@zereight/mcp-gitlab 2.1.28 → 2.1.30

package/build/test/path-segment-encoding.test.js

@@ -0,0 +1,27 @@
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { test } from "node:test";
+const source = readFileSync(new URL("../index.ts", import.meta.url), "utf8");
+const rawPathSegmentPatterns = [
+    "/issues/${issueIid}",
+    "/merge_requests/${mergeRequestIid}",
+    "/discussions/${discussionId}",
+    "/notes/${noteId}",
+    "/links/${issueLinkId}",
+    "/draft_notes/${draftNoteId}",
+    "/versions/${versionId}",
+    "/groups/${groupId}",
+];
+test("GitLab URL path IDs are encoded before interpolation", () => {
+    for (const pattern of rawPathSegmentPatterns) {
+        assert.equal(source.includes(pattern), false, `${pattern} must use encodeGitLabPathSegment`);
+    }
+});
+test("encoding keeps path traversal payloads inside one URL segment", () => {
+    const payload = "1/../../../../admin/ci/variables";
+    const url = new URL(`https://gitlab.com/api/v4/projects/42/issues/${encodeURIComponent(payload)}/notes`);
+    assert.equal(url.pathname, "/api/v4/projects/42/issues/1%2F..%2F..%2F..%2F..%2Fadmin%2Fci%2Fvariables/notes");
+});
+test("malformed percent-encoded segments can still be encoded", () => {
+    assert.equal(encodeURIComponent("bad%zz/path"), "bad%25zz%2Fpath");
+});

