@google-cloud/cloud-run-mcp 1.8.0 → 1.10.0

package/test/local/middleware/oauth.test.js

@@ -0,0 +1,156 @@
+import { describe, it, mock, beforeEach, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import esmock from 'esmock';
+
+describe('oauthMiddleware', () => {
+  let req;
+  let res;
+  let next;
+  let originalEnv;
+
+  beforeEach(() => {
+    originalEnv = process.env;
+    process.env = { ...originalEnv };
+    req = {
+      headers: {},
+      body: {},
+    };
+    res = {
+      headersSent: false,
+      status: mock.fn(() => res),
+      json: mock.fn(),
+    };
+    next = mock.fn();
+  });
+
+  afterEach(() => {
+    process.env = originalEnv;
+    mock.restoreAll();
+  });
+
+  it('should call next() if OAUTH_ENABLED is not "true"', async () => {
+    process.env.OAUTH_ENABLED = 'false';
+    const { oauthMiddleware } = await esmock(
+      '../../../lib/middleware/oauth.js',
+      {}
+    );
+
+    await oauthMiddleware(req, res, next);
+
+    assert.strictEqual(next.mock.callCount(), 1);
+    assert.strictEqual(res.status.mock.callCount(), 0);
+  });
+
+  it('should call next() if method is not tools/call', async () => {
+    process.env.OAUTH_ENABLED = 'true';
+    req.body.method = 'other/method';
+
+    // We don't verify token if it's not a tool call (based on current implementation)
+    // So we don't need to mock successful verification here
+    const { oauthMiddleware } = await esmock(
+      '../../../lib/middleware/oauth.js',
+      {}
+    );
+
+    await oauthMiddleware(req, res, next);
+
+    assert.strictEqual(next.mock.callCount(), 1);
+  });
+
+  it('should return 401 if Authorization header is missing for tool call', async () => {
+    process.env.OAUTH_ENABLED = 'true';
+    req.body.method = 'tools/call';
+
+    const { oauthMiddleware } = await esmock(
+      '../../../lib/middleware/oauth.js',
+      {}
+    );
+
+    await oauthMiddleware(req, res, next);
+
+    assert.strictEqual(next.mock.callCount(), 0);
+    assert.strictEqual(res.status.mock.callCount(), 1);
+    assert.deepStrictEqual(res.status.mock.calls[0].arguments, [401]);
+    assert.strictEqual(res.json.mock.callCount(), 1);
+  });
+
+  it('should verify token and call next() for valid tool call', async () => {
+    process.env.OAUTH_ENABLED = 'true';
+    req.body.method = 'tools/call';
+    req.headers.authorization = 'Bearer valid-token';
+
+    const mockGetTokenInfo = mock.fn(async () => ({ aud: 'valid-audience' }));
+    const mockGetOAuthClient = mock.fn(async () => ({
+      getTokenInfo: mockGetTokenInfo,
+    }));
+
+    const { oauthMiddleware } = await esmock(
+      '../../../lib/middleware/oauth.js',
+      {
+        '../../../lib/clients.js': {
+          getOAuthClient: mockGetOAuthClient,
+        },
+      }
+    );
+
+    await oauthMiddleware(req, res, next);
+
+    assert.strictEqual(next.mock.callCount(), 1);
+    assert.strictEqual(mockGetOAuthClient.mock.callCount(), 1);
+    assert.strictEqual(mockGetTokenInfo.mock.callCount(), 1);
+  });
+
+  it('should return 401 if token verification fails', async () => {
+    process.env.OAUTH_ENABLED = 'true';
+    req.body.method = 'tools/call';
+    req.headers.authorization = 'Bearer invalid-token';
+
+    const mockGetOAuthClient = mock.fn(async () => ({
+      getTokenInfo: async () => {
+        throw new Error('Invalid token');
+      },
+    }));
+
+    const { oauthMiddleware } = await esmock(
+      '../../../lib/middleware/oauth.js',
+      {
+        '../../../lib/clients.js': {
+          getOAuthClient: mockGetOAuthClient,
+        },
+      }
+    );
+
+    await oauthMiddleware(req, res, next);
+
+    assert.strictEqual(next.mock.callCount(), 0);
+    assert.strictEqual(res.status.mock.callCount(), 1);
+    assert.deepStrictEqual(res.status.mock.calls[0].arguments, [401]);
+  });
+
+  it('should return 401 if audience does not match', async () => {
+    process.env.OAUTH_ENABLED = 'true';
+    process.env.GOOGLE_OAUTH_AUDIENCE = 'expected-audience';
+    req.body.method = 'tools/call';
+    req.headers.authorization = 'Bearer valid-token-wrong-audience';
+
+    const mockGetTokenInfo = mock.fn(async () => ({ aud: 'wrong-audience' }));
+    const mockGetOAuthClient = mock.fn(async () => ({
+      getTokenInfo: mockGetTokenInfo,
+    }));
+
+    const { oauthMiddleware } = await esmock(
+      '../../../lib/middleware/oauth.js',
+      {
+        '../../../lib/clients.js': {
+          getOAuthClient: mockGetOAuthClient,
+        },
+      }
+    );
+
+    await oauthMiddleware(req, res, next);
+
+    assert.strictEqual(next.mock.callCount(), 0);
+    assert.strictEqual(res.status.mock.callCount(), 1);
+    assert.deepStrictEqual(res.status.mock.calls[0].arguments, [401]);
+  });
+});

