fix(github): derive API URLs from GitHub HTML hosts (#10610)

2026-08-20 06:23:23 +00:00 · 2026-07-07 12:29:15 +02:00
parent f3ca349765 21bd8fa2bc
commit 2caa5e67ff
12 changed files with 681 additions and 46 deletions
@@ -14,6 +14,141 @@ use Lcobucci\JWT\Signer\Key\InMemory;
 use Lcobucci\JWT\Signer\Rsa\Sha256;
 use Lcobucci\JWT\Token\Builder;

+/**
+ * Extract and normalize the hostname from a GitHub URL.
+ *
+ * @param  string|null  $url  The URL to parse
+ * @return string|null The lowercase hostname, or null if the URL is blank or has no parseable host
+ */
+function githubUrlHost(?string $url): ?string
+{
+    if (blank($url)) {
+        return null;
+    }
+
+    $host = parse_url($url, PHP_URL_HOST);
+
+    if (! is_string($host) || blank($host)) {
+        return null;
+    }
+
+    return strtolower($host);
+}
+
+/**
+ * Build the scheme://host[:port] origin for a GitHub URL.
+ *
+ * This helper fails explicitly for blank, scheme-less, or malformed input when
+ * githubUrlHost() cannot parse a host, because returning the original input
+ * would not be a valid origin. Callers should pass already-validated URLs.
+ *
+ * @param  string  $url  The URL to derive the origin from
+ * @return string The normalized origin
+ *
+ * @throws InvalidArgumentException When the URL does not contain a parseable scheme and host
+ */
+function githubUrlOrigin(string $url): string
+{
+    $scheme = parse_url($url, PHP_URL_SCHEME);
+    $host = githubUrlHost($url);
+    $port = parse_url($url, PHP_URL_PORT);
+
+    if (! is_string($scheme) || blank($scheme) || ! $host) {
+        throw new InvalidArgumentException('GitHub URL must include a valid scheme and host.');
+    }
+
+    return $scheme.'://'.$host.($port ? ":{$port}" : '');
+}
+
+/**
+ * Determine whether the URL points at github.com.
+ *
+ * @param  string|null  $htmlUrl  The GitHub HTML URL to check
+ */
+function isGithubDotComHost(?string $htmlUrl): bool
+{
+    return githubUrlHost($htmlUrl) === 'github.com';
+}
+
+/**
+ * Determine whether the URL points at a *.ghe.com GitHub Enterprise Cloud host.
+ *
+ * @param  string|null  $htmlUrl  The GitHub HTML URL to check
+ */
+function isGheDotComHost(?string $htmlUrl): bool
+{
+    $host = githubUrlHost($htmlUrl);
+
+    return is_string($host)
+        && Str::endsWith($host, '.ghe.com')
+        && ! Str::startsWith($host, 'api.');
+}
+
+/**
+ * Determine whether the URL belongs to GitHub's cloud family (github.com or *.ghe.com).
+ *
+ * @param  string|null  $htmlUrl  The GitHub HTML URL to check
+ */
+function isGithubCloudFamilyHost(?string $htmlUrl): bool
+{
+    return isGithubDotComHost($htmlUrl) || isGheDotComHost($htmlUrl);
+}
+
+/**
+ * Determine whether the URL belongs to a self-hosted GitHub Enterprise Server.
+ *
+ * @param  string|null  $htmlUrl  The GitHub HTML URL to check
+ */
+function isGithubEnterpriseServerHost(?string $htmlUrl): bool
+{
+    return filled($htmlUrl) && ! isGithubCloudFamilyHost($htmlUrl);
+}
+
+/**
+ * Derive the GitHub REST API base URL from a GitHub HTML URL.
+ *
+ * @param  string  $htmlUrl  The GitHub HTML URL
+ * @return string The API base URL (api.github.com, api.<host> for *.ghe.com, or <origin>/api/v3 for GHES)
+ */
+function githubApiUrlFromHtmlUrl(string $htmlUrl): string
+{
+    if (isGithubDotComHost($htmlUrl)) {
+        return 'https://api.github.com';
+    }
+
+    if (isGheDotComHost($htmlUrl)) {
+        return 'https://api.'.githubUrlHost($htmlUrl);
+    }
+
+    return githubUrlOrigin($htmlUrl).'/api/v3';
+}
+
+/**
+ * Normalize a GitHub organization slug by trimming surrounding slashes and whitespace.
+ *
+ * @param  string|null  $organization  The raw organization value
+ * @return string|null The trimmed organization, or null when blank
+ */
+function normalizeGithubOrganization(?string $organization): ?string
+{
+    if (blank($organization)) {
+        return null;
+    }
+
+    return trim((string) $organization, "/ \t\n\r\0\x0B");
+}
+
+/**
+ * URL-encode a single GitHub path segment.
+ *
+ * @param  string  $segment  The raw path segment
+ * @return string The raw-URL-encoded segment
+ */
+function encodeGithubPathSegment(string $segment): string
+{
+    return rawurlencode($segment);
+}
+
 function assertGithubClockInSync(string $apiUrl): void
 {
    $response = Http::get("{$apiUrl}/zen");
@@ -192,13 +327,17 @@ function syncGithubAppName(GithubApp $source, bool $throw = false): ?string

