You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@community.apache.org by "potiuk (via GitHub)" <gi...@apache.org> on 2026/07/05 16:54:13 UTC
[PR] ponymail-mcp: add API token authentication with scopes [comdev]
potiuk opened a new pull request, #23:
URL: https://github.com/apache/comdev/pull/23
## Summary
Adds long-term API **token authentication** to the PonyMail MCP server — the client-side counterpart to apache/incubator-ponymail-foal#321, which adds the server-side token endpoint, bearer auth, and per-action scopes.
Tokens authenticate via an `Authorization: Bearer <token>` header and, unlike the session cookie, don't expire on the ~20h schedule — ideal for automation.
### What's new
- **Bearer-token auth in `apiFetch`** — prefers an API token (`PONYMAIL_API_TOKEN` env, or a token cached to `~/.ponymail-mcp/token.json`) over the session cookie; falls back to anonymous for public lists.
- **Token-management tools** — `create_token` / `list_tokens` / `revoke_token` calling `/api/token.json`. Management always uses the interactive **cookie** session (the server forbids managing tokens with a token); `create_token` caches the one-time secret locally so it's used automatically afterwards.
- **Scopes** (`read` / `write` / `admin`) on `create_token`, shown by `list_tokens`. Default is least-privilege `read`, which covers every request this read-only MCP makes; `write`/`admin` are offered for tokens minted here but used by other clients.
- **Auth-error handling** — `describeApiError` turns 401/403 into actionable, credential-aware messages: a scope 403 names the fix; an invalid/expired/revoked token (now a **403** from the server, no longer a silent anonymous downgrade) tells the user to re-auth; a cookie rejection points back at `login`. `auth_status` distinguishes valid / scope-limited-but-valid / invalid.
- `logout` clears both cached cookie and token; README documents tokens, scopes, and `PONYMAIL_API_TOKEN`.
### Testing
- Unit tests extended — **65 pass** (`npm test`).
- Verified **end-to-end against a live Foal server** (the #321 branch): cookie login, create/list/revoke, scoped access, the scope-403 path, and **403 on invalid/expired/revoked tokens** (no silent public read).
Counterpart server PR: apache/incubator-ponymail-foal#321.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For additional commands, e-mail: dev-help@community.apache.org
Re: [PR] ponymail-mcp: add API token authentication with scopes [comdev]
Posted by "sebbASF (via GitHub)" <gi...@apache.org>.
sebbASF commented on PR #23:
URL: https://github.com/apache/comdev/pull/23#issuecomment-4895033171
> Actually, there is no need - this is already implemented automatically (I think also well explained in the documentation) - the actual permissions that the token allows to have is a subseet of the token scope and actual **current** permissions of the user. So basically what the "scope" of the token is is a "wish" - but the wish is only granted if the user already has those permissions.
Are you saying that the user permissions are rechecked each time the token is used?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For additional commands, e-mail: dev-help@community.apache.org
Re: [PR] ponymail-mcp: add API token authentication with scopes [comdev]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #23:
URL: https://github.com/apache/comdev/pull/23#issuecomment-4896001668
> Are you saying that the user permissions are rechecked each time the token is used?
Technically speaking - it's checked every time in ES. I did not touch Oauth Provider - and Oauth Provider stores the sessions in ES. This is the authoritative source of "user access" in PonyMail. And unlike the sssion id from PonyMail - ES is read with every request (enabling cache might limit that at the expense of caching the session) locally. It uses basicaly the same mechanism that "cookie" login uses for ES.
Hower - that triggered me to go deeper and I see the issue now. I see when the user auth in ES is stored - and I see now the limitation of ES not being able to refresh this data without the login - I see that ES does not store long term refresh tokens and does not refresh the authorization in the backround - I was quite sure it does. This makes it clear why we have 20 hour per-session timeout in ASF - instead of 7 days, because it also means that if user's permissions are changed, they are also not reflected in Pony Mail unil the session expires. I guess 20 hours is a reasonable trade-off made by Infra
So .. Yeah.. Unfortunately the approach would ilnot work to refresh changes without user interaction.
