@zereight/mcp-gitlab 2.1.18 → 2.1.20

package/build/test/mcp-oauth-tests.js

@@ -79,7 +79,6 @@ function addOAuthEndpoints(mockGitLab, validToken, clientId, baseUrl) {
 // Test suite: Discovery endpoints
 // ---------------------------------------------------------------------------
 describe("MCP OAuth — Discovery Endpoints", () => {
-    let mcpUrl;
     let mcpBaseUrl;
     let mockGitLab;
     let servers = [];
@@ -94,7 +93,6 @@ describe("MCP OAuth — Discovery Endpoints", () => {
         addOAuthEndpoints(mockGitLab, MOCK_OAUTH_TOKEN, MOCK_CLIENT_ID, mockGitLabUrl);
         const mcpPort = await findAvailablePort(MCP_SERVER_PORT_BASE);
         mcpBaseUrl = `http://${HOST}:${mcpPort}`;
-        mcpUrl = `${mcpBaseUrl}/mcp`;
         const server = await launchServer({
             mode: TransportMode.STREAMABLE_HTTP,
             port: mcpPort,
@@ -285,13 +283,6 @@ describe("MCP OAuth — /mcp Auth Enforcement", () => {
 describe("MCP OAuth — BoundedClientCache", () => {
     // Access the internal class via a minimal provider (it's not exported directly)
     // by driving it through the public clientsStore API.
-    function makeClient(id, redirectUri = "https://example.com/cb") {
-        return {
-            client_id: id,
-            redirect_uris: [redirectUri],
-            token_endpoint_auth_method: "none",
-        };
-    }
     async function buildCachingProvider() {
         // Spin up a DCR stub that returns a stable client_id from the request body.
         // The stub reads client_id from the incoming body (set by the SDK's register
@@ -380,7 +371,7 @@ describe("MCP OAuth — createGitLabOAuthProvider", () => {
     test("verifyAccessToken throws on non-OK response", async () => {
         // Spin up a tiny local server that always returns 401
         const { createServer } = await import("node:http");
-        const stub = createServer((req, res) => {
+        const stub = createServer((_req, res) => {
             res.writeHead(401);
             res.end(JSON.stringify({ error: "invalid_token" }));
         });
@@ -599,3 +590,195 @@ describe("MCP OAuth — Header Auth Fallback", () => {
         console.log("  ✓ No auth still returns 401");
     });
 });
+// ---------------------------------------------------------------------------
+// Test suite: Group Allowlist (unit tests — exchangeAuthorizationCode)
+// ---------------------------------------------------------------------------
+describe("MCP OAuth — Group Allowlist", () => {
+    let stubServer;
+    let stubUrl;
+    // Mutable state lets each test control the stub's response without
+    // spinning up a new server.
+    let groupsForPage = () => [];
+    let totalPages = 1;
+    before(async () => {
+        const { createServer } = await import("node:http");
+        stubServer = createServer((req, res) => {
+            const url = new URL(req.url, "http://127.0.0.1");
+            res.setHeader("Content-Type", "application/json");
+            // Token exchange — passthrough mode calls POST /oauth/token
+            if (req.method === "POST" && url.pathname === "/oauth/token") {
+                res.writeHead(200).end(JSON.stringify({
+                    access_token: MOCK_OAUTH_TOKEN,
+                    token_type: "bearer",
+                    expires_in: 7200,
+                    refresh_token: "mock-refresh",
+                    scope: "api",
+                }));
+                return;
+            }
+            if (req.method === "GET" && url.pathname === "/api/v4/groups") {
+                const page = Number.parseInt(url.searchParams.get("page") ?? "1", 10);
+                res
+                    .writeHead(200, { "x-total-pages": String(totalPages) })
+                    .end(JSON.stringify(groupsForPage(page)));
+                return;
+            }
+            res.writeHead(404).end("{}");
+        });
