devpush 0.0.0-stage → 1.0.0-beta.3

package/src/server/github/service.ts

@@ -0,0 +1,831 @@
+import { fetchGitHub, readGitHubJson } from '#devpush/server/github/http'
+import { readProviderToken } from '#devpush/server/auth/provider-tokens'
+import { and, desc, eq } from 'drizzle-orm'
+import { createPrivateKey } from 'node:crypto'
+import { SignJWT } from 'jose'
+import { isAPIError } from 'better-auth/api'
+import { PublicError } from '#devpush/lib/public-error'
+
+import { config } from '#devpush/server/config'
+import { db } from '#devpush/server/db'
+import {
+  account,
+  githubInstallations,
+  projects,
+} from '#devpush/server/db/schema'
+import { getGitHubInstallationChange } from '#devpush/server/github/webhooks'
+import type { GitHubInstallationWebhookEvent } from '#devpush/server/github/webhooks'
+
+const githubApiBaseUrl = 'https://api.github.com'
+const composeCandidates = [
+  'compose.yml',
+  'compose.yaml',
+  'docker-compose.yml',
+  'docker-compose.yaml',
+]
+
+export type GitHubAccount = {
+  login: string
+  accessToken: string
+}
+
+export type GitHubInstallation = {
+  id: number
+  accountId: number
+  accountLogin: string
+  accountType: string
+  repositorySelection: string
+  status: 'active' | 'suspended'
+}
+
+export type GitHubRepository = {
+  id: number
+  installationId: number
+  name: string
+  fullName: string
+  owner: string
+  private: boolean
+  defaultBranch: string
+  updatedAt: string
+  permissions: {
+    push: boolean
+  }
+}
+
+type GitHubUserResponse = {
+  login: string
+}
+
+type GitHubInstallationResponse = {
+  id: number
+  account: {
+    id: number
+    login: string
+    type: string
+  }
+  repository_selection: string
+  suspended_at?: string | null
+}
+
+type GitHubInstallationsResponse = {
+  installations: Array<GitHubInstallationResponse>
+  total_count: number
+}
+
+type GitHubRepositoryResponse = {
+  id: number
+  name: string
+  full_name: string
+  private: boolean
+  default_branch: string
+  updated_at: string
+  owner: {
+    login: string
+  }
+  permissions?: {
+    push?: boolean
+  }
+}
+
+type GitHubBranchResponse = {
+  commit: {
+    sha: string
+    commit?: {
+      message?: string
+    }
+  }
+}
+
+type GitHubBranchListResponse = Array<{
+  name: string
+}>
+
+type GitHubCommitResponse = {
+  sha: string
+  commit?: {
+    message?: string
+    author?: {
+      date?: string
+      name?: string
+    }
+  }
+  html_url?: string
+}
+
+type GitHubRepositoriesResponse = {
+  repositories: Array<GitHubRepositoryResponse>
+  total_count: number
+}
+
+type GitHubContentResponse =
+  | {
+      type: 'file'
+      content: string
+      encoding: string
+    }
+  | {
+      type: string
+      content?: string
+      encoding?: string
+    }
+
+let cachedJwt: { token: string; expiresAt: number } | null = null
+
+export function isGitHubAppConfigured() {
+  return Boolean(
+    config.GITHUB_APP_ID &&
+    config.GITHUB_APP_NAME &&
+    config.GITHUB_APP_PRIVATE_KEY,
+  )
+}
+
+export function getGitHubAppInstallUrl() {
+  if (!config.GITHUB_APP_NAME) {
+    return null
+  }
+
+  return `https://github.com/apps/${config.GITHUB_APP_NAME}/installations/new`
+}
+
+export async function getGitHubAccount(
+  userId: string,
+): Promise<GitHubAccount | null> {
+  const accountRows = await db
+    .select({
+      id: account.id,
+      accessToken: account.accessToken,
+      accessTokenExpiresAt: account.accessTokenExpiresAt,
+      login: account.providerAccountUsername,
+    })
+    .from(account)
+    .where(and(eq(account.userId, userId), eq(account.providerId, 'github')))
+    .orderBy(desc(account.updatedAt))
+    .limit(1)
+  const githubAccount = accountRows.at(0)
+
+  if (!githubAccount?.accessToken) {
+    return null
+  }
+
+  let accessToken = await readProviderToken(githubAccount.accessToken)
+  if (
+    githubAccount.accessTokenExpiresAt &&
+    githubAccount.accessTokenExpiresAt.getTime() - Date.now() < 5_000
+  ) {
+    const { auth } = await import('#devpush/server/auth/better-auth')
+    try {
+      const refreshed = await auth.api.getAccessToken({
+        body: { accountId: githubAccount.id, userId },
+      })
+      if (
+        !refreshed.accessToken ||
+        (refreshed.accessTokenExpiresAt &&
+          new Date(refreshed.accessTokenExpiresAt).getTime() <= Date.now())
+      ) {
+        throw new PublicError('GITHUB_ACCESS_REFRESH_FAILED')
+      }
+      accessToken = refreshed.accessToken
+    } catch (error) {
+      if (
+        isAPIError(error) &&
+        [
+          'FAILED_TO_GET_ACCESS_TOKEN',
+          'PROVIDER_NOT_SUPPORTED',
+          'ACCOUNT_NOT_FOUND',
+        ].includes(error.body?.code ?? '')
+      ) {
+        throw new PublicError('GITHUB_ACCESS_REFRESH_FAILED')
+      }
+      throw error
+    }
+  }
+
+  const login =
+    githubAccount.login ??
