType<typeof requests>>,
 	resource: (path: string) => string,
 	responseByteLimit = 1024 * 1024,
 ) {
 	function get(path: string, accept = "application/vnd.github+json") {
-		return HttpClientRequest.get(new URL(path, apiUrl).href, { headers: { Accept: accept } });
+		return HttpClientRequest.get(resolveApiUrl(apiUrl, path), { headers: { Accept: accept } });
 	}
 	function readRepresentation(path: string, byteLimit = responseByteLimit) {
 		return Effect.map(request(get(path), byteLimit), jsonResponse);
 	}
-	function listRepresentations(
+	function listRepresentations<E = ServiceUnavailable>(
 		path: string,
-		beforeRequest?: (resource: string) => Effect.Effect<void, ServiceUnavailable>,
+		beforeRequest?: (resource: string) => Effect.Effect<void, E>,
 		byteLimit = responseByteLimit,
 	) {
 		const entries = new WeakMap<HttpClientResponse.HttpClientResponse, CachedResponse>();
@@ -46,7 +47,7 @@ export function representations(
 		);
 	}
 	function writeRepresentation(method: "POST" | "PATCH" | "PUT" | "DELETE", path: string, body?: unknown, byteLimit = responseByteLimit) {
-		return HttpClientRequest.make(method)(new URL(path, apiUrl).href, { headers: { Accept: "application/vnd.github+json" } }).pipe(
+		return HttpClientRequest.make(method)(resolveApiUrl(apiUrl, path), { headers: { Accept: "application/vnd.github+json" } }).pipe(
 			(input) => (body === undefined ? Effect.succeed(input) : HttpClientRequest.bodyJson(input, body)),
 			Effect.flatMap((input) => request(input, byteLimit)),
 			Effect.map(jsonResponse),

package/src/requests.ts

@@ -2,20 +2,18 @@ import { Effect } from "effect";
 import { HttpClient, HttpClientRequest } from "effect/http";
 import { readBoundedBody } from "@shivaedev/http/body.ts";
 import { ResponseBodyTooLarge } from "@shivaedev/http/errors.ts";
-import { authenticatedRequest } from "./authenticatedRequest.ts";
-import { type CachedResponse, responseCache, revalidatedResponse } from "./cache.ts";
-import { GitHubTransportError } from "./errors.ts";
-import type { GitHubToken } from "./GitHubToken.ts";
-import type { RateLimits } from "./rateLimits.ts";
-import { isUnchanged } from "./status.ts";
-import type { TokenRefresh } from "./TokenRefresh.ts";
+import { authenticatedRequest } from "#authenticatedRequest.ts";
+import { type CachedResponse, responseCache, revalidatedResponse } from "#cache.ts";
+import { GitHubTransportError } from "#errors.ts";
+import { GitHubToken } from "#GitHubToken.ts";
+import type { RateLimits } from "#rateLimits.ts";
+import { isUnchanged } from "#status.ts";
+import { TokenRefresh } from "#TokenRefresh.ts";
 
-export function requests(
-	client: HttpClient.HttpClient,
-	token: GitHubToken["Service"],
-	rates: RateLimits,
-	refresh: typeof TokenRefresh.Service = undefined,
-) {
+export const requests = Effect.fnUntraced(function* (rates: RateLimits) {
+	const client = yield* HttpClient.HttpClient;
+	const token = yield* GitHubToken;
+	const refresh = yield* TokenRefresh;
 	const cache = responseCache();
 	const send = authenticatedRequest(HttpClient.withScope(client), token, rates, refresh);
 	return Effect.fn("GitHub.request")(function* (input: HttpClientRequest.HttpClientRequest, limit: number) {
@@ -43,4 +41,4 @@ export function requests(
 		}
 		return entry;
 	}, Effect.scoped);
-}
+});

package/src/status.ts

@@ -1,8 +1,8 @@
 import { DateTime, Effect, Option, Schema } from "effect";
-import { HttpClient, type HttpClientResponse } from "effect/http";
+import type { HttpClientResponse } from "effect/http";
 import * as HttpStatus from "effect/http/HttpStatus";
 import { readBoundedText } from "@shivaedev/http/body.ts";
-import { filterStatus } from "@shivaedev/http/filterStatus.ts";
+import { checkStatus as checkResponseStatus } from "@shivaedev/http/checkStatus.ts";
 import { parseRetryAfter } from "@shivaedev/http/parseRetryAfter.ts";
 import { GitHubConversationLocked, GitHubPermissionDenied, GitHubRateLimited } from "#errors.ts";
 