+        await new Promise(resolve => stubServer.listen(0, "127.0.0.1", resolve));
+        const addr = stubServer.address();
+        stubUrl = `http://127.0.0.1:${addr.port}`;
+    });
+    after(() => {
+        stubServer.close();
+    });
+    async function makeProvider(allowedGroups = undefined, callbackProxyEnabled = false) {
+        const { createGitLabOAuthProvider } = await import("../oauth-proxy.js");
+        return createGitLabOAuthProvider(stubUrl, "test-app-id", "GitLab MCP Server", false, undefined, // customScopes
+        allowedGroups, callbackProxyEnabled, callbackProxyEnabled ? "https://mcp.example.test/callback" : "" // callbackUrl
+        );
+    }
+    function exchange(provider) {
+        return provider.exchangeAuthorizationCode({}, "mock-auth-code");
+    }
+    test("no allowedGroups — groups API not called, tokens returned", async () => {
+        const provider = await makeProvider(undefined);
+        groupsForPage = () => []; // wrong groups — proves endpoint isn't called
+        totalPages = 1;
+        const tokens = await exchange(provider);
+        assert.strictEqual(tokens.access_token, MOCK_OAUTH_TOKEN);
+        console.log("  ✓ No allowedGroups: token issued without group check");
+    });
+    test("user is direct member of the allowed group → token issued", async () => {
+        const provider = await makeProvider(["my-org"]);
+        groupsForPage = () => [{ full_path: "my-org" }];
+        totalPages = 1;
+        const tokens = await exchange(provider);
+        assert.strictEqual(tokens.access_token, MOCK_OAUTH_TOKEN);
+        console.log("  ✓ Direct group member: token issued");
+    });
+    test("user in first-level subgroup of allowed group → token issued", async () => {
+        const provider = await makeProvider(["my-org"]);
+        groupsForPage = () => [{ full_path: "my-org/team-a" }];
+        totalPages = 1;
+        const tokens = await exchange(provider);
+        assert.strictEqual(tokens.access_token, MOCK_OAUTH_TOKEN);
+        console.log("  ✓ First-level subgroup member: token issued");
+    });
+    test("user in nested subgroup → token issued", async () => {
+        const provider = await makeProvider(["my-org"]);
+        groupsForPage = () => [{ full_path: "my-org/team-a/squad-1" }];
+        totalPages = 1;
+        const tokens = await exchange(provider);
+        assert.strictEqual(tokens.access_token, MOCK_OAUTH_TOKEN);
+        console.log("  ✓ Nested subgroup member: token issued");
+    });
+    test("user not in any matching group → token issuance denied", async () => {
+        const provider = await makeProvider(["my-org"]);
+        groupsForPage = () => [{ full_path: "other-org" }];
+        totalPages = 1;
+        await assert.rejects(() => exchange(provider), (err) => {
+            assert.ok(err.message.includes("Access denied"), `Unexpected message: ${err.message}`);
+            return true;
+        });
+        console.log("  ✓ Non-member: token issuance denied");
+    });
+    test("prefix spoofing rejected — my-org2 does not match my-org", async () => {
+        const provider = await makeProvider(["my-org"]);
+        groupsForPage = () => [{ full_path: "my-org2" }];
+        totalPages = 1;
+        await assert.rejects(() => exchange(provider), (err) => {
+            assert.ok(err.message.includes("Access denied"), `Unexpected message: ${err.message}`);
+            return true;
+        });
+        console.log("  ✓ my-org2 correctly rejected (not a sub-path of my-org)");
+    });
+    test("user matches second of multiple allowed groups → token issued", async () => {
+        const provider = await makeProvider(["team-x", "my-org"]);
+        groupsForPage = () => [{ full_path: "my-org/backend" }];
+        totalPages = 1;
+        const tokens = await exchange(provider);
+        assert.strictEqual(tokens.access_token, MOCK_OAUTH_TOKEN);
