@zereight/mcp-gitlab 2.1.69 → 2.2.0

package/build/test/server/metrics.test.js

@@ -1,47 +0,0 @@
-import { describe, test } from "node:test";
-import assert from "node:assert";
-import { escapePrometheusLabel, formatPrometheusMetrics } from "../../server/metrics.js";
-describe("Prometheus metrics formatting", () => {
-    test("escapes label values", () => {
-        assert.strictEqual(escapePrometheusLabel('a"b\\c\nd'), 'a\\"b\\\\c\\nd');
-    });
-    test("formats current MCP metrics", () => {
-        const body = formatPrometheusMetrics({
-            requestsProcessed: 2,
-            rejectedByRateLimit: 1,
-            rejectedByCapacity: 0,
-            authFailures: 3,
-            totalSessions: 4,
-            expiredSessions: 5,
-            activeSessions: 6,
-            authenticatedSessions: 7,
-            gitlabClientPool: { size: 8, maxSize: 100 },
-            uptime: 9,
-            memoryUsage: {
-                rss: 10,
-                heapTotal: 11,
-                heapUsed: 12,
-                external: 13,
-                arrayBuffers: 14,
-            },
-            statelessRequests: 15,
-            statelessAuthFromHeader: 16,
-            statelessAuthFromSealedSid: 17,
-            statelessAuthFailures: 18,
-            statelessSidRotated: 19,
-            config: {
-                maxSessions: 1000,
-                maxRequestsPerMinute: 60,
-                sessionTimeoutSeconds: 3600,
-                remoteAuthEnabled: true,
-                mcpOAuthEnabled: false,
-                statelessModeEnabled: false,
-                statelessRotationKey: false,
-            },
-        });
-        assert.match(body, /# HELP gitlab_mcp_requests_processed_total/);
-        assert.match(body, /gitlab_mcp_requests_processed_total 2/);
-        assert.match(body, /gitlab_mcp_requests_rejected_total\{reason="rate_limit"\} 1/);
-        assert.match(body, /gitlab_mcp_config_info\{[^}]*remote_auth_enabled="true"/);
-    });
-});

package/build/test/server/request-helpers.test.js

@@ -1,48 +0,0 @@
-import { describe, test } from "node:test";
-import assert from "node:assert";
-import { isInitializationRequestBody, isUnauthenticatedDiscoveryRequestBody, readAcceptHeader, readMcpSessionIdHeader, redactSessionIdForLog, } from "../../server/request-helpers.js";
-describe("streamable request helpers", () => {
-    test("redacts stateless session ids and truncates legacy ids", () => {
-        assert.strictEqual(redactSessionIdForLog(undefined), "<none>");
-        assert.strictEqual(redactSessionIdForLog("v1.sid.secret-payload"), "v1.sid.<redacted>");
-        assert.strictEqual(redactSessionIdForLog("123456789abcdef"), "12345678…");
-        assert.strictEqual(redactSessionIdForLog("short"), "short");
-    });
-    test("detects initialize requests in single and batch bodies", () => {
-        assert.strictEqual(isInitializationRequestBody({ method: "initialize" }), true);
-        assert.strictEqual(isInitializationRequestBody([{ method: "tools/list" }, { method: "initialize" }]), true);
-        assert.strictEqual(isInitializationRequestBody({ method: "tools/list" }), false);
-        assert.strictEqual(isInitializationRequestBody(null), false);
-    });
-    test("allows only discovery methods in unauthenticated discovery bodies", () => {
-        assert.strictEqual(isUnauthenticatedDiscoveryRequestBody({ method: "tools/list" }), true);
-        assert.strictEqual(isUnauthenticatedDiscoveryRequestBody({ method: "server/discover" }), true);
-        assert.strictEqual(isUnauthenticatedDiscoveryRequestBody([
-            { method: "initialize" },
-            { method: "notifications/initialized" },
-            { method: "tools/list" },
-            { method: "server/discover" },
-        ]), true);
-        assert.strictEqual(isUnauthenticatedDiscoveryRequestBody([
-            { method: "tools/list" },
-            { method: "call_tool" },
-            { method: "tools/call" },
-        ]), false);
-        assert.strictEqual(isUnauthenticatedDiscoveryRequestBody([
-            { method: "server/discover" },
-            { method: "tools/call" },
-        ]), false);
-        assert.strictEqual(isUnauthenticatedDiscoveryRequestBody(undefined), false);
-    });
-    test("normalizes Mcp-Session-Id headers", () => {
-        assert.strictEqual(readMcpSessionIdHeader({ headers: { "mcp-session-id": "sid-1" } }), "sid-1");
-        assert.strictEqual(readMcpSessionIdHeader({ headers: { "mcp-session-id": "" } }), undefined);
-        assert.strictEqual(readMcpSessionIdHeader({ headers: { "mcp-session-id": ["sid-1", "sid-2"] } }), undefined);
-        assert.strictEqual(readMcpSessionIdHeader({ headers: {} }), undefined);
-    });
-    test("joins duplicate Accept headers so text/event-stream is not dropped", () => {
-        assert.strictEqual(readAcceptHeader({ headers: { accept: "application/json, text/event-stream" } }), "application/json, text/event-stream");
-        assert.strictEqual(readAcceptHeader({ headers: { accept: ["application/json", "text/event-stream"] } }), "application/json, text/event-stream");
-        assert.strictEqual(readAcceptHeader({ headers: {} }), "");
-    });
-});

