Function getRepoPermissionFilterForUser

packages/web/src/prisma.ts:110–182

(user?: UserWithAccounts)

 * Returns a filter for repositories that the user has access to.
 */
export const getRepoPermissionFilterForUser = (user?: UserWithAccounts): Prisma.RepoWhereInput => {
    // Collect the issuer URLs from the user's linked accounts.
    // Used to grant access to public repos on connections with enforcePermissionsForPublicRepos: true.
    const linkedAccountIssuerUrls = (user?.accounts ?? [])
        .map(account => account.issuerUrl)
        .filter((url): url is string => url !== null && url !== undefined);

    // One of the following conditions must be met in order
    // for the user to be able to have access to the repo:
    return {
        OR: [
            // 1. The repo is explicitly permitted to the user
            // via the permittedAccounts relation.
            ...((user && user.accounts.length > 0) ? [
                {
                    permittedAccounts: {
                        some: {
                            accountId: {
                                in: user.accounts.map(account => account.id),
                            }
                        }
                    }
                },
            ] : []),
            // 2. The `enforcePermissions` flag is *not* set to `true` on any
            // of the repo's connections.
            {
                AND: [
                    { connections: { some: {} } }, // guard against vacuous truthiness
                    {
                        NOT: {
                            connections: {
                                some: {
                                    connection: {
                                        enforcePermissions: true,
                                    }
                                }
                            }
                        }
                    }
                ]
            },
            // 3. The repo is public and either:
            //   - a. The `enforcePermissionsForPublicRepos` flag is *not* set to `true`
            //     on any of the repo's connections.
            //   - b. The user has a account linked to the same code host as the repo.
            {
                AND: [
                    { isPublic: true },
                    { connections: { some: {} } }, // guard against vacuous truthiness
                    {
                        OR: [
                            {
                                NOT: {
                                    connections: {
                                        some: {
                                            connection: { enforcePermissionsForPublicRepos: true }
                                        }