+    (await githubRequest<GitHubUserResponse>('/user', accessToken)).login
+
+  return {
+    login,
+    accessToken,
+  }
+}
+
+export async function listUserInstallations(
+  accessToken: string,
+): Promise<Array<GitHubInstallation>> {
+  const installations: Array<GitHubInstallation> = []
+  let page = 1
+  let hasMore = true
+
+  while (hasMore) {
+    const data = await githubRequest<GitHubInstallationsResponse>(
+      `/user/installations?per_page=100&page=${page}`,
+      accessToken,
+    )
+
+    installations.push(
+      ...data.installations.map((installation) => ({
+        id: installation.id,
+        accountId: installation.account.id,
+        accountLogin: installation.account.login,
+        accountType: installation.account.type,
+        repositorySelection: installation.repository_selection,
+        status: 'active' as const,
+      })),
+    )
+
+    if (data.installations.length < 100 || page * 100 >= data.total_count) {
+      hasMore = false
+    } else {
+      page += 1
+    }
+  }
+
+  return installations
+}
+
+export async function listUserInstallationsPage({
+  accessToken,
+  page,
+  perPage,
+}: {
+  accessToken: string
+  page: number
+  perPage: number
+}) {
+  const data = await githubRequest<GitHubInstallationsResponse>(
+    `/user/installations?per_page=${perPage}&page=${page}`,
+    accessToken,
+  )
+  return {
+    items: data.installations.map((installation) => ({
+      id: installation.id,
+      accountLogin: installation.account.login,
+      accountType: installation.account.type,
+      repositorySelection: installation.repository_selection,
+    })),
+    hasMore: page * perPage < data.total_count,
+  }
+}
+
+export async function listInstallationRepositoriesPage({
+  accessToken,
+  installationId,
+  page,
+  perPage,
+}: {
+  accessToken: string
+  installationId: number
+  page: number
+  perPage: number
+}) {
+  const data = await githubRequest<GitHubRepositoriesResponse>(
+    `/user/installations/${installationId}/repositories?per_page=${perPage}&page=${page}`,
+    accessToken,
+  )
+  return {
+    items: data.repositories.map((repository) =>
+      mapRepository(repository, installationId),
+    ),
+    hasMore: page * perPage < data.total_count,
+  }
+}
+
+export async function listInstallationRepositories({
+  accessToken,
+  installationId,
+}: {
+  accessToken: string
+  installationId: number
+}): Promise<Array<GitHubRepository>> {
+  const repositories: Array<GitHubRepository> = []
+  let page = 1
+  let hasMore = true
+
+  while (hasMore) {
+    const data = await githubRequest<GitHubRepositoriesResponse>(
+      `/user/installations/${installationId}/repositories?per_page=100&page=${page}`,
+      accessToken,
+    )
+
+    repositories.push(
+      ...data.repositories.map((repo) => mapRepository(repo, installationId)),
+    )
+
+    if (data.repositories.length < 100 || page * 100 >= data.total_count) {
+      hasMore = false
+    } else {
+      page += 1
+    }
+  }
+
+  return repositories
+}
+
+export async function getGitHubRepository(
+  accessToken: string,
+  fullName: string,
+  installationId: number,
+): Promise<GitHubRepository> {
+  const repo = await githubRequest<GitHubRepositoryResponse>(
+    `/repos/${encodeURIComponentRepoName(fullName)}`,
+    accessToken,
+  )
+
+  return mapRepository(repo, installationId)
+}
+
+export async function detectComposePath({
+  accessToken,
+  repo,
+  ref,
+}: {
+  accessToken: string
+  repo: string
+  ref: string
+}) {
+  for (const path of composeCandidates) {
