@zereight/mcp-gitlab 2.1.12 → 2.1.14

package/build/schemas.js

@@ -595,6 +595,39 @@ export const GitLabCurrentUserSchema = z.object({
         extern_uid: z.string(),
     })).optional(),
 }).passthrough();
+// Group related schemas
+export const CreateGroupSchema = z.object({
+    name: z.string().describe("The name of the group"),
+    path: z.string().describe("The path of the group"),
+    description: z.string().optional().describe("The group's description"),
+    visibility: z.enum(["private", "internal", "public"]).optional().describe("The group's visibility level"),
+    parent_id: z.coerce.number().optional().describe("The parent group ID for creating a subgroup"),
+});
+export const GitLabGroupSchema = z.object({
+    id: z.coerce.string(),
+    name: z.string(),
+    path: z.string(),
+    description: z.string().nullable(),
+    visibility: z.string().optional(),
+    share_with_group_lock: z.boolean().optional(),
+    require_two_factor_authentication: z.boolean().optional(),
+    two_factor_grace_period: z.number().optional(),
+    project_creation_level: z.string().optional(),
+    auto_devops_enabled: z.boolean().nullable().optional(),
+    subgroup_creation_level: z.string().optional(),
+    emails_disabled: z.boolean().nullable().optional(),
+    mentions_disabled: z.boolean().nullable().optional(),
+    lfs_enabled: z.boolean().nullable().optional(),
+    avatar_url: z.string().nullable().optional(),
+    web_url: z.string(),
+    request_access_enabled: z.boolean().nullable().optional(),
+    full_name: z.string(),
+    full_path: z.string(),
+    file_template_project_id: z.number().nullable().optional(),
+    parent_id: z.coerce.string().nullable().optional(),
+    created_at: z.string().optional(),
+    statistics: z.any().optional(),
+});
 // Namespace related schemas
 // Base schema for project-related operations
 const ProjectParamsSchema = z.object({
@@ -2404,6 +2437,50 @@ export const GetCommitDiffSchema = z.object({
         .optional()
         .describe("Whether to return the full diff or only first page (default: false)"),
 });
+export const GetFileBlameSchema = z
+    .object({
+    project_id: z.coerce.string().describe("Project ID or complete URL-encoded path to project"),
+    file_path: z.string().describe("The full path of the file to blame, relative to repo root"),
+    ref: z
+        .string()
+        .describe("The name of branch, tag or commit (required by GitLab blame API)"),
+    range_start: z
+        .coerce.number()
+        .int()
+        .optional()
+        .describe("First line of the blame range (inclusive, 1-based). Both range[start] and range[end] must be set together."),
+    range_end: z
+        .coerce.number()
+        .int()
+        .optional()
+        .describe("Last line of the blame range (inclusive, 1-based). Both range[start] and range[end] must be set together."),
+})
+    .refine((v) => (v.range_start === undefined) === (v.range_end === undefined), {
+    message: "range_start and range_end must be provided together (both or neither). Passing only one silently returned full-file blame on GitLab side.",
+    path: ["range_end"],
+})
+    .refine((v) => v.range_start === undefined ||
+    v.range_end === undefined ||
+    v.range_start <= v.range_end, {
+    message: "range_start must be less than or equal to range_end.",
+    path: ["range_start"],
+});
+export const GitLabBlameEntrySchema = z.object({
+    lines: z.array(z.string()).describe("Source lines covered by this blame range"),
+    commit: z
+        .object({
+        id: z.string(),
+        parent_ids: z.array(z.string()).optional(),
+        message: z.string().optional(),
+        authored_date: z.string().optional(),
+        author_name: z.string().optional(),
+        author_email: z.string().optional(),
+        committed_date: z.string().optional(),
+        committer_name: z.string().optional(),
+        committer_email: z.string().optional(),
+    })
+        .passthrough(),
+});
 export const ListCommitStatusesSchema = z
     .object({
     project_id: z.coerce.string().describe("Project ID or complete URL-encoded path to project"),
@@ -2513,6 +2590,11 @@ export const MarkdownUploadSchema = z.object({
     project_id: z.string().describe("Project ID or URL-encoded path of the project"),
     file_path: z.string().describe("Path to the file to upload"),
 });
+export const MarkdownUploadRemoteSchema = z.object({
+    project_id: z.string().describe("Project ID or URL-encoded path of the project"),
+    content: z.string().describe("File content as base64-encoded string"),
+    filename: z.string().describe("Filename for the uploaded content"),
+});
 export const DownloadAttachmentSchema = z.object({
     project_id: z.string().describe("Project ID or URL-encoded path of the project"),
     secret: z.string().describe("The 32-character secret of the upload"),
@@ -2522,6 +2604,11 @@ export const DownloadAttachmentSchema = z.object({
         .optional()
         .describe("Local path to save the file (optional, defaults to current directory)"),
 });
