@zereight/mcp-gitlab 2.0.7 → 2.0.8

package/build/schemas.js

@@ -1758,3 +1758,159 @@ export const ExecuteGraphQLSchema = z.object({
         .optional()
         .describe("Variables object for the GraphQL query"),
 });
+// Release schemas
+export const GitLabReleaseAssetLinkSchema = z.object({
+    id: z.number().optional(),
+    name: z.string(),
+    url: z.string(),
+    direct_asset_path: z.string().optional(),
+    link_type: z.enum(["other", "runbook", "image", "package"]).optional(),
+});
+export const GitLabReleaseAssetSourceSchema = z.object({
+    format: z.string(),
+    url: z.string(),
+});
+export const GitLabReleaseAssetsSchema = z.object({
+    count: z.number().optional(),
+    sources: z.array(GitLabReleaseAssetSourceSchema).optional(),
+    links: z.array(GitLabReleaseAssetLinkSchema).optional(),
+    evidence_file_path: z.string().optional(),
+});
+export const GitLabReleaseEvidenceSchema = z.object({
+    sha: z.string(),
+    filepath: z.string(),
+    collected_at: z.string(),
+});
+export const GitLabReleaseSchema = z.object({
+    tag_name: z.string(),
+    name: z.string().nullable().optional(),
+    description: z.string().nullable().optional(),
+    description_html: z.string().nullable().optional(),
+    created_at: z.string(),
+    released_at: z.string().nullable().optional(),
+    author: z.object({
+        id: z.number(),
+        name: z.string(),
+        username: z.string(),
+        state: z.string(),
+        avatar_url: z.string().nullable().optional(),
+        web_url: z.string(),
+    }).optional(),
+    commit: z.object({
+        id: z.string(),
+        short_id: z.string(),
+        title: z.string(),
+        created_at: z.string(),
+        parent_ids: z.array(z.string()),
+        message: z.string(),
+        author_name: z.string(),
+        author_email: z.string(),
+        authored_date: z.string(),
+        committer_name: z.string(),
+        committer_email: z.string(),
+        committed_date: z.string(),
+    }).optional(),
+    milestones: z.array(GitLabMilestonesSchema).optional(),
+    commit_path: z.string().optional(),
+    tag_path: z.string().optional(),
+    assets: GitLabReleaseAssetsSchema.optional(),
+    evidences: z.array(GitLabReleaseEvidenceSchema).optional(),
+    _links: z.object({
+        closed_issues_url: z.string().optional(),
+        closed_merge_requests_url: z.string().optional(),
+        edit_url: z.string().optional(),
+        merged_merge_requests_url: z.string().optional(),
+        opened_issues_url: z.string().optional(),
+        opened_merge_requests_url: z.string().optional(),
+        self: z.string().optional(),
+    }).optional(),
+    upcoming_release: z.boolean().optional(),
+    historical_release: z.boolean().optional(),
+});
+export const ListReleasesSchema = z
+    .object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    order_by: z
+        .enum(["released_at", "created_at"])
+        .optional()
+        .describe("The field to use as order. Either released_at (default) or created_at."),
+    sort: z
+        .enum(["desc", "asc"])
+        .optional()
+        .describe("The direction of the order. Either desc (default) for descending order or asc for ascending order."),
+    include_html_description: z
+        .boolean()
+        .optional()
+        .describe("If true, a response includes HTML rendered Markdown of the release description."),
+})
+    .merge(PaginationOptionsSchema);
+export const GetReleaseSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    tag_name: z.string().describe("The Git tag the release is associated with"),
+    include_html_description: z
+        .boolean()
+        .optional()
+        .describe("If true, a response includes HTML rendered Markdown of the release description."),
+});
+export const CreateReleaseSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    tag_name: z.string().describe("The tag where the release is created from"),
+    name: z.string().optional().describe("The release name"),
+    tag_message: z.string().optional().describe("Message to use if creating a new annotated tag"),
+    description: z.string().optional().describe("The description of the release. You can use Markdown."),
+    ref: z
+        .string()
+        .optional()
+        .describe("If a tag specified in tag_name doesn't exist, the release is created from ref and tagged with tag_name. It can be a commit SHA, another tag name, or a branch name."),
+    milestones: z
+        .array(z.string())
+        .optional()
+        .describe("The title of each milestone the release is associated with. GitLab Premium customers can specify group milestones."),
+    assets: z
+        .object({
+        links: z
+            .array(z.object({
+            name: z.string().describe("The name of the link. Link names must be unique within the release."),
+            url: z.string().describe("The URL of the link. Link URLs must be unique within the release."),
+            direct_asset_path: z.string().optional().describe("Optional path for a direct asset link."),
+            link_type: z
+                .enum(["other", "runbook", "image", "package"])