package/build/test/server/version.test.js

@@ -1,13 +0,0 @@
-import { test } from "node:test";
-import assert from "node:assert";
-import fs from "node:fs";
-import path, { dirname } from "node:path";
-import { fileURLToPath } from "node:url";
-import { SERVER_VERSION } from "../../server/version.js";
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-const packageJsonPath = path.resolve(__dirname, "../../package.json");
-const packageVersion = JSON.parse(fs.readFileSync(packageJsonPath, "utf8")).version;
-test("SERVER_VERSION matches package.json", () => {
-    assert.strictEqual(SERVER_VERSION, packageVersion);
-});

package/build/test/sse-auth-guard.test.js

@@ -1,96 +0,0 @@
-import assert from "node:assert/strict";
-import { spawn } from "node:child_process";
-import { once } from "node:events";
-import { afterEach, describe, test } from "node:test";
-import * as path from "node:path";
-import { findAvailablePort } from "./utils/server-launcher.js";
-const ERROR_MESSAGE = "SSE=true requires SSE_AUTH_TOKEN (or explicitly set SSE_DANGEROUSLY_ALLOW_UNAUTHENTICATED_REMOTE=true)";
-const LOOPBACK = "127.0.0.1";
-const SERVER_PATH = path.resolve(process.cwd(), "build/index.js");
-const running = new Set();
-function startSseServer(env, port) {
-    const child = spawn("node", [SERVER_PATH], {
-        env: {
-            ...process.env,
-            GITLAB_API_URL: "https://gitlab.example.com/api/v4",
-            HOST: "0.0.0.0",
-            PORT: String(port),
-            SSE: "true",
-            STREAMABLE_HTTP: "false",
-            REMOTE_AUTHORIZATION: "false",
-            GITLAB_MCP_OAUTH: "false",
-            GITLAB_USE_OAUTH: "false",
-            GITLAB_PERSONAL_ACCESS_TOKEN: "glpat_test",
-            GITLAB_JOB_TOKEN: "",
-            GITLAB_AUTH_COOKIE_PATH: "",
-            ...env,
-        },
-        stdio: ["ignore", "pipe", "pipe"],
-    });
-    running.add(child);
-    child.once("exit", () => running.delete(child));
-    return child;
-}
-async function waitForExit(child, timeoutMs = 5000) {
-    let output = "";
-    child.stdout?.on("data", chunk => {
-        output += chunk.toString();
-    });
-    child.stderr?.on("data", chunk => {
-        output += chunk.toString();
-    });
-    let timeoutHandle;
-    const timeout = new Promise((_, reject) => {
-        timeoutHandle = setTimeout(() => reject(new Error(`server did not exit within ${timeoutMs}ms`)), timeoutMs);
-    });
-    try {
-        const [code] = (await Promise.race([once(child, "exit"), timeout]));
-        return { code, output };
-    }
-    finally {
-        clearTimeout(timeoutHandle);
-    }
-}
-async function waitForHealth(port, timeoutMs = 5000) {
-    const deadline = Date.now() + timeoutMs;
-    let lastError;
-    while (Date.now() < deadline) {
-        try {
-            const response = await fetch(`http://${LOOPBACK}:${port}/health`);
-            if (response.ok)
-                return;
-        }
-        catch (error) {
-            lastError = error;
-        }
-        await new Promise(resolve => setTimeout(resolve, 100));
-    }
-    throw new Error(`server did not become healthy: ${String(lastError)}`);
-}
-afterEach(() => {
-    for (const child of running) {
-        if (!child.killed)
-            child.kill("SIGTERM");
-    }
-    running.clear();
-});
-describe("SSE remote auth guard", () => {
-    test("refuses unauthenticated SSE", async () => {
-        const port = await findAvailablePort(4400);
-        const child = startSseServer({}, port);
-        const { code, output } = await waitForExit(child);
-        assert.notEqual(code, 0);
-        assert.match(output, new RegExp(ERROR_MESSAGE.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")));
-    });
-    test("requires bearer auth on SSE endpoints when SSE_AUTH_TOKEN is configured", async () => {
-        const port = await findAvailablePort(4410);
-        startSseServer({ SSE_AUTH_TOKEN: "mcp_sse_secret" }, port);
-        await waitForHealth(port);
-        const sseResponse = await fetch(`http://${LOOPBACK}:${port}/sse`);
-        assert.equal(sseResponse.status, 401);
-        const unauthenticatedMessage = await fetch(`http://${LOOPBACK}:${port}/messages?sessionId=missing`, { method: "POST" });
-        assert.equal(unauthenticatedMessage.status, 401);
-        const authenticatedMessage = await fetch(`http://${LOOPBACK}:${port}/messages?sessionId=missing`, { method: "POST", headers: { Authorization: "Bearer mcp_sse_secret" } });
-        assert.equal(authenticatedMessage.status, 400);
-    });
-});