package/test/local/source-processor.test.js

@@ -75,171 +75,6 @@ describe('Source Processor', () => {
     assert.ok(cpCall, 'Should call cp -R for directories');
   });
 
-  test('installDependencies runs npm install for Node.js', async () => {
-    // We need to mock fs.existsSync as well
-    const fsMock = {
-      existsSync: mock.fn(),
-    };
-
-    const sourceProcessor = await esmock(
-      '../../lib/deployment/source-processor.js',
-      {
-        'node:fs': fsMock,
-        'node:fs/promises': fspMock,
-        'node:child_process': childProcessMock,
-      }
-    );
-
-    const targetDir = '/temp/dir';
-    const deploymentAttrs = {
-      runtime: 'nodejs',
-      cmd: ['node', 'server.js'],
-      args: ['server.js'],
-      baseImage: 'node:22',
-    };
-    const progressCallback = mock.fn();
-
-    // Mock existsSync
-    fsMock.existsSync.mock.mockImplementation((p) => {
-      if (p.includes('node_modules')) return false; // not installed yet
-      if (p.includes('package-lock.json')) return false; // no lock file
-      return false;
-    });
-
-    // Mock exec for npm install
-    childProcessMock.exec.mock.mockImplementation((cmd, opts, callback) => {
-      if (typeof opts === 'function') callback = opts;
-      if (callback) callback(null, 'ok', '');
-    });
-
-    await sourceProcessor.installDependencies(
-      targetDir,
-      deploymentAttrs,
-      progressCallback
-    );
-
-    const calls = childProcessMock.exec.mock.calls;
-    const npmCall = calls.find((call) =>
-      call.arguments[0].includes('npm install')
-    );
-    assert.ok(npmCall, 'Should run npm install');
-    assert.strictEqual(npmCall.arguments[1].cwd, targetDir);
-  });
-
-  test('installDependencies uses npm ci if lockfile exists', async () => {
-    const fsMock = {
-      existsSync: mock.fn(),
-    };
-
-    const sourceProcessor = await esmock(
-      '../../lib/deployment/source-processor.js',
-      {
-        'node:fs': fsMock,
-        'node:child_process': childProcessMock,
-      }
-    );
-
-    const targetDir = '/temp/dir';
-    const deploymentAttrs = {
-      runtime: 'nodejs',
-      cmd: ['node', 'server.js'],
-      args: ['server.js'],
-      baseImage: 'node:22',
-    };
-
-    // Mock existsSync
-    fsMock.existsSync.mock.mockImplementation((p) => {
-      if (p.includes('node_modules')) return false;
-      if (p.includes('package-lock.json')) return true; // has lock file
-      return false;
-    });
-
-    childProcessMock.exec.mock.mockImplementation((cmd, opts, callback) => {
-      if (typeof opts === 'function') callback = opts;
-      if (callback) callback(null, 'ok', '');
-    });
-
-    await sourceProcessor.installDependencies(
-      targetDir,
-      deploymentAttrs,
-      () => {}
-    );
-
-    const calls = childProcessMock.exec.mock.calls;
-    const npmCall = calls.find((call) => call.arguments[0].includes('npm ci'));
-    assert.ok(npmCall, 'Should run npm ci');
-  });
-
-  test('installDependencies skips if node_modules exists', async () => {
-    const fsMock = {
-      existsSync: mock.fn(),
-    };
-
-    const sourceProcessor = await esmock(
-      '../../lib/deployment/source-processor.js',
-      {
-        'node:fs': fsMock,
-        'node:child_process': childProcessMock,
-      }
-    );
-
-    fsMock.existsSync.mock.mockImplementation((p) => {
-      if (p.includes('node_modules')) return true;
-      return false;
-    });
-
-    // clear mock calls
-    childProcessMock.exec.mock.resetCalls();
-
-    await sourceProcessor.installDependencies(
-      '/dir',
-      {
-        runtime: 'nodejs',
-        cmd: ['node', 'server.js'],
-        args: ['server.js'],
-        baseImage: 'node:22',
-      },
-      () => {}
-    );
-
-    assert.equal(childProcessMock.exec.mock.callCount(), 0);
-  });
-
-  test('installDependencies logs warn on failure but does not throw', async () => {
-    const fsMock = { existsSync: mock.fn(() => false) };
-    const sourceProcessor = await esmock(
-      '../../lib/deployment/source-processor.js',
-      {
-        'node:fs': fsMock,
-        'node:child_process': childProcessMock,
-      }
-    );
-
-    childProcessMock.exec.mock.mockImplementation((cmd, opts, callback) => {
-      if (typeof opts === 'function') callback = opts;
-      callback(new Error('npm failed'));
-    });
-
-    const consoleLogMock = mock.method(console, 'log');
-
-    await assert.doesNotReject(async () => {
-      await sourceProcessor.installDependencies('/dir', { runtime: 'nodejs' });
-    });
-
-    assert.equal(
-      consoleLogMock.mock.callCount(),
-      1,
-      'console.log should be called once'
-    );
-    const logArgs = consoleLogMock.mock.calls[0].arguments;
-    assert.ok(
-      logArgs[0].includes('Dependency installation failed: npm failed'),
-      'console.log should contain the error message'
-    );
-
-    consoleLogMock.mock.restore();
-  });
-
   test('cleanupTempDirectory removes directory', async () => {
     const fsMock = {
       existsSync: mock.fn(() => true),

