@zereight/mcp-gitlab 2.0.11 → 2.0.18

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -0,0 +1,442 @@
1
+ import { describe, test, after, before } from 'node:test';
2
+ import assert from 'node:assert';
3
+ import { launchServer, findAvailablePort, TransportMode, HOST } from './utils/server-launcher.js';
4
+ import { MockGitLabServer, findMockServerPort } from './utils/mock-gitlab-server.js';
5
+ import { CustomHeaderClient } from './clients/custom-header-client.js';
6
+ const MOCK_TOKEN_DEFAULT = 'glpat-mock-token-default';
7
+ const MOCK_TOKEN_HEADER = 'glpat-mock-token-header';
8
+ describe('Dynamic Routing and Authentication Scenarios', () => {
9
+ const originalToken = process.env.GITLAB_TOKEN_TEST;
10
+ before(() => {
11
+ process.env.GITLAB_TOKEN_TEST = 'mock-token-for-launcher';
12
+ });
13
+ after(() => {
14
+ if (originalToken) {
15
+ process.env.GITLAB_TOKEN_TEST = originalToken;
16
+ }
17
+ else {
18
+ delete process.env.GITLAB_TOKEN_TEST;
19
+ }
20
+ });
21
+ // Scenario 1: remote=off, dynamic=off
22
+ describe('Scenario 1: Remote Auth OFF, Dynamic URL OFF', () => {
23
+ let mcpServer;
24
+ let mcpUrl;
25
+ let mockServer;
26
+ const originalProjectId = process.env.TEST_PROJECT_ID;
27
+ before(async () => {
28
+ // Ensure GITLAB_TOKEN_TEST matches what we expect for this scenario
29
+ // to avoid launchServer overwriting GITLAB_PERSONAL_ACCESS_TOKEN with a different value
30
+ process.env.GITLAB_TOKEN_TEST = MOCK_TOKEN_DEFAULT;
31
+ process.env.TEST_PROJECT_ID = '1';
32
+ const mockPort = await findMockServerPort(9021);
33
+ mockServer = new MockGitLabServer({ port: mockPort, validTokens: [MOCK_TOKEN_DEFAULT] });
34
+ await mockServer.start();
35
+ const mcpPort = await findAvailablePort(3021);
36
+ mcpServer = await launchServer({
37
+ mode: TransportMode.STREAMABLE_HTTP,
38
+ port: mcpPort,
39
+ env: {
40
+ GITLAB_API_URL: `${mockServer.getUrl()}/api/v4`,
41
+ GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN_DEFAULT,
42
+ REMOTE_AUTHORIZATION: "false",
43
+ ENABLE_DYNAMIC_API_URL: "false",
44
+ GITLAB_TOKEN_TEST: MOCK_TOKEN_DEFAULT,
45
+ },
46
+ });
47
+ mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
48
+ });
49
+ after(async () => {
50
+ if (originalProjectId) {
51
+ process.env.TEST_PROJECT_ID = originalProjectId;
52
+ }
53
+ else {
54
+ delete process.env.TEST_PROJECT_ID;
55
+ }
56
+ if (mcpServer)
57
+ mcpServer.kill();
58
+ if (mockServer)
59
+ await mockServer.stop();
60
+ });
61
+ test('should ignore headers and use startup config', async () => {
62
+ mockServer.addMockHandler('get', '/projects/1', (req, res) => {
63
+ // index.ts uses Authorization header by default unless GITLAB_IS_OLD is set
64
+ assert.strictEqual(req.headers['authorization'], `Bearer ${MOCK_TOKEN_DEFAULT}`);
65
+ res.json({ id: 1, default_branch: 'main' });
66
+ });
67
+ const client = new CustomHeaderClient({