+export const DownloadAttachmentRemoteSchema = z.object({
+    project_id: z.string().describe("Project ID or URL-encoded path of the project"),
+    secret: z.string().describe("The 32-character secret of the upload"),
+    filename: z.string().describe("The filename of the upload"),
+});
 export const GroupIteration = z.object({
     id: z.coerce.string(),
     iid: z.coerce.string(),
@@ -2866,6 +2953,10 @@ export const DownloadJobArtifactsSchema = z.object({
         .optional()
         .describe("Local directory to save the artifact archive (defaults to current directory)"),
 });
+export const DownloadJobArtifactsRemoteSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    job_id: z.coerce.string().describe("The ID of the job"),
+});
 export const GetJobArtifactFileSchema = z.object({
     project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
     job_id: z.coerce.string().describe("The ID of the job"),

package/build/test/test-get-file-blame.js

@@ -0,0 +1,145 @@
+import { describe, test, before, after } from "node:test";
+import assert from "node:assert";
+import { spawn } from "child_process";
+import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server.js";
+const MOCK_TOKEN = "glpat-mock-token-12345";
+const TEST_PROJECT_ID = "123";
+const MOCK_BLAME = [
+    {
+        lines: ["line one", ""],
+        commit: {
+            id: "1111111111111111111111111111111111111111",
+            message: "feat: initial commit",
+            authored_date: "2024-01-01T00:00:00.000Z",
+            author_name: "Alice",
+            author_email: "alice@example.com",
+        },
+    },
+    {
+        lines: ["line three"],
+        commit: {
+            id: "2222222222222222222222222222222222222222",
+            message: "feat: add second change",
+            authored_date: "2024-02-02T00:00:00.000Z",
+            author_name: "Bob",
+            author_email: "bob@example.com",
+        },
+    },
+];
+async function callGetFileBlame(args, env) {
+    return new Promise((resolve, reject) => {
+        const proc = spawn("node", ["build/index.js"], {
+            stdio: ["pipe", "pipe", "pipe"],
+            env: {
+                ...process.env,
+                ...env,
+                GITLAB_READ_ONLY_MODE: "true",
+            },
+        });
+        let output = "";
+        let errorOutput = "";
+        proc.stdout?.on("data", (d) => (output += d));
+        proc.stderr?.on("data", (d) => (errorOutput += d));
+        proc.on("close", (code) => {
+            if (code !== 0)
+                return reject(new Error(`Process exited with code ${code}: ${errorOutput}`));
+            const line = output.split("\n").find((l) => l.startsWith("{"));
+            if (!line)
+                return reject(new Error("No JSON output found"));
+            try {
+                const response = JSON.parse(line);
+                if (response.error)
+                    return reject(response.error);
+                const content = response.result?.content?.[0]?.text;
+                if (content)
+                    return resolve(JSON.parse(content));
+                resolve(response.result);
+            }
+            catch (e) {
+                reject(e);
+            }
+        });
+        proc.stdin?.end(JSON.stringify({
+            jsonrpc: "2.0",
+            id: 1,
+            method: "tools/call",
+            params: { name: "get_file_blame", arguments: args },
+        }) + "\n");
+    });
+}
+describe("get_file_blame", () => {
+    let mockGitLab;
+    let mockGitLabUrl;
+    let lastQuery = {};
+    before(async () => {
+        const mockPort = await findMockServerPort(9000);
+        mockGitLab = new MockGitLabServer({
+            port: mockPort,
+            validTokens: [MOCK_TOKEN],
+        });
+        mockGitLab.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/repository/files/src%2Fexample.txt/blame`, (req, res) => {
+            lastQuery = req.query;
+            res.json(MOCK_BLAME);
+        });
+        await mockGitLab.start();
+        mockGitLabUrl = mockGitLab.getUrl();
+    });
+    after(async () => {
+        await mockGitLab.stop();
+    });
+    test("returns blame entries for a file at ref", async () => {
+        const blame = await callGetFileBlame({
+            project_id: TEST_PROJECT_ID,
+            file_path: "src/example.txt",
+            ref: "main",
+        }, {
+            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
+        });
+        assert.ok(Array.isArray(blame), "Response should be an array");
+        assert.strictEqual(blame.length, 2, "Two blame entries expected");
+        assert.strictEqual(blame[1].commit.id, "2222222222222222222222222222222222222222", "second entry commit id matches");
+        assert.deepStrictEqual(blame[1].lines, ["line three"]);
+        assert.strictEqual(lastQuery.ref, "main", "ref propagated to GitLab API");
+        assert.ok(!("range[start]" in lastQuery) && !("range[end]" in lastQuery), "no range params when omitted");
+    });
+    test("passes range[start]/range[end] when both set", async () => {
