binglua
a47a8470f8
feat(security): privacy hardening + data export (v0.2.1)
...
- CORS: default localhost-only origins (was *, allowed any webpage
to read local health data cross-site); env override MI_FITNESS_CORS_ORIGINS
- Host header allowlist middleware on FastAPI and Flask (DNS-rebinding
protection); auto-configured for non-loopback binds via CLI
- Move API key passTokens from SQLite plaintext to system keyring,
with automatic migration on startup and cleanup for revoked keys
- Disable uvicorn access log by default (query params out of terminals)
- New GET /api/export: JSON/CSV export of local data (offline, Excel BOM)
- Add docs/PRIVACY.md: full data-flow audit, outbound endpoint inventory,
threat model, self-verification steps
- 6 new tests (host allowlist, keyring roundtrip, CSV)
2026-09-03 22:43:15 +08:00
binglua
42c42b2c9e
docs: point badges and clone URL to this repository
2026-09-03 22:33:57 +08:00
binglua
99bc32e862
docs: polish README for open-source release
...
- Add CI/license/version/python badges and bilingual one-liner
- Add mermaid architecture diagram
- Feature list: add MCP access, incremental sync engine, local-first
- Add FAQ (data freshness, passToken expiry, mcp<2, sync duration)
- Consolidate auth levels into a table; add key issuance example
- Fix imprecise bare-sync description (resume from cursor, not fixed 30d)
- Add docs navigation and repo file layout notes
2026-09-03 22:30:24 +08:00
binglua
2dd32f1ee6
feat: REST API with API keys, QR login, and web dashboard (v0.2.0)
...
- REST API (FastAPI): all data endpoints, sync (foreground/background),
coverage stats, interactive docs at /docs
- API key system: exchange Xiaomi credentials for mif_sk_* keys
(multi-account contexts, last-used tracking, prefix revocation);
static key via MI_FITNESS_API_KEY, admin endpoints via MI_FITNESS_ADMIN_KEY
- QR code login: reverse-engineered Xiaomi universal QR flow
(sid=xiaomiio), auto-issues API key after scan confirmation
- Built-in web dashboard (Flask): visual console for all endpoints,
key management, QR login; reverse proxy with server-side key relay
- Standalone testpage/ console (python app.py, no install needed)
- Fix: pin mcp<2 (SDK 2.x removed Server.list_tools, broke startup)
- CI: install [all,dev] extras; docs: full technical documentation
and QR login implementation guide
2026-09-03 22:28:31 +08:00
binglua
7fcd06980f
feat: improve cloud sync reliability and background status
2026-07-13 04:03:57 +00:00
binglua
ebc94b50e9
chore: localize CLI output and comments to Chinese
2026-06-29 02:49:10 +00:00
binglua
636d2857c3
fix: preserve daily activity timezone metadata
2026-06-29 02:38:41 +00:00
binglua
f73fcb6659
fix: sync all supported Mi Fitness data types by default
2026-06-29 02:21:44 +00:00
binglua
c901e712d7
fix: preserve Mi Fitness local timezone offsets
2026-06-22 02:10:55 +00:00
binglua
eef795672d
feat: sync spo2 stress and abnormal heart beat
2026-06-22 01:31:54 +00:00
binglua
0ff3dd1c82
feat: sync spo2 stress and abnormal heart beat
2026-06-22 01:31:54 +00:00
binglua
b532ee652d
docs: translate README to Chinese
2026-06-21 11:45:54 +00:00
binglua
62be8dfc2b
Add Mi Fitness sleep and workout sync support
2026-06-21 11:45:53 +00:00
binglua