3 Commits

Include renames

Author	SHA1	Message	Date
jochen	ea772a9cce	Let gitea_api send only the query keys it needs, never sudo, and never approve a pull request ... The confirmation review of 2026-10-09 measured GET /user?sudo=… answer the operator's own account: the query went to the forge unjudged, and the tools' token is the site administrator's, so any caller could act as any user. gitea_api now sends only allow-listed query keys and refuses sudo in any case, and a review that approves or requests changes is the operator's.	2026-10-09 12:57:16 +02:00
jochen	ff648ad32b	Send the path gitea_api judged, keep a pull request's base, merge only into a guarded branch, and delete only the tools' own idle repositories ... Follow-ups of the review of 2026-10-09: the escape hatch sent the raw path it had judged in normalised form; a pull request's base could be moved through it; the merge tool would merge into a branch no rule guards; a rule named for a branch could undercut the glob rule guarding it; and the delete tool took any unguarded repository. It now takes only a repository of the tools' own user with no protection and no commit in 30 days, named in full.	2026-10-09 12:26:37 +02:00
jochen	080c113d69	Let the forge's tools never weaken protection or merge past the checks ... gitea_api took any endpoint with a token minted for the forge's administrator with write:admin: an agent could drop a branch's protection or its required checks, set the merge check's status, write to main or merge its own pull request (novox/hq ADR 0266 §7, the review of 2026-10-09). gitea_api now reads anything but the administration and writes only what an author writes; protection is only strengthened; a merge needs every required status a success and merges only that head; a guarded repository is not deleted; and the token is minted without write:admin, a kept one re-minted at the next start.	2026-10-09 11:47:36 +02:00