From 5ecb2f8e993d128606e390edcb7f4f6d718eb17b Mon Sep 17 00:00:00 2001
From: Xavier L'Hour <xavier.lhour@gmail.com>
Date: Wed, 23 Sep 2026 16:59:57 +0200
Subject: [PATCH 1/2] Bug 2074854 - Recognize USAGE_MODE_MOJO_REST as a
 webservice mode in i_am_webservice

---
 Bugzilla/Util.pm       | 4 +++-
 qa/t/rest_components.t | 9 +++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/Bugzilla/Util.pm b/Bugzilla/Util.pm
index 7c3e4f8928..d9570aba05 100644
--- a/Bugzilla/Util.pm
+++ b/Bugzilla/Util.pm
@@ -298,7 +298,9 @@ sub i_am_cgi {
 
 sub i_am_webservice {
   my $usage_mode = Bugzilla->usage_mode;
-  return $usage_mode == USAGE_MODE_JSON || $usage_mode == USAGE_MODE_REST;
+  return $usage_mode == USAGE_MODE_JSON
+    || $usage_mode == USAGE_MODE_REST
+    || $usage_mode == USAGE_MODE_MOJO_REST;
 }
 
 sub is_webserver_group {
diff --git a/qa/t/rest_components.t b/qa/t/rest_components.t
index 2a5fadae32..ab116ccff7 100644
--- a/qa/t/rest_components.t
+++ b/qa/t/rest_components.t
@@ -41,6 +41,15 @@ $t->post_ok($url . 'rest/component/Firefox' => json => $new_component)
   ->json_is(
   '/message' => 'You must log in before using this part of Bugzilla.');
 
+# Authenticated but unprivileged. This message is 110 characters long, so an
+# exact match also pins that native REST errors are not wrapped at 72 columns.
+$t->post_ok($url
+    . 'rest/component/Firefox' =>
+    {'X-Bugzilla-API-Key' => $config->{unprivileged_user_api_key}} => json =>
+    $new_component)->status_is(401)->json_is('/message' =>
+  "Sorry, you aren't a member of the 'editcomponents' group, and so you are not authorized to add new components."
+  );
+
 # Now try as authenticated user using API key. But a required field is missing (default_assignee).
 $t->post_ok($url
     . 'rest/component/Firefox' => {'X-Bugzilla-API-Key' => $api_key} => json =>

From 7bfe26c3a81941012d6207ddfccd074a0823dd69 Mon Sep 17 00:00:00 2001
From: Xavier L'Hour <xavier.lhour@gmail.com>
Date: Wed, 23 Sep 2026 17:39:17 +0200
Subject: [PATCH 2/2] Bug 2074854 - Add test coverage for restrict_comments
 surviving an automation update

---
 qa/t/rest_github_push_comment.t | 54 +++++++++++++++++++++++++++++++++
 1 file changed, 54 insertions(+)

diff --git a/qa/t/rest_github_push_comment.t b/qa/t/rest_github_push_comment.t
index a29261fafd..3e65591147 100644
--- a/qa/t/rest_github_push_comment.t
+++ b/qa/t/rest_github_push_comment.t
@@ -399,4 +399,58 @@ $t->post_ok(
     } => json => $payload
 )->status_is(200)->json_has("/bugs/$bug_id_3/id");
 
+# An automation update must not clear restrict_comments on the bug it touches.
+
+$new_bug = {
+  product     => 'Firefox',
+  component   => 'General',
+  summary     => 'Test GitHub Push Commenting (restrict_comments)',
+  type        => 'defect',
+  version     => 'unspecified',
+  severity    => 'blocker',
+  description => 'This is a new test bug',
+};
+
+$t->post_ok(
+  $url . 'rest/bug' => {'X-Bugzilla-API-Key' => $api_key} => json => $new_bug)
+  ->status_is(200)->json_has('/id');
+
+my $bug_id_4 = $t->tx->res->json->{id};
+
+$t->put_ok($url
+    . "rest/bug/$bug_id_4" => {'X-Bugzilla-API-Key' => $api_key} => json =>
+    {restrict_comments => 1})->status_is(200);
+
+$payload = {
+  ref        => 'refs/heads/master',
+  repository => {
+    full_name      => 'mozilla-mobile/firefox-android',
+    default_branch => 'master',
+  },
+  commits => [{
+    author => {username => 'foobar', name => 'Foo Bar'},
+    url => 'https://github.com/mozilla-bteam/bmo/commit/abcdefghijklmnopqrstuvwxyz',
+    message => "Bug $bug_id_4 - Test Github Push Comment (restrict_comments)",
+  }]
+};
+
+$t->post_ok(
+  $url
+    . 'rest/github/push_comment' => {
+    'X-Hub-Signature-256' => generate_payload_signature($secret, $payload),
+    'X-GitHub-Event'      => 'push'
+    } => json => $payload
+)->status_is(200)->json_has("/bugs/$bug_id_4/id");
+
+$comment_id = $t->tx->res->json->{bugs}->{$bug_id_4}->{id};
+
+# restrict_comments is not exposed by the REST bug API, so assert its effect:
+# a user outside restrict_comments_group still cannot react to the comment.
+$t->put_ok($url
+    . "rest/bug/comment/$comment_id/reactions" =>
+    {'X-Bugzilla-API-Key' => $config->{unprivileged_user_api_key}} => json =>
+    {add => ['-1']})->status_is(400)
+  ->json_is('/message' =>
+    'You are not allowed to react to comments on this bug.');
+
 done_testing();