mathias/gitea-mcp

Fork 0

Go to file

Mathias 3795800461

CD / Lint / Test / Vet (push) Successful in 7s

Details

CD / Build & Import (push) Successful in 12s

Details

CD / Deploy via GitOps (push) Successful in 4s

Details

fix(auth): require Bearer on /mcp regardless of DefaultToken

Previously BearerMiddleware allowed requests with no Authorization
header to pass through whenever GITEA_MCP_DEFAULT_TOKEN was set. The
intent was "fall back to the service PAT for upstream Gitea calls,"
but the side effect was that anyone could hit /mcp anonymously and the
server would happily proxy requests as the service account.

Drop that path. Auth on /mcp now requires either:
  - a valid Dex-issued JWT, or
  - a Bearer matching GITEA_MCP_STATIC_TOKEN.

The Gitea service PAT (GITEA_MCP_DEFAULT_TOKEN) is no longer wired
into BearerMiddleware at all — it stays an upstream-client concern,
used by gitea.NewClient for outbound API calls only. This decouples
"can this caller invoke a tool" from "what credentials does the tool
use against Gitea".

Tests updated: drop the NoAuthHeader_WithDefault permissive case, add
NoAuthHeader_RejectsEvenWhenStaticConfigured to lock in the new
behavior.

Closes part of mathias/infra#2.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-12 14:44:38 +02:00

.context

feat(auth): JWT-or-static middleware + /.well-known/oauth-protected-resource (issue #5 )

2026-05-12 11:30:52 +02:00

.gitea/workflows

ci: add environment: staging gate to deploy job

2026-05-07 21:52:40 +02:00

.skills

feat(auth): JWT-or-static middleware + /.well-known/oauth-protected-resource (issue #5 )

2026-05-12 11:30:52 +02:00

cmd/gitea-mcp

fix(auth): require Bearer on /mcp regardless of DefaultToken

2026-05-12 14:44:38 +02:00

docs/superpowers

docs: add GitOps agent tools implementation plan

2026-05-06 22:22:41 +02:00

internal

fix(auth): require Bearer on /mcp regardless of DefaultToken

2026-05-12 14:44:38 +02:00

scripts

feat(auth): JWT-or-static middleware + /.well-known/oauth-protected-resource (issue #5 )

2026-05-12 11:30:52 +02:00

.aider.conf.yml

feat(auth): JWT-or-static middleware + /.well-known/oauth-protected-resource (issue #5 )

2026-05-12 11:30:52 +02:00

.aider.conventions.md

feat(auth): JWT-or-static middleware + /.well-known/oauth-protected-resource (issue #5 )

2026-05-12 11:30:52 +02:00

.cursorrules

feat(auth): JWT-or-static middleware + /.well-known/oauth-protected-resource (issue #5 )

2026-05-12 11:30:52 +02:00

.gitignore

feat: initial scaffold with /healthz

2026-05-04 20:13:41 +02:00

AGENTS.md

feat(auth): JWT-or-static middleware + /.well-known/oauth-protected-resource (issue #5 )

2026-05-12 11:30:52 +02:00

CLAUDE.md

feat(auth): JWT-or-static middleware + /.well-known/oauth-protected-resource (issue #5 )

2026-05-12 11:30:52 +02:00

Dockerfile

feat: dockerfile

2026-05-05 07:52:29 +02:00

go.mod

feat(auth): JWT-or-static middleware + /.well-known/oauth-protected-resource (issue #5 )

2026-05-12 11:30:52 +02:00

go.sum

feat(auth): JWT-or-static middleware + /.well-known/oauth-protected-resource (issue #5 )

2026-05-12 11:30:52 +02:00

README.md

feat: initial scaffold with /healthz

2026-05-04 20:13:41 +02:00

Taskfile.yml

fix(ci): skip context sync drift check in CI environment

2026-05-12 12:09:24 +02:00

README.md

gitea-mcp

Streamable HTTP MCP service exposing Gitea repo operations to Claude apps. See ~/dev/AI/infra/docs/superpowers/specs/2026-05-04-gitea-mcp-gitops-workflow-design.md.