Support full GitHub app authentication

github/ApplicationOAuth.pyi

@@ -13,12 +13,12 @@ class ApplicationOAuth(NonCompletableGithubObject):
     def client_secret(self) -> str: ...
     def get_login_url(
         self,
-        redirect_uri: Optional[str],
-        state: Optional[str],
-        login: Optional[str]
+        redirect_uri: Optional[str]=None,
+        state: Optional[str]=None,
+        login: Optional[str]=None
     ) -> str: ...
     def get_access_token(
         self,
         code: str,
-        state: Optional[str]
+        state: Optional[str]=None
     ) -> AccessToken: ...

github/AuthenticatedUser.pyi

@@ -1,5 +1,5 @@
 from datetime import datetime
-from typing import Any, Dict, List, Optional, Union, NamedTuple
+from typing import Any, Dict, List, NamedTuple, Union
 
 from github.Authorization import Authorization
 from github.Event import Event
@@ -20,6 +20,7 @@ from github.Repository import Repository
 from github.Team import Team
 from github.UserKey import UserKey
 
+
 class EmailData(NamedTuple):
     email: str
     primary: bool
@@ -85,6 +86,7 @@ class AuthenticatedUser(CompletableGithubObject):
         allow_squash_merge: Union[bool, _NotSetType] = ...,
         allow_merge_commit: Union[bool, _NotSetType] = ...,
         allow_rebase_merge: Union[bool, _NotSetType] = ...,
+        delete_branch_on_merge: Union[bool, _NotSetType] = ...,
     ) -> Repository: ...
     @property
     def created_at(self) -> datetime: ...

github/Branch.pyi

@@ -42,8 +42,6 @@ class Branch(NonCompletableGithubObject):
         strict: Union[_NotSetType, bool] = ...,
         contexts: Union[List[str], _NotSetType] = ...,
     ) -> None: ...
-    def edit_team_push_restrictions(self, *teams: str) -> None: ...
-    def edit_user_push_restrictions(self, *users: str) -> None: ...
     def get_admin_enforcement(self) -> bool: ...
     def get_protection(self) -> BranchProtection: ...
     def get_required_pull_request_reviews(self) -> RequiredPullRequestReviews: ...

github/CheckSuite.pyi

@@ -1,5 +1,5 @@
 from datetime import datetime
-from typing import Any, Dict, List
+from typing import Any, Dict, List, Union
 
 from github.CheckRun import CheckRun
 from github.GitCommit import GitCommit
@@ -8,6 +8,7 @@ from github.GithubObject import CompletableGithubObject
 from github.PaginatedList import PaginatedList
 from github.PullRequest import PullRequest
 from github.Repository import Repository
+from github.GithubObject import _NotSetType, NotSet
 
 class CheckSuite(CompletableGithubObject):
     def __repr__(self) -> str: ...
@@ -47,5 +48,8 @@ class CheckSuite(CompletableGithubObject):
     def url(self) -> str: ...
     def rerequest(self) -> bool: ...
     def get_check_runs(
-        self, check_name: str, status: str, filter: str
+        self,
+        check_name: Union[str, _NotSetType]=NotSet,
+        status: Union[str, _NotSetType]=NotSet,
+        filter: Union[str, _NotSetType]=NotSet,
     ) -> PaginatedList[CheckRun]: ...

github/Commit.pyi

@@ -8,7 +8,7 @@ from github.CommitStats import CommitStats
 from github.CommitStatus import CommitStatus
 from github.File import File
 from github.GitCommit import GitCommit
-from github.GithubObject import CompletableGithubObject, _NotSetType
+from github.GithubObject import CompletableGithubObject, _NotSetType, NotSet
 from github.NamedUser import NamedUser
 from github.PaginatedList import PaginatedList
 from github.PullRequest import PullRequest
@@ -45,8 +45,8 @@ class Commit(CompletableGithubObject):
     def files(self) -> List[File]: ...
     def get_check_suites(
         self,
-        app_id: Union[_NotSetType, int],
-        check_name: Union[_NotSetType, str],
+        app_id: Union[_NotSetType, int]=NotSet,
+        check_name: Union[_NotSetType, str]=NotSet,
     ) -> PaginatedList[CheckSuite]: ...
     def get_combined_status(self) -> CommitCombinedStatus: ...
     def get_comments(self) -> PaginatedList[CommitComment]: ...

