Commit f23d0084b6e023ffb1af9e332d8666affc99d542 | the-knife

author	Julius Marminge <julius0216@outlook.com> 2026-10-11 10:35:54-07:00
committer	GitHub <noreply@github.com> 2026-10-11 10:35:54-07:00
log	f23d0084b6e023ffb1af9e332d8666affc99d542
tree	29739400873ad46de31f497aad13ae9034ba7620
parent	8ac6846a0b855c3aad70adbf745ff113d4eb3f1f
signature	Signed by PGP key B5690EEEBB952194

perf(github): resolve credentials once per GraphQL request (#18289)

2 files changed, 65 insertions(+), 33 deletions(-)

packages
- source-control-github
  - src
    server
    GitHubApi.test.ts
    GitHubApi.ts

packages/source-control-github/src/server/GitHubApi.test.ts+44-8

...	@@ -1,6 +1,5 @@	...	@@ -1,6 +1,5 @@
1	import { describe, expect, it } from "@effect/vitest";	1	import { describe, expect, it } from "@effect/vitest";
2	import * as NodeCrypto from "@effect/platform-node/NodeCrypto";	2	import * as NodeCrypto from "@effect/platform-node/NodeCrypto";
3	import * as NodeServices from "@effect/platform-node/NodeServices";
4	import * as Effect from "effect/Effect";	3	import * as Effect from "effect/Effect";
5	import * as Layer from "effect/Layer";	4	import * as Layer from "effect/Layer";
6	import * as Redacted from "effect/Redacted";	5	import * as Redacted from "effect/Redacted";
...	@@ -24,16 +23,20 @@ function harness(respond: (request: HttpClientRequest.HttpClientRequest) => Resp	...	@@ -24,16 +23,20 @@ function harness(respond: (request: HttpClientRequest.HttpClientRequest) => Resp
24	const requests: Array<HttpClientRequest.HttpClientRequest> = [];	23	const requests: Array<HttpClientRequest.HttpClientRequest> = [];
25	let tokens = ["first", "second"];	24	let tokens = ["first", "second"];
26	let invalidations = 0;	25	let invalidations = 0;
		26	let credentialReads = 0;
27	const credentials = Layer.succeed(	27	const credentials = Layer.succeed(
28	GitHubCredentials.GitHubCredentials,	28	GitHubCredentials.GitHubCredentials,
29	GitHubCredentials.GitHubCredentials.of({	29	GitHubCredentials.GitHubCredentials.of({
30	get: (host) =>	30	get: (host) =>
31	Effect.sync(() => ({	31	Effect.sync(() => {
32	host,	32	credentialReads++;
33	token: Redacted.make(tokens[0]!),	33	return {
34	source: "gh" as const,	34	host,
35	fingerprint: `${host}:${tokens[0]}`,	35	token: Redacted.make(tokens[0]!),
36	})),	36	source: "gh" as const,
		37	fingerprint: `${host}:${tokens[0]}`,
		38	};
		39	}),
37	invalidate: () =>	40	invalidate: () =>
38	Effect.sync(() => {	41	Effect.sync(() => {
39	invalidations++;	42	invalidations++;
...	@@ -53,7 +56,12 @@ function harness(respond: (request: HttpClientRequest.HttpClientRequest) => Resp	...	@@ -53,7 +56,12 @@ function harness(respond: (request: HttpClientRequest.HttpClientRequest) => Resp
53	Layer.provideMerge(GitHubQuota.layer),	56	Layer.provideMerge(GitHubQuota.layer),
54	Layer.provideMerge(SourceControlRateLimit.layer),	57	Layer.provideMerge(SourceControlRateLimit.layer),
55	);	58	);
56	return { layer, requests, invalidations: () => invalidations };	59	return {
		60	layer,
		61	requests,
		62	invalidations: () => invalidations,
		63	credentialReads: () => credentialReads,
		64	};
57	}	65	}
58		66
59	const json = (body: unknown, init?: ResponseInit) =>	67	const json = (body: unknown, init?: ResponseInit) =>
...	@@ -119,6 +127,34 @@ describe("GitHubApi", () => {	...	@@ -119,6 +127,34 @@ describe("GitHubApi", () => {
119	}).pipe(Effect.provide(layer));	127	}).pipe(Effect.provide(layer));
120	});	128	});
121		129
		130	it.effect("resolves GraphQL credentials once per request and refreshes after refusal", () => {
		131	const { layer, requests, invalidations, credentialReads } = harness((request) =>
		132	request.headers.authorization === "Bearer first"
		133	? new Response(null, { status: 401 })
		134	: json({ data: { viewer: { login: "julius" } } }),
		135	);
		136	return Effect.gen(function* () {
		137	const api = yield* GitHubApi.GitHubApi;
		138	const input = {
		139	host: "github.com",
		140	operation: "viewer",
		141	query: "query { viewer { login } }",
		142	};
		143	const refused = yield* Effect.flip(api.graphql(input));
		144	expect(refused._tag).toBe("GitHubApiAuthenticationError");
		145	expect(credentialReads()).toBe(1);
		146	expect(invalidations()).toBe(1);
		147
		148	const body = yield* api.graphql(input);
		149	expect(body).toContain('"login":"julius"');
		150	expect(credentialReads()).toBe(2);
		151	expect(requests.map((request) => request.headers.authorization)).toEqual([
		152	"Bearer first",
		153	"Bearer second",
		154	]);
		155	}).pipe(Effect.provide(layer));
		156	});
		157
122	it.effect(	158	it.effect(
123	"traces the operation, path, query and quota, never the query string or variables",	159	"traces the operation, path, query and quota, never the query string or variables",
124	() => {	160	() => {

