Merge extensions v2 reads into scoped endpoints

[admdly]

Summary by cubic

Merges the extensions v2 read endpoints into role-aware scoped endpoints so each resource has one read path instead of separate public, owner, and moderator routes. Existing clients using the old read paths must update.

Migration

• GET /extensions keeps scope=public as the default; ?scope=mine and ?scope=all replace GET /extensions/mine and GET /moderation/all-extensions.
• GET /extensions/{id} replaces GET /extensions/mine/{id} and GET /moderation/extensions/{id}.
• The revision queue moved from GET /moderation/extensions to GET /revisions; per-extension history stays at GET /extensions/{id}/revisions.
• GET /developers now defaults to status=all; ?status=unapproved replaces GET /developers/unapproved.
• GET /developers/claims?scope=mine|pending replaces /developers/claims/mine and /developers/claims.
• Migration 0020 now only guards reserved developer ids, since GET /extensions/mine no longer exists.

Behavior

• GET /extensions/{id} and GET /developers/{id} are role-aware: anonymous, unrelated, or inactive-account callers get the public projection, active owners and moderators get the full record, and unpublished or delisted extensions return 404 outside those roles.
• GET /developers, ?scope=all, ?scope=pending, and GET /revisions remain moderator-only; ?scope=mine requires an active account.
• A provided but invalid bearer token returns 401; anonymous reads stay cacheable and authenticated reads set Vary: Authorization.
• On GET /extensions, developer_id is rejected outside scope=public; status and q are rejected outside scope=all (422 instead of being ignored).
• GET /developers/claims?scope=mine now returns the same enriched claim shape as the pending queue.
• GET /revisions (queue) defaults to oldest first; GET /extensions/{id}/revisions (history) defaults to newest first.
• PATCH /users/me now returns the full account projection instead of only display_name.
• A whitespace-only GitHub login no longer counts as a linked identity.
• mine is no longer a reserved extension id; POST /extensions accepts it now that the static route is gone.

^{Written for commit c7f2d13. Summary will update on new commits.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	api	5ff5f42	Commit Preview URL Branch Preview URL	Sep 17 2026, 08:04 AM

[cubic-dev-ai]

All reported issues were addressed across 22 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 17 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

<sub>Requires human review: Auto-approval blocked by 1 unresolved issue from previous reviews.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 10 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 10 files (changes from recent commits).

<sub>Requires human review: Breaks the public API by merging extensions v2 read endpoints into scope/role-aware routes; clients must migrate and response, auth, and cache behavior change, so a human should approve the contract and migration.

Re-trigger cubic</sub>