name: Check Organization Membership

on:
  workflow_call:
    inputs:
      commenter:
        required: false
        type: string
        default: ''
        description: 'The username to check. Auto-detected from the event context if not provided.'
      organization:
        required: false
        type: string
        default: 'windmill-labs'
        description: 'The organization to check membership for'
      trusted_bot:
        required: false
        type: string
        default: 'windmill-internal-app[bot]'
        description: 'The trusted bot username to allow'
    secrets:
      access_token:
        required: true
        description: 'The access token to use for org membership check'
    outputs:
      is_member:
        description: 'Whether the user is an organization member or trusted bot'
        value: ${{ jobs.check-membership.outputs.is_member }}

jobs:
  check-membership:
    runs-on: ubicloud-standard-2
    outputs:
      is_member: ${{ steps.check-membership.outputs.is_member }}
    steps:
      - name: Determine commenter
        id: determine-commenter
        run: |
          COMMENTER="${{ inputs.commenter }}"
          if [[ -z "$COMMENTER" ]]; then
            if [[ "${{ github.event_name }}" == "issue_comment" || \
                  "${{ github.event_name }}" == "pull_request_review_comment" ]]; then
              COMMENTER="${{ github.event.comment.user.login }}"
            elif [[ "${{ github.event_name }}" == "pull_request_review" ]]; then
              COMMENTER="${{ github.event.review.user.login }}"
            else
              COMMENTER="${{ github.event.issue.user.login }}"
            fi
          fi
          echo "commenter=$COMMENTER" >> $GITHUB_OUTPUT

      - name: Check organization membership
        id: check-membership
        env:
          ORG_ACCESS_TOKEN: ${{ secrets.access_token }}
          COMMENTER: ${{ steps.determine-commenter.outputs.commenter }}
          ORG: ${{ inputs.organization }}
          TRUSTED_BOT: ${{ inputs.trusted_bot }}
        run: |
          # 1. Allow the trusted bot straight away
          if [[ "$COMMENTER" == "$TRUSTED_BOT" ]]; then
            echo "is_member=true" >> $GITHUB_OUTPUT
            exit 0
          fi

          # 2. Disallow other bots
          if [[ "${COMMENTER}" =~ \[bot\]$ ]]; then
            echo "is_member=false" >> $GITHUB_OUTPUT
            exit 0
          fi

          # 3. Otherwise check if the user is a member of the organization
          STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
            -H "Authorization: token $ORG_ACCESS_TOKEN" \
            -H "Accept: application/vnd.github+json" \
            -H "X-GitHub-Api-Version: 2022-11-28" \
            "https://api.github.com/orgs/$ORG/members/$COMMENTER")

          if [ "$STATUS" -eq 204 ]; then
            echo "is_member=true" >> $GITHUB_OUTPUT
          else
            echo "is_member=false" >> $GITHUB_OUTPUT
          fi