repo-sdk 0.2.0 → 0.2.1

package/dist/github.d.ts

@@ -57,6 +57,18 @@ interface ListUserInstallationsParams {
   cursor?: string;
   signal?: AbortSignal;
 }
+interface ListInstallationRequestsParams {
+  /** The GitHub App id the installation requests belong to. */
+  appId: string | number;
+  /** PEM-encoded private key of the app, used to sign the app JWT. */
+  privateKey: string;
+  /** GHES API root (`/api/v3`); defaults to `https://api.github.com`. */
+  baseUrl?: string;
+  fetch?: typeof fetch;
+  limit?: number;
+  cursor?: string;
+  signal?: AbortSignal;
+}
 interface GitHubInstallationAccount {
   id: string;
   login: string;
@@ -69,6 +81,16 @@ interface GitHubUserInstallation {
   account?: GitHubInstallationAccount;
   raw: unknown;
 }
+interface GitHubInstallationRequest {
+  id: string;
+  /** Account (organization or user) the installation was requested for. */
+  account?: GitHubInstallationAccount;
+  /** ISO 8601 timestamp of when the request was created. */
+  createdAt: string;
+  /** User who requested the installation. */
+  requester?: GitHubInstallationAccount;
+  raw: unknown;
+}
 /**
  * Lists the GitHub App installations the given user can access
  * (`GET /user/installations`). Standalone by design: the endpoint requires a
@@ -76,9 +98,17 @@ interface GitHubUserInstallation {
  * `github` provider authenticates its requests with.
  */
 declare function listUserInstallations(params: ListUserInstallationsParams): Promise<Page<GitHubUserInstallation>>;
+/**
+ * Lists the pending installation requests of a GitHub App
+ * (`GET /app/installation-requests`) — installations an organization owner has
+ * yet to approve. Standalone by design: the endpoint is authenticated with an
+ * app JWT, a different credential from the installation token the `github`
+ * provider authenticates its requests with.
+ */
+declare function listInstallationRequests(params: ListInstallationRequestsParams): Promise<Page<GitHubInstallationRequest>>;
 //#endregion
 //#region src/providers/github/webhooks.d.ts
 declare function verifyWebhook(params: VerifyWebhookParams): Promise<boolean>;
 declare function parseWebhookEvent(input: Request | IncomingWebhookRequest): Promise<ParsedWebhookEvent>;
 //#endregion
-export { type GitHubAppAuth, type GitHubAuth, type GitHubInstallationAccount, type GitHubInstallationToken, type GitHubProviderOptions, type GitHubRepoProvider, type GitHubTokenAuth, type GitHubUserInstallation, type ListUserInstallationsParams, type VerifyWebhookParams, commitWebUrl, github, listUserInstallations, parseWebhookEvent, verifyWebhook };
+export { type GitHubAppAuth, type GitHubAuth, type GitHubInstallationAccount, type GitHubInstallationRequest, type GitHubInstallationToken, type GitHubProviderOptions, type GitHubRepoProvider, type GitHubTokenAuth, type GitHubUserInstallation, type ListInstallationRequestsParams, type ListUserInstallationsParams, type VerifyWebhookParams, commitWebUrl, github, listInstallationRequests, listUserInstallations, parseWebhookEvent, verifyWebhook };

