feat(github-app): App credentials, installation tokens, and a Select repo picker (#621)

* feat(github-app): App credentials, installation tokens, and a Select repo picker RoboCo was 100% PAT-based. A singleton Fernet-encrypted github_app_credentials row (migration 077, telegram-credentials pattern) now stores the App id + private key; github_app_auth mints RS256 app JWTs and caches installation tokens until 5 minutes before expiry. Projects can bind an installation (projects.github_installation_id): get_decrypted_token returns a minted installation token for bound projects and falls back to the stored PAT on any minting failure, so all ten token consumers work unchanged. CEO-gated routes expose credentials CRUD plus installation/repo listing, and the New Project dialog gains a Select repo picker (disabled with a HelpTip until the App is configured) that fills the git URL and binds the installation; manual URL + PAT stays the default path. * test(panel): mock the GitHub App credentials card in the settings page test --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>
2026-08-03 07:23:24 +02:00 · 2026-07-21 00:54:20 +02:00
parent 2d210ce6ee
commit 7b84162ae9
26 changed files with 2105 additions and 38 deletions
@@ -0,0 +1,96 @@
+"""GitHubAppCredentialsService coverage — plain app_id, encrypted private key,
+all-or-nothing set/clear (mirrors ``test_telegram_credentials_service.py``).
+
+Drives a real ``db_session`` via the project's Postgres-backed conftest.
+"""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+import pytest
+import pytest_asyncio
+from roboco.db.tables import GitHubAppCredentialsTable
+from roboco.services.github_app_credentials import (
+    GitHubAppCredentialsService,
+    GitHubAppCredentialsValidationError,
+    get_github_app_credentials_service,
+)
+from sqlalchemy import select
+
+if TYPE_CHECKING:
+    from collections.abc import AsyncIterator
+
+    from sqlalchemy.ext.asyncio import AsyncSession
+
+_CREDS = {
+    "app_id": "123456",
+    "private_key": "-----BEGIN PRIVATE KEY-----\nfake-pem\n-----END PRIVATE KEY-----",
+}
+
+
+@pytest_asyncio.fixture
+async def svc(
+    db_session: AsyncSession,
+) -> AsyncIterator[GitHubAppCredentialsService]:
+    yield get_github_app_credentials_service(db_session)
+
+
+@pytest.mark.asyncio
+async def test_unset_has_no_credentials(svc: GitHubAppCredentialsService) -> None:
+    assert await svc.has_credentials() is False
+    assert await svc.get_decrypted() is None
+
+
+@pytest.mark.asyncio
+async def test_set_both_stores_and_roundtrips(
+    svc: GitHubAppCredentialsService,
+) -> None:
+    has_creds = await svc.set_credentials(**_CREDS)
+    assert has_creds is True
+    assert await svc.has_credentials() is True
+
+    decrypted = await svc.get_decrypted()
+    assert decrypted is not None
+    assert decrypted.app_id == _CREDS["app_id"]
+    assert decrypted.private_key == _CREDS["private_key"]
+
+
+@pytest.mark.asyncio
+async def test_app_id_stored_plain_key_encrypted(
+    svc: GitHubAppCredentialsService, db_session: AsyncSession
+) -> None:
+    await svc.set_credentials(**_CREDS)
+    result = await db_session.execute(select(GitHubAppCredentialsTable).limit(1))
+    row = result.scalar_one_or_none()
+    assert row is not None
+    assert row.app_id == _CREDS["app_id"]
+    assert row.private_key_encrypted != _CREDS["private_key"]
+
+
+@pytest.mark.asyncio
+async def test_clearing_both_removes_row(svc: GitHubAppCredentialsService) -> None:
+    await svc.set_credentials(**_CREDS)
+    has_creds = await svc.set_credentials(app_id="", private_key="")
+    assert has_creds is False
+    assert await svc.has_credentials() is False
+    assert await svc.get_decrypted() is None
+
+
+@pytest.mark.asyncio
+async def test_partial_set_is_rejected(svc: GitHubAppCredentialsService) -> None:
+    with pytest.raises(GitHubAppCredentialsValidationError):
+        await svc.set_credentials(app_id="only-one", private_key="")
+
+
+@pytest.mark.asyncio
+async def test_rotate_overwrites_previous_values(
+    svc: GitHubAppCredentialsService,
+) -> None:
+    await svc.set_credentials(**_CREDS)
+    rotated = {"app_id": "654321", "private_key": _CREDS["private_key"] + "-rotated"}
+    await svc.set_credentials(**rotated)
+    decrypted = await svc.get_decrypted()
+    assert decrypted is not None
+    assert decrypted.app_id == rotated["app_id"]
+    assert decrypted.private_key == rotated["private_key"]
@@ -0,0 +1,173 @@
+"""GitHub App route coverage — CEO-only credentials + installation/repo listing.
+
+Mirrors ``test_x_routes.py``'s credentials section; the two listing routes
+back the New Project dialog's "Select repo" picker and are covered against a
+mocked ``github_app_auth`` (network calls are covered directly in
+``test_github_app_auth.py``).
