fix(control-panel): revoke owner-match scope for suspended installations (#953)

[jason020818]

Summary

Fixes #953. buildControlPanelAccessScope / buildControlPanelRoleSummary granted control-panel scope to a user's own installed repos through the owner-match branch (sameLogin(repo.owner, args.login)) without checking suspension — even though the installation-id branch is already suspend-aware (accountInstallationIds excludes suspendedAt).

Because the installation suspend webhook does not flip repositories.isInstalled to false, a user who suspended the App still retained control-panel access to their own repo's private gittensory data — the exact access the suspend was meant to revoke.

Fix

Compute suspendedAccountInstallationIds (installations with suspendedAt set for the same account login) and exclude any repo under such an installation from ownedInstalledRepos, in both functions. The owner-match branch can no longer override suspension; non-suspended owners are unaffected.

Tests

• buildControlPanelAccessScope: a suspended owner's repo yields an empty scope (no repos/installations/logins).
• buildControlPanelRoleSummary: a suspended owner gets no owner/maintainer role and zero owned/account evidence.
• npx vitest run test/unit/control-panel-roles.test.ts → 9 passed · npx tsc --noEmit → clean · git diff --check → clean.

Closes #953.

[ghost]

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ Maintainer review — Ready to merge

Reviewed 2 changed file(s) — two independent AI reviewers, synthesized. ✅ Safe to merge — both reviewers found no blocking issues.

Summary

The changes correctly prevent repos under suspended installations from granting control‑panel scope via owner‑match logic, fixing a security/permission regression. Added tests verify the new behavior. No new security concerns, build passes, and existing functionality is preserved.

💡 Nits — non-blocking, optional

• The double negation in the filter could be simplified for readability.
• Comment could mention that the check also applies to maintainer role logic for consistency.
• Consider extracting the suspended‑installation filter into a helper function for readability.
• The test uses hard‑coded ISO strings for dates; using Date objects or a constant would make intent clearer.
• Consider extracting the suspended installation ID set and filter logic into a reusable helper function to reduce duplication between buildControlPanelAccessScope and buildControlPanelRoleSummary.
• The filter condition for ownedInstalledRepos is complex; splitting it into named intermediate variables could improve readability without changing behavior.

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#966 is no longer open.	No action.

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.64%. Comparing base (afbe222) to head (dd785cf).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #966   +/-   ##
=======================================
  Coverage   96.64%   96.64%           
=======================================
  Files         110      110           
  Lines       15033    15039    +6     
  Branches     5432     5434    +2     
=======================================
+ Hits        14528    14534    +6     
  Misses        104      104           
  Partials      401      401           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ghost]

Both reviewers approved, all CI is green, and this is a small, low-risk change — auto-merging.