package/build/test/remote-auth-simple-test.js

@@ -43,222 +43,249 @@ async function waitForSessionDecrease(mcpUrl, beforeTimeout, timeoutMs = 3000) {
 }
 console.log('🔐 Remote Authorization Test Suite');
 console.log('');
-describe('Remote Authorization - Basic Functionality', () => {
-    let mcpUrl;
-    let mockGitLab;
-    let servers = [];
-    before(async () => {
-        // Start mock GitLab server
-        const mockPort = await findMockServerPort(MOCK_GITLAB_PORT_BASE);
-        mockGitLab = new MockGitLabServer({
-            port: mockPort,
-            validTokens: [MOCK_TOKEN, MOCK_JOB_TOKEN],
+describe('Remote Authorization', { concurrency: 1 }, () => {
+    describe('Remote Authorization - Basic Functionality', () => {
+        let mcpUrl;
+        let mockGitLab;
+        let servers = [];
+        before(async () => {
+            // Start mock GitLab server
+            const mockPort = await findMockServerPort();
+            mockGitLab = new MockGitLabServer({
+                port: mockPort,
+                validTokens: [MOCK_TOKEN, MOCK_JOB_TOKEN],
+            });
+            await mockGitLab.start();
+            const mockGitLabUrl = mockGitLab.getUrl();
+            // Start MCP server with remote auth
+            const mcpPort = await findAvailablePort(MCP_SERVER_PORT_BASE);
+            const server = await launchServer({
+                mode: TransportMode.STREAMABLE_HTTP,
+                port: mcpPort,
+                timeout: 5000,
+                env: {
+                    STREAMABLE_HTTP: 'true',
+                    REMOTE_AUTHORIZATION: 'true',
+                    GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+                    GITLAB_READ_ONLY_MODE: 'true',
+                }
+            });
+            servers.push(server);
+            mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
+            console.log(`Mock GitLab: ${mockGitLabUrl}`);
+            console.log(`MCP Server: ${mcpUrl}`);
         });
-        await mockGitLab.start();
-        const mockGitLabUrl = mockGitLab.getUrl();
-        // Start MCP server with remote auth
-        const mcpPort = await findAvailablePort(MCP_SERVER_PORT_BASE);
-        const server = await launchServer({
-            mode: TransportMode.STREAMABLE_HTTP,
-            port: mcpPort,
-            timeout: 5000,
-            env: {
-                STREAMABLE_HTTP: 'true',
-                REMOTE_AUTHORIZATION: 'true',
-                GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
-                GITLAB_READ_ONLY_MODE: 'true',
+        after(async () => {
+            cleanupServers(servers);
+            if (mockGitLab) {
+                await mockGitLab.stop();
             }
         });
-        servers.push(server);
-        mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
-        console.log(`Mock GitLab: ${mockGitLabUrl}`);
-        console.log(`MCP Server: ${mcpUrl}`);
-    });
-    after(async () => {
-        cleanupServers(servers);
-        if (mockGitLab) {
-            await mockGitLab.stop();
-        }
-    });
-    test('should connect with Authorization Bearer header', async () => {
-        const client = new CustomHeaderClient({
-            'authorization': `Bearer ${MOCK_TOKEN}`
+        test('should reject invalid tokens before creating a session', async () => {
+            const before = await getMetrics(mcpUrl);
+            const response = await fetch(mcpUrl, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    Accept: 'application/json, text/event-stream',
+                    'Private-Token': 'aaaaaaaaaaaaaaaaaaaaaaaa',
+                },
+                body: JSON.stringify({
+                    jsonrpc: '2.0',
+                    id: 1,
+                    method: 'initialize',
+                    params: {
+                        protocolVersion: '2025-03-26',
+                        capabilities: {},
+                        clientInfo: { name: 'invalid-token-test', version: '1.0.0' },
+                    },
+                }),
+            });
+            assert.strictEqual(response.status, 401);
+            const after = await getMetrics(mcpUrl);
+            assert.strictEqual(after.activeSessions, before.activeSessions);
+            assert.strictEqual(after.authenticatedSessions, before.authenticatedSessions);
         });
-        await client.connect(mcpUrl);
-        const tools = await client.listTools();
-        assert.ok(tools.tools.length > 0, 'Should have tools');
-        console.log(`  ✓ Connected successfully, got ${tools.tools.length} tools`);
-        await client.disconnect();
-    });
-    test('should connect with Private-Token header', async () => {
-        const client = new CustomHeaderClient({
-            'private-token': MOCK_TOKEN
+        test('should connect with Authorization Bearer header', async () => {
+            const client = new CustomHeaderClient({
+                'authorization': `Bearer ${MOCK_TOKEN}`
+            });
+            await client.connect(mcpUrl);
+            const tools = await client.listTools();
+            assert.ok(tools.tools.length > 0, 'Should have tools');
+            console.log(`  ✓ Connected successfully, got ${tools.tools.length} tools`);
+            await client.disconnect();
         });
-        await client.connect(mcpUrl);
-        const tools = await client.listTools();
-        assert.ok(tools.tools.length > 0, 'Should have tools');
-        console.log(`  ✓ Connected with Private-Token, got ${tools.tools.length} tools`);
-        await client.disconnect();
-    });
