@zereight/mcp-gitlab 2.1.56 → 2.1.58

package/build/test/test-dynamic-project-scope.js

@@ -0,0 +1,362 @@
+import { describe, test, before, after } from "node:test";
+import assert from "node:assert";
+import { cleanupServers, findAvailablePort, HOST, launchServer, TransportMode, } from "./utils/server-launcher.js";
+import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server.js";
+import { CustomHeaderClient } from "./clients/custom-header-client.js";
+const MOCK_TOKEN = "glpat-dynamic-scope-token";
+const SCOPE_HEADER = "x-gitlab-allowed-project-ids";
+async function connectClient(mcpUrl, scope) {
+    const headers = { authorization: `Bearer ${MOCK_TOKEN}` };
+    if (scope !== undefined) {
+        headers[SCOPE_HEADER] = scope;
+    }
+    const client = new CustomHeaderClient(headers);
+    await client.connect(mcpUrl);
+    return client;
+}
+async function getProjectId(client, projectId) {
+    const result = await client.callTool("get_project", { project_id: projectId });
+    assert.ok(result.content, "Should have content");
+    const content = result.content[0];
+    assert.ok("text" in content, "Content should have text");
+    const project = JSON.parse(content.text);
+    return project.id.toString();
+}
+describe("Dynamic project scope", { concurrency: 1 }, () => {
+    describe("with GITLAB_ALLOWED_PROJECT_IDS set", () => {
+        let mockGitLab;
+        const servers = [];
+        let mcpUrl;
+        before(async () => {
+            const mockPort = await findMockServerPort();
+            mockGitLab = new MockGitLabServer({ port: mockPort, validTokens: [MOCK_TOKEN] });
+            mockGitLab.addMockHandler("get", "/projects", (req, res) => {
+                if (req.query.search === "no-totals") {
+                    const requestedPage = Number(req.query.page ?? "1");
+                    if (requestedPage < 3) {
+                        res.set("x-next-page", String(requestedPage + 1));
+                    }
+                }
+                else {
+                    res.set("x-total", "3");
+                    res.set("x-total-pages", "2");
+                }
+                res.json(["1", "2", "3"].map(id => ({
+                    id: Number(id),
+                    name: `Project ${id}`,
+                    path: `project-${id}`,
+                    path_with_namespace: `group/project-${id}`,
+                    description: null,
+                    visibility: "private",
+                    namespace: { id: 1, name: "Group", path: "group", kind: "group", full_path: "group" },
+                })));
+            });
+            await mockGitLab.start();
+            const mcpPort = await findAvailablePort(3200);
+            const server = await launchServer({
+                mode: TransportMode.STREAMABLE_HTTP,
+                port: mcpPort,
+                timeout: 5000,
+                env: {
+                    STREAMABLE_HTTP: "true",
+                    REMOTE_AUTHORIZATION: "true",
+                    ENABLE_DYNAMIC_PROJECT_SCOPE: "true",
+                    ENABLE_STRICT_PROJECT_SCOPE: "true",
+                    GITLAB_API_URL: `${mockGitLab.getUrl()}/api/v4`,
+                    GITLAB_ALLOWED_PROJECT_IDS: "1,2",
+                },
+            });
+            servers.push(server);
+            mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
+        });
+        after(async () => {
+            cleanupServers(servers);
+            await mockGitLab?.stop();
+        });
+        test("header narrows the allowlist to the requested projects", async () => {
+            const client = await connectClient(mcpUrl, "1");
+            try {
+                assert.strictEqual(await getProjectId(client, ""), "1");
+                await assert.rejects(() => client.callTool("get_project", { project_id: "2" }), /Access denied/);
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+        test("project outside GITLAB_ALLOWED_PROJECT_IDS rejects the session", async () => {
+            const client = new CustomHeaderClient({
+                authorization: `Bearer ${MOCK_TOKEN}`,
+                [SCOPE_HEADER]: "1,3",
+            });
+            let connected = false;
+            try {
+                await client.connect(mcpUrl);
+                connected = true;
+                await client.callTool("get_project", { project_id: "1" });
+            }
+            catch {
+                // Expected: the session is rejected before any tool call is possible.
+            }
+            finally {
+                await client.disconnect();
+            }
+            assert.strictEqual(connected, false, "out-of-scope header must not initialize a session");
+        });
+        test("empty header rejects the session", async () => {
+            const client = new CustomHeaderClient({
+                authorization: `Bearer ${MOCK_TOKEN}`,
+                [SCOPE_HEADER]: "  ",
+            });
+            let connected = false;
+            try {
+                await client.connect(mcpUrl);
+                connected = true;
+                await client.callTool("get_project", { project_id: "1" });
+            }
+            catch {
+                // Expected: the session is rejected before any tool call is possible.
