@zereight/mcp-gitlab 2.1.56 → 2.1.58

package/build/schemas.js

@@ -1229,6 +1229,7 @@ export const GitLabCreateUpdateFileResponseSchema = z.object({
 export const GitLabSearchResponseSchema = z.object({
     count: z.coerce.number().optional(),
     total_pages: z.coerce.number().optional(),
+    next_page: z.coerce.number().optional(),
     current_page: z.coerce.number().optional(),
     items: z.array(GitLabRepositorySchema),
 });
@@ -4091,6 +4092,14 @@ export const CreateTimelineEventSchema = z.object({
         .describe("Timeline event tags to attach. Available: 'Start time', 'End time', 'Impact detected', 'Response initiated', 'Impact mitigated', 'Cause identified'."),
 });
 // --- Webhook schemas ---
+function hasExactlyOneWebhookScope(data) {
+    const hasProject = Boolean(data.project_id);
+    const hasGroup = Boolean(data.group_id);
+    return (hasProject || hasGroup) && !(hasProject && hasGroup);
+}
+const EXACTLY_ONE_WEBHOOK_SCOPE = {
+    message: "Provide exactly one of project_id or group_id",
+};
 export const ListWebhooksSchema = z
     .object({
     project_id: z.coerce
@@ -4103,9 +4112,7 @@ export const ListWebhooksSchema = z
         .describe("Group ID or URL-encoded path. Provide either project_id or group_id, not both."),
 })
     .merge(PaginationOptionsSchema)
-    .refine(data => (data.project_id || data.group_id) && !(data.project_id && data.group_id), {
-    message: "Provide exactly one of project_id or group_id",
-});
+    .refine(hasExactlyOneWebhookScope, EXACTLY_ONE_WEBHOOK_SCOPE);
 export const ListWebhookEventsSchema = z
     .object({
     project_id: z.coerce
@@ -4128,9 +4135,7 @@ export const ListWebhookEventsSchema = z
     per_page: z.number().max(20).optional().default(20).describe("Number of events per page"),
     page: z.coerce.number().optional().describe("Page number for pagination"),
 })
-    .refine(data => (data.project_id || data.group_id) && !(data.project_id && data.group_id), {
-    message: "Provide exactly one of project_id or group_id",
-});
+    .refine(hasExactlyOneWebhookScope, EXACTLY_ONE_WEBHOOK_SCOPE);
 export const GetWebhookEventSchema = z
     .object({
     project_id: z.coerce
@@ -4148,9 +4153,115 @@ export const GetWebhookEventSchema = z
         .optional()
         .describe("If known, the page where the event is located (from list_webhook_events). Skips auto-pagination and fetches only this page."),
 })
-    .refine(data => (data.project_id || data.group_id) && !(data.project_id && data.group_id), {
-    message: "Provide exactly one of project_id or group_id",
+    .refine(hasExactlyOneWebhookScope, EXACTLY_ONE_WEBHOOK_SCOPE);
+const WebhookCustomHeaderSchema = z.object({
+    key: z.string().min(1).describe("Custom header name"),
+    value: z.string().describe("Custom header value"),
 });
+const WebhookMutationFields = {
+    url: z.string().url().describe("Webhook destination URL"),
+    name: z.string().optional().describe("Display name for the webhook"),
+    description: z.string().optional().describe("Description of the webhook"),
+    token: z
+        .string()
+        .optional()
+        .describe("Secret token to validate received payloads. Not returned by GitLab in responses."),
+    signing_token: z
+        .string()
+        .optional()
+        .describe("HMAC signing token in whsec_<base64> form, where the Base64 suffix encodes a 32-byte key. Used for the webhook-signature header. Not returned by GitLab in responses."),
+    enable_ssl_verification: z
+        .boolean()
+        .optional()
+        .describe("Verify SSL when delivering the webhook"),
+    push_events: z.boolean().optional().describe("Trigger on push events"),
+    push_events_branch_filter: z
+        .string()
+        .optional()
+        .describe("Only trigger push events for matching branches"),
+    branch_filter_strategy: z
+        .enum(["wildcard", "regex", "all_branches"])
+        .optional()
