8 Commits

Include renames

Author	SHA1	Message	Date
LatteandClaude Sonnet 4.6	b8217dce8a	feat: harden OAuth state secret validation, DCR file permissions, and policy defaults ... - Enforce 32-char minimum on OAUTH_STATE_SECRET at startup (config.py) - Write DCR client registry with owner-only (0o600) permissions before atomic replace - Flip policy.yaml default write action from allow → deny - Add CLAUDE.md with architecture, commands, and AGENTS.md contract summary - Add .pre-commit-config.yaml mirroring `make lint` checks - Update .gitignore: add .venv, .claude, .mypy_cache, .ruff_cache, .coverage.* - Extend docs: audit log rotation guidance, OAUTH_STATE_SECRET and DCR_STORAGE_PATH notes - Tests: short-secret rejection, 32-char acceptance, POSIX permission check for DCR store Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-14 14:13:22 +02:00
Latte	c79cc1ab9e	Add PUBLIC_BASE_URL and refine OAuth scopes	2026-02-25 20:49:08 +01:00
Latte	59e1ea53a8	Add OAuth2/OIDC per-user Gitea authentication ... Introduce a GiteaOAuthValidator for JWT and userinfo validation and fallbacks, add /oauth/token proxy, and thread per-user tokens through the request context and automation paths. Update config and .env.example for OAuth-first mode, add OpenAPI, extensive unit/integration tests, GitHub/Gitea CI workflows, docs, and lint/test enforcement (>=80% cov).	2026-02-25 16:54:01 +01:00
Latte	ecc87cbb65	quick fix	2026-02-14 17:18:30 +01:00
Latte	8504a95a11	feat: add opt-in write access for all token-visible repos	2026-02-14 16:35:03 +01:00
Latte	5969892af3	feat: harden gateway with policy engine, secure tools, and governance docs	2026-02-14 16:06:43 +01:00
Latte	eeaad748a6	feat: add API key authentication system for ChatGPT Business ... Implements comprehensive Bearer token authentication to ensure only authorized ChatGPT workspaces can access the MCP server. Core Features: - API key validation with constant-time comparison - Multi-key support for rotation grace periods - Rate limiting (5 failures per IP per 5 min) - Comprehensive audit logging of all auth attempts - IP-based failed attempt tracking Key Management: - generate_api_key.py: Create secure 64-char keys - rotate_api_key.py: Guided key rotation with backup - check_key_age.py: Automated expiration monitoring Infrastructure: - Traefik labels for HTTPS and rate limiting - Security headers (HSTS, CSP, X-Frame-Options) - Environment-based configuration - Docker secrets support Documentation: - AUTH_SETUP.md: Complete authentication setup guide - CHATGPT_SETUP.md: ChatGPT Business integration guide - KEY_ROTATION.md: Key rotation procedures and automation Security: - Read-only operations enforced - No write access to Gitea possible - All auth attempts logged with correlation IDs - Failed attempts trigger IP rate limits - Keys never logged in full (only hints) Breaking Changes: - AUTH_ENABLED defaults to true - MCP_API_KEYS environment variable now required - Minimum key length: 32 characters (64 recommended) Migration: 1. Generate API key: make generate-key 2. Add to .env: MCP_API_KEYS=<generated-key> 3. Restart: docker-compose restart aegis-mcp 4. Configure ChatGPT with Authorization header Closes requirements for ChatGPT Business exclusive access.	2026-01-29 20:05:49 +01:00
Latte	a9708b33e2	.	2026-01-29 19:53:36 +01:00