@google-cloud/cloud-run-mcp 1.7.0 → 1.9.0

package/test/local/mcp-server-stdio.test.js

@@ -13,7 +13,6 @@ describe('MCP Server stdio startup', () => {
       stderr = '';
       serverProcess = spawn('node', ['mcp-server.js'], {
         cwd: process.cwd(),
-        env: { ...process.env, GCP_STDIO: 'true' },
       });
       stderr = await waitForString(serverProcess.stderr, stdioMsg);
     });

package/test/local/mcp-server-streamable-http.test.js

@@ -4,6 +4,11 @@ import { test, describe, before, after } from 'node:test';
 import assert from 'node:assert/strict';
 import { spawn } from 'child_process';
 import { waitForString } from './test-utils.js';
+import {
+  SCOPES,
+  BEARER_METHODS_SUPPORTED,
+  RESPONSE_TYPES_SUPPORTED,
+} from '../../constants.js';
 
 class MCPClient {
   client = null;
@@ -59,3 +64,67 @@ describe('MCP Server in Streamble HTTP mode', () => {
     });
   });
 });
+
+describe('OAuth Endpoints', () => {
+  let serverProcess;
+  let stdout = '';
+  const httpMsg = 'Cloud Run MCP server listening on port 3001';
+  const oauthProtectedResource = 'https://example.com/resource';
+  const oauthAuthorizationServer = 'https://example.com/auth';
+  const oauthAuthorizationEndpoint = 'https://example.com/auth/authorize';
+  const oauthTokenEndpoint = 'https://example.com/auth/token';
+
+  before(async () => {
+    stdout = '';
+    serverProcess = spawn('node', ['mcp-server.js'], {
+      cwd: process.cwd(),
+      env: {
+        ...process.env,
+        GCP_STDIO: 'false',
+        PORT: '3001',
+        OAUTH_PROTECTED_RESOURCE: oauthProtectedResource,
+        OAUTH_AUTHORIZATION_SERVER: oauthAuthorizationServer,
+        OAUTH_AUTHORIZATION_ENDPOINT: oauthAuthorizationEndpoint,
+        OAUTH_TOKEN_ENDPOINT: oauthTokenEndpoint,
+      },
+    });
+    stdout = await waitForString(serverProcess.stdout, httpMsg);
+  });
+
+  after(() => {
+    if (serverProcess) {
+      serverProcess.kill();
+    }
+  });
+
+  test('should return correct OAuth protected resource configuration', async () => {
+    const response = await fetch(
+      'http://localhost:3001/.well-known/oauth-protected-resource'
+    );
+    assert.equal(response.status, 200);
+    const data = await response.json();
+
+    assert.deepStrictEqual(data, {
+      resource: oauthProtectedResource,
+      authorization_servers: [oauthAuthorizationServer],
+      scopes_supported: [SCOPES.OPENID, SCOPES.EMAIL, SCOPES.CLOUD_PLATFORM],
+      bearer_methods_supported: [...BEARER_METHODS_SUPPORTED],
+    });
+  });
+
+  test('should return correct OAuth authorization server configuration', async () => {
+    const response = await fetch(
+      'http://localhost:3001/.well-known/oauth-authorization-server'
+    );
+    assert.equal(response.status, 200);
+    const data = await response.json();
+
+    assert.deepStrictEqual(data, {
+      issuer: oauthProtectedResource,
+      authorization_endpoint: oauthAuthorizationEndpoint,
+      token_endpoint: oauthTokenEndpoint,
+      scopes_supported: [SCOPES.OPENID, SCOPES.EMAIL, SCOPES.CLOUD_PLATFORM],
+      response_types_supported: [...RESPONSE_TYPES_SUPPORTED],
+    });
+  });
+});

package/test/local/mcp-server.test.js

@@ -11,6 +11,7 @@ describe('MCP Server in stdio mode', () => {
     transport = new StdioClientTransport({
       command: 'node',
       args: ['mcp-server.js'],
+      env: { ...process.env, GCP_STDIO: 'true' },
     });
     client = new Client({
       name: 'test-client',

