mirror of
https://gitea.com/gitea/gitea-mcp.git
synced 2026-03-14 17:05:14 +00:00
c57e4c2e57
When a Gitea repo is renamed, the API returns a 301 redirect. Go's default `http.Client` follows 301/302/303 redirects by changing the HTTP method from PATCH/POST/PUT to GET and dropping the request body. This causes mutating API calls (edit PR, create issue, etc.) to silently appear to succeed while no write actually occurs — the client receives the current resource data via the redirected GET and returns it as if the edit worked. ## Fix Add a `CheckRedirect` function to both HTTP clients (SDK client in `gitea.go` and REST client in `rest.go`) that returns `http.ErrUseLastResponse` for non-GET/HEAD methods. This surfaces the redirect as an error instead of silently downgrading the request. GET/HEAD reads continue to follow redirects normally. ## Tests - `TestCheckRedirect`: table-driven unit tests for all HTTP methods + redirect limit - `TestDoJSON_RepoRenameRedirect`: regression test with `httptest` server proving PATCH to a 301 endpoint returns an error instead of silently succeeding - `TestDoJSON_GETRedirectFollowed`: verifies GET reads still follow 301 redirects *This PR was authored by Claude.* Reviewed-on: https://gitea.com/gitea/gitea-mcp/pulls/154 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
63 lines
1.6 KiB
Go
63 lines
1.6 KiB
Go
package gitea
|
|
|
|
import (
|
|
"context"
|
|
"crypto/tls"
|
|
"errors"
|
|
"fmt"
|
|
"net/http"
|
|
|
|
"code.gitea.io/sdk/gitea"
|
|
mcpContext "gitea.com/gitea/gitea-mcp/pkg/context"
|
|
"gitea.com/gitea/gitea-mcp/pkg/flag"
|
|
)
|
|
|
|
func NewClient(token string) (*gitea.Client, error) {
|
|
httpClient := &http.Client{
|
|
Transport: http.DefaultTransport,
|
|
CheckRedirect: checkRedirect,
|
|
}
|
|
|
|
opts := []gitea.ClientOption{
|
|
gitea.SetToken(token),
|
|
}
|
|
if flag.Insecure {
|
|
httpClient.Transport.(*http.Transport).TLSClientConfig = &tls.Config{
|
|
InsecureSkipVerify: true,
|
|
}
|
|
}
|
|
opts = append(opts, gitea.SetHTTPClient(httpClient))
|
|
if flag.Debug {
|
|
opts = append(opts, gitea.SetDebugMode())
|
|
}
|
|
client, err := gitea.NewClient(flag.Host, opts...)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("create gitea client err: %w", err)
|
|
}
|
|
|
|
// Set user agent for the client
|
|
client.SetUserAgent("gitea-mcp-server/" + flag.Version)
|
|
return client, nil
|
|
}
|
|
|
|
// checkRedirect prevents Go from silently changing mutating requests (POST, PATCH, etc.)
|
|
// to GET when following 301/302/303 redirects, which would drop the request body and
|
|
// make writes appear to succeed when they didn't.
|
|
func checkRedirect(_ *http.Request, via []*http.Request) error {
|
|
if len(via) >= 10 {
|
|
return errors.New("stopped after 10 redirects")
|
|
}
|
|
if via[0].Method != http.MethodGet && via[0].Method != http.MethodHead {
|
|
return http.ErrUseLastResponse
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func ClientFromContext(ctx context.Context) (*gitea.Client, error) {
|
|
token, ok := ctx.Value(mcpContext.TokenContextKey).(string)
|
|
if !ok {
|
|
token = flag.Token
|
|
}
|
|
return NewClient(token)
|
|
}
|