Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.
| Git storage hardened, pages in tens of milliseconds, honest security alerts, and costs reconciled daily | 1 | import { type Abilities, type Capability, type RepoRole, needs } from "@g1t/contracts"; |
| 2 | ||
| 3 | /** | |
| 4 | * What the viewer may do in the repository being looked at, as the | |
| 5 | * repository's layout loads it for its pages and the sidebar. | |
| 6 | */ | |
| 7 | export type ViewerAccess = { | |
| 8 | /** Their effective role; null when they cannot see it. */ | |
| 9 | role: RepoRole | null; | |
| 10 | /** Whether they have a role of their own, not only because it is public. */ | |
| 11 | insider: boolean; | |
| 12 | can: Abilities; | |
| 13 | }; | |
| 14 | ||
| 15 | /** The title of something the viewer cannot use, saying which role it needs; undefined when they can. */ | |
| 16 | export function whyNot(can: Abilities | null | undefined, capability: Capability): string | undefined { | |
| 17 | return can?.[capability] ? undefined : needs(capability); | |
| 18 | } | |
| 19 | ||
| 20 | /** Whether the viewer sees the repository's settings: Maintain and up. */ | |
| 21 | export function seesSettings(access: Pick<ViewerAccess, "can" | "insider"> | null | undefined): boolean { | |
| 22 | return Boolean(access?.insider && (access.can.manage_settings || access.can.manage_protection)); | |
| 23 | } | |
| 24 | ||
| 25 | /** Each settings page and the capability that opens it. */ | |
| 26 | export const SETTINGS_CAPABILITY: Record<string, Capability> = { | |
| 27 | "": "manage_settings", | |
| 28 | repository: "manage_settings", | |
| 29 | agents: "manage_settings", | |
| Merge main (membership, two-factor, GitHub repo roles) into tokens | 30 | branches: "manage_settings", |
| Merge rulesets: branch and tag rules, agent-first, enforced on push and merge | 31 | rules: "manage_protection", |
| Git storage hardened, pages in tens of milliseconds, honest security alerts, and costs reconciled daily | 32 | guardrails: "manage_protection", |
| 33 | webhooks: "manage_integrations", | |
| 34 | secrets: "manage_integrations", | |
| Merge branch 'worktree-agent-a3abfcce648e87dca' | 35 | actions: "manage_integrations", |
| 36 | environments: "manage_integrations", | |
| Git storage hardened, pages in tens of milliseconds, honest security alerts, and costs reconciled daily | 37 | runners: "manage_integrations", |
| 38 | deployments: "manage_integrations", | |
| 39 | domains: "manage_integrations", | |
| Merge branch 'mirroring' into artifacts-mode | 40 | // Taking over, handing back and adding remotes: Admins. |
| 41 | mirroring: "manage_integrations", | |
| Git storage hardened, pages in tens of milliseconds, honest security alerts, and costs reconciled daily | 42 | // Write and up can see who has access; Admins change it. |
| 43 | access: "push", | |
| Merge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca | 44 | // Deploy keys decide who reaches a repository too: Admins only. |
| 45 | keys: "manage_access", | |
| Git storage hardened, pages in tens of milliseconds, honest security alerts, and costs reconciled daily | 46 | }; |
This file's history is long; its oldest lines are credited to the oldest commit read.