yatfa 1.0.79 → 1.0.81

package/setup/setup-github.rb

@@ -0,0 +1,222 @@
+# frozen_string_literal: true
+
+# GitHub authentication and gh CLI wrapper setup
+# Extracted from setup-agent.rb for modularity
+
+def setup_github_auth!
+  rails_api_url = ENV["YATFA_API_URL"]
+  rails_api_key = ENV["YATFA_API_KEY"]
+
+  # Derive YATFA_API_URL from YATFA_URL if not set
+  unless rails_api_url && !rails_api_url.empty?
+    yatfa_url = ENV["YATFA_URL"]
+    if yatfa_url && !yatfa_url.empty?
+      rails_api_url = "#{yatfa_url}/api/v1"
+      ENV["YATFA_API_URL"] = rails_api_url
+    end
+  end
+
+  # Validate YATFA_API_URL format before proceeding
+  if rails_api_url && !rails_api_url.empty? && !rails_api_url.include?('/api/v1')
+    puts "⚠️  Warning: YATFA_API_URL must include /api/v1 path"
+    puts "   Current: #{rails_api_url}"
+    puts "   Expected: https://example.com/api/v1"
+    puts "   Falling back to alternative authentication..."
+    rails_api_url = nil  # Clear it to fall through to other methods
+  end
+
+  # New method: Get token from Rails backend (preferred)
+  if rails_api_url && !rails_api_url.empty? && rails_api_key && !rails_api_key.empty?
+    puts "🔐 Configuring GitHub App authentication (via backend)..."
+
+    # Create helper script that calls backend API
+    helper_content = <<~RUBY
+      #!/usr/bin/env ruby
+      require 'json'
+      require 'net/http'
+      require 'uri'
+      require 'time'
+
+      def get_token_from_backend
+        rails_api_url = ENV['YATFA_API_URL']
+        rails_api_key = ENV['YATFA_API_KEY']
+
+        unless rails_api_url && rails_api_key
+          STDERR.puts "❌ Error: YATFA_API_URL or YATFA_API_KEY not set"
+          exit 1
+        end
+
+        # Build GitHub token endpoint URL
+        token_url = "#{rails_api_url.chomp('/')}/github/token"
+
+        uri = URI(token_url)
+        http = Net::HTTP.new(uri.host, uri.port)
+        http.use_ssl = uri.scheme == 'https'
+        http.open_timeout = 5
+        http.read_timeout = 10
+
+        request = Net::HTTP::Get.new(uri)
+        request['X-API-Key'] = rails_api_key
+        request['Accept'] = 'application/json'
+
+        response = http.request(request)
+
+        unless response.is_a?(Net::HTTPSuccess)
+          # Silent failure for git credential helper - let git try other auth methods
+          exit 0
+        end
+
+        data = JSON.parse(response.body)
+        token = data['token']
+
+        unless token
+          STDERR.puts "❌ Error: No token in backend response"
+          exit 1
+        end
+
+        data  # Return full response including expires_at
+      rescue Net::OpenTimeout, Net::ReadTimeout => e
+        STDERR.puts "❌ Error: Backend API timeout: \#{e.message}"
+        exit 1
+      rescue StandardError => e
+        STDERR.puts "❌ Error: \#{e.class} - \#{e.message}"
+        exit 1
+      end
+
+      def find_or_create_cached_token
+        cache_file = '/tmp/github-app-token-cache'
+        cached_token = read_cached_token(cache_file)
+        return cached_token if cached_token
+
+        token_data = get_token_from_backend
+        expires_at = token_data['expires_at'] ? Time.parse(token_data['expires_at']) : (Time.now + 3600 - 300)
+        token = token_data['token']
+
+        cache_data = {
+          token: token,
+          expires_at: expires_at.iso8601
+        }
+        File.write(cache_file, cache_data.to_json)
+        token
+      end
+
+      def read_cached_token(cache_file)
+        return nil unless File.exist?(cache_file)
+        cache = JSON.parse(File.read(cache_file))
+        return nil if cache['token'].nil? || cache['expires_at'].nil?
+        return cache['token'] if Time.parse(cache['expires_at']) > Time.now + 300
+        nil
+      rescue JSON::ParserError
+        nil
+      end
+
+      puts find_or_create_cached_token
+    RUBY
+
+    # Install helper via sudo to /usr/local/bin
+    helper_path = "/usr/local/bin/git-auth-helper"
+    File.write("/tmp/git-auth-helper", helper_content)
+    system("sudo mv /tmp/git-auth-helper #{helper_path}")
+    system("sudo chmod +x #{helper_path}")
+
+    # Configure git
+    system("git config --global credential.helper '!f() { test \"$1\" = get && echo \"protocol=https\" && echo \"host=github.com\" && echo \"username=x-access-token\" && echo \"password=$(#{helper_path})\"; }; f'")
+
+    # Configure gh CLI wrapper for auto-refresh and permission controls
+    if install_gh_wrapper!(real_gh_path: "/usr/bin/gh", with_token_refresh: true, token_helper_path: helper_path)
+      puts "✅ GitHub App authentication configured (via backend with auto-refresh + permission controls)"
+    end
+
+  elsif ENV["GH_TOKEN"] && !ENV["GH_TOKEN"].empty?
