weiyuqing/mi-fitness-health
1
0 Fork 0
mirror of https://github.com/This-weiyuqing/mi-fitness-health.git synced 2026-10-17 18:55:37 +08:00
Code Issues Packages Projects Releases Wiki Activity
16 Commits 1 Branch 0 Tags
a47a8470f8d7f3240b2c075d10ed60cde72c6bb3
Commit Graph
9 Commits
Author SHA1 Message Date
binglua a47a8470f8 feat(security): privacy hardening + data export (v0.2.1) 
- CORS: default localhost-only origins (was *, allowed any webpage
  to read local health data cross-site); env override MI_FITNESS_CORS_ORIGINS
- Host header allowlist middleware on FastAPI and Flask (DNS-rebinding
  protection); auto-configured for non-loopback binds via CLI
- Move API key passTokens from SQLite plaintext to system keyring,
  with automatic migration on startup and cleanup for revoked keys
- Disable uvicorn access log by default (query params out of terminals)
- New GET /api/export: JSON/CSV export of local data (offline, Excel BOM)
- Add docs/PRIVACY.md: full data-flow audit, outbound endpoint inventory,
  threat model, self-verification steps
- 6 new tests (host allowlist, keyring roundtrip, CSV)
 2026-09-03 22:43:15 +08:00
binglua 42c42b2c9e docs: point badges and clone URL to this repository 2026-09-03 22:33:57 +08:00
binglua 99bc32e862 docs: polish README for open-source release 
- Add CI/license/version/python badges and bilingual one-liner
- Add mermaid architecture diagram
- Feature list: add MCP access, incremental sync engine, local-first
- Add FAQ (data freshness, passToken expiry, mcp<2, sync duration)
- Consolidate auth levels into a table; add key issuance example
- Fix imprecise bare-sync description (resume from cursor, not fixed 30d)
- Add docs navigation and repo file layout notes
 2026-09-03 22:30:24 +08:00
binglua 2dd32f1ee6 feat: REST API with API keys, QR login, and web dashboard (v0.2.0) 
- REST API (FastAPI): all data endpoints, sync (foreground/background),
  coverage stats, interactive docs at /docs
- API key system: exchange Xiaomi credentials for mif_sk_* keys
  (multi-account contexts, last-used tracking, prefix revocation);
  static key via MI_FITNESS_API_KEY, admin endpoints via MI_FITNESS_ADMIN_KEY
- QR code login: reverse-engineered Xiaomi universal QR flow
  (sid=xiaomiio), auto-issues API key after scan confirmation
- Built-in web dashboard (Flask): visual console for all endpoints,
  key management, QR login; reverse proxy with server-side key relay
- Standalone testpage/ console (python app.py, no install needed)
- Fix: pin mcp<2 (SDK 2.x removed Server.list_tools, broke startup)
- CI: install [all,dev] extras; docs: full technical documentation
  and QR login implementation guide
 2026-09-03 22:28:31 +08:00
binglua eef795672d feat: sync spo2 stress and abnormal heart beat 2026-06-22 01:31:54 +00:00
binglua b532ee652d docs: translate README to Chinese 2026-06-21 11:45:54 +00:00
Aleksej Kubulashvili 6440121d67 docs: add repository badges 2026-03-16 14:13:56 +03:00
Aleksej Kubulashvili df914ea56a feat: prepare mi-fitness-mcp for first public release 
Package the standalone Mi Fitness MCP with clearer public docs, release metadata, CI, and safer local repository hygiene so it is ready to publish without secrets or work identity leakage.
 2026-03-12 14:12:49 +03:00
Aleksej Kubulashvili 6771fc841c Initialize standalone Mi Fitness MCP repository 2026-03-12 10:03:58 +03:00