@google-cloud/cloud-run-mcp 1.10.0 → 1.12.0

package/lib/deployment/universal-maker.js

@@ -19,22 +19,18 @@ import fs from 'fs';
 import path from 'path';
 import os from 'os';
 import util from 'util';
-import crypto from 'crypto';
 import { logAndProgress } from '../util/helpers.js';
 import { TEMP_PATHS } from './constants.js';
-import { getArtifactRegistryClient } from '../clients.js';
+import { ensureRepositoryDownloaded } from '../util/artifacts.js';
 
 const execAsync = util.promisify(exec);
 
 const UNIVERSAL_MAKER_BIN = 'universal_maker';
 const UM_VERSION = '1.0.0';
 
-const AR_HOST = 'https://artifactregistry.googleapis.com';
 const AR_PROJECT = 'serverless-runtimes';
 const AR_LOCATION = 'us-central1';
 const AR_REPOSITORY = 'universal-maker';
-const AR_DOWNLOAD_PATH_PREFIX = '/download/v1/';
-const AR_DOWNLOAD_URL_SUFFIX = ':download?alt=media';
 
 const ARCH_MAPPING = {
   linux_x64: 'x86-64',
@@ -58,91 +54,19 @@ function getUniversalMakerArchitectureKey() {
 }
 
 /**
- * Checks if the existing binary is up to date by comparing its SHA256 mash with the remote metadata.
- * If the binary is out of date, it removes it.
- * @param {string} binPath - Path to the local binary.
- * @param {string} arch - Current architecture.
- * @param {string} accessToken - Access token for authentication.
+ * Runs Universal Maker on the given application directory.
+ * @param {string} appDir - Directory containing the application source.
  * @param {function} progressCallback - Progress callback.
- * @returns {Promise<boolean>} True if the binary is up to date (or if updating fails), false otherwise.
- */
-async function isBinaryUpToDate(binPath, arch, accessToken, progressCallback) {
-  if (!fs.existsSync(binPath)) {
-    return false;
-  }
-
-  try {
-    await logAndProgress(
-      'Checking for Universal Maker updates...',
-      progressCallback,
-      'debug'
-    );
-
-    const artifactRegistryClient = await getArtifactRegistryClient(
-      AR_PROJECT,
-      accessToken
-    );
-    const resourceName = artifactRegistryClient.filePath(
-      AR_PROJECT,
-      AR_LOCATION,
-      AR_REPOSITORY,
-      `${arch}:${UM_VERSION}:${UNIVERSAL_MAKER_BIN}`
-    );
-
-    const [file] = await artifactRegistryClient.getFile({ name: resourceName });
-    const remoteSha256Base64 = file.hashes?.find(
-      (h) => h.type === 'SHA256'
-    )?.value;
-
-    if (!remoteSha256Base64) {
-      return false; // Cannot verify, download new binary
-    }
-
-    const remoteSha256Hex = Buffer.from(remoteSha256Base64, 'base64').toString(
-      'hex'
-    );
-    const localFileContent = fs.readFileSync(binPath);
-    const localSha256Hex = crypto
-      .createHash('sha256')
-      .update(localFileContent)
-      .digest('hex');
-
-    if (remoteSha256Hex === localSha256Hex) {
-      await logAndProgress(
-        'Universal Maker binary is up to date.',
-        progressCallback,
-        'debug'
-      );
-      return true;
-    }
-
-    await logAndProgress(
-      'Universal Maker binary is out of date. Removing existing binary.',
-      progressCallback,
-      'debug'
-    );
-    fs.unlinkSync(binPath);
-    return false;
-  } catch (error) {
-    await logAndProgress(
-      `Could not check for Universal Maker updates: ${error.message}. Downloading the new binary.`,
-      progressCallback,
-      'debug'
-    );
-    return false; // On error, fallback to downloading the new binary
-  }
-}
-
-/**
- * Downloads the universal maker binary if it doesn't exist.
- * @param {string} binDir - Directory to store the binary.
  * @param {string} accessToken - Access token for authentication.
- * @param {function} progressCallback - Progress callback.
- * @returns {Promise<string|null>} Path to the binary or null if not supported.
+ * @returns {Promise<object|null>} The parsed build_output.json or null.
  */
-async function ensureUniversalMaker(binDir, accessToken, progressCallback) {
+export async function runUniversalMaker(appDir, accessToken, progressCallback) {
+  const binDir = path.join(
+    os.homedir(),
+    TEMP_PATHS.BASE,
+    TEMP_PATHS.BIN_SUBDIR
+  );
   const key = getUniversalMakerArchitectureKey();
-
   if (!key) {
     await logAndProgress(
       `Universal Maker is not supported on ${process.platform} ${process.arch}.`,
@@ -152,74 +76,23 @@ async function ensureUniversalMaker(binDir, accessToken, progressCallback) {
     return null;
   }
 
