From 2030b5e80dadf3de04a793ce5a17e8f2c14f53c1 Mon Sep 17 00:00:00 2001
From: Iain Billett <iain@roadie.io>
Date: Tue, 18 Jan 2022 18:01:07 +0000
Subject: [PATCH] Return an empty token where an installation owner is not
 allowed

While this is less obvious to the user this facilitates anonymous access
to (public) files where the app is installed but the owner is not in the
allowed list.

Signed-off-by: Iain Billett <iain@roadie.io>
---
 ...eInstanceGithubCredentialsProvider.test.ts | 38 +++++++++++++++++++
 ...SingleInstanceGithubCredentialsProvider.ts |  4 +-
 2 files changed, 39 insertions(+), 3 deletions(-)

diff --git a/packages/integration/src/github/SingleInstanceGithubCredentialsProvider.test.ts b/packages/integration/src/github/SingleInstanceGithubCredentialsProvider.test.ts
index e5c6307338..246a859b7a 100644
--- a/packages/integration/src/github/SingleInstanceGithubCredentialsProvider.test.ts
+++ b/packages/integration/src/github/SingleInstanceGithubCredentialsProvider.test.ts
@@ -136,6 +136,44 @@ describe('SingleInstanceGithubCredentialsProvider tests', () => {
     expect(token).toEqual('secret_token');
   });
 
+  it('does not return a token where the organisation is not in the allowedInstallationsList', async () => {
+    github = SingleInstanceGithubCredentialsProvider.create({
+      host: 'github.com',
+      apps: [
+        {
+          appId: 1,
+          privateKey: 'privateKey',
+          webhookSecret: '123',
+          clientId: 'CLIENT_ID',
+          clientSecret: 'CLIENT_SECRET',
+          allowedInstallationOwners: ['backstage'],
+        },
+      ],
+    });
+
+    octokit.apps.listInstallations.mockResolvedValue({
+      headers: {
+        etag: '123',
+      },
+      data: [
+        {
+          id: 1,
+          repository_selection: 'all',
+          account: {
+            login: 'backstage',
+          },
+        },
+      ],
+    } as RestEndpointMethodTypes['apps']['listInstallations']['response']);
+
+    const { token, headers } = await github.getCredentials({
+      url: 'https://github.com/RoadiehHQ',
+    });
+
+    expect(headers).toEqual(undefined);
+    expect(token).toEqual(undefined);
+  });
+
   it('should not fail to issue tokens for an organization when the app is installed for a single repo', async () => {
     octokit.apps.listInstallations.mockResolvedValue({
       headers: {
diff --git a/packages/integration/src/github/SingleInstanceGithubCredentialsProvider.ts b/packages/integration/src/github/SingleInstanceGithubCredentialsProvider.ts
index 408c5b1348..b3fd26cddf 100644
--- a/packages/integration/src/github/SingleInstanceGithubCredentialsProvider.ts
+++ b/packages/integration/src/github/SingleInstanceGithubCredentialsProvider.ts
@@ -96,9 +96,7 @@ class GithubAppManager {
     const { installationId, suspended } = await this.getInstallationData(owner);
     if (this.allowedInstallationOwners) {
       if (!this.allowedInstallationOwners?.includes(owner)) {
-        throw new Error(
-          `The GitHub application for ${owner} is not included in the allowed installation list (${installationId}).`,
-        );
+        return { accessToken: '' }; // An empty token allows anonymous access to public repos
       }
     }
     if (suspended) {