import * as pulumi from '@pulumi/pulumi';

import * as github from '@pulumi/github';

import { ROLES, type Role, buildRoleLookup } from './config/roles';

import { REPOSITORY_ACCESS } from './config/repoAccess';

import { ORG_ROLE_ASSIGNMENTS } from './config/orgRoles';

import { ORG_SETTINGS } from './config/orgSettings';

import { MEMBERS } from './config/users';

import { sortRolesByGitHubDependency } from './config/utils';

import type { RoleId } from './config/roleIds';

const config = new pulumi.Config();

// The provider's Create for this resource is a PATCH on the existing org, so

// no import is needed; first apply writes the values below directly.

new github.OrganizationSettings(

'org-settings',

{

...ORG_SETTINGS,

billingEmail: config.requireSecret('githubBillingEmail'),

},

{ additionalSecretOutputs: ['billingEmail'] }

);

const roleLookup = buildRoleLookup();

// Teams keyed by GitHub team name (matches repoAccess.ts references)

const teams: Record<string, github.Team> = {};

// Sort roles so parent teams are created before child teams

const sortedRoles = sortRolesByGitHubDependency(ROLES, roleLookup);

// Create GitHub teams for roles that have GitHub config

sortedRoles.forEach((role: Role) => {

if (!role.github) return;

// Resolve parent team ID if specified

// Parent is guaranteed to exist in `teams` due to topological sort

let parentTeamId: github.Team['id'] | undefined;

if (role.github.parent) {

const parentRole = roleLookup.get(role.github.parent);

if (parentRole?.github) {

parentTeamId = teams[parentRole.github.team]?.id;

}

}

teams[role.github.team] = new github.Team(role.github.team, {

name: role.github.team,

description: role.description + ' \n(Managed by github.com/modelcontextprotocol/access)',

privacy: 'closed',

parentTeamId,

});

});

// Create team memberships

MEMBERS.forEach((member) => {

if (!member.github) return;

member.memberOf.forEach((roleId: RoleId) => {

const role = roleLookup.get(roleId);

if (!role?.github) return; // Role doesn't have GitHub config

new github.TeamMembership(`${member.github}-${role.github.team}`, {

teamId: teams[role.github.team].id,

username: member.github!,

role: 'member',

});

});

});

// Assign organization-level roles to teams (grants access across all repos)

const orgRoles = github.getOrganizationRolesOutput();

ORG_ROLE_ASSIGNMENTS.forEach((assignment) => {

const team = teams[assignment.team];

if (!team) {

throw new Error(

`orgRoles.ts references team '${assignment.team}' which is not managed in roles.ts`

);

}

const roleId = orgRoles.roles.apply((roles) => {

const match = roles.find((r) => r.name === assignment.role);

if (!match) throw new Error(`Organization role '${assignment.role}' not found`);

return match.roleId;

});

new github.OrganizationRoleTeam(`orgrole-${assignment.team}-${assignment.role}`, {

teamSlug: team.slug,

roleId,

});

});

// Configure repository access

REPOSITORY_ACCESS.forEach((repo) => {

new github.RepositoryCollaborators(`repo-${repo.repository}`, {

repository: repo.repository,

teams: repo.teams?.map((t) => ({

teamId: teams[t.team]?.id,

permission: t.permission,

})),

users: repo.users?.map((u) => ({

username: u.username,

permission: u.permission,

})),

});

});

export { teams as githubTeams };