@zereight/mcp-gitlab 2.1.29 → 2.1.38

package/build/test/dynamic-api-url-test.js

@@ -25,7 +25,7 @@ describe('Dynamic API URL - Multiple GitLab Instances', () => {
     let servers = [];
     before(async () => {
         // Start first mock GitLab server
-        const mockPort1 = await findMockServerPort(MOCK_GITLAB_PORT_BASE_1);
+        const mockPort1 = await findMockServerPort();
         mockGitLab1 = new MockGitLabServer({
             port: mockPort1,
             validTokens: [MOCK_TOKEN_1]
@@ -33,7 +33,7 @@ describe('Dynamic API URL - Multiple GitLab Instances', () => {
         await mockGitLab1.start();
         mockGitLabUrl1 = mockGitLab1.getUrl();
         // Start second mock GitLab server
-        const mockPort2 = await findMockServerPort(MOCK_GITLAB_PORT_BASE_2);
+        const mockPort2 = await findMockServerPort();
         mockGitLab2 = new MockGitLabServer({
             port: mockPort2,
             validTokens: [MOCK_TOKEN_2]
@@ -203,14 +203,14 @@ describe('Dynamic API URL - Connection Pool', () => {
     let servers = [];
     before(async () => {
         // Start mock GitLab servers
-        const mockPort1 = await findMockServerPort(MOCK_GITLAB_PORT_BASE_1 + 50);
+        const mockPort1 = await findMockServerPort();
         mockGitLab1 = new MockGitLabServer({
             port: mockPort1,
             validTokens: [MOCK_TOKEN_1]
         });
         await mockGitLab1.start();
         mockGitLabUrl1 = mockGitLab1.getUrl();
-        const mockPort2 = await findMockServerPort(MOCK_GITLAB_PORT_BASE_2 + 50);
+        const mockPort2 = await findMockServerPort();
         mockGitLab2 = new MockGitLabServer({
             port: mockPort2,
             validTokens: [MOCK_TOKEN_2]

package/build/test/dynamic-routing-tests.js

@@ -29,7 +29,7 @@ describe('Dynamic Routing and Authentication Scenarios', () => {
             // to avoid launchServer overwriting GITLAB_PERSONAL_ACCESS_TOKEN with a different value
             process.env.GITLAB_TOKEN_TEST = MOCK_TOKEN_DEFAULT;
             process.env.TEST_PROJECT_ID = '1';
-            const mockPort = await findMockServerPort(9021);
+            const mockPort = await findMockServerPort();
             mockServer = new MockGitLabServer({ port: mockPort, validTokens: [MOCK_TOKEN_DEFAULT] });
             await mockServer.start();
             const mcpPort = await findAvailablePort(3021);
@@ -82,7 +82,7 @@ describe('Dynamic Routing and Authentication Scenarios', () => {
         let mcpUrl;
         let mockServer;
         before(async () => {
-            const mockPort = await findMockServerPort(9022);
+            const mockPort = await findMockServerPort();
             mockServer = new MockGitLabServer({ port: mockPort, validTokens: [MOCK_TOKEN_HEADER] });
             await mockServer.start();
             const mcpPort = await findAvailablePort(3022);
@@ -146,10 +146,10 @@ describe('Dynamic Routing and Authentication Scenarios', () => {
         let defaultMockServer;
         let headerMockServer;
         before(async () => {
-            const defaultPort = await findMockServerPort(9024);
+            const defaultPort = await findMockServerPort();
             defaultMockServer = new MockGitLabServer({ port: defaultPort, validTokens: [MOCK_TOKEN_DEFAULT, MOCK_TOKEN_HEADER] });
             await defaultMockServer.start();
-            const headerPort = await findMockServerPort(9025);
+            const headerPort = await findMockServerPort();
             headerMockServer = new MockGitLabServer({ port: headerPort, validTokens: [MOCK_TOKEN_DEFAULT, MOCK_TOKEN_HEADER] });
             await headerMockServer.start();
             const mcpPort = await findAvailablePort(3024);

package/build/test/group-milestone-schema.test.js

@@ -0,0 +1,45 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { GitLabGroupMilestonesSchema, GitLabMilestonesSchema, GetGroupMilestoneIssuesSchema, } from "../schemas.js";
+test("group milestone response keeps group_id and rejects missing group_id", () => {
+    const parsed = GitLabGroupMilestonesSchema.parse({
+        id: 12,
+        iid: 3,
+        group_id: 16,
+        title: "10.0",
+        description: null,
+        due_date: null,
+        start_date: null,
+        state: "active",
+        updated_at: "2013-10-02T09:24:18Z",
+        created_at: "2013-10-02T09:24:18Z",
+        expired: false,
+    });
+    assert.equal(parsed.group_id, "16");
+    assert.equal("project_id" in parsed, false);
+    // Project schema coerces missing project_id to "undefined" — why group schema exists
+    const coerced = GitLabMilestonesSchema.parse({
+        id: 12,
+        iid: 3,
+        group_id: 16,
+        title: "10.0",
+        description: null,
+        due_date: null,
+        start_date: null,
+        state: "active",
+        updated_at: "2013-10-02T09:24:18Z",
+        created_at: "2013-10-02T09:24:18Z",
+        expired: false,
+    });
+    assert.equal(coerced.project_id, "undefined");
+});
+test("group milestone issues schema accepts page and per_page", () => {
+    const parsed = GetGroupMilestoneIssuesSchema.parse({
+        group_id: "16",
+        milestone_id: "12",
+        page: 2,
+        per_page: 50,
+    });
+    assert.equal(parsed.page, 2);
+    assert.equal(parsed.per_page, 50);
+});

package/build/test/mcp-oauth-tests.js

@@ -83,7 +83,7 @@ describe("MCP OAuth — Discovery Endpoints", () => {
     let mockGitLab;
     let servers = [];
     before(async () => {
-        const mockPort = await findMockServerPort(MOCK_GITLAB_PORT_BASE);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_OAUTH_TOKEN],
@@ -137,8 +137,20 @@ describe("MCP OAuth — Discovery Endpoints", () => {
         assert.ok(body.resource, "Should have resource field");
         console.log("  ✓ Protected resource metadata returned");
     });
+    test("unprefixed MCP_SERVER_URL serves /mcp resource discovery at /.well-known/oauth-protected-resource/mcp", async () => {
+        // When MCP_SERVER_URL has no path, the server registers a dedicated route
+        // at /.well-known/oauth-protected-resource/mcp (RFC 9728 path-suffixed
+        // discovery) so clients connecting to /mcp can discover the resource.
+        const issuerUrl = new URL(mcpBaseUrl);
+        const res = await fetch(`${mcpBaseUrl}/.well-known/oauth-protected-resource/mcp`);
+        assert.strictEqual(res.status, 200, "Should return 200");
+        const body = (await res.json());
+        assert.strictEqual(body.resource, `${issuerUrl.origin}/mcp`, "resource should be ${origin}/mcp");
+        assert.deepStrictEqual(body.authorization_servers, [issuerUrl.href], "authorization_servers should contain the issuer URL");
+        console.log("  ✓ Unprefixed MCP_SERVER_URL: /mcp resource discovery returned correct metadata");
+    });
     test("path-prefixed MCP_SERVER_URL serves path-aware discovery metadata", async () => {
-        const mockPort = await findMockServerPort(MOCK_GITLAB_PORT_BASE + 25);
+        const mockPort = await findMockServerPort();
         const prefixedMockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_OAUTH_TOKEN],
@@ -196,7 +208,7 @@ describe("MCP OAuth — /mcp Auth Enforcement", () => {
     let mockGitLab;
     let servers = [];
     before(async () => {
-        const mockPort = await findMockServerPort(MOCK_GITLAB_PORT_BASE + 50);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_OAUTH_TOKEN],
@@ -492,7 +504,7 @@ describe("MCP OAuth — Header Auth Fallback", () => {
     let mockGitLab;
     let servers = [];
     before(async () => {
-        const mockPort = await findMockServerPort(MOCK_GITLAB_PORT_BASE + 150);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             // Include both OAuth token and raw tokens so GitLab API calls succeed
@@ -566,6 +578,19 @@ describe("MCP OAuth — Header Auth Fallback", () => {
         assert.notStrictEqual(res.status, 403, "Should not return 403 with valid JOB-TOKEN");
         console.log(`  ✓ JOB-TOKEN header accepted (status: ${res.status})`);
     });
+    test("POST /mcp with invalid Private-Token is rejected before session creation", async () => {
+        const res = await fetch(mcpUrl, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Accept: "application/json, text/event-stream",
+                "Private-Token": "glpat-invalid-token-0000",
+            },
+            body: initBody,
+        });
+        assert.strictEqual(res.status, 401);
+        assert.strictEqual(res.headers.get("mcp-session-id"), null);
+    });
     test("POST /mcp with valid OAuth Bearer token still works normally", async () => {
         const res = await fetch(mcpUrl, {
             method: "POST",