package/dist/github.js

@@ -77,7 +77,23 @@ const encoder = new TextEncoder();
 function base64UrlJson(value) {
 	return bytesToBase64Url(encoder.encode(JSON.stringify(value)));
 }
-async function createJwt(key, appId) {
+/**
+* Mints a short-lived RS256 JWT signed with the app private key — the
+* credential for app-level endpoints (`/app/…`), which installation and user
+* tokens cannot access. Internal to the package: not exported from the
+* `repo-sdk/github` barrel.
+*/
+async function createAppJwt(options) {
+	let key;
+	try {
+		key = await importPrivateKey(options.privateKey);
+	} catch (error) {
+		throw new RepoError("GitHub App private key is not a valid PEM-encoded RSA private key", {
+			provider: "github",
+			code: "validation",
+			cause: error
+		});
+	}
 	const now = Math.floor(Date.now() / 1e3);
 	const signingInput = `${base64UrlJson({
 		alg: "RS256",
@@ -85,7 +101,7 @@ async function createJwt(key, appId) {
 	})}.${base64UrlJson({
 		iat: now - 60,
 		exp: now + 540,
-		iss: appId
+		iss: String(options.appId)
 	})}`;
 	const signature = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", key, encoder.encode(signingInput));
 	return `${signingInput}.${bytesToBase64Url(new Uint8Array(signature))}`;
@@ -94,8 +110,9 @@ async function createJwt(key, appId) {
 * Mints and caches GitHub App installation access tokens. A short-lived RS256
 * JWT (signed with the app private key) authenticates the app-level calls that
 * resolve the installation and mint installation tokens; the installation token
-* is cached and refreshed once it nears expiry. A fresh JWT is minted per token
-* refresh (cheap, and refreshes are rare given the ~1h token TTL).
+* is cached and refreshed once it nears expiry. A fresh key import and JWT go
+* into every token refresh (cheap, and refreshes are rare given the ~1h token
+* TTL).
 */
 var AppTokenSource = class {
 	kind = "app";
@@ -107,7 +124,6 @@ var AppTokenSource = class {
 	userAgent;
 	installationId;
 	owner;
-	keyPromise;
 	cached;
 	refresh;
 	constructor(options) {
@@ -153,7 +169,10 @@ var AppTokenSource = class {
 		return this.refresh;
 	}
 	async mintInstallationToken() {
-		const jwt = await this.createAppJwt();
+		const jwt = await createAppJwt({
+			appId: this.appId,
+			privateKey: this.privateKey
+		});
 		const installationId = await this.resolveInstallationId(jwt);
 		const data = await this.appRequest(`/app/installations/${installationId}/access_tokens`, "POST", jwt);
 		const token = {
@@ -199,10 +218,6 @@ var AppTokenSource = class {
 		});
 		return String(installations[0].id);
 	}
-	createAppJwt() {
-		if (!this.keyPromise) this.keyPromise = importPrivateKey(this.privateKey);
-		return this.keyPromise.then((key) => createJwt(key, this.appId));
-	}
 	async appRequest(path, method, jwt) {
 		const url = joinUrl(this.baseUrl, path);
 		const { fetchImpl } = this;
@@ -864,42 +879,47 @@ function github(options) {
 }
 //#endregion
 //#region src/providers/github/installations.ts
+function toAccount(payload) {
+	if (payload?.login === void 0) return void 0;
+	return {
+		id: String(payload.id),
+		login: payload.login,
+		kind: payload.type === "Organization" ? "organization" : "user",
+		avatarUrl: payload.avatar_url
+	};
+}
 function toInstallation(payload) {
-	const account = payload.account;
 	return {
 		id: String(payload.id),
-		account: account?.login === void 0 ? void 0 : {
-			id: String(account.id),
-			login: account.login,
-			kind: account.type === "Organization" ? "organization" : "user",
-			avatarUrl: account.avatar_url
-		},
+		account: toAccount(payload.account),
 		raw: payload
 	};
 }
-/**
-* Lists the GitHub App installations the given user can access
-* (`GET /user/installations`). Standalone by design: the endpoint requires a
-* user access token, a different credential from the installation token the
-* `github` provider authenticates its requests with.
-*/
-async function listUserInstallations(params) {
-	const { token } = params;
+function toInstallationRequest(payload) {
+	return {
+		id: String(payload.id),
+		account: toAccount(payload.account),
+		createdAt: payload.created_at,
+		requester: toAccount(payload.requester),
+		raw: payload
+	};
+}
+async function listPage(bearer, defaultPath, params, toItems) {
 	const baseUrl = params.baseUrl ?? "https://api.github.com";
 	const http = new HttpClient({
 		provider: "github",
 		baseUrl,
 		fetchImpl: params.fetch,
 		authHeaders: () => ({
-			Authorization: `Bearer ${token}`,
+			Authorization: `Bearer ${bearer}`,
 			Accept: "application/vnd.github+json",
 			"X-GitHub-Api-Version": API_VERSION,
 			"User-Agent": USER_AGENT
 		}),
 		mapError,
-		secrets: () => [token]
+		secrets: () => [bearer]
 	});
-	let path = "/user/installations";
+	let path = defaultPath;
 	let query;
 	if (params.cursor) {
 		const { url } = decodeCursor("github", params.cursor);
@@ -910,10 +930,32 @@ async function listUserInstallations(params) {
 		signal: params.signal
 	});
 	return {
-		data: (data.installations ?? []).map(toInstallation),
+		data: toItems(data),
 		cursor: nextCursor(response)
 	};
 }
+/**
+* Lists the GitHub App installations the given user can access
+* (`GET /user/installations`). Standalone by design: the endpoint requires a
+* user access token, a different credential from the installation token the
+* `github` provider authenticates its requests with.
+*/
+async function listUserInstallations(params) {
+	return listPage(params.token, "/user/installations", params, (payload) => (payload.installations ?? []).map(toInstallation));
+}
+/**
+* Lists the pending installation requests of a GitHub App
+* (`GET /app/installation-requests`) — installations an organization owner has
+* yet to approve. Standalone by design: the endpoint is authenticated with an
+* app JWT, a different credential from the installation token the `github`
+* provider authenticates its requests with.
+*/
+async function listInstallationRequests(params) {
+	return listPage(await createAppJwt({
+		appId: params.appId,
+		privateKey: params.privateKey
+	}), "/app/installation-requests", params, (payload) => payload.map(toInstallationRequest));
+}
 //#endregion
 //#region src/providers/github/webhooks.ts
 function verifyWebhook(params) {
@@ -949,4 +991,4 @@ async function parseWebhookEvent(input) {
 	};
 }
 //#endregion
-export { commitWebUrl, github, listUserInstallations, parseWebhookEvent, verifyWebhook };
+export { commitWebUrl, github, listInstallationRequests, listUserInstallations, parseWebhookEvent, verifyWebhook };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "repo-sdk",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Unified TypeScript SDK for git providers — GitHub, GitLab, Bitbucket, Azure DevOps, Gitea",
   "license": "MIT",
   "author": "Robin Genz <mail@robingenz.dev>",