Repository navigation
[quality] the authorization policy arms of auth.ts (members/collaborators/root-OWNERS admits, trusted refusal, config-load failures, empty login) run only under unit tests, never through dist/index.js #377
Description
Finding
#367 added the opt-in authorization policy to src/utils/auth.ts (policyAllows, assertPolicy, closePolicyAllows, loadAuthorization, rootOwnersIncludes, and the review fallback inside assertAuthorizedByOwnersOrMembership). Its own bundle suite, __tests__/bundle/authorization.test.ts, drives three arms (labels: trusted by a users login and by an outsider; review: trusted by a users login). The remaining policy arms are reached by unit tests only.
Unit evidence — npx vitest run --coverage on main @ 5061d57 (81 files / 1852 tests): auth.ts 100 % statements / 100 % lines / 98.93 % branches.
End-to-end evidence — npm run test:coverage:e2e on main @ 5061d57 (the bundle suite against a source-mapped dist, vitest.e2e-coverage.config.mjs): auth.ts 69.85 % statements / 70.14 % lines. The policy lines with 0 hits (coverage/lcov.info, DA:<line>,0):
| line(s) | arm |
|---|---|
265 (.catch(() => defaultAuthorization)), 377–378 |
review refusal when the prow config cannot be loaded: loadAuthorization warns and the defaults (review: members) decide |
| 270 | review: trusted refusing a user who is neither member, collaborator nor in authorization.users |
| 304 | policyAllows with no commenter login |
| 313 | policyAllows admitting an org member (labels: members/trusted) |
| 316 | policyAllows admitting a collaborator (labels: collaborators) |
| 365 | closePolicyAllows returning false when the prow config cannot be loaded (silent /close refusal) |
| 460–462 | rootOwnersIncludes admitting a root-OWNERS reviewer/approver under trusted (the existing outsider case only reaches the 404 → '' return) |
Not part of this finding: auth.ts 392–403 and 480–499 (assertRootOwner, retrieveOwnersFile success) are claimed by #283/#331, and 436–437 by #283.
Recommendation
One bundle suite, __tests__/bundle/authorizationPolicyArms.test.ts, with one issue_comment run per arm above through dist/index.js against the fake GitHub — a label command under labels: members / labels: collaborators / labels: trusted with a root OWNERS file, /close and /lgtm with a schema-invalid authorization section, /lgtm under review: trusted by a non-listed user, and a label command whose payload carries no commenter login.
- add
__tests__/bundle/authorizationPolicyArms.test.tscovering the seven arms, measured withnpm run test:coverage:e2e
Priority
- Impact: medium (authorization decides who may label, hold, close and review; only three of its arms run through the shipped bundle)
- Effort: low
Filed by quality agent (hold-gated mode)
🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: unknown
— hive: agent=quality backend=copilot model=claude-fable-5.1
Activity
github-actions commentedon Oct 8, 2026
Please add a kind label with
/kind failing-testor/kind cleanup.