+            }
+            finally {
+                await client.disconnect();
+            }
+            assert.strictEqual(connected, false, "an empty header must not initialize a session");
+        });
+        test("scoped session refuses non-scopable tools", async () => {
+            const client = await connectClient(mcpUrl, "1");
+            try {
+                await assert.rejects(() => client.callTool("execute_graphql", { query: "query { currentUser { id } }" }), /not allowed while a project allowlist is in effect/);
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+        test("session without the header keeps the full env allowlist", async () => {
+            const client = await connectClient(mcpUrl);
+            try {
+                assert.strictEqual(await getProjectId(client, "2"), "2");
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+        test("list_issues without project_id stays within the session scope", async () => {
+            const client = await connectClient(mcpUrl, "1");
+            try {
+                const result = await client.callTool("list_issues", {});
+                assert.ok(result.content, "Should have content");
+                const content = result.content[0];
+                assert.ok("text" in content, "Content should have text");
+                const issues = JSON.parse(content.text);
+                assert.ok(issues.every(issue => issue.web_url.includes("/project/1/")), "Should only return issues of the scoped project");
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+        test("list_todos is refused under strict scope", async () => {
+            const client = await connectClient(mcpUrl, "1");
+            try {
+                await assert.rejects(() => client.callTool("list_todos", {}), /not allowed while a project allowlist is in effect/);
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+        test("search_repositories keeps the unfiltered pagination totals", async () => {
+            const client = await connectClient(mcpUrl, "1");
+            try {
+                const result = await client.callTool("search_repositories", { search: "project" });
+                assert.ok(result.content, "Should have content");
+                const content = result.content[0];
+                assert.ok("text" in content, "Content should have text");
+                const search = JSON.parse(content.text);
+                assert.deepStrictEqual(search.items.map(item => item.id), ["1"]);
+                assert.strictEqual(search.count, 3, "count must reflect the unfiltered GitLab total");
+                assert.strictEqual(search.total_pages, 2, "total_pages must cover the unfiltered pages");
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+        test("search_repositories follows next_page across all pages when totals are missing", async () => {
+            const client = await connectClient(mcpUrl, "1");
+            try {
+                let page = 1;
+                const visited = [];
+                while (page !== undefined) {
+                    const result = await client.callTool("search_repositories", {
+                        search: "no-totals",
+                        page,
+                    });
+                    assert.ok(result.content, "Should have content");
+                    const content = result.content[0];
+                    assert.ok("text" in content, "Content should have text");
+                    const search = JSON.parse(content.text);
+                    assert.strictEqual(search.total_pages, undefined, "total_pages must stay unset");
+                    assert.deepStrictEqual(search.items.map(item => item.id), ["1"]);
+                    visited.push(search.current_page);
+                    page = search.next_page;
+                }
+                assert.deepStrictEqual(visited, [1, 2, 3], "next_page must make every page reachable");
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+        test("list_projects is filtered to the session scope", async () => {
+            const client = await connectClient(mcpUrl, "1");
+            try {
+                const result = await client.callTool("list_projects", {});
+                assert.ok(result.content, "Should have content");
+                const content = result.content[0];
+                assert.ok("text" in content, "Content should have text");
+                const projects = JSON.parse(content.text);
+                assert.deepStrictEqual(projects.map(project => project.id), ["1"]);
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+        test("list_projects is filtered to the env allowlist without the header", async () => {
+            const client = await connectClient(mcpUrl);
+            try {
+                const result = await client.callTool("list_projects", {});
+                assert.ok(result.content, "Should have content");
+                const content = result.content[0];
+                assert.ok("text" in content, "Content should have text");
+                const projects = JSON.parse(content.text);
+                assert.deepStrictEqual(projects.map(project => project.id), ["1", "2"]);
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+    });
