Check with repo-permission before accessing secrets and variables (#175)

languageserver/src/context-providers/secrets.ts

@@ -5,6 +5,7 @@ import {isMapping, isString} from "@github/actions-workflow-parser";
 import {Octokit} from "@octokit/rest";
 import {RepositoryContext} from "../initializationOptions";
 import {TTLCache} from "../utils/cache";
+import {getRepoPermission} from "../utils/repo-permission";
 
 export async function getSecrets(
   workflowContext: WorkflowContext,
@@ -13,6 +14,13 @@ export async function getSecrets(
   repo: RepositoryContext,
   defaultContext: DescriptionDictionary | undefined
 ): Promise<DescriptionDictionary> {
+  const permission = await getRepoPermission(octokit, cache, repo);
+  if (permission === "none") {
+    const secretsContext = defaultContext || new DescriptionDictionary();
+    secretsContext.complete = false;
+    return secretsContext;
+  }
+
   let environmentName: string | undefined;
   if (workflowContext?.job?.environment) {
     if (isString(workflowContext.job.environment)) {
@@ -30,54 +38,49 @@ export async function getSecrets(
   }
 
   const secretsContext = defaultContext || new DescriptionDictionary();
-  try {
-    const secrets = await getRemoteSecrets(octokit, cache, repo, environmentName);
+  const secrets = await getRemoteSecrets(octokit, cache, repo, environmentName);
 
-    // Build combined map of secrets
-    const secretsMap = new Map<
-      string,
-      {
-        key: string;
-        value: data.StringData;
-        description?: string;
-      }
-    >();
-
-    secrets.orgSecrets.forEach(secret =>
-      secretsMap.set(secret.value.toLowerCase(), {
-        key: secret.value,
-        value: new data.StringData("***"),
-        description: "Organization secret"
-      })
-    );
-
-    // Override org secrets with repo secrets
-    secrets.repoSecrets.forEach(secret =>
-      secretsMap.set(secret.value.toLowerCase(), {
-        key: secret.value,
-        value: new data.StringData("***"),
-        description: "Repository secret"
-      })
-    );
-
-    // Override repo secrets with environment secrets (if defined)
-    secrets.environmentSecrets.forEach(secret =>
-      secretsMap.set(secret.value.toLowerCase(), {
-        key: secret.value,
-        value: new data.StringData("***"),
-        description: `Secret for environment \`${environmentName}\``
-      })
-    );
-
-    // Sort secrets by key and add to context
-    Array.from(secretsMap.values())
-      .sort((a, b) => a.key.localeCompare(b.key))
-      .forEach(secret => secretsContext?.add(secret.key, secret.value, secret.description));
-  } catch (e: any) {
-    if (e.status === 403 || e.status === 404) {
-      secretsContext.complete = false;
+  // Build combined map of secrets
+  const secretsMap = new Map<
+    string,
+    {
+      key: string;
+      value: data.StringData;
+      description?: string;
     }
-  }
+  >();
+
+  secrets.orgSecrets.forEach(secret =>
+    secretsMap.set(secret.value.toLowerCase(), {
+      key: secret.value,
+      value: new data.StringData("***"),
+      description: "Organization secret"
+    })
+  );
+
+  // Override org secrets with repo secrets
+  secrets.repoSecrets.forEach(secret =>
+    secretsMap.set(secret.value.toLowerCase(), {
+      key: secret.value,
+      value: new data.StringData("***"),
+      description: "Repository secret"
+    })
+  );
+
+  // Override repo secrets with environment secrets (if defined)
+  secrets.environmentSecrets.forEach(secret =>
+    secretsMap.set(secret.value.toLowerCase(), {
+      key: secret.value,
+      value: new data.StringData("***"),
+      description: `Secret for environment \`${environmentName}\``
+    })
+  );
+
+  // Sort secrets by key and add to context
+  Array.from(secretsMap.values())
+    .sort((a, b) => a.key.localeCompare(b.key))
+    .forEach(secret => secretsContext?.add(secret.key, secret.value, secret.description));
+
   return secretsContext;
 }
 