+    const response = await fetchGitHub(
+      `${githubApiBaseUrl}/repos/${encodeURIComponentRepoName(repo)}/contents/${path}?ref=${encodeURIComponent(ref)}`,
+      {
+        headers: githubHeaders(accessToken),
+      },
+    )
+
+    if (response.status === 404) {
+      continue
+    }
+
+    if (!response.ok) {
+      throw new Error(await readGitHubError(response))
+    }
+
+    return path
+  }
+
+  return null
+}
+
+export async function getRepositoryFileText({
+  accessToken,
+  path,
+  ref,
+  repo,
+}: {
+  accessToken: string
+  path: string
+  ref: string
+  repo: string
+}) {
+  const data = await githubRequest<GitHubContentResponse>(
+    `/repos/${encodeURIComponentRepoName(repo)}/contents/${encodeURIComponentPath(path)}?ref=${encodeURIComponent(ref)}`,
+    accessToken,
+  )
+
+  if (data.type !== 'file' || !data.content) {
+    throw new Error(`${path} is not a file.`)
+  }
+
+  if (data.encoding !== 'base64') {
+    throw new Error(`${path} has unsupported encoding.`)
+  }
+
+  return Buffer.from(data.content.replace(/\s/g, ''), 'base64').toString('utf8')
+}
+
+export async function getBranchHeadCommit({
+  accessToken,
+  branch,
+  repo,
+}: {
+  accessToken: string
+  branch: string
+  repo: string
+}) {
+  if (
+    config.DEVPUSH_SMOKE_GITHUB_TOKEN &&
+    accessToken === config.DEVPUSH_SMOKE_GITHUB_TOKEN
+  ) {
+    return {
+      sha: 'smoke-branch-head',
+      message: `Smoke commit for ${repo}@${branch}`,
+    }
+  }
+
+  const data = await githubRequest<GitHubBranchResponse>(
+    `/repos/${encodeURIComponentRepoName(repo)}/branches/${encodeURIComponent(branch)}`,
+    accessToken,
+  )
+
+  return {
+    sha: data.commit.sha,
+    message: data.commit.commit?.message ?? null,
+  }
+}
+
+export async function listBranchCommits({
+  accessToken,
+  branch,
+  perPage = 5,
+  repo,
+}: {
+  accessToken: string
+  branch: string
+  perPage?: number
+  repo: string
+}) {
+  const data = await githubRequest<Array<GitHubCommitResponse>>(
+    `/repos/${encodeURIComponentRepoName(repo)}/commits?sha=${encodeURIComponent(branch)}&per_page=${perPage}`,
+    accessToken,
+  )
+
+  return data.map(mapCommit)
+}
+
+export async function listRepositoryBranches({
+  accessToken,
+  repo,
+}: {
+  accessToken: string
+  repo: string
+}) {
+  if (
+    config.DEVPUSH_SMOKE_GITHUB_TOKEN &&
+    accessToken === config.DEVPUSH_SMOKE_GITHUB_TOKEN
+  ) {
+    return ['main']
+  }
+
+  const branches: Array<string> = []
+  let page = 1
+  let hasMore = true
+
+  while (hasMore) {
+    const data = await githubRequest<GitHubBranchListResponse>(
+      `/repos/${encodeURIComponentRepoName(repo)}/branches?per_page=100&page=${page}`,
+      accessToken,
+    )
+
+    branches.push(...data.map((branch) => branch.name))
+
+    hasMore = data.length === 100
+    page += 1
+  }
+
+  return branches
+}
+
+export async function listRepositoryBranchesPage({
+  accessToken,
+  repo,
+  page,
+  perPage,
+}: {
+  accessToken: string
+  repo: string
+  page: number
+  perPage: number
+}) {
+  if (
+    config.DEVPUSH_SMOKE_GITHUB_TOKEN &&
+    accessToken === config.DEVPUSH_SMOKE_GITHUB_TOKEN
+  )
+    return { items: page === 1 ? ['main'] : [], hasMore: false }
+  const branches = await githubRequest<GitHubBranchListResponse>(
+    `/repos/${encodeURIComponentRepoName(repo)}/branches?per_page=${perPage}&page=${page}`,
+    accessToken,
+  )
+  // One additional empty page is possible when GitHub returns an exact multiple
+  // of perPage; continuation never loses branches or fetches every page upfront.
