weiyuqing/mi-fitness-health
1
0 Fork 0
mirror of https://github.com/This-weiyuqing/mi-fitness-health.git synced 2026-10-17 18:55:37 +08:00
Code Issues Packages Projects Releases Wiki Activity
29 Commits 1 Branch 0 Tags
317194c21c51373b82decb351840ea9985dd349a
Commit Graph
3 Commits
Author SHA1 Message Date
binglua a47a8470f8 feat(security): privacy hardening + data export (v0.2.1) 
- CORS: default localhost-only origins (was *, allowed any webpage
  to read local health data cross-site); env override MI_FITNESS_CORS_ORIGINS
- Host header allowlist middleware on FastAPI and Flask (DNS-rebinding
  protection); auto-configured for non-loopback binds via CLI
- Move API key passTokens from SQLite plaintext to system keyring,
  with automatic migration on startup and cleanup for revoked keys
- Disable uvicorn access log by default (query params out of terminals)
- New GET /api/export: JSON/CSV export of local data (offline, Excel BOM)
- Add docs/PRIVACY.md: full data-flow audit, outbound endpoint inventory,
  threat model, self-verification steps
- 6 new tests (host allowlist, keyring roundtrip, CSV)
 2026-09-03 22:43:15 +08:00
binglua 2dd32f1ee6 feat: REST API with API keys, QR login, and web dashboard (v0.2.0) 
- REST API (FastAPI): all data endpoints, sync (foreground/background),
  coverage stats, interactive docs at /docs
- API key system: exchange Xiaomi credentials for mif_sk_* keys
  (multi-account contexts, last-used tracking, prefix revocation);
  static key via MI_FITNESS_API_KEY, admin endpoints via MI_FITNESS_ADMIN_KEY
- QR code login: reverse-engineered Xiaomi universal QR flow
  (sid=xiaomiio), auto-issues API key after scan confirmation
- Built-in web dashboard (Flask): visual console for all endpoints,
  key management, QR login; reverse proxy with server-side key relay
- Standalone testpage/ console (python app.py, no install needed)
- Fix: pin mcp<2 (SDK 2.x removed Server.list_tools, broke startup)
- CI: install [all,dev] extras; docs: full technical documentation
  and QR login implementation guide
 2026-09-03 22:28:31 +08:00
Aleksej Kubulashvili df914ea56a feat: prepare mi-fitness-mcp for first public release 
Package the standalone Mi Fitness MCP with clearer public docs, release metadata, CI, and safer local repository hygiene so it is ready to publish without secrets or work identity leakage.
 2026-03-12 14:12:49 +03:00