mathias
4d6597639e
dispatch#67 fix #2 needed a read-only CI credential and hit a hard wall: Gitea's own token-creation and admin-user endpoints reject token auth outright -- POST /users/{u}/tokens returns 'auth required', POST /admin/users returns 'token does not have at least one of required scope(s), required=[write:admin]' -- for ANY existing token, by design. An existing token cannot mint another token or create an account; the only way through either endpoint is real basic auth as an actual site admin. That is exactly what a sandboxed agent session cannot safely hold. internal/adminbootstrap: the core bootstrap, HTTP-only, fully testable against a fake transport (5 tests, no network). Given real admin username/password, it creates the target account (or resets its password if it already exists -- deliberately unconditional, gated behind a required ConfirmServiceAccount flag since that reset is only safe for a dedicated bot account), mints it a scoped token by authenticating AS that account (Gitea requires this specifically -- an admin cannot mint on another account's behalf), grants it read-only collaborator access on named repos, and stores the result via a SecretStore -- never returning the token or either password to the caller. internal/localtools: the MCP tool wrapper (mint_service_account_token) and the real op-CLI-backed SecretStore (token passed via stdin, never argv, per the estate's own secret-handling rule). Deliberately its OWN package, not internal/tools -- this capability is far too dangerous to risk it ever being wired into RegisterAll and reachable from the shared HTTP gitea-mcp server, even behind OIDC. internal/mcp/stdio.go: a stdio JSON-RPC transport (one message per line, standard MCP stdio framing) for the existing registry.Tool interface -- the only transport gitea-mcp had before this was HTTP (server.go), which a sandboxed session can reach but a real admin password never should be piped through. cmd/gitea-admin-mcp: the binary. Meant to be spawned by a LOCAL Claude Code session (.mcp.json stdio server) or run by hand, via 'op run --env-file ~/.op-env' so admin credentials arrive just-in-time and never touch a sandboxed session. 11 new tests total, all passing under -race. Nothing in cmd/gitea-mcp (the shared HTTP server) changed.
53 lines
1.5 KiB
Go
53 lines
1.5 KiB
Go
package localtools_test
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"git.d-ma.be/mathias/gitea-mcp/internal/localtools"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// The estate's own secret-handling rule: never place a literal secret in a
|
|
// command's argv — it lands in process listings and any transcript of the
|
|
// command. OpSecretStore feeds the token to `op` via stdin instead.
|
|
|
|
func TestOpSecretStore_PassesValueViaStdinNeverArgv(t *testing.T) {
|
|
var gotStdin string
|
|
var gotArgs []string
|
|
s := localtools.OpSecretStore{
|
|
Vault: "AgentSecrets",
|
|
Run: func(_ context.Context, stdin string, args ...string) error {
|
|
gotStdin = stdin
|
|
gotArgs = args
|
|
return nil
|
|
},
|
|
}
|
|
|
|
ref, err := s.Store(context.Background(), "gitea-dispatch-bot-ci-readonly", "tok_the_actual_secret_value")
|
|
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "op://AgentSecrets/gitea-dispatch-bot-ci-readonly/credential", ref)
|
|
assert.Equal(t, "tok_the_actual_secret_value", gotStdin)
|
|
for _, a := range gotArgs {
|
|
assert.NotContains(t, a, "tok_the_actual_secret_value",
|
|
"the secret value must never appear as a literal argv element")
|
|
}
|
|
assert.Contains(t, gotArgs, "--vault=AgentSecrets")
|
|
assert.Contains(t, gotArgs, "--title=gitea-dispatch-bot-ci-readonly")
|
|
}
|
|
|
|
func TestOpSecretStore_PropagatesRunError(t *testing.T) {
|
|
s := localtools.OpSecretStore{
|
|
Vault: "AgentSecrets",
|
|
Run: func(_ context.Context, _ string, _ ...string) error {
|
|
return assert.AnError
|
|
},
|
|
}
|
|
|
|
_, err := s.Store(context.Background(), "x", "y")
|
|
|
|
require.Error(t, err)
|
|
}
|