@zereight/mcp-gitlab 2.0.7 → 2.0.8

package/build/test/remote-auth-tests.js

@@ -0,0 +1,315 @@
+/**
+ * Remote Authorization Tests
+ * Tests for per-session HTTP header-based authorization
+ */
+import { describe, test, after, before } from 'node:test';
+import assert from 'node:assert';
+import fetch from 'node-fetch';
+import { launchServer, findAvailablePort, cleanupServers, TransportMode, checkHealthEndpoint, HOST } from './utils/server-launcher.js';
+console.log('🔐 Remote Authorization Tests');
+console.log('');
+// Configuration check
+const GITLAB_API_URL = process.env.GITLAB_API_URL || "https://gitlab.com";
+const GITLAB_TOKEN = process.env.GITLAB_TOKEN_TEST || process.env.GITLAB_TOKEN;
+const TEST_PROJECT_ID = process.env.TEST_PROJECT_ID;
+console.log('🔧 Test Configuration:');
+console.log(`  GitLab URL: ${GITLAB_API_URL}`);
+console.log(`  Token: ${GITLAB_TOKEN ? '✅ Provided' : '❌ Missing'}`);
+console.log(`  Project ID: ${TEST_PROJECT_ID || '❌ Missing'}`);
+// Validate required configuration
+if (!GITLAB_TOKEN) {
+    console.error('❌ Error: GITLAB_TOKEN_TEST or GITLAB_TOKEN environment variable is required for testing');
+    console.error('   Set one of these variables to your GitLab API token');
+    process.exit(1);
+}
+if (!TEST_PROJECT_ID) {
+    console.error('❌ Error: TEST_PROJECT_ID environment variable is required for testing');
+    console.error('   Set this variable to a valid GitLab project ID (e.g., "123" or "group/project")');
+    process.exit(1);
+}
+console.log('✅ Configuration validated');
+console.log('');
+let servers = [];
+// Cleanup function for all tests
+const cleanup = () => {
+    cleanupServers(servers);
+    servers = [];
+};
+// Handle process termination
+process.on('SIGINT', cleanup);
+process.on('SIGTERM', cleanup);
+process.on('exit', cleanup);
+/**
+ * Helper to send MCP request with custom headers
+ */
+async function sendMCPRequest(url, method, headers = {}) {
+    const response = await fetch(url, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            ...headers,
+        },
+        body: JSON.stringify(method),
+    });
+    if (!response.ok) {
+        const text = await response.text();
+        throw new Error(`HTTP ${response.status}: ${text}`);
+    }
+    return response.json();
+}
+describe('Remote Authorization - Streamable HTTP with Authorization header', () => {
+    let server;
+    let port;
+    let mcpUrl;
+    before(async () => {
+        port = await findAvailablePort();
+        server = await launchServer({
+            mode: TransportMode.STREAMABLE_HTTP,
+            port,
+            timeout: 3000,
+            env: {
+                STREAMABLE_HTTP: 'true',
+                REMOTE_AUTHORIZATION: 'true',
+                GITLAB_API_URL: `${GITLAB_API_URL}/api/v4`,
+                GITLAB_PROJECT_ID: TEST_PROJECT_ID,
+                GITLAB_READ_ONLY_MODE: 'true',
+                // Explicitly no GITLAB_PERSONAL_ACCESS_TOKEN
+            }
+        });
+        servers.push(server);
+        mcpUrl = `http://${HOST}:${port}/mcp`;
+        // Verify server started successfully
+        assert.ok(server.process.pid !== undefined, 'Server process should have PID');
+        // Verify health check
+        if (server.port) {
+            const health = await checkHealthEndpoint(server.port);
+            assert.strictEqual(health.status, 'healthy', 'Health status should be healthy');
+        }
+        console.log('Server started with remote authorization enabled');
+    });
+    after(async () => {
+        cleanup();
+        console.log('Server stopped');
+    });
+    test('should reject request without Authorization header', async () => {
+        const initRequest = {
+            jsonrpc: '2.0',
+            id: 1,
+            method: 'initialize',
+            params: {
+                protocolVersion: '2024-11-05',
+                capabilities: {},
+                clientInfo: { name: 'test-client', version: '1.0.0' }
+            }
+        };
+        try {
+            await sendMCPRequest(mcpUrl, initRequest, {
+                'mcp-session-id': 'test-session-no-auth'
