@zereight/mcp-gitlab 2.1.64 → 2.1.65

package/build/test/test-remote-downloads.js

@@ -30,6 +30,7 @@ const RFC_FORWARDED_HEADERS = {
 // Minimal 1x1 transparent PNG
 const MINIMAL_PNG = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==', 'base64');
 const LARGE_FILE_TOKEN = 'glpat-largefile-test-token';
+const ATTACHMENT_TOKEN = 'glpat-attachment-test-token';
 const FAKE_ZIP = Buffer.from('PK\x03\x04fake-zip-content-for-testing');
 const MOCK_UPLOAD_RESPONSE = {
     id: 99,
@@ -52,7 +53,7 @@ describe('Remote Downloads - Download Proxy Endpoint', { timeout: 30_000 }, () =
         const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
-            validTokens: [MOCK_TOKEN, LARGE_FILE_TOKEN],
+            validTokens: [MOCK_TOKEN, LARGE_FILE_TOKEN, ATTACHMENT_TOKEN],
         });
         // Mock artifact download
         mockGitLab.addMockHandler('get', `/projects/${TEST_PROJECT_ID}/jobs/${TEST_JOB_ID}/artifacts`, (_req, res) => {
@@ -70,6 +71,13 @@ describe('Remote Downloads - Download Proxy Endpoint', { timeout: 30_000 }, () =
             res.set('Content-Type', 'text/plain');
             res.send('hello document content');
         });
+        // Mock attachment whose name contains a slash. The uploads route takes one filename
+        // segment, so the proxy has to request it as `nested%2Fdocument.txt`; a handler on
+        // `nested/document.txt` would match the wrong route shape and must not be hit.
+        mockGitLab.addMockHandler('get', `/projects/${TEST_PROJECT_ID}/uploads/${TEST_SECRET}/nested%2Fdocument.txt`, (_req, res) => {
+            res.set('Content-Type', 'text/plain');
+            res.send('nested document content');
+        });
         // Mock large artifact (2MB) to verify streaming works for big files
         mockGitLab.addMockHandler('get', `/projects/${TEST_PROJECT_ID}/jobs/999/artifacts`, (_req, res) => {
             res.set('Content-Type', 'application/zip');
@@ -143,6 +151,11 @@ describe('Remote Downloads - Download Proxy Endpoint', { timeout: 30_000 }, () =
         const expectedSize = 2 * 1024 * 1024;
         assert.strictEqual(buf.length, expectedSize, `Should receive full 2MB (got ${buf.length} bytes)`);
     });
+    test('keeps a slash-bearing attachment filename inside one path segment', async () => {
+        const res = await fetch(`http://${HOST}:${serverPort}/downloads/attachment?project_id=${TEST_PROJECT_ID}&secret=${TEST_SECRET}&filename=${encodeURIComponent('nested/document.txt')}`, { headers: { 'Private-Token': ATTACHMENT_TOKEN } });
+        assert.strictEqual(res.status, 200, 'attachment proxy should route to one encoded segment');
+        assert.strictEqual(await res.text(), 'nested document content');
+    });
     test('returns 429 after exceeding rate limit', async () => {
         // Use a different token to get a fresh rate limit counter
         const rateLimitToken = 'glpat-ratelimit-test-token';

package/build/test/utils/graphql-query.test.js

@@ -89,8 +89,80 @@ describe("When graphqlQueryContainsDeleteOperation runs", () => {
         test("should detect delete mutations with variable definitions", () => {
             assert.equal(graphqlQueryContainsDeleteOperation("mutation DeleteIssue($id: IssueID!) { issueDelete(input: { id: $id }) { errors } }"), true);
         });
+        test("should detect comma-prefixed delete mutations", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation(', mutation M { issueDelete(input: { iid: "1" }) { id } }'), true);
+        });
+        test("should detect comma-prefixed delete mutations without whitespace", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation(',mutation{issueDelete(input:{iid:"1"}){id}}'), true);
+        });
+        test("should detect delete mutations after a comma-separated query", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation("query HealthCheck { x }, mutation M { issueDelete(input: {}) { id } }"), true);
+        });
+        test("should allow comma-separated queries", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation("query A { a }, query B { b }"), false);
+        });
         test("should conservatively block top-level fragment spreads in mutations", () => {
             assert.equal(graphqlQueryContainsDeleteOperation("mutation { ...f } fragment f on Mutation { issueDelete(input: {}) { errors } }"), true);
         });
     });
+    describe("with destructive mutations that are not named delete", () => {
+        test("should detect environmentStop", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation('mutation { environmentStop(input: { environmentId: "gid://gitlab/Environment/1" }) { errors } }'), true);
+        });
+        test("should detect pipelineCancel", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation("mutation { pipelineCancel(input: {}) { errors } }"), true);
+        });
+        test("should detect clusterAgentTokenRevoke", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation("mutation { clusterAgentTokenRevoke(input: {}) { errors } }"), true);
+        });
+        test("should detect jobUnschedule", () => {
+            // GitLab moves the scheduled job to manual and clears its scheduled state, so it
+            // is a teardown action even though no teardown verb is part of its name.
+            assert.equal(graphqlQueryContainsDeleteOperation("mutation { jobUnschedule(input: {}) { errors } }"), true);
+        });
+        test("should detect aliased destructive mutations", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation("mutation { s: environmentStop(input: {}) { errors } }"), true);
+        });
+        test("should not treat an alias as a destructive mutation field", () => {
+            for (const query of [
+                "mutation { stop: issueSetSeverity(input: {}) { errors } }",
+                "mutation { revoke: issueSetSeverity(input: {}) { errors } }",
+                "mutation { terminate: updateIssue(input: {}) { issue { id } } }",
+            ]) {
+                assert.equal(graphqlQueryContainsDeleteOperation(query), false, query);
+            }
+        });
+        test("should not treat a spaced or comma-separated alias as a destructive field", () => {
+            for (const query of [
+                "mutation { stop : issueSetSeverity(input: {}) { errors } }",
+                "mutation { revoke,: issueSetSeverity(input: {}) { errors } }",
+                "mutation { terminate\n: updateIssue(input: {}) { issue { id } } }",
+            ]) {
+                assert.equal(graphqlQueryContainsDeleteOperation(query), false, query);
+            }
+        });
+        test("should still detect a destructive field after a spaced alias", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation("mutation { harmless : environmentStop(input: {}) { errors } }"), true);
+        });
+        test("should still detect a destructive field hidden behind a harmless alias", () => {
+            for (const query of [
+                "mutation { harmless: environmentStop(input: {}) { errors } }",
+                "mutation { step: pipelineCancel(input: {}) { errors } }",
+            ]) {
+                assert.equal(graphqlQueryContainsDeleteOperation(query), true, query);
+            }
+        });
+        test("should detect destructive mutations in multi-operation documents", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation("query A { project { id } } mutation B { environmentStop(input: {}) { errors } }"), true);
+        });
+        test("should still allow mutations without a destructive verb", () => {
+            for (const query of [
+                "mutation { issueMove(input: {}) { errors } }",
+                "mutation { mergeRequestMerge(input: {}) { errors } }",
+                "mutation { todoMarkDone(input: {}) { errors } }",
+            ]) {
+                assert.equal(graphqlQueryContainsDeleteOperation(query), false, query);
+            }
+        });
+    });
 });

package/build/test/utils/safe-redirect-fetch.test.js

@@ -0,0 +1,463 @@
+import assert from "node:assert/strict";
+import http from "node:http";
+import { after, before, describe, test } from "node:test";
+import { Agent, MockAgent } from "undici";
+import { fetchWithValidatedRedirects, isNonPublicAddress, UnsafeRedirectError, } from "../../utils/safe-redirect-fetch.js";
+const dispatcher = new Agent();
+/** A public IPv4 literal, so hop checks never depend on DNS resolution. */
+const PUBLIC_HOST = "93.184.216.34";
+let server;
+let origin;
+let serverPort;
+let secondServer;
+let secondOrigin;
+let secondPort;
+let lastSecondHeaders = {};
+/** Hosts the trusted-host predicate has been called with. */
+const trustedHostArguments = [];
+function listen(target) {
+    return new Promise(resolve => {
+        target.listen(0, "127.0.0.1", () => {
+            const address = target.address();
+            if (!address || typeof address === "string")
+                throw new Error("no port");
+            resolve(address.port);
+        });
+    });
+}
+/**
+ * A fetch stub that answers the first request with a redirect and every later one
+ * with a body, recording the headers used on each hop. Injected so hop policy can
+ * be asserted without reaching the network.
+ */
+function stubRedirectFetch(location, calls) {
+    const impl = async (input, init) => {
+        calls.push({ url: String(input), headers: { ...(init?.headers ?? {}) } });
+        if (calls.length === 1 && location) {
+            return new Response(null, { status: 302, headers: { location } });
+        }
+        return new Response("payload", { status: 200 });
+    };
+    return impl;
+}
+/**
+ * A fetch stub that walks a list of redirect locations: call N answers with
+ * `locations[N - 1]` and the call after the last location returns a body. Used to
+ * assert the header policy on chains longer than one hop.
+ */
+function stubRedirectChain(locations, calls) {
+    const impl = async (input, init) => {
+        calls.push({ url: String(input), headers: { ...(init?.headers ?? {}) } });
+        const location = locations[calls.length - 1];
+        if (location) {
+            return new Response(null, { status: 302, headers: { location } });
+        }
+        return new Response("payload", { status: 200 });
+    };
+    return impl;
+}
+/**
+ * Pass one injected client for both the hops that carry the credentials and the ones the
+ * helper strips. The stripped hops default to plain `undici`, so injecting only
+ * `fetchImpl` in a test would send the hop it wants to inspect to the network.
+ */
+function sameClientForEveryHop(stub) {
+    return { fetchImpl: stub, unauthenticatedFetchImpl: stub };
+}
+describe("safe redirect fetch", () => {
+    before(async () => {
+        server = http.createServer((req, res) => {
+            const url = new URL(req.url ?? "/", "http://127.0.0.1");
+            switch (url.pathname) {
+                case "/file":
+                    res.writeHead(200, { "content-type": "application/octet-stream" });
+                    res.end("payload");
+                    return;
+                case "/same-origin-redirect":
+                    res.writeHead(302, { location: "/file" });
+                    res.end();
+                    return;
+                case "/cross-origin-redirect":
+                    res.writeHead(302, { location: `${secondOrigin}/file` });
+                    res.end();
+                    return;
+                case "/loopback-redirect":
+                    res.writeHead(302, { location: "http://127.0.0.1:1/file" });
+                    res.end();
+                    return;
+                case "/metadata-redirect":
+                    res.writeHead(302, { location: "http://169.254.169.254/latest/meta-data/" });
+                    res.end();
+                    return;
+                case "/mapped-metadata-redirect":
+                    res.writeHead(302, { location: "http://[::ffff:169.254.169.254]/latest/meta-data/" });
+                    res.end();
+                    return;
+                case "/mapped-loopback-redirect":
+                    res.writeHead(302, { location: "http://[::ffff:7f00:1]:1/file" });
+                    res.end();
+                    return;
+                case "/dotted-mapped-loopback-redirect":
+                    res.writeHead(302, { location: "http://[::ffff:127.0.0.1]:1/file" });
+                    res.end();
+                    return;
+                case "/nat64-metadata-redirect":
+                    res.writeHead(302, { location: "http://[64:ff9b::a9fe:a9fe]/latest/meta-data/" });
+                    res.end();
+                    return;
+                case "/file-protocol-redirect":
+                    res.writeHead(302, { location: "file:///etc/passwd" });
+                    res.end();
+                    return;
+                case "/loop":
+                    res.writeHead(302, { location: "/loop" });
+                    res.end();
+                    return;
+                default:
+                    res.writeHead(404);
+                    res.end();
+            }
+        });
+        secondServer = http.createServer((req, res) => {
+            lastSecondHeaders = req.headers;
+            res.writeHead(200).end("second");
+        });
+        serverPort = await listen(server);
+        secondPort = await listen(secondServer);
+        origin = `http://127.0.0.1:${serverPort}`;
+        secondOrigin = `http://127.0.0.1:${secondPort}`;
+    });
+    after(async () => {
+        await Promise.all([
+            new Promise(resolve => server.close(resolve)),
+            new Promise(resolve => secondServer.close(resolve)),
+            dispatcher.close(),
+        ]);
+    });
+    const rejectsWith = (promise, fragment) => assert.rejects(promise, (error) => error instanceof UnsafeRedirectError && error.message.includes(fragment));
+    test("follows a same-origin redirect", async () => {
+        const response = await fetchWithValidatedRedirects(`${origin}/same-origin-redirect`, {
+            headers: {},
+            dispatcher,
+        });
+        assert.equal(response.status, 200);
+        assert.equal(await response.text(), "payload");
+    });
+    test("refuses a redirect to a loopback address on another origin", async () => {
+        await rejectsWith(() => fetchWithValidatedRedirects(`${origin}/loopback-redirect`, { headers: {}, dispatcher }), "non-public address");
+    });
+    test("refuses a redirect to the cloud instance metadata address", async () => {
+        await rejectsWith(() => fetchWithValidatedRedirects(`${origin}/metadata-redirect`, { headers: {}, dispatcher }), "169.254.169.254");
+    });
+    // The URL parser canonicalizes IPv4-mapped hosts to hex (`::ffff:169.254.169.254`
+    // becomes `::ffff:a9fe:a9fe`), so the check has to classify parsed bits. These
+    // routes exercise the production path: `new URL(location, currentUrl)`.
+    for (const [route, address] of [
+        ["/mapped-metadata-redirect", "::ffff:a9fe:a9fe"],
+        ["/mapped-loopback-redirect", "::ffff:7f00:1"],
+        ["/dotted-mapped-loopback-redirect", "::ffff:7f00:1"],
+        ["/nat64-metadata-redirect", "64:ff9b::a9fe:a9fe"],
+    ]) {
+        test(`refuses a redirect to the IPv6 form ${route} (${address})`, async () => {
+            await rejectsWith(() => fetchWithValidatedRedirects(`${origin}${route}`, { headers: {}, dispatcher }), "non-public address");
+        });
+    }
+    test("refuses a redirect to a non-http protocol", async () => {
+        await rejectsWith(() => fetchWithValidatedRedirects(`${origin}/file-protocol-redirect`, {
+            headers: {},
+            dispatcher,
+        }), "unsupported protocol");
+    });
+    test("refuses to follow more redirects than the limit allows", async () => {
+        await rejectsWith(() => fetchWithValidatedRedirects(`${origin}/loop`, {
+            headers: {},
+            dispatcher,
+            maxRedirects: 2,
+        }), "Too many redirects");
+    });
+    test("follows a non-public redirect target when the host:port is trusted", async () => {
+        trustedHostArguments.length = 0;
+        const response = await fetchWithValidatedRedirects(`${origin}/cross-origin-redirect`, {
+            headers: {},
+            dispatcher,
+            isTrustedRedirectHost: host => {
+                trustedHostArguments.push(host);
+                return host === `127.0.0.1:${secondPort}`;
+            },
+        });
+        assert.equal(response.status, 200);
+        assert.equal(await response.text(), "second");
+        // The allowlist is keyed by `URL.host`, so the predicate must receive the port
+        // with the host: matching on a bare hostname would never find `:8443` entries.
+        assert.deepEqual(trustedHostArguments, [`127.0.0.1:${secondPort}`]);
+    });
+    test("the URL parser canonicalizes IPv4-mapped literals before the check runs", () => {
+        assert.equal(new URL("http://[::ffff:169.254.169.254]/").hostname, "[::ffff:a9fe:a9fe]");
+        assert.equal(new URL("http://[::ffff:7f00:1]/").hostname, "[::ffff:7f00:1]");
+        assert.equal(new URL("http://[::ffff:127.0.0.1]:1/").hostname, "[::ffff:7f00:1]");
+        assert.equal(new URL("http://[64:ff9b::a9fe:a9fe]/").hostname, "[64:ff9b::a9fe:a9fe]");
+    });
+    test("classifies address ranges", () => {
+        for (const address of [
+            // IPv4
+            "127.0.0.1",
+            "10.1.2.3",
+            "172.16.0.1",
+            "192.168.1.1",
+            "169.254.169.254",
+            "100.64.0.1",
+            "0.0.0.0",
+            // IPv6
+            "::",
+            "::1",
+            "fd00::1",
+            "fe80::1",
+            "fea0::1",
+            "febf::1",
+            "fec0::1",
+            // IPv6 carrying a non-public IPv4 address
+            "::ffff:127.0.0.1",
+            "::ffff:a9fe:a9fe",
+            "::ffff:7f00:1",
+            "::ffff:0:127.0.0.1",
+            "::7f00:1",
+            "64:ff9b::a9fe:a9fe",
+            "64:ff9b:1::a9fe:a9fe",
+            "2002:a9fe:a9fe::",
+            // Not a literal address this helper understands — fail closed
+            "[::ffff:a9fe:a9fe]",
+            "not-an-address",
+        ]) {
+            assert.equal(isNonPublicAddress(address), true, `${address} should be non-public`);
+        }
+        for (const address of [
+            "8.8.8.8",
+            "1.1.1.1",
+            "2606:4700::1111",
+            // IPv6 carrying a public IPv4 address
+            "::ffff:8.8.8.8",
+            "::ffff:808:808",
+            "64:ff9b::808:808",
+            "2002:0808:0808::",
+        ]) {
+            assert.equal(isNonPublicAddress(address), false, `${address} should be public`);
+        }
+    });
+});
+describe("credential headers across redirect hops", () => {
+    const credentials = {
+        Accept: "application/octet-stream",
+        Authorization: "Bearer secret",
+        "Private-Token": "secret",
+    };
+    test("keeps credentials on a same-origin hop", async () => {
+        const calls = [];
+        const response = await fetchWithValidatedRedirects("http://127.0.0.1:1/start", {
+            headers: credentials,
+            fetchImpl: stubRedirectFetch("/file", calls),
+        });
+        assert.equal(response.status, 200);
+        assert.deepEqual(calls.map(call => call.url), ["http://127.0.0.1:1/start", "http://127.0.0.1:1/file"]);
+        assert.equal(calls[1].headers.Authorization, "Bearer secret");
+        assert.equal(calls[1].headers["Private-Token"], "secret");
+    });
+    test("drops credential headers on a cross-origin hop to a public host", async () => {
+        const calls = [];
+        const response = await fetchWithValidatedRedirects("http://127.0.0.1:1/start", {
+            headers: credentials,
+            ...sameClientForEveryHop(stubRedirectFetch(`http://${PUBLIC_HOST}/file`, calls)),
+        });
+        assert.equal(response.status, 200);
+        assert.equal(calls[0].headers["Private-Token"], "secret");
+        assert.equal(calls[1].headers.Authorization, undefined);
+        assert.equal(calls[1].headers["Private-Token"], undefined);
+        // Non-credential headers still travel with the request.
+        assert.equal(calls[1].headers.Accept, "application/octet-stream");
+    });
+    test("drops additional header names passed as credentialHeaders", async () => {
+        const calls = [];
+        await fetchWithValidatedRedirects("http://127.0.0.1:1/start", {
+            headers: { ...credentials, "X-Gitlab-Session": "secret" },
+            credentialHeaders: ["authorization", "private-token", "x-gitlab-session"],
+            ...sameClientForEveryHop(stubRedirectFetch(`http://${PUBLIC_HOST}/file`, calls)),
+        });
+        assert.equal(calls[1].headers["X-Gitlab-Session"], undefined);
+        assert.equal(calls[1].headers.Accept, "application/octet-stream");
+    });
+    test("keeps credentials on a hop to a trusted host", async () => {
+        const calls = [];
+        const seen = [];
+        await fetchWithValidatedRedirects("http://127.0.0.1:1/start", {
+            headers: credentials,
+            isTrustedRedirectHost: host => {
+                seen.push(host);
+                return host === PUBLIC_HOST;
+            },
+            fetchImpl: stubRedirectFetch(`http://${PUBLIC_HOST}/file`, calls),
+        });
+        assert.deepEqual(seen, [PUBLIC_HOST]);
+        assert.equal(calls[1].headers.Authorization, "Bearer secret");
+        assert.equal(calls[1].headers["Private-Token"], "secret");
+    });
+    test("still refuses an untrusted non-public target even without credentials", async () => {
+        const calls = [];
+        await assert.rejects(() => fetchWithValidatedRedirects("http://127.0.0.1:1/start", {
+            headers: credentials,
+            fetchImpl: stubRedirectFetch("http://169.254.169.254/latest/meta-data/", calls),
+        }), (error) => error instanceof UnsafeRedirectError && error.message.includes("non-public address"));
+        assert.equal(calls.length, 1);
+    });
+    const rejectsWithCleartext = (promise) => assert.rejects(promise, (error) => error instanceof UnsafeRedirectError && error.message.includes("cleartext"));
+    test("refuses an https-to-http downgrade even for a trusted host", async () => {
+        const calls = [];
+        await rejectsWithCleartext(() => fetchWithValidatedRedirects(`https://${PUBLIC_HOST}/start`, {
+            headers: credentials,
+            // Trust must not re-enable the credentials on a cleartext hop.
+            isTrustedRedirectHost: () => true,
+            fetchImpl: stubRedirectFetch(`http://${PUBLIC_HOST}/file`, calls),
+        }));
+        assert.deepEqual(calls.map(call => call.url), [`https://${PUBLIC_HOST}/start`]);
+    });
+    test("refuses a downgrade that happens after an earlier https hop", async () => {
+        const calls = [];
+        await rejectsWithCleartext(() => fetchWithValidatedRedirects(`https://${PUBLIC_HOST}/start`, {
+            headers: credentials,
+            fetchImpl: stubRedirectChain([`https://${PUBLIC_HOST}/mid`, `http://${PUBLIC_HOST}/file`], calls),
+        }));
+        assert.deepEqual(calls.map(call => call.url), [`https://${PUBLIC_HOST}/start`, `https://${PUBLIC_HOST}/mid`]);
+    });
+    test("follows an http-to-https upgrade and keeps credentials on a trusted host", async () => {
+        const calls = [];
+        const response = await fetchWithValidatedRedirects(`http://${PUBLIC_HOST}/start`, {
+            headers: credentials,
+            isTrustedRedirectHost: host => host === PUBLIC_HOST,
+            fetchImpl: stubRedirectFetch(`https://${PUBLIC_HOST}/file`, calls),
+        });
+        assert.equal(response.status, 200);
+        assert.equal(calls[1].headers.Authorization, "Bearer secret");
+        assert.equal(calls[1].headers["Private-Token"], "secret");
+    });
+    test("treats a scheme change to an untrusted host as cross-origin", async () => {
+        const calls = [];
+        await fetchWithValidatedRedirects(`http://${PUBLIC_HOST}/start`, {
+            headers: credentials,
+            ...sameClientForEveryHop(stubRedirectFetch(`https://${PUBLIC_HOST}/file`, calls)),
+        });
+        assert.equal(calls[1].headers.Authorization, undefined);
+        assert.equal(calls[1].headers["Private-Token"], undefined);
+        assert.equal(calls[1].headers.Accept, "application/octet-stream");
+    });
+    test("keeps the credentials off a hop that returns to the initial origin", async () => {
+        const calls = [];
+        const response = await fetchWithValidatedRedirects("http://127.0.0.1:1/start", {
+            headers: credentials,
+            ...sameClientForEveryHop(stubRedirectChain([`http://${PUBLIC_HOST}/mid`, "http://127.0.0.1:1/file"], calls)),
+        });
+        assert.equal(response.status, 200);
+        assert.deepEqual(calls.map(call => call.url), ["http://127.0.0.1:1/start", `http://${PUBLIC_HOST}/mid`, "http://127.0.0.1:1/file"]);
+        // The untrusted hop keeps the token out of the request...
+        assert.equal(calls[1].headers["Private-Token"], undefined);
+        // ...and a target cannot get it back by bouncing the request to the origin, whose
+        // response the caller of this helper reads as the downloaded body.
+        assert.equal(calls[2].headers.Authorization, undefined);
+        assert.equal(calls[2].headers["Private-Token"], undefined);
+    });
+    test("restores credentials on a return to the origin only after a trusted hop", async () => {
+        const calls = [];
+        await fetchWithValidatedRedirects("http://127.0.0.1:1/start", {
+            headers: credentials,
+            isTrustedRedirectHost: host => host === PUBLIC_HOST,
+            fetchImpl: stubRedirectChain([`http://${PUBLIC_HOST}/mid`, "http://127.0.0.1:1/file"], calls),
+        });
+        // The trusted hop already received the token, so the return hop may carry it too.
+        assert.equal(calls[1].headers["Private-Token"], "secret");
+        assert.equal(calls[2].headers["Private-Token"], "secret");
+    });
+    test("stays without credentials across untrusted hops and returns without them", async () => {
+        const calls = [];
+        await fetchWithValidatedRedirects("http://127.0.0.1:1/start", {
+            headers: credentials,
+            ...sameClientForEveryHop(stubRedirectChain([`http://${PUBLIC_HOST}/mid`, `http://${PUBLIC_HOST}/other`, "http://127.0.0.1:1/file"], calls)),
+        });
+        assert.equal(calls[1].headers["Private-Token"], undefined);
+        assert.equal(calls[2].headers["Private-Token"], undefined);
+        assert.equal(calls[3].headers["Private-Token"], undefined);
+    });
+    test("a trusted hop after an untrusted one stays without credentials", async () => {
+        const calls = [];
+        await fetchWithValidatedRedirects("http://127.0.0.1:1/start", {
+            headers: credentials,
+            isTrustedRedirectHost: host => host === "93.184.216.35",
+            ...sameClientForEveryHop(stubRedirectChain([`http://${PUBLIC_HOST}/mid`, "http://93.184.216.35/storage", "http://127.0.0.1:1/file"], calls)),
+        });
+        // The untrusted hop chose the trusted URL, so trust must not re-attach the token.
+        assert.equal(calls[1].headers["Private-Token"], undefined);
+        assert.equal(calls[2].headers.Authorization, undefined);
+        assert.equal(calls[2].headers["Private-Token"], undefined);
+        assert.equal(calls[3].headers["Private-Token"], undefined);
+    });
+    test("an untrusted hop cannot re-attach credentials via a second trusted host", async () => {
+        const calls = [];
+        await fetchWithValidatedRedirects("https://gitlab.a/start", {
+            headers: credentials,
+            isTrustedRedirectHost: host => host === "gitlab.a" || host === "gitlab.b",
+            ...sameClientForEveryHop(stubRedirectChain([`https://${PUBLIC_HOST}/evil`, "https://gitlab.b/api/v4/user"], calls)),
+        });
+        assert.equal(calls[0].headers["Private-Token"], "secret");
+        assert.equal(calls[1].headers["Private-Token"], undefined);
+        assert.equal(calls[2].headers.Authorization, undefined);
+        assert.equal(calls[2].headers["Private-Token"], undefined);
+    });
+    test("an untrusted hop cannot re-attach credentials via a scheme change on the origin host", async () => {
+        const calls = [];
+        await fetchWithValidatedRedirects("http://gitlab.a/start", {
+            headers: credentials,
+            isTrustedRedirectHost: host => host === "gitlab.a",
+            ...sameClientForEveryHop(stubRedirectChain([`http://${PUBLIC_HOST}/evil`, "https://gitlab.a/api/v4/user"], calls)),
+        });
+        assert.equal(calls[1].headers["Private-Token"], undefined);
+        assert.equal(calls[2].headers.Authorization, undefined);
+        assert.equal(calls[2].headers["Private-Token"], undefined);
+    });
+    test("uses the unauthenticated client once the credentials are withheld", async () => {
+        const authenticatedCalls = [];
+        const unauthenticatedCalls = [];
+        await fetchWithValidatedRedirects("http://127.0.0.1:1/start", {
+            headers: credentials,
+            // A client that can add credentials by itself (cookie jar, OAuth 401 retry) must
+            // not see a hop the helper stripped.
+            fetchImpl: stubRedirectChain([`http://${PUBLIC_HOST}/mid`, "http://127.0.0.1:1/file"], authenticatedCalls),
+            // This stub answers from its own first call on, which is the untrusted hop.
+            unauthenticatedFetchImpl: stubRedirectChain(["http://127.0.0.1:1/file"], unauthenticatedCalls),
+        });
+        assert.deepEqual(authenticatedCalls.map(call => call.url), ["http://127.0.0.1:1/start"]);
+        assert.deepEqual(unauthenticatedCalls.map(call => call.url), [`http://${PUBLIC_HOST}/mid`, "http://127.0.0.1:1/file"]);
+        assert.equal(unauthenticatedCalls[0].headers["Private-Token"], undefined);
+        // ...including the hop back to the origin, which the caller reads as the download.
+        assert.equal(unauthenticatedCalls[1].headers["Private-Token"], undefined);
+    });
+    test("falls back to the plain client for stripped hops when only fetchImpl is given", async () => {
+        const calls = [];
+        // `undici`'s own client is observable through the dispatcher, so this asserts the
+        // default rather than trusting it: were the stripped hop routed to `fetchImpl`, the
+        // stub would answer and the mock pool would stay untouched.
+        const mockAgent = new MockAgent();
+        mockAgent.disableNetConnect();
+        mockAgent
+            .get(`http://${PUBLIC_HOST}`)
+            .intercept({ path: "/file", method: "GET" })
+            .reply(200, "from-plain-undici");
+        try {
+            const response = await fetchWithValidatedRedirects("http://127.0.0.1:1/start", {
+                headers: credentials,
+                dispatcher: mockAgent,
+                fetchImpl: stubRedirectFetch(`http://${PUBLIC_HOST}/file`, calls),
+            });
+            assert.equal(await response.text(), "from-plain-undici");
+            assert.deepEqual(calls.map(call => call.url), ["http://127.0.0.1:1/start"]);
+        }
+        finally {
+            await mockAgent.close();
+        }
+    });
+});

package/build/test/utils/tool-args.test.js

@@ -107,6 +107,38 @@ describe("When cleanMutuallyExclusiveIdUsernameOptions runs", () => {
                 assignee_username: [],
             });
         });
+        test("should keep assignee_id when assignee_username holds only blank entries", () => {
+            // The blank entries are dropped when the query is built, so counting them as a
+            // value here would delete the id filter and leave the request unfiltered.
+            const result = cleanMutuallyExclusiveIdUsernameOptions({
+                assignee_id: "7",
+                assignee_username: ["", "   "],
+            });
+            assert.deepEqual(result, {
+                assignee_id: "7",
+                assignee_username: ["", "   "],
+            });
+        });
+        test("should drop assignee_id when a username survives the blank entries", () => {
+            const result = cleanMutuallyExclusiveIdUsernameOptions({
+                assignee_id: "7",
+                assignee_username: ["", "bob"],
+            });
+            assert.deepEqual(result, {
+                assignee_username: ["", "bob"],
+            });
+        });
+        test("should keep assignee_id when assignee_username is a blank scalar", () => {
+            // Boolean(" ") is true, so a whitespace-only scalar used to delete the id and then
+            // be dropped by the blank guard, leaving the request with no filter at all.
+            for (const blank of ["", " ", "  \t "]) {
+                const result = cleanMutuallyExclusiveIdUsernameOptions({
+                    assignee_id: "7",
+                    assignee_username: blank,
+                });
+                assert.deepEqual(result, { assignee_id: "7", assignee_username: blank }, `blank scalar ${JSON.stringify(blank)} must not drop the id`);
+            }
+        });
     });
     describe("with list_merge_requests reviewer filters", () => {
         test("should drop reviewer_id when reviewer_username is also set", () => {