Use AppBearerTokenAuth in login_as_app_installation

dato · dato · commit 655c8e1d4aa4 · 2020-12-20T18:31:10.000-03:00
Previously, this method used an Authorization header via `headers`
parameter, instead of an AuthBase instance via the `auth` parameter.

But the requests library has this behavior where it will try
to pick up authentication credentials from ~/.netrc if neither
session nor request has an associated AuthBase object. (A sole
Authorization header will not prevent this behavior.)

Since all of github3.py uses AuthBase instances to
authenticate, but login_as_app_installation didn't, this makes
for an incredibly difficult issue to debug, since the latter
is the only place in which the issue can manifest, if a user's
~/.netrc has an entry for api.github.com.

By using AppBearerTokenAuth, this can no longer happen, since
the ~/.netrc path is not hit any more.
diff --git a/AUTHORS.rst b/AUTHORS.rst
@@ -200,3 +200,5 @@ Contributors
 - Andrew Hayworth (@ahayworth)
 
 - Dmitry Kiselev (@dmitrykiselev27)
+
+- Adeodato Simó (@dato)
diff --git a/src/github3/github.py b/src/github3/github.py
@@ -22,6 +22,7 @@
 from . import pulls
 from .repos import repo
 from . import search
+from . import session
 from . import structs
 from . import users
 from . import utils
@@ -1399,14 +1400,15 @@ def login_as_app_installation(
         # NOTE(sigmavirus24): This JWT token does not need to last very long.
         # Instead of allowing it to stick around for 10 minutes, let's limit
         # it to 30 seconds.
-        headers = apps.create_jwt_headers(
-            private_key_pem, app_id, expire_in=30
-        )
+        jwt_token = apps.create_token(private_key_pem, app_id, expire_in=30)
+        bearer_auth = session.AppBearerTokenAuth(jwt_token, 30)
         url = self._build_url(
             "app", "installations", str(installation_id), "access_tokens"
         )
         with self.session.no_auth():
-            response = self.session.post(url, headers=headers)
+            response = self.session.post(
+                url, auth=bearer_auth, headers=apps.APP_PREVIEW_HEADERS
+            )
             json = self._json(response, 201)
 
         self.session.app_installation_token_auth(json)
