Homu users can close any PR or Issue of any other Homu enabled project

[kbknapp]

I had a PR in clap-rs/clap#921 that said, "Fixes BurntSushi/ripgrep#426" in order to ping the ripgrep author. Once that PR merged, Homu closed BurntSushi/ripgrep#426 even though I have no rights to the ripgrep project.

IMO Humo should probably check if the issue it's closing is in the same repo (or maybe even just org/owner) as the merging PR.

[sigmavirus24]

@kbknapp homu was designed for projects that span repositories. I'd expect this behaviour based on that understanding and the understanding that the repository owner for ripgrep set up Homu sometime back and didn't appropriately remove the authorizations.

[kbknapp]

@sigmavirus24 spanning multiple repositories inside a single org/user is fine and makes perfect sense. But crossing organization boundaries (or user boundaries if the repo isn't part of an org) seems wrong. The fact that the ripgrep author didn't remove the Homu authorizations is orthogonal to this issue.