fix: limit /roll commands to authorized users

src/index.ts

@@ -5,6 +5,7 @@ import { handleChromiumCheck } from './chromium-handler.js';
 import { handleBuildImagesCheck } from './build-images-handler.js';
 import { handleBuildImagesChromiumDepsCheck } from './build-images-chromium-deps-handler.js';
 import { ROLL_TARGETS } from './constants.js';
+import { isAuthorizedUser } from './utils/is-authorized-user.js';
 
 const handler = (robot: Probot) => {
   robot.on('pull_request.closed', async (context) => {
@@ -67,6 +68,18 @@ const handler = (robot: Probot) => {
       return;
     }
 
+    // Allow all users with push access to run commands
+    if (!(await isAuthorizedUser(context, comment.user.login))) {
+      d(`@${comment.user.login} is not authorized to run roller commands - stopping`);
+      await context.octokit.rest.issues.createComment(
+        context.repo({
+          issue_number: issue.number,
+          body: `@${comment.user.login} is not authorized to run roller commands.`,
+        }),
+      );
+      return;
+    }
+
     const branch = match[1];
     const isNodePR = issue.title.startsWith(`chore: bump ${ROLL_TARGETS.node.name}`);
     const isChromiumPR = issue.title.startsWith(`chore: bump ${ROLL_TARGETS.chromium.name}`);

src/utils/is-authorized-user.ts

@@ -0,0 +1,14 @@
+import type { Context } from 'probot';
+
+export async function isAuthorizedUser(
+  context: Context<'issue_comment.created'>,
+  username: string,
+) {
+  const { data } = await context.octokit.rest.repos.getCollaboratorPermissionLevel(
+    context.repo({
+      username,
+    }),
+  );
+
+  return ['admin', 'write'].includes(data.permission);
+}

tests/fixtures/issue_comment_roll.created.json

@@ -0,0 +1,36 @@
+{
+  "name": "issue_comment",
+  "payload": {
+    "action": "created",
+    "issue": {
+      "url": "https://api.github.com/repos/electron/electron/pull/0",
+      "html_url": "https://github.com/electron/electron/pull/0",
+      "number": 0,
+      "title": "chore: bump chromium to 1.2.3.4",
+      "user": {
+        "login": "dsanders11"
+      },
+      "body": "Bump the version of Chromium to 1.2.3.4.",
+      "pull_request": {}
+    },
+    "comment": {
+      "url": "https://api.github.com/repos/electron/electron/pulls/comments/0",
+      "html_url": "https://github.com/electron/electron/pulls/0#issuecomment-0",
+      "id": 0,
+      "user": {
+        "login": "dsanders11"
+      },
+      "body": "/roll main"
+    },
+    "repository": {
+      "name": "electron",
+      "full_name": "electron/electron",
+      "owner": {
+        "login": "electron"
+      }
+    },
+    "installation": {
+      "id": 12345
+    }
+  }
+}

tests/index.spec.ts

@@ -0,0 +1,94 @@
+import nock from 'nock';
+import { Context, Probot, ProbotOctokit } from 'probot';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import handler from '../src/index.js';
+import { handleChromiumCheck } from '../src/chromium-handler.js';
+import { handleNodeCheck } from '../src/node-handler.js';
+import { isAuthorizedUser } from '../src/utils/is-authorized-user.js';
+
+import issueCommentRollCreatedEvent from './fixtures/issue_comment_roll.created.json' with { type: 'json' };
+
+vi.mock('../src/chromium-handler.js');
+vi.mock('../src/node-handler.js');
+vi.mock('../src/utils/is-authorized-user.js');
+
+const GH_API = 'https://api.github.com';
+
+describe('roller', () => {
+  describe('issue_comment.created event', () => {
+    let probot: Probot;
+
+    beforeEach(() => {
+      vi.clearAllMocks();
+      nock.disableNetConnect();
+
+      probot = new Probot({
+        githubToken: 'test',
+        Octokit: ProbotOctokit.defaults((instanceOptions: any) => {
+          return {
+            ...instanceOptions,
+            retry: { enabled: false },
+            throttle: { enabled: false },
+          };
+        }),
+      });
+
+      probot.load(handler);
+    });
+
+    afterEach(() => {
+      expect(nock.isDone(), 'Not all Nock interceptors used');
+      nock.cleanAll();
+      nock.enableNetConnect();
+    });
+
+    it('rolls Chromium when an authorized user comments /roll main', async () => {
+      vi.mocked(isAuthorizedUser).mockResolvedValue(true);
+
+      nock(GH_API)
+        .post('/repos/electron/electron/issues/0/comments', ({ body }) => {
+          expect(body).toEqual('Checking for new Chromium commits on `main`');
+          return true;
+        })
+        .reply(200);
+
+      await probot.receive(issueCommentRollCreatedEvent as Parameters<typeof probot.receive>[0]);
+
+      expect(handleChromiumCheck).toHaveBeenCalledWith('main');
+    });
+
+    it('rolls Node.js when an authorized user comments /roll main', async () => {
+      vi.mocked(isAuthorizedUser).mockResolvedValue(true);
+
+      nock(GH_API)
+        .post('/repos/electron/electron/issues/0/comments', ({ body }) => {
+          expect(body).toEqual('Checking for new Node.js commits on `main`');
+          return true;
+        })
+        .reply(200);
+
+      const event = JSON.parse(JSON.stringify(issueCommentRollCreatedEvent));
+      event.payload.issue.title = 'chore: bump node to 1.2.3.4';
+      await probot.receive(event as Parameters<typeof probot.receive>[0]);
+
+      expect(handleNodeCheck).toHaveBeenCalledWith('main');
+    });
+
+    it('blocks unauthorized users from triggering a roll', async () => {
+      vi.mocked(isAuthorizedUser).mockResolvedValue(false);
+
+      nock(GH_API)
+        .post('/repos/electron/electron/issues/0/comments', ({ body }) => {
+          expect(body).toEqual('@dsanders11 is not authorized to run roller commands.');
+          return true;
+        })
+        .reply(200);
+
+      await probot.receive(issueCommentRollCreatedEvent as Parameters<typeof probot.receive>[0]);
+
+      expect(handleChromiumCheck).not.toHaveBeenCalled();
+      expect(handleNodeCheck).not.toHaveBeenCalled();
+    });
+  });
+});