@zereight/mcp-gitlab 2.1.64 → 2.1.66

package/build/test/test-permission-mode.js

@@ -7,6 +7,7 @@
  */
 import { describe, test, after, before } from "node:test";
 import assert from "node:assert";
+import { allTools, deleteTools, destructiveTools } from "../tools/registry.js";
 import { launchServer, findAvailablePort, cleanupServers, TransportMode, HOST, } from "./utils/server-launcher.js";
 import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server.js";
 import { CustomHeaderClient } from "./clients/custom-header-client.js";
@@ -50,6 +51,29 @@ async function getToolNames(server) {
     await client.disconnect();
     return result.tools.map((t) => t.name);
 }
+/**
+ * Asserts that a query passes the modify-mode guard *and* is forwarded to GitLab. The mock
+ * server has no `/api/graphql` route, so the call comes back as a downstream
+ * "GraphQL request failed" — that failure is the evidence the guard let the query through,
+ * which a "does not throw" check alone would not provide.
+ */
+async function assertQueryReachesGitLab(server, query) {
+    const client = await connectClient(server);
+    try {
+        let outcome;
+        try {
+            outcome = JSON.stringify(await client.callTool("execute_graphql", { query }));
+        }
+        catch (error) {
+            outcome = error instanceof Error ? error.message : String(error);
+        }
+        assert.ok(!outcome.includes("modify mode"), `the guard must not fire for "${query}", got: ${outcome}`);
+        assert.ok(outcome.includes("GraphQL request failed"), `"${query}" should be forwarded to GitLab after passing the guard, got: ${outcome}`);
+    }
+    finally {
+        await client.disconnect();
+    }
+}
 const DELETE_SAMPLE_TOOLS = [
     "delete_issue",
     "delete_branch",
@@ -60,6 +84,16 @@ const DELETE_SAMPLE_TOOLS = [
     "delete_project_variable",
     "delete_webhook",
 ];
+// Destructive teardown tools whose names do not start with `delete_`. All five are listed
+// here (list-hiding) and exercised with explicit `callTool` literals below (call-rejection),
+// so the tool-coverage detector sees the call path too.
+const DESTRUCTIVE_SAMPLE_TOOLS = [
+    "cancel_pipeline",
+    "cancel_pipeline_job",
+    "stop_environment",
+    "stop_stale_environments",
+    "unprotect_branch",
+];
 const MODIFY_SAMPLE_TOOLS = [
     "create_issue",
     "update_issue",
@@ -67,9 +101,26 @@ const MODIFY_SAMPLE_TOOLS = [
     "create_branch",
     "push_files",
     "merge_merge_request",
-    "stop_stale_environments",
 ];
 const READ_SAMPLE_TOOLS = ["list_issues", "get_project", "list_merge_requests"];
+describe("Modify-mode deny list invariants", () => {
+    test("deleteTools is a subset of destructiveTools", () => {
+        for (const name of deleteTools) {
+            assert.ok(destructiveTools.has(name), `"${name}" is blocked in modify mode but missing from destructiveTools`);
+        }
+    });
+    test("every blocked tool exists in the registry", () => {
+        const names = new Set(allTools.map(tool => tool.name));
+        for (const name of deleteTools) {
+            assert.ok(names.has(name), `"${name}" is in deleteTools but not in allTools`);
+        }
+    });
+    test("every destructive sample tool is in the modify-mode deny list", () => {
+        for (const name of DESTRUCTIVE_SAMPLE_TOOLS) {
+            assert.ok(deleteTools.has(name), `"${name}" should be blocked in modify mode`);
+        }
+    });
+});
 describe("Permission Mode", { concurrency: 1 }, () => {
     before(async () => {
         const mockPort = await findMockServerPort();
@@ -94,7 +145,12 @@ describe("Permission Mode", { concurrency: 1 }, () => {
         after(() => cleanupServers(servers));
         test("exposes read, modify, and delete tools", async () => {
             const names = await getToolNames(server);
-            for (const name of [...READ_SAMPLE_TOOLS, ...MODIFY_SAMPLE_TOOLS, ...DELETE_SAMPLE_TOOLS]) {
+            for (const name of [
+                ...READ_SAMPLE_TOOLS,
+                ...MODIFY_SAMPLE_TOOLS,
+                ...DELETE_SAMPLE_TOOLS,
+                ...DESTRUCTIVE_SAMPLE_TOOLS,
