7c:I[154500,[["$2",["$3","$4"],[14451,1389]],["$5",["$6","$7","$8","$9","$a","$b"],[40076,28925,10525,30632,7744,72054]]],"IconMark"] 78:Tf9b,> [!IMPORTANT] > Every PR MUST have **exactly one** of these labels, the merge is blocked otherwise: > - `major` / `minor` / `patch` publishes a new release on merge with the corresponding semver bump. > - `skip-release` merges without publishing a release (use for docs, CI changes, refactors, etc.). ## 📝 Description An auditor who approved a review received 403 on PUT /api/reviews/dcdf3b10-8fbb-4813-a114-81dcb5ace66e. An admin on the same review succeeded. The gateway logs were: ``` forbidden access: PUT /api/reviews/dcdf3b10-8fbb-4813-a114-81dcb5ace66e, roles=[], email=auditor@example.com access allowed: PUT /api/reviews/dcdf3b10-8fbb-4813-a114-81dcb5ace66e, roles=[], email=admin@example.com, isadmin=true, isauditor=false ``` roles=[] is the cause. PUT `/reviews/:id` and PUT `/sessions/:session_id/review` registered only AuthMiddleware, so no role was set on the route. `isGroupAllowed` allows a standard user when the role list is empty and denies an auditor. The admin passed because that function always allows the admin group. GET `/reviews` and GET `/reviews/:id` already use `ReadOnlyAccessRole`, which allows a standard user, an admin, and an auditor. Both PUT routes now use the same middleware. An auditor who is not a member of the review's groups still receives 400 not eligible for review from doIndividualReview. ## 📣 User-facing impact - An auditor can approve or deny a review they are eligible for. Before this change, that action returned 403. ## 🔗 Related Issue Fixes # ## 🚀 Type of Change - [x] 🐛 Bug fix (non-breaking change which fixes an issue) - [ ] ✨ New feature (non-breaking change which adds functionality) - [ ] 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] 📚 Documentation update - [ ] 🎨 Style/UI update - [ ] ♻️ Code refactor - [ ] ⚡ Performance improvement - [ ] ✅ Test update - [ ] 🔧 Build configuration change - [ ] 🧹 Chore ## 📋 Changes Made - Add ReadOnlyAccessRole to PUT /reviews/:id. - Add ReadOnlyAccessRole to PUT /sessions/:session_id/review. ## 🧪 Testing ### Test Configuration: - **Browser(s)**: - **OS**: ### Tests performed: - [ ] Unit tests pass - [ ] Integration tests pass - [ ] Manual testing completed ## 📸 Screenshots (if applicable) ## ✅ Checklist - [x] My code follows the style guidelines of this project - [x] I have performed a self-review of my own code - [ ] I have commented my code, particularly in hard-to-understand areas - [x] My changes generate no new warnings - [ ] New and existing unit tests pass locally with my changes - [ ] I have checked my code and corrected any misspellings ## 📄 Additional Notes --- 79:T86a,

PR Summary by Qodo

Allow eligible auditors to approve or deny reviews 🐞 Bug fix 🕐 Less than 10 minutes Grey Divider

AI Description

> • Allow auditors through both review update routes, which previously returned 403.
> • Preserve reviewer eligibility checks so auditors cannot decide reviews outside their groups.
>

Diagram

```mermaid graph TD A["Review PUT routes"] --> B["ReadOnlyAccessRole"] --> C["AuthMiddleware"] --> D["Review handler"] --> E["Reviewer eligibility"] ```

High-Level Assessment

> Reuse the existing ReadOnlyAccessRole middleware on both PUT routes. It matches the review read routes' access policy while leaving per\-review eligibility enforcement in the handler; a new role policy is unnecessary.

Files changed (1) +2 / -0

Bug fix (1) +2 / -0

server.goGrant auditors route access to review updates +2/-0

> Grant auditors route access to review updates > >

> • Adds ReadOnlyAccessRole before authentication on PUT /reviews/:id and PUT /sessions/:session_id/review. Eligible auditors can reach the existing review handler instead of being rejected at the route authorization check.
