Mage AI PR #6207: deny failed Git project authorization

Evidence record

Maintainer patch removes unconditional permission fallthrough for Viewer and unassigned users of project Git API, with regression tests.

Read the original source ↗

Claim-level citations (3)

• supportsMage project Git actions could be granted after a failed role check: PR #6207 introduces explicit failure on denied checks and reports separate regression tests for Viewer, unassigned, Editor and Admin behavior.

  PR #6207 patch/test sections

• supportsMage project Git actions could be granted after a failed role check: Failed role checks could fall through and allow authenticated non-Editor users to create or change version-control resources.

  PR #6207 authorization bug description and Viewer/unassigned HTTP regression

• supportsMage project Git actions could be granted after a failed role check: The October 16 merged Mage PR #6207 rejects legacy-mode project mutations without Editor-level authority while retaining granular permission checks; no fixed published package version is established by that merge alone.

  Pull request #6207 merged status and authentication/authorization policy summary