Libra CodeHub

CedarCopilot/cedar-mail

Branch: staging

[2026-09-11] merging staging tom ain

merged#2763CedarCopilot

CedarCopilot wants to merge 1 commit into main from staging

Not deployedTimeline and evidence
  1. Opened
    Sep 11, 2026, 12:52 PM
  2. Merged
    Sep 11, 2026, 12:57 PM
  3. No findings
    Sep 11, 2026, 2:23 PM
  4. Live on staging, live on prod, observed
    Pending
  5. Not deployed

    Not deployed

    Pending

Libra has no production signal for this change yet because it has not deployed. Libra checks hourly for 3 days after each deploy.

Greptile Summary

Summary

  • User-scoped document event subscriptions now allow authorized same-organization administrators and owners while continuing to deny ordinary members and callers from other organizations.
  • Add route-level coverage for this access matrix so future authorization changes cannot silently change who can receive live document updates.

Confidence Score: 4/5

Safe to merge with a non-blocking coverage gap: the exercised authorization behavior enforces the intended access boundaries.

The only remaining concern is missing route-level regression coverage for a newly expanded authorization path; the focused HTTP contract check confirmed the expected allow and deny outcomes.

Files Needing Attention: apps/server/src/http/app.ts needs accompanying server route tests for same-organization administrators and owners, ordinary members, and cross-organization callers.

T-Rex T-Rex Logs

What T-Rex did

  • T-Rex produced a proof for a posted P2 finding and linked it to the finding-comment-proof.
  • Artifacts were prepared to inspect the document events authorization contract harness and its before/after outputs, enabling review of the finding.
  • The general-contract-validation-proof shows the harness exercised the /api/doc-events endpoint and verified that prior behavior denied all four cross-user callers, while after-change behavior allowed same-org admin and owner and denied same-org member and cross-org member, with both runs exiting successfully.

View all artifacts

T-Rex Ran code and verified through T-Rex

Prompt To Fix All With AI 
### Issue 1
apps/server/src/http/app.ts:868-874
**Test SSE authorization**

The new delegated authorization branch allows same-organization administrators and owners to open a user document’s live-update stream, but the server has no route-level test for that contract. Add cases proving administrators and owners receive the stream while ordinary members and callers from another organization receive `403`; otherwise a future change can silently broaden or remove this endpoint’s access control. This is a non-blocking test-coverage concern.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Reviews (1): Last reviewed commit: "Merge pull request #2762 from CedarCopil..." | Re-trigger Greptile

Greptile also left 1 inline comment on this PR.

Context used (4)
Show production surfaces and changed-file mapping

Production surfaces

Libra has not measured any production surfaces for this change yet.

Changed files → surfaces

  • apps/mail/modules/agents/components/AgentInstructionsSection.tsxno production surface mapped
  • apps/mail/modules/documents/document.tsxno production surface mapped
  • apps/mail/tests/modules/documents/document.test.tsxno production surface mapped
  • apps/server/src/http/app.tsno production surface mapped
  • apps/server/src/runtime/chat-entry.tsno production surface mapped