+        .describe("How push_events_branch_filter is interpreted"),
+    issues_events: z.boolean().optional().describe("Trigger on issue events"),
+    confidential_issues_events: z
+        .boolean()
+        .optional()
+        .describe("Trigger on confidential issue events"),
+    merge_requests_events: z.boolean().optional().describe("Trigger on merge request events"),
+    tag_push_events: z.boolean().optional().describe("Trigger on tag push events"),
+    note_events: z.boolean().optional().describe("Trigger on note/comment events"),
+    confidential_note_events: z
+        .boolean()
+        .optional()
+        .describe("Trigger on confidential note events"),
+    job_events: z.boolean().optional().describe("Trigger on job events"),
+    pipeline_events: z.boolean().optional().describe("Trigger on pipeline events"),
+    wiki_page_events: z.boolean().optional().describe("Trigger on wiki page events"),
+    deployment_events: z.boolean().optional().describe("Trigger on deployment events"),
+    feature_flag_events: z.boolean().optional().describe("Trigger on feature flag events"),
+    releases_events: z.boolean().optional().describe("Trigger on release events"),
+    milestone_events: z.boolean().optional().describe("Trigger on milestone events"),
+    resource_access_token_events: z
+        .boolean()
+        .optional()
+        .describe("Trigger on access token expiry events"),
+    resource_deploy_token_events: z
+        .boolean()
+        .optional()
+        .describe("Trigger on project deploy token expiry events (project webhooks)"),
+    member_events: z.boolean().optional().describe("Trigger on member events (group webhooks)"),
+    project_events: z.boolean().optional().describe("Trigger on project events (group webhooks)"),
+    subgroup_events: z.boolean().optional().describe("Trigger on subgroup events (group webhooks)"),
+    custom_webhook_template: z
+        .string()
+        .optional()
+        .describe("Custom JSON payload template for the webhook"),
+    custom_headers: z
+        .array(WebhookCustomHeaderSchema)
+        .optional()
+        .describe("Custom HTTP headers sent with the webhook. Each item has key and value strings."),
+};
+export const CreateWebhookSchema = z
+    .object({
+    project_id: z.coerce
+        .string()
+        .optional()
+        .describe("Project ID or URL-encoded path. Provide either project_id or group_id, not both."),
+    group_id: z.coerce
+        .string()
+        .optional()
+        .describe("Group ID or URL-encoded path. Provide either project_id or group_id, not both."),
+    ...WebhookMutationFields,
+})
+    .refine(hasExactlyOneWebhookScope, EXACTLY_ONE_WEBHOOK_SCOPE);
+export const UpdateWebhookSchema = z
+    .object({
+    project_id: z.coerce
+        .string()
+        .optional()
+        .describe("Project ID or URL-encoded path. Provide either project_id or group_id, not both."),
+    group_id: z.coerce
+        .string()
+        .optional()
+        .describe("Group ID or URL-encoded path. Provide either project_id or group_id, not both."),
+    hook_id: z.coerce.number().describe("ID of the webhook to update"),
+    ...WebhookMutationFields,
+})
+    .refine(hasExactlyOneWebhookScope, EXACTLY_ONE_WEBHOOK_SCOPE);
+export const DeleteWebhookSchema = z
+    .object({
+    project_id: z.coerce
+        .string()
+        .optional()
+        .describe("Project ID or URL-encoded path. Provide either project_id or group_id, not both."),
+    group_id: z.coerce
+        .string()
+        .optional()
+        .describe("Group ID or URL-encoded path. Provide either project_id or group_id, not both."),
+    hook_id: z.coerce.number().describe("ID of the webhook to delete"),
+})
+    .refine(hasExactlyOneWebhookScope, EXACTLY_ONE_WEBHOOK_SCOPE);
 export const HealthCheckSchema = z.object({});
 // --- CI/CD Variable types ---
 export const GitLabCiVariableSchema = z.object({

