a 404 that means the App is not installed on that repo

"""Say whether a GitHub App is installed on one specific repository.

Read only. Three GETs: one unauthenticated existence check, and two presence
questions asked with the App's JWT, at repository scope and at account scope.
Nothing is installed, added, changed or minted.

An installation access token cannot see outside its installation, and GitHub
answers 404 rather than 403 for anything outside it, so a public repository the
App was never installed on is indistinguishable from one that does not exist.
GET /repos/{owner}/{repo}/installation is the call that answers directly.

The JWT is read from the environment and never printed. The output is three
status codes, two timestamps and a verdict.
"""
import argparse
import json
import logging
import os
import re
import sys
from datetime import datetime, timezone

import requests

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
log = logging.getLogger("github_app_installation_presence")

API = "https://api.github.com"
UA = "github-app-installation-presence/1.0"

# Owner and repository names GitHub will actually issue.
NAME = re.compile(r"[A-Za-z0-9._-]+")

# Every way a repository reference tends to arrive in a bug report.
PREFIXES = ("https://github.com/", "http://github.com/",
            "https://api.github.com/repos/", "git@github.com:")


def split_repo(value):
    """Reduce any repository reference to (owner, name). Pure.

    A browser URL, an API URL, a clone path and a plain owner/name pair all
    describe the same repository, and a bug report will contain whichever one
    the reporter had on their clipboard. Returns None when it is not a
    repository reference at all.
    """
    text = str(value or "").strip().rstrip("/")
    for prefix in PREFIXES:
        if text.startswith(prefix):
            text = text[len(prefix):]
            break
    if text.endswith(".git"):
        text = text[:-4]
    parts = [p for p in text.split("/") if p]
    if len(parts) < 2:
        return None
    owner, name = parts[0], parts[1]
    if not NAME.fullmatch(owner) or not NAME.fullmatch(name):
        return None
    return (owner, name)


def account_route(owner, owner_type):
    """The account-scope installation route for this kind of owner. Pure.

    Organizations and user accounts have separate routes and the wrong one
    404s for reasons that have nothing to do with the App, which would be a
    very annoying way to get a false finding.
    """
    if str(owner_type or "").lower() == "user":
        return "/users/%s/installation" % owner
    return "/orgs/%s/installation" % owner


def parse_iso(value):
    """Parse an ISO-8601 timestamp into epoch seconds. Pure. None if unusable."""
    text = str(value or "").strip()
    if not text:
        return None
    try:
        moment = datetime.fromisoformat(text.replace("Z", "+00:00"))
    except ValueError:
        return None
    if moment.tzinfo is None:
        moment = moment.replace(tzinfo=timezone.utc)
    return moment.timestamp()


def visibility(status):
    """What the unauthenticated read proved about the repository. Pure."""
    if status == 200:
        return ("public-repo",
                "the repository exists and is publicly readable, so whatever "
                "is wrong is on your side of the request.")
    if status == 404:
        return ("not-public-or-absent",
                "an unauthenticated read also returns 404, which means the "
                "repository is private or does not exist. A read-only check "
                "cannot separate those two, and neither can anyone else "
                "without access.")
    return ("visibility-unknown",
            "the unauthenticated read returned something other than 200 or "
            "404, so nothing was established about the repository itself.")


def classify(repo_status, account_status):
    """Turn two presence questions into one verdict. Pure.

    Repository scope is asked first because a 200 there ends the matter. The
    account-scope answer only matters when the repository-scope answer is no,
    and it is what splits one 404 into two different repairs.
    """
    if repo_status in (401, 403) or account_status in (401, 403):
        return ("jwt-not-accepted",
                "the App JWT was refused, so nothing was learned about any "
                "installation. Fix the JWT first; a signing or clock fault "
                "looks like an absent installation from here.")
    if repo_status == 200:
        return ("installed-on-this-repo",
                "the App is installed on this repository, so a 404 from your "
                "integration is about something else: a permission, a wrong "
                "path, or a credential that is not this App's.")
    if repo_status == 404 and account_status == 200:
        return ("installed-on-account-not-repo",
                "the App is installed on the account and this repository is "
                "not in the installation. The installation is set to selected "
                "repositories and this one was never selected.")
    if repo_status == 404 and account_status == 404:
        return ("not-installed-on-account",
                "the App is not installed anywhere on this account. Somebody "
                "with admin rights on the account has to install it; no "
                "permission or token change will do anything until they do.")
    return ("inconclusive",
            "the two presence checks did not return a pair this check "
            "recognises, so no verdict is safe.")


