test: forward-direction issue-comment permission separation (#137 follow-up) #140

2026-07-05T01:41:14-05:00

jcwalker3 commented

2026-07-05 01:41:14 -05:00

Refs #137 (closed by #138), groundwork for #139 requirement 9.

Summary

PR #138 added the issue.comment alias, example grants, and alias-normalization tests. This follow-up adds the forward-direction permission-separation guards the #137 migration decision requires but which only existed in the reverse direction (test_review_permissions_do_not_grant_issue_comments):

gitea.issue.comment does not imply issue close
gitea.issue.comment does not imply PR review/approve/merge/request_changes
gitea.issue.comment does not imply branch push / repo commit / branch create / PR create
gitea.pr.comment does not imply gitea.issue.comment
the exact pre-#137 live prgs-author op set still fails closed with the operator-facing reason string (regression pin for the #51 audit blocker)
shipped v1/v2 example configs keep granting issue comments (guards the example side of the migration)
v2 examples preserve role separation: author examples never gain approve/merge, reviewer examples never gain push/commit

Files changed

tests/test_mcp_server.py only (+1 import, +1 test class, 8 tests). No production code.

Validation

pytest tests/ -q: 523 passed, 6 skipped (515 baseline + 8 new)
py_compile on the test file: OK
git diff --check: clean; secret sweep: 0 hits (example keychain item names only, which the repo already ships)

Verification note

This PR was authored while the running MCP session was failing closed on the stale pre-#138 alias table (every tool returning "operation issue.comment cannot be normalized"). This CLI invocation itself runs the post-#138 code against the live config successfully — confirming the #138 fix + live-config migration work together and only the MCP session reconnect remains.

Generated with Claude Code

Refs #137 (closed by #138), groundwork for #139 requirement 9. ## Summary PR #138 added the `issue.comment` alias, example grants, and alias-normalization tests. This follow-up adds the forward-direction permission-separation guards the #137 migration decision requires but which only existed in the reverse direction (`test_review_permissions_do_not_grant_issue_comments`): - `gitea.issue.comment` does **not** imply issue close - `gitea.issue.comment` does **not** imply PR review/approve/merge/request_changes - `gitea.issue.comment` does **not** imply branch push / repo commit / branch create / PR create - `gitea.pr.comment` does **not** imply `gitea.issue.comment` - the exact pre-#137 live `prgs-author` op set still fails closed with the operator-facing reason string (regression pin for the #51 audit blocker) - shipped v1/v2 example configs keep granting issue comments (guards the example side of the migration) - v2 examples preserve role separation: author examples never gain approve/merge, reviewer examples never gain push/commit ## Files changed - `tests/test_mcp_server.py` only (+1 import, +1 test class, 8 tests). No production code. ## Validation - `pytest tests/ -q`: **523 passed, 6 skipped** (515 baseline + 8 new) - `py_compile` on the test file: OK - `git diff --check`: clean; secret sweep: 0 hits (example keychain item *names* only, which the repo already ships) ## Verification note This PR was authored while the running MCP session was failing closed on the stale pre-#138 alias table (every tool returning "operation issue.comment cannot be normalized"). This CLI invocation itself runs the post-#138 code against the live config successfully — confirming the #138 fix + live-config migration work together and only the MCP session reconnect remains. Generated with [Claude Code](https://claude.com/claude-code)

jcwalker3 added 1 commit 2026-07-05 01:41:14 -05:00

test: forward-direction issue-comment permission separation (#137 follow-up) 9b84ecf592

PR #138 added the issue.comment alias and example grants. Add the
forward-direction separation guards the migration decision requires:
gitea.issue.comment never implies issue close, PR review/approve/merge,
or branch push / repo commit; gitea.pr.comment never implies
gitea.issue.comment; the pre-#137 live author op set still fails closed
with the exact operator-facing reason; and the shipped v1/v2 example
configs keep granting issue comments while preserving author/reviewer
role separation.

Refs #137, #139

Co-Authored-By: Claude Fable 5 <[email protected]>

jcwalker3 referenced this pull request

2026-07-05 01:44:48 -05:00

Make Gitea MCP task routing role-aware instead of launcher-profile dependent #139

sysadmin reviewed 2026-07-05 01:47:05 -05:00

sysadmin left a comment

Reviewed at pinned head 9b84ecf as sysadmin/prgs-reviewer.

Scope: tests only (tests/test_mcp_server.py, +96) — matches PR/issue exactly. Validation: targeted 8/8; full suite 523 passed, 6 skipped; py_compile OK; git diff --check clean; secret sweep 0 hits.

Separation matrix verified against the #137 requirements: issue.comment implies none of issue close / review / approve / merge / request_changes / branch push / repo commit / branch create / PR create; pr.comment does not imply issue.comment; pre-#137 live author op set pinned with the exact fail-closed reason; v1+v2 examples keep the grant while preserving author/reviewer role separation. No production code, no config, no dynamic-switching scope.

Nit (non-blocking, follow-up welcome): test_pre_137_author_op_set_fails_closed does not patch api_request — safe today because the cleared env cannot resolve credentials and the gate precedes auth, but patching it would make the no-network guarantee explicit.

Reviewed at pinned head 9b84ecf as sysadmin/prgs-reviewer. Scope: tests only (tests/test_mcp_server.py, +96) — matches PR/issue exactly. Validation: targeted 8/8; full suite 523 passed, 6 skipped; py_compile OK; git diff --check clean; secret sweep 0 hits. Separation matrix verified against the #137 requirements: issue.comment implies none of issue close / review / approve / merge / request_changes / branch push / repo commit / branch create / PR create; pr.comment does not imply issue.comment; pre-#137 live author op set pinned with the exact fail-closed reason; v1+v2 examples keep the grant while preserving author/reviewer role separation. No production code, no config, no dynamic-switching scope. Nit (non-blocking, follow-up welcome): test_pre_137_author_op_set_fails_closed does not patch api_request — safe today because the cleared env cannot resolve credentials and the gate precedes auth, but patching it would make the no-network guarantee explicit.

sysadmin merged commit 3c1ab87e1b into master

2026-07-05 01:47:26 -05:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Scaled-Tech-Consulting/Gitea-Tools#140