#!/usr/bin/env python

from __future__ import print_function

import argparse

import base64

import calendar

import codecs

import json

import logging

import os

import platform

import random

import re

import select

import socket

import ssl

import subprocess

import sys

import time

from collections.abc import Generator

from datetime import datetime

from http.client import IncompleteRead

from urllib.error import HTTPError, URLError

from urllib.parse import urlencode, urlparse

from urllib.request import HTTPRedirectHandler, Request, build_opener, urlopen

try:

from . import __version__

VERSION = __version__

except ImportError:

VERSION = "unknown"

from .graphql_queries import (

DISCUSSION_DETAIL_QUERY,

DISCUSSION_LIST_QUERY,

DISCUSSION_PAGE_SIZE,

DISCUSSION_REPLIES_QUERY,

)

FILE_URI_PREFIX = "file://"

logger = logging.getLogger(__name__)

class RepositoryUnavailableError(Exception):

"""Raised when a repository is unavailable due to legal reasons (e.g., DMCA takedown, TOS violation)."""

def __init__(self, message, legal_url=None):

super().__init__(message)

self.legal_url = legal_url

# Setup SSL context with fallback chain

https_ctx = ssl.create_default_context()

if https_ctx.get_ca_certs():

# Layer 1: Certificates pre-loaded from system (file-based)

pass

else:

paths = ssl.get_default_verify_paths()

if (paths.cafile and os.path.exists(paths.cafile)) or (

paths.capath and os.path.exists(paths.capath)

):

# Layer 2: Cert paths exist, will be lazy-loaded on first use (directory-based)

pass

else:

# Layer 3: Try certifi package as optional fallback

try:

import certifi

https_ctx = ssl.create_default_context(cafile=certifi.where())

except ImportError:

# All layers failed - no certificates available anywhere

sys.exit(

"\nERROR: No CA certificates found. Cannot connect to GitHub over SSL.\n\n"

"Solutions you can explore:\n"

" 1. pip install certifi\n"

" 2. Alpine: apk add ca-certificates\n"

" 3. Debian/Ubuntu: apt-get install ca-certificates\n\n"

)

def logging_subprocess(

popenargs, stdout_log_level=logging.DEBUG, stderr_log_level=logging.ERROR, **kwargs

):

"""

Variant of subprocess.call that accepts a logger instead of stdout/stderr,

and logs stdout messages via logger.debug and stderr messages via

logger.error.

"""

child = subprocess.Popen(

popenargs, stdout=subprocess.PIPE, stderr=subprocess.PIPE, **kwargs

)

if sys.platform == "win32":

logger.info(

"Windows operating system detected - no subprocess logging will be returned"

)

log_level = {child.stdout: stdout_log_level, child.stderr: stderr_log_level}

def check_io():

if sys.platform == "win32":

return

ready_to_read = select.select([child.stdout, child.stderr], [], [], 1000)[0]

for io in ready_to_read:

line = io.readline()

if not logger:

continue

if not (io == child.stderr and not line):

logger.log(log_level[io], line[:-1])

# keep checking stdout/stderr until the child exits

while child.poll() is None:

check_io()

check_io() # check again to catch anything after the process exits

rc = child.wait()

if rc != 0:

print("{} returned {}:".format(popenargs[0], rc), file=sys.stderr)

print("\t", " ".join(popenargs), file=sys.stderr)

return rc

def mkdir_p(*args):

for path in args:

os.makedirs(path, exist_ok=True)

def mask_password(url, secret="*****"):

parsed = urlparse(url)

if not parsed.password:

return url

elif parsed.password == "x-oauth-basic":

return url.replace(parsed.username, secret)

return url.replace(parsed.password, secret)

def non_negative_int(value):

"""Argparse type validator for non-negative integers."""

try:

ivalue = int(value)

except ValueError:

raise argparse.ArgumentTypeError(f"'{value}' is not a valid integer")

if ivalue < 0:

raise argparse.ArgumentTypeError(f"{value} must be 0 or greater")

return ivalue

def parse_args(args=None):

parser = argparse.ArgumentParser(description="Backup a github account")

parser.add_argument("user", metavar="USER", type=str, help="github username")

parser.add_argument(

"-t",

"--token",

dest="token_classic",

help="personal access, OAuth, or JSON Web token, or path to token (file://...)",

) # noqa

parser.add_argument(

"-f",

"--token-fine",

dest="token_fine",

help="fine-grained personal access token (github_pat_....), or path to token (file://...)",

