fix(customer-analytics): allow api keys on feature request actions - #89646
Merged
Conversation
|
😎 Merged successfully - details. |
arthurdedeus
marked this pull request as ready for review
August 26, 2026 18:42
Contributor
🤖 CI report
|
Contributor
|
Reviews (1): Last reviewed commit: "fix(customer-analytics): allow api keys ..." | Re-trigger Greptile |
…m/PostHog/posthog into fix/feature-request-action-scopes
arthurdedeus
added
stamphog
![stamphog[bot]](https://avatars.githubusercontent.com/in/3000332?s=60&v=4){kind=small}
There was a problem hiding this comment.
Adds required_scopes to eight actions that previously had none (fail-closed for API keys), narrowly scoped to the correct existing customer_analytics:read/write scopes and backed by a new test proving the fix; author is on the owning team with 100% familiarity of the touched lines, satisfying independent assurance for this auth-adjacent change.
- Author wrote 100% of the modified lines and has 69 merged PRs in these paths (familiarity STRONG).
- 👍 on the PR from greptile-apps[bot].
Gate mechanics and policy version
| Gate | Result | |
|---|---|---|
| prerequisites | ✓ | all clear |
| deny-list | ✓ | no deny categories matched |
| size | ✓ | 16L, 1F substantive, 51L/2F incl. docs/generated/snapshots — within ceiling |
| tier | ✓ | T1-agent / T1b-small (51L, 2F, single-area, fix) |
| stamphog 2.0.0b4 | .stamphog/policy.yml @ 479667e · reviewed head 479667e |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
API keys and OAuth tokens cannot use most of the feature request API. Every custom action returns 403 with "This action does not support personal API key access", so the MCP tools for adding evidence, archiving, and reading history are broken for everyone.
The custom actions on
FeatureRequestViewSetdeclare norequired_scopes, and the scope framework fails closed for undeclared actions. The standard CRUD methods work because they map to default scopes.Changes
customer_analytics:writecan now calladd_account,add_evidence,update_evidence,remove_evidence,archive, andrestore.customer_analytics:readcan now callhistoryandstatus_history.required_scopesto the eight@actiondecorators. Session auth is unaffected.How did you test this code?
test_scoped_personal_api_key_can_use_custom_actions: a write-scoped personal API key callsadd_evidenceandhistory. It fails with 403 without the fix and passes with it. No existing test authenticated these endpoints with an API key.hogli ci:preflight --fix.Automatic notifications
Docs update
None. No documented workflow changes.
🤖 Agent context
Autonomy: Human-driven (agent-assisted)
Claude Code session. The 403 surfaced while filing feature requests through the MCP
feature-requests-add-evidence-createtool; the session confirmed the missingrequired_scopesin the viewset and fixed all sibling actions. Skills invoked: /improving-drf-endpoints, /writing-tests, /writing-pr-descriptions.