bazaar-contrib-server-github 0.3.0rc1__tar.gz

bazaar_contrib_server_github-0.3.0rc1/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

bazaar_contrib_server_github-0.3.0rc1/PKG-INFO

@@ -0,0 +1,33 @@
+Metadata-Version: 2.4
+Name: bazaar-contrib-server-github
+Version: 0.3.0rc1
+Summary: Logging in to the Bazaar Compute server with a GitHub account
+License-Expression: Apache-2.0
+License-File: LICENSE
+Requires-Dist: aiohttp>=3.12.0
+Requires-Dist: bazaar-core~=0.3.0rc1
+Requires-Dist: bazaar-contrib-http~=0.3.0rc1
+Requires-Dist: bazaar-contrib-schema~=0.3.0rc1
+Requires-Dist: bazaar-contrib-storage~=0.3.0rc1
+Requires-Dist: bazaar-contrib-server~=0.3.0rc3
+Requires-Dist: bazaar-contrib-server-access~=0.3.0rc2
+Requires-Dist: bazaar-contrib-server-database~=0.3.0rc1
+Requires-Dist: pydantic>=2.12.0
+Requires-Dist: python-multipart>=0.0.32
+Requires-Dist: starlette>=0.48.0
+Requires-Python: >=3.15
+Project-URL: Repository, https://github.com/open-bazaar/contrib-server-github
+Description-Content-Type: text/markdown
+
+# bazaar-contrib-server-github
+
+Logging in to the Bazaar Compute server with a GitHub account.
+
+```toml
+[[contribs]]
+package = "bazaar-contrib-server-github~=0.3.0rc1"
+[[contribs.enabled]]
+entry = "server-github"
+```
+
+Create an OAuth App on GitHub, then fill in its Client ID and Client Secret under Settings › Login methods, where the callback URL to give the app is shown.

bazaar_contrib_server_github-0.3.0rc1/README.md

@@ -0,0 +1,12 @@
+# bazaar-contrib-server-github
+
+Logging in to the Bazaar Compute server with a GitHub account.
+
+```toml
+[[contribs]]
+package = "bazaar-contrib-server-github~=0.3.0rc1"
+[[contribs.enabled]]
+entry = "server-github"
+```
+
+Create an OAuth App on GitHub, then fill in its Client ID and Client Secret under Settings › Login methods, where the callback URL to give the app is shown.

bazaar_contrib_server_github-0.3.0rc1/pyproject.toml

@@ -0,0 +1,72 @@
+[project]
+name = "bazaar-contrib-server-github"
+version = "0.3.0rc1"
+description = "Logging in to the Bazaar Compute server with a GitHub account"
+readme = "README.md"
+license = "Apache-2.0"
+license-files = ["LICENSE"]
+requires-python = ">=3.15"
+dependencies = [
+    "aiohttp>=3.12.0",
+    "bazaar-core~=0.3.0rc1",
+    "bazaar-contrib-http~=0.3.0rc1",
+    "bazaar-contrib-schema~=0.3.0rc1",
+    "bazaar-contrib-storage~=0.3.0rc1",
+    "bazaar-contrib-server~=0.3.0rc3",
+    "bazaar-contrib-server-access~=0.3.0rc2",
+    "bazaar-contrib-server-database~=0.3.0rc1",
+    "pydantic>=2.12.0",
+    "python-multipart>=0.0.32",
+    "starlette>=0.48.0",
+]
+
+[project.entry-points."bazaar_compute_node.contribs"]
+server-github = "bazaar_contrib_server_github:github"
+
+[project.urls]
+Repository = "https://github.com/open-bazaar/contrib-server-github"
+
+[build-system]
+requires = ["uv_build>=0.13.0,<0.14.0"]
+build-backend = "uv_build"
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = "-p no:anyio"
+asyncio_mode = "auto"
+asyncio_default_fixture_loop_scope = "function"
+
+[tool.pyright]
+include = [
+    "src",
+    "tests",
+    "scripts",
+]
+pythonVersion = "3.15"
+pythonPlatform = "All"
+venvPath = "."
+venv = ".venv"
+typeCheckingMode = "basic"
+reportMatchNotExhaustive = "error"
+reportUnreachable = "warning"
+reportUnusedFunction = "warning"
+reportUnusedVariable = "warning"
+
+[tool.ruff.lint]
+extend-select = ["ASYNC"]
+
+[dependency-groups]
+dev = [
+    "bazaar-contrib-server-migrations~=0.3.0rc2",
+    "bazaar-contrib-sqlite~=0.3.0rc1",
+    "bazaar-contrib-timer-wheel~=0.3.0rc1",
+    "blockbuster>=1.5.29,<1.6",
+    "httpx>=0.28.0,<1",
+    "playwright>=1.55.0",
+    "pyright==1.1.414",
+    "pytest>=8.3.0",
+    "pytest-asyncio>=0.24.0",
+    "ruff>=0.9.0",
+    "trustme>=1.2.0",
+    "uvicorn>=0.38.0",
+]

