Add a SUPERUSERS environment variable

Whoever operates a deployment is not necessarily an admin on every repository
the bot is installed on, so the bot would refuse their commands. Let a
deployment name a set of users who are trusted everywhere.

SUPERUSERS is a comma separated list of GitHub usernames, tolerating a
leading @ so a value can be pasted straight from a mention, and compared case
insensitively. The check short-circuits `Session._get_permission`, which is
the single point both the direct scope check and the cross-repository
`has_permission` check go through, and it answers without calling GitHub.

Unset by default, in which case nobody is treated specially.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mj75Ckx8LdU8sQCgfyyERG

Author: Carreau

CONTRIBUTING.md

@@ -80,6 +80,20 @@ PERSONAL_ACCOUNT_NAME="<account name>"
 PERSONAL_ACCOUNT_TOKEN="<github personal access token with repo access>"
 ```
 
+Optionally:
+
+```
+SUPERUSERS="<comma separated github usernames>"
+```
+
+Superusers are treated as administrators on every repository the bot is
+installed on, whatever their actual GitHub permissions are there. This is
+meant for whoever operates the deployment, so that the bot does not refuse
+their commands on repositories they do not have admin rights to. A leading
+`@` is accepted and the comparison is case insensitive, so
+`SUPERUSERS="@Carreau"` and `SUPERUSERS="carreau"` are equivalent. Leave it
+unset to give nobody special treatment.
+
 ### Code Styling
 
 `MeeseeksDev` has adopted automatic code formatting so you shouldn't

meeseeksdev/__init__.py

@@ -128,6 +128,17 @@ def load_config_from_env():
     config["personal_account_name"] = os.environ.get("PERSONAL_ACCOUNT_NAME")
     config["personal_account_token"] = os.environ.get("PERSONAL_ACCOUNT_TOKEN")
 
+    # Comma separated list of GitHub usernames trusted on every repository the
+    # bot is installed on; typically whoever runs this deployment. A leading @
+    # is tolerated so that the value can be pasted straight from a mention.
+    config["superusers"] = [
+        u.strip().lstrip("@")
+        for u in os.environ.get("SUPERUSERS", "").split(",")
+        if u.strip().lstrip("@")
+    ]
+    if config["superusers"]:
+        print("superusers:", ", ".join(config["superusers"]))
+
     return Config(**config).validate()
 
 

meeseeksdev/meeseeksbox/core.py

@@ -35,6 +35,10 @@ class Config:
     webhook_secret = None
     personal_account_name = None
     personal_account_token = None
+    # Users trusted on every repository the bot is installed on, regardless of
+    # their GitHub permissions there. Empty by default, never None, so that
+    # validate() does not treat "no superusers" as missing configuration.
+    superusers: list = []
 
     def __init__(self, **kwargs):
         self.__dict__.update(kwargs)
@@ -644,6 +648,7 @@ def __init__(self, commands, config):
             self.config.key,
             self.config.personal_account_token,
             self.config.personal_account_name,
+            self.config.superusers,
         )
 
     def sig_handler(self, sig, frame):

meeseeksdev/meeseeksbox/utils.py

@@ -6,7 +6,7 @@
 import re
 import shlex
 import subprocess
-from typing import Any, Dict, Optional, cast
+from typing import Any, Dict, Optional, Sequence, cast
 
 import jwt
 import requests
@@ -96,6 +96,7 @@ def __init__(
         rsadata: Optional[str],
         personal_account_token: Optional[str],
         personal_account_name: Optional[str],
+        superusers: Sequence[str] = (),
     ):
         self.since = int(datetime.datetime.now().timestamp())
         self.duration = 60 * 10
@@ -104,6 +105,7 @@ def __init__(
         self.rsadata = rsadata
         self.personal_account_token = personal_account_token
         self.personal_account_name = personal_account_name
+        self.superusers = frozenset(u.lower() for u in superusers)
         self.idmap: Dict[str, str] = {}
         self._org_idmap: Dict[str, str] = {}
         self._session_class = Session
@@ -120,6 +122,7 @@ def session(self, installation_id: str) -> "Session":
             installation_id,
             self.personal_account_token,
             self.personal_account_name,
+            self.superusers,
         )
 
     def get_session(self, org_repo):
@@ -234,8 +237,11 @@ def __init__(
         installation_id,
         personal_account_token,
         personal_account_name,
+        superusers=(),
     ):
-        super().__init__(integration_id, rsadata, personal_account_token, personal_account_name)
+        super().__init__(
+            integration_id, rsadata, personal_account_token, personal_account_name, superusers
+        )
         self.installation_id = installation_id
 
     def token(self) -> str:
@@ -344,6 +350,12 @@ def prepare():
             return response  # type:ignore[no-any-return]
 
     def _get_permission(self, org: str, repo: str, username: str) -> Permission:
+        # Superusers are the people running this deployment. They are trusted
+        # everywhere the bot is installed, whatever GitHub says about their
+        # access to any one repository, so short-circuit before asking.
+        if username.lower() in self.superusers:
+            print("superuser", username, "granted admin on", org, repo)
+            return Permission.admin
         get_collaborators_query = API_COLLABORATORS_TEMPLATE.format(
             org=org, repo=repo, username=username
         )