-  const binPath = path.join(binDir, UNIVERSAL_MAKER_BIN);
   const arch = ARCH_MAPPING[key];
+  const binPath = path.join(binDir, UNIVERSAL_MAKER_BIN);
 
-  if (await isBinaryUpToDate(binPath, arch, accessToken, progressCallback)) {
-    return binPath;
-  }
-
-  await logAndProgress(`Downloading Universal Maker...`, progressCallback);
-
-  try {
-    if (!fs.existsSync(binDir)) {
-      fs.mkdirSync(binDir, { recursive: true });
-    }
-
-    const artifactRegistryClient = await getArtifactRegistryClient(
-      AR_PROJECT,
-      accessToken
-    );
-    const resourceName = artifactRegistryClient.filePath(
-      AR_PROJECT,
-      AR_LOCATION,
-      AR_REPOSITORY,
-      `${arch}:${UM_VERSION}:${UNIVERSAL_MAKER_BIN}`
-    );
-
-    const url = `${AR_HOST}${AR_DOWNLOAD_PATH_PREFIX}${resourceName}${AR_DOWNLOAD_URL_SUFFIX}`;
-    const response = await artifactRegistryClient.auth.request({
-      url,
-      responseType: 'stream',
-    });
-
-    const dest = fs.createWriteStream(binPath);
-    await new Promise((resolve, reject) => {
-      response.data.pipe(dest).on('finish', resolve).on('error', reject);
-    });
-
-    fs.chmodSync(binPath, '755');
-    return binPath;
-  } catch (error) {
-    await logAndProgress(
-      `Failed to download Universal Maker: ${error.message}`,
-      progressCallback,
-      'debug'
-    );
-    return null;
-  }
-}
-
-/**
- * Runs Universal Maker on the given application directory.
- * @param {string} appDir - Directory containing the application source.
- * @param {function} progressCallback - Progress callback.
- * @param {string} accessToken - Access token for authentication.
- * @returns {Promise<object|null>} The parsed build_output.json or null.
- */
-export async function runUniversalMaker(appDir, accessToken, progressCallback) {
-  const binDir = path.join(
-    os.homedir(),
-    TEMP_PATHS.BASE,
-    TEMP_PATHS.BIN_SUBDIR
-  );
-  const binPath = await ensureUniversalMaker(
-    binDir,
+  const binPathResult = await ensureRepositoryDownloaded(
+    binPath,
+    {
+      project: AR_PROJECT,
+      location: AR_LOCATION,
+      repository: AR_REPOSITORY,
+      artifactPath: `${arch}:${UM_VERSION}:${UNIVERSAL_MAKER_BIN}`,
+      displayName: 'Universal Maker',
+    },
     accessToken,
     progressCallback
   );
 
-  if (!binPath) {
+  if (!binPathResult) {
     return null;
   }
 

package/lib/middleware/oauth.js

@@ -1,8 +1,6 @@
-import { getOAuthClient } from '../clients.js';
+import { clients, getOAuthClient } from '../clients.js';
 import { extractAccessToken } from '../util/helpers.js';
 
-const TOOLS_CALL_METHOD = 'tools/call';
-
 /**
  * Verifies the validity of an access token and checks the audience.
  * @param {string} accessToken - The access token to verify.
@@ -16,13 +14,14 @@ async function verifyAccessToken(accessToken, audience) {
     const tokenInfo = await client.getTokenInfo(accessToken);
 
