feat. Enforce repo review config

tests/test_webhook.py

@@ -64,6 +64,11 @@ def test_webhook_accepts_review_and_queues(monkeypatch) -> None:
         return 100
 
     monkeypatch.setattr("gitea_codex_bot.services.gitea.GiteaClient.post_issue_comment", _post_issue_comment)
+    monkeypatch.setattr(
+        "gitea_codex_bot.services.gitea.GiteaClient.get_pull_request",
+        lambda *_args, **_kwargs: type("PR", (), {"head_sha": "abcdef123"})(),
+    )
+    monkeypatch.setattr("gitea_codex_bot.services.gitea.GiteaClient.get_file_content", lambda *_args, **_kwargs: None)
 
     client = TestClient(app)
     payload_obj = _payload("@codex review security", username="alice", comment_id=111)
@@ -140,3 +145,38 @@ def test_webhook_logs_when_codex_command_is_not_review(monkeypatch) -> None:
     assert response.status_code == 200
     assert response.json()["status"] == "queued"
     assert any("Webhook without @codex review command" in item for item in messages)
+
+
+def test_webhook_rejects_review_when_repo_config_disabled(monkeypatch) -> None:
+    posted_comments: list[str] = []
+
+    monkeypatch.setattr(
+        "gitea_codex_bot.services.gitea.GiteaClient.get_pull_request",
+        lambda *_args, **_kwargs: type("PR", (), {"head_sha": "abcdef123"})(),
+    )
+    monkeypatch.setattr(
+        "gitea_codex_bot.services.gitea.GiteaClient.get_file_content",
+        lambda *_args, **_kwargs: "enabled: false\n",
+    )
+    monkeypatch.setattr(
+        "gitea_codex_bot.services.gitea.GiteaClient.post_issue_comment",
+        lambda _self, _repo, _pr, body: posted_comments.append(body) or 100,
+    )
+
+    client = TestClient(app)
+    payload_obj = _payload("@codex review", username="alice", comment_id=224)
+    raw = json.dumps(payload_obj).encode()
+    response = client.post(
+        "/webhook/gitea",
+        content=raw,
+        headers={
+            "X-Gitea-Event": "issue_comment",
+            "X-Gitea-Delivery": "d-5",
+            "X-Gitea-Signature": _sign(raw),
+            "Content-Type": "application/json",
+        },
+    )
+
+    assert response.status_code == 200
+    assert response.json()["reason"] == "review disabled by repo config"
+    assert any("Review is disabled" in body for body in posted_comments)