perf: bound My Work authorization requests (#171)

tests/test_gitea_work_search.py

@@ -142,53 +142,75 @@ async def test_pull_request_searches_start_concurrently(monkeypatch):
 
 
 @pytest.mark.anyio
-async def test_requested_review_guard_uses_only_dedicated_review_search(monkeypatch):
+async def test_requested_review_guard_uses_direct_pull_and_current_user(monkeypatch):
     requested = []
 
-    async def fake_page(stream, page=1, limit=50):
-        requested.append((stream, page))
-        items = [] if page == 1 else [{
-            "number": 77,
-            "repository": {"full_name": "stackchain/api"},
-        }]
+    async def fake_fetch(path):
+        requested.append(path)
+        if path == "user":
+            return {"login": "timmy"}
+        assert path == "repos/stackchain/api/pulls/77"
         return {
-            "stream": stream, "items": items, "page": page,
-            "total": 51, "has_more": page == 1,
+            "state": "open",
+            "requested_reviewers": [{"login": "timmy"}],
         }
 
-    monkeypatch.setattr(gitea_proxy, "work_page", fake_page)
+    async def reject_search(*args, **kwargs):
+        raise AssertionError("authorization must not scan review search pages")
+
+    monkeypatch.setattr(gitea_proxy, "fetch", fake_fetch)
+    monkeypatch.setattr(gitea_proxy, "work_page", reject_search)
 
     assert await gitea_proxy.is_requested_review("stackchain/api", 77) is True
-    assert await gitea_proxy.is_requested_review("stackchain/api", 9) is False
-    assert requested == [
-        ("review", 1), ("review", 2),
-        ("review", 1), ("review", 2),
-    ]
+    assert sorted(requested) == ["repos/stackchain/api/pulls/77", "user"]
 
 
 @pytest.mark.anyio
-async def test_assignment_guards_find_eligible_items_beyond_first_page(monkeypatch):
+async def test_assigned_issue_guard_uses_direct_target_and_current_user(monkeypatch):
     requested = []
 
-    async def fake_page(stream, page=1, limit=50):
-        requested.append((stream, page))
+    async def fake_fetch(path):
+        requested.append(path)
+        if path == "user":
+            return {"login": "timmy"}
+        assert path == "repos/stackchain/api/issues/77"
         return {
-            "stream": stream,
-            "items": [] if page == 1 else [{
-                "number": 77,
-                "repository": {"full_name": "stackchain/api"},
-            }],
-            "page": page, "total": 51, "has_more": page == 1,
+            "state": "open",
+            "assignees": [{"login": "timmy"}],
         }
 
-    monkeypatch.setattr(gitea_proxy, "work_page", fake_page)
+    async def reject_search(*args, **kwargs):
+        raise AssertionError("authorization must not scan work search pages")
+
+    monkeypatch.setattr(gitea_proxy, "fetch", fake_fetch)
+    monkeypatch.setattr(gitea_proxy, "work_page", reject_search)
 
     assert await gitea_proxy.is_assigned_issue("stackchain/api", 77) is True
+    assert sorted(requested) == ["repos/stackchain/api/issues/77", "user"]
+
+
+@pytest.mark.anyio
+async def test_assigned_pull_guard_uses_direct_target_and_current_user(monkeypatch):
+    requested = []
+
+    async def fake_fetch(path):
+        requested.append(path)
+        if path == "user":
+            return {"login": "timmy"}
+        assert path == "repos/stackchain/api/pulls/77"
+        return {
+            "state": "open",
+            "assignees": [{"login": "timmy"}],
+        }
+
+    async def reject_search(*args, **kwargs):
+        raise AssertionError("authorization must not scan work search pages")
+
+    monkeypatch.setattr(gitea_proxy, "fetch", fake_fetch)
+    monkeypatch.setattr(gitea_proxy, "work_page", reject_search)
+
     assert await gitea_proxy.is_assigned_pull("stackchain/api", 77) is True
-    assert requested == [
-        ("issue", 1), ("issue", 2),
-        ("pull", 1), ("pull", 2),
-    ]
+    assert sorted(requested) == ["repos/stackchain/api/pulls/77", "user"]
 
 
 @pytest.mark.anyio