@google-cloud/cloud-run-mcp 1.10.0 → 1.12.0

package/test/local/middleware/oauth.test.js

@@ -17,6 +17,7 @@ describe('oauthMiddleware', () => {
     };
     res = {
       headersSent: false,
+      set: mock.fn(),
       status: mock.fn(() => res),
       json: mock.fn(),
     };
@@ -41,12 +42,10 @@ describe('oauthMiddleware', () => {
     assert.strictEqual(res.status.mock.callCount(), 0);
   });
 
-  it('should call next() if method is not tools/call', async () => {
+  it('should return 401 if Authorization header is missing even when method is not tools/call', async () => {
     process.env.OAUTH_ENABLED = 'true';
     req.body.method = 'other/method';
 
-    // We don't verify token if it's not a tool call (based on current implementation)
-    // So we don't need to mock successful verification here
     const { oauthMiddleware } = await esmock(
       '../../../lib/middleware/oauth.js',
       {}
@@ -54,7 +53,61 @@ describe('oauthMiddleware', () => {
 
     await oauthMiddleware(req, res, next);
 
-    assert.strictEqual(next.mock.callCount(), 1);
+    assert.strictEqual(next.mock.callCount(), 0);
+    assert.strictEqual(res.status.mock.callCount(), 1);
+    assert.deepStrictEqual(res.status.mock.calls[0].arguments, [401]);
+    assert.strictEqual(res.json.mock.callCount(), 1);
+  });
+
+  it('should return 401 if Authorization header is missing when req.body is a JSON array', async () => {
+    process.env.OAUTH_ENABLED = 'true';
+    req.body = [{ jsonrpc: '2.0', method: 'tools/call', id: 1 }];
+
+    const { oauthMiddleware } = await esmock(
+      '../../../lib/middleware/oauth.js',
+      {}
+    );
+
+    await oauthMiddleware(req, res, next);
+
+    assert.strictEqual(next.mock.callCount(), 0);
+    assert.strictEqual(res.status.mock.callCount(), 1);
+    assert.deepStrictEqual(res.status.mock.calls[0].arguments, [401]);
+    assert.strictEqual(res.json.mock.callCount(), 1);
+  });
+
+  it('should return 401 if Authorization header is missing when req.body is undefined (e.g. GET /sse)', async () => {
+    process.env.OAUTH_ENABLED = 'true';
+    req.body = undefined;
+
+    const { oauthMiddleware } = await esmock(
+      '../../../lib/middleware/oauth.js',
+      {}
+    );
+
+    await oauthMiddleware(req, res, next);
+
+    assert.strictEqual(next.mock.callCount(), 0);
+    assert.strictEqual(res.status.mock.callCount(), 1);
+    assert.deepStrictEqual(res.status.mock.calls[0].arguments, [401]);
+    assert.strictEqual(res.json.mock.callCount(), 1);
+  });
+
+  it('should return 401 if Authorization header has no token value', async () => {
+    process.env.OAUTH_ENABLED = 'true';
+    req.headers.authorization = 'Bearer';
+
+    const { oauthMiddleware } = await esmock(
+      '../../../lib/middleware/oauth.js',
+      {}
+    );
+
+    await oauthMiddleware(req, res, next);
+
+    assert.strictEqual(next.mock.callCount(), 0);
+    assert.strictEqual(res.status.mock.callCount(), 1);
+    assert.deepStrictEqual(res.status.mock.calls[0].arguments, [401]);
+    assert.strictEqual(res.json.mock.callCount(), 1);
   });
 
   it('should return 401 if Authorization header is missing for tool call', async () => {
@@ -74,8 +127,27 @@ describe('oauthMiddleware', () => {
     assert.strictEqual(res.json.mock.callCount(), 1);
   });
 
+  it('should return 401 if GOOGLE_OAUTH_AUDIENCE is missing when OAUTH_ENABLED is "true"', async () => {
+    process.env.OAUTH_ENABLED = 'true';
+    delete process.env.GOOGLE_OAUTH_AUDIENCE;
+    req.body.method = 'tools/call';
+    req.headers.authorization = 'Bearer valid-token';
+
+    const { oauthMiddleware } = await esmock(
+      '../../../lib/middleware/oauth.js',
+      {}
+    );
+
+    await oauthMiddleware(req, res, next);
+
+    assert.strictEqual(next.mock.callCount(), 0);
+    assert.strictEqual(res.status.mock.callCount(), 1);
+    assert.deepStrictEqual(res.status.mock.calls[0].arguments, [401]);
+  });
+
   it('should verify token and call next() for valid tool call', async () => {
     process.env.OAUTH_ENABLED = 'true';
+    process.env.GOOGLE_OAUTH_AUDIENCE = 'valid-audience';
     req.body.method = 'tools/call';
     req.headers.authorization = 'Bearer valid-token';
 