>

> > gateway/api/server.go

7a:T20a8,

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 🔗 Cross\-repo conflicts (1) 📜 Skill insights (0) Grey Divider

1. Auditor approval contradicts access guidance 🔗 Cross-repo conflict ⛨ Security

Description

>
> >

> Adding ReadOnlyAccessRole to PUT /sessions/:session_id/review lets eligible auditors approve or
> reject a review, while the documentation repository describes the auditor group as having read-only
> access to session resources. Operators relying on that guidance may overlook this decision-making
> permission when assigning the auditor group.
>

> >

Code

>
> >

[gateway/api/server.go[1051]](https://github.com/hoophq/hoop/pull/1951/files#diff-9683911dd37855f4e7187088cf945ee3fbfa2c107b9f0139250a4039d58aef64R1051-R1051)

> > ```diff > + apiroutes.ReadOnlyAccessRole, > ``` >

Relevance

>
> > `●●● Strong` > >

> Access-control/documentation mismatches are accepted; prior auditor-role and API-contract
> corrections support clarifying this permission.
>

> > [PR\-\#1359](https://github.com/hoophq/hoop/pull/1359) > [PR\-\#1673](https://github.com/hoophq/hoop/pull/1673) > [PR\-\#1778](https://github.com/hoophq/hoop/pull/1778) > > ⓘ Recommendations generated based on similar findings in past PRs >

Evidence

>
> >

> The changed route admits auditors to a review-writing handler; the documentation characterizes
> auditor session permissions as read-only.
>

> >

[hoop \-> documentation](https://app.qodo.ai/management/relationships?repoId=3fa59f31-0d80-40a0-af80-288f8e2e46ee&relatedRepoId=e8c0c354-a086-42bf-a56e-1b8a05c8705a&view=table)

[gateway/api/server.go\[1049\-1054\]](https://github.com/hoophq/hoop/blob/8b220daad3d3ba1c2d46b610373c20825b969e36/gateway/api/server.go/#L1049-L1054)

[gateway/api/review/review.go\[356\-363\]](https://github.com/hoophq/hoop/blob/8b220daad3d3ba1c2d46b610373c20825b969e36/gateway/api/review/review.go/#L356-L363)

[External repo: hoophq/documentation, setup/configuration/idp/get\-started.mdx \[73\-77\]](https://github.com/hoophq/documentation/blob/10fc5a5bddb4983b353971b04de3d414d1475443/setup/configuration/idp/get-started.mdx/#L73-L77)

[External repo: hoophq/documentation, setup/configuration/access\-control\-configuration.mdx \[83\-87\]](https://github.com/hoophq/documentation/blob/10fc5a5bddb4983b353971b04de3d414d1475443/setup/configuration/access-control-configuration.mdx/#L83-L87)

Agent prompt

>
> > ``` > The issue below was found during a code review. Follow the provided context and guidance below and implement a solution > > ## Issue description > The auditor group can now submit session review decisions, but the documentation describes its session access as read-only. > ## Fix Focus Areas > - gateway/api/server.go[1049-1054] > - /cross_repos/documentation/setup/configuration/idp/get-started.mdx[73-77] > - /cross_repos/documentation/setup/configuration/access-control-configuration.mdx[83-87] > ## Recommended Fix > Coordinate a documentation update that distinguishes auditors' read access from their ability to approve or reject reviews when eligible. > ``` > ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools >

[Dismiss ↗](https://app.qodo.ai/findings/9e607e88-e255-4a25-a17e-430a0cec9cfa?action=dismiss&origin=git) \| [View ↗](https://app.qodo.ai/findings/9e607e88-e255-4a25-a17e-430a0cec9cfa)

Context sources

✅ Compliance rules (platform): 53 rules

✅ Cross-repo context — repo relationships

Explored: repo: hoophq/documentation (sha: 10fc5a5b) — View relationship

Explored: repo: hoophq/internal-runtime-control (sha: f9e2bc6f) — View relationship

Explored: repo: hoophq/hoop-skills (sha: 372cfc31) — View relationship

Review mode: Auto: ⚖️ Balanced: Authorization middleware changes access control on review mutation endpoints.

