9 Commits

Include renames

Author	SHA1	Message	Date
mathiasandClaude Opus 4.8	184d5a95dd	fix(tools,gitea): alias repo/index args and reject empty path segments ... Per-repo MCP tools 404'd while owner-level tools worked (#36). Root cause was a parameter-name contract mismatch, not a routing fault: every per-repo tool declares the repo identifier as 'name' (and issue/PR index as 'number'), but every caller — the claude.ai connector, LLMs primed on gitea's own API — sends 'repo' and 'index'. The unmatched fields zero-valued the upstream path segment, producing '/api/v1/repos/{owner}//...', which gitea answers with its generic api-404 whose body points at /api/swagger. That swagger pointer is gitea boiler- plate, not a misroute — the MCP dispatch was correct all along. Two layers of defence: - parseArgs aliases repo->name and index->number (explicit canonical wins; alias key left intact so pr_merge's real 'index' field is unaffected). Kills the recurrence by accepting the idiomatic argument names. - the gitea client rejects any path with an empty segment before the HTTP call, returning ErrValidation instead of forwarding a malformed path and surfacing gitea's opaque swagger-404. Kills the silent-misleading-error class. Closes #36 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-10 10:16:33 +02:00
mathias	91be18c100	feat(auth): JWT-or-static middleware + /.well-known/oauth-protected-resource (issue #5) ... - internal/auth/jwt.go: JWTValidator via lestrrat-go/jwx/v2, JWKS auto-refresh - internal/auth/bearer.go: replace Gitea PAT validation with JWT->static->default chain - internal/gitea/client.go: always use service PAT; remove TokenFromContext lookup - internal/config/config.go: add DexIssuerURL, MCPAudience, MCPResourceURL, StaticToken - cmd/gitea-mcp/main.go: wire validator, fix /.well-known to return real AS list - bearer_test.go: rewrite for new API	2026-05-12 11:30:52 +02:00
mathias	923689afa5	feat: replace static API token with per-request Gitea PAT pass-through ... Callers now supply their own Gitea PAT as a Bearer token; the server validates it against GET /api/v1/user and threads it through context to all downstream Gitea API calls. GITEA_API_TOKEN env var and the GiteaAPIToken config field are removed.	2026-05-07 21:04:47 +02:00
mathias	44c42fa636	feat(gitea): add DeleteJSONBody for delete-with-body requests	2026-05-06 22:36:37 +02:00
mathias	64559f0250	fix(lint): check Body.Close error return in http client	2026-05-05 08:55:31 +02:00
mathias	4274b48ea5	feat(gitea): default-branch lru cache ... Shared LRU avoids repeated Gitea calls for default-branch resolution; the simple stdlib map alternative would race on concurrent access without a mutex per entry, which is more code than the LRU.	2026-05-04 23:06:06 +02:00
mathias	fb473262ba	feat(gitea): read retry once on 5xx GET	2026-05-04 23:04:55 +02:00
mathias	ba172e3db8	feat(tools): workflow_run_trigger	2026-05-04 22:25:10 +02:00
mathias	2ecffd1b7a	feat(gitea): base http client with token auth	2026-05-04 21:26:03 +02:00