mirror of
https://github.com/tdurieux/anonymous_github.git
synced 2026-10-19 06:07:21 +02:00
287 lines
17 KiB
TypeScript
287 lines
17 KiB
TypeScript
import { registerGitHubToken } from "./github-token-context";
|
|
import { createSign, randomUUID } from "crypto";
|
|
import { readFileSync } from "fs";
|
|
import config from "../config";
|
|
import AnonymousError from "./AnonymousError";
|
|
import CredentialModel from "./model/credentials/credentials.model";
|
|
import InstallationModel from "./model/github-installation";
|
|
import UserModel from "./model/users/users.model";
|
|
import { credentialCipher, getCredentialToken } from "./credentials";
|
|
import { RepositoryAccess } from "./repository-access.types";
|
|
|
|
export const APP_PROVIDER = "github-app-user";
|
|
export function appError(code = "github_app_reconnect_required", status = 403) {
|
|
return new AnonymousError(code, { httpStatus: status });
|
|
}
|
|
|
|
// Never expose upstream bodies, bearer credentials or signed URLs in errors.
|
|
export async function githubRequest<T>(path: string, token: string, method = "GET", body?: unknown, scheme: "Bearer" | "Basic" = "Bearer"): Promise<T> {
|
|
if (!path.startsWith("/") || path.startsWith("//")) throw appError("invalid_github_path", 400);
|
|
let response: Response;
|
|
try {
|
|
response = await fetch(`https://api.github.com${path}`, {
|
|
method, headers: { Accept: "application/vnd.github+json", Authorization: `${scheme} ${token}`,
|
|
"X-GitHub-Api-Version": "2022-11-28", "Content-Type": "application/json" },
|
|
body: body === undefined ? undefined : JSON.stringify(body), signal: AbortSignal.timeout(20000),
|
|
});
|
|
} catch { throw appError("github_unavailable", 502); }
|
|
if (!response.ok) {
|
|
const limited = response.status === 429 || (response.status === 403 &&
|
|
(response.headers.get("x-ratelimit-remaining") === "0" || response.headers.has("retry-after")));
|
|
throw appError(limited ? "github_rate_limit_exceeded" : response.status >= 500 ? "github_unavailable" :
|
|
response.status === 401 ? "github_app_reconnect_required" : "github_app_access_required",
|
|
limited ? 429 : response.status >= 500 ? 502 : 403);
|
|
}
|
|
if (response.status === 204) return undefined as T;
|
|
return await response.json() as T;
|
|
}
|
|
|
|
export function appJWT(now = Date.now()): string {
|
|
if (!config.GITHUB_APP_ENABLED) throw appError("github_app_disabled", 503);
|
|
const key = config.GITHUB_APP_PRIVATE_KEY || readFileSync(config.GITHUB_APP_PRIVATE_KEY_FILE, "utf8");
|
|
const encode = (value: unknown) => Buffer.from(JSON.stringify(value)).toString("base64url");
|
|
const payload = `${encode({ alg: "RS256", typ: "JWT" })}.${encode({ iat: Math.floor(now / 1000) - 60,
|
|
exp: Math.floor(now / 1000) + 540, iss: config.GITHUB_APP_CLIENT_ID })}`;
|
|
return `${payload}.${createSign("RSA-SHA256").update(payload).sign(key, "base64url")}`;
|
|
}
|
|
|
|
export interface AppTokenResponse {
|
|
access_token: string;
|
|
refresh_token: string;
|
|
expires_in: number;
|
|
refresh_token_expires_in: number;
|
|
}
|
|
export async function exchangeAppToken(values: Record<string, string>): Promise<AppTokenResponse> {
|
|
let response: Response;
|
|
try {
|
|
response = await fetch("https://github.com/login/oauth/access_token", {
|
|
method: "POST", headers: { Accept: "application/json", "Content-Type": "application/json" },
|
|
body: JSON.stringify({ ...values, client_id: config.GITHUB_APP_CLIENT_ID, client_secret: config.GITHUB_APP_CLIENT_SECRET }),
|
|
signal: AbortSignal.timeout(20000),
|
|
});
|
|
} catch { throw appError("github_unavailable", 502); }
|
|
if (response.status >= 500) throw appError("github_unavailable", 502);
|
|