bazaar_contrib_server_github-0.3.0rc1/pyproject.toml.orig

@@ -0,0 +1,68 @@
+[project]
+name = "bazaar-contrib-server-github"
+version = "0.3.0rc1"
+description = "Logging in to the Bazaar Compute server with a GitHub account"
+readme = "README.md"
+license = "Apache-2.0"
+license-files = ["LICENSE"]
+requires-python = ">=3.15"
+dependencies = [
+    "aiohttp>=3.12.0",
+    "bazaar-core~=0.3.0rc1",
+    "bazaar-contrib-http~=0.3.0rc1",
+    "bazaar-contrib-schema~=0.3.0rc1",
+    "bazaar-contrib-storage~=0.3.0rc1",
+    "bazaar-contrib-server~=0.3.0rc3",
+    "bazaar-contrib-server-access~=0.3.0rc2",
+    "bazaar-contrib-server-database~=0.3.0rc1",
+    "pydantic>=2.12.0",
+    "python-multipart>=0.0.32",
+    "starlette>=0.48.0",
+]
+
+[project.entry-points."bazaar_compute_node.contribs"]
+server-github = "bazaar_contrib_server_github:github"
+
+[project.urls]
+Repository = "https://github.com/open-bazaar/contrib-server-github"
+
+[build-system]
+requires = ["uv_build>=0.13.0,<0.14.0"]
+build-backend = "uv_build"
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = "-p no:anyio"
+asyncio_mode = "auto"
+asyncio_default_fixture_loop_scope = "function"
+
+[tool.pyright]
+include = ["src", "tests", "scripts"]
+pythonVersion = "3.15"
+pythonPlatform = "All"
+venvPath = "."
+venv = ".venv"
+typeCheckingMode = "basic"
+reportMatchNotExhaustive = "error"
+reportUnreachable = "warning"
+reportUnusedFunction = "warning"
+reportUnusedVariable = "warning"
+
+[tool.ruff.lint]
+extend-select = ["ASYNC"]
+
+[dependency-groups]
+dev = [
+    "bazaar-contrib-server-migrations~=0.3.0rc2",
+    "bazaar-contrib-sqlite~=0.3.0rc1",
+    "bazaar-contrib-timer-wheel~=0.3.0rc1",
+    "blockbuster>=1.5.29,<1.6",
+    "httpx>=0.28.0,<1",
+    "playwright>=1.55.0",
+    "pyright==1.1.414",
+    "pytest>=8.3.0",
+    "pytest-asyncio>=0.24.0",
+    "ruff>=0.9.0",
+    "trustme>=1.2.0",
+    "uvicorn>=0.38.0",
+]

bazaar_contrib_server_github-0.3.0rc1/src/bazaar_contrib_server_github/__init__.py

@@ -0,0 +1,69 @@
+"""Logging in to the server with a GitHub account, through the OAuth App set on
+the login methods part of the settings page."""
+
+from __future__ import annotations
+
+from contextlib import asynccontextmanager
+lazy import asyncio
+lazy import ssl
+lazy from collections.abc import AsyncIterator
+lazy from importlib.resources import files
+lazy from pathlib import Path
+
+from bazaar_contrib_server import SERVER
+from bazaar_contrib_server_access import ACCESS
+from bazaar_contrib_server_database import SERVER_DB, SERVER_SCHEMA
+from bazaar_contrib_server_migrations import SERVER_MIGRATIONS
+from bazaar_core import Context, Contrib
+lazy import aiohttp
+
+lazy from .client import GitHub
+lazy from .method import GitHubLogin
+lazy from .schema import MODULE
+lazy from .settings import Settings
+
+__all__ = ["github"]
+
+SITE = "https://github.com"
+API = "https://api.github.com"
+
+
+@asynccontextmanager
+async def _github(
+    ctx: Context,
+    *,
+    site: str = SITE,
+    api: str = API,
+    context: ssl.SSLContext | None = None,
+) -> AsyncIterator[None]:
+    server = ctx.accept(SERVER)
+    access = ctx.accept(ACCESS)
+    database = ctx.accept(SERVER_DB)
+    async with ctx.accept(SERVER_SCHEMA).register(MODULE):
+        resources = Path(str(files(__name__))) / "resources"
+        icon = await asyncio.to_thread(
+            (resources / "templates" / "github" / "github.svg").read_text,
+            encoding="utf-8",
+        )
+        pages = await server.pages("github", __name__)
+        verified = context or await asyncio.to_thread(ssl.create_default_context)
+        async with aiohttp.ClientSession(
+            connector=aiohttp.TCPConnector(ssl=verified)
+        ) as session:
+            login = GitHubLogin(access, database, GitHub(session, site, api), icon)
+            async with (
+                server.module(
+                    "github",
+                    ui=Settings(pages, access, database).app,
+                    static=resources / "static",
+                    locales=resources / "locales",
+                ),
+                access.method(login),
+            ):
+                yield
+
+
+github = Contrib(
+    accepts=[SERVER, SERVER_DB, SERVER_SCHEMA, SERVER_MIGRATIONS, ACCESS],
+    lifespan=_github,
+)

