Githawk: Don't allow comment when locked

[rnystrom]

[rnystrom]

Tweaking b/c you can comment on your own stuff even if locked. Hmm. viewerCanUpdate is for editing...

The Issue API doesn't have a viewerCanComment or anything.

@Sherlouk can you use the API explorer and see if you can administer this repo?

query {
  repository(owner: "rnystrom", name: "githawk") {
    viewerCanAdminister
  }
}

[Sherlouk]

"viewerCanAdminister": false 😢

[rnystrom]

Crap! Wtf. How are we able to tell who has commenting permissions while locked?

@Sherlouk are you able to lock issues on this repo?

[Sherlouk]

Yup!

[rnystrom]

Grrr this is frustrating.

@Sherlouk what about this query

query {
  repository(owner: "rnystrom", name: "githawk") {
    viewerCanAdminister
    viewerCanSubscribe
    viewerCanUpdateTopics
    viewerCanCreateProjects
  }
}

One of these has to be a proxy for this type of permission.

[Sherlouk]

viewerCannotUpdateReasons references the issue being locked, we sure viewerCanUpdate doesn't have a double purpose?

[rnystrom]

@Sherlouk ah wait, I think you're right. I thought that I owned the playground repo, but I made it w/ my test account. I think viewerCanUpdate is ok then.

[Sherlouk]

Hmm no I don't think it is viewerCanUpdate is false for my alt account on this issue - that's checking whether I can update the root message (not whether I can make a new comment)

[Sherlouk]

Collaborator:
"viewerCanAdminister": false,
"viewerCanSubscribe": true,
"viewerCanUpdateTopics": false,
"viewerCanCreateProjects": true

Normal User:
"viewerCanAdminister": false,
"viewerCanSubscribe": true,
"viewerCanUpdateTopics": false,
"viewerCanCreateProjects": false

[Sherlouk]

Also we need to be careful because GitHub treats permissions differently for repos owned by an organisation versus repos owned by a "normal user"

https://help.github.com/articles/access-permissions-on-github/

[rnystrom]

Hopefully the “viewerCan” fields are enough info. Wish the field to actions mapping was more clear.

_{Sent with GitHawk}

[BasThomas]

Ugh, this is messy :(

[rnystrom]

Maybe we just use hidden = locked && !viewerCanAdminister? Non-admin collabs wont be able to comment, but IMO its weird that we all can comment when its locked, lol.

[Sherlouk]

I don't see locked conversations enough to see why people use them honestly - but I feel we should try n match GH as much as possible despite how piss poor the API is in places

[BasThomas]

Eg, Fastlane is doing auto closing and later locking. Prevents users from adding comments on a (possibly) outdated issue, forcing them to create a new one. Could go well with #405 maybe?!

[rnystrom]

Wrote a question on the API forums for this

https://platform.github.community/t/which-permissions-to-use-for-issue-actions-lock-label-close/3390

[rnystrom]

Alright got a v1 of this working