collectRequiredPermissions collects all required permissions for the given toolsets
(toolsets []string, readOnly bool)
| 94 | |
| 95 | // collectRequiredPermissions collects all required permissions for the given toolsets |
| 96 | func collectRequiredPermissions(toolsets []string, readOnly bool) map[PermissionScope]PermissionLevel { |
| 97 | if permissionsValidationLog.Enabled() { |
| 98 | permissionsValidationLog.Printf("Collecting required permissions for %d toolsets, read_only=%t", len(toolsets), readOnly) |
| 99 | } |
| 100 | required := make(map[PermissionScope]PermissionLevel) |
| 101 | toolsetPermissionsMap := getToolsetPermissionsMap() |
| 102 | |
| 103 | for _, toolset := range toolsets { |
| 104 | perms, exists := toolsetPermissionsMap[toolset] |
| 105 | if !exists { |
| 106 | if permissionsValidationLog.Enabled() { |
| 107 | permissionsValidationLog.Printf("Unknown toolset: %s", toolset) |
| 108 | } |
| 109 | continue |
| 110 | } |
| 111 | |
| 112 | // Add read permissions only (write tools are not considered for permission requirements) |
| 113 | for _, scope := range perms.ReadPermissions { |
| 114 | // Skip GitHub App-only permission scopes; these cannot be set via GITHUB_TOKEN |
| 115 | // and are validated separately in validateGitHubAppOnlyPermissions. |
| 116 | if IsGitHubAppOnlyScope(scope) { |
| 117 | if permissionsValidationLog.Enabled() { |
| 118 | permissionsValidationLog.Printf("Skipping GitHub App-only scope %s for toolset %s", scope, toolset) |
| 119 | } |
| 120 | continue |
| 121 | } |
| 122 | // Always require at least read access |
| 123 | if existing, found := required[scope]; !found || existing == PermissionNone { |
| 124 | required[scope] = PermissionRead |
| 125 | } |
| 126 | } |
| 127 | } |
| 128 | |
| 129 | return required |
| 130 | } |
| 131 | |
| 132 | // isPermissionSufficient checks if the current permission level is sufficient for the required level. |
| 133 | // write > read > none |