package/build/test/sse-session-limits.test.js

@@ -1,273 +0,0 @@
-import assert from "node:assert/strict";
-import { spawn } from "node:child_process";
-import http from "node:http";
-import { afterEach, describe, test } from "node:test";
-import * as path from "node:path";
-import { findAvailablePort } from "./utils/server-launcher.js";
-const LOOPBACK = "127.0.0.1";
-const SSE_TOKEN = "mcp_sse_secret";
-const SERVER_PATH = path.resolve(process.cwd(), "build/index.js");
-// Keeps connection churn from tripping the per-IP creation limit in tests that
-// are not about rate limiting.
-const UNTHROTTLED = "1000";
-const running = new Set();
-function startSseServer(env, port) {
-    const child = spawn("node", [SERVER_PATH], {
-        env: {
-            ...process.env,
-            GITLAB_API_URL: "https://gitlab.example.com/api/v4",
-            HOST: "0.0.0.0",
-            PORT: String(port),
-            SSE: "true",
-            STREAMABLE_HTTP: "false",
-            REMOTE_AUTHORIZATION: "false",
-            GITLAB_MCP_OAUTH: "false",
-            GITLAB_USE_OAUTH: "false",
-            GITLAB_PERSONAL_ACCESS_TOKEN: "glpat_test",
-            GITLAB_JOB_TOKEN: "",
-            GITLAB_AUTH_COOKIE_PATH: "",
-            SSE_AUTH_TOKEN: SSE_TOKEN,
-            ...env,
-        },
-        stdio: ["ignore", "pipe", "pipe"],
-    });
-    running.add(child);
-    child.once("exit", () => running.delete(child));
-    return child;
-}
-async function waitForHealth(port, timeoutMs = 10000) {
-    const deadline = Date.now() + timeoutMs;
-    let lastError;
-    while (Date.now() < deadline) {
-        try {
-            const response = await fetch(`http://${LOOPBACK}:${port}/health`);
-            if (response.ok)
-                return;
-        }
-        catch (error) {
-            lastError = error;
-        }
-        await new Promise(resolve => setTimeout(resolve, 100));
-    }
-    throw new Error(`server did not become healthy: ${String(lastError)}`);
-}
-function openSseConnection(port) {
-    let statusCode;
-    let text = "";
-    let resolveEnded = () => { };
-    const ended = new Promise(resolve => {
-        resolveEnded = resolve;
-    });
-    const request = http.get({
-        host: LOOPBACK,
-        port,
-        path: "/sse",
-        headers: { Authorization: `Bearer ${SSE_TOKEN}`, Accept: "text/event-stream" },
-    }, response => {
-        statusCode = response.statusCode;
-        response.on("data", chunk => {
-            text += chunