fix(runners): restore project runners list endpoint

[cursor]

Bug and impact

Commit ff963e7d (fix(runners): do not include inactive global runners to endpoint /project/runners) accidentally replaced the entire GetRunners handler with []any{}. The /api/project/{project_id}/runners endpoint always returned an empty list, so project runner management in the UI was completely broken for all users.

Root cause

The intended change was to exclude inactive global runners from the merged project/global runner list. Instead, the handler body was removed and replaced with a hard-coded empty response.

Fix

• Restore fetching project runners via store.GetRunners
• Merge active global runners that have tags (per API docs), excluding inactive globals
• Add mergeProjectRunnersList unit test

Validation

• go test ./api/projects/... in the pro module (passes)

  

[cursor]

Security review

Outcome: No medium, high, or critical vulnerabilities found in this PR.

Scope reviewed

• pro/api/projects/runners.go — restored GetRunners and mergeProjectRunnersList
• pro/api/projects/runners_test.go — unit test for merge logic
• pro/go.mod — test dependency only

Prior automation threads

No unresolved security-review threads were present on this PR.

Analysis

Authentication / authorization

• GET /api/project/{project_id}/runners remains behind authenticatedAPI, ProjectMiddleware, and GetMustCanMiddleware(db.CanManageProjectResources) (api/router.go). Callers must be project members with resource-management permission; project_id comes from the route and is validated in middleware, not from request body input.

Sensitive fields

• db.Runner omits token and public_key from JSON (json:"-"). The response exposes metadata (name, tags, webhook, activity) consistent with the existing admin runners API and the project runners UI.

Global runner merge

• Listing active tagged global runners alongside project runners matches the tagged-global-runner feature (#3804) and what the project Runners UI expects. Inactive and untagged globals are filtered in mergeProjectRunnersList. This is a functional restore after commit ff963e7d accidentally returned []; it is not an auth bypass for create/update/delete (those handlers still return 404 in pro).

Injection / other classes

• No user-controlled strings reach SQL or shell sinks in the changed code; store calls use typed parameters and server-side project.ID.

Slack summary

PR #3909 security review: clean — no medium+ issues. Restores project runner listing with intended global-runner merge; auth and secret redaction look sound.

  

_{Sent by Cursor Automation: Find vulnerabilities}