swadhinbiswas Enforce repo and path permissions for comment and review mutations · 2/19/2026
93f6489
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
import { beforeEach, describe, expect, it, vi } from "vitest";
const { canWriteRepoMock, checkPathPermissionsMock } = vi.hoisted(() => ({
canWriteRepoMock: vi.fn(async () => true),
checkPathPermissionsMock: vi.fn(async () => ({ allowed: true, deniedPaths: [] })),
}));
vi.mock("@/lib/permissions", async () => {
const actual = await vi.importActual<any>("@/lib/permissions");
return {
...actual,
canWriteRepo: canWriteRepoMock,
};
});
vi.mock("@/lib/path-scoping", () => ({
checkPathPermissions: checkPathPermissionsMock,
}));
import { resolvers } from "@/lib/graphql/resolvers";
function makeContext() {
const insertCalls: unknown[] = [];
return {
db: {
query: {
pullRequests: {
findFirst: vi.fn(async () => ({ id: "pr-1", repositoryId: "repo-1" })),
},
repositories: {
findFirst: vi.fn(async () => ({ id: "repo-1" })),
},
pullRequestReviews: {
findFirst: vi.fn(async () => ({ id: "review-1" })),
},
},
insert: vi.fn(() => ({
values: vi.fn(async (value: unknown) => {
insertCalls.push(value);
}),
})),
__state: { insertCalls },
},
userId: "user-1",
user: { isAdmin: false },
} as any;
}
describe("GraphQL addPullRequestReview permission enforcement", () => {
beforeEach(() => {
canWriteRepoMock.mockResolvedValue(true);
checkPathPermissionsMock.mockResolvedValue({ allowed: true, deniedPaths: [] });
});
it("blocks review submission when path write permission is denied", async () => {
const ctx = makeContext();
checkPathPermissionsMock.mockResolvedValue({
allowed: false,
deniedPaths: ["secure/config.yml"],
reason: "Insufficient permissions for paths: secure/config.yml",
});
await expect(
resolvers.Mutation.addPullRequestReview(
{},
{
input: {
pullRequestId: "pr-1",
event: "COMMENT",
body: "review",
comments: [{ body: "inline", path: "secure/config.yml", line: 3 }],
},
},
ctx
)
).rejects.toThrow("Insufficient permissions for paths: secure/config.yml");
expect(ctx.db.__state.insertCalls).toHaveLength(0);
});
});