+            });
+            assert.fail('Should have rejected request without auth header');
+        }
+        catch (error) {
+            assert.ok(error instanceof Error);
+            assert.ok(error.message.includes('401'), 'Should get 401 Unauthorized');
+        }
+    });
+    test('should accept request with Authorization Bearer header', async () => {
+        const sessionId = `test-session-bearer-${Date.now()}`;
+        const initRequest = {
+            jsonrpc: '2.0',
+            id: 1,
+            method: 'initialize',
+            params: {
+                protocolVersion: '2024-11-05',
+                capabilities: {},
+                clientInfo: { name: 'test-client', version: '1.0.0' }
+            }
+        };
+        const response = await sendMCPRequest(mcpUrl, initRequest, {
+            'mcp-session-id': sessionId,
+            'authorization': `Bearer ${GITLAB_TOKEN}`
+        });
+        assert.ok(response, 'Should get response');
+        assert.ok(response.result, 'Should have result');
+        assert.strictEqual(response.result.protocolVersion, '2024-11-05', 'Protocol version should match');
+    });
+    test('should reuse auth from first request in subsequent requests', async () => {
+        const sessionId = `test-session-reuse-${Date.now()}`;
+        // First request with auth
+        const initRequest = {
+            jsonrpc: '2.0',
+            id: 1,
+            method: 'initialize',
+            params: {
+                protocolVersion: '2024-11-05',
+                capabilities: {},
+                clientInfo: { name: 'test-client', version: '1.0.0' }
+            }
+        };
+        const initResponse = await sendMCPRequest(mcpUrl, initRequest, {
+            'mcp-session-id': sessionId,
+            'authorization': `Bearer ${GITLAB_TOKEN}`
+        });
+        assert.ok(initResponse.result, 'Init should succeed');
+        // Second request without auth header (should reuse)
+        const listToolsRequest = {
+            jsonrpc: '2.0',
+            id: 2,
+            method: 'tools/list',
+            params: {}
+        };
+        const listResponse = await sendMCPRequest(mcpUrl, listToolsRequest, {
+            'mcp-session-id': sessionId
+            // No authorization header
+        });
+        assert.ok(listResponse.result, 'List tools should succeed with reused auth');
+        assert.ok(Array.isArray(listResponse.result.tools), 'Should return tools array');
+        assert.ok(listResponse.result.tools.length > 0, 'Should have at least one tool');
+    });
+    test('should call tool with Bearer token', async () => {
+        const sessionId = `test-session-tool-${Date.now()}`;
+        // Initialize
+        const initRequest = {
+            jsonrpc: '2.0',
+            id: 1,
+            method: 'initialize',
+            params: {
+                protocolVersion: '2024-11-05',
+                capabilities: {},
+                clientInfo: { name: 'test-client', version: '1.0.0' }
+            }
+        };
+        await sendMCPRequest(mcpUrl, initRequest, {
+            'mcp-session-id': sessionId,
+            'authorization': `Bearer ${GITLAB_TOKEN}`
+        });
+        // Call tool
+        const callToolRequest = {
+            jsonrpc: '2.0',
+            id: 2,
+            method: 'tools/call',
+            params: {
+                name: 'get_project',
+                arguments: {
+                    project_id: TEST_PROJECT_ID
+                }
+            }
+        };
+        const toolResponse = await sendMCPRequest(mcpUrl, callToolRequest, {
+            'mcp-session-id': sessionId
+        });
+        assert.ok(toolResponse.result, 'Tool call should succeed');
+        assert.ok(toolResponse.result.content, 'Should have content');
+        assert.ok(Array.isArray(toolResponse.result.content), 'Content should be array');
+        assert.ok(toolResponse.result.content.length > 0, 'Should have content items');
+        const projectData = JSON.parse(toolResponse.result.content[0].text);
+        assert.ok(projectData.id, 'Should have project id');
