potiuk opened a new pull request, #23: URL: https://github.com/apache/comdev/pull/23
## Summary Adds long-term API **token authentication** to the PonyMail MCP server — the client-side counterpart to apache/incubator-ponymail-foal#321, which adds the server-side token endpoint, bearer auth, and per-action scopes. Tokens authenticate via an `Authorization: Bearer <token>` header and, unlike the session cookie, don't expire on the ~20h schedule — ideal for automation. ### What's new - **Bearer-token auth in `apiFetch`** — prefers an API token (`PONYMAIL_API_TOKEN` env, or a token cached to `~/.ponymail-mcp/token.json`) over the session cookie; falls back to anonymous for public lists. - **Token-management tools** — `create_token` / `list_tokens` / `revoke_token` calling `/api/token.json`. Management always uses the interactive **cookie** session (the server forbids managing tokens with a token); `create_token` caches the one-time secret locally so it's used automatically afterwards. - **Scopes** (`read` / `write` / `admin`) on `create_token`, shown by `list_tokens`. Default is least-privilege `read`, which covers every request this read-only MCP makes; `write`/`admin` are offered for tokens minted here but used by other clients. - **Auth-error handling** — `describeApiError` turns 401/403 into actionable, credential-aware messages: a scope 403 names the fix; an invalid/expired/revoked token (now a **403** from the server, no longer a silent anonymous downgrade) tells the user to re-auth; a cookie rejection points back at `login`. `auth_status` distinguishes valid / scope-limited-but-valid / invalid. - `logout` clears both cached cookie and token; README documents tokens, scopes, and `PONYMAIL_API_TOKEN`. ### Testing - Unit tests extended — **65 pass** (`npm test`). - Verified **end-to-end against a live Foal server** (the #321 branch): cookie login, create/list/revoke, scoped access, the scope-403 path, and **403 on invalid/expired/revoked tokens** (no silent public read). Counterpart server PR: apache/incubator-ponymail-foal#321. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