def creation_order(repo_created, installation_created, selection):
    """Say whether the repository is simply newer than the installation. Pure.

    This is the difference between a mistake and a recurring condition. A
    selection that does not grow will keep producing this finding for every
    repository created after it, and adding this one by hand fixes only today.
    """
    if str(selection or "").lower() == "all":
        return ("selection-covers-everything",
                "repository_selection is all, so new repositories are covered "
                "automatically and creation order is irrelevant.")
    if not selection:
        return ("selection-unknown",
                "no repository_selection was returned, so nothing can be said "
                "about how the installation grows.")
    if repo_created is None or installation_created is None:
        return ("creation-order-unknown",
                "one of the two creation dates is missing, so the order "
                "cannot be established.")
    if repo_created > installation_created:
        days = int((repo_created - installation_created) // 86400)
        return ("repo-created-after-installation",
                "this repository was created %d day(s) after the installation, "
                "and a selected-repositories installation does not gain new "
                "ones. Every repository created from now on will land in the "
                "same state." % days)
    return ("repo-predates-installation",
            "the repository already existed when the installation was "
            "configured, so it was left out deliberately or by oversight "
            "rather than by the passage of time.")


def repair_for(state, selection):
    """The sentence worth printing under a verdict. Pure."""
    if state == "installed-on-account-not-repo":
        if str(selection or "").lower() == "selected":
            return ("add this repository to the installation, or switch the "
                    "installation to all repositories so future ones are "
                    "covered without anybody remembering to.")
        return ("open the installation's configuration and add this "
                "repository to it.")
    if state == "not-installed-on-account":
        return ("install the App on this account. This needs somebody with "
                "admin rights on the account, and it is not something a token "
                "change can substitute for.")
    if state == "installed-on-this-repo":
        return ("nothing to repair here. If calls still fail, read the status "
                "code and the message rather than assuming coverage.")
    if state == "jwt-not-accepted":
        return ("fix the App JWT before reading anything above; an unusable "
                "JWT and an absent installation look the same from here.")
    return "no repair applies to this state."


def get(path, token=None):
    """One GET. Returns (status, body). The only network in this script."""
    headers = {"Accept": "application/vnd.github+json",
               "X-GitHub-Api-Version": "2022-11-28", "User-Agent": UA}
    if token:
        headers["Authorization"] = "Bearer " + token
    r = requests.get(API + path, timeout=30, headers=headers)
    try:
        body = r.json()
    except ValueError:
        body = None
    return r.status_code, body


def main():
    ap = argparse.ArgumentParser(description=__doc__)
    ap.add_argument("--repo", required=True,
                    help="the repository, as owner/name or as any GitHub URL "
                         "for it")
    args = ap.parse_args()

    target = split_repo(args.repo)
    if target is None:
        log.error("could not read %r as a repository reference", args.repo)
        return 2
    owner, name = target

    jwt = os.environ.get("GITHUB_APP_JWT")
    if not jwt:
        log.error("set GITHUB_APP_JWT to the App JWT. The per-repository "
                  "installation route is answered with the JWT, not with an "
                  "installation access token")
        return 2

