Skip to content

Extend github auth logging #5112

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
auto-submit merged 2 commits into from
Jul 23, 2026
Merged

Extend github auth logging #5112

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
757b38b
Extend logging, refactoring.
ievdokdm Jul 23, 2026
3f2429a
fix ai review
ievdokdm Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 20 additions & 28 deletions app_dart/lib/src/request_handling/presubmit_authentication.dart
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,6 @@ class GithubAuthentication implements AuthenticationProvider {
try {
if (request.header('X-Flutter-IdToken') case final idTokenFromHeader?) {
final token = await _validator.decodeAndVerify(idTokenFromHeader);
log.info('authing with github.com');
return await authenticateGithub(
token,
clientContext: _clientContextProvider(),
Expand All @@ -65,39 +64,40 @@ class GithubAuthentication implements AuthenticationProvider {
TokenInfo token, {
required ClientContext clientContext,
}) async {
final githubLogin = await _getGithubLoginCached(
token.firebase?.identities?['github.com']?.first,
);
if (await _isGithubAllowedCached(
token.firebase?.identities?['github.com']?.first,
githubLogin,
)) {
final accountId = token.firebase?.identities?['github.com']?.first;
Comment thread
ievdokdm marked this conversation as resolved.
if (accountId == null) {
throw const Unauthenticated('Could not find github identity');
}
log.info('authing with github.com accountId: $accountId');
final login = await _getGithubLoginCached(accountId);
if (login == null) {
throw const Unauthenticated('Could not find github account');
}
log.info('authing with github.com login: $login');
if (await _isGithubLoginAllowedCached(login)) {
return AuthenticatedContext(
clientContext: clientContext,
email: token.email!,
githubLogin: githubLogin,
githubLogin: login,
);
}
throw Unauthenticated(
'${token.email} is not authorized to access the checkrun',
);
}

Future<String?> _getGithubLogin(String? accountId) async {
if (accountId == null) {
return null;
}
Future<String?> _getGithubLogin(String accountId) async {
final ghService = _config.createGithubServiceWithToken(
await _config.githubOAuthToken,
);
final user = await ghService.getUserByAccountId(accountId);
return user.login;
}

Future<String?> _getGithubLoginCached(String? accountId) async {
Future<String?> _getGithubLoginCached(String accountId) async {
final bytes = await _cache.getOrCreate(
'github_account_login',
accountId ?? 'null_accountId',
accountId,
createFn: () async => Uint8List.fromList(
(await _getGithubLogin(accountId))?.codeUnits ?? [],
),
Expand All @@ -106,11 +106,7 @@ class GithubAuthentication implements AuthenticationProvider {
return login.isEmpty ? null : login;
}

Future<bool> _isGithubAllowed(String? accountId, String? githubLogin) async {
final login = githubLogin ?? await _getGithubLogin(accountId);
if (login == null) {
return false;
}
Future<bool> _isGithubLoginAllowed(String login) async {
final ghService = _config.createGithubServiceWithToken(
await _config.githubOAuthToken,
);
Expand All @@ -120,15 +116,11 @@ class GithubAuthentication implements AuthenticationProvider {
);
}

Future<bool> _isGithubAllowedCached(
String? accountId,
String? githubLogin,
) async {
Future<bool> _isGithubLoginAllowedCached(String login) async {
final bytes = await _cache.getOrCreate(
'github_account_allowed',
accountId ?? 'null_accountId',
createFn: () async =>
(await _isGithubAllowed(accountId, githubLogin)).toUint8List(),
'github_login_allowed',
login,
createFn: () async => (await _isGithubLoginAllowed(login)).toUint8List(),
);
return bytes?.toBool() ?? false;
}
Expand Down
Loading