fix(api): scope app command feedback by repo access

[JSONbored]

Motivation

• The app feedback endpoint accepted any authenticated identity and recorded feedback for arbitrary answer IDs, allowing non-maintainers to vote on answers and exposing repo/issue metadata for known answer IDs.
• The intent is to require repository-scoped access for session-based browser users before recording app-surface feedback or returning answer metadata, aligning the app path with the stricter GitHub reaction authorization policy.

Description

• Add a repository lookup and session-scoped guard before recording app command feedback by calling getRepository and requireSessionRepoAccess when identity.kind === "session" in the /v1/app/commands/feedback handler in src/api/routes.ts.
• Preserve the existing requireAppRole guard for control-panel roles and only enforce repo-scoped access for session identities to avoid widening static-token behavior.
• Add integration coverage in test/integration/api.test.ts to verify that an in-scope repo owner can submit feedback for their repository's answer while the same user is denied when using a known answer ID from an out-of-scope private repo.

Testing

• Ran the targeted integration suite with npx vitest run test/integration/api.test.ts --reporter verbose, and the integration file completed successfully (all tests passed).
• Ran static type checks with npm run typecheck (tsc --noEmit) and the typecheck completed without errors.

---

Codex Task

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#492 is no longer open.	No action.

---

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	ed43677	Commit Preview URL Branch Preview URL	Jun 10 2026, 06:38 AM

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.