feat(broker): drop the repo allowlist from the broker config #65

Merged

lucas merged 1 commit from 64-remove-the-repo-allowlist-from-the-forgejo-admin-broker-config into main

2026-10-25 17:03:16 +01:00

omp-deck commented

2026-10-25 16:57:56 +01:00

Collaborator

The Forgejo admin broker no longer has a repos allowlist. POST /permission answers for any owner/name. Which repositories reach it is already limited by the agent account's collaborator access and by the configured webhooks. The broker config is now {forgejoUrl, adminToken, webhookSecret}. A leftover repos key, in an existing config or in an old unfilled template, is ignored silently. The template check only looks for an empty forgejoUrl and adminToken. The entrypoint template, the checkPermission doc comment and the docs are updated to match.

Verification

bun run typecheck: all workspaces pass.
apps/broker: bun test, 17 pass. New tests: a leftover repos key is ignored; a template with or without repos counts as unconfigured; /permission for other/x returns 200 with the level.
apps/server: bun test, 866 pass.
sh -n docker/entrypoint.sh passes, and the generated template heredoc parses with jq.
Broker smoke test with a 0600 config that still contains "repos": ["a/b"]: the broker starts. POST /permission {"repo":"other/x","user":"alice"} reaches Forgejo; with no Forgejo running it returns 502 forgejo unreachable, where it used to return 403 repository not allowed.

Closes #64

The Forgejo admin broker no longer has a `repos` allowlist. `POST /permission` answers for any `owner/name`. Which repositories reach it is already limited by the agent account's collaborator access and by the configured webhooks. The broker config is now `{forgejoUrl, adminToken, webhookSecret}`. A leftover `repos` key, in an existing config or in an old unfilled template, is ignored silently. The template check only looks for an empty `forgejoUrl` and `adminToken`. The entrypoint template, the `checkPermission` doc comment and the docs are updated to match. ## Verification - `bun run typecheck`: all workspaces pass. - `apps/broker`: `bun test`, 17 pass. New tests: a leftover `repos` key is ignored; a template with or without `repos` counts as unconfigured; `/permission` for `other/x` returns 200 with the level. - `apps/server`: `bun test`, 866 pass. - `sh -n docker/entrypoint.sh` passes, and the generated template heredoc parses with `jq`. - Broker smoke test with a 0600 config that still contains `"repos": ["a/b"]`: the broker starts. `POST /permission {"repo":"other/x","user":"alice"}` reaches Forgejo; with no Forgejo running it returns 502 `forgejo unreachable`, where it used to return 403 `repository not allowed`. Closes #64

omp-deck added 1 commit

2026-10-25 16:57:57 +01:00

feat(broker): drop the repo allowlist from the broker config a96e168dcb

The broker now answers permission checks for any repository; the agent
account's collaborator access and the configured webhooks already limit
which repositories reach it. A leftover `repos` key in an existing config
or template is ignored.

Refs #64

Co-Authored-By: Claude Opus 5.5 via omp-deck

omp-deck referenced this pull request

2026-10-25 16:57:59 +01:00

Remove the repo allowlist from the Forgejo admin broker config #64

lucas approved these changes

2026-10-25 17:03:11 +01:00

omp-deck commented

2026-10-25 17:03:12 +01:00

Author

Collaborator

omp-deck failed to handle this event: an internal error occurred.

Details are in omp-deck under webhook delivery 49cda3e6-1741-4cd8-8027-8ae1e7a3058f.

omp-deck failed to handle this event: an internal error occurred. Details are in omp-deck under webhook delivery `49cda3e6-1741-4cd8-8027-8ae1e7a3058f`.