From e687cd400704237c42abc23e6ad5728d5ac21730 Mon Sep 17 00:00:00 2001
From: choniszn1 <277282434+choniszn1@users.noreply.github.com>
Date: Thu, 15 Oct 2026 16:23:18 +0100
Subject: [PATCH 1/2] fix(auth): type RepoScopeGuard params via Request generic
 (#495)

Redeclaring params as optional conflicted with express.Request's
required ParamsDictionary (TS2430).
---
 src/auth/guards/repo-scope.guard.ts | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/auth/guards/repo-scope.guard.ts b/src/auth/guards/repo-scope.guard.ts
index 0e70ef2c..28010a79 100644
--- a/src/auth/guards/repo-scope.guard.ts
+++ b/src/auth/guards/repo-scope.guard.ts
@@ -17,9 +17,11 @@ import { ROLES_KEY } from '../decorators/roles.decorator';
 import { REPO_SCOPED_SYNC_KEY } from '../decorators/repo-scoped-sync.decorator';
 import { AppConfig } from '../../config/configuration';
 
-interface AuthenticatedRequest extends Request {
+interface AuthenticatedRequest extends Request<{
+  owner?: string;
+  repo?: string;
+}> {
   user?: { userId: string };
-  params?: { owner?: string; repo?: string };
 }
 
 /**

From a0702f24208975279fec1c000a4422cd7422a92e Mon Sep 17 00:00:00 2001
From: choniszn1 <277282434+choniszn1@users.noreply.github.com>
Date: Thu, 15 Oct 2026 16:23:18 +0100
Subject: [PATCH 2/2] chore(auth): drop unused ROLES_KEY import in
 RepoScopeGuard (#495)

Also applies prettier --fix to the file so it lints clean.
---
 src/auth/guards/repo-scope.guard.ts | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/src/auth/guards/repo-scope.guard.ts b/src/auth/guards/repo-scope.guard.ts
index 28010a79..a5549ee8 100644
--- a/src/auth/guards/repo-scope.guard.ts
+++ b/src/auth/guards/repo-scope.guard.ts
@@ -13,7 +13,6 @@ import { Repository } from 'typeorm';
 import { Repository as RepositoryEntity } from '../../common/entities';
 import { User } from '../../common/entities';
 import { UserRole } from '../../common/enums';
-import { ROLES_KEY } from '../decorators/roles.decorator';
 import { REPO_SCOPED_SYNC_KEY } from '../decorators/repo-scoped-sync.decorator';
 import { AppConfig } from '../../config/configuration';
 
@@ -77,7 +76,8 @@ export class RepoScopeGuard implements CanActivate {
       where: { id: request.user.userId },
       select: { id: true, roles: true },
     });
-    if (!user) throw new ForbiddenException('Authenticated user no longer exists');
+    if (!user)
+      throw new ForbiddenException('Authenticated user no longer exists');
     if (!user.roles.includes(UserRole.MAINTAINER)) {
       throw new ForbiddenException('Maintainer role required');
     }
@@ -106,14 +106,18 @@ export class RepoScopeGuard implements CanActivate {
 
     // Tracked with no maintainer yet: allow, and claim it for this user so the
     // scope is explicit from here on.
-    await this.repositoryRepo.update({ id: tracked.id }, { maintainerId: user.id });
+    await this.repositoryRepo.update(
+      { id: tracked.id },
+      { maintainerId: user.id },
+    );
     return true;
   }
 
   /** Exact `owner/repo` entries from `GITHUB_SYNC_ALLOWED_REPOS`. */
   private isAllowlisted(fullName: string): boolean {
-    const raw = this.configService.get('github', { infer: true })
-      .syncAllowedRepos;
+    const raw = this.configService.get('github', {
+      infer: true,
+    }).syncAllowedRepos;
     if (!raw) return false;
     return raw
       .split(',')