gabriel / musehub public
BREAKING fix/issue-label-auth-security #1 / 1
gabriel · 170 days ago · Apr 10, 2026 · Diff

security: enforce write-access checks on all label and issue-label MCP/REST operations

- execute_remove_issue_label: add repo fetch + _require_write_access guard (matches other 4 issue executors) - labels.py REST: add _guard_repo_owner helper; apply to create_label, update_label, delete_label - write_tools/labels.py MCP: import _require_write_access; apply to execute_create_label, execute_update_label, execute_delete_label (with repo fetch for update/delete) - test_mcp_write_tools.py: fix existing label tests to pass actor='alice'; add TestLabelWriteAccessGuard with 4 forbidden tests - test_musehub_labels.py: add 2 REST 403 tests (non-owner create/delete label)

sha256:d3ae4478c0410dbb6ee5f0e3c33739ed3e5329d10f45fa29c56be010d1dfd1ef sha
sha256:3c970c31e3f83085b6d8fcafe5ee0f74b64f4c621e1c297aac81b61df2e3283d parent
+11 ~25 symbols
sha256:0fbe3125ab29f515eb0ebe9a400389f2edd4b55b0094cd8ac323ae21aa4bcf2d snapshot
+11
symbols added
~25
symbols modified
0
dead code introduced
Semantic Changes 36 symbols
~ musehub/api/routes/musehub/labels.py .py 1 symbol added, 3 symbols modified
+ _guard_repo_owner function async_function _guard_repo_owner L109–119
~ create_label
~ delete_label
~ update_label
~ musehub/mcp/write_tools/issues.py .py 1 symbol added, 5 symbols modified
+ _require_write_access function async_function _require_write_access L260–299
~ execute_assign_issue
~ execute_close_issue
~ execute_remove_issue_label
~ execute_reopen_issue
~ execute_set_issue_labels
~ musehub/mcp/write_tools/labels.py .py 1 symbol added, 3 symbols modified
+ _require_write_access import import _require_write_access L18–18
~ execute_create_label
~ execute_delete_label
~ execute_update_label
~ musehub/services/musehub_repository.py .py 1 symbol added
+ check_write_access function async_function check_write_access L231–262
~ tests/test_mcp_write_tools.py .py 5 symbols added, 14 symbols modified
+ TestLabelWriteAccessGuard class class TestLabelWriteAccessGuard L720–761
+ test_create_label_forbidden_for_non_owner method async_method test_create_label_forbidden_for_non_owner L724–731
+ test_create_label_forbidden_when_unauthenticated method async_method test_create_label_forbidden_when_unauthenticated L756–761
+ test_delete_label_forbidden_for_non_owner method async_method test_delete_label_forbidden_for_non_owner L745–753
+ test_update_label_forbidden_for_non_owner method async_method test_update_label_forbidden_for_non_owner L734–742
~ TestIntegrationCreateLabel
~ test_duplicate_name_rejected
~ TestIntegrationDeleteLabel
~ test_deletes_label
~ test_not_found_returns_error
~ TestIntegrationListLabels
~ test_returns_all_labels
~ TestIntegrationUpdateLabel
~ test_change_color
~ test_invalid_color_rejected
~ test_no_fields_returns_error
~ test_not_found_returns_error
~ test_rename_conflict_rejected
~ test_rename_label
~ tests/test_musehub_labels.py .py 2 symbols added
+ test_create_label_forbidden_for_non_owner function async_function test_create_label_forbidden_for_non_owner L600–624
+ test_delete_label_forbidden_for_non_owner function async_function test_delete_label_forbidden_for_non_owner L628–650
← Older Oldest on fix/issue-label-auth-security
All commits
Newer → Latest on fix/issue-label-auth-security

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:d3ae4478c0410dbb6ee5f0e3c33739ed3e5329d10f45fa29c56be010d1dfd1ef --body "your comment"