+    describe("without GITLAB_ALLOWED_PROJECT_IDS", () => {
+        let mockGitLab;
+        const servers = [];
+        let mcpUrl;
+        before(async () => {
+            const mockPort = await findMockServerPort();
+            mockGitLab = new MockGitLabServer({ port: mockPort, validTokens: [MOCK_TOKEN] });
+            mockGitLab.addRootHandler("post", "/api/graphql", (req, res) => {
+                const { query } = req.body;
+                if (query.includes("vulnerability(")) {
+                    res.json({
+                        data: {
+                            vulnerability: {
+                                id: "gid://gitlab/Vulnerability/42",
+                                title: "Mock vulnerability",
+                                project: {
+                                    id: "gid://gitlab/Project/8",
+                                    name: "Other project",
+                                    fullPath: "other/project",
+                                },
+                            },
+                        },
+                    });
+                    return;
+                }
+                res.status(500).json({ message: `Unexpected GraphQL query: ${query}` });
+            });
+            await mockGitLab.start();
+            const mcpPort = await findAvailablePort(3200);
+            const server = await launchServer({
+                mode: TransportMode.STREAMABLE_HTTP,
+                port: mcpPort,
+                timeout: 5000,
+                env: {
+                    STREAMABLE_HTTP: "true",
+                    REMOTE_AUTHORIZATION: "true",
+                    ENABLE_DYNAMIC_PROJECT_SCOPE: "true",
+                    GITLAB_API_URL: `${mockGitLab.getUrl()}/api/v4`,
+                },
+            });
+            servers.push(server);
+            mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
+        });
+        after(async () => {
+            cleanupServers(servers);
+            await mockGitLab?.stop();
+        });
+        test("header bounds an otherwise unrestricted server", async () => {
+            const client = await connectClient(mcpUrl, "7");
+            try {
+                assert.strictEqual(await getProjectId(client, ""), "7");
+                await assert.rejects(() => client.callTool("get_project", { project_id: "8" }), /Access denied/);
+                await assert.rejects(() => client.callTool("execute_graphql", { query: "query { currentUser { id } }" }), /not allowed while a project allowlist is in effect/);
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+        test("session without the header stays unrestricted", async () => {
+            const client = await connectClient(mcpUrl);
+            try {
+                assert.strictEqual(await getProjectId(client, "8"), "8");
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+        test("scoped session cannot reach vulnerabilities of other projects", async () => {
+            const client = await connectClient(mcpUrl, "7");
+            try {
+                await assert.rejects(() => client.callTool("get_vulnerability", { vulnerability_id: "42" }), /Access denied/);
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+        test("unscoped session can reach vulnerabilities", async () => {
+            const client = await connectClient(mcpUrl);
+            try {
+                const result = await client.callTool("get_vulnerability", { vulnerability_id: "42" });
+                assert.ok(result.content, "Should have content");
+                const content = result.content[0];
+                assert.ok("text" in content, "Content should have text");
+                const vulnerability = JSON.parse(content.text);
+                assert.strictEqual(vulnerability.project.fullPath, "other/project");
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+    });
+    describe("with ENABLE_DYNAMIC_PROJECT_SCOPE disabled", () => {
+        let mockGitLab;
+        const servers = [];
+        let mcpUrl;
+        before(async () => {
+            const mockPort = await findMockServerPort();
+            mockGitLab = new MockGitLabServer({ port: mockPort, validTokens: [MOCK_TOKEN] });
+            await mockGitLab.start();
+            const mcpPort = await findAvailablePort(3200);
+            const server = await launchServer({
+                mode: TransportMode.STREAMABLE_HTTP,
+                port: mcpPort,
+                timeout: 5000,
+                env: {
+                    STREAMABLE_HTTP: "true",
+                    REMOTE_AUTHORIZATION: "true",
+                    GITLAB_API_URL: `${mockGitLab.getUrl()}/api/v4`,
+                },
+            });
+            servers.push(server);
+            mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
+        });
+        after(async () => {
+            cleanupServers(servers);
+            await mockGitLab?.stop();
+        });
+        test("header is ignored when the feature flag is off", async () => {
+            const client = await connectClient(mcpUrl, "1");
+            try {
+                assert.strictEqual(await getProjectId(client, "2"), "2");
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+    });
+});

