refactor: cut bot identity comment noise

Author: kolaente

pkg/db/fixtures/labels.yml

@@ -64,8 +64,6 @@
   created_by_id: 21
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
-# Created by bot 25, the sibling of bot 23 under user 21, with no task
-# attachment: only the identity branch can grant access to it.
 - id: 12
   title: 'Label #12 - created by bot 25, sibling of bot 23'
   created_by_id: 25

pkg/db/fixtures/users.yml

@@ -226,8 +226,6 @@
   bot_owner_id: 22
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
-# Second bot owned by user 21 — sibling of bot 23, used to assert bots of the
-# same owner share an identity.
 - id: 25
   username: 'bot-owner-a-scheduler'
   name: 'Owner A Scheduler'

pkg/models/label_task_test.go

@@ -289,8 +289,6 @@ func TestLabelTask_Create(t *testing.T) {
 			wantForbidden: true,
 		},
 		{
-			// Label 12 was created by bot 25 and never attached: bot 23 reaches
-			// it only through the owner both bots share.
 			name: "bot can attach a label created by a sibling bot",
 			fields: fields{
 				TaskID:  52,

pkg/models/label_test.go

@@ -466,10 +466,7 @@ func TestLabel_ReadOne(t *testing.T) {
 			auth:          &user.User{ID: 24, BotOwnerID: 22},
 		},
 		{
-			// Label 12 was created by bot 25, the sibling of bot 23 under user
-			// 21, and is unattached. BotOwnerID is left unset here on purpose:
-			// JWT-built auth values carry none, so the identity must come from
-			// the database.
+			// JWT auth carries no BotOwnerID, so the identity must resolve from the database.
 			name: "bot can read label created by a sibling bot",
 			fields: fields{
 				ID: 12,
@@ -723,8 +720,6 @@ func TestLabel_Update(t *testing.T) {
 			auth: &user.User{ID: 21},
 		},
 		{
-			// Sharing an identity grants read access, not write: updates stay
-			// with the creator and the human who owns it.
 			name: "bot cannot update label created by a sibling bot",
 			fields: fields{
 				ID:    12,

pkg/user/bot_identity.go

@@ -20,26 +20,18 @@ import (
 	"xorm.io/builder"
 )
 
-// The two helpers below are not opposites: SameBotIdentityCond is symmetric
-// across an owner's fleet, IsBotOwnedBy only ever points from owner to bot.
-// Symmetry is opt-in per resource - so far only labels - and gates reads
-// alone. Everything else, including reading bot users and their tokens, stays
-// on the directional check.
-
 // IsBotOwnedBy reports whether u is a bot owned by owner.
 func (u *User) IsBotOwnedBy(owner *User) bool {
 	return u.IsBot() && u.BotOwnerID == owner.ID
 }
 
-// SameBotIdentityCond matches a user id column against every user sharing u's
-// identity root - a bot's owner, or a human themselves.
+// SameBotIdentityCond matches a user ID column against users sharing u's root:
+// a bot's owner or a human themselves. It is symmetric across an owner's fleet.
 //
 // The root is resolved in SQL so the result never depends on how populated the
 // passed struct happens to be; callers routinely hold a User carrying only an ID.
 //
-// Chain-safe by construction rather than by invariant: the root is exactly one
-// hop up, so even a bot owning a bot would leave the grandchild resolving to its
-// parent bot, never reaching the human.
+// Resolving only one owner hop keeps accidental bot chains out of a human's identity set.
 //
 // column is interpolated as a raw SQL identifier and must be a trusted literal.
 func SameBotIdentityCond(u *User, column string) builder.Cond {

pkg/user/bot_identity_test.go

@@ -57,7 +57,6 @@ func TestUser_IsBotOwnedBy(t *testing.T) {
 			want: false,
 		},
 		{
-			// Reversed direction: the bot must not inherit its owner.
 			name: "caller is the bot, subject is the owner",
 			u:    &User{ID: 21},
 			a:    &User{ID: 23, BotOwnerID: 21},
@@ -70,8 +69,7 @@ func TestUser_IsBotOwnedBy(t *testing.T) {
 			want: false,
 		},
 		{
-			// Both ids are 0, so only the IsBot() half keeps a human from being
-			// reported as owned by an unresolved caller.
+			// IsBot prevents a zero-ID owner from matching a human.
 			name: "human subject, zero-id owner",
 			u:    &User{ID: 5},
 			a:    &User{},
@@ -89,8 +87,7 @@ func TestUser_IsBotOwnedBy(t *testing.T) {
 func TestSameBotIdentityCond(t *testing.T) {
 	tests := []struct {
 		name string
-		// Only the ID is set on purpose: the identity must be resolved from
-		// the database, not from the in-memory struct.
+		// JWT auth carries only an ID, so the identity must resolve from the database.
 		auth *User
 		want []int64
 	}{

pkg/webtests/huma_bot_user_test.go

@@ -72,7 +72,6 @@ func TestHumaBotUser(t *testing.T) {
 			rec, err := h.testReadAllWithUser(nil, nil)
 			require.NoError(t, err)
 			ids := botIDsFromReadAll(t, rec.Body.Bytes())
-			// user 21 owns exactly bots 23 and 25; user 22's bot 24 must never leak.
 			assert.ElementsMatch(t, []int64{23, 25}, ids,
 				"ReadAll must return exactly {23,25}; body: %s", rec.Body.String())
 			assert.NotContains(t, ids, int64(24), "bot #24 (other owner) must be hidden")

pkg/webtests/huma_label_test.go

@@ -302,9 +302,7 @@ func TestHumaLabel_BotOwner(t *testing.T) {
 	})
 }
 
-// Fixture labels #11 (created by the owner) and #12 (created by sibling bot 25)
-// are unattached, so attachment history cannot grant access here - only the
-// shared identity can (#3592).
+// Unattached labels #11 and #12 isolate identity-based access (#3592).
 func TestHumaLabel_BotUsesOwnerLabel(t *testing.T) {
 	bot := webHandlerTestV2{
 		user:     &testbot23,