+        console.log("  ✓ Match on second allowed group: token issued");
+    });
+    test("match found on page 2 of paginated groups response → token issued", async () => {
+        const provider = await makeProvider(["my-org"]);
+        totalPages = 2;
+        groupsForPage = page => page === 1 ? [{ full_path: "other-org" }] : [{ full_path: "my-org/team-b" }];
+        const tokens = await exchange(provider);
+        assert.strictEqual(tokens.access_token, MOCK_OAUTH_TOKEN);
+        console.log("  ✓ Group found on page 2: token issued");
+    });
+    test("user not in group across all pages → token issuance denied", async () => {
+        const provider = await makeProvider(["my-org"]);
+        totalPages = 2;
+        groupsForPage = () => [{ full_path: "other-org" }];
+        await assert.rejects(() => exchange(provider), (err) => {
+            assert.ok(err.message.includes("Access denied"), `Unexpected message: ${err.message}`);
+            return true;
+        });
+        console.log("  ✓ Non-member across all pages: token issuance denied");
+    });
+    test("callback-proxy exchange also enforces allowed groups", async () => {
+        const provider = await makeProvider(["my-org"], true);
+        groupsForPage = () => [{ full_path: "my-org/team-a" }];
+        totalPages = 1;
+        const proxyCode = "proxy-code-for-group-test";
+        const clientId = "test-client";
+        const redirectUri = "https://client.example.test/callback";
+        provider._storedTokens.set(proxyCode, {
+            tokens: {
+                access_token: MOCK_OAUTH_TOKEN,
+                token_type: "bearer",
+                expires_in: 7200,
+                refresh_token: "mock-refresh",
+                scope: "api",
+            },
+            clientId,
+            clientCodeChallenge: "",
+            clientRedirectUri: redirectUri,
+            createdAt: Date.now(),
+        });
+        const tokens = await provider.exchangeAuthorizationCode({
+            client_id: clientId,
+        }, proxyCode, undefined, redirectUri);
+        assert.strictEqual(tokens.access_token, MOCK_OAUTH_TOKEN);
+        console.log("  ✓ Callback-proxy exchange enforces allowedGroups before issuing tokens");
+    });
+    test("callback-proxy exchange denies users outside allowed groups", async () => {
+        const provider = await makeProvider(["my-org"], true);
+        groupsForPage = () => [{ full_path: "other-org/team-a" }];
+        totalPages = 1;
+        const proxyCode = "proxy-code-for-group-deny-test";
+        const clientId = "test-client-deny";
+        const redirectUri = "https://client.example.test/callback";
+        provider._storedTokens.set(proxyCode, {
+            tokens: {
+                access_token: MOCK_OAUTH_TOKEN,
+                token_type: "bearer",
+                expires_in: 7200,
+                refresh_token: "mock-refresh",
+                scope: "api",
+            },
+            clientId,
+            clientCodeChallenge: "",
+            clientRedirectUri: redirectUri,
+            createdAt: Date.now(),
+        });
+        await assert.rejects(() => provider.exchangeAuthorizationCode({
+            client_id: clientId,
+        }, proxyCode, undefined, redirectUri), (err) => {
+            assert.ok(err.message.includes("Access denied"), `Unexpected message: ${err.message}`);
+            return true;
+        });
+        console.log("  ✓ Callback-proxy exchange denies users outside allowedGroups");
+    });
+    test("matching is case-insensitive", async () => {
+        const provider = await makeProvider(["My-Org"]);
+        groupsForPage = () => [{ full_path: "my-org/team-a" }];
+        totalPages = 1;
+        const tokens = await exchange(provider);
+        assert.strictEqual(tokens.access_token, MOCK_OAUTH_TOKEN);
+        console.log("  ✓ Case-insensitive match: token issued");
+    });
+});

