potiuk opened a new pull request, #46: URL: https://github.com/apache/comdev/pull/46
## Summary Client side of apache/ponymail-foal#340: a `token` login method for the PonyMail MCP server. **Not usable against lists.apache.org yet.** It needs a PonyMail Foal release with session tokens, and the ASF deploying it for lists.apache.org with `tokens.enabled`. Until then, the method checks `/api/token?action=info` first and fails fast with a clear message, without opening a browser. Cookie login stays the default. ## How it works With `login` `method: "token"` (or `PONYMAIL_AUTH_METHOD=token`), the MCP: 1. starts a one-shot listener on a random `127.0.0.1` port; 2. opens PonyMail's `token.html` approval page with a random `state`; 3. once the user approves, receives the token by form POST and ignores anything without the matching `state`; 4. validates the token against `preferences`, caches it in `~/.ponymail-mcp/session.json` (mode `0600`), and sends it as `Authorization: Bearer`. `logout` also revokes the token on the server, and `auth_status` shows whether a cookie or a token is in use and when the token expires. Compared with pasting the session cookie, the token is read-only, short-lived and bound to the browser session. The user approves each request explicitly, and nothing is copied out of DevTools or the browser's cookie store. ## Other changes - `PONYMAIL_TOKEN`: a manual token override that takes precedence over `PONYMAIL_SESSION_COOKIE`. - The session file is now written owner-only for cookies too. - Fixed quoting of URLs passed to `start` on Windows. URLs with `&` were broken. - README: new "Option 4 (FUTURE)" section. Version bumped to 1.2.0. ## Testing `prek run --all-files --hook-stage pre-push` passes: 79 MCP tests, the license allowlist and zizmor. New tests run the whole token flow against a fake PonyMail server with a simulated browser: approval, forged `state`, denial, a rejected token, a server without the endpoint, tokens switched off, timeout, and revocation. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