    # No credential on this one on purpose: whether the repository is publicly
    # readable is a fact about the world, not about the App.
    public_status, public_body = get("/repos/%s/%s" % (owner, name))
    vis_state, vis_detail = visibility(public_status)
    log.info("%s: %s", vis_state, vis_detail)
    owner_type = None
    repo_created = None
    if isinstance(public_body, dict):
        owner_type = (public_body.get("owner") or {}).get("type")
        repo_created = parse_iso(public_body.get("created_at"))

    repo_status, repo_body = get("/repos/%s/%s/installation" % (owner, name), jwt)
    log.info("GET /repos/%s/%s/installation returned %d", owner, name, repo_status)

    route = account_route(owner, owner_type)
    account_status, account_body = get(route, jwt)
    log.info("GET %s returned %d", route, account_status)

    state, detail = classify(repo_status, account_status)
    log.info("%s: %s", state, detail)

    installation = repo_body if repo_status == 200 else account_body
    selection = None
    installation_created = None
    installation_id = None
    if isinstance(installation, dict):
        selection = installation.get("repository_selection")
        installation_created = parse_iso(installation.get("created_at"))
        installation_id = installation.get("id")
    if installation_id is not None:
        log.info("installation %s, repository_selection=%s",
                 installation_id, selection or "unknown")

    order_state, order_detail = creation_order(repo_created,
                                               installation_created, selection)
    log.info("%s: %s", order_state, order_detail)
    log.info("repair: %s", repair_for(state, selection))

    print(json.dumps({"owner": owner, "repo": name,
                      "public_status": public_status,
                      "repo_installation_status": repo_status,
                      "account_installation_status": account_status,
                      "account_route": route,
                      "repository_selection": selection,
                      "installation_id": installation_id,
                      "visibility": vis_state, "order": order_state,
                      "state": state}, indent=2))
    return 0 if state == "installed-on-this-repo" else 1


if __name__ == "__main__":
    sys.exit(main())

/**
 * Say whether a GitHub App is installed on one specific repository.
 *
 * Read only. Three GETs: one unauthenticated existence check, and two
 * presence questions asked with the App's JWT, at repository scope and at
 * account scope. Nothing is installed, added, changed or minted.
 *
 * An installation access token cannot see outside its installation, and
 * GitHub answers 404 rather than 403 for anything outside it, so a public
 * repository the App was never installed on is indistinguishable from one
 * that does not exist. GET /repos/{owner}/{repo}/installation answers
 * directly.
 *
 * The JWT is read from the environment and never printed.
 */
const API = 'https://api.github.com';
const UA = 'github-app-installation-presence/1.0';

/** Owner and repository names GitHub will actually issue. */
const NAME = /^[A-Za-z0-9._-]+$/;

/** Every way a repository reference tends to arrive in a bug report. */
const PREFIXES = ['https://github.com/', 'http://github.com/',
  'https://api.github.com/repos/', 'git@github.com:'];

/**
 * Reduce any repository reference to [owner, name]. Pure.
 * null when it is not a repository reference at all.
 */
export function splitRepo(value) {
  let text = String(value ?? '').trim().replace(/\/+$/, '');
  for (const prefix of PREFIXES) {
    if (text.startsWith(prefix)) {
      text = text.slice(prefix.length);
      break;
    }
  }
  if (text.endsWith('.git')) text = text.slice(0, -4);
  const parts = text.split('/').filter(Boolean);
  if (parts.length < 2) return null;
  const [owner, name] = parts;
  if (!NAME.test(owner) || !NAME.test(name)) return null;
  return [owner, name];
}

/**
 * The account-scope installation route for this kind of owner. Pure.
 * The wrong one 404s for reasons that have nothing to do with the App.
 */
export function accountRoute(owner, ownerType) {
  if (String(ownerType ?? '').toLowerCase() === 'user') {
    return `/users/${owner}/installation`;
  }
  return `/orgs/${owner}/installation`;
}

/** Parse an ISO-8601 timestamp into epoch seconds. Pure. null if unusable. */
export function parseIso(value) {
  const text = String(value ?? '').trim();
  if (!text) return null;
  const ms = Date.parse(text);
  return Number.isNaN(ms) ? null : ms / 1000;
}

