From 43714047befe61d756b825f3ab8f6d12f4c83b01 Mon Sep 17 00:00:00 2001 From: Mathias Date: Wed, 22 Jul 2026 08:31:43 +0200 Subject: [PATCH] fix(auth): owner allowlist trusts pass-through-authenticated callers (#59) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Allowlist.Check now takes ctx: when the caller authenticated with their own Gitea PAT (pass-through, v0.12.0), it skips the static GITEA_MCP_ALLOWED_OWNERS check entirely — Gitea's own permission model already gates that caller's access more precisely than a coarse owner-name list can. The static list still applies unchanged for the shared static-token/JWT path, where it's the only defense against the service token's blast radius. Mechanical: every tool call site already had ctx in scope, so this is a signature-only change at 41 call sites, no other tool behavior changes. Closes the "Deferred" item from #59. Co-Authored-By: Claude Sonnet 5 --- internal/allowlist/allowlist.go | 16 +++++++++-- internal/allowlist/allowlist_test.go | 28 ++++++++++++++++--- internal/tools/branch_delete.go | 2 +- internal/tools/branch_list.go | 2 +- internal/tools/branch_protection_get.go | 2 +- internal/tools/code_search.go | 2 +- .../tools/create_project_from_template.go | 2 +- internal/tools/dir_list.go | 2 +- internal/tools/file_delete.go | 2 +- internal/tools/file_read.go | 2 +- internal/tools/file_write_branch.go | 2 +- internal/tools/issue_close.go | 2 +- internal/tools/issue_comment.go | 2 +- internal/tools/issue_create.go | 2 +- internal/tools/issue_edit.go | 2 +- internal/tools/issue_get.go | 2 +- internal/tools/issue_label.go | 2 +- internal/tools/issue_list.go | 2 +- internal/tools/issue_list_comments.go | 2 +- internal/tools/issue_reopen.go | 2 +- internal/tools/label_list.go | 2 +- internal/tools/pr_comment.go | 2 +- internal/tools/pr_create.go | 2 +- internal/tools/pr_files_diff.go | 2 +- internal/tools/pr_get.go | 2 +- internal/tools/pr_list.go | 2 +- internal/tools/pr_merge.go | 2 +- internal/tools/release_create.go | 2 +- internal/tools/repo_create.go | 2 +- internal/tools/repo_delete.go | 2 +- internal/tools/repo_get.go | 2 +- internal/tools/repo_list.go | 2 +- internal/tools/repo_mirror_push.go | 2 +- internal/tools/repo_search.go | 4 +-- internal/tools/repo_status.go | 2 +- internal/tools/repo_topics_update.go | 2 +- internal/tools/repo_tree.go | 2 +- internal/tools/repo_update.go | 2 +- internal/tools/tag_create.go | 2 +- internal/tools/tbd_ship.go | 2 +- internal/tools/workflow_run_list.go | 2 +- internal/tools/workflow_run_status.go | 2 +- internal/tools/workflow_run_trigger.go | 2 +- 43 files changed, 80 insertions(+), 48 deletions(-) diff --git a/internal/allowlist/allowlist.go b/internal/allowlist/allowlist.go index 6e76435..cdcae28 100644 --- a/internal/allowlist/allowlist.go +++ b/internal/allowlist/allowlist.go @@ -1,6 +1,11 @@ package allowlist -import "fmt" +import ( + "context" + "fmt" + + "git.d-ma.be/mathias/gitea-mcp/internal/gitea" +) type Allowlist struct { owners map[string]struct{} @@ -14,10 +19,17 @@ func New(owners []string) *Allowlist { return &Allowlist{owners: m} } -func (a *Allowlist) Check(owner string) error { +// Check gates owner access to the static list — except for a caller +// authenticated with their own Gitea PAT (pass-through, gitea-mcp#59), whose +// access Gitea's own permission model already gates more precisely than a +// coarse owner name list ever could. +func (a *Allowlist) Check(ctx context.Context, owner string) error { if owner == "" { return fmt.Errorf("owner required") } + if _, ok := gitea.TokenFromContext(ctx); ok { + return nil + } if _, ok := a.owners[owner]; !ok { return fmt.Errorf("owner %q not in allowlist", owner) } diff --git a/internal/allowlist/allowlist_test.go b/internal/allowlist/allowlist_test.go index 0de817b..d8b74ca 100644 --- a/internal/allowlist/allowlist_test.go +++ b/internal/allowlist/allowlist_test.go @@ -1,16 +1,36 @@ package allowlist_test import ( + "context" "testing" "git.d-ma.be/mathias/gitea-mcp/internal/allowlist" + "git.d-ma.be/mathias/gitea-mcp/internal/gitea" "github.com/stretchr/testify/assert" ) func TestAllowlistCheck(t *testing.T) { a := allowlist.New([]string{"mathias", "acme"}) - assert.NoError(t, a.Check("mathias")) - assert.NoError(t, a.Check("acme")) - assert.Error(t, a.Check("evil")) - assert.Error(t, a.Check("")) + ctx := context.Background() + assert.NoError(t, a.Check(ctx, "mathias")) + assert.NoError(t, a.Check(ctx, "acme")) + assert.Error(t, a.Check(ctx, "evil")) + assert.Error(t, a.Check(ctx, "")) +} + +// A caller authenticated with their own Gitea PAT (pass-through, gitea-mcp#59) +// is gated by Gitea's own permission model, not the MCP's static owner list — +// otherwise a legitimate second user could never touch their own repos. +func TestAllowlistCheckTrustsPassthroughAuthenticatedCaller(t *testing.T) { + a := allowlist.New([]string{"mathias"}) + ctx := gitea.WithToken(context.Background(), "someone-elses-pat") + assert.NoError(t, a.Check(ctx, "someone-else")) +} + +// Empty owner is a structural input error, not an authz question — still +// rejected even on the pass-through path. +func TestAllowlistCheckStillRejectsEmptyOwnerOnPassthrough(t *testing.T) { + a := allowlist.New([]string{"mathias"}) + ctx := gitea.WithToken(context.Background(), "someone-elses-pat") + assert.Error(t, a.Check(ctx, "")) } diff --git a/internal/tools/branch_delete.go b/internal/tools/branch_delete.go index 4fcba20..1a451cd 100644 --- a/internal/tools/branch_delete.go +++ b/internal/tools/branch_delete.go @@ -46,7 +46,7 @@ func (t *BranchDelete) Call(ctx context.Context, raw json.RawMessage) (json.RawM if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } if args.Branch == "" { diff --git a/internal/tools/branch_list.go b/internal/tools/branch_list.go index 66ff777..85fd4d1 100644 --- a/internal/tools/branch_list.go +++ b/internal/tools/branch_list.go @@ -47,7 +47,7 @@ func (t *BranchList) Call(ctx context.Context, raw json.RawMessage) (json.RawMes if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } diff --git a/internal/tools/branch_protection_get.go b/internal/tools/branch_protection_get.go index 910a328..9317a34 100644 --- a/internal/tools/branch_protection_get.go +++ b/internal/tools/branch_protection_get.go @@ -45,7 +45,7 @@ func (t *BranchProtectionGet) Call(ctx context.Context, raw json.RawMessage) (js if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } diff --git a/internal/tools/code_search.go b/internal/tools/code_search.go index 54a71f8..bfd1930 100644 --- a/internal/tools/code_search.go +++ b/internal/tools/code_search.go @@ -70,7 +70,7 @@ func (t *CodeSearch) Call(ctx context.Context, raw json.RawMessage) (json.RawMes if args.Q == "" { return nil, fmt.Errorf("q is required: %w", gitea.ErrValidation) } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } if args.Page < 1 { diff --git a/internal/tools/create_project_from_template.go b/internal/tools/create_project_from_template.go index f122449..8e44f69 100644 --- a/internal/tools/create_project_from_template.go +++ b/internal/tools/create_project_from_template.go @@ -111,7 +111,7 @@ func (t *CreateProjectFromTemplate) Call(ctx context.Context, raw json.RawMessag } // Allowlist check first. - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } diff --git a/internal/tools/dir_list.go b/internal/tools/dir_list.go index a65a84f..9797cb3 100644 --- a/internal/tools/dir_list.go +++ b/internal/tools/dir_list.go @@ -47,7 +47,7 @@ func (t *DirList) Call(ctx context.Context, raw json.RawMessage) (json.RawMessag if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } diff --git a/internal/tools/file_delete.go b/internal/tools/file_delete.go index 9ac8505..f8ddcf1 100644 --- a/internal/tools/file_delete.go +++ b/internal/tools/file_delete.go @@ -52,7 +52,7 @@ func (t *FileDelete) Call(ctx context.Context, raw json.RawMessage) (json.RawMes if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } if args.Sha == "" { diff --git a/internal/tools/file_read.go b/internal/tools/file_read.go index dc197db..db1cf63 100644 --- a/internal/tools/file_read.go +++ b/internal/tools/file_read.go @@ -51,7 +51,7 @@ func (t *FileRead) Call(ctx context.Context, raw json.RawMessage) (json.RawMessa if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } diff --git a/internal/tools/file_write_branch.go b/internal/tools/file_write_branch.go index 4db137a..f98976e 100644 --- a/internal/tools/file_write_branch.go +++ b/internal/tools/file_write_branch.go @@ -57,7 +57,7 @@ func (t *FileWriteBranch) Call(ctx context.Context, raw json.RawMessage) (json.R if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } if args.Branch == "" { diff --git a/internal/tools/issue_close.go b/internal/tools/issue_close.go index 2a45b03..9264e72 100644 --- a/internal/tools/issue_close.go +++ b/internal/tools/issue_close.go @@ -45,7 +45,7 @@ func (t *IssueClose) Call(ctx context.Context, raw json.RawMessage) (json.RawMes if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } iss, err := t.c.SetIssueState(ctx, args.Owner, args.Repo, args.Number, "closed") diff --git a/internal/tools/issue_comment.go b/internal/tools/issue_comment.go index 53253cf..1483e08 100644 --- a/internal/tools/issue_comment.go +++ b/internal/tools/issue_comment.go @@ -50,7 +50,7 @@ func (t *IssueComment) Call(ctx context.Context, raw json.RawMessage) (json.RawM if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } if args.Number < 1 { diff --git a/internal/tools/issue_create.go b/internal/tools/issue_create.go index 68324b6..ccb86cb 100644 --- a/internal/tools/issue_create.go +++ b/internal/tools/issue_create.go @@ -56,7 +56,7 @@ func (t *IssueCreate) Call(ctx context.Context, raw json.RawMessage) (json.RawMe if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } if args.Title == "" { diff --git a/internal/tools/issue_edit.go b/internal/tools/issue_edit.go index 140e4d6..62b1e8e 100644 --- a/internal/tools/issue_edit.go +++ b/internal/tools/issue_edit.go @@ -53,7 +53,7 @@ func (t *IssueEdit) Call(ctx context.Context, raw json.RawMessage) (json.RawMess if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } if args.Number < 1 { diff --git a/internal/tools/issue_get.go b/internal/tools/issue_get.go index 1cdf75b..91f4832 100644 --- a/internal/tools/issue_get.go +++ b/internal/tools/issue_get.go @@ -43,7 +43,7 @@ func (t *IssueGet) Call(ctx context.Context, raw json.RawMessage) (json.RawMessa if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } iss, err := t.c.GetIssue(ctx, args.Owner, args.Repo, args.Number) diff --git a/internal/tools/issue_label.go b/internal/tools/issue_label.go index c778d46..92eeb5d 100644 --- a/internal/tools/issue_label.go +++ b/internal/tools/issue_label.go @@ -50,7 +50,7 @@ func (t *IssueLabel) Call(ctx context.Context, raw json.RawMessage) (json.RawMes if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } if args.Number < 1 { diff --git a/internal/tools/issue_list.go b/internal/tools/issue_list.go index bfb6ad5..b569fbd 100644 --- a/internal/tools/issue_list.go +++ b/internal/tools/issue_list.go @@ -53,7 +53,7 @@ func (t *IssueList) Call(ctx context.Context, raw json.RawMessage) (json.RawMess if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } if args.State == "" { diff --git a/internal/tools/issue_list_comments.go b/internal/tools/issue_list_comments.go index 229c455..8be2763 100644 --- a/internal/tools/issue_list_comments.go +++ b/internal/tools/issue_list_comments.go @@ -45,7 +45,7 @@ func (t *IssueListComments) Call(ctx context.Context, raw json.RawMessage) (json if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } comments, err := t.c.ListIssueComments(ctx, args.Owner, args.Repo, args.Number) diff --git a/internal/tools/issue_reopen.go b/internal/tools/issue_reopen.go index ec78a5b..42cbf89 100644 --- a/internal/tools/issue_reopen.go +++ b/internal/tools/issue_reopen.go @@ -45,7 +45,7 @@ func (t *IssueReopen) Call(ctx context.Context, raw json.RawMessage) (json.RawMe if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } iss, err := t.c.SetIssueState(ctx, args.Owner, args.Repo, args.Number, "open") diff --git a/internal/tools/label_list.go b/internal/tools/label_list.go index 704782f..599b52c 100644 --- a/internal/tools/label_list.go +++ b/internal/tools/label_list.go @@ -43,7 +43,7 @@ func (t *LabelList) Call(ctx context.Context, raw json.RawMessage) (json.RawMess if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } labels, err := t.c.ListLabels(ctx, args.Owner, args.Repo) diff --git a/internal/tools/pr_comment.go b/internal/tools/pr_comment.go index 5e9deb8..fbbbab7 100644 --- a/internal/tools/pr_comment.go +++ b/internal/tools/pr_comment.go @@ -50,7 +50,7 @@ func (t *PRComment) Call(ctx context.Context, raw json.RawMessage) (json.RawMess if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } if args.Number < 1 { diff --git a/internal/tools/pr_create.go b/internal/tools/pr_create.go index ba17b2a..9d783f1 100644 --- a/internal/tools/pr_create.go +++ b/internal/tools/pr_create.go @@ -56,7 +56,7 @@ func (t *PRCreate) Call(ctx context.Context, raw json.RawMessage) (json.RawMessa if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } if args.Title == "" { diff --git a/internal/tools/pr_files_diff.go b/internal/tools/pr_files_diff.go index c48ccae..42b7310 100644 --- a/internal/tools/pr_files_diff.go +++ b/internal/tools/pr_files_diff.go @@ -63,7 +63,7 @@ func (t *PRFilesDiff) Call(ctx context.Context, raw json.RawMessage) (json.RawMe if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } if args.Number < 1 { diff --git a/internal/tools/pr_get.go b/internal/tools/pr_get.go index 717999a..c586a75 100644 --- a/internal/tools/pr_get.go +++ b/internal/tools/pr_get.go @@ -44,7 +44,7 @@ func (t *PRGet) Call(ctx context.Context, raw json.RawMessage) (json.RawMessage, if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } if args.Number < 1 { diff --git a/internal/tools/pr_list.go b/internal/tools/pr_list.go index 00e5c9f..838f985 100644 --- a/internal/tools/pr_list.go +++ b/internal/tools/pr_list.go @@ -51,7 +51,7 @@ func (t *PRList) Call(ctx context.Context, raw json.RawMessage) (json.RawMessage if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } state := args.State diff --git a/internal/tools/pr_merge.go b/internal/tools/pr_merge.go index 6467b8f..10d5f4b 100644 --- a/internal/tools/pr_merge.go +++ b/internal/tools/pr_merge.go @@ -52,7 +52,7 @@ func (t *PRMerge) Call(ctx context.Context, raw json.RawMessage) (json.RawMessag if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } if args.Number < 1 { diff --git a/internal/tools/release_create.go b/internal/tools/release_create.go index c4bf1a3..e39c3f1 100644 --- a/internal/tools/release_create.go +++ b/internal/tools/release_create.go @@ -55,7 +55,7 @@ func (t *ReleaseCreate) Call(ctx context.Context, raw json.RawMessage) (json.Raw if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } rel, err := t.c.CreateRelease(ctx, args.Owner, args.Repo, gitea.CreateReleaseArgs{ diff --git a/internal/tools/repo_create.go b/internal/tools/repo_create.go index 2ffae0f..baa81a0 100644 --- a/internal/tools/repo_create.go +++ b/internal/tools/repo_create.go @@ -53,7 +53,7 @@ func (t *RepoCreate) Call(ctx context.Context, raw json.RawMessage) (json.RawMes if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } createArgs := gitea.CreateRepoArgs{ diff --git a/internal/tools/repo_delete.go b/internal/tools/repo_delete.go index 275d270..5da12a4 100644 --- a/internal/tools/repo_delete.go +++ b/internal/tools/repo_delete.go @@ -46,7 +46,7 @@ func (t *RepoDelete) Call(ctx context.Context, raw json.RawMessage) (json.RawMes if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } if args.Confirm != args.Repo { diff --git a/internal/tools/repo_get.go b/internal/tools/repo_get.go index 456c441..3d48a2d 100644 --- a/internal/tools/repo_get.go +++ b/internal/tools/repo_get.go @@ -38,7 +38,7 @@ func (t *RepoGet) Call(ctx context.Context, raw json.RawMessage) (json.RawMessag if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } r, err := t.c.GetRepo(ctx, args.Owner, args.Repo) diff --git a/internal/tools/repo_list.go b/internal/tools/repo_list.go index 698cdcf..580006e 100644 --- a/internal/tools/repo_list.go +++ b/internal/tools/repo_list.go @@ -45,7 +45,7 @@ func (t *RepoList) Call(ctx context.Context, raw json.RawMessage) (json.RawMessa if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } args.Limit = capLimit(args.Limit, 30) diff --git a/internal/tools/repo_mirror_push.go b/internal/tools/repo_mirror_push.go index 2ffadc5..5f289f7 100644 --- a/internal/tools/repo_mirror_push.go +++ b/internal/tools/repo_mirror_push.go @@ -96,7 +96,7 @@ func (t *RepoMirrorPush) Call(ctx context.Context, raw json.RawMessage) (json.Ra if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } switch