@zereight/mcp-gitlab 2.1.69 → 2.2.0

package/build/test/dynamic-api-url-allowlist.test.js

@@ -1,121 +0,0 @@
-import { after, before, describe, test } from "node:test";
-import assert from "node:assert";
-import { createServer } from "node:http";
-import { cleanupServers, findAvailablePort, HOST, launchServer, TransportMode, } from "./utils/server-launcher.js";
-import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server.js";
-import { CustomHeaderClient } from "./clients/custom-header-client.js";
-const MOCK_TOKEN = "glpat-dynamic-url-token";
-async function startAttackerServer(port) {
-    let hits = 0;
-    const server = createServer((_req, res) => {
-        hits++;
-        res.writeHead(200, { "content-type": "application/json" });
-        res.end("[]");
-    });
-    await new Promise((resolve, reject) => {
-        server.once("error", reject);
-        server.listen(port, HOST, () => {
-            server.off("error", reject);
-            resolve();
-        });
-    });
-    return { server, getHits: () => hits };
-}
-describe("Dynamic API URL allowlist", () => {
-    let primaryGitLab;
-    let secondaryGitLab;
-    let attackerServer;
-    let mcpServer;
-    let mcpPort;
-    let mcpUrl;
-    let secondaryHit = false;
-    let getAttackerHits = () => 0;
-    before(async () => {
-        const primaryPort = await findMockServerPort();
-        primaryGitLab = new MockGitLabServer({ port: primaryPort, validTokens: [MOCK_TOKEN] });
-        await primaryGitLab.start();
-        const secondaryPort = await findMockServerPort();
-        secondaryGitLab = new MockGitLabServer({ port: secondaryPort, validTokens: [MOCK_TOKEN] });
-        secondaryGitLab.addMockHandler("get", "/projects/1/issues", (_req, res) => {
-            secondaryHit = true;
-            res.json([]);
-        });
-        await secondaryGitLab.start();
-        const attackerPort = await findAvailablePort(9300);
-        const attacker = await startAttackerServer(attackerPort);
-        attackerServer = attacker.server;
-        getAttackerHits = attacker.getHits;
-        mcpPort = await findAvailablePort(3100);
-        mcpServer = await launchServer({
-            mode: TransportMode.STREAMABLE_HTTP,
-            port: mcpPort,
-            timeout: 5000,
-            env: {
-                STREAMABLE_HTTP: "true",
-                REMOTE_AUTHORIZATION: "true",
-                ENABLE_DYNAMIC_API_URL: "true",
-                GITLAB_API_URL: `${primaryGitLab.getUrl()}/api/v4`,
-                GITLAB_ALLOWED_HOSTS: `${secondaryGitLab.getUrl()}/api/v4`,
-            },
-        });
-        mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
-    });
-    after(async () => {
-        if (mcpServer)
-            cleanupServers([mcpServer]);
-        await primaryGitLab?.stop();
-        await secondaryGitLab?.stop();
-        const server = attackerServer;
-        if (server)
-            await new Promise(resolve => server.close(() => resolve()));
-    });
-    test("allows dynamic API URLs on configured hosts", async () => {
-        const client = new CustomHeaderClient({
-            authorization: `Bearer ${MOCK_TOKEN}`,
-            "x-gitlab-api-url": `${secondaryGitLab.getUrl()}/api/v4`,
-        });
-        await client.connect(mcpUrl);
-        await client.callTool("list_issues", { project_id: "1" });
-        await client.disconnect();
-        assert.strictEqual(secondaryHit, true, "allowed dynamic host should receive GitLab calls");
-    });
-    test("rejects dynamic API URLs on unconfigured hosts before forwarding tokens", async () => {
-        const server = attackerServer;
-        assert.ok(server, "attacker server should be running");
-        const attackerUrl = `http://${HOST}:${server.address().port}/api/v4`;
-        const client = new CustomHeaderClient({
-            authorization: `Bearer ${MOCK_TOKEN}`,
-            "x-gitlab-api-url": attackerUrl,
-        });
-        let connected = false;
-        try {
-            await client.connect(mcpUrl);
-            connected = true;
-            await client.callTool("list_issues", { project_id: "1" });
-        }
-        catch {
-            // Expected: the session is rejected before any GitLab API request is made.