/** What the unauthenticated read proved about the repository. Pure. */
export function visibility(status) {
  if (status === 200) {
    return ['public-repo',
      'the repository exists and is publicly readable, so whatever is wrong ' +
      'is on your side of the request.'];
  }
  if (status === 404) {
    return ['not-public-or-absent',
      'an unauthenticated read also returns 404, which means the repository ' +
      'is private or does not exist. A read-only check cannot separate those ' +
      'two, and neither can anyone else without access.'];
  }
  return ['visibility-unknown',
    'the unauthenticated read returned something other than 200 or 404, so ' +
    'nothing was established about the repository itself.'];
}

/**
 * Turn two presence questions into one verdict. Pure.
 * Repository scope first: a 200 there ends the matter. The account answer is
 * what splits one 404 into two different repairs.
 */
export function classify(repoStatus, accountStatus) {
  if ([401, 403].includes(repoStatus) || [401, 403].includes(accountStatus)) {
    return ['jwt-not-accepted',
      'the App JWT was refused, so nothing was learned about any ' +
      'installation. Fix the JWT first; a signing or clock fault looks like ' +
      'an absent installation from here.'];
  }
  if (repoStatus === 200) {
    return ['installed-on-this-repo',
      'the App is installed on this repository, so a 404 from your ' +
      'integration is about something else: a permission, a wrong path, or a ' +
      'credential that is not this App\'s.'];
  }
  if (repoStatus === 404 && accountStatus === 200) {
    return ['installed-on-account-not-repo',
      'the App is installed on the account and this repository is not in the ' +
      'installation. The installation is set to selected repositories and ' +
      'this one was never selected.'];
  }
  if (repoStatus === 404 && accountStatus === 404) {
    return ['not-installed-on-account',
      'the App is not installed anywhere on this account. Somebody with ' +
      'admin rights on the account has to install it; no permission or token ' +
      'change will do anything until they do.'];
  }
  return ['inconclusive',
    'the two presence checks did not return a pair this check recognises, so ' +
    'no verdict is safe.'];
}

/**
 * Say whether the repository is simply newer than the installation. Pure.
 * This is the difference between a mistake and a recurring condition.
 */
export function creationOrder(repoCreated, installationCreated, selection) {
  if (String(selection ?? '').toLowerCase() === 'all') {
    return ['selection-covers-everything',
      'repository_selection is all, so new repositories are covered ' +
      'automatically and creation order is irrelevant.'];
  }
  if (!selection) {
    return ['selection-unknown',
      'no repository_selection was returned, so nothing can be said about ' +
      'how the installation grows.'];
  }
  if (repoCreated === null || repoCreated === undefined
      || installationCreated === null || installationCreated === undefined) {
    return ['creation-order-unknown',
      'one of the two creation dates is missing, so the order cannot be ' +
      'established.'];
  }
  if (repoCreated > installationCreated) {
    const days = Math.trunc((repoCreated - installationCreated) / 86400);
    return ['repo-created-after-installation',
      `this repository was created ${days} day(s) after the installation, and ` +
      'a selected-repositories installation does not gain new ones. Every ' +
      'repository created from now on will land in the same state.'];
  }
  return ['repo-predates-installation',
    'the repository already existed when the installation was configured, so ' +
    'it was left out deliberately or by oversight rather than by the passage ' +
    'of time.'];
}

/** The sentence worth printing under a verdict. Pure. */
export function repairFor(state, selection) {
  if (state === 'installed-on-account-not-repo') {
    if (String(selection ?? '').toLowerCase() === 'selected') {
      return 'add this repository to the installation, or switch the ' +
        'installation to all repositories so future ones are covered without ' +
        'anybody remembering to.';
    }
    return 'open the installation\'s configuration and add this repository to it.';
  }
  if (state === 'not-installed-on-account') {
    return 'install the App on this account. This needs somebody with admin ' +
      'rights on the account, and it is not something a token change can ' +
      'substitute for.';
  }
  if (state === 'installed-on-this-repo') {
    return 'nothing to repair here. If calls still fail, read the status code ' +
      'and the message rather than assuming coverage.';
  }
  if (state === 'jwt-not-accepted') {
    return 'fix the App JWT before reading anything above; an unusable JWT ' +
      'and an absent installation look the same from here.';
  }
  return 'no repair applies to this state.';
}