+                .optional()
+                .describe("The type of the link: other, runbook, image, package. Defaults to other."),
+        }))
+            .optional(),
+    })
+        .optional()
+        .describe("An array of assets links"),
+    released_at: z
+        .string()
+        .optional()
+        .describe("Date and time for the release. Defaults to the current time. Expected in ISO 8601 format (2019-03-15T08:00:00Z). Only provide this field if creating an upcoming or historical release."),
+});
+export const UpdateReleaseSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    tag_name: z.string().describe("The Git tag the release is associated with"),
+    name: z.string().optional().describe("The release name"),
+    description: z.string().optional().describe("The description of the release. You can use Markdown."),
+    milestones: z
+        .array(z.string())
+        .optional()
+        .describe("The title of each milestone to associate with the release. GitLab Premium customers can specify group milestones. To remove all milestones from the release, specify []."),
+    released_at: z
+        .string()
+        .optional()
+        .describe("The date when the release is/was ready. Expected in ISO 8601 format (2019-03-15T08:00:00Z)."),
+});
+export const DeleteReleaseSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    tag_name: z.string().describe("The Git tag the release is associated with"),
+});
+export const CreateReleaseEvidenceSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    tag_name: z.string().describe("The Git tag the release is associated with"),
+});
+export const DownloadReleaseAssetSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    tag_name: z.string().describe("The Git tag the release is associated with"),
+    direct_asset_path: z.string().describe("Path to the release asset file as specified when creating or updating its link"),
+});

package/build/test/clients/custom-header-client.js

@@ -0,0 +1,122 @@
+/**
+ * Custom Header MCP Client for Testing Remote Authorization
+ * Extends StreamableHTTPTestClient to support custom headers
+ */
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+/**
+ * MCP client with support for custom HTTP headers
+ * Useful for testing remote authorization scenarios
+ */
+export class CustomHeaderClient {
+    client;
+    transport = null;
+    customHeaders;
+    timeout;
+    constructor(options = {}) {
+        // Support both old signature (headers only) and new options object
+        if ('headers' in options || 'timeout' in options || 'clientName' in options) {
+            const opts = options;
+            this.customHeaders = opts.headers || {};
+            this.timeout = opts.timeout || 30000;
+            this.client = new Client({
+                name: opts.clientName || "test-client-with-headers",
+                version: opts.clientVersion || "1.0.0"
+            });
+        }
+        else {
+            // Backward compatible: treat options as headers record
+            this.customHeaders = options;
+            this.timeout = 30000;
+            this.client = new Client({ name: "test-client-with-headers", version: "1.0.0" });
+        }
+    }
+    /**
+     * Connect to MCP server with custom headers
+     */
+    async connect(url) {
+        if (this.transport) {
+            throw new Error('Client is already connected');
+        }
+        try {
+            this.transport = new StreamableHTTPClientTransport(new URL(url), {
+                requestInit: {
+                    headers: this.customHeaders
+                }
+            });
+            await this.client.connect(this.transport);
+        }
+        catch (error) {
+            this.transport = null;
+            throw new Error(`Failed to connect: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /**
+     * Disconnect from server
+     */
+    async disconnect() {
+        if (this.transport) {
+            try {
+                await this.transport.close();
+            }
+            catch (error) {
+                // Silently ignore disconnect errors in tests
+                // In production, you'd want proper logging
+            }
+            finally {
+                this.transport = null;
+            }
+        }
+    }
+    /**
+     * Get session ID from transport (useful for testing)
+     */
+    getSessionId() {
+        return this.transport?.sessionId;
+    }
+    /**
+     * Update custom headers (creates new connection if already connected)
+     */
+    setHeaders(headers) {
+        if (this.transport) {
+            throw new Error('Cannot update headers while connected. Disconnect first.');
+        }
+        this.customHeaders = headers;
+    }
+    /**
+     * List available tools from server
+     */
+    async listTools() {
+        if (!this.transport) {
+            throw new Error('Client is not connected');
+        }
+        try {
+            const response = await this.client.listTools();
+            return response;
+        }
+        catch (error) {
+            throw new Error(`Failed to list tools: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /**
