fix: sha256:9ace58a6faebf7ad96771affa4eb18baa3bcea6f15728a4f3b46186fdcb1857a · gabriel/musehub

fix: harden fork feature — security, data integrity, and coverage

Security: - Private forks are now filtered from all public listing endpoints: GET /repos/{id}/forks and GET /repos/{id}/fork-network exclude private forks GET /users/{username}/forks shows private forks only to the profile owner - ForkRepoRequest.visibility validated to 'public'|'private'; 422 on any other value

Data integrity: - Duplicate fork now detected with a pre-check SELECT before any DB write, so IntegrityError from slug collision can no longer be misreported as 'already forked' - Auto-slug-suffix (_unique_slug_for_owner) resolves slug collisions on fork by appending -2, -3, … (GitHub behaviour); avoids spurious 409 errors - duplicate_fork ValueError code propagates cleanly through route and MCP executor

MCP coverage: - musehub_fork_repo executor now maps duplicate_fork code → conflict error code - IntegrityError catch removed from MCP executor (superseded by pre-check)

Test coverage (30 fork tests + 43 MCP dispatcher tests): - test_private_fork_hidden_from_source_forks_list - test_private_fork_hidden_from_fork_network - test_private_fork_hidden_from_public_user_forks (genuinely anon — no auth override) - test_private_fork_visible_to_owner - test_invalid_visibility_returns_422 - test_slug_collision_auto_resolved - test_musehub_list_repo_forks_routes_to_executor - test_musehub_get_fork_network_routes_to_executor - test_musehub_get_user_forks_routes_to_executor - test_musehub_fork_repo_requires_auth - test_musehub_fork_repo_in_write_tool_names

+13

symbols added

symbols modified

dead code introduced

Semantic Changes 21 symbols

~ musehub/api/routes/musehub/repos.py .py 1 symbol modified

~ fork_repo

~ musehub/api/routes/musehub/users.py .py 1 symbol modified

~ get_user_forks

~ musehub/mcp/write_tools/repos.py .py 1 symbol modified

~ execute_fork_repo

~ musehub/models/musehub.py .py 1 symbol added, 1 symbol modified

+ _validate_visibility method method _validate_visibility L2528–2531

~ ForkRepoRequest

~ musehub/services/musehub_repository.py .py 1 symbol added, 4 symbols modified

+ _unique_slug_for_owner function async_function _unique_slug_for_owner L1843–1872

~ fork_repo

~ get_user_forks

~ list_repo_forks

~ list_repo_forks_flat

~ tests/test_mcp_dispatcher.py .py 5 symbols added

+ test_musehub_fork_repo_in_write_tool_names function async_function test_musehub_fork_repo_in_write_tool_names L603–605

+ test_musehub_fork_repo_requires_auth function async_function test_musehub_fork_repo_requires_auth L589–599

+ test_musehub_get_fork_network_routes_to_executor function async_function test_musehub_get_fork_network_routes_to_executor L540–568

+ test_musehub_get_user_forks_routes_to_executor function async_function test_musehub_get_user_forks_routes_to_executor L572–585

+ test_musehub_list_repo_forks_routes_to_executor function async_function test_musehub_list_repo_forks_routes_to_executor L519–536

~ tests/test_musehub_forks.py .py 6 symbols added

+ test_invalid_visibility_returns_422 function async_function test_invalid_visibility_returns_422 L954–979

+ test_private_fork_hidden_from_fork_network function async_function test_private_fork_hidden_from_fork_network L830–863

+ test_private_fork_hidden_from_public_user_forks function async_function test_private_fork_hidden_from_public_user_forks L866–915

+ test_private_fork_hidden_from_source_forks_list function async_function test_private_fork_hidden_from_source_forks_list L794–827

+ test_private_fork_visible_to_owner function async_function test_private_fork_visible_to_owner L918–951

+ test_slug_collision_auto_resolved function async_function test_slug_collision_auto_resolved L982–1019

← Older Oldest on dev

All commits

Newer → Latest on dev

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:9ace58a6faebf7ad96771affa4eb18baa3bcea6f15728a4f3b46186fdcb1857a --body "your comment"