@dpesch/mantisbt-mcp-server 1.5.1 → 1.5.4

package/tests/config.test.ts

@@ -146,6 +146,75 @@ describe('getConfig() – errors', () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// HTTP transport configuration
+// ---------------------------------------------------------------------------
+
+describe('getConfig() – HTTP transport', () => {
+  it('uses 127.0.0.1 as default httpHost', async () => {
+    vi.stubEnv('MANTIS_BASE_URL', 'https://mantis.example.com');
+    vi.stubEnv('MANTIS_API_KEY', 'key');
+
+    const getConfig = await freshGetConfig();
+    const config = await getConfig();
+
+    expect(config.httpHost).toBe('127.0.0.1');
+  });
+
+  it('uses 3000 as default httpPort', async () => {
+    vi.stubEnv('MANTIS_BASE_URL', 'https://mantis.example.com');
+    vi.stubEnv('MANTIS_API_KEY', 'key');
+
+    const getConfig = await freshGetConfig();
+    const config = await getConfig();
+
+    expect(config.httpPort).toBe(3000);
+  });
+
+  it('uses PORT when set', async () => {
+    vi.stubEnv('MANTIS_BASE_URL', 'https://mantis.example.com');
+    vi.stubEnv('MANTIS_API_KEY', 'key');
+    vi.stubEnv('PORT', '8080');
+
+    const getConfig = await freshGetConfig();
+    const config = await getConfig();
+
+    expect(config.httpPort).toBe(8080);
+  });
+
+  it('uses MCP_HTTP_HOST when set', async () => {
+    vi.stubEnv('MANTIS_BASE_URL', 'https://mantis.example.com');
+    vi.stubEnv('MANTIS_API_KEY', 'key');
+    vi.stubEnv('MCP_HTTP_HOST', '0.0.0.0');
+
+    const getConfig = await freshGetConfig();
+    const config = await getConfig();
+
+    expect(config.httpHost).toBe('0.0.0.0');
+  });
+
+  it('leaves httpToken undefined when MCP_HTTP_TOKEN is not set', async () => {
+    vi.stubEnv('MANTIS_BASE_URL', 'https://mantis.example.com');
+    vi.stubEnv('MANTIS_API_KEY', 'key');
+
+    const getConfig = await freshGetConfig();
+    const config = await getConfig();
+
+    expect(config.httpToken).toBeUndefined();
+  });
+
+  it('reads httpToken from MCP_HTTP_TOKEN', async () => {
+    vi.stubEnv('MANTIS_BASE_URL', 'https://mantis.example.com');
+    vi.stubEnv('MANTIS_API_KEY', 'key');
+    vi.stubEnv('MCP_HTTP_TOKEN', 'secret-token');
+
+    const getConfig = await freshGetConfig();
+    const config = await getConfig();
+
+    expect(config.httpToken).toBe('secret-token');
+  });
+});
+
 // ---------------------------------------------------------------------------
 // Singleton caching
 // ---------------------------------------------------------------------------

package/tests/tools/files.test.ts

@@ -1,3 +1,4 @@
+import path from 'node:path';
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { MantisClient } from '../../src/client.js';
 import { registerFileTools } from '../../src/tools/files.js';
@@ -20,7 +21,7 @@ let client: MantisClient;
 beforeEach(() => {
   mockServer = new MockMcpServer();
   client = new MantisClient('https://mantis.example.com', 'test-token');
-  registerFileTools(mockServer as never, client);
+  registerFileTools(mockServer as never, client, undefined);
   vi.stubGlobal('fetch', vi.fn());
 });
 