) # noqa

parser.add_argument(

"--token-from-gh",

action="store_true",

dest="token_from_gh",

help="read token from GitHub CLI (gh auth token)",

)

parser.add_argument(

"-q",

"--quiet",

action="store_true",

dest="quiet",

help="supress log messages less severe than warning, e.g. info",

)

parser.add_argument(

"--as-app",

action="store_true",

dest="as_app",

help="authenticate as github app instead of as a user.",

)

parser.add_argument(

"-o",

"--output-directory",

default=".",

dest="output_directory",

help="directory at which to backup the repositories",

)

parser.add_argument(

"-l",

"--log-level",

default="info",

dest="log_level",

help="log level to use (default: info, possible levels: debug, info, warning, error, critical)",

)

parser.add_argument(

"-i",

"--incremental",

action="store_true",

dest="incremental",

help="incremental backup",

)

parser.add_argument(

"--incremental-by-files",

action="store_true",

dest="incremental_by_files",

help="incremental backup based on modification date of files",

)

parser.add_argument(

"--starred",

action="store_true",

dest="include_starred",

help="include JSON output of starred repositories in backup",

)

parser.add_argument(

"--all-starred",

action="store_true",

dest="all_starred",

help="include starred repositories in backup [*]",

)

parser.add_argument(

"--starred-skip-size-over",

type=int,

metavar="MB",

dest="starred_skip_size_over",

help="skip starred repositories larger than this size in MB",

)

parser.add_argument(

"--watched",

action="store_true",

dest="include_watched",

help="include JSON output of watched repositories in backup",

)

parser.add_argument(

"--followers",

action="store_true",

dest="include_followers",

help="include JSON output of followers in backup",

)

parser.add_argument(

"--following",

action="store_true",

dest="include_following",

help="include JSON output of following users in backup",

)

parser.add_argument(

"--all",

action="store_true",

dest="include_everything",

help="include everything in backup (not including [*])",

)

parser.add_argument(

"--issues",

action="store_true",

dest="include_issues",

help="include issues in backup",

)

parser.add_argument(

"--issue-comments",

action="store_true",

dest="include_issue_comments",

help="include issue comments in backup",

)

parser.add_argument(

"--issue-events",

action="store_true",

dest="include_issue_events",

help="include issue events in backup",

)

parser.add_argument(

"--pulls",

action="store_true",

dest="include_pulls",

help="include pull requests in backup",

)

parser.add_argument(

"--pull-comments",

action="store_true",

dest="include_pull_comments",

help="include pull request review comments in backup",

)

parser.add_argument(

"--pull-reviews",

action="store_true",

dest="include_pull_reviews",

help="include pull request reviews in backup",

)

parser.add_argument(

"--pull-commits",

action="store_true",

dest="include_pull_commits",

help="include pull request commits in backup",

)

parser.add_argument(

"--pull-details",

action="store_true",

dest="include_pull_details",

help="include more pull request details in backup [*]",

)

parser.add_argument(

"--labels",

action="store_true",

dest="include_labels",

help="include labels in backup",

)

parser.add_argument(

"--hooks",

action="store_true",

dest="include_hooks",

help="include hooks in backup (works only when authenticated)",

) # noqa

parser.add_argument(

"--milestones",

action="store_true",

dest="include_milestones",

help="include milestones in backup",

)

parser.add_argument(

"--security-advisories",

action="store_true",

dest="include_security_advisories",

help="include security advisories in backup",

)

parser.add_argument(

"--discussions",

action="store_true",

dest="include_discussions",

help="include discussions in backup",

)

parser.add_argument(

"--repositories",

action="store_true",

dest="include_repository",

help="include repository clone in backup",

)

parser.add_argument(

"--bare", action="store_true", dest="bare_clone", help="clone bare repositories"

)

parser.add_argument(

"--no-prune",

action="store_true",

dest="no_prune",

help="disable prune option for git fetch",

)

parser.add_argument(

"--lfs",

action="store_true",

dest="lfs_clone",

help="clone LFS repositories (requires Git LFS to be installed, https://git-lfs.github.com) [*]",