Thanks for making me dig deeper - that helped me to see a flaw in the "refresh" mechanism. And yeah, I think it makes sense for PonyMail to implement the ASFQuart interface - I see that ASF Quart uses directly LDAP access to refresh that data.
Good discussion thanks. Then yeah I think I will just close it - the permission refresh is a feature that indeed is quite an important feature and it would require always to communicate to PonyMail to invalidate token to remove it - which I guess is too brittle and it makes no sense to do it.
Fair. Thanks for the questions - it was a good discussion and alowed me to understand better internal PonyMail architecture :).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For additional commands, e-mail: dev-help@community.apache.org
Re: [PR] ponymail-mcp: add API token authentication with scopes [comdev]
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on PR #23:
URL: https://github.com/apache/comdev/pull/23#issuecomment-4887057874
> Of course it should not be merged before [apache/incubator-ponymail-foal#321](https://github.com/apache/incubator-ponymail-foal/pull/321) is released in PonyMail
Actually it is before that PR is accepted and the feature implemented by the vendor for lists.apache.org there are no guarantees on this and it might require a request from VP, Infra or the InfraAdmin.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For additional commands, e-mail: dev-help@community.apache.org
Re: [PR] ponymail-mcp: add API token authentication with scopes [comdev]
Posted by "sebbASF (via GitHub)" <gi...@apache.org>.
sebbASF commented on PR #23:
URL: https://github.com/apache/comdev/pull/23#issuecomment-4890441747
The tokens can be regarded as a cache of the permissions that were active when the user logged in originally. There needs to be a way to evict tokes when these permissions change. I think this approach needs to be discussed with Infra.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For additional commands, e-mail: dev-help@community.apache.org
Re: [PR] ponymail-mcp: add API token authentication with scopes [comdev]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk closed pull request #23: ponymail-mcp: add API token authentication with scopes
URL: https://github.com/apache/comdev/pull/23
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For additional commands, e-mail: dev-help@community.apache.org
Re: [PR] ponymail-mcp: add API token authentication with scopes [comdev]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #23:
URL: https://github.com/apache/comdev/pull/23#issuecomment-4886814390
Of course it should not be merged before https://github.com/apache/incubator-ponymail-foal/pull/321 is released in PonyMail
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For additional commands, e-mail: dev-help@community.apache.org
Re: [PR] ponymail-mcp: add API token authentication with scopes [comdev]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #23:
URL: https://github.com/apache/comdev/pull/23#issuecomment-4893517568
@/reply.md
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For additional commands, e-mail: dev-help@community.apache.org
Re: [PR] ponymail-mcp: add API token authentication with scopes [comdev]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #23:
URL: https://github.com/apache/comdev/pull/23#issuecomment-4887538121
> Another issue to consider: what about other tools that could benefit from long-term tokens?
I guess it's up to those tools - since we are purely basing it on openapi - and openapi is implemented in server (and is part of the impleme manntation) - it's "good enough" to be implemented by others.
> Does it make sense to replicate the code in every tool that could benefit from it?
I guess it depends on the programming language - we have a common "Open API" layer describing API and it can be implemented by others. But if - as a maintainer of PonyMail, you think tha some libraries in a number ofntia programming languages is a good Idea - I am happy to produce a separate library in many languages. The "openapi" spec can be turned into a ready to use library, with documented interface and API - by just a matter of using one of the openapi generators. In airflow for example we generate a Python client library automatically from our openapi spec.
And if PonyMail maintainers want to build and release such libraries - I am happy to automate generation of those - but I think it's more of PonyMail maintainers what they want to support - whether the API (this is what is supported today) or whether they want to also release and support libraries (in Airlfow we decided to only support Python library and we suggest our users to use generators to support the same interface in other libraries - and I think it's the **right** approach for maintainers to only support libraries in language they are comfortable with.