@@ -102,6 +174,7 @@ describe('oauthMiddleware', () => {
 
   it('should return 401 if token verification fails', async () => {
     process.env.OAUTH_ENABLED = 'true';
+    process.env.GOOGLE_OAUTH_AUDIENCE = 'valid-audience';
     req.body.method = 'tools/call';
     req.headers.authorization = 'Bearer invalid-token';
 
@@ -127,12 +200,13 @@ describe('oauthMiddleware', () => {
     assert.deepStrictEqual(res.status.mock.calls[0].arguments, [401]);
   });
 
-  it('should return 401 if audience does not match', async () => {
+  it('should return 401 if audience does not match and remove token from oauth cache', async () => {
     process.env.OAUTH_ENABLED = 'true';
     process.env.GOOGLE_OAUTH_AUDIENCE = 'expected-audience';
     req.body.method = 'tools/call';
     req.headers.authorization = 'Bearer valid-token-wrong-audience';
 
+    const mockOAuthMap = new Map([['valid-token-wrong-audience', {}]]);
     const mockGetTokenInfo = mock.fn(async () => ({ aud: 'wrong-audience' }));
     const mockGetOAuthClient = mock.fn(async () => ({
       getTokenInfo: mockGetTokenInfo,
@@ -142,6 +216,7 @@ describe('oauthMiddleware', () => {
       '../../../lib/middleware/oauth.js',
       {
         '../../../lib/clients.js': {
+          clients: { oauth: mockOAuthMap },
           getOAuthClient: mockGetOAuthClient,
         },
       }
@@ -152,5 +227,31 @@ describe('oauthMiddleware', () => {
     assert.strictEqual(next.mock.callCount(), 0);
     assert.strictEqual(res.status.mock.callCount(), 1);
     assert.deepStrictEqual(res.status.mock.calls[0].arguments, [401]);
+    assert.strictEqual(mockOAuthMap.has('valid-token-wrong-audience'), false);
+    assert.strictEqual(
+      res.json.mock.calls[0].arguments[0].error.data,
+      'Invalid or missing access token'
+    );
+  });
+
+  it('should set WWW-Authenticate header on 401 when OAUTH_PROTECTED_RESOURCE is set', async () => {
+    process.env.OAUTH_ENABLED = 'true';
+    process.env.OAUTH_PROTECTED_RESOURCE = 'https://example.com/resource';
+
+    const { oauthMiddleware } = await esmock(
+      '../../../lib/middleware/oauth.js',
+      {}
+    );
+
+    await oauthMiddleware(req, res, next);
+
+    assert.strictEqual(next.mock.callCount(), 0);
+    assert.strictEqual(res.set.mock.callCount(), 1);
+    assert.deepStrictEqual(res.set.mock.calls[0].arguments, [
+      'WWW-Authenticate',
+      'Bearer resource_metadata="https://example.com/.well-known/oauth-protected-resource"',
+    ]);
+    assert.strictEqual(res.status.mock.callCount(), 1);
+    assert.deepStrictEqual(res.status.mock.calls[0].arguments, [401]);
   });
 });

package/test/local/test-utils.js

@@ -1,19 +1,3 @@
-/*
-Copyright 2025 Google LLC
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    https://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
 /**
  * Waits for a specific string to appear in a stream's output.
  * This is useful for synchronizing tests with asynchronous child processes,
@@ -22,11 +6,11 @@ limitations under the License.
  *
  * @param {ReadableStream} stream - The stream to listen to (e.g., process.stdout or process.stderr).
  * @param {string} str - The string to wait for in the stream's output.
- * @param {number} [timeoutMs=7000] - The maximum time in milliseconds to wait before rejecting.
+ * @param {number} [timeoutMs=10000] - The maximum time in milliseconds to wait before rejecting.
  * @returns {Promise<string>} A promise that resolves with the accumulated data
  *   when the string is found, or rejects if the timeout is reached.
  */
-export async function waitForString(stream, str, timeoutMs = 7000) {
+export async function waitForString(stream, str, timeoutMs = 10000) {
   let accumulatedData = '';
   return new Promise((resolve, reject) => {
     const timeout = setTimeout(() => {

package/test/local/tools.test.js

@@ -207,6 +207,7 @@ describe('registerTools', () => {
                 name: 'my-service',
                 uri: 'my-uri',
                 lastModifier: 'me',
+                updateTime: { seconds: '1735732800', nanos: 0 }, // 2025-01-01T12:00:00Z
               }),
           },
         }
@@ -223,11 +224,12 @@ describe('registerTools', () => {
         service: 'my-service',
       });
 
