molecule-ai/molecule-core
41
0
Fork 2
Code Issues 43 Pull Requests 14 Actions 22 Packages Projects Releases Wiki Activity

fix(platform): /github-installation-token returns 501 on missing config (closes #388) #407

Merged
core-be merged 1 commits from fix/388-github-token-501-staging into staging 2026-05-11 07:04:43 +00:00
Conversation 1 Commits 1 Files Changed 2 +25 -10
2 changed files with 25 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
workspace-server/internal/handlers/github_token.go
View File

@ -49,6 +49,7 @@ import (
"net/http"
"os"
"strconv"
"strings"
"time"
"github.com/Molecule-AI/molecule-monorepo/platform/pkg/provisionhook"
@ -98,7 +99,17 @@ func (h *GitHubTokenHandler) GetInstallationToken(c *gin.Context) {
token, expiresAt, err := generateAppInstallationToken()
if err != nil {
log.Printf("[github] fallback token generation failed: %v", err)
c.JSON(http.StatusInternalServerError, gin.H{"error": "token refresh failed"})
// #388: GITHUB_APP_ID/INSTALLATION_ID unset → Gitea-canonical deployment
// or suspended org. Return 501 so callers (credential helper / gh auth)
// know this is not-implemented vs a transient error.
if strings.Contains(err.Error(), "required") {
c.JSON(http.StatusNotImplemented, gin.H{
"error": "GitHub integration not configured",
"scm": "gitea",
})
} else {
c.JSON(http.StatusInternalServerError, gin.H{"error": "token refresh failed"})
}
return
}
c.JSON(http.StatusOK, gin.H{"token": token, "expires_at": expiresAt})

22
workspace-server/internal/handlers/github_token_test.go
View File

@ -78,11 +78,12 @@ func TestGitHubToken_NilRegistry(t *testing.T) {
// Post-#960/#1101 the handler now falls back to direct env-based App
// token generation (GITHUB_APP_ID / INSTALLATION_ID / PRIVATE_KEY_FILE)
// when no registered provider matches. In the test environment those
// env vars are unset, so the fallback fails with 500 "token refresh
// failed" — a clean retryable signal for the workspace credential
// helper. Previously this path returned 404; the new 500 matches the
// ProviderError shape so callers don't have to branch on "missing
// provider" vs "provider failed".
// env vars are unset, so the fallback fails with 501 "not implemented"
// with scm:"gitea" — signals a Gitea-canonical or suspended-org
// deployment where GitHub integration is not configured (#388).
// Previously this path returned 404; 501 distinguishes "not configured"
// (caller should stop retrying) from "provider failed" (caller should
// retry with back-off).
func TestGitHubToken_NoTokenProvider(t *testing.T) {
reg := provisionhook.NewRegistry()
reg.Register(&mockMutatorOnly{name: "other-plugin"})
@ -91,12 +92,15 @@ func TestGitHubToken_NoTokenProvider(t *testing.T) {
h.GetInstallationToken(c)
if w.Code != http.StatusInternalServerError {
t.Fatalf("expected 500 (env-based fallback fails with unset GITHUB_APP_* vars), got %d: %s",
if w.Code != http.StatusNotImplemented {
t.Fatalf("expected 501 (env-based fallback fails with unset GITHUB_APP_* vars), got %d: %s",
w.Code, w.Body.String())
}
if !strings.Contains(w.Body.String(), "token refresh failed") {
t.Errorf("expected body to contain 'token refresh failed', got: %s", w.Body.String())
if !strings.Contains(w.Body.String(), "GitHub integration not configured") {
t.Errorf("expected body to contain 'GitHub integration not configured', got: %s", w.Body.String())
}
if !strings.Contains(w.Body.String(), `"scm":"gitea"`) {
t.Errorf("expected body to contain 'scm:gitea', got: %s", w.Body.String())
}
}