fix(auth): fix connectionData 400 + resolve_reviewer_id for non-creator PRs

Two fixes:

  1. connectionData API returns 400 when called with api-version=7.1.
     Added Client.get_raw_no_version/2 that builds the URL without
     the api-version query parameter. connectionData now returns
     the authenticated user's GUID correctly.

  2. resolve_reviewer_id now uses a two-tier approach:
     a) Match current_user_id() against the reviewer list's
        identity.id (handles PRs where the user was explicitly
        added as a reviewer)
     b) Fall back to createdBy.id (handles PRs the user created
        themselves)

  This covers both common scenarios: PRs you created, and PRs you
  were added to as a reviewer. For PRs where you're neither the
  creator nor a reviewer, the error message suggests adding
  yourself via the browser first.

  Verified against live Azure DevOps:
    ado prs approve 'Employee Management' 'Employee Management' 1
    -> Voted +10 (approved) on PR #1.

  325 tests pass, 0 warnings, credo clean.

Author: gilbertwong96

lib/ado_cli/auth.ex

@@ -81,7 +81,7 @@ defmodule AdoCli.Auth do
   end
 
   defp fetch_and_cache_user_id do
-    case Client.get_raw("/_apis/connectionData") do
+    case Client.get_raw_no_version("/_apis/connectionData") do
       {:ok, body} ->
         case JSON.decode(body) do
           {:ok, %{"authenticatedUser" => %{"id" => id}}} when is_binary(id) and id != "" ->

lib/ado_cli/cli/pull_requests.ex

@@ -1081,24 +1081,38 @@ defmodule AdoCli.CLI.PullRequests do
   end
 
   defp resolve_reviewer_id(project, repo_id, pr_id) do
-    # The PR creator is always a reviewer. Fetch the PR to get
-    # their identity GUID, then use it as the reviewer ID for
-    # the PUT /reviewers/{id} vote call.
-    #
-    # This avoids the connectionData API (which returns 400 on
-    # some orgs) and the reviewers list (which is empty for
-    # newly created PRs).
+    # Fetch the PR to get both the reviewer list and the creator.
+    # Match the authenticated user against the reviewer list first;
+    # if the user isn't found or current_user_id() fails, fall back
+    # to the PR creator (always a valid voter).
     case Client.get(
            "/#{URI.encode(project)}/_apis/git/repositories/#{URI.encode(repo_id)}/pullrequests/#{pr_id}"
          ) do
-      {:ok, %{"createdBy" => %{"id" => id}}} when is_binary(id) ->
-        id
+      {:ok, pr} ->
+        reviewers = pr["reviewers"] || []
+
+        reviewer_id =
+          case AdoCli.Auth.current_user_id() do
+            {:ok, user_id} ->
+              Enum.find_value(reviewers, fn r ->
+                if get_in(r, ["identity", "id"]) == user_id, do: r["id"]
+              end)
+
+            _ ->
+              nil
+          end
+
+        if reviewer_id do
+          reviewer_id
+        else
+          case get_in(pr, ["createdBy", "id"]) do
+            nil -> halt_error("Cannot determine reviewer identity for PR ##{pr_id}")
+            creator_id -> creator_id
+          end
+        end
 
       _ ->
-        halt_error(
-          "Cannot determine reviewer identity for PR ##{pr_id}. " <>
-            "The PR may not exist or you may not have permission."
-        )
+        halt_error("Cannot fetch PR ##{pr_id} to determine reviewer identity")
     end
   end
 

lib/ado_cli/client.ex

@@ -80,6 +80,27 @@ defmodule AdoCli.Client do
     handle_response(do_request(:put, path, body, params, extra_headers))
   end
 
+  @doc """
+  Makes a GET request without the api-version query parameter.
+  Used for endpoints like /_apis/connectionData that don't
+  support the standard api-version scheme.
+  """
+  def get_raw_no_version(path, params \\ %{}) do
+    url = build_url_no_version(path, params)
+
+    with {:ok, org, auth_headers} <- AdoCli.Auth.resolve_auth(),
+         {:ok, %Finch.Response{status: status, body: body}} <-
+           Finch.request(Finch.build(:get, inject_org(url, org), auth_headers), AdoCli.Finch) do
+      if status in 200..299, do: {:ok, body}, else: {:error, %{status: status}}
+    end
+  end
+
+  defp build_url_no_version(path, params) do
+    query = if params == %{}, do: "", else: "?" <> URI.encode_query(params)
+    base = base_url()
+    "#{base}/#{String.trim_leading(path, "/")}#{query}"
+  end
+
   # ── Private ──────────────────────────────────────────────────────────
 
   defp handle_response({:ok, %{status: status, body: body}}) when status in 200..299 do