File Coverage

blib/lib/GitHub/Apps/Auth.pm

Criterion	Covered	Total	%
statement	84	102	82.3
branch	11	20	55.0
condition	4	9	44.4
subroutine	27	31	87.1
pod	2	3	66.6
total	128	165	77.5

package GitHub::Apps::Auth;
use 5.008001;
use strict;
use warnings;

our $VERSION = "0.04";

use Class::Accessor::Lite (
    rw => [qw/token expires installation_id/],
    ro => [qw/_furl private_key app_id/],
);

use Carp;
use Crypt::PK::RSA;
use Crypt::JWT qw/encode_jwt/;
use Furl;
use JSON qw/decode_json/;
use Time::Moment;

sub _lazy(&) {
    return GitHub::Apps::Auth::Lazy->new($_[0]);
}

use overload
    "\"\"" => sub { shift->issued_token },
    "." => sub {
        my ($self, $other, $reverse) = @_;
        return $reverse ?
            _lazy { "$other" . "$self" } :
            _lazy { "$self" . "$other" };
    };

sub new {
    my ($class, %args) = @_;
    if (!exists $args{private_key} || !$args{private_key}) {
        croak "private_key is required.";
    }
    if (!exists $args{app_id} || !$args{app_id}) {
        croak "app_id is required.";
    }
    if (!$args{installation_id} && !$args{login}) {
        croak "must be set installation_id or login.";
    }

    my $pk = Crypt::PK::RSA->new($args{private_key});

    my $klass = {
        private_key => $pk,
        installation_id => $args{installation_id},
        app_id => $args{app_id},
        expires => 0,
        _furl => Furl->new,
    };
    my $self = bless $klass, $class;

    if (!$self->installation_id) {
        my $installations = $self->installations;
        if (!exists $installations->{$args{login}}) {
            croak $args{login} . " is not found in installations."
        }
        my $installation_id = $installations->{$args{login}};
        $self->installation_id($installation_id);
    }

    return $self;
}

sub installations {
    my $self = shift;

    my $header = $self->_generate_request_header();

    my $resp = $self->_furl->get(
        "https://api.github.com/app/installations",
        $header,
    );
    if (!$resp->is_success) {
        croak "fail to fetch installations: ". $resp->content;
    }

    my $content = decode_json $resp->content;
    my %ids_by_account = map { $_->{account}{login} => $_->{id} } @$content;
    return \%ids_by_account;
}

sub _generate_jwt {
    my $self = shift;

    my $jwt = encode_jwt(
        payload => {
            iat => time(),
            exp => time() + 60,
            iss => $self->app_id,
        },
        alg => "RS256",
        key => $self->private_key,
    );

    return $jwt;
}

sub _generate_request_header {
    my $self = shift;
    my $jwt = $self->_generate_jwt();

    return [
        Authorization => 'Bearer ' . $jwt,
        Accept => "application/vnd.github.machine-man-preview+json",
    ];
}

sub _fetch_access_token {
    my $self = shift;

    my $installation_id = $self->installation_id;
    my $header = $self->_generate_request_header();
    my $resp = $self->_post_to_access_token($installation_id, $header);

    if (!$resp->is_success) {
        croak "cannot fetch access_token: ". $resp->content;
    }

    my $content = decode_json $resp->content;
    my $token = $content->{token};
    $self->token($token);
    my $expires = $content->{expires_at};
    my $tm = Time::Moment->from_string($expires);
    $self->expires($tm->epoch);

    return $token;
}

sub _post_to_access_token {
    my ($self, $installation_id, $header) = @_;

    return $self->_furl->post(
        "https://api.github.com/app/installations/$installation_id/access_tokens",
        $header,
    );
}

sub _is_expired_token {
    my $self = shift;

    return time() > $self->expires;
}

sub issued_token {
    my $self = shift;

    if ($self->_is_expired_token) {
        return $self->_fetch_access_token;
    }

    return $self->token;
}

package
    GitHub::Apps::Auth::Lazy;


sub _lazy(&) {
    return GitHub::Apps::Auth::Lazy->new($_[0]);
}

use overload
    '""'   => sub { shift->{sub}->() . "" },
    "." => sub {
        my ($self, $other, $reverse) = @_;
        return $reverse ?
            _lazy { "$other" . "$self" } :
            _lazy { "$self" . "$other" };
    };

sub new {
    my ($class, $sub) = @_;
    return bless { sub => $sub }, $class;
}

1;
__END__