+        await callGetFileBlame({
+            project_id: TEST_PROJECT_ID,
+            file_path: "src/example.txt",
+            ref: "main",
+            range_start: 10,
+            range_end: 20,
+        }, {
+            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
+        });
+        assert.strictEqual(lastQuery["range[start]"], "10");
+        assert.strictEqual(lastQuery["range[end]"], "20");
+    });
+    test("rejects partial range (range_start only) at schema layer", async () => {
+        await assert.rejects(() => callGetFileBlame({
+            project_id: TEST_PROJECT_ID,
+            file_path: "src/example.txt",
+            ref: "main",
+            range_start: 10,
+        }, {
+            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
+        }), (e) => typeof e?.message === "string" &&
+            e.message.includes("range_start and range_end must be provided together"));
+    });
+    test("rejects inverted range (start > end) at schema layer", async () => {
+        await assert.rejects(() => callGetFileBlame({
+            project_id: TEST_PROJECT_ID,
+            file_path: "src/example.txt",
+            ref: "main",
+            range_start: 20,
+            range_end: 10,
+        }, {
+            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
+        }), (e) => typeof e?.message === "string" &&
+            e.message.includes("range_start must be less than or equal to range_end"));
+    });
+});

package/build/test/test-geteffectiveprojectid.js

@@ -6,7 +6,7 @@ import { describe, test, before, after } from 'node:test';
 import assert from 'node:assert';
 import { launchServer, findAvailablePort, cleanupServers, TransportMode, HOST } from './utils/server-launcher.js';
 import { MockGitLabServer, findMockServerPort } from './utils/mock-gitlab-server.js';
-import { StreamableHTTPTestClient } from './clients/streamable-http-client.js';
+import { CustomHeaderClient } from './clients/custom-header-client.js';
 // Use the same token that will be passed via GITLAB_TOKEN_TEST environment variable
 const MOCK_TOKEN = process.env.GITLAB_TOKEN_TEST || 'glpat-mock-token-12345';
 const DEFAULT_PROJECT_ID = '123';
@@ -43,6 +43,7 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
                 timeout: 5000,
                 env: {
                     STREAMABLE_HTTP: 'true',
+                    REMOTE_AUTHORIZATION: 'true',
                     GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
                     GITLAB_PROJECT_ID: DEFAULT_PROJECT_ID,
                     GITLAB_READ_ONLY_MODE: 'true',
@@ -50,7 +51,9 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
             });
             servers.push(server);
             mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
-            client = new StreamableHTTPTestClient();
+            client = new CustomHeaderClient({
+                authorization: `Bearer ${MOCK_TOKEN}`,
+            });
             await client.connect(mcpUrl);
             console.log(`Mock GitLab: ${mockGitLabUrl}`);
             console.log(`MCP Server: ${mcpUrl}`);
@@ -113,7 +116,7 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
                 port: mcpPort,
                 timeout: 5000,
                 env: {
-                    STREAMABLE_HTTP: 'true',
+                    REMOTE_AUTHORIZATION: 'true',
                     GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
                     GITLAB_PROJECT_ID: DEFAULT_PROJECT_ID,
                     GITLAB_ALLOWED_PROJECT_IDS: DEFAULT_PROJECT_ID,
@@ -122,7 +125,9 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
             });
             servers.push(server);
             mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
-            client = new StreamableHTTPTestClient();
+            client = new CustomHeaderClient({
+                authorization: `Bearer ${MOCK_TOKEN}`,
+            });
             await client.connect(mcpUrl);
             console.log(`Mock GitLab: ${mockGitLabUrl}`);
             console.log(`MCP Server: ${mcpUrl}`);
@@ -183,7 +188,7 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
                 port: mcpPort,
                 timeout: 5000,
                 env: {
-                    STREAMABLE_HTTP: 'true',
+                    REMOTE_AUTHORIZATION: 'true',
                     GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
                     GITLAB_ALLOWED_PROJECT_IDS: `${DEFAULT_PROJECT_ID},${OTHER_PROJECT_ID}`,
                     GITLAB_READ_ONLY_MODE: 'true',
@@ -191,7 +196,9 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
             });
             servers.push(server);
             mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
-            client = new StreamableHTTPTestClient();
+            client = new CustomHeaderClient({
+                authorization: `Bearer ${MOCK_TOKEN}`,
+            });
             await client.connect(mcpUrl);
             console.log(`Mock GitLab: ${mockGitLabUrl}`);
             console.log(`MCP Server: ${mcpUrl}`);
