[dosubot]

Update documentation for #3239

The guide now explicitly notes that all manual and automated checks for the multi-repo browser require an admin session, since non-admins are blocked. It updates the pytest setup to set session['user_id'] to ADMIN_USER_ID, adjusts test expectations to admin-only behavior, and adds a new test verifying non-admin users receive a 403 with admin_only for /repo/api/select-repo. The security section is expanded to document how /repo/* routes are protected via the blueprint before_request and _require_admin_for_repo_browser(), including the specific JSON/abort responses and the PR #3239 metadata exposure fix for /repo/api/repos.

Generated by Dosu

Summary by Sourcery

Document and validate administrator-only access across the multi-repository code browser.

Enhancements:

• Clarify that the multi-repository code browser is restricted to administrators and document its blueprint-level security behavior, responses, and fail-closed policy.

Documentation:

• Update the multi-repository implementation guide with administrator-only manual and automated testing guidance and the security implications of the repository browser.

Tests:

• Update repository browser test guidance and expectations for administrator access, including coverage of blocked non-administrator requests.

[sourcery-ai]

Sorry @dosubot[bot], you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[github-actions]

🧯 Dangerous deletes guard report

Policy: see .cursorrules — dangerous deletions are blocked unless wrapped safely.

Summary:

• Flagged findings (blocking): 0
  0
• Excluded matches (not blocking): 15
• Total matches (all files): 129

Flagged findings (file:line:snippet):
(none)

Excluded matches (by path pattern)

./webapp/static/js/md_preview.bundle.js.map:4:  "sourcesContent": ["// Markdown-it plugin to render GitHub-style task lists; see\n//\n// https://github.com/blog/1375-task-lists-in-gfm-issues-pulls-comments\n// https://github.com/blog/1825-t … [truncated]
./README.md:842:find . -name "__pycache__" -exec rm -rf {} +
./docs/DOCUMENTATION_GUIDE.md:453:rm -rf _build
./docs/Makefile:24:	rm -rf $(BUILDDIR)
./Dockerfile:42:    rm -rf /var/lib/apt/lists/*
./Dockerfile:121:    rm -rf /var/lib/apt/lists/*
./node_modules/katex/src/fonts/Makefile:139:	rm -rf pfa ff otf ttf woff woff2
./node_modules/katex/package.json:153:    "build": "rimraf dist/ && mkdirp dist && cp README.md dist && rollup -c --failAfterWarnings && webpack && node update-sri.js package dist/README.md",
./node_modules/mermaid/dist/mermaid.js.map:4:  "sourcesContent": ["/**\n* Default values for dimensions\n*/\nconst defaultIconDimensions = Object.freeze({\n\tleft: 0,\n\ttop: 0,\n\twidth: 16,\n\theight: 16\n});\n/**\n* Default values for tr … [truncated]
./node_modules/mermaid/dist/mermaid.min.js:1524:`,"getStyles"),c1e=RQe});var h1e={};dr(h1e,{diagram:()=>NQe});var NQe,f1e=N(()=>{"use strict";$ge();a1e();l1e();u1e();NQe={parser:Fge,db:n1e,renderer:o1e,styles:c1e}});var m1e,g1e=N(()=>{"use  … [truncated]
./node_modules/mermaid/dist/chunks/mermaid.esm/chunk-2M32CCKP.mjs.map:4:  "sourcesContent": ["{\n  \"name\": \"mermaid\",\n  \"version\": \"11.12.0\",\n  \"description\": \"Markdown-ish syntax for generating flowcharts, mindmaps, sequence d … [truncated]
./node_modules/mermaid/dist/chunks/mermaid.core/chunk-KS23V3DP.mjs.map:4:  "sourcesContent": ["{\n  \"name\": \"mermaid\",\n  \"version\": \"11.12.0\",\n  \"description\": \"Markdown-ish syntax for generating flowcharts, mindmaps, sequence  … [truncated]
./node_modules/mermaid/dist/chunks/mermaid.esm.min/chunk-4HFYJGYH.mjs.map:4:  "sourcesContent": ["{\n  \"name\": \"mermaid\",\n  \"version\": \"11.12.0\",\n  \"description\": \"Markdown-ish syntax for generating flowcharts, mindmaps, sequen … [truncated]
./node_modules/mermaid/dist/chunks/mermaid.esm.min/chunk-4HFYJGYH.mjs:1:var r={name:"mermaid",version:"11.12.0",description:"Markdown-ish syntax for generating flowcharts, mindmaps, sequence diagrams, class diagrams, gantt charts, git graph … [truncated]
./node_modules/mermaid/dist/mermaid.min.js.map:4:  "sourcesContent": ["/**\n* Default values for dimensions\n*/\nconst defaultIconDimensions = Object.freeze({\n\tleft: 0,\n\ttop: 0,\n\twidth: 16,\n\theight: 16\n});\n/**\n* Default values fo … [truncated]

