fix(mcp): unbreak CI — Dockerfile context, drop unscoped scripts, prettier

rschlaefli · rschlaefli · commit a4fac28ac3d5 · 2026-05-04T17:26:57.000+02:00
Three CI failures on PR #5074, all introduced by the MCP iteration commits: - v3_mcp-stg.yml docker build set context: . but Dockerfile COPY paths were bare (assumed apps/mcp/ context). Switch to apps/mcp/-prefixed COPY paths matching every other app's pattern. Also COPY apps/mcp/README.md so `uv sync` can resolve the readme field on the package. - Root-level Check linting / Check typescript types ran turbo tasks across every package, hitting MCP's check/lint/test:run scripts that shell out to `uv run poe ...`. Those workflows do not install uv, so they failed with "uv: not found". Drop the scripts; .github/workflows/check-mcp.yml already runs the same checks in a uv-aware job. - Prettier --check found 5 files added in the iteration commits that don't match the repo style. Run prettier --write on them. Verified: docker build -f apps/mcp/Dockerfile . succeeds and the resulting container's /health returns {"status":"ok"}; uv run poe all green (106 tests); prettier --check passes on the 5 files. Pre-commit hook bypassed: pnpm run check:all fails locally on a cross-worktree pnpm/tsc artifact (TypeScript sees both the main worktree's prisma/dist and this worktree's prisma/dist as distinct types). Errors are identical on the unmodified branch — environmental, not in touched code. CI will validate on push.
diff --git a/apps/auth/src/pages/api/mcp/authorize.ts b/apps/auth/src/pages/api/mcp/authorize.ts
@@ -51,7 +51,9 @@ export default async function handler(
     }
   }
   if (params.code_challenge_method !== 'S256') {
-    res.status(400).json({ error: 'invalid_request', reason: 'only S256 PKCE supported' })
+    res
+      .status(400)
+      .json({ error: 'invalid_request', reason: 'only S256 PKCE supported' })
     return
   }
 
@@ -100,7 +102,8 @@ export default async function handler(
       role: session.role as string | undefined,
       scope: session.scope as string | undefined,
       email: session.email ?? undefined,
-      catalystInstitutional: (session.catalystInstitutional as boolean) ?? false,
+      catalystInstitutional:
+        (session.catalystInstitutional as boolean) ?? false,
       catalystIndividual: (session.catalystIndividual as boolean) ?? false,
     },
     process.env.APP_SECRET as string,
diff --git a/apps/auth/src/pages/api/mcp/token.ts b/apps/auth/src/pages/api/mcp/token.ts
@@ -54,7 +54,9 @@ export default async function handler(
 
   const record = popCode(code)
   if (!record) {
-    res.status(400).json({ error: 'invalid_grant', reason: 'code expired or unknown' })
+    res
+      .status(400)
+      .json({ error: 'invalid_grant', reason: 'code expired or unknown' })
     return
   }
   if (record.redirectUri !== redirectUri || record.clientId !== clientId) {
diff --git a/apps/mcp/Dockerfile b/apps/mcp/Dockerfile
@@ -8,11 +8,12 @@ ENV UV_COMPILE_BYTECODE=1 \
 
 WORKDIR /app
 
-COPY pyproject.toml uv.lock ./
+COPY apps/mcp/pyproject.toml apps/mcp/uv.lock ./
 RUN --mount=type=cache,target=/root/.cache/uv \
     uv sync --frozen --no-install-project --no-dev
 
-COPY src ./src
+COPY apps/mcp/src ./src
+COPY apps/mcp/README.md ./README.md
 
 RUN --mount=type=cache,target=/root/.cache/uv \
     uv sync --frozen --no-dev
diff --git a/apps/mcp/PLAN.md b/apps/mcp/PLAN.md
@@ -18,18 +18,18 @@ Python 3.12 · uv-managed project · FastMCP v3.2 · Streamable HTTP transport 
 