bazaar_contrib_server_github-0.3.0rc1/src/bazaar_contrib_server_github/client.py

@@ -0,0 +1,145 @@
+"""GitHub as a login sees it: where a person approves the login, and what the
+site answers for a code and its API for a token."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+lazy from typing import Any
+lazy from urllib.parse import urlencode
+
+lazy import aiohttp
+lazy from bazaar_contrib_server_access import Refused, Unavailable
+
+# the API version the answers below are read as
+_API = {
+    "Accept": "application/vnd.github+json",
+    "X-GitHub-Api-Version": "2022-11-28",
+}
+
+
+@dataclass(frozen=True, slots=True)
+class Grant:
+    """What GitHub hands over for a code or a refresh token: the access token
+    and, when the app's tokens expire, the token that renews it."""
+
+    access: str
+    refresh: str | None
+
+
+@dataclass(frozen=True, slots=True)
+class User:
+    id: str
+    login: str
+    # the profile's name, or the login when it has none
+    name: str
+    avatar: str | None
+
+
+class GitHub:
+    """github.com and its API, at the addresses it is given."""
+
+    def __init__(self, session: aiohttp.ClientSession, site: str, api: str) -> None:
+        self._session = session
+        self._site = site
+        self._api = api
+
+    def authorize(
+        self, client_id: str, redirect_uri: str, state: str, challenge: str
+    ) -> str:
+        return f"{self._site}/login/oauth/authorize?" + urlencode(
+            {
+                "client_id": client_id,
+                "redirect_uri": redirect_uri,
+                "scope": "read:user user:email",
+                "state": state,
+                "code_challenge": challenge,
+                "code_challenge_method": "S256",
+            }
+        )
+
+    async def token(
+        self,
+        client_id: str,
+        client_secret: str,
+        code: str,
+        redirect_uri: str,
+        verifier: str,
+    ) -> Grant:
+        return await self._grant(
+            {
+                "client_id": client_id,
+                "client_secret": client_secret,
+                "code": code,
+                "redirect_uri": redirect_uri,
+                "code_verifier": verifier,
+            }
+        )
+
+    async def refresh(self, client_id: str, client_secret: str, refresh: str) -> Grant:
+        """A new access token, and a new refresh token in place of this one."""
+        return await self._grant(
+            {
+                "client_id": client_id,
+                "client_secret": client_secret,
+                "grant_type": "refresh_token",
+                "refresh_token": refresh,
+            }
+        )
+
+    async def _grant(self, data: dict[str, str]) -> Grant:
+        try:
+            async with self._session.post(
+                f"{self._site}/login/oauth/access_token",
+                data=data,
+                headers={"Accept": "application/json"},
+            ) as response:
+                if response.status >= 500:
+                    raise Unavailable
+                answer = await response.json(content_type=None)
+        except aiohttp.ClientError, ValueError:
+            raise Unavailable from None
+        # what is wrong, used or expired is answered 200 with an error
+        access = answer.get("access_token") if isinstance(answer, dict) else None
+        if not isinstance(access, str) or not access:
+            raise Refused
+        refresh = answer.get("refresh_token")
+        return Grant(access, refresh if isinstance(refresh, str) and refresh else None)
+
+    async def user(self, token: str) -> User | None:
+        """Whom the token is for; nothing once it no longer holds."""
+        answer = await self._get("/user", token)
+        if answer is None:
+            return None
+        login = str(answer["login"])
+        return User(
+            id=str(answer["id"]),
+            login=login,
+            name=str(answer.get("name") or login),
+            avatar=answer.get("avatar_url") or None,
+        )
+
+    async def email(self, token: str) -> str | None:
+        """The primary address, once verified."""
+        answer = await self._get("/user/emails", token)
+        return next(
+            (
+                str(entry["email"])
+                for entry in answer or ()
+                if entry.get("primary") and entry.get("verified")
+            ),
+            None,
+        )
+
+    async def _get(self, path: str, token: str) -> Any:
+        try:
+            async with self._session.get(
+                f"{self._api}{path}",
+                headers=_API | {"Authorization": f"Bearer {token}"},
+            ) as response:
+                if response.status == 401:
+                    return None
+                if response.status != 200:
+                    raise Unavailable
+                return await response.json()
+        except aiohttp.ClientError, ValueError:
+            raise Unavailable from None

