PR Management APIs

Relevant source files

The following files were used as context for generating this wiki page:

• app/api/prs/route.ts
• app/api/review/route.ts
• app/api/merge/route.ts
• app/review/page.tsx
• components/PRCard.tsx
• middleware.ts

Introduction

The PR Management APIs in GeNCorE provide a centralized interface for interacting with GitHub Pull Requests. These APIs allow the "Command Center" to fetch active pull requests, submit reviews (approvals or change requests), and execute merge operations directly from the web interface. This system acts as a proxy between the frontend and the GitHub REST API, ensuring that sensitive credentials like the GITHUB_TOKEN remain server-side.

Sources: app/api/prs/route.ts, README.md:12-20, README.md:95-103

Core API Endpoints

The system implements three primary server-side routes to handle Pull Request lifecycle events. All requests are authenticated via middleware before reaching these handlers.

1. Fetching Pull Requests (/api/prs)

The GET endpoint retrieves a list of up to 20 open pull requests from the configured repository. It uses the next: { revalidate: 0 } configuration to ensure that the data is never cached and always reflects the current state of the repository.

Sources: app/api/prs/route.ts:7-35

2. PR Review Operations (/api/review)

The POST endpoint allows users to submit reviews. It supports three types of events: APPROVE, REQUEST_CHANGES, and COMMENT. This endpoint includes validation logic to ensure a comment body is provided when requesting changes or commenting.

Sources: app/api/review/route.ts:11-55

3. PR Merge Operations (/api/merge)

The POST endpoint handles merging pull requests using one of three methods: merge, squash, or rebase. By default, the system utilizes the squash method for merges initiated from the UI.

Sources: app/api/merge/route.ts:11-45, app/review/page.tsx:49-55

Security and Validation

Security is enforced at multiple levels to protect the repository and the server environment:

• Middleware Protection: All API routes (except auth) are intercepted by middleware.ts which verifies a session cookie containing an HMAC-SHA256 hash of the ADMIN_TOKEN.
• SSRF Protection: Input parameters like prNumber are validated as safe integers. The code ensures the number is a positive integer within the range of a 32-bit signed integer (up to 2,147,483,647) before interpolating it into GitHub API URLs.
• Credential Isolation: The GITHUB_TOKEN is strictly stored as a server-side environment variable and is never exposed to the client-side code.

Sources: middleware.ts:25-63, app/api/review/route.ts:28-33, README.md:95-103

Data Flow for PR Actions

The following sequence diagram illustrates the flow of a PR review action from the User Interface through the secure API layer to GitHub.

Endpoint Specifications

API Parameter Summary

Endpoint	Method	Parameter	Type	Description
/api/prs	GET	N/A	N/A	Returns prs[] (Open status)
/api/review	POST	prNumber	Integer	The GitHub PR ID
/api/review	POST	event	String	APPROVE, REQUEST_CHANGES, or COMMENT
/api/review	POST	body	String	Required for REQUEST_CHANGES
/api/merge	POST	prNumber	Integer	The GitHub PR ID
/api/merge	POST	mergeMethod	String	merge, squash, or rebase

Sources: app/api/review/route.ts:11-45, app/api/merge/route.ts:11-35

Implementation Details

PR Action Logic in UI

The frontend uses the fetch API to trigger these routes. For example, the merge operation requires user confirmation before sending a request to the server.

// app/review/page.tsx:49-55
const handleMerge = async (prNumber: number) => {
  if (!confirm(`Merge PR #${prNumber}? Ta operacja jest nieodwracalna.`)) return
  setActionLoading(true)
  try {
    const res = await fetch('/api/merge', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ prNumber, mergeMethod: 'squash' }),
    })
    // ... handling response
  }
}

Sources: app/review/page.tsx:49-65

GitHub API Integration

The server-side routes construct requests to the GitHub REST API v3, providing the Authorization header with the Bearer token and specifying the API version.

// app/api/review/route.ts:58-63
headers: {
  Authorization: `Bearer ${GITHUB_TOKEN}`,
  Accept: 'application/vnd.github+json',
  'Content-Type': 'application/json',
  'X-GitHub-Api-Version': '2022-11-28',
}

Sources: app/api/review/route.ts:58-63, app/api/merge/route.ts:46-51

Conclusion

The PR Management APIs form a robust bridge between the GeNCorE dashboard and GitHub. By combining strict input validation, middleware-based authentication, and a clear separation of client/server responsibilities, the system allows for safe and efficient management of AI-generated pull requests from any device.