@zereight/mcp-gitlab 2.1.21 → 2.1.22

package/README.ko.md

@@ -187,7 +187,7 @@ MCP 서버가 직접 로컬 브라우저 callback을 받을 때만 `GITLAB_OAUTH
 | `STREAMABLE_HTTP` | 예 | 반드시 `true` |
 | `GITLAB_OAUTH_CALLBACK_PROXY` | 선택 | MCP 서버의 고정 `/callback` URL을 사용하려면 `true` |
 | `GITLAB_OAUTH_SCOPES` | 선택 | 쉼표로 구분된 scope 목록(기본값: `api,read_api,read_user`) |
-| `GITLAB_ALLOWED_GROUPS` | 선택 | 쉼표로 구분된 GitLab 그룹 전체 경로 — 해당 그룹 및 하위 그룹 멤버만 토큰을 발급받을 수 있음 |
+| `GITLAB_OAUTH_ALLOWED_GROUPS` | 선택 | 쉼표로 구분된 GitLab 그룹 전체 경로 — 해당 그룹 및 하위 그룹 멤버만 토큰을 발급받을 수 있음 (기존 `GITLAB_ALLOWED_GROUPS` 대체) |
 
 > **`Unregistered redirect_uri` 문제 해결**
 >

package/README.md

@@ -208,7 +208,7 @@ exchanging credentials with GitLab on behalf of the client.
 | `STREAMABLE_HTTP`     | ✅       | Must be `true`                                             |
 | `GITLAB_OAUTH_CALLBACK_PROXY` | optional | Set to `true` to use the MCP server's fixed `/callback` URL |
 | `GITLAB_OAUTH_SCOPES` | optional | Comma-separated scopes (default: `api,read_api,read_user`) |
-| `GITLAB_ALLOWED_GROUPS` | optional | Comma-separated group full paths — only members (and subgroup members) may obtain a token |
+| `GITLAB_OAUTH_ALLOWED_GROUPS` | optional | Comma-separated group full paths — only members (and subgroup members) may obtain a token (replaces deprecated `GITLAB_ALLOWED_GROUPS`) |
 
 When `STREAMABLE_HTTP=true`, server-side `GITLAB_PERSONAL_ACCESS_TOKEN` or `GITLAB_JOB_TOKEN` require `REMOTE_AUTHORIZATION=true` or `GITLAB_MCP_OAUTH=true`.
 
@@ -265,6 +265,13 @@ the token to GitLab on behalf of the caller.
 | `REMOTE_AUTHORIZATION`   | ✅       | Set to `true` to enable                                    |
 | `STREAMABLE_HTTP`        | ✅       | Must be `true`                                             |
 | `ENABLE_DYNAMIC_API_URL` | optional | Allow per-request GitLab URL via `X-GitLab-API-URL` header |
+| `MCP_TRUST_PROXY`        | optional | Trust `Forwarded` / `X-Forwarded-*` headers for public download URLs when deployed behind a trusted reverse proxy |
+
+When `MCP_SERVER_URL` is not set, remote download URLs fall back to the local
+server address. Set `MCP_TRUST_PROXY=true` only if the server is reachable through a
+trusted reverse proxy and direct client access to the MCP server is blocked.
+This lets the server derive public download URLs from `Forwarded` /
+`X-Forwarded-Proto`, `X-Forwarded-Host`, and `X-Forwarded-Prefix`.
 
 **Example request headers**:
 
@@ -299,6 +306,7 @@ Commonly referenced variables:
 - `GITLAB_PERSONAL_ACCESS_TOKEN`
 - `GITLAB_USE_OAUTH`
 - `REMOTE_AUTHORIZATION`
+- `MCP_TRUST_PROXY`
 - `GITLAB_MCP_OAUTH`
 - `GITLAB_OAUTH_CALLBACK_PROXY`
 - `OAUTH_STATELESS_MODE`

package/README.zh-CN.md

@@ -187,7 +187,7 @@ OpenCode、MCPJam、Claude.ai 等远程 MCP 客户端可能会在授权时发送
 | `STREAMABLE_HTTP` | 是 | 必须为 `true` |
 | `GITLAB_OAUTH_CALLBACK_PROXY` | 可选 | 设置为 `true` 时使用 MCP 服务器固定的 `/callback` URL |
 | `GITLAB_OAUTH_SCOPES` | 可选 | 逗号分隔的 scope（默认：`api,read_api,read_user`） |
-| `GITLAB_ALLOWED_GROUPS` | 可选 | 逗号分隔的 GitLab 群组完整路径 — 仅该群组及其子群组的成员可获取令牌 |
+| `GITLAB_OAUTH_ALLOWED_GROUPS` | 可选 | 逗号分隔的 GitLab 群组完整路径 — 仅该群组及其子群组的成员可获取令牌（替代已废弃的 `GITLAB_ALLOWED_GROUPS`）|
 