+    puts "🔑 Using GitHub token authentication (fallback method)"
+    real_gh_path = "/usr/bin/gh"
+
+    # Authenticate using the real gh binary
+    # On first run: real_gh_path exists, authenticate before wrapper installation
+    # On subsequent runs: real_gh_path.real exists from previous run
+    if File.exist?("#{real_gh_path}.real")
+      system("echo '#{ENV['GH_TOKEN']}' | #{real_gh_path}.real auth login --with-token 2>/dev/null")
+    elsif File.exist?(real_gh_path)
+      system("echo '#{ENV['GH_TOKEN']}' | #{real_gh_path} auth login --with-token 2>/dev/null")
+    end
+
+    # Install wrapper for permission controls even with GH_TOKEN
+    if install_gh_wrapper!(real_gh_path: real_gh_path)
+      puts "🔐 GitHub authentication configured (with permission controls)"
+    else
+      puts "🔐 GitHub authentication configured"
+    end
+  else
+    puts "⚠️  No YATFA_API_KEY or GH_TOKEN - GitHub operations will fail"
+  end
+end
+
+def install_gh_wrapper!(real_gh_path:, with_token_refresh: false, token_helper_path: nil)
+  unless File.exist?(real_gh_path)
+    puts "⚠️  Could not find 'gh' at #{real_gh_path}, skipping wrapper"
+    return false
+  end
+
+  # Move real gh to gh.real if not already done
+  unless File.exist?("#{real_gh_path}.real")
+    system("sudo mv #{real_gh_path} #{real_gh_path}.real")
+  end
+
+  wrapper_path = "/usr/local/bin/gh"
+
+  # Build token export line if auto-refresh is enabled
+  token_export = with_token_refresh ? "export GH_TOKEN=$(#{token_helper_path})\n\n" : ""
+
+  wrapper_content = <<~BASH
+    #!/bin/bash
+    # GitHub CLI wrapper with permission controls for agents
+    #{token_export}# Verify GH_TOKEN is set if using auto-refresh
+    if [ -n "$AGENT_TYPE" ] && [ "#{with_token_refresh}" = "true" ] && [ -z "$GH_TOKEN" ]; then
+      echo "❌ GitHub authentication failed: token helper returned empty value" >&2
+      echo "   Check that GITHUB_APP_CLIENT_ID and GITHUB_APP_INSTALLATION_ID are set" >&2
+      echo "   Run 'git-auth-helper' to test the token helper directly" >&2
+      exit 1
+    fi
+
+    # Check if caller is an agent (read AGENT_TYPE at runtime)
+    if [ -n "$AGENT_TYPE" ] && [[ "$AGENT_TYPE" =~ ^(worker|planner|reviewer|researcher)$ ]]; then
+      # Block comment-related commands for agents
+      if [[ "$1" == "comment" ]] || ([[ "$1" == "pr" ]] && [[ "$2" == "comment" ]]); then
+        echo "❌ You cannot use 'gh $*' commands as an agent." >&2
+        echo "" >&2
+        echo "Yatfa has its own comment system via the add_comment MCP tool." >&2
+        echo "Please use the add_comment tool instead of gh commands." >&2
+        echo "" >&2
+        echo "Example:" >&2
+        echo "  add_comment(ticket_id: 123, content: \\"Your comment here\\", comment_type: \\"note\\")" >&2
+        exit 1
+      fi
+
+      # Block pr create for agents - they should use the create_pull_request MCP tool
+      if [[ "$1" == "pr" ]] && [[ "$2" == "create" ]]; then
+        echo "❌ You cannot use 'gh pr create' as an agent." >&2
+        echo "" >&2
+        echo "Yatfa has its own PR creation system via the create_pull_request MCP tool." >&2
+        echo "This automatically attaches PRs to tickets and adds metadata footers." >&2
+        echo "" >&2
+        echo "Example:" >&2
+        echo "  create_pull_request(" >&2
+        echo "    ticket_id: 123," >&2
+        echo "    repository_id: 1," >&2
+        echo "    title: \\"Fix authentication bug\\"," >&2
+        echo "    body: \\"Description of changes\\"," >&2
+        echo "    branch: \\"feature/123-fix-auth\\"" >&2
+        echo "  )" >&2
+        exit 1
+      fi
+    fi
+
+    # Execute real gh binary with all arguments
+    exec #{real_gh_path}.real "$@"
+  BASH
+
+  File.write("/tmp/gh-wrapper", wrapper_content)
+  system("sudo mv /tmp/gh-wrapper #{wrapper_path}")
+  system("sudo chmod +x #{wrapper_path}")
+  true
+end