[demortes]

Problem

After the extension secret and owner id were corrected on the server, real PubSub broadcasts returned 204 and the EBS was working — but the startup check (added in #220) still logged Twitch REJECTED the EBS's PubSub credentials (403: ...Permission denied to use target), /healthz said "pubsub":"rejected", and the desktop app would show its Twitch warning. A false alarm that sent the operator chasing a problem that was already fixed.

Cause

The check sends a deliberately invalid target and I had assumed Twitch answers that with 400 when the credentials are good. Twitch actually verifies the token first and then checks what it may do, so the bogus target gets 403 Permission denied to use target for valid credentials and 403 JWT could not be verified for wrong ones. The check treated every 403 as a refusal.

Observed (live endpoint, from the server, secret never printed)

• Request missing message, wrong key → 400 (body is validated before the token).
• Complete request to a dummy whisper target, correct key → 204; raw-text key or numeric user_id → 403 JWT could not be verified.
• The check's own request: wrong secret → 403 JWT could not be verified; right secret → 403 Permission denied to use target.

Change

TwitchCredentialProbe: a 403 whose body says Permission denied to use target is accepted; every other 401/403 is still a rejection. Doc comment and README corrected to describe the real ordering.

Verified

3 new tests (permission-denied → accepted, other 403 → rejected, 401 never accepted). EBS suite 217 passing, 0 build warnings. On the affected server, a real broadcast already flipped /healthz to accepted; this stops the startup check from reporting the opposite.

🤖 Generated with Claude Code

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 938b168b-5d1f-40d3-bd6c-c4d62d752800

📥 Commits

Reviewing files that changed from the base of the PR and between b5b9967 and 5923533.

📒 Files selected for processing: 3

• src/EDNexus.Ebs/README.md
• src/EDNexus.Ebs/Services/TwitchCredentialProbe.cs
• tests/EDNexus.Ebs.Tests/TwitchCredentialCheckTests.cs

+---------------------------------+
| All your bugs are belong to us. |
+---------------------------------+
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}