🐛 Bugfix: Why does git-proxy return 0 repos when extension sends JWT b...

Date: 2026-03-24
Time: 19:03:54 UTC
Session: gspace1-264.8
Agent: backend
Confidence: 95%
Status: ✅ Documented

📋 Decision Context

Question:

Why does git-proxy return 0 repos when extension sends JWT but curl without auth returns 1 repo?

Task: Not specified

🎯 Decision Made

Chosen:

The MCP access token has type=mcp_access but no platformRole field. resolveGitOpsTier() defaulted to 'user' tier which filters repos to the caller's space. The caller's spaceId didn't match the repo's spaceSlug. Fixed by treating authenticated callers (userId + email present) as developer tier, since only developers/admins get MCP tokens.

Options Considered:

• No alternatives documented

💭 Reasoning

JWT payload decoded: {type: mcp_access, mcpTier: free, email: [email protected]} — no platformRole. createUserCaller() in unified-caller.interface.ts maps platformRole from payload but mcpTier is declared on UnifiedCaller interface but never set. Curl without auth worked because the auth guard creates a guest caller that happens to bypass the space filter differently. The root cause: git-proxy assumed platform JWTs, but the extension sends MCP tokens.

📁 Files Involved

• APIs/backend-ai-api/src/app/git-proxy/git-proxy.controller.ts
• libs/libs-api/auth-core/src/lib/interfaces/unified-caller.interface.ts

🔗 Related

• Decision ID: dev_1774379034512_vapbitf
• Session: 264
• Workspace: gspace1

Auto-generated by MCP Smart Consolidation