)

parser.add_argument(

"--wikis",

action="store_true",

dest="include_wiki",

help="include wiki clone in backup",

)

parser.add_argument(

"--gists",

action="store_true",

dest="include_gists",

help="include gists in backup [*]",

)

parser.add_argument(

"--starred-gists",

action="store_true",

dest="include_starred_gists",

help="include starred gists in backup [*]",

)

parser.add_argument(

"--skip-archived",

action="store_true",

dest="skip_archived",

help="skip project if it is archived",

)

parser.add_argument(

"--skip-existing",

action="store_true",

dest="skip_existing",

help="skip project if a backup directory exists",

)

parser.add_argument(

"-L",

"--languages",

dest="languages",

help="only allow these languages",

nargs="*",

)

parser.add_argument(

"-N",

"--name-regex",

dest="name_regex",

help="python regex to match names against",

)

parser.add_argument(

"-H", "--github-host", dest="github_host", help="GitHub Enterprise hostname"

)

parser.add_argument(

"-O",

"--organization",

action="store_true",

dest="organization",

help="whether or not this is an organization user",

)

parser.add_argument(

"-R",

"--repository",

dest="repository",

help="name of repository to limit backup to",

)

parser.add_argument(

"-P",

"--private",

action="store_true",

dest="private",

help="include private repositories [*]",

)

parser.add_argument(

"-F",

"--fork",

action="store_true",

dest="fork",

help="include forked repositories [*]",

)

parser.add_argument(

"--prefer-ssh",

action="store_true",

help="Clone repositories using SSH instead of HTTPS",

)

parser.add_argument(

"-v", "--version", action="version", version="%(prog)s " + VERSION

)

parser.add_argument(

"--keychain-name",

dest="osx_keychain_item_name",

help="OSX ONLY: name field of password item in OSX keychain that holds the personal access or OAuth token",

)

parser.add_argument(

"--keychain-account",

dest="osx_keychain_item_account",

help="OSX ONLY: account field of password item in OSX keychain that holds the personal access or OAuth token",

)

parser.add_argument(

"--releases",

action="store_true",

dest="include_releases",

help="include release information, not including assets or binaries",

)

parser.add_argument(

"--latest-releases",

type=int,

default=0,

dest="number_of_latest_releases",

help="include certain number of the latest releases; only applies if including releases",

)

parser.add_argument(

"--skip-prerelease",

action="store_true",

dest="skip_prerelease",

help="skip prerelease and draft versions; only applies if including releases",

)

parser.add_argument(

"--assets",

action="store_true",

dest="include_assets",

help="include assets alongside release information; only applies if including releases",

)

parser.add_argument(

"--skip-assets-on",

dest="skip_assets_on",

nargs="*",

help="skip asset downloads for these repositories",

)

parser.add_argument(

"--attachments",

action="store_true",

dest="include_attachments",

help="download user-attachments from issues, pull requests, and discussions [*]",

)

parser.add_argument(

"--throttle-limit",

dest="throttle_limit",

type=int,

default=0,

help="start throttling of GitHub API requests after this amount of API requests remain",

)

parser.add_argument(

"--throttle-pause",

dest="throttle_pause",

type=float,

default=30.0,

help="wait this amount of seconds when API request throttling is active (default: 30.0, requires --throttle-limit to be set)",

)

parser.add_argument(

"--exclude", dest="exclude", help="names of repositories to exclude", nargs="*"

)

parser.add_argument(

"--retries",

dest="max_retries",

type=non_negative_int,

default=5,

help="maximum number of retries for API calls (default: 5)",

)

return parser.parse_args(args)

def get_auth(args, encode=True, for_git_cli=False):

auth = None

if args.osx_keychain_item_name:

if not args.osx_keychain_item_account:

raise Exception(

"You must specify both name and account fields for osx keychain password items"

)

else:

if platform.system() != "Darwin":

raise Exception("Keychain arguments are only supported on Mac OSX")

try:

token = subprocess.check_output(

[

"security",

"find-generic-password",

"-s",

args.osx_keychain_item_name,

"-a",

args.osx_keychain_item_account,

"-w",

],

stderr=subprocess.DEVNULL,

).strip()

token = token.decode("utf-8")

auth = token + ":" + "x-oauth-basic"

except subprocess.SubprocessError:

raise Exception(

"No password item matching the provided name and account could be found in the osx keychain."