+      const expectedDate = new Date('2025-01-01T12:00:00Z').toUTCString();
       assert.deepStrictEqual(result, {
         content: [
           {
             type: 'text',
-            text: 'Name: my-service\nRegion: my-region\nProject: my-project\nURL: my-uri\nLast deployed by: me',
+            text: `Name: my-service\nRegion: my-region\nProject: my-project\nURL: my-uri\nConsole URL: https://console.cloud.google.com/run/detail/my-region/my-service?project=my-project\nLast deployed by: me\nLast deployed date: ${expectedDate}`,
           },
         ],
       });
@@ -324,6 +326,46 @@ describe('registerTools', () => {
         ],
       });
     });
+
+    it('should deploy local folder with ingress', async () => {
+      const server = {
+        registerTool: mock.fn(),
+      };
+      const deployMock = mock.fn(() => Promise.resolve({ uri: 'my-uri' }));
+
+      const { registerTools } = await esmock(
+        '../../tools/tools.js',
+        {},
+        {
+          '../../lib/deployment/deployer.js': {
+            deploy: deployMock,
+          },
+        }
+      );
+
+      registerTools(server, {
+        gcpCredentialsAvailable: true,
+        ingress: 'INGRESS_TRAFFIC_INTERNAL_ONLY',
+      });
+
+      const handler = server.registerTool.mock.calls.find(
+        (call) => call.arguments[0] === 'deploy_local_folder'
+      ).arguments[2];
+      await handler(
+        {
+          project: 'my-project',
+          region: 'my-region',
+          service: 'my-service',
+          folderPath: '/my/folder',
+        },
+        { sendNotification: mock.fn() }
+      );
+
+      assert.strictEqual(
+        deployMock.mock.calls[0].arguments[0].ingress,
+        'INGRESS_TRAFFIC_INTERNAL_ONLY'
+      );
+    });
   });
 
   describe('deploy_file_contents', () => {

package/test/local/universal-maker.test.js

@@ -22,15 +22,8 @@ describe('Universal Maker', () => {
   const fsMock = {
     existsSync: mock.fn(),
     mkdirSync: mock.fn(),
-    chmodSync: mock.fn(),
     readFileSync: mock.fn(),
     rmSync: mock.fn(),
-    unlinkSync: mock.fn(),
-    createWriteStream: mock.fn(),
-  };
-
-  const cryptoMock = {
-    createHash: mock.fn(),
   };
 
   const childProcessMock = {
@@ -46,34 +39,27 @@ describe('Universal Maker', () => {
     logAndProgress: mock.fn(),
   };
 
-  const clientsMock = {
-    getArtifactRegistryClient: mock.fn(),
+  const artifactsMock = {
+    ensureRepositoryDownloaded: mock.fn(),
   };
 
   test('runUniversalMaker skips download if binary exists and runs successfully', async () => {
     fsMock.existsSync.mock.resetCalls();
     fsMock.readFileSync.mock.resetCalls();
     childProcessMock.exec.mock.resetCalls();
+    artifactsMock.ensureRepositoryDownloaded.mock.resetCalls();
 
-    const localContent = 'local content';
-    const sha256 =
-      'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855';
-
-    cryptoMock.createHash.mock.mockImplementation(() => ({
-      update: mock.fn(() => ({
-        digest: mock.fn(() => sha256),
-      })),
-    }));
+    // Mock binary exists and is up to date
+    artifactsMock.ensureRepositoryDownloaded.mock.mockImplementation(
+      () => '/home/user/.cloud-run-mcp/bin/universal_maker'
+    );
 
-    // Mock binary exists
     fsMock.existsSync.mock.mockImplementation((p) => {
-      if (p.includes('universal_maker')) return true;
       if (p.includes('build_output.json')) return true;
       return false;
     });
 
     fsMock.readFileSync.mock.mockImplementation((p) => {
-      if (p.includes('universal_maker')) return localContent;
       if (p.includes('build_output.json')) {
         return JSON.stringify({
           command: 'node',
@@ -85,34 +71,12 @@ describe('Universal Maker', () => {
       return '';
     });
 
-    // Mock Artifact Registry client
-    const artifactRegistryClientMock = {
-      filePath: mock.fn(
-        (p, l, r, f) =>
-          `projects/${p}/locations/${l}/repositories/${r}/files/${f}`
-      ),
-      getFile: mock.fn(() => [
-        {
-          hashes: [
-            {
-              type: 'SHA256',
-              value: Buffer.from(sha256, 'hex').toString('base64'),
-            },
-          ],
-        },
-      ]),
-    };
-    clientsMock.getArtifactRegistryClient.mock.mockImplementation(
-      () => artifactRegistryClientMock
-    );
-
     const um = await esmock('../../lib/deployment/universal-maker.js', {
       fs: fsMock,
       child_process: childProcessMock,
       os: osMock,
-      crypto: cryptoMock,
       '../../lib/util/helpers.js': helpersMock,
-      '../../lib/clients.js': clientsMock,
+      '../../lib/util/artifacts.js': artifactsMock,
     });
 
