package utils //nolint:revive //TODO: figure out a better name for this package
import (
"fmt"
"net/http"
"regexp"
"strings"
httpheaders "github.com/github/github-mcp-server/pkg/http/headers"
"github.com/github/github-mcp-server/pkg/http/mark"
)
type TokenType int
const (
TokenTypeUnknown TokenType = iota
TokenTypePersonalAccessToken
TokenTypeFineGrainedPersonalAccessToken
TokenTypeOAuthAccessToken
TokenTypeUserToServerGitHubAppToken
TokenTypeServerToServerGitHubAppToken
)
var supportedGitHubPrefixes = map[string]TokenType{
"ghp_": TokenTypePersonalAccessToken, // Personal access token (classic)
"github_pat_": TokenTypeFineGrainedPersonalAccessToken, // Fine-grained personal access token
"gho_": TokenTypeOAuthAccessToken, // OAuth access token
"ghu_": TokenTypeUserToServerGitHubAppToken, // User access token for a GitHub App
"ghs_": TokenTypeServerToServerGitHubAppToken, // Installation access token for a GitHub App (a.k.a. server-to-server token)
}
var (
ErrMissingAuthorizationHeader = fmt.Errorf("%w: missing required Authorization header", mark.ErrBadRequest)
ErrBadAuthorizationHeader = fmt.Errorf("%w: Authorization header is badly formatted", mark.ErrBadRequest)
ErrUnsupportedAuthorizationHeader = fmt.Errorf("%w: unsupported Authorization header", mark.ErrBadRequest)
)
// oldPatternRegexp is the regular expression for the old pattern of the token.
// Until 2021, GitHub API tokens did not have an identifiable prefix. They
// were 40 characters long and only contained the characters a-f and 0-9.
var oldPatternRegexp = regexp.MustCompile(`\A[a-f0-9]{40}\z`)
// ParseAuthorizationHeader parses the Authorization header from the HTTP request
func ParseAuthorizationHeader(req *http.Request) (tokenType TokenType, token string, _ error) {
authHeader := req.Header.Get(httpheaders.AuthorizationHeader)
if authHeader == "" {
return 0, "", ErrMissingAuthorizationHeader
}
switch {
// decrypt dotcom token and set it as token
case strings.HasPrefix(authHeader, "GitHub-Bearer "):
return 0, "", ErrUnsupportedAuthorizationHeader
default:
// support both "Bearer" and "bearer" to conform to api.github.com
if len(authHeader) > 7 && strings.EqualFold(authHeader[:7], "Bearer ") {
token = authHeader[7:]
} else {
token = authHeader
}
}
for prefix, tokenType := range supportedGitHubPrefixes {
if strings.HasPrefix(token, prefix) {
return tokenType, token, nil
}
}
matchesOldTokenPattern := oldPatternRegexp.MatchString(token)
if matchesOldTokenPattern {
return TokenTypePersonalAccessToken, token, nil
}
return 0, "", ErrBadAuthorizationHeader
}