But I think this is more of a discussion in https://github.com/apache/incubator-ponymail-foal/pull/321 than here. This one is just one of the implementations that I used to test the new API with - but if maintainers of Ponymail would like to support library in Python, I can help to build such library and use it in PonyMailMCP as well. No problem whatsoever.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For additional commands, e-mail: dev-help@community.apache.org
Re: [PR] ponymail-mcp: add API token authentication with scopes [comdev]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #23:
URL: https://github.com/apache/comdev/pull/23#issuecomment-4892216158
Rebased onto the latest `main` (picked up the `.json` endpoint changes from #21/#22; resolved the `apiFetch` / `auth_status` conflicts so bearer-token auth composes with the new `.json` POST vs `.lua` GET handling) and updated the README docs.
Added an explicit clarification of the token permission model to the README: a scope is a *wish, not a stored grant*. The server re-intersects a token's scopes with the owner's **current** permissions on every request, so a token is never a cached snapshot of permissions — lose access upstream and every token loses it on its next request, with nothing to cache-evict. Also noted that tokens are disabled by default and that enabling them on an ASF instance is a per-deployment, Infra-coordinated decision (an instance may leave them off or cap their lifetime).
This mirrors the docs clarification (and the new server-side admin/auto token-revocation) in the counterpart server PR apache/incubator-ponymail-foal#321. `npm test` green (65 tests).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For additional commands, e-mail: dev-help@community.apache.org
Re: [PR] ponymail-mcp: add API token authentication with scopes [comdev]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #23:
URL: https://github.com/apache/comdev/pull/23#issuecomment-4893531680
Thanks @dave2wave — I dug into both `infrastructure-asfquart` and `tooling-trusted-releases` to see what's reusable, and wanted to share what I found so the discussion is grounded in the actual code.
**What's in asfquart today** is the auth *seam*, not token management:
- a bearer hook — `session.py` recognises `Authorization: Bearer <token>` and calls a pluggable `app.token_handler(token)` callback that returns a session dict;
- a session model (`uid`, committees/projects, `isMember/isChair/isRoot`, `mfa`, `roleaccount`, plus a free-form `metadata` dict where scope lives by convention);
- the `@asfquart.auth.require(...)` decorators with `Requirements` (committer/member/pmc_member/chair/root/mfa/roleacct).
The one PAT example (`examples/snippets/personal_access_tokens.py`) is a static-YAML role-account lookup — no generation, hashing, storage, expiry, revocation, scope-intersection, caps or audit. So the token *lifecycle* PR #321 implements isn't in asfquart; it's the plumbing where such a subsystem would plug in.
**The richer machinery you described lives in ATR**, not asfquart — `atr/shared/tokens.py`, `storage/readers|writers/tokens.py`, `get|post/tokens.py`, `jwtoken.py`, the admin revoke templates and `api_auth` blueprint, on top of asfquart. That matches your "we're considering pushing more of this to `infrastructure-asfquart`" — i.e. it's not there yet, it's ATR-specific for now. One design difference worth flagging: ATR uses a long-lived PAT exchanged for a short-lived HS256 JWT per request, whereas #321 uses an opaque token directly and re-intersects its scope with the owner's *current* permissions on every request. Both are valid; they make different revocation/latency trade-offs.
**Practical catch for PonyMail:** asfquart is a Quart framework, and ponymail-foal's server is a hand-rolled aiohttp async app — so "use asfquart" isn't a drop-in; it'd mean reframing the server or just mirroring the pattern (which `session.py` already does in spirit).
