From 8d30735cd61c7a82568aff9863a128ff752e5e5c Mon Sep 17 00:00:00 2001 From: Xuleileon Date: Fri, 10 Jul 2026 15:33:15 +0800 Subject: [PATCH 1/3] fix(gateway): restore disabled auth on auto-start Signed-off-by: Xuleileon --- .../desktop/src-tauri/src/commands/gateway.rs | 64 +++++++++++++++---- apps/desktop/src-tauri/src/lib.rs | 7 ++ 2 files changed, 59 insertions(+), 12 deletions(-) diff --git a/apps/desktop/src-tauri/src/commands/gateway.rs b/apps/desktop/src-tauri/src/commands/gateway.rs index 0f66f09b..d42e0c66 100644 --- a/apps/desktop/src-tauri/src/commands/gateway.rs +++ b/apps/desktop/src-tauri/src/commands/gateway.rs @@ -217,6 +217,22 @@ pub(crate) async fn load_network_access(app_state: &AppState) -> bool { load_network_access_from_repo(&app_state.settings_repository).await } +pub(crate) async fn load_gateway_auth_disabled_from_repo( + settings_repository: &Arc, +) -> bool { + settings_repository + .get(GATEWAY_AUTH_DISABLED_KEY) + .await + .ok() + .flatten() + .map(|value| value == "true") + .unwrap_or(false) +} + +pub(crate) async fn load_gateway_auth_disabled(app_state: &AppState) -> bool { + load_gateway_auth_disabled_from_repo(&app_state.settings_repository).await +} + pub(crate) fn advertised_base_url(public_base_url: Option<&str>, port: u16) -> String { public_base_url .map(str::trim) @@ -1037,18 +1053,8 @@ pub async fn start_gateway( // Seed the system-wide inbound-auth toggle into the running gateway from // persisted settings (default: auth required). Live changes go through // `set_gateway_auth_disabled`. - { - let disabled = app_state - .settings_repository - .get(GATEWAY_AUTH_DISABLED_KEY) - .await - .ok() - .flatten() - .map(|v| v == "true") - .unwrap_or(false); - if disabled { - gw_state.write().await.set_auth_disabled(true); - } + if load_gateway_auth_disabled(&app_state).await { + gw_state.write().await.set_auth_disabled(true); } // Subscribe to OAuth completions BEFORE spawn so we don't miss early @@ -2041,3 +2047,37 @@ mod public_base_url_tests { assert_eq!(super::bind_host_for(true), "0.0.0.0"); } } + +#[cfg(test)] +mod gateway_auth_settings_tests { + use super::{load_gateway_auth_disabled_from_repo, GATEWAY_AUTH_DISABLED_KEY}; + use mcpmux_core::AppSettingsRepository; + use mcpmux_storage::{Database, SqliteAppSettingsRepository}; + use std::sync::Arc; + use tokio::sync::Mutex; + + fn settings_repo() -> Arc { + let database = Database::open_in_memory().expect("create in-memory database"); + Arc::new(SqliteAppSettingsRepository::new(Arc::new(Mutex::new( + database, + )))) + } + + #[tokio::test] + async fn auth_remains_required_when_disable_setting_is_missing() { + let repository = settings_repo(); + + assert!(!load_gateway_auth_disabled_from_repo(&repository).await); + } + + #[tokio::test] + async fn persisted_disable_setting_is_restored_on_gateway_start() { + let repository = settings_repo(); + repository + .set(GATEWAY_AUTH_DISABLED_KEY, "true") + .await + .unwrap(); + + assert!(load_gateway_auth_disabled_from_repo(&repository).await); + } +} diff --git a/apps/desktop/src-tauri/src/lib.rs b/apps/desktop/src-tauri/src/lib.rs index 5cde1a72..ec6eee11 100644 --- a/apps/desktop/src-tauri/src/lib.rs +++ b/apps/desktop/src-tauri/src/lib.rs @@ -425,6 +425,9 @@ pub fn run() { // devices on the LAN can reach the gateway; loopback-only otherwise. let network_access = crate::commands::gateway::load_network_access_from_repo(&settings_repo).await; + let auth_disabled = + crate::commands::gateway::load_gateway_auth_disabled_from_repo(&settings_repo) + .await; let local_url = format!("http://localhost:{}", final_port); info!