 > **排查 `Unregistered redirect_uri`**
 >

package/build/config.js

@@ -47,6 +47,7 @@ export const SSE = getConfig("sse", "SSE") === "true";
 export const STREAMABLE_HTTP = getConfig("streamable-http", "STREAMABLE_HTTP") === "true";
 export const REMOTE_AUTHORIZATION = getConfig("remote-auth", "REMOTE_AUTHORIZATION") === "true";
 export const GITLAB_MCP_OAUTH = getConfig("mcp-oauth", "GITLAB_MCP_OAUTH") === "true";
+export const MCP_TRUST_PROXY = getConfig("mcp-trust-proxy", "MCP_TRUST_PROXY") === "true";
 // ---------------------------------------------------------------------------
 // OAuth / MCP OAuth
 // ---------------------------------------------------------------------------
@@ -57,8 +58,13 @@ export const GITLAB_OAUTH_SCOPES = GITLAB_OAUTH_SCOPES_RAW
     ? GITLAB_OAUTH_SCOPES_RAW.split(",").map((s) => s.trim()).filter(Boolean)
     : undefined;
 export const GITLAB_OAUTH_CALLBACK_PROXY = getConfig("oauth-callback-proxy", "GITLAB_OAUTH_CALLBACK_PROXY") === "true";
-export const GITLAB_ALLOWED_GROUPS = (() => {
-    const raw = getConfig("allowed-groups", "GITLAB_ALLOWED_GROUPS");
+/** @deprecated Use GITLAB_OAUTH_ALLOWED_GROUPS_RAW instead. Will be removed in the next major version. */
+export const GITLAB_ALLOWED_GROUPS_RAW = getConfig("allowed-groups", "GITLAB_ALLOWED_GROUPS");
+export const GITLAB_OAUTH_ALLOWED_GROUPS_RAW = getConfig("oauth-allowed-groups", "GITLAB_OAUTH_ALLOWED_GROUPS");
+export const GITLAB_OAUTH_ALLOWED_GROUPS = (() => {
+    const newVar = GITLAB_OAUTH_ALLOWED_GROUPS_RAW;
+    const oldVar = GITLAB_ALLOWED_GROUPS_RAW;
+    const raw = newVar ?? oldVar;
     if (!raw)
         return undefined;
     const groups = raw.split(",").map((g) => g.trim()).filter(Boolean);

