The engine is open. Read the code behind every claim.

function assertReviewerOrAdmin(user: User): void {
    if (!canReview(user)) {
        const err = new Error(
            user.agent?.reviewOnly
                ? 'An agent can’t approve or reject reviews: a person does.'
                : 'Only users with reviewer or admin role can perform this action'
        );
        (err as Error & { statusCode: number }).statusCode = 403;
        throw err;

export function needsApproval(
    user: WithRoles,
    project: { workflow?: { enabled?: boolean; requireReview?: boolean } | null } | null | undefined
): boolean {
    if (user?.agent?.reviewOnly) return true;
    return !!(
        project?.workflow?.enabled &&
        project.workflow.requireReview &&
        !hasRole(user, 'lead')
    );

if (allowed?.length && !allowed.includes(blockType)) {
    issues.push({
        type: 'error',
        code: 'BLOCK_TYPE_NOT_ALLOWED',
        message: `Block type "${blockType}" is not allowed for this field.`,
        path: `${blockPath}.type`
    });
    return;

const honeypotValue = body._honeypot;
const honeypotTriggered =
    form.honeypot !== false &&
    honeypotValue !== undefined &&
    honeypotValue !== null &&
    String(honeypotValue).trim() !== '';

/**
 * Limits a host puts on a project (api.moteur.io's plans). Moteur on its own has none: until a
 * plugin sets a resolver, every check passes.
 */

const { projectId, message, user } = payload;
const waiting = uncommitted.get(projectId);
const paths = [...new Set([...trackedPaths(payload.paths), ...(waiting ?? [])])];
if (paths.length === 0) return;

const project = await getProjectById(projectId);
if (!project) return;
if (project.git?.enabled === false) return;

const dir = projectDir(projectId);
if (!isGitRepo(dir)) return;

let commitHash: string;
try {
    commitHash = await addAndCommit(dir, paths, message, user);