GitHubClientFactory.cs

Go to the documentation of this file.

using System;
using System.Collections.Generic;
using System.IdentityModel.Tokens.Jwt;
using System.Linq;
using System.Net.Http;
using System.Security.Cryptography;
using System.Text;
using System.Threading;
using System.Threading.Tasks;
 
using Microsoft.Extensions.Logging;
using Microsoft.Extensions.Options;
using Microsoft.IdentityModel.Tokens;
 
using Octokit;
using Octokit.Internal;
 
using Tgstation.Server.Api.Models;
using Tgstation.Server.Host.Configuration;
using Tgstation.Server.Host.System;
 
namespace Tgstation.Server.Host.Utils.GitHub
{
    sealed class GitHubClientFactory : IGitHubClientFactory, IDisposable
    {
        const uint ClientCacheHours = 1;
 
        const uint AppTokenExpiryGraceMinutes = 15;
 
        const string DefaultCacheKey = "~!@TGS_DEFAULT_GITHUB_CLIENT_CACHE_KEY@!~";
 
        readonly IAssemblyInformationProvider assemblyInformationProvider;
 
        readonly IHttpMessageHandlerFactory httpMessageHandlerFactory;
 
        readonly IOptionsMonitor<GeneralConfiguration> generalConfigurationOptions;
 
        readonly ILogger<GitHubClientFactory> logger;
 
        readonly Dictionary<string, (GitHubClient Client, DateTimeOffset LastUsed, DateTimeOffset? Expiry)> clientCache;
 
        readonly SemaphoreSlim clientCacheSemaphore;
 
        public GitHubClientFactory(
            IAssemblyInformationProvider assemblyInformationProvider,
            IHttpMessageHandlerFactory httpMessageHandlerFactory,
            IOptionsMonitor<GeneralConfiguration> generalConfigurationOptions,
            ILogger<GitHubClientFactory> logger)
        {
            this.assemblyInformationProvider = assemblyInformationProvider ?? throw new ArgumentNullException(nameof(assemblyInformationProvider));
            this.httpMessageHandlerFactory = httpMessageHandlerFactory ?? throw new ArgumentNullException(nameof(httpMessageHandlerFactory));
            this.generalConfigurationOptions = generalConfigurationOptions ?? throw new ArgumentNullException(nameof(generalConfigurationOptions));
            this.logger = logger ?? throw new ArgumentNullException(nameof(logger));
 
            clientCache = new Dictionary<string, (GitHubClient, DateTimeOffset, DateTimeOffset?)>();
            clientCacheSemaphore = new SemaphoreSlim(1, 1);
        }
 
        public void Dispose() => clientCacheSemaphore.Dispose();
 
        public async ValueTask<IGitHubClient> CreateClient(CancellationToken cancellationToken)
            => (await GetOrCreateClient(
                generalConfigurationOptions.CurrentValue.GitHubAccessToken,
                null,
                cancellationToken))!;
 
        public async ValueTask<IGitHubClient> CreateClient(string accessToken, CancellationToken cancellationToken)
            => (await GetOrCreateClient(
                accessToken ?? throw new ArgumentNullException(nameof(accessToken)),
                null,
                cancellationToken))!;
 
        public ValueTask<IGitHubClient?> CreateClientForRepository(string accessString, RepositoryIdentifier repositoryIdentifier, CancellationToken cancellationToken)
            => GetOrCreateClient(accessString, repositoryIdentifier, cancellationToken);
 
        public IGitHubClient? CreateAppClient(string tgsEncodedAppPrivateKey)
            => CreateAppClientInternal(tgsEncodedAppPrivateKey ?? throw new ArgumentNullException(nameof(tgsEncodedAppPrivateKey)));
 