68
+ headers: {
69
+ 'authorization': `Bearer ${MOCK_TOKEN_HEADER}`, // This should be ignored
70
+ 'X-GitLab-API-URL': 'http://localhost:9999/api/v4', // This should be ignored
71
+ }
72
+ });
73
+ await client.connect(mcpUrl);
74
+ const result = await client.callTool('get_project', { project_id: "1" });
75
+ assert.ok(result, 'Should get a result from the tool call');
76
+ await client.disconnect();
77
+ });
78
+ });
79
+ // Scenario 2: remote=on, dynamic=off
80
+ describe('Scenario 2: Remote Auth ON, Dynamic URL OFF', () => {
81
+ let mcpServer;
82
+ let mcpUrl;
83
+ let mockServer;
84
+ before(async () => {
85
+ const mockPort = await findMockServerPort(9022);
86
+ mockServer = new MockGitLabServer({ port: mockPort, validTokens: [MOCK_TOKEN_HEADER] });
87
+ await mockServer.start();
88
+ const mcpPort = await findAvailablePort(3022);
89
+ mcpServer = await launchServer({
90
+ mode: TransportMode.STREAMABLE_HTTP,
91
+ port: mcpPort,
92
+ env: {
93
+ GITLAB_API_URL: `${mockServer.getUrl()}/api/v4`,
94
+ REMOTE_AUTHORIZATION: "true",
95
+ ENABLE_DYNAMIC_API_URL: "false",
96
+ },
97
+ });
98
+ mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
99
+ });
100
+ after(async () => {
101
+ if (mcpServer)
102
+ mcpServer.kill();
103
+ if (mockServer)
104
+ await mockServer.stop();
105
+ });
106
+ test('should use token from header and ignore dynamic URL', async () => {
107
+ mockServer.addMockHandler('get', '/projects/1', (req, res) => {
108
+ assert.strictEqual(req.headers['authorization'], `Bearer ${MOCK_TOKEN_HEADER}`);
109
+ res.json({ id: 1, default_branch: 'main' });
110
+ });
111
+ const client = new CustomHeaderClient({
112
+ headers: {
113
+ 'authorization': `Bearer ${MOCK_TOKEN_HEADER}`,
114
+ 'X-GitLab-API-URL': 'http://localhost:9999/api/v4', // This should be ignored
115
+ }
116
+ });
117
+ await client.connect(mcpUrl);
118
+ const result = await client.callTool('get_project', { project_id: "1" });
119
+ assert.ok(result, 'Should get a result from the tool call');
120
+ await client.disconnect();
121
+ });
122
+ });
123
+ // Scenario 3: remote=off, dynamic=on - should be an error
124
+ describe('Scenario 3: Remote Auth OFF, Dynamic URL ON (Error Case)', () => {
125
+ test('should fail to start with an error', async () => {
126
+ await assert.rejects(launchServer({
127
+ mode: TransportMode.STREAMABLE_HTTP,
128
+ port: await findAvailablePort(3023),
129
+ env: {
130
+ REMOTE_AUTHORIZATION: "false",
131
+ ENABLE_DYNAMIC_API_URL: "true",
132
+ GITLAB_TOKEN_TEST: "mock-token", // Required to bypass launcher check
133
+ },
134
+ }), (err) => {
135
+ // The server process exits with code 1, which launchServer catches and throws as a generic error
136
+ // We can't easily see the stderr output here without modifying launchServer,
137
+ // so we accept the exit code 1 error as success for this negative test.