package/test/local/tools.test.js

@@ -42,7 +42,7 @@ describe('registerTools', () => {
         {},
         {
           '../../lib/cloud-api/projects.js': {
-            listProjects: () =>
+            listProjects: (token) =>
               Promise.resolve([{ id: 'project1' }, { id: 'project2' }]),
           },
         }
@@ -433,7 +433,7 @@ describe('registerTools', () => {
           content: [
             {
               type: 'text',
-              text: 'GCP credentials are not available. Please configure your environment.',
+              text: 'GCP credentials are not available. Please configure your environment using OAuth or `gcloud auth`.',
             },
           ],
         });

package/test/local/universal-maker.test.js

@@ -0,0 +1,248 @@
+/*
+Copyright 2025 Google LLC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { test, describe, mock } from 'node:test';
+import assert from 'node:assert/strict';
+import esmock from 'esmock';
+
+describe('Universal Maker', () => {
+  const fsMock = {
+    existsSync: mock.fn(),
+    mkdirSync: mock.fn(),
+    chmodSync: mock.fn(),
+    readFileSync: mock.fn(),
+    rmSync: mock.fn(),
+    unlinkSync: mock.fn(),
+    createWriteStream: mock.fn(),
+  };
+
+  const cryptoMock = {
+    createHash: mock.fn(),
+  };
+
+  const childProcessMock = {
+    exec: mock.fn(),
+  };
+
+  const osMock = {
+    homedir: () => '/home/user',
+    tmpdir: () => '/tmp',
+  };
+
+  const helpersMock = {
+    logAndProgress: mock.fn(),
+  };
+
+  const clientsMock = {
+    getArtifactRegistryClient: mock.fn(),
+  };
+
+  test('runUniversalMaker skips download if binary exists and runs successfully', async () => {
+    fsMock.existsSync.mock.resetCalls();
+    fsMock.readFileSync.mock.resetCalls();
+    childProcessMock.exec.mock.resetCalls();
+
+    const localContent = 'local content';
+    const sha256 =
+      'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855';
+
+    cryptoMock.createHash.mock.mockImplementation(() => ({
+      update: mock.fn(() => ({
+        digest: mock.fn(() => sha256),
+      })),
+    }));
+
+    // Mock binary exists
+    fsMock.existsSync.mock.mockImplementation((p) => {
+      if (p.includes('universal_maker')) return true;
+      if (p.includes('build_output.json')) return true;
+      return false;
+    });
+
+    fsMock.readFileSync.mock.mockImplementation((p) => {
+      if (p.includes('universal_maker')) return localContent;
+      if (p.includes('build_output.json')) {
+        return JSON.stringify({
+          command: 'node',
+          args: ['index.js'],
+          runtime: 'nodejs20',
+          envVars: { DEBUG: 'true' },
+        });
+      }
+      return '';
+    });
+
+    // Mock Artifact Registry client
+    const artifactRegistryClientMock = {
+      filePath: mock.fn(
+        (p, l, r, f) =>
+          `projects/${p}/locations/${l}/repositories/${r}/files/${f}`
+      ),
+      getFile: mock.fn(() => [
+        {
+          hashes: [
+            {
+              type: 'SHA256',
+              value: Buffer.from(sha256, 'hex').toString('base64'),
+            },
+          ],
+        },
+      ]),
+    };
+    clientsMock.getArtifactRegistryClient.mock.mockImplementation(
+      () => artifactRegistryClientMock
+    );
+
+    const um = await esmock('../../lib/deployment/universal-maker.js', {
+      fs: fsMock,
+      child_process: childProcessMock,
+      os: osMock,
+      crypto: cryptoMock,
+      '../../lib/util/helpers.js': helpersMock,
+      '../../lib/clients.js': clientsMock,
+    });
+
+    // Mock exec only for binary execution
+    childProcessMock.exec.mock.mockImplementation((cmd, cb) => {
+      cb(null, { stdout: '', stderr: '' });
+    });
+
+    // runUniversalMaker(appDir, accessToken, progressCallback)