package/build/test/mcp-server-name.test.js

@@ -0,0 +1,87 @@
+import { after, describe, test } from "node:test";
+import assert from "node:assert";
+import { cleanupServers, findAvailablePort, HOST, launchServer, TransportMode, } from "./utils/server-launcher.js";
+async function rawMcpRequest(url, body, headers = {}) {
+    const response = await fetch(url, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            Accept: "application/json, text/event-stream",
+            ...headers,
+        },
+        body: JSON.stringify(body),
+    });
+    const text = await response.text();
+    const contentType = response.headers.get("content-type") ?? "";
+    if (contentType.includes("text/event-stream")) {
+        const dataLines = text
+            .split("\n")
+            .filter(line => line.startsWith("data: "))
+            .map(line => line.slice(6));
+        return {
+            status: response.status,
+            data: dataLines.length > 0 ? JSON.parse(dataLines.at(-1)) : null,
+            text,
+        };
+    }
+    return {
+        status: response.status,
+        data: text ? JSON.parse(text) : null,
+        text,
+    };
+}
+const initializeBody = {
+    jsonrpc: "2.0",
+    id: 1,
+    method: "initialize",
+    params: {
+        protocolVersion: "2025-03-26",
+        capabilities: {},
+        clientInfo: { name: "server-name-test", version: "1.0.0" },
+    },
+};
+let portOffset = 0;
+async function launchWithServerName(mcpServerName) {
+    const port = await findAvailablePort(3700 + portOffset++ * 10);
+    const server = await launchServer({
+        mode: TransportMode.STREAMABLE_HTTP,
+        port,
+        timeout: 10_000,
+        env: {
+            STREAMABLE_HTTP: "true",
+            REMOTE_AUTHORIZATION: "true",
+            GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY: "true",
+            GITLAB_API_URL: "https://gitlab.example.com/api/v4",
+            ...(mcpServerName !== undefined ? { MCP_SERVER_NAME: mcpServerName } : {}),
+        },
+    });
+    return { server, mcpUrl: `http://${HOST}:${port}/mcp` };
+}
+describe("MCP_SERVER_NAME", { timeout: 20_000 }, () => {
+    let servers = [];
+    after(() => {
+        cleanupServers(servers);
+        servers = [];
+    });
+    test("defaults to zereight-gitlab-mcp-server when unset", async () => {
+        const { server, mcpUrl } = await launchWithServerName();
+        servers.push(server);
+        const response = await rawMcpRequest(mcpUrl, initializeBody);
+        assert.strictEqual(response.status, 200, response.text);
+        assert.strictEqual(response.data?.result?.serverInfo?.name, "zereight-gitlab-mcp-server");
+    });
+    test("reports the overridden name when MCP_SERVER_NAME is set", async () => {
+        const { server, mcpUrl } = await launchWithServerName("gitlab-selfhosted-readonly");
+        servers.push(server);
+        const response = await rawMcpRequest(mcpUrl, initializeBody);
+        assert.strictEqual(response.status, 200, response.text);
+        assert.strictEqual(response.data?.result?.serverInfo?.name, "gitlab-selfhosted-readonly");
+    });
+    test("treats a whitespace-only MCP_SERVER_NAME as unset", async () => {
+        const { server, mcpUrl } = await launchWithServerName("   ");
+        servers.push(server);
+        const response = await rawMcpRequest(mcpUrl, initializeBody);
+        assert.strictEqual(response.status, 200, response.text);
+        assert.strictEqual(response.data?.result?.serverInfo?.name, "zereight-gitlab-mcp-server");
+    });
+});

