feat(api): /v1/extension/* contributor-context endpoints + miner auth scope

[oktofeesh1]

Fixes #556.

Carves out the non-visual contributor (miner) backend of the extension overlay so the rebuilt extension (#534) can focus on rendering. No UI.

What this adds

New auth scope — extension:contributor_context

• Minted for non-maintainer sign-ins at POST /v1/auth/extension/session (maintainers still get extension:pull_context). The role branch keys off loadControlPanelRoleSummary.
• Strictly self-only: the coarse canSessionAccessPath allowlist only lets the scope reach /v1/extension/contributors/<login>/*, and every handler then enforces requireContributorAccess (actor === login). A miner token can read only its own data.

Three redaction-checked endpoints under /v1/extension/contributors/:login/:

• GET …/issue-fit?owner=&repo=&issueNumber= — "is this issue a good one for me?" → fit band (good/caution/hold), multiplier tier, availability, reasons. Reuses buildContributorOpportunities.
• GET …/pr-status?owner=&repo=&pullNumber= — the contributor's own PR readiness as a band (+ per-component met/partial/unmet, review status). Reuses buildPreflightResult + buildPublicReadinessScore. Also self-checks PR authorship.
• GET …/issue-badges?owner=&repo= — per-issue fit badges for an issue-list overlay.

Public/private boundary

• Every payload runs through a public-safe redaction guard (redactExtensionText) and the score is returned as a band, never a raw number — no score/total/max keys, and no reward/wallet/key/trust-score terms can leak (server-side authoritative).
• A miner token can only read its OWN contributor data (cross-login → 403).

Tests

• test/unit/extension-contributor-context.test.ts — bands, redaction, band-not-number, edge cases.
• test/integration/api.test.ts — scope minting for non-maintainers, self-only allowlist + cross-login 403, scope isolation (contributor scope can't reach the maintainer pull-context path), full success paths, validation 400s, 403/404 paths, forbidden-term redaction.
• npm run test:ci green; 97%+ branch & function coverage.

🤖 Generated with Claude Code

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#723 is no longer open.	No action.

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[ghost]

gittensory · advisory review

Reviewed 5 changed file(s) — two independent AI reviewers.

Changed files: src/api/routes.ts, src/signals/extension-contributor-context.ts, test/integration/api.test.ts, test/unit/extension-contributor-context.test.ts, test/unit/routes-extension.test.ts

Suggested action: ✅ Safe to merge — both reviewers found no blocking issues.

Reviewer A · gpt-oss-120b — recommends ✅ merge
The PR introduces a new public‑safe contributor‑context API for the browser extension, adds a strict self‑only auth scope, and includes comprehensive unit and integration tests. The implementation respects the privacy sanitizer, correctly limits token access, and appears type‑safe.

Suggestions

• Consider adding a test that a maintainer (extension:pull_context) token cannot access the new contributor‑only endpoints, to verify the inverse restriction.
• Document the EXTENSION_CONTRIBUTOR_CONTEXT_PATH regex pattern for future maintainers, noting it must match all current sub‑paths.

Worth double-checking

• Future endpoints under /v1/extension/contributors/:login/ must be added to the EXTENSION_CONTRIBUTOR_CONTEXT_PATH regex or else they may be unintentionally blocked.
• Ensure any new public‑facing text passes through redactExtensionText to avoid leaking forbidden terms.

Reviewer B · nemotron-3-120b-a12b — recommends ✅ merge
The PR adds three new endpoints (/v1/extension/contributors/:login/issue-fit, /v1/extension/contributors/:login/issue-badges, /v1/extension/contributors/:login/pr-status) for the browser extension's contributor context, along with auth scoping and data sanitization. It ensures contributor tokens are strictly self-only and public-safe by banding scores and redacting forbidden terms. The changes are well-tested with unit and integration tests covering security boundaries and edge cases.

No blocking issues spotted.

[JSONbored]

PR #723 — feat(api): /v1/extension/* contributor-context endpoints + miner auth scope
Author: oktofeesh1 | CI: ❌ validate FAIL | Status: Concerns (auth design is sound)
ACTION: REQUEST CHANGES

Highlights:

• Auth scoping careful and correct: new extension:contributor_context scope is strictly self-only; canSessionAccessPath allowlists only /v1/extension/contributors//*; every handler calls requireContributorAccess; pr-status self-checks PR authorship (cross-login → 403). Cannot reach maintainer/control-panel paths. TIGHTENS the boundary.
• Public/private respected: scores as bands only (strong/developing/early), no score/total/max keys; redactExtensionText scrubs wallet/hotkey/reward/payout/trust. Integration tests assert band-not-number, forbidden-term absence, cross-login 403.
• Linked to #556; backend-only, no UI.

Change requests / reasons:

• CI validate is red — must be green before merge. Root cause is the repo-wide npm audit failure (js-yaml/tar/ws) inherited from main, NOT this PR's code. Clears once the audit fix lands and the branch rebases.
• mergeable_state: blocked — rebase onto a main that includes the audit fix.
• Confirm no <97% coverage regression given the large new surface (verify in the green run).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.69%. Comparing base (e99d427) to head (d50555e).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #723      +/-   ##
==========================================
+ Coverage   96.68%   96.69%   +0.01%     
==========================================
  Files          93       94       +1     
  Lines       13771    13845      +74     
  Branches     5017     5050      +33     
==========================================
+ Hits        13314    13388      +74     
  Misses         88       88              
  Partials      369      369              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[JSONbored]

PR #723 — feat(api): /v1/extension/* contributor-context endpoints + miner auth scope
Verdict: MERGE
Resolves issue #556: FULLY
CI: All green (validate, test x2, lint, workers, ui, security, Superagent Security Scan = success, codecov). gittensory/Context neutral.

Highlights:

• Adds extension:contributor_context scope, minted only for non-maintainer sign-ins (maintainers keep extension:pull_context), keyed off loadControlPanelRoleSummary as the issue requires.
• Strict self-only enforcement layered correctly: coarse canSessionAccessPath allowlist + per-handler requireContributorAccess (actor === login) + extra self-check on PR authorship; contributor token blocked from re-minting sessions and /v1/app/*.
• All three endpoints return public-safe payloads; readiness emitted as bands (strong/developing/early, met/partial/unmet) — no score/total/max keys; defense-in-depth redactExtensionText re-filters every free-form string.
• Excellent coverage: unit (bands, redaction, zero-max, missing issue number) + integration (scope minting, cross-login 403, isolation vs maintainer path, 400/403/404, band-not-number, forbidden-term assertions).

Concerns / required changes:

• None. No public/private leakage; reuses existing builders without duplicating scoring logic.

Completeness vs issue: Implements the scope, self-only allowlist, and all redaction-checked endpoints with score-as-band, each covered by tests mirroring existing extension route tests. Fully satisfies #556.