@@ -272,3 +273,72 @@ describe('upload_file (Base64)', () => {
     expect(result.content[0]!.text).toContain('Error:');
   });
 });
+
+// ---------------------------------------------------------------------------
+// upload_file – Path Traversal protection (uploadDir)
+// ---------------------------------------------------------------------------
+
+describe('upload_file (uploadDir restriction)', () => {
+  const uploadDir = path.resolve('/tmp/uploads');
+
+  beforeEach(() => {
+    // Override the server registered in the outer beforeEach with one that
+    // has uploadDir set.
+    mockServer = new MockMcpServer();
+    client = new MantisClient('https://mantis.example.com', 'test-token');
+    registerFileTools(mockServer as never, client, uploadDir);
+    vi.stubGlobal('fetch', vi.fn());
+  });
+
+  it('allows file_path inside uploadDir', async () => {
+    vi.mocked(readFile).mockResolvedValue(Buffer.from('content') as never);
+    vi.mocked(fetch).mockResolvedValue(makeResponse(200, JSON.stringify({ id: 5 })));
+
+    const result = await mockServer.callTool('upload_file', {
+      issue_id: 42,
+      file_path: path.join(uploadDir, 'report.pdf'),
+    });
+
+    expect(result.isError).toBeUndefined();
+    expect(readFile).toHaveBeenCalled();
+  });
+
+  it('blocks file_path outside uploadDir', async () => {
+    const result = await mockServer.callTool('upload_file', {
+      issue_id: 42,
+      file_path: '/etc/passwd',
+    });
+
+    expect(result.isError).toBe(true);
+    expect(result.content[0]!.text).toContain('not allowed');
+    expect(readFile).not.toHaveBeenCalled();
+  });
+
+  it('blocks path traversal escaping uploadDir', async () => {
+    const result = await mockServer.callTool('upload_file', {
+      issue_id: 42,
+      file_path: path.join(uploadDir, '..', 'secret.txt'),
+    });
+
+    expect(result.isError).toBe(true);
+    expect(result.content[0]!.text).toContain('not allowed');
+    expect(readFile).not.toHaveBeenCalled();
+  });
+
+  it('allows any file_path when uploadDir is undefined (no restriction)', async () => {
+    // This uses the outer beforeEach server (uploadDir = undefined).
+    const unrestrictedServer = new MockMcpServer();
+    registerFileTools(unrestrictedServer as never, client, undefined);
+
+    vi.mocked(readFile).mockResolvedValue(Buffer.from('content') as never);
+    vi.mocked(fetch).mockResolvedValue(makeResponse(200, JSON.stringify({ id: 5 })));
+
+    const result = await unrestrictedServer.callTool('upload_file', {
+      issue_id: 42,
+      file_path: '/etc/passwd',
+    });
+
+    expect(result.isError).toBeUndefined();
+    expect(readFile).toHaveBeenCalledWith('/etc/passwd');
+  });
+});

package/tests/tools/issues.test.ts

@@ -474,3 +474,55 @@ describe('list_issues – recorded fixtures', () => {
     expect(parsed.issues).toHaveLength(resolvedInFixture);
   });
 });
+
+// ---------------------------------------------------------------------------
+// update_issue – fields allowlist
+// ---------------------------------------------------------------------------
+
+describe('update_issue – fields allowlist', () => {
+  it('accepts known string fields (summary, description)', async () => {
+    vi.mocked(fetch).mockResolvedValue(makeResponse(200, JSON.stringify({ issue: { id: 1, summary: 'Updated' } })));
+
+    const result = await mockServer.callTool(
+      'update_issue',
+      { id: 1, fields: { summary: 'Updated', description: 'New desc' } },
+      { validate: true },
+    );
+
+    expect(result.isError).toBeUndefined();
+  });
+
+  it('accepts known object fields (status, resolution, handler)', async () => {
+    vi.mocked(fetch).mockResolvedValue(makeResponse(200, JSON.stringify({ issue: { id: 1 } })));
+
+    const result = await mockServer.callTool(
+      'update_issue',
+      { id: 1, fields: { status: { name: 'resolved' }, resolution: { id: 20 }, handler: { id: 5 } } },
+      { validate: true },
+    );
+
+    expect(result.isError).toBeUndefined();
+  });
+
+  it('rejects unknown fields without calling the API', async () => {
+    const result = await mockServer.callTool(
+      'update_issue',
+      { id: 1, fields: { reporter: { id: 99 } } },
+      { validate: true },
+    );
+
+    expect(result.isError).toBe(true);
+    expect(vi.mocked(fetch)).not.toHaveBeenCalled();
+  });
+
+  it('rejects fields with an unknown key mixed with known keys without calling the API', async () => {
+    const result = await mockServer.callTool(
+      'update_issue',
+      { id: 1, fields: { summary: 'ok', unknown_field: 'bad' } },
+      { validate: true },
+    );
+
+    expect(result.isError).toBe(true);
+    expect(vi.mocked(fetch)).not.toHaveBeenCalled();
+  });
+});

