fix(auth): enforce repo-scoped access for self-dogfood registration pack

[JSONbored]

Motivation

• The app-level /v1/app/self-dogfood/registration-pack route performed a global role check (requireAppRole) but did not verify that a browser session actually had access to the configured self-dogfood repository, allowing maintainers of unrelated repos to view a private report.

Description

• Require the resolved self-dogfood repo and its RepositoryRecord inside the app route and call requireSessionRepoAccess for session identities before returning the pack.
• Preserve existing app-role guard by keeping the requireAppRole check and only adding a repo-scoped access check for browser sessions.
• Add unit tests and a seedInstalledRepo helper to cover the new behavior, verifying that an unrelated repo-scoped session receives forbidden_repo and that a session scoped to the configured repo is allowed.
• Update imports in the test to seed installations and repositories for the auth scenarios.

Testing

• Ran npm run test:unit -- test/unit/routes-self-dogfood-registration-pack.test.ts and the added tests passed.
• Ran tsc --noEmit via npm run typecheck and typechecking succeeded.
• The full unit test run in this environment completed successfully (all tests passed).

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	988e6da	Commit Preview URL Branch Preview URL	Jun 10 2026, 06:12 AM

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#486 is no longer open.	No action.

---

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.