args.Action { diff --git a/internal/tools/repo_search.go b/internal/tools/repo_search.go index e9d102f..f5bad76 100644 --- a/internal/tools/repo_search.go +++ b/internal/tools/repo_search.go @@ -53,7 +53,7 @@ func (t *RepoSearch) Call(ctx context.Context, raw json.RawMessage) (json.RawMes return nil, fmt.Errorf("q is required: %w", gitea.ErrValidation) } if args.Owner != "" { - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } } @@ -75,7 +75,7 @@ func (t *RepoSearch) Call(ctx context.Context, raw json.RawMessage) (json.RawMes if len(parts) != 2 { continue } - if t.a.Check(parts[0]) == nil { + if t.a.Check(ctx, parts[0]) == nil { filtered = append(filtered, r) } } diff --git a/internal/tools/repo_status.go b/internal/tools/repo_status.go index 6c3e611..1e0e343 100644 --- a/internal/tools/repo_status.go +++ b/internal/tools/repo_status.go @@ -45,7 +45,7 @@ func (t *RepoStatus) Call(ctx context.Context, raw json.RawMessage) (json.RawMes if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } diff --git a/internal/tools/repo_topics_update.go b/internal/tools/repo_topics_update.go index 6f15e3e..e8a497b 100644 --- a/internal/tools/repo_topics_update.go +++ b/internal/tools/repo_topics_update.go @@ -45,7 +45,7 @@ func (t *RepoTopicsUpdate) Call(ctx context.Context, raw json.RawMessage) (json. if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } if err := t.c.UpdateTopics(ctx, args.Owner, args.Repo, args.Topics); err != nil { diff --git a/internal/tools/repo_tree.go b/internal/tools/repo_tree.go index 49128a5..a96b406 100644 --- a/internal/tools/repo_tree.go +++ b/internal/tools/repo_tree.go @@ -45,7 +45,7 @@ func (t *RepoTree) Call(ctx context.Context, raw json.RawMessage) (json.RawMessa if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } tree, err := t.c.GetTree(ctx, args.Owner, args.Repo, args.Ref, true) diff --git a/internal/tools/repo_update.go b/internal/tools/repo_update.go index 803ac18..28631e9 100644 --- a/internal/tools/repo_update.go +++ b/internal/tools/repo_update.go @@ -60,7 +60,7 @@ func (t *RepoUpdate) Call(ctx context.Context, raw json.RawMessage) (json.RawMes if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } diff --git a/internal/tools/tag_create.go b/internal/tools/tag_create.go index b40961e..065bf29 100644 --- a/internal/tools/tag_create.go +++ b/internal/tools/tag_create.go @@ -50,7 +50,7 @@ func (t *TagCreate) Call(ctx context.Context, raw json.RawMessage) (json.RawMess if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } if args.Tag == "" { diff --git a/internal/tools/tbd_ship.go b/internal/tools/tbd_ship.go index dba459b..49d22b6 100644 --- a/internal/tools/tbd_ship.go +++ b/internal/tools/tbd_ship.go @@ -145,7 +145,7 @@ func (t *TBDShip) Call(ctx context.Context, raw json.RawMessage) (json.RawMessag if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } if args.Path == "" || args.Content == "" || args.Message == "" { diff --git a/internal/tools/workflow_run_list.go b/internal/tools/workflow_run_list.go index 5732848..9f9f92c 100644 --- a/internal/tools/workflow_run_list.go +++ b/internal/tools/workflow_run_list.go @@ -57,7 +57,7 @@ func (t *WorkflowRunList) Call(ctx context.Context, raw json.RawMessage) (json.R if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } args.Limit = capLimit(args.Limit, 10) diff --git a/internal/tools/workflow_run_status.go b/internal/tools/workflow_run_status.go index 8ddac00..517a933 100644 --- a/internal/tools/workflow_run_status.go +++ b/internal/tools/workflow_run_status.go @@ -47,7 +47,7 @@ func (t *WorkflowRunStatus) Call(ctx context.Context, raw json.RawMessage) (json if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } if args.RunID < 1 { diff --git a/internal/tools/workflow_run_trigger.go b/internal/tools/workflow_run_trigger.go index 826a723..2792608 100644 --- a/internal/tools/workflow_run_trigger.go +++ b/internal/tools/workflow_run_trigger.go @@ -62,7 +62,7 @@ func (t *WorkflowRunTrigger) Call(ctx context.Context, raw json.RawMessage) (jso if err := parseArgs(raw, &args); err != nil { return nil, err } - if err := t.a.Check(args.Owner); err != nil { + if err := t.a.Check(ctx, args.Owner); err != nil { return nil, err } if args.Workflow == "" {