if (response.status === 429) throw appError("github_rate_limit_exceeded", 429);
|
|
const data = await response.json().catch(() => null) as AppTokenResponse | null;
|
|
if (!response.ok || !data || typeof data.access_token !== "string" || !data.access_token ||
|
|
typeof data.refresh_token !== "string" || !data.refresh_token ||
|
|
!Number.isFinite(data.expires_in) || data.expires_in <= 0 ||
|
|
!Number.isFinite(data.refresh_token_expires_in) || data.refresh_token_expires_in <= 0) {
|
|
throw appError("github_app_reconnect_required", 401);
|
|
}
|
|
return data;
|
|
}
|
|
function tokenFields(ownerId: string, data: AppTokenResponse) {
|
|
const cipher = credentialCipher();
|
|
return { encryptedToken: cipher.encrypt(data.access_token, ownerId, APP_PROVIDER),
|
|
encryptedRefreshToken: cipher.encrypt(data.refresh_token, ownerId, APP_PROVIDER, "encryptedRefreshToken"),
|
|
expiresAt: new Date(Date.now() + data.expires_in * 1000),
|
|
refreshExpiresAt: new Date(Date.now() + data.refresh_token_expires_in * 1000),
|
|
revision: randomUUID(), revoked: false, updatedAt: new Date() };
|
|
}
|
|
export async function saveAppGrant(ownerId: string, data: AppTokenResponse) {
|
|
await CredentialModel.updateOne({ ownerId, provider: APP_PROVIDER }, {
|
|
$set: tokenFields(ownerId, data), $unset: { refreshLock: "", refreshLockUntil: "" },
|
|
}, { upsert: true, runValidators: true });
|
|
await UserModel.updateOne({ _id: ownerId }, { $set: { repositories: [] } });
|
|
}
|
|
|
|
export async function appUserToken(ownerId: string): Promise<string> {
|
|
if (!config.GITHUB_APP_ENABLED) throw appError("github_app_disabled", 503);
|
|
const user = await UserModel.findById(ownerId).select("status externalIDs").lean();
|
|
if (!user || user.status === "removed" || user.status === "banned") throw appError();
|
|
// MongoDB lock serializes refresh across API processes and streamers. Conditional
|
|
// writes cannot replace a newer login or revive a grant revoked during refresh.
|
|
for (let attempt = 0; attempt < 30; attempt++) {
|
|
const row = await CredentialModel.findOne({ ownerId, provider: APP_PROVIDER })
|
|
.select("+encryptedToken +encryptedRefreshToken").lean();
|
|
if (!row || row.revoked) throw appError();
|
|
if (row.expiresAt && row.expiresAt.getTime() > Date.now() + 60000) {
|
|
return credentialCipher().decrypt(row.encryptedToken, ownerId, APP_PROVIDER);
|
|
}
|
|
if (!row.encryptedRefreshToken || !row.refreshExpiresAt || row.refreshExpiresAt.getTime() <= Date.now()) throw appError();
|
|
const lock = randomUUID();
|
|
const acquired = await CredentialModel.updateOne({ _id: row._id, revision: row.revision, revoked: { $ne: true },
|
|
$or: [{ refreshLockUntil: { $exists: false } }, { refreshLockUntil: { $lt: new Date() } }] },
|
|
{ $set: { refreshLock: lock, refreshLockUntil: new Date(Date.now() + 30000) } });
|
|
if (!acquired.modifiedCount) { await new Promise(resolve => setTimeout(resolve, 1000)); continue; }
|
|
try {
|
|
const refreshed = await exchangeAppToken({ grant_type: "refresh_token",
|
|
refresh_token: credentialCipher().decrypt(row.encryptedRefreshToken, ownerId, APP_PROVIDER, "encryptedRefreshToken") });
|
|
const saved = await CredentialModel.updateOne({ _id: row._id, revision: row.revision, refreshLock: lock, revoked: { $ne: true } },
|
|
{ $set: tokenFields(ownerId, refreshed), $unset: { refreshLock: "", refreshLockUntil: "" } });
|
|
if (saved.modifiedCount) return refreshed.access_token;
|
|
} finally {
|
|
await CredentialModel.updateOne({ _id: row._id, refreshLock: lock }, { $unset: { refreshLock: "", refreshLockUntil: "" } });
|
|
}
|
|
}
|
|
throw appError("github_app_refresh_busy", 503);
|
|
}
|
|
|
|
// Replayed revocations must never invalidate a newer, working authorization.