+  return {
+    items: branches.map((branch) => branch.name),
+    hasMore: branches.length === perPage,
+  }
+}
+
+export async function getAppInstallation(installationId: number) {
+  const jwt = await getGitHubAppJwt()
+
+  const installation = await githubRequest<GitHubInstallationResponse>(
+    `/app/installations/${installationId}`,
+    jwt,
+  )
+
+  return mapInstallation(installation)
+}
+
+async function getRepositoryAppInstallation(repositoryFullName: string) {
+  const jwt = await getGitHubAppJwt()
+  const installation = await githubRequest<GitHubInstallationResponse>(
+    `/repos/${encodeURIComponentRepoName(repositoryFullName)}/installation`,
+    jwt,
+  )
+
+  return mapInstallation(installation)
+}
+
+export async function createInstallationAccessToken({
+  installationId,
+  repositoryId,
+  repositoryFullName,
+}: {
+  installationId: number
+  repositoryId: number | null
+  repositoryFullName: string
+}) {
+  if (config.DEVPUSH_SMOKE_GITHUB_TOKEN) {
+    return {
+      token: config.DEVPUSH_SMOKE_GITHUB_TOKEN,
+      expiresAt: new Date(Date.now() + 60 * 60 * 1000).toISOString(),
+    }
+  }
+
+  try {
+    return await requestInstallationAccessToken({
+      installationId,
+      repositoryId,
+    })
+  } catch (error) {
+    if (!(error instanceof GitHubApiError) || error.status !== 404) {
+      throw error
+    }
+
+    const installation = await getRepositoryAppInstallation(repositoryFullName)
+
+    if (installation.id === installationId) {
+      throw error
+    }
+
+    await upsertGitHubInstallation(installation)
+    await db
+      .update(projects)
+      .set({
+        githubInstallationId: installation.id,
+        updatedAt: new Date(),
+      })
+      .where(
+        and(
+          eq(projects.githubInstallationId, installationId),
+          eq(projects.githubRepo, repositoryFullName),
+        ),
+      )
+    await markGitHubInstallationStatus(installationId, 'deleted')
+
+    return requestInstallationAccessToken({
+      installationId: installation.id,
+      repositoryId,
+    })
+  }
+}
+
+export async function upsertGitHubInstallation(
+  installation: GitHubInstallation,
+) {
+  await db
+    .insert(githubInstallations)
+    .values({
+      installationId: installation.id,
+      accountId: installation.accountId,
+      accountLogin: installation.accountLogin,
+      accountType: installation.accountType,
+      repositorySelection: installation.repositorySelection,
+      status: installation.status,
+      updatedAt: new Date(),
+    })
+    .onConflictDoUpdate({
+      target: githubInstallations.installationId,
+      set: {
+        accountId: installation.accountId,
+        accountLogin: installation.accountLogin,
+        accountType: installation.accountType,
+        repositorySelection: installation.repositorySelection,
+        status: installation.status,
+        updatedAt: new Date(),
+      },
+    })
+}
+
+export async function handleGitHubInstallationWebhook({
+  action,
+  event,
+  installationId,
+}: {
+  action: string
+  event: GitHubInstallationWebhookEvent
+  installationId: number
+}) {
+  const change = getGitHubInstallationChange(event, action)
+
+  if (change.type === 'status') {
+    await markGitHubInstallationStatus(installationId, change.status)
+    return
+  }
+
+  if (change.type === 'refresh') {
+    await upsertGitHubInstallation(await getAppInstallation(installationId))
+  }
+}
+
+async function markGitHubInstallationStatus(
+  installationId: number,
+  status: 'active' | 'deleted' | 'suspended',
+) {
+  await db
+    .update(githubInstallations)
+    .set({ status, updatedAt: new Date() })
+    .where(eq(githubInstallations.installationId, installationId))
+}
+
+function mapRepository(
+  repo: GitHubRepositoryResponse,
+  installationId: number,
+): GitHubRepository {
+  return {
+    id: repo.id,
+    installationId,
+    name: repo.name,
+    fullName: repo.full_name,
+    owner: repo.owner.login,
+    private: repo.private,
+    defaultBranch: repo.default_branch,
+    updatedAt: repo.updated_at,
+    permissions: {
+      push: repo.permissions?.push ?? false,
+    },
+  }
+}
+
+function mapInstallation(
+  installation: GitHubInstallationResponse,
+): GitHubInstallation {
+  return {
+    id: installation.id,
