pandoras-box/youtrack-cli
Watch
8
0
Fork
You've already forked youtrack-cli
 0
Code Issues Pull requests Projects Releases 12 Packages 1 Wiki Activity Actions

fix(mcp): stop administering Hub from secret rotate #118

Merged
Claude-Run merged 1 commit from fix/YT-61-drop-hub-secret-administration into main 2026-07-17 12:26:24 +02:00
Conversation 0 Commits 1 Files changed 4 +209 -739
Claude-Run commented 2026-07-17 12:25:21 +02:00
Member
Copy link

yt mcp secret rotate minted a client secret locally and installed it on the Hub service record, authenticating with the active instance's YouTrack token. That made yt a Hub administration client, and the capability was unrequested (YT-56 asked for a way to apply a rotation, not to perform one), unusable with the token the CLI actually mints (Hub answers a YouTrack-scoped token with The operation requires the "0-0-0-0-0" scope), and usable at all only if an operator parked a Hub-administration credential in a config file whose every other consumer needs YouTrack access alone. yt has no interactive authorization flow, no 2FA, and no redirect handling, so administration of that weight does not belong in it.

The operator now rotates the secret in Hub and passes the value to --hub-client-secret, which becomes the only source of the new secret: with none supplied the command fails before the prompt, having written nothing, and names the Hub step that produces one. The command resolves no YouTrack credentials and makes no Hub request, so --config / --instance no longer reach it and it runs with no instance configured at all. The half with no workaround is unchanged: patch mcp.env, regenerate the session key, purge every derived credential, restart the unit.

Removes rotate_service_secret and the YT-60 preflight check_service_admin_access from youtrack-mcp, along with their tests, since the command was the only caller. HubClient's own calls are unaffected: an OAuth client reading its own grant is not service administration. The removal is enforced by a workspace source sweep that fails if either name returns, so it cannot be undone by a later edit that reaches for the endpoint again.

Supersedes YT-60, which made the admin path's scope error explain itself; with the admin path gone there is no preflight to add and no scope error to explain.

#YT-61

`yt mcp secret rotate` minted a client secret locally and installed it on the Hub service record, authenticating with the active instance's YouTrack token. That made `yt` a Hub administration client, and the capability was unrequested (YT-56 asked for a way to apply a rotation, not to perform one), unusable with the token the CLI actually mints (Hub answers a YouTrack-scoped token with `The operation requires the "0-0-0-0-0" scope`), and usable at all only if an operator parked a Hub-administration credential in a config file whose every other consumer needs YouTrack access alone. `yt` has no interactive authorization flow, no 2FA, and no redirect handling, so administration of that weight does not belong in it. The operator now rotates the secret in Hub and passes the value to `--hub-client-secret`, which becomes the only source of the new secret: with none supplied the command fails before the prompt, having written nothing, and names the Hub step that produces one. The command resolves no YouTrack credentials and makes no Hub request, so `--config` / `--instance` no longer reach it and it runs with no instance configured at all. The half with no workaround is unchanged: patch `mcp.env`, regenerate the session key, purge every derived credential, restart the unit. Removes `rotate_service_secret` and the YT-60 preflight `check_service_admin_access` from `youtrack-mcp`, along with their tests, since the command was the only caller. `HubClient`'s own calls are unaffected: an OAuth client reading its own grant is not service administration. The removal is enforced by a workspace source sweep that fails if either name returns, so it cannot be undone by a later edit that reaches for the endpoint again. Supersedes YT-60, which made the admin path's scope error explain itself; with the admin path gone there is no preflight to add and no scope error to explain. #YT-61
fix(mcp): stop administering Hub from secret rotate
All checks were successful
Check / fmt + clippy + build + tests (pull_request) Successful in 54s
Details
Create release / Create release from merged PR (pull_request) Has been skipped
Details
5ed383020d 
`yt mcp secret rotate` minted a client secret locally and installed it on the Hub service record, authenticating with the active instance's YouTrack token. That made `yt` a Hub administration client, and the capability was unrequested (YT-56 asked for a way to apply a rotation, not to perform one), unusable with the token the CLI actually mints (Hub answers a YouTrack-scoped token with `The operation requires the "0-0-0-0-0" scope`), and usable at all only if an operator parked a Hub-administration credential in a config file whose every other consumer needs YouTrack access alone. `yt` has no interactive authorization flow, no 2FA, and no redirect handling, so administration of that weight does not belong in it.

The operator now rotates the secret in Hub and passes the value to `--hub-client-secret`, which becomes the only source of the new secret: with none supplied the command fails before the prompt, having written nothing, and names the Hub step that produces one. The command resolves no YouTrack credentials and makes no Hub request, so `--config` / `--instance` no longer reach it and it runs with no instance configured at all. The half with no workaround is unchanged: patch `mcp.env`, regenerate the session key, purge every derived credential, restart the unit.

Removes `rotate_service_secret` and the YT-60 preflight `check_service_admin_access` from `youtrack-mcp`, along with their tests, since the command was the only caller. `HubClient`'s own calls are unaffected: an OAuth client reading its own grant is not service administration. The removal is enforced by a workspace source sweep that fails if either name returns, so it cannot be undone by a later edit that reaches for the endpoint again.

Supersedes YT-60, which made the admin path's scope error explain itself; with the admin path gone there is no preflight to add and no scope error to explain.

#YT-61
Claude-Run deleted branch fix/YT-61-drop-hub-secret-administration 2026-07-17 12:26:24 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
pandoras-box/youtrack-cli!118
No description provided.