mathiasandClaude Sonnet 5
43714047be
Allowlist.Check now takes ctx: when the caller authenticated with their own Gitea PAT (pass-through, v0.12.0), it skips the static GITEA_MCP_ALLOWED_OWNERS check entirely — Gitea's own permission model already gates that caller's access more precisely than a coarse owner-name list can. The static list still applies unchanged for the shared static-token/JWT path, where it's the only defense against the service token's blast radius. Mechanical: every tool call site already had ctx in scope, so this is a signature-only change at 41 call sites, no other tool behavior changes. Closes the "Deferred" item from #59. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
105 lines
2.5 KiB
Go
105 lines
2.5 KiB
Go
package tools
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
|
|
"git.d-ma.be/mathias/gitea-mcp/internal/allowlist"
|
|
"git.d-ma.be/mathias/gitea-mcp/internal/gitea"
|
|
"git.d-ma.be/mathias/gitea-mcp/internal/registry"
|
|
)
|
|
|
|
type RepoStatus struct {
|
|
c *gitea.Client
|
|
a *allowlist.Allowlist
|
|
}
|
|
|
|
func NewRepoStatus(c *gitea.Client, a *allowlist.Allowlist) *RepoStatus {
|
|
return &RepoStatus{c: c, a: a}
|
|
}
|
|
|
|
func (t *RepoStatus) Descriptor() registry.ToolDescriptor {
|
|
return registry.ToolDescriptor{
|
|
Name: "repo_status",
|
|
Description: "Get repo state in one call: all branches, open PRs, and protection rules for a target branch. Use this first to decide whether to use feature-branch or trunk-based development.",
|
|
InputSchema: json.RawMessage(`{
|
|
"type":"object",
|
|
"properties":{
|
|
"owner":{"type":"string"},
|
|
"repo":{"type":"string"},
|
|
"branch":{"type":"string"}
|
|
},
|
|
"required":["owner","repo"]
|
|
}`),
|
|
}
|
|
}
|
|
|
|
type repoStatusArgs struct {
|
|
Owner string `json:"owner"`
|
|
Repo string `json:"repo"`
|
|
Branch string `json:"branch"`
|
|
}
|
|
|
|
func (t *RepoStatus) Call(ctx context.Context, raw json.RawMessage) (json.RawMessage, error) {
|
|
var args repoStatusArgs
|
|
if err := parseArgs(raw, &args); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := t.a.Check(ctx, args.Owner); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
branch := args.Branch
|
|
if branch == "" {
|
|
var err error
|
|
branch, err = t.c.DefaultBranch(ctx, args.Owner, args.Repo)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
}
|
|
|
|
branches, err := t.c.ListBranches(ctx, args.Owner, args.Repo, 1, 50)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
prs, err := t.c.ListPullRequests(ctx, args.Owner, args.Repo, "open", "", 1, 50)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
bp, err := t.c.GetBranchProtection(ctx, args.Owner, args.Repo, branch)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
branchList := make([]map[string]any, len(branches))
|
|
for i, b := range branches {
|
|
branchList[i] = map[string]any{"name": b.Name, "sha": b.Commit.ID}
|
|
}
|
|
|
|
prList := make([]map[string]any, len(prs))
|
|
for i, pr := range prs {
|
|
prList[i] = map[string]any{
|
|
"number": pr.Number,
|
|
"title": pr.Title,
|
|
"state": pr.State,
|
|
"head_branch": pr.Head.Ref,
|
|
"base_branch": pr.Base.Ref,
|
|
"draft": pr.Draft,
|
|
"html_url": pr.HTMLURL,
|
|
}
|
|
}
|
|
|
|
return textOK(map[string]any{
|
|
"branches": branchList,
|
|
"open_prs": prList,
|
|
"protection": map[string]any{
|
|
"protected": bp.Protected,
|
|
"required_approvals": bp.RequiredApprovals,
|
|
"push_whitelist": bp.PushWhitelist,
|
|
"merge_whitelist": bp.MergeWhitelist,
|
|
},
|
|
})
|
|
}
|