package/build/test/remote-auth-simple-test.js

@@ -10,7 +10,6 @@ import { CustomHeaderClient } from './clients/custom-header-client.js';
 // Test constants
 const MOCK_TOKEN = 'glpat-mock-token-12345';
 const MOCK_JOB_TOKEN = 'glcbt-mock-job-token-9876';
-const TEST_PROJECT_ID = '123';
 // Port ranges to avoid collisions
 const MOCK_GITLAB_PORT_BASE = 9000;
 const MOCK_GITLAB_PORT_OFFSET = 500; // Offset for timeout test suite
@@ -22,6 +21,26 @@ const TIMEOUT_BUFFER_MS = 1000; // Extra time beyond timeout to ensure expiratio
 const TIMEOUT_TEST_WAIT_MS = SESSION_TIMEOUT_SECONDS * 1000 + TIMEOUT_BUFFER_MS;
 const KEEPALIVE_INTERVAL_MS = 2000; // Must be less than SESSION_TIMEOUT_SECONDS
 const KEEPALIVE_REQUEST_COUNT = 3; // Number of keepalive requests to test
+async function getMetrics(mcpUrl) {
+    const metricsUrl = mcpUrl.replace(/\/mcp$/, '/metrics');
+    const response = await fetch(metricsUrl);
+    assert.strictEqual(response.status, 200, 'metrics endpoint should be available');
+    return (await response.json());
+}
+async function waitForSessionDecrease(mcpUrl, beforeTimeout, timeoutMs = 3000) {
+    const startedAt = Date.now();
+    let last = await getMetrics(mcpUrl);
+    while (Date.now() - startedAt < timeoutMs) {
+        if (last.activeSessions < beforeTimeout.activeSessions &&
+            last.authenticatedSessions < beforeTimeout.authenticatedSessions) {
+            return;
+        }
+        await new Promise(resolve => setTimeout(resolve, 100));
+        last = await getMetrics(mcpUrl);
+    }
+    assert.ok(last.activeSessions < beforeTimeout.activeSessions, `activeSessions should decrease after timeout (${last.activeSessions} !< ${beforeTimeout.activeSessions})`);
+    assert.ok(last.authenticatedSessions < beforeTimeout.authenticatedSessions, `authenticatedSessions should decrease after timeout (${last.authenticatedSessions} !< ${beforeTimeout.authenticatedSessions})`);
+}
 console.log('🔐 Remote Authorization Test Suite');
 console.log('');
 describe('Remote Authorization - Basic Functionality', () => {
@@ -178,6 +197,7 @@ describe('Remote Authorization - Session Timeout', () => {
     test('session timeout expiration - inactivity expires auth', async () => {
         // Add a small delay to ensure server is ready/clean from previous test
         await new Promise(resolve => setTimeout(resolve, 1000));
+        const baseline = await getMetrics(mcpUrl);
         // Step 1: Connect WITH auth header to establish session
         const clientWithAuth = new CustomHeaderClient({
             'authorization': `Bearer ${MOCK_TOKEN}`
@@ -190,9 +210,14 @@ describe('Remote Authorization - Session Timeout', () => {
         const sessionId = clientWithAuth.getSessionId();
         assert.ok(sessionId, 'Session ID should exist');
         console.log(`  ℹ️  Session ID: ${sessionId}`);
+        const beforeTimeout = await getMetrics(mcpUrl);
+        assert.strictEqual(beforeTimeout.activeSessions, baseline.activeSessions + 1, 'Session should occupy one additional active slot');
+        assert.strictEqual(beforeTimeout.authenticatedSessions, baseline.authenticatedSessions + 1, 'Session should add one authenticated session');
         // Step 2: Wait for timeout WITHOUT making any requests
         console.log(`  ⏳ Waiting ${TIMEOUT_TEST_WAIT_MS / 1000}s for timeout without activity...`);
         await new Promise(resolve => setTimeout(resolve, TIMEOUT_TEST_WAIT_MS));
+        await waitForSessionDecrease(mcpUrl, beforeTimeout);
+        console.log('  ✓ Timeout closed transport and released active session slot');
         // Step 3: Try to make request WITHOUT auth header - should fail with 401
         try {
             const response = await fetch(mcpUrl, {

package/build/test/stateless/callback-proxy.test.js

@@ -34,7 +34,7 @@ function loadMaterial(current, previous) {
     return m;
 }
 function makeProvider(material, { callbackProxy = true } = {}) {
-    return createGitLabOAuthProvider(GITLAB_BASE, "real-gitlab-app-id", "Test Server", false, undefined, callbackProxy, callbackProxy ? CALLBACK_URL : "", material
+    return createGitLabOAuthProvider(GITLAB_BASE, "real-gitlab-app-id", "Test Server", false, undefined, undefined, callbackProxy, callbackProxy ? CALLBACK_URL : "", material
         ? {
             material,
             clientTtlSeconds: 86400,

package/build/test/stateless/client-id.test.js

@@ -31,6 +31,7 @@ function loadMaterial(current, previous) {
 function makeProvider(material, { callbackProxy = false } = {}) {
     return createGitLabOAuthProvider("https://gitlab.example.com", "real-gitlab-app-id", "GitLab MCP Server (test)", false, // readOnly
     undefined, // customScopes
+    undefined, // allowedGroups
     callbackProxy, callbackProxy ? "https://mcp.example.com/callback" : "", material
         ? {
             material,

