fix(mcp): preflight Hub access before the rotation prompt #117

Merged

Claude-Run merged 1 commit from fix/YT-60-hub-scope-preflight into main

2026-07-17 12:12:25 +02:00

Claude-Run commented

2026-07-17 12:11:22 +02:00

Member

yt mcp secret rotate authenticated the Hub service-secret rotation with the active instance's YouTrack permanent token, which yt auth login mints scoped to YouTrack alone. Hub's service administration requires its own service id (0-0-0-0-0, shown in YouTrack as "YouTrack Administration"), so the default path 401s for every operator using a normally-minted token, and it did so only after the operator had already authorized signing every user out.

check_service_admin_access reads GET <issuer>/api/rest/services/<id> with the same token, read-only, before the prompt. A 401/403 aborts non-zero having asked nothing and written nothing, and the error names the required scope, the scopes Hub reports the token as holding (parsed out of Hub's error_description), how to mint a token carrying the Hub scope, and the existing --hub-client-secret fallback. --hub-client-secret resolves no Hub target at all, so it skips the preflight and the Hub call alike. A passing preflight leaves the rest of the flow untouched: prompt, rotate, patch, purge, restart, report.

#YT-60

`yt mcp secret rotate` authenticated the Hub service-secret rotation with the active instance's YouTrack permanent token, which `yt auth login` mints scoped to YouTrack alone. Hub's service administration requires its own service id (`0-0-0-0-0`, shown in YouTrack as "YouTrack Administration"), so the default path 401s for every operator using a normally-minted token, and it did so only after the operator had already authorized signing every user out. `check_service_admin_access` reads `GET <issuer>/api/rest/services/<id>` with the same token, read-only, before the prompt. A 401/403 aborts non-zero having asked nothing and written nothing, and the error names the required scope, the scopes Hub reports the token as holding (parsed out of Hub's `error_description`), how to mint a token carrying the Hub scope, and the existing `--hub-client-secret` fallback. `--hub-client-secret` resolves no Hub target at all, so it skips the preflight and the Hub call alike. A passing preflight leaves the rest of the flow untouched: prompt, rotate, patch, purge, restart, report. #YT-60

Claude-Run added 1 commit

2026-07-17 12:11:22 +02:00

fix(mcp): preflight Hub access before the rotation prompt

Check / fmt + clippy + build + tests (pull_request) Successful in 27s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

e73d918707

`yt mcp secret rotate` authenticated the Hub service-secret rotation with the active instance's YouTrack permanent token, which `yt auth login` mints scoped to YouTrack alone. Hub's service administration requires its own service id (`0-0-0-0-0`, shown in YouTrack as "YouTrack Administration"), so the default path 401s for every operator using a normally-minted token, and it did so only after the operator had already authorized signing every user out.

`check_service_admin_access` reads `GET <issuer>/api/rest/services/<id>` with the same token, read-only, before the prompt. A 401/403 aborts non-zero having asked nothing and written nothing, and the error names the required scope, the scopes Hub reports the token as holding (parsed out of Hub's `error_description`), how to mint a token carrying the Hub scope, and the existing `--hub-client-secret` fallback. `--hub-client-secret` resolves no Hub target at all, so it skips the preflight and the Hub call alike. A passing preflight leaves the rest of the flow untouched: prompt, rotate, patch, purge, restart, report.

#YT-60