@@ -242,4 +249,221 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
             console.log(`  ✓ Allowed access to second project ${OTHER_PROJECT_ID}`);
         });
     });
+    describe('GITLAB_PROJECT_ID guards repository and group mutators', () => {
+        let mcpUrl;
+        let mockGitLab;
+        let servers = [];
+        let client;
+        before(async () => {
+            const mockPort = await findMockServerPort(9400);
+            mockGitLab = new MockGitLabServer({
+                port: mockPort,
+                validTokens: [MOCK_TOKEN]
+            });
+            await mockGitLab.start();
+            const mockGitLabUrl = mockGitLab.getUrl();
+            const mcpPort = await findAvailablePort(3400);
+            const server = await launchServer({
+                mode: TransportMode.STREAMABLE_HTTP,
+                port: mcpPort,
+                timeout: 5000,
+                env: {
+                    REMOTE_AUTHORIZATION: 'true',
+                    GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+                    GITLAB_PROJECT_ID: DEFAULT_PROJECT_ID,
+                }
+            });
+            servers.push(server);
+            mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
+            client = new CustomHeaderClient({
+                authorization: `Bearer ${MOCK_TOKEN}`,
+            });
+            await client.connect(mcpUrl);
+        });
+        after(async () => {
+            if (client)
+                await client.disconnect();
+            cleanupServers(servers);
+            if (mockGitLab)
+                await mockGitLab.stop();
+        });
+        test('should reject create_repository when GITLAB_PROJECT_ID is set', async () => {
+            try {
+                await client.callTool('create_repository', { name: 'test-repo' });
+                assert.fail('Should have rejected create_repository');
+            }
+            catch (error) {
+                assert.ok(error instanceof Error);
+                assert.ok(error.message.includes('create_repository is not allowed'), 'Should mention create_repository');
+            }
+        });
+        test('should reject fork_repository when GITLAB_PROJECT_ID is set', async () => {
+            try {
+                await client.callTool('fork_repository', { project_id: '999' });
+                assert.fail('Should have rejected fork_repository');
+            }
+            catch (error) {
+                assert.ok(error instanceof Error);
+                assert.ok(error.message.includes('fork_repository is not allowed'), 'Should mention fork_repository');
+            }
+        });
+        test('should reject create_group when GITLAB_PROJECT_ID is set', async () => {
+            try {
+                await client.callTool('create_group', { name: 'test-group', path: 'test-group' });
+                assert.fail('Should have rejected create_group');
+            }
+            catch (error) {
+                assert.ok(error instanceof Error);
+                assert.ok(error.message.includes('create_group is not allowed'), 'Should mention create_group');
+            }
+        });
+        test('should allow get_project (non-mutator) when GITLAB_PROJECT_ID is set', async () => {
+            const result = await client.callTool('get_project', { project_id: '' });
+            assert.ok(result.content, 'Should have content');
+            const content = result.content[0];
+            assert.ok('text' in content, 'Content should have text');
+            const project = JSON.parse(content.text);
+            assert.strictEqual(project.id.toString(), DEFAULT_PROJECT_ID, 'Should use default project');
+        });
+    });
+    describe('GITLAB_ALLOWED_PROJECT_IDS guards repository and group mutators (allowlist-only, no GITLAB_PROJECT_ID)', () => {
+        let mcpUrl;
+        let mockGitLab;
+        let servers = [];
+        let client;
+        before(async () => {
+            const mockPort = await findMockServerPort(9600);
+            mockGitLab = new MockGitLabServer({
+                port: mockPort,
+                validTokens: [MOCK_TOKEN]
+            });
+            await mockGitLab.start();
+            const mockGitLabUrl = mockGitLab.getUrl();
+            const mcpPort = await findAvailablePort(3600);
+            const server = await launchServer({
+                mode: TransportMode.STREAMABLE_HTTP,
+                port: mcpPort,
+                timeout: 5000,
+                env: {
+                    REMOTE_AUTHORIZATION: 'true',
+                    GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+                    GITLAB_ALLOWED_PROJECT_IDS: DEFAULT_PROJECT_ID,
+                }
+            });
+            servers.push(server);
+            mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
+            client = new CustomHeaderClient({
+                authorization: `Bearer ${MOCK_TOKEN}`,
+            });
+            await client.connect(mcpUrl);
+        });
+        after(async () => {