#pragma warning disable CA1506 // TODO: Decomplexify
        async ValueTask<IGitHubClient?> GetOrCreateClient(string? accessString, RepositoryIdentifier? repositoryIdentifier, CancellationToken cancellationToken)
#pragma warning restore CA1506
        {
            GitHubClient? client;
            bool cacheHit;
            DateTimeOffset? lastUsed;
            using (await SemaphoreSlimContext.Lock(clientCacheSemaphore, cancellationToken))
            {
                string cacheKey;
                if (String.IsNullOrWhiteSpace(accessString))
                {
                    accessString = null;
                    cacheKey = DefaultCacheKey;
                }
                else
                    cacheKey = accessString;
 
                var now = DateTimeOffset.UtcNow;
                cacheHit = clientCache.TryGetValue(cacheKey, out var tuple);
                var tokenValid = cacheHit && (!tuple.Expiry.HasValue || tuple.Expiry.Value <= now);
                if (!tokenValid)
                {
                    if (cacheHit)
                    {
                        logger.LogDebug("Previously cached GitHub token has expired!");
                        clientCache.Remove(cacheKey);
                    }
 
                    logger.LogTrace("Creating new GitHubClient...");
 
                    DateTimeOffset? expiry = null;
                    if (accessString != null)
                    {
                        if (accessString.StartsWith(RepositorySettings.TgsAppPrivateKeyPrefix))
                        {
                            if (repositoryIdentifier == null)
                                throw new InvalidOperationException("Cannot create app installation key without target repositoryIdentifier!");
 
                            logger.LogTrace("Performing GitHub App authentication for installation on repository {installationRepositoryId}", repositoryIdentifier);
 
                            client = CreateAppClientInternal(accessString);
                            if (client == null)
                                return null;
 
                            Installation installation;
                            try
                            {
                                var installationTask = repositoryIdentifier.IsSlug
                                    ? client.GitHubApps.GetRepositoryInstallationForCurrent(repositoryIdentifier.Owner, repositoryIdentifier.Name)
                                    : client.GitHubApps.GetRepositoryInstallationForCurrent(repositoryIdentifier.RepositoryId.Value);
                                installation = await installationTask;
                            }
                            catch (Exception ex)
                            {
                                logger.LogError(ex, "Failed to perform app authentication!");
                                return null;
                            }
 
                            cancellationToken.ThrowIfCancellationRequested();
                            try
                            {
                                var installToken = await client.GitHubApps.CreateInstallationToken(installation.Id);
 
                                client.Credentials = new Credentials(installToken.Token);
                                expiry = installToken.ExpiresAt.AddMinutes(-AppTokenExpiryGraceMinutes);
                            }
                            catch (Exception ex)
                            {
                                logger.LogError(ex, "Failed to perform installation authentication!");
                                return null;
                            }
                        }
                        else
                        {
                            client = CreateUnauthenticatedClient();
                            client.Credentials = new Credentials(accessString);
                        }
                    }
                    else
                        client = CreateUnauthenticatedClient();
 
                    clientCache.Add(cacheKey, (Client: client, LastUsed: now, Expiry: expiry));
                    lastUsed = null;
                }
                else
                {
                    logger.LogTrace("Cache hit for GitHubClient");
                    client = tuple.Client;
                    lastUsed = tuple.LastUsed;
                    tuple.LastUsed = now;
                }
 
                // Prune the cache
                var purgeCount = 0U;
                var purgeAfter = now.AddHours(-ClientCacheHours);
                foreach (var key in clientCache.Keys.ToList())
                {
                    if (key == cacheKey)
                        continue; // save the hash lookup
 
                    tuple = clientCache[key];
                    if (tuple.LastUsed <= purgeAfter || (tuple.Expiry.HasValue && tuple.Expiry.Value <= now))
                    {
                        clientCache.Remove(key);
                        ++purgeCount;
                    }
                }
 
                if (purgeCount > 0)
                    logger.LogDebug(
                        "Pruned {count} expired GitHub client(s) from cache that haven't been used in {purgeAfterHours} hours.",
                        purgeCount,
                        ClientCacheHours);
            }
 
