gitfor/platform

import { createServerFn } from "@tanstack/react-start";
import { webhookEventOf } from "~/lib/webhook-events";
import { findWebhookDelivery, listWebhookDeliveries } from "~/server/webhook-log";
import { assertBelowCap, CAPS, limitWrite } from "~/server/limits";
import { z } from "zod";
import { requireViewer, viewerMiddleware } from "./middleware";
import { repoDb } from "~/server/scoped-db";
import { forgetLocator, registerLocator } from "~/server/scoped-db/locators";
import { scopedId } from "~/server/scoped-db/ids";
import { randomId } from "~/server/crypto";
import { encryptRepoSecret } from "~/server/secrets";
import { assertNotArchived, canAdministerAccount, requireRepoAccess } from "~/server/repos";
import { env } from "cloudflare:workers";
import { isForgeWebhookUrl } from "~/server/events/consumer";
import {
  assertWebhookTarget,
  deliverWebhook,
  MAX_WEBHOOK_SECRET,
  MIN_WEBHOOK_SECRET,
  replayableBody,
  sealWebhookSecret,
} from "~/server/webhooks/legacy";
import { WEBHOOK_EVENTS } from "~/lib/webhook-events";
import type { WebhookEvent } from "~/lib/webhook-events";
import { listRepoRunners, mintRegistrationToken, removeRepoRunner, repoScope } from "~/server/ci/runner-registration";
import { forkRunsAllowed, setForkRunsAllowed } from "~/server/ci/runner-policy";
import { notFoundError } from "~/server/errors";
import { repoRef, secretName } from "~/lib/validation";
import { deleteProtectionRule, listProtectionRules, saveProtectionRule } from "~/server/protection-write";

export const listProtections = createServerFn({ method: "GET" })
  .middleware([viewerMiddleware])
  .validator(repoRef)
  .handler(async ({ data, context }) => {
    const { repo } = await requireRepoAccess(data.owner, data.repo, context.viewer, "admin");
    return listProtectionRules(repo.id);
  });

export const saveProtection = createServerFn({ method: "POST" })
  .middleware([viewerMiddleware])