fix: fix: dispatcher admin check fails — is_admin not visible to non-admin tokens (#152) #154

Merged

dev-qwen merged 1 commit from fix/issue-152 into main

2026-04-02 18:09:51 +00:00

dev-qwen commented

2026-04-02 18:01:27 +00:00

Collaborator

Fixes #152

Changes

Fixes #152 ## Changes

dev-qwen added 1 commit 2026-04-02 18:01:28 +00:00

fix: fix: dispatcher admin check fails — is_admin not visible to non-admin tokens (#152 )

ci/woodpecker/push/ci Pipeline was successful

Details

ci/woodpecker/pr/ci Pipeline was successful

Details

ci/woodpecker/pr/smoke-init Pipeline was successful

Details

e07e718060

review-bot commented

2026-04-02 18:08:35 +00:00

Collaborator

AI Review

Summary\n\nThis PR fixes a real Forgejo API limitation: `.is_admin` is only returned as `true` when the requesting token belongs to a site admin. The fix introduces `FORGE_ADMIN_TOKEN` for the `is_user_admin()` API call, falling back to `FORGE_TOKEN` if not set.\n\n### Assessment\n\n- correct `dispatcher.sh:68`: `local admin_token="${FORGE_ADMIN_TOKEN:-${FORGE_TOKEN}}"` — properly quoted, safe fallback, token never echoed or logged\n- correct `bin/disinto:299-300`: env vars wired correctly into the edge container; `FORGE_ADMIN_USERS` default updated to reflect actual deployment usernames (`disinto-admin,johba`)\n- No secret leakage — the log skeleton at line 341 redacts `-e` flags and the curl header is not logged\n- Change is minimal and well-scoped; no dead code or unrelated modifications\n\nChange is correct, complete, and follows project conventions.

Verdict

APPROVE — Correct targeted fix: uses a dedicated admin token for the Forgejo is_admin API check, with safe fallback and no secret leakage

Reviewed at e07e718 | AGENTS.md

## AI Review  ### Summary\n\nThis PR fixes a real Forgejo API limitation: `.is_admin` is only returned as `true` when the *requesting* token belongs to a site admin. The fix introduces `FORGE_ADMIN_TOKEN` for the `is_user_admin()` API call, falling back to `FORGE_TOKEN` if not set.\n\n### Assessment\n\n- **correct** `dispatcher.sh:68`: `local admin_token="${FORGE_ADMIN_TOKEN:-${FORGE_TOKEN}}"` — properly quoted, safe fallback, token never echoed or logged\n- **correct** `bin/disinto:299-300`: env vars wired correctly into the edge container; `FORGE_ADMIN_USERS` default updated to reflect actual deployment usernames (`disinto-admin,johba`)\n- No secret leakage — the log skeleton at line 341 redacts `-e` flags and the curl header is not logged\n- Change is minimal and well-scoped; no dead code or unrelated modifications\n\nChange is correct, complete, and follows project conventions. ### Verdict **APPROVE** — Correct targeted fix: uses a dedicated admin token for the Forgejo is_admin API check, with safe fallback and no secret leakage --- *Reviewed at `e07e718` | [AGENTS.md](AGENTS.md)*

review-bot approved these changes 2026-04-02 18:08:35 +00:00

review-bot left a comment

Collaborator

AI Review: APPROVE — Correct targeted fix: uses a dedicated admin token for the Forgejo is_admin API check, with safe fallback and no secret leakage

AI Review: **APPROVE** — Correct targeted fix: uses a dedicated admin token for the Forgejo is_admin API check, with safe fallback and no secret leakage