Adds access check to integrations

Enforces access check

Author: eamodio

src/autolinks.ts

@@ -188,6 +188,7 @@ export class Autolinks implements Disposable {
 		await Promise.allSettled(
 			supportedAutolinkIntegrations.map(async integrationId => {
 				const integration = await this.container.integrations.get(integrationId);
+				// Don't check for integration access, as we want to allow autolinks to always be generated
 				const autoLinks = await integration.autolinks();
 				if (autoLinks.length) {
 					refsets.push([integration, autoLinks]);
@@ -198,6 +199,7 @@ export class Autolinks implements Disposable {
 		// Remote-specific autolinks and remote integration autolinks
 		if (remote?.provider != null) {
 			const autoLinks = [];
+			// Don't check for integration access, as we want to allow autolinks to always be generated
 			const integrationAutolinks = await (await remote.getIntegration())?.autolinks();
 			if (integrationAutolinks?.length) {
 				autoLinks.push(...integrationAutolinks);
@@ -293,7 +295,7 @@ export class Autolinks implements Disposable {
 		let integration = await remote?.getIntegration();
 		if (integration != null) {
 			const connected = integration.maybeConnected ?? (await integration.isConnected());
-			if (!connected) {
+			if (!connected || !(await integration.access())) {
 				integration = undefined;
 			}
 		}
@@ -305,7 +307,7 @@ export class Autolinks implements Disposable {
 				: undefined;
 			if (linkIntegration != null) {
 				const connected = linkIntegration.maybeConnected ?? (await linkIntegration.isConnected());
-				if (!connected) {
+				if (!connected || !(await linkIntegration.access())) {
 					linkIntegration = undefined;
 				}
 			}

src/plus/integrations/integration.ts

@@ -25,6 +25,7 @@ import { Logger } from '../../system/logger';
 import type { LogScope } from '../../system/logger.scope';
 import { getLogScope } from '../../system/logger.scope';
 import { configuration } from '../../system/vscode/configuration';
+import { isSubscriptionStatePaidOrTrial } from '../gk/account/subscription';
 import type {
 	IntegrationAuthenticationProviderDescriptor,
 	IntegrationAuthenticationService,
@@ -107,6 +108,11 @@ export abstract class IntegrationBase<
 		return this.id;
 	}
 
+	async access(): Promise<boolean> {
+		const subscription = await this.container.subscription.getSubscription();
+		return isSubscriptionStatePaidOrTrial(subscription.state);
+	}
+
 	autolinks():
 		| (AutolinkReference | DynamicAutolinkReference)[]
 		| Promise<(AutolinkReference | DynamicAutolinkReference)[]> {

src/plus/integrations/providers/github.ts

@@ -265,6 +265,11 @@ export class GitHubIntegration extends GitHubIntegrationBase<HostingIntegrationI
 		return 'https://api.github.com';
 	}
 
+	override access(): Promise<boolean> {
+		// Always allow GitHub cloud integration access
+		return Promise.resolve(true);
+	}
+
 	// This is a special case for GitHub because we use VSCode's GitHub session, and it can be disconnected
 	// outside of the extension.
 	override async refresh() {

src/plus/integrations/providers/gitlab.ts

@@ -322,6 +322,11 @@ export class GitLabIntegration extends GitLabIntegrationBase<HostingIntegrationI
 	protected get apiBaseUrl(): string {
 		return 'https://gitlab.com/api';
 	}
+
+	override access(): Promise<boolean> {
+		// Always allow GitHub cloud integration access
+		return Promise.resolve(true);
+	}
 }
 
 export class GitLabSelfHostedIntegration extends GitLabIntegrationBase<SelfHostedIntegrationId.GitLabSelfHosted> {