Tip of the day

💡 Did you know, you can import rules and skills only from the repositories your team follows

More tips ↗ \| Customize Qodo ↗ \| Qodo docs ↗

62:["$","$L75",null,{"entries":[{"key":["platform",{"userId":"anon"},"pulls","page",{"owner":"hoophq","repo":"hoop","pullNumber":1951}],"data":{"repositoryId":"4079","detail":{"author":{"avatarUrl":"https://cdn.trylle.com/media/images/d5fb917302a4c7ab0375905df476d10b?key=AWJmYcJmmdqqgRG5b3fBSpLDaUYgYCtbt2hid44Vuhm4kOt%2Bye4N7HC2g0kuJyhaY8g7bD%2FSmAcxTQfdToAKPapEEoxsqBB06n0L3i8aO2T3h0cBlnynn8QRq2zpJOUOMTkxIABvT27uBOYtR0Fik5WhQ0asq%2Bn65dKeLIY3dqTlFOrtczkoNCD3AQ%3D%3D","externalProvider":"github","login":"ducminhle","type":"User","url":"https://github.com/ducminhle"},"authorId":"15701678","baseRefName":"main","closedAt":null,"comments":5,"createdAt":"2026-10-12T16:09:10Z","headRefName":"ducminhle/fix/auditor-review-access","id":"4931752","isDraft":false,"labels":[],"number":1951,"repository":{"name":"hoop","owner":"hoophq","provider":"forgejo"},"state":"open","title":"fix: allow auditors to approve reviews","updatedAt":"2026-10-12T16:10:44Z","url":"https://trylle.com/hoophq/hoop/pulls/1951","body":"$78","additions":2,"deletions":1,"changedFiles":1,"commits":1,"reviewComments":1,"headSha":"8b220daad3d3ba1c2d46b610373c20825b969e36","baseSha":"d5126d8ae3603bdbd31e56c4e9c085cc12d42be8","headRepoOwner":"hoophq","headRepoName":"hoop","isMerged":false,"mergeCommitSha":null,"mergedBy":null,"mergeable":true,"mergeableState":"clean","conflictingFiles":null,"requestedTeams":[],"requestedReviewers":[],"graphqlId":"issue:1951"},"comments":[{"id":26848901,"graphqlId":"26848901","body":"All contributors have signed the CLA ✍️ ✅
_{Posted by the ****CLA Assistant Lite bot****.}","createdAt":"2026-10-12T16:09:24Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/618d0dadf2cc03e4da918f9fce155434?key=AZR2NWibZ4GI6G7n0snc5O%2FCy3ukthRybL%2FnPkuHfb%2BSDl5jyY%2BICnK7fBwKjvxrsVV6C0JPZxZTQgFdB8jeaILFLR9JfexsaUup8AkkgNnbAGbZgojNsOfLPmKPf7SYvH%2FYQb5ondr7R93kUYfqwz0RJC2nyFR5R%2Brm41rXkHLcotJyErDIvfgcMw%3D%3D","externalProvider":"github","login":"github-actions[bot]","type":"Bot","url":"https://github.com/apps/github-actions"}},{"id":26848902,"graphqlId":"26848902","body":"$79","createdAt":"2026-10-12T16:09:51Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/6e9366337c504d875f07d9396e8dad00?key=AbmsGsgJmFD1q6W9lI%2BWlurvwVh7T7MGrDc0ETLcwBdoqSo2kcmX7nhhJNnLgsxxdzofTpyOUif40XIBYZ95kmq5gfWwHWOY48VCwySHn4Mm2HYFJoiPLOZOi5ngyxXNJA6eJ6MLzY6hFqYe6Pe6ByR9Z%2BY%2FuN%2BGw1l%2BfZWheBgQMxiHG5oiqcDYo%2Bg%3D","externalProvider":"github","login":"qodo-code-review[bot]","type":"Bot","url":"https://github.com/apps/qodo-code-review"}},{"id":26848903,"graphqlId":"26848903","body":"I have read the CLA Document and I hereby sign the