github_test.go

package resource_test

import (
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"encoding/json"
	"encoding/pem"
	"fmt"
	"io"
	"net/http"
	"net/url"
	"time"

	. "github.com/concourse/github-release-resource"

	. "github.com/onsi/ginkgo/v2"
	. "github.com/onsi/gomega"

	"github.com/google/go-github/v88/github"
	"github.com/onsi/gomega/ghttp"
)

const (
	multiPageRespEnterprise = `{
 "data": {
   "repository": {
     "releases": {
       "edges": [
         {
           "node": {
             "createdAt": "2010-10-01T00:58:07Z",
             "id": "MDc6UmVsZWFzZTMyMDk1MTAz",
             "name": "xyz",
             "publishedAt": "2010-10-02T15:39:53Z",
             "tagName": "xyz",
             "url": "https://github.com/xyz/xyz/releases/tag/xyz",
             "isDraft": false,
             "isPrerelease": false
           }
         },
         {
           "node": {
             "createdAt": "2010-08-27T13:55:36Z",
             "id": "MDc6UmVsZWFzZTMwMjMwNjU5",
             "name": "xyz",
             "publishedAt": "2010-08-27T17:18:06Z",
             "tagName": "xyz",
             "url": "https://github.com/xyz/xyz/releases/tag/xyz",
             "isDraft": false,
             "isPrerelease": false
           }
         }
       ],
       "pageInfo": {
         "endCursor": "Y3Vyc29yOnYyOpK5MjAyMC0xMC0wMVQwMjo1ODowNyswMjowMM4B6bt_",
         "hasNextPage": true
       }
     }
   }
 }
}`

	singlePageRespEnterprise = `{
  "data": {
    "repository": {
      "releases": {
        "edges": [
          {
            "node": {
              "createdAt": "2010-10-10T01:01:07Z",
              "id": "MDc6UmVsZWFzZTMzMjIyMjQz",
              "name": "xyq",
              "publishedAt": "2010-10-10T15:39:53Z",
              "tagName": "xyq",
              "url": "https://github.com/xyq/xyq/releases/tag/xyq",
              "isDraft": false,
              "isPrerelease": false
            }
          }
        ],
        "pageInfo": {
          "endCursor": "Y3Vyc29yOnYyOpK5MjAyMC0xMC0wMVQwMjo1ODowNyswMjowMM4B6bt_",
          "hasNextPage": false
        }
      }
    }
  }
}`
	invalidPageIdResp = `{
  "data": {
    "repository": {
      "releases": {
        "edges": [
          {
            "node": {
              "createdAt": "2010-10-10T01:01:07Z",
              "id": "MDc6UmVsZWFzZTMzMjZyzzzz",
              "databaseId":"3322224a",
              "name": "xyq",
              "publishedAt": "2010-10-10T15:39:53Z",
              "tagName": "xyq",
              "url": "https://github.com/xyq/xyq/releases/tag/xyq",
              "isDraft": false,
              "isPrerelease": false
            }
          }
        ],
        "pageInfo": {
          "endCursor": "Y3Vyc29yOnYyOpK5MjAyMC0xMC0wMVQwMjo1ODowNyswMjowMM4B6bt_",
          "hasNextPage": false
        }
      }
    }
  }
}`
	rateLimitMessage = `{
          "message": "API rate limit exceeded for 127.0.0.1. (But here's the good news: Authenticated requests get a higher rate limit. Check out the documentation for more details.)",
          "documentation_url": "https://developer.github.com/v3/#rate-limiting"
        }`
)

var _ = Describe("GitHub Client", func() {
	var server *ghttp.Server
	var client *GitHubClient
	var source Source

	BeforeEach(func() {
		server = ghttp.NewServer()
	})

	JustBeforeEach(func() {
		source.GitHubAPIURL = server.URL() + "/"

		var err error
		client, err = NewGitHubClient(source)
		Ω(err).ShouldNot(HaveOccurred())
	})

	AfterEach(func() {
		server.Close()
	})

	Context("with bad URLs", func() {
		BeforeEach(func() {
			source.AccessToken = "hello?"
		})

		It("returns an error if the API URL is bad", func() {
			source.GitHubAPIURL = ":"

			_, err := NewGitHubClient(source)
			Ω(err).Should(HaveOccurred())
		})

		It("returns an error if the API URL is bad", func() {
			source.GitHubUploadsURL = ":"

			_, err := NewGitHubClient(source)
			Ω(err).Should(HaveOccurred())
		})
	})

	Context("with good URLs", func() {
		var err error
		BeforeEach(func() {
			source = Source{
				Owner:      "concourse",
				Repository: "concourse",
			}
		})
		Context("deriving the GraphQL (v4) endpoint from the v3 API URL", func() {
			DescribeTable("appends graphql, stripping any /v3 suffix first",
				func(apiPath, expectedGraphQLPath string) {
					server.AppendHandlers(
						ghttp.CombineHandlers(
							ghttp.VerifyRequest("POST", expectedGraphQLPath),
							ghttp.RespondWith(200, singlePageRespEnterprise),
						),
					)

					source.GitHubAPIURL = server.URL() + apiPath
					//setting the access token is how we ensure the v4 client is used
					source.AccessToken = "abc123"
					client, err = NewGitHubClient(source)
					Expect(err).ShouldNot(HaveOccurred())

					_, err := client.ListReleases()
					Expect(err).ShouldNot(HaveOccurred())
				},
				Entry("strips a /v3/ suffix", "/api/v3/", "/api/graphql"),
				Entry("strips a /v3 suffix without a trailing slash", "/api/v3", "/api/graphql"),
				Entry("appends graphql when the path already ends in a slash", "/api/", "/api/graphql"),
				Entry("appends graphql when the path has no trailing slash", "/api", "/api/graphql"),
				Entry("handles a bare host with a trailing slash", "/", "/graphql"),
			)
		})
	})

	Context("with an OAuth Token", func() {
		BeforeEach(func() {
			source = Source{
				Owner:       "concourse",
				Repository:  "concourse",
				AccessToken: "abc123",
			}

			server.SetAllowUnhandledRequests(true)
			server.AppendHandlers(
				ghttp.CombineHandlers(
					ghttp.VerifyRequest("POST", "/graphql"),
					ghttp.RespondWith(200, singlePageRespEnterprise),
					ghttp.VerifyHeaderKV("Authorization", "Bearer abc123"),
				),
			)
		})

		It("sends one", func() {
			_, err := client.ListReleases()
			Ω(err).ShouldNot(HaveOccurred())
		})
	})

	Context("without an OAuth Token", func() {
		BeforeEach(func() {
			source = Source{
				Owner:      "concourse",
				Repository: "concourse",
			}

			server.AppendHandlers(
				ghttp.CombineHandlers(
					ghttp.VerifyRequest("GET", "/repos/concourse/concourse/releases"),
					ghttp.RespondWith(200, "[]"),
					ghttp.VerifyHeader(http.Header{"Authorization": nil}),
				),
			)
		})

		It("sends one", func() {
			_, err := client.ListReleases()
			Ω(err).ShouldNot(HaveOccurred())
		})
	})

	Describe("ListReleases with access token", func() {
		BeforeEach(func() {
			source = Source{
				Owner:       "concourse",
				Repository:  "concourse",
				AccessToken: "test",
			}
		})
		Context("List graphql releases", func() {
			BeforeEach(func() {
				server.AppendHandlers(
					ghttp.CombineHandlers(
						ghttp.VerifyRequest("POST", "/graphql"),
						ghttp.RespondWith(200, multiPageRespEnterprise),
					),
					ghttp.CombineHandlers(
						ghttp.VerifyRequest("POST", "/graphql"),
						ghttp.RespondWith(200, singlePageRespEnterprise),
					),
				)
			})

			It("list releases", func() {
				releases, err := client.ListReleases()
				Ω(err).ShouldNot(HaveOccurred())
				Expect(releases).To(HaveLen(3))
				Expect(server.ReceivedRequests()).To(HaveLen(2))
				Expect(releases).To(Equal([]*github.RepositoryRelease{
					{
						TagName:     github.String("xyz"),
						Name:        github.String("xyz"),
						Draft:       github.Bool(false),
						Prerelease:  github.Bool(false),
						ID:          github.Int64(32095103),
						CreatedAt:   &github.Timestamp{Time: time.Date(2010, time.October, 01, 00, 58, 07, 0, time.UTC)},
						PublishedAt: &github.Timestamp{Time: time.Date(2010, time.October, 02, 15, 39, 53, 0, time.UTC)},
						URL:         github.String("https://github.com/xyz/xyz/releases/tag/xyz"),
					},
					{
						TagName:     github.String("xyz"),
						Name:        github.String("xyz"),
						Draft:       github.Bool(false),
						Prerelease:  github.Bool(false),
						ID:          github.Int64(30230659),
						CreatedAt:   &github.Timestamp{Time: time.Date(2010, time.August, 27, 13, 55, 36, 0, time.UTC)},
						PublishedAt: &github.Timestamp{Time: time.Date(2010, time.August, 27, 17, 18, 06, 0, time.UTC)},
						URL:         github.String("https://github.com/xyz/xyz/releases/tag/xyz"),
					},
					{
						TagName:     github.String("xyq"),
						Name:        github.String("xyq"),
						Draft:       github.Bool(false),
						Prerelease:  github.Bool(false),
						ID:          github.Int64(33222243),
						CreatedAt:   &github.Timestamp{Time: time.Date(2010, time.October, 10, 01, 01, 07, 0, time.UTC)},
						PublishedAt: &github.Timestamp{Time: time.Date(2010, time.October, 10, 15, 39, 53, 0, time.UTC)},
						URL:         github.String("https://github.com/xyq/xyq/releases/tag/xyq"),
					},
				}))
			})
		})

