Verify user auth is used in diff calculation GitHub API calls

[Copilot]

Verified that the diff calculation endpoint uses the authenticated user's OAuth token for all GitHub API calls, providing implicit authorization.

Authentication Flow

The diffCalculator is initialized with gitHubClient which:

1. Uses oauthTokenDataSource to fetch the user's OAuth token from session
2. Passes this token to all GitHub API calls (getRepositoryContent, compareCommitsWithBasehead)
3. Relies on GitHub's API to enforce repository access permissions

// composition.ts
const gitHubClient = new GitHubClient({
  ...gitHubAppCredentials,
  oauthTokenDataSource  // Retrieves user's token via session.getUserId()
})

export const diffCalculator = new OasDiffCalculator(gitHubClient)

Users without repository access will receive 403/404 errors from GitHub's API, which are already handled by the existing try-catch in the route handler.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.