feat(preview-auth): gate a preview to its base repo's GitHub readers - #32
Merged
Merged
Conversation
Write the base repository full name (owner/name) into the per-site [preview_auth] override section as a new `repo` key, so ePHPm's preview gate can admit exactly the GitHub users with read access to that repo. This is switchboard's half of the approved per-preview repo-read gating contract shared with ePHPm: for a gated preview switchboard emits `repo = "owner/name"` (the preview's BASE repo, never a fork's) alongside `session_secret` and `login_url`. - site_override.rs: PreviewAuthSection carries a validated `repo` field. is_valid_repo_full_name enforces the exact owner/name shape (two non-empty [A-Za-z0-9._-] segments, single slash), which also makes the value TOML-safe for the hand-rolled writer. render_override emits it inside [preview_auth]. - deployer.rs: resolve_preview_gate threads req.repo_full_name (the base repo, already populated from repository.full_name) into the section, failing the deploy closed if the base repo is not a clean owner/name. The global github-auth mount, the share-link path, the secret model, and should_gate are untouched (private is still always gated).
|
ePHPm Preview — removed Preview deployment has been torn down. |
This was referenced Sep 10, 2026
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Switchboard's half of per-preview GitHub-repo-read gating. For a gated preview, switchboard now writes one new key into the per-site
[preview_auth]override:repo = "owner/name"— the preview's base repo full name. ePHPm's preview gate reads it and admits exactly the GitHub users with read access to that repo. (ePHPm reader is a separate coordinated PR.)Contract (must match ePHPm)
Exactly
owner/name, the base repo (never a fork's).Changes
site_override.rs:PreviewAuthSectioncarries a validatedrepo.is_valid_repo_full_nameenforces two non-empty[A-Za-z0-9._-]segments, single slash, no./..segment (also guarantees TOML-safety for the hand-rolled writer).render_overrideemits therepoline.deployer.rs:resolve_preview_gatethreadsreq.repo_full_nameinto the section, failing the deploy closed on a malformed base repo.job.rs/webhook.rs: no change — base repo already reaches the builder viaPreviewRequest.repo_full_name.Not touched
Global
github-authmount, share-link path, secret model,should_gate(private still always gated).Validation
cargo build,cargo test(268 pass), clippy-D warnings,fmt --check, MSRV+1.85 check— all clean. New tests:owner/nameshape accept/reject, TOML-injection rejection, fail-closed on malformed base repo, render assertions; ungated preview still writes no[preview_auth].Rollout
Forward-compat: ePHPm tolerates unknown
[preview_auth]keys today, so writingrepois safe on nodes whose ePHPm predates the reader (ignored/warned until the consuming side lands).