+"""
+
+from __future__ import annotations
+
+from http import HTTPStatus
+from typing import TYPE_CHECKING
+from unittest.mock import AsyncMock, patch
+from uuid import UUID, uuid4
+
+import pytest
+import pytest_asyncio
+from fastapi import FastAPI
+from httpx import ASGITransport, AsyncClient
+from roboco.api.deps import get_agent_context, get_db
+from roboco.api.routes.github_app import router as github_app_router
+from roboco.models import AgentRole
+from roboco.models.permissions import AgentContext
+from roboco.services.github_app_auth import (
+    GitHubAppAPIError,
+    GitHubAppNotConfiguredError,
+    Installation,
+    InstallationRepo,
+)
+
+if TYPE_CHECKING:
+    from collections.abc import AsyncIterator
+
+    from sqlalchemy.ext.asyncio import AsyncSession
+
+
+def _build_app(db_session: AsyncSession, role: AgentRole, agent_id: UUID) -> FastAPI:
+    app = FastAPI()
+    app.include_router(github_app_router, prefix="/api/github-app")
+
+    async def _override_db() -> AsyncIterator[AsyncSession]:
+        yield db_session
+
+    async def _override_agent() -> AgentContext:
+        return AgentContext(agent_id=agent_id, role=role, team=None)
+
+    app.dependency_overrides[get_db] = _override_db
+    app.dependency_overrides[get_agent_context] = _override_agent
+    return app
+
+
+@pytest_asyncio.fixture
+async def ceo_client(db_session: AsyncSession) -> AsyncIterator[AsyncClient]:
+    app = _build_app(db_session, AgentRole.CEO, uuid4())
+    transport = ASGITransport(app=app)
+    async with AsyncClient(transport=transport, base_url="http://test") as client:
+        yield client
+    app.dependency_overrides.clear()
+
+
+@pytest.mark.asyncio
+async def test_credentials_default_is_unset(ceo_client: AsyncClient) -> None:
+    resp = await ceo_client.get("/api/github-app/credentials")
+    assert resp.status_code == HTTPStatus.OK
+    assert resp.json()["has_credentials"] is False
+
+
+@pytest.mark.asyncio
+async def test_set_credentials_reports_status_never_plaintext(
+    ceo_client: AsyncClient,
+) -> None:
+    resp = await ceo_client.put(
+        "/api/github-app/credentials",
+        json={
+            "app_id": "123456",
+            "private_key": "-----BEGIN KEY-----\nsecretpem\n-----END KEY-----",
+        },
+    )
+    assert resp.status_code == HTTPStatus.OK
+    assert resp.json() == {"has_credentials": True}
+    assert "secretpem" not in resp.text
+
+    status_resp = await ceo_client.get("/api/github-app/credentials")
+    assert status_resp.json()["has_credentials"] is True
+
+
+@pytest.mark.asyncio
+async def test_partial_credentials_is_400(ceo_client: AsyncClient) -> None:
+    resp = await ceo_client.put(
+        "/api/github-app/credentials",
+        json={"app_id": "123456", "private_key": ""},
+    )
+    assert resp.status_code == HTTPStatus.BAD_REQUEST
+
+
+@pytest.mark.asyncio
+async def test_clear_credentials(ceo_client: AsyncClient) -> None:
+    await ceo_client.put(
+        "/api/github-app/credentials",
+        json={"app_id": "123456", "private_key": "pem-body"},
+    )
+    resp = await ceo_client.delete("/api/github-app/credentials")
+    assert resp.status_code == HTTPStatus.OK
+    assert resp.json() == {"has_credentials": False}
+
+    status_resp = await ceo_client.get("/api/github-app/credentials")
+    assert status_resp.json()["has_credentials"] is False
+
+
+@pytest.mark.asyncio
+async def test_installations_not_configured_is_409(ceo_client: AsyncClient) -> None:
+    with patch(
+        "roboco.api.routes.github_app.list_installations",
+        AsyncMock(side_effect=GitHubAppNotConfiguredError("nope")),
+    ):
+        resp = await ceo_client.get("/api/github-app/installations")
+    assert resp.status_code == HTTPStatus.CONFLICT
+
+
+@pytest.mark.asyncio
+async def test_installations_upstream_error_is_502(ceo_client: AsyncClient) -> None:
+    with patch(
+        "roboco.api.routes.github_app.list_installations",
+        AsyncMock(side_effect=GitHubAppAPIError("boom")),
+    ):
+        resp = await ceo_client.get("/api/github-app/installations")
+    assert resp.status_code == HTTPStatus.BAD_GATEWAY
+
+
+@pytest.mark.asyncio
+async def test_installations_returns_list(ceo_client: AsyncClient) -> None:
+    with patch(
+        "roboco.api.routes.github_app.list_installations",
+        AsyncMock(return_value=[Installation(id=1, account_login="acme")]),
+    ):
+        resp = await ceo_client.get("/api/github-app/installations")
+    assert resp.status_code == HTTPStatus.OK
+    assert resp.json() == [{"id": 1, "account_login": "acme"}]
+
+
+@pytest.mark.asyncio
+async def test_installation_repositories_returns_list(ceo_client: AsyncClient) -> None:
+    repos = [
+        InstallationRepo(
+            full_name="acme/widgets",
+            clone_url="https://github.com/acme/widgets.git",
+            private=True,
+        )
+    ]
+    with patch(
+        "roboco.api.routes.github_app.list_installation_repositories",
+        AsyncMock(return_value=repos),
+    ):
+        resp = await ceo_client.get("/api/github-app/installations/1/repositories")
+    assert resp.status_code == HTTPStatus.OK
+    assert resp.json() == [
+        {
+            "full_name": "acme/widgets",
+            "clone_url": "https://github.com/acme/widgets.git",
+            "private": True,
+        }
+    ]
+
+
+@pytest.mark.asyncio
+async def test_non_ceo_is_forbidden(db_session: AsyncSession) -> None:
+    app = _build_app(db_session, AgentRole.DEVELOPER, uuid4())
+    transport = ASGITransport(app=app)
+    async with AsyncClient(transport=transport, base_url="http://test") as client:
+        creds_resp = await client.get("/api/github-app/credentials")
+        installs_resp = await client.get("/api/github-app/installations")
+    assert creds_resp.status_code == HTTPStatus.FORBIDDEN
+    assert installs_resp.status_code == HTTPStatus.FORBIDDEN