- internal/auth/jwt.go: JWTValidator via lestrrat-go/jwx/v2, JWKS auto-refresh - internal/auth/bearer.go: replace Gitea PAT validation with JWT->static->default chain - internal/gitea/client.go: always use service PAT; remove TokenFromContext lookup - internal/config/config.go: add DexIssuerURL, MCPAudience, MCPResourceURL, StaticToken - cmd/gitea-mcp/main.go: wire validator, fix /.well-known to return real AS list - bearer_test.go: rewrite for new API
3.3 KiB
3.3 KiB
Project context
Identity
- Name: gitea-mcp
- Owner: Mathias
- Client: personal
- Repo: https://gitea.d-ma.be/mathias/gitea-mcp
- Status: active
Stack
- Primary language: Go
- UI layer: HTMX + Templ (when applicable)
- Fallback languages: Python, TypeScript (justify in PR if used)
- Build: Task (taskfile.dev), not Make
- Containers: Docker (compose for dev, k3s for deploy)
- Target infra: koala (GPU workloads), iguana (services), flamingo (edge)
Conventions
Code style
- Go: follow
golines,gofumpt,golangci-lintwith project config - Tests: table-driven, in
_test.gonext to source,testifyfor assertions - Errors: wrap with
fmt.Errorf("operation: %w", err), no naked returns - Naming: stdlib conventions, no stuttering (
http.Clientnothttp.HTTPClient)
Architecture preferences
- Prefer standard library over frameworks (net/http over gin/echo)
- Dependency injection via constructor functions, not containers
- Configuration via environment variables, parsed at startup into a typed struct
- Structured logging via
slog
Git
- Conventional commits:
feat:,fix:,chore:,docs:,refactor: - Branch naming:
feat/short-description,fix/short-description - PRs: one concern per PR, description explains why not what
Security
- No secrets in code, ever — use env vars or SOPS-encrypted files
- Client data never leaves local network unless explicitly cleared
- Dependencies: audit with
govulncheckbefore adding
Knowledge base access
This project can query the shared knowledge base via MCP or HTTP:
- MCP endpoint:
mcp://localhost:3100/knowledge - HTTP fallback:
http://localhost:3100/api/v1/search - Scoping: queries are filtered to collection
personal+public
Behavior rules
These rules apply to every task in this project, regardless of harness.
- No assumptions. Don't hide confusion — surface it. Surface tradeoffs explicitly. Think before coding; if the problem is unclear, ask or state assumptions before acting.
- Minimum viable code. Solve with the smallest change that works. Nothing speculative, no "while we're here" cleanups, no premature abstractions. Simplicity first.
- Surgical changes. Touch only what the task requires. Leave unrelated code, files, and formatting alone. Diffs should be small and reviewable.
- Goal-driven execution. Define clear success criteria up front for every task. Loop — implement, verify, refine — until those criteria are met. Don't claim completion without evidence (tests pass, command output, observed behavior).
Agent instructions
When acting as a coding agent on this project:
- Read this file and all
SKILL.mdfiles in.skills/before starting work - Run
task checkbefore committing (lint + test + vet) - If unsure about a convention, check
DECISIONS.mdor ask - Never modify files outside the project root without explicit permission
- When adding a dependency, explain why in the commit message
- For client projects: never send code or context to cloud APIs — use local models via LiteLLM