csharpfritz / csharpfritz/SquadUI

Private repositories: no GitHub auth token acquired, issues/dashboard empty

Open
#90 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
18
Forks
3
PR merge metrics
No merged PRs in 30d

Description

## Problem

SquadUI does not work with GitHub private repositories. The sidebar tree, dashboard issues, and burndown charts all show empty results when the Issue Source in `team.md` points to a private repo.

### Root Cause

The `GitHubIssuesService` is created in `extension.ts` without ever acquiring a GitHub auth token:

```typescript
// line 84 — no token provided
const issuesService = new GitHubIssuesService({ squadFolder: squadFolderName });
```

The service supports tokens (`setToken()` method exists, `apiGet()` includes `Authorization: Bearer` header when a token is set), but **nobody calls `setToken()` or uses `vscode.authentication.getSession`** to acquire one.

This means all GitHub API requests go out **unauthenticated**:
- Public repos work (GitHub allows unauthenticated reads)
- Private repos return **404** (GitHub returns 404 for unauthorized private repo access)
- Rate limits are only 60 req/hour vs 5,000 authenticated

### Additional Issues Found During Investigation

1. **Race condition** — Even if a token were acquired, the tree view renders before the async token acquisition completes, so the first fetch always goes out unauthenticated
2. **Scope mismatch** — VS Code's `getSession('github', ['repo'], { createIfNone: false })` returns `undefined` if the user hasn't specifically granted the `repo` scope, even when signed into GitHub in VS Code
3. **Silent error swallowing** — The dashboard's `updateContent()` catches all issue-fetching errors with `catch { /* issues optional */ }` giving zero feedback

### Suggested Fix

Use VS Code's built-in GitHub authentication API:

```typescript
const session = await vscode.authentication.getSession('github', ['repo'], { createIfNone: false });
issuesService.setToken(session?.accessToken);
```

With fallback to prompted auth when the silent attempt returns no token, and `onDidChangeSessions` listener for sign-in/out events.

### Environment

- VS Code 1.113.0 / VS Code Insiders
- SquadUI 0.9.1
- Windows 11

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.