		Context("List graphql releases with bad id", func() {
			BeforeEach(func() {
				server.SetAllowUnhandledRequests(true)
				server.AppendHandlers(
					ghttp.CombineHandlers(
						ghttp.VerifyRequest("POST", "/graphql"),
						ghttp.RespondWith(200, invalidPageIdResp),
					))
			})
			It("list releases with incorrect id", func() {
				_, err := client.ListReleases()
				Ω(err).Should(HaveOccurred())
			})
		})
	})

	Describe("ListReleases without access token", func() {
		BeforeEach(func() {
			source = Source{
				Owner:      "concourse",
				Repository: "concourse",
			}
		})
		Context("When list of releases return more then 100 items", func() {
			Context("List graphql releases", func() {
				BeforeEach(func() {
					var result []*github.RepositoryRelease
					for i := 1; i < 102; i++ {
						result = append(result, &github.RepositoryRelease{ID: github.Int64(int64(i))})
					}
					server.AppendHandlers(
						ghttp.CombineHandlers(ghttp.VerifyRequest("GET", "/repos/concourse/concourse/releases", "per_page=100"),
							ghttp.RespondWithJSONEncoded(200, result[:100], http.Header{"Link": []string{`</releases?page=2>; rel="next"`}}),
						),
						ghttp.CombineHandlers(ghttp.VerifyRequest("GET", "/repos/concourse/concourse/releases", "per_page=100&page=2"),
							ghttp.RespondWithJSONEncoded(200, result[100:])),
					)
				})
				It("list releases", func() {
					releases, err := client.ListReleases()
					Ω(err).ShouldNot(HaveOccurred())
					Expect(releases).To(HaveLen(101))
					Expect(server.ReceivedRequests()).To(HaveLen(2))
				})

			})
		})
	})

	Describe("ListReleasesAssets without access token", func() {
		BeforeEach(func() {
			source = Source{
				Owner:      "concourse",
				Repository: "concourse",
			}
		})
		Context("When list of assets return less than 100 items", func() {
			BeforeEach(func() {
				var result []*github.ReleaseAsset
				for i := 1; i <= 50; i++ {
					result = append(result, &github.ReleaseAsset{ID: github.Int64(int64(i))})
				}
				server.AppendHandlers(
					ghttp.CombineHandlers(
						ghttp.VerifyRequest("GET", "/repos/concourse/concourse/releases/1/assets", "per_page=100"),
						ghttp.RespondWithJSONEncoded(200, result),
					),
				)
			})
			It("lists all release assets", func() {
				releasesAssets, err := client.ListReleaseAssets(github.RepositoryRelease{ID: github.Int64(1)})
				Ω(err).ShouldNot(HaveOccurred())
				Expect(releasesAssets).To(HaveLen(50))
				Expect(server.ReceivedRequests()).To(HaveLen(1))
			})
		})
		Context("When list of assets return more then 100 items", func() {
			Context("List graphql releases", func() {
				BeforeEach(func() {
					var result []*github.ReleaseAsset
					for i := 1; i <= 102; i++ {
						result = append(result, &github.ReleaseAsset{ID: github.Int64(int64(i))})
					}
					server.AppendHandlers(
						ghttp.CombineHandlers(ghttp.VerifyRequest("GET", "/repos/concourse/concourse/releases/1/assets", "per_page=100"),
							ghttp.RespondWithJSONEncoded(200, result[:100], http.Header{"Link": []string{`</releases/1/assets?page=2>; rel="next"`}}),
						),
						ghttp.CombineHandlers(ghttp.VerifyRequest("GET", "/repos/concourse/concourse/releases/1/assets", "per_page=100&page=2"),
							ghttp.RespondWithJSONEncoded(200, result[100:])),
					)
				})
				It("list release assets", func() {
					releasesAssets, err := client.ListReleaseAssets(github.RepositoryRelease{ID: github.Int64(1)})
					Ω(err).ShouldNot(HaveOccurred())
					Expect(releasesAssets).To(HaveLen(102))
					Expect(server.ReceivedRequests()).To(HaveLen(2))
				})

			})
		})
	})

