Stop publishing repository-wide prompt ledgers and enforce per-user prompt isolation through authenticated Gitea IDs.

Hop-State: A_06FN8NFDRFAFN5VCJTHJAAG
Hop-Proposal: R_06FN8NEGJ054CPMJF9ZAN70
Hop-Task: T_06FN8HT6XG332C3XY6PYCCG
Hop-Attempt: AT_06FN8HT6XGRXW0B4WPFFBJG

services/control-plane/internal/gitea/client.go

@@ -27,6 +27,19 @@ type Owner struct {
 	Username string `json:"username"`
 }
 
+type User struct {
+	ID       int64  `json:"id"`
+	Login    string `json:"login"`
+	Username string `json:"username"`
+}
+
+func (u User) LoginName() string {
+	if u.Login != "" {
+		return u.Login
+	}
+	return u.Username
+}
+
 func (r Repository) OwnerName() string {
 	if r.Owner.Login != "" {
 		return r.Owner.Login
@@ -79,6 +92,69 @@ func (c *Client) Repository(ctx context.Context, owner, name string) (Repository
 	return repo, nil
 }
 
+func (c *Client) User(ctx context.Context, login string) (User, error) {
+	if c.token == "" {
+		return User{}, ErrTokenNotConfigured
+	}
+	u := c.baseURL.JoinPath("api", "v1", "users", login)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
+	if err != nil {
+		return User{}, err
+	}
+	req.Header.Set("Authorization", "token "+c.token)
+	req.Header.Set("Accept", "application/json")
+
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return User{}, fmt.Errorf("request user: %w", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return User{}, fmt.Errorf("gitea user lookup returned %s", resp.Status)
+	}
+	var user User
+	if err := json.NewDecoder(resp.Body).Decode(&user); err != nil {
+		return User{}, fmt.Errorf("decode user: %w", err)
+	}
+	if user.ID <= 0 || user.LoginName() == "" {
+		return User{}, errors.New("gitea returned an incomplete user")
+	}
+	return user, nil
+}
+
+func (c *Client) AuthenticatedUser(ctx context.Context, cookie string) (User, bool, error) {
+	if strings.TrimSpace(cookie) == "" {
+		return User{}, false, nil
+	}
+	u := c.baseURL.JoinPath("api", "v1", "user")
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
+	if err != nil {
+		return User{}, false, err
+	}
+	req.Header.Set("Cookie", cookie)
+	req.Header.Set("Accept", "application/json")
+
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return User{}, false, fmt.Errorf("load authenticated user: %w", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode == http.StatusUnauthorized || resp.StatusCode == http.StatusForbidden {
+		return User{}, false, nil
+	}
+	if resp.StatusCode != http.StatusOK {
+		return User{}, false, fmt.Errorf("gitea authenticated user lookup returned %s", resp.Status)
+	}
+	var user User
+	if err := json.NewDecoder(resp.Body).Decode(&user); err != nil {
+		return User{}, false, fmt.Errorf("decode authenticated user: %w", err)
+	}
+	if user.ID <= 0 || user.LoginName() == "" {
+		return User{}, false, errors.New("gitea returned an incomplete authenticated user")
+	}
+	return user, true, nil
+}
+
 // ViewerCanReadRepository checks a browser's existing Gitea session before
 // returning prompt data. Prompts may contain sensitive intent, so the Hop API
 // must never turn a private repository into a public metadata feed.