github/Consts.py

@@ -128,3 +128,11 @@
 
 # https://developer.github.com/changes/2019-12-03-internal-visibility-changes/
 repoVisibilityPreview = "application/vnd.github.nebula-preview+json"
+
+DEFAULT_BASE_URL = "https://api.github.com"
+DEFAULT_STATUS_URL = "https://status.github.com"
+# As of 2018-05-17, Github imposes a 10s limit for completion of API requests.
+# Thus, the timeout should be slightly > 10s to account for network/front-end
+# latency.
+DEFAULT_TIMEOUT = 15
+DEFAULT_PER_PAGE = 30

github/GithubException.py

@@ -38,7 +38,7 @@ class GithubException(Exception):
     Some other types of exceptions might be raised by underlying libraries, for example for network-related issues.
     """
 
-    def __init__(self, status, data, headers):
+    def __init__(self, status, data, headers=None):
         super().__init__()
         self.__status = status
         self.__data = data

github/GithubIntegration.py

@@ -0,0 +1,140 @@
+import time
+
+import deprecated
+import jwt
+import requests
+
+import github.Installation
+import github.InstallationAuthorization
+import github.PaginatedList
+import github.Requester
+
+from . import Consts, GithubException
+
+
+class GithubIntegration:
+    """
+    Main class to obtain tokens for a GitHub integration.
+    """
+
+    def __init__(self, integration_id, private_key, base_url=Consts.DEFAULT_BASE_URL):
+        """
+        :param base_url: string
+        :param integration_id: int
+        :param private_key: string
+        """
+        self.base_url = base_url
+        self.integration_id = integration_id
+        self.private_key = private_key
+        assert isinstance(base_url, str), base_url
+
+    def create_jwt(self, expiration=60):
+        """
+        Creates a signed JWT, valid for 60 seconds by default.
+        The expiration can be extended beyond this, to a maximum of 600 seconds.
+
+        :param expiration: int
+        :return string:
+        """
+        now = int(time.time())
+        payload = {"iat": now, "exp": now + expiration, "iss": self.integration_id}
+        encrypted = jwt.encode(payload, key=self.private_key, algorithm="RS256")
+
+        if isinstance(encrypted, bytes):
+            encrypted = encrypted.decode("utf-8")
+
+        return encrypted
+
+    def get_access_token(self, installation_id, user_id=None):
+        """
+        Get an access token for the given installation id.
+        POSTs https://api.github.com/app/installations/<installation_id>/access_tokens
+        :param user_id: int
+        :param installation_id: int
+        :return: :class:`github.InstallationAuthorization.InstallationAuthorization`
+        """
+        body = {}
+        if user_id:
+            body = {"user_id": user_id}
+        response = requests.post(
+            f"{self.base_url}/app/installations/{installation_id}/access_tokens",
+            headers={
+                "Authorization": f"Bearer {self.create_jwt()}",
+                "Accept": Consts.mediaTypeIntegrationPreview,
+                "User-Agent": "PyGithub/Python",
+            },
+            json=body,
+        )
+
+        if response.status_code == 201:
+            return github.InstallationAuthorization.InstallationAuthorization(
+                requester=None,  # not required, this is a NonCompletableGithubObject
+                headers={},  # not required, this is a NonCompletableGithubObject
+                attributes=response.json(),
+                completed=True,
+            )
+        elif response.status_code == 403:
+            raise GithubException.BadCredentialsException(
+                status=response.status_code, data=response.text
+            )
+        elif response.status_code == 404:
+            raise GithubException.UnknownObjectException(
+                status=response.status_code, data=response.text
+            )
+        raise GithubException.GithubException(
+            status=response.status_code, data=response.text
+        )
+
+    @deprecated.deprecated("Use get_repo_installation")
+    def get_installation(self, owner, repo):
+        """
+        :calls: `GET /repos/{owner}/{repo}/installation <https://docs.github.com/en/rest/reference/apps#get-a-repository-installation-for-the-authenticated-app>`_
+        :param owner: str
+        :param repo: str
+        :rtype: :class:`github.Installation.Installation`
+        """
+        headers = {
+            "Authorization": f"Bearer {self.create_jwt()}",
+            "Accept": Consts.mediaTypeIntegrationPreview,
+            "User-Agent": "PyGithub/Python",
+        }
+
+        response = requests.get(
+            f"{self.base_url}/repos/{owner}/{repo}/installation",
+            headers=headers,
+        )
+        response_dict = response.json()
+        return github.Installation.Installation(None, headers, response_dict, True)
+
+    def get_repo_installation(self, owner, repo):
+        return self.get_installation(owner, repo)
+
+    def get_installations(self):
+        """
+        :calls: GET /app/installations <https://docs.github.com/en/rest/reference/apps#list-installations-for-the-authenticated-app>
+        :rtype: :class:`github.PaginatedList.PaginatedList[github.Installation.Installation]`
+        """
+        return github.PaginatedList.PaginatedList(
+            contentClass=github.Installation.Installation,
+            requester=github.Requester.Requester(
+                login_or_token=None,
+                password=None,
+                jwt=self.create_jwt(),
+                app_id=None,
+                app_private_key=None,
+                base_url=Consts.DEFAULT_BASE_URL,
+                timeout=Consts.DEFAULT_TIMEOUT,
+                user_agent="PyGithub/Python",
+                per_page=Consts.DEFAULT_PER_PAGE,
+                verify=True,
+                retry=None,
+                pool_size=None,
+            ),
+            firstUrl="/app/installations",
+            firstParams=None,
+            headers={
+                "Authorization": f"Bearer {self.create_jwt()}",
+                "User-Agent": "PyGithub/Python",
+            },
+            list_item="installations",
+        )