Given that, I don't think there's an asfquart token library to adopt today. The cheap, high-value alignment I'd suggest is matching asfquart's session/scope *shape* (`metadata["scope"]`, the roleaccount flag, `Requirements` semantics) so that if a shared asfquart token layer ever materialises — or PonyMail ever moves onto asfquart — the tokens are already compatible, without taking a Quart dependency now. Happy to do that in this PR if the PMC agrees it's worth it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For additional commands, e-mail: dev-help@community.apache.org
Re: [PR] ponymail-mcp: add API token authentication with scopes [comdev]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #23:
URL: https://github.com/apache/comdev/pull/23#issuecomment-4887095304
> Actually it is before that PR is accepted and the feature implemented by the vendor for lists.apache.org there are no guarantees on this and it might require a request from VP, Infra or the InfraAdmin.
I leave it up to PonyMail PMC, it's just implementing a feature request created in May https://github.com/apache/incubator-ponymail-foal/issues/312 . I am not sure how much permissions or requests it needs - but I am looking for feedback from all Incubating Ponymail PMC members - and of course Infra has to host it and likely security team might need to review it (happy to help with that).
But yes all that - if/when it happens - will happen before new version (if there will be one incorporating my changes) is released, so I guess what I wrote still hold.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For additional commands, e-mail: dev-help@community.apache.org
Re: [PR] ponymail-mcp: add API token authentication with scopes [comdev]
Posted by "sebbASF (via GitHub)" <gi...@apache.org>.
sebbASF commented on PR #23:
URL: https://github.com/apache/comdev/pull/23#issuecomment-4887508829
Another issue to consider: what about other tools that could benefit from long-term tokens?
Does it make sense to replicate the code in every tool that could benefit from it?
That would increase the maintenance load. If a bug is found in one instance, or an enhancement proposed, it would be a lot easier if most of the code could be shared.
This would of course mean more work up-front, but should result in long-term benefits in maintainability.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For additional commands, e-mail: dev-help@community.apache.org
Re: [PR] ponymail-mcp: add API token authentication with scopes [comdev]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #23:
URL: https://github.com/apache/comdev/pull/23#issuecomment-4891799232
> The tokens can be regarded as a cache of the permissions that were active when the user logged in originally. There needs to be a way to evict tokes when these permissions change. I think this approach needs to be discussed with Infra.
Actually, there is no need - this is already implemented automatically (I think also well explained in the documentation) - the actual permissions that the token allows to have is a superset of the token scope and actual **current** permissions of the user. So basically what the "scope" of the token is is a "wish" - but the wish is only granted if the user already has those permissions.
But yes - maybe worth explaining it more in the docs, and definitely infra needs to be involved when enabling it. Note that this feature is disabled by default - so for example "mail.apache.org" might choose not to enable it or limit the time for example - all this is configurable.
Let me make sure that what I explained above is very clear in the docs of the change in PonyMail change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For additional commands, e-mail: dev-help@community.apache.org
Re: [PR] ponymail-mcp: add API token authentication with scopes [comdev]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #23:
URL: https://github.com/apache/comdev/pull/23#issuecomment-4887543585
Also I conider PonyMail maintainers might want to not implement it at all - this is a viable option if there are concerns other than implementation. Really - the responsibility and decisions whether to consider it and how is - as usual - resting on the shoulders of maintainers, who can consider pros and cons.
No pressure - just wanted to make sure implementation effort is not considered as blocker in those discussions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For additional commands, e-mail: dev-help@community.apache.org
Re: [PR] ponymail-mcp: add API token authentication with scopes [comdev]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #23:
URL: https://github.com/apache/comdev/pull/23#issuecomment-4893359712
> You have described much of what is already implemented in ATR with permission schemes around roles and api endpoints and including admin functions around purging of tokens and disabling "banned" users. We are considering pushing more of this to `infrastructure-asfquart` which is the preferred base for Tooling and Infrastructure websites.
I think you probably misread it.
That has nothing to do with ATR - it's just long term "scope" of token. It's not "management" of the permissions - it's just using the permissions that are already present and exposed via Oauth, it's more of implementing token authenticaion mechanism manageable by the user via PonyMail.
But of course if there is a mechanism for long term tokens handed-over by other systems centraly - this PonyMail mechanims can also support it, no problem whatsoever - it should be a simple, few line change.
