feat(control-panel): add authenticated maintainer settings update

apps/gittensory-ui/public/openapi.json

@@ -12817,6 +12817,36 @@
         ]
       }
     },
+    "/v1/app/repos/{owner}/{repo}/settings": {
+      "post": {
+        "responses": {
+          "200": {
+            "description": "Updated repository automation settings (requires maintainer, owner, or operator role with repo access)",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RepositorySettings"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Invalid repository settings"
+          },
+          "403": {
+            "description": "Insufficient role or repo access"
+          }
+        },
+        "security": [
+          {
+            "GittensoryBearer": []
+          },
+          {
+            "GittensorySessionCookie": []
+          }
+        ]
+      }
+    },
     "/v1/repos/{owner}/{repo}/settings-preview": {
       "post": {
         "responses": {

scripts/check-mcp-release-due.mjs

@@ -83,6 +83,11 @@ async function upsertIssue(report) {
   if (!token) throw new Error("GITHUB_TOKEN is required for --upsert-issue");
   const [owner, repo] = repository.split("/");
   if (!owner || !repo) throw new Error(`Invalid GITHUB_REPOSITORY: ${repository}`);
+  const issuesEnabled = await checkIssuesEnabled({ owner, repo, token });
+  if (!issuesEnabled) {
+    process.stderr.write("Issues are disabled in this repository — skipping issue upsert.\n");
+    return;
+  }
 
   const issue = buildMcpReleaseIssue(report);
   const existingIssue = await findExistingIssue({ owner, repo, token });
@@ -133,6 +138,20 @@ export function isReleaseWatchIssue(issue) {
   );
 }
 
+async function checkIssuesEnabled({ owner, repo, token }) {
+  const response = await fetch(`https://api.github.com/repos/${owner}/${repo}`, {
+    headers: {
+      accept: "application/vnd.github+json",
+      authorization: `Bearer ${token}`,
+      "user-agent": "gittensory-mcp-release-watch",
+      "x-github-api-version": "2022-11-28",
+    },
+  });
+  if (!response.ok) return false;
+  const payload = await response.json();
+  return payload.has_issues === true;
+}
+
 async function githubRequest({ token, method, path, body }) {
   const response = await fetch(`https://api.github.com${path}`, {
     method,

src/api/routes.ts

@@ -1676,6 +1676,60 @@ export function createApp() {
     return c.json(await getRepositorySettings(c.env, fullName));
   });
 
+  app.post("/v1/app/repos/:owner/:repo/settings", async (c) => {
+    const forbidden = await requireAppRole(c, ["maintainer", "owner", "operator"]);
+    if (forbidden) return forbidden;
+    const fullName = `${c.req.param("owner")}/${c.req.param("repo")}`;
+    const identity = await authenticateRequestIdentity(c);
+    const repo = await getRepository(c.env, fullName);
+    if (identity?.kind === "session") {
+      const repoForbidden = await requireSessionRepoAccess(c, identity, fullName, repo);
+      if (repoForbidden) return repoForbidden;
+    }
+    const body = await c.req.json().catch(() => null);
+    if (body === null) return c.json({ error: "invalid_request_body" }, 400);
+    const parsed = repositorySettingsSchema.safeParse(body);
+    if (!parsed.success) return c.json({ error: "invalid_repository_settings", issues: parsed.error.issues }, 400);
+    const updated = await upsertRepositorySettings(c.env, {
+      repoFullName: fullName,
+      commentMode: parsed.data.commentMode,
+      publicAudienceMode: parsed.data.publicAudienceMode,
+      publicSignalLevel: parsed.data.publicSignalLevel,
+      checkRunMode: parsed.data.checkRunMode,
+      checkRunDetailLevel: parsed.data.checkRunDetailLevel,
+      gateCheckMode: parsed.data.gateCheckMode,
+      linkedIssueGateMode: parsed.data.linkedIssueGateMode,
+      duplicatePrGateMode: parsed.data.duplicatePrGateMode,
+      qualityGateMode: parsed.data.qualityGateMode,
+      qualityGateMinScore: parsed.data.qualityGateMinScore,
+      autoLabelEnabled: parsed.data.autoLabelEnabled,
+      gittensorLabel: parsed.data.gittensorLabel,
+      createMissingLabel: parsed.data.createMissingLabel,
+      publicSurface: parsed.data.publicSurface,
+      includeMaintainerAuthors: parsed.data.includeMaintainerAuthors,
+      requireLinkedIssue: parsed.data.requireLinkedIssue,
+      backfillEnabled: parsed.data.backfillEnabled,
+      privateTrustEnabled: parsed.data.privateTrustEnabled,
+      commandAuthorization: normalizeCommandAuthorizationPolicy(parsed.data.commandAuthorization).policy,
+    });
+    await recordAuditEvent(c.env, {
+      eventType: "settings.updated",
+      actor: identity?.actor ?? null,
+      route: c.req.path,
+      targetKey: fullName,
+      outcome: "success",
+      detail: `Maintainer updated settings for ${fullName}`,
+      metadata: {
+        publicSurface: parsed.data.publicSurface,
+        checkRunMode: parsed.data.checkRunMode,
+        autoLabelEnabled: parsed.data.autoLabelEnabled,
+        includeMaintainerAuthors: parsed.data.includeMaintainerAuthors,
+        requireLinkedIssue: parsed.data.requireLinkedIssue,
+      },
+    });
+    return c.json(updated);
+  });
+
   app.post("/v1/repos/:owner/:repo/settings-preview", async (c) => {
     const identity = await authenticateRequestIdentity(c);
     const fullName = `${c.req.param("owner")}/${c.req.param("repo")}`;
@@ -3839,4 +3893,5 @@ export const __routesInternals = {
   buildExtensionPrivateBlockers,
   ensureExtensionPublicSafeText,
   authenticateRequestIdentity,
+  extensionQueueLevel,
 };

src/openapi/spec.ts

@@ -443,6 +443,15 @@ export function buildOpenApiSpec() {
       200: { description: "Gittensory repository automation settings", content: { "application/json": { schema: RepositorySettingsSchema } } },
     },
   });
+  registry.registerPath({
+    method: "post",
+    path: "/v1/app/repos/{owner}/{repo}/settings",
+    responses: {
+      200: { description: "Updated repository automation settings (requires maintainer, owner, or operator role with repo access)", content: { "application/json": { schema: RepositorySettingsSchema } } },
+      400: { description: "Invalid repository settings" },
+      403: { description: "Insufficient role or repo access" },
+    },
+  });
   registry.registerPath({
     method: "post",
     path: "/v1/repos/{owner}/{repo}/settings-preview",