Require committer access on either side of /transfer

[Copilot]

Issue transfers were previously attempted without checking the commenter’s repository role, which allowed non-committers to invoke /transfer until GitHub rejected it downstream. This change enforces app-level authorization: transfer is allowed only when the actor has committer-level access on the source or destination repo.

• Authorization gate for issue transfer

  • Added a permission check in transferIssue(...) before the transfer mutation runs.
  • Commiter-equivalent permissions are treated as: WRITE, MAINTAIN, ADMIN.
  • Transfer is blocked unless at least one side (source or target) grants committer access.

• Transfer flow wiring

  • Updated TransferCommand to pass payload.sender.login into transferIssue(...) so checks are evaluated against the command actor.

• Behavioral documentation

  • Updated /transfer docs to state that users must have committer access on either source or destination repository.

• Focused unit coverage

  • Added unit tests for the permission decision helper to cover allow/deny cases across permission combinations.

if (
  !hasCommitterAccess(
    getCollaboratorPermission(source, username),
    getCollaboratorPermission(target, username),
  )
) {
  throw new Error(
    `User ${username} requires committer access on ${sourceRepo} or ${targetRepo} to transfer issues`,
  );
}

• Fixes Require committer access on either end of issue transfers #58

[comment-ops-bot]

The transfer command is not enabled for this repository

[comment-ops-bot]

The transfer command is not enabled for this repository

[comment-ops-bot]

The transfer command is not enabled for this repository