kodev-org
/
vikunja
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
vikunja/pkg
History
kolaente 8fbc6b62a2 feat(mcp): enforce per-tool api token scopes 
Filter MCP tool visibility and invocation by the requesting API token's
(group, permission) scopes. tools/list now returns only the tools the
token's APIPermissions authorise; tools/call additionally re-checks the
scope in the dispatcher as defence-in-depth, so a session created with
one token cannot be reused to invoke tools that token never had access to.

The per-session filter runs at session-init via the StreamableHTTPHandler
getServer factory (which the SDK calls once per session, before caching
the *mcp.Server). The dispatcher check runs on every tools/call and
returns ErrScopeDenied, which the AddTool wrapper renders as an IsError
tool result.
 		2026-05-26 23:54:02 +02:00
..
caldav fix(caldav): escape user-controlled strings per RFC 5545 in VCALENDAR output 2026-04-09 15:44:04 +00:00
caldavtests fix(caldav): skip tests for known CalDAV bugs and fix timing issues 2026-04-02 11:34:55 +00:00
cmd fix(cli): guard last admin on scheduled CLI deletion path 2026-04-20 18:55:06 +00:00
config feat: always enable bot users 2026-05-04 10:38:53 +00:00
cron fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
db feat(mcp): expose projects via mcp tools 2026-05-26 23:43:59 +02:00
doctor feat(auth): enforce OpenID Connect issuer uniqueness across providers 2026-03-30 22:41:50 +00:00
e2etests test(webhook): assert bad webhook is retried in no-duplicate test 2026-04-09 09:26:04 +00:00
events feat: add InitEventsForTesting and Unfake for real event dispatch in tests 2026-03-05 12:49:27 +01:00
files fix(files): derive file size from reader at creation boundary 2026-04-09 16:22:56 +00:00
health feat: introduce shared health check logic (#1073) 2025-07-02 21:01:41 +00:00
i18n chore(i18n): update translations via Crowdin 2026-05-19 02:26:35 +00:00
initialize feat: add license comments for agents and humans 2026-04-15 10:32:37 +00:00
license fix(license): degrade to free when servers unreachable or key rejected 2026-04-20 18:55:06 +00:00
log fix(mail): guard log calls in GetMailDomain and fix hostname-dependent tests 2026-04-03 18:30:39 +00:00
mail feat: add Atom feed for user notifications with API token auth (#2758) 2026-05-15 17:25:09 +02:00
metrics fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
migration feat(migration): add bot_owner_id column to users 2026-05-01 14:44:10 +00:00
models feat(mcp): expose projects via mcp tools 2026-05-26 23:43:59 +02:00
modules feat(mcp): enforce per-tool api token scopes 2026-05-26 23:54:02 +02:00
notifications fix(notifications): skip logo attachment for conversational mails 2026-05-18 19:06:49 +00:00
plugins test(plugins): add yaegi plugin integration tests 2026-03-30 20:44:46 +00:00
red fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
routes feat(mcp): add streamable-http endpoint skeleton 2026-05-26 23:08:45 +02:00
swagger [skip ci] Updated swagger docs 2026-05-04 11:19:21 +00:00
user feat: always enable bot users 2026-05-04 10:38:53 +00:00
utils fix: add timeouts to Gravatar, Unsplash, and SSRF-safe HTTP clients 2026-04-09 07:31:08 +00:00
version fix: correct license header references (#882) 2025-06-10 12:18:38 +02:00
web refactor(handler): return domain error for forbidden instead of echo.HTTPError 2026-04-21 09:23:13 +00:00
websocket feat(websocket): add notification event with XORM AfterInsert dispatch 2026-04-02 16:30:23 +00:00
webtests feat(mcp): enforce per-tool api token scopes 2026-05-26 23:54:02 +02:00
yaegi_symbols feat(user): extract last-admin guard and close invariant gaps 2026-04-20 18:55:06 +00:00