GitHubClientFactory.cs

Go to the documentation of this file.

using System;
using System.Collections.Generic;
using System.IdentityModel.Tokens.Jwt;
using System.Linq;
using System.Security.Cryptography;
using System.Text;
using System.Threading;
using System.Threading.Tasks;
 
using Microsoft.Extensions.Logging;
using Microsoft.Extensions.Options;
using Microsoft.IdentityModel.Tokens;
 
using Octokit;
 
using Tgstation.Server.Host.Configuration;
using Tgstation.Server.Host.System;
 
namespace Tgstation.Server.Host.Utils.GitHub
{
    sealed class GitHubClientFactory : IGitHubClientFactory, IDisposable
    {
        const uint ClientCacheDays = 7;
 
        const string DefaultCacheKey = "~!@TGS_DEFAULT_GITHUB_CLIENT_CACHE_KEY@!~";
 
        readonly IAssemblyInformationProvider assemblyInformationProvider;
 
        readonly ILogger<GitHubClientFactory> logger;
 
        readonly GeneralConfiguration generalConfiguration;
 
        readonly Dictionary<string, (GitHubClient Client, DateTimeOffset LastUsed)> clientCache;
 
        readonly SemaphoreSlim clientCacheSemaphore;
 
        public GitHubClientFactory(
            IAssemblyInformationProvider assemblyInformationProvider,
            ILogger<GitHubClientFactory> logger,
            IOptions<GeneralConfiguration> generalConfigurationOptions)
        {
            this.assemblyInformationProvider = assemblyInformationProvider ?? throw new ArgumentNullException(nameof(assemblyInformationProvider));
            this.logger = logger ?? throw new ArgumentNullException(nameof(logger));
            generalConfiguration = generalConfigurationOptions?.Value ?? throw new ArgumentNullException(nameof(generalConfigurationOptions));
 
            clientCache = new Dictionary<string, (GitHubClient, DateTimeOffset)>();
            clientCacheSemaphore = new SemaphoreSlim(1, 1);
        }
 
        public void Dispose() => clientCacheSemaphore.Dispose();
 
        public async ValueTask<IGitHubClient> CreateClient(CancellationToken cancellationToken)
            => (await GetOrCreateClient(
                generalConfiguration.GitHubAccessToken,
                null,
                cancellationToken))!;
 
        public async ValueTask<IGitHubClient> CreateClient(string accessToken, CancellationToken cancellationToken)
            => (await GetOrCreateClient(
                accessToken ?? throw new ArgumentNullException(nameof(accessToken)),
                null,
                cancellationToken))!;
 
        public ValueTask<IGitHubClient?> CreateInstallationClient(string serializedPem, long repositoryId, CancellationToken cancellationToken)
            => GetOrCreateClient(serializedPem, repositoryId, cancellationToken);
 
#pragma warning disable CA1506 // TODO: Decomplexify
        async ValueTask<IGitHubClient?> GetOrCreateClient(string? accessTokenOrSerializedPem, long? installationRepositoryId, CancellationToken cancellationToken)
#pragma warning restore CA1506
        {
            GitHubClient client;
            bool cacheHit;
            DateTimeOffset? lastUsed;
            using (await SemaphoreSlimContext.Lock(clientCacheSemaphore, cancellationToken))
            {
                string cacheKey;
                if (String.IsNullOrWhiteSpace(accessTokenOrSerializedPem))
                {
                    accessTokenOrSerializedPem = null;
                    cacheKey = DefaultCacheKey;
                }
                else
                    cacheKey = accessTokenOrSerializedPem;
 
                cacheHit = clientCache.TryGetValue(cacheKey, out var tuple);
 
                var now = DateTimeOffset.UtcNow;
                if (!cacheHit)
                {
                    logger.LogTrace("Creating new GitHubClient...");
                    var product = assemblyInformationProvider.ProductInfoHeaderValue.Product!;
                    client = new GitHubClient(
                        new ProductHeaderValue(
                            product.Name,
                            product.Version));
 
                    if (accessTokenOrSerializedPem != null)
                    {
                        if (installationRepositoryId.HasValue)
                        {
                            logger.LogTrace("Performing GitHub App authentication for installation on repository {installationRepositoryId}", installationRepositoryId.Value);
                            var splits = accessTokenOrSerializedPem.Split(':');
                            if (splits.Length != 2)
                            {
                                logger.LogError("Failed to parse serialized Client ID & PEM! Expected 2 chunks, got {chunkCount}", splits.Length);
                                return null;
                            }
 
