| 1 | /** The GitHub OAuth scopes Ghost recognizes. gh checks `repo` and `read:org` on login; the rest are granted so tools that ask for them keep working. */ |
| 2 | export const KNOWN_SCOPES = |
| 3 | 'repo', |
| 4 | 'public_repo', |
| 5 | 'read:org', |
| 6 | 'write:org', |
| 7 | 'admin:org', |
| 8 | 'user', |
| 9 | 'read:user', |
| 10 | 'user:email', |
| 11 | 'admin:public_key', |
| 12 | 'write:public_key', |
| 13 | 'read:public_key', |
| 14 | 'delete_repo', |
| 15 | 'gist', |
| 16 | ] as const; |
| 17 | |
| 18 | export type Scope |
| 19 | |
| 20 | /** Stands for "no scope" in the oauth-provider plugin, which reads an empty request as every scope where GitHub reads it as public access only. `grantableScopes` drops it. */ |
| 21 | export const NO_SCOPE = |
| 22 | |
| 23 | /** What each scope also grants, as on GitHub. */ |
| 24 | const IMPLIES: Partial |
| 25 | repo: ['public_repo'], |
| 26 | 'admin:org': ['write:org' |
| 27 | 'write:org': ['read:org' |
| 28 | 'admin:public_key': ['write:public_key' |
| 29 | 'write:public_key': ['read:public_key' |
| 30 | user: ['read:user', |
| 31 | }; |
| 32 | |
| 33 | export function hasScope(granted |
| 34 | return granted.some |
| 35 | } |
| 36 | |
| 37 | /** The known scopes in a space-separated OAuth `scope` request, in order; unknown ones are dropped, so gh asking for one Ghost lacks still logs in. */ |
| 38 | export function grantableScopes(requested |
| 39 | return requested.split |
| 40 | } |
| 41 | |
| 42 | /** A key's granted scopes. Keys made in Ghost carry none and hold every scope, as Ghost keys always have. */ |
| 43 | export function scopesOfKey(permissions |
| 44 | return permissions?.scopes |
| 45 | } |