From 8d43875a97aacb9ad7ce8094e360476402ccbd2d Mon Sep 17 00:00:00 2001
From: oppiliappan <me@oppi.li>
Date: Thu, 9 Oct 2025 09:24:26 +0100
Subject: [PATCH] appview/pulls: show branch delete only if the logged-in-user
 can push to the repo

Signed-off-by: oppiliappan <me@oppi.li>
---
 appview/pulls/pulls.go  | 11 +++++++++++
 appview/state/router.go |  2 +-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/appview/pulls/pulls.go b/appview/pulls/pulls.go
index 3f7c2e8b..bf0da184 100644
--- a/appview/pulls/pulls.go
+++ b/appview/pulls/pulls.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"log"
 	"net/http"
+	"slices"
 	"sort"
 	"strconv"
 	"strings"
@@ -24,6 +25,7 @@ import (
 	"tangled.org/core/appview/xrpcclient"
 	"tangled.org/core/idresolver"
 	"tangled.org/core/patchutil"
+	"tangled.org/core/rbac"
 	"tangled.org/core/tid"
 	"tangled.org/core/types"
 
@@ -43,6 +45,7 @@ type Pulls struct {
 	db           *db.DB
 	config       *config.Config
 	notifier     notify.Notifier
+	enforcer     *rbac.Enforcer
 }
 
 func New(
@@ -53,6 +56,7 @@ func New(
 	db *db.DB,
 	config *config.Config,
 	notifier notify.Notifier,
+	enforcer *rbac.Enforcer,
 ) *Pulls {
 	return &Pulls{
 		oauth:        oauth,
@@ -62,6 +66,7 @@ func New(
 		db:           db,
 		config:       config,
 		notifier:     notifier,
+		enforcer:     enforcer,
 	}
 }
 
@@ -329,6 +334,12 @@ func (s *Pulls) branchDeleteStatus(r *http.Request, f *reporesolver.ResolvedRepo
 		return nil
 	}
 
+	// user can only delete branch if they are a collaborator in the repo that the branch belongs to
+	perms := s.enforcer.GetPermissionsInRepo(user.Did, repo.Knot, repo.DidSlashRepo())
+	if !slices.Contains(perms, "repo:push") {
+		return nil
+	}
+
 	scheme := "http"
 	if !s.config.Core.Dev {
 		scheme = "https"
diff --git a/appview/state/router.go b/appview/state/router.go
index 45df2a8a..f0396fc9 100644
--- a/appview/state/router.go
+++ b/appview/state/router.go
@@ -258,7 +258,7 @@ func (s *State) IssuesRouter(mw *middleware.Middleware) http.Handler {
 }
 
 func (s *State) PullsRouter(mw *middleware.Middleware) http.Handler {
-	pulls := pulls.New(s.oauth, s.repoResolver, s.pages, s.idResolver, s.db, s.config, s.notifier)
+	pulls := pulls.New(s.oauth, s.repoResolver, s.pages, s.idResolver, s.db, s.config, s.notifier, s.enforcer)
 	return pulls.Router(mw)
 }
 
-- 
2.51.2