feat(application-server): implement workspace and organization domain (#401)

Co-authored-by: semantic-release-bot <semantic-release-bot@martynus.net>
Co-authored-by: Felix T.J. Dietrich <felix_dietrich@gmx.de>
Co-authored-by: Felix T.J. Dietrich <felixtj.dietrich@tum.de>
Co-authored-by: Dmytro Dmukh <dmytro.dmukh@tum.de>
Co-authored-by: Florian Ehrenstorfer <57101116+iam-flo@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

Author: 6 people

docs/contributor/erd/schema.mmd

@@ -145,6 +145,25 @@ erDiagram
         BIGINT repository_id FK
     }
 
+    Organization {
+        BIGINT id PK
+        TIMESTAMPTZ created_at
+        TIMESTAMPTZ updated_at
+        VARCHAR(255) avatar_url
+        BIGINT github_id UK "NOT NULL"
+        VARCHAR(255) html_url
+        BIGINT installation_id
+        VARCHAR(255) login UK "NOT NULL"
+        VARCHAR(255) name
+    }
+
+    OrganizationMembership {
+        BIGINT organization_id PK
+        BIGINT user_id PK
+        TIMESTAMPTZ joined_at
+        VARCHAR(255) role
+    }
+
     PullRequestRequestedReviewer {
         BIGINT pull_request_id PK,FK
         BIGINT user_id PK,FK
@@ -220,6 +239,7 @@ erDiagram
         INTEGER stargazers_count "NOT NULL"
         VARCHAR(255) visibility
         INTEGER watchers_count "NOT NULL"
+        BIGINT organization_id FK
     }
 
     RepositoryToMonitor {
@@ -287,12 +307,20 @@ erDiagram
     Workspace {
         BIGINT id PK
         TIMESTAMP users_synced_at
+        VARCHAR(255) account_login
+        VARCHAR(255) git_provider_mode
+        VARCHAR(255) github_repository_selection
+        BIGINT installation_id
+        TIMESTAMPTZ installation_linked_at
+        BIGINT organization_id FK,UK
+        TEXT personal_access_token
     }
 
     %% Relationships
     %% One-to-One relationships
     ChatMessage ||--|| ChatMessagePart : has
     ChatMessage ||--|| ChatThread : references
+    Organization ||--|| Workspace : has
 
     %% One-to-Many relationships
     Issue ||--o{ BadPracticeDetection : references
@@ -317,6 +345,7 @@ erDiagram
     PullRequestReview ||--o{ PullRequestReviewComment : commented_on
     BadPracticeDetection ||--o{ PullRequestBadPractice : has
     Issue ||--o{ PullRequestBadPractice : references
+    Organization ||--o{ Repository : has
     Workspace ||--o{ RepositoryToMonitor : monitors
 
     %% Many-to-Many relationships

server/application-server/pom.xml

@@ -70,6 +70,11 @@
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-web</artifactId>
         </dependency>
+		<dependency>
+			<groupId>com.auth0</groupId>
+			<artifactId>java-jwt</artifactId>
+			<version>4.4.0</version>
+		</dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-webflux</artifactId>

server/application-server/src/main/java/de/tum/in/www1/hephaestus/config/GitHubConfig.java

@@ -0,0 +1,102 @@
+package de.tum.in.www1.hephaestus.gitprovider.common.github;
+
+import com.github.benmanes.caffeine.cache.Cache;
+import com.github.benmanes.caffeine.cache.Caffeine;
+import de.tum.in.www1.hephaestus.gitprovider.common.github.app.GitHubAppTokenService;
+import de.tum.in.www1.hephaestus.workspace.Workspace;
+import de.tum.in.www1.hephaestus.workspace.Workspace.GitProviderMode;
+import de.tum.in.www1.hephaestus.workspace.WorkspaceRepository;
+import jakarta.annotation.PreDestroy;
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.time.Duration;
+import org.kohsuke.github.GitHub;
+import org.kohsuke.github.GitHubBuilder;
+import org.springframework.stereotype.Component;
+
+@Component
+public class GitHubClientProvider {
+
+    private final WorkspaceRepository workspaceRepository;
+    private final GitHubAppTokenService appTokens;
+
+    private final Cache<Long, GitHub> workspaceClients = Caffeine.newBuilder()
+        .expireAfterWrite(Duration.ofMinutes(50))
+        .maximumSize(10_000)
+        .build();
+
+    public GitHubClientProvider(WorkspaceRepository workspaceRepository, GitHubAppTokenService appTokens) {
+        this.workspaceRepository = workspaceRepository;
+        this.appTokens = appTokens;
+    }
+
+    /**
+     * Return a cached Hub4J {@link GitHub} client for the given workspace id.
+     * <p>
+     * The provider transparently handles both GitHub App installations and PAT-backed workspaces,
+     * creating short-lived clients on-demand and reusing them for up to 50 minutes to avoid hitting
+     * rate limits or issuing unnecessary installation tokens.
+     */
+    public GitHub forWorkspace(Long workspaceId) throws IOException {
+        try {
+            return workspaceClients.get(workspaceId, this::createClientForWorkspace);
+        } catch (UncheckedIOException e) {
+            throw e.getCause();
+        }
+    }
+
+    /**
+     * Evict all cached clients associated with the supplied installation id.
+     * <p>
+     * This is primarily invoked when we update installation metadata (e.g. after rotating tokens),
+     * ensuring that subsequent calls obtain a fresh client.
+     */
+    public void invalidateInstallation(Long installationId) {
+        if (installationId == null) {
+            return;
+        }
+        workspaceRepository
+            .findByInstallationId(installationId)
+            .map(Workspace::getId)
+            .ifPresent(workspaceClients::invalidate);
+    }
+
+    /**
+     * Evict the cached client for the given workspace, forcing the next lookup to build a new instance.
+     */
+    public void invalidateWorkspace(Long workspaceId) {
+        workspaceClients.invalidate(workspaceId);
+    }
+
+    @PreDestroy
+    public void shutdown() {
+        workspaceClients.invalidateAll();
+    }
+
+    private GitHub createClientForWorkspace(Long workspaceId) {
+        try {
+            Workspace workspace = workspaceRepository
+                .findById(workspaceId)
+                .orElseThrow(() -> new IllegalArgumentException("Workspace not found: " + workspaceId));
+
+            if (workspace.getGitProviderMode() == GitProviderMode.GITHUB_APP_INSTALLATION) {
+                Long installationId = workspace.getInstallationId();
+                if (installationId == null) {
+                    throw new IllegalStateException("Workspace " + workspaceId + " has no installation id.");
+                }
+                return appTokens.clientForInstallation(installationId);
+            }
+
+            String token = workspace.getPersonalAccessToken();
+            if (token == null || token.isBlank()) {
+                throw new IllegalStateException(
+                    "Workspace " + workspaceId + " is configured for PAT access but no token is stored."
+                );
+            }
+
+            return new GitHubBuilder().withOAuthToken(token).build();
+        } catch (IOException e) {
+            throw new UncheckedIOException(e);
+        }
+    }
+}