+    const result = await um.runUniversalMaker(
+      '/app/dir',
+      'fake-token',
+      mock.fn()
+    );
+
+    assert.ok(result);
+    assert.equal(result.command, 'node');
+    assert.deepEqual(result.args, ['index.js']);
+    assert.equal(result.runtime, 'nodejs20');
+
+    // Verify bin check was performed
+    const binExistsCall = fsMock.existsSync.mock.calls.find((c) =>
+      c.arguments[0].includes('universal_maker')
+    );
+    assert.ok(binExistsCall);
+  });
+
+  test('runUniversalMaker downloads binary if missing', async () => {
+    fsMock.existsSync.mock.resetCalls();
+    fsMock.readFileSync.mock.resetCalls();
+    childProcessMock.exec.mock.resetCalls();
+
+    let downloaded = false;
+
+    // Mock binary missing first, then exists after "download"
+    fsMock.existsSync.mock.mockImplementation((p) => {
+      if (p.includes('universal_maker')) return downloaded;
+      if (p.includes('build_output.json')) return true;
+      return true; // for dir checks
+    });
+
+    // Mock Artifact Registry client for download
+    const artifactRegistryClientMock = {
+      filePath: mock.fn(
+        (p, l, r, f) =>
+          `projects/${p}/locations/${l}/repositories/${r}/files/${f}`
+      ),
+      getFile: mock.fn(() => [{ hashes: [] }]), // trigger download
+      auth: {
+        request: mock.fn(() => {
+          downloaded = true;
+          return {
+            data: {
+              pipe: (dest) => {
+                setTimeout(() => dest.emit('finish'), 10);
+                return dest;
+              },
+            },
+          };
+        }),
+      },
+    };
+    clientsMock.getArtifactRegistryClient.mock.mockImplementation(
+      () => artifactRegistryClientMock
+    );
+
+    const writeStreamMock = {
+      on: mock.fn(function (event, cb) {
+        if (event === 'finish') this.finishCb = cb;
+        return this;
+      }),
+      emit: mock.fn(function (event) {
+        if (event === 'finish' && this.finishCb) this.finishCb();
+      }),
+      pipeFrom: mock.fn(),
+    };
+    fsMock.createWriteStream = mock.fn(() => writeStreamMock);
+
+    fsMock.readFileSync.mock.mockImplementation(() =>
+      JSON.stringify({ command: 'npm', args: ['start'] })
+    );
+
+    const um = await esmock('../../lib/deployment/universal-maker.js', {
+      fs: fsMock,
+      child_process: childProcessMock,
+      os: osMock,
+      crypto: cryptoMock,
+      '../../lib/util/helpers.js': helpersMock,
+      '../../lib/clients.js': clientsMock,
+    });
+
+    // Mock exec only for binary execution
+    childProcessMock.exec.mock.mockImplementation((cmd, cb) => {
+      cb(null, { stdout: '', stderr: '' });
+    });
+
+    // runUniversalMaker(appDir, accessToken, progressCallback)
+    const result = await um.runUniversalMaker(
+      '/app/dir',
+      'fake-token',
+      mock.fn()
+    );
+
+    assert.ok(result);
+    assert.equal(result.command, 'npm');
+    assert.ok(downloaded);
+  });
+
+  test('runUniversalMaker returns null if binary not supported on platform', async () => {
+    // Save original platform
+    const originalPlatform = process.platform;
+    Object.defineProperty(process, 'platform', { value: 'win32' });
+
+    try {
+      const um = await esmock('../../lib/deployment/universal-maker.js', {
+        fs: fsMock,
+        child_process: childProcessMock,
+        os: osMock,
+        crypto: cryptoMock,
+        '../../lib/util/helpers.js': helpersMock,
+        '../../lib/clients.js': clientsMock,
+      });
+
+      const result = await um.runUniversalMaker(
+        '/app/dir',
+        'fake-token',
+        mock.fn()
+      );
+      assert.equal(result, null);
+    } finally {
+      Object.defineProperty(process, 'platform', { value: originalPlatform });
+    }
+  });
+});

