From 79d96c9dd3d40eaa4fa2d359bdcf0130ee0b8078 Mon Sep 17 00:00:00 2001
From: dawn <dawn@tangled.org>
Date: Sun, 26 Jul 2026 00:07:13 +0300
Subject: [PATCH] spindle: check for perm on process pull

---
 spindle/tapclient.go | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/spindle/tapclient.go b/spindle/tapclient.go
index 3cc88fe28..d62caf4d5 100644
--- a/spindle/tapclient.go
+++ b/spindle/tapclient.go
@@ -355,6 +355,17 @@ func (s *Spindle) processPull(ctx context.Context, evt *tapc.RecordEventData) er
 			return nil
 		}
 
+		// check if pull record author has push access to target repo
+		allowed, err := s.e.IsPushAllowed(evt.Did.String(), rbac.ThisServer, repo.RepoDid.String())
+		if err != nil {
+			return fmt.Errorf("checking push access for pull record author: %w", err)
+		}
+		if !allowed {
+			l.Warn("rejecting pull-triggered pipeline. author has no push access",
+				"author", evt.Did, "repo", repo.RepoDid)
+			return nil
+		}
+
 		latestSubmission, err := s.fetchLatestSubmission(ctx, evt.Did.String(), evt.Rkey.String(), &record)
 		if err != nil {
 			return err
-- 
2.51.2