package/.env.local

@@ -1,3 +0,0 @@
-MANTIS_BASE_URL=https://mantis.dev.11com7.de
-MANTIS_API_KEY=3vhKDwxVavmCzRUR7Cp0Lk7F8E4dha6n
-MANTIS_SEARCH_ENABLED=true

package/tests/fixtures/recorded/get_current_user.json

@@ -1,108 +0,0 @@
-{
-  "id": 51,
-  "name": "domAgent",
-  "real_name": "Dominik Pesch (via Agent)",
-  "email": "d.pesch+agent@11com7.de",
-  "language": "german",
-  "timezone": "Europe/Berlin",
-  "access_level": {
-    "id": 70,
-    "name": "manager",
-    "label": "Manager"
-  },
-  "created_at": "2026-02-28T09:08:30+01:00",
-  "projects": [
-    {
-      "id": 30,
-      "name": "((Haus)) (Bolliggasse 1a)"
-    },
-    {
-      "id": 54,
-      "name": "11com7 Claude MetaRepo"
-    },
-    {
-      "id": 2,
-      "name": "11com7 ContentGo-Lib"
-    },
-    {
-      "id": 48,
-      "name": "11com7 DevServer"
-    },
-    {
-      "id": 25,
-      "name": "11com7 GmbH"
-    },
-    {
-      "id": 39,
-      "name": "11com7 Hosting (Keyweb, Ansible)"
-    },
-    {
-      "id": 44,
-      "name": "11com7-Ausbildung-FIAE"
-    },
-    {
-      "id": 52,
-      "name": "11com7-DVMS (Datenschutzverletzungsmelder)"
-    },
-    {
-      "id": 5,
-      "name": "11com7-Homepage"
-    },
-    {
-      "id": 27,
-      "name": "b11com7"
-    },
-    {
-      "id": 3,
-      "name": "BIBB NAA309"
-    },
-    {
-      "id": 11,
-      "name": "BIBB wbmonitor"
-    },
-    {
-      "id": 38,
-      "name": "DSGV Budgetanalyse 3"
-    },
-    {
-      "id": 28,
-      "name": "DSGV Finanzchecker (App)"
-    },
-    {
-      "id": 45,
-      "name": "DSGV Finanzchecker (Landingpage)"
-    },
-    {
-      "id": 40,
-      "name": "DSGV Login"
-    },
-    {
-      "id": 26,
-      "name": "DSGV Referenzbudgets"
-    },
-    {
-      "id": 8,
-      "name": "DSGV Vortragsservice"
-    },
-    {
-      "id": 14,
-      "name": "DSGV Web-Budgetplaner"
-    },
-    {
-      "id": 42,
-      "name": "Lingua-World"
-    },
-    {
-      "id": 49,
-      "name": "SIK M&E-App"
-    },
-    {
-      "id": 21,
-      "name": "Uni Bonn (Hausprint V2)"
-    },
-    {
-      "id": 53,
-      "name": "ZEEEM GSM-Landingpage"
-    }
-  ]
-}