-    test('should connect with JOB-TOKEN header', async () => {
-        const client = new CustomHeaderClient({
-            'job-token': MOCK_JOB_TOKEN,
+        test('should connect with Private-Token header', async () => {
+            const client = new CustomHeaderClient({
+                'private-token': MOCK_TOKEN
+            });
+            await client.connect(mcpUrl);
+            const tools = await client.listTools();
+            assert.ok(tools.tools.length > 0, 'Should have tools');
+            console.log(`  ✓ Connected with Private-Token, got ${tools.tools.length} tools`);
+            await client.disconnect();
         });
-        await client.connect(mcpUrl);
-        const tools = await client.listTools();
-        assert.ok(tools.tools.length > 0, 'Should have tools');
-        console.log(`  ✓ Connected with JOB-TOKEN, got ${tools.tools.length} tools`);
-        await client.disconnect();
-    });
-    test('should successfully call listTools with auth', async () => {
-        const client = new CustomHeaderClient({
-            'authorization': `Bearer ${MOCK_TOKEN}`
+        test('should connect with JOB-TOKEN header', async () => {
+            const client = new CustomHeaderClient({
+                'job-token': MOCK_JOB_TOKEN,
+            });
+            await client.connect(mcpUrl);
+            const tools = await client.listTools();
+            assert.ok(tools.tools.length > 0, 'Should have tools');
+            console.log(`  ✓ Connected with JOB-TOKEN, got ${tools.tools.length} tools`);
+            await client.disconnect();
         });
-        await client.connect(mcpUrl);
-        // List tools multiple times to verify auth persists
-        const tools1 = await client.listTools();
-        const tools2 = await client.listTools();
-        const tools3 = await client.listTools();
-        assert.ok(tools1.tools.length > 0, 'Should have tools');
-        assert.strictEqual(tools1.tools.length, tools2.tools.length, 'Tool count should be consistent');
-        assert.strictEqual(tools2.tools.length, tools3.tools.length, 'Tool count should be consistent');
-        console.log('  ✓ Multiple tool list calls successful with persistent auth');
-        await client.disconnect();
-    });
-    test('should expose Prometheus metrics at /metrics', async () => {
-        const metricsUrl = mcpUrl.replace(/\/mcp$/, '/metrics');
-        const response = await fetch(metricsUrl);
-        assert.strictEqual(response.status, 200, 'metrics endpoint should be available');
-        assert.match(response.headers.get('content-type') || '', /^text\/plain/);
-        const body = await response.text();
-        assert.match(body, /# HELP gitlab_mcp_requests_processed_total/);
-        assert.match(body, /# TYPE gitlab_mcp_active_sessions gauge/);
-        assert.match(body, /gitlab_mcp_config_info\{[^}]*remote_auth_enabled="true"/);
-        console.log('  ✓ Prometheus metrics available');
-    });
-    test('should reject connection without auth header', async () => {
-        const client = new CustomHeaderClient({});
-        try {
+        test('should successfully call listTools with auth', async () => {
+            const client = new CustomHeaderClient({
+                'authorization': `Bearer ${MOCK_TOKEN}`
+            });
             await client.connect(mcpUrl);
-            await client.listTools();
+            // List tools multiple times to verify auth persists
+            const tools1 = await client.listTools();
+            const tools2 = await client.listTools();
+            const tools3 = await client.listTools();
+            assert.ok(tools1.tools.length > 0, 'Should have tools');
+            assert.strictEqual(tools1.tools.length, tools2.tools.length, 'Tool count should be consistent');
+            assert.strictEqual(tools2.tools.length, tools3.tools.length, 'Tool count should be consistent');
+            console.log('  ✓ Multiple tool list calls successful with persistent auth');
             await client.disconnect();
-            assert.fail('Should have rejected connection without auth');
-        }
-        catch (error) {
-            assert.ok(error instanceof Error);
-            console.log('  ✓ Correctly rejected connection without auth');
-        }
-    });
-});
-describe('Remote Authorization - Session Timeout', () => {
-    let mcpUrl;
-    let mockGitLab;
-    let servers = [];
-    before(async () => {
-        // Use different port ranges to avoid collisions with basic tests
-        const mockPort = await findMockServerPort(MOCK_GITLAB_PORT_BASE + MOCK_GITLAB_PORT_OFFSET);
-        mockGitLab = new MockGitLabServer({
-            port: mockPort,
-            validTokens: [MOCK_TOKEN]
         });
-        await mockGitLab.start();
-        const mockGitLabUrl = mockGitLab.getUrl();
-        const mcpPort = await findAvailablePort(MCP_SERVER_PORT_BASE + MCP_SERVER_PORT_OFFSET);
-        const server = await launchServer({
-            mode: TransportMode.STREAMABLE_HTTP,
-            port: mcpPort,
-            timeout: 5000,
-            env: {
-                STREAMABLE_HTTP: 'true',
-                REMOTE_AUTHORIZATION: 'true',
-                GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
-                SESSION_TIMEOUT_SECONDS: String(SESSION_TIMEOUT_SECONDS),
+        test('should expose Prometheus metrics at /metrics', async () => {
+            const metricsUrl = mcpUrl.replace(/\/mcp$/, '/metrics');
+            const response = await fetch(metricsUrl);
+            assert.strictEqual(response.status, 200, 'metrics endpoint should be available');