package/tools/register-tools.js

@@ -41,7 +41,7 @@ function gcpTool(gcpCredentialsAvailable, fn) {
       content: [
         {
           type: 'text',
-          text: 'GCP credentials are not available. Please configure your environment.',
+          text: 'GCP credentials are not available. Please configure your environment using OAuth or `gcloud auth`.',
         },
       ],
     });
@@ -59,7 +59,7 @@ function registerListProjectsTool(server, options) {
     },
     gcpTool(options.gcpCredentialsAvailable, async () => {
       try {
-        const projects = await listProjects();
+        const projects = await listProjects(options.accessToken);
         return {
           content: [
             {
@@ -113,7 +113,11 @@ function registerCreateProjectTool(server, options) {
         };
       }
       try {
-        const result = await createProjectAndAttachBilling(projectId);
+        const result = await createProjectAndAttachBilling(
+          projectId,
+          undefined,
+          options.accessToken
+        );
         return {
           content: [
             {
@@ -161,7 +165,7 @@ function registerListServicesTool(server, options) {
         };
       }
       try {
-        const allServices = await listServices(project);
+        const allServices = await listServices(project, options.accessToken);
         const content = [];
         for (const region of Object.keys(allServices)) {
           const serviceList = allServices[region];
@@ -230,7 +234,12 @@ function registerGetServiceTool(server, options) {
           };
         }
         try {
-          const serviceDetails = await getService(project, region, service);
+          const serviceDetails = await getService(
+            project,
+            region,
+            service,
+            options.accessToken
+          );
           if (serviceDetails) {
             return {
               content: [
@@ -299,6 +308,7 @@ function registerGetServiceLogTool(server, options) {
               project,
               region,
               service,
+              options.accessToken,
               requestOptions
             );
 
@@ -394,6 +404,7 @@ function registerDeployLocalFolderTool(server, options) {
             region: region,
             files: [folderPath],
             skipIamCheck: options.skipIamCheck, // Pass the new flag
+            accessToken: options.accessToken,
             progressCallback,
           });
           return {
@@ -495,6 +506,7 @@ function registerDeployFileContentsTool(server, options) {
             region: region,
             files: files,
             skipIamCheck: options.skipIamCheck, // Pass the new flag
+            accessToken: options.accessToken,
             progressCallback,
           });
           return {
@@ -575,6 +587,7 @@ function registerDeployContainerImageTool(server, options) {
             region: region,
             imageUrl: imageUrl,
             skipIamCheck: options.skipIamCheck,
+            accessToken: options.accessToken,
             progressCallback,
           });
           return {

package/.kokoro/kokoro_build.sh

@@ -1,22 +0,0 @@
-#!/bin/bash
-
-# Copyright 2022 Google LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Code under repo is checked out to ${KOKORO_ARTIFACTS_DIR}/git.
-# The final directory name in this path is determined by the scm name specified
-# in the job configuration.
-
-cd "${KOKORO_ARTIFACTS_DIR}/github/cloud-run-mcp"
-.kokoro/run_tests.sh