package/tests/fixtures/recorded/get_issue.json

@@ -1,138 +0,0 @@
-{
-  "issues": [
-    {
-      "id": 7860,
-      "summary": "sync_metadata befüllt Kategorien und Tags nicht im Cache",
-      "description": "## Was ist passiert?\n`/mantis-sync` zeigt für alle Projekte \"Kategorien: 0\" und \"Tags: 0\" an, obwohl in Mantis Kategorien und Tags vorhanden sind.\n\nDirektaufruf von `get_project_categories(project_id: 25)` liefert 9 Kategorien für \"11com7 GmbH\" — der Cache enthält jedoch ein leeres `categories: []`. Tags fehlen im Cache-Root vollständig (kein `tags`-Key vorhanden).\n\n## Betroffene Komponente\n- Skill: `/mantis-sync`\n- Helper: `~/.claude/helpers/mantis-metadata-summary.js`\n- Externer Dependency: `mantisbt-mcp` Server, Tool `sync_metadata`\n- Plattform: beide\n\n## Ursachenanalyse\n`sync_metadata` im mantisbt-mcp-Server befüllt `byProject[id].categories` nicht — das Feld existiert im Schema, enthält aber immer `[]`. Der `tags`-Key wird auf Root-Ebene gar nicht angelegt.\n\nDas Summary-Script liest bereits korrekt:\n- `pd.categories || proj.categories || []` → bekommt immer `[]`\n- `metadata.tags || []` → bekommt immer `[]` (Key fehlt im Cache)\n\n## Lösungsansätze\n1. **mantisbt-mcp `sync_metadata` erweitern (bevorzugt):**\n   - Für jedes Projekt `get_project_categories(project_id)` aufrufen und Ergebnis in `byProject[id].categories` speichern\n   - `list_tags()` einmalig aufrufen und als `tags: [...]` auf Root-Ebene speichern\n2. **Workaround im /mantis-sync-Skill:** Kategorien und Tags per Direkt-API-Aufruf nachladen — unabhängig vom MCP-Server, aber teurer.\n\n## So reproduzierbar\n1. `/mantis-sync` ausführen\n2. Alle Projekte zeigen \"0\" in der Kategorien-Spalte, Fußzeile \"0 Tags\"\n3. Kontrollaufruf: `get_project_categories(project_id: 25)` → 9 Kategorien\n\n## Hinweise zur Umsetzung\n- `mantis-metadata-summary.js` muss NICHT geändert werden — liest bereits korrekt\n- Kategorien sind projektspezifisch → Sync muss über alle Projekte iterieren (erhöhter API-Aufwand)\n- Tags sind global → ein einzelner `list_tags()`-Aufruf reicht\n- Nach MCP-Server-Fix: `sync_metadata()` neu ausführen und Cache prüfen",
-      "project": {
-        "id": 54,
-        "name": "11com7 Claude MetaRepo"
-      },
-      "category": {
-        "id": 393,
-        "name": "Skills"
-      },
-      "reporter": {
-        "id": 51,
-        "name": "domAgent",
-        "real_name": "Dominik Pesch (via Agent)",
-        "email": "d.pesch+agent@11com7.de"
-      },
-      "handler": {
-        "id": 51,
-        "name": "domAgent",
-        "real_name": "Dominik Pesch (via Agent)",
-        "email": "d.pesch+agent@11com7.de"
-      },
-      "status": {
-        "id": 50,
-        "name": "assigned",
-        "label": "zugewiesen",
-        "color": "#afbed5"
-      },
-      "resolution": {
-        "id": 10,
-        "name": "open",
-        "label": "offen"
-      },
-      "view_state": {
-        "id": 10,
-        "name": "public",
-        "label": "öffentlich"
-      },
-      "priority": {
-        "id": 30,
-        "name": "normal",
-        "label": "normal"
-      },
-      "severity": {
-        "id": 200,
-        "name": "Technische Schuld",
-        "label": "Technische Schuld"
-      },
-      "reproducibility": {
-        "id": 70,
-        "name": "have not tried",
-        "label": "nicht getestet"
-      },
-      "sticky": false,
-      "created_at": "2026-03-16T15:40:38+01:00",
-      "updated_at": "2026-03-16T15:40:38+01:00",
-      "history": [
-        {
-          "created_at": "2026-03-16T15:40:38+01:00",
-          "user": {
-            "id": 51,
-            "name": "domAgent",
-            "real_name": "Dominik Pesch (via Agent)",
-            "email": "d.pesch+agent@11com7.de"
-          },
-          "type": {
-            "id": 1,
-            "name": "issue-new"
-          },
-          "message": "Neuer Eintrag"
-        },
-        {
-          "created_at": "2026-03-16T15:40:38+01:00",
-          "user": {
-            "id": 51,
-            "name": "domAgent",
-            "real_name": "Dominik Pesch (via Agent)",
-            "email": "d.pesch+agent@11com7.de"
-          },
-          "field": {
-            "name": "status",
-            "label": "Status"
-          },
-          "type": {
-            "id": 0,
-            "name": "field-updated"
-          },
-          "old_value": {
-            "id": 10,
-            "name": "new",
-            "label": "neu",
-            "color": "#eeb3aa"
-          },
-          "new_value": {
-            "id": 50,
-            "name": "assigned",
-            "label": "zugewiesen",
-            "color": "#afbed5"
-          },
-          "message": "Status",
-          "change": "neu => zugewiesen"
-        },
-        {
-          "created_at": "2026-03-16T15:40:38+01:00",
-          "user": {
-            "id": 51,
-            "name": "domAgent",
-            "real_name": "Dominik Pesch (via Agent)",
-            "email": "d.pesch+agent@11com7.de"
-          },
-          "field": {
-            "name": "handler",
-            "label": "Bearbeitung durch"
-          },
-          "type": {
-            "id": 0,
-            "name": "field-updated"
-          },
-          "old_value": {
-            "id": 0
-          },
-          "new_value": {
-            "id": 51,
-            "name": "domAgent",
-            "real_name": "Dominik Pesch (via Agent)",
-            "email": "d.pesch+agent@11com7.de"
-          },
-          "message": "Bearbeitung durch",
-          "change": " => domAgent"
-        }
-      ]
-    }
-  ]
-}

