appview/pulls: show branch delete only if the logged-in-user can push to the repo

Signed-off-by: oppiliappan <[e-mail]>

appview/pulls/pulls.go

···
 	"fmt"
 	"log"
 	"net/http"
+	"slices"
 	"sort"
 	"strconv"
 	"strings"
···
 	"tangled.org/core/appview/xrpcclient"
 	"tangled.org/core/idresolver"
 	"tangled.org/core/patchutil"
+	"tangled.org/core/rbac"
 	"tangled.org/core/tid"
 	"tangled.org/core/types"
 
···
 	db           *db.DB
 	config       *config.Config
 	notifier     notify.Notifier
+	enforcer     *rbac.Enforcer
 }
 
 func New(
···
 	db *db.DB,
 	config *config.Config,
 	notifier notify.Notifier,
+	enforcer *rbac.Enforcer,
 ) *Pulls {
 	return &Pulls{
 		oauth:        oauth,
···
 		db:           db,
 		config:       config,
 		notifier:     notifier,
+		enforcer:     enforcer,
 	}
 }
 
···
 		branch = pull.PullSource.Branch
 		repo = pull.PullSource.Repo
 	} else {
+		return nil
+	}
+
+	// user can only delete branch if they are a collaborator in the repo that the branch belongs to
+	perms := s.enforcer.GetPermissionsInRepo(user.Did, repo.Knot, repo.DidSlashRepo())
+	if !slices.Contains(perms, "repo:push") {
 		return nil
 	}
 

appview/state/router.go

···
 }
 
 func (s *State) PullsRouter(mw *middleware.Middleware) http.Handler {
-	pulls := pulls.New(s.oauth, s.repoResolver, s.pages, s.idResolver, s.db, s.config, s.notifier)
+	pulls := pulls.New(s.oauth, s.repoResolver, s.pages, s.idResolver, s.db, s.config, s.notifier, s.enforcer)
 	return pulls.Router(mw)
 }