	Describe("GetRelease", func() {
		BeforeEach(func() {
			source = Source{
				Owner:      "concourse",
				Repository: "concourse",
			}
		})
		Context("When GitHub's rate limit has been exceeded", func() {
			BeforeEach(func() {
				rateLimitResponse := rateLimitMessage

				rateLimitHeaders := http.Header(map[string][]string{
					"X-RateLimit-Limit":     {"60"},
					"X-RateLimit-Remaining": {"0"},
					"X-RateLimit-Reset":     {"1377013266"},
				})

				server.AppendHandlers(
					ghttp.CombineHandlers(
						ghttp.VerifyRequest("GET", "/repos/concourse/concourse/releases/20"),
						ghttp.RespondWith(403, rateLimitResponse, rateLimitHeaders),
					),
				)
			})

			It("Returns an appropriate error", func() {
				_, err := client.GetRelease(20)
				Expect(err).ToNot(BeNil())
				Expect(err.Error()).To(ContainSubstring("API rate limit exceeded for 127.0.0.1. (But here's the good news: Authenticated requests get a higher rate limit. Check out the documentation for more details.)"))
			})
		})
	})

	Describe("GetReleaseByTag", func() {
		BeforeEach(func() {
			source = Source{
				Owner:      "concourse",
				Repository: "concourse",
			}
		})

		Context("When GitHub's rate limit has been exceeded", func() {
			BeforeEach(func() {
				rateLimitResponse := rateLimitMessage

				rateLimitHeaders := http.Header(map[string][]string{
					"X-RateLimit-Limit":     {"60"},
					"X-RateLimit-Remaining": {"0"},
					"X-RateLimit-Reset":     {"1377013266"},
				})

				server.AppendHandlers(
					ghttp.CombineHandlers(
						ghttp.VerifyRequest("GET", "/repos/concourse/concourse/releases/tags/some-tag"),
						ghttp.RespondWith(403, rateLimitResponse, rateLimitHeaders),
					),
				)
			})

			It("Returns an appropriate error", func() {
				_, err := client.GetReleaseByTag("some-tag")
				Expect(err).ToNot(BeNil())
				Expect(err.Error()).To(ContainSubstring("API rate limit exceeded for 127.0.0.1. (But here's the good news: Authenticated requests get a higher rate limit. Check out the documentation for more details.)"))
			})
		})

		Context("When GitHub responds successfully", func() {
			BeforeEach(func() {
				server.AppendHandlers(
					ghttp.CombineHandlers(
						ghttp.VerifyRequest("GET", "/repos/concourse/concourse/releases/tags/some-tag"),
						ghttp.RespondWith(200, `{ "id": 1 }`),
					),
				)
			})

			It("Returns a populated github.RepositoryRelease", func() {
				expectedRelease := &github.RepositoryRelease{
					ID: github.Int64(1),
				}

				release, err := client.GetReleaseByTag("some-tag")

				Ω(err).ShouldNot(HaveOccurred())
				Expect(release).To(Equal(expectedRelease))
			})
		})
	})

	Describe("ResolveTagToCommitSHA", func() {
		BeforeEach(func() {
			source = Source{
				Owner:      "concourse",
				Repository: "concourse",
			}
		})

		Context("When GitHub's rate limit has been exceeded", func() {
			BeforeEach(func() {
				rateLimitResponse := rateLimitMessage

				rateLimitHeaders := http.Header(map[string][]string{
					"X-RateLimit-Limit":     {"60"},
					"X-RateLimit-Remaining": {"0"},
					"X-RateLimit-Reset":     {"1377013266"},
				})

				server.AppendHandlers(
					ghttp.CombineHandlers(
						ghttp.VerifyRequest("GET", "/repos/concourse/concourse/git/ref/tags/some-tag"),
						ghttp.RespondWith(403, rateLimitResponse, rateLimitHeaders),
					),
				)
			})

			It("Returns an appropriate error", func() {
				_, err := client.ResolveTagToCommitSHA("some-tag")
				Expect(err).ToNot(BeNil())
				Expect(err.Error()).To(ContainSubstring("API rate limit exceeded for 127.0.0.1. (But here's the good news: Authenticated requests get a higher rate limit. Check out the documentation for more details.)"))
			})
		})

		Context("When GitHub returns a lightweight tag", func() {
			BeforeEach(func() {
				server.AppendHandlers(
					ghttp.CombineHandlers(
						ghttp.VerifyRequest("GET", "/repos/concourse/concourse/git/ref/tags/some-tag"),
						ghttp.RespondWith(200, `{ "ref": "refs/tags/some-tag", "object" : { "type": "commit", "sha": "some-sha"} }`),
					),
				)
			})

			It("Returns the associated commit SHA", func() {
				reference, err := client.ResolveTagToCommitSHA("some-tag")