@@ -29,7 +29,7 @@ export const checkStatus = Effect.fnUntraced(function* (response: HttpClientResp
 			return yield* refusal;
 		}
 	}
-	return yield* filterStatus(HttpClient.makeWith(() => Effect.succeed(response), Effect.succeed)).execute(response.request);
+	return yield* checkResponseStatus(response);
 });
 
 const Message = Schema.fromJsonString(Schema.Struct({ message: Schema.String }));

package/src/verifyWebhook.ts

@@ -1,6 +1,6 @@
-import { createHmac, timingSafeEqual } from "node:crypto";
-import { Effect, Redacted, Schema } from "effect";
-import { GitHubWebhookSignatureError } from "#errors.ts";
+import { Effect, type Redacted, Schema } from "effect";
+import { verifySignature } from "#adapters/verifySignature.ts";
+import type { GitHubWebhookSignatureError } from "#errors.ts";
 
 const verify = Effect.fnUntraced(function* <TSchema extends Schema.Constraint>(
 	body: Uint8Array,
@@ -8,13 +8,7 @@ const verify = Effect.fnUntraced(function* <TSchema extends Schema.Constraint>(
 	secret: Redacted.Redacted<string>,
 	schema?: TSchema,
 ) {
-	if (signature === undefined || !/^sha256=[0-9a-f]{64}$/u.test(signature)) {
-		return yield* new GitHubWebhookSignatureError();
-	}
-	const expected = createHmac("sha256", Redacted.value(secret)).update(body).digest();
-	if (!timingSafeEqual(expected, Buffer.from(signature.slice(7), "hex"))) {
-		return yield* new GitHubWebhookSignatureError();
-	}
+	yield* verifySignature(body, signature, secret);
 	if (schema === undefined) {
 		return;
 	}

package/src/viewerRepositoryAccess.ts

@@ -0,0 +1,66 @@
+import { Cache, Effect, Exit, Schema, Stream } from "effect";
+import { decodedPages } from "#pagedLists.ts";
+import type { Representations } from "#representations.ts";
+
+export const InstalledRepository = Schema.Struct({
+	htmlUrl: Schema.String,
+	id: Schema.Number,
+	name: Schema.String,
+	owner: Schema.Struct({ login: Schema.String }),
+	private: Schema.Boolean,
+}).pipe(Schema.encodeKeys({ htmlUrl: "html_url" }));
+
+export interface ViewerRepositoryAccess {
+	readonly administrable: readonly (typeof InstalledRepository.Type & { readonly installationId: number })[];
+	readonly readable: readonly (typeof InstalledRepository.Type & { readonly installationId: number })[];
+}
+
+const Account = Schema.Struct({ login: Schema.String });
+const Installation = Schema.Struct({ id: Schema.Number });
+const Permission = Schema.Struct({ permission: Schema.String });
+
+const installationAccess = Effect.fnUntraced(function* (client: Representations, installationId: number, login: string) {
+	const pages = yield* decodedPages(client, "/installation/repositories?per_page=100", InstalledRepository, {
+		arrayKey: "repositories",
+	}).pipe(Stream.runCollect);
+	const readable: ViewerRepositoryAccess["readable"][number][] = [];
+	const administrable: ViewerRepositoryAccess["administrable"][number][] = [];
+	for (const repository of pages.flatMap((page) => page.items)) {
+		const permissionPath = `/repos/${encodeURIComponent(repository.owner.login)}/${encodeURIComponent(repository.name)}/collaborators/${encodeURIComponent(login)}/permission`;
+		const permission = yield* Effect.flatMap(client.read(permissionPath), (response) => response.decode(Permission)).pipe(
+			Effect.map((grant) => grant.permission),
+			Effect.catchTag("RemoteNotFound", () => Effect.succeed("none")),
+		);
+		const installed = { ...repository, installationId };
+		if (!repository.private || ["read", "triage", "write", "maintain", "admin"].includes(permission)) {
+			readable.push(installed);
+		}
+		if (permission === "admin") {
+			administrable.push(installed);
+		}
+	}
+	return { administrable, readable } satisfies ViewerRepositoryAccess;
+});
+
+export function viewerRepositoryAccess(app: Representations, installation: (id: number) => Effect.Effect<Representations>) {
+	const lookup = Effect.fnUntraced(function* (account: string) {
+		const path = account.startsWith("id:") ? `/user/${account.slice(3)}` : `/users/${encodeURIComponent(account.slice(6))}`;
+		const installations = yield* decodedPages(app, "/app/installations?per_page=100", Installation).pipe(Stream.runCollect);
+		const first = installations.flatMap((page) => page.items)[0];
+		if (first === undefined) {
+			return { administrable: [], readable: [] } satisfies ViewerRepositoryAccess;
+		}
+		const resolver = yield* installation(first.id);
+		const { login } = yield* Effect.flatMap(resolver.read(path), (response) => response.decode(Account));
+		const readable: ViewerRepositoryAccess["readable"][number][] = [];
+		const administrable: ViewerRepositoryAccess["administrable"][number][] = [];
+		for (const { id } of installations.flatMap((page) => page.items)) {
+			const client = yield* installation(id);
+			const access = yield* installationAccess(client, id, login);
+			readable.push(...access.readable);
+			administrable.push(...access.administrable);
+		}
+		return { administrable, readable } satisfies ViewerRepositoryAccess;
+	});
+	return Cache.makeWith(lookup, { capacity: 100, timeToLive: (exit) => (Exit.isSuccess(exit) ? "60 seconds" : 0) });
+}