@zereight/mcp-gitlab 2.1.25 → 2.1.27

package/build/utils/forwarded-public-base-url.js

@@ -0,0 +1,62 @@
+function getLastHeaderValue(value) {
+    const raw = Array.isArray(value) ? value[value.length - 1] : value;
+    if (!raw)
+        return undefined;
+    const parts = raw.split(",").map(part => part.trim()).filter(Boolean);
+    return parts.length > 0 ? parts[parts.length - 1] : undefined;
+}
+function unquoteHeaderValue(value) {
+    if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) {
+        return value.slice(1, -1).replace(/\\"/g, '"').replace(/\\\\/g, "\\");
+    }
+    return value;
+}
+function trimTrailingSlashes(value) {
+    let end = value.length;
+    while (end > 0 && value[end - 1] === "/")
+        end--;
+    return value.slice(0, end);
+}
+export function getForwardedPublicBaseUrl(req, trustProxy) {
+    if (!trustProxy)
+        return undefined;
+    const forwarded = getLastHeaderValue(req.headers.forwarded);
+    const forwardedValues = {};
+    if (forwarded) {
+        for (const part of forwarded.split(";")) {
+            const separator = part.indexOf("=");
+            if (separator <= 0)
+                continue;
+            const key = part.slice(0, separator).trim().toLowerCase();
+            const value = unquoteHeaderValue(part.slice(separator + 1).trim());
+            if (key && value)
+                forwardedValues[key] = value;
+        }
+    }
+    const proto = (forwardedValues.proto || getLastHeaderValue(req.headers["x-forwarded-proto"]))?.toLowerCase();
+    const host = forwardedValues.host || getLastHeaderValue(req.headers["x-forwarded-host"]);
+    if (!proto || !host || !/^https?$/.test(proto))
+        return undefined;
+    if (/[\s/\\]/.test(host))
+        return undefined;
+    const prefix = getLastHeaderValue(req.headers["x-forwarded-prefix"]);
+    const safePrefix = prefix &&
+        prefix.startsWith("/") &&
+        !prefix.startsWith("//") &&
+        !prefix.includes("://") &&
+        !/[\s\\]/.test(prefix)
+        ? trimTrailingSlashes(prefix)
+        : undefined;
+    try {
+        const baseUrl = new URL(`${proto}://${host}`);
+        if (baseUrl.username || baseUrl.password || baseUrl.pathname !== "/" || baseUrl.search || baseUrl.hash) {
+            return undefined;
+        }
+        if (safePrefix)
+            baseUrl.pathname = safePrefix;
+        return baseUrl.toString().replace(/\/$/, "");
+    }
+    catch {
+        return undefined;
+    }
+}

package/build/utils/schema.js

@@ -86,5 +86,19 @@ export const toJSONSchema = (schema) => {
         }
         return obj;
     }
-    return fixNullableOptional(jsonSchema, true);
+    const fixedSchema = fixNullableOptional(jsonSchema, true);
+    if (!fixedSchema.properties && Array.isArray(fixedSchema.anyOf)) {
+        const variants = fixedSchema.anyOf.filter((item) => item?.type === "object" && item.properties);
+        if (variants.length === fixedSchema.anyOf.length) {
+            fixedSchema.type = "object";
+            fixedSchema.properties = variants.reduce((properties, item) => {
+                Object.entries(item.properties).forEach(([key, value]) => {
+                    if (!properties[key])
+                        properties[key] = value;
+                });
+                return properties;
+            }, {});
+        }
+    }
+    return fixedSchema;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.1.25",
+  "version": "2.1.27",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [
@@ -51,7 +51,7 @@
     "changelog": "auto-changelog -p",
     "test": "npm run test:all",
     "test:all": "npm run build && npm run test:mock && npm run test:live",
-    "test:mock": "node --import tsx/esm --test test/remote-auth-simple-test.ts && node --import tsx/esm --test test/mcp-oauth-tests.ts && node --import tsx/esm --test test/test-oauth-proxy-rate-limit.ts && node --import tsx/esm --test test/streamable-http-static-token-auth.test.ts && tsx test/oauth-tests.ts && tsx test/test-list-merge-requests.ts && tsx test/test-list-issues.ts && node --import tsx/esm --test test/test-merge-request-pipelines.ts && tsx test/test-list-project-members.ts && tsx test/test-download-attachment.ts && node --import tsx/esm --test test/test-upload-markdown.ts && node --import tsx/esm --test test/test-job-artifacts.ts && node --import tsx/esm --test test/test-remote-downloads.ts && node --import tsx/esm --test test/test-deployment-tools.ts && node --import tsx/esm --test test/test-merge-request-approval-state-tools.ts && node --import tsx/esm --test test/test-search-code.ts && node --import tsx/esm --test test/test-tags.ts && node --import tsx/esm --test test/test-protected-branches.ts && node --import tsx/esm --test test/test-toolset-filtering.ts && node --import tsx/esm --test test/test-ci-lint.ts && node --import tsx/esm --test test/test-todos.ts && node --import tsx/esm --test test/test-auth-retry.ts && node --import tsx/esm --test test/test-issue-description-patch.ts && node --import tsx/esm --test test/test-geteffectiveprojectid.ts && node --import tsx/esm --test test/test-get-file-blame.ts && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts && node --import tsx/esm --test test/utils/tool-args.test.ts && node --import tsx/esm --test test/utils/proxy-client-ip.test.ts && node --import tsx/esm --test test/utils/graphql-query.test.ts && node --import tsx/esm --test test/utils/wiki-title.test.ts && node --import tsx/esm --test test/utils/merge-request-position.test.ts && node --import tsx/esm --test test/nullish-tool-arguments-schema.test.ts && node --import tsx/esm --test test/test-ci-variables.ts && node --import tsx/esm --test test/test-dependency-proxy.ts",
+    "test:mock": "node --import tsx/esm --test test/remote-auth-simple-test.ts && node --import tsx/esm --test test/dynamic-api-url-allowlist.test.ts && node --import tsx/esm --test test/mcp-oauth-tests.ts && node --import tsx/esm --test test/test-oauth-proxy-rate-limit.ts && node --import tsx/esm --test test/streamable-http-static-token-auth.test.ts && node --import tsx/esm --test test/sse-auth-guard.test.ts && node --import tsx/esm --test test/streamable-http-concurrent-session.test.ts && node --import tsx/esm --test test/streamable-http-unauthenticated-discovery.test.ts && tsx test/oauth-tests.ts && tsx test/test-list-merge-requests.ts && tsx test/test-list-issues.ts && node --import tsx/esm --test test/test-create-repository.ts && node --import tsx/esm --test test/test-update-project.ts && node --import tsx/esm --test test/test-merge-request-pipelines.ts && tsx test/test-list-project-members.ts && tsx test/test-download-attachment.ts && node --import tsx/esm --test test/test-upload-markdown.ts && node --import tsx/esm --test test/test-job-artifacts.ts && node --import tsx/esm --test test/test-remote-downloads.ts && node --import tsx/esm --test test/test-deployment-tools.ts && node --import tsx/esm --test test/test-merge-request-approval-state-tools.ts && node --import tsx/esm --test test/test-search-code.ts && node --import tsx/esm --test test/test-tags.ts && node --import tsx/esm --test test/test-protected-branches.ts && node --import tsx/esm --test test/test-toolset-filtering.ts && node --import tsx/esm --test test/test-ci-lint.ts && node --import tsx/esm --test test/test-ci-catalog.ts && node --import tsx/esm --test test/test-todos.ts && node --import tsx/esm --test test/test-auth-retry.ts && node --import tsx/esm --test test/test-issue-description-patch.ts && node --import tsx/esm --test test/test-geteffectiveprojectid.ts && node --import tsx/esm --test test/test-get-file-blame.ts && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts && node --import tsx/esm --test test/utils/tool-args.test.ts && node --import tsx/esm --test test/utils/proxy-client-ip.test.ts && node --import tsx/esm --test test/utils/forwarded-public-base-url.test.ts && node --import tsx/esm --test test/utils/graphql-query.test.ts && node --import tsx/esm --test test/utils/wiki-title.test.ts && node --import tsx/esm --test test/utils/merge-request-position.test.ts && node --import tsx/esm --test test/nullish-tool-arguments-schema.test.ts && node --import tsx/esm --test test/test-ci-variables.ts && node --import tsx/esm --test test/test-dependency-proxy.ts",
     "test:stateless": "npm run build && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts",
     "test:mcp-oauth": "npm run build && node --import tsx/esm --test test/mcp-oauth-tests.ts",
     "test:live": "node test/validate-api.js",