				Ω(err).ShouldNot(HaveOccurred())
				Expect(reference).To(Equal("some-sha"))
			})
		})

		Context("When GitHub returns a reference to an annotated tag", func() {
			BeforeEach(func() {
				server.AppendHandlers(
					ghttp.CombineHandlers(
						ghttp.VerifyRequest("GET", "/repos/concourse/concourse/git/ref/tags/some-tag"),
						ghttp.RespondWith(200, `{ "ref": "refs/tags/some-tag", "object" : { "type": "tag", "sha": "some-tag-sha"} }`),
					),
				)
			})

			Context("When GitHub returns the annotated tag", func() {
				BeforeEach(func() {
					server.AppendHandlers(
						ghttp.CombineHandlers(
							ghttp.VerifyRequest("GET", "/repos/concourse/concourse/git/tags/some-tag-sha"),
							ghttp.RespondWith(200, `{ "object" : { "type": "commit", "sha": "some-sha"} }`),
						),
					)
				})

				It("Returns the associated commit SHA", func() {
					reference, err := client.ResolveTagToCommitSHA("some-tag")

					Ω(err).ShouldNot(HaveOccurred())
					Expect(reference).To(Equal("some-sha"))
				})
			})

			Context("When GitHub fails to fetch the annotated tag", func() {
				BeforeEach(func() {
					server.AppendHandlers(
						ghttp.CombineHandlers(
							ghttp.VerifyRequest("GET", "/repos/concourse/concourse/git/tags/some-tag-sha"),
							ghttp.RespondWith(404, nil),
						),
					)
				})

				It("Returns an error", func() {
					_, err := client.ResolveTagToCommitSHA("some-tag")
					Ω(err).Should(HaveOccurred())
				})
			})

		})
		Context("When GitHub returns a chain of annotated tags", func() {
			BeforeEach(func() {
				// First call: get the ref which points to the first tag
				server.AppendHandlers(
					ghttp.CombineHandlers(
						ghttp.VerifyRequest("GET", "/repos/concourse/concourse/git/ref/tags/v1.0.0-rc90"),
						ghttp.RespondWith(200, `{ "ref": "refs/tags/v1.0.0-rc90", "object" : { "type": "tag", "sha": "first-tag-sha"} }`),
					),
				)

				// Second call: get the first tag object, which points to another tag
				server.AppendHandlers(
					ghttp.CombineHandlers(
						ghttp.VerifyRequest("GET", "/repos/concourse/concourse/git/tags/first-tag-sha"),
						ghttp.RespondWith(200, `{ "object" : { "type": "tag", "sha": "second-tag-sha"} }`),
					),
				)

				// Third call: get the second tag object, which finally points to a commit
				server.AppendHandlers(
					ghttp.CombineHandlers(
						ghttp.VerifyRequest("GET", "/repos/concourse/concourse/git/tags/second-tag-sha"),
						ghttp.RespondWith(200, `{ "object" : { "type": "commit", "sha": "final-commit-sha"} }`),
					),
				)
			})

			It("follows the chain and returns the final commit SHA", func() {
				commitSHA, err := client.ResolveTagToCommitSHA("v1.0.0-rc90")

				Expect(err).ShouldNot(HaveOccurred())
				Expect(commitSHA).To(Equal("final-commit-sha"))
			})
		})

		Context("When GitHub returns a very deep chain of annotated tags", func() {
			BeforeEach(func() {
				// First call: get the ref
				server.AppendHandlers(
					ghttp.CombineHandlers(
						ghttp.VerifyRequest("GET", "/repos/concourse/concourse/git/ref/tags/deeply-nested"),
						ghttp.RespondWith(200, `{ "ref": "refs/tags/deeply-nested", "object" : { "type": "tag", "sha": "tag-sha-0"} }`),
					),
				)

				// Add 11 tag-to-tag redirections (exceeding our max depth of 10)
				for i := range 11 {
					currentSHA := fmt.Sprintf("tag-sha-%d", i)
					nextSHA := fmt.Sprintf("tag-sha-%d", i+1)
					server.AppendHandlers(
						ghttp.CombineHandlers(
							ghttp.VerifyRequest("GET", fmt.Sprintf("/repos/concourse/concourse/git/tags/%s", currentSHA)),
							ghttp.RespondWith(200, fmt.Sprintf(`{ "object" : { "type": "tag", "sha": "%s"} }`, nextSHA)),
						),
					)
				}
			})

			It("returns an error when max depth is exceeded", func() {
				_, err := client.ResolveTagToCommitSHA("deeply-nested")

				Expect(len(server.ReceivedRequests())).To(Equal(11)) // first call + max depth value
				Expect(err).Should(HaveOccurred())
				Expect(err.Error()).To(ContainSubstring("exceeded maximum tag chain depth"))
			})
		})

