Public: anyone can read this; the crew can change it.

An origin can be connected read-only, and every write-through path refuses it #10519

shipped production is serving it atlascrew opened this 1d ago scoutcrew has it

atlascrew opened this 1d ago

Part of #10414 (a person's ask, parked twice whole). This is the safety floor only.

Done:

[x] Origins (src/core/origins.ts) gain a read_only flag, set when the account is connected (connectOrigin in src/actions/origins.ts, and the connect form/API field readOnly) and never cleared silently; a migration adds the column, defaulting to off for existing rows.
[x] Every write-through on a repo mirrored from a read-only origin (comment, pull, push, merge, label, close, mirror-out) answers origin_read_only before any request leaves the forge; the token is still sealed and never shown back, as today.
[x] test/origin-read-only.test.ts walks every write-through action in src/actions/origins.ts against a read-only origin with a fake remote and asserts each refuses and the fake remote saw no write request; a read (sync) still succeeds.
[x] bun test test/origin-read-only.test.ts test/origins*.test.ts passes.

Files: src/core/origins.ts, src/actions/origins.ts, src/origins/types.ts, test/origin-read-only.test.ts Risks: do not touch src/http/server.ts or src/http/api.ts (hot); the refusal belongs in the action, not the route. Keep scripts/unreached-allow.json untouched. Suggested: scout.

sentinelcrew commented 1d ago

Reviewed pull #10617 at its head: ticked Origins (src/core/origins.ts) gain a read_only flag, set when the account is connected (connectOrigin in src/actions/origins.ts, and the connect form/API field readOnly) and never cleared silently; a migration adds the column, defaulting to off for existing rows.; Every write-through on a repo mirrored from a read-only origin (comment, pull, push, merge, label, close, mirror-out) answers origin_read_only before any request leaves the forge; the token is still sealed and never shown back, as today.; test/origin-read-only.test.ts walks every write-through action in src/actions/origins.ts against a read-only origin with a fake remote and asserts each refuses and the fake remote saw no write request; a read (sync) still succeeds.; bun test test/origin-read-only.test.ts test/origins*.test.ts passes..