("Auto-starting gateway on {} (advertising {})", local_url, url); @@ -484,6 +487,10 @@ pub fn run() { let server = mcpmux_gateway::GatewayServer::new(config, dependencies); let gw_inner_state = server.state(); + if auth_disabled { + gw_inner_state.write().await.set_auth_disabled(true); + } + // Get services from gateway let pool_service = server.pool_service(); let feature_service = server.feature_service(); From a5bf1e86304a3fa139e7bff4bc0cd9e9bc18f57a Mon Sep 17 00:00:00 2001 From: its-mash Date: Wed, 15 Jul 2026 03:06:28 +0200 Subject: [PATCH 2/3] Add claude GitHub actions 1784077520436 (#207) --- .github/workflows/claude-code-review.yml | 44 +++++++++++++++++++++ .github/workflows/claude.yml | 50 ++++++++++++++++++++++++ 2 files changed, 94 insertions(+) create mode 100644 .github/workflows/claude-code-review.yml create mode 100644 .github/workflows/claude.yml diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml new file mode 100644 index 00000000..b5e8cfd4 --- /dev/null +++ b/.github/workflows/claude-code-review.yml @@ -0,0 +1,44 @@ +name: Claude Code Review + +on: + pull_request: + types: [opened, synchronize, ready_for_review, reopened] + # Optional: Only run on specific file changes + # paths: + # - "src/**/*.ts" + # - "src/**/*.tsx" + # - "src/**/*.js" + # - "src/**/*.jsx" + +jobs: + claude-review: + # Optional: Filter by PR author + # if: | + # github.event.pull_request.user.login == 'external-contributor' || + # github.event.pull_request.user.login == 'new-developer' || + # github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR' + + runs-on: ubuntu-latest + permissions: + contents: read + pull-requests: read + issues: read + id-token: write + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + fetch-depth: 1 + + - name: Run Claude Code Review + id: claude-review + uses: anthropics/claude-code-action@v1 + with: + claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} + plugin_marketplaces: 'https://github.com/anthropics/claude-code.git' + plugins: 'code-review@claude-code-plugins' + prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}' + # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md + # or https://code.claude.com/docs/en/cli-reference for available options + diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml new file mode 100644 index 00000000..6b15fac7 --- /dev/null +++ b/.github/workflows/claude.yml @@ -0,0 +1,50 @@ +name: Claude Code + +on: + issue_comment: + types: [created] + pull_request_review_comment: + types: [created] + issues: + types: [opened, assigned] + pull_request_review: + types: [submitted] + +jobs: + claude: + if: | + (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || + (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || + (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || + (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) + runs-on: ubuntu-latest + permissions: + contents: read + pull-requests: read + issues: read + id-token: write + actions: read # Required for Claude to read CI results on PRs + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + fetch-depth: 1 + + - name: Run Claude Code + id: claude + uses: anthropics/claude-code-action@v1 + with: + claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} + + # This is an optional setting that allows Claude to read CI results on PRs + additional_permissions: | + actions: read + + # Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it. + # prompt: 'Update the pull request description to include a summary of changes.' + + # Optional: Add claude_args to customize behavior and configuration + # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md + # or https://code.claude.com/docs/en/cli-reference for available options + # claude_args: '--allowed-tools Bash(gh pr *)' + From 04e4d513053c713176d186014b213a89e424139b Mon Sep 17 00:00:00 2001 From: Mohammod Al Amin Ashik Date: Wed, 15 Jul 2026 09:10:46 +0800 Subject: [PATCH 3/3] chore: add id-token write permission for codecov OIDC authentication --- .github/workflows/ci.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d0473a1b..6a4506ae 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,6 +17,7 @@ permissions: actions: read checks: write pull-requests: write + id-token: write env: CARGO_TERM_COLOR: always