fix(releases): remove broken allowedRepoIds token gate

The token was only applied if the repository's id matched the saved
widget options, but the token is already scoped to the widget's itemId
and provider kind. This check silently failed when saved options lacked
ids (old data) or when ids mismatched, causing all GitHub API calls to
be unauthenticated and hit the 60 req/hr rate limit.

Changes:
- Remove allowedRepoIds check in releases.ts — use token by provider
- Remove unused SuperJSON import
- Enable Octokit throttling for authenticated requests

packages/api/src/router/widgets/releases.ts

@@ -1,4 +1,3 @@
-import SuperJSON from "superjson";
 import { escapeForRegEx } from "@tiptap/react";
 import { z } from "zod/v4";
 
@@ -45,7 +44,6 @@ export const releasesRouter = createTRPCRouter({
     )
     .query(async ({ ctx, input }) => {
       const tokensByProvider = new Map<string, string>();
-      let allowedRepoIds: Set<string> | null = null;
 
       if (input.itemId) {
         try {
@@ -53,12 +51,6 @@ export const releasesRouter = createTRPCRouter({
           if (item && item.kind === "releases") {
             await throwIfActionForbiddenAsync(ctx, eq(boards.id, item.boardId), "view");
 
-            const options = SuperJSON.parse<Record<string, unknown>>(item.options);
-            const repos = options.repositories as Array<{ id?: string }> | undefined;
-            if (repos) {
-              allowedRepoIds = new Set(repos.map((r) => r.id).filter((id): id is string => Boolean(id)));
-            }
-
             const secrets = await ctx.db.query.widgetSecrets.findMany({
               where: eq(widgetSecrets.itemId, input.itemId),
             });
@@ -79,7 +71,6 @@ export const releasesRouter = createTRPCRouter({
         input.repositories.map(async (repository) => {
           const repositoryId = repository.id ?? repository.identifier;
           try {
-            const useToken = allowedRepoIds === null || allowedRepoIds.has(repositoryId);
             const response = await releasesRequestHandler
               .handler({
                 id: repositoryId,
@@ -87,7 +78,7 @@ export const releasesRouter = createTRPCRouter({
                 identifier: repository.identifier,
                 versionRegex: formatVersionFilterRegex(repository.versionFilter),
                 providerUrl: repository.providerUrl,
-                token: useToken ? tokensByProvider.get(repository.provider) : undefined,
+                token: tokensByProvider.get(repository.provider),
               })
               .getDataAsync();
 

packages/request-handler/src/release-providers.ts

@@ -134,7 +134,7 @@ const getGithubApi = (baseUrl: string, userAgent: string, token?: string) =>
     baseUrl,
     auth: token,
     request: { fetch: fetchWithTrustedCertificatesAsync },
-    throttle: { enabled: false },
+    throttle: { enabled: true },
     userAgent,
   });