|
|
export async function reconcileAppGrant(ownerId: string) {
|
|
const row = await CredentialModel.findOne({ ownerId, provider: APP_PROVIDER }).lean();
|
|
if (!row || row.revoked) return;
|
|
try {
|
|
const token = await appUserToken(ownerId);
|
|
await githubRequest("/user", token);
|
|
} catch (error) {
|
|
if (!(error instanceof Error) || error.message !== "github_app_reconnect_required") throw error;
|
|
await CredentialModel.updateOne({ _id: row._id, revision: row.revision },
|
|
{ $set: { revoked: true, revision: randomUUID() } });
|
|
}
|
|
}
|
|
|
|
// Pending reconciliation is durable and retried on access after upstream failures.
|
|
// The revision guard prevents an older response from undoing a newer webhook.
|
|
export async function reconcileInstallation(installationId: number, revision: string) {
|
|
const current = await githubRequest<AppInstallation>(`/app/installations/${installationId}`, appJWT());
|
|
if (String(current.app_id) !== config.GITHUB_APP_ID) throw appError();
|
|
await InstallationModel.updateOne({ appId: config.GITHUB_APP_ID, installationId, revision },
|
|
{ $set: { blocked: !!current.suspended_at, reconciliationPending: false,
|
|
accountId: current.account.id, accountLogin: current.account.login, accountType: current.account.type,
|
|
checkedAt: new Date(), revision: randomUUID() } });
|
|
}
|
|
|
|
export interface GitHubRepositoryInfo {
|
|
id: number; full_name: string; name: string; private: boolean; visibility?: string; html_url: string; size: number;
|
|
default_branch: string; owner: { id: number; login: string };
|
|
}
|
|
export interface AppInstallation {
|
|
id: number; app_id: number; suspended_at: string | null;
|
|
account: { id: number; login: string; type: string };
|
|
permissions: Record<string, string>;
|
|
}
|
|
export async function userInstallations(ownerId: string): Promise<AppInstallation[]> {
|
|
const token = await appUserToken(ownerId);
|
|
const result: AppInstallation[] = [];
|
|
for (let page = 1; ; page++) {
|
|
const data = await githubRequest<{ installations: AppInstallation[] }>(`/user/installations?per_page=100&page=${page}`, token);
|
|
result.push(...data.installations.filter(i => String(i.app_id) === config.GITHUB_APP_ID));
|
|
if (data.installations.length < 100) break;
|
|
}
|
|
return result;
|
|
}
|
|
export async function appRepositories(ownerId: string) {
|
|
const installations = await userInstallations(ownerId);
|
|
const token = await appUserToken(ownerId);
|
|
const results: (GitHubRepositoryInfo & { installationId: number })[] = [];
|
|
for (const installation of installations) {
|
|
if (installation.suspended_at) continue;
|
|
for (let page = 1; ; page++) {
|
|
const data = await githubRequest<{ repositories: GitHubRepositoryInfo[] }>(
|
|
`/user/installations/${installation.id}/repositories?per_page=100&page=${page}`, token);
|
|
results.push(...data.repositories.map(r => ({ ...r, installationId: installation.id })));
|
|
if (data.repositories.length < 100) break;
|
|
}
|
|
}
|
|
return results;
|
|
}
|
|
|
|
const installationTokens = new Map<string, { token: string; expires: number }>();
|
|
const minting = new Map<string, Promise<string>>();
|
|
export function clearAppTokenCache() { installationTokens.clear(); }
|
|
