@google-cloud/cloud-run-mcp 1.10.0 → 1.12.0

package/test/local/deploy.test.js

@@ -0,0 +1,408 @@
+/*
+Copyright 2025 Google LLC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { test, describe, mock } from 'node:test';
+import assert from 'node:assert/strict';
+import esmock from 'esmock';
+import path from 'path';
+
+describe('Deploy Compose', () => {
+  const projectId = 'test-project';
+  const region = 'us-central1';
+  const accessToken = 'test-token';
+  const composeFilePath = '/abs/path/to/compose.yaml';
+  const files = [path.dirname(composeFilePath)];
+
+  test('successfully deploys a simple compose file with one source-built service', async () => {
+    // Setup mocks
+    const prepareSourceDirectoryMock = mock.fn(async () => '/tmp/temp-dir');
+    const getProjectNumberMock = mock.fn(async () => '123456789');
+    const downloadRunComposeMock = mock.fn(
+      async () => '/usr/local/bin/run-compose'
+    );
+    const resourceComposeMock = mock.fn(async () =>
+      JSON.stringify({
+        source_builds: {
+          web: { context: 'app' },
+        },
+      })
+    );
+    const translateComposeMock = mock.fn(async () =>
+      JSON.stringify({
+        services: {
+          web: 'web.yaml',
+        },
+      })
+    );
+    const triggerCloudBuildMock = mock.fn(async () => ({
+      results: {
+        images: [
+          {
+            name: 'us-central1-docker.pkg.dev/test-project/mcp-cloud-run-deployments/web:latest',
+          },
+        ],
+      },
+    }));
+    const ensureArtifactRegistryRepoExistsMock = mock.fn();
+    const ensureStorageBucketExistsMock = mock.fn(async () => ({}));
+    const uploadToStorageBucketMock = mock.fn();
+    const zipFilesMock = mock.fn(async () => Buffer.from('dummy zip content'));
+    const cleanupTempDirectoryMock = mock.fn();
+    const getRunV1ClientMock = mock.fn(async () => ({
+      namespaces: {
+        services: {
+          replaceService: mock.fn(async () => ({
+            data: { metadata: { name: 'web' } },
+          })),
+          create: mock.fn(),
+        },
+      },
+    }));
+    const fsMock = {
+      existsSync: mock.fn(() => true),
+      promises: {
+        mkdtemp: mock.fn(async () => '/tmp/random-dir'),
+        readFile: mock.fn(async () => 'name: web'),
+      },
+    };
+    const logAndProgressMock = mock.fn();
+
+    // Import with mocks
+    const { deployCompose } = await esmock('../../lib/deployment/deployer.js', {
+      '../../lib/deployment/source-processor.js': {
+        prepareSourceDirectory: prepareSourceDirectoryMock,
+        cleanupTempDirectory: cleanupTempDirectoryMock,
+      },
+      '../../lib/util/helpers.js': {
+        getProjectNumber: getProjectNumberMock,
+        logAndProgress: logAndProgressMock,
+      },
+      '../../lib/deployment/compose.js': {
+        runCompose: downloadRunComposeMock,
+        resourceCompose: resourceComposeMock,
+        translateCompose: translateComposeMock,
+        composeVolumes: mock.fn(async (resourcesConfig) => resourcesConfig),
+      },
+      '../../lib/cloud-api/build.js': {
+        triggerCloudBuild: triggerCloudBuildMock,
+        composeBuild: mock.fn(
+          async (resourcesConfig, token, pId, reg, fPath, cb) => {
+            for (const serviceName in resourcesConfig.source_builds) {
+              const imageUrl = `${reg}-docker.pkg.dev/${pId}/mcp-cloud-run-deployments/${serviceName}:latest`;
+              const buildResult = await triggerCloudBuildMock(
+                pId,
+                reg,
+                'bucket',
+                'blob',
+                'repo',
+                imageUrl,
+                true,
+                token,
+                cb
+              );
+              resourcesConfig.source_builds[serviceName].image_id =
+                buildResult.results.images[0].name;
+            }
+            return resourcesConfig;
+          }
+        ),
+      },
+      '../../lib/cloud-api/registry.js': {
+        ensureArtifactRegistryRepoExists: ensureArtifactRegistryRepoExistsMock,
+      },
+      '../../lib/util/archive.js': {
+        zipFiles: zipFilesMock,
+      },
+      '../../lib/cloud-api/storage.js': {
+        ensureStorageBucketExists: ensureStorageBucketExistsMock,
+        uploadToStorageBucket: uploadToStorageBucketMock,
+      },
+      '../../lib/clients.js': {
+        getRunV1Client: getRunV1ClientMock,
+      },
+      fs: fsMock,
+      path: path,
+    });
+
+    const result = await deployCompose({
+      projectId,
+      region,
+      files,
+      composeFilePath,
+      accessToken,
+      progressCallback: logAndProgressMock,
+    });
+
+    // Validations
+    assert.ok(result);
+    assert.equal(result.service, 'web');
+    assert.equal(result.uri, undefined); // In the mock, status.url is not provided
+    assert.equal(prepareSourceDirectoryMock.mock.callCount(), 1);
+    assert.equal(resourceComposeMock.mock.callCount(), 1);
+    assert.equal(translateComposeMock.mock.callCount(), 1);
+    assert.equal(triggerCloudBuildMock.mock.callCount(), 1);
+    assert.equal(cleanupTempDirectoryMock.mock.callCount(), 1);
+
+    // Verify triggerCloudBuild was called with correctly updated image tag
+    const buildCall = triggerCloudBuildMock.mock.calls[0];
+    assert.equal(
+      buildCall.arguments[5],
+      'us-central1-docker.pkg.dev/test-project/mcp-cloud-run-deployments/web:latest'
+    );
+  });
+
+  test('failure in prepareSourceDirectory triggers cleanup and rethrows', async () => {
+    const error = new Error('Preparation failed');
+    const prepareSourceDirectoryMock = mock.fn(async () => {
+      throw error;
+    });
+    const logAndProgressMock = mock.fn();
+    const cleanupTempDirectoryMock = mock.fn();
+
+    const { deployCompose } = await esmock('../../lib/deployment/deployer.js', {
+      '../../lib/deployment/source-processor.js': {
+        prepareSourceDirectory: prepareSourceDirectoryMock,
+        cleanupTempDirectory: cleanupTempDirectoryMock,
+      },
+      '../../lib/util/helpers.js': {
+        logAndProgress: logAndProgressMock,
+      },
+    });
+
+    await assert.rejects(
+      deployCompose({
+        projectId,
+        region,
+        files,
+        composeFilePath,
+        accessToken,
+        progressCallback: logAndProgressMock,
+      }),
+      error
+    );
+
+    assert.equal(
+      logAndProgressMock.mock.calls.some(
+        (call) => call.arguments[2] === 'error'
+      ),
+      true
+    );
+  });
+
+  test('calls composeSecrets during deployment', async () => {
+    const composeSecretsMock = mock.fn(
+      async (resourcesConfig) => resourcesConfig
+    );
+    const prepareSourceDirectoryMock = mock.fn(async () => '/tmp/temp-dir');
+    const downloadRunComposeMock = mock.fn(async () => '/bin/run-compose');
+    const resourceComposeMock = mock.fn(async () => JSON.stringify({}));
+    const translateComposeMock = mock.fn(async () =>
+      JSON.stringify({ services: {} })
+    );
+    const getProjectNumberMock = mock.fn(async () => '123456');
+    const cleanupTempDirectoryMock = mock.fn();
+
+    const { deployCompose } = await esmock('../../lib/deployment/deployer.js', {
+      '../../lib/deployment/source-processor.js': {
+        prepareSourceDirectory: prepareSourceDirectoryMock,
+        cleanupTempDirectory: cleanupTempDirectoryMock,
+      },
+      '../../lib/util/helpers.js': {
+        getProjectNumber: getProjectNumberMock,
+        logAndProgress: mock.fn(),
+      },
+      '../../lib/deployment/compose.js': {
+        runCompose: downloadRunComposeMock,
+        resourceCompose: resourceComposeMock,
+        translateCompose: translateComposeMock,
+        composeVolumes: mock.fn(async (resourcesConfig) => resourcesConfig),
+        composeSecrets: composeSecretsMock,
+      },
+      '../../lib/clients.js': {
+        getRunV1Client: mock.fn(async () => ({ namespaces: { services: {} } })),
+      },
+      fs: {
+        promises: {
+          readFile: mock.fn(async () => 'name: web'),
+        },
+      },
+      path: path,
+    });
+
+    await deployCompose({
+      projectId,
+      region,
+      files,
+      composeFilePath,
+      accessToken,
+      progressCallback: mock.fn(),
+    });
+
+    assert.strictEqual(composeSecretsMock.mock.callCount(), 1);
+  });
+
+  test('successfully deploys models and services in correct order', async () => {
+    const prepareSourceDirectoryMock = mock.fn(async () => '/tmp/temp-dir');
+    const getProjectNumberMock = mock.fn(async () => '123456');
+    const downloadRunComposeMock = mock.fn(async () => '/bin/run-compose');
+    const resourceComposeMock = mock.fn(async () => JSON.stringify({}));
+    const translateComposeMock = mock.fn(async () =>
+      JSON.stringify({
+        models: { 'my-model': 'model.yaml' },
+        services: { 'my-app': 'app.yaml' },
+      })
+    );
+
+    const deployedServices = [];
+    const replaceServiceMock = mock.fn(async (params) => {
+      // Extract service name from namespaces/{p}/services/{s}
+      const serviceName = params.name.split('/').pop();
+      deployedServices.push(serviceName);
+      return { data: { status: { url: `https://${serviceName}.a.run.app` } } };
+    });
+
+    const getRunV1ClientMock = mock.fn(async () => ({
+      namespaces: {
+        services: {
+          replaceService: replaceServiceMock,
+        },
+      },
+    }));
+
+    const { deployCompose } = await esmock('../../lib/deployment/deployer.js', {
+      '../../lib/deployment/source-processor.js': {
+        prepareSourceDirectory: prepareSourceDirectoryMock,
+        cleanupTempDirectory: mock.fn(),
+      },
+      '../../lib/util/helpers.js': {
+        getProjectNumber: getProjectNumberMock,
+        logAndProgress: mock.fn(),
+      },
+      '../../lib/deployment/compose.js': {
+        runCompose: downloadRunComposeMock,
+        resourceCompose: resourceComposeMock,
+        translateCompose: translateComposeMock,
+        composeVolumes: mock.fn(async (resourcesConfig) => resourcesConfig),
+        composeSecrets: mock.fn(async (resourcesConfig) => resourcesConfig),
+      },
+      '../../lib/clients.js': {
+        getRunV1Client: getRunV1ClientMock,
+      },
+      fs: {
+        promises: {
+          readFile: mock.fn(async () => 'name: dummy'),
+        },
+      },
+      path: path,
+    });
+
+    const result = await deployCompose({
+      projectId,
+      region,
+      files,
+      composeFilePath,
+      accessToken,
+      progressCallback: mock.fn(),
+    });
+
+    assert.ok(result);
+    assert.strictEqual(result.service, 'my-app');
+    assert.strictEqual(result.uri, 'https://my-app.a.run.app');
+    assert.strictEqual(deployedServices.length, 2);
+    // Verify order: models first
+    assert.strictEqual(deployedServices[0], 'my-model');
+    assert.strictEqual(deployedServices[1], 'my-app');
+  });
+
+  test('sanitizes service names with underscores', async () => {
