GitHub repo owner gates catalog admin

Platform spec ADR

GitHub repo owner gates catalog admin

Back to Beskid Nexus ◎ Open feature in platform map

Spec standingStandard

Owner

Piotr Mikstacki pmikstacki@cybernomad.it

Submitter

Piotr Mikstacki pmikstacki@cybernomad.it

Current document

Articles

• Contracts and edge cases Nexus REST API contracts, CodeDocRecord rules, spec link validation, auth/me ownedRepoIds, and MCP Bearer requirements. article Standard Reviewed Sat May 30
• Design model Graph-first landing, navbar shell, global registry, code-doc vs platform-spec separation, and MCP connect surface. article Standard Reviewed Sat May 30

History

0 revisions (git unavailable at build; counts may be empty)

Open full history on GitHub

No commits recorded for this path.

Completeness

OKarea · 4 SpecSection(s) · 0 H2 heading(s)

Section id	Required	Found
what-this-feature-specifies	yes	yes
implementation-anchors	yes	yes

Full tree: run pnpm verify:platform-spec-layout (writes src/generated/platform-spec-layout-report.json).

Related spec docs

• Feature
  Beskid Nexus

  Parent feature hub

Context

GitNexus used a static admin roster for catalog mutations. Beskid Nexus indexes public graphs for many repositories — administration should follow GitHub ownership, not a deployment-time username list that does not scale across contributors and org repos.

Instance operators still need bootstrap authority for auth hub pairing and secrets — distinct from day-to-day repo administration.

Decision

1. POST/PATCH/DELETE /api/admin/catalog* and POST .../analyze and POST .../refresh-docs require the session user to be owner or admin of the entry’s gitUrl per GitHub API (GET /repos/{owner}/{repo} with hub user token).
2. GET /api/auth/me must expose ownedRepoIds — catalog ids the user may administer — for UI gating.
3. requireAdmin (env roster) is retained only for POST /api/admin/auth/pair and first-run setup endpoints.
4. Ownership verification may be cached up to 15 minutes per (login, gitUrl).
5. Non-owners receive 403 on mutating routes.

Consequences

• github-ownership.ts centralizes URL parsing and API checks.
• Frontend admin sheet gates on ownedRepoIds.includes(activeEntry.id).
• Public catalog and graph routes remain unauthenticated.

Status

Accepted — reference implementation in beskid_nexus/gitnexus/src/server/nexus/github-ownership.ts.