Prevent login for people without write access github repo

[CapitaineToinon]

Hey there,

I've been trying to setup Keystatic with a Github repo. It works great until I want new people to contribute. I understand that people need write access to use Keystatic but why allow people to login at all? Right now, people can login but get a cryptic error when they try to edit anything:

It seems like keystatic cloud handles this, if I try to login to https://keystatic.com/keystatic I get an expected error message:

Could we have something similar for the Github integration?

[CapitaineToinon]

As a work around, I added some code before loading the keystatic admin using a different access token to verify that the current keystatic logged in user has access to my repo. If not, shows an error. For this, I stopped using the astro integration and just imported the UI and the API endpoints to install them manually, like we used to do before the integration.

---
import { Keystatic } from '@/components/keystatic'
import { Octokit } from '@octokit/core'
import { z } from 'astro:content'
import Layout from '@/layouts/default.astro'
import { ExclamationTriangleIcon } from '@radix-ui/react-icons'
import { Alert, AlertDescription, AlertTitle } from '@/components/ui/alert'
import config from 'keystatic.config'

export const prerender = false

const accessToken = Astro.cookies.get('keystatic-gh-access-token')
let error: { title: string; message: string } | undefined = undefined

if (config.storage.kind === 'github' && accessToken) {
	const souls = new Octokit({
		auth: import.meta.env.SOULS_PERSONAL_ACCESS_TOKEN,
	})

	const keystatic = new Octokit({
		auth: accessToken.value,
	})

	try {
		const me = await keystatic.request('GET /user', {
			headers: {
				'X-GitHub-Api-Version': '2022-11-28',
			},
		})

		await souls.request('GET /repos/{owner}/{repo}/collaborators/{username}', {
			owner: 'soulsspeedruns',
			repo: 'website',
			username: me.data.login,
			headers: {
				'X-GitHub-Api-Version': '2022-11-28',
			},
		})
	} catch (e) {
		const result = z.object({ status: z.literal(404) }).safeParse(e)

		if (result.success) {
			error = {
				title: 'Forbidden',
				message: `The user is not a verified contributor.`,
			}

			Astro.response.status = 403
		} else {
			console.log(e)
			throw e
		}
	}
}
---

{
	error ? (
		<Layout title="Unauthorized">
			<main class="container mx-auto mt-20 grid grid-cols-10">
				<div class="col-span-6 col-start-3">
					<Alert
						variant="destructive"
						className="mb-6"
					>
						<ExclamationTriangleIcon className="h-4 w-4" />
						<AlertTitle>{error.title}</AlertTitle>
						<AlertDescription>{error.message}</AlertDescription>
					</Alert>
					<p class="prose max-w-none dark:prose-invert">
						Please check <a href="/contribute">how to contribute</a>.
					</p>
				</div>
			</main>
		</Layout>
	) : (
		<Keystatic client:only="react" />
	)
}

I had to use a different access token because for some reason I just couldn't get the correct api information using the keystatic token. Not really sure why, not that familiar with github scopes and stuff. Works for now though.

[AliMejbar]

+1