package/build/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { getConfig, ENABLE_DYNAMIC_API_URL, GITLAB_AUTH_COOKIE_PATH, GITLAB_CA_CERT_PATH, GITLAB_JOB_TOKEN, GITLAB_MCP_OAUTH, GITLAB_OAUTH_APP_ID, GITLAB_OAUTH_SCOPES, GITLAB_OAUTH_CALLBACK_PROXY, GITLAB_PERSONAL_ACCESS_TOKEN, GITLAB_POOL_MAX_SIZE, GITLAB_READ_ONLY_MODE, GITLAB_TOOLSETS_RAW, GITLAB_TOOLS_RAW, HOST, HTTP_PROXY, HTTPS_PROXY, IS_OLD, MCP_SERVER_URL, NODE_TLS_REJECT_UNAUTHORIZED, NO_PROXY, OAUTH_STATELESS_CLIENT_TTL_SECONDS, OAUTH_STATELESS_MODE, OAUTH_STATELESS_PENDING_TTL_SECONDS, OAUTH_STATELESS_SESSION_TTL_SECONDS, OAUTH_STATELESS_STORED_TTL_SECONDS, PORT, REMOTE_AUTHORIZATION, SESSION_TIMEOUT_SECONDS, SSE, STREAMABLE_HTTP, USE_GITLAB_WIKI, USE_MILESTONE, USE_OAUTH, USE_PIPELINE, GITLAB_TOOL_POLICY_APPROVE_RAW, GITLAB_TOOL_POLICY_HIDDEN_RAW, GITLAB_ALLOWED_GROUPS, } from "./config.js";
+import { getConfig, ENABLE_DYNAMIC_API_URL, GITLAB_AUTH_COOKIE_PATH, GITLAB_CA_CERT_PATH, GITLAB_JOB_TOKEN, GITLAB_MCP_OAUTH, GITLAB_OAUTH_APP_ID, GITLAB_OAUTH_SCOPES, GITLAB_OAUTH_CALLBACK_PROXY, GITLAB_PERSONAL_ACCESS_TOKEN, GITLAB_POOL_MAX_SIZE, GITLAB_READ_ONLY_MODE, GITLAB_TOOLSETS_RAW, GITLAB_TOOLS_RAW, HOST, HTTP_PROXY, HTTPS_PROXY, IS_OLD, MCP_SERVER_URL, NODE_TLS_REJECT_UNAUTHORIZED, NO_PROXY, OAUTH_STATELESS_CLIENT_TTL_SECONDS, OAUTH_STATELESS_MODE, OAUTH_STATELESS_PENDING_TTL_SECONDS, OAUTH_STATELESS_SESSION_TTL_SECONDS, OAUTH_STATELESS_STORED_TTL_SECONDS, PORT, REMOTE_AUTHORIZATION, SESSION_TIMEOUT_SECONDS, SSE, STREAMABLE_HTTP, MCP_TRUST_PROXY, USE_GITLAB_WIKI, USE_MILESTONE, USE_OAUTH, USE_PIPELINE, GITLAB_TOOL_POLICY_APPROVE_RAW, GITLAB_TOOL_POLICY_HIDDEN_RAW, GITLAB_OAUTH_ALLOWED_GROUPS_RAW, GITLAB_ALLOWED_GROUPS_RAW, GITLAB_OAUTH_ALLOWED_GROUPS, } from "./config.js";
 /** True when the server is running in remote/network mode (SSE or StreamableHTTP transport). */
 const IS_REMOTE = SSE || STREAMABLE_HTTP;
 /**
@@ -59,17 +59,74 @@ function decryptDownloadToken(tokenStr) {
         return null;
     }
 }
+function getLastHeaderValue(value) {
+    const raw = Array.isArray(value) ? value[value.length - 1] : value;
+    if (!raw)
+        return undefined;
+    const parts = raw.split(",").map(part => part.trim()).filter(Boolean);
+    return parts.length > 0 ? parts[parts.length - 1] : undefined;
+}
+function unquoteHeaderValue(value) {
+    if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) {
+        return value.slice(1, -1).replace(/\\"/g, '"').replace(/\\\\/g, "\\");
+    }
+    return value;
+}
+function getForwardedPublicBaseUrl(req) {
+    if (!MCP_TRUST_PROXY)
+        return undefined;
+    const forwarded = getLastHeaderValue(req.headers.forwarded);
+    const forwardedValues = {};
+    if (forwarded) {
+        for (const part of forwarded.split(";")) {
+            const separator = part.indexOf("=");
+            if (separator <= 0)
+                continue;
+            const key = part.slice(0, separator).trim().toLowerCase();
+            const value = unquoteHeaderValue(part.slice(separator + 1).trim());
+            if (key && value)
+                forwardedValues[key] = value;
+        }
+    }
+    const proto = (forwardedValues.proto || getLastHeaderValue(req.headers["x-forwarded-proto"]))?.toLowerCase();
+    const host = forwardedValues.host || getLastHeaderValue(req.headers["x-forwarded-host"]);
+    if (!proto || !host || !/^https?$/.test(proto))
+        return undefined;
+    if (/[\s/\\]/.test(host))
+        return undefined;
+    const prefix = getLastHeaderValue(req.headers["x-forwarded-prefix"]);
+    const safePrefix = prefix &&
+        prefix.startsWith("/") &&
+        !prefix.startsWith("//") &&
+        !prefix.includes("://") &&
+        !/[\s\\]/.test(prefix)
+        ? prefix.replace(/\/+$/, "")
+        : undefined;
+    try {
+        const baseUrl = new URL(`${proto}://${host}`);
+        if (baseUrl.username || baseUrl.password || baseUrl.pathname !== "/" || baseUrl.search || baseUrl.hash) {
+            return undefined;
+        }
+        if (safePrefix)
+            baseUrl.pathname = safePrefix;
+        return baseUrl.toString().replace(/\/$/, "");
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * Build a URL pointing to the download proxy endpoint.
  * Embeds an encrypted auth token (and API URL for dynamic routing)
  * from the current session so the URL works standalone.
  */
 function buildDownloadUrl(type, params) {
-    const base = MCP_SERVER_URL || `http://${HOST}:${PORT}`;
+    const base = MCP_SERVER_URL || sessionAuthStore.getStore()?.publicBaseUrl || `http://${HOST}:${PORT}`;
     const baseUrl = new URL(base);
     // Preserve any path prefix (e.g. /gitlab-mcp) from the base URL
     const basePath = baseUrl.pathname.replace(/\/+$/, "");
-    const url = new URL(`${basePath}/downloads/${type}`, baseUrl.origin);
+    const safeBasePath = basePath ? `/${basePath.replace(/^\/+/, "")}` : "";
+    const url = new URL(`${safeBasePath}/downloads/${type}`, baseUrl.origin);
     for (const [key, value] of Object.entries(params)) {
         url.searchParams.set(key, value);
     }
@@ -429,6 +486,7 @@ function createServer() {