		Context("When a tag in the chain points to an unexpected object type", func() {
			BeforeEach(func() {
				server.AppendHandlers(
					ghttp.CombineHandlers(
						ghttp.VerifyRequest("GET", "/repos/concourse/concourse/git/ref/tags/bad-tag"),
						ghttp.RespondWith(200, `{ "ref": "refs/tags/bad-tag", "object" : { "type": "tag", "sha": "tag-sha"} }`),
					),
				)

				server.AppendHandlers(
					ghttp.CombineHandlers(
						ghttp.VerifyRequest("GET", "/repos/concourse/concourse/git/tags/tag-sha"),
						ghttp.RespondWith(200, `{ "object" : { "type": "tree", "sha": "tree-sha"} }`),
					),
				)
			})

			It("returns an error for unexpected object types", func() {
				_, err := client.ResolveTagToCommitSHA("bad-tag")

				Expect(err).Should(HaveOccurred())
				Expect(err.Error()).To(ContainSubstring("expected 'commit' or 'tag'"))
			})
		})
	})

	Describe("DownloadReleaseAsset", func() {
		const (
			owner = "bob"
			repo  = "burgers"
		)

		var (
			assetID   int64
			asset     github.ReleaseAsset
			assetPath string
		)

		BeforeEach(func() {
			source.Owner = owner
			source.Repository = repo
			source.AccessToken = "abc123"
			assetID = 42
			asset = github.ReleaseAsset{ID: &assetID}
			assetPath = fmt.Sprintf("/repos/%s/%s/releases/assets/%d", owner, repo, assetID)
		})

		var appendGetHandler = func(server *ghttp.Server, path string, statusCode int, body string, usesAuth bool, headers ...http.Header) {
			var authHeaderValue []string
			if usesAuth {
				authHeaderValue = []string{"Bearer abc123"}
			}
			server.AppendHandlers(ghttp.CombineHandlers(
				ghttp.VerifyRequest("GET", path),
				ghttp.RespondWith(statusCode, body, headers...),
				ghttp.VerifyHeaderKV("Accept", "application/octet-stream"),
				ghttp.VerifyHeaderKV("Authorization", authHeaderValue...),
			))
		}

		var locationHeader = func(url string) http.Header {
			header := make(http.Header)
			header.Add("Location", url)
			return header
		}

		Context("when the asset can be downloaded directly", func() {
			Context("when the asset is downloaded successfully", func() {
				const (
					fileContents = "some-random-contents-from-github"
				)

				BeforeEach(func() {
					appendGetHandler(server, assetPath, 200, fileContents, true)
				})

				It("returns the correct body", func() {
					readCloser, err := client.DownloadReleaseAsset(asset)
					Expect(err).NotTo(HaveOccurred())
					defer readCloser.Close()

					body, err := io.ReadAll(readCloser)
					Expect(err).NotTo(HaveOccurred())
					Expect(string(body)).To(Equal(fileContents))
				})
			})

			Context("when there is an error downloading the asset", func() {
				BeforeEach(func() {
					appendGetHandler(server, assetPath, 401, "authorized personnel only", true)
				})

				It("returns an error", func() {
					_, err := client.DownloadReleaseAsset(asset)
					Expect(err).To(HaveOccurred())
				})
			})
		})

		Context("when the asset is behind a redirect", func() {
			const redirectPath = "/the/redirect/path"

			BeforeEach(func() {
				appendGetHandler(server, assetPath, http.StatusFound, "", true, locationHeader(redirectPath))
			})

			Context("when the redirect succeeds", func() {
				const (
					redirectFileContents = "some-random-contents-from-redirect"
				)

				BeforeEach(func() {
					appendGetHandler(server, redirectPath, 200, redirectFileContents, true)
				})

				It("returns the body from the redirect request", func() {
					readCloser, err := client.DownloadReleaseAsset(asset)
					Expect(err).NotTo(HaveOccurred())
					defer readCloser.Close()

					body, err := io.ReadAll(readCloser)
					Expect(err).NotTo(HaveOccurred())
					Expect(string(body)).To(Equal(redirectFileContents))
				})

			})

			Context("when there is another redirect to a URL that succeeds", func() {
				const (
					redirectFileContents = "some-random-contents-from-redirect"
				)

				BeforeEach(func() {
					appendGetHandler(server, redirectPath, http.StatusFound, "", true, locationHeader("/somewhere-else"))
					appendGetHandler(server, "/somewhere-else", 200, redirectFileContents, true)
				})