bazaar_contrib_server_github-0.3.0rc1/src/bazaar_contrib_server_github/method.py

@@ -0,0 +1,261 @@
+"""Logging in with GitHub: setting off to approve on GitHub, coming back with a
+code, the account each GitHub user logs in as, and asking GitHub again when a
+session runs out."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+lazy import asyncio
+lazy from collections.abc import Awaitable, Mapping
+lazy from time import time_ns
+lazy from typing import cast
+
+from bazaar_contrib_http import redact
+from starlette.applications import Starlette
+from starlette.requests import Request
+from starlette.responses import Response
+from starlette.routing import Route
+from starlette.types import ASGIApp
+lazy from bazaar_contrib_server_access import (
+    Access,
+    Authorization,
+    Confirmed,
+    Refused,
+    Unavailable,
+)
+lazy from bazaar_contrib_storage import (
+    Column,
+    Compare,
+    Database,
+    Insert,
+    Select,
+    Session,
+    Update,
+    Value,
+)
+
+lazy from .client import GitHub, Grant, User
+lazy from .settings import Configured, configured
+
+KEY = "github"
+
+
+@dataclass
+class GitHubLogin:
+    access: Access
+    database: Database
+    github: GitHub
+    icon: str
+
+    app: ASGIApp = field(init=False)
+    # GitHub takes a refresh token back once it is used: the requests that
+    # find an account's access token out of date at the same time wait for one
+    # refresh between them
+    _refreshing: dict[str, asyncio.Future[str | None]] = field(
+        init=False, default_factory=dict
+    )
+
+    key = KEY
+    name = "github.name"
+    description = "github.description"
+    settings = "/ui/github/"
+
+    def __post_init__(self) -> None:
+        self.app = Starlette(
+            routes=[Route("/", self._start), Route("/callback", self._callback)]
+        )
+
+    async def ready(self) -> bool:
+        return await configured(self.database) is not None
+
+    async def roles(self) -> set[str]:
+        settings = await configured(self.database)
+        return (
+            {settings.default_role_id}
+            if settings is not None and settings.default_role_id is not None
+            else set()
+        )
+
+    async def renew(self, account_id: str) -> Confirmed | None:
+        held = await self._held(account_id)
+        settings = await configured(self.database)
+        if held is None or settings is None:
+            return None
+        user = await self.github.user(cast(str, held["token"]))
+        if user is None and held["refresh_token"] is not None:
+            token = await self._refreshed(
+                settings, account_id, cast(str, held["token"])
+            )
+            user = None if token is None else await self.github.user(token)
+        if user is None or user.id != held["github_id"]:
+            return None
+        await self.database.write(
+            lambda session: session.update(
+                Update(
+                    table="github_accounts",
+                    values={
+                        "login": Value(value=user.login),
+                        "name": Value(value=user.name),
+                        "avatar_url": Value(value=user.avatar),
+                        "updated_at_ms": Value(value=time_ns() // 1_000_000),
+                    },
+                    where=_equals("github_id", user.id),
+                )
+            )
+        )
+        return Confirmed(account_id, user.name, user.avatar, settings.session_minutes)
+
+    async def _held(self, account_id: str) -> Mapping[str, object] | None:
+        rows = await self.database.read(
+            lambda session: session.select(
+                Select(table="github_accounts", where=_equals("account_id", account_id))
+            )
+        )
+        return rows[0] if rows else None
+
+    def _refreshed(
+        self, settings: Configured, account_id: str, stale: str
+    ) -> Awaitable[str | None]:
+        """The access token in place of the stale one; nothing once GitHub
+        takes the authorization back."""
+        refreshing = self._refreshing.get(account_id)
+        if refreshing is None:
+            refreshing = self._refreshing[account_id] = asyncio.ensure_future(
+                self._refresh(settings, account_id, stale)
+            )
+            refreshing.add_done_callback(
+                lambda _: self._refreshing.pop(account_id, None)
+            )
+        # one waiting request given up leaves the refresh to the others
+        return asyncio.shield(refreshing)
+
+    async def _refresh(
+        self, settings: Configured, account_id: str, stale: str
+    ) -> str | None:
+        held = await self._held(account_id)
+        if held is None:
+            return None
+        # refreshed by a request before this one
+        if held["token"] != stale:
+            return cast(str, held["token"])
+        try:
+            grant = await self.github.refresh(
+                settings.client_id,
+                settings.client_secret,
+                cast(str, held["refresh_token"]),
+            )
+        except Refused:
+            return None
+        await self.database.write(
+            lambda session: session.update(
+                Update(
+                    table="github_accounts",
+                    values={
+                        "token": Value(value=grant.access),
+                        "refresh_token": Value(value=grant.refresh),
+                        "updated_at_ms": Value(value=time_ns() // 1_000_000),
+                    },
+                    where=_equals("account_id", account_id),
+                )
+            )
+        )
+        return grant.access
+
+    async def _start(self, request: Request) -> Response:
+        async def authorize(authorization: Authorization) -> str:
+            settings = await configured(self.database)
+            if settings is None:
+                raise Unavailable
+            return self.github.authorize(
+                settings.client_id,
+                settings.redirect_uri,
+                authorization.state,
+                authorization.challenge,
+            )
+
+        return await self.access.start(request, KEY, authorize)
+
+    @redact("code", "state")
+    async def _callback(self, request: Request) -> Response:
+        return await self.access.finish(request, KEY, self._confirm)
+
+    async def _confirm(
+        self, authorization: Authorization, query: Mapping[str, str]
+    ) -> Confirmed:
+        # declined on GitHub, or nothing to redeem
+        code = query.get("code", "")
+        if "error" in query or not code:
+            raise Refused
+        settings = await configured(self.database)
+        if settings is None:
+            raise Unavailable
+        grant = await self.github.token(
+            settings.client_id,
+            settings.client_secret,
+            code,
+            settings.redirect_uri,
+            authorization.verifier,
+        )
+        user = await self.github.user(grant.access)
+        if user is None:
+            raise Refused
+        email = await self.github.email(grant.access)
+
+        async def remember(session: Session) -> str:
+            return await self._remember(session, settings, user, email, grant)
+
+        account_id = await self.database.transaction(remember)
+        return Confirmed(account_id, user.name, user.avatar, settings.session_minutes)
+
+    async def _remember(
+        self,
+        session: Session,
+        settings: Configured,
+        user: User,
+        email: str | None,
+        grant: Grant,
+    ) -> str:
+        """The account the GitHub user logs in as, made on the first login."""
+        now = time_ns() // 1_000_000
+        known = await session.select(
+            Select(table="github_accounts", where=_equals("github_id", user.id))
+        )
+        profile = {
+            "login": user.login,
+            "name": user.name,
+            "email": email,
+            "avatar_url": user.avatar,
+            "token": grant.access,
+            "refresh_token": grant.refresh,
+            "updated_at_ms": now,
+        }
+        if known:
+            await session.update(
+                Update(
+                    table="github_accounts",
+                    values={
+                        name: Value(value=value) for name, value in profile.items()
+                    },
+                    where=_equals("github_id", user.id),
+                )
+            )
+            return cast(str, known[0]["account_id"])
+        account_id = await self.access.enroll(session, KEY, settings.default_role_id)
+        await session.insert(
+            Insert(
+                table="github_accounts",
+                rows=(
+                    {
+                        "github_id": user.id,
+                        "account_id": account_id,
+                        "created_at_ms": now,
+                    }
+                    | profile,
+                ),
+            )
+        )
+        return account_id
+
+
+def _equals(column: str, value: str) -> Compare:
+    return Compare(left=Column(name=column), operator="=", right=Value(value=value))