)

elif args.osx_keychain_item_account:

raise Exception(

"You must specify both name and account fields for osx keychain password items"

)

elif args.token_fine:

if args.token_fine.startswith(FILE_URI_PREFIX):

args.token_fine = read_first_line(args.token_fine)

if args.token_fine.startswith("github_pat_"):

auth = args.token_fine

else:

raise Exception(

"Fine-grained token supplied does not look like a GitHub PAT"

)

elif args.token_classic or args.token_from_gh:

if args.token_from_gh:

if args.as_app:

raise Exception(

"--token-from-gh cannot be used with --as-app; provide the app token with --token instead"

)

args.token_classic = read_token_from_gh_cli(args)

elif args.token_classic.startswith(FILE_URI_PREFIX):

args.token_classic = read_first_line(args.token_classic)

if not args.as_app:

auth = args.token_classic + ":" + "x-oauth-basic"

else:

if not for_git_cli:

auth = args.token_classic

else:

auth = "x-access-token:" + args.token_classic

if not auth:

return None

if not encode or args.token_fine is not None:

return auth

return base64.b64encode(auth.encode("ascii"))

def get_github_api_host(args):

if args.github_host:

host = args.github_host + "/api/v3"

else:

host = "api.github.com"

return host

def get_github_graphql_url(args):

if args.github_host:

return "https://{0}/api/graphql".format(args.github_host)

return "https://api.github.com/graphql"

def get_graphql_auth(args):

auth = get_auth(args, encode=False)

if not auth:

return None

# GraphQL expects a bearer token. Classic tokens and keychain tokens use

# "token:x-oauth-basic" for REST Basic auth, so strip the synthetic

# password before sending the GraphQL Authorization header.

if (

not getattr(args, "as_app", False)

and getattr(args, "token_fine", None) is None

and ":" in auth

):

auth = auth.split(":", 1)[0]

return auth

def get_github_host(args):

if args.github_host:

host = args.github_host

else:

host = "github.com"

return host

def read_first_line(file_uri):

with open(file_uri[len(FILE_URI_PREFIX) :], "rt") as f:

return f.readline().strip()

def read_token_from_gh_cli(args):

cached_token = getattr(args, "_token_from_gh_value", None)

if cached_token:

return cached_token

command = ["gh", "auth", "token"]

if args.github_host:

command.extend(["--hostname", get_github_host(args)])

try:

token = subprocess.check_output(command, stderr=subprocess.PIPE).decode(

"utf-8"

).strip()

except FileNotFoundError:

raise Exception(

"Unable to read token from GitHub CLI: 'gh' executable not found"

)

except subprocess.CalledProcessError as e:

stderr = e.stderr.decode("utf-8", errors="replace").strip()

if stderr:

raise Exception(

"Unable to read token from GitHub CLI: {0}".format(stderr)

)

raise Exception("Unable to read token from GitHub CLI")

if not token:

raise Exception("Unable to read token from GitHub CLI: token was empty")

args._token_from_gh_value = token

return token

def get_github_repo_url(args, repository):

if repository.get("is_gist"):

if args.prefer_ssh:

# The git_pull_url value is always https for gists, so we need to transform it to ssh form

repo_url = re.sub(

r"^https?:\/\/(.+)\/(.+)\.git$",

r"git@\1:\2.git",

repository["git_pull_url"],

)

repo_url = re.sub(

r"^git@gist\.", "git@", repo_url

) # strip gist subdomain for better hostkey compatibility

else:

repo_url = repository["git_pull_url"]

return repo_url

if args.prefer_ssh:

return repository["ssh_url"]

auth = get_auth(args, encode=False, for_git_cli=True)

if auth:

repo_url = "https://{0}@{1}/{2}/{3}.git".format(

auth if args.token_fine is None else "oauth2:" + auth,

get_github_host(args),

repository["owner"]["login"],

repository["name"],

)

else:

repo_url = repository["clone_url"]

return repo_url

def calculate_retry_delay(attempt, headers):

"""Calculate delay before next retry with exponential backoff."""

# Respect retry-after header if present

if retry_after := headers.get("retry-after"):

return int(retry_after)

# Respect rate limit reset time

if int(headers.get("x-ratelimit-remaining", 1)) < 1:

reset_time = int(headers.get("x-ratelimit-reset", 0))

return max(10, reset_time - calendar.timegm(time.gmtime()))

# Exponential backoff with jitter for server errors (1s base, 120s max)

delay = min(1.0 * (2**attempt), 120.0)

return delay + random.uniform(0, delay * 0.1)

def retrieve_data(args, template, query_args=None, paginated=True, lazy=False):

"""

Fetch the data from GitHub API.

