gabriel / musehub public
fix BREAKING task/ssr-visibility-gate #1 / 1
AI Agent gabriel · 8 hours ago · Jun 12, 2026 · Diff

fix: enforce repo visibility gate on all SSR route handlers (issue #90)

All 14 repo-scoped ui_*.py route handlers previously served private repos to anonymous browser requests with HTTP 200. _resolve_repo and _resolve_repo_full in _ui_helpers.py now accept an optional claims: MSignContext | None parameter and raise HTTP 404 when repo.visibility != 'public' and claims is None.

Every SSR handler threads Depends(optional_token) through to the resolver so authenticated CLI/API callers can still reach their own private repos.

ui_repo_settings.py and ui_sessions.py use require_valid_token (not optional) and add a claims.handle == owner check (403 for non-owners) since those pages expose owner-only configuration and session telemetry.

Pre-launch checklist corrected: the SSR visibility item was falsely marked done.

sha256:e17dff4303a5885a1a61af6b39594fe316aeb62821bad17ccb66c52128a315f5 sha
sha256:1d2908ddb74d5ba2a5fc2db72acce8c7d07e210acc58fbea60291670731ee141 parent
+27 ~59 symbols
15 changed · 969 in snapshot files
sha256:9775d5977e31923046eab672c7c8b496ecdbf3353057a5860193daa41c3e6502 snapshot
+27
symbols added
~59
symbols modified
15
files changed
969
files in snapshot
0
dead code introduced
Semantic Changes 86 symbols
+ .vscode/
+ alembic/
+ alembic/versions/
+ deploy/
+ deploy/load-tests/
+ docs/
+ docs/guides/
+ docs/legal/
+ docs/reference/
+ docs/roadmaps/
+ musehub/
+ musehub/api/
+ musehub/api/routes/
+ musehub/api/routes/api/
+ musehub/api/routes/musehub/
+ musehub/auth/
+ musehub/core/
+ musehub/crypto/
+ musehub/db/
+ musehub/debug/
+ musehub/graph/
+ musehub/maintenance/
+ musehub/mcp/
+ musehub/mcp/tools/
+ musehub/mcp/write_tools/
+ musehub/middleware/
+ musehub/models/
+ musehub/muse_cli/
+ musehub/proposals/
+ musehub/protocol/
+ musehub/security/
+ musehub/services/
+ musehub/storage/
+ musehub/templates/
+ musehub/templates/mcp/
+ musehub/templates/musehub/
+ musehub/templates/musehub/fragments/
+ musehub/templates/musehub/macros/
+ musehub/templates/musehub/pages/
+ musehub/templates/musehub/partials/
+ musehub/templates/musehub/static/
+ musehub/templates/musehub/static/vendor/
+ musehub/types/
+ scripts/
+ src/
+ src/scss/
+ src/scss/components/
+ src/scss/pages/
+ src/scss/patterns/
+ src/scss/theme/
+ src/ts/
+ src/ts/pages/
+ tests/
+ tests/unit/
+ tools/
+ workflows/
~ docs/pre-launch-checklist.md .md 3 symbols modified
~ MuseHub Pre-Launch Checklist
~ Authentication & Authorization
~ 2 Authorization (ownership checks)
~ musehub/api/routes/musehub/_ui_helpers.py .py 1 symbol added, 2 symbols modified
+ MSignContext import import MSignContext L16–16
~ _resolve_repo
~ _resolve_repo_full
~ musehub/api/routes/musehub/ui_agents.py .py 2 symbols added, 5 symbols modified
+ TokenClaims import import TokenClaims L20–20
+ optional_token import import optional_token L20–20
~ agent_profile_page
~ agents_coord_forecast_page
~ agents_coord_page
~ agents_coord_shard_page
~ agents_swarm_page
~ musehub/api/routes/musehub/ui_blame.py .py 2 symbols added, 1 symbol modified
+ TokenClaims import import TokenClaims L52–52
+ optional_token import import optional_token L52–52
~ blame_page
~ musehub/api/routes/musehub/ui_blob.py .py 2 symbols added, 1 symbol modified
+ TokenClaims import import TokenClaims L24–24
+ optional_token import import optional_token L24–24
~ blob_page
~ musehub/api/routes/musehub/ui_commits.py .py 2 symbols added, 3 symbols modified
+ TokenClaims import import TokenClaims L24–24
+ optional_token import import optional_token L24–24