138
+ return err.message.includes('Server process exited with code 1');
139
+ });
140
+ });
141
+ });
142
+ // Scenario 4: remote=on, dynamic=on
143
+ describe('Scenario 4: Remote Auth ON, Dynamic URL ON', () => {
144
+ let mcpServer;
145
+ let mcpUrl;
146
+ let defaultMockServer;
147
+ let headerMockServer;
148
+ before(async () => {
149
+ const defaultPort = await findMockServerPort(9024);
150
+ defaultMockServer = new MockGitLabServer({ port: defaultPort, validTokens: [MOCK_TOKEN_DEFAULT, MOCK_TOKEN_HEADER] });
151
+ await defaultMockServer.start();
152
+ const headerPort = await findMockServerPort(9025);
153
+ headerMockServer = new MockGitLabServer({ port: headerPort, validTokens: [MOCK_TOKEN_DEFAULT, MOCK_TOKEN_HEADER] });
154
+ await headerMockServer.start();
155
+ const mcpPort = await findAvailablePort(3024);
156
+ mcpServer = await launchServer({
157
+ mode: TransportMode.STREAMABLE_HTTP,
158
+ port: mcpPort,
159
+ env: {
160
+ GITLAB_API_URL: `${defaultMockServer.getUrl()}/api/v4`,
161
+ GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN_DEFAULT,
162
+ REMOTE_AUTHORIZATION: "true",
163
+ ENABLE_DYNAMIC_API_URL: "true",
164
+ },
165
+ });
166
+ mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
167
+ });
168
+ after(async () => {
169
+ if (mcpServer)
170
+ mcpServer.kill();
171
+ if (defaultMockServer)
172
+ await defaultMockServer.stop();
173
+ if (headerMockServer)
174
+ await headerMockServer.stop();
175
+ });
176
+ test('should use default URL and token when no headers are provided', async () => {
177
+ defaultMockServer.addMockHandler('get', '/projects/1', (req, res) => {
178
+ assert.strictEqual(req.headers['private-token'], MOCK_TOKEN_DEFAULT);
179
+ res.json(createMockProject(1, 'default-server'));
180
+ });
181
+ const client = new CustomHeaderClient({ headers: { 'private-token': MOCK_TOKEN_DEFAULT } });
182
+ await client.connect(mcpUrl);
183
+ const result = await client.callTool('get_project', { project_id: "1" });
184
+ const resultContent = JSON.parse(result.content[0].text);
185
+ assert.strictEqual(resultContent.description, 'default-server');
186
+ await client.disconnect();
187
+ });
188
+ test('should use custom URL from header and default token', async () => {
189
+ headerMockServer.addMockHandler('get', '/projects/2', (req, res) => {
190
+ assert.strictEqual(req.headers['private-token'], MOCK_TOKEN_DEFAULT);
191
+ res.json(createMockProject(2, 'header-server'));
192
+ });
193
+ const client = new CustomHeaderClient({
194
+ headers: {
195
+ 'private-token': MOCK_TOKEN_DEFAULT,
196
+ 'X-GitLab-API-URL': `${headerMockServer.getUrl()}/api/v4`,
197
+ }
198
+ });
199
+ await client.connect(mcpUrl);
200
+ const result = await client.callTool('get_project', { project_id: "2" });
201
+ const resultContent = JSON.parse(result.content[0].text);
202
+ assert.strictEqual(resultContent.description, 'header-server');
203
+ await client.disconnect();
204
+ });
205
+ test('should use custom URL and token from headers', async () => {
206
+ headerMockServer.addMockHandler('get', '/projects/3', (req, res) => {
207
+ assert.strictEqual(req.headers['authorization'], `Bearer ${MOCK_TOKEN_HEADER}`);
208
+ res.json(createMockProject(3, 'header-server-with-header-token'));
209
+ });
210
+ const client = new CustomHeaderClient({
211
+ headers: {
212
+ 'authorization': `Bearer ${MOCK_TOKEN_HEADER}`,
213
+ 'X-GitLab-API-URL': `${headerMockServer.getUrl()}/api/v4`,
214
+ }
215
+ });
216
+ await client.connect(mcpUrl);
217
+ const result = await client.callTool('get_project', { project_id: "3" });
218
+ const resultContent = JSON.parse(result.content[0].text);
219