package/build/scripts/generate-tool-docs.js

@@ -101,7 +101,7 @@ const GROUP_META = {
     },
     webhooks: {
         title: "Webhooks",
-        blurb: "List webhooks configured on projects or groups, and inspect recent webhook events.",
+        blurb: "Create, update, and delete project or group webhooks, and inspect recent webhook events.",
     },
     search: {
         title: "Search",

package/build/stateless/session-id.js

@@ -35,6 +35,9 @@ export function mintSessionId(material, input) {
         h: input.header,
         t: input.token,
         u: input.apiUrl,
+        ...(input.allowedProjectIds && input.allowedProjectIds.length > 0
+            ? { p: input.allowedProjectIds }
+            : {}),
     };
     return seal(material, STATELESS_PURPOSES.SESSION_ID, payload);
 }
@@ -51,7 +54,9 @@ export function openSessionId(material, sid, ttlSeconds, now) {
             payload.h !== "JOB-TOKEN") ||
             typeof payload.t !== "string" ||
             payload.t.length === 0 ||
-            typeof payload.u !== "string") {
+            typeof payload.u !== "string" ||
+            (payload.p !== undefined &&
+                (!Array.isArray(payload.p) || payload.p.some(id => typeof id !== "string")))) {
             return null;
         }
         return payload;

package/build/test/no-proxy-test.js

@@ -134,5 +134,16 @@ describe('NO_PROXY Pattern Matching', () => {
         assert.strictEqual(agent1.constructor.name, 'Agent', 'Should match case-insensitively (lowercase)');
         assert.strictEqual(agent2.constructor.name, 'Agent', 'Should match case-insensitively (uppercase)');
     });
+    test('should re-evaluate NO_PROXY for redirect origins', () => {
+        const pool = new GitLabClientPool({
+            httpProxy: 'http://proxy.example.com:8080',
+            httpsProxy: 'http://proxy.example.com:8080',
+            noProxy: 'gitlab.internal.com',
+        });
+        const proxyToBypass = pool.getDispatcherForOrigin('https://gitlab.external.com/api/v4', 'https://gitlab.internal.com/api/v4');
+        const bypassToProxy = pool.getDispatcherForOrigin('https://gitlab.internal.com/api/v4', 'https://gitlab.external.com/api/v4');
+        assert.strictEqual(proxyToBypass.constructor.name, 'Agent', 'redirect onto NO_PROXY host should bypass');
+        assert.notStrictEqual(bypassToProxy.constructor.name, 'Agent', 'redirect onto proxied host should use proxy');
+    });
 });
 console.log('✅ NO_PROXY tests completed');

package/build/test/remote-auth-tests.js

@@ -4,7 +4,6 @@
  */
 import { describe, test, after, before } from 'node:test';
 import assert from 'node:assert';
-import fetch from 'node-fetch';
 import { launchServer, findAvailablePort, cleanupServers, TransportMode, checkHealthEndpoint, HOST } from './utils/server-launcher.js';
 console.log('🔐 Remote Authorization Tests');
 console.log('');

package/build/test/stateless/session-id.test.js

@@ -19,6 +19,32 @@ function load(current, previous) {
     return m;
 }
 describe("mintSessionId / openSessionId", () => {
+    test("seals and restores a narrowed project scope", () => {
+        const s = secret();
+        const a = load(s);
+        const b = load(s);
+        const sid = mintSessionId(a, {
+            header: "Private-Token",
+            token: "glpat-ABCDEFG123456789-abcdef",
+            apiUrl: "https://gitlab.example.com/api/v4",
+            allowedProjectIds: ["42", "org/theorg"],
+        });
+        const opened = openSessionId(b, sid, 3600);
+        assert.ok(opened);
+        assert.deepEqual(opened.p, ["42", "org/theorg"]);
+    });
+    test("omits the scope field when no scope was narrowed", () => {
+        const s = secret();
+        const m = load(s);
+        const sid = mintSessionId(m, {
+            header: "Private-Token",
+            token: "glpat-ABCDEFG123456789-abcdef",
+            apiUrl: "https://gitlab.example.com/api/v4",
+        });
+        const opened = openSessionId(m, sid, 3600);
+        assert.ok(opened);
+        assert.equal(opened.p, undefined);
+    });
     test("roundtrips across pods", () => {
         const s = secret();
         const a = load(s);