     //An expired token will not have audience
-    if (audience && tokenInfo.aud !== audience) {
-      throw new Error(`Invalid audience: expected ${audience}`);
+    if (!audience || tokenInfo.aud !== audience) {
+      throw new Error('Invalid token audience');
     }
 
     console.log('Access token verified successfully.');
     return tokenInfo;
   } catch (error) {
+    clients.oauth.delete(accessToken);
     console.error('Error verifying access token:', error);
     throw error;
   }
@@ -43,11 +42,19 @@ async function ensureOAuthTokenInEnv(req, res) {
       console.log('No authorization header found in request');
       throw new Error('No authorization header');
     }
+    const accessToken = extractAccessToken(req.headers.authorization);
+    if (!accessToken) {
+      console.log('No access token found in authorization header');
+      throw new Error('No access token found in authorization header');
+    }
+    if (!audience) {
+      console.log('GOOGLE_OAUTH_AUDIENCE environment variable is missing');
+      throw new Error(
+        'GOOGLE_OAUTH_AUDIENCE environment variable is required when OAuth is enabled.'
+      );
+    }
     console.log('Authorization header found.. Verifying token');
-    await verifyAccessToken(
-      extractAccessToken(req.headers.authorization),
-      audience
-    );
+    await verifyAccessToken(accessToken, audience);
     console.log('Token verified');
   } catch (error) {
     console.error('Authentication failed: ', error);
@@ -64,11 +71,8 @@ async function ensureOAuthTokenInEnv(req, res) {
  * @param {import('express').NextFunction} next
  */
 export const oauthMiddleware = async (req, res, next) => {
-  //If OAUTH_ENABLED is not true or the request is not a tools/call, skip the middleware
-  if (
-    process.env.OAUTH_ENABLED !== 'true' ||
-    req.body.method !== TOOLS_CALL_METHOD
-  ) {
+  //If OAUTH_ENABLED is not true, skip the middleware
+  if (process.env.OAUTH_ENABLED !== 'true') {
     return next();
   }
 
@@ -79,12 +83,19 @@ export const oauthMiddleware = async (req, res, next) => {
     console.error('OAuth Middleware Error:', error);
     // ensureOAuthTokenInEnv throws an error if auth fails.
     // We catch it and send a 401 response.
+    if (process.env.OAUTH_PROTECTED_RESOURCE) {
+      const metadataUrl = new URL(
+        '/.well-known/oauth-protected-resource',
+        process.env.OAUTH_PROTECTED_RESOURCE
+      ).href;
+      res.set('WWW-Authenticate', `Bearer resource_metadata="${metadataUrl}"`);
+    }
     res.status(401).json({
       jsonrpc: '2.0',
       error: {
         code: -32001, // Custom auth error code or standard -32000
         message: 'Authentication failed',
-        data: error.message,
+        data: 'Invalid or missing access token',
       },
       id: null,
     });

package/lib/util/archive.js

@@ -31,7 +31,7 @@ import { logAndProgress } from './helpers.js';
 export async function zipFiles(files, useTarGz, progressCallback) {
   const path = await import('path');
   const fs = await import('fs');
-  const archiver = (await import('archiver')).default;
+  const { TarArchive, ZipArchive } = await import('archiver');
 
   return new Promise((resolve, reject) => {
     logAndProgress('Creating in-memory archive...', progressCallback);
@@ -39,11 +39,11 @@ export async function zipFiles(files, useTarGz, progressCallback) {
 
     let archive;
     if (useTarGz) {
-      archive = archiver('tar', {
+      archive = new TarArchive({
         gzip: { level: 9 },
       });
     } else {
-      archive = archiver('zip', {
+      archive = new ZipArchive({
         zlib: { level: 9 },
       });
     }

