fix(mcp-gateway): stamp the session user as grantor in the optimistic access patch

setAccessMutation's no-refetch cache patch filled granted_by from the stale
cache entry (null for a fresh grant), so the "shared by" attribution on the
server-detail access row stayed blank until an unrelated refetch. The backend
assigns granted_by to the requesting user on every enable, so mirror that by
projecting the session user (useCurrentUser) into the patched agents row,
falling back to the previous behavior only while the user is still loading.

Generated-By: PostHog Code
Task-Id: ebf7c1be-72ee-497b-8ed2-225c71d59b32

Author: cvolzer3

packages/ui/src/features/mcp-gateway/hooks/useServiceAccounts.test.tsx

@@ -12,6 +12,16 @@ const mocks = vi.hoisted(() => ({
   getAccounts: vi.fn(),
   setAccess: vi.fn(),
   infoToast: vi.fn(),
+  currentUser: {
+    id: 7,
+    uuid: "user-uuid-7",
+    distinct_id: "distinct-7",
+    first_name: "Ada",
+    last_name: "Lovelace",
+    email: "ada@posthog.com",
+    is_email_verified: true,
+    hedgehog_config: null,
+  },
 }));
 
 vi.mock("@posthog/ui/features/auth/authClient", () => ({
@@ -21,6 +31,11 @@ vi.mock("@posthog/ui/features/auth/authClient", () => ({
   }),
 }));
 
+vi.mock("@posthog/ui/features/auth/useCurrentUser", async (importOriginal) => ({
+  ...(await importOriginal<Record<string, unknown>>()),
+  useCurrentUser: () => ({ data: mocks.currentUser }),
+}));
+
 vi.mock("@posthog/ui/primitives/toast", () => ({
   toast: {
     error: vi.fn(),
@@ -104,4 +119,45 @@ describe("useServiceAccounts", () => {
       "Support agent no longer has access to Linear",
     );
   });
+
+  it("stamps the current user as grantor on a fresh grant without a refetch", async () => {
+    queryClient.setQueryData(gatewayKeys.servers, [
+      { ...server, agents: [] } as McpGatewayServer,
+    ]);
+    mocks.setAccess.mockResolvedValue({ ...account, server_ids: [server.id] });
+    const { result } = renderHook(() => useServiceAccounts(), { wrapper });
+
+    await waitFor(() => expect(result.current.accounts).toEqual([account]));
+
+    act(() => {
+      result.current.setAccess({
+        accountId: account.id,
+        serverId: server.id,
+        enabled: true,
+      });
+    });
+
+    await waitFor(() =>
+      expect(
+        queryClient.getQueryData<McpGatewayServer[]>(gatewayKeys.servers)?.[0]
+          ?.agents,
+      ).toHaveLength(1),
+    );
+
+    expect(
+      queryClient.getQueryData<McpGatewayServer[]>(gatewayKeys.servers)?.[0]
+        ?.agents[0],
+    ).toMatchObject({
+      service_account_id: account.id,
+      granted_by: {
+        id: mocks.currentUser.id,
+        uuid: mocks.currentUser.uuid,
+        first_name: "Ada",
+        last_name: "Lovelace",
+        email: "ada@posthog.com",
+        hedgehog_config: null,
+      },
+    });
+    expect(mocks.getAccounts).toHaveBeenCalledTimes(1);
+  });
 });

packages/ui/src/features/mcp-gateway/hooks/useServiceAccounts.ts

@@ -1,23 +1,53 @@
 import type {
   McpGatewayServer,
+  McpGatewayUser,
   McpServiceAccount,
   McpServiceAccountStatus,
   McpServiceAccountWithToken,
   McpToolPolicyEntry,
 } from "@posthog/api-client/posthog-client";
+import { useOptionalAuthenticatedClient } from "@posthog/ui/features/auth/authClient";
+import { useCurrentUser } from "@posthog/ui/features/auth/useCurrentUser";
 import { gatewayKeys } from "@posthog/ui/features/mcp-gateway/hooks/gatewayKeys";
 import { useAuthenticatedMutation } from "@posthog/ui/hooks/useAuthenticatedMutation";
 import { useAuthenticatedQuery } from "@posthog/ui/hooks/useAuthenticatedQuery";
 import { toast } from "@posthog/ui/primitives/toast";
 import { useQueryClient } from "@tanstack/react-query";
 import { useCallback, useState } from "react";
 
+/** Project the current-user shape onto the UserBasic fields the gateway serves. */
+function toGatewayUser(user: {
+  id: number;
+  uuid: string;
+  distinct_id: string | null;
+  first_name?: string;
+  last_name?: string;
+  email: string;
+  is_email_verified: boolean | null;
+  hedgehog_config?: McpGatewayUser["hedgehog_config"];
+  role_at_organization?: McpGatewayUser["role_at_organization"];
+}): McpGatewayUser {
+  return {
+    id: user.id,
+    uuid: user.uuid,
+    distinct_id: user.distinct_id,
+    first_name: user.first_name,
+    last_name: user.last_name,
+    email: user.email,
+    is_email_verified: user.is_email_verified,
+    hedgehog_config: user.hedgehog_config ?? null,
+    role_at_organization: user.role_at_organization,
+  };
+}
+
 /**
  * Agent service accounts and their mutations. A freshly-issued token surfaces
  * once via `newToken` on creation and is discarded on dismiss.
  */
 export function useServiceAccounts() {
   const queryClient = useQueryClient();
+  const client = useOptionalAuthenticatedClient();
+  const { data: currentUser } = useCurrentUser({ client });
   const [newToken, setNewToken] = useState<McpServiceAccountWithToken | null>(
     null,
   );
@@ -104,6 +134,8 @@ export function useServiceAccounts() {
       onSuccess: (account, vars) => {
         // The response is the updated account, so keep both access views in
         // sync without racing it against a potentially stale list refetch.
+        // The backend stamps `granted_by` with the requesting user on every
+        // enable, so mirror that with the current user here.
         queryClient.setQueryData<McpServiceAccount[]>(
           gatewayKeys.accounts,
           (current) =>
@@ -133,7 +165,9 @@ export function useServiceAccounts() {
                         handle: account.handle,
                         status: account.status,
                         last_active_at: account.last_active_at,
-                        granted_by: currentAccess?.granted_by ?? null,
+                        granted_by: currentUser
+                          ? toGatewayUser(currentUser)
+                          : (currentAccess?.granted_by ?? null),
                       },
                     ]
                   : withoutAccount,