fix(gitRoutes): block edits on default branch

ui/gitRoutes.js

@@ -8,7 +8,7 @@ import {
   slugify
 } from './routes.js';
 import { ensureRepositoryCheckout } from './repositoryManager.js';
-import { getDefaultBranch, checkExistingPR, isPRBranch } from './helpers.js';
+import { getDefaultBranch, checkExistingPR, isPRBranch, isOnDefaultBranch } from './helpers.js';
 import tokenManager from './tokenManager.js';
 
 // Setup Git routes
@@ -625,6 +625,17 @@ export function setupGitRoutes(app, isAuthenticated, dependencies) {
     const username = req.user.username;
     const userRepo = getUserRepoPath(req, WORKDIR, ROOT_DIR, getAuthConfig);
 
+    // Check if on default branch - block commits
+    const branchCheck = await isOnDefaultBranch(userRepo);
+    if (branchCheck.isDefault) {
+      return res.status(403).json({ 
+        error: `Cannot commit changes on default branch (${branchCheck.defaultBranch}). Please create a new branch before committing.`,
+        currentBranch: branchCheck.currentBranch,
+        defaultBranch: branchCheck.defaultBranch,
+        isDefaultBranch: true
+      });
+    }
+
     const git = simpleGit({ baseDir: userRepo });
     await ensureGitRemoteWithToken(git, req.user.token, REPO_URL);
 
@@ -794,6 +805,17 @@ export function setupGitRoutes(app, isAuthenticated, dependencies) {
         return res.status(404).json({ error: 'Repository not found' });
       }
 
+      // Check if on default branch - block file checkout (discarding changes)
+      const branchCheck = await isOnDefaultBranch(userRepo);
+      if (branchCheck.isDefault) {
+        return res.status(403).json({ 
+          error: `Cannot discard file changes on default branch (${branchCheck.defaultBranch}). Please create a new branch before editing.`,
+          currentBranch: branchCheck.currentBranch,
+          defaultBranch: branchCheck.defaultBranch,
+          isDefaultBranch: true
+        });
+      }
+
       try {
         // Initialize simple-git with the user's repo path
         const git = simpleGit(userRepo);
@@ -1094,6 +1116,17 @@ export function setupGitRoutes(app, isAuthenticated, dependencies) {
         return res.status(404).json({ error: 'Repository not found' });
       }
 
+      // Check if on default branch - block undo operations
+      const branchCheck = await isOnDefaultBranch(userRepo);
+      if (branchCheck.isDefault) {
+        return res.status(403).json({ 
+          error: `Cannot undo changes on default branch (${branchCheck.defaultBranch}). Please create a new branch before editing.`,
+          currentBranch: branchCheck.currentBranch,
+          defaultBranch: branchCheck.defaultBranch,
+          isDefaultBranch: true
+        });
+      }
+
       const git = simpleGit({ baseDir: userRepo });
       const isRepo = await git.checkIsRepo();
 
@@ -1225,6 +1258,17 @@ export function setupGitRoutes(app, isAuthenticated, dependencies) {
         return res.status(404).json({ error: 'Repository not found' });
       }
 
+      // Check if on default branch - block redo operations
+      const branchCheck = await isOnDefaultBranch(userRepo);
+      if (branchCheck.isDefault) {
+        return res.status(403).json({ 
+          error: `Cannot redo changes on default branch (${branchCheck.defaultBranch}). Please create a new branch before editing.`,
+          currentBranch: branchCheck.currentBranch,
+          defaultBranch: branchCheck.defaultBranch,
+          isDefaultBranch: true
+        });
+      }
+
       const git = simpleGit({ baseDir: userRepo });
       const isRepo = await git.checkIsRepo();
 

ui/helpers.js

@@ -376,6 +376,35 @@ export function updateSessionMetadata(session) {
   }
 }
 
+/**
+ * Check if current branch is a default branch (main/master)
+ * Reuses logic from autoCommitAndPush to avoid duplication
+ * @param {string} userRepoPath - Path to user repository
+ * @returns {Promise<Object>} Object with isDefault boolean and branch names
+ */
+export async function isOnDefaultBranch(userRepoPath) {
+  try {
+    const git = simpleGit(userRepoPath);
+
+    const isRepo = await git.checkIsRepo();
+    if (!isRepo) {
+      return { isDefault: false, currentBranch: null, defaultBranch: null };
+    }
+
+    const currentBranch = await git.revparse(['--abbrev-ref', 'HEAD']);
+    const defaultBranch = await getDefaultBranch(git, userRepoPath);
+
+    return {
+      isDefault: currentBranch === defaultBranch,
+      currentBranch,
+      defaultBranch
+    };
+  } catch (error) {
+    console.error('Error checking default branch:', error);
+    return { isDefault: false, currentBranch: null, defaultBranch: null };
+  }
+}
+
 /**
  * Auto-commit and push changes when not on default branch
  * @param {string} userRepoPath - Path to user repository

ui/routes.js

@@ -7,7 +7,7 @@ import {
   generateRecFileToMapWasm,
   validateTestFromMapWasm
 } from './wasmNodeWrapper.js';
-import { autoCommitAndPush } from './helpers.js';
+import { autoCommitAndPush, isOnDefaultBranch } from './helpers.js';
 