bazaar_contrib_server_github-0.3.0rc1/src/bazaar_contrib_server_github/resources/THIRD_PARTY.md

@@ -0,0 +1,6 @@
+# Third-party assets
+
+## Simple Icons 16.31.0
+- Source: https://registry.npmjs.org/simple-icons/-/simple-icons-16.31.0.tgz (`icons/github.svg`)
+- License: CC0-1.0; the GitHub mark is GitHub's
+- Used in: `templates/github/github.svg`, the mark drawn on a dark tile

bazaar_contrib_server_github-0.3.0rc1/src/bazaar_contrib_server_github/resources/locales/en.toml

@@ -0,0 +1,20 @@
+"github.name" = "GitHub"
+"github.description" = "Log in with a GitHub account"
+"github.client_id.hint" = "Copy it from the OAuth App's page"
+"github.client_secret.hint" = "Generate one on the OAuth App's page"
+"github.client_secret.kept" = "Set · leave empty to keep it"
+"github.client_secret.show" = "Show or hide the Client Secret"
+"github.role" = "Default role"
+"github.role.global" = "The global default role ({{ role }})"
+"github.role.none" = "The global default role (none yet)"
+"github.minutes" = "Session length"
+"github.minutes.same" = "As long as a password login ({{ minutes }})"
+"github.minutes.unit" = "minutes"
+"github.callback" = "Callback URL"
+"github.callback.hint" = "On GitHub, create an app under Settings › Developer settings › OAuth Apps with the address above as its Authorization callback URL, then fill in its Client ID and a Client Secret generated there."
+"github.copy" = "Copy"
+"github.copied" = "Copied"
+"github.offer" = "Once saved, the login page offers logging in with GitHub."
+"github.offered" = "Offered on the login page"
+"github.invalid" = "Not saved: check the required fields and the callback URL."
+"github.save" = "Save"

bazaar_contrib_server_github-0.3.0rc1/src/bazaar_contrib_server_github/resources/locales/zh-CN.toml

@@ -0,0 +1,20 @@
+"github.name" = "GitHub"
+"github.description" = "用 GitHub 账号登录"
+"github.client_id.hint" = "从 OAuth App 页面复制"
+"github.client_secret.hint" = "在 OAuth App 页面生成后填入"
+"github.client_secret.kept" = "已设置 · 留空保持不变"
+"github.client_secret.show" = "显示或隐藏 Client Secret"
+"github.role" = "默认角色"
+"github.role.global" = "使用全局默认角色（{{ role }}）"
+"github.role.none" = "使用全局默认角色（尚未设置）"
+"github.minutes" = "会话时长"
+"github.minutes.same" = "与账号密码登录相同（{{ minutes }}）"
+"github.minutes.unit" = "分钟"
+"github.callback" = "回调地址"
+"github.callback.hint" = "在 GitHub 的 Settings › Developer settings › OAuth Apps 里新建应用，Authorization callback URL 填上面的回调地址；创建后把 Client ID 和生成的 Client Secret 填到这里。"
+"github.copy" = "复制"
+"github.copied" = "已复制"
+"github.offer" = "保存后，登录页出现「用 GitHub 账号登录」。"
+"github.offered" = "已出现在登录页"
+"github.invalid" = "没有保存：请检查必填项和回调地址。"
+"github.save" = "保存"

bazaar_contrib_server_github-0.3.0rc1/src/bazaar_contrib_server_github/resources/static/github.css