package/tests/fixtures/recorded/get_issue_enums.json

@@ -1,67 +0,0 @@
-{
-  "configs": [
-    {
-      "option": "severity_enum_string",
-      "value": [
-        { "id": 10, "name": "Feature-Wunsch", "label": "Feature-Wunsch" },
-        { "id": 20, "name": "Trivial", "label": "Trivial" },
-        { "id": 30, "name": "Fehler im Text", "label": "Fehler im Text" },
-        { "id": 40, "name": "Unschönheit", "label": "Unschönheit" },
-        { "id": 50, "name": "kleinerer Fehler", "label": "kleinerer Fehler" },
-        { "id": 60, "name": "schwerer Fehler", "label": "schwerer Fehler" },
-        { "id": 70, "name": "Absturz", "label": "Absturz" },
-        { "id": 80, "name": "Blocker", "label": "Blocker" },
-        { "id": 200, "name": "Technische Schuld", "label": "Technische Schuld" },
-        { "id": 210, "name": "Wartung", "label": "Wartung" }
-      ]
-    },
-    {
-      "option": "status_enum_string",
-      "value": [
-        { "id": 10, "name": "new", "label": "neu" },
-        { "id": 20, "name": "feedback", "label": "Rückmeldung" },
-        { "id": 30, "name": "acknowledged", "label": "anerkannt" },
-        { "id": 40, "name": "confirmed", "label": "bestätigt" },
-        { "id": 50, "name": "assigned", "label": "zugewiesen" },
-        { "id": 80, "name": "resolved", "label": "erledigt" },
-        { "id": 90, "name": "closed", "label": "geschlossen" }
-      ]
-    },
-    {
-      "option": "priority_enum_string",
-      "value": [
-        { "id": 10, "name": "none", "label": "keine" },
-        { "id": 20, "name": "low", "label": "niedrig" },
-        { "id": 30, "name": "normal", "label": "normal" },
-        { "id": 40, "name": "high", "label": "hoch" },
-        { "id": 50, "name": "urgent", "label": "dringend" },
-        { "id": 60, "name": "immediate", "label": "sofort" }
-      ]
-    },
-    {
-      "option": "resolution_enum_string",
-      "value": [
-        { "id": 10, "name": "open", "label": "offen" },
-        { "id": 20, "name": "fixed", "label": "erledigt" },
-        { "id": 30, "name": "reopened", "label": "wiedereröffnet" },
-        { "id": 40, "name": "unable to duplicate", "label": "nicht reproduzierbar" },
-        { "id": 50, "name": "not fixable", "label": "unlösbar" },
-        { "id": 60, "name": "duplicate", "label": "doppelt" },
-        { "id": 70, "name": "not a bug", "label": "keine Änderung notwendig" },
-        { "id": 80, "name": "suspended", "label": "aufgeschoben" },
-        { "id": 90, "name": "wont fix", "label": "wird nicht behoben" }
-      ]
-    },
-    {
-      "option": "reproducibility_enum_string",
-      "value": [
-        { "id": 10, "name": "always", "label": "immer" },
-        { "id": 30, "name": "sometimes", "label": "manchmal" },
-        { "id": 50, "name": "random", "label": "zufällig" },
-        { "id": 70, "name": "have not tried", "label": "nicht getestet" },
-        { "id": 90, "name": "unable to duplicate", "label": "nicht reproduzierbar" },
-        { "id": 100, "name": "N/A", "label": "N/A" }
-      ]
-    }
-  ]
-}