package/build/test/test-list-issues.js

@@ -0,0 +1,111 @@
+import { describe, test, before, after } from "node:test";
+import assert from "node:assert";
+import { spawn } from "child_process";
+import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server.js";
+const MOCK_TOKEN = "glpat-mock-token-12345";
+const TEST_PROJECT_ID = "123";
+async function callListIssues(args = {}, env) {
+    return new Promise((resolve, reject) => {
+        const proc = spawn("node", ["build/index.js"], {
+            stdio: ["pipe", "pipe", "pipe"],
+            env: {
+                ...process.env,
+                ...env,
+                GITLAB_READ_ONLY_MODE: "true",
+            },
+        });
+        let output = "";
+        let errorOutput = "";
+        proc.stdout?.on("data", d => (output += d));
+        proc.stderr?.on("data", d => (errorOutput += d));
+        proc.on("close", code => {
+            if (code !== 0) {
+                return reject(new Error(`Process exited with code ${code}: ${errorOutput}`));
+            }
+            const line = output.split("\n").find(l => l.startsWith("{"));
+            if (!line) {
+                return reject(new Error("No JSON output found"));
+            }
+            try {
+                const response = JSON.parse(line);
+                if (response.error) {
+                    reject(response.error);
+                }
+                else {
+                    const content = response.result?.content?.[0]?.text;
+                    if (content) {
+                        try {
+                            resolve(JSON.parse(content));
+                        }
+                        catch {
+                            reject(new Error(`Failed to parse tool output JSON: ${content}`));
+                        }
+                    }
+                    else {
+                        resolve(response.result);
+                    }
+                }
+            }
+            catch (e) {
+                reject(e);
+            }
+        });
+        proc.stdin?.end(JSON.stringify({
+            jsonrpc: "2.0",
+            id: 1,
+            method: "tools/call",
+            params: { name: "list_issues", arguments: args },
+        }) + "\n");
+    });
+}
+describe("list_issues", () => {
+    let mockGitLab;
+    let mockGitLabUrl;
+    before(async () => {
+        const mockPort = await findMockServerPort(9000);
+        mockGitLab = new MockGitLabServer({
+            port: mockPort,
+            validTokens: [MOCK_TOKEN],
+        });
+        await mockGitLab.start();
+        mockGitLabUrl = mockGitLab.getUrl();
+    });
+    after(async () => {
+        await mockGitLab.stop();
+    });
+    test("lists project-specific issues", async () => {
+        const issues = await callListIssues({ project_id: TEST_PROJECT_ID }, {
+            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
+        });
+        assert.ok(Array.isArray(issues), "Response should be an array");
+        assert.strictEqual(issues.length, 1, "Should return 1 mock issue");
+        const firstIssue = issues[0];
+        assert.ok(firstIssue && typeof firstIssue === "object" && "title" in firstIssue);
+        const title = Reflect.get(firstIssue, "title");
+        assert.strictEqual(title, "Test Issue 1");
+    });
+    test("prefers author_username over author_id when both are provided", async () => {
+        let capturedUrl;
+        mockGitLab.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/issues`, (req, res) => {
+            capturedUrl = req.originalUrl;
+            res.json([]);
+        });
+        try {
+            await callListIssues({
+                project_id: TEST_PROJECT_ID,
+                author_id: "42",
+                author_username: "alice",
+            }, {
+                GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+                GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
+            });
+            assert.ok(capturedUrl, "Mock handler should have received a request");
+            assert.match(capturedUrl, /author_username=alice/, "Request should include author_username");
+            assert.doesNotMatch(capturedUrl, /author_id=/, "Request should not include author_id");
+        }
+        finally {
+            mockGitLab.clearCustomHandlers();
+        }
+    });
+});