+     * Call a tool on the server
+     */
+    async callTool(name, arguments_ = {}) {
+        if (!this.transport) {
+            throw new Error('Client is not connected');
+        }
+        try {
+            const response = await this.client.callTool({ name, arguments: arguments_ });
+            return response;
+        }
+        catch (error) {
+            throw new Error(`Failed to call tool '${name}': ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /**
+     * Get client connection status
+     */
+    get isConnected() {
+        return this.transport !== null;
+    }
+}

package/build/test/remote-auth-simple-test.js

@@ -0,0 +1,215 @@
+/**
+ * Remote Authorization Test Suite
+ * Tests remote auth functionality with mock GitLab server
+ */
+import { describe, test, after, before } from 'node:test';
+import assert from 'node:assert';
+import { launchServer, findAvailablePort, cleanupServers, TransportMode, HOST } from './utils/server-launcher.js';
+import { MockGitLabServer, findMockServerPort } from './utils/mock-gitlab-server.js';
+import { CustomHeaderClient } from './clients/custom-header-client.js';
+// Test constants
+const MOCK_TOKEN = 'glpat-mock-token-12345';
+const TEST_PROJECT_ID = '123';
+// Port ranges to avoid collisions
+const MOCK_GITLAB_PORT_BASE = 9000;
+const MOCK_GITLAB_PORT_OFFSET = 500; // Offset for timeout test suite
+const MCP_SERVER_PORT_BASE = 3000;
+const MCP_SERVER_PORT_OFFSET = 500; // Offset for timeout test suite
+// Timeout settings
+const SESSION_TIMEOUT_SECONDS = 3;
+const TIMEOUT_BUFFER_MS = 1000; // Extra time beyond timeout to ensure expiration
+const TIMEOUT_TEST_WAIT_MS = SESSION_TIMEOUT_SECONDS * 1000 + TIMEOUT_BUFFER_MS;
+const KEEPALIVE_INTERVAL_MS = 2000; // Must be less than SESSION_TIMEOUT_SECONDS
+const KEEPALIVE_REQUEST_COUNT = 3; // Number of keepalive requests to test
+console.log('🔐 Remote Authorization Test Suite');
+console.log('');
+describe('Remote Authorization - Basic Functionality', () => {
+    let mcpUrl;
+    let mockGitLab;
+    let servers = [];
+    before(async () => {
+        // Start mock GitLab server
+        const mockPort = await findMockServerPort(MOCK_GITLAB_PORT_BASE);
+        mockGitLab = new MockGitLabServer({
+            port: mockPort,
+            validTokens: [MOCK_TOKEN]
+        });
+        await mockGitLab.start();
+        const mockGitLabUrl = mockGitLab.getUrl();
+        // Start MCP server with remote auth
+        const mcpPort = await findAvailablePort(MCP_SERVER_PORT_BASE);
+        const server = await launchServer({
+            mode: TransportMode.STREAMABLE_HTTP,
+            port: mcpPort,
+            timeout: 5000,
+            env: {
+                STREAMABLE_HTTP: 'true',
+                REMOTE_AUTHORIZATION: 'true',
+                GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+                GITLAB_READ_ONLY_MODE: 'true',
+            }
+        });
+        servers.push(server);
+        mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
+        console.log(`Mock GitLab: ${mockGitLabUrl}`);
+        console.log(`MCP Server: ${mcpUrl}`);
+    });
+    after(async () => {
+        cleanupServers(servers);
+        if (mockGitLab) {
+            await mockGitLab.stop();
+        }
+    });
+    test('should connect with Authorization Bearer header', async () => {
+        const client = new CustomHeaderClient({
+            'authorization': `Bearer ${MOCK_TOKEN}`
+        });
+        await client.connect(mcpUrl);
+        const tools = await client.listTools();
+        assert.ok(tools.tools.length > 0, 'Should have tools');
+        console.log(`  ✓ Connected successfully, got ${tools.tools.length} tools`);
+        await client.disconnect();
+    });
+    test('should connect with Private-Token header', async () => {
+        const client = new CustomHeaderClient({
+            'private-token': MOCK_TOKEN
+        });
+        await client.connect(mcpUrl);
+        const tools = await client.listTools();
+        assert.ok(tools.tools.length > 0, 'Should have tools');
+        console.log(`  ✓ Connected with Private-Token, got ${tools.tools.length} tools`);
+        await client.disconnect();
+    });
+    test('should successfully call listTools with auth', async () => {
+        const client = new CustomHeaderClient({
+            'authorization': `Bearer ${MOCK_TOKEN}`
+        });
+        await client.connect(mcpUrl);
+        // List tools multiple times to verify auth persists
+        const tools1 = await client.listTools();
+        const tools2 = await client.listTools();
+        const tools3 = await client.listTools();
+        assert.ok(tools1.tools.length > 0, 'Should have tools');
+        assert.strictEqual(tools1.tools.length, tools2.tools.length, 'Tool count should be consistent');
+        assert.strictEqual(tools2.tools.length, tools3.tools.length, 'Tool count should be consistent');
+        console.log('  ✓ Multiple tool list calls successful with persistent auth');
+        await client.disconnect();
+    });
+    test('should reject connection without auth header', async () => {