+            ]) {
                 assert.ok(names.includes(name), `full mode: expected "${name}" to be present`);
             }
         });
@@ -117,6 +173,28 @@ describe("Permission Mode", { concurrency: 1 }, () => {
             }
             assert.ok(!names.some(n => n.startsWith("delete_")), "no delete_* tool should be listed");
         });
+        test("hides destructive stop/cancel/unprotect tools", async () => {
+            const names = await getToolNames(server);
+            for (const name of DESTRUCTIVE_SAMPLE_TOOLS) {
+                assert.ok(!names.includes(name), `modify mode: expected "${name}" to be absent`);
+            }
+        });
+        test("rejects destructive stop/cancel/unprotect tool calls", async () => {
+            const client = await connectClient(server);
+            try {
+                await assert.rejects(() => client.callTool("cancel_pipeline", { project_id: "1", pipeline_id: 1 }), (error) => error.message.includes("not allowed in modify mode"), "cancel_pipeline should be rejected in modify mode");
+                await assert.rejects(() => client.callTool("cancel_pipeline_job", { project_id: "1", job_id: 1 }), (error) => error.message.includes("not allowed in modify mode"), "cancel_pipeline_job should be rejected in modify mode");
+                await assert.rejects(() => client.callTool("stop_environment", { project_id: "1", environment_id: 1 }), (error) => error.message.includes("not allowed in modify mode"), "stop_environment should be rejected in modify mode");
+                await assert.rejects(() => client.callTool("stop_stale_environments", {
+                    project_id: "1",
+                    before: "2026-01-01T00:00:00Z",
+                }), (error) => error.message.includes("not allowed in modify mode"), "stop_stale_environments should be rejected in modify mode");
+                await assert.rejects(() => client.callTool("unprotect_branch", { project_id: "1", branch: "main" }), (error) => error.message.includes("not allowed in modify mode"), "unprotect_branch should be rejected in modify mode");
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
         test("hides purge_dependency_proxy_cache", async () => {
             const names = await getToolNames(server);
             assert.ok(!names.includes("purge_dependency_proxy_cache"), "modify mode: purge_dependency_proxy_cache should be absent");
@@ -136,7 +214,7 @@ describe("Permission Mode", { concurrency: 1 }, () => {
             try {
                 await assert.rejects(() => client.callTool("execute_graphql", {
                     query: 'mutation { issueDelete(input: { projectPath: "g/p", iid: "1" }) { errors } }',
-                }), (error) => error.message.includes("delete mutations in modify mode"), "delete mutation should be rejected in modify mode");
+                }), (error) => error.message.includes("destructive mutations in modify mode"), "delete mutation should be rejected in modify mode");
             }
             finally {
                 await client.disconnect();
@@ -171,17 +249,30 @@ describe("Permission Mode", { concurrency: 1 }, () => {
             }
         });
         test("does not apply the modify-mode guard to non-delete mutations", async () => {
+            // issueSetSeverity writes, but nothing about it is destructive.
+            await assertQueryReachesGitLab(server, "mutation { issueSetSeverity(input: { severity: HIGH }) { errors } }");
+        });
+        test("does not apply the modify-mode guard when the alias looks destructive", async () => {
+            // "stop" is only the caller-chosen label here; the field is issueSetSeverity.
+            await assertQueryReachesGitLab(server, "mutation { stop: issueSetSeverity(input: { severity: HIGH }) { errors } }");
+        });
+        test("rejects a destructive mutation hidden behind a harmless alias", async () => {
             const client = await connectClient(server);
             try {
-                // The mock GitLab server has no GraphQL endpoint, so the call may fail
-                // downstream — but it must not fail with the modify-mode guard error.
-                await client.callTool("execute_graphql", {
-                    query: "mutation { issueSetSeverity(input: { severity: HIGH }) { errors } }",
-                });
-            }
-            catch (error) {
-                assert.ok(error instanceof Error);
-                assert.ok(!error.message.includes("modify mode"), `non-delete mutation should pass the guard, got: ${error.message}`);
+                await assert.rejects(() => client.callTool("execute_graphql", {
+                    query: "mutation { harmless: environmentStop(input: {}) { errors } }",
+                }), (error) => error.message.includes("destructive mutations in modify mode"), "a destructive field must be rejected even when aliased");
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+        test("rejects jobUnschedule", async () => {
+            const client = await connectClient(server);
+            try {
+                await assert.rejects(() => client.callTool("execute_graphql", {
+                    query: 'mutation { jobUnschedule(input: { id: "gid://gitlab/Ci::Build/1" }) { errors } }',
+                }), (error) => error.message.includes("destructive mutations in modify mode"), "jobUnschedule must be rejected in modify mode");
             }
             finally {
                 await client.disconnect();

package/build/test/test-remote-downloads.js

@@ -30,6 +30,7 @@ const RFC_FORWARDED_HEADERS = {
 // Minimal 1x1 transparent PNG
 const MINIMAL_PNG = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==', 'base64');
 const LARGE_FILE_TOKEN = 'glpat-largefile-test-token';
+const ATTACHMENT_TOKEN = 'glpat-attachment-test-token';
 const FAKE_ZIP = Buffer.from('PK\x03\x04fake-zip-content-for-testing');
 const MOCK_UPLOAD_RESPONSE = {
     id: 99,
@@ -52,7 +53,7 @@ describe('Remote Downloads - Download Proxy Endpoint', { timeout: 30_000 }, () =
         const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
-            validTokens: [MOCK_TOKEN, LARGE_FILE_TOKEN],
+            validTokens: [MOCK_TOKEN, LARGE_FILE_TOKEN, ATTACHMENT_TOKEN],
         });
         // Mock artifact download
         mockGitLab.addMockHandler('get', `/projects/${TEST_PROJECT_ID}/jobs/${TEST_JOB_ID}/artifacts`, (_req, res) => {
@@ -70,6 +71,13 @@ describe('Remote Downloads - Download Proxy Endpoint', { timeout: 30_000 }, () =
             res.set('Content-Type', 'text/plain');
             res.send('hello document content');
         });
+        // Mock attachment whose name contains a slash. The uploads route takes one filename
+        // segment, so the proxy has to request it as `nested%2Fdocument.txt`; a handler on
+        // `nested/document.txt` would match the wrong route shape and must not be hit.
+        mockGitLab.addMockHandler('get', `/projects/${TEST_PROJECT_ID}/uploads/${TEST_SECRET}/nested%2Fdocument.txt`, (_req, res) => {
+            res.set('Content-Type', 'text/plain');
+            res.send('nested document content');
+        });
         // Mock large artifact (2MB) to verify streaming works for big files
         mockGitLab.addMockHandler('get', `/projects/${TEST_PROJECT_ID}/jobs/999/artifacts`, (_req, res) => {
             res.set('Content-Type', 'application/zip');
@@ -143,6 +151,11 @@ describe('Remote Downloads - Download Proxy Endpoint', { timeout: 30_000 }, () =
         const expectedSize = 2 * 1024 * 1024;
         assert.strictEqual(buf.length, expectedSize, `Should receive full 2MB (got ${buf.length} bytes)`);
     });
+    test('keeps a slash-bearing attachment filename inside one path segment', async () => {
+        const res = await fetch(`http://${HOST}:${serverPort}/downloads/attachment?project_id=${TEST_PROJECT_ID}&secret=${TEST_SECRET}&filename=${encodeURIComponent('nested/document.txt')}`, { headers: { 'Private-Token': ATTACHMENT_TOKEN } });
+        assert.strictEqual(res.status, 200, 'attachment proxy should route to one encoded segment');
+        assert.strictEqual(await res.text(), 'nested document content');
+    });
     test('returns 429 after exceeding rate limit', async () => {
         // Use a different token to get a fresh rate limit counter
         const rateLimitToken = 'glpat-ratelimit-test-token';

package/build/test/utils/graphql-query.test.js

@@ -89,8 +89,80 @@ describe("When graphqlQueryContainsDeleteOperation runs", () => {
         test("should detect delete mutations with variable definitions", () => {
             assert.equal(graphqlQueryContainsDeleteOperation("mutation DeleteIssue($id: IssueID!) { issueDelete(input: { id: $id }) { errors } }"), true);
         });
