fix(bounties): add tests for claim_bounty repo-read gate (#160)

[Gravirei]

Summary

Add integration tests verifying the claim_bounty repo-read gate that was added in PR #157.

Motivation & context

Closes #160.

Issue #160 identified that claim_bounty was an ungated path to private bounty metadata — even though the authorize_repo_read gate was included in PR #157, no tests were added for it. These tests close the coverage gap.

What changed

• crates/gitlawb-node/src/test_support.rs: Added two integration tests:
  • claim_bounty_gate_denies_non_reader_on_private — a stranger claiming an open bounty on a private repo gets 404
  • claim_bounty_gate_admits_owner_on_private — the repo owner claiming their own open bounty on a private repo gets 200

How a reviewer can verify

cargo test -p gitlawb-node claim_bounty_gate -- --test-threads=1

Both tests follow the same patterns as the existing get_bounty_gate_* and star_repo_gate_* tests.

Before you request review

• Scope is one logical change; no unrelated churn
• New behavior is covered by tests
• cargo check and cargo clippy are clean

Summary by CodeRabbit

• Bug Fixes
  • Tightened access checks for claiming bounties on private repositories.
  • Non-authorized users now receive a not-found response when attempting to claim a private-repo bounty.
  • Repository owners can still successfully claim bounties on their private repositories.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

Thanks for the contribution. A couple of things will help us review this faster:

• This changes Rust source but no tests changed. Tests are required for fixes and strongly encouraged for features.

See CONTRIBUTING.md. Update the PR and these notes will clear automatically.

[coderabbitai]

Warning

Review limit reached

@Gravirei, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 43 minutes

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: ae978718-f127-46a2-b202-d5f4290030a8

📥 Commits

Reviewing files that changed from the base of the PR and between 14ed8ef and ee2968c.

📒 Files selected for processing (1)

• crates/gitlawb-node/src/api/profiles.rs

📝 Walkthrough

Walkthrough

Two new sqlx integration tests were added to test_support.rs validating the repo-scoped claim bounty gate: one confirms a non-reader claiming a bounty on a private repo receives NOT_FOUND, and another confirms the repo owner's claim succeeds.

Changes

Claim bounty gate tests

Layer / File(s)	Summary
Private repo claim gate integration tests crates/gitlawb-node/src/test_support.rs	Adds claim_bounty_gate_denies_non_reader_on_private and claim_bounty_gate_admits_owner_on_private tests that seed a private repo with a bounty, sign a POST /api/v1/bounties/{id}/claim request, run it via crate::server::build_router, and assert NOT_FOUND for non-owners and success for the owner.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested labels: kind:test, crate:node, subsystem:visibility, subsystem:api

Suggested reviewers: beardthelion, kevincodex1

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly states the main change: adding tests for the claim_bounty repo-read gate.
Linked Issues check	✅ Passed	The added deny and admit tests match #160's required 404/200 coverage for private-repo claim_bounty access.
Out of Scope Changes check	✅ Passed	The changes stay within the issue scope by adding only claim_bounty gate tests in test_support.rs.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[beardthelion]

Approving. The deny test is load-bearing: with the authorize_repo_read gate in claim_bounty (crates/gitlawb-node/src/api/bounties.rs:245-256) neutralized, the stranger's claim goes through and returns 200 instead of 404, so the test genuinely pins the gate rather than incidentally catching a bounty-not-found. The 404 it asserts is a real read-deny on a private repo with no reader rule, hiding existence the same way the sibling bounty read-surfaces do. Owner-admit clears the gate and returns 200. CI green, base current with main.

Two small non-blocking follow-ups if you want to extend this later:

Findings

• [P3] Cover the reader path, not just the owner short-circuit — crates/gitlawb-node/src/test_support.rs:3602. The admit test's claimant is the repo owner, so it is admitted before any reader_dids rule is consulted (crates/gitlawb-node/src/visibility.rs:85); the actual repo-read allow-list is never exercised. A case with a non-owner DID in a / rule's reader_dids would exercise it (that path admits and claims correctly).
• [P3] Assert the claim actually landed — crates/gitlawb-node/src/test_support.rs:3648. The admit test checks only is_success() and discards the returned record; asserting status == "claimed" and claimant_did would bind the mutation so a gate-passing no-op could not pass green.

Solid as-is. @kevincodex1 good to merge once you're happy with it.