~ commit_page
~ commits_list_page
~ diff_page
~ musehub/api/routes/musehub/ui_intel.py .py 2 symbols added, 23 symbols modified
+ TokenClaims import import TokenClaims L30–30
+ optional_token import import optional_token L30–30
~ intel_api_surface_page
~ intel_blast_risk_detail_page
~ intel_blast_risk_page
~ intel_breakage_page
~ intel_clones_detail_page
~ intel_clones_page
~ intel_codemap_page
~ intel_coupling_page
~ intel_dashboard_page
~ intel_dead_dismiss
~ intel_dead_page
~ intel_detect_refactor_page
~ intel_entangle_page
~ intel_entangle_symbol_page
~ intel_gravity_detail_page
~ intel_gravity_page
~ intel_hotspots_page
~ intel_languages_page
~ intel_stable_detail_page
~ intel_stable_page
~ intel_type_page
~ intel_velocity_detail_page
~ intel_velocity_page
~ musehub/api/routes/musehub/ui_issues.py .py 2 symbols added, 3 symbols modified
+ TokenClaims import import TokenClaims L22–22
+ optional_token import import optional_token L22–22
~ issue_detail_page
~ issue_list_page
~ issue_new_page
~ musehub/api/routes/musehub/ui_proposals.py .py 2 symbols added, 5 symbols modified
+ TokenClaims import import TokenClaims L21–21
+ optional_token import import optional_token L21–21
~ proposal_detail_page
~ proposal_heat_fragment
~ proposal_list_page
~ proposal_row_summary
~ proposal_rows_fragment
~ musehub/api/routes/musehub/ui_releases.py .py 2 symbols added, 4 symbols modified
+ TokenClaims import import TokenClaims L22–22
+ optional_token import import optional_token L22–22
~ branches_page
~ release_detail_page
~ release_list_page
~ tags_page
~ musehub/api/routes/musehub/ui_repo.py .py 2 symbols added, 1 symbol modified
+ TokenClaims import import TokenClaims L21–21
+ optional_token import import optional_token L21–21
~ repo_page
~ musehub/api/routes/musehub/ui_repo_settings.py .py 2 symbols added, 2 symbols modified
+ TokenClaims import import TokenClaims L18–18
+ require_valid_token import import require_valid_token L18–18
~ collaborators_settings_page
~ settings_page
~ musehub/api/routes/musehub/ui_sessions.py .py 2 symbols added, 2 symbols modified
+ TokenClaims import import TokenClaims L16–16
+ require_valid_token import import require_valid_token L16–16
~ session_detail_page
~ sessions_page
~ musehub/api/routes/musehub/ui_symbols.py .py 2 symbols added, 2 symbols modified
+ TokenClaims import import TokenClaims L19–19
+ optional_token import import optional_token L19–19
~ symbol_detail_page
~ symbol_list_page
~ musehub/api/routes/musehub/ui_tree.py .py 2 symbols added, 2 symbols modified
+ TokenClaims import import TokenClaims L21–21
+ optional_token import import optional_token L21–21
~ raw_file_semantic
~ tree_page
Files Changed
~15
969 in snapshot
~ docs/pre-launch-checklist.md .md
~ musehub/api/routes/musehub/_ui_helpers.py .py
~ musehub/api/routes/musehub/ui_agents.py .py
~ musehub/api/routes/musehub/ui_blame.py .py
~ musehub/api/routes/musehub/ui_blob.py .py
~ musehub/api/routes/musehub/ui_commits.py .py
~ musehub/api/routes/musehub/ui_intel.py .py
~ musehub/api/routes/musehub/ui_issues.py .py
~ musehub/api/routes/musehub/ui_proposals.py .py
~ musehub/api/routes/musehub/ui_releases.py .py
~ musehub/api/routes/musehub/ui_repo.py .py
~ musehub/api/routes/musehub/ui_repo_settings.py .py
~ musehub/api/routes/musehub/ui_sessions.py .py
~ musehub/api/routes/musehub/ui_symbols.py .py
~ musehub/api/routes/musehub/ui_tree.py .py
← Older Oldest on task/ssr-visibility-gate
All commits
Newer → Latest on task/ssr-visibility-gate

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:e17dff4303a5885a1a61af6b39594fe316aeb62821bad17ccb66c52128a315f5 --body "your comment"