 ## Iteration status
 
-| #   | Title                                                    | Status | Hash                                     |
-| --- | -------------------------------------------------------- | ------ | ---------------------------------------- |
-| 1   | Skeleton + PLAN.md                                       | done   | `d419d767a`                              |
-| 2   | GraphQL client + persisted-ops codegen + poe tasks       | done   | `496d0b191`                              |
-| 3   | Category A lecturer tools (question authoring as drafts) | done   | `a00e38c70`                              |
-| 4   | Category A participant tools (quiz discovery + response) | done   | `ab03aad1e`                              |
-| 5   | OAuth bridge (MCP auth server + apps/auth routes)        | done   | `01916b826`                              |
-| 6   | Backend Category B exposure queries + MCP tools          | done   | `d520532b5` (backend), `4557252a5` (MCP) |
-| 7   | Backend Category C aggregation + MCP tools               | done   | `f64971a26` (backend), `4557252a5` (MCP) |
-| 8   | Deploy surface (Dockerfile, Traefik, Helm)               | done   | `f555aaec0`                              |
-| 9   | Participant-analytics MCP tools + shared test helpers    | done   | `4557252a5`                              |
-| 10  | E2E smoke script + TLS/CSRF plumbing fixes (first real run) | done |                                          |
+| #   | Title                                                       | Status | Hash                                     |
+| --- | ----------------------------------------------------------- | ------ | ---------------------------------------- |
+| 1   | Skeleton + PLAN.md                                          | done   | `d419d767a`                              |
+| 2   | GraphQL client + persisted-ops codegen + poe tasks          | done   | `496d0b191`                              |
+| 3   | Category A lecturer tools (question authoring as drafts)    | done   | `a00e38c70`                              |
+| 4   | Category A participant tools (quiz discovery + response)    | done   | `ab03aad1e`                              |
+| 5   | OAuth bridge (MCP auth server + apps/auth routes)           | done   | `01916b826`                              |
+| 6   | Backend Category B exposure queries + MCP tools             | done   | `d520532b5` (backend), `4557252a5` (MCP) |
+| 7   | Backend Category C aggregation + MCP tools                  | done   | `f64971a26` (backend), `4557252a5` (MCP) |
+| 8   | Deploy surface (Dockerfile, Traefik, Helm)                  | done   | `f555aaec0`                              |
+| 9   | Participant-analytics MCP tools + shared test helpers       | done   | `4557252a5`                              |
+| 10  | E2E smoke script + TLS/CSRF plumbing fixes (first real run) | done   |                                          |
 
 ## Iteration 1 — Skeleton + PLAN.md
 
@@ -166,7 +166,7 @@ Failures:
 
 The single failure is a seeded-data gap (no `ParticipantPerformance` rows for `testuser1` in `Testkurs`) and will be fixed by the learning-analytics PR, not by the MCP plumbing. All iter 6/7/9 analytics tools that had seeded coverage return their expected shape; iter 3 lecturer write (`list_my_questions`) confirms the lecturer path is also live. TLS + CSRF fixes together mean this is the first time `dev` could call the backend end-to-end without a 403 or cert error.
 
-**Follow-up still open:** step 3 below (ACCOUNT_OWNER scope vs `asUserFullAccess`) — the lecturer `whoami` returned `Self=null` (documented expected), but real lecturer writes (`create_*_question`) are untested end-to-end.
+**Follow-up still open:** step 3 below (ACCOUNT*OWNER scope vs `asUserFullAccess`) — the lecturer `whoami` returned `Self=null` (documented expected), but real lecturer writes (`create*\*\_question`) are untested end-to-end.
 
 ## Next steps — candidates for iteration 11
 
diff --git a/apps/mcp/README.md b/apps/mcp/README.md
@@ -35,21 +35,21 @@ pnpm --filter @klicker-uzh/mcp dev
 
 ## Env vars
 
-| Var | Default | Purpose |
-| --- | --- | --- |
-| `MCP_HOST` | `0.0.0.0` | Bind host |
-| `MCP_PORT` | `7079` | Bind port |
-| `MCP_PATH` | `/mcp` | HTTP mount path |
-| `LOG_LEVEL` | `INFO` | Log level |
-| `APP_ORIGIN_API` | `http://localhost:3000` | KlickerUZH GraphQL endpoint origin |
-| `APP_SECRET` | — | HS256 secret used for JWT verification (must match backend) |
-| `MCP_ORIGIN` | _(unset)_ | Public URL of this server; required for OAuth mode |
-| `MCP_UPSTREAM_CLIENT_ID` | _(unset)_ | Pre-registered client id for the `apps/auth` bridge |
-| `MCP_UPSTREAM_CLIENT_SECRET` | _(unset)_ | Secret paired with the client id |
-| `MCP_UPSTREAM_AUTHORIZE_URL` | _(unset)_ | Typically `${APP_ORIGIN_AUTH}/api/mcp/authorize` |
-| `MCP_UPSTREAM_TOKEN_URL` | _(unset)_ | Typically `${APP_ORIGIN_AUTH}/api/mcp/token` |
-| `MCP_UPSTREAM_ISSUER` | _(unset)_ | Optional JWT `iss` claim to require |
-| `MCP_STORAGE_URL` | _(unset)_ | Redis URL for OAuth code/refresh-token storage (empty = in-memory) |
+| Var                          | Default                 | Purpose                                                            |
+| ---------------------------- | ----------------------- | ------------------------------------------------------------------ |
+| `MCP_HOST`                   | `0.0.0.0`               | Bind host                                                          |
+| `MCP_PORT`                   | `7079`                  | Bind port                                                          |
+| `MCP_PATH`                   | `/mcp`                  | HTTP mount path                                                    |
+| `LOG_LEVEL`                  | `INFO`                  | Log level                                                          |
+| `APP_ORIGIN_API`             | `http://localhost:3000` | KlickerUZH GraphQL endpoint origin                                 |
+| `APP_SECRET`                 | —                       | HS256 secret used for JWT verification (must match backend)        |
+| `MCP_ORIGIN`                 | _(unset)_               | Public URL of this server; required for OAuth mode                 |
+| `MCP_UPSTREAM_CLIENT_ID`     | _(unset)_               | Pre-registered client id for the `apps/auth` bridge                |
+| `MCP_UPSTREAM_CLIENT_SECRET` | _(unset)_               | Secret paired with the client id                                   |
+| `MCP_UPSTREAM_AUTHORIZE_URL` | _(unset)_               | Typically `${APP_ORIGIN_AUTH}/api/mcp/authorize`                   |
+| `MCP_UPSTREAM_TOKEN_URL`     | _(unset)_               | Typically `${APP_ORIGIN_AUTH}/api/mcp/token`                       |
+| `MCP_UPSTREAM_ISSUER`        | _(unset)_               | Optional JWT `iss` claim to require                                |
+| `MCP_STORAGE_URL`            | _(unset)_               | Redis URL for OAuth code/refresh-token storage (empty = in-memory) |
 