+            assert.match(response.headers.get('content-type') || '', /^text\/plain/);
+            const body = await response.text();
+            assert.match(body, /# HELP gitlab_mcp_requests_processed_total/);
+            assert.match(body, /# TYPE gitlab_mcp_active_sessions gauge/);
+            assert.match(body, /gitlab_mcp_config_info\{[^}]*remote_auth_enabled="true"/);
+            console.log('  ✓ Prometheus metrics available');
+        });
+        test('should reject connection without auth header', async () => {
+            const client = new CustomHeaderClient({});
+            try {
+                await client.connect(mcpUrl);
+                await client.listTools();
+                await client.disconnect();
+                assert.fail('Should have rejected connection without auth');
+            }
+            catch (error) {
+                assert.ok(error instanceof Error);
+                console.log('  ✓ Correctly rejected connection without auth');
             }
         });
-        servers.push(server);
-        mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
-        console.log(`Session timeout: ${SESSION_TIMEOUT_SECONDS} seconds`);
-    });
-    after(async () => {
-        cleanupServers(servers);
-        if (mockGitLab) {
-            await mockGitLab.stop();
-        }
     });
-    test('session timeout verification - activity keeps session alive', async () => {
-        const client = new CustomHeaderClient({
-            'authorization': `Bearer ${MOCK_TOKEN}`
+    describe('Remote Authorization - Session Timeout', () => {
+        let mcpUrl;
+        let mockGitLab;
+        let servers = [];
+        before(async () => {
+            // Use different port ranges to avoid collisions with basic tests
+            const mockPort = await findMockServerPort();
+            mockGitLab = new MockGitLabServer({
+                port: mockPort,
+                validTokens: [MOCK_TOKEN]
+            });
+            await mockGitLab.start();
+            const mockGitLabUrl = mockGitLab.getUrl();
+            const mcpPort = await findAvailablePort(MCP_SERVER_PORT_BASE + MCP_SERVER_PORT_OFFSET);
+            const server = await launchServer({
+                mode: TransportMode.STREAMABLE_HTTP,
+                port: mcpPort,
+                timeout: 5000,
+                env: {
+                    STREAMABLE_HTTP: 'true',
+                    REMOTE_AUTHORIZATION: 'true',
+                    GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+                    SESSION_TIMEOUT_SECONDS: String(SESSION_TIMEOUT_SECONDS),
+                }
+            });
+            servers.push(server);
+            mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
+            console.log(`Session timeout: ${SESSION_TIMEOUT_SECONDS} seconds`);
         });
-        // Connect and verify it works
-        await client.connect(mcpUrl);
-        const tools1 = await client.listTools();
-        assert.ok(tools1.tools.length > 0, 'Initial connection should work');
-        console.log('  ✓ Initial connection successful');
-        // Keep connection alive with periodic requests
-        console.log('  Keeping session alive with requests...');
-        for (let i = 0; i < KEEPALIVE_REQUEST_COUNT; i++) {
-            await new Promise(resolve => setTimeout(resolve, KEEPALIVE_INTERVAL_MS));
-            const tools = await client.listTools();
-            assert.ok(tools.tools.length > 0, `Request ${i + 1} should succeed`);
-            console.log(`  ✓ Request ${i + 1} succeeded (session still alive)`);
-        }
-        await client.disconnect();
-        console.log('  ✓ Session remained active with periodic requests');
-    });
-    test('session timeout expiration - inactivity expires auth', async () => {
-        // Add a small delay to ensure server is ready/clean from previous test
-        await new Promise(resolve => setTimeout(resolve, 1000));
-        const baseline = await getMetrics(mcpUrl);
-        // Step 1: Connect WITH auth header to establish session
-        const clientWithAuth = new CustomHeaderClient({
-            'authorization': `Bearer ${MOCK_TOKEN}`
+        after(async () => {
+            cleanupServers(servers);
+            if (mockGitLab) {
+                await mockGitLab.stop();
+            }
         });
-        await clientWithAuth.connect(mcpUrl);
-        const tools1 = await clientWithAuth.listTools();
-        assert.ok(tools1.tools.length > 0, 'Initial connection should work');
-        console.log('  ✓ Initial connection successful with auth');
-        // Extract session ID using proper API
-        const sessionId = clientWithAuth.getSessionId();
-        assert.ok(sessionId, 'Session ID should exist');
-        console.log(`  ℹ️  Session ID: ${sessionId}`);
-        const beforeTimeout = await getMetrics(mcpUrl);
-        assert.strictEqual(beforeTimeout.activeSessions, baseline.activeSessions + 1, 'Session should occupy one additional active slot');
-        assert.strictEqual(beforeTimeout.authenticatedSessions, baseline.authenticatedSessions + 1, 'Session should add one authenticated session');
-        // Step 2: Wait for timeout WITHOUT making any requests
-        console.log(`  ⏳ Waiting ${TIMEOUT_TEST_WAIT_MS / 1000}s for timeout without activity...`);
-        await new Promise(resolve => setTimeout(resolve, TIMEOUT_TEST_WAIT_MS));
-        await waitForSessionDecrease(mcpUrl, beforeTimeout);
-        console.log('  ✓ Timeout closed transport and released active session slot');
