pippinmole/ghost

public

Source code of Ghost - On Ghost

Let organizations restrict OAuth apps024853a10 hours ago140 lines · 5.0 KB

1	import { sql } from "drizzle-orm";
2	import {
3	boolean,
4	index,
5	integer,
6	pgEnum,
7	pgTable,
8	primaryKey,
9	text,
10	timestamp,
11	uniqueIndex,
12	} from "drizzle-orm/pg-core";
13
14	import { organization, team
15	import { repositoryRole }
16	import { oauthClient }
17	import { repository }
18
19	/** What Ghost knows about an organization beyond Better Auth's row: its policies and its public profile. One row per organization, written when it is created. */
20	export const organizationSettings =
21	organizationId: text()
22	.primaryKey()
23	.references(() =>
24	// Every member's floor on every repository. Null is no access beyond teams and collaborations.
25	basePermission: repositoryRole().default
26	membersCanCreatePublicRepositories: boolean().notNull
27	membersCanCreatePrivateRepositories: boolean().notNull
28	allowPrivateForks: boolean().notNull
29	// GitHub's "OAuth app access restrictions": keys minted for an OAuth app reach the organization's repositories only once an admin approves the app.
30	oauthAppRestrictions: boolean().notNull
31	// Recorded on each new repository, and followed once a branch by that name is pushed.
32	defaultBranch: text(),
33	description: text(),
34	website: text(),
35	location: text(),
36	email: text(),
37	updatedAt: timestamp({
38	.notNull()
39	.defaultNow()
40	.$onUpdateFn(() =>
41	});
42
43	/** Members who chose to show their membership. Membership is private otherwise. */
44	export const organizationPublicMember =
45	"organization_public_member",
46	{
47	organizationId: text()
48	.references(() =>
49	.notNull(),
50	userId: text()
51	.references(() =>
52	.notNull(),
53	},
54	(t) =>
55	);
56
57	export const organizationPinnedRepository =
58	"organization_pinned_repository",
59	{
60	organizationId: text()
61	.references(() =>
62	.notNull(),
63	repositoryId: text()
64	.references(() =>
65	.notNull(),
66	position: integer().notNull
67	},
68	(t) =>
69	);
70
71	/** Members who may manage one team's membership without administering the organization. */
72	export const teamMaintainer =
73	"team_maintainer",
74	{
75	teamId: text()
76	.references(() =>
77	.notNull(),
78	userId: text()
79	.references(() =>
80	.notNull(),
81	},
82	(t) =>
83	);
84
85	/** Where a repository used to be, so links and git remotes survive a rename or a transfer. A repository created at the old name takes precedence. */
86	export const repositoryRedirect =
87	"repository_redirect",
88	{
89	ownerName: text().notNull
90	slug: text().notNull
91	repositoryId: text()
92	.references(() =>
93	.notNull(),
94	createdAt: timestamp({
95	},
96	(t) =>
97	uniqueIndex("repository_redirect_name_idx").
98	sql`lower(${t.
99	t.slug,
100	),
101	index("repository_redirect_repository_idx").
102	],
103	);
104
105	/** A transfer waiting for its recipient: a user accepts for themselves, an organization's admins for it. Exactly one of the two targets is set. */
106	export const repositoryTransfer =
107	repositoryId: text()
108	.primaryKey()
109	.references(() =>
110	toUserId: text().references
111	toOrganizationId: text().references
112	onDelete: "cascade",
113	}),
114	requestedById: text().references
115	createdAt: timestamp({
116	});
117
118	export const organizationOauthAppState =
119	"organization_oauth_app_state",
120	["requested", "approved"
121	);
122
123	/** An organization's answer about one OAuth app, which matters only while the organization restricts OAuth apps. No row means nobody asked yet. */
124	export const organizationOauthApp =
125	"organization_oauth_app",
126	{
127	organizationId: text()
128	.notNull()
129	.references(() =>
130	clientId: text()
131	.notNull()
132	.references(() =>
133	state: organizationOauthAppState().notNull
134	requestedById: text().references
135	decidedById: text().references
136	requestedAt: timestamp({
137	decidedAt: timestamp({
138	},
139	(t) =>
140	);