async function get(path, token) {
  const headers = {
    Accept: 'application/vnd.github+json',
    'X-GitHub-Api-Version': '2022-11-28',
    'User-Agent': UA,
  };
  if (token) headers.Authorization = `Bearer ${token}`;
  const res = await fetch(API + path, { headers });
  let body = null;
  try { body = await res.json(); } catch { body = null; }
  return [res.status, body];
}

function flag(name) {
  const at = process.argv.indexOf(name);
  return (at === -1 || at === process.argv.length - 1) ? null : process.argv[at + 1];
}

async function main() {
  const target = splitRepo(flag('--repo'));
  if (!target) {
    console.error('pass --repo owner/name, or any GitHub URL for the repository');
    process.exitCode = 2;
    return;
  }
  const [owner, name] = target;

  const jwt = process.env.GITHUB_APP_JWT;
  if (!jwt) {
    console.error('set GITHUB_APP_JWT to the App JWT. The per-repository ' +
      'installation route is answered with the JWT, not with an installation ' +
      'access token');
    process.exitCode = 2;
    return;
  }

  // No credential on this one on purpose: whether the repository is publicly
  // readable is a fact about the world, not about the App.
  const [publicStatus, publicBody] = await get(`/repos/${owner}/${name}`);
  const [visState, visDetail] = visibility(publicStatus);
  console.log(`${visState}: ${visDetail}`);
  const ownerType = publicBody && publicBody.owner ? publicBody.owner.type : null;
  const repoCreated = publicBody ? parseIso(publicBody.created_at) : null;

  const [repoStatus, repoBody] = await get(`/repos/${owner}/${name}/installation`, jwt);
  console.log(`GET /repos/${owner}/${name}/installation returned ${repoStatus}`);

  const route = accountRoute(owner, ownerType);
  const [accountStatus, accountBody] = await get(route, jwt);
  console.log(`GET ${route} returned ${accountStatus}`);

  const [state, detail] = classify(repoStatus, accountStatus);
  console.log(`${state}: ${detail}`);

  const installation = repoStatus === 200 ? repoBody : accountBody;
  const selection = installation ? installation.repository_selection : null;
  const installationCreated = installation ? parseIso(installation.created_at) : null;
  const installationId = installation ? installation.id : null;
  if (installationId !== null && installationId !== undefined) {
    console.log(`installation ${installationId}, ` +
      `repository_selection=${selection ?? 'unknown'}`);
  }

  const [orderState, orderDetail] = creationOrder(repoCreated, installationCreated, selection);
  console.log(`${orderState}: ${orderDetail}`);
  console.log(`repair: ${repairFor(state, selection)}`);

  console.log(JSON.stringify({
    owner,
    repo: name,
    public_status: publicStatus,
    repo_installation_status: repoStatus,
    account_installation_status: accountStatus,
    account_route: route,
    repository_selection: selection ?? null,
    installation_id: installationId ?? null,
    visibility: visState,
    order: orderState,
    state,
  }, null, 2));
  process.exitCode = state === 'installed-on-this-repo' ? 0 : 1;
}

// Only run when invoked directly, so importing this module from the test file
// does not execute main() and set an exit code that fails a passing suite.
if (import.meta.url === `file://${process.argv[1]}`) {
  main().catch((err) => { console.error(err.message); process.exitCode = 2; });
}

from github_app_installation_presence import (
    account_route, classify, creation_order, parse_iso, repair_for, split_repo,
    visibility,
)