-        }
-        finally {
-            await client.disconnect();
-        }
-        assert.strictEqual(connected, false, "untrusted dynamic host should not initialize a session");
-        assert.strictEqual(getAttackerHits(), 0, "token-bearing requests must not reach untrusted hosts");
-    });
-    test("returns remediation text when download proxy rejects untrusted dynamic hosts", async () => {
-        const server = attackerServer;
-        assert.ok(server, "attacker server should be running");
-        const attackerUrl = `http://${HOST}:${server.address().port}/api/v4`;
-        const response = await fetch(`http://${HOST}:${mcpPort}/downloads/job-artifacts?project_id=1&job_id=1`, {
-            headers: {
-                "Private-Token": MOCK_TOKEN,
-                "x-gitlab-api-url": attackerUrl,
-            },
-        });
-        assert.strictEqual(response.status, 400);
-        const body = (await response.json());
-        assert.match(body.error, /not allowed/);
-        assert.match(body.error, /GITLAB_ALLOWED_HOSTS/);
-        assert.strictEqual(getAttackerHits(), 0, "download proxy must not forward to untrusted hosts");
-    });
-});

package/build/test/dynamic-api-url-test.js

@@ -1,304 +0,0 @@
-/**
- * Dynamic GitLab API URL Test Suite
- * Tests the ability to connect to multiple GitLab instances via custom headers
- */
-import { describe, test, after, before } from 'node:test';
-import assert from 'node:assert';
-import { launchServer, findAvailablePort, cleanupServers, TransportMode, HOST } from './utils/server-launcher.js';
-import { MockGitLabServer, findMockServerPort } from './utils/mock-gitlab-server.js';
-import { CustomHeaderClient } from './clients/custom-header-client.js';
-// Test constants
-const MOCK_TOKEN_1 = 'glpat-mock-token-instance-1';
-const MOCK_TOKEN_2 = 'glpat-mock-token-instance-2';
-// Port ranges
-const MOCK_GITLAB_PORT_BASE_1 = 9100;
-const MOCK_GITLAB_PORT_BASE_2 = 9200;
-const MCP_SERVER_PORT_BASE = 3100;
-console.log('🌐 Dynamic GitLab API URL Test Suite');
-console.log('');
-describe('Dynamic API URL - Multiple GitLab Instances', () => {
-    let mcpUrl;
-    let mockGitLab1;
-    let mockGitLab2;
-    let mockGitLabUrl1;
-    let mockGitLabUrl2;
-    let servers = [];
-    before(async () => {
-        // Start first mock GitLab server
-        const mockPort1 = await findMockServerPort();
-        mockGitLab1 = new MockGitLabServer({
-            port: mockPort1,
-            validTokens: [MOCK_TOKEN_1]
-        });
-        await mockGitLab1.start();
-        mockGitLabUrl1 = mockGitLab1.getUrl();
-        // Start second mock GitLab server
-        const mockPort2 = await findMockServerPort();
-        mockGitLab2 = new MockGitLabServer({
-            port: mockPort2,
-            validTokens: [MOCK_TOKEN_2]
-        });
-        await mockGitLab2.start();
-        mockGitLabUrl2 = mockGitLab2.getUrl();
-        // Start MCP server with dynamic API URL enabled
-        const mcpPort = await findAvailablePort(MCP_SERVER_PORT_BASE);
-        const server = await launchServer({
-            mode: TransportMode.STREAMABLE_HTTP,
-            port: mcpPort,
-            timeout: 5000,
-            env: {
-                STREAMABLE_HTTP: 'true',
-                REMOTE_AUTHORIZATION: 'true',
-                ENABLE_DYNAMIC_API_URL: 'true',
-                GITLAB_READ_ONLY_MODE: 'true',
-            }
-        });
-        servers.push(server);
-        mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
-        console.log(`Mock GitLab Instance 1: ${mockGitLabUrl1}`);
-        console.log(`Mock GitLab Instance 2: ${mockGitLabUrl2}`);
-        console.log(`MCP Server: ${mcpUrl}`);
-    });
-    after(async () => {
-        cleanupServers(servers);
-        if (mockGitLab1) {
-            await mockGitLab1.stop();
-        }
-        if (mockGitLab2) {
-            await mockGitLab2.stop();
-        }
-    });
-    test('should connect to first GitLab instance with custom API URL', async () => {
-        const client = new CustomHeaderClient({
-            'authorization': `Bearer ${MOCK_TOKEN_1}`,
-            'x-gitlab-api-url': mockGitLabUrl1
-        });
-        await client.connect(mcpUrl);
-        const tools = await client.listTools();
-        assert.ok(tools.tools.length > 0, 'Should have tools');
-        console.log(`  ✓ Connected to instance 1, got ${tools.tools.length} tools`);
-        await client.disconnect();
-    });
-    test('should connect to second GitLab instance with different API URL', async () => {
-        const client = new CustomHeaderClient({
-            'authorization': `Bearer ${MOCK_TOKEN_2}`,
