From e48402ac4ebc9c03504e7251fcadfa0f3920283b Mon Sep 17 00:00:00 2001
From: ajnart <49837342+ajnart@users.noreply.github.com>
Date: Fri, 10 Jul 2026 17:38:15 +0200
Subject: [PATCH] fix(releases): remove broken allowedRepoIds token gate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The token was only applied if the repository's id matched the saved
widget options, but the token is already scoped to the widget's itemId
and provider kind. This check silently failed when saved options lacked
ids (old data) or when ids mismatched, causing all GitHub API calls to
be unauthenticated and hit the 60 req/hr rate limit.

Changes:
- Remove allowedRepoIds check in releases.ts — use token by provider
- Remove unused SuperJSON import
- Enable Octokit throttling for authenticated requests
---
 packages/api/src/router/widgets/releases.ts       | 11 +----------
 packages/request-handler/src/release-providers.ts |  2 +-
 2 files changed, 2 insertions(+), 11 deletions(-)

diff --git a/packages/api/src/router/widgets/releases.ts b/packages/api/src/router/widgets/releases.ts
index b58fecd19..6e105aaf9 100644
--- a/packages/api/src/router/widgets/releases.ts
+++ b/packages/api/src/router/widgets/releases.ts
@@ -1,4 +1,3 @@
-import SuperJSON from "superjson";
 import { escapeForRegEx } from "@tiptap/react";
 import { z } from "zod/v4";
 
@@ -45,7 +44,6 @@ export const releasesRouter = createTRPCRouter({
     )
     .query(async ({ ctx, input }) => {
       const tokensByProvider = new Map<string, string>();
-      let allowedRepoIds: Set<string> | null = null;
 
       if (input.itemId) {
         try {
@@ -53,12 +51,6 @@ export const releasesRouter = createTRPCRouter({
           if (item && item.kind === "releases") {
             await throwIfActionForbiddenAsync(ctx, eq(boards.id, item.boardId), "view");
 
-            const options = SuperJSON.parse<Record<string, unknown>>(item.options);
-            const repos = options.repositories as Array<{ id?: string }> | undefined;
-            if (repos) {
-              allowedRepoIds = new Set(repos.map((r) => r.id).filter((id): id is string => Boolean(id)));
-            }
-
             const secrets = await ctx.db.query.widgetSecrets.findMany({
               where: eq(widgetSecrets.itemId, input.itemId),
             });
@@ -79,7 +71,6 @@ export const releasesRouter = createTRPCRouter({
         input.repositories.map(async (repository) => {
           const repositoryId = repository.id ?? repository.identifier;
           try {
-            const useToken = allowedRepoIds === null || allowedRepoIds.has(repositoryId);
             const response = await releasesRequestHandler
               .handler({
                 id: repositoryId,
@@ -87,7 +78,7 @@ export const releasesRouter = createTRPCRouter({
                 identifier: repository.identifier,
                 versionRegex: formatVersionFilterRegex(repository.versionFilter),
                 providerUrl: repository.providerUrl,
-                token: useToken ? tokensByProvider.get(repository.provider) : undefined,
+                token: tokensByProvider.get(repository.provider),
               })
               .getDataAsync();
 
diff --git a/packages/request-handler/src/release-providers.ts b/packages/request-handler/src/release-providers.ts
index f4a647668..d4a9dd2b3 100644
--- a/packages/request-handler/src/release-providers.ts
+++ b/packages/request-handler/src/release-providers.ts
@@ -134,7 +134,7 @@ const getGithubApi = (baseUrl: string, userAgent: string, token?: string) =>
     baseUrl,
     auth: token,
     request: { fetch: fetchWithTrustedCertificatesAsync },
-    throttle: { enabled: false },
+    throttle: { enabled: true },
     userAgent,
   });