de0ae09fc4
fix: update structlog configuration for compatibility
...
Removed deprecated make_filtering_bound_logger() call that was
causing TypeError. Using structlog.BoundLogger directly instead.
2026-01-29 20:44:17 +01:00
a0605eaa27
fix: change mcp_api_keys to string field to avoid JSON parsing
...
Pydantic was trying to parse List[str] as JSON from env vars.
Changed to use a string field (mcp_api_keys_raw) and parse manually
in model_validator, then expose as property.
This fixes the JSONDecodeError when reading MCP_API_KEYS from .env
2026-01-29 20:30:28 +01:00
0945f560ff
fix: use model_validator for API keys validation
...
Changed from field_validator to model_validator to properly access
auth_enabled field during validation. This fixes the SettingsError
when parsing mcp_api_keys from environment variables.
Also improved handling of empty strings and None values.
2026-01-29 20:27:36 +01:00
0d986eb78b
fix: correct Python dependencies path for non-root user in Docker
...
The builder stage installed dependencies to /root/.local but the final
stage switched to the 'aegis' user who couldn't access /root/.local.
Fixed by copying dependencies to /home/aegis/.local and updating PATH
to point to the correct location.
2026-01-29 20:24:45 +01:00
9e2ff4cec8
Merge pull request 'feature/authentication-systems' ( #1 ) from feature/authentication-system into main
...
Reviewed-on: #1
2026-01-29 19:13:08 +00:00
aff91d9386
docs: add implementation summary for authentication system
2026-01-29 20:07:04 +01:00
eeaad748a6
feat: add API key authentication system for ChatGPT Business
...
Implements comprehensive Bearer token authentication to ensure only
authorized ChatGPT workspaces can access the MCP server.
Core Features:
- API key validation with constant-time comparison
- Multi-key support for rotation grace periods
- Rate limiting (5 failures per IP per 5 min)
- Comprehensive audit logging of all auth attempts
- IP-based failed attempt tracking
Key Management:
- generate_api_key.py: Create secure 64-char keys
- rotate_api_key.py: Guided key rotation with backup
- check_key_age.py: Automated expiration monitoring
Infrastructure:
- Traefik labels for HTTPS and rate limiting
- Security headers (HSTS, CSP, X-Frame-Options)
- Environment-based configuration
- Docker secrets support
Documentation:
- AUTH_SETUP.md: Complete authentication setup guide
- CHATGPT_SETUP.md: ChatGPT Business integration guide
- KEY_ROTATION.md: Key rotation procedures and automation
Security:
- Read-only operations enforced
- No write access to Gitea possible
- All auth attempts logged with correlation IDs
- Failed attempts trigger IP rate limits
- Keys never logged in full (only hints)
Breaking Changes:
- AUTH_ENABLED defaults to true
- MCP_API_KEYS environment variable now required
- Minimum key length: 32 characters (64 recommended)
Migration:
1. Generate API key: make generate-key
2. Add to .env: MCP_API_KEYS=<generated-key>
3. Restart: docker-compose restart aegis-mcp
4. Configure ChatGPT with Authorization header
Closes requirements for ChatGPT Business exclusive access.
2026-01-29 20:05:49 +01:00
a9708b33e2
.
2026-01-29 19:53:36 +01:00
1bda2013bb
Initial commit
2026-01-29 18:36:24 +00:00