+    const rawServiceName = 'ai-model-test_web';
+    const sanitizedName = 'ai-model-test-web';
+
+    const prepareSourceDirectoryMock = mock.fn(async () => '/tmp/temp-dir');
+    const getProjectNumberMock = mock.fn(async () => '123456');
+    const downloadRunComposeMock = mock.fn(async () => '/bin/run-compose');
+    const translateComposeMock = mock.fn(async () =>
+      JSON.stringify({
+        services: { [rawServiceName]: 'web.yaml' },
+      })
+    );
+
+    const replaceServiceMock = mock.fn(async (params) => {
+      return { data: { metadata: { name: params.name.split('/').pop() } } };
+    });
+
+    const { deployCompose } = await esmock('../../lib/deployment/deployer.js', {
+      '../../lib/deployment/source-processor.js': {
+        prepareSourceDirectory: prepareSourceDirectoryMock,
+        cleanupTempDirectory: mock.fn(),
+      },
+      '../../lib/util/helpers.js': {
+        getProjectNumber: getProjectNumberMock,
+        logAndProgress: mock.fn(),
+        sanitizeCloudRunServiceName: (name) =>
+          name
+            .toLowerCase()
+            .replace(/[^a-z0-9]/g, '-')
+            .replace(/^-+|-+$/g, ''),
+      },
+      '../../lib/deployment/compose.js': {
+        runCompose: downloadRunComposeMock,
+        resourceCompose: mock.fn(async () => JSON.stringify({})),
+        translateCompose: translateComposeMock,
+        composeVolumes: mock.fn(async (resourcesConfig) => resourcesConfig),
+        composeSecrets: mock.fn(async (resourcesConfig) => resourcesConfig),
+      },
+      '../../lib/cloud-api/build.js': {
+        composeBuild: mock.fn(async (rc) => rc),
+      },
+      '../../lib/clients.js': {
+        getRunV1Client: mock.fn(async () => ({
+          namespaces: { services: { replaceService: replaceServiceMock } },
+        })),
+      },
+      fs: {
+        promises: {
+          readFile: mock.fn(async () => 'metadata:\n  name: ai-model-test_web'),
+        },
+      },
+      path: path,
+    });
+
+    await deployCompose({
+      projectId,
+      region,
+      files,
+      composeFilePath,
+      accessToken,
+      progressCallback: mock.fn(),
+    });
+
+    assert.strictEqual(replaceServiceMock.mock.callCount(), 1);
+    const call = replaceServiceMock.mock.calls[0];
+
+    // Verify name in URL was sanitized
+    assert.strictEqual(
+      call.arguments[0].name,
+      `namespaces/${projectId}/services/${sanitizedName}`
+    );
+
+    // Verify name in requestBody metadata was sanitized
+    assert.strictEqual(
+      call.arguments[0].requestBody.metadata.name,
+      sanitizedName
+    );
+  });
+});

package/test/local/deployment-helpers.test.js

@@ -23,7 +23,10 @@ describe('Deployment Helpers', () => {
   const fsMock = {
     statSync: mock.fn(),
     existsSync: mock.fn(),
-    readFileSync: mock.fn(),
+    promises: {
+      readdir: mock.fn(),
+      readFile: mock.fn(),
+    },
   };
 
   test('makeFileDeploymentMetadata correctly identifies Dockerfile in folder', async () => {
@@ -176,4 +179,100 @@ describe('Deployment Helpers', () => {
       ],
     });
   });
+
+  test('uploadDirectory recursively uploads files', async () => {
+    const uploadToStorageBucketMock = mock.fn(async () => ({}));
+    const readFileMock = mock.fn(async () => Buffer.from('content'));
+
+    // Create a setup for each call to differentiate directory depth
+    fsMock.promises.readdir.mock.resetCalls();
+    fsMock.promises.readdir.mock.mockImplementation(async (p) => {
+      if (p.endsWith('subdir')) {
+        return [{ name: 'file2.txt', isDirectory: () => false }];
+      }
+      return [
+        { name: 'file1.txt', isDirectory: () => false },
