mathiasandClaude Sonnet 5
43714047be
Allowlist.Check now takes ctx: when the caller authenticated with their own Gitea PAT (pass-through, v0.12.0), it skips the static GITEA_MCP_ALLOWED_OWNERS check entirely — Gitea's own permission model already gates that caller's access more precisely than a coarse owner-name list can. The static list still applies unchanged for the shared static-token/JWT path, where it's the only defense against the service token's blast radius. Mechanical: every tool call site already had ctx in scope, so this is a signature-only change at 41 call sites, no other tool behavior changes. Closes the "Deferred" item from #59. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
75 lines
2.1 KiB
Go
75 lines
2.1 KiB
Go
package tools
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
|
|
"git.d-ma.be/mathias/gitea-mcp/internal/allowlist"
|
|
"git.d-ma.be/mathias/gitea-mcp/internal/gitea"
|
|
"git.d-ma.be/mathias/gitea-mcp/internal/registry"
|
|
)
|
|
|
|
type RepoCreate struct {
|
|
c *gitea.Client
|
|
a *allowlist.Allowlist
|
|
}
|
|
|
|
func NewRepoCreate(c *gitea.Client, a *allowlist.Allowlist) *RepoCreate {
|
|
return &RepoCreate{c: c, a: a}
|
|
}
|
|
|
|
func (t *RepoCreate) Descriptor() registry.ToolDescriptor {
|
|
return registry.ToolDescriptor{
|
|
Name: "repo_create",
|
|
Description: "Create a repository for the authenticated user or an organisation.",
|
|
InputSchema: json.RawMessage(`{
|
|
"type":"object",
|
|
"properties":{
|
|
"owner":{"type":"string","description":"Username or org name (used for allowlist check)."},
|
|
"name":{"type":"string","description":"Repository name."},
|
|
"description":{"type":"string"},
|
|
"private":{"type":"boolean","description":"Create as private. Default false."},
|
|
"auto_init":{"type":"boolean","description":"Initialise with README."},
|
|
"default_branch":{"type":"string","description":"Default branch name. Default 'main'."},
|
|
"is_org":{"type":"boolean","description":"When true, create under the organisation named in 'owner'."}
|
|
},
|
|
"required":["owner","name"]
|
|
}`),
|
|
}
|
|
}
|
|
|
|
type repoCreateArgs struct {
|
|
Owner string `json:"owner"`
|
|
Name string `json:"name"`
|
|
Description string `json:"description"`
|
|
Private bool `json:"private"`
|
|
AutoInit bool `json:"auto_init"`
|
|
DefaultBranch string `json:"default_branch"`
|
|
IsOrg bool `json:"is_org"`
|
|
}
|
|
|
|
func (t *RepoCreate) Call(ctx context.Context, raw json.RawMessage) (json.RawMessage, error) {
|
|
var args repoCreateArgs
|
|
if err := parseArgs(raw, &args); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := t.a.Check(ctx, args.Owner); err != nil {
|
|
return nil, err
|
|
}
|
|
createArgs := gitea.CreateRepoArgs{
|
|
Name: args.Name,
|
|
Description: args.Description,
|
|
Private: args.Private,
|
|
AutoInit: args.AutoInit,
|
|
DefaultBranch: args.DefaultBranch,
|
|
}
|
|
if args.IsOrg {
|
|
createArgs.Org = args.Owner
|
|
}
|
|
r, err := t.c.CreateRepo(ctx, createArgs)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return textOK(r)
|
|
}
|