require the git permission for repository deploy/sync/test

src/routes/api/git/repositories/[id]/deploy/+server.ts

@@ -2,6 +2,7 @@ import { json } from '@sveltejs/kit';
 import type { RequestHandler } from './$types';
 import { getGitRepository } from '$lib/server/db';
 import { deployFromRepository } from '$lib/server/git';
+import { authorize } from '$lib/server/authorize';
 
 /**
  * @openapi
@@ -10,10 +11,16 @@ import { deployFromRepository } from '$lib/server/git';
  * resp-200: {success:boolean!, error:string}
  * resp-200-example: {"success":true}
  * resp-400: The id path segment is not a valid integer
+ * resp-403: Caller lacks the git:edit permission
  * resp-404: No repository exists with that ID
  * resp-500: The deployment failed
  */
-export const POST: RequestHandler = async ({ params }) => {
+export const POST: RequestHandler = async ({ params, cookies }) => {
+	const auth = await authorize(cookies);
+	if (auth.authEnabled && !await auth.can('git', 'edit')) {
+		return json({ error: 'Permission denied' }, { status: 403 });
+	}
+
 	try {
 		const id = parseInt(params.id);
 		if (isNaN(id)) {

src/routes/api/git/repositories/[id]/sync/+server.ts

@@ -2,6 +2,7 @@ import { json } from '@sveltejs/kit';
 import type { RequestHandler } from './$types';
 import { getGitRepository } from '$lib/server/db';
 import { syncRepository, checkForUpdates } from '$lib/server/git';
+import { authorize } from '$lib/server/authorize';
 
 /**
  * @openapi
@@ -10,10 +11,16 @@ import { syncRepository, checkForUpdates } from '$lib/server/git';
  * resp-200: {success:boolean!, error:string}
  * resp-200-example: {"success":true}
  * resp-400: The id path segment is not a valid integer
+ * resp-403: Caller lacks the git:edit permission
  * resp-404: No repository exists with that ID
  * resp-500: The sync failed
  */
-export const POST: RequestHandler = async ({ params }) => {
+export const POST: RequestHandler = async ({ params, cookies }) => {
+	const auth = await authorize(cookies);
+	if (auth.authEnabled && !await auth.can('git', 'edit')) {
+		return json({ error: 'Permission denied' }, { status: 403 });
+	}
+
 	try {
 		const id = parseInt(params.id);
 		if (isNaN(id)) {
@@ -40,10 +47,16 @@ export const POST: RequestHandler = async ({ params }) => {
  * resp-200: {hasUpdates:boolean!, error:string}
  * resp-200-example: {"hasUpdates":false}
  * resp-400: The id path segment is not a valid integer
+ * resp-403: Caller lacks the git:view permission
  * resp-404: No repository exists with that ID
  * resp-500: The update check failed
  */
-export const GET: RequestHandler = async ({ params }) => {
+export const GET: RequestHandler = async ({ params, cookies }) => {
+	const auth = await authorize(cookies);
+	if (auth.authEnabled && !await auth.can('git', 'view')) {
+		return json({ error: 'Permission denied' }, { status: 403 });
+	}
+
 	// Check for updates without syncing
 	try {
 		const id = parseInt(params.id);

src/routes/api/git/repositories/[id]/test/+server.ts

@@ -2,6 +2,7 @@ import { json } from '@sveltejs/kit';
 import type { RequestHandler } from './$types';
 import { getGitRepository } from '$lib/server/db';
 import { testRepository } from '$lib/server/git';
+import { authorize } from '$lib/server/authorize';
 
 /**
  * @openapi
@@ -10,10 +11,16 @@ import { testRepository } from '$lib/server/git';
  * resp-200: {success:boolean!, error:string}
  * resp-200-example: {"success":true}
  * resp-400: The id path segment is not a valid integer
+ * resp-403: Caller lacks the git:edit permission
  * resp-404: No repository exists with that ID
  * resp-500: The connectivity test failed
  */
-export const POST: RequestHandler = async ({ params }) => {
+export const POST: RequestHandler = async ({ params, cookies }) => {
+	const auth = await authorize(cookies);
+	if (auth.authEnabled && !await auth.can('git', 'edit')) {
+		return json({ error: 'Permission denied' }, { status: 403 });
+	}
+
 	try {
 		const id = parseInt(params.id);
 		if (isNaN(id)) {