packages/source-control-github/src/server/GitHubApi.ts+21-25

 @@ -534,8 +534,6 @@ export const make = Effect.gen(function* () {
   const graphql: GitHubApi["Service"]["graphql"] = Effect.fn("GitHubApi.graphql")(
     function* (input) {
       const host = normalizeHost(input.host);
-      const { fingerprint } = yield* credential(host);
-      const scope = (yield* SourceControlRateLimit.CredentialScope) || fingerprint;
       const allowReserve = input.allowReserve ?? (yield* SourceControlRateLimit.Interactive);
       // The document, never its variables: user text (bodies, search terms) travels as variables.
       yield* Effect.annotateCurrentSpan({
 @@ -546,32 +544,30 @@ export const make = Effect.gen(function* () {
             ? `${input.query.slice(0, TRACED_QUERY_MAX_CHARS)}…`
             : input.query,
       });
-      return yield* Effect.gen(function* () {
+      const response = yield* send({
-        const response = yield* send({
+        host,
+        operation: input.operation,
+        request: HttpClientRequest.post(gitHubApiUrls(host).graphql).pipe(
+          HttpClientRequest.acceptJson,
+          HttpClientRequest.bodyJsonUnsafe({
+            query: input.query,
+            variables: input.variables ?? {},
+          }),
+        ),
+        maxResponseBytes: input.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES,
+        allowReserve,
+        acceptNotModified: false,
+        graphql: true,
+      });
+      // A body cut at the byte cap hides any `errors` past the cut and cannot be decoded.
+      if (response.truncated) {
+        return yield* new GitHubApiResponseError({
           host,
           operation: input.operation,
-          request: HttpClientRequest.post(gitHubApiUrls(host).graphql).pipe(
+          status: response.status,
-            HttpClientRequest.acceptJson,
-            HttpClientRequest.bodyJsonUnsafe({
-              query: input.query,
-              variables: input.variables ?? {},
-            }),
-          ),
-          maxResponseBytes: input.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES,
-          allowReserve,
-          acceptNotModified: false,
-          graphql: true,
         });
-        // A body cut at the byte cap hides any `errors` past the cut and cannot be decoded.
+      }
-        if (response.truncated) {
+      return response.body;
-          return yield* new GitHubApiResponseError({
-            host,
-            operation: input.operation,
-            status: response.status,
-          });
-        }
-        return response.body;
-      }).pipe(Effect.provideService(SourceControlRateLimit.CredentialScope, scope));
     },
   );