File Coverage

blib/lib/GitHub/Apps/Auth.pm

Criterion	Covered	Total	%
statement	72	79	91.1
branch	9	14	64.2
condition	3	9	33.3
subroutine	19	21	90.4
pod	2	2	100.0
total	105	125	84.0

package GitHub::Apps::Auth;
use 5.008001;
use strict;
use warnings;

our $VERSION = "0.02";

use Class::Accessor::Lite (
    rw => [qw/token expires _prefix _suffix/],
    ro => [qw/_furl private_key app_id installation_id/],
);

use Carp;
use Crypt::PK::RSA;
use Crypt::JWT qw/encode_jwt/;
use Furl;
use JSON qw/decode_json/;
use Time::Moment;

use overload
    "\"\"" => sub { shift->issued_token },
    "." => sub {
        my $self = shift;
        my $other = shift;
        my $reverse = shift;

        $other = "" unless defined $other;

        my $new_self = bless {}, ref $self;
        %$new_self = %$self;

        $reverse ?
            $new_self->_prefix($other . $new_self->_prefix) :
            $new_self->_suffix($new_self->_suffix . $other);
        return $new_self;
    },
    "eq" => sub { shift->issued_token eq shift };

sub new {
    my ($class, %args) = @_;
    if (!exists $args{private_key} || !$args{private_key}) {
        croak "private_key is required.";
    }
    if (!exists $args{app_id} || !$args{app_id}) {
        croak "app_id is required.";
    }
    if (!exists $args{installation_id} || !$args{installation_id}) {
        croak "installation_id is required.";
    }

    my $pk = Crypt::PK::RSA->new($args{private_key});

    my $self = {
        private_key => $pk,
        installation_id => $args{installation_id},
        app_id => $args{app_id},
        expires => 0,
        _furl => Furl->new,
        _prefix => "",
        _suffix => "",
    };
    return bless $self, $class;
}

sub _generate_jwt {
    my $self = shift;

    my $jwt = encode_jwt(
        payload => {
            iat => time(),
            exp => time() + 60,
            iss => $self->app_id,
        },
        alg => "RS256",
        key => $self->private_key,
    );

    return $jwt;
}

sub _generate_request_header {
    my $self = shift;
    my $jwt = $self->_generate_jwt();

    return [
        Authorization => 'Bearer ' . $jwt,
        Accept => "application/vnd.github.machine-man-preview+json",
    ];
}

sub _fetch_access_token {
    my $self = shift;

    my $installation_id = $self->installation_id;
    my $header = $self->_generate_request_header();
    my $resp = $self->_post_to_access_token($installation_id, $header);

    if (!$resp->is_success) {
        croak "cannot fetch access_token: ". $resp->content;
    }

    my $content = decode_json $resp->content;
    my $token = $content->{token};
    $self->token($token);
    my $expires = $content->{expires_at};
    my $tm = Time::Moment->from_string($expires);
    $self->expires($tm->epoch);

    return $self->_prefix . $token . $self->_suffix;
}

sub _post_to_access_token {
    my ($self, $installation_id, $header) = @_;

    return $self->_furl->post(
        "https://api.github.com/app/installations/$installation_id/access_tokens",
        $header,
    );
}

sub _is_expired_token {
    my $self = shift;

    return time() > $self->expires;
}

sub issued_token {
    my $self = shift;

    if ($self->_is_expired_token) {
        return $self->_prefix . $self->_fetch_access_token . $self->_suffix;
    }

    return $self->_prefix . $self->token . $self->_suffix;
}

1;
__END__