fix(api): restrict public GitHub stats proxy

[JSONbored]

Motivation

• Close an unauthenticated arbitrary-repo GitHub proxy that used the deployment GITHUB_PUBLIC_TOKEN and could be abused to exhaust upstream quota and grow an unbounded cache.
• Ensure the website-facing stats endpoint only serves the intended jsonbored/gittensory chip and cannot be abused via varying owner/repo path segments.

Description

• Add explicit allowlisting by introducing PUBLIC_REPO_STATS_OWNER/PUBLIC_REPO_STATS_REPO and reject non-allowlisted owner/repo values in publicRepoFullName (in src/github/public.ts) so arbitrary repo requests return 400 before any GitHub fetch.
• Normalize the rate-limit key for the public stats route in rateLimitKey (in src/auth/rate-limit.ts) by mapping /v1/public/github/repos/:owner/:repo/stats to a canonical path so varying owner/repo do not create separate rate-limit buckets.
• Update the OpenAPI source (src/openapi/spec.ts) and generated UI OpenAPI (apps/gittensory-ui/public/openapi.json) to document that only JSONbored/gittensory is accepted and non-allowlisted requests produce 400.
• Add regression tests: integration test to assert non-allowlisted public stats paths are rejected without calling fetch and a unit test asserting rate-limit key normalization for the public stats route (files under test/integration and test/unit).

Testing

• Ran npx vitest run test/integration/api.test.ts test/unit/auth.test.ts test/unit/openapi.test.ts --reporter=verbose and all tests passed.
• Ran type checks with npm run typecheck and the project compiled with no type errors.
• Ran the UI OpenAPI check with npm run ui:openapi:check and it completed successfully.

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	9f25f6b	Commit Preview URL Branch Preview URL	Jun 08 2026, 07:56 AM

[gittensory]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#461 is no longer open.	No action.

---

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent found 1 security concern(s).