package/test/local/middleware/oauth.test.js

@@ -0,0 +1,156 @@
+import { describe, it, mock, beforeEach, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import esmock from 'esmock';
+
+describe('oauthMiddleware', () => {
+  let req;
+  let res;
+  let next;
+  let originalEnv;
+
+  beforeEach(() => {
+    originalEnv = process.env;
+    process.env = { ...originalEnv };
+    req = {
+      headers: {},
+      body: {},
+    };
+    res = {
+      headersSent: false,
+      status: mock.fn(() => res),
+      json: mock.fn(),
+    };
+    next = mock.fn();
+  });
+
+  afterEach(() => {
+    process.env = originalEnv;
+    mock.restoreAll();
+  });
+
+  it('should call next() if OAUTH_ENABLED is not "true"', async () => {
+    process.env.OAUTH_ENABLED = 'false';
+    const { oauthMiddleware } = await esmock(
+      '../../../lib/middleware/oauth.js',
+      {}
+    );
+
+    await oauthMiddleware(req, res, next);
+
+    assert.strictEqual(next.mock.callCount(), 1);
+    assert.strictEqual(res.status.mock.callCount(), 0);
+  });
+
+  it('should call next() if method is not tools/call', async () => {
+    process.env.OAUTH_ENABLED = 'true';
+    req.body.method = 'other/method';
+
+    // We don't verify token if it's not a tool call (based on current implementation)
+    // So we don't need to mock successful verification here
+    const { oauthMiddleware } = await esmock(
+      '../../../lib/middleware/oauth.js',
+      {}
+    );
+
+    await oauthMiddleware(req, res, next);
+
+    assert.strictEqual(next.mock.callCount(), 1);
+  });
+
+  it('should return 401 if Authorization header is missing for tool call', async () => {
+    process.env.OAUTH_ENABLED = 'true';
+    req.body.method = 'tools/call';
+
+    const { oauthMiddleware } = await esmock(
+      '../../../lib/middleware/oauth.js',
+      {}
+    );
+
+    await oauthMiddleware(req, res, next);
+
+    assert.strictEqual(next.mock.callCount(), 0);
+    assert.strictEqual(res.status.mock.callCount(), 1);
+    assert.deepStrictEqual(res.status.mock.calls[0].arguments, [401]);
+    assert.strictEqual(res.json.mock.callCount(), 1);
+  });
+
+  it('should verify token and call next() for valid tool call', async () => {
+    process.env.OAUTH_ENABLED = 'true';
+    req.body.method = 'tools/call';
+    req.headers.authorization = 'Bearer valid-token';
+
+    const mockGetTokenInfo = mock.fn(async () => ({ aud: 'valid-audience' }));
+    const mockGetOAuthClient = mock.fn(async () => ({
+      getTokenInfo: mockGetTokenInfo,
+    }));
+
+    const { oauthMiddleware } = await esmock(
+      '../../../lib/middleware/oauth.js',
+      {
+        '../../../lib/clients.js': {
+          getOAuthClient: mockGetOAuthClient,
+        },
+      }
+    );
+
+    await oauthMiddleware(req, res, next);
+
+    assert.strictEqual(next.mock.callCount(), 1);
+    assert.strictEqual(mockGetOAuthClient.mock.callCount(), 1);
+    assert.strictEqual(mockGetTokenInfo.mock.callCount(), 1);
+  });
+
+  it('should return 401 if token verification fails', async () => {
+    process.env.OAUTH_ENABLED = 'true';
+    req.body.method = 'tools/call';
+    req.headers.authorization = 'Bearer invalid-token';
+
+    const mockGetOAuthClient = mock.fn(async () => ({
+      getTokenInfo: async () => {
+        throw new Error('Invalid token');
+      },
+    }));
+
+    const { oauthMiddleware } = await esmock(
+      '../../../lib/middleware/oauth.js',
+      {
+        '../../../lib/clients.js': {
+          getOAuthClient: mockGetOAuthClient,
+        },
+      }
+    );
+
+    await oauthMiddleware(req, res, next);
+
+    assert.strictEqual(next.mock.callCount(), 0);
+    assert.strictEqual(res.status.mock.callCount(), 1);
+    assert.deepStrictEqual(res.status.mock.calls[0].arguments, [401]);
+  });
+
+  it('should return 401 if audience does not match', async () => {
+    process.env.OAUTH_ENABLED = 'true';
+    process.env.GOOGLE_OAUTH_AUDIENCE = 'expected-audience';
+    req.body.method = 'tools/call';
+    req.headers.authorization = 'Bearer valid-token-wrong-audience';
+
+    const mockGetTokenInfo = mock.fn(async () => ({ aud: 'wrong-audience' }));
+    const mockGetOAuthClient = mock.fn(async () => ({
+      getTokenInfo: mockGetTokenInfo,
+    }));
+
+    const { oauthMiddleware } = await esmock(
+      '../../../lib/middleware/oauth.js',
+      {
+        '../../../lib/clients.js': {
+          getOAuthClient: mockGetOAuthClient,
+        },
+      }
+    );
+
+    await oauthMiddleware(req, res, next);
+
+    assert.strictEqual(next.mock.callCount(), 0);
+    assert.strictEqual(res.status.mock.callCount(), 1);
+    assert.deepStrictEqual(res.status.mock.calls[0].arguments, [401]);
+  });
+});