package/lib/util/artifacts.js

@@ -0,0 +1,189 @@
+/*
+Copyright 2025 Google LLC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import fs from 'fs';
+import path from 'path';
+import crypto from 'crypto';
+import { logAndProgress } from './helpers.js';
+import { getArtifactRegistryClient } from '../clients.js';
+
+const AR_HOST = 'https://artifactregistry.googleapis.com';
+const AR_DOWNLOAD_PATH_PREFIX = '/download/v1/';
+const AR_DOWNLOAD_URL_SUFFIX = ':download?alt=media';
+
+/**
+ * Checks if the existing binary is up to date by comparing its SHA256 hash with the remote metadata.
+ * If the binary is out of date, it removes it.
+ * @param {string} binPath - Path to the local binary.
+ * @param {object} artifactParams - Parameters for the remote artifact.
+ * @param {string} artifactParams.project - Artifact Registry project.
+ * @param {string} artifactParams.location - Artifact Registry location.
+ * @param {string} artifactParams.repository - Artifact Registry repository.
+ * @param {string} artifactParams.artifactPath - Path to the artifact within the repository.
+ * @param {string} artifactParams.displayName - A friendly name for logging.
+ * @param {string} accessToken - Access token for authentication.
+ * @param {function} progressCallback - Progress callback.
+ * @returns {Promise<boolean>} True if the binary is up to date, false otherwise.
+ */
+export async function isBinaryUpToDate(
+  binPath,
+  artifactParams,
+  accessToken,
+  progressCallback
+) {
+  const { project, location, repository, artifactPath, displayName } =
+    artifactParams;
+
+  if (!fs.existsSync(binPath)) {
+    return false;
+  }
+
+  try {
+    await logAndProgress(
+      `Checking for ${displayName} updates...`,
+      progressCallback,
+      'debug'
+    );
+
+    const artifactRegistryClient = await getArtifactRegistryClient(
+      project,
+      accessToken
+    );
+    const resourceName = artifactRegistryClient.filePath(
+      project,
+      location,
+      repository,
+      artifactPath
+    );
+
+    const [file] = await artifactRegistryClient.getFile({ name: resourceName });
+    const remoteSha256Base64 = file.hashes?.find(
+      (h) => h.type === 'SHA256'
+    )?.value;
+
+    if (!remoteSha256Base64) {
+      return false; // Cannot verify, download new binary
+    }
+
+    const remoteSha256Hex = Buffer.from(remoteSha256Base64, 'base64').toString(
+      'hex'
+    );
+    const localFileContent = fs.readFileSync(binPath);
+    const localSha256Hex = crypto
+      .createHash('sha256')
+      .update(localFileContent)
+      .digest('hex');
+
+    if (remoteSha256Hex === localSha256Hex) {
+      await logAndProgress(
+        `${displayName} binary is up to date.`,
+        progressCallback,
+        'debug'
+      );
+      return true;
+    }
+
+    await logAndProgress(
+      `${displayName} binary is out of date. Removing existing binary.`,
+      progressCallback,
+      'debug'
+    );
+    fs.unlinkSync(binPath);
+    return false;
+  } catch (error) {
+    await logAndProgress(
+      `Could not check for ${displayName} updates: ${error.message}. Downloading the new binary.`,
+      progressCallback,
+      'debug'
+    );
+    return false; // On error, fallback to downloading the new binary
+  }
+}
+
+/**
+ * Downloads a binary from Artifact Registry if it doesn't exist or is out of date.
+ * @param {string} binPath - Path where the binary should be stored.
+ * @param {object} artifactParams - Parameters for the remote artifact.
+ * @param {string} artifactParams.project - Artifact Registry project.
+ * @param {string} artifactParams.location - Artifact Registry location.
+ * @param {string} artifactParams.repository - Artifact Registry repository.
+ * @param {string} artifactParams.artifactPath - Path to the artifact within the repository.
+ * @param {string} artifactParams.displayName - A friendly name for logging.
+ * @param {string} accessToken - Access token for authentication.
+ * @param {function} progressCallback - Progress callback.
+ * @returns {Promise<string|null>} Path to the binary or null if it fails.
+ */
+export async function ensureRepositoryDownloaded(
+  binPath,
+  artifactParams,
+  accessToken,
+  progressCallback
+) {
+  const { project, location, repository, artifactPath, displayName } =
+    artifactParams;
+  const binDir = path.dirname(binPath);
+
+  if (
+    await isBinaryUpToDate(
+      binPath,
+      artifactParams,
+      accessToken,
+      progressCallback
+    )
+  ) {
+    return binPath;
+  }
+
+  await logAndProgress(`Downloading ${displayName}...`, progressCallback);
+
+  try {
+    if (!fs.existsSync(binDir)) {
+      fs.mkdirSync(binDir, { recursive: true });
+    }
+
+    const artifactRegistryClient = await getArtifactRegistryClient(
+      project,
+      accessToken
+    );
+    const resourceName = artifactRegistryClient.filePath(
+      project,
+      location,
+      repository,
+      artifactPath
+    );
+
+    const url = `${AR_HOST}${AR_DOWNLOAD_PATH_PREFIX}${resourceName}${AR_DOWNLOAD_URL_SUFFIX}`;
+    const response = await artifactRegistryClient.auth.request({
+      url,
+      responseType: 'stream',
+    });
+
+    const dest = fs.createWriteStream(binPath);
+    await new Promise((resolve, reject) => {
+      response.data.pipe(dest).on('finish', resolve).on('error', reject);
+    });
+
+    fs.chmodSync(binPath, '755');
+    return binPath;
+  } catch (error) {
+    await logAndProgress(
+      `Failed to download ${displayName}: ${error.message}`,
+      progressCallback,
+      'debug'
+    );
+    return null;
+  }
+}

