sysadmin
3aaba73127
Let one MCP server select among named Gitea runtime profiles from a JSON file
instead of editing code or juggling many .env files:
GITEA_MCP_CONFIG=/path/to/gitea-mcp.json
GITEA_MCP_PROFILE=dev
- New gitea_config.py: load/validate the JSON, select the named profile, and
resolve its token by env-var reference. Profiles supply base_url,
profile_name, token_env, owner/repo, allowed/forbidden operations, and audit
label.
- gitea_auth.get_profile() now overlays env over the selected JSON profile:
explicit env vars win, the JSON profile fills only what env leaves unset.
- gitea_auth.get_auth_header() gains a JSON token_env fallback after explicit
env tokens (env still wins).
Security / safety:
- Tokens are referenced by env-var NAME (token_env); an inline "token" is
rejected and never echoed. The value is never stored in or returned as
profile metadata.
- Fail-safe errors: missing file / invalid JSON / unknown or unset selected
profile raise a clear ConfigError that never prints file contents or tokens
(JSONDecodeError context is suppressed so the raw file text can't surface).
- No network calls during config parsing.
- Real config files are gitignored (gitea-mcp*.json), example kept.
Backwards compatible: with GITEA_MCP_CONFIG unset, behaviour is exactly the
prior env-only behaviour (all existing get_profile/get_auth_header tests pass
unchanged).
Docs: README JSON-profiles section + env table rows, .env.example placeholders,
gitea-mcp.example.json.
Tests: tests/test_config.py (22 cases) — env-only, selection, multiple
profiles, env-override precedence, missing file, invalid JSON, missing/unset
profile, inline-token rejection + redaction, and no-network-during-parse.
Refs #10. Note: issue #19 (env-based profiles) was already implemented and
closed; this JSON-file capability is adjacent new scope tracked under the
roadmap rather than reopening #19.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
25 lines
724 B
JSON
25 lines
724 B
JSON
{
|
|
"profiles": {
|
|
"dev": {
|
|
"base_url": "https://gitea.dev.example",
|
|
"profile_name": "gitea-author",
|
|
"token_env": "GITEA_TOKEN_DEV",
|
|
"owner": "Scaled-Tech-Consulting",
|
|
"repo": "Gitea-Tools",
|
|
"allowed_operations": ["read", "pr.create"],
|
|
"forbidden_operations": ["merge"],
|
|
"audit_label": "dev-author"
|
|
},
|
|
"prod-readonly": {
|
|
"base_url": "https://gitea.prgs.cc",
|
|
"profile_name": "gitea-readonly",
|
|
"token_env": "GITEA_TOKEN_PROD",
|
|
"owner": "Scaled-Tech-Consulting",
|
|
"repo": "Gitea-Tools",
|
|
"allowed_operations": ["read"],
|
|
"forbidden_operations": ["merge", "approve", "request_changes"],
|
|
"audit_label": "prod-ro"
|
|
}
|
|
}
|
|
}
|