     // Mock exec only for binary execution
@@ -132,92 +96,38 @@ describe('Universal Maker', () => {
     assert.deepEqual(result.args, ['index.js']);
     assert.equal(result.runtime, 'nodejs20');
 
-    // Verify bin check was performed
-    const binExistsCall = fsMock.existsSync.mock.calls.find((c) =>
-      c.arguments[0].includes('universal_maker')
+    // Verify ensureRepositoryDownloaded was called
+    assert.strictEqual(
+      artifactsMock.ensureRepositoryDownloaded.mock.callCount(),
+      1
     );
-    assert.ok(binExistsCall);
   });
 
-  test('runUniversalMaker downloads binary if missing', async () => {
-    fsMock.existsSync.mock.resetCalls();
-    fsMock.readFileSync.mock.resetCalls();
-    childProcessMock.exec.mock.resetCalls();
-
-    let downloaded = false;
-
-    // Mock binary missing first, then exists after "download"
-    fsMock.existsSync.mock.mockImplementation((p) => {
-      if (p.includes('universal_maker')) return downloaded;
-      if (p.includes('build_output.json')) return true;
-      return true; // for dir checks
-    });
-
-    // Mock Artifact Registry client for download
-    const artifactRegistryClientMock = {
-      filePath: mock.fn(
-        (p, l, r, f) =>
-          `projects/${p}/locations/${l}/repositories/${r}/files/${f}`
-      ),
-      getFile: mock.fn(() => [{ hashes: [] }]), // trigger download
-      auth: {
-        request: mock.fn(() => {
-          downloaded = true;
-          return {
-            data: {
-              pipe: (dest) => {
-                setTimeout(() => dest.emit('finish'), 10);
-                return dest;
-              },
-            },
-          };
-        }),
-      },
-    };
-    clientsMock.getArtifactRegistryClient.mock.mockImplementation(
-      () => artifactRegistryClientMock
-    );
-
-    const writeStreamMock = {
-      on: mock.fn(function (event, cb) {
-        if (event === 'finish') this.finishCb = cb;
-        return this;
-      }),
-      emit: mock.fn(function (event) {
-        if (event === 'finish' && this.finishCb) this.finishCb();
-      }),
-      pipeFrom: mock.fn(),
-    };
-    fsMock.createWriteStream = mock.fn(() => writeStreamMock);
-
-    fsMock.readFileSync.mock.mockImplementation(() =>
-      JSON.stringify({ command: 'npm', args: ['start'] })
+  test('runUniversalMaker behaves correctly when binary fails to download', async () => {
+    artifactsMock.ensureRepositoryDownloaded.mock.resetCalls();
+    artifactsMock.ensureRepositoryDownloaded.mock.mockImplementation(
+      () => null
     );
 
     const um = await esmock('../../lib/deployment/universal-maker.js', {
       fs: fsMock,
       child_process: childProcessMock,
       os: osMock,
-      crypto: cryptoMock,
       '../../lib/util/helpers.js': helpersMock,
-      '../../lib/clients.js': clientsMock,
-    });
-
-    // Mock exec only for binary execution
-    childProcessMock.exec.mock.mockImplementation((cmd, cb) => {
-      cb(null, { stdout: '', stderr: '' });
+      '../../lib/util/artifacts.js': artifactsMock,
     });
 
-    // runUniversalMaker(appDir, accessToken, progressCallback)
     const result = await um.runUniversalMaker(
       '/app/dir',
       'fake-token',
       mock.fn()
     );
 
-    assert.ok(result);
-    assert.equal(result.command, 'npm');
-    assert.ok(downloaded);
+    assert.equal(result, null);
+    assert.strictEqual(
+      artifactsMock.ensureRepositoryDownloaded.mock.callCount(),
+      1
+    );
   });
 
   test('runUniversalMaker returns null if binary not supported on platform', async () => {
@@ -230,9 +140,8 @@ describe('Universal Maker', () => {
         fs: fsMock,
         child_process: childProcessMock,
         os: osMock,
-        crypto: cryptoMock,
         '../../lib/util/helpers.js': helpersMock,
-        '../../lib/clients.js': clientsMock,
+        '../../lib/util/artifacts.js': artifactsMock,
       });
 
       const result = await um.runUniversalMaker(