gitfor/platform

import { credentialAllows } from "../token-scope";
import type { RequestCredential, TokenArea } from "../token-scope";
import type { RepoRow } from "~/lib/types";

/** Which token area guards each event type: an event never reveals more than its area's read tools would. */
const EVENT_AREAS: Record<string, TokenArea> = {
  push: "contents",
  create: "contents",
  delete: "contents",
  release: "contents",
  claims: "contents",
  issues: "issues",
  issue_comment: "issues",
  pull_request: "pulls",
  pull_request_review: "pulls",
  pull_request_review_comment: "pulls",
  workflow_run: "actions",
};

export async function readableEventTypes(repo: RepoRow, credential: RequestCredential): Promise<Set<string>> {
  const allowed = new Map<TokenArea, boolean>();
  const readable = new Set<string>();
  for (const [type, area] of Object.entries(EVENT_AREAS)) {
    if (!allowed.has(area)) allowed.set(area, await credentialAllows(repo, credential, area, "read"));
    if (allowed.get(area)) readable.add(type);
  }
  return readable;
}