package/test/local/mock-clients.js

@@ -0,0 +1,35 @@
+import { mock } from 'node:test';
+
+/**
+ * Creates a mock Cloud Build Client.
+ * @param {object} [overrides] - Optional overrides for methods.
+ * @returns {object} A mock Cloud Build Client.
+ */
+export function getMockCloudBuildClient(overrides = {}) {
+  return {
+    createBuild:
+      overrides.createBuild ||
+      mock.fn(() =>
+        Promise.resolve([
+          {
+            metadata: {
+              build: {
+                id: 'default-mock-build-id',
+              },
+            },
+          },
+        ])
+      ),
+    getBuild:
+      overrides.getBuild ||
+      mock.fn(() =>
+        Promise.resolve([
+          {
+            id: 'default-mock-build-id',
+            status: 'SUCCESS',
+          },
+        ])
+      ),
+    ...overrides,
+  };
+}

package/test/local/tools.test.js

@@ -42,7 +42,7 @@ describe('registerTools', () => {
         {},
         {
           '../../lib/cloud-api/projects.js': {
-            listProjects: () =>
+            listProjects: (token) =>
               Promise.resolve([{ id: 'project1' }, { id: 'project2' }]),
           },
         }
@@ -433,7 +433,7 @@ describe('registerTools', () => {
           content: [
             {
               type: 'text',
-              text: 'GCP credentials are not available. Please configure your environment.',
+              text: 'GCP credentials are not available. Please configure your environment using OAuth or `gcloud auth`.',
             },
           ],
         });

package/test/need-gcp/test-helpers.js

@@ -163,7 +163,7 @@ export async function setSourceDeployProjectPermissions(projectId) {
   const context = {
     serviceUsageClient: serviceUsageClient,
   };
-  await ensureApisEnabled(context, projectId, ['run.googleapis.com']);
+  await ensureApisEnabled(projectId, ['run.googleapis.com']);
   console.log('Adding editor role to Compute SA...');
   const projectNumber = await getProjectNumber(projectId);
   const member = `serviceAccount:${projectNumber}-compute@developer.gserviceaccount.com`;