-        // Step 3: Try to make request WITHOUT auth header - should fail with 401
-        try {
-            const response = await fetch(mcpUrl, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                    'mcp-session-id': sessionId,
-                },
-                body: JSON.stringify({
-                    jsonrpc: '2.0',
-                    id: 1,
-                    method: 'tools/list'
-                })
+        test('session timeout verification - activity keeps session alive', async () => {
+            const client = new CustomHeaderClient({
+                'authorization': `Bearer ${MOCK_TOKEN}`
             });
-            if (!response.ok) {
-                assert.strictEqual(response.status, 401, 'Should return 401 Unauthorized');
-                console.log(`  ✓ Request correctly failed with status ${response.status}`);
-                const body = await response.text();
-                console.log(`  ℹ️  Error: ${body.substring(0, 100)}...`);
+            // Connect and verify it works
+            await client.connect(mcpUrl);
+            const tools1 = await client.listTools();
+            assert.ok(tools1.tools.length > 0, 'Initial connection should work');
+            console.log('  ✓ Initial connection successful');
+            // Keep connection alive with periodic requests
+            console.log('  Keeping session alive with requests...');
+            for (let i = 0; i < KEEPALIVE_REQUEST_COUNT; i++) {
+                await new Promise(resolve => setTimeout(resolve, KEEPALIVE_INTERVAL_MS));
+                const tools = await client.listTools();
+                assert.ok(tools.tools.length > 0, `Request ${i + 1} should succeed`);
+                console.log(`  ✓ Request ${i + 1} succeeded (session still alive)`);
             }
-            else {
-                assert.fail('Should have failed due to expired auth token');
+            await client.disconnect();
+            console.log('  ✓ Session remained active with periodic requests');
+        });
+        test('session timeout expiration - inactivity expires auth', async () => {
+            // Add a small delay to ensure server is ready/clean from previous test
+            await new Promise(resolve => setTimeout(resolve, 1000));
+            const baseline = await getMetrics(mcpUrl);
+            // Step 1: Connect WITH auth header to establish session
+            const clientWithAuth = new CustomHeaderClient({
+                'authorization': `Bearer ${MOCK_TOKEN}`
+            });
+            await clientWithAuth.connect(mcpUrl);
+            const tools1 = await clientWithAuth.listTools();
+            assert.ok(tools1.tools.length > 0, 'Initial connection should work');
+            console.log('  ✓ Initial connection successful with auth');
+            // Extract session ID using proper API
+            const sessionId = clientWithAuth.getSessionId();
+            assert.ok(sessionId, 'Session ID should exist');
+            console.log(`  ℹ️  Session ID: ${sessionId}`);
+            const beforeTimeout = await getMetrics(mcpUrl);
+            assert.strictEqual(beforeTimeout.activeSessions, baseline.activeSessions + 1, 'Session should occupy one additional active slot');
+            assert.strictEqual(beforeTimeout.authenticatedSessions, baseline.authenticatedSessions + 1, 'Session should add one authenticated session');
+            // Step 2: Wait for timeout WITHOUT making any requests
+            console.log(`  ⏳ Waiting ${TIMEOUT_TEST_WAIT_MS / 1000}s for timeout without activity...`);
+            await new Promise(resolve => setTimeout(resolve, TIMEOUT_TEST_WAIT_MS));
+            await waitForSessionDecrease(mcpUrl, beforeTimeout);
+            console.log('  ✓ Timeout closed transport and released active session slot');
+            // Step 3: Try to make request WITHOUT auth header - should fail with 401
+            try {
+                const response = await fetch(mcpUrl, {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json',
+                        'mcp-session-id': sessionId,
+                    },
+                    body: JSON.stringify({
+                        jsonrpc: '2.0',
+                        id: 1,
+                        method: 'tools/list'
+                    })
+                });
+                if (!response.ok) {
+                    assert.strictEqual(response.status, 401, 'Should return 401 Unauthorized');
+                    console.log(`  ✓ Request correctly failed with status ${response.status}`);
+                    const body = await response.text();
+                    console.log(`  ℹ️  Error: ${body.substring(0, 100)}...`);
+                }
+                else {
+                    assert.fail('Should have failed due to expired auth token');
+                }
             }
-        }
-        catch (error) {
-            // Network errors are also acceptable
-            assert.ok(error instanceof Error, 'Should throw error');
-            console.log('  ✓ Request correctly failed after timeout');
-            console.log(`  ℹ️  Error: ${error.message.substring(0, 100)}...`);
-        }
-        await clientWithAuth.disconnect();
+            catch (error) {
+                // Network errors are also acceptable
+                assert.ok(error instanceof Error, 'Should throw error');
+                console.log('  ✓ Request correctly failed after timeout');
+                console.log(`  ℹ️  Error: ${error.message.substring(0, 100)}...`);
+            }
+            await clientWithAuth.disconnect();
+        });
     });
 });