                     token: authData.token,
                     lastUsed: authData.lastUsed,
                     apiUrl: authData.apiUrl,
+                    publicBaseUrl: authData.publicBaseUrl,
                 };
                 // Run the handler within the retrieved context
                 const result = await sessionAuthStore.run(sessionContext, () => handleToolCall(request.params));
@@ -856,6 +914,15 @@ const sessionAuthStore = new AsyncLocalStorage();
 // Session context map for storing auth data by session ID
 // This survives async boundaries where AsyncLocalStorage might not
 const authBySession = {};
+function withPublicBaseUrl(authData, publicBaseUrl, previous) {
+    const effectivePublicBaseUrl = publicBaseUrl || previous?.publicBaseUrl;
+    return effectivePublicBaseUrl ? { ...authData, publicBaseUrl: effectivePublicBaseUrl } : authData;
+}
+function updateSessionPublicBaseUrl(sessionId, publicBaseUrl) {
+    if (sessionId && publicBaseUrl && authBySession[sessionId]) {
+        authBySession[sessionId].publicBaseUrl = publicBaseUrl;
+    }
+}
 // Base headers without authentication
 const BASE_HEADERS = {
     Accept: "application/json",
@@ -8995,6 +9062,7 @@ async function startStreamableHTTPServer() {
             token: effective.token,
             lastUsed: Date.now(),
             apiUrl: effective.apiUrl,
+            publicBaseUrl: getForwardedPublicBaseUrl(req),
         };
         // Step 4: create a fresh transport per request.
         const transport = isInit
@@ -9044,13 +9112,13 @@ async function startStreamableHTTPServer() {
         });
     };
     // Configure Express middleware
+    if (MCP_TRUST_PROXY) {
+        app.set("trust proxy", 1);
+    }
     app.use(express.json());
     registerDownloadProxy(app);
     // MCP OAuth — mount auth router and prepare bearer-auth middleware
     if (GITLAB_MCP_OAUTH) {
-        // Trust first proxy so express-rate-limit uses X-Forwarded-For for real client IP.
-        // Only enabled in OAuth mode where the server is typically behind a reverse proxy.
-        app.set("trust proxy", 1);
         const gitlabBaseUrl = GITLAB_API_URL.replace(/\/api\/v4\/?$/, "").replace(/\/$/, "");
         const issuerUrl = new URL(MCP_SERVER_URL);
         const callbackUrl = GITLAB_OAUTH_CALLBACK_PROXY
@@ -9064,7 +9132,7 @@ async function startStreamableHTTPServer() {
                 storedTtlSeconds: OAUTH_STATELESS_STORED_TTL_SECONDS,
             }
             : null;
-        const oauthProvider = createGitLabOAuthProvider(gitlabBaseUrl, GITLAB_OAUTH_APP_ID, "GitLab MCP Server", GITLAB_READ_ONLY_MODE, GITLAB_OAUTH_SCOPES, GITLAB_ALLOWED_GROUPS, GITLAB_OAUTH_CALLBACK_PROXY, callbackUrl, statelessOptions);
+        const oauthProvider = createGitLabOAuthProvider(gitlabBaseUrl, GITLAB_OAUTH_APP_ID, "GitLab MCP Server", GITLAB_READ_ONLY_MODE, GITLAB_OAUTH_SCOPES, GITLAB_OAUTH_ALLOWED_GROUPS, GITLAB_OAUTH_CALLBACK_PROXY, callbackUrl, statelessOptions);
         const scopesSupported = GITLAB_OAUTH_SCOPES ?? ["api", "read_api", "read_user"];
         // When server URL has a path (e.g. behind Kong), the SDK's well-known metadata
         // advertises root-level endpoints. Override to use path-prefixed endpoints.
@@ -9178,6 +9246,7 @@ async function startStreamableHTTPServer() {
     // Streamable HTTP endpoint - handles both session creation and message handling
     app.post("/mcp", mcpBearerAuth, async (req, res) => {
         const sessionId = readMcpSessionIdHeader(req);
+        const publicBaseUrl = getForwardedPublicBaseUrl(req);
         // Track request
         metrics.requestsProcessed++;
         // Stateless-mode branch: bypass authBySession / streamableTransports
@@ -9222,19 +9291,20 @@ async function startStreamableHTTPServer() {
                     return;
                 }
                 // Store auth for this session
-                authBySession[sessionId] = authData;
+                authBySession[sessionId] = withPublicBaseUrl(authData, publicBaseUrl);
                 logger.info(`Session ${sessionId}: stored ${authData.header} header`);
                 setAuthTimeout(sessionId);
             }
             else if (sessionId && authData) {
                 // Existing session: allow auth rotation/update
-                authBySession[sessionId] = authData;
+                authBySession[sessionId] = withPublicBaseUrl(authData, publicBaseUrl, authBySession[sessionId]);
                 logger.debug(`Session ${sessionId}: updated ${authData.header} header`);
                 setAuthTimeout(sessionId);
             }
             else if (sessionId && authBySession[sessionId]) {
                 // Existing session with stored auth: update last used time and reset timeout
                 authBySession[sessionId].lastUsed = Date.now();
+                updateSessionPublicBaseUrl(sessionId, publicBaseUrl);
                 setAuthTimeout(sessionId);
             }
             else if (!sessionId && !authData) {
@@ -9250,17 +9320,12 @@ async function startStreamableHTTPServer() {
             if (headerAuthData) {
                 if (headerAuthData && sessionId) {
