gabriel / musehub public
BREAKING task/security-depth-sweep #1 / 1
gabriel · 170 days ago · Apr 10, 2026 · Diff

security: defense-in-depth auth checks for all MCP write tools and REST endpoints

- MCP issues: add _require_public_or_write_access to create_issue, create_issue_comment; add _require_write_access + actor param to update_issue - MCP proposals: add _require_public_or_write_access to create_proposal, create_proposal_comment - MCP repos: guard create_repo against empty owner_user_id (unauthenticated callers) - REST webhooks: add _guard_repo_owner to redeliver_delivery (was auth-only, not authz) - REST labels: add _guard_repo_owner to assign_labels_to_proposal and remove_label_from_proposal (were scope-only, no repo-level ownership check) - Dispatcher: pass actor=user_id to execute_update_issue (was missing) - Tests: 20+ new auth tests covering forbidden paths for all affected executors

sha256:b52c6cbdd7835160038c284ec5ab828b8c999530f1913d4e17110acbbc153eab sha
sha256:f4abfa2a48e891e8daac08544a196429c07cd91993320e9cdcbd189354a14dfe parent
+13 ~23 symbols
sha256:14500c2377a9d71e8040d1ef6493ab0a02945944d3dffc33abe458eda8da04b3 snapshot
+13
symbols added
~23
symbols modified
0
dead code introduced
Semantic Changes 36 symbols
~ musehub/api/routes/musehub/labels.py .py 2 symbols modified
~ assign_labels_to_proposal
~ remove_label_from_proposal
~ musehub/api/routes/musehub/webhooks.py .py 1 symbol modified
~ redeliver_delivery
~ musehub/mcp/dispatcher.py .py 1 symbol modified
~ _call_tool
~ musehub/mcp/write_tools/issues.py .py 1 symbol added, 4 symbols modified
+ _require_public_or_write_access function async_function _require_public_or_write_access L333–381
~ _require_write_access
~ execute_create_issue
~ execute_create_issue_comment
~ execute_update_issue
~ musehub/mcp/write_tools/proposals.py .py 1 symbol added, 3 symbols modified
+ _require_public_or_write_access import import _require_public_or_write_access L10–10
~ execute_create_proposal
~ execute_create_proposal_comment
~ _require_write_access
~ musehub/mcp/write_tools/repos.py .py 1 symbol modified
~ execute_create_repo
~ tests/test_mcp_write_tools.py .py 11 symbols added, 11 symbols modified
+ test_any_user_can_create_issue_on_public_repo method async_method test_any_user_can_create_issue_on_public_repo L303–309
+ test_forbidden_on_private_repo_for_non_owner method async_method test_forbidden_on_private_repo_for_non_owner L312–319
+ test_forbidden_without_auth method async_method test_forbidden_without_auth L322–329
+ test_forbidden_on_private_repo_for_non_owner method async_method test_forbidden_on_private_repo_for_non_owner L446–455
+ test_forbidden_without_auth method async_method test_forbidden_without_auth L436–443
+ test_any_user_can_create_proposal_on_public_repo method async_method test_any_user_can_create_proposal_on_public_repo L489–497
+ test_forbidden_on_private_repo_for_non_owner method async_method test_forbidden_on_private_repo_for_non_owner L500–509
+ test_forbidden_without_auth method async_method test_forbidden_without_auth L512–521
+ test_forbidden_when_unauthenticated method async_method test_forbidden_when_unauthenticated L720–728
+ test_forbidden_non_collaborator method async_method test_forbidden_non_collaborator L403–414
+ test_forbidden_without_auth method async_method test_forbidden_without_auth L393–400
~ TestDataIntegrityIssue
~ test_closed_issue_state_persisted
~ TestIntegrationCreateIssue
~ TestIntegrationCreateIssueComment
~ test_happy_path
~ TestIntegrationCreateProposal
~ TestIntegrationCreateRepo
~ TestIntegrationUpdateIssue
~ test_close_issue
~ test_unknown_repo
~ test_update_title
← Older Oldest on task/security-depth-sweep
All commits
Newer → Latest on task/security-depth-sweep

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:b52c6cbdd7835160038c284ec5ab828b8c999530f1913d4e17110acbbc153eab --body "your comment"