languageserver/src/context-providers/variables.ts

@@ -6,6 +6,7 @@ import {Pair} from "@github/actions-expressions/data/expressiondata";
 import {RepositoryContext} from "../initializationOptions";
 import {StringData} from "@github/actions-expressions/data/index";
 import {TTLCache} from "../utils/cache";
+import {getRepoPermission} from "../utils/repo-permission";
 
 export async function getVariables(
   workflowContext: WorkflowContext,
@@ -14,6 +15,13 @@ export async function getVariables(
   repo: RepositoryContext,
   defaultContext: DescriptionDictionary | undefined
 ): Promise<DescriptionDictionary | undefined> {
+  const permission = await getRepoPermission(octokit, cache, repo);
+  if (permission === "none") {
+    const secretsContext = defaultContext || new DescriptionDictionary();
+    secretsContext.complete = false;
+    return secretsContext;
+  }
+
   let environmentName: string | undefined;
   if (workflowContext?.job?.environment) {
     if (isString(workflowContext.job.environment)) {
@@ -31,54 +39,49 @@ export async function getVariables(
   }
 
   const variablesContext = defaultContext || new DescriptionDictionary();
-  try {
-    const variables = await getRemoteVariables(octokit, cache, repo, environmentName);
+  const variables = await getRemoteVariables(octokit, cache, repo, environmentName);
 
-    // Build combined map of variables
-    const variablesMap = new Map<
-      string,
-      {
-        key: string;
-        value: data.StringData;
-        description?: string;
-      }
-    >();
-
-    variables.organizationVariables.forEach(variable =>
-      variablesMap.set(variable.key.toLowerCase(), {
-        key: variable.key,
-        value: new data.StringData(variable.value.coerceString()),
-        description: `${variable.value.coerceString()} - Organization variable`
-      })
-    );
-
-    // Override org variables with repo variables
-    variables.repoVariables.forEach(variable =>
-      variablesMap.set(variable.key.toLowerCase(), {
-        key: variable.key,
-        value: new data.StringData(variable.value.coerceString()),
-        description: `${variable.value.coerceString()} - Repository variable`
-      })
-    );
-
-    // Override repo variables with environment veriables (if defined)
-    variables.environmentVariables.forEach(variable =>
-      variablesMap.set(variable.key.toLowerCase(), {
-        key: variable.key,
-        value: new data.StringData(variable.value.coerceString()),
-        description: `${variable.value.coerceString()} - Variable for environment \`${environmentName}\``
-      })
-    );
-
-    // Sort variables by key and add to context
-    Array.from(variablesMap.values())
-      .sort((a, b) => a.key.localeCompare(b.key))
-      .forEach(variable => variablesContext?.add(variable.key, variable.value, variable.description));
-  } catch (e: any) {
-    if (e.status === 403 || e.status === 404) {
-      variablesContext.complete = false;
+  // Build combined map of variables
+  const variablesMap = new Map<
+    string,
+    {
+      key: string;
+      value: data.StringData;
+      description?: string;
     }
-  }
+  >();
+
+  variables.organizationVariables.forEach(variable =>
+    variablesMap.set(variable.key.toLowerCase(), {
+      key: variable.key,
+      value: new data.StringData(variable.value.coerceString()),
+      description: `${variable.value.coerceString()} - Organization variable`
+    })
+  );
+
+  // Override org variables with repo variables
+  variables.repoVariables.forEach(variable =>
+    variablesMap.set(variable.key.toLowerCase(), {
+      key: variable.key,
+      value: new data.StringData(variable.value.coerceString()),
+      description: `${variable.value.coerceString()} - Repository variable`
+    })
+  );
+
+  // Override repo variables with environment veriables (if defined)
+  variables.environmentVariables.forEach(variable =>
+    variablesMap.set(variable.key.toLowerCase(), {
+      key: variable.key,
+      value: new data.StringData(variable.value.coerceString()),
+      description: `${variable.value.coerceString()} - Variable for environment \`${environmentName}\``
+    })
+  );
+
+  // Sort variables by key and add to context
+  Array.from(variablesMap.values())
+    .sort((a, b) => a.key.localeCompare(b.key))
+    .forEach(variable => variablesContext?.add(variable.key, variable.value, variable.description));
+
   return variablesContext;
 }