package/lib/util/helpers.js

@@ -14,6 +14,11 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
+import { getProjectsClient } from '../clients.js';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+
 /**
  * Helper function to log a message and call the progress callback.
  * @param {string} message - The message to log.
@@ -52,3 +57,107 @@ export function extractAccessToken(authorizationHeader) {
   }
   return authorizationHeader.split(' ')[1];
 }
+
+/**
+ * Gets the project number for a given project ID.
+ * @param {string} projectId - The Google Cloud project ID.
+ * @param {string} accessToken - Access token for authentication.
+ * @returns {Promise<string>} The project number.
+ */
+export async function getProjectNumber(projectId, accessToken) {
+  const projectsClient = await getProjectsClient(accessToken);
+  const [project] = await projectsClient.getProject({
+    name: `projects/${projectId}`,
+  });
+  // project.name is in the format "projects/123456"
+  const parts = project.name.split('/');
+  return parts.length > 1 ? parts[1] : project.projectNumber;
+}
+
+/**
+ * Calculates a SHA256 fingerprint of a directory.
+ * Matches the logic in gcloud run compose builder.py.
+ * @param {string} dirPath - The directory to fingerprint.
+ * @returns {Promise<string>} The SHA256 hex digest.
+ */
+export async function calculateSourceFingerprint(dirPath) {
+  const hash = crypto.createHash('sha256');
+
+  // Helper for recursive walk matching Python's deterministic order
+  async function walk(currentDir) {
+    const entries = await fs.promises.readdir(currentDir, {
+      withFileTypes: true,
+    });
+
+    // Sort entries to match deterministic order (dirs and files sorted)
+    entries.sort((a, b) => a.name.localeCompare(b.name));
+
+    // Handle files first (matching filenames.sort() in builder.py's walk)
+    for (const entry of entries) {
+      if (entry.isFile()) {
+        const filePath = path.join(currentDir, entry.name);
+        const relPath = path.relative(dirPath, filePath);
+
+        // Update hash with relative path
+        hash.update(relPath);
+
+        // Update hash with file content
+        const content = await fs.promises.readFile(filePath);
+        hash.update(content);
+      }
+    }
+
+    // Then recurse into directories
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        await walk(path.join(currentDir, entry.name));
+      }
+    }
+  }
+
+  await walk(dirPath);
+  return hash.digest('hex');
+}
+
+/**
+ * Sanitizes a string for use as a Cloud Run service name.
+ * Only lowercase, digits, and hyphens are allowed.
+ * Must begin with a letter and cannot end with a hyphen.
+ * @param {string} name - The name to sanitize.
+ * @returns {string} The sanitized name.
+ */
+export function sanitizeCloudRunServiceName(name) {
+  let sanitized = name
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-') // Replace non-alphanumeric with hyphen
+    .replace(/^-+|-+$/g, ''); // Remove leading/trailing hyphens
+
+  // Ensure it starts with a letter if possible
+  if (sanitized.length > 0 && !/^[a-z]/.test(sanitized)) {
+    sanitized = 's-' + sanitized;
+  }
+
+  // Cap at 49 characters (Cloud Run limit is usually 50-63 depending on API, 49 is safe)
+  return sanitized.slice(0, 49).replace(/-$/, '');
+}
+
+/**
+ * Sanitizes a string to be a valid GCP label value.
+ * Label values must be:
+ * - <= 63 characters.
+ * - Contain only lowercase letters, numbers, underscores, and dashes.
+ * @param {string} value - The string to sanitize.
+ * @returns {string} A valid GCP label value string.
+ */
+export function sanitizeLabelValue(value) {
+  if (value === undefined || value === null) {
+    return '';
+  }
+  const stringValue = String(value);
+  if (stringValue === '') {
+    return '';
+  }
+  let sanitized = stringValue.toLowerCase();
+  sanitized = sanitized.replace(/[^a-z0-9_-]/g, '-');
+  return sanitized.slice(0, 63);
+}