feat: allow gitea.issue.comment for author and reviewer profiles (#137)

- Add aliases 'issue.comment' and 'issue_comment' to GITEA_OPERATION_ALIASES so short names normalize to gitea.issue.comment
- Grant 'issue.comment' (and short) in v2 example profiles for example-author and example-reviewer
- Grant in gitea-mcp.example.json mdcps-reviewer
- Update docs example profiles
- Add test coverage for new aliases and normalization

This enables gitea_create_issue_comment and list for profiles that include it, while preserving fail-closed for others and separation of duties (issue.comment does not imply pr.review etc).

Closes #137

docs/gitea-execution-profiles.md

@@ -84,7 +84,7 @@ boundaries; they are the model, not a runtime enforcement mechanism yet.
 
 ### `gitea-reviewer`
 
-- **allowed:** `read`, `pr.comment`, `pr.review`, `pr.approve`, `pr.request_changes`
+- **allowed:** `read`, `pr.comment`, `pr.review`, `pr.approve`, `pr.request_changes`, `issue.comment`
 - **forbidden:** `pr.merge`, `branch.push`
 - `can_approve_prs`: `true`
 - `can_merge_prs`: `false`

gitea-mcp.example.json

@@ -30,7 +30,7 @@
       },
       "default_owner": "MDCPS",
       "execution_profile": "mdcps-reviewer",
-      "allowed_operations": ["read", "review", "approve", "merge"],
+      "allowed_operations": ["read", "review", "approve", "merge", "issue.comment"],
       "forbidden_operations": ["branch.push", "pr.create"]
     },
     "prgs-env": {

gitea-mcp.v2-contexts.example.json

@@ -41,7 +41,7 @@
       "execution_profile": "example-author",
       "audit_label": "example-author",
       "auth": { "type": "keychain", "id": "example-gitea-author-token" },
-      "allowed_operations": ["read", "branch", "commit", "push", "open_pr", "comment"],
+      "allowed_operations": ["read", "branch", "commit", "push", "open_pr", "comment", "issue.comment"],
       "forbidden_operations": ["approve", "request_changes", "merge"]
     },
     "example-reviewer": {
@@ -52,7 +52,7 @@
       "execution_profile": "example-reviewer",
       "audit_label": "example-reviewer",
       "auth": { "type": "keychain", "id": "example-gitea-reviewer-token" },
-      "allowed_operations": ["read", "review", "comment", "approve", "request_changes", "merge"],
+      "allowed_operations": ["read", "review", "comment", "issue.comment", "approve", "request_changes", "merge"],
       "forbidden_operations": ["branch", "commit", "push", "open_pr"]
     }
   },

gitea_config.py

@@ -80,6 +80,8 @@ GITEA_OPERATION_ALIASES = {
     "read": "gitea.read",
     "review": "gitea.pr.review",
     "comment": "gitea.pr.comment",
+    "issue.comment": "gitea.issue.comment",
+    "issue_comment": "gitea.issue.comment",
     "approve": "gitea.pr.approve",
     "request_changes": "gitea.pr.request_changes",
     "merge": "gitea.pr.merge",

tests/test_op_normalization.py

@@ -47,6 +47,8 @@ class TestNormalizeOperation(unittest.TestCase):
             "request_changes": "gitea.pr.request_changes",
             "review": "gitea.pr.review",
             "comment": "gitea.pr.comment",
+            "issue.comment": "gitea.issue.comment",
+            "issue_comment": "gitea.issue.comment",
             "read": "gitea.read",
         }
         for legacy, canonical in expected.items():
@@ -58,6 +60,10 @@ class TestNormalizeOperation(unittest.TestCase):
         self.assertEqual(normalize_operation("push"), "gitea.branch.push")
         self.assertEqual(normalize_operation("open_pr"), "gitea.pr.create")
 
+    def test_issue_comment_alias(self):
+        self.assertEqual(normalize_operation("issue.comment"), "gitea.issue.comment")
+        self.assertEqual(normalize_operation("issue_comment"), "gitea.issue.comment")
+
     def test_unknown_unqualified_op_fails_closed(self):
         with self.assertRaises(ConfigError):
             normalize_operation("frobnicate")