From a7c458fe1784706ad1201a30854db02d9cf5b719 Mon Sep 17 00:00:00 2001
From: Michel-Liao <michel.liao22@gmail.com>
Date: Wed, 2 Sep 2026 22:05:41 -0400
Subject: [PATCH] fix(server): authenticate Azure DevOps comment reads

---
 .../pullRequest/AzureDevOpsPullRequestCli.test.ts  | 14 +++++++++++---
 .../src/pullRequest/AzureDevOpsPullRequestCli.ts   |  3 +++
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/apps/server/src/pullRequest/AzureDevOpsPullRequestCli.test.ts b/apps/server/src/pullRequest/AzureDevOpsPullRequestCli.test.ts
index d893924b3f2a..0135afcf8f85 100644
--- a/apps/server/src/pullRequest/AzureDevOpsPullRequestCli.test.ts
+++ b/apps/server/src/pullRequest/AzureDevOpsPullRequestCli.test.ts
@@ -543,10 +543,18 @@ layer("AzureDevOpsPullRequestCli.layer", (it) => {
       });
 
       assert.strictEqual(comments.length, 1);
-      expect(argsOfCall(0)).toContain("rest");
-      expect(argsOfCall(0)).toContain(
+      expect(argsOfCall(0)).toEqual([
+        "rest",
+        "--method",
+        "get",
+        "--url",
         "https://dev.azure.com/acme/platform/_apis/git/r/web/pullRequests/42/threads?api-version=7.1",
-      );
+        "--resource",
+        "499b84ac-1321-427f-aa17-267ca6975798",
+        "--only-show-errors",
+        "--output",
+        "json",
+      ]);
     }),
   );
 
diff --git a/apps/server/src/pullRequest/AzureDevOpsPullRequestCli.ts b/apps/server/src/pullRequest/AzureDevOpsPullRequestCli.ts
index fe87692e1cc3..8ed299215641 100644
--- a/apps/server/src/pullRequest/AzureDevOpsPullRequestCli.ts
+++ b/apps/server/src/pullRequest/AzureDevOpsPullRequestCli.ts
@@ -111,6 +111,7 @@ export type AzureDevOpsPullRequestCliError =
 
 /** The version every REST call below is pinned to, so a new default cannot reshape a response. */
 const REST_API_VERSION = "7.1";
+const AZURE_DEVOPS_RESOURCE_ID = "499b84ac-1321-427f-aa17-267ca6975798";
 const PULL_REQUEST_LIST_MAX_OUTPUT_BYTES = 16 * 1024 * 1024;
 
 export class AzureDevOpsPullRequestCli extends Context.Service<
@@ -455,6 +456,8 @@ export const make = Effect.gen(function* () {
           "get",
           "--url",
           `${input.threadsUrl}?api-version=${REST_API_VERSION}`,
+          "--resource",
+          AZURE_DEVOPS_RESOURCE_ID,
         ],
       }).pipe(
         Effect.flatMap((result) => {