feat(github): installation tokens administer their account; repository permissions follow GitHub's model - #230
Closed
0xChathurinda wants to merge 1 commit into
Conversation
…y permissions follow GitHub's model A GitHub App installation token could read through the emulator but not administer anything: POST /orgs/:org/repos, the collaborator routes and PUT /orgs/:org/memberships all resolved the caller as a user and refused it, so an App that provisions repositories for an organization could not run against the emulator at all. Installations now act for the account they are installed on through their permission set, as on GitHub: administration: write creates repositories and manages collaborators, members: write manages organization membership. Repository permissions also follow GitHub's model instead of treating every organization member as an admin: owners hold admin, members start from the org's default_repository_permission (which may be none), collaborator and team grants raise it, and GET /repos/:owner/:repo/collaborators/:username/ permission answers for any user, with the legacy permission scale and the precise role_name, returning none rather than 404 for a user without access. The seed gains orgs[].default_repository_permission, orgs[].members and repos[].collaborators so those situations can be set up without an admin token.
Contributor
|
@0xChathurinda is attempting to deploy a commit to the Vercel Labs Team on Vercel. A member of the Team first needs to authorize it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two related fidelity fixes for the GitHub emulator, found while pointing a real GitHub App based provisioning service at it.
Installation tokens can administer the account they are installed on.
POST /orgs/:org/repos,PUT/DELETE /repos/:owner/:repo/collaborators/:usernameandPUT /orgs/:org/memberships/:usernameresolved the caller as a user (the installation token's login is the account login, which has no user row) and refused every installation. GitHub Apps manage an account through their permission set, not membership, so now:administration: writeon the installation lets it create repositories in the account and manage collaborators on repositories it can accessmembers: writelets it manage organization membershipRepository permissions follow GitHub's model. Every organization member was treated as a repository admin (
isOrgMembershort-circuitedhasRepoAdminandcanAccessRepo). Now, via onerepoRoleForresolver:default_repository_permission, which may benoneGET /repos/:owner/:repo/collaborators/:username/permissionanswers for any existing user with the legacypermissionscale (admin/write/read/none) and the preciserole_name(maintain,triage, ...), returningnonerather than 404 when the user has no access. 404 stays for an unknown user.The seed gains
orgs[].default_repository_permission,orgs[].members(withrole: adminfor owners) andrepos[].collaborators, so these situations can be set up without an admin token at start.Testing
src/__tests__/installation-admin.test.tscovers installation create/collaborator/membership paths with and without the permission, the permission endpoint across owner, member, collaborator, stranger and unknown user, base-permission visibility, owner-vs-member collaborator management, and the new seed keys. The existing 91 tests pass unchanged. Docs: package README seed example and Auth section, root README seed example.