Initial curated projectbrain source from 8a7b1e0651dbdab97d744cbd2e653ab3970ac6c5

backend/src/mcp/scopeGuards.ts

@@ -0,0 +1,23 @@
+import { getLinkedRepository, listProjectRepositories, type LinkedRepository } from "../integrations/gitea/service.js";
+import { getFindingInvestigation, getRepositoryFinding } from "../repositories/findingRepository.js";
+
+export class PartialExternalMutationError extends Error {}
+
+export const requireLink = async (projectId: string, write = false, repositoryId?: string): Promise<LinkedRepository> => {
+  const link = repositoryId ? (await listProjectRepositories(projectId)).find((item) => item.id === repositoryId) : await getLinkedRepository(projectId);
+  if (!link) throw new Error("GITEA_LINK_NOT_FOUND");
+  if (write && link.accessMode !== "read_write") throw new Error("GITEA_REPOSITORY_READ_ONLY");
+  return link;
+};
+
+export const assertFindingProject = async (projectId: string, findingId: string) => {
+  const [link, finding] = await Promise.all([requireLink(projectId), getRepositoryFinding(findingId)]);
+  if (finding.projectId !== link.projectId) throw new Error("FINDING_PROJECT_SCOPE_MISMATCH");
+  return finding;
+};
+
+export const assertInvestigationProject = async (projectId: string, investigationId: string) => {
+  const [link, investigation] = await Promise.all([requireLink(projectId), getFindingInvestigation(investigationId)]);
+  if (investigation.projectId !== link.projectId) throw new Error("FINDING_PROJECT_SCOPE_MISMATCH");
+  return investigation;
+};