mathiasandClaude Opus 5
e1e9a2e30e
Closes #60. Closes #58 (fixed in mcp-chassis v0.7.0, consumed here). Three auth paths reach this server and none of them said so on success. PassthroughMiddleware logged nothing at all, success or failure. While verifying #59 end to end there was no way to confirm from the logs whether calls were using the new PAT pass-through — the caller's own Gitea PAT, the caller's own identity — or falling through to the shared JWT/static path. The only available reasoning was inference from which failures were absent. INFO mcp auth accepted auth_path=passthrough caller=alice token_fp=... INFO mcp auth accepted auth_path=jwt caller=mathiasbq token_fp=... INFO mcp auth accepted auth_path=static token_fp=... The first line matters more than the other two. Pass-through is the path where a request acts as a SPECIFIC Gitea user; an audit trail that cannot say which identity performed a write is not an audit trail. chassisauth.Fingerprint, not a local equivalent. The chassis emits token_fp on its own accepted and rejected lines, and two different fingerprints for the same token cannot be correlated — which is the only reason the field exists. Exported from the chassis in v0.7.1 for exactly this. A token that is not a valid PAT still falls through SILENTLY. The chassis owns the verdict, and logging here as well would double-count every static-token request, since all of them reach this middleware first. Asserted, because "logs nothing on the failure path" is indistinguishable from "was never called". Also lands #58 by consuming mcp-chassis v0.7.0: a JWT presented to a server with no JWT auth configured now reports jwt_auth_not_configured rather than static_token_mismatch. That log line is what sent a debugging session into re-running the OAuth flow while the credentials were valid the whole time. Verified: task check EXIT=0. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
27 lines
862 B
AMPL
27 lines
862 B
AMPL
module git.d-ma.be/mathias/gitea-mcp
|
|
|
|
go 1.26.2
|
|
|
|
require (
|
|
git.d-ma.be/mathias/mcp-chassis v0.7.1
|
|
github.com/hashicorp/golang-lru/v2 v2.0.7
|
|
github.com/stretchr/testify v1.11.1
|
|
)
|
|
|
|
require (
|
|
github.com/davecgh/go-spew v1.1.1 // indirect
|
|
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
|
|
github.com/goccy/go-json v0.10.3 // indirect
|
|
github.com/lestrrat-go/blackmagic v1.0.3 // indirect
|
|
github.com/lestrrat-go/httpcc v1.0.1 // indirect
|
|
github.com/lestrrat-go/httprc v1.0.6 // indirect
|
|
github.com/lestrrat-go/iter v1.0.2 // indirect
|
|
github.com/lestrrat-go/jwx/v2 v2.1.6 // indirect
|
|
github.com/lestrrat-go/option v1.0.1 // indirect
|
|
github.com/pmezard/go-difflib v1.0.0 // indirect
|
|
github.com/segmentio/asm v1.2.0 // indirect
|
|
golang.org/x/crypto v0.32.0 // indirect
|
|
golang.org/x/sys v0.31.0 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
)
|