From 9f875e3180ccd2931c40c8821f4af9fd9409e241 Mon Sep 17 00:00:00 2001
From: RhenCloud <i@rhen.cloud>
Date: Sun, 9 Aug 2026 00:13:02 +0800
Subject: [PATCH] fix: align PR button custom_id with parser, secure token
 deletion, load zh locale

---
 src/formatters/pull-request.ts | 7 ++++---
 src/lib/i18n.ts                | 2 ++
 src/web/oauth-routes.ts        | 4 +++-
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/src/formatters/pull-request.ts b/src/formatters/pull-request.ts
index e2c1fd4..6a6127a 100644
--- a/src/formatters/pull-request.ts
+++ b/src/formatters/pull-request.ts
@@ -84,11 +84,12 @@ export function formatPullRequest(
     });
   }
 
-  const actionable = pr.state === "open" && !!repo && pr.number != null;
+  const [repoOwner, repoName] = (repo ?? "/").split("/", 2);
+  const actionable = pr.state === "open" && !!repoOwner && !!repoName && pr.number != null;
   const actions: NeutralAction[] | undefined = actionable
     ? [
-        { id: `ghpr|merge|${repo}|${pr.number}`, label: "合并", style: "primary" },
-        { id: `ghpr|close|${repo}|${pr.number}`, label: "关闭", style: "danger" },
+        { id: `ghpr|merge|${repoOwner}|${repoName}|${pr.number}`, label: "合并", style: "primary" },
+        { id: `ghpr|close|${repoOwner}|${repoName}|${pr.number}`, label: "关闭", style: "danger" },
       ]
     : undefined;
 
diff --git a/src/lib/i18n.ts b/src/lib/i18n.ts
index 9146342..bcaa3fa 100644
--- a/src/lib/i18n.ts
+++ b/src/lib/i18n.ts
@@ -1,4 +1,5 @@
 import { en } from "./locales/en";
+import { zh } from "./locales/zh";
 
 type NestedStrings = { [key: string]: string | NestedStrings };
 export type Translations = NestedStrings;
@@ -26,6 +27,7 @@ export async function loadTranslations(
   kv?: { get<T>(key: string, type: "json"): Promise<T | null> },
 ): Promise<Translations> {
   if (lang === "en") return en;
+  if (lang === "zh") return zh;
 
   const cached = cache.get(lang);
   if (cached) return cached;
diff --git a/src/web/oauth-routes.ts b/src/web/oauth-routes.ts
index 3bef03f..a4c7949 100644
--- a/src/web/oauth-routes.ts
+++ b/src/web/oauth-routes.ts
@@ -1,7 +1,7 @@
 import { Hono } from "hono";
 import { getOAuthURL, handleOAuthCallback } from "../github/oauth";
 import { removeToken, saveDiscordLink, saveTelegramLink } from "../github/store";
-import { createAdminSession, adminCookie } from "./session";
+import { createAdminSession, adminCookie, getAdminSession } from "./session";
 import { loadGroups, resolveScope, hasAnyAccess } from "./groups";
 import { sendMessage } from "../drivers/telegram/rest";
 import type { Env } from "../types";
@@ -127,6 +127,8 @@ export function createOAuthRoutes(): Hono<{ Bindings: Env }> {
   });
 
   app.delete("/token/:userId", async (c) => {
+    const session = await getAdminSession(c.env.KV, c.req.header("Cookie"));
+    if (!session) return c.json({ error: "Unauthorized" }, 401);
     await removeToken(c.env.KV, c.req.param("userId"));
     return c.json({ ok: true });
   });