[sourcery-ai]

Reviewer's Guide

This PR clarifies that the multi-repo browser is admin-only, updates the multi-repo implementation guide and pytest examples accordingly, and adds/adjusts tests and security documentation around admin gating and 403/admin_only behavior for /repo/* routes.

Sequence diagram for admin-only gating of /repo/api/select-repo

sequenceDiagram
    actor User
    participant repo_bp
    participant _require_admin_for_repo_browser
    participant is_admin
    participant RepoApi

    User->>repo_bp: POST /repo/api/select-repo
    repo_bp->>_require_admin_for_repo_browser: before_request
    _require_admin_for_repo_browser->>is_admin: is_admin(user_id from session)
    alt [user is admin]
        _require_admin_for_repo_browser-->>repo_bp: allow
        repo_bp->>RepoApi: POST /repo/api/select-repo
        RepoApi-->>User: 200 JSON success
    else [user is not admin]
        _require_admin_for_repo_browser-->>User: 403 JSON {success:false, error: admin_only}
    end

Loading

File-Level Changes

Change	Details	Files
Clarify that multi-repo browser manual checks require an admin session and document admin-only behavior in example curl commands.	Add a highlighted note that all manual checks for the code browser require an admin session because non-admins are blocked. Annotate curl examples for /repo/api/repos and /repo/api/tree to indicate they require an admin session and that non-admins receive 403. Update the manual flow for repo switching to explicitly state that the tester must log in as admin first.	GUIDES/multi-repo-implementation-guide.md
Update pytest guidance and examples so automated tests run as an admin user and verify non-admin blocking behavior.	Add ADMIN_USER_ID constant in the example test module and explain it should be set to the appropriate admin user id. Introduce a client fixture that sets session['user_id'] = ADMIN_USER_ID to simulate an admin session for repo browser tests. Update existing tests' docstrings to clarify they cover admin-only behavior for /repo/api/repos, /repo/api/tree, and file access. Replace the previous unauthenticated select-repo test with a new test that ensures a non-admin session receives a 403 and an 'admin_only' error from /repo/api/select-repo.	GUIDES/multi-repo-implementation-guide.md
Expand the security section to describe admin-only protection for /repo/* routes and document the metadata exposure fix from PR #3239.	Document that all /repo/* routes are admin-only and enforced via @repo_bp.before_request at the blueprint level, covering current and future routes. Explain that _require_admin_for_repo_browser() checks is_admin(user_id) from the session and details the differing responses for API routes (JSON with success:false, error:'admin_only', 403) versus page routes (abort(403)). Note that PR fix(security): דפדפן הקוד חסום לאדמינים בלבד #3239 fixed a security issue where /repo/api/repos previously exposed full repo metadata (including private repo names and URLs) to any logged-in user. Retain and slightly reposition existing notes about repo name regex validation and DB-based repo visibility to fit the expanded security context.	GUIDES/multi-repo-implementation-guide.md

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[github-actions]

⏱️ Performance report

• Run: https://github.com/amirbiron/CodeBot/actions/runs/32200980709
• Artifact: perf-durations

(No performance test durations collected. Mark tests with @pytest.mark.performance.)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!