package/build/test/server/metrics.test.js

@@ -0,0 +1,47 @@
+import { describe, test } from "node:test";
+import assert from "node:assert";
+import { escapePrometheusLabel, formatPrometheusMetrics } from "../../server/metrics.js";
+describe("Prometheus metrics formatting", () => {
+    test("escapes label values", () => {
+        assert.strictEqual(escapePrometheusLabel('a"b\\c\nd'), 'a\\"b\\\\c\\nd');
+    });
+    test("formats current MCP metrics", () => {
+        const body = formatPrometheusMetrics({
+            requestsProcessed: 2,
+            rejectedByRateLimit: 1,
+            rejectedByCapacity: 0,
+            authFailures: 3,
+            totalSessions: 4,
+            expiredSessions: 5,
+            activeSessions: 6,
+            authenticatedSessions: 7,
+            gitlabClientPool: { size: 8, maxSize: 100 },
+            uptime: 9,
+            memoryUsage: {
+                rss: 10,
+                heapTotal: 11,
+                heapUsed: 12,
+                external: 13,
+                arrayBuffers: 14,
+            },
+            statelessRequests: 15,
+            statelessAuthFromHeader: 16,
+            statelessAuthFromSealedSid: 17,
+            statelessAuthFailures: 18,
+            statelessSidRotated: 19,
+            config: {
+                maxSessions: 1000,
+                maxRequestsPerMinute: 60,
+                sessionTimeoutSeconds: 3600,
+                remoteAuthEnabled: true,
+                mcpOAuthEnabled: false,
+                statelessModeEnabled: false,
+                statelessRotationKey: false,
+            },
+        });
+        assert.match(body, /# HELP gitlab_mcp_requests_processed_total/);
+        assert.match(body, /gitlab_mcp_requests_processed_total 2/);
+        assert.match(body, /gitlab_mcp_requests_rejected_total\{reason="rate_limit"\} 1/);
+        assert.match(body, /gitlab_mcp_config_info\{[^}]*remote_auth_enabled="true"/);
+    });
+});

