Update Auth middleware to accept a fallbackToken parameter. When no
per-user cookie token is present and GITEA_TOKEN is set in the
environment, the middleware uses the env token instead of redirecting
to /settings. Cookie tokens still take precedence over the fallback.
Add three new unit tests covering: fallback used when no cookie,
cookie takes precedence over fallback, and redirect when neither is set.
Closesleeworks-agents/gitea-mobile#125
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Implement 12-factor configuration via environment variables and
token-in-cookie authentication for Gitea API access.
- internal/config/config.go: reads GITEA_URL, GITEA_TOKEN, LISTEN_ADDR,
SESSION_SECRET from environment with validation
- internal/auth/cookie.go: HMAC-signed HTTP-only cookie for storing
Gitea API tokens (Secure, SameSite=Strict)
- internal/middleware/auth.go: extracts token from cookie, injects into
request context, redirects unauthenticated users to /settings
- internal/middleware/logging.go: structured JSON request logging
- internal/handlers/settings.go: settings page for entering/removing
Gitea API token with mobile-first dark UI
- cmd/server/main.go: integrated config, auth middleware, and settings
Includes unit tests for config loading, cookie signing/verification,
and auth middleware bypass/redirect logic.
Closesleeworks-agents/gitea-mobile#2
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Initialize go.mod with gitea.leeworks.dev/0xwheatyz/gitea-mobile
- Create directory structure: cmd/server/, internal/{config,gitea,handlers,middleware,templates}/, static/
- Add minimal HTTP server with /health and / endpoints
- Add flake.nix with Go toolchain, gopls, and air for live reload
Closesleeworks-agents/gitea-mobile#1
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
agent-company