Mathias Bergqvist 91be18c100 feat(auth): JWT-or-static middleware + /.well-known/oauth-protected-resource (issue #5) ...

- internal/auth/jwt.go: JWTValidator via lestrrat-go/jwx/v2, JWKS auto-refresh
- internal/auth/bearer.go: replace Gitea PAT validation with JWT->static->default chain
- internal/gitea/client.go: always use service PAT; remove TokenFromContext lookup
- internal/config/config.go: add DexIssuerURL, MCPAudience, MCPResourceURL, StaticToken
- cmd/gitea-mcp/main.go: wire validator, fix /.well-known to return real AS list
- bearer_test.go: rewrite for new API

2026-05-12 11:30:52 +02:00

11 KiB

Raw Blame History

View Raw