GitHub Integration

let config = GitHubOAuthConfig {
    client_id: "...".to_string(),
    client_secret: SecretString::new("..."),
    redirect_uri: "...".to_string(),
    scopes: vec![
        "user:email".to_string(),
        "read:user".to_string(),
        "repo".to_string(),  // Access private repositories
        "read:org".to_string(),  // Read organization membership
    ],
};

// User profile
pub struct GitHubUser {
    pub id: i64,              // Stable identifier (use this)
    pub login: String,        // Username (can change)
    pub name: Option<String>, // Display name
    pub email: Option<String>,  // Public email (often null)
    pub avatar_url: Option<String>,
}

// Email address
pub struct GitHubEmail {
    pub email: String,
    pub primary: bool,    // User's primary email
    pub verified: bool,   // Verified by GitHub
}

// Token response
pub struct GitHubTokenResponse {
    pub access_token: SecretString,  // Never logged
    pub token_type: String,  // "bearer"
    pub scope: String,       // Granted scopes
}

use loom_server_github_app::{GithubAppClient, GithubAppConfig};

let config = GithubAppConfig::from_env()?;
let client = GithubAppClient::new(config)?;

// Get installation access token
let installation_id = 12345678;  // From webhook or API
let token = client.get_installation_token(installation_id).await?;

// Use token for API requests (automatically refreshed)

// loom-server-github-app/src/jwt.rs
use jsonwebtoken::{encode, Header, EncodingKey, Algorithm};

#[derive(Serialize)]
struct Claims {
    iat: i64,  // Issued at
    exp: i64,  // Expires at (max 10 minutes)
    iss: String,  // App ID
}

pub fn create_jwt(app_id: &str, private_key: &str) -> Result<String, JwtError> {
    let now = Utc::now().timestamp();
    let claims = Claims {
        iat: now - 60,  // 60 seconds in the past (clock skew)
        exp: now + 600,  // 10 minutes in the future
        iss: app_id.to_string(),
    };
    
    let header = Header::new(Algorithm::RS256);
    let key = EncodingKey::from_rsa_pem(private_key.as_bytes())?;
    
    Ok(encode(&header, &claims, &key)?)
}

use loom_server_github_app::{CodeSearchRequest, CodeSearchResponse};

let request = CodeSearchRequest {
    query: "language:rust trait LlmClient".to_string(),
    per_page: Some(30),
    page: Some(1),
};

let response: CodeSearchResponse = client.search_code(&request, installation_id).await?;

for item in response.items {
    println!("File: {} in {}/{}",
        item.name,
        item.repository.full_name,
        item.path
    );
    println!("  URL: {}", item.html_url);
}

language:rust trait LlmClient
repo:owner/repo filename:main.rs
org:myorg path:src/ extension:rs
user:username "async fn"

use loom_server_github_app::{RepoInfoRequest, FileContentsRequest};

// Get repository info
let repo = client.get_repository_info(
    &RepoInfoRequest {
        owner: "loom".to_string(),
        repo: "loom".to_string(),
    },
    installation_id
).await?;

println!("Repo: {}", repo.full_name);
println!("Description: {:?}", repo.description);
println!("Stars: {}", repo.stargazers_count);
println!("Language: {:?}", repo.language);
println!("Default branch: {}", repo.default_branch);

// Get file contents
let file = client.get_file_contents(
    &FileContentsRequest {
        owner: "loom".to_string(),
        repo: "loom".to_string(),
        path: "README.md".to_string(),
        reference: Some("main".to_string()),  // branch, tag, or commit SHA
    },
    installation_id
).await?;

let content = file.decode_content()?;  // Base64 decode
println!("README.md:\n{}", content);

use loom_server_github_app::verify_webhook_signature;

// In your webhook handler
async fn handle_webhook(
    payload: Vec<u8>,
    signature: &str,  // X-Hub-Signature-256 header
    secret: &str,
) -> Result<(), Error> {
    // Verify signature
    if !verify_webhook_signature(&payload, signature, secret) {
        return Err(Error::InvalidSignature);
    }
    
    // Parse payload
    let event: serde_json::Value = serde_json::from_slice(&payload)?;
    
    // Handle event types
    match event["action"].as_str() {
        Some("created") => { /* Installation created */ }
        Some("deleted") => { /* Installation deleted */ }
        _ => {}
    }
    
    Ok(())
}

// loom-server-github-app/src/webhook.rs
use hmac::{Hmac, Mac};
use sha2::Sha256;

pub fn verify_webhook_signature(
    payload: &[u8],
    signature: &str,
    secret: &str,
) -> bool {
    // GitHub sends "sha256=<hex>"
    let expected = match signature.strip_prefix("sha256=") {
        Some(sig) => sig,
        None => return false,
    };
    
    // Compute HMAC-SHA256
    let mut mac = Hmac::<Sha256>::new_from_slice(secret.as_bytes())
        .expect("HMAC can take key of any size");
    mac.update(payload);
    
    // Compare (constant-time)
    let computed = hex::encode(mac.finalize().into_bytes());
    computed == expected
}

// List installations
let installations = client.list_installations().await?;

for install in installations {
    println!("Installation ID: {}", install.id);
    println!("  Account: {}", install.account.login);
    println!("  Type: {:?}", install.account.account_type);
    println!("  Repos: {:?}", install.repository_selection);
}

// Get installation status
let status = client.get_installation_status(installation_id).await?;
println!("Status: {}", status.status);  // "active" or "suspended"

let response = client.get(...).await?;

if let Some(remaining) = response.headers().get("x-ratelimit-remaining") {
    println!("Remaining: {}", remaining.to_str()?);
}

if let Some(reset) = response.headers().get("x-ratelimit-reset") {
    let timestamp = reset.to_str()?.parse::<i64>()?;
    println!("Resets at: {}", timestamp);
}

use loom_server_github_app::GithubAppError;

match client.search_code(&request, installation_id).await {
    Ok(results) => { /* ... */ }
    Err(GithubAppError::RateLimitExceeded { reset_at }) => {
        let wait = reset_at - Utc::now();
        println!("Rate limited, retry in {} seconds", wait.num_seconds());
    }
    Err(GithubAppError::NotFound) => {
        println!("Repository or installation not found");
    }
    Err(GithubAppError::Unauthorized) => {
        println!("Invalid credentials or insufficient permissions");
    }
    Err(e) => {
        println!("Error: {}", e);
    }
}