                            byte[] pemBytes;
                            try
                            {
                                pemBytes = Convert.FromBase64String(splits[1]);
                            }
                            catch (Exception ex)
                            {
                                logger.LogError(ex, "Failed to parse supposed base64 PEM!");
                                return null;
                            }
 
                            var pem = Encoding.UTF8.GetString(pemBytes);
 
                            using var rsa = RSA.Create();
                            rsa.ImportFromPem(pem);
 
                            var signingCredentials = new SigningCredentials(new RsaSecurityKey(rsa), SecurityAlgorithms.RsaSha256);
                            var jwtSecurityTokenHandler = new JwtSecurityTokenHandler { SetDefaultTimesOnTokenCreation = false };
 
                            var nowDateTime = DateTime.UtcNow;
 
                            var jwt = jwtSecurityTokenHandler.CreateToken(new SecurityTokenDescriptor
                            {
                                Issuer = splits[0],
                                Expires = nowDateTime.AddMinutes(10),
                                IssuedAt = nowDateTime,
                                SigningCredentials = signingCredentials,
                            });
 
                            var jwtStr = jwtSecurityTokenHandler.WriteToken(jwt);
 
                            client.Credentials = new Credentials(jwtStr, AuthenticationType.Bearer);
 
                            Installation installation;
                            try
                            {
                                installation = await client.GitHubApps.GetRepositoryInstallationForCurrent(installationRepositoryId.Value);
                            }
                            catch (Exception ex)
                            {
                                logger.LogError(ex, "Failed to perform app authentication!");
                                return null;
                            }
 
                            cancellationToken.ThrowIfCancellationRequested();
                            try
                            {
                                var installToken = await client.GitHubApps.CreateInstallationToken(installation.Id);
 
                                client.Credentials = new Credentials(installToken.Token);
                            }
                            catch (Exception ex)
                            {
                                logger.LogError(ex, "Failed to perform installation authentication!");
                                return null;
                            }
                        }
                        else
                            client.Credentials = new Credentials(accessTokenOrSerializedPem);
                    }
 
                    clientCache.Add(cacheKey, (Client: client, LastUsed: now));
                    lastUsed = null;
                }
                else
                {
                    logger.LogTrace("Cache hit for GitHubClient");
                    client = tuple.Client;
                    lastUsed = tuple.LastUsed;
                    tuple.LastUsed = now;
                }
 
                // Prune the cache
                var purgeCount = 0U;
                var purgeAfter = now.AddDays(-ClientCacheDays);
                foreach (var key in clientCache.Keys.ToList())
                {
                    if (key == cacheKey)
                        continue; // save the hash lookup
 
                    tuple = clientCache[key];
                    if (tuple.LastUsed <= purgeAfter)
                    {
                        clientCache.Remove(key);
                        ++purgeCount;
                    }
                }
 
                if (purgeCount > 0)
                    logger.LogDebug(
                        "Pruned {count} expired GitHub client(s) from cache that haven't been used in {purgeAfterHours} days.",
                        purgeCount,
                        ClientCacheDays);
            }
 
            var rateLimitInfo = client.GetLastApiInfo()?.RateLimit;
            if (rateLimitInfo != null)
                if (rateLimitInfo.Remaining == 0)
                    logger.LogWarning(
                        "Requested GitHub client has no requests remaining! Limit resets at {resetTime}",
                        rateLimitInfo.Reset.ToString("o"));
                else if (rateLimitInfo.Remaining < 25) // good luck hitting these lines on codecov
                    logger.LogWarning(
                        "Requested GitHub client has only {remainingRequests} requests remaining after the usage at {lastUse}! Limit resets at {resetTime}",
                        rateLimitInfo.Remaining,
                        lastUsed,
                        rateLimitInfo.Reset.ToString("o"));
                else
                    logger.LogDebug(
                        "Requested GitHub client has {remainingRequests} requests remaining after the usage at {lastUse}. Limit resets at {resetTime}",
                        rateLimitInfo.Remaining,
                        lastUsed,
                        rateLimitInfo.Reset.ToString("o"));
 
            return client;
        }
    }
}