feat: disable permit gen for users in non collaborative issues

src/helpers/checkers.ts

@@ -0,0 +1,56 @@
+import { GitHubPullRequestReviewState } from "../github-types";
+import { IssueActivity } from "../issue-activity";
+import { ContextPlugin } from "../types/plugin-input";
+
+export function isCollaborative(data: Readonly<IssueActivity>) {
+  if (!data.self?.closed_by || !data.self.user) return false;
+  const issueCreator = data.self.user;
+
+  if (data.self.closed_by.id === issueCreator.id) {
+    const pricingEventsByNonAssignee = data.events.find(
+      (event) =>
+        event.event === "labeled" &&
+        "label" in event &&
+        (event.label.name.startsWith("Time: ") || event.label.name.startsWith("Priority: ")) &&
+        event.actor.id !== issueCreator.id
+    );
+    return !!pricingEventsByNonAssignee || !!nonAssigneeApprovedReviews(data);
+  }
+  return true;
+}
+
+export function nonAssigneeApprovedReviews(data: Readonly<IssueActivity>) {
+  if (data.linkedReviews[0] && data.self?.assignee) {
+    const pullRequest = data.linkedReviews[0].self;
+    const pullReview = data.linkedReviews[0];
+    const reviewsByNonAssignee: GitHubPullRequestReviewState[] = [];
+    const assignee = data.self.assignee;
+
+    if (pullReview.reviews && pullRequest) {
+      for (const review of pullReview.reviews) {
+        const isReviewRequestedForUser =
+          "requested_reviewers" in pullRequest &&
+          pullRequest.requested_reviewers?.some((o) => o.id === review.user?.id);
+        if (!isReviewRequestedForUser && review.user?.id) {
+          reviewsByNonAssignee.push(review);
+        }
+      }
+    }
+    return reviewsByNonAssignee.filter((v) => v.user?.id !== assignee.id && v.state === "APPROVED");
+  }
+  return false;
+}
+
+export async function isAdmin(username: string, context: ContextPlugin): Promise<boolean> {
+  const octokit = context.octokit;
+  try {
+    const userPerms = await octokit.rest.orgs.getMembershipForUser({
+      org: context.payload.repository.owner.login,
+      username: username,
+    });
+    return userPerms.data.role === "admin" || userPerms.data.role === "billing_manager";
+  } catch (e) {
+    context.logger.debug(`${username} is not a member of ${context.payload.repository.owner.login}`, { e });
+    return false;
+  }
+}

src/parser/github-comment-module.ts

@@ -13,6 +13,8 @@ import { getErc20TokenSymbol } from "../helpers/web3";
 import { IssueActivity } from "../issue-activity";
 import { BaseModule } from "../types/module";
 import { GithubCommentScore, Result } from "../types/results";
+import { postComment } from "@ubiquity-os/plugin-sdk";
+import { isAdmin, isCollaborative } from "../helpers/checkers";
 
 interface SortedTasks {
   issues: { specification: GithubCommentScore | null; comments: GithubCommentScore[] };
@@ -104,13 +106,20 @@ export class GithubCommentModule extends BaseModule {
   }
 
   async transform(data: Readonly<IssueActivity>, result: Result): Promise<Result> {
+    const isIssueCollaborative = isCollaborative(data);
+    const isUserAdmin = data.self?.user ? await isAdmin(data.self.user.login, this.context) : false;
     const body = await this.getBodyContent(result);
     if (this._configuration?.debug) {
       fs.writeFileSync(this._debugFilePath, body);
     }
     if (this._configuration?.post) {
       try {
-        await this.postComment(body);
+        if (Object.values(result).some((v) => v.permitUrl) || isIssueCollaborative || isUserAdmin) {
+          await this.postComment(body);
+        } else {
+          const errorLog = this.context.logger.error("Issue is non-collaborative. Skipping permit generation.");
+          await postComment(this.context, errorLog);
+        }
       } catch (e) {
         this.context.logger.error(`Could not post GitHub comment: ${e}`);
       }

src/parser/permit-generation-module.ts

@@ -24,6 +24,7 @@ import { getRepo, parseGitHubUrl } from "../start";
 import { EnvConfig } from "../types/env-type";
 import { BaseModule } from "../types/module";
 import { Result } from "../types/results";
+import { isAdmin, isCollaborative } from "../helpers/checkers";
 
 interface Payload {
   evmNetworkId: number;
@@ -38,6 +39,12 @@ export class PermitGenerationModule extends BaseModule {
   readonly _supabase = createClient<Database>(this.context.env.SUPABASE_URL, this.context.env.SUPABASE_KEY);
 
   async transform(data: Readonly<IssueActivity>, result: Result): Promise<Result> {
+    const canGeneratePermits = await this._canGeneratePermit(data);
+
+    if (!canGeneratePermits) {
+      this.context.logger.error("[PermitGenerationModule] Non collaborative issue detected, skipping.");
+      return Promise.resolve(result);
+    }
     const payload: Context["payload"] & Payload = {
       ...context.payload.inputs,
       issueUrl: this.context.payload.issue.html_url,
@@ -192,6 +199,14 @@ export class PermitGenerationModule extends BaseModule {
     return this._deductFeeFromReward(result, treasuryGithubData);
   }
 
+  async _canGeneratePermit(data: Readonly<IssueActivity>) {
+    if (!data.self?.closed_by || !data.self.user) return false;
+
+    if (await isAdmin(data.self.user.login, this.context)) return true;
+
+    return isCollaborative(data);
+  }
+
   _deductFeeFromReward(
     result: Result,
     treasuryGithubData: RestEndpointMethodTypes["users"]["getByUsername"]["response"]["data"]

tests/__mocks__/handlers.ts

@@ -131,6 +131,22 @@ export const handlers = [
     }
     return HttpResponse.json(user);
   }),
+  http.get("https://api.github.com/orgs/:org/memberships/:username", ({ params }) => {
+    const { username } = params;
+
+    if (username === "0x4007") {
+      return HttpResponse.json({
+        data: {
+          role: "admin"
+        }
+      });
+    }
+    return HttpResponse.json({
+      data: {
+        role: "member"
+      }
+    });
+  }),
   http.post("https://api.github.com/app/installations/48381972/access_tokens", () => {
     return HttpResponse.json({});
   }),