+        const client = new CustomHeaderClient({});
+        try {
+            await client.connect(mcpUrl);
+            await client.listTools();
+            await client.disconnect();
+            assert.fail('Should have rejected connection without auth');
+        }
+        catch (error) {
+            assert.ok(error instanceof Error);
+            console.log('  ✓ Correctly rejected connection without auth');
+        }
+    });
+});
+describe('Remote Authorization - Session Timeout', () => {
+    let mcpUrl;
+    let mockGitLab;
+    let servers = [];
+    before(async () => {
+        // Use different port ranges to avoid collisions with basic tests
+        const mockPort = await findMockServerPort(MOCK_GITLAB_PORT_BASE + MOCK_GITLAB_PORT_OFFSET);
+        mockGitLab = new MockGitLabServer({
+            port: mockPort,
+            validTokens: [MOCK_TOKEN]
+        });
+        await mockGitLab.start();
+        const mockGitLabUrl = mockGitLab.getUrl();
+        const mcpPort = await findAvailablePort(MCP_SERVER_PORT_BASE + MCP_SERVER_PORT_OFFSET);
+        const server = await launchServer({
+            mode: TransportMode.STREAMABLE_HTTP,
+            port: mcpPort,
+            timeout: 5000,
+            env: {
+                STREAMABLE_HTTP: 'true',
+                REMOTE_AUTHORIZATION: 'true',
+                GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+                SESSION_TIMEOUT_SECONDS: String(SESSION_TIMEOUT_SECONDS),
+            }
+        });
+        servers.push(server);
+        mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
+        console.log(`Session timeout: ${SESSION_TIMEOUT_SECONDS} seconds`);
+    });
+    after(async () => {
+        cleanupServers(servers);
+        if (mockGitLab) {
+            await mockGitLab.stop();
+        }
+    });
+    test('session timeout verification - activity keeps session alive', async () => {
+        const client = new CustomHeaderClient({
+            'authorization': `Bearer ${MOCK_TOKEN}`
+        });
+        // Connect and verify it works
+        await client.connect(mcpUrl);
+        const tools1 = await client.listTools();
+        assert.ok(tools1.tools.length > 0, 'Initial connection should work');
+        console.log('  ✓ Initial connection successful');
+        // Keep connection alive with periodic requests
+        console.log('  Keeping session alive with requests...');
+        for (let i = 0; i < KEEPALIVE_REQUEST_COUNT; i++) {
+            await new Promise(resolve => setTimeout(resolve, KEEPALIVE_INTERVAL_MS));
+            const tools = await client.listTools();
+            assert.ok(tools.tools.length > 0, `Request ${i + 1} should succeed`);
+            console.log(`  ✓ Request ${i + 1} succeeded (session still alive)`);
+        }
+        await client.disconnect();
+        console.log('  ✓ Session remained active with periodic requests');
+    });
+    test('session timeout expiration - inactivity expires auth', async () => {
+        // Step 1: Connect WITH auth header to establish session
+        const clientWithAuth = new CustomHeaderClient({
+            'authorization': `Bearer ${MOCK_TOKEN}`
+        });
+        await clientWithAuth.connect(mcpUrl);
+        const tools1 = await clientWithAuth.listTools();
+        assert.ok(tools1.tools.length > 0, 'Initial connection should work');
+        console.log('  ✓ Initial connection successful with auth');
+        // Extract session ID using proper API
+        const sessionId = clientWithAuth.getSessionId();
+        assert.ok(sessionId, 'Session ID should exist');
+        console.log(`  ℹ️  Session ID: ${sessionId}`);
+        // Step 2: Wait for timeout WITHOUT making any requests
+        console.log(`  ⏳ Waiting ${TIMEOUT_TEST_WAIT_MS / 1000}s for timeout without activity...`);
+        await new Promise(resolve => setTimeout(resolve, TIMEOUT_TEST_WAIT_MS));
+        // Step 3: Try to make request WITHOUT auth header - should fail with 401
+        try {
+            const response = await fetch(mcpUrl, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'mcp-session-id': sessionId,
+                },
+                body: JSON.stringify({
+                    jsonrpc: '2.0',
+                    id: 1,
+                    method: 'tools/list'
+                })
+            });
+            if (!response.ok) {
+                assert.strictEqual(response.status, 401, 'Should return 401 Unauthorized');
+                console.log(`  ✓ Request correctly failed with status ${response.status}`);
+                const body = await response.text();
+                console.log(`  ℹ️  Error: ${body.substring(0, 100)}...`);
+            }
+            else {
+                assert.fail('Should have failed due to expired auth token');
+            }
+        }
+        catch (error) {
+            // Network errors are also acceptable
+            assert.ok(error instanceof Error, 'Should throw error');
+            console.log('  ✓ Request correctly failed after timeout');
+            console.log(`  ℹ️  Error: ${error.message.substring(0, 100)}...`);
+        }
+        await clientWithAuth.disconnect();
+    });
+});