package/build/test/test-protected-branches.js

@@ -0,0 +1,155 @@
+import { after, before, describe, test } from "node:test";
+import assert from "node:assert";
+import { spawn } from "child_process";
+import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server.js";
+const MOCK_TOKEN = "glpat-mock-token-protected-branches";
+const TEST_PROJECT_ID = "123";
+const TEST_BRANCH = "main";
+function buildProtectedBranch(overrides = {}) {
+    return {
+        id: 1,
+        name: TEST_BRANCH,
+        push_access_levels: [
+            { access_level: 30, access_level_description: "Developers + Maintainers" },
+        ],
+        merge_access_levels: [{ access_level: 40, access_level_description: "Maintainers" }],
+        unprotect_access_levels: [{ access_level: 60, access_level_description: "Administrators" }],
+        allow_force_push: false,
+        code_owner_approval_required: false,
+        ...overrides,
+    };
+}
+async function callTool(toolName, args, env) {
+    return new Promise((resolve, reject) => {
+        const proc = spawn("node", ["build/index.js"], {
+            stdio: ["pipe", "pipe", "pipe"],
+            env: {
+                ...process.env,
+                ...env,
+            },
+        });
+        let output = "";
+        let errorOutput = "";
+        proc.stdout?.on("data", (d) => (output += d));
+        proc.stderr?.on("data", (d) => (errorOutput += d));
+        proc.on("close", code => {
+            if (code !== 0) {
+                reject(new Error(`Process exited with code ${code}: ${errorOutput}`));
+                return;
+            }
+            const line = output.split("\n").find(l => l.startsWith("{"));
+            if (!line) {
+                reject(new Error("No JSON output found"));
+                return;
+            }
+            const response = JSON.parse(line);
+            if (response.error) {
+                reject(new Error(response.error.message ?? JSON.stringify(response.error)));
+                return;
+            }
+            const content = response.result?.content?.[0]?.text;
+            if (!content) {
+                resolve(response.result);
+                return;
+            }
+            try {
+                resolve(JSON.parse(content));
+            }
+            catch {
+                resolve(content);
+            }
+        });
+        proc.stdin?.end(JSON.stringify({
+            jsonrpc: "2.0",
+            id: 1,
+            method: "tools/call",
+            params: { name: toolName, arguments: args },
+        }) + "\n");
+    });
+}
+describe("protected branch tools", () => {
+    let mockGitLab;
+    let mockGitLabUrl;
+    before(async () => {
+        const mockPort = await findMockServerPort(20500, 50);
+        mockGitLab = new MockGitLabServer({
+            port: mockPort,
+            validTokens: [MOCK_TOKEN],
+        });
+        mockGitLab.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/protected_branches`, (req, res) => {
+            assert.strictEqual(req.query.search, "main");
+            assert.strictEqual(req.query.page, "2");
+            assert.strictEqual(req.query.per_page, "10");
+            res.json([buildProtectedBranch()]);
+        });
+        mockGitLab.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/protected_branches/${TEST_BRANCH}`, (_req, res) => {
+            res.json(buildProtectedBranch());
+        });
+        mockGitLab.addMockHandler("post", `/projects/${TEST_PROJECT_ID}/protected_branches`, (req, res) => {
+            assert.deepStrictEqual(req.body, {
+                name: TEST_BRANCH,
+                push_access_level: 30,
+                merge_access_level: 40,
+                unprotect_access_level: 60,
+                allow_force_push: false,
+                code_owner_approval_required: false,
+            });
+            res.status(201).json(buildProtectedBranch());
+        });
+        mockGitLab.addMockHandler("delete", `/projects/${TEST_PROJECT_ID}/protected_branches/${TEST_BRANCH}`, (_req, res) => {
+            res.status(204).send();
+        });
+        mockGitLab.addMockHandler("put", `/projects/${TEST_PROJECT_ID}`, (req, res) => {
+            assert.deepStrictEqual(req.body, { default_branch: TEST_BRANCH });
+            res.json({ id: Number(TEST_PROJECT_ID), default_branch: TEST_BRANCH });
+        });
+        await mockGitLab.start();
+        mockGitLabUrl = mockGitLab.getUrl();
+    });
+    after(async () => {
+        await mockGitLab.stop();
+    });
+    const env = () => ({
+        GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+        GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
+        GITLAB_TOOLSETS: "branches",
+    });
+    test("list_protected_branches forwards search and pagination", async () => {
+        const result = await callTool("list_protected_branches", { project_id: TEST_PROJECT_ID, search: "main", page: 2, per_page: 10 }, env());
+        assert.ok(Array.isArray(result));
+        assert.strictEqual(result[0].name, TEST_BRANCH);
+    });
+    test("get_protected_branch parses a single protected branch", async () => {
+        const result = await callTool("get_protected_branch", { project_id: TEST_PROJECT_ID, branch_name: TEST_BRANCH }, env());
+        assert.strictEqual(result.name, TEST_BRANCH);
+        assert.strictEqual(result.allow_force_push, false);
+    });
+    test("protect_branch posts normalized branch name, access levels, and false booleans", async () => {
+        const result = await callTool("protect_branch", {
+            project_id: TEST_PROJECT_ID,
+            branch_name: TEST_BRANCH,
+            push_access_level: "30",
+            merge_access_level: 40,
+            unprotect_access_level: 60,
+            allow_force_push: "false",
+            code_owner_approval_required: "false",
+        }, env());
+        assert.strictEqual(result.name, TEST_BRANCH);
+    });
+    test("protect_branch rejects invalid access levels before calling GitLab", async () => {
+        await assert.rejects(() => callTool("protect_branch", {
+            project_id: TEST_PROJECT_ID,
+            branch_name: TEST_BRANCH,
+            push_access_level: 99,
+        }, env()), /Access level must be one of/);
+    });
+    test("unprotect_branch sends DELETE and returns status", async () => {
+        const result = await callTool("unprotect_branch", { project_id: TEST_PROJECT_ID, branch_name: TEST_BRANCH }, env());
+        assert.deepStrictEqual(result, { status: "unprotected", branch: TEST_BRANCH });
+    });
+    test("update_default_branch sends the expected PUT body", async () => {
+        const result = await callTool("update_default_branch", { project_id: TEST_PROJECT_ID, default_branch: TEST_BRANCH }, env());
+        assert.strictEqual(result.status, "updated");
+        assert.strictEqual(result.default_branch, TEST_BRANCH);
+    });
+});