+        assert.ok(projectData.name, 'Should have project name');
+    });
+});
+describe('Remote Authorization - Streamable HTTP with Private-Token header', () => {
+    let server;
+    let port;
+    let mcpUrl;
+    before(async () => {
+        port = await findAvailablePort();
+        server = await launchServer({
+            mode: TransportMode.STREAMABLE_HTTP,
+            port,
+            timeout: 3000,
+            env: {
+                STREAMABLE_HTTP: 'true',
+                REMOTE_AUTHORIZATION: 'true',
+                GITLAB_API_URL: `${GITLAB_API_URL}/api/v4`,
+                GITLAB_PROJECT_ID: TEST_PROJECT_ID,
+                GITLAB_READ_ONLY_MODE: 'true',
+            }
+        });
+        servers.push(server);
+        mcpUrl = `http://${HOST}:${port}/mcp`;
+        console.log('Server started for Private-Token tests');
+    });
+    after(async () => {
+        cleanup();
+        console.log('Server stopped');
+    });
+    test('should accept request with Private-Token header', async () => {
+        const sessionId = `test-session-private-${Date.now()}`;
+        const initRequest = {
+            jsonrpc: '2.0',
+            id: 1,
+            method: 'initialize',
+            params: {
+                protocolVersion: '2024-11-05',
+                capabilities: {},
+                clientInfo: { name: 'test-client', version: '1.0.0' }
+            }
+        };
+        const response = await sendMCPRequest(mcpUrl, initRequest, {
+            'mcp-session-id': sessionId,
+            'private-token': GITLAB_TOKEN
+        });
+        assert.ok(response.result, 'Should succeed with Private-Token');
+        assert.strictEqual(response.result.protocolVersion, '2024-11-05', 'Protocol version should match');
+    });
+    test('should call tool with Private-Token', async () => {
+        const sessionId = `test-session-private-tool-${Date.now()}`;
+        // Initialize
+        const initRequest = {
+            jsonrpc: '2.0',
+            id: 1,
+            method: 'initialize',
+            params: {
+                protocolVersion: '2024-11-05',
+                capabilities: {},
+                clientInfo: { name: 'test-client', version: '1.0.0' }
+            }
+        };
+        await sendMCPRequest(mcpUrl, initRequest, {
+            'mcp-session-id': sessionId,
+            'private-token': GITLAB_TOKEN
+        });
+        // Call tool
+        const callToolRequest = {
+            jsonrpc: '2.0',
+            id: 2,
+            method: 'tools/call',
+            params: {
+                name: 'list_merge_requests',
+                arguments: {
+                    project_id: TEST_PROJECT_ID
+                }
+            }
+        };
+        const toolResponse = await sendMCPRequest(mcpUrl, callToolRequest, {
+            'mcp-session-id': sessionId
+        });
+        assert.ok(toolResponse.result, 'Tool call should succeed with Private-Token');
+        assert.ok(toolResponse.result.content, 'Should have content');
+    });
+});
+describe('Remote Authorization - SSE mode should be disabled', () => {
+    test('should fail to start with SSE and REMOTE_AUTHORIZATION', async () => {
+        const port = await findAvailablePort();
+        try {
+            const server = await launchServer({
+                mode: TransportMode.SSE,
+                port,
+                timeout: 3000,
+                env: {
+                    SSE: 'true',
+                    REMOTE_AUTHORIZATION: 'true',
+                    GITLAB_API_URL: `${GITLAB_API_URL}/api/v4`,
+                }
+            });
+            // If we get here, the server started when it shouldn't have
+            servers.push(server);
+            assert.fail('Server should not start with SSE and REMOTE_AUTHORIZATION=true');
+        }
+        catch (error) {
+            // Expected: server should fail to start
+            assert.ok(error instanceof Error, 'Should throw an error');
+            console.log('✅ Server correctly rejected SSE mode with remote authorization');
+        }
+    });
+});

package/build/test/utils/mock-gitlab-server.js

@@ -0,0 +1,275 @@
+/**
+ * Mock GitLab API Server for Testing
+ * Implements minimal GitLab API endpoints for testing remote authorization
+ */
+import express from 'express';
+export class MockGitLabServer {
+    app;
+    server = null;
+    config;
+    requestCount = 0;
+    constructor(config) {
+        this.config = config;
+        this.app = express();
+        this.setupMiddleware();
+        this.setupRoutes();
+    }
+    /**
+     * Setup middleware including auth validation
+     */
+    setupMiddleware() {
+        this.app.use(express.json());
+        // Request counter for rate limiting tests
+        this.app.use((req, res, next) => {
+            this.requestCount++;
+            next();
+        });
+        // Artificial delay middleware (for timeout testing)
+        if (this.config.responseDelay) {
+            this.app.use((req, res, next) => {
+                setTimeout(next, this.config.responseDelay);
+            });
+        }
+        // Rate limiting middleware
+        if (this.config.rateLimitAfter) {
+            this.app.use((req, res, next) => {
+                if (this.requestCount > this.config.rateLimitAfter) {
+                    res.status(429).json({
+                        message: 'Rate limit exceeded',
+                        retry_after: 60
+                    });
+                    return;
+                }
+                next();
+            });
+        }
+        // Authentication middleware - applies to all /api/v4/* routes
+        this.app.use('/api/v4', (req, res, next) => {
+            const authHeader = req.headers['authorization'];
+            const privateToken = req.headers['private-token'];
+            let token = null;
+            if (authHeader) {
+                // Extract token from "Bearer <token>"
+                const match = authHeader.match(/^Bearer\s+(.+)$/i);
+                token = match ? match[1].trim() : null;
+            }
+            else if (privateToken) {
+                token = privateToken.trim();
+            }
+            if (!token) {
+                res.status(401).json({
+                    message: 'Unauthorized',
+                    error: 'Missing authentication token'
+                });
+                return;
+            }
+            if (!this.config.validTokens.includes(token)) {
+                res.status(401).json({
+                    message: 'Unauthorized',
+                    error: 'Invalid authentication token'
+                });
+                return;
+            }
+            // Store validated token in request
+            req.gitlabToken = token;
+            next();
+        });
+    }
+    setupRoutes() {
+        // GET /api/v4/user - Get current user
+        this.app.get('/api/v4/user', (req, res) => {
+            const token = req.gitlabToken || 'unknown';
+            res.json({
+                id: 1,
+                username: `user_${token.substring(0, 8)}`,
+                name: 'Test User',
+                email: 'test@example.com',
+                state: 'active'
+            });
+        });
+        // GET /api/v4/projects/:projectId - Get project
+        this.app.get('/api/v4/projects/:projectId', (req, res) => {
+            const projectId = req.params.projectId;
+            res.json({
+                id: parseInt(projectId) || 123,
+                name: 'Test Project',
+                path: 'test-project',
+                path_with_namespace: 'test-group/test-project',
+                description: 'A mock test project',
+                visibility: 'private',
+                created_at: '2024-01-01T00:00:00Z',
+                web_url: `https://gitlab.mock/project/${projectId}`,
+                namespace: {
+                    id: 1,
+                    name: 'Test Group',
+                    path: 'test-group',
+                    kind: 'group',
+                    full_path: 'test-group'
+                }
+            });
+        });
+        // GET /api/v4/projects/:projectId/merge_requests - List merge requests
