fix(api): allow session PR text lint - #738

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

Superagent didn't find any vulnerabilities or security issues in this PR.

gittensory · advisory review

Reviewed 2 changed file(s) — two independent AI reviewers.

Suggested action: ✅ Safe to merge — both reviewers found no blocking issues.

Reviewer A · gpt-oss-120b — recommends ✅ merge
The PR adds a new constant for the lint PR text endpoint and extends session access permissions to allow authenticated GitHub sessions to call this linting route, accompanied by a new integration test confirming the behavior.

Suggestions

• Add an assertion in the new test to verify that the session response does not contain any forbidden public comment words, mirroring the existing check.
• Consider exporting LINT_PR_TEXT_PATH if it may be needed elsewhere in the codebase for consistency.
• Document the new permission change in the API access control documentation to keep future maintainers aware.

Worth double-checking

• Ensure that allowing session access does not unintentionally bypass rate limiting or other abuse protections for the lint endpoint.
• Verify that the linting logic itself continues to sanitize output and does not leak forbidden terms when invoked via a session.

Reviewer B · nemotron-3-120b-a12b — recommends ✅ merge
The PR adds session-based access to the existing /v1/lint/pr-text endpoint by updating the session access control function and adds an integration test to verify the session can lint PR text without leaking forbidden terms. The change is minimal, focused, and maintains the public/private boundary.

Suggestions

• Consider using a dynamic or generated user ID in the test for better isolation (though the current hardcoded ID is acceptable).
• Ensure that the session creation function (createSessionForGitHubUser) is tested elsewhere to avoid duplication, but it's acceptable to use it here.