The manual 0.1.0->0.2.0 bump conflicted with the automated release
workflow, which would have double-bumped to 0.3.0. Version is now driven
solely by `cz bump` from conventional commits (last tag v0.1.0 is the
baseline); CHANGELOG entries are generated at release time.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NGzHtDvJur9U7ysgRKRUTN
Establishes the release process for the upcoming nutrition/wellness features (a
minor bump). Source of truth is pyproject [project].version; `uvx cz bump` derives
future versions from conventional commits and tags vX.Y.Z.
Foundation for multi-user operation (Phase 1):
- crypto.py: AES-256-GCM encrypt/decrypt for the per-user Intervals API key,
key from INTERVALS_ENC_KEY (base64 32 bytes). Random nonce per message.
- db/models.py + db/session.py: SQLAlchemy 2.0 async User model (keyed on the
Authentik sub; api_key stored encrypted; enabled = admin-approval gate) and a
lazy async engine/sessionmaker from DATABASE_URL.
- store.py: async CRUD. New users created disabled; login never flips enabled;
get_active_credentials returns decrypted creds only for an enabled user that
has them.
- credentials.py: resolve_caller_credentials() maps get_access_token().subject
to that user's stored creds, falling back to env config only when unauthenticated
(stdio/local).
- Tests (SQLite in-memory, no infra): crypto round-trip/tamper, store gating,
resolver paths. Suite 199 passing at 90.4% (gate holds).
Deps: sqlalchemy[asyncio], asyncpg, alembic (+ aiosqlite for tests). Pin py3.12.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Bump mcp[cli] 1.22 -> 1.28.1 (negotiates MCP protocol 2025-11-25, matching
current Claude clients; the old 2025-06-18 server never got a tools/list on
the connector surface).
- Bake transport config into code: stateless_http + json_response for HTTP
(single JSON body instead of a 34KB SSE stream, which the connector pipeline
handles far more reliably).
- Bake Authentik OAuth (AuthSettings + JWT TokenVerifier) into intervals_mcp_server.auth,
configured from MCP_ISSUER/MCP_RESOURCE/MCP_JWKS_URI/MCP_CLIENT_ID — removes the
runtime FastMCP.__init__ monkeypatch from the k8s deployment command.
- Accept token audience with/without trailing slash (RFC 8707 clients use the
slash-normalised resource metadata value).
- Dockerfile CMD runs the module (transport via MCP_TRANSPORT); add .gitea CI to
build+push the image to git.farh.net/farhoodlabs/intervalsicu-mcp.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
release-bot
Chris Farhood