feat(auth): adopt chassis v0.3.0 — auth audit logs + 503 on Dex outage (#6, #9)

Bumps mcp-chassis to v0.3.0, which adds structured audit logging on every auth rejection and returns 503 temporarily_unavailable (not a silent 401) when Dex is unreachable at validation time. Wires slog.SetDefault so those audit lines flow through gitea-mcp's JSON handler. Together with the earlier /healthz jwt-status reporting and startup degradation warning, this closes #6 (Dex-down is now observable and distinct from a bad token) and #9 (auth failures are audit-logged: reason, IP, token type, hashed fingerprint — never the raw token). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-03 23:17:39 +02:00
parent 9b7f53bdda
commit 72ba89be63
3 changed files with 6 additions and 3 deletions
@@ -3,7 +3,7 @@ module git.d-ma.be/mathias/gitea-mcp
 go 1.26.2

 require (
-	git.d-ma.be/mathias/mcp-chassis v0.2.0
+	git.d-ma.be/mathias/mcp-chassis v0.3.0
 	github.com/hashicorp/golang-lru/v2 v2.0.7
 	github.com/stretchr/testify v1.11.1
 )