3 Commits

Include renames

Author	SHA1	Message	Date
mathiasandClaude Sonnet 5	5601927dc8	feat(auth): per-caller Gitea PAT pass-through (#59) ... Replaces the shared GITEA_MCP_DEFAULT_TOKEN for all callers. When a request's bearer validates directly against Gitea's own /api/v1/user, that token is used for every upstream call this request makes instead of the service PAT, and the caller identity comes from Gitea's own login rather than the proxy header. Any other bearer (static token, JWT, none) falls through unchanged to the existing chassis auth. Prep: Authentik now SSOs into Gitea (infra a32801c), so each real user can mint their own PAT from their own linked account. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-22 08:22:50 +02:00
mathiasandClaude Opus 4.8	9b7f53bdda	feat(auth): document caller header precedence + warn on conflict (#10) ... CallerMiddleware silently preferred X-Auth-Request-User over X-Forwarded-User with no explanation and no signal when both were set. Documented the precedence (X-Auth-Request-User is the verified OIDC identity oauth2-proxy sets, so it is authoritative; X-Forwarded-User is a fallback), and it now takes a *slog.Logger and warns when both headers are present and disagree, so a proxy misconfiguration is visible instead of silently resolved. Table-driven tests cover precedence (both/single/none) and the conflict-warning path. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-03 22:57:24 +02:00
mathias	0b5daca198	feat(auth): X-Auth-Request-User context middleware	2026-05-04 21:05:16 +02:00