+ assert.strictEqual(resultContent.description, 'header-server-with-header-token');
220
+ await client.disconnect();
221
+ });
222
+ test('should work with multiple tool calls', async () => {
223
+ const client = new CustomHeaderClient({
224
+ headers: {
225
+ 'authorization': `Bearer ${MOCK_TOKEN_HEADER}`,
226
+ 'X-GitLab-API-URL': `${headerMockServer.getUrl()}/api/v4`,
227
+ }
228
+ });
229
+ await client.connect(mcpUrl);
230
+ await validateToolCalls(client, headerMockServer, MOCK_TOKEN_HEADER);
231
+ await client.disconnect();
232
+ });
233
+ });
234
+ });
235
+ // Helper functions to create schema-compliant mock objects
236
+ function createMockUser() {
237
+ return {
238
+ id: 1,
239
+ username: 'mock_user',
240
+ name: 'Mock User',
241
+ state: 'active',
242
+ avatar_url: 'https://example.com/avatar.png',
243
+ web_url: 'https://example.com/mock_user'
244
+ };
245
+ }
246
+ function createMockProject(id, description = 'Mock Project') {
247
+ return {
248
+ id,
249
+ name: `Project ${id}`,
250
+ path_with_namespace: `group/project-${id}`,
251
+ description,
252
+ visibility: 'private',
253
+ web_url: `https://gitlab.example.com/group/project-${id}`,
254
+ created_at: '2024-01-01T00:00:00Z',
255
+ last_activity_at: '2024-01-01T00:00:00Z',
256
+ default_branch: 'main',
257
+ namespace: {
258
+ id: 1,
259
+ name: 'Group',
260
+ path: 'group',
261
+ kind: 'group',
262
+ full_path: 'group',
263
+ web_url: 'https://gitlab.example.com/group'
264
+ }
265
+ };
266
+ }
267
+ function createMockIssue(id, projectId) {
268
+ return {
269
+ id,
270
+ iid: id,
271
+ project_id: projectId,
272
+ title: `Issue ${id}`,
273
+ description: 'Description',
274
+ state: 'opened',
275
+ created_at: '2024-01-01T00:00:00Z',
276
+ updated_at: '2024-01-01T00:00:00Z',
277
+ closed_at: null,
278
+ web_url: `https://gitlab.example.com/group/project-${projectId}/issues/${id}`,
279
+ author: createMockUser(),
280
+ assignees: [],
281
+ labels: [],
282
+ milestone: null,
283
+ user_notes_count: 0,
284
+ upvotes: 0,
285
+ downvotes: 0,
286
+ confidential: false
287
+ };
288
+ }
289
+ function createMockMergeRequest(id, projectId) {
290
+ return {
291
+ id,
292
+ iid: id,
293
+ project_id: projectId,
294
+ title: `MR ${id}`,
295
+ description: 'Description',
296
+ state: 'opened',
297
+ created_at: '2024-01-01T00:00:00Z',
298
+ updated_at: '2024-01-01T00:00:00Z',
299
+ merged_at: null,
300
+ closed_at: null,
301
+ merge_commit_sha: null,
302
+ web_url: `https://gitlab.example.com/group/project-${projectId}/merge_requests/${id}`,
303
+ author: createMockUser(),
304
+ source_branch: 'feature',
305
+ target_branch: 'main',
306
+ draft: false,
307
+ work_in_progress: false,
308
+ merge_status: 'can_be_merged'
309
+ };
310
+ }
311
+ function createMockPipeline(id, projectId) {
312
+ return {
313
+ id,
314
+ project_id: projectId,
315
+ sha: 'sha123',
316
+ ref: 'main',
317
+ status: 'success',
318
+ created_at: '2024-01-01T00:00:00Z',
319
+ updated_at: '2024-01-01T00:00:00Z',
320
+ web_url: `https://gitlab.example.com/group/project-${projectId}/pipelines/${id}`,
321
+ user: createMockUser()
322
+ };
323
+ }
324
+ function createMockCommit(id) {
325
+ return {
326
+ id,
327
+ short_id: id.substring(0, 8),
328
+ title: 'Commit message',
329
+ author_name: 'Mock User',
330
+ author_email: 'mock@example.com',
331
+ authored_date: '2024-01-01T00:00:00Z',
332
+ committer_name: 'Mock User',
333
+ committer_email: 'mock@example.com',
334
+ committed_date: '2024-01-01T00:00:00Z',
335
+ message: 'Commit message',
336
+ parent_ids: [],
337
+ web_url: `https://gitlab.example.com/commit/${id}`
338
+ };
339
+ }
340