+        { name: 'subdir', isDirectory: () => true },
+      ];
+    });
+
+    const deploymentHelpers = await esmock('../../lib/deployment/helpers.js', {
+      fs: {
+        ...fsMock,
+        promises: {
+          ...fsMock.promises,
+          readFile: readFileMock,
+        },
+        default: {
+          ...fsMock,
+          promises: {
+            ...fsMock.promises,
+            readFile: readFileMock,
+          },
+        },
+      },
+      '../../lib/cloud-api/storage.js': {
+        uploadToStorageBucket: uploadToStorageBucketMock,
+      },
+    });
+
+    const bucket = { name: 'test-bucket' };
+    const localPath = '/local/path';
+    const gcsPrefix = 'prefix';
+    const progressCallback = mock.fn();
+
+    await deploymentHelpers.uploadDirectory(
+      bucket,
+      localPath,
+      gcsPrefix,
+      progressCallback
+    );
+
+    assert.strictEqual(uploadToStorageBucketMock.mock.callCount(), 2);
+
+    // Verify first upload (root level)
+    const call1 = uploadToStorageBucketMock.mock.calls[0];
+    assert.ok(call1.arguments[2].endsWith('prefix/file1.txt'));
+
+    // Verify second upload (subdir level)
+    const call2 = uploadToStorageBucketMock.mock.calls[1];
+    assert.ok(call2.arguments[2].endsWith('prefix/subdir/file2.txt'));
+  });
+
+  test('makeFileDeploymentMetadata correctly identifies compose file in folder', async () => {
+    const deploymentHelpers = await esmock('../../lib/deployment/helpers.js', {
+      fs: fsMock,
+    });
+
+    const folderPath = '/absolute/path/to/folder';
+
+    fsMock.statSync.mock.mockImplementation(() => ({
+      isDirectory: () => true,
+    }));
+
+    fsMock.existsSync.mock.mockImplementation((filePath) => {
+      if (filePath.endsWith('compose.yaml')) return true;
+      return false;
+    });
+
+    const result = deploymentHelpers.makeFileDeploymentMetadata([folderPath]);
+
+    assert.ok(result.composeFilePath.endsWith('compose.yaml'));
+  });
+
+  test('makeFileDeploymentMetadata returns null for composeFilePath if no compose file exists', async () => {
+    const deploymentHelpers = await esmock('../../lib/deployment/helpers.js', {
+      fs: fsMock,
+    });
+
+    const files = ['Dockerfile', 'index.js'];
+
+    fsMock.statSync.mock.mockImplementation(() => ({
+      isDirectory: () => false,
+    }));
+
+    const result = deploymentHelpers.makeFileDeploymentMetadata(files);
+
+    assert.strictEqual(result.composeFilePath, null);
+  });
 });

package/test/local/mcp-server-streamable-http.test.js

@@ -3,6 +3,7 @@ import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/
 import { test, describe, before, after } from 'node:test';
 import assert from 'node:assert/strict';
 import { spawn } from 'child_process';
+import { pathToFileURL } from 'node:url';
 import { waitForString } from './test-utils.js';
 import {
   SCOPES,
@@ -76,18 +77,35 @@ describe('OAuth Endpoints', () => {
 
   before(async () => {
     stdout = '';
-    serverProcess = spawn('node', ['mcp-server.js'], {
-      cwd: process.cwd(),
-      env: {
-        ...process.env,
-        GCP_STDIO: 'false',
-        PORT: '3001',
-        OAUTH_PROTECTED_RESOURCE: oauthProtectedResource,
-        OAUTH_AUTHORIZATION_SERVER: oauthAuthorizationServer,
-        OAUTH_AUTHORIZATION_ENDPOINT: oauthAuthorizationEndpoint,
-        OAUTH_TOKEN_ENDPOINT: oauthTokenEndpoint,
-      },
-    });
+    const clientsUrl = pathToFileURL(`${process.cwd()}/lib/clients.js`).href;
+    // Note: verifyAccessToken evicts clients.oauth entries on any verification failure,
+    // so only use these pre-seeded tokens in test cases where token verification succeeds.