CLA","createdAt":"2026-10-12T16:10:30Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/d5fb917302a4c7ab0375905df476d10b?key=AWJmYcJmmdqqgRG5b3fBSpLDaUYgYCtbt2hid44Vuhm4kOt%2Bye4N7HC2g0kuJyhaY8g7bD%2FSmAcxTQfdToAKPapEEoxsqBB06n0L3i8aO2T3h0cBlnynn8QRq2zpJOUOMTkxIABvT27uBOYtR0Fik5WhQ0asq%2Bn65dKeLIY3dqTlFOrtczkoNCD3AQ%3D%3D","externalProvider":"github","login":"ducminhle","type":"User","url":"https://github.com/ducminhle"}},{"id":26848904,"graphqlId":"26848904","body":"$7a","createdAt":"2026-10-12T16:10:37Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/6e9366337c504d875f07d9396e8dad00?key=AbmsGsgJmFD1q6W9lI%2BWlurvwVh7T7MGrDc0ETLcwBdoqSo2kcmX7nhhJNnLgsxxdzofTpyOUif40XIBYZ95kmq5gfWwHWOY48VCwySHn4Mm2HYFJoiPLOZOi5ngyxXNJA6eJ6MLzY6hFqYe6Pe6ByR9Z%2BY%2FuN%2BGw1l%2BfZWheBgQMxiHG5oiqcDYo%2Bg%3D","externalProvider":"github","login":"qodo-code-review[bot]","type":"Bot","url":"https://github.com/apps/qodo-code-review"}}],"commits":[{"sha":"8b220daad3d3ba1c2d46b610373c20825b969e36","message":"fix: allow auditors to approve reviews\nPUT review routes had no role middleware, so auditors were denied.\n\nSigned-off-by: ducminhle \n","createdAt":"2026-10-12T21:05:17+07:00","author":{"avatarUrl":"","login":"","name":"ducminhle","type":"User","url":""},"verification":{"verified":false,"reason":"gpg.error.no_gpg_keys_found"}}],"events":[{"id":26849278,"event":"reviewed","createdAt":"2026-10-12T16:10:39Z","actor":{"avatarUrl":"https://cdn.trylle.com/media/images/6e9366337c504d875f07d9396e8dad00?key=AbmsGsgJmFD1q6W9lI%2BWlurvwVh7T7MGrDc0ETLcwBdoqSo2kcmX7nhhJNnLgsxxdzofTpyOUif40XIBYZ95kmq5gfWwHWOY48VCwySHn4Mm2HYFJoiPLOZOi5ngyxXNJA6eJ6MLzY6hFqYe6Pe6ByR9Z%2BY%2FuN%2BGw1l%2BfZWheBgQMxiHG5oiqcDYo%2Bg%3D","externalProvider":"github","login":"qodo-code-review[bot]","type":"Bot","url":"https://github.com/apps/qodo-code-review"},"reviewId":3600604,"reviewState":"COMMENT"}],"reviews":[{"id":3600604,"state":"COMMENT","author":{"avatarUrl":"https://cdn.trylle.com/media/images/6e9366337c504d875f07d9396e8dad00?key=AbmsGsgJmFD1q6W9lI%2BWlurvwVh7T7MGrDc0ETLcwBdoqSo2kcmX7nhhJNnLgsxxdzofTpyOUif40XIBYZ95kmq5gfWwHWOY48VCwySHn4Mm2HYFJoiPLOZOi5ngyxXNJA6eJ6MLzY6hFqYe6Pe6ByR9Z%2BY%2FuN%2BGw1l%2BfZWheBgQMxiHG5oiqcDYo%2Bg%3D","externalProvider":"github","login":"qodo-code-review[bot]","type":"Bot","url":"https://github.com/apps/qodo-code-review"},"submittedAt":"2026-10-12T16:10:39Z","official":false}],"stackEvents":[],"commentPagination":{"totalCount":5,"perPage":30,"loadedPages":[1]},"eventPagination":{"loadedPages":[1],"hasMore":false},"headRefDeleted":false},"fetchedAt":1793510188169}],"children":"$L7b"}] 64:null 6b:[["$","title","0",{"children":"Commits · fix: allow auditors to approve reviews · hoophq/hoop | Trylle"}],["$","meta","1",{"name":"description","content":"Commits on fix: allow auditors to approve reviews (#1951) in hoophq/hoop."