JAN = parse_iso("2026-01-01T00:00:00Z")
MAR = parse_iso("2026-03-02T00:00:00Z")


def test_every_shape_of_repository_reference_lands_on_the_same_pair():
    assert split_repo("acme/reporting") == ("acme", "reporting")
    assert split_repo("https://github.com/acme/reporting") == ("acme", "reporting")
    assert split_repo("https://github.com/acme/reporting/") == ("acme", "reporting")
    assert split_repo("https://github.com/acme/reporting/pulls/12") == ("acme", "reporting")
    assert split_repo("https://api.github.com/repos/acme/reporting") == ("acme", "reporting")
    assert split_repo("git@github.com:acme/reporting.git") == ("acme", "reporting")


def test_something_that_is_not_a_repository_reference_is_refused():
    assert split_repo("acme") is None
    assert split_repo("") is None
    assert split_repo(None) is None
    assert split_repo("acme/repo with spaces") is None


def test_organizations_and_user_accounts_have_different_routes():
    assert account_route("acme", "Organization") == "/orgs/acme/installation"
    assert account_route("octocat", "User") == "/users/octocat/installation"
    assert account_route("acme", None) == "/orgs/acme/installation"


def test_a_public_repository_narrows_the_search_to_your_own_app():
    state, detail = visibility(200)
    assert state == "public-repo"
    assert "your side of the request" in detail


def test_a_404_without_a_credential_is_two_answers_and_says_so():
    state, detail = visibility(404)
    assert state == "not-public-or-absent"
    assert "cannot separate those two" in detail
    assert visibility(500)[0] == "visibility-unknown"


def test_installed_on_the_account_but_not_the_repository_is_the_headline():
    state, detail = classify(404, 200)
    assert state == "installed-on-account-not-repo"
    assert "never selected" in detail
    assert "add this repository" in repair_for(state, "selected")


def test_not_installed_at_all_is_a_different_repair_and_a_different_person():
    state, detail = classify(404, 404)
    assert state == "not-installed-on-account"
    assert "admin rights" in repair_for(state, None)


def test_installed_here_means_the_404_came_from_somewhere_else():
    state, detail = classify(200, 200)
    assert state == "installed-on-this-repo"
    assert "about something else" in detail


def test_a_refused_jwt_is_not_reported_as_an_absent_installation():
    assert classify(401, 404)[0] == "jwt-not-accepted"
    assert classify(404, 403)[0] == "jwt-not-accepted"
    assert "Fix the JWT first" in classify(401, 404)[1]


def test_an_unrecognised_pair_gets_no_verdict():
    assert classify(500, 200)[0] == "inconclusive"


def test_a_repository_newer_than_the_installation_is_a_recurring_cause():
    state, detail = creation_order(MAR, JAN, "selected")
    assert state == "repo-created-after-installation"
    assert "60 day(s) after" in detail
    assert "Every repository created from now on" in detail


def test_a_repository_older_than_the_installation_was_left_out_by_hand():
    assert creation_order(JAN, MAR, "selected")[0] == "repo-predates-installation"


def test_an_installation_covering_everything_makes_the_dates_irrelevant():
    state, detail = creation_order(MAR, JAN, "all")
    assert state == "selection-covers-everything"
    assert "automatically" in detail


def test_missing_inputs_produce_a_named_state_rather_than_a_guess():
    assert creation_order(None, JAN, "selected")[0] == "creation-order-unknown"
    assert creation_order(MAR, None, "selected")[0] == "creation-order-unknown"
    assert creation_order(MAR, JAN, None)[0] == "selection-unknown"


def test_timestamps_that_cannot_be_read_are_none_rather_than_an_exception():
    assert parse_iso("2026-01-01T00:00:00Z") is not None
    assert parse_iso("last thursday") is None
    assert parse_iso("") is None
    assert parse_iso(None) is None

import { test } from 'node:test';
import assert from 'node:assert/strict';
import {
  accountRoute, classify, creationOrder, parseIso, repairFor, splitRepo,
  visibility,
} from './github-app-installation-presence.mjs';

const JAN = parseIso('2026-01-01T00:00:00Z');
const MAR = parseIso('2026-03-02T00:00:00Z');

