Fixed Auto assignment (#102)

* Update 1763927762

* Update 1763931046

* Update 1763932028

* Update 1763941949

* Update 1763943179

* Update 1763946296

Author: palisadoes

.coderabbit.yaml

@@ -0,0 +1,24 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+
+language: 'en-US'
+early_access: false
+chat:
+  auto_reply: true
+reviews:
+  profile: 'assertive'
+  poem: false
+  request_changes_workflow: true
+  high_level_summary: true
+  review_status: true
+  collapse_walkthrough: false
+  auto_review:
+    enabled: true
+    drafts: false
+    base_branches:
+      - develop
+      - main
+  path_filters:
+    - '!**/docs/**'
+    - '!*.html'
+    - '!*.md'
+    - '!*.svg'

.github/workflows/auto-assign.yml

@@ -149,6 +149,50 @@ jobs:
             * Author is the owner of the repository.
             */
 
+            // Restrict /assign based on issue creator's permissions
+            // We don't want non repo members using the feature to 
+            // grab assignments from issues created by other non-members
+            if (isAssign) {
+              const issueCreator = issue.user.login;
+              let issueCreatorAssociation;
+
+              // Fetch author_association via REST API since it's no longer in event payload
+              try {
+                const issueDetails = await github.rest.issues.get({
+                  owner,
+                  repo,
+                  issue_number: issueNumber
+                });                
+                issueCreatorAssociation = issueDetails.data.author_association; 
+              } catch (error) {
+                console.error(`Error fetching issue details for #${issueNumber}:`, error);
+                await github.rest.issues.createComment({
+                  owner,
+                  repo,
+                  issue_number: issueNumber,
+                  body: `❌ Failed to verify issue permissions. Please contact a maintainer or try again later.`,
+                });
+                return;
+              }           
+              console.log(`Issue #${issueNumber} creator ${issueCreator} has association: ${issueCreatorAssociation}`);
+              
+              // Only allow /assign on issues created by OWNER, MEMBER, COLLABORATOR or CONTRIBUTOR
+              const allowedAssociations = ['OWNER', 'MEMBER', 'COLLABORATOR', 'CONTRIBUTOR'];
+              
+              if (!allowedAssociations.includes(issueCreatorAssociation)) {
+                await github.rest.issues.createComment({
+                  owner,
+                  repo,
+                  issue_number: issueNumber,
+                  body: `❌ @${user} The \`/assign\` feature is only available for issues created by OWNER, MEMBER, COLLABORATOR or CONTRIBUTOR user associations. This issue was created by @${issueCreator} who has the association: ${issueCreatorAssociation}.`,
+                });
+                console.log(`Denied /assign for ${user} - Issue creator ${issueCreator} has insufficient association (${issueCreatorAssociation})`);
+                return;
+              }
+              
+              console.log(`Issue creator ${issueCreator} has sufficient association (${issueCreatorAssociation}), allowing /assign for ${user}`);
+            }
+
             // Log the type of user association
             console.log(`Commenting user ${user} is a ${association}`);