import { createServerFn } from "@tanstack/react-start";
import { viewerMiddleware } from "./middleware";
import { hasPermission, requireRepoAccess } from "~/server/repos";
import { limitBrowse } from "~/server/limits";
import { githubTokenNotice } from "~/server/ci/github-token-notice";
import { repoRef } from "~/lib/validation";

/** Shown to admins (who can add the secret) above the Actions page; null when nothing needs attention. */
export const getGithubTokenNotice = createServerFn({ method: "GET" })
  .middleware([viewerMiddleware])
  .validator(repoRef)
  .handler(async ({ data, context }) => {
    await limitBrowse(context.viewer);
    const { repo, permission } = await requireRepoAccess(data.owner, data.repo, context.viewer, "read");
    if (!hasPermission(permission, "admin")) return null;
    return githubTokenNotice(repo);
  });