feat(gitea): support extra outbound HTTP headers via GITEA_EXTRA_HEADERS

Add a GITEA_EXTRA_HEADERS environment variable that accepts a JSON
object of header name/value pairs (e.g. Cloudflare Access
credentials) and applies them to every outbound request to Gitea,
both the raw pkg/gitea.DoJSON/DoBytes path and the SDK-backed
pkg/gitea.NewClient path, without overriding Authorization,
Content-Type, or Accept.

Co-Authored-By: Codet <codet@commitgo.dev> (GPT-5-Codex)

cmd/cmd.go

@@ -2,9 +2,11 @@ package cmd
 
 import (
 	"context"
+	"encoding/json"
 	"flag"
 	"fmt"
 	"io"
+	"net/http"
 	"os"
 	"strconv"
 	"strings"
@@ -86,6 +88,7 @@ func initFlagSet(fs *flag.FlagSet, args []string, getenv func(string) string, re
 		fmt.Fprintf(w, "  GITEA_ACCESS_TOKEN\tProvide access token\n")
 		fmt.Fprintf(w, "  GITEA_ACCESS_TOKEN_FILE\tPath to a file containing the access token (e.g. a Docker secret)\n")
 		fmt.Fprintf(w, "  GITEA_DEBUG\tSet to 'true' for debug mode\n")
+		fmt.Fprintf(w, "  GITEA_EXTRA_HEADERS\tJSON object of extra HTTP headers to send with Gitea API requests\n")
 		fmt.Fprintf(w, "  GITEA_HOST\tOverride Gitea host URL\n")
 		fmt.Fprintf(w, "  GITEA_INSECURE\tSet to 'true' to ignore TLS errors\n")
 		fmt.Fprintf(w, "  GITEA_MAX_INLINE_ATTACHMENT_BYTES\tOverride inline image attachment size limit in bytes\n")
@@ -164,6 +167,18 @@ func initFlagSet(fs *flag.FlagSet, args []string, getenv func(string) string, re
 			flagPkg.MaxInlineAttachmentBytes = parsed
 		}
 	}
+	if val := getenv("GITEA_EXTRA_HEADERS"); val != "" {
+		var headers map[string]string
+		if err := json.Unmarshal([]byte(val), &headers); err != nil {
+			fmt.Fprintf(stderr, "invalid GITEA_EXTRA_HEADERS: %v\n", err)
+			osExit(1)
+		}
+		extraHeaders := make(http.Header, len(headers))
+		for name, value := range headers {
+			extraHeaders.Set(name, value)
+		}
+		flagPkg.ExtraHeaders = extraHeaders
+	}
 }
 
 // normalizeScope trims whitespace, lowercases, and converts internal spaces

cmd/cmd_test.go

@@ -5,6 +5,7 @@ import (
 	"flag"
 	"maps"
 	"slices"
+	"strings"
 	"testing"
 
 	flagPkg "gitea.com/gitea/gitea-mcp/pkg/flag"
@@ -95,3 +96,54 @@ func TestInitFlagSetScopes(t *testing.T) {
 		})
 	}
 }
+
+func TestInitFlagSetExtraHeaders(t *testing.T) {
+	t.Cleanup(func() { flagPkg.ExtraHeaders = nil })
+
+	getenv := func(key string) string {
+		if key == "GITEA_EXTRA_HEADERS" {
+			return `{"CF-Access-Client-Id":"id","CF-Access-Client-Secret":"secret"}`
+		}
+		return ""
+	}
+	readFile := func(string) ([]byte, error) { return nil, nil }
+	fs := flag.NewFlagSet("test", flag.ContinueOnError)
+	var stderr bytes.Buffer
+
+	initFlagSet(fs, []string{}, getenv, readFile, &stderr)
+
+	if got := flagPkg.ExtraHeaders.Get("CF-Access-Client-Id"); got != "id" {
+		t.Errorf("ExtraHeaders[CF-Access-Client-Id] = %q, want %q", got, "id")
+	}
+	if got := flagPkg.ExtraHeaders.Get("CF-Access-Client-Secret"); got != "secret" {
+		t.Errorf("ExtraHeaders[CF-Access-Client-Secret] = %q, want %q", got, "secret")
+	}
+}
+
+func TestInitFlagSetExtraHeadersInvalidJSON(t *testing.T) {
+	t.Cleanup(func() { flagPkg.ExtraHeaders = nil })
+
+	origOsExit := osExit
+	var exitCode int
+	osExit = func(code int) { exitCode = code }
+	t.Cleanup(func() { osExit = origOsExit })
+
+	getenv := func(key string) string {
+		if key == "GITEA_EXTRA_HEADERS" {
+			return `not-json`
+		}
+		return ""
+	}
+	readFile := func(string) ([]byte, error) { return nil, nil }
+	fs := flag.NewFlagSet("test", flag.ContinueOnError)
+	var stderr bytes.Buffer
+
+	initFlagSet(fs, []string{}, getenv, readFile, &stderr)
+
+	if exitCode != 1 {
+		t.Errorf("exitCode = %d, want 1", exitCode)
+	}
+	if !strings.Contains(stderr.String(), "GITEA_EXTRA_HEADERS") {
+		t.Errorf("stderr = %q, want mention of GITEA_EXTRA_HEADERS", stderr.String())
+	}
+}