Handle both single requests and pagination. Returns a list by default, or

a generator when lazy=True so callers can stop before fetching every page.

Handles throttling, retries, read errors, and DMCA takedowns.

"""

query_args = query_args or {}

auth = get_auth(args, encode=not args.as_app)

per_page = 100

def _extract_next_page_url(link_header):

for link in link_header.split(","):

if 'rel="next"' in link:

return link[link.find("<") + 1 : link.find(">")]

return None

def fetch_all() -> Generator[dict, None, None]:

def _extract_legal_url(response_body_bytes):

"""Extract DMCA/legal notice URL from GitHub API error response body."""

try:

data = json.loads(response_body_bytes.decode("utf-8"))

return data.get("block", {}).get("html_url")

except Exception:

return None

next_url = None

while True:

# FIRST: Fetch response

for attempt in range(args.max_retries + 1):

request = _construct_request(

per_page=per_page if paginated else None,

query_args=query_args,

template=next_url or template,

auth=auth,

as_app=args.as_app,

fine=args.token_fine is not None,

)

try:

http_response = make_request_with_retry(

request, auth, args.max_retries

)

except HTTPError as exc:

if exc.code == 451:

legal_url = _extract_legal_url(exc.read())

raise RepositoryUnavailableError(

f"Repository unavailable due to legal reasons (HTTP {exc.code})",

legal_url=legal_url,

)

elif exc.code == 403:

# Rate-limit 403s (x-ratelimit-remaining=0) are retried

# by make_request_with_retry — re-raise if exhausted.

if int(exc.headers.get("x-ratelimit-remaining", 1)) < 1:

raise

# Only convert to RepositoryUnavailableError if GitHub

# indicates a TOS/DMCA block (response contains "block"

# key). Other 403s (permissions, scopes) should propagate.

body = exc.read()

try:

data = json.loads(body.decode("utf-8"))

except Exception:

data = {}

if "block" in data:

raise RepositoryUnavailableError(

"Repository access blocked (HTTP 403)",

legal_url=data.get("block", {}).get("html_url"),

)

raise

else:

raise

# urlopen raises HTTPError for non-2xx, so only success gets here.

# Guard against unexpected status codes from proxies, future Python

# changes, or other edge cases we haven't considered.

status = http_response.getcode()

if status != 200:

raise Exception(

f"Unexpected HTTP {status} from {next_url or template} "

f"(expected non-2xx to raise HTTPError)"

)

# Parse JSON response

try:

response = json.loads(http_response.read().decode("utf-8"))

break # Exit retry loop and handle the data returned

except (

ConnectionError,

IncompleteRead,

json.decoder.JSONDecodeError,

TimeoutError,

) as e:

logger.warning(f"{type(e).__name__} reading response")

if attempt < args.max_retries:

delay = calculate_retry_delay(attempt, {})

logger.warning(

f"Retrying read in {delay:.1f}s (attempt {attempt + 1}/{args.max_retries + 1})"

)

time.sleep(delay)

continue # Next retry attempt

else:

logger.error(

f"Failed to read response after {args.max_retries + 1} attempts for {next_url or template}"

)

raise Exception(

f"Failed to read response after {args.max_retries + 1} attempts for {next_url or template}"

)

# SECOND: Process and paginate

# Pause before next request if rate limit is low

if (

remaining := int(http_response.headers.get("x-ratelimit-remaining", 0))

) <= (args.throttle_limit or 0):

if args.throttle_limit:

logger.info(

f"Throttling: {remaining} requests left, pausing {args.throttle_pause}s"

)

time.sleep(args.throttle_pause)

# Yield results

if isinstance(response, list):

yield from response

elif isinstance(response, dict):

yield response

# Check for more pages

if not paginated or not (

next_url := _extract_next_page_url(

http_response.headers.get("Link", "")

)

):

break # No more data

if lazy:

return fetch_all()

return list(fetch_all())

def retrieve_graphql_data(args, query, variables=None, log_context=None):

"""Fetch data from GitHub's GraphQL API."""

