binglua
a47a8470f8
feat(security): privacy hardening + data export (v0.2.1)
...
- CORS: default localhost-only origins (was *, allowed any webpage
to read local health data cross-site); env override MI_FITNESS_CORS_ORIGINS
- Host header allowlist middleware on FastAPI and Flask (DNS-rebinding
protection); auto-configured for non-loopback binds via CLI
- Move API key passTokens from SQLite plaintext to system keyring,
with automatic migration on startup and cleanup for revoked keys
- Disable uvicorn access log by default (query params out of terminals)
- New GET /api/export: JSON/CSV export of local data (offline, Excel BOM)
- Add docs/PRIVACY.md: full data-flow audit, outbound endpoint inventory,
threat model, self-verification steps
- 6 new tests (host allowlist, keyring roundtrip, CSV)
2026-09-03 22:43:15 +08:00
binglua
42c42b2c9e
docs: point badges and clone URL to this repository
2026-09-03 22:33:57 +08:00
binglua
99bc32e862
docs: polish README for open-source release
...
- Add CI/license/version/python badges and bilingual one-liner
- Add mermaid architecture diagram
- Feature list: add MCP access, incremental sync engine, local-first
- Add FAQ (data freshness, passToken expiry, mcp<2, sync duration)
- Consolidate auth levels into a table; add key issuance example
- Fix imprecise bare-sync description (resume from cursor, not fixed 30d)
- Add docs navigation and repo file layout notes
2026-09-03 22:30:24 +08:00
binglua
2dd32f1ee6
feat: REST API with API keys, QR login, and web dashboard (v0.2.0)
...
- REST API (FastAPI): all data endpoints, sync (foreground/background),
coverage stats, interactive docs at /docs
- API key system: exchange Xiaomi credentials for mif_sk_* keys
(multi-account contexts, last-used tracking, prefix revocation);
static key via MI_FITNESS_API_KEY, admin endpoints via MI_FITNESS_ADMIN_KEY
- QR code login: reverse-engineered Xiaomi universal QR flow
(sid=xiaomiio), auto-issues API key after scan confirmation
- Built-in web dashboard (Flask): visual console for all endpoints,
key management, QR login; reverse proxy with server-side key relay
- Standalone testpage/ console (python app.py, no install needed)
- Fix: pin mcp<2 (SDK 2.x removed Server.list_tools, broke startup)
- CI: install [all,dev] extras; docs: full technical documentation
and QR login implementation guide
2026-09-03 22:28:31 +08:00
binglua
7fcd06980f
feat: improve cloud sync reliability and background status
2026-07-13 04:03:57 +00:00
binglua
ebc94b50e9
chore: localize CLI output and comments to Chinese
2026-06-29 02:49:10 +00:00
binglua
636d2857c3
fix: preserve daily activity timezone metadata
2026-06-29 02:38:41 +00:00
binglua
f73fcb6659
fix: sync all supported Mi Fitness data types by default
2026-06-29 02:21:44 +00:00
binglua
c901e712d7
fix: preserve Mi Fitness local timezone offsets
2026-06-22 02:10:55 +00:00
binglua
eef795672d
feat: sync spo2 stress and abnormal heart beat
2026-06-22 01:31:54 +00:00
binglua
0ff3dd1c82
feat: sync spo2 stress and abnormal heart beat
2026-06-22 01:31:54 +00:00
binglua
b532ee652d
docs: translate README to Chinese
2026-06-21 11:45:54 +00:00
binglua
62be8dfc2b
Add Mi Fitness sleep and workout sync support
2026-06-21 11:45:53 +00:00
Aleksej Kubulashvili
6440121d67
docs: add repository badges
2026-03-16 14:13:56 +03:00
Aleksej Kubulashvili
df914ea56a
feat: prepare mi-fitness-mcp for first public release
...
Package the standalone Mi Fitness MCP with clearer public docs, release metadata, CI, and safer local repository hygiene so it is ready to publish without secrets or work identity leakage.
2026-03-12 14:12:49 +03:00
Aleksej Kubulashvili
6771fc841c
Initialize standalone Mi Fitness MCP repository
2026-03-12 10:03:58 +03:00
binglua