+ function createMockLabel(id) {
341
+ return {
342
+ id,
343
+ name: `Label ${id}`,
344
+ color: '#FF0000',
345
+ text_color: '#FFFFFF',
346
+ description: 'Label description',
347
+ open_issues_count: 0,
348
+ closed_issues_count: 0,
349
+ open_merge_requests_count: 0,
350
+ subscribed: false,
351
+ priority: null,
352
+ is_project_label: true
353
+ };
354
+ }
355
+ function createMockTreeItem(id) {
356
+ return {
357
+ id,
358
+ name: 'file.txt',
359
+ type: 'blob',
360
+ path: 'file.txt',
361
+ mode: '100644'
362
+ };
363
+ }
364
+ async function validateToolCalls(client, mockServer, expectedToken) {
365
+ const toolsToTest = [
366
+ { name: 'get_project', params: { project_id: '1' } },
367
+ { name: 'list_issues', params: { project_id: '1' } },
368
+ { name: 'get_merge_request', params: { project_id: '1', merge_request_iid: '1' } },
369
+ { name: 'list_merge_requests', params: { project_id: '1' } },
370
+ { name: 'get_repository_tree', params: { project_id: '1' } },
371
+ { name: 'list_labels', params: { project_id: '1' } },
372
+ { name: 'list_pipelines', params: { project_id: '1' } },
373
+ { name: 'list_commits', params: { project_id: '1' } },
374
+ ];
375
+ for (const tool of toolsToTest) {
376
+ mockServer.clearCustomHandlers();
377
+ let mockPath = '';
378
+ let mockResponse;
379
+ switch (tool.name) {
380
+ case 'get_project':
381
+ mockPath = '/projects/1';
382
+ mockResponse = createMockProject(1, 'mock-response');
383
+ break;
384
+ case 'list_issues':
385
+ mockPath = '/projects/1/issues';
386
+ mockResponse = [createMockIssue(1, 1)];
387
+ break;
388
+ case 'get_merge_request':
389
+ mockPath = '/projects/1/merge_requests/1';
390
+ mockResponse = createMockMergeRequest(1, 1);
391
+ break;
392
+ case 'list_merge_requests':
393
+ mockPath = '/projects/1/merge_requests';
394
+ mockResponse = [createMockMergeRequest(1, 1)];
395
+ break;
396
+ case 'get_repository_tree':
397
+ mockPath = '/projects/1/repository/tree';
398
+ mockResponse = [createMockTreeItem('blob1')];
399
+ break;
400
+ case 'list_labels':
401
+ mockPath = '/projects/1/labels';
402
+ mockResponse = [createMockLabel(1)];
403
+ break;
404
+ case 'list_pipelines':
405
+ mockPath = '/projects/1/pipelines';
406
+ mockResponse = [createMockPipeline(1, 1)];
407
+ break;
408
+ case 'list_commits':
409
+ mockPath = '/projects/1/repository/commits';
410
+ mockResponse = [createMockCommit('sha1')];
411
+ break;
412
+ default:
413
+ throw new Error(`Unknown tool: ${tool.name}`);
414
+ }
415
+ mockServer.addMockHandler('get', mockPath, (req, res) => {
416
+ if (req.headers['authorization']) {
417
+ assert.strictEqual(req.headers['authorization'], `Bearer ${expectedToken}`);
418
+ }
419
+ else {
420
+ assert.strictEqual(req.headers['private-token'], expectedToken);
421
+ }
422
+ res.json(mockResponse);
423
+ });
424
+ const result = await client.callTool(tool.name, tool.params);
425
+ const resultContent = JSON.parse(result.content[0].text);
426
+ // Basic validation that we got the expected object back
427
+ if (Array.isArray(mockResponse)) {
428
+ assert.ok(Array.isArray(resultContent));
429
+ assert.strictEqual(resultContent.length, mockResponse.length);
430
+ // Check ID of first item
431
+ if (resultContent[0].id) {
432
+ assert.strictEqual(String(resultContent[0].id), String(mockResponse[0].id));
433
+ }
434
+ }
435
+ else {
436
+ assert.strictEqual(String(resultContent.id), String(mockResponse.id));
437
+ if (tool.name === 'get_project') {
438
+ assert.strictEqual(resultContent.description, 'mock-response');
439
+ }
440
+ }
441
+ }
442
+ }
@@ -0,0 +1,182 @@
1
+ import { describe, test, after, before } from 'node:test';