            var rateLimitInfo = client.GetLastApiInfo()?.RateLimit;
            if (rateLimitInfo != null)
                if (rateLimitInfo.Remaining == 0)
                    logger.LogWarning(
                        "Requested GitHub client has no requests remaining! Limit resets at {resetTime}",
                        rateLimitInfo.Reset.ToString("o"));
                else if (rateLimitInfo.Remaining < 25) // good luck hitting these lines on codecov
                    logger.LogWarning(
                        "Requested GitHub client has only {remainingRequests} requests remaining after the usage at {lastUse}! Limit resets at {resetTime}",
                        rateLimitInfo.Remaining,
                        lastUsed,
                        rateLimitInfo.Reset.ToString("o"));
                else
                    logger.LogDebug(
                        "Requested GitHub client has {remainingRequests} requests remaining after the usage at {lastUse}. Limit resets at {resetTime}",
                        rateLimitInfo.Remaining,
                        lastUsed,
                        rateLimitInfo.Reset.ToString("o"));
 
            return client;
        }
 
        GitHubClient? CreateAppClientInternal(string tgsEncodedAppPrivateKey)
        {
            var client = CreateUnauthenticatedClient();
            var splits = tgsEncodedAppPrivateKey.Split(':');
            if (splits.Length != 2)
            {
                logger.LogError("Failed to parse serialized Client ID & PEM! Expected 2 chunks, got {chunkCount}", splits.Length);
                return null;
            }
 
            byte[] pemBytes;
            try
            {
                pemBytes = Convert.FromBase64String(splits[1]);
            }
            catch (Exception ex)
            {
                logger.LogError(ex, "Failed to parse supposed base64 PEM!");
                return null;
            }
 
            var pem = Encoding.UTF8.GetString(pemBytes);
 
            using var rsa = RSA.Create();
 
            try
            {
                rsa.ImportFromPem(pem);
            }
            catch (Exception ex)
            {
                logger.LogWarning(ex, "Failed to parse PEM!");
                return null;
            }
 
            var signingCredentials = new SigningCredentials(
                 new RsaSecurityKey(rsa),
                 SecurityAlgorithms.RsaSha256)
            {
                // https://stackoverflow.com/questions/62307933/rsa-disposed-object-error-every-other-test
                CryptoProviderFactory = new CryptoProviderFactory
                {
                    CacheSignatureProviders = false,
                },
            };
            var jwtSecurityTokenHandler = new JwtSecurityTokenHandler { SetDefaultTimesOnTokenCreation = false };
 
            var nowDateTime = DateTime.UtcNow;
 
            var appOrClientId = splits[0][RepositorySettings.TgsAppPrivateKeyPrefix.Length..];
 
            var jwt = jwtSecurityTokenHandler.CreateToken(new SecurityTokenDescriptor
            {
                Issuer = appOrClientId,
                Expires = nowDateTime.AddMinutes(10),
                IssuedAt = nowDateTime,
                SigningCredentials = signingCredentials,
            });
 
            var jwtStr = jwtSecurityTokenHandler.WriteToken(jwt);
            client.Credentials = new Credentials(jwtStr, AuthenticationType.Bearer);
            return client;
        }
 
        GitHubClient CreateUnauthenticatedClient()
        {
            var product = assemblyInformationProvider.ProductInfoHeaderValue.Product!;
#pragma warning disable CA2000 // Dispose objects before losing scope
            var handler = httpMessageHandlerFactory.CreateHandler();
            try
            {
                var clientAdapter = new HttpClientAdapter(() => handler);
#pragma warning restore CA2000 // Dispose objects before losing scope
                handler = null;
                try
                {
                    return new GitHubClient(
                        new Connection(
                            new ProductHeaderValue(
                                product.Name,
                                product.Version),
                            clientAdapter));
                }
                catch
                {
                    clientAdapter.Dispose();
                    throw;
                }
            }
            catch
            {
                handler?.Dispose();
                throw;
            }
        }
    }
}