feat(web): add HTTP-mode deploy artifacts, docs, and OAuth e2e test #15

Merged

David merged 1 commit from feat/http-deploy-artifacts-docs-e2e into main

2026-06-14 23:50:47 +02:00

David commented

2026-06-14 23:27:18 +02:00

Owner

Ship the deployment story for the multi-user HTTP transport and prove the full OAuth dance end to end.

Add compose.yml and .env.example for the HTTP service: app-prefixed service / volume / network (youtrack-mcp, youtrack-mcp-data, youtrack-mcp-private), the SQLite state on a named volume, and every real env var the server reads (YT_MCP_PUBLIC_BASE_URL, YT_MCP_HUB_*, YT_MCP_MASTER_KEY, YT_MCP_SESSION_KEY, YT_MCP_BIND_ADDR, YT_MCP_DATABASE_URL, ...). TLS terminates at a reverse proxy, so no ports: are published.
Add docs/deployment.md: reverse-proxy TLS termination (Caddy + Traefik), forwarded-header / PUBLIC_BASE_URL anchoring, the /healthz probe, registering the OAuth service in Hub (redirect URI PUBLIC_BASE_URL/oauth/hub/callback), and the Claude callback allowlist + discovery flow.
Update CLAUDE.md (dual stdio/http profile, the HTTP bootstrap env) and README.md (transport overview + pointer to the deployment docs).
Add src/web/it_oauth.rs: an end-to-end integration test driving the real /oauth/hub/callback against a stubbed Hub through register -> authorize -> Hub login -> consent -> token -> authenticated /mcp, plus the non-allowlisted 403 denial. The existing flow_tests inject a pre-authenticated session and skip this path.

Back-compat: stdio mode is untouched. just check and just test are green (67 tests).

#YTMCP-8

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

Ship the deployment story for the multi-user HTTP transport and prove the full OAuth dance end to end. - Add `compose.yml` and `.env.example` for the HTTP service: app-prefixed service / volume / network (`youtrack-mcp`, `youtrack-mcp-data`, `youtrack-mcp-private`), the SQLite state on a named volume, and every real env var the server reads (`YT_MCP_PUBLIC_BASE_URL`, `YT_MCP_HUB_*`, `YT_MCP_MASTER_KEY`, `YT_MCP_SESSION_KEY`, `YT_MCP_BIND_ADDR`, `YT_MCP_DATABASE_URL`, ...). TLS terminates at a reverse proxy, so no `ports:` are published. - Add `docs/deployment.md`: reverse-proxy TLS termination (Caddy + Traefik), forwarded-header / `PUBLIC_BASE_URL` anchoring, the `/healthz` probe, registering the OAuth service in Hub (redirect URI `PUBLIC_BASE_URL/oauth/hub/callback`), and the Claude callback allowlist + discovery flow. - Update `CLAUDE.md` (dual stdio/http profile, the HTTP bootstrap env) and `README.md` (transport overview + pointer to the deployment docs). - Add `src/web/it_oauth.rs`: an end-to-end integration test driving the real `/oauth/hub/callback` against a stubbed Hub through register -> authorize -> Hub login -> consent -> token -> authenticated `/mcp`, plus the non-allowlisted `403` denial. The existing `flow_tests` inject a pre-authenticated session and skip this path. Back-compat: stdio mode is untouched. `just check` and `just test` are green (67 tests). #YTMCP-8 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

David added 1 commit

2026-06-14 23:27:18 +02:00

feat(web): add HTTP-mode deploy artifacts, docs, and OAuth e2e test

Check / fmt + clippy + build + tests (pull_request) Successful in 29s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

a5737f6019

Ship the deployment story for the multi-user HTTP transport and prove the full OAuth dance end to end.

- Add `compose.yml` and `.env.example` for the HTTP service: app-prefixed service / volume / network (`youtrack-mcp`, `youtrack-mcp-data`, `youtrack-mcp-private`), the SQLite state on a named volume, and every real env var the server reads (`YT_MCP_PUBLIC_BASE_URL`, `YT_MCP_HUB_*`, `YT_MCP_MASTER_KEY`, `YT_MCP_SESSION_KEY`, `YT_MCP_BIND_ADDR`, `YT_MCP_DATABASE_URL`, ...). TLS terminates at a reverse proxy, so no `ports:` are published.
- Add `docs/deployment.md`: reverse-proxy TLS termination (Caddy + Traefik), forwarded-header / `PUBLIC_BASE_URL` anchoring, the `/healthz` probe, registering the OAuth service in Hub (redirect URI `PUBLIC_BASE_URL/oauth/hub/callback`), and the Claude callback allowlist + discovery flow.
- Update `CLAUDE.md` (dual stdio/http profile, the HTTP bootstrap env) and `README.md` (transport overview + pointer to the deployment docs).
- Add `src/web/it_oauth.rs`: an end-to-end integration test driving the real `/oauth/hub/callback` against a stubbed Hub through register -> authorize -> Hub login -> consent -> token -> authenticated `/mcp`, plus the non-allowlisted `403` denial. The existing `flow_tests` inject a pre-authenticated session and skip this path.

Back-compat: stdio mode is untouched. `just check` and `just test` are green (67 tests).

#YTMCP-8

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>