github/GithubIntegration.pyi

@@ -0,0 +1,17 @@
+from typing import Union, Optional
+
+from github.Installation import Installation
+from github.InstallationAuthorization import InstallationAuthorization
+from github.PaginatedList import PaginatedList
+
+
+class GithubIntegration:
+    def __init__(
+        self, integration_id: Union[int, str], private_key: str, base_url: str = ...
+    ) -> None: ...
+    def create_jwt(self, expiration: int = ...) -> str: ...
+    def get_access_token(
+        self, installation_id: int, user_id: Optional[int] = ...
+    ) -> InstallationAuthorization: ...
+    def get_installation(self, owner: str, repo: str) -> Installation: ...
+    def get_installations(self) -> PaginatedList[Installation]: ...

github/GithubObject.pyi

@@ -1,11 +1,6 @@
 from typing import Any, Callable, Dict, List, Optional, Type, Union
 
-from github.Commit import Commit
 from github.GistFile import GistFile
-from github.GitRelease import GitRelease
-from github.NamedUser import NamedUser
-from github.Organization import Organization
-from github.PullRequestReview import PullRequestReview
 from github.Requester import Requester
 
 class GithubObject:
@@ -108,7 +103,7 @@ class CompletableGithubObject(GithubObject):
     def _completeIfNotSet(
         self, value: Union[_ValuedAttribute, _BadAttribute, _NotSetType]
     ) -> None: ...
-    def update(self) -> bool: ...
+    def update(self, additional_headers: Optional[Dict[str, str]]=None) -> bool: ...
 
 class _BadAttribute:
     def __init__(
@@ -120,5 +115,7 @@ class _BadAttribute:
 class _NotSetType:
     def __repr__(self) -> str: ...
 
+NotSet: _NotSetType
+
 class _ValuedAttribute:
     def __init__(self, value: Any) -> None: ...