@@ -0,0 +1,26 @@
+/* The GitHub login's settings, folded open under its row in the login methods part. */
+
+body { background: transparent; }
+[x-cloak] { display: none !important; }
+.github { display: grid; gap: 18px; padding: 18px; }
+.fields { display: grid; grid-template-columns: 1fr 1fr; gap: 16px; }
+.fields > * { min-width: 0; }
+.fields .wide { grid-column: 1 / -1; }
+.req { color: var(--crimson); margin-left: 3px; }
+input.input { width: 100%; font: inherit; }
+.input > input { flex: 1; min-width: 0; height: 100%; padding: 0; border: 0; background: none; color: inherit; font: inherit; outline: none; }
+.input:has(> input:focus-visible) { border-color: var(--saffron); box-shadow: 0 0 0 4px var(--saffron-soft); }
+/* the callback: its beginning shows, a long end gives way */
+.input.ro { background: var(--surface-2); }
+.input.ro > input { text-overflow: ellipsis; }
+.copy, .eye { flex: none; padding: 0; border: 0; background: none; font: inherit; cursor: pointer; }
+.eye span { display: flex; }
+.eye svg { width: 16px; height: 16px; }
+footer { display: flex; align-items: center; gap: 12px; }
+footer .btn { margin-left: auto; }
+.outcome { display: inline-flex; align-items: center; gap: 6px; color: var(--muted); font-size: 12.5px; }
+.outcome .i svg { width: 14px; height: 14px; }
+.outcome.done { color: var(--jade); }
+.outcome.wrong { color: var(--crimson); }
+
+:root[data-layout="narrow"] .fields { grid-template-columns: 1fr; }

bazaar_contrib_server_github-0.3.0rc1/src/bazaar_contrib_server_github/resources/templates/github/github.svg

@@ -0,0 +1 @@
+<svg viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><rect width="24" height="24" rx="6.5" fill="#24292f"/><path fill="#fff" transform="translate(4.5 4.5) scale(.625)" d="M12 .297c-6.63 0-12 5.373-12 12 0 5.303 3.438 9.8 8.205 11.385.6.113.82-.258.82-.577 0-.285-.01-1.04-.015-2.04-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729 1.205.084 1.838 1.236 1.838 1.236 1.07 1.835 2.809 1.305 3.495.998.108-.776.417-1.305.76-1.605-2.665-.3-5.466-1.332-5.466-5.93 0-1.31.465-2.38 1.235-3.22-.135-.303-.54-1.523.105-3.176 0 0 1.005-.322 3.3 1.23.96-.267 1.98-.399 3-.405 1.02.006 2.04.138 3 .405 2.28-1.552 3.285-1.23 3.285-1.23.645 1.653.24 2.873.12 3.176.765.84 1.23 1.91 1.23 3.22 0 4.61-2.805 5.625-5.475 5.92.42.36.81 1.096.81 2.22 0 1.606-.015 2.896-.015 3.286 0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12"/></svg>

bazaar_contrib_server_github-0.3.0rc1/src/bazaar_contrib_server_github/resources/templates/github/icons/eye-off.svg

@@ -0,0 +1 @@
+<!-- @license lucide-static v1.46.0 - ISC --><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" ><path d="M10.733 5.076a10.744 10.744 0 0 1 11.205 6.575 1 1 0 0 1 0 .696 10.747 10.747 0 0 1-1.444 2.49" /><path d="M14.084 14.158a3 3 0 0 1-4.242-4.242" /><path d="M17.479 17.499a10.75 10.75 0 0 1-15.417-5.151 1 1 0 0 1 0-.696 10.75 10.75 0 0 1 4.446-5.143" /><path d="m2 2 20 20" /></svg>

bazaar_contrib_server_github-0.3.0rc1/src/bazaar_contrib_server_github/resources/templates/github/icons/eye.svg

@@ -0,0 +1 @@
+<!-- @license lucide-static v1.46.0 - ISC --><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" ><path d="M2.062 12.348a1 1 0 0 1 0-.696 10.75 10.75 0 0 1 19.876 0 1 1 0 0 1 0 .696 10.75 10.75 0 0 1-19.876 0" /><circle cx="12" cy="12" r="3" /></svg>

bazaar_contrib_server_github-0.3.0rc1/src/bazaar_contrib_server_github/resources/templates/github/settings.html

