Add permissions check to valid_owner

internal/check/valid_owner.go

@@ -139,7 +139,7 @@ func (v *ValidOwner) initOrgListTeams(ctx context.Context) *validateError {
 		PerPage: 100,
 	}
 	for {
-		resultPage, resp, err := v.ghClient.Repositories.ListTeams(ctx, v.orgName, v.orgRepoName, req)
+		resultPage, resp, err := v.ghClient.Teams.ListTeams(ctx, v.orgName, req)
 		if err != nil { // TODO(mszostok): implement retry?
 			switch err := err.(type) {
 			case *github.ErrorResponse:
@@ -192,7 +192,59 @@ func (v *ValidOwner) validateTeam(ctx context.Context, name string) *validateErr
 	}
 
 	if !teamExists() {
-		return newValidateError("Team %q does not exist in organization %q or has no permissions associated with the repository.", team, org)
+		return newValidateError("Team %q does not exist in organization %q.", team, org)
+	}
+
+	// repo contains the permissions for the team slug given
+	// TODO(mszostok): Switch to GraphQL API, see:
+	//   https://github.com/mszostok/codeowners-validator/pull/62#discussion_r561273525
+	repo, _, err := v.ghClient.Teams.IsTeamRepoBySlug(ctx, v.orgName, team, org, v.orgRepoName)
+	if err != nil { // TODO(mszostok): implement retry?
+		switch err := err.(type) {
+		case *github.ErrorResponse:
+			if err.Response.StatusCode == http.StatusUnauthorized {
+				return newValidateError(
+					"Team permissions information for %q/%q could not be queried. Requires GitHub authorization.",
+					org, v.orgRepoName)
+			} else if err.Response.StatusCode == http.StatusNotFound {
+				return newValidateError(
+					"Team %q does not have permissions associated with the repository %q.",
+					team, v.orgRepoName)
+			} else {
+				return newValidateError("HTTP error occurred while calling GitHub: %v", err)
+			}
+		case *github.RateLimitError:
+			return newValidateError("GitHub rate limit reached: %v", err.Message)
+		default:
+			return newValidateError("Unknown error occurred while calling GitHub: %v", err)
+		}
+	}
+
+	teamHasWritePermission := func() bool {
+		for k, v := range repo.GetPermissions() {
+			if !v {
+				continue
+			}
+
+			switch k {
+			case
+				"admin",
+				"maintain",
+				"push":
+				return true
+			case
+				"pull",
+				"triage":
+			}
+		}
+
+		return false
+	}
+
+	if !teamHasWritePermission() {
+		return newValidateError(
+			"Team %q cannot review PRs on %q as neither it nor any parent team does not have write permissions.",
+			team, v.orgRepoName)
 	}
 
 	return nil