fix(auth): scope issue-quality reports to repo access

[JSONbored]

Motivation

• Issue-quality reports (REST and MCP) could be retrieved by any bearer-authenticated identity because authenticatePrivateToken accepts session tokens and the loader returned cached snapshots without caller-scoped authorization, exposing private issue titles and triage signals.
• The goal is to enforce repository-scoped access checks before loading or returning sensitive issue-quality payloads so sessions cannot enumerate private repo metadata.

Description

• Require an authenticated identity and apply requireSessionRepoAccess before returning /v1/repos/:owner/:repo/issue-quality in src/api/routes.ts so session callers must have repo access before the report is loaded.
• Add an isIssueQualityPath matcher and allow the route to be considered by session path-scoping helpers so the global protected-route middleware and route-specific guard work together.
• Add canAccessRepo to the MCP server and gate gittensory_get_issue_quality in src/mcp/server.ts to return a non-leaking forbidden payload when the caller lacks access.
• Add regression tests that assert unrelated session tokens receive 403 on the REST endpoint and that the MCP tool returns a forbidden payload without leaking snapshot contents (test/integration/api.test.ts and test/unit/mcp-upstream.test.ts).

Testing

• Ran the focused test subset with npm exec vitest run test/unit/mcp-upstream.test.ts test/integration/api.test.ts -- --reporter=verbose and the tests passed.
• Ran static type checks with npm run typecheck and the TypeScript check completed successfully.
• New assertions verify REST returns 403 with { error: "forbidden_repo" } for unrelated sessions and MCP returns a { status: "forbidden", repoFullName } payload without exposing sensitive report fields.

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	85a8bf8	Commit Preview URL Branch Preview URL	Jun 10 2026, 05:52 AM

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#483 is no longer open.	No action.

---

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.