+        this.app.get('/api/v4/projects/:projectId/merge_requests', (req, res) => {
+            res.json([
+                {
+                    id: 1,
+                    iid: 1,
+                    title: 'Test MR 1',
+                    state: 'opened',
+                    created_at: '2024-01-01T00:00:00Z',
+                    author: {
+                        id: 1,
+                        username: 'test-user',
+                        name: 'Test User'
+                    }
+                },
+                {
+                    id: 2,
+                    iid: 2,
+                    title: 'Test MR 2',
+                    state: 'merged',
+                    created_at: '2024-01-02T00:00:00Z',
+                    author: {
+                        id: 1,
+                        username: 'test-user',
+                        name: 'Test User'
+                    }
+                }
+            ]);
+        });
+        // GET /api/v4/projects/:projectId/merge_requests/:mr_iid - Get single MR
+        this.app.get('/api/v4/projects/:projectId/merge_requests/:mr_iid', (req, res) => {
+            const mrIid = parseInt(req.params.mr_iid);
+            res.json({
+                id: mrIid,
+                iid: mrIid,
+                title: `Test MR ${mrIid}`,
+                state: 'opened',
+                created_at: '2024-01-01T00:00:00Z',
+                author: {
+                    id: 1,
+                    username: 'test-user',
+                    name: 'Test User'
+                },
+                source_branch: 'feature-branch',
+                target_branch: 'main',
+                merge_status: 'can_be_merged'
+            });
+        });
+        // GET /api/v4/projects/:projectId/issues - List issues
+        this.app.get('/api/v4/projects/:projectId/issues', (req, res) => {
+            res.json([
+                {
+                    id: 1,
+                    iid: 1,
+                    title: 'Test Issue 1',
+                    state: 'opened',
+                    created_at: '2024-01-01T00:00:00Z',
+                    author: {
+                        id: 1,
+                        username: 'test-user',
+                        name: 'Test User'
+                    }
+                }
+            ]);
+        });
+        // GET /api/v4/projects - List projects
+        this.app.get('/api/v4/projects', (req, res) => {
+            res.json([
+                {
+                    id: 123,
+                    name: 'Test Project',
+                    path: 'test-project',
+                    path_with_namespace: 'test-group/test-project',
+                    description: 'A mock test project',
+                    visibility: 'private',
+                    namespace: {
+                        id: 1,
+                        name: 'Test Group',
+                        path: 'test-group',
+                        kind: 'group',
+                        full_path: 'test-group'
+                    }
+                }
+            ]);
+        });
+        // Health check endpoint
+        this.app.get('/health', (req, res) => {
+            res.json({ status: 'ok', message: 'Mock GitLab API is running' });
+        });
+        // Catch-all for unimplemented endpoints
+        this.app.use((req, res) => {
+            console.log(`Mock GitLab: Unimplemented endpoint: ${req.method} ${req.path}`);
+            res.status(404).json({
+                message: '404 Not Found',
+                error: 'Endpoint not implemented in mock server'
+            });
+        });
+    }
+    async start() {
+        return new Promise((resolve) => {
+            this.server = this.app.listen(this.config.port, '127.0.0.1', () => {
+                console.log(`Mock GitLab API listening on http://127.0.0.1:${this.config.port}`);
+                resolve();
+            });
+        });
+    }
+    async stop() {
+        return new Promise((resolve, reject) => {
+            if (this.server) {
+                this.server.close((err) => {
+                    if (err)
+                        reject(err);
