Ashwin Bhat 1dc994ee7a

Resolve actor account type before applying allowed_bots (#1330) ...

Move the allowed_bots check in checkHumanActor and checkWritePermissions so
it only fires after the actor has been resolved as a non-User account
(GitHub App / bot, or unresolvable app actor). Actors that resolve to a
regular User account go through the standard human/write checks regardless
of allowed_bots.

The Copilot-style path (GITHUB_ACTOR not ending in [bot] and not resolvable
as a user) is unchanged: it still falls through to the existing 404 catch,
which already consults allowed_bots once the API has reported the actor is
not a user.

Update tests to match and add coverage for the User-account path.

2026-05-19 16:30:49 -07:00

..

actor.ts

Resolve actor account type before applying allowed_bots (#1330)

2026-05-19 16:30:49 -07:00

permissions.ts

Resolve actor account type before applying allowed_bots (#1330)

2026-05-19 16:30:49 -07:00

trigger.ts

fix: make trigger_phrase match case-insensitive (#1279)

2026-05-02 10:10:30 -07:00