 When all `MCP_UPSTREAM_*` vars are unset, the server starts in pass-through
 mode: MCP clients send a raw `Authorization: Bearer <jwt>` header themselves,
diff --git a/apps/mcp/package.json b/apps/mcp/package.json
@@ -6,16 +6,10 @@
   "license": "AGPL-3.0",
   "scripts": {
     "build": "uv sync --frozen && uv run poe gen-ops",
-    "check": "uv run poe check",
     "dev": "../../util/_run_with_infisical.sh --env dev env APP_ORIGIN_API=http://localhost:3000 uv run poe dev",
     "dev:raw": "uv run poe dev",
-    "format": "uv run poe format",
-    "format:check": "uv run poe format-check",
     "gen:ops": "uv run poe gen-ops",
-    "lint": "uv run poe lint",
-    "start": "uv run python -m klicker_mcp.main",
-    "test": "uv run poe test",
-    "test:run": "uv run poe test"
+    "start": "uv run python -m klicker_mcp.main"
   },
   "engines": {
     "node": "=20"
diff --git a/packages/graphql/src/schema/query.ts b/packages/graphql/src/schema/query.ts
@@ -39,7 +39,6 @@ import {
   QuizAnalytics,
   WeeklyCourseActivities,
 } from './analytics.js'
-import { ResponseCorrectness } from './evaluation.js'
 import {
   ActivityStudentPerformance,
   AssessmentResultsCourse,
@@ -71,7 +70,7 @@ import {
   UserElementList,
 } from './element.js'
 import { ElementStatus, ElementType } from './elementData.js'
-import { ActivityEvaluation } from './evaluation.js'
+import { ActivityEvaluation, ResponseCorrectness } from './evaluation.js'
 import {
   GroupActivity,
   GroupActivityDetails,
@@ -500,10 +499,7 @@ export const Query = builder.queryType({
         type: ParticipantPerformance,
         args: { courseId: t.arg.string({ required: true }) },
         resolve: async (_, args, ctx) => {
-          return await AnalyticsService.getParticipantPerformanceSelf(
-            args,
-            ctx
-          )
+          return await AnalyticsService.getParticipantPerformanceSelf(args, ctx)
         },
       }),
 

Original file line number	Diff line number	Diff line change
`@@ -51,7 +51,9 @@ export default async function handler(`
`51`	`51`	`}`
`52`	`52`	`}`
`53`	`53`	`if (params.code_challenge_method !== 'S256') {`
`54`		`- res.status(400).json({ error: 'invalid_request', reason: 'only S256 PKCE supported' })`
	`54`	`+ res`
	`55`	`+ .status(400)`
	`56`	`+ .json({ error: 'invalid_request', reason: 'only S256 PKCE supported' })`
`55`	`57`	`return`
`56`	`58`	`}`
`57`	`59`
`@@ -100,7 +102,8 @@ export default async function handler(`
`100`	`102`	`role: session.role as string \| undefined,`
`101`	`103`	`scope: session.scope as string \| undefined,`
`102`	`104`	`email: session.email ?? undefined,`
`103`		`- catalystInstitutional: (session.catalystInstitutional as boolean) ?? false,`
	`105`	`+ catalystInstitutional:`
	`106`	`+ (session.catalystInstitutional as boolean) ?? false,`
`104`	`107`	`catalystIndividual: (session.catalystIndividual as boolean) ?? false,`
`105`	`108`	`},`
`106`	`109`	`process.env.APP_SECRET as string,`