                     if (!authBySession[sessionId]) {
-                        authBySession[sessionId] = headerAuthData;
+                        authBySession[sessionId] = withPublicBaseUrl(headerAuthData, publicBaseUrl);
                         logger.info(`Session ${sessionId}: stored ${headerAuthData.header} header (header auth)`);
                         setAuthTimeout(sessionId);
                     }
                     else {
-                        authBySession[sessionId] = {
-                            ...authBySession[sessionId],
-                            header: headerAuthData.header,
-                            token: headerAuthData.token,
-                            lastUsed: Date.now(),
-                        };
+                        authBySession[sessionId] = withPublicBaseUrl(headerAuthData, publicBaseUrl, authBySession[sessionId]);
                         setAuthTimeout(sessionId);
                     }
                 }
@@ -9274,6 +9339,7 @@ async function startStreamableHTTPServer() {
                             token: authInfo.token,
                             lastUsed: Date.now(),
                             apiUrl: GITLAB_API_URL,
+                            publicBaseUrl,
                         };
                         logger.info(`Session ${sessionId}: stored OAuth token (client: ${authInfo.clientId})`);
                         setAuthTimeout(sessionId);
@@ -9282,6 +9348,7 @@ async function startStreamableHTTPServer() {
                         // Update token on every request — the client may have refreshed it
                         authBySession[sessionId].token = authInfo.token;
                         authBySession[sessionId].lastUsed = Date.now();
+                        updateSessionPublicBaseUrl(sessionId, publicBaseUrl);
                         setAuthTimeout(sessionId);
                     }
                 }
@@ -9309,7 +9376,7 @@ async function startStreamableHTTPServer() {
                             if (REMOTE_AUTHORIZATION && !authBySession[newSessionId]) {
                                 const authData = parseAuthHeaders(req);
                                 if (authData) {
-                                    authBySession[newSessionId] = authData;
+                                    authBySession[newSessionId] = withPublicBaseUrl(authData, publicBaseUrl);
                                     logger.info(`Session ${newSessionId}: stored ${authData.header} header`);
                                     setAuthTimeout(newSessionId);
                                 }
@@ -9320,7 +9387,7 @@ async function startStreamableHTTPServer() {
                                 if (hasHeaderAuth(req)) {
                                     const authData = parseAuthHeaders(req);
                                     if (authData) {
-                                        authBySession[newSessionId] = authData;
+                                        authBySession[newSessionId] = withPublicBaseUrl(authData, publicBaseUrl);
                                         logger.info(`Session ${newSessionId}: stored ${authData.header} header (header auth)`);
                                         setAuthTimeout(newSessionId);
                                     }
@@ -9333,6 +9400,7 @@ async function startStreamableHTTPServer() {
                                             token: authInfo.token,
                                             lastUsed: Date.now(),
                                             apiUrl: GITLAB_API_URL,
+                                            publicBaseUrl,
                                         };
                                         logger.info(`Session ${newSessionId}: stored OAuth token (client: ${authInfo.clientId})`);
                                         setAuthTimeout(newSessionId);
@@ -9380,6 +9448,7 @@ async function startStreamableHTTPServer() {
                 token: authData.token,
                 lastUsed: authData.lastUsed,
                 apiUrl: authData.apiUrl,
+                publicBaseUrl: authData.publicBaseUrl,
             };
             // Run the entire request handling within AsyncLocalStorage context
             await sessionAuthStore.run(ctx, handleRequest);
@@ -9551,6 +9620,17 @@ async function runServer() {
         await initializeServerByTransportMode(transportMode);
         logger.info(`Configured GitLab API URLs: ${GITLAB_API_URLS.join(", ")}`);
         logger.info(`Default GitLab API URL: ${GITLAB_API_URL}`);
+        if (GITLAB_ALLOWED_GROUPS_RAW) {
+            if (GITLAB_OAUTH_ALLOWED_GROUPS_RAW) {
+                logger.warn("GITLAB_ALLOWED_GROUPS is set but ignored — GITLAB_OAUTH_ALLOWED_GROUPS takes precedence.");
+            }
+            else {
+                logger.warn("GITLAB_ALLOWED_GROUPS is deprecated. Use GITLAB_OAUTH_ALLOWED_GROUPS instead.");
+            }
+        }
+        if (GITLAB_OAUTH_ALLOWED_GROUPS) {
+            logger.info(`Group access control enabled for: ${GITLAB_OAUTH_ALLOWED_GROUPS.join(", ")}`);
+        }
     }
     catch (error) {
         logger.error("Error initializing server:", error);

