app/Jobs/GithubAppPermissionJob.php

Rama main · réplica de lectura del repositorio original.

<?php

namespace App\Jobs;

use App\Models\GithubApp;
use Illuminate\Bus\Queueable;
use Illuminate\Contracts\Queue\ShouldBeEncrypted;
use Illuminate\Contracts\Queue\ShouldQueue;
use Illuminate\Foundation\Bus\Dispatchable;
use Illuminate\Http\Client\PendingRequest;
use Illuminate\Queue\InteractsWithQueue;
use Illuminate\Queue\SerializesModels;
use Illuminate\Support\Facades\Http;

class GithubAppPermissionJob implements ShouldBeEncrypted, ShouldQueue
{
    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;

    public $tries = 4;

    public function backoff(): int
    {
        return isDev() ? 1 : 3;
    }

    public function __construct(public GithubApp $github_app) {}

    public function handle()
    {
        try {
            $github_access_token = generateGithubJwt($this->github_app);

            $github = Http::GitSource($this->github_app->api_url)->withHeaders([
                'Authorization' => "Bearer $github_access_token",
                'Accept' => 'application/vnd.github+json',
            ]);
            $response = $github->get("{$this->github_app->api_url}/app");

            if (! $response->successful()) {
                assertGithubClockInSync($response);
                throw new \RuntimeException('Failed to fetch GitHub app permissions: '.$response->body());
            }

            $response = $response->json();
            $permissions = data_get($response, 'permissions');

            $this->github_app->contents = data_get($permissions, 'contents');
            $this->github_app->metadata = data_get($permissions, 'metadata');
            $this->github_app->pull_requests = data_get($permissions, 'pull_requests');
            $this->github_app->deployments = $this->approvedInstallationPermission($github, 'deployments');
            $this->github_app->administration = data_get($permissions, 'administration');
            $this->github_app->organization_self_hosted_runners = data_get($permissions, 'organization_self_hosted_runners');
            $this->github_app->actions = data_get($permissions, 'actions');
            $this->github_app->webhook_events = data_get($response, 'events', []);

            $this->github_app->save();
            $this->github_app->makeVisible('client_secret')->makeVisible('webhook_secret');

        } catch (\Throwable $e) {
            send_internal_notification('GithubAppPermissionJob failed with: '.$e->getMessage());
            throw $e;
        }
    }

    /**
     * GET /app returns the permissions the App requests. A new permission
     * counts only after the installation approves it.
     */
    private function approvedInstallationPermission(PendingRequest $github, string $permission): ?string
    {
        if (! $this->github_app->installation_id) {
            return null;
        }

        $response = $github->get("{$this->github_app->api_url}/app/installations/{$this->github_app->installation_id}");
        if (! $response->successful()) {
            throw new \RuntimeException('Failed to fetch GitHub app installation permissions: '.$response->body());
        }

        return data_get($response->json(), "permissions.{$permission}");
    }
}