 function getInstallationPath(GithubApp $source): string
 {
-    $name = str(Str::kebab($source->name));
-    $baseUrl = rtrim($source->html_url, '/');
-    $host = parse_url($source->html_url, PHP_URL_HOST);
-    $host = blank($host) ? null : Str::lower($host);
-    $usesDataResidencyPath = filled($host) && Str::endsWith($host, '.ghe.com');
-    $installation_path = $host === 'github.com' || $usesDataResidencyPath ? 'apps' : 'github-apps';
+    $name = encodeGithubPathSegment(Str::kebab($source->name));
    $state = Str::random(64);
+    $organization = normalizeGithubOrganization($source->organization);
+
+    if (isGithubEnterpriseServerHost($source->html_url)) {
+        $path = "github-apps/{$name}";
+    } elseif (isGheDotComHost($source->html_url) && filled($organization)) {
+        $path = 'apps/'.encodeGithubPathSegment($organization)."/{$name}";
+    } else {
+        $path = "apps/{$name}";
+    }

    Cache::put('github-app-setup-state:'.hash('sha256', $state), [
        'action' => 'install',
@@ -206,25 +345,19 @@ function getInstallationPath(GithubApp $source): string
        'team_id' => $source->team_id,
    ], now()->addMinutes(60));

-    if ($usesDataResidencyPath) {
-        $organization = str($source->organization)->trim('/');
-
-        if ($organization->isNotEmpty()) {
-            $organization = rawurlencode((string) $organization);
-
-            return "$baseUrl/$installation_path/$organization/$name/installations/new?".http_build_query(['state' => $state]);
-        }
-    }
-
-    return "$baseUrl/$installation_path/$name/installations/new?".http_build_query(['state' => $state]);
+    return rtrim($source->html_url, '/')."/{$path}/installations/new?".http_build_query(['state' => $state]);
 }

 function getPermissionsPath(GithubApp $source)
 {
-    $github = GithubApp::where('uuid', $source->uuid)->first();
-    $name = str(Str::kebab($github->name));
+    $name = encodeGithubPathSegment(Str::kebab($source->name));
+    $organization = normalizeGithubOrganization($source->organization);

-    return "$github->html_url/settings/apps/$name/permissions";
+    if (filled($organization)) {
+        return rtrim($source->html_url, '/').'/organizations/'.encodeGithubPathSegment($organization)."/settings/apps/{$name}/permissions";
+    }
+
+    return rtrim($source->html_url, '/')."/settings/apps/{$name}/permissions";
 }

 function loadRepositoryByPage(GithubApp $source, string $token, int $page)