package/build/test/config-allowed-groups.test.js

@@ -0,0 +1,97 @@
+/**
+ * Tests for GITLAB_OAUTH_ALLOWED_GROUPS config resolution.
+ *
+ * Verifies that:
+ *   - The new GITLAB_OAUTH_ALLOWED_GROUPS env var is preferred when set.
+ *   - The deprecated GITLAB_ALLOWED_GROUPS is accepted as a fallback and
+ *     sets the deprecation flag so callers can emit a warning.
+ *   - When both are set, the new var wins and GITLAB_ALLOWED_GROUPS_RAW remains
+ *     set, so callers can emit a "set but ignored" warning.
+ *
+ * config.ts reads process.env at module load, so each scenario runs in a
+ * fresh child process — same pattern as test/stateless/config-ttl.test.ts.
+ */
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import * as path from "node:path";
+import * as url from "node:url";
+import { describe, test } from "node:test";
+const __dirname = path.dirname(url.fileURLToPath(import.meta.url));
+const CONFIG_PATH = path.resolve(__dirname, "../config.ts");
+function loadConfig(env) {
+    const script = `
+    import(${JSON.stringify(url.pathToFileURL(CONFIG_PATH).href)}).then((m) => {
+      const out = {
+        GITLAB_OAUTH_ALLOWED_GROUPS: m.GITLAB_OAUTH_ALLOWED_GROUPS ?? null,
+        GITLAB_OAUTH_ALLOWED_GROUPS_RAW: m.GITLAB_OAUTH_ALLOWED_GROUPS_RAW ?? null,
+        GITLAB_ALLOWED_GROUPS_RAW: m.GITLAB_ALLOWED_GROUPS_RAW ?? null,
+      };
+      process.stdout.write(JSON.stringify(out));
+    }).catch((err) => {
+      process.stderr.write(String(err && err.stack || err));
+      process.exit(2);
+    });
+  `;
+    const childEnv = {
+        ...process.env,
+    };
+    delete childEnv.GITLAB_OAUTH_ALLOWED_GROUPS;
+    delete childEnv.GITLAB_ALLOWED_GROUPS;
+    for (const [k, v] of Object.entries(env)) {
+        if (v === undefined) {
+            delete childEnv[k];
+        }
+        else {
+            childEnv[k] = v;
+        }
+    }
+    const stdout = execFileSync(process.execPath, ["--import", "tsx/esm", "--input-type=module", "--eval", script], { env: childEnv, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    return JSON.parse(stdout);
+}
+describe("config.ts — GITLAB_OAUTH_ALLOWED_GROUPS resolution", () => {
+    test("neither var set — resolved value and raws are null", () => {
+        const cfg = loadConfig({});
+        assert.equal(cfg.GITLAB_OAUTH_ALLOWED_GROUPS, null);
+        assert.equal(cfg.GITLAB_OAUTH_ALLOWED_GROUPS_RAW, null);
+        assert.equal(cfg.GITLAB_ALLOWED_GROUPS_RAW, null);
+    });
+    test("only new var set — resolved correctly, deprecated raw is null", () => {
+        const cfg = loadConfig({ GITLAB_OAUTH_ALLOWED_GROUPS: "my-org" });
+        assert.deepEqual(cfg.GITLAB_OAUTH_ALLOWED_GROUPS, ["my-org"]);
+        assert.equal(cfg.GITLAB_OAUTH_ALLOWED_GROUPS_RAW, "my-org");
+        assert.equal(cfg.GITLAB_ALLOWED_GROUPS_RAW, null);
+    });
+    test("only deprecated var set — resolved via fallback, deprecated raw is set", () => {
+        const cfg = loadConfig({ GITLAB_ALLOWED_GROUPS: "my-org" });
+        assert.deepEqual(cfg.GITLAB_OAUTH_ALLOWED_GROUPS, ["my-org"]);
+        assert.equal(cfg.GITLAB_ALLOWED_GROUPS_RAW, "my-org");
+        assert.equal(cfg.GITLAB_OAUTH_ALLOWED_GROUPS_RAW, null);
+    });
+    test("both vars set — new var wins, both raws are set (triggers 'set but ignored' warning)", () => {
+        const cfg = loadConfig({
+            GITLAB_OAUTH_ALLOWED_GROUPS: "new-org",
+            GITLAB_ALLOWED_GROUPS: "old-org",
+        });
+        assert.deepEqual(cfg.GITLAB_OAUTH_ALLOWED_GROUPS, ["new-org"]);
+        assert.equal(cfg.GITLAB_OAUTH_ALLOWED_GROUPS_RAW, "new-org");
+        assert.equal(cfg.GITLAB_ALLOWED_GROUPS_RAW, "old-org");
+    });
+    test("comma-separated values are split and trimmed", () => {
+        const cfg = loadConfig({
+            GITLAB_OAUTH_ALLOWED_GROUPS: "my-org/team-a , my-org/team-b , my-org",
+        });
+        assert.deepEqual(cfg.GITLAB_OAUTH_ALLOWED_GROUPS, [
+            "my-org/team-a",
+            "my-org/team-b",
+            "my-org",
+        ]);
+    });
+    test("empty string resolves to null", () => {
+        const cfg = loadConfig({ GITLAB_OAUTH_ALLOWED_GROUPS: "" });
+        assert.equal(cfg.GITLAB_OAUTH_ALLOWED_GROUPS, null);
+    });
+    test("whitespace-only entries are filtered out", () => {
+        const cfg = loadConfig({ GITLAB_OAUTH_ALLOWED_GROUPS: " , , " });
+        assert.equal(cfg.GITLAB_OAUTH_ALLOWED_GROUPS, null);
+    });
+});

