gitfor/platform

import { createServerFn } from "@tanstack/react-start";
import { assertBelowCap, CAPS, limitWrite } from "~/server/limits";
import { z } from "zod";
import { requireViewer, viewerMiddleware } from "./middleware";
import { all, first, run } from "~/server/db";
import { randomId } from "~/server/crypto";
import { encryptRepoSecret } from "~/server/secrets";
import { requireRepoAccess } from "~/server/repos";
import { deliverWebhook, isForgeWebhookUrl } from "~/server/events/consumer";
import { WEBHOOK_EVENTS } from "~/lib/webhook-events";
import type { WebhookEvent } from "~/lib/webhook-events";
import { listRepoRunners, mintRegistrationToken, removeRepoRunner, repoScope } from "~/server/ci/runner-registration";
import { forkRunsAllowed, setForkRunsAllowed } from "~/server/ci/runner-policy";
import { notFoundError } from "~/server/errors";
import { repoRef, secretName } from "~/lib/validation";
import { deleteProtectionRule, listProtectionRules, saveProtectionRule } from "~/server/protection-write";

export const listProtections = createServerFn({ method: "GET" })
  .middleware([viewerMiddleware])
  .validator(repoRef)
  .handler(async ({ data, context }) => {
    const { repo } = await requireRepoAccess(data.owner, data.repo, context.viewer, "admin");
    return listProtectionRules(repo.id);
  });

export const saveProtection = createServerFn({ method: "POST" })
  .middleware([viewerMiddleware])
  .validator(
    repoRef.extend({
      id: z.string().nullable(),
      pattern: z.string().trim().min(1).max(200),
      requirePullRequest: z.boolean(),
      requiredApprovals: z.number().int().min(0).max(10),
      requiredChecks: z.array(z.string().min(1)).max(50),
      dismissStaleReviews: z.boolean(),
      allowDeletions: z.boolean(),
      allowForcePushes: z.boolean().default(false),
      enforceAdmins: z.boolean(),
    }),
  )