From aaa2a9fdeeea625ab78524914dce8623762d4dc8 Mon Sep 17 00:00:00 2001
From: quality <280983584+hivecommons-hive[bot]@users.noreply.github.com>
Date: Wed, 21 Oct 2026 01:00:38 -0400
Subject: [PATCH] test(assign,cc): pin that /assign and /cc write only the
 authorized subset of a mixed argument list

A single-operator mutation probe over src/issueComment/{assign,unassign,cc,uncc}.ts
(24 mutants, npx vitest related <file> --run) left two survivors: replacing
assignees: authUsers with assignees: commentArgs in assign.ts, and the same swap
for reviewers in cc.ts, passed all 576 related tests. Every unit case either
authorizes every argument user or none, so the write body never differed from
the raw arguments.

Adds one case to each file where the arguments mix an org member with a user
who fails all three checks, asserting the POST carries only the authorized
user. The two mutants now fail one test each.

Signed-off-by: quality <280983584+hivecommons-hive[bot]@users.noreply.github.com>
---
 __tests__/issueCommentTest/assign.test.ts | 42 +++++++++++++++++++++++
 __tests__/issueCommentTest/cc.test.ts     | 42 +++++++++++++++++++++++
 2 files changed, 84 insertions(+)

diff --git a/__tests__/issueCommentTest/assign.test.ts b/__tests__/issueCommentTest/assign.test.ts
index 60966d53..0e2272e8 100644
--- a/__tests__/issueCommentTest/assign.test.ts
+++ b/__tests__/issueCommentTest/assign.test.ts
@@ -168,6 +168,48 @@ describe('/assign', () => {
     expect((await observeReq.body()).assignees.sort()).toEqual(['other-user', 'some-user'])
   })
 
+  it('assigns only the authorized subset when the arguments mix authorized and unknown users', async () => {
+    issueCommentEventAssign.comment.body = '/assign @some-user @stranger'
+
+    server.use(
+      http.get(
+        `${utils.api}/orgs/Codertocat/members/some-user`,
+        utils.mockResponse(204),
+      ),
+      http.get(
+        `${utils.api}/orgs/Codertocat/members/stranger`,
+        utils.mockResponse(404),
+      ),
+      http.get(
+        `${utils.api}/repos/Codertocat/Hello-World/collaborators/some-user`,
+        utils.mockResponse(404),
+      ),
+      http.get(
+        `${utils.api}/repos/Codertocat/Hello-World/collaborators/stranger`,
+        utils.mockResponse(404),
+      ),
+      http.get(
+        `${utils.api}/repos/Codertocat/Hello-World/issues/1/comments`,
+        utils.mockResponse(404),
+      ),
+    )
+
+    const observeReq = new utils.ObserveRequest()
+    server.use(
+      http.post(
+        `${utils.api}/repos/Codertocat/Hello-World/issues/1/assignees`,
+        utils.mockResponse(201, issueAssignedResp, observeReq),
+      ),
+    )
+
+    const commentContext = new utils.MockContext(issueCommentEventAssign)
+
+    await handleIssueComment(commentContext)
+    await observeReq.called()
+    // the write carries getOrgCollabCommentUsers' filtered list, not the raw arguments
+    expect(await observeReq.body()).toEqual({ assignees: ['some-user'] })
+  })
+
   it('assigns users from every /assign line in the comment', async () => {
     issueCommentEventAssign.comment.body = '/assign @some-user\nplease also take a look\n/assign @other-user'
 
diff --git a/__tests__/issueCommentTest/cc.test.ts b/__tests__/issueCommentTest/cc.test.ts
index 2ce0f73b..a1cdd975 100644
--- a/__tests__/issueCommentTest/cc.test.ts
+++ b/__tests__/issueCommentTest/cc.test.ts
@@ -161,6 +161,48 @@ describe('/cc', () => {
     expect((await observeReq.body()).reviewers.sort()).toEqual(['other-user', 'some-user'])
   })
 
+  it('requests reviews from only the authorized subset when the arguments mix authorized and unknown users', async () => {
+    issueCommentEvent.comment.body = '/cc @some-user @stranger'
+
+    server.use(
+      http.get(
+        `${utils.api}/orgs/Codertocat/members/some-user`,
+        utils.mockResponse(204),
+      ),
+      http.get(
+        `${utils.api}/orgs/Codertocat/members/stranger`,
+        utils.mockResponse(404),
+      ),
+      http.get(
+        `${utils.api}/repos/Codertocat/Hello-World/collaborators/some-user`,
+        utils.mockResponse(404),
+      ),
+      http.get(
+        `${utils.api}/repos/Codertocat/Hello-World/collaborators/stranger`,
+        utils.mockResponse(404),
+      ),
+      http.get(
+        `${utils.api}/repos/Codertocat/Hello-World/issues/1/comments`,
+        utils.mockResponse(404),
+      ),
+    )
+
+    const observeReq = new utils.ObserveRequest()
+    server.use(
+      http.post(
+        `${utils.api}/repos/Codertocat/Hello-World/pulls/1/requested_reviewers`,
+        utils.mockResponse(201, pullReviewRequested, observeReq),
+      ),
+    )
+
+    const commentContext = new utils.MockContext(issueCommentEvent)
+
+    await handleIssueComment(commentContext)
+    await observeReq.called()
+    // the write carries getOrgCollabCommentUsers' filtered list, not the raw arguments
+    expect(await observeReq.body()).toEqual({ reviewers: ['some-user'] })
+  })
+
   it('ccs user if they are an org member', async () => {
     issueCommentEvent.comment.body = '/cc @some-user'