fix(worker): Permission syncer fixes

[brendan-kellam]

Fixes two issues:

1. The repo driven permission syncer was including public repositories when scheduling. This is a issue because a) it's wasted work since public repositories are always included in queries regardless of a user's permissions (see userScopedPrismaClientExtension in /web/src/prisma.ts and b) the /collaborators endpoint may not be accessible to the provided token. For example, consider this config:

{
    "connections": {
        "my-connection": {
            "type": "github",
            "orgs": [
                "sourcebot-dev",
                "codemirror"
            ],
            "token": {
                "env": "GITHUB_TOKEN"
            }
        }
    }
}

Assuming GITHUB_TOKEN is a fine-grained access token with access to sourcebot-dev, then this connection will sync with all public and private repositories in sourcebot-dev, and all public repositories in codemirror. Previously, when the codemirror repositories permissions were synced, we would hit 403s because GITHUB_TOKEN is not scoped to the codemirror org.

The other way of viewing this is that by filtering out public repositories during syncing, we are guaranteed that whatever repositories we do sync will have their /collaborators endpoint accessible by the fact that they were accessible during connection syncing.

2. If a permission sync job (user or repo) was in progress, it would block the worker from exiting. Added a force = true option to worker.close to prevent this behaviour.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch bkellam/permission_syncer_improvements

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}