implement indexing private repos using app installations

Author: tayloraswift

Assets/css/Main.css

@@ -49,10 +49,9 @@ extension GitHub
         public
         var fork:Bool
 
-        /// The repo’s visibility on GitHub. Some queries return only public repositories and so
-        /// omit this field.
+        /// The repo’s visibility on GitHub.
         public
-        var visibility:RepoVisibility?
+        var visibility:RepoVisibility
         /// The repo’s dominant language, if GitHub was able to detect one.
         public
         var language:String?
@@ -90,7 +89,7 @@ extension GitHub
             archived:Bool,
             disabled:Bool,
             fork:Bool,
-            visibility:RepoVisibility? = nil,
+            visibility:RepoVisibility,
             language:String? = nil,
             homepage:String? = nil,
             about:String? = nil,
@@ -172,7 +171,7 @@ extension GitHub.Repo:JSONObjectDecodable
             archived: try json[.archived].decode(),
             disabled: try json[.disabled].decode(),
             fork: try json[.fork].decode(),
-            visibility: try json[.visibility]?.decode(),
+            visibility: try json[.visibility].decode(),
             language: try json[.language]?.decode(),
             homepage: try json[.homepage]?.decode(),
             about: try json[.description]?.decode(),

Assets/css/Main.css.map

@@ -3,9 +3,47 @@ import JSON
 extension GitHub
 {
     @frozen public
-    enum RepoVisibility:String, JSONEncodable, JSONDecodable, Equatable, Sendable
+    enum RepoVisibility:Equatable, Comparable, Sendable
     {
-        case `public`
         case `private`
+        case `internal`
+        case `public`
+    }
+}
+extension GitHub.RepoVisibility:CustomStringConvertible
+{
+    @inlinable public
+    var description:String
+    {
+        switch self
+        {
+        case .private:  "private"
+        case .internal: "internal"
+        case .public:   "public"
+        }
     }
 }
+extension GitHub.RepoVisibility:LosslessStringConvertible
+{
+    @inlinable public
+    init?(_ description:String)
+    {
+        //  Note: the GraphQL API returns the visibility in all caps, for some reason.
+        switch description
+        {
+        case "PRIVATE":  self = .private
+        case "private":  self = .private
+
+        case "INTERNAL": self = .internal
+        case "internal": self = .internal
+
+        case "PUBLIC":   self = .public
+        case "public":   self = .public
+
+        default:         return nil
+        }
+    }
+}
+extension GitHub.RepoVisibility:JSONStringDecodable
+{
+}

Sources/GitHubAPI/GitHub.Repo.swift

@@ -26,16 +26,17 @@ extension GitHub.Client
         }
     }
 }
-extension GitHub.Client<GitHub.PersonalAccessToken>.Connection
+extension GitHub.Client<Void>.Connection
 {
     /// Run a GraphQL API request.
     ///
     /// The request will be charged to the user associated with the stored token. It is not
     /// possible to run a GraphQL API request without a token.
     @inlinable public
-    func post<Response>(query:String,
-        for _:Response.Type = Response.self) async throws -> GraphQL.Response<Response>
-        where Response:JSONDecodable
+    func post<T>(query:String,
+        expecting _:T.Type = T.self,
+        with authorization:GitHub.ClientAuthorization) async throws -> GraphQL.Response<T>
+        where T:JSONDecodable
     {
         let request:HTTP.Client2.Request = .init(headers:
             [
@@ -44,7 +45,7 @@ extension GitHub.Client<GitHub.PersonalAccessToken>.Connection
                 ":authority": self.http2.remote,
                 ":path": "/graphql",
 
-                "authorization": "Bearer \(self.app)",
+                "authorization": authorization.header,
 
                 //  GitHub will reject the API request if the user-agent is not set.
                 "user-agent": self.agent,
@@ -65,8 +66,7 @@ extension GitHub.Client<GitHub.PersonalAccessToken>.Connection
             if  let second:String = response.headers?["x-ratelimit-reset"].first,
                 let second:Int64 = .init(second)
             {
-                throw GitHub.Client<GitHub.PersonalAccessToken>.RateLimitError.init(
-                    until: .second(second))
+                throw GitHub.Client<Application>.RateLimitError.init(until: .second(second))
             }
             else
             {