 // Helper functions that were in server.js
 export function getUserRepoPath(req, WORKDIR, ROOT_DIR, getAuthConfig) {
@@ -492,6 +492,19 @@ export function setupRoutes(app, isAuthenticated, dependencies) {
         return res.status(400).json({ error: 'File path is required' });
       }
 
+      // Check if on default branch - block file modifications
+      const userRepoPath = getUserRepoPath(req, WORKDIR, ROOT_DIR, getAuthConfig);
+      const branchCheck = await isOnDefaultBranch(userRepoPath);
+
+      if (branchCheck.isDefault) {
+        return res.status(403).json({ 
+          error: `Cannot save files on default branch (${branchCheck.defaultBranch}). Please create a new branch before editing.`,
+          currentBranch: branchCheck.currentBranch,
+          defaultBranch: branchCheck.defaultBranch,
+          isDefaultBranch: true
+        });
+      }
+
       // Use the user's test directory as the base
       const testDir = getUserTestPath(req, WORKDIR, ROOT_DIR, getAuthConfig);
       const absolutePath = path.join(testDir, filePath);
@@ -607,6 +620,19 @@ export function setupRoutes(app, isAuthenticated, dependencies) {
         return res.status(400).json({ error: 'Source and target paths are required' });
       }
 
+      // Check if on default branch - block file modifications
+      const userRepoPath = getUserRepoPath(req, WORKDIR, ROOT_DIR, getAuthConfig);
+      const branchCheck = await isOnDefaultBranch(userRepoPath);
+
+      if (branchCheck.isDefault) {
+        return res.status(403).json({ 
+          error: `Cannot move files on default branch (${branchCheck.defaultBranch}). Please create a new branch before editing.`,
+          currentBranch: branchCheck.currentBranch,
+          defaultBranch: branchCheck.defaultBranch,
+          isDefaultBranch: true
+        });
+      }
+
       // Use the user's test directory as the base
       const testDir = getUserTestPath(req, WORKDIR, ROOT_DIR, getAuthConfig);
       const absoluteSourcePath = path.join(testDir, sourcePath);
@@ -640,6 +666,19 @@ export function setupRoutes(app, isAuthenticated, dependencies) {
         return res.status(400).json({ error: 'File path is required' });
       }
 
+      // Check if on default branch - block file modifications
+      const userRepoPath = getUserRepoPath(req, WORKDIR, ROOT_DIR, getAuthConfig);
+      const branchCheck = await isOnDefaultBranch(userRepoPath);
+
+      if (branchCheck.isDefault) {
+        return res.status(403).json({ 
+          error: `Cannot delete files on default branch (${branchCheck.defaultBranch}). Please create a new branch before editing.`,
+          currentBranch: branchCheck.currentBranch,
+          defaultBranch: branchCheck.defaultBranch,
+          isDefaultBranch: true
+        });
+      }
+
       // Use the user's test directory as the base
       const testDir = getUserTestPath(req, WORKDIR, ROOT_DIR, getAuthConfig);
       const absolutePath = path.join(testDir, filePath);
@@ -694,6 +733,19 @@ export function setupRoutes(app, isAuthenticated, dependencies) {
         return res.status(400).json({ error: 'Directory path is required' });
       }
 
+      // Check if on default branch - block directory creation
+      const userRepoPath = getUserRepoPath(req, WORKDIR, ROOT_DIR, getAuthConfig);
+      const branchCheck = await isOnDefaultBranch(userRepoPath);
+
+      if (branchCheck.isDefault) {
+        return res.status(403).json({ 
+          error: `Cannot create directories on default branch (${branchCheck.defaultBranch}). Please create a new branch before editing.`,
+          currentBranch: branchCheck.currentBranch,
+          defaultBranch: branchCheck.defaultBranch,
+          isDefaultBranch: true
+        });
+      }
+
       // Use the user's test directory as the base
       const testDir = getUserTestPath(req, WORKDIR, ROOT_DIR, getAuthConfig);
       const absolutePath = path.join(testDir, dirPath);