+            if (client)
+                await client.disconnect();
+            cleanupServers(servers);
+            if (mockGitLab)
+                await mockGitLab.stop();
+        });
+        test('should reject create_repository with GITLAB_ALLOWED_PROJECT_IDS', async () => {
+            try {
+                await client.callTool('create_repository', { name: 'test-repo' });
+                assert.fail('Should have rejected create_repository');
+            }
+            catch (error) {
+                assert.ok(error instanceof Error);
+                assert.ok(error.message.includes('create_repository is not allowed'), 'Should mention create_repository');
+            }
+        });
+        test('should reject fork_repository with GITLAB_ALLOWED_PROJECT_IDS', async () => {
+            try {
+                await client.callTool('fork_repository', { project_id: '999' });
+                assert.fail('Should have rejected fork_repository');
+            }
+            catch (error) {
+                assert.ok(error instanceof Error);
+                assert.ok(error.message.includes('fork_repository is not allowed'), 'Should mention fork_repository');
+            }
+        });
+        test('should reject create_group with GITLAB_ALLOWED_PROJECT_IDS', async () => {
+            try {
+                await client.callTool('create_group', { name: 'test-group', path: 'test-group' });
+                assert.fail('Should have rejected create_group');
+            }
+            catch (error) {
+                assert.ok(error instanceof Error);
+                assert.ok(error.message.includes('create_group is not allowed'), 'Should mention create_group');
+            }
+        });
+        test('should allow get_project (non-mutator) with GITLAB_ALLOWED_PROJECT_IDS', async () => {
+            const result = await client.callTool('get_project', { project_id: '' });
+            assert.ok(result.content, 'Should have content');
+            const content = result.content[0];
+            assert.ok('text' in content, 'Content should have text');
+            const project = JSON.parse(content.text);
+            assert.strictEqual(project.id.toString(), DEFAULT_PROJECT_ID, 'Should use default project');
+        });
+    });
+    describe('GITLAB_READ_ONLY_MODE enforces read-only for all write tools', () => {
+        let mcpUrl;
+        let mockGitLab;
+        let servers = [];
+        let client;
+        before(async () => {
+            const mockPort = await findMockServerPort(9500);
+            mockGitLab = new MockGitLabServer({
+                port: mockPort,
+                validTokens: [MOCK_TOKEN]
+            });
+            await mockGitLab.start();
+            const mockGitLabUrl = mockGitLab.getUrl();
+            const mcpPort = await findAvailablePort(3500);
+            const server = await launchServer({
+                mode: TransportMode.STREAMABLE_HTTP,
+                port: mcpPort,
+                timeout: 5000,
+                env: {
+                    REMOTE_AUTHORIZATION: 'true',
+                    GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+                    GITLAB_READ_ONLY_MODE: 'true',
+                }
+            });
+            servers.push(server);
+            mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
+            client = new CustomHeaderClient({
+                authorization: `Bearer ${MOCK_TOKEN}`,
+            });
+            await client.connect(mcpUrl);
+        });
+        after(async () => {
+            if (client)
+                await client.disconnect();
+            cleanupServers(servers);
+            if (mockGitLab)
+                await mockGitLab.stop();
+        });
+        test('should reject create_group in read-only mode (no project ID)', async () => {
+            try {
+                await client.callTool('create_group', { name: 'test-group', path: 'test-group' });
+                assert.fail('Should have rejected create_group in read-only mode');
+            }
+            catch (error) {
+                assert.ok(error instanceof Error);
+                assert.ok(error.message.includes('create_group is not allowed'), 'Should mention create_group');
+            }
+        });
+        test('should reject create_repository in read-only mode', async () => {
+            try {
+                await client.callTool('create_repository', { name: 'test-repo' });
+                assert.fail('Should have rejected create_repository in read-only mode');
+            }
+            catch (error) {
+                assert.ok(error instanceof Error);
+                assert.ok(error.message.includes('create_repository is not allowed'), 'Should mention create_repository');
+            }
+        });
+        test('should allow get_project (read-only) in read-only mode', async () => {
+            const result = await client.callTool('get_project', { project_id: DEFAULT_PROJECT_ID });
+            assert.ok(result.content, 'Should have content');
+        });
+    });
 }); // end wrapper describe