refactor: handle unknown permissions safely

Add fallback handling for unknown permissions, effectively handle empty permission sets, and refine label notes and categories.

Author: zapdev360

backend/src/routes/label.js

@@ -11,6 +11,10 @@ router.get("/app/:slug/label", async (_req, res) => {
       ([name, access]) => ({ name, access })
     );
 
+    if (perms.length === 0) {
+      return res.json(buildLabel([]));
+    }
+
     res.json(buildLabel(perms));
   } catch (err) {
     console.error(err.response?.data || err.message);

backend/src/services/privacyLabel.js

@@ -6,7 +6,10 @@ function buildLabel(perms) {
 
   perms.forEach(({ name }) => {
     const perm = permissions[name];
-    if (!perm) return;
+    if (!perm) {
+      used.add("unknown");
+      return;
+    }
 
     const key = perm.category;
     used.add(key);
@@ -26,8 +29,8 @@ function buildLabel(perms) {
     overall_sensitivity: sensitivity,
     permissions: perms,
     notes: [
-      "Based on publicly available GitHub App permission metadata.",
-      "Does not inspect runtime behavior or private repositories.",
+      "Derived from declared GitHub App permissions.",
+      "Based on public metadata only; no runtime inspection.",
     ],
   };
 }

shared/categories.json

@@ -28,5 +28,10 @@
     "label": "Organization-level access",
     "sensitivity": "high",
     "description": "Permissions that apply across an organization rather than individual repositories."
+  },
+  "unknown": {
+    "label": "Unknown data access",
+    "sensitivity": "moderate",
+    "description": "Permissions not yet classified by PermLens."
   }
 }