fix(server): finish audit logging - #1463
Conversation
Add DevelopmentMixin to retrieve development panel information (pull requests, branches, commits) linked to Jira issues via the /rest/dev-status/1.0/issue/detail endpoint. New MCP tools: - get_issue_development_info: single issue - get_issues_development_info: batch for multiple issues Supports Bitbucket Server (stash), Bitbucket Cloud, GitHub, GitLab.
Add jira_get_issue_development_info and jira_get_issues_development_info to README.md Key Tools table and docs/tools-reference.mdx Complete Tool List.
Add comprehensive tests for development info API: - Test PR retrieval with various response formats - Test commit and branch extraction - Test error handling (missing issue ID, API errors) - Test batch retrieval with partial failures - Test parsing of reviewers and missing fields
Merge in RAN/mcp-atlassian from feature/development-info-api to main * commit 'df23691de676a5f4451900c0fd722ad69b2f308c': test: add unit tests for DevelopmentMixin docs: add development info tools to documentation feat: add development info API for PRs, branches, and commits Add Jira development info tool
Merge branch 'main' into develop
Co-authored-by: Ihor Knysh <Ihor.Knysh@medhost.com>
sooperset
left a comment
sooperset
left a comment
There was a problem hiding this comment.
The cancellation-safe finally path and post-execution identity backfill are both covered well.
- Align sensitive-field masking with the public security contract.
- Make enabled-by-default audit records emit under the default logging configuration.
- Remove the organization-specific setup changes and unrelated generated artifacts.
See inline comments for details.
| "token", | ||
| "password", | ||
| "secret", | ||
| "api_key", |
There was a problem hiding this comment.
BLOCKER: The README and the included requirement both say field names containing key are masked, but this list doesn't contain key. A literal key or encryption_key is currently logged in plaintext. Required for merge: reconcile the contract and implementation, then add regression cases whose expected patterns aren't copied from DEFAULT_SENSITIVE_PATTERNS.
| body, | ||
| ) | ||
| ) | ||
| audit_logger.info(log_entry) |
There was a problem hiding this comment.
BLOCKER: This call is silently filtered in the default configuration. setup_logging() sets the mcp-atlassian hierarchy to WARNING, so mcp-atlassian.audit inherits an effective level of WARNING and drops this INFO record unless verbose logging is enabled. Required for merge: configure the dedicated audit logger so enabled audit logging works by default, and test with a real handler instead of mocking audit_logger.info.
| Add to your Claude Desktop or Cursor MCP configuration: | ||
| #### Add to your IntelliJ IDEA MCP configuration (mcp.json): | ||
|
|
||
| ##### Configure connection to remote Medhost MCP server: |
There was a problem hiding this comment.
IMPORTANT: This replaces the project's generic setup instructions with organization-specific Medhost endpoints and a private Docker registry. Restore the public setup section and keep only the audit documentation relevant to this PR. Please also remove the unrelated generated .kiro planning files.
# Conflicts: # .env.example # pyproject.toml # uv.lock
2 participants
Summary
Finish the audit-logging work from #1357 and sync it with current
main.Verification
uv lock --checkuv run pytest tests/unit/ -xvs(3691 passed, 5 skipped)pre-commit run --all-files(passed)uv run pytest tests/e2e/cloud --cloud-e2e(92 passed, 15 skipped; the watcher test passed on an isolated retry after one transient Jira Cloud 404 during the full run)uv run pytest tests/e2e --dc-e2e(210 skipped by the environment DC gating)The replacement PR retains the original work and the maintainer hardening commit with contributor attribution.