+                    else {
+                        console.log('Mock GitLab API stopped');
+                        resolve();
+                    }
+                });
+            }
+            else {
+                resolve();
+            }
+        });
+    }
+    getUrl() {
+        return `http://127.0.0.1:${this.config.port}`;
+    }
+}
+/**
+ * Helper to find available port for mock server
+ */
+export async function findMockServerPort(basePort = 9000, maxAttempts = 10) {
+    const net = await import('net');
+    const tryPort = async (port, attemptsLeft) => {
+        if (attemptsLeft === 0) {
+            throw new Error(`Could not find available port after ${maxAttempts} attempts starting from ${basePort}`);
+        }
+        return new Promise((resolve, reject) => {
+            const server = net.createServer();
+            server.unref();
+            server.on('error', async () => {
+                try {
+                    const nextPort = await tryPort(port + 1, attemptsLeft - 1);
+                    resolve(nextPort);
+                }
+                catch (err) {
+                    reject(err);
+                }
+            });
+            server.listen(port, '127.0.0.1', () => {
+                const addr = server.address();
+                const actualPort = typeof addr === 'object' && addr ? addr.port : port;
+                server.close(() => {
+                    resolve(actualPort);
+                });
+            });
+        });
+    };
+    return tryPort(basePort, maxAttempts);
+}
+/**
+ * Reset request counter (useful for rate limit testing)
+ */
+export function resetMockServerState(server) {
+    server.requestCount = 0;
+}

package/build/test/utils/server-launcher.js

@@ -21,21 +21,27 @@ export async function launchServer(config) {
     const GITLAB_API_URL = process.env.GITLAB_API_URL || "https://gitlab.com";
     const GITLAB_TOKEN = process.env.GITLAB_TOKEN_TEST || process.env.GITLAB_TOKEN;
     const TEST_PROJECT_ID = process.env.TEST_PROJECT_ID;
-    // Validate that we have required configuration
-    if (!GITLAB_TOKEN) {
+    // Check if remote authorization is enabled
+    const isRemoteAuth = env.REMOTE_AUTHORIZATION === 'true';
+    // Validate that we have required configuration (unless using remote auth)
+    if (!GITLAB_TOKEN && !isRemoteAuth) {
         throw new Error('GITLAB_TOKEN_TEST or GITLAB_TOKEN environment variable is required for server testing');
     }
-    if (!TEST_PROJECT_ID) {
+    if (!TEST_PROJECT_ID && !isRemoteAuth) {
         throw new Error('TEST_PROJECT_ID environment variable is required for server testing');
     }
     const serverEnv = {
         // Add all environment variables from the current process
         ...process.env,
         GITLAB_API_URL: `${GITLAB_API_URL}/api/v4`,
-        GITLAB_PROJECT_ID: TEST_PROJECT_ID,
+        ...(TEST_PROJECT_ID ? { GITLAB_PROJECT_ID: TEST_PROJECT_ID } : {}),
         GITLAB_READ_ONLY_MODE: 'true', // Use read-only mode for testing
         ...env,
     };
+    // Only set GITLAB_PERSONAL_ACCESS_TOKEN if not using remote auth
+    if (!isRemoteAuth && GITLAB_TOKEN) {
+        serverEnv.GITLAB_PERSONAL_ACCESS_TOKEN = GITLAB_TOKEN;
+    }
     // Set transport-specific environment variables
     switch (mode) {
         case TransportMode.SSE:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.0.7",
+  "version": "2.0.8",
   "description": "MCP server for using the GitLab API",
   "license": "MIT",
   "author": "zereight",
@@ -22,8 +22,9 @@
     "watch": "tsc --watch",
     "deploy": "npm publish --access public",
     "changelog": "auto-changelog -p",
-    "test": "node test/validate-api.js",
+    "test": "node test/validate-api.js && npm run test:remote-auth",
     "test:integration": "node test/validate-api.js",
+    "test:remote-auth": "npm run build && npx tsx --test test/remote-auth-simple-test.ts",
     "test:server": "npm run build && node build/test/test-all-transport-server.js",
     "test:mcp:readonly": "tsx test/readonly-mcp-tests.ts",
     "test:all": "npm run test && npm run test:mcp:readonly",