fix(git-tools): unify PR edit identity proof (#1080)

packages/mosaic/framework/tools/git/pr-edit.sh

@@ -21,7 +21,16 @@ AUTH_CONFIG=""
 cleanup() {
     [[ -z "$AUTH_CONFIG" ]] || rm -f -- "$AUTH_CONFIG"
 }
-trap cleanup EXIT HUP INT TERM
+terminate() {
+    local signal="$1"
+    trap - "$signal"
+    cleanup
+    kill -s "$signal" "$$"
+}
+trap cleanup EXIT
+trap 'terminate HUP' HUP
+trap 'terminate INT' INT
+trap 'terminate TERM' TERM
 
 usage() {
     cat <<EOF
@@ -129,24 +138,29 @@ case "$PLATFORM" in
             echo "Error: login '$GITEA_LOGIN_NAME' is not configured for target host '$HOST'" >&2
             exit 1
         }
-        AUTHENTICATED_USER=$(get_gitea_authenticated_user "$GITEA_LOGIN_NAME") || {
-            echo "Error: could not authenticate Gitea login '$GITEA_LOGIN_NAME'" >&2
-            exit 1
-        }
-        [[ "$AUTHENTICATED_USER" == "$IDENTITY" ]] || {
-            echo "Error: Gitea login '$GITEA_LOGIN_NAME' authenticates as '$AUTHENTICATED_USER', not MOSAIC_GIT_IDENTITY '$IDENTITY'" >&2
-            exit 1
-        }
         AUTH_CONFIG=$(gitea_write_auth_config "$TOKEN") || {
             echo "Error: could not stage private Gitea authentication" >&2
             exit 1
         }
         unset TOKEN
 
-        API_BASE="https://${HOST}/api/v1/repos/${REPO_SLUG}"
-        # Preflight the explicit host/repo pair before any mutation. This prevents
-        # a slug inferred from one checkout being combined with another host.
-        curl -fsS --config "$AUTH_CONFIG" -H "User-Agent: mosaic-pr-edit" "$API_BASE" >/dev/null || {
+        API_BASE="https://${HOST}/api/v1"
+        # Resolve identity through the SAME private curl config used for the
+        # mutation. Tea login names are globally scoped and can be duplicated
+        # across hosts; a separate `tea api --login NAME` could validate another
+        # credential than this host-bound token.
+        AUTHENTICATED_USER=$(curl -fsS --config "$AUTH_CONFIG" -H "User-Agent: mosaic-pr-edit" "$API_BASE/user" \
+            | python3 -c 'import json,sys; value=json.load(sys.stdin).get("login"); print(value) if isinstance(value,str) and value else sys.exit(1)') || {
+            echo "Error: could not authenticate the host-bound credential for '$GITEA_LOGIN_NAME'" >&2
+            exit 1
+        }
+        [[ "$AUTHENTICATED_USER" == "$IDENTITY" ]] || {
+            echo "Error: host-bound credential authenticates as '$AUTHENTICATED_USER', not MOSAIC_GIT_IDENTITY '$IDENTITY'" >&2
+            exit 1
+        }
+
+        REPO_API="$API_BASE/repos/${REPO_SLUG}"
+        curl -fsS --config "$AUTH_CONFIG" -H "User-Agent: mosaic-pr-edit" "$REPO_API" >/dev/null || {
             echo "Error: target repository preflight failed for https://${HOST}/${REPO_SLUG}" >&2
             exit 1
         }
@@ -164,7 +178,7 @@ PY
 )
         curl -fsS --config "$AUTH_CONFIG" -X PATCH \
             -H "User-Agent: mosaic-pr-edit" -H "Content-Type: application/json" \
-            -d "$PAYLOAD" "$API_BASE/pulls/${PR_NUMBER}"
+            -d "$PAYLOAD" "$REPO_API/pulls/${PR_NUMBER}"
         echo "Updated Gitea pull request #$PR_NUMBER as '$AUTHENTICATED_USER'" >&2
         ;;
     *) echo "Error: Could not detect git platform" >&2; exit 1 ;;