+    accountId: installation.account.id,
+    accountLogin: installation.account.login,
+    accountType: installation.account.type,
+    repositorySelection: installation.repository_selection,
+    status: installation.suspended_at ? 'suspended' : 'active',
+  }
+}
+
+async function requestInstallationAccessToken({
+  installationId,
+  repositoryId,
+}: {
+  installationId: number
+  repositoryId: number | null
+}) {
+  const jwt = await getGitHubAppJwt()
+  const response = await fetchGitHub(
+    `${githubApiBaseUrl}/app/installations/${installationId}/access_tokens`,
+    {
+      method: 'POST',
+      headers: {
+        ...githubHeaders(jwt),
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({
+        ...(repositoryId ? { repository_ids: [repositoryId] } : {}),
+        permissions: {
+          contents: 'read',
+          metadata: 'read',
+        },
+      }),
+    },
+  )
+
+  if (!response.ok) {
+    throw new GitHubApiError(response.status, await readGitHubError(response))
+  }
+
+  const data = await readGitHubJson<{ token: string; expires_at: string }>(
+    response,
+  )
+
+  return {
+    token: data.token,
+    expiresAt: data.expires_at,
+    installationId,
+  }
+}
+
+class GitHubApiError extends Error {
+  constructor(
+    readonly status: number,
+    message: string,
+  ) {
+    super(message)
+    this.name = 'GitHubApiError'
+  }
+}
+
+function mapCommit(commit: GitHubCommitResponse) {
+  return {
+    sha: commit.sha,
+    message: commit.commit?.message ?? null,
+    authorName: commit.commit?.author?.name ?? null,
+    authoredAt: commit.commit?.author?.date ?? null,
+    url: commit.html_url ?? null,
+  }
+}
+
+async function githubRequest<T>(path: string, accessToken: string): Promise<T> {
+  const response = await fetchGitHub(`${githubApiBaseUrl}${path}`, {
+    headers: githubHeaders(accessToken),
+  })
+
+  if (!response.ok) {
+    throw new Error(await readGitHubError(response))
+  }
+
+  return readGitHubJson<T>(response)
+}
+
+function githubHeaders(accessToken: string) {
+  return {
+    Accept: 'application/vnd.github+json',
+    Authorization: `Bearer ${accessToken}`,
+    'User-Agent': 'devpush',
+    'X-GitHub-Api-Version': '2022-11-28',
+  }
+}
+
+async function getGitHubAppJwt() {
+  if (!config.GITHUB_APP_ID || !config.GITHUB_APP_PRIVATE_KEY) {
+    throw new Error('GitHub App is not configured.')
+  }
+
+  const now = Math.floor(Date.now() / 1000)
+
+  if (cachedJwt && cachedJwt.expiresAt - now > 60) {
+    return cachedJwt.token
+  }
+
+  const privateKey = createPrivateKey(
+    normalizePrivateKey(config.GITHUB_APP_PRIVATE_KEY),
+  )
+  const expiresAt = now + 10 * 60
+  const token = await new SignJWT({})
+    .setProtectedHeader({ alg: 'RS256' })
+    .setIssuedAt(now - 60)
+    .setExpirationTime(expiresAt)
+    .setIssuer(config.GITHUB_APP_ID)
+    .sign(privateKey)
+
+  cachedJwt = { token, expiresAt }
+
+  return token
+}
+
+function normalizePrivateKey(value: string) {
+  const trimmed = value.trim()
+  const unquoted =
+    (trimmed.startsWith('"') && trimmed.endsWith('"')) ||
+    (trimmed.startsWith("'") && trimmed.endsWith("'"))
+      ? trimmed.slice(1, -1)
+      : trimmed
+
+  const withNewlines = unquoted.replace(/\\n/g, '\n')
+  if (withNewlines.includes('\n')) {
+    return withNewlines
+  }
+
+  const singleLinePem = withNewlines.match(
+    /^-----BEGIN ([A-Z ]+)-----(.+)-----END \1-----$/,
+  )
+  if (!singleLinePem) {
+    return withNewlines
+  }
+
+  const [, label, body] = singleLinePem
+  if (label === undefined || body === undefined) return withNewlines
+  const chunks = body.match(/.{1,64}/g) ?? []
+  return [
+    `-----BEGIN ${label}-----`,
+    ...chunks,
+    `-----END ${label}-----`,
+    '',
+  ].join('\n')
+}
+
+async function readGitHubError(response: Response) {
+  try {
+    const body = await readGitHubJson<{ message?: string }>(response)
+
+    if (body.message) {
+      return body.message
+    }
+  } catch {
+    // Fall through to generic HTTP error.
+  }
+
+  return `GitHub request failed with ${response.status}`
+}
+
+function encodeURIComponentRepoName(fullName: string) {
+  return fullName.split('/').map(encodeURIComponent).join('/')
+}
+
+function encodeURIComponentPath(path: string) {
+  return path.split('/').map(encodeURIComponent).join('/')
+}