package/tests/fixtures/recorded/get_issue_fields_sample.json

@@ -1,138 +0,0 @@
-{
-  "issues": [
-    {
-      "id": 7860,
-      "summary": "sync_metadata befüllt Kategorien und Tags nicht im Cache",
-      "description": "## Was ist passiert?\n`/mantis-sync` zeigt für alle Projekte \"Kategorien: 0\" und \"Tags: 0\" an, obwohl in Mantis Kategorien und Tags vorhanden sind.\n\nDirektaufruf von `get_project_categories(project_id: 25)` liefert 9 Kategorien für \"11com7 GmbH\" — der Cache enthält jedoch ein leeres `categories: []`. Tags fehlen im Cache-Root vollständig (kein `tags`-Key vorhanden).\n\n## Betroffene Komponente\n- Skill: `/mantis-sync`\n- Helper: `~/.claude/helpers/mantis-metadata-summary.js`\n- Externer Dependency: `mantisbt-mcp` Server, Tool `sync_metadata`\n- Plattform: beide\n\n## Ursachenanalyse\n`sync_metadata` im mantisbt-mcp-Server befüllt `byProject[id].categories` nicht — das Feld existiert im Schema, enthält aber immer `[]`. Der `tags`-Key wird auf Root-Ebene gar nicht angelegt.\n\nDas Summary-Script liest bereits korrekt:\n- `pd.categories || proj.categories || []` → bekommt immer `[]`\n- `metadata.tags || []` → bekommt immer `[]` (Key fehlt im Cache)\n\n## Lösungsansätze\n1. **mantisbt-mcp `sync_metadata` erweitern (bevorzugt):**\n   - Für jedes Projekt `get_project_categories(project_id)` aufrufen und Ergebnis in `byProject[id].categories` speichern\n   - `list_tags()` einmalig aufrufen und als `tags: [...]` auf Root-Ebene speichern\n2. **Workaround im /mantis-sync-Skill:** Kategorien und Tags per Direkt-API-Aufruf nachladen — unabhängig vom MCP-Server, aber teurer.\n\n## So reproduzierbar\n1. `/mantis-sync` ausführen\n2. Alle Projekte zeigen \"0\" in der Kategorien-Spalte, Fußzeile \"0 Tags\"\n3. Kontrollaufruf: `get_project_categories(project_id: 25)` → 9 Kategorien\n\n## Hinweise zur Umsetzung\n- `mantis-metadata-summary.js` muss NICHT geändert werden — liest bereits korrekt\n- Kategorien sind projektspezifisch → Sync muss über alle Projekte iterieren (erhöhter API-Aufwand)\n- Tags sind global → ein einzelner `list_tags()`-Aufruf reicht\n- Nach MCP-Server-Fix: `sync_metadata()` neu ausführen und Cache prüfen",
-      "project": {
-        "id": 54,
-        "name": "11com7 Claude MetaRepo"
-      },
-      "category": {
-        "id": 393,
-        "name": "Skills"
-      },
-      "reporter": {
-        "id": 51,
-        "name": "domAgent",
-        "real_name": "Dominik Pesch (via Agent)",
-        "email": "d.pesch+agent@11com7.de"
-      },
-      "handler": {
-        "id": 51,
-        "name": "domAgent",
-        "real_name": "Dominik Pesch (via Agent)",
-        "email": "d.pesch+agent@11com7.de"
-      },
-      "status": {
-        "id": 50,
-        "name": "assigned",
-        "label": "zugewiesen",
-        "color": "#afbed5"
