fix(api): restrict approval decisions to server auth

[JSONbored]

Motivation

• Prevent cookie-backed browser OAuth sessions from reaching the state-changing agent pending-action decision endpoints (/accept / /reject) which opened a CSRF-exploitable path by coarse allowlisting the whole pending-actions family.

Description

• Narrow the isRepoAgentPendingActionsPath regex in src/api/routes.ts so it matches only the read-only list endpoint (/v1/repos/:owner/:repo/agent/pending-actions) and no longer admits /:id/accept or /:id/reject for session auth.
• Clarify the allowlist comment to document that decision POSTs require server (bearer) auth while the list remains reachable to maintainer sessions.
• Add a regression unit test in test/unit/routes-agent-approval.test.ts asserting that a repository-owner browser session receives 403 and does not execute an approval POST, leaving the queued action pending.

Testing

• Ran targeted unit tests with npx vitest run test/unit/routes-agent-approval.test.ts test/unit/access-boundary.test.ts and both suites passed.
• Ran npm run ui:openapi:check which succeeded to confirm OpenAPI parity.
• Attempted a full coverage run with npm run test:coverage but the local unsharded run could not be completed in this environment due to long-running suites/timeouts, so a complete coverage report was not produced here.

---

Codex Task

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ Gittensory review result - approve/merge recommended

_{Review updated: 2026-07-05 04:40:12 UTC}

2 files · 1 AI reviewer · no blockers · readiness 93/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This change narrows the session-auth allowlist to the read-only pending-actions list route, so cookie-backed browser sessions no longer reach the state-changing accept/reject endpoints. The regression test drives the real POST route with a repository-owner session and verifies both the 403 response and that the pending action remains pending, which covers the security boundary the PR claims to fix. I do not see a reachable correctness or contract break in the diff.

Nits — 2 non-blocking

• nit: test/unit/routes-agent-approval.test.ts:166 covers the accept decision path only; accept and reject share the same route regex, but adding the reject variant would make the CSRF regression intent harder to accidentally weaken later.
• test/unit/routes-agent-approval.test.ts:166 could parameterize the decision segment over `["accept", "reject"]` so both state-changing endpoints stay pinned to server-token-only auth.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 56 registered-repo PR(s), 46 merged, 416 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 56 PR(s), 416 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 56 PR(s), 416 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Explain no-issue PR.
• No action.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.14%. Comparing base (c6813b5) to head (783d290).
⚠️ Report is 44 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3350   +/-   ##
=======================================
  Coverage   94.14%   94.14%           
=======================================
  Files         276      276           
  Lines       30246    30246           
  Branches    11021    11021           
=======================================
  Hits        28474    28474           
  Misses       1127     1127           
  Partials      645      645           

Files with missing lines	Coverage Δ
src/api/routes.ts	94.72% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Gittensory approves — the gate is satisfied and CI is green.