+        test("should detect comma-prefixed delete mutations", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation(', mutation M { issueDelete(input: { iid: "1" }) { id } }'), true);
+        });
+        test("should detect comma-prefixed delete mutations without whitespace", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation(',mutation{issueDelete(input:{iid:"1"}){id}}'), true);
+        });
+        test("should detect delete mutations after a comma-separated query", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation("query HealthCheck { x }, mutation M { issueDelete(input: {}) { id } }"), true);
+        });
+        test("should allow comma-separated queries", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation("query A { a }, query B { b }"), false);
+        });
         test("should conservatively block top-level fragment spreads in mutations", () => {
             assert.equal(graphqlQueryContainsDeleteOperation("mutation { ...f } fragment f on Mutation { issueDelete(input: {}) { errors } }"), true);
         });
     });
+    describe("with destructive mutations that are not named delete", () => {
+        test("should detect environmentStop", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation('mutation { environmentStop(input: { environmentId: "gid://gitlab/Environment/1" }) { errors } }'), true);
+        });
+        test("should detect pipelineCancel", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation("mutation { pipelineCancel(input: {}) { errors } }"), true);
+        });
+        test("should detect clusterAgentTokenRevoke", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation("mutation { clusterAgentTokenRevoke(input: {}) { errors } }"), true);
+        });
+        test("should detect jobUnschedule", () => {
+            // GitLab moves the scheduled job to manual and clears its scheduled state, so it
+            // is a teardown action even though no teardown verb is part of its name.
+            assert.equal(graphqlQueryContainsDeleteOperation("mutation { jobUnschedule(input: {}) { errors } }"), true);
+        });
+        test("should detect aliased destructive mutations", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation("mutation { s: environmentStop(input: {}) { errors } }"), true);
+        });
+        test("should not treat an alias as a destructive mutation field", () => {
+            for (const query of [
+                "mutation { stop: issueSetSeverity(input: {}) { errors } }",
+                "mutation { revoke: issueSetSeverity(input: {}) { errors } }",
+                "mutation { terminate: updateIssue(input: {}) { issue { id } } }",
+            ]) {
+                assert.equal(graphqlQueryContainsDeleteOperation(query), false, query);
+            }
+        });
+        test("should not treat a spaced or comma-separated alias as a destructive field", () => {
+            for (const query of [
+                "mutation { stop : issueSetSeverity(input: {}) { errors } }",
+                "mutation { revoke,: issueSetSeverity(input: {}) { errors } }",
+                "mutation { terminate\n: updateIssue(input: {}) { issue { id } } }",
+            ]) {
+                assert.equal(graphqlQueryContainsDeleteOperation(query), false, query);
+            }
+        });
+        test("should still detect a destructive field after a spaced alias", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation("mutation { harmless : environmentStop(input: {}) { errors } }"), true);
+        });
+        test("should still detect a destructive field hidden behind a harmless alias", () => {
+            for (const query of [
+                "mutation { harmless: environmentStop(input: {}) { errors } }",
+                "mutation { step: pipelineCancel(input: {}) { errors } }",
+            ]) {
+                assert.equal(graphqlQueryContainsDeleteOperation(query), true, query);
+            }
+        });
+        test("should detect destructive mutations in multi-operation documents", () => {
+            assert.equal(graphqlQueryContainsDeleteOperation("query A { project { id } } mutation B { environmentStop(input: {}) { errors } }"), true);
+        });
+        test("should still allow mutations without a destructive verb", () => {
+            for (const query of [
+                "mutation { issueMove(input: {}) { errors } }",
+                "mutation { mergeRequestMerge(input: {}) { errors } }",
+                "mutation { todoMarkDone(input: {}) { errors } }",
+            ]) {
+                assert.equal(graphqlQueryContainsDeleteOperation(query), false, query);
+            }
+        });
+    });
 });

package/build/test/utils/jmespath-tool-result.test.js

@@ -0,0 +1,91 @@
+import assert from "node:assert/strict";
+import { describe, test } from "node:test";
+import { applyJmespathFilter, applyJmespathToToolResult, getJmespathSyntaxError, omitJmespathArgument, readJmespathExpression, shouldApplyJmespathFilter, } from "../../utils/jmespath-tool-result.js";
+describe("jmespath tool result helpers", () => {
+    test("readJmespathExpression trims and rejects blank values", () => {
+        assert.equal(readJmespathExpression({ jmespath: "  [].title  " }), "[].title");
+        assert.equal(readJmespathExpression({ jmespath: "   " }), undefined);
+        assert.equal(readJmespathExpression({ jmespath: 1 }), undefined);
+    });
+    test("omitJmespathArgument removes MCP-only key", () => {
+        assert.deepEqual(omitJmespathArgument({ project_id: "1", jmespath: "[].id" }), {
+            project_id: "1",
+        });
+    });
+    test("applyJmespathFilter projects array fields", () => {
+        const data = [
+            { title: "a", description: "long" },
+            { title: "b", description: "longer" },
+        ];
+        assert.deepEqual(applyJmespathFilter(data, "[].title"), ["a", "b"]);
+    });
+    test("applyJmespathToToolResult filters JSON text content", () => {
+        const result = applyJmespathToToolResult({
+            content: [
+                {
+                    type: "text",
+                    text: JSON.stringify([{ title: "mr-one", iid: 1 }]),
+                },
+            ],
+        }, "[].title");
+        assert.equal(result.content[0].text, JSON.stringify(["mr-one"]));
+    });
+    test("applyJmespathToToolResult applies maskValue before JMESPath", () => {
+        const result = applyJmespathToToolResult({
+            content: [
+                {
+                    type: "text",
+                    text: JSON.stringify([{ title: "ProjectOneSecret" }]),
+                },
+            ],
+        }, "[].starts_with(title, `ProjectOne`)", {
+            maskValue: value => {
+                if (!Array.isArray(value))
+                    return value;
+                return value.map(entry => entry && typeof entry === "object" && "title" in entry
+                    ? { ...entry, title: "[one]" }
+                    : entry);
+            },
+        });
+        assert.deepEqual(JSON.parse(result.content[0].text), [false]);
+    });
+    test("shouldApplyJmespathFilter is false for isError and explicit skip", () => {
+        const errorResult = {
+            content: [{ type: "text", text: 'Unknown category "foo"' }],
+            isError: true,
+        };
+        assert.equal(shouldApplyJmespathFilter(errorResult, "[].title"), false);
+        assert.equal(shouldApplyJmespathFilter({ content: [{ type: "text", text: "requires confirmation" }] }, "[].title", { skipJmespath: true }), false);
+        assert.equal(shouldApplyJmespathFilter({ content: [{ type: "text", text: "[]" }] }, "[].title"), true);
+    });
+    test("applyJmespathToToolResult preserves isError tool results", () => {
+        const original = {
+            content: [{ type: "text", text: 'Unknown category "foo"' }],
+            isError: true,
+        };
+        assert.deepEqual(applyJmespathToToolResult(original, "[].title"), original);
+    });
+    test("applyJmespathToToolResult preserves approval-style plain text when skipJmespath", () => {
+        const original = {
+            content: [
+                {
+                    type: "text",
+                    text: 'Tool "create_issue" requires confirmation. Re-call with _confirmed: true to proceed.',
+                },
+            ],
+        };
+        assert.deepEqual(applyJmespathToToolResult(original, "[].title", { skipJmespath: true }), original);
+    });
+    test("applyJmespathToToolResult passes non-JSON success text through unchanged", () => {
+        const original = { content: [{ type: "text", text: "Created pipeline #1 for main." }] };
+        assert.deepEqual(applyJmespathToToolResult(original, "id"), original);
+    });
+    test("applyJmespathToToolResult returns the original result when evaluation fails", () => {
+        const original = { content: [{ type: "text", text: JSON.stringify({ title: 1 }) }] };
+        assert.deepEqual(applyJmespathToToolResult(original, "starts_with(title, `a`)"), original);
+    });
+    test("getJmespathSyntaxError rejects invalid expressions before execution", () => {
+        assert.match(getJmespathSyntaxError("[[[") ?? "", /Invalid jmespath expression/);
+        assert.equal(getJmespathSyntaxError("[].title"), undefined);
+    });
+});