[yordis]

• LFS upload batches did not require write access, and the sign-in popup could post the principal's identity to any opener origin.
• Brings in fix(auth): constrain LFS writes and popup identity messages tobi/walgit#63 by tobi, cherry-picked with original authorship; the upstream test fails on our main and passes with this change.

[cursor]

PR Summary

High Risk
Changes authentication for LFS batch uploads and cross-origin sign-in messaging—both are security-sensitive paths where mistakes could allow unauthorized writes or leak identity to untrusted pages.

Overview
Closes two authorization gaps: LFS batch upload now requires write (download still requires read; unknown operation → 400), and the sign-in popup no longer broadcasts identity with postMessage(..., "*").

The authenticate page accepts optional ?origin= only when it matches a configured CORS origin (parsed via the new url dependency so wildcard/exact checks reject strings a browser would read as a different origin). The HTML embeds the principal with JSON/script-safe substitution; web/sdk/repos.ts passes the caller origin cross-site and accepts messages only from the server origin and the popup window.

Integration tests cover script injection in principal names, disallowed origins, and read-only tokens on LFS upload.

^{Reviewed by Cursor Bugbot for commit f82cead. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 741654e1-dd01-41b2-a20d-fbe322f78631

Commits

Reviewing files that changed from the base of the PR and between 2668870 and f82cead.

Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

Files selected for processing: 7

• Cargo.toml
• crates/walgit-server/Cargo.toml
• crates/walgit-server/src/lfs.rs
• crates/walgit-server/src/web/v1.rs
• crates/walgit-server/tests/api_v1.rs
• web/API.md
• web/sdk/repos.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8225bac. Configure here.}