package/build/test/test-permission-mode.js

@@ -58,6 +58,7 @@ const DELETE_SAMPLE_TOOLS = [
     "delete_milestone",
     "delete_group_milestone",
     "delete_project_variable",
+    "delete_webhook",
 ];
 const MODIFY_SAMPLE_TOOLS = [
     "create_issue",

package/build/test/test-toolset-filtering.js

@@ -31,7 +31,7 @@ const TOOLSET_TOOL_COUNTS = {
     users: 7,
     search: 3,
     workitems: 18,
-    webhooks: 3,
+    webhooks: 6,
     groups: 1,
     variables: 10,
     dependency_proxy: 4,
@@ -83,7 +83,7 @@ const TOOLSET_SAMPLE_TOOLS = {
     tags: ["list_tags", "create_tag", "get_tag_signature"],
     users: ["get_users", "upload_markdown", "download_attachment"],
     search: ["search_code", "search_project_code", "search_group_code"],
-    webhooks: ["list_webhooks", "list_webhook_events", "get_webhook_event"],
+    webhooks: ["list_webhooks", "create_webhook", "update_webhook", "delete_webhook", "list_webhook_events", "get_webhook_event"],
     groups: ["create_group"],
     variables: ["list_project_variables", "create_project_variable", "delete_project_variable", "list_group_variables", "create_group_variable", "delete_group_variable"],
     dependency_proxy: ["get_dependency_proxy_settings", "list_dependency_proxy_blobs", "purge_dependency_proxy_cache"],