package/build/test/multi-server-test.js

@@ -45,7 +45,7 @@ describe("Single Client Mode (ENABLE_DYNAMIC_API_URL=false)", () => {
     let mcpUrl;
     let mockServer1;
     before(async () => {
-        const mockPort = await findMockServerPort(9001);
+        const mockPort = await findMockServerPort();
         mockServer1 = new MockGitLabServer({ port: mockPort, validTokens: [MOCK_TOKEN] });
         mockServer1.addMockHandler('get', '/projects/1', (req, res) => { res.json(project1); });
         await mockServer1.start();
@@ -105,8 +105,8 @@ describe("Dynamic Client Mode (ENABLE_DYNAMIC_API_URL=true)", () => {
     let mockServer1;
     let mockServer2;
     before(async () => {
-        const port1 = await findMockServerPort(9011);
-        const port2 = await findMockServerPort(9012);
+        const port1 = await findMockServerPort();
+        const port2 = await findMockServerPort();
         mockServer1 = new MockGitLabServer({ port: port1, validTokens: [MOCK_TOKEN] });
         mockServer2 = new MockGitLabServer({ port: port2, validTokens: [MOCK_TOKEN] });
         mockServer1.addMockHandler('get', '/projects/1', (req, res) => { res.json(project1); });

package/build/test/no-proxy-integration-test.js

@@ -22,7 +22,7 @@ describe('NO_PROXY Integration Tests', () => {
     let mockGitLabHost;
     before(async () => {
         // Start mock GitLab server
-        const mockPort = await findMockServerPort(MOCK_GITLAB_PORT_BASE);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_TOKEN]

package/build/test/nullable-gitlab-response-fields.test.js

@@ -0,0 +1,22 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { GitLabCompareResultSchema, GitLabProtectedBranchAccessLevelSchema, } from "../schemas.js";
+test("role-based protected-branch access levels accept null user_id/group_id", () => {
+    // #575: GitLab returns null for role-based levels, not omitted fields
+    const parsed = GitLabProtectedBranchAccessLevelSchema.parse({
+        access_level: 40,
+        access_level_description: "Maintainers",
+        user_id: null,
+        group_id: null,
+    });
+    assert.equal(parsed.user_id, null);
+    assert.equal(parsed.group_id, null);
+});
+test("branch compare accepts null commit", () => {
+    const parsed = GitLabCompareResultSchema.parse({
+        commit: null,
+        commits: [],
+        diffs: [],
+    });
+    assert.equal(parsed.commit, null);
+});

package/build/test/path-segment-encoding.test.js

@@ -11,6 +11,9 @@ const rawPathSegmentPatterns = [
     "/draft_notes/${draftNoteId}",
     "/versions/${versionId}",
     "/groups/${groupId}",
+    "/jobs/${jobId}",
+    "/pipelines/${pipelineId}",
+    "/milestones/${milestoneId}",
 ];
 test("GitLab URL path IDs are encoded before interpolation", () => {
     for (const pattern of rawPathSegmentPatterns) {
@@ -22,6 +25,14 @@ test("encoding keeps path traversal payloads inside one URL segment", () => {
     const url = new URL(`https://gitlab.com/api/v4/projects/42/issues/${encodeURIComponent(payload)}/notes`);
     assert.equal(url.pathname, "/api/v4/projects/42/issues/1%2F..%2F..%2F..%2F..%2Fadmin%2Fci%2Fvariables/notes");
 });
+test("job_id path traversal stays under /jobs/", () => {
+    // GHSA-7c3w-fxgh-frc7 / #587: unencoded job_id with ../ escaped to /api/v4/user
+    const payload = "../../../user";
+    const url = new URL(`https://gitlab.com/api/v4/projects/1/jobs/${encodeURIComponent(payload)}/trace`);
+    assert.equal(url.pathname, "/api/v4/projects/1/jobs/..%2F..%2F..%2Fuser/trace");
+    assert.match(url.pathname, /\/jobs\/[^/]+\/trace$/);
+    assert.equal(url.pathname.includes("/api/v4/user"), false);
+});
 test("malformed percent-encoded segments can still be encoded", () => {
     assert.equal(encodeURIComponent("bad%zz/path"), "bad%25zz%2Fpath");
 });