fix: enforce tracked-repo allowlist on repo-scoped API routes

src/app/api/gt/repos/[owner]/[name]/miners/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from 'next/server';
+import { assertTrackedRepo } from '@/lib/assert-tracked-repo';
 import { getReadDb } from '@/lib/db';
 import { backfillPrIssueLinksIfNeeded } from '@/lib/refresh';
 
@@ -102,6 +103,8 @@ async function getShared(): Promise<CachedShared> {
 
 export async function GET(_req: Request, ctx: { params: Promise<{ owner: string; name: string }> }) {
   const params = await ctx.params;
+  const denied = await assertTrackedRepo(params.owner, params.name);
+  if (denied) return denied;
   const fullName = `${params.owner}/${params.name}`;
   const fullNameKey = fullName.toLowerCase();
   try {

src/app/api/gt/repos/[owner]/[name]/prs/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from 'next/server';
+import { assertTrackedRepo } from '@/lib/assert-tracked-repo';
 import type { GtRepoPr, GtRepoPrsResponse } from '@/types/entities';
 
 export const dynamic = 'force-dynamic';
@@ -91,6 +92,8 @@ async function getShared(): Promise<Cached> {
 
 export async function GET(_req: Request, ctx: { params: Promise<{ owner: string; name: string }> }) {
   const params = await ctx.params;
+  const denied = await assertTrackedRepo(params.owner, params.name);
+  if (denied) return denied;
   const fullName = `${params.owner}/${params.name}`;
   try {
     const shared = await getShared();

src/app/api/related-prs/[owner]/[name]/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
+import { assertTrackedRepo } from '@/lib/assert-tracked-repo';
 import { getReadDb } from '@/lib/db';
 import { backfillPrIssueLinksIfNeeded } from '@/lib/refresh';
 import { buildEtag, etagNotModified, withEtagHeaders } from '@/lib/etag';
@@ -16,6 +17,8 @@ export async function GET(
   ctx: { params: Promise<{ owner: string; name: string }> }
 ) {
   const params = await ctx.params;
+  const denied = await assertTrackedRepo(params.owner, params.name);
+  if (denied) return denied;
   const repo = `${params.owner}/${params.name}`;
   const db = getReadDb();
 

src/app/api/repos/[owner]/[name]/authors/[login]/issues/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
+import { assertTrackedRepo } from '@/lib/assert-tracked-repo';
 import { getReadDb, type IssueRow } from '@/lib/db';
 import { authorCredibilityForRepo, getGittensorCredibilityIndex } from '@/lib/gittensor-credibility';
 import { getIssueDiscoveryDisabledReposAsyncServer } from '@/lib/repos-server';
@@ -24,6 +25,8 @@ export async function GET(
   ctx: { params: Promise<{ owner: string; name: string; login: string }> },
 ) {
   const params = await ctx.params;
+  const denied = await assertTrackedRepo(params.owner, params.name);
+  if (denied) return denied;
   const full = `${params.owner}/${params.name}`;
   const login = params.login;
   const url = new URL(req.url);

src/app/api/repos/[owner]/[name]/authors/[login]/pulls/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
+import { assertTrackedRepo } from '@/lib/assert-tracked-repo';
 import { getReadDb, type PullRow } from '@/lib/db';
 import { authorCredibilityForRepo, getGittensorCredibilityIndex } from '@/lib/gittensor-credibility';
 import { getIssueDiscoveryDisabledReposAsyncServer } from '@/lib/repos-server';
@@ -14,6 +15,8 @@ export async function GET(
   ctx: { params: Promise<{ owner: string; name: string; login: string }> },
 ) {
   const params = await ctx.params;
+  const denied = await assertTrackedRepo(params.owner, params.name);
+  if (denied) return denied;
   const full = `${params.owner}/${params.name}`;
   const login = params.login;
   const url = new URL(req.url);

src/app/api/repos/[owner]/[name]/badges/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
+import { assertTrackedRepo } from '@/lib/assert-tracked-repo';
 import { getDb } from '@/lib/db';
 import { buildEtag, etagNotModified, withEtagHeaders } from '@/lib/etag';
 