package/build/test/test-webhooks.js

@@ -0,0 +1,218 @@
+import { describe, test, before, after } from "node:test";
+import assert from "node:assert";
+import { spawn } from "child_process";
+import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server.js";
+const MOCK_TOKEN = "glpat-mock-token-webhooks";
+const TEST_PROJECT_ID = "123";
+const TEST_GROUP_ID = "my-group";
+const TEST_HOOK_ID = 42;
+const MOCK_PROJECT_HOOK = {
+    id: TEST_HOOK_ID,
+    url: "https://example.com/hook",
+    name: "AI Hook",
+    description: "Registered by MCP",
+    project_id: Number(TEST_PROJECT_ID),
+    push_events: true,
+    issues_events: false,
+    enable_ssl_verification: true,
+};
+const MOCK_GROUP_HOOK = {
+    id: TEST_HOOK_ID,
+    url: "https://example.com/group-hook",
+    name: "Group Hook",
+    group_id: 3,
+    push_events: true,
+    member_events: true,
+    enable_ssl_verification: true,
+};
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function callTool(toolName, args, env) {
+    return new Promise((resolve, reject) => {
+        const proc = spawn("node", ["build/index.js"], {
+            stdio: ["pipe", "pipe", "pipe"],
+            env: { ...process.env, ...env },
+        });
+        let output = "";
+        let errorOutput = "";
+        proc.stdout?.on("data", (d) => (output += d));
+        proc.stderr?.on("data", (d) => (errorOutput += d));
+        proc.on("close", code => {
+            if (code !== 0) {
+                return reject(new Error(`Process exited with code ${code}: ${errorOutput}`));
+            }
+            const line = output.split("\n").find(l => l.startsWith("{"));
+            if (!line)
+                return reject(new Error("No JSON output found"));
+            try {
+                const response = JSON.parse(line);
+                if (response.error) {
+                    reject(new Error(response.error?.message ?? String(response.error)));
+                }
+                else {
+                    const content = response.result?.content?.[0]?.text;
+                    resolve(content ? JSON.parse(content) : response.result);
+                }
+            }
+            catch (e) {
+                reject(e);
+            }
+        });
+        proc.stdin?.end(JSON.stringify({
+            jsonrpc: "2.0",
+            id: 1,
+            method: "tools/call",
+            params: { name: toolName, arguments: args },
+        }) + "\n");
+    });
+}
+describe("When managing webhooks", () => {
+    let mockServer;
+    let baseEnv;
+    let lastCreateBody;
+    let lastUpdateBody;
+    let lastDeletePath;
+    before(async () => {
+        mockServer = new MockGitLabServer({
+            port: await findMockServerPort(),
+            validTokens: [MOCK_TOKEN],
+        });
+        mockServer.addMockHandler("post", `/projects/${TEST_PROJECT_ID}/hooks`, (req, res) => {
+            lastCreateBody = isRecord(req.body) ? req.body : undefined;
+            res.status(201).json({ ...MOCK_PROJECT_HOOK, ...lastCreateBody });
+        });
+        mockServer.addMockHandler("put", `/projects/${TEST_PROJECT_ID}/hooks/${TEST_HOOK_ID}`, (req, res) => {
+            lastUpdateBody = isRecord(req.body) ? req.body : undefined;
+            res.json({ ...MOCK_PROJECT_HOOK, ...lastUpdateBody, id: TEST_HOOK_ID });
+        });
+        mockServer.addMockHandler("delete", `/projects/${TEST_PROJECT_ID}/hooks/${TEST_HOOK_ID}`, (req, res) => {
+            lastDeletePath = req.path;
+            res.status(204).send();
+        });
+        mockServer.addMockHandler("post", `/groups/${TEST_GROUP_ID}/hooks`, (req, res) => {
+            lastCreateBody = isRecord(req.body) ? req.body : undefined;
+            res.status(201).json({ ...MOCK_GROUP_HOOK, ...lastCreateBody });
+        });
+        mockServer.addMockHandler("put", `/groups/${TEST_GROUP_ID}/hooks/${TEST_HOOK_ID}`, (req, res) => {
+            lastUpdateBody = isRecord(req.body) ? req.body : undefined;
+            res.json({ ...MOCK_GROUP_HOOK, ...lastUpdateBody, id: TEST_HOOK_ID });
+        });
+        mockServer.addMockHandler("delete", `/groups/${TEST_GROUP_ID}/hooks/${TEST_HOOK_ID}`, (req, res) => {
+            lastDeletePath = req.path;
+            res.status(204).send();
+        });
+        await mockServer.start();
+        baseEnv = {
+            GITLAB_API_URL: mockServer.getUrl() + "/api/v4",
+            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
+            GITLAB_TOOLSETS: "webhooks",
+            GITLAB_READ_ONLY_MODE: "false",
+        };
+    });
+    after(async () => {
+        if (mockServer)
+            await mockServer.stop();
+    });
+    describe("with create_webhook on a project", () => {
+        test("should create a webhook and return the GitLab response", async () => {
+            lastCreateBody = undefined;
+            const result = await callTool("create_webhook", {
+                project_id: TEST_PROJECT_ID,
+                url: "https://example.com/hook",
+                name: "AI Hook",
+                push_events: true,
+                issues_events: true,
+            }, baseEnv);
+            assert.deepStrictEqual(lastCreateBody, {
+                url: "https://example.com/hook",
+                name: "AI Hook",
+                push_events: true,
+                issues_events: true,
+            });
+            assert.ok(isRecord(result));
+            assert.strictEqual(result.url, "https://example.com/hook");
+            assert.strictEqual(result.name, "AI Hook");
+        });
+    });
+    describe("with update_webhook on a project", () => {
+        test("should update a webhook and return the GitLab response", async () => {
+            lastUpdateBody = undefined;
+            const result = await callTool("update_webhook", {
+                project_id: TEST_PROJECT_ID,
+                hook_id: TEST_HOOK_ID,
+                url: "https://example.com/hook-updated",
+                name: "Renamed Hook",
+            }, baseEnv);
+            assert.deepStrictEqual(lastUpdateBody, {
+                url: "https://example.com/hook-updated",
+                name: "Renamed Hook",
+            });
+            assert.ok(isRecord(result));
+            assert.strictEqual(result.url, "https://example.com/hook-updated");
+        });
+    });
+    describe("with delete_webhook on a project", () => {
+        test("should delete a webhook and return a deleted status", async () => {
+            lastDeletePath = undefined;
+            const result = await callTool("delete_webhook", {
+                project_id: TEST_PROJECT_ID,
+                hook_id: TEST_HOOK_ID,
+            }, baseEnv);
+            assert.strictEqual(lastDeletePath, `/projects/${TEST_PROJECT_ID}/hooks/${TEST_HOOK_ID}`);
+            assert.deepStrictEqual(result, { status: "deleted", hook_id: TEST_HOOK_ID });
+        });
+    });
+    describe("with create_webhook on a group", () => {
+        test("should create a group webhook", async () => {
+            lastCreateBody = undefined;
+            const result = await callTool("create_webhook", {
+                group_id: TEST_GROUP_ID,
+                url: "https://example.com/group-hook",
+                member_events: true,
+            }, baseEnv);
+            assert.ok(lastCreateBody);
+            assert.strictEqual(lastCreateBody["url"], "https://example.com/group-hook");
+            assert.strictEqual(lastCreateBody["member_events"], true);
+            assert.ok(isRecord(result));
+            assert.strictEqual(result["url"], "https://example.com/group-hook");
+        });
+    });
+    describe("with update_webhook on a group", () => {
+        test("should update a group webhook", async () => {
+            lastUpdateBody = undefined;
+            const result = await callTool("update_webhook", {
+                group_id: TEST_GROUP_ID,
+                hook_id: TEST_HOOK_ID,
+                url: "https://example.com/group-hook-updated",
+                name: "Renamed Group Hook",
+            }, baseEnv);
+            assert.deepStrictEqual(lastUpdateBody, {
+                url: "https://example.com/group-hook-updated",
+                name: "Renamed Group Hook",
+            });
+            assert.ok(isRecord(result));
+            assert.strictEqual(result.url, "https://example.com/group-hook-updated");
+        });
+    });
+    describe("with delete_webhook on a group", () => {
+        test("should delete a group webhook", async () => {
+            lastDeletePath = undefined;
+            const result = await callTool("delete_webhook", {
+                group_id: TEST_GROUP_ID,
+                hook_id: TEST_HOOK_ID,
+            }, baseEnv);
+            assert.strictEqual(lastDeletePath, `/groups/${TEST_GROUP_ID}/hooks/${TEST_HOOK_ID}`);
+            assert.deepStrictEqual(result, { status: "deleted", hook_id: TEST_HOOK_ID });
+        });
+    });
+    describe("with invalid scope", () => {
+        test("should reject when both project_id and group_id are provided", async () => {
+            await assert.rejects(() => callTool("create_webhook", {
+                project_id: TEST_PROJECT_ID,
+                group_id: TEST_GROUP_ID,
+                url: "https://example.com/hook",
+            }, baseEnv), /project_id or group_id/);
+        });
+    });
+});

package/build/test-note.js

@@ -3,7 +3,6 @@
  * with the fixed endpoint URL construction that uses plural resource names
  * (issues instead of issue, merge_requests instead of merge_request).
  */
-import fetch from "node-fetch";
 // GitLab API configuration (replace with actual values when testing)
 const GITLAB_API_URL = process.env.GITLAB_API_URL || "https://gitlab.com";
 const GITLAB_PERSONAL_ACCESS_TOKEN = process.env.GITLAB_TOKEN || "";

package/build/test-resolve-issue-note.js

@@ -3,7 +3,6 @@
  * It shows how to use the update_issue_note tool to resolve or unresolve
  * issue discussion threads.
  */
-import fetch from "node-fetch";
 // GitLab API configuration (replace with actual values when testing)
 const GITLAB_API_URL = process.env.GITLAB_API_URL || "https://gitlab.com";
 const GITLAB_PERSONAL_ACCESS_TOKEN = process.env.GITLAB_TOKEN || "";