This is really mechanism of managing "tokens" not permisssions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For additional commands, e-mail: dev-help@community.apache.org
Re: [PR] ponymail-mcp: add API token authentication with scopes [comdev]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #23:
URL: https://github.com/apache/comdev/pull/23#issuecomment-4893568779
Let me know @dave2wave and other PonyMail PMC members - if such "Requirements" alignment is good - that would allow to just swap the mechanism with the `infrastructure-quart` blueprint when/if the PMC decides to migrate PonyMail to Quart - until now it's just a matter of mirroring the same semantics (which is basically already done in this PR except the Requirement semantics that I can easily mirror. I will add a follow-up small fixup here that can be easily removed - just to demonstrate how it might look like.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For additional commands, e-mail: dev-help@community.apache.org
Re: [PR] ponymail-mcp: add API token authentication with scopes [comdev]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #23:
URL: https://github.com/apache/comdev/pull/23#issuecomment-4892258326
Also it triggered me to implement another change - those tokens can be now removed by admin "purge-token" option as well as they will automatically purge themselves when Oauth metadata indicate that groups/permissions of the user changed in LDAP (ASF Oauth already provides that information) - which adds additional memory savings and database savings. Previously, those tokens would have been rejected if auth interface would reject the token - now (if enabled) the tokens will be "out of abundance of caution" immediately removed when we see any "permission/group change" for the user when it tries to login with token that was generated with previous set of permissions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For additional commands, e-mail: dev-help@community.apache.org
Re: [PR] ponymail-mcp: add API token authentication with scopes [comdev]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #23:
URL: https://github.com/apache/comdev/pull/23#issuecomment-4892456756
@sebbASF — on your point about [replicating token/client code across tools](https://github.com/apache/comdev/pull/23#issuecomment-4887508829): agreed, and the design already avoids that. The shared, maintained artifact is the server's OpenAPI spec (`server/openapi.yaml`), not hand-written client code. Any tool generates its own typed client from that spec with a standard OpenAPI generator, so there is nothing to copy between tools — an API fix or enhancement lives in the spec and every consumer just regenerates.
I've documented exactly how in the counterpart server PR: a new [Generating API Client Libraries](https://github.com/apache/incubator-ponymail-foal/blob/api-tokens/docs/generating_api_clients.md) guide, with copy-paste `openapi-generator` examples for Python, TypeScript, Go and Java, including bearer-token auth. That PR (apache/incubator-ponymail-foal#321) also adds a `bearerAuth` security scheme to the spec, so generated clients handle long-term API tokens out of the box.
The MCP in this PR is just one such consumer; other tools that want long-term tokens generate a client the same way rather than reimplementing the plumbing.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For additional commands, e-mail: dev-help@community.apache.org
Re: [PR] ponymail-mcp: add API token authentication with scopes [comdev]
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on PR #23:
URL: https://github.com/apache/comdev/pull/23#issuecomment-4893241451
You have described much of what is already implemented in ATR with permission schemes around roles and api endpoints. Which PMCs, etcetera. We are considering pushing this to `infrastructure-asfquart` which is the preferred base for Tooling and Infrastructure websites
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For additional commands, e-mail: dev-help@community.apache.org
Re: [PR] ponymail-mcp: add API token authentication with scopes [comdev]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #23:
URL: https://github.com/apache/comdev/pull/23#issuecomment-4893405242
@dave2wave - is there a documentation about those asfquart mechanisms? I am happy to replace or add additional mechanism to PonyMail about it, separately configurable as well. PonyMail can still have all mechanism added - if PonyMail PMC agrees to incorporate that one as well - having asfquart mechanism should be added as well, I can easily do that if there are docs/code I can refer to. Then when deploying PonyMail new versions on mail.apache.org, Infra might choose which mechanisms to enable. I am super happy to implement asfquart, additionally or separately from the generic "token" based one that other users of PonyMail might choose between,
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For additional commands, e-mail: dev-help@community.apache.org