Method DenyProjectAccess

admin/server/projects.go:1732–1778

(ctx context.Context, req *adminv1.DenyProjectAccessRequest)

}

func (s *Server) DenyProjectAccess(ctx context.Context, req *adminv1.DenyProjectAccessRequest) (*adminv1.DenyProjectAccessResponse, error) {
	observability.AddRequestAttributes(ctx,
		attribute.String("args.id", req.Id),
	)

	accessReq, err := s.admin.DB.FindProjectAccessRequestByID(ctx, req.Id)
	if err != nil {
		return nil, err
	}

	proj, err := s.admin.DB.FindProject(ctx, accessReq.ProjectID)
	if err != nil {
		return nil, err
	}

	claims := auth.GetClaims(ctx)
	if !claims.ProjectPermissions(ctx, proj.OrganizationID, proj.ID).ManageProjectMembers {
		return nil, status.Error(codes.PermissionDenied, "not allowed to set project member roles")
	}

	user, err := s.admin.DB.FindUser(ctx, accessReq.UserID)
	if err != nil {
		return nil, err
	}
	org, err := s.admin.DB.FindOrganization(ctx, proj.OrganizationID)
	if err != nil {
		return nil, err
	}

	// remove the invitation
	err = s.admin.DB.DeleteProjectAccessRequest(ctx, req.Id)
	if err != nil {
		return nil, err
	}

	err = s.admin.Email.SendProjectAccessRejected(&email.ProjectAccessRejected{
		ToEmail:     user.Email,
		ToName:      user.DisplayName,
		OrgName:     org.Name,
		ProjectName: proj.Name,
	})
	if err != nil {
		return nil, err
	}

	return &adminv1.DenyProjectAccessResponse{}, nil
}

// getAndCheckGithubInstallationID returns a valid installation ID iff app is installed and user is a collaborator of the repo
func (s *Server) getAndCheckGithubInstallationID(ctx context.Context, gitRemote, userID string) (repoID, installationID int64, err error) {