async function installationToken(binding: RepositoryAccess, ownerId: string): Promise<string> {
|
|
const id = binding.installationId;
|
|
let local = await InstallationModel.findOne({ appId: config.GITHUB_APP_ID, installationId: id }).lean();
|
|
if (local?.reconciliationPending && local.revision) {
|
|
await reconcileInstallation(id!, local.revision);
|
|
local = await InstallationModel.findOne({ appId: config.GITHUB_APP_ID, installationId: id }).lean();
|
|
}
|
|
if (local?.blocked) throw appError("github_app_access_required");
|
|
const key = `${ownerId}:${id}:${binding.repositoryId}:${local?.revision || ""}`;
|
|
const cached = installationTokens.get(key);
|
|
if (cached && cached.expires > Date.now() + 60000) return cached.token;
|
|
if (minting.has(key)) return minting.get(key)!;
|
|
const work = (async () => {
|
|
const jwt = appJWT();
|
|
const installation = await githubRequest<AppInstallation>(`/app/installations/${id}`, jwt);
|
|
if (String(installation.app_id) !== config.GITHUB_APP_ID || installation.suspended_at || installation.permissions.contents !== "read") {
|
|
throw appError("github_app_access_required");
|
|
}
|
|
// Refuse accidentally configured write permissions instead of presenting a
|
|
// misleading read-only connection to the user.
|
|
if (Object.values(installation.permissions).some(p => p === "write" || p === "admin")) throw appError("github_app_permissions_invalid");
|
|
const permissions: Record<string, string> = { contents: "read", metadata: "read" };
|
|
for (const p of ["pull_requests", "pages"]) if (installation.permissions[p] === "read") permissions[p] = "read";
|
|
const issued = await githubRequest<{ token: string; expires_at: string }>(`/app/installations/${id}/access_tokens`, jwt, "POST",
|
|
{ repository_ids: [binding.repositoryId], permissions });
|
|
const expires = Date.parse(issued.expires_at);
|
|
if (!issued.token || !Number.isFinite(expires)) throw appError();
|
|
// Bound memory and ensure a revocation that races minting is observed before use.
|
|
if (installationTokens.size >= 1000) installationTokens.clear();
|
|
const current = await InstallationModel.findOne({ appId: config.GITHUB_APP_ID, installationId: id }).lean();
|
|
if (current?.blocked || current?.revision !== local?.revision) throw appError("github_app_access_required");
|
|
installationTokens.set(key, { token: issued.token, expires });
|
|
return issued.token;
|
|
})();
|
|
minting.set(key, work);
|
|
try { return await work; } finally { minting.delete(key); }
|
|
}
|
|
|
|
export async function boundAppToken(ownerId: string, binding: RepositoryAccess, sourceName?: string, _force = false): Promise<string> {
|
|
if (!Number.isSafeInteger(binding.repositoryId)) throw appError();
|
|
if (binding.publicRead === true) {
|
|
if (binding.installationId !== undefined || !sourceName || !/^[^/\s]+\/[^/\s]+$/.test(sourceName)) throw appError();
|
|
const renew = async () => {
|
|
const userToken = await appUserToken(ownerId);
|
|
const repo = await githubRequest<GitHubRepositoryInfo>(
|
|
`/repos/${sourceName.split("/").map(encodeURIComponent).join("/")}`, userToken);
|
|
// A public binding must not acquire private access or follow a replacement
|
|
// repository at an old name, even if the user can read it.