package/build/test/test-remote-downloads.js

@@ -17,6 +17,16 @@ const MOCK_TOKEN = 'glpat-mock-token-12345';
 const TEST_PROJECT_ID = '123';
 const TEST_JOB_ID = '456';
 const TEST_SECRET = 'testsecret';
+const FORWARDED_BASE_URL = 'https://gitlab.mcp.example.test/gitlab-mcp';
+const FORWARDED_HEADERS = {
+    'X-Forwarded-Proto': 'https',
+    'X-Forwarded-Host': 'gitlab.mcp.example.test',
+    'X-Forwarded-Prefix': '/gitlab-mcp',
+};
+const RFC_FORWARDED_HEADERS = {
+    'Forwarded': 'for=192.0.2.43;proto=http;host=attacker.example.test, for="[2001:db8:cafe::17]";proto="https";host="gitlab.mcp.example.test"',
+    'X-Forwarded-Prefix': '/gitlab-mcp',
+};
 // Minimal 1x1 transparent PNG
 const MINIMAL_PNG = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==', 'base64');
 const LARGE_FILE_TOKEN = 'glpat-largefile-test-token';
@@ -92,6 +102,8 @@ describe('Remote Downloads - Download Proxy Endpoint', { timeout: 30_000 }, () =
             env: {
                 STREAMABLE_HTTP: 'true',
                 REMOTE_AUTHORIZATION: 'true',
+                MCP_TRUST_PROXY: 'false',
+                MCP_SERVER_URL: '',
                 GITLAB_API_URL: `${mockGitLab.getUrl()}/api/v4`,
                 USE_PIPELINE: 'true',
                 MAX_REQUESTS_PER_MINUTE: '2',
@@ -148,6 +160,61 @@ describe('Remote Downloads - Download Proxy Endpoint', { timeout: 30_000 }, () =
         }
         assert.ok(got429, 'Should have received 429 within 10 requests (rate limit is 2/min)');
     });
+    test('ignores forwarded headers unless MCP_TRUST_PROXY is enabled', async () => {
+        const initRes = await fetch(`http://${HOST}:${serverPort}/mcp`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Accept': 'application/json, text/event-stream',
+                'Private-Token': MOCK_TOKEN,
+            },
+            body: JSON.stringify({
+                jsonrpc: '2.0',
+                id: 20,
+                method: 'initialize',
+                params: {
+                    protocolVersion: '2025-03-26',
+                    capabilities: {},
+                    clientInfo: { name: 'test-remote-downloads-no-trust-proxy', version: '1.0' },
+                },
+            }),
+        });
+        assert.strictEqual(initRes.status, 200, 'Initialize should succeed');
+        const sessionId = initRes.headers.get('mcp-session-id');
+        assert.ok(sessionId, 'Should receive a session ID');
+        const toolRes = await fetch(`http://${HOST}:${serverPort}/mcp`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Accept': 'application/json, text/event-stream',
+                ...FORWARDED_HEADERS,
+                'Private-Token': MOCK_TOKEN,
+                'mcp-session-id': sessionId,
+            },
+            body: JSON.stringify({
+                jsonrpc: '2.0',
+                id: 21,
+                method: 'tools/call',
+                params: {
+                    name: 'download_job_artifacts',
+                    arguments: {
+                        project_id: TEST_PROJECT_ID,
+                        job_id: TEST_JOB_ID,
+                    },
+                },
+            }),
+        });
+        assert.strictEqual(toolRes.status, 200, 'Tool call should return 200');
+        const responses = parseSSE(await toolRes.text());
+        const result = responses.find(r => r.id === 21);
+        assert.ok(result?.result, 'Should have a result');
+        const textBlock = result.result.content.find(c => c.type === 'text');
+        assert.ok(textBlock?.text, 'Should have text content');
+        const parsed = JSON.parse(textBlock.text);
+        assert.ok(parsed.download_url, 'Should contain download_url');
+        assert.ok(parsed.download_url.startsWith(`http://${HOST}:${serverPort}/downloads/job-artifacts?`), `URL should fall back to local server address when MCP_TRUST_PROXY is disabled, got ${parsed.download_url}`);
+        assert.ok(!parsed.download_url.startsWith(`${FORWARDED_BASE_URL}/downloads/job-artifacts?`), 'URL should not use forwarded public base URL when MCP_TRUST_PROXY is disabled');
+    });
 });
 describe('Remote Downloads - Tool Behavior via MCP Protocol', { timeout: 60_000 }, () => {
     let mockGitLab;
@@ -189,6 +256,8 @@ describe('Remote Downloads - Tool Behavior via MCP Protocol', { timeout: 60_000
             env: {
                 STREAMABLE_HTTP: 'true',
                 REMOTE_AUTHORIZATION: 'true',
+                MCP_TRUST_PROXY: 'true',
+                MCP_SERVER_URL: '',
                 GITLAB_API_URL: `${mockGitLab.getUrl()}/api/v4`,
                 USE_PIPELINE: 'true',
             },
@@ -222,12 +291,13 @@ describe('Remote Downloads - Tool Behavior via MCP Protocol', { timeout: 60_000
         if (mockGitLab)
             await mockGitLab.stop();
     });
-    async function callTool(id, name, args) {
+    async function callTool(id, name, args, extraHeaders = {}) {
         const res = await fetch(`http://${HOST}:${serverPort}/mcp`, {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
                 'Accept': 'application/json, text/event-stream',
+                ...extraHeaders,
                 'Private-Token': MOCK_TOKEN,
                 'mcp-session-id': sessionId,
             },
@@ -269,6 +339,97 @@ describe('Remote Downloads - Tool Behavior via MCP Protocol', { timeout: 60_000
         assert.ok(buf.length > 0, 'Downloaded content should not be empty');
         assert.ok(buf.includes(Buffer.from('PK')), 'Should contain zip magic bytes');
     });
+    test('download_job_artifacts ignores forwarded hosts containing URL components', async () => {
+        const result = await callTool(14, 'download_job_artifacts', {
+            project_id: TEST_PROJECT_ID,
+            job_id: TEST_JOB_ID,
+        }, {
+            ...FORWARDED_HEADERS,
+            'X-Forwarded-Host': 'gitlab.mcp.example.test@attacker.example.test',
+        });
+        assert.ok(result.result, 'Should have a result');
+        const content = result.result.content;
+        assert.ok(content && content.length > 0, 'Should have content');
+        const textBlock = content.find(c => c.type === 'text');
+        assert.ok(textBlock?.text, 'Should have text content');
+        const parsed = JSON.parse(textBlock.text);
+        assert.ok(parsed.download_url, 'Should contain download_url');
+        assert.ok(parsed.download_url.startsWith(`http://${HOST}:${serverPort}/downloads/job-artifacts?`), `URL should fall back to local server address for unsafe forwarded host, got ${parsed.download_url}`);
+        assert.ok(!parsed.download_url.includes('attacker.example.test'), `URL should not contain unsafe forwarded host, got ${parsed.download_url}`);
+        assert.ok(parsed.download_url.includes('_token='), 'URL should contain embedded auth token');
+    });
+    test('download_job_artifacts ignores authority-style forwarded prefixes', async () => {
+        const result = await callTool(15, 'download_job_artifacts', {
+            project_id: TEST_PROJECT_ID,
+            job_id: TEST_JOB_ID,
+        }, {
+            ...FORWARDED_HEADERS,
+            'X-Forwarded-Prefix': '//attacker.example.test',
+        });
+        assert.ok(result.result, 'Should have a result');
+        const content = result.result.content;
+        assert.ok(content && content.length > 0, 'Should have content');
+        const textBlock = content.find(c => c.type === 'text');
+        assert.ok(textBlock?.text, 'Should have text content');
+        const parsed = JSON.parse(textBlock.text);
+        assert.ok(parsed.download_url, 'Should contain download_url');
+        assert.ok(parsed.download_url.startsWith('https://gitlab.mcp.example.test/downloads/job-artifacts?'), `URL should keep forwarded proto/host while ignoring unsafe prefix, got ${parsed.download_url}`);
+        assert.ok(!parsed.download_url.includes('attacker.example.test'), `URL should not contain authority-style prefix, got ${parsed.download_url}`);
+        assert.ok(!parsed.download_url.startsWith(`http://${HOST}:${serverPort}`), 'URL should not fall back to local server address');
+        assert.ok(parsed.download_url.includes('_token='), 'URL should contain embedded auth token');
+    });
+    test('download_job_artifacts uses rightmost forwarded header values', async () => {
+        const result = await callTool(16, 'download_job_artifacts', {
+            project_id: TEST_PROJECT_ID,
+            job_id: TEST_JOB_ID,
+        }, {
+            'X-Forwarded-Proto': 'http, https',
+            'X-Forwarded-Host': 'attacker.example.test, gitlab.mcp.example.test',
+            'X-Forwarded-Prefix': '/attacker, /gitlab-mcp',
+        });
+        assert.ok(result.result, 'Should have a result');
+        const content = result.result.content;
+        assert.ok(content && content.length > 0, 'Should have content');
+        const textBlock = content.find(c => c.type === 'text');
+        assert.ok(textBlock?.text, 'Should have text content');
+        const parsed = JSON.parse(textBlock.text);
+        assert.ok(parsed.download_url, 'Should contain download_url');
+        assert.ok(parsed.download_url.startsWith(`${FORWARDED_BASE_URL}/downloads/job-artifacts?`), `URL should use the rightmost forwarded header values, got ${parsed.download_url}`);
+        assert.ok(!parsed.download_url.includes('attacker.example.test'), `URL should not use the leftmost untrusted forwarded header value, got ${parsed.download_url}`);
+        assert.ok(parsed.download_url.includes('_token='), 'URL should contain embedded auth token');
+    });
+    test('download_job_artifacts derives download_url from RFC 7239 Forwarded header', async () => {
+        const result = await callTool(18, 'download_job_artifacts', {
+            project_id: TEST_PROJECT_ID,
+            job_id: TEST_JOB_ID,
+        }, RFC_FORWARDED_HEADERS);
+        assert.ok(result.result, 'Should have a result');
+        const content = result.result.content;
+        assert.ok(content && content.length > 0, 'Should have content');
+        const textBlock = content.find(c => c.type === 'text');
+        assert.ok(textBlock?.text, 'Should have text content');
+        const parsed = JSON.parse(textBlock.text);
+        assert.ok(parsed.download_url, 'Should contain download_url');
+        assert.ok(parsed.download_url.startsWith(`${FORWARDED_BASE_URL}/downloads/job-artifacts?`), `URL should use RFC 7239 Forwarded header values, got ${parsed.download_url}`);
+        assert.ok(!parsed.download_url.includes('attacker.example.test'), `URL should not use the leftmost untrusted Forwarded value, got ${parsed.download_url}`);
+        assert.ok(parsed.download_url.includes('_token='), 'URL should contain embedded auth token');
+    });
+    test('download_job_artifacts derives download_url from forwarded headers when MCP_SERVER_URL is unset', async () => {
+        const result = await callTool(17, 'download_job_artifacts', {
+            project_id: TEST_PROJECT_ID,
+            job_id: TEST_JOB_ID,
+        }, FORWARDED_HEADERS);
+        assert.ok(result.result, 'Should have a result');
+        const content = result.result.content;
+        assert.ok(content && content.length > 0, 'Should have content');
+        const textBlock = content.find(c => c.type === 'text');
+        assert.ok(textBlock?.text, 'Should have text content');
+        const parsed = JSON.parse(textBlock.text);
+        assert.ok(parsed.download_url, 'Should contain download_url');
+        assert.ok(parsed.download_url.startsWith(`${FORWARDED_BASE_URL}/downloads/job-artifacts?`), `URL should use forwarded public base URL, got ${parsed.download_url}`);
+        assert.ok(!parsed.download_url.startsWith(`http://${HOST}:${serverPort}`), 'URL should not fall back to local server address');
+        assert.ok(parsed.download_url.includes('_token='), 'URL should contain embedded auth token');
+    });
     test('download_attachment for non-image returns download_url', async () => {
         const result = await callTool(11, 'download_attachment', {
             project_id: TEST_PROJECT_ID,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.1.21",
+  "version": "2.1.22",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [
@@ -51,7 +51,7 @@
     "changelog": "auto-changelog -p",
     "test": "npm run test:all",
     "test:all": "npm run build && npm run test:mock && npm run test:live",
-    "test:mock": "node --import tsx/esm --test test/remote-auth-simple-test.ts && node --import tsx/esm --test test/mcp-oauth-tests.ts && node --import tsx/esm --test test/streamable-http-static-token-auth.test.ts && tsx test/oauth-tests.ts && tsx test/test-list-merge-requests.ts && tsx test/test-list-issues.ts && node --import tsx/esm --test test/test-merge-request-pipelines.ts && tsx test/test-list-project-members.ts && tsx test/test-download-attachment.ts && node --import tsx/esm --test test/test-upload-markdown.ts && node --import tsx/esm --test test/test-job-artifacts.ts && node --import tsx/esm --test test/test-deployment-tools.ts && node --import tsx/esm --test test/test-merge-request-approval-state-tools.ts && node --import tsx/esm --test test/test-search-code.ts && node --import tsx/esm --test test/test-tags.ts && node --import tsx/esm --test test/test-protected-branches.ts && node --import tsx/esm --test test/test-toolset-filtering.ts && node --import tsx/esm --test test/test-ci-lint.ts && node --import tsx/esm --test test/test-todos.ts && node --import tsx/esm --test test/test-auth-retry.ts && node --import tsx/esm --test test/test-issue-description-patch.ts && node --import tsx/esm --test test/test-geteffectiveprojectid.ts && node --import tsx/esm --test test/test-get-file-blame.ts && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts && node --import tsx/esm --test test/utils/tool-args.test.ts && node --import tsx/esm --test test/utils/graphql-query.test.ts && node --import tsx/esm --test test/utils/wiki-title.test.ts && node --import tsx/esm --test test/utils/merge-request-position.test.ts && node --import tsx/esm --test test/nullish-tool-arguments-schema.test.ts && node --import tsx/esm --test test/test-ci-variables.ts && node --import tsx/esm --test test/test-dependency-proxy.ts",
+    "test:mock": "node --import tsx/esm --test test/remote-auth-simple-test.ts && node --import tsx/esm --test test/mcp-oauth-tests.ts && node --import tsx/esm --test test/streamable-http-static-token-auth.test.ts && tsx test/oauth-tests.ts && tsx test/test-list-merge-requests.ts && tsx test/test-list-issues.ts && node --import tsx/esm --test test/test-merge-request-pipelines.ts && tsx test/test-list-project-members.ts && tsx test/test-download-attachment.ts && node --import tsx/esm --test test/test-upload-markdown.ts && node --import tsx/esm --test test/test-job-artifacts.ts && node --import tsx/esm --test test/test-remote-downloads.ts && node --import tsx/esm --test test/test-deployment-tools.ts && node --import tsx/esm --test test/test-merge-request-approval-state-tools.ts && node --import tsx/esm --test test/test-search-code.ts && node --import tsx/esm --test test/test-tags.ts && node --import tsx/esm --test test/test-protected-branches.ts && node --import tsx/esm --test test/test-toolset-filtering.ts && node --import tsx/esm --test test/test-ci-lint.ts && node --import tsx/esm --test test/test-todos.ts && node --import tsx/esm --test test/test-auth-retry.ts && node --import tsx/esm --test test/test-issue-description-patch.ts && node --import tsx/esm --test test/test-geteffectiveprojectid.ts && node --import tsx/esm --test test/test-get-file-blame.ts && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts && node --import tsx/esm --test test/utils/tool-args.test.ts && node --import tsx/esm --test test/utils/graphql-query.test.ts && node --import tsx/esm --test test/utils/wiki-title.test.ts && node --import tsx/esm --test test/utils/merge-request-position.test.ts && node --import tsx/esm --test test/nullish-tool-arguments-schema.test.ts && node --import tsx/esm --test test/test-ci-variables.ts && node --import tsx/esm --test test/test-dependency-proxy.ts",
     "test:stateless": "npm run build && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts",
     "test:mcp-oauth": "npm run build && node --import tsx/esm --test test/mcp-oauth-tests.ts",
     "test:live": "node test/validate-api.js",