Restrict Organizations (Public GitHub)

[jonsharratt]

What did you implement:

Closes #36

Allow new environment variable CODEBOX_RESTRICTED_ORGS you can set with comma separated list of organization names that are only allowed access. e.g. org1,org2.

This allows organisations on public GitHub the ability to grant access to their GitHub application and ensure only those part of the restricted organizations list can then get access to your registry.

Without setting this environment variable anyone with a GitHub / GitHub Enterprise account can have read access to your npm registry by default. We want to allow read access by default as in the enterprise we want to foster productivity and not hamper access in order for npm installs to work.

How did you implement it:

• Widened scope to include ability to read user organisations
• If CODEBOX_RESTRICTED_ORGS variable is set then check access against github to see if the user belongs to that org if so they get access.
• Admins are still explicitly set using CODEBOX_ADMINS variable as organization roles in GitHub are either member or admin which is way too wide to cater for gradual roll out of publishers. Not all team members will be admins of an organization that should have publish rights.

How can we verify it:

• Deploy this branch with relevant env vars / situations set with public github
• Deploy this branch with relevant env vars / situations set with enterprise github
• Check npm info operation and npm publish

Todos:

• Write tests
• Write documentation
• Fix linting errors
• Tag ready for review or wip

Is this a breaking change?: NO