Readonly forbid GitHub authorization (#9212)

packages/presentation/src/components/extensions/ComponentExtensions.svelte

@@ -3,10 +3,12 @@
   import plugin from '../../plugin'
   import { ComponentPointExtension } from '../../types'
   import { getClient } from '../../utils'
+  import { getCurrentAccount, hasAccountRole } from '@hcengineering/core'
 
   export let extension: ComponentExtensionId
   export let props: Record<string, any> = {}
 
+  const currentAccount = getCurrentAccount()
   let extensions: ComponentPointExtension[] = []
 
   void getClient()
@@ -14,7 +16,7 @@
     extension
   })
     .then((res) => {
-      extensions = res
+      extensions = res.filter((it) => it.accessLevel === undefined || hasAccountRole(currentAccount, it.accessLevel))
     })
 </script>
 

packages/presentation/src/types.ts

@@ -11,7 +11,8 @@ import {
   type RelatedDocument,
   type Space,
   type TxOperations,
-  type BlobMetadata
+  type BlobMetadata,
+  type AccountRole
 } from '@hcengineering/core'
 import { type Asset, type IntlString, type Resource } from '@hcengineering/platform'
 import { type AnyComponent, type AnySvelteComponent, type ComponentExtensionId } from '@hcengineering/ui/src/types'
@@ -92,6 +93,7 @@ export interface ComponentExt {
 export interface ComponentPointExtension extends Doc, ComponentExt {
   // Extension point we should extend.
   extension: ComponentExtensionId
+  accessLevel?: AccountRole
 }
 
 export type DocCreatePhase = 'pre' | 'post'

server/account/src/serviceOperations.ts

@@ -66,7 +66,8 @@ import {
   getPersonName,
   doReleaseSocialId,
   doMergeAccounts,
-  doMergePersons
+  doMergePersons,
+  READONLY_GUEST_ACCOUNT
 } from './utils'
 
 // Note: it is IMPORTANT to always destructure params passed here to avoid sending extra params
@@ -598,6 +599,12 @@ export async function createIntegration (
   }
 
   const { socialId, kind, workspaceUuid, data } = params
+  const social = await db.socialId.findOne({ _id: socialId })
+
+  if (social?.personUuid === READONLY_GUEST_ACCOUNT) {
+    throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
+  }
+
   await db.integration.insertOne({ socialId, kind, workspaceUuid, data })
 }
 

services/github/model-github/src/index.ts

@@ -37,7 +37,8 @@ import {
   type Hyperlink,
   type Markup,
   type Ref,
-  type Timestamp
+  type Timestamp,
+  AccountRole
 } from '@hcengineering/core'
 
 import { type Person } from '@hcengineering/contact'
@@ -849,12 +850,14 @@ export function createModel (builder: Builder): void {
 
   builder.createDoc(presentation.class.ComponentPointExtension, core.space.Model, {
     extension: tracker.extensions.IssueListHeader,
-    component: github.component.AuthenticationCheck
+    component: github.component.AuthenticationCheck,
+    accessLevel: AccountRole.User
   })
 
   builder.createDoc(presentation.class.ComponentPointExtension, core.space.Model, {
     extension: tracker.extensions.EditIssueHeader,
     component: github.component.AuthenticationCheck,
+    accessLevel: AccountRole.User,
     props: {
       kind: 'ghost'
     }