}],["$","meta","2",{"name":"application-name","content":"Trylle"}],["$","link","3",{"rel":"manifest","href":"/manifest.json","crossOrigin":"$undefined"}],["$","meta","4",{"name":"keywords","content":"Commits · fix: allow auditors to approve reviews · hoophq/hoop, hoophq/hoop, hoophq/hoop repository, hoop, Go repository, source code, trylle, agent-native git platform, git platform for agents and humans, git platform for ai agents, coding agent pull requests, ai code review, repository automation, stacked pull requests, two-way github sync, github-compatible actions, try cli"}],["$","meta","5",{"name":"robots","content":"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"}],["$","meta","6",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","7",{"name":"googlebot","content":"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"}],["$","meta","8",{"name":"twitter:domain","content":"trylle.com"}],["$","meta","9",{"name":"twitter:url","content":"https://trylle.com/hoophq/hoop/pulls/1951/commits"}],["$","link","10",{"rel":"canonical","href":"https://trylle.com/hoophq/hoop/pulls/1951/commits"}],["$","meta","11",{"name":"format-detection","content":"telephone=no"}],["$","meta","12",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","13",{"name":"apple-mobile-web-app-title","content":"Trylle"}],["$","meta","14",{"name":"apple-mobile-web-app-status-bar-style","content":"black-translucent"}],["$","meta","15",{"property":"og:title","content":"Commits · fix: allow auditors to approve reviews · hoophq/hoop | Trylle"}],["$","meta","16",{"property":"og:description","content":"Commits on fix: allow auditors to approve reviews (#1951) in hoophq/hoop."}],["$","meta","17",{"property":"og:url","content":"https://trylle.com/hoophq/hoop/pulls/1951/commits"}],["$","meta","18",{"property":"og:site_name","content":"Trylle"}],["$","meta","19",{"property":"og:locale","content":"en_US"}],["$","meta","20",{"property":"og:image","content":"https://trylle.com/api/og.png?kind=repo&owner=hoophq&repo=hoop"}],["$","meta","21",{"property":"og:image:secure_url","content":"https://trylle.com/api/og.png?kind=repo&owner=hoophq&repo=hoop"}],["$","meta","22",{"property":"og:image:type","content":"image/png"}],["$","meta","23",{"property":"og:image:width","content":"1200"}],["$","meta","24",{"property":"og:image:height","content":"630"}],["$","meta","25",{"property":"og:image:alt","content":"hoophq/hoop repository preview on Trylle"}],["$","meta","26",{"property":"og:type","content":"website"}],["$","meta","27",{"name":"twitter:card","content":"summary_large_image"}],["$","meta","28",{"name":"twitter:site","content":"@trylle"}],["$","meta","29",{"name":"twitter:title","content":"Commits · fix: allow auditors to approve reviews · hoophq/hoop | Trylle"}],["$","meta","30",{"name":"twitter:description","content":"Commits on fix: allow auditors to approve reviews (#1951) in hoophq/hoop."}],["$","meta","31",{"name":"twitter:image","content":"https://trylle.com/api/og.png?kind=repo&owner=hoophq&repo=hoop"}],["$","meta","32",{"name":"twitter:image:alt","content":"hoophq/hoop repository preview on Trylle"}],["$","link","33",{"rel":"icon","href":"/favicon.png","type":"image/png"}],["$","link","34",{"rel":"icon","href":"/favicon-white.png","type":"image/png","media":"(prefers-color-scheme: dark)"}],["$","link","35",{"rel":"apple-touch-icon","href":"/logo192.png"}],["$","$L7c","36",{}]]

Commits on Mon, Oct 12, 2026