csharpfritz / csharpfritz/SquadUI
Private repositories: no GitHub auth token acquired, issues/dashboard empty
- Dominant language
- TypeScript
- Stars
- 18
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Description
## Problem
SquadUI does not work with GitHub private repositories. The sidebar tree, dashboard issues, and burndown charts all show empty results when the Issue Source in `team.md` points to a private repo.
### Root Cause
The `GitHubIssuesService` is created in `extension.ts` without ever acquiring a GitHub auth token:
```typescript
// line 84 — no token provided
const issuesService = new GitHubIssuesService({ squadFolder: squadFolderName });
```
The service supports tokens (`setToken()` method exists, `apiGet()` includes `Authorization: Bearer` header when a token is set), but **nobody calls `setToken()` or uses `vscode.authentication.getSession`** to acquire one.
This means all GitHub API requests go out **unauthenticated**:
- Public repos work (GitHub allows unauthenticated reads)
- Private repos return **404** (GitHub returns 404 for unauthorized private repo access)
- Rate limits are only 60 req/hour vs 5,000 authenticated
### Additional Issues Found During Investigation
1. **Race condition** — Even if a token were acquired, the tree view renders before the async token acquisition completes, so the first fetch always goes out unauthenticated
2. **Scope mismatch** — VS Code's `getSession('github', ['repo'], { createIfNone: false })` returns `undefined` if the user hasn't specifically granted the `repo` scope, even when signed into GitHub in VS Code
3. **Silent error swallowing** — The dashboard's `updateContent()` catches all issue-fetching errors with `catch { /* issues optional */ }` giving zero feedback
### Suggested Fix
Use VS Code's built-in GitHub authentication API:
```typescript
const session = await vscode.authentication.getSession('github', ['repo'], { createIfNone: false });
issuesService.setToken(session?.accessToken);
```
With fallback to prompted auth when the silent attempt returns no token, and `onDidChangeSessions` listener for sign-in/out events.
### Environment
- VS Code 1.113.0 / VS Code Insiders
- SquadUI 0.9.1
- Windows 11
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.