package/build/test/sse-auth-guard.test.js

@@ -4,7 +4,7 @@ import { once } from "node:events";
 import { afterEach, describe, test } from "node:test";
 import * as path from "node:path";
 import { findAvailablePort } from "./utils/server-launcher.js";
-const ERROR_MESSAGE = "SSE=true on a non-loopback HOST requires SSE_AUTH_TOKEN (or explicitly set SSE_DANGEROUSLY_ALLOW_UNAUTHENTICATED_REMOTE=true)";
+const ERROR_MESSAGE = "SSE=true requires SSE_AUTH_TOKEN (or explicitly set SSE_DANGEROUSLY_ALLOW_UNAUTHENTICATED_REMOTE=true)";
 const LOOPBACK = "127.0.0.1";
 const SERVER_PATH = path.resolve(process.cwd(), "build/index.js");
 const running = new Set();
@@ -75,7 +75,7 @@ afterEach(() => {
     running.clear();
 });
 describe("SSE remote auth guard", () => {
-    test("refuses unauthenticated SSE on non-loopback hosts", async () => {
+    test("refuses unauthenticated SSE", async () => {
         const port = await findAvailablePort(4400);
         const child = startSseServer({}, port);
         const { code, output } = await waitForExit(child);

package/build/test/stateless/callback-proxy.test.js

@@ -256,6 +256,14 @@ describe("callback-proxy cross-pod flow (stateless)", () => {
         const tokens = await podC.exchangeAuthorizationCode(podCClient, proxyCode, clientCodeVerifier, CLIENT_REDIRECT);
         assert.equal(tokens.access_token, "gl-access-123");
     });
+    test("callback rejects repeated query parameters", async () => {
+        const pod = makeProvider(loadMaterial(secret()));
+        const cbRes = makeFakeRes();
+        await pod.handleCallback(fakeReq({ code: "gitlab-code", state: ["one", "two"] }), cbRes);
+        assert.equal(cbRes.statusCode, 400);
+        assert.equal(cbRes.body, "Invalid query parameter");
+        assert.equal(stub.calls.length, 0);
+    });
     test("exchangeAuthorizationCode rejects wrong PKCE verifier", async () => {
         const s = secret();
         const pod = makeProvider(loadMaterial(s));

package/build/test/stateless/session-id-integration.test.js

@@ -28,7 +28,7 @@ describe("Stateless Mcp-Session-Id — cross-pod integration", () => {
     let urlB;
     const sharedSecret = randomBytes(32).toString("base64url");
     before(async () => {
-        const mockPort = await findMockServerPort(MOCK_PORT_BASE);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_TOKEN],
@@ -204,7 +204,7 @@ describe("Stateless Mcp-Session-Id — inactivity-TTL semantics", () => {
     const sharedSecret = randomBytes(32).toString("base64url");
     const TTL_SECONDS = 3;
     before(async () => {
-        const mockPort = await findMockServerPort(MOCK_PORT_BASE + 100);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_TOKEN],
@@ -471,7 +471,7 @@ describe("Stateless Mcp-Session-Id — OAuth + sid-only follow-up", () => {
     let material;
     const sharedSecret = randomBytes(32).toString("base64url");
     before(async () => {
-        const mockPort = await findMockServerPort(OAUTH_MOCK_PORT_BASE);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_OAUTH_TOKEN],

package/build/test/streamable-http-concurrent-session.test.js

@@ -19,7 +19,7 @@ describe("Streamable HTTP concurrent session requests", { timeout: 20_000 }, ()
     let server;
     let mcpUrl;
     before(async () => {
-        const mockPort = await findMockServerPort(9360);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_TOKEN],