5 Commits

Include renames

Author	SHA1	Message	Date
mathiasandClaude Opus 4.8	3329ff3088	fix(deps): migrate mcp-chassis to git.d-ma.be path — unblock CD build (#74) ... The image build's `go mod download` failed on the stale gitea.d-ma.be/mathias/mcp-chassis import (the gitea→git rename; the server no longer serves a matching go-import meta tag). This is the latent #74 breakage flagged for gitea-mcp, triggered by the first clean rebuild since the rename (the #42 push). Point at git.d-ma.be/mathias/mcp-chassis v0.2.0 + go mod tidy. Unblocks deploying the #42 create_project_from_template fix. gitea-mcp's own module path stays gitea.d-ma.be (main module, not fetched — separate cleanup). Refs #74, #42. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-01 23:06:35 +02:00
mathiasandClaude Opus 4.7	658f4ba84f	feat(auth): migrate to gitea.d-ma.be/mathias/mcp-chassis v0.1.0 ... First real port of the MCP chassis library — abort-criterion check for spike S3 of the 2026-05 homelab architecture review. Changes: - Drop internal/auth/jwt.go (~79 LOC) — chassis provides JWTValidator with identical signature. - Drop internal/auth/bearer.go (~42 LOC) — chassis BearerMiddleware has the same static-or-JWT semantics plus an optional WWW-Authenticate resource_metadata challenge (consumed via new resourceMetadataURL arg). - Drop internal/auth/bearer_test.go — same scenarios are covered in the chassis bearer_test.go now. - main.go: import chassis as `chassisauth`, build resourceMetadataURL only when both DexIssuerURL + MCPResourceURL are set, replace the inline /.well-known/oauth-protected-resource handler with the chassis ProtectedResourceHandler. internal/auth/caller.go (oauth2-proxy header → context) stays — chassis out-of-scope. Net LOC change: -~150 LOC duplicated infra + a 5-LOC import. go.mod gains gitea.d-ma.be/mathias/mcp-chassis v0.1.0 (jwx/v2 + testify already transitive, no new top-level deps). Verifies abort criterion: one PR, one binary's worth of port, task check green (lint + test + vet + govulncheck clean). Per the S3 spike spec, this clears the chassis to continue. Next port: hyperguild/ingestion (brain-mcp), filed as a follow-up. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-22 09:25:23 +02:00
mathias	91be18c100	feat(auth): JWT-or-static middleware + /.well-known/oauth-protected-resource (issue #5) ... - internal/auth/jwt.go: JWTValidator via lestrrat-go/jwx/v2, JWKS auto-refresh - internal/auth/bearer.go: replace Gitea PAT validation with JWT->static->default chain - internal/gitea/client.go: always use service PAT; remove TokenFromContext lookup - internal/config/config.go: add DexIssuerURL, MCPAudience, MCPResourceURL, StaticToken - cmd/gitea-mcp/main.go: wire validator, fix /.well-known to return real AS list - bearer_test.go: rewrite for new API	2026-05-12 11:30:52 +02:00
mathias	4274b48ea5	feat(gitea): default-branch lru cache ... Shared LRU avoids repeated Gitea calls for default-branch resolution; the simple stdlib map alternative would race on concurrent access without a mutex per entry, which is more code than the LRU.	2026-05-04 23:06:06 +02:00
mathiasandClaude Sonnet 4.6	d399a216c1	feat(config): env-var loading ... Add internal/config package with Config struct and Load() function. Reads GITEA_BASE_URL, GITEA_API_TOKEN, GITEA_MCP_ALLOWED_OWNERS, GITEA_MCP_ORIGIN_ALLOWLIST, GITEA_MCP_PORT with sensible defaults. Wire cfg.Port into main.go. TDD: tests written first, then impl. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-04 20:19:31 +02:00