2
+ import assert from 'node:assert';
3
+ import { launchServer, findAvailablePort, TransportMode, HOST } from './utils/server-launcher.js';
4
+ import { MockGitLabServer, findMockServerPort } from './utils/mock-gitlab-server.js';
5
+ import { CustomHeaderClient } from './clients/custom-header-client.js';
6
+ const MOCK_TOKEN = 'glpat-mock-token-12345';
7
+ const project1 = {
8
+ id: 1,
9
+ name: "ProjectFromServer1",
10
+ description: "Mock project from server 1",
11
+ path_with_namespace: "group1/project1",
12
+ web_url: "http://mock.gitlab/group1/project1",
13
+ default_branch: "main",
14
+ visibility: "private",
15
+ path: "project1",
16
+ created_at: new Date().toISOString(),
17
+ namespace: {
18
+ id: 1,
19
+ name: "group1",
20
+ path: "group1",
21
+ kind: "group",
22
+ full_path: "group1",
23
+ },
24
+ };
25
+ const project2 = {
26
+ id: 2,
27
+ name: "ProjectFromServer2",
28
+ description: "Mock project from server 2",
29
+ path_with_namespace: "group2/project2",
30
+ web_url: "http://mock.gitlab/group2/project2",
31
+ default_branch: "main",
32
+ visibility: "private",
33
+ path: "project2",
34
+ created_at: new Date().toISOString(),
35
+ namespace: {
36
+ id: 2,
37
+ name: "group2",
38
+ path: "group2",
39
+ kind: "group",
40
+ full_path: "group2",
41
+ },
42
+ };
43
+ describe("Single Client Mode (ENABLE_DYNAMIC_API_URL=false)", () => {
44
+ let mcpServer;
45
+ let mcpUrl;
46
+ let mockServer1;
47
+ before(async () => {
48
+ const mockPort = await findMockServerPort(9001);
49
+ mockServer1 = new MockGitLabServer({ port: mockPort, validTokens: [MOCK_TOKEN] });
50
+ mockServer1.addMockHandler('get', '/projects/1', (req, res) => { res.json(project1); });
51
+ await mockServer1.start();
52
+ const mcpPort = await findAvailablePort(3002);
53
+ mcpServer = await launchServer({
54
+ mode: TransportMode.STREAMABLE_HTTP,
55
+ port: mcpPort,
56
+ env: {
57
+ GITLAB_API_URL: `${mockServer1.getUrl()}/api/v4`,
58
+ ENABLE_DYNAMIC_API_URL: "false",
59
+ REMOTE_AUTHORIZATION: "true",
60
+ },
61
+ });
62
+ mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
63
+ });
64
+ after(async () => {
65
+ if (mcpServer)
66
+ mcpServer.kill();
67
+ if (mockServer1)
68
+ await mockServer1.stop();
69
+ });
70
+ test("should use the default server when no header is provided", async () => {
71
+ const client = new CustomHeaderClient({ headers: { 'authorization': `Bearer ${MOCK_TOKEN}` } });
72
+ await client.connect(mcpUrl);
73
+ const result = await client.callTool('get_project', { project_id: "1" });
74
+ if (result.content[0].type === 'text') {
75
+ const textContent = JSON.parse(result.content[0].text);
76
+ assert.deepStrictEqual(textContent, project1);
77
+ }
78
+ else {
79
+ assert.fail('Expected text content from tool call');
80
+ }
81
+ await client.disconnect();
82
+ });
83
+ test("should IGNORE the custom header and still use the default server", async () => {
84
+ const client = new CustomHeaderClient({
85
+ headers: {
86
+ 'authorization': `Bearer ${MOCK_TOKEN}`,
87
+ 'X-GitLab-API-URL': `http://localhost:9999/api/v4`,
88
+ }
89
+ });
90
+ await client.connect(mcpUrl);
91
+ const result = await client.callTool('get_project', { project_id: "1" });
92
+ if (result.content[0].type === 'text') {
93
+ const textContent = JSON.parse(result.content[0].text);
94
+ assert.deepStrictEqual(textContent, project1);
95
+ }
96
+ else {
97
+ assert.fail('Expected text content from tool call');
98
+ }
99
+ await client.disconnect();
100
+ });
101
+ });
102
+ describe("Dynamic Client Mode (ENABLE_DYNAMIC_API_URL=true)", () => {
103
+ let mcpServer;
104
+ let mcpUrl;
105
+ let mockServer1;
106
