feat(mcp): adopt shared mcp-web crate in fj mcp serve #72

Merged

Claude-Run merged 1 commit from feat/FJ-54-adopt-mcp-web-crate into main

2026-07-18 16:09:19 +02:00

Claude-Run commented

2026-07-18 16:07:17 +02:00

Member

Make fj mcp serve over HTTP a multi-user web service built on the shared, product-agnostic mcp-web crate instead of a single-identity endpoint behind one static bearer. The crate supplies local accounts (email + password + TOTP), browser sessions, an OAuth 2.1 Authorization Server (dynamic client registration, PKCE, both .well-known discovery documents), encryption at rest, and a SQLite state store with an expiry sweep; none of that security-critical code is written in this repo.

http.rs now assembles the crate's AppState from this service's environment and mounts the rmcp Streamable HTTP /mcp service behind the crate's Resource-Server bearer middleware, so /mcp is gated by an app-issued OAuth token bound to a local account rather than a shared static secret, and an unauthenticated request gets a 401 carrying a WWW-Authenticate challenge that points at the protected-resource metadata. The account-to-client seam is stubbed (NoInstanceDirectory): every account reports no configured instance, which FJ-55 replaces with a real per-account Forgejo instance lookup. The #[tool] surface in server.rs is untouched.

The service fails closed at startup when FORGEJO_MCP_MASTER_KEY or FORGEJO_MCP_SESSION_KEY (each base64 of 32 bytes) is missing or malformed, and never generates either, so a restart cannot silently invalidate every session or orphan every encrypted credential. FORGEJO_MCP_ADMIN_EMAIL bootstraps the first admin. fj mcp stdio is unchanged: it shares init_server but takes on no database, key, or account requirement, as its existing tests show.

The crate is pulled from the Pandora's Box Forgejo Cargo registry, aliased pandoras-box-cargo in .cargo/config.toml; the three build Dockerfiles copy that config so the builder can resolve it. Docs updated: the README HTTP-mode section and env-var table, the repo CLAUDE.md shape note, and a note that fj mcp service install does not yet provision the new keys (tracked in FJ-57).

#FJ-54

Make `fj mcp serve` over HTTP a multi-user web service built on the shared, product-agnostic `mcp-web` crate instead of a single-identity endpoint behind one static bearer. The crate supplies local accounts (email + password + TOTP), browser sessions, an OAuth 2.1 Authorization Server (dynamic client registration, PKCE, both `.well-known` discovery documents), encryption at rest, and a SQLite state store with an expiry sweep; none of that security-critical code is written in this repo. `http.rs` now assembles the crate's `AppState` from this service's environment and mounts the rmcp Streamable HTTP `/mcp` service behind the crate's Resource-Server bearer middleware, so `/mcp` is gated by an app-issued OAuth token bound to a local account rather than a shared static secret, and an unauthenticated request gets a 401 carrying a `WWW-Authenticate` challenge that points at the protected-resource metadata. The account-to-client seam is stubbed (`NoInstanceDirectory`): every account reports no configured instance, which FJ-55 replaces with a real per-account Forgejo instance lookup. The `#[tool]` surface in `server.rs` is untouched. The service fails closed at startup when `FORGEJO_MCP_MASTER_KEY` or `FORGEJO_MCP_SESSION_KEY` (each base64 of 32 bytes) is missing or malformed, and never generates either, so a restart cannot silently invalidate every session or orphan every encrypted credential. `FORGEJO_MCP_ADMIN_EMAIL` bootstraps the first admin. `fj mcp stdio` is unchanged: it shares `init_server` but takes on no database, key, or account requirement, as its existing tests show. The crate is pulled from the Pandora's Box Forgejo Cargo registry, aliased `pandoras-box-cargo` in `.cargo/config.toml`; the three build Dockerfiles copy that config so the builder can resolve it. Docs updated: the README HTTP-mode section and env-var table, the repo CLAUDE.md shape note, and a note that `fj mcp service install` does not yet provision the new keys (tracked in FJ-57). #FJ-54

Claude-Run added 1 commit

2026-07-18 16:07:17 +02:00

feat(mcp): adopt shared mcp-web crate in fj mcp serve

Check / fmt + clippy + build + tests (pull_request) Successful in 1m2s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

b28e84ea5b

Make `fj mcp serve` over HTTP a multi-user web service built on the shared, product-agnostic `mcp-web` crate instead of a single-identity endpoint behind one static bearer. The crate supplies local accounts (email + password + TOTP), browser sessions, an OAuth 2.1 Authorization Server (dynamic client registration, PKCE, both `.well-known` discovery documents), encryption at rest, and a SQLite state store with an expiry sweep; none of that security-critical code is written in this repo.

`http.rs` now assembles the crate's `AppState` from this service's environment and mounts the rmcp Streamable HTTP `/mcp` service behind the crate's Resource-Server bearer middleware, so `/mcp` is gated by an app-issued OAuth token bound to a local account rather than a shared static secret, and an unauthenticated request gets a 401 carrying a `WWW-Authenticate` challenge that points at the protected-resource metadata. The account-to-client seam is stubbed (`NoInstanceDirectory`): every account reports no configured instance, which FJ-55 replaces with a real per-account Forgejo instance lookup. The `#[tool]` surface in `server.rs` is untouched.

The service fails closed at startup when `FORGEJO_MCP_MASTER_KEY` or `FORGEJO_MCP_SESSION_KEY` (each base64 of 32 bytes) is missing or malformed, and never generates either, so a restart cannot silently invalidate every session or orphan every encrypted credential. `FORGEJO_MCP_ADMIN_EMAIL` bootstraps the first admin. `fj mcp stdio` is unchanged: it shares `init_server` but takes on no database, key, or account requirement, as its existing tests show.

The crate is pulled from the Pandora's Box Forgejo Cargo registry, aliased `pandoras-box-cargo` in `.cargo/config.toml`; the three build Dockerfiles copy that config so the builder can resolve it. Docs updated: the README HTTP-mode section and env-var table, the repo CLAUDE.md shape note, and a note that `fj mcp service install` does not yet provision the new keys (tracked in FJ-57).

#FJ-54