|
|
if (repo.id !== binding.repositoryId || repo.private !== false || repo.visibility !== "public") throw appError("github_app_access_required");
|
|
return userToken;
|
|
};
|
|
await renew();
|
|
// This process-local handle keeps concurrent repositories independent without
|
|
// asking GitHub to mint an installation-scoped token for an uninstalled repo.
|
|
const handle = `public-read:${randomUUID()}`;
|
|
registerGitHubToken(handle, { quotaKey: `app-user:${ownerId}`, renew, publicRepository: sourceName });
|
|
return handle;
|
|
}
|
|
|
|
if (!Number.isSafeInteger(binding.installationId)) throw appError();
|
|
const userToken = await appUserToken(ownerId);
|
|
// User token checks the intersection of user and App rights on every access.
|
|
// No indefinite local authorization cache can preserve a departed user's access.
|
|
await githubRequest<GitHubRepositoryInfo>(`/repositories/${binding.repositoryId}`, userToken);
|
|
const token = await installationToken(binding, ownerId);
|
|
registerGitHubToken(token, { quotaKey: `installation:${binding.installationId}`, renew: async (force) => {
|
|
if (force) clearAppTokenCache();
|
|
return boundAppToken(ownerId, binding);
|
|
} });
|
|
return token;
|
|
}
|
|
|
|
export async function selectRepositoryAccess(ownerId: string, fullName: string, choice?: unknown, repositoryId?: number): Promise<{ token: string; binding: RepositoryAccess; fullName?: string }> {
|
|
if (!/^[^/\s]+\/[^/\s]+$/.test(fullName)) throw appError("repo_not_found", 400);
|
|
if (choice !== undefined && choice !== "oauth" && choice !== "github-app") throw appError("invalid_connection", 400);
|
|
const hasApp = config.GITHUB_APP_ENABLED && await CredentialModel.exists({ ownerId, provider: APP_PROVIDER });
|
|
if (choice === "github-app" || (choice === undefined && hasApp)) {
|
|
const repo = (await appRepositories(ownerId)).find(r => repositoryId === undefined ? r.full_name.toLowerCase() === fullName.toLowerCase() : r.id === repositoryId);
|
|
if (!repo) {
|
|
const userToken = await appUserToken(ownerId);
|
|
const publicRepo = await githubRequest<GitHubRepositoryInfo>(
|
|
repositoryId === undefined ? `/repos/${fullName.split("/").map(encodeURIComponent).join("/")}` : `/repositories/${repositoryId}`, userToken);
|
|
if (publicRepo.private !== false || publicRepo.visibility !== "public" || !Number.isSafeInteger(publicRepo.id)) throw appError("github_app_access_required");
|
|
const binding: RepositoryAccess = { kind: "github-app", publicRead: true,
|
|
repositoryId: publicRepo.id, revision: randomUUID() };
|
|
return { binding, fullName: publicRepo.full_name, token: await boundAppToken(ownerId, binding, publicRepo.full_name) };
|
|
}
|
|
const binding: RepositoryAccess = { kind: "github-app", repositoryId: repo.id, installationId: repo.installationId, revision: randomUUID() };
|
|
return { binding, fullName: repo.full_name, token: await boundAppToken(ownerId, binding, repo.full_name) };
|
|
}
|
|
const token = await getCredentialToken(ownerId);
|
|
if (!token) throw appError("github_oauth_required");
|
|
return { token, binding: { kind: "oauth", revision: randomUUID() } };
|
|
}
|
|
|
|
export function installationURL(targetId?: number, repositoryIds: number[] = []) {
|
|
const base = `https://github.com/apps/${encodeURIComponent(config.GITHUB_APP_SLUG)}/installations/new`;
|
|
if (!targetId || !repositoryIds.length) return base;
|
|
const url = new URL(`${base}/permissions`);
|
|
url.searchParams.set("suggested_target_id", String(targetId));
|
|
for (const id of repositoryIds.slice(0, 100)) url.searchParams.append("repository_ids[]", String(id));
|
|
return url.toString();
|
|
}
|