test('every shape of repository reference lands on the same pair', () => {
  assert.deepEqual(splitRepo('acme/reporting'), ['acme', 'reporting']);
  assert.deepEqual(splitRepo('https://github.com/acme/reporting'), ['acme', 'reporting']);
  assert.deepEqual(splitRepo('https://github.com/acme/reporting/'), ['acme', 'reporting']);
  assert.deepEqual(splitRepo('https://github.com/acme/reporting/pulls/12'), ['acme', 'reporting']);
  assert.deepEqual(splitRepo('https://api.github.com/repos/acme/reporting'), ['acme', 'reporting']);
  assert.deepEqual(splitRepo('git@github.com:acme/reporting.git'), ['acme', 'reporting']);
});

test('something that is not a repository reference is refused', () => {
  assert.equal(splitRepo('acme'), null);
  assert.equal(splitRepo(''), null);
  assert.equal(splitRepo(null), null);
  assert.equal(splitRepo('acme/repo with spaces'), null);
});

test('organizations and user accounts have different routes', () => {
  assert.equal(accountRoute('acme', 'Organization'), '/orgs/acme/installation');
  assert.equal(accountRoute('octocat', 'User'), '/users/octocat/installation');
  assert.equal(accountRoute('acme', null), '/orgs/acme/installation');
});

test('a public repository narrows the search to your own app', () => {
  const [state, detail] = visibility(200);
  assert.equal(state, 'public-repo');
  assert.match(detail, /your side of the request/);
});

test('a 404 without a credential is two answers and says so', () => {
  const [state, detail] = visibility(404);
  assert.equal(state, 'not-public-or-absent');
  assert.match(detail, /cannot separate those two/);
  assert.equal(visibility(500)[0], 'visibility-unknown');
});

test('installed on the account but not the repository is the headline', () => {
  const [state, detail] = classify(404, 200);
  assert.equal(state, 'installed-on-account-not-repo');
  assert.match(detail, /never selected/);
  assert.match(repairFor(state, 'selected'), /add this repository/);
});

test('not installed at all is a different repair and a different person', () => {
  const [state] = classify(404, 404);
  assert.equal(state, 'not-installed-on-account');
  assert.match(repairFor(state, null), /admin rights/);
});

test('installed here means the 404 came from somewhere else', () => {
  const [state, detail] = classify(200, 200);
  assert.equal(state, 'installed-on-this-repo');
  assert.match(detail, /about something else/);
});

test('a refused jwt is not reported as an absent installation', () => {
  assert.equal(classify(401, 404)[0], 'jwt-not-accepted');
  assert.equal(classify(404, 403)[0], 'jwt-not-accepted');
  assert.match(classify(401, 404)[1], /Fix the JWT first/);
});

test('an unrecognised pair gets no verdict', () => {
  assert.equal(classify(500, 200)[0], 'inconclusive');
});

test('a repository newer than the installation is a recurring cause', () => {
  const [state, detail] = creationOrder(MAR, JAN, 'selected');
  assert.equal(state, 'repo-created-after-installation');
  assert.match(detail, /60 day\(s\) after/);
  assert.match(detail, /Every repository created from now on/);
});

test('a repository older than the installation was left out by hand', () => {
  assert.equal(creationOrder(JAN, MAR, 'selected')[0], 'repo-predates-installation');
});

test('an installation covering everything makes the dates irrelevant', () => {
  const [state, detail] = creationOrder(MAR, JAN, 'all');
  assert.equal(state, 'selection-covers-everything');
  assert.match(detail, /automatically/);
});

test('missing inputs produce a named state rather than a guess', () => {
  assert.equal(creationOrder(null, JAN, 'selected')[0], 'creation-order-unknown');
  assert.equal(creationOrder(MAR, null, 'selected')[0], 'creation-order-unknown');
  assert.equal(creationOrder(MAR, JAN, null)[0], 'selection-unknown');
});

test('timestamps that cannot be read are null rather than an exception', () => {
  assert.notEqual(parseIso('2026-01-01T00:00:00Z'), null);
  assert.equal(parseIso('last thursday'), null);
  assert.equal(parseIso(''), null);
  assert.equal(parseIso(null), null);
});