fetchLightRepo.ts

import { getServiceChildLogger } from '@crowd/logging'

import { FetchError, LightRepoResult } from './types'
import {
  RepoTrees,
  TreeEntryNode,
  classifyWellKnownFiles,
  deriveSecurityFileEnabled,
} from './wellKnownFiles'

const log = getServiceChildLogger('fetch-light-repo')

const GITHUB_API_URL = 'https://api.github.com'

const REPO_QUERY = `
  query($owner: String!, $name: String!) {
    rateLimit { limit cost remaining resetAt }
    repository(owner: $owner, name: $name) {
      description
      primaryLanguage { name }
      repositoryTopics(first: 25) { nodes { topic { name } } }
      stargazerCount
      forkCount
      watchers { totalCount }
      issues(states: OPEN) { totalCount }
      pushedAt
      isArchived
      isDisabled
      isFork
      createdAt
      isSecurityPolicyEnabled
      defaultBranchRef { name }
      rootTree: object(expression: "HEAD:") {
        ... on Tree { entries { name type oid } }
      }
      githubTree: object(expression: "HEAD:.github") {
        ... on Tree { entries { name type oid } }
      }
      docsTree: object(expression: "HEAD:docs") {
        ... on Tree { entries { name type oid } }
      }
    }
  }
`

export function parseGithubUrl(url: string): { owner: string; name: string } {
  const match = url.match(/https?:\/\/github\.com\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/)
  if (!match) throw new FetchError('MALFORMED', `Cannot parse GitHub URL: ${url}`)
  return { owner: match[1], name: match[2] }
}

interface BranchProtection {
  enabled: boolean | null
  requiredReviews: number | null
  requiresStatusChecks: boolean | null
  allowsForcePush: boolean | null
}

const UNKNOWN_PROTECTION: BranchProtection = {
  enabled: null,
  requiredReviews: null,
  requiresStatusChecks: null,
  allowsForcePush: null,
}

interface BranchRule {
  type: string
  parameters?: { required_approving_review_count?: number }
}

async function restGet(path: string, token: string, timeoutMs: number): Promise<Response> {
  const controller = new AbortController()
  const timeoutId = setTimeout(() => controller.abort(), timeoutMs)
  try {
    const response = await fetch(`${GITHUB_API_URL}${path}`, {
      headers: { Authorization: `bearer ${token}`, Accept: 'application/vnd.github+json' },
      signal: controller.signal,
    })
    if (response.status === 403) {
      const body = await response.text()
      if (body.toLowerCase().includes('rate limit')) {
        const retryAfterSec = parseInt(response.headers.get('retry-after') ?? '0', 10)
        const resetSec = parseInt(response.headers.get('x-ratelimit-reset') ?? '0', 10)
        const resetMs = retryAfterSec
          ? Date.now() + retryAfterSec * 1000
          : resetSec
            ? resetSec * 1000 + 5_000
            : Date.now() + 65_000
        throw new FetchError('RATE_LIMIT', `Rate limited on ${path}`, resetMs)
      }
    }
    return response
  } finally {
    clearTimeout(timeoutId)
  }
}

async function fetchBranchProtection(
  url: string,
  owner: string,
  name: string,
  branch: string,
  token: string,
  timeoutMs: number,
): Promise<BranchProtection> {
  try {
    const branchResp = await restGet(
      `/repos/${owner}/${name}/branches/${encodeURIComponent(branch)}`,
      token,
      timeoutMs,
    )
    if (branchResp.status !== 200) return UNKNOWN_PROTECTION

    const { protected: isProtected } = (await branchResp.json()) as { protected?: boolean }
    if (!isProtected) {
      return {
        enabled: false,
        requiredReviews: 0,
        requiresStatusChecks: false,
        allowsForcePush: true,
      }
    }

    const rulesResp = await restGet(
      `/repos/${owner}/${name}/rules/branches/${encodeURIComponent(branch)}?per_page=100`,
      token,
      timeoutMs,
    )
    if (rulesResp.status !== 200) return { ...UNKNOWN_PROTECTION, enabled: true }

    const rules = (await rulesResp.json()) as BranchRule[]
    if (rules.length === 0) return { ...UNKNOWN_PROTECTION, enabled: true }

    const pullRequestRule = rules.find((r) => r.type === 'pull_request')
    // Absent rule types stay null, not false: classic protection can coexist with rulesets
    // on the same branch and its rules are invisible without admin access
    return {
      enabled: true,
      requiredReviews: pullRequestRule?.parameters?.required_approving_review_count ?? null,
      requiresStatusChecks: rules.some((r) => r.type === 'required_status_checks') ? true : null,
      allowsForcePush: rules.some((r) => r.type === 'non_fast_forward') ? false : null,
    }
  } catch (err) {
    if (err instanceof FetchError && err.kind === 'RATE_LIMIT') throw err
    log.warn(
      { url, errName: (err as Error).name, errMsg: (err as Error).message },
      'Branch protection check failed — fields will be null',
    )
    return UNKNOWN_PROTECTION
  }
}

