fix(github): restrict POST /github/sync/:owner/:repo with auth, roles, allowlist and throttling (#62)

[ghzhost]

Summary

Resolves #62.

Problem

Previously, POST /github/sync/:owner/:repo was unauthenticated and had no allowlist or role checks, allowing anyone to trigger expensive sync operations against arbitrary public GitHub repositories. Because GitHub REST API rate limits are shared platform-wide across the single GITHUB_API_TOKEN (5,000 req/hr), an attacker could exhaust the quota on unrelated repositories and cause legitimate syncs to fail with GithubSyncInterruptedError.

Solution

1. Authentication & Authorization (JwtAuthGuard & Role gating):
   • Protected POST /github/sync/:owner/:repo behind @UseGuards(JwtAuthGuard) and @ApiBearerAuth().
   • Restricted execution to users with MAINTAINER, SPONSOR, or admin roles, preventing unauthorized users from triggering syncs.
2. Repository Allowlist Validation:
   • Added findRepositoryByOwnerAndName(owner, repo) in GithubSyncService.
   • Verified that the target repository is already tracked in the repositories table before proceeding with sync; untracked repositories return 404 Not Found.
3. Dedicated Route Throttling:
   • Applied @Throttle({ default: { limit: 5, ttl: 60_000 } }) to ensure the endpoint has a strict request budget tailored to its high downstream cost.
4. Unit Tests:
   • Added unit test suite in src/github/github.controller.spec.ts covering role rejection (403 Forbidden), untracked repository rejection (404 Not Found), and successful sync dispatch for maintainers and sponsors.

Acceptance Criteria Checklist

• POST /github/sync/:owner/:repo requires authentication and maintainer/sponsor role.
• Restricts sync targets to already-tracked repositories in MergeFi database.
• Dedicated throttle limit (5 req / 60s) applied directly to the route.
• Comprehensive unit tests verifying access control, allowlist rejection, and execution paths.

[vercel]

Someone is attempting to deploy a commit to the chonilius' projects Team on Vercel.

A member of the Team first needs to authorize it.