feat(mcp): list_idea_questions + answer_question (question-channel B) #56

Merged

janpeter merged 3 commits from claude/question-channel-mcp into main

2026-06-15 00:03:52 +02:00

janpeter commented

2026-06-14 23:53:03 +02:00

Owner

Laag B (question-channel) — de twee MCP-tools

Voor de copilot-question-channel (grill-vragen als kaart in S4MChatWindow). Bevat de shared-submodule-bump (→ #19, allowlist) + twee nieuwe binding-scoped tools:

list_idea_questions (READ) — open vragen op ideeën die de binding-user bezit, in dit product (idee-context erbij voor de kaart).
answer_question (WRITE namens binding-user) — beantwoordt een open grill-vraag; de wachtende grill-worker pikt het op via directe DB-read.

Security (154-P1): beide tools doen userCanAccessProduct(product_id, auth.userId) als EERSTE check (de gedeelde binding-user bezit ideeën in véél producten → zonder dit cross-product-lek). answer_question: pre-read owner/product-grens + options-validatie (answer ∈ options) + atomic updateMany mét de grens IN de WHERE (idea: { is: {...} }, geen TOCTOU) → count 0 = conflict. Mirror list_ideas/create_idea (scope-guard) + update_idea (requireWriteAccess).

Verificatie

npm test → list_idea_questions 6 + answer_question 10; volledige suite 838 tests groen (114 files), 0 pre-existing failures.
npm run typecheck schoon. De Prisma idea:{is:{...}}-relation-WHERE in updateMany accepteerde zonder workaround.
Tests bewijzen dat de DB NIET wordt geraakt als de scope-guard weigert.

Merge-gate: na merge draait 154 de scrum4me-mcp-http-deploy (handmatig, §5 spec) → verifieer tools/list bevat beide tools, vóór Laag C/D.

🤖 Generated with Claude Code

## Laag B (question-channel) — de twee MCP-tools Voor de copilot-question-channel (grill-vragen als kaart in S4MChatWindow). Bevat de shared-submodule-bump (→ #19, allowlist) + twee nieuwe **binding-scoped** tools: - **`list_idea_questions`** (READ) — open vragen op ideeën die de binding-user bezit, in dit product (idee-context erbij voor de kaart). - **`answer_question`** (WRITE namens binding-user) — beantwoordt een open grill-vraag; de wachtende grill-worker pikt het op via directe DB-read. **Security (154-P1):** beide tools doen `userCanAccessProduct(product_id, auth.userId)` als **EERSTE** check (de gedeelde binding-user bezit ideeën in véél producten → zonder dit cross-product-lek). `answer_question`: pre-read owner/product-grens + **options-validatie** (answer ∈ options) + **atomic** `updateMany` mét de grens IN de WHERE (`idea: { is: {...} }`, geen TOCTOU) → count 0 = conflict. Mirror `list_ideas`/`create_idea` (scope-guard) + `update_idea` (requireWriteAccess). ## Verificatie - `npm test` → list_idea_questions 6 + answer_question 10; **volledige suite 838 tests groen** (114 files), 0 pre-existing failures. - `npm run typecheck` schoon. De Prisma `idea:{is:{...}}`-relation-WHERE in `updateMany` accepteerde zonder workaround. - Tests bewijzen dat de DB NIET wordt geraakt als de scope-guard weigert. Merge-gate: na merge draait 154 de **`scrum4me-mcp-http`-deploy** (handmatig, §5 spec) → verifieer `tools/list` bevat beide tools, vóór Laag C/D. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

janpeter added 3 commits

2026-06-14 23:53:03 +02:00

chore(mcp): bump shared submodule → 4fbb288 (question-channel allowlist) 078292c2dd

feat(mcp): list_idea_questions tool + tests (B2) 5299f8ecdb

Token-scoped MCP tool for the copilot question-channel: lists open,
non-expired ClaudeQuestion rows on ideas owned by the binding-user in a
given product. userCanAccessProduct scope-guard is the first check.
6 tests green, typecheck clean.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat(mcp): answer_question tool + tests (B3) c2a4e80418

Write-scoped MCP tool for the copilot question-channel: answers an open,
non-expired ClaudeQuestion on an idea owned by the binding-user. Guards:
userCanAccessProduct scope-guard first, cross-user/cross-product ownership
check, option-list validation, updateMany idempotency guard (count=0).
10 tests green, typecheck clean.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

janpeter merged commit 61e2b2aea6 into main

2026-06-15 00:03:52 +02:00

janpeter referenced this pull request from a commit

2026-06-15 00:03:52 +02:00

Merge pull request 'feat(mcp): list_idea_questions + answer_question (question-channel B)' (#56) from claude/question-channel-mcp into main

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

janpeter/scrum4me-mcp!56

No description provided.

Rows
Columns