+    const preloadScript = `import { clients } from '${clientsUrl}';
+      const mockClient = { getTokenInfo: async () => ({ aud: 'test-audience' }) };
+      clients.oauth.set('token-user-a', mockClient);
+      clients.oauth.set('token-user-b', mockClient);`;
+    serverProcess = spawn(
+      'node',
+      [
+        '--import',
+        `data:text/javascript,${encodeURIComponent(preloadScript)}`,
+        'mcp-server.js',
+      ],
+      {
+        cwd: process.cwd(),
+        env: {
+          ...process.env,
+          GCP_STDIO: 'false',
+          PORT: '3001',
+          OAUTH_PROTECTED_RESOURCE: oauthProtectedResource,
+          OAUTH_AUTHORIZATION_SERVER: oauthAuthorizationServer,
+          OAUTH_AUTHORIZATION_ENDPOINT: oauthAuthorizationEndpoint,
+          OAUTH_TOKEN_ENDPOINT: oauthTokenEndpoint,
+          OAUTH_ENABLED: 'true',
+          GOOGLE_OAUTH_AUDIENCE: 'test-audience',
+        },
+      }
+    );
     stdout = await waitForString(serverProcess.stdout, httpMsg);
   });
 
@@ -127,4 +145,106 @@ describe('OAuth Endpoints', () => {
       response_types_supported: [...RESPONSE_TYPES_SUPPORTED],
     });
   });
+
+  test('should reject unauthenticated POST /mcp with JSON array body with 401', async () => {
+    const response = await fetch('http://localhost:3001/mcp', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify([
+        { jsonrpc: '2.0', method: 'tools/call', params: {}, id: 1 },
+      ]),
+    });
+    assert.equal(response.status, 401);
+  });
+
+  test('should reject unauthenticated GET /sse with 401 and WWW-Authenticate header', async () => {
+    const response = await fetch('http://localhost:3001/sse');
+    assert.equal(response.status, 401);
+    assert.equal(
+      response.headers.get('www-authenticate'),
+      'Bearer resource_metadata="https://example.com/.well-known/oauth-protected-resource"'
+    );
+  });
+
+  test('should reject unauthenticated POST /messages with 401', async () => {
+    const response = await fetch(
+      'http://localhost:3001/messages?sessionId=test',
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          jsonrpc: '2.0',
+          method: 'tools/call',
+          params: {},
+          id: 1,
+        }),
+      }
+    );
+    assert.equal(response.status, 401);
+  });
+
+  test('should reject POST /messages with 403 when accessToken does not match SSE session token', async () => {
+    const sseController = new AbortController();
+    const sseResponse = await fetch('http://localhost:3001/sse', {
+      headers: { Authorization: 'Bearer token-user-a' },
+      signal: sseController.signal,
+    });
+    assert.equal(sseResponse.status, 200);
+
+    const reader = sseResponse.body.getReader();
+    const { value } = await reader.read();
+    const sseText = new TextDecoder().decode(value);
+    const match = sseText.match(/sessionId=([^\s]+)/);
+    assert.ok(
+      match,
+      `Expected sessionId in SSE endpoint event, got: ${sseText}`
+    );
+    const sessionId = match[1];
+
+    try {
+      const msgResponse = await fetch(
+        `http://localhost:3001/messages?sessionId=${sessionId}`,
+        {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+            Authorization: 'Bearer token-user-b',
+          },
+          body: JSON.stringify({
+            jsonrpc: '2.0',
+            method: 'tools/list',
+            params: {},
+            id: 1,
+          }),
+        }
+      );
+      assert.equal(msgResponse.status, 403);
+      const body = await msgResponse.json();
+      assert.equal(
+        body.error.message,
+        'Forbidden: session is bound to a different access token; reconnect to /sse'
+      );
+    } finally {
+      sseController.abort();
+    }
+  });
+
+  test('should exit at startup with non-zero code when OAUTH_ENABLED=true and GOOGLE_OAUTH_AUDIENCE is missing', async () => {
+    const envWithoutAudience = {
+      ...process.env,
+      GCP_STDIO: 'false',
+      PORT: '3002',
+      OAUTH_ENABLED: 'true',
+    };
+    delete envWithoutAudience.GOOGLE_OAUTH_AUDIENCE;
+
+    const exitCode = await new Promise((resolve) => {
+      const child = spawn('node', ['mcp-server.js'], {
+        cwd: process.cwd(),
+        env: envWithoutAudience,
+      });
+      child.on('exit', (code) => resolve(code));
+    });
+    assert.equal(exitCode, 1);
+  });
 });