interface RepoGraphqlResponse {
  data?: {
    rateLimit: { limit: number; cost: number; remaining: number; resetAt: string }
    repository: {
      description: string | null
      primaryLanguage: { name: string } | null
      repositoryTopics: { nodes: Array<{ topic: { name: string } }> }
      stargazerCount: number
      forkCount: number
      watchers: { totalCount: number }
      issues: { totalCount: number }
      pushedAt: string | null
      isArchived: boolean
      isDisabled: boolean
      isFork: boolean
      createdAt: string
      isSecurityPolicyEnabled: boolean
      defaultBranchRef: { name: string } | null
      rootTree: { entries?: TreeEntryNode[] } | null
      githubTree: { entries?: TreeEntryNode[] } | null
      docsTree: { entries?: TreeEntryNode[] } | null
    } | null
  }
  errors?: Array<{ type?: string; message?: string }>
}

export async function fetchLightRepo(
  url: string,
  token: string,
  timeoutMs: number,
): Promise<LightRepoResult> {
  const { owner, name } = parseGithubUrl(url)

  const controller = new AbortController()
  const timeoutId = setTimeout(() => controller.abort(), timeoutMs)

  let response: Response
  try {
    response = await fetch(`${GITHUB_API_URL}/graphql`, {
      method: 'POST',
      headers: {
        Authorization: `bearer ${token}`,
        'Content-Type': 'application/json',
      },
      body: JSON.stringify({ query: REPO_QUERY, variables: { owner, name } }),
      signal: controller.signal,
    })
  } catch (err) {
    throw new FetchError('TRANSIENT', `Network error for ${url}: ${(err as Error).message}`)
  } finally {
    clearTimeout(timeoutId)
  }

  const resetSec = parseInt(response.headers.get('x-ratelimit-reset') ?? '0', 10)
  const resetMs = resetSec ? resetSec * 1000 + 5_000 : Date.now() + 65_000

  // 401 is requester/platform-side (bad token, GitHub auth incident) — never a repo signal
  if (response.status === 401) throw new FetchError('TRANSIENT', `401 Unauthorized for ${url}`)

  if (response.status === 403) {
    const body = await response.text()
    if (body.toLowerCase().includes('rate limit'))
      throw new FetchError('RATE_LIMIT', `Rate limited on ${url}`, resetMs)
    throw new FetchError('AUTH', `403 Forbidden for ${url}`)
  }

  if (response.status === 404) throw new FetchError('NOT_FOUND', `404 for ${url}`)
  if (response.status >= 500) throw new FetchError('TRANSIENT', `${response.status} for ${url}`)

  const json = (await response.json()) as RepoGraphqlResponse

  if (json.errors?.length) {
    const err = json.errors[0]
    if (err.type === 'RATE_LIMITED' || err.message?.toLowerCase().includes('rate limit'))
      throw new FetchError('RATE_LIMIT', `RATE_LIMITED for ${url}`, resetMs)
    if (err.type === 'NOT_FOUND') throw new FetchError('NOT_FOUND', `NOT_FOUND for ${url}`)
    if (err.message?.toLowerCase().includes('ip allow list'))
      throw new FetchError('AUTH', `IP allowlist blocks access to ${url}`)
    throw new FetchError('TRANSIENT', `GraphQL error for ${url}: ${err.message ?? err.type}`)
  }

  const repo = json.data?.repository
  if (!repo) throw new FetchError('NOT_FOUND', `No repository data for ${url}`)

  const trees: RepoTrees = {
    root: repo.rootTree?.entries ?? null,
    github: repo.githubTree?.entries ?? null,
    docs: repo.docsTree?.entries ?? null,
  }

  const defaultBranch = repo.defaultBranchRef?.name ?? null
  const branchProtection = defaultBranch
    ? await fetchBranchProtection(url, owner, name, defaultBranch, token, timeoutMs)
    : UNKNOWN_PROTECTION

  return {
    url,
    host: 'github',
    owner,
    name,
    description: repo.description ?? null,
    primaryLanguage: repo.primaryLanguage?.name ?? null,
    topics: (repo.repositoryTopics?.nodes ?? []).map(
      (n: { topic: { name: string } }) => n.topic.name,
    ),
    stars: repo.stargazerCount ?? null,
    forks: repo.forkCount ?? null,
    watchers: repo.watchers?.totalCount ?? null,
    openIssues: repo.issues?.totalCount ?? null,
    lastCommitAt: repo.pushedAt ?? null,
    archived: repo.isArchived ?? null,
    disabled: repo.isDisabled ?? null,
    isFork: repo.isFork ?? null,
    createdAt: repo.createdAt ?? null,
    securityPolicyEnabled: repo.isSecurityPolicyEnabled ?? null,
    securityFileEnabled: deriveSecurityFileEnabled(trees),
    wellKnownFiles: classifyWellKnownFiles(trees),
    branchProtectionEnabled: branchProtection.enabled,
    branchProtectionRequiredReviews: branchProtection.requiredReviews,
    branchProtectionRequiresStatusChecks: branchProtection.requiresStatusChecks,
    branchProtectionAllowsForcePush: branchProtection.allowsForcePush,
    rateLimit: json.data?.rateLimit ?? null,
  }
}