-            'x-gitlab-api-url': mockGitLabUrl2
-        });
-        await client.connect(mcpUrl);
-        const tools = await client.listTools();
-        assert.ok(tools.tools.length > 0, 'Should have tools');
-        console.log(`  ✓ Connected to instance 2, got ${tools.tools.length} tools`);
-        await client.disconnect();
-    });
-    test('should handle multiple concurrent connections to different instances', async () => {
-        const client1 = new CustomHeaderClient({
-            'authorization': `Bearer ${MOCK_TOKEN_1}`,
-            'x-gitlab-api-url': mockGitLabUrl1
-        });
-        const client2 = new CustomHeaderClient({
-            'authorization': `Bearer ${MOCK_TOKEN_2}`,
-            'x-gitlab-api-url': mockGitLabUrl2
-        });
-        // Connect both clients
-        await Promise.all([
-            client1.connect(mcpUrl),
-            client2.connect(mcpUrl)
-        ]);
-        // List tools from both
-        const [tools1, tools2] = await Promise.all([
-            client1.listTools(),
-            client2.listTools()
-        ]);
-        assert.ok(tools1.tools.length > 0, 'Instance 1 should have tools');
-        assert.ok(tools2.tools.length > 0, 'Instance 2 should have tools');
-        console.log('  ✓ Both instances accessible concurrently');
-        // Disconnect both
-        await Promise.all([
-            client1.disconnect(),
-            client2.disconnect()
-        ]);
-    });
-    test('should reject invalid API URL format', async () => {
-        const client = new CustomHeaderClient({
-            'authorization': `Bearer ${MOCK_TOKEN_1}`,
-            'x-gitlab-api-url': 'not-a-valid-url'
-        });
-        try {
-            await client.connect(mcpUrl);
-            await client.listTools();
-            await client.disconnect();
-            assert.fail('Should have rejected invalid URL');
-        }
-        catch (error) {
-            assert.ok(error instanceof Error);
-            console.log('  ✓ Correctly rejected invalid URL format');
-        }
-    });
-    test('should reject connection with wrong token for instance', async () => {
-        const client = new CustomHeaderClient({
-            'authorization': `Bearer ${MOCK_TOKEN_1}`, // Token for instance 1
-            'x-gitlab-api-url': mockGitLabUrl2 // But connecting to instance 2
-        });
-        try {
-            await client.connect(mcpUrl);
-            await client.listTools();
-            await client.disconnect();
-            assert.fail('Should have rejected wrong token');
-        }
-        catch (error) {
-            assert.ok(error instanceof Error);
-            console.log('  ✓ Correctly rejected wrong token for instance');
-        }
-    });
-    test('should maintain separate sessions for different API URLs', async () => {
-        const client1 = new CustomHeaderClient({
-            'authorization': `Bearer ${MOCK_TOKEN_1}`,
-            'x-gitlab-api-url': mockGitLabUrl1
-        });
-        const client2 = new CustomHeaderClient({
-            'authorization': `Bearer ${MOCK_TOKEN_2}`,
-            'x-gitlab-api-url': mockGitLabUrl2
-        });
-        // Connect both
-        await client1.connect(mcpUrl);
-        await client2.connect(mcpUrl);
-        // Get session IDs
-        const sessionId1 = client1.getSessionId();
-        const sessionId2 = client2.getSessionId();
-        assert.ok(sessionId1, 'Session 1 should exist');
-        assert.ok(sessionId2, 'Session 2 should exist');
-        assert.notStrictEqual(sessionId1, sessionId2, 'Sessions should be different');
-        console.log('  ✓ Separate sessions maintained for different instances');
-        // Make requests from both sessions
-        const [tools1, tools2] = await Promise.all([
-            client1.listTools(),
-            client2.listTools()
-        ]);
-        assert.ok(tools1.tools.length > 0, 'Instance 1 should work');
-        assert.ok(tools2.tools.length > 0, 'Instance 2 should work');
-        console.log('  ✓ Both sessions work independently');
-        await client1.disconnect();
-        await client2.disconnect();
-    });
-    test('should normalize API URLs correctly', async () => {
-        // Test with URL that needs normalization (no /api/v4)
-        const client = new CustomHeaderClient({
-            'authorization': `Bearer ${MOCK_TOKEN_1}`,
-            'x-gitlab-api-url': mockGitLabUrl1 // Without /api/v4
-        });
-        await client.connect(mcpUrl);
-        const tools = await client.listTools();
-        assert.ok(tools.tools.length > 0, 'Should work with normalized URL');