package/build/test/test-auth-retry.js

@@ -6,20 +6,18 @@
  */
 import { describe, test } from "node:test";
 import assert from "node:assert";
-import { Headers, Response } from "node-fetch";
+import { Readable } from "node:stream";
+import { Response } from "undici";
 import { headersToPlainObject, isNonReplayableBody, wrapWithAuthRetry, } from "../auth-retry.js";
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
 function mockFetch(status) {
-    return (async () => new Response("", { status }));
+    return async () => new Response("", { status });
 }
 function mockFetchThenRetry() {
     let callCount = 0;
-    return (async () => {
+    return async () => {
         callCount++;
         return new Response("", { status: callCount === 1 ? 401 : 200 });
-    });
+    };
 }
 function makeConfig(overrides) {
     return {
@@ -30,9 +28,6 @@ function makeConfig(overrides) {
         ...overrides,
     };
 }
-// ---------------------------------------------------------------------------
-// headersToPlainObject
-// ---------------------------------------------------------------------------
 describe("headersToPlainObject", () => {
     test("null returns empty object", () => {
         assert.deepStrictEqual(headersToPlainObject(null), {});
@@ -63,9 +58,6 @@ describe("headersToPlainObject", () => {
         });
     });
 });
-// ---------------------------------------------------------------------------
-// isNonReplayableBody
-// ---------------------------------------------------------------------------
 describe("isNonReplayableBody", () => {
     test("null returns false", () => {
         assert.strictEqual(isNonReplayableBody(null), false);
@@ -85,16 +77,15 @@ describe("isNonReplayableBody", () => {
     test("object with .read() returns true (stream-like)", () => {
         assert.strictEqual(isNonReplayableBody({ read: () => { } }), true);
     });
-    test("object with .getBuffer() and .getBoundary() returns true (FormData-like)", () => {
-        assert.strictEqual(isNonReplayableBody({ getBuffer: () => { }, getBoundary: () => { } }), true);
-    });
-    test("object with only .getBuffer() (no .getBoundary()) returns false", () => {
-        assert.strictEqual(isNonReplayableBody({ getBuffer: () => { } }), false);
+    test("Web ReadableStream returns true", () => {
+        const stream = new ReadableStream({
+            start(controller) {
+                controller.close();
+            },
+        });
+        assert.strictEqual(isNonReplayableBody(stream), true);
     });
 });
-// ---------------------------------------------------------------------------
-// wrapWithAuthRetry
-// ---------------------------------------------------------------------------
 describe("wrapWithAuthRetry", () => {
     test("non-401 response passes through unchanged", async () => {
         const wrapped = wrapWithAuthRetry(mockFetch(200), makeConfig());
@@ -137,7 +128,29 @@ describe("wrapWithAuthRetry", () => {
         });
         const wrapped = wrapWithAuthRetry(mockFetch(401), config);
         const res = await wrapped("http://example.com", {
-            body: { pipe: () => { } }, // stream-like
+            body: Readable.from([]),
+            duplex: "half",
+        });
+        assert.strictEqual(res.status, 401);
+        assert.strictEqual(refreshCalled, false);
+    });
+    test("401 with Web ReadableStream body skips retry", async () => {
+        let refreshCalled = false;
+        const config = makeConfig({
+            refreshToken: async () => {
+                refreshCalled = true;
+                return "tok";
+            },
+        });
+        const stream = new ReadableStream({
+            start(controller) {
+                controller.close();
+            },
+        });
+        const wrapped = wrapWithAuthRetry(mockFetch(401), config);
+        const res = await wrapped("http://example.com", {
+            body: stream,
+            duplex: "half",
         });
         assert.strictEqual(res.status, 401);
         assert.strictEqual(refreshCalled, false);
@@ -148,27 +161,21 @@ describe("wrapWithAuthRetry", () => {
         const config = makeConfig({
             refreshToken: () => {
                 refreshCount++;
-                return new Promise((resolve) => {
+                return new Promise(resolve => {
                     resolveRefresh = resolve;
                 });
             },
             buildAuthHeaders: () => ({ Authorization: "Bearer stamped" }),
         });
-        // Each call returns 401 first, then 200 on retry
         let callCount = 0;
-        const base = (async () => {
+        const base = async () => {
             callCount++;
-            // First two calls are the initial requests (both 401)
-            // Next two are the retries (both 200)
             return new Response("", { status: callCount <= 2 ? 401 : 200 });
-        });
+        };
         const wrapped = wrapWithAuthRetry(base, config);
-        // Fire two concurrent requests
         const p1 = wrapped("http://example.com/a");
         const p2 = wrapped("http://example.com/b");
-        // Wait a tick for both to hit the refresh path
-        await new Promise((r) => setTimeout(r, 10));
-        // Resolve the single pending refresh
+        await new Promise(r => setTimeout(r, 10));
         resolveRefresh("stamped-token");
         const [r1, r2] = await Promise.all([p1, p2]);
         assert.strictEqual(r1.status, 200);