@@ -0,0 +1,61 @@
+{% extends "server/base.html" %}
+{% import "server/icons.html" as icons %}
+{# folded open under the GitHub row of the login methods part #}
+{% block top %}{% endblock %}
+{% block title %}{{ t.text("github.name") }}{% endblock %}
+{% block head %}<link rel="stylesheet" href="{{ asset('github.css') }}">{% endblock %}
+{% block body %}
+{# once saved, the part around it is drawn again to show GitHub set up #}
+<form class="github" method="post" action="/ui/github/"{% if saved %} x-data x-init="window.parent !== window && window.parent.location.reload()"{% endif %}>
+  <div class="fields">
+    <div class="field">
+      <label for="client_id">Client ID<span class="req">*</span></label>
+      <input class="input mono" id="client_id" name="client_id" value="{{ configured.client_id if configured else '' }}" placeholder="{{ t.text('github.client_id.hint') }}" autocomplete="off" spellcheck="false" required>
+    </div>
+    {# what is typed may be shown; the secret saved before never comes back to the page #}
+    <div class="field" x-data="{ shown: false }">
+      <label for="client_secret">Client Secret<span class="req">*</span></label>
+      <span class="input">
+        <input class="mono" id="client_secret" name="client_secret" type="password" :type="shown ? 'text' : 'password'" placeholder="{{ t.text('github.client_secret.kept' if configured else 'github.client_secret.hint') }}" autocomplete="new-password" spellcheck="false"{% if not configured %} required{% endif %}>
+        <button class="suffix eye" type="button" @click="shown = !shown" :aria-pressed="shown" aria-label="{{ t.text('github.client_secret.show') }}">
+          <span x-show="!shown">{% include "github/icons/eye.svg" %}</span><span x-show="shown" x-cloak>{% include "github/icons/eye-off.svg" %}</span>
+        </button>
+      </span>
+    </div>
+    <div class="field">
+      <label for="default_role">{{ t.text("github.role") }}</label>
+      <span class="input select">
+        <select id="default_role" name="default_role">
+          <option value="">{{ t.text("github.role.global", {"role": default.name}) if default else t.text("github.role.none") }}</option>
+          {% for role in roles %}<option value="{{ role.id }}"{% if configured and configured.default_role_id == role.id %} selected{% endif %}>{{ role.name }}</option>{% endfor %}
+        </select>
+        {{ icons.icon("chevron-down") }}
+      </span>
+    </div>
+    <div class="field">
+      <label for="session_minutes">{{ t.text("github.minutes") }}</label>
+      <span class="input">
+        <input id="session_minutes" name="session_minutes" type="number" min="1" inputmode="numeric" value="{{ configured.session_minutes or '' if configured else '' }}" placeholder="{{ t.text('github.minutes.same', {'minutes': minutes}) }}">
+        <span class="suffix">{{ t.text("github.minutes.unit") }}</span>
+      </span>
+    </div>
+    {# where GitHub sends the browser back: under the address this page is seen at, not the one the server hears #}
+    <div class="field wide" x-data="{ copied: false }">
+      <label for="redirect_uri">{{ t.text("github.callback") }}</label>
+      <span class="input ro">
+        <input class="mono" id="redirect_uri" name="redirect_uri" x-ref="callback" readonly x-init="$el.value = location.origin + '{{ callback }}'">
+        <button class="suffix copy" type="button" @click="$refs.callback.select(); navigator.clipboard?.writeText($refs.callback.value); copied = true">
+          <span x-show="!copied">{{ t.text("github.copy") }}</span><span x-show="copied" x-cloak>{{ t.text("github.copied") }}</span>
+        </button>
+      </span>
+      <span class="hint">{{ t.text("github.callback.hint") }}</span>
+    </div>
+  </div>
+  <footer>
+    {% if error %}<span class="outcome wrong" role="alert">{{ t.text("github.invalid") }}</span>
+    {% elif configured %}<span class="outcome done">{{ icons.icon("check") }}{{ t.text("github.offered") }}</span>
+    {% else %}<span class="outcome">{{ t.text("github.offer") }}</span>{% endif %}
+    <button class="btn sm primary" type="submit">{{ t.text("github.save") }}</button>
+  </footer>
+</form>
+{% endblock %}

bazaar_contrib_server_github-0.3.0rc1/src/bazaar_contrib_server_github/schema.py

@@ -0,0 +1,52 @@
+"""What the GitHub login keeps: its one set of settings, and which GitHub user
+each account came from, with the token renewing the account's sessions."""
+
+import bazaar_contrib_storage as s
+from bazaar_contrib_schema import Migration, ModuleSchema
+
+SETTINGS = s.Table(
+    name="github_settings",
+    columns=(
+        s.ColumnDefinition(
+            name="id",
+            type="integer",
+            check=s.Compare(
+                left=s.Column(name="id"), operator="=", right=s.Value(value=1)
+            ),
+        ),
+        s.ColumnDefinition(name="client_id", type="text"),
+        s.ColumnDefinition(name="client_secret", type="text"),
+        s.ColumnDefinition(name="redirect_uri", type="text"),
+        s.ColumnDefinition(name="default_role_id", type="text", nullable=True),
+        s.ColumnDefinition(name="session_minutes", type="integer", nullable=True),
+        s.ColumnDefinition(name="updated_at_ms", type="integer"),
+    ),
+    primary_key=("id",),
+)
+ACCOUNTS = s.Table(
+    name="github_accounts",
+    columns=(
+        s.ColumnDefinition(name="github_id", type="text"),
+        s.ColumnDefinition(name="account_id", type="text", unique=True),
+        s.ColumnDefinition(name="login", type="text"),
+        s.ColumnDefinition(name="name", type="text"),
+        s.ColumnDefinition(name="email", type="text", nullable=True),
+        s.ColumnDefinition(name="avatar_url", type="text", nullable=True),
+        s.ColumnDefinition(name="token", type="text"),
+        s.ColumnDefinition(name="refresh_token", type="text", nullable=True),
+        s.ColumnDefinition(name="created_at_ms", type="integer"),
+        s.ColumnDefinition(name="updated_at_ms", type="integer"),
+    ),
+    primary_key=("github_id",),
+)
+
+MODULE = ModuleSchema(
+    tables=("github_settings", "github_accounts"),
+    migrations=(
+        Migration(
+            version=1,
+            name="github_login",
+            operations=(s.CreateTable(table=SETTINGS), s.CreateTable(table=ACCOUNTS)),
+        ),
+    ),
+)

bazaar_contrib_server_github-0.3.0rc1/src/bazaar_contrib_server_github/settings.py