package/tools/register-tools.js

@@ -41,7 +41,7 @@ function gcpTool(gcpCredentialsAvailable, fn) {
       content: [
         {
           type: 'text',
-          text: 'GCP credentials are not available. Please configure your environment.',
+          text: 'GCP credentials are not available. Please configure your environment using OAuth or `gcloud auth`.',
         },
       ],
     });
@@ -59,7 +59,7 @@ function registerListProjectsTool(server, options) {
     },
     gcpTool(options.gcpCredentialsAvailable, async () => {
       try {
-        const projects = await listProjects();
+        const projects = await listProjects(options.accessToken);
         return {
           content: [
             {
@@ -113,7 +113,11 @@ function registerCreateProjectTool(server, options) {
         };
       }
       try {
-        const result = await createProjectAndAttachBilling(projectId);
+        const result = await createProjectAndAttachBilling(
+          projectId,
+          undefined,
+          options.accessToken
+        );
         return {
           content: [
             {
@@ -161,7 +165,7 @@ function registerListServicesTool(server, options) {
         };
       }
       try {
-        const allServices = await listServices(project);
+        const allServices = await listServices(project, options.accessToken);
         const content = [];
         for (const region of Object.keys(allServices)) {
           const serviceList = allServices[region];
@@ -230,7 +234,12 @@ function registerGetServiceTool(server, options) {
           };
         }
         try {
-          const serviceDetails = await getService(project, region, service);
+          const serviceDetails = await getService(
+            project,
+            region,
+            service,
+            options.accessToken
+          );
           if (serviceDetails) {
             return {
               content: [
@@ -299,6 +308,7 @@ function registerGetServiceLogTool(server, options) {
               project,
               region,
               service,
+              options.accessToken,
               requestOptions
             );
 
@@ -394,6 +404,7 @@ function registerDeployLocalFolderTool(server, options) {
             region: region,
             files: [folderPath],
             skipIamCheck: options.skipIamCheck, // Pass the new flag
+            accessToken: options.accessToken,
             progressCallback,
           });
           return {
@@ -495,6 +506,7 @@ function registerDeployFileContentsTool(server, options) {
             region: region,
             files: files,
             skipIamCheck: options.skipIamCheck, // Pass the new flag
+            accessToken: options.accessToken,
             progressCallback,
           });
           return {
@@ -575,6 +587,7 @@ function registerDeployContainerImageTool(server, options) {
             region: region,
             imageUrl: imageUrl,
             skipIamCheck: options.skipIamCheck,
+            accessToken: options.accessToken,
             progressCallback,
           });
           return {

package/.kokoro/kokoro_build.sh

@@ -1,22 +0,0 @@
-#!/bin/bash
-
-# Copyright 2022 Google LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Code under repo is checked out to ${KOKORO_ARTIFACTS_DIR}/git.
-# The final directory name in this path is determined by the scm name specified
-# in the job configuration.
-
-cd "${KOKORO_ARTIFACTS_DIR}/github/cloud-run-mcp"
-.kokoro/run_tests.sh

package/.kokoro/presubmit.cfg

@@ -1,21 +0,0 @@
-# -*- protobuffer -*-
-# proto-file: google3/devtools/kokoro/config/proto/build.proto
-# proto-message: BuildConfig
-
-# Location of the bash script. Should have value <github_scm.name>/<path_from_repository_root>.
-# github_scm.name is specified in the job configuration (next section).
-build_file: "cloud-run-mcp/.kokoro/kokoro_build.sh"
-
-container_properties {
-  docker_image: "us-central1-docker.pkg.dev/kokoro-container-bakery/kokoro/ubuntu/ubuntu2204/full:next"
-}
-
-env_vars {
-  key: "GOOGLE_CLOUD_PROJECT"
-  value: "cloud-run-mcp-server-testing"
-}
-
-env_vars {
-  key: "GCP_PARENT"
-  value: "folders/138095058155"
-}

package/.kokoro/run_tests.sh

@@ -1,31 +0,0 @@
-#!/bin/bash
-#
-# Copyright 2022 Google LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Fail on any error.
-set -xe
-
-# cd to project root
-cd "$(dirname "$0")"/..
-
-# Install dependencies
-npm install
-
-# Run tests
-npm run test:workflows # Run tests related to all workflows
-npm run test:projects # Run tests related to GCP projects
-npm run test:services # Run tests related to services
-npm run test:deploy # Run tests related to deployments
-npm run test:gcp-auth # Run tests related to GCP authentication