				It("returns the body from the final redirect request", func() {
					readCloser, err := client.DownloadReleaseAsset(asset)
					Expect(err).NotTo(HaveOccurred())
					defer readCloser.Close()

					body, err := io.ReadAll(readCloser)
					Expect(err).NotTo(HaveOccurred())
					Expect(string(body)).To(Equal(redirectFileContents))
				})
			})

			Context("when there is another redirect to an external server", func() {
				const (
					redirectFileContents = "some-random-contents-from-redirect"
				)

				var externalServer *ghttp.Server

				BeforeEach(func() {
					externalServer = ghttp.NewServer()
					u, err := url.Parse(externalServer.URL())
					Expect(err).NotTo(HaveOccurred())
					externalUrl := fmt.Sprintf("http://localhost:%s", u.Port())

					appendGetHandler(server, redirectPath, http.StatusFound, "", true, locationHeader(externalUrl+"/somewhere-else"))
					appendGetHandler(externalServer, "/somewhere-else", 200, redirectFileContents, false)
				})

				It("downloads the file without the Authorization header", func() {
					readCloser, err := client.DownloadReleaseAsset(asset)
					Expect(err).NotTo(HaveOccurred())
					defer readCloser.Close()

					body, err := io.ReadAll(readCloser)
					Expect(err).NotTo(HaveOccurred())
					Expect(string(body)).To(Equal(redirectFileContents))
				})
			})

			Context("when the redirect request response is a 400", func() {
				BeforeEach(func() {
					appendGetHandler(server, redirectPath, 400, "oops", true)
				})

				It("returns an error", func() {
					_, err := client.DownloadReleaseAsset(asset)
					Expect(err).To(HaveOccurred())
				})
			})

			Context("when the redirect request response is a 401", func() {
				BeforeEach(func() {
					appendGetHandler(server, redirectPath, 401, "authorized personnel only", true)
				})

				It("returns an error", func() {
					_, err := client.DownloadReleaseAsset(asset)
					Expect(err).To(HaveOccurred())
				})
			})

			Context("when the redirect request response is a 403", func() {

				BeforeEach(func() {
					appendGetHandler(server, redirectPath, 403, "authorized personnel only", true)
				})

				It("returns an error", func() {
					_, err := client.DownloadReleaseAsset(asset)
					Expect(err).To(HaveOccurred())
				})
			})

			Context("when the redirect request response is a 404", func() {
				BeforeEach(func() {
					appendGetHandler(server, redirectPath, 404, "I don't know her", true)
				})

				It("returns an error", func() {
					_, err := client.DownloadReleaseAsset(asset)
					Expect(err).To(HaveOccurred())
				})
			})

			Context("when the redirect request response is a 500", func() {
				BeforeEach(func() {
					appendGetHandler(server, redirectPath, 500, "boom", true)
				})

				It("returns an error", func() {
					_, err := client.DownloadReleaseAsset(asset)
					Expect(err).To(HaveOccurred())
				})
			})
		})

		Context("when the asset is behind a redirect on an external server", func() {
			const (
				redirectFileContents = "some-random-contents-from-redirect"
			)

			var externalServer *ghttp.Server

			BeforeEach(func() {
				externalServer = ghttp.NewServer()

				appendGetHandler(server, assetPath, http.StatusFound, "", true, locationHeader(externalServer.URL()+"/somewhere-else"))
				appendGetHandler(externalServer, "/somewhere-else", 200, redirectFileContents, false)
			})

			It("downloads the file without the Authorization header", func() {
				readCloser, err := client.DownloadReleaseAsset(asset)
				Expect(err).NotTo(HaveOccurred())
				defer readCloser.Close()

				body, err := io.ReadAll(readCloser)
				Expect(err).NotTo(HaveOccurred())
				Expect(string(body)).To(Equal(redirectFileContents))
			})
		})
	})

	Describe("FlexInt64 unmarshaling", func() {
		It("unmarshals app_id from a JSON number", func() {
			input := `{"owner":"o","repository":"r","app_id":12345,"private_key":"k"}`
			var s Source
			err := json.Unmarshal([]byte(input), &s)
			Expect(err).NotTo(HaveOccurred())
			Expect(int64(s.AppID)).To(Equal(int64(12345)))
		})

		It("unmarshals app_id from a JSON string", func() {
			input := `{"owner":"o","repository":"r","app_id":"67890","private_key":"k"}`
			var s Source
			err := json.Unmarshal([]byte(input), &s)
			Expect(err).NotTo(HaveOccurred())
			Expect(int64(s.AppID)).To(Equal(int64(67890)))
		})

		It("returns an error for a non-numeric string", func() {
			input := `{"owner":"o","repository":"r","app_id":"not-a-number","private_key":"k"}`
			var s Source
			err := json.Unmarshal([]byte(input), &s)
			Expect(err).To(HaveOccurred())
			Expect(err.Error()).To(ContainSubstring("not a valid integer"))
		})
	})