@@ -0,0 +1,181 @@
+"""The GitHub login's settings: the OAuth App it logs in through, the role it
+gives the people logging in for the first time and how long their sessions
+last, kept in one row and set on its own page inside the login methods part
+of the settings page."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+lazy from time import time_ns
+lazy from typing import Annotated, cast
+lazy from urllib.parse import urlsplit
+
+lazy from bazaar_contrib_server import Account, Pages
+lazy from bazaar_contrib_server_access import METHODS, Access
+lazy from bazaar_contrib_storage import (
+    Column,
+    Compare,
+    Conflict,
+    Database,
+    Insert,
+    Select,
+    Value,
+)
+lazy from pydantic import (
+    BaseModel,
+    BeforeValidator,
+    Field,
+    StringConstraints,
+    ValidationError,
+    field_validator,
+)
+lazy from starlette.exceptions import HTTPException
+lazy from starlette.requests import Request
+lazy from starlette.responses import RedirectResponse, Response
+lazy from starlette.routing import Route
+
+# where GitHub sends the browser back to, under the address the page is seen at
+CALLBACK = "/login/github/callback"
+
+
+@dataclass(frozen=True, slots=True)
+class Configured:
+    client_id: str
+    client_secret: str
+    redirect_uri: str
+    # nothing for the global default role, and for as long as a password login
+    default_role_id: str | None
+    session_minutes: int | None
+
+
+async def configured(database: Database) -> Configured | None:
+    rows = await database.read(
+        lambda session: session.select(
+            Select(
+                table="github_settings",
+                where=Compare(
+                    left=Column(name="id"), operator="=", right=Value(value=1)
+                ),
+            )
+        )
+    )
+    if not rows:
+        return None
+    row = rows[0]
+    return Configured(
+        client_id=cast(str, row["client_id"]),
+        client_secret=cast(str, row["client_secret"]),
+        redirect_uri=cast(str, row["redirect_uri"]),
+        default_role_id=cast(str | None, row["default_role_id"]),
+        session_minutes=cast(int | None, row["session_minutes"]),
+    )
+
+
+def _blank(value: object) -> object:
+    return None if value == "" else value
+
+
+type _Text = Annotated[
+    str, StringConstraints(strip_whitespace=True, min_length=1, max_length=255)
+]
+
+
+class _Given(BaseModel):
+    client_id: _Text
+    # left empty, the secret saved before stays
+    client_secret: Annotated[_Text | None, BeforeValidator(_blank)] = None
+    default_role: Annotated[str | None, BeforeValidator(_blank)] = None
+    session_minutes: Annotated[
+        Annotated[int, Field(ge=1)] | None, BeforeValidator(_blank)
+    ] = None
+    redirect_uri: str = Field(max_length=2048)
+
+    @field_validator("redirect_uri")
+    @classmethod
+    def callback(cls, value: str) -> str:
+        parts = urlsplit(value)
+        if parts.scheme not in ("http", "https") or not parts.netloc:
+            raise ValueError("redirect_uri is an address of this site")
+        if parts.path != CALLBACK or parts.query or parts.fragment:
+            raise ValueError("redirect_uri is the GitHub login's callback")
+        return value
+
+
+class Settings:
+    def __init__(self, pages: Pages, access: Access, database: Database) -> None:
+        self._pages = pages
+        self._access = access
+        self._database = database
+        self.app = pages.application(
+            [Route("/", self._page), Route("/", self._save, methods=["POST"])]
+        )
+
+    async def _page(
+        self, request: Request, *, error: bool = False, status_code: int = 200
+    ) -> Response:
+        _allow(request)
+        return await self._pages.render(
+            request,
+            "github/settings.html",
+            status_code=status_code,
+            configured=await configured(self._database),
+            roles=await self._access.roles(),
+            default=await self._access.default_role(),
+            minutes=self._access.minutes,
+            callback=CALLBACK,
+            saved="saved" in request.query_params,
+            error=error,
+        )
+
+    async def _save(self, request: Request) -> Response:
+        _allow(request)
+        form = await request.form()
+        try:
+            given = _Given.model_validate(
+                {name: form.get(name, "") for name in _Given.model_fields}
+            )
+        except ValidationError:
+            return await self._page(request, error=True, status_code=422)
+        stored = await configured(self._database)
+        secret = given.client_secret or (
+            None if stored is None else stored.client_secret
+        )
+        roles = {role.id for role in await self._access.roles()}
+        if secret is None or given.default_role not in roles | {None}:
+            return await self._page(request, error=True, status_code=422)
+        await self._database.write(
+            lambda session: session.insert(
+                Insert(
+                    table="github_settings",
+                    rows=(
+                        {
+                            "id": 1,
+                            "client_id": given.client_id,
+                            "client_secret": secret,
+                            "redirect_uri": given.redirect_uri,
+                            "default_role_id": given.default_role,
+                            "session_minutes": given.session_minutes,
+                            "updated_at_ms": time_ns() // 1_000_000,
+                        },
+                    ),
+                    conflict=Conflict(
+                        columns=("id",),
+                        update=(
+                            "client_id",
+                            "client_secret",
+                            "redirect_uri",
+                            "default_role_id",
+                            "session_minutes",
+                            "updated_at_ms",
+                        ),
+                    ),
+                )
+            )
+        )
+        return RedirectResponse("/ui/github/?saved", status_code=303)
+
+
+def _allow(request: Request) -> None:
+    account: Account = request.state.account
+    if not account.allows(METHODS):
+        raise HTTPException(status_code=403)