Sources/GitHubAPI/GitHub.RepoVisibility.swift

@@ -27,17 +27,17 @@ extension GitHub
         }
     }
 }
-extension GitHub.Client<GitHub.PersonalAccessToken>
+extension GitHub.Client<Void>
 {
     public static
-    func graphql(pat:consuming GitHub.PersonalAccessToken,
+    func graphql(
         threads:consuming MultiThreadedEventLoopGroup,
         niossl:consuming NIOSSLContext,
-        as agent:String) -> GitHub.Client<GitHub.PersonalAccessToken>
+        as agent:String) -> GitHub.Client<Void>
     {
         .init(http2: .init(threads: threads, niossl: niossl, remote: "api.github.com"),
             agent: agent,
-            app: pat)
+            app: ())
     }
 }
 extension GitHub.Client where Application:GitHubApplication

Sources/GitHubClient/GitHub.Client.Connection.swift

@@ -4,13 +4,21 @@ import GitHubAPI
 extension GitHub
 {
     @frozen public
-    enum ClientAuthorization
+    enum ClientAuthorization:Sendable
     {
         case basic(GitHub.OAuth)
         case token(String)
     }
 }
 extension GitHub.ClientAuthorization
+{
+    @inlinable public
+    static func token(_ iat:GitHub.InstallationAccessToken) -> Self { .token(iat.rawValue) }
+
+    @inlinable public
+    static func token(_ pat:GitHub.PersonalAccessToken) -> Self { .token(pat.rawValue) }
+}
+extension GitHub.ClientAuthorization
 {
     @inlinable
     var header:String

Sources/GitHubClient/GitHub.Client.swift

@@ -45,7 +45,7 @@ extension Unidoc.PackageRepo
             created: .init(created),
             updated: updated,
             license: repo.license.map { .init(spdx: $0.id, name: $0.name) },
-            private: repo.visibility == .private,
+            private: repo.visibility < .public,
             topics: repo.topics,
             master: repo.master,
             origin: .github(.init(

Sources/GitHubClient/GitHub.ClientAuthorization.swift

@@ -2,7 +2,7 @@ extension Unidoc.PackageIndexOperation
 {
     enum Subject
     {
-        case repo(owner:String, name:String, private:Bool)
+        case repo(owner:String, name:String, githubInstallation:Int32?)
         case ref(Unidoc.Package, ref:String)
     }
 }
@@ -19,7 +19,9 @@ extension Unidoc.PackageIndexOperation.Subject
                 return nil
             }
 
-            self = .repo(owner: owner, name: repo, private: form["private"] == "true")
+            let githubInstallation:Int32? = form["installation"].flatMap(Int32.init(_:))
+
+            self = .repo(owner: owner, name: repo, githubInstallation: githubInstallation)
         }
         else if
             let package:String = form["package"],

Sources/UnidocDB/Packages/Unidoc.PackageRepo (ext).swift

@@ -45,17 +45,18 @@ extension Unidoc.PackageIndexOperation:Unidoc.MeteredOperation
 
         switch self.subject
         {
-        case .repo(owner: let owner, name: let repo, private: let `private`):
+        case .repo(owner: let owner, name: let repo, githubInstallation: let appInstallation):
             if  let error:Unidoc.PolicyErrorPage = try await self.charge(cost: 8,
                     from: server,
                     with: session)
             {
                 return error.response(format: format)
             }
 
-            let repo:GitHub.Repo? = try await github.connect
+            let repo:GitHub.Repo? = try await github.connect(
+                with: .init(githubInstallation: appInstallation))
             {
-                try await $0.lookup(owner: owner, repo: repo, private: `private`)
+                try await $0.lookup(owner: owner, repo: repo)
             }
 
             guard
@@ -110,7 +111,7 @@ extension Unidoc.PackageIndexOperation:Unidoc.MeteredOperation
                 return error.response(format: format)
             }
 
-            let ref:GitHub.Ref? = try await github.connect
+            let ref:GitHub.Ref? = try await github.connect(with: .init())
             {
                 try await $0.lookup(owner: origin.owner, repo: origin.name, ref: ref)
             }