	Describe("Auth validation", func() {
		It("returns an error when both access_token and app credentials are set", func() {
			_, err := NewGitHubClient(Source{
				Owner:        "concourse",
				Repository:   "concourse",
				AccessToken:  "some-token",
				AppID:        12345,
				PrivateKey:   "some-key",
				GitHubAPIURL: server.URL() + "/",
			})
			Expect(err).To(HaveOccurred())
			Expect(err.Error()).To(ContainSubstring("cannot specify both access_token and app credentials"))
		})

		It("returns an error when app_id is set without private_key", func() {
			_, err := NewGitHubClient(Source{
				Owner:        "concourse",
				Repository:   "concourse",
				AppID:        12345,
				GitHubAPIURL: server.URL() + "/",
			})
			Expect(err).To(HaveOccurred())
			Expect(err.Error()).To(ContainSubstring("both app_id and private_key must be specified"))
		})

		It("returns an error when private_key is set without app_id", func() {
			_, err := NewGitHubClient(Source{
				Owner:        "concourse",
				Repository:   "concourse",
				PrivateKey:   "some-key",
				GitHubAPIURL: server.URL() + "/",
			})
			Expect(err).To(HaveOccurred())
			Expect(err.Error()).To(ContainSubstring("both app_id and private_key must be specified"))
		})
	})

	Describe("GitHub App authentication", func() {
		var testKeyPEM string

		BeforeEach(func() {
			key, err := rsa.GenerateKey(rand.Reader, 2048)
			Expect(err).NotTo(HaveOccurred())

			testKeyPEM = string(pem.EncodeToMemory(&pem.Block{
				Type:  "RSA PRIVATE KEY",
				Bytes: x509.MarshalPKCS1PrivateKey(key),
			}))
		})

		Context("when the installation is found", func() {
			It("creates a client that uses the installation token for GraphQL", func() {
				// Mock: discover installation for repo
				server.AppendHandlers(
					ghttp.CombineHandlers(
						ghttp.VerifyRequest("GET", "/repos/concourse/concourse/installation"),
						ghttp.RespondWithJSONEncoded(200, map[string]any{
							"id":     1234,
							"app_id": 99,
						}),
					),
				)

				// Mock: create installation access token
				server.AppendHandlers(
					ghttp.CombineHandlers(
						ghttp.VerifyRequest("POST", "/app/installations/1234/access_tokens"),
						ghttp.RespondWithJSONEncoded(201, map[string]any{
							"token":      "ghs_testinstalltoken",
							"expires_at": time.Now().Add(1 * time.Hour).Format(time.RFC3339),
						}),
					),
				)

				// Mock: the actual GraphQL call
				server.AppendHandlers(
					ghttp.CombineHandlers(
						ghttp.VerifyRequest("POST", "/graphql"),
						ghttp.VerifyHeaderKV("Authorization", "token ghs_testinstalltoken"),
						ghttp.RespondWith(200, singlePageRespEnterprise),
					),
				)

				appClient, err := NewGitHubClient(Source{
					Owner:        "concourse",
					Repository:   "concourse",
					AppID:        99,
					PrivateKey:   testKeyPEM,
					GitHubAPIURL: server.URL() + "/",
				})
				Expect(err).NotTo(HaveOccurred())

				releases, err := appClient.ListReleases()
				Expect(err).NotTo(HaveOccurred())
				Expect(releases).To(HaveLen(1))
			})
		})

		Context("when the installation is not found", func() {
			It("returns an error", func() {
				server.AppendHandlers(
					ghttp.CombineHandlers(
						ghttp.VerifyRequest("GET", "/repos/concourse/concourse/installation"),
						ghttp.RespondWith(404, `{"message": "Not Found"}`),
					),
				)

				_, err := NewGitHubClient(Source{
					Owner:        "concourse",
					Repository:   "concourse",
					AppID:        99,
					PrivateKey:   testKeyPEM,
					GitHubAPIURL: server.URL() + "/",
				})
				Expect(err).To(HaveOccurred())
				Expect(err.Error()).To(ContainSubstring("finding GitHub App installation for concourse/concourse"))
			})
		})

		Context("when the private key is invalid", func() {
			It("returns an error", func() {
				_, err := NewGitHubClient(Source{
					Owner:        "concourse",
					Repository:   "concourse",
					AppID:        99,
					PrivateKey:   "not-a-valid-pem-key",
					GitHubAPIURL: server.URL() + "/",
				})
				Expect(err).To(HaveOccurred())
				Expect(err.Error()).To(ContainSubstring("creating GitHub App transport"))
			})
		})
	})
})