auth = get_graphql_auth(args)

if not auth:

raise Exception("GitHub GraphQL API requires authentication")

variables = variables or {}

payload = json.dumps(

{"query": query, "variables": variables}, ensure_ascii=False

).encode("utf-8")

endpoint = get_github_graphql_url(args)

for attempt in range(args.max_retries + 1):

request = Request(endpoint, data=payload, method="POST")

request.add_header("Accept", "application/json")

request.add_header("Content-Type", "application/json")

request.add_header("Authorization", "bearer " + auth)

log_url = endpoint

if log_context:

log_url = "{0} ({1})".format(log_url, log_context)

logger.info("Requesting {0}".format(log_url))

http_response = make_request_with_retry(request, auth, args.max_retries)

status = http_response.getcode()

if status != 200:

raise Exception(

f"Unexpected HTTP {status} from {endpoint} "

f"(expected non-2xx to raise HTTPError)"

)

try:

response = json.loads(http_response.read().decode("utf-8"))

except (IncompleteRead, json.decoder.JSONDecodeError, TimeoutError) as e:

logger.warning(f"{type(e).__name__} reading GraphQL response")

if attempt < args.max_retries:

delay = calculate_retry_delay(attempt, {})

logger.warning(

f"Retrying GraphQL read in {delay:.1f}s "

f"(attempt {attempt + 1}/{args.max_retries + 1})"

)

time.sleep(delay)

continue

raise Exception(

f"Failed to read GraphQL response after {args.max_retries + 1} "

f"attempts for {endpoint}"

)

if (

remaining := int(http_response.headers.get("x-ratelimit-remaining", 0))

) <= (args.throttle_limit or 0):

if args.throttle_limit:

logger.info(

f"Throttling: {remaining} requests left, pausing {args.throttle_pause}s"

)

time.sleep(args.throttle_pause)

errors = response.get("errors") or []

if errors:

if any(error.get("type") == "RATE_LIMITED" for error in errors):

if attempt < args.max_retries:

delay = calculate_retry_delay(attempt, http_response.headers)

logger.warning(

f"GraphQL rate limit hit, retrying in {delay:.1f}s "

f"(attempt {attempt + 1}/{args.max_retries + 1})"

)

time.sleep(delay)

continue

messages = "; ".join(

error.get("message", str(error)) for error in errors

)

raise Exception("GraphQL Error: {0}".format(messages))

return response.get("data", {})

raise Exception(

f"GraphQL request failed after {args.max_retries + 1} attempts"

) # pragma: no cover

def make_request_with_retry(request, auth, max_retries=5):

"""Make HTTP request with automatic retry for transient errors."""

def is_retryable_status(status_code, headers):

# Server errors are always retryable

if status_code in (500, 502, 503, 504):

return True

# Rate limit (403/429) is retryable if limit exhausted

if status_code in (403, 429):

return int(headers.get("x-ratelimit-remaining", 1)) < 1

return False

for attempt in range(max_retries + 1):

try:

return urlopen(request, context=https_ctx)

except HTTPError as exc:

# HTTPError can be used as a response-like object

if not is_retryable_status(exc.code, exc.headers):

logger.error(

f"API Error: {exc.code} {exc.reason} for {request.full_url}"

)

raise # Non-retryable error

if attempt >= max_retries:

logger.error(

f"HTTP {exc.code} failed after {max_retries + 1} attempts for {request.full_url}"

)

raise

delay = calculate_retry_delay(attempt, exc.headers)

logger.warning(

f"HTTP {exc.code} ({exc.reason}), retrying in {delay:.1f}s "

f"(attempt {attempt + 1}/{max_retries + 1}) for {request.full_url}"

)

if auth is None and exc.code in (403, 429):

logger.info("Hint: Authenticate to raise your GitHub rate limit")

time.sleep(delay)

except (URLError, socket.error) as e:

if attempt >= max_retries:

logger.error(

f"Connection error failed after {max_retries + 1} attempts: {e} for {request.full_url}"

)

raise

delay = calculate_retry_delay(attempt, {})

logger.warning(

f"Connection error: {e}, retrying in {delay:.1f}s "

f"(attempt {attempt + 1}/{max_retries + 1}) for {request.full_url}"

)

time.sleep(delay)

raise Exception(

f"Request failed after {max_retries + 1} attempts"

) # pragma: no cover

def _construct_request(per_page, query_args, template, auth, as_app=None, fine=False):

# If template is already a full URL with query params (from Link header), use it directly

if "?" in template and template.startswith("http"):

request_url = template

# Extract query string for logging

querystring = template.split("?", 1)[1]

else:

# Build URL with query parameters

all_query_args = {}