-        console.log('  ✓ URL normalization works correctly');
-        await client.disconnect();
-    });
-});
-describe('Dynamic API URL - Connection Pool', () => {
-    let mcpUrl;
-    let metricsUrl;
-    let mockGitLab1;
-    let mockGitLab2;
-    let mockGitLabUrl1;
-    let mockGitLabUrl2;
-    let servers = [];
-    before(async () => {
-        // Start mock GitLab servers
-        const mockPort1 = await findMockServerPort();
-        mockGitLab1 = new MockGitLabServer({
-            port: mockPort1,
-            validTokens: [MOCK_TOKEN_1]
-        });
-        await mockGitLab1.start();
-        mockGitLabUrl1 = mockGitLab1.getUrl();
-        const mockPort2 = await findMockServerPort();
-        mockGitLab2 = new MockGitLabServer({
-            port: mockPort2,
-            validTokens: [MOCK_TOKEN_2]
-        });
-        await mockGitLab2.start();
-        mockGitLabUrl2 = mockGitLab2.getUrl();
-        // Start MCP server
-        const mcpPort = await findAvailablePort(MCP_SERVER_PORT_BASE + 50);
-        const server = await launchServer({
-            mode: TransportMode.STREAMABLE_HTTP,
-            port: mcpPort,
-            timeout: 5000,
-            env: {
-                STREAMABLE_HTTP: 'true',
-                REMOTE_AUTHORIZATION: 'true',
-                ENABLE_DYNAMIC_API_URL: 'true',
-                GITLAB_CLIENT_POOL_SIZE: '5',
-                GITLAB_CLIENT_IDLE_TIMEOUT: '30000',
-            }
-        });
-        servers.push(server);
-        mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
-        metricsUrl = `http://${HOST}:${mcpPort}/metrics.json`;
-        console.log(`MCP Server: ${mcpUrl}`);
-        console.log(`Metrics URL: ${metricsUrl}`);
-    });
-    after(async () => {
-        cleanupServers(servers);
-        if (mockGitLab1) {
-            await mockGitLab1.stop();
-        }
-        if (mockGitLab2) {
-            await mockGitLab2.stop();
-        }
-    });
-    test('should track pool statistics via metrics JSON endpoint', async () => {
-        // Make some connections first
-        const client1 = new CustomHeaderClient({
-            'authorization': `Bearer ${MOCK_TOKEN_1}`,
-            'x-gitlab-api-url': mockGitLabUrl1
-        });
-        const client2 = new CustomHeaderClient({
-            'authorization': `Bearer ${MOCK_TOKEN_2}`,
-            'x-gitlab-api-url': mockGitLabUrl2
-        });
-        await client1.connect(mcpUrl);
-        await client2.connect(mcpUrl);
-        await client1.listTools();
-        await client2.listTools();
-        // Check metrics
-        const response = await fetch(metricsUrl);
-        assert.ok(response.ok, 'Metrics JSON endpoint should be accessible');
-        const metrics = await response.json();
-        assert.ok(metrics.gitlabClientPool, 'Should have pool metrics');
-        assert.ok(typeof metrics.gitlabClientPool.size === 'number', 'Should have pool size');
-        assert.ok(typeof metrics.gitlabClientPool.maxSize === 'number', 'Should have max size');
-        console.log('  ✓ Pool metrics available');
-        console.log(`  ℹ️  Pool size: ${metrics.gitlabClientPool.size}/${metrics.gitlabClientPool.maxSize}`);
-        await client1.disconnect();
-        await client2.disconnect();
-    });
-    test('should reuse connections for same API URL', async () => {
-        // Get initial metrics
-        const response1 = await fetch(metricsUrl);
-        const metrics1 = await response1.json();
-        const initialSize = metrics1.gitlabClientPool?.size || 0;
-        // Create multiple clients to same instance
-        const clients = [];
-        for (let i = 0; i < 3; i++) {
-            const client = new CustomHeaderClient({
-                'authorization': `Bearer ${MOCK_TOKEN_1}`,
-                'x-gitlab-api-url': mockGitLabUrl1
-            });
-            await client.connect(mcpUrl);
-            await client.listTools();
-            clients.push(client);
-        }
-        // Check metrics - should not have created 3 new pool entries
-        const response2 = await fetch(metricsUrl);
-        const metrics2 = await response2.json();
-        const finalSize = metrics2.gitlabClientPool?.size || 0;
-        // Pool size should increase by at most 1 (for the shared URL)
-        assert.ok(finalSize - initialSize <= 1, 'Should reuse connection for same URL');
-        console.log('  ✓ Connection reuse working');
-        console.log(`  ℹ️  Pool size change: ${initialSize} → ${finalSize}`);
-        // Cleanup
-        for (const client of clients) {
-            await client.disconnect();
-        }
-    });
-});