datatug / backend / 34985092841

87%

push

github

feat(api): exchange a GitHub OAuth code server-side

Adds POST /v0/datatug/github/oauth_token: the client sends the authorization
code GitHub handed it at the redirect URI, the host trades it for an access
token, and the client gets the token to call GitHub with. This is what lets the
app offer "Sign in with GitHub" instead of asking for a personal access token.

- facade4datatug.GithubOAuthExchanger is a PORT: the exchange needs the OAuth
  app's client secret, which must never reach the browser or this repository.
  The host owns the secret and supplies the adapter (nil when unconfigured, in
  which case the endpoint answers "github sign-in is not configured on this
  server" instead of failing obscurely).
- Facade now carries that port alongside the id generator.
- api4datatug registers the route; datatugext.Extension takes both adapters.

The token is returned to the caller and never stored server-side.

Tests: successful exchange (including that the code and redirect URI reach the
port, since GitHub verifies they match), validation of both fields, an
unconfigured host, a GitHub failure wrapped rather than swallowed, and an empty
token treated as a failure; plus the handler's success and 400 paths.

Coverage 89.3% (gate: 88%); build/vet/test clean.

51 of 57 new or added lines in 7 files covered. (89.47%)

208 of 238 relevant lines covered (87.39%)

0.87 hits per line