fix(autofix): require LLMO capability for LLMO auto-fix

[ravverma]

What

Adds an early exit to autofixSuggestions (PATCH /sites/{siteId}/opportunities/{opportunityId}/suggestions/auto-fixes): when the request is for the LLMO product (x-product: LLMO) and the caller does not hold hasLlmoCapabilityForSite, the request is rejected with 403.

Why

LLMO logins never carry the ASO auto_fix scope (dx_aem_perf_auto_fix), so for LLMO requests the existing access check intentionally falls back to plain org-membership (LLMO-6553). That left LLMO auto-fix gated only on org membership, not on the finer-grained LLMO capability that other LLMO routes already enforce. This closes that gap.

How

• After the existing S2S / hasAccess gate, require accessControlUtil.hasLlmoCapabilityForSite(site) when xProduct === 'LLMO'.
• Reuses the standard hasLlmoCapabilityForSite / llmoForbiddenMessage pair, same as the LLMO edge-optimize routes in llmo.js.
• S2S callers are exempt: they are already authorized via CAP_FIX_ENTITY_CREATE and are not FACS subjects, so the gate is skipped when s2sResult.allowed — this avoids regressing the LLMO-6553 S2S path.

Tests

• LLMO product without the capability → 403.
• LLMO product with the capability → proceeds (207).
• Full auto-fix suggestions suite (70 tests) and lint pass.

🤖 Generated with Claude Code

Change Management

cm-assessment: v1
changeType: standard
impact: unnoticeable
risk: minor
changeApprovedBy: ["Dominique Jäggi"]
rationale: "Auto-added baseline (no PR assessment present at CI time); refine via the cmr skill if this change is higher-impact."

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[MysticatBot]

Hey @ravverma,

⚠ Degraded review - no spec document was found for this change (searched the PR links, the touched repos' docs, the architecture/guidelines docs, and linked Jira). This review covers code-level quality but could not validate the change against an agreed design, so confidence is reduced. Add a spec link (PR template section 4) and re-request review for a full-confidence pass.

Verdict: Approve - clean, well-scoped authorization fix that follows established patterns.
Complexity: MEDIUM - small diff; API surface risk flag.
Changes: Adds LLMO capability enforcement to the auto-fix suggestions endpoint, closing an authorization gap where LLMO users were only gated by org membership (2 files).

Non-blocking (2): minor issues and suggestions

• suggestion: Assert the response body message in the 403 test to distinguish between the two nearby forbidden() paths and guard against stub-wiring drift - test/controllers/suggestions.test.js:4462
• suggestion: Add a test verifying S2S callers with x-product: LLMO bypass the LLMO capability check (stub hasS2SCapability to { allowed: true }, stub hasLlmoCapabilityForSite to false, assert request proceeds) - test/controllers/suggestions.test.js:4455

---

_{Skill: pr-review | Model: us.anthropic.claude-opus-4-6-v1[1m] | Duration: 1m 39s | Cost: $3.88 | Commit: 4b318e6ee2ba3c1633090299c55f25f6bf502a58
If this code review was useful, please react with 👍. Otherwise, react with 👎.}

[solaris007]

🎉 This PR is included in version 1.741.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