+ let mockServer2;
107
+ before(async () => {
108
+ const port1 = await findMockServerPort(9011);
109
+ const port2 = await findMockServerPort(9012);
110
+ mockServer1 = new MockGitLabServer({ port: port1, validTokens: [MOCK_TOKEN] });
111
+ mockServer2 = new MockGitLabServer({ port: port2, validTokens: [MOCK_TOKEN] });
112
+ mockServer1.addMockHandler('get', '/projects/1', (req, res) => { res.json(project1); });
113
+ mockServer2.addMockHandler('get', '/projects/2', (req, res) => { res.json(project2); });
114
+ await mockServer1.start();
115
+ await mockServer2.start();
116
+ const mcpPort = await findAvailablePort(3012);
117
+ mcpServer = await launchServer({
118
+ mode: TransportMode.STREAMABLE_HTTP,
119
+ port: mcpPort,
120
+ env: {
121
+ GITLAB_API_URL: `${mockServer1.getUrl()}/api/v4,${mockServer2.getUrl()}/api/v4`,
122
+ ENABLE_DYNAMIC_API_URL: "true",
123
+ REMOTE_AUTHORIZATION: "true",
124
+ },
125
+ });
126
+ mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
127
+ });
128
+ after(async () => {
129
+ if (mcpServer)
130
+ mcpServer.kill();
131
+ if (mockServer1)
132
+ await mockServer1.stop();
133
+ if (mockServer2)
134
+ await mockServer2.stop();
135
+ });
136
+ test("should use the default server (first in list) when no header is provided", async () => {
137
+ const client = new CustomHeaderClient({ headers: { 'authorization': `Bearer ${MOCK_TOKEN}` } });
138
+ await client.connect(mcpUrl);
139
+ const result = await client.callTool('get_project', { project_id: "1" });
140
+ if (result.content[0].type === 'text') {
141
+ const textContent = JSON.parse(result.content[0].text);
142
+ assert.deepStrictEqual(textContent, project1);
143
+ }
144
+ else {
145
+ assert.fail('Expected text content from tool call');
146
+ }
147
+ await client.disconnect();
148
+ });
149
+ test("should switch to the second server when the header is provided", async () => {
150
+ const client = new CustomHeaderClient({
151
+ headers: {
152
+ 'authorization': `Bearer ${MOCK_TOKEN}`,
153
+ 'X-GitLab-API-URL': `${mockServer2.getUrl()}/api/v4`,
154
+ }
155
+ });
156
+ await client.connect(mcpUrl);
157
+ const result = await client.callTool('get_project', { project_id: "2" });
158
+ if (result.content[0].type === 'text') {
159
+ const textContent = JSON.parse(result.content[0].text);
160
+ assert.deepStrictEqual(textContent, project2);
161
+ }
162
+ else {
163
+ assert.fail('Expected text content from tool call');
164
+ }
165
+ await client.disconnect();
166
+ });
167
+ test("should default to the first server if the header contains a non-whitelisted URL", async () => {
168
+ const client = new CustomHeaderClient({
169
+ headers: {
170
+ 'authorization': `Bearer ${MOCK_TOKEN}`,
171
+ 'X-GitLab-API-URL': 'http://localhost:9999/api/v4',
172
+ }
173
+ });
174
+ // This call should fail at the MCP client level because the server will reject the auth
175
+ await assert.rejects(async () => {
176
+ await client.connect(mcpUrl);
177
+ }, (err) => {
178
+ assert.match(err.message, /Failed to connect/);
179
+ return true;
180
+ });
181
+ });
182
+ });
@@ -165,6 +165,8 @@ describe('Remote Authorization - Session Timeout', () => {
165
165
  console.log(' ✓ Session remained active with periodic requests');
166
166
  });
167
167
  test('session timeout expiration - inactivity expires auth', async () => {
168
+ // Add a small delay to ensure server is ready/clean from previous test
169
+ await new Promise(resolve => setTimeout(resolve, 1000));
168
170
  // Step 1: Connect WITH auth header to establish session
169
171
  const clientWithAuth = new CustomHeaderClient({
170
172
  'authorization': `Bearer ${MOCK_TOKEN}`