@@ -26,6 +27,8 @@ export async function GET(
   ctx: { params: Promise<{ owner: string; name: string }> },
 ) {
   const params = await ctx.params;
+  const denied = await assertTrackedRepo(params.owner, params.name);
+  if (denied) return denied;
   const full = `${params.owner}/${params.name}`;
   const db = getDb();
 

src/app/api/repos/[owner]/[name]/issues-meta/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
+import { assertTrackedRepo } from '@/lib/assert-tracked-repo';
 import { getReadDb } from '@/lib/db';
 import { backfillPrIssueLinksIfNeeded } from '@/lib/refresh';
 import { buildEtag, etagNotModified, withEtagHeaders } from '@/lib/etag';
@@ -13,6 +14,8 @@ export async function GET(
   ctx: { params: Promise<{ owner: string; name: string }> }
 ) {
   const params = await ctx.params;
+  const denied = await assertTrackedRepo(params.owner, params.name);
+  if (denied) return denied;
   const full = `${params.owner}/${params.name}`;
   const db = getReadDb();
   const url = new URL(req.url);

src/app/api/repos/[owner]/[name]/issues/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
+import { assertTrackedRepo } from '@/lib/assert-tracked-repo';
 import { getReadDb, IssueRow } from '@/lib/db';
 import { refreshIssuesIfStale, backfillPrIssueLinksIfNeeded } from '@/lib/refresh';
 import { buildEtag, etagNotModified, withEtagHeaders } from '@/lib/etag';
@@ -37,6 +38,8 @@ export async function GET(
 ) {
   const params = await ctx.params;
   const { owner, name } = params;
+  const denied = await assertTrackedRepo(owner, name);
+  if (denied) return denied;
   const full = `${owner}/${name}`;
 
   // Refresh is the poller's job — calling it from per-request handlers caused

src/app/api/repos/[owner]/[name]/pulls-meta/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
+import { assertTrackedRepo } from '@/lib/assert-tracked-repo';
 import { getReadDb } from '@/lib/db';
 import { buildEtag, etagNotModified, withEtagHeaders } from '@/lib/etag';
 
@@ -9,6 +10,8 @@ export async function GET(
   ctx: { params: Promise<{ owner: string; name: string }> }
 ) {
   const params = await ctx.params;
+  const denied = await assertTrackedRepo(params.owner, params.name);
+  if (denied) return denied;
   const full = `${params.owner}/${params.name}`;
   const db = getReadDb();
   const url = new URL(req.url);

src/app/api/repos/[owner]/[name]/pulls/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
+import { assertTrackedRepo } from '@/lib/assert-tracked-repo';
 import { getReadDb, PullRow } from '@/lib/db';
 import { refreshPullsIfStale } from '@/lib/refresh';
 import { buildEtag, etagNotModified, withEtagHeaders } from '@/lib/etag';
@@ -27,6 +28,8 @@ export async function GET(
 ) {
   const params = await ctx.params;
   const { owner, name } = params;
+  const denied = await assertTrackedRepo(owner, name);
+  if (denied) return denied;
   const full = `${owner}/${name}`;
 
   // Poller handles refresh on its own cadence — see the same note in the

src/app/api/repos/[owner]/[name]/validations/[number]/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
+import { assertTrackedRepo } from '@/lib/assert-tracked-repo';
 import { getDb } from '@/lib/db';
 import { getSessionFromCookies } from '@/lib/auth';
 
@@ -15,6 +16,8 @@ export async function POST(
   ctx: { params: Promise<{ owner: string; name: string; number: string }> },
 ) {
   const params = await ctx.params;
+  const denied = await assertTrackedRepo(params.owner, params.name);
+  if (denied) return denied;
   const session = await getSessionFromCookies();
   if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });