Function isDeploymentEligibleForGithubDefaultProvider

cli/server.go:2066–2091

(ctx context.Context, db database.Store)

}

func isDeploymentEligibleForGithubDefaultProvider(ctx context.Context, db database.Store) (bool, error) {
	// We want to enable the default provider only for new deployments, and avoid
	// enabling it if a deployment was upgraded from an older version.
	// nolint:gocritic // Requires system privileges
	defaultEligible, err := db.GetOAuth2GithubDefaultEligible(dbauthz.AsSystemRestricted(ctx))
	if err != nil && !errors.Is(err, sql.ErrNoRows) {
		return false, xerrors.Errorf("get github default eligible: %w", err)
	}
	defaultEligibleNotSet := errors.Is(err, sql.ErrNoRows)

	if defaultEligibleNotSet {
		// nolint:gocritic // User count requires system privileges
		userCount, err := db.GetUserCount(dbauthz.AsSystemRestricted(ctx), false)
		if err != nil {
			return false, xerrors.Errorf("get user count: %w", err)
		}
		// We check if a deployment is new by checking if it has any users.
		defaultEligible = userCount == 0
		// nolint:gocritic // Requires system privileges
		if err := db.UpsertOAuth2GithubDefaultEligible(dbauthz.AsSystemRestricted(ctx), defaultEligible); err != nil {
			return false, xerrors.Errorf("upsert github default eligible: %w", err)
		}
	}

	return defaultEligible, nil
}

func maybeAppendDefaultGithubExternalAuthProvider(
	ctx context.Context,