-      },
-      "resolution": {
-        "id": 10,
-        "name": "open",
-        "label": "offen"
-      },
-      "view_state": {
-        "id": 10,
-        "name": "public",
-        "label": "öffentlich"
-      },
-      "priority": {
-        "id": 30,
-        "name": "normal",
-        "label": "normal"
-      },
-      "severity": {
-        "id": 200,
-        "name": "Technische Schuld",
-        "label": "Technische Schuld"
-      },
-      "reproducibility": {
-        "id": 70,
-        "name": "have not tried",
-        "label": "nicht getestet"
-      },
-      "sticky": false,
-      "created_at": "2026-03-16T15:40:38+01:00",
-      "updated_at": "2026-03-16T15:40:38+01:00",
-      "history": [
-        {
-          "created_at": "2026-03-16T15:40:38+01:00",
-          "user": {
-            "id": 51,
-            "name": "domAgent",
-            "real_name": "Dominik Pesch (via Agent)",
-            "email": "d.pesch+agent@11com7.de"
-          },
-          "type": {
-            "id": 1,
-            "name": "issue-new"
-          },
-          "message": "Neuer Eintrag"
-        },
-        {
-          "created_at": "2026-03-16T15:40:38+01:00",
-          "user": {
-            "id": 51,
-            "name": "domAgent",
-            "real_name": "Dominik Pesch (via Agent)",
-            "email": "d.pesch+agent@11com7.de"
-          },
-          "field": {
-            "name": "status",
-            "label": "Status"
-          },
-          "type": {
-            "id": 0,
-            "name": "field-updated"
-          },
-          "old_value": {
-            "id": 10,
-            "name": "new",
-            "label": "neu",
-            "color": "#eeb3aa"
-          },
-          "new_value": {
-            "id": 50,
-            "name": "assigned",
-            "label": "zugewiesen",
-            "color": "#afbed5"
-          },
-          "message": "Status",
-          "change": "neu => zugewiesen"
-        },
-        {
-          "created_at": "2026-03-16T15:40:38+01:00",
-          "user": {
-            "id": 51,
-            "name": "domAgent",
-            "real_name": "Dominik Pesch (via Agent)",
-            "email": "d.pesch+agent@11com7.de"
-          },
-          "field": {
-            "name": "handler",
-            "label": "Bearbeitung durch"
-          },
-          "type": {
-            "id": 0,
-            "name": "field-updated"
-          },
-          "old_value": {
-            "id": 0
-          },
-          "new_value": {
-            "id": 51,
-            "name": "domAgent",
-            "real_name": "Dominik Pesch (via Agent)",
-            "email": "d.pesch+agent@11com7.de"
-          },
-          "message": "Bearbeitung durch",
-          "change": " => domAgent"
-        }
-      ]
-    }
-  ]
-}