@@ -113,13 +113,19 @@ type CacheStats struct {
113113Evictions int64
114114}
115115
116+ // IsSafeContent determines if the specified user can safely access the requested repository content.
117+ // Safe access applies when any of the following is true:
118+ // - the content was created by a trusted bot;
119+ // - the author currently has push access to the repository;
120+ // - the repository is private;
121+ // - the content was created by the viewer.
116122func (c * RepoAccessCache )IsSafeContent (ctx context.Context ,username ,owner ,repo string ) (bool ,error ) {
117123repoInfo ,err := c .getRepoAccessInfo (ctx ,username ,owner ,repo )
118124if err != nil {
119125return false ,err
120126}
121127
122- c .logDebug (ctx ,fmt .Sprintf ("evaluated repo accessfur user %s to %s/%s for content filtering, result: hasPushAccess=%t, isPrivate=%t" ,
128+ c .logDebug (ctx ,fmt .Sprintf ("evaluated repo accessfor user %s to %s/%s for content filtering, result: hasPushAccess=%t, isPrivate=%t" ,
123129username ,owner ,repo ,repoInfo .HasPushAccess ,repoInfo .IsPrivate ))
124130
125131if c .isTrustedBot (username )|| repoInfo .IsPrivate || repoInfo .ViewerLogin == strings .ToLower (username ) {
@@ -143,15 +149,15 @@ func (c *RepoAccessCache) getRepoAccessInfo(ctx context.Context, username, owner
143149if err == nil {
144150entry := cacheItem .Data ().(* repoAccessCacheEntry )
145151if cachedHasPush ,known := entry .knownUsers [userKey ];known {
146- c .logDebug (ctx ,"repo access cache hit" )
152+ c .logDebug (ctx ,fmt . Sprintf ( "repo access cache hit for user %s to %s/%s" , username , owner , repo ) )
147153return RepoAccessInfo {
148154IsPrivate :entry .isPrivate ,
149155HasPushAccess :cachedHasPush ,
150156ViewerLogin :entry .viewerLogin ,
151157},nil
152158}
153159
154- c .logDebug (ctx ,"known users cache miss" )
160+ c .logDebug (ctx ,"known users cache miss, fetching from graphql API " )
155161
156162info ,queryErr := c .queryRepoAccessInfo (ctx ,username ,owner ,repo )
157163if queryErr != nil {
@@ -170,7 +176,7 @@ func (c *RepoAccessCache) getRepoAccessInfo(ctx context.Context, username, owner
170176},nil
171177}
172178
173- c .logDebug (ctx ,"repo access cache miss" )
179+ c .logDebug (ctx ,fmt . Sprintf ( "repo access cache miss for user %s to %s/%s" , username , owner , repo ) )
174180
175181info ,queryErr := c .queryRepoAccessInfo (ctx ,username ,owner ,repo )
176182if queryErr != nil {
@@ -234,6 +240,9 @@ func (c *RepoAccessCache) queryRepoAccessInfo(ctx context.Context, username, own
234240}
235241}
236242
243+ c .logDebug (ctx ,fmt .Sprintf ("queried repo access info for user %s to %s/%s: isPrivate=%t, hasPushAccess=%t, viewerLogin=%s" ,
244+ username ,owner ,repo ,bool (query .Repository .IsPrivate ),hasPush ,query .Viewer .Login ))
245+
237246return RepoAccessInfo {
238247IsPrivate :bool (query .Repository .IsPrivate ),
239248HasPushAccess :hasPush ,