fix: Allow asset download from private repos

Use --public to download in a way (the old way) that only works for public repos.

Resolves: #18

Author: Mark Gentry

src/github.rs

@@ -55,6 +55,8 @@ impl<K, U> Knowable<K, U> {
 
 #[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Hash, Deserialize)]
 pub struct Asset<T = Type> {
+    /// (Asset) ID needed to download assets from private repositories
+    pub id: u64,
     pub name: String,
     pub size: u64,
 
@@ -68,6 +70,7 @@ pub struct Asset<T = Type> {
 impl Asset<Knowable<Type, String>> {
     fn known(self) -> Option<Asset> {
         self.mime.known().map(|mime| Asset {
+            id: self.id,
             name: self.name,
             size: self.size,
             url: self.url,
@@ -116,6 +119,11 @@ pub struct GitHubArgs {
     #[arg(short = 't', long)]
     pub tag: String,
 
+    /// Download Release Assets w/o supplying token, which doesn't work for
+    /// private repos.
+    #[arg(long)]
+    pub public: bool,
+
     /// Filter asset names
     #[arg(trailing_var_arg = true)]
     pub filter: Vec<String>,
@@ -243,13 +251,34 @@ impl GitHub {
         })
     }
 
+    /// Get the GitHub token if available
+    pub fn token(&self) -> Option<&str> {
+        self.args.token.as_deref()
+    }
+
+    /// Returns true if the repository is not public (i.e., `public` flag is false).
+    pub const fn is_private(&self) -> bool {
+        !self.args.public
+    }
+
+    /// Get the owner name
+    pub fn owner(&self) -> &str {
+        &self.args.owner
+    }
+
+    /// Get the repo name
+    pub fn repo(&self) -> &str {
+        &self.args.repo
+    }
+
     pub async fn assets(&self) -> Result<BTreeSet<Asset>> {
         let url = format!(
             "https://api.github.com/repos/{}/{}/releases/tags/{}",
             self.args.owner, self.args.repo, self.args.tag
         );
 
         let response = self.client.get(&url).send().await?;
+
         let release: Release = response.json().await?;
 
         let assets = release

src/http/server.rs

@@ -49,11 +49,31 @@ impl Server {
             attempt.stop()
         });
 
+        let mut client_builder = Client::builder().redirect(policy);
+        if github.is_private() {
+            // Build client with GitHub authentication if token is available
+            if let Some(token) = github.token() {
+                let mut headers = reqwest::header::HeaderMap::new();
+                headers.insert("Authorization", format!("token {token}").parse().unwrap());
+                headers.insert(
+                    "User-Agent",
+                    concat!(env!("CARGO_PKG_NAME"), "/", env!("CARGO_PKG_VERSION"))
+                        .parse()
+                        .unwrap(),
+                );
+                headers.insert(
+                    "Accept",
+                    "Accept: application/octet-stream".parse().unwrap(),
+                );
+                client_builder = client_builder.default_headers(headers);
+            }
+        }
+
         Ok(Self {
             listener,
             status,
             github,
-            client: Client::builder().redirect(policy).build()?,
+            client: client_builder.build()?,
             path,
         })
     }

src/http/service.rs

@@ -45,6 +45,46 @@ impl Service {
             path,
         }
     }
+
+    /// Build a reqwest request for an asset, handling private/public repos and method.
+    fn build_request(
+        gh: &GitHub,
+        asset: &Asset,
+        client: &Client,
+        method: &Method,
+    ) -> reqwest::RequestBuilder {
+        let url = if gh.is_private() {
+            format!(
+                "https://api.github.com/repos/{}/{}/releases/assets/{}",
+                gh.owner(),
+                gh.repo(),
+                asset.id
+            )
+        } else {
+            asset.url.clone()
+        };
+
+        let rb = match method {
+            &Method::HEAD => client.head(url),
+            _ => client.get(url), // fallback; you only use HEAD/GET here
+        };
+
+        if gh.is_private() {
+            // Required by GitHub asset API for private repos
+            rb.header("Accept", "application/octet-stream")
+        } else {
+            rb
+        }
+    }
+
+    fn inspect_response(response: &reqwest::Response) -> (reqwest::StatusCode, Option<&str>) {
+        let status_code = response.status();
+        let content_length = response
+            .headers()
+            .get("content-length")
+            .and_then(|v| v.to_str().ok());
+        (status_code, content_length)
+    }
 }
 
 impl hyper::service::Service<Request<Incoming>> for Service {
@@ -110,7 +150,21 @@ impl hyper::service::Service<Request<Incoming>> for Service {
                         None => return Ok(POWEROFF_EFI.reply(None, Type::Efi, EMPTY)),
 
                         // Send the request (possibly redirecting...)
-                        Some(asset) => (client.head(asset.url).send().await?, asset.mime),
+                        Some(asset) => {
+                            let request =
+                                Self::build_request(&github, &asset, &client, &Method::HEAD);
+
+                            match request.send().await {
+                                Ok(resp) => {
+                                    let (_status_code, _content_length) =
+                                        Self::inspect_response(&resp);
+                                    (resp, asset.mime)
+                                }
+                                Err(_e) => {
+                                    return Ok(EMPTY.reply(Code::BAD_GATEWAY, None, None));
+                                }
+                            }
+                        }
                     }
                 }
 
@@ -122,9 +176,20 @@ impl hyper::service::Service<Request<Incoming>> for Service {
 
                         // Send the request (possibly redirecting...)
                         Some(asset) => {
-                            let response = client.get(asset.url).send().await?;
-                            status.lock().await.update().downloading(remote);
-                            (response, asset.mime)
+                            let request =
+                                Self::build_request(&github, &asset, &client, &Method::GET);
+
+                            match request.send().await {
+                                Ok(resp) => {
+                                    let (_status_code, _content_length) =
+                                        Self::inspect_response(&resp);
+                                    status.lock().await.update().downloading(remote);
+                                    (resp, asset.mime)
+                                }
+                                Err(_e) => {
+                                    return Ok(EMPTY.reply(Code::BAD_GATEWAY, None, None));
+                                }
+                            }
                         }
                     }
                 }