4 Commits

Include renames

Author	SHA1	Message	Date
mathiasandClaude Sonnet 5	43714047be	fix(auth): owner allowlist trusts pass-through-authenticated callers (#59) ... Allowlist.Check now takes ctx: when the caller authenticated with their own Gitea PAT (pass-through, v0.12.0), it skips the static GITEA_MCP_ALLOWED_OWNERS check entirely — Gitea's own permission model already gates that caller's access more precisely than a coarse owner-name list can. The static list still applies unchanged for the shared static-token/JWT path, where it's the only defense against the service token's blast radius. Mechanical: every tool call site already had ctx in scope, so this is a signature-only change at 41 call sites, no other tool behavior changes. Closes the "Deferred" item from #59. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-22 08:31:43 +02:00
mathiasandClaude Opus 4.8	4c1f36f9eb	chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39) ... Gitea host renamed (infra ADR-0004); the mcp-chassis dep already migrated (3329ff3), so the sequencing gate is clear. `go mod edit -module` + bulk import rewrite across all .go files. gitea-mcp is a server binary (not an imported library), so no downstream consumers break. build + task check green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-03 22:48:26 +02:00
mathiasandClaude Opus 4.8	93c32edbb5	feat(tools): make repo the canonical repo-identifier arg; name now an alias (#38) ... Every caller (claude.ai connector, LLMs primed on gitea/GitHub) sends the repo identifier as `repo`, but the 33 per-repo identifier tools advertised `name`. The v0.2.8 shim aliased repo->name so it worked, yet the advertised inputSchema still said `name` — a misleading contract, with the shim load-bearing. - Flip all 33 identifier tools: schema property + required + struct field/tag from `name` to `repo`. A compliant `repo` caller now matches the struct directly; the shim is pure back-compat. - normalizeAliases is now bidirectional (name<->repo), so legacy `name` callers still resolve, and repo_create / create_project_from_template — whose `name` means "name of the NEW repo", not an existing-repo id — keep `name` and still accept `repo`. - `number`/`index` left as-is (out of scope; separate pre-existing quirk where pr_merge advertises `index` rather than `number`). - Tests: schema-canonical assertion + flipped alias round-trip (explicit `repo` wins over `name`). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-03 21:42:18 +02:00
mathias	dc907fb7e0	feat: issue_close + issue_reopen tools (#30) ... Adds two MCP tools that PATCH /api/v1/repos/{owner}/{name}/issues/{number} with {"state":"closed"} or {"state":"open"}. Both use a shared SetIssueState helper on the gitea client. - internal/gitea/issues.go: SetIssueState method using the existing PatchJSON + MapStatus + json.Unmarshal pattern from GetIssue. - internal/tools/issue_close.go: IssueClose tool. owner+name+number args. Owner allowlist enforced. Returns the updated issue. Reversible via issue_reopen, classified LOW risk. - internal/tools/issue_reopen.go: mirror of IssueClose with state="open". Same risk profile. - Registered both tools in cmd/gitea-mcp/main.go. - Tests for both: success (asserts PATCH method, path, body), 404, and allowlist rejection — same shape as issue_get_test.go. Closes #30	2026-05-18 07:51:17 +02:00