Stop publishing repository-wide prompt ledgers and enforce per-user prompt isolation through authenticated Gitea IDs.

Hop-State: A_06FN8NFDRFAFN5VCJTHJAAG
Hop-Proposal: R_06FN8NEGJ054CPMJF9ZAN70
Hop-Task: T_06FN8HT6XG332C3XY6PYCCG
Hop-Attempt: AT_06FN8HT6XGRXW0B4WPFFBJG

services/control-plane/internal/gitea/client.go

@@ -27,6 +27,19 @@ type Owner struct {
 	Username string `json:"username"`
 }
 
+type User struct {
+	ID       int64  `json:"id"`
+	Login    string `json:"login"`
+	Username string `json:"username"`
+}
+
+func (u User) LoginName() string {
+	if u.Login != "" {
+		return u.Login
+	}
+	return u.Username
+}
+
 func (r Repository) OwnerName() string {
 	if r.Owner.Login != "" {
 		return r.Owner.Login
@@ -79,6 +92,69 @@ func (c *Client) Repository(ctx context.Context, owner, name string) (Repository
 	return repo, nil
 }
 
+func (c *Client) User(ctx context.Context, login string) (User, error) {
+	if c.token == "" {
+		return User{}, ErrTokenNotConfigured
+	}
+	u := c.baseURL.JoinPath("api", "v1", "users", login)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
+	if err != nil {
+		return User{}, err
+	}
+	req.Header.Set("Authorization", "token "+c.token)
+	req.Header.Set("Accept", "application/json")
+
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return User{}, fmt.Errorf("request user: %w", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return User{}, fmt.Errorf("gitea user lookup returned %s", resp.Status)
+	}
+	var user User
+	if err := json.NewDecoder(resp.Body).Decode(&user); err != nil {
+		return User{}, fmt.Errorf("decode user: %w", err)
+	}
+	if user.ID <= 0 || user.LoginName() == "" {
+		return User{}, errors.New("gitea returned an incomplete user")
+	}
+	return user, nil
+}
+
+func (c *Client) AuthenticatedUser(ctx context.Context, cookie string) (User, bool, error) {
+	if strings.TrimSpace(cookie) == "" {
+		return User{}, false, nil
+	}
+	u := c.baseURL.JoinPath("api", "v1", "user")
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
+	if err != nil {
+		return User{}, false, err
+	}
+	req.Header.Set("Cookie", cookie)
+	req.Header.Set("Accept", "application/json")
+
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return User{}, false, fmt.Errorf("load authenticated user: %w", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode == http.StatusUnauthorized || resp.StatusCode == http.StatusForbidden {
+		return User{}, false, nil
+	}
+	if resp.StatusCode != http.StatusOK {
+		return User{}, false, fmt.Errorf("gitea authenticated user lookup returned %s", resp.Status)
+	}
+	var user User
+	if err := json.NewDecoder(resp.Body).Decode(&user); err != nil {
+		return User{}, false, fmt.Errorf("decode authenticated user: %w", err)
+	}
+	if user.ID <= 0 || user.LoginName() == "" {
+		return User{}, false, errors.New("gitea returned an incomplete authenticated user")
+	}
+	return user, true, nil
+}
+
 // ViewerCanReadRepository checks a browser's existing Gitea session before
 // returning prompt data. Prompts may contain sensitive intent, so the Hop API
 // must never turn a private repository into a public metadata feed.

services/control-plane/internal/gitea/client_test.go

@@ -43,6 +43,59 @@ func TestRepositoryRequiresToken(t *testing.T) {
 	}
 }
 
+func TestUserUsesTokenAndDecodesStableID(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/v1/users/alice" {
+			t.Fatalf("path = %q", r.URL.Path)
+		}
+		if got := r.Header.Get("Authorization"); got != "token gitea-token" {
+			t.Fatalf("authorization = %q", got)
+		}
+		_, _ = w.Write([]byte(`{"id":42,"login":"alice"}`))
+	}))
+	defer server.Close()
+	client, err := NewClient(server.URL, "gitea-token")
+	if err != nil {
+		t.Fatal(err)
+	}
+	user, err := client.User(context.Background(), "alice")
+	if err != nil || user.ID != 42 || user.LoginName() != "alice" {
+		t.Fatalf("user = %#v, err = %v", user, err)
+	}
+}
+
+func TestAuthenticatedUserForwardsSessionCookie(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/v1/user" {
+			t.Fatalf("path = %q", r.URL.Path)
+		}
+		if got := r.Header.Get("Cookie"); got != "i_like_gitea=session" {
+			t.Fatalf("cookie = %q", got)
+		}
+		_, _ = w.Write([]byte(`{"id":42,"login":"alice"}`))
+	}))
+	defer server.Close()
+	client, err := NewClient(server.URL, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	user, authenticated, err := client.AuthenticatedUser(context.Background(), "i_like_gitea=session")
+	if err != nil || !authenticated || user.ID != 42 {
+		t.Fatalf("user = %#v, authenticated = %t, err = %v", user, authenticated, err)
+	}
+}
+
+func TestAuthenticatedUserRejectsMissingSession(t *testing.T) {
+	client, err := NewClient("http://gitea.test", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	user, authenticated, err := client.AuthenticatedUser(context.Background(), "")
+	if err != nil || authenticated || user.ID != 0 {
+		t.Fatalf("user = %#v, authenticated = %t, err = %v", user, authenticated, err)
+	}
+}
+
 func TestViewerCanReadRepositoryForwardsSessionCookie(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path != "/api/v1/repos/hop/private" {