package/build/test/test-toolset-filtering.js

@@ -19,7 +19,7 @@ const TOOLSET_TOOL_COUNTS = {
     merge_requests: 41,
     issues: 24,
     repositories: 7,
-    branches: 10,
+    branches: 15,
     projects: 9,
     labels: 5,
     ci: 2,

package/build/test/utils/tool-args.test.js

@@ -1,6 +1,6 @@
 import assert from "node:assert/strict";
 import { describe, test } from "node:test";
-import { sanitizeToolArguments } from "../../utils/tool-args.js";
+import { cleanMutuallyExclusiveIdUsernameOptions, LIST_MERGE_REQUESTS_ID_USERNAME_PAIRS, sanitizeToolArguments, } from "../../utils/tool-args.js";
 describe("When sanitizeToolArguments runs", () => {
     describe("with top-level null optionals", () => {
         test("should omit null and undefined keys for generic tools", () => {
@@ -73,3 +73,50 @@ describe("When sanitizeToolArguments runs", () => {
         });
     });
 });
+describe("When cleanMutuallyExclusiveIdUsernameOptions runs", () => {
+    describe("with list_issues author filters", () => {
+        test("should drop author_id when author_username is also set", () => {
+            const result = cleanMutuallyExclusiveIdUsernameOptions({
+                author_id: "42",
+                author_username: "alice",
+                state: "opened",
+            });
+            assert.deepEqual(result, {
+                author_username: "alice",
+                state: "opened",
+            });
+        });
+    });
+    describe("with list_issues assignee filters", () => {
+        test("should drop assignee_id when assignee_username is also set", () => {
+            const result = cleanMutuallyExclusiveIdUsernameOptions({
+                assignee_id: "7",
+                assignee_username: ["bob"],
+            });
+            assert.deepEqual(result, {
+                assignee_username: ["bob"],
+            });
+        });
+        test("should keep assignee_id when assignee_username is an empty array", () => {
+            const result = cleanMutuallyExclusiveIdUsernameOptions({
+                assignee_id: "7",
+                assignee_username: [],
+            });
+            assert.deepEqual(result, {
+                assignee_id: "7",
+                assignee_username: [],
+            });
+        });
+    });
+    describe("with list_merge_requests reviewer filters", () => {
+        test("should drop reviewer_id when reviewer_username is also set", () => {
+            const result = cleanMutuallyExclusiveIdUsernameOptions({
+                reviewer_id: "3",
+                reviewer_username: "carol",
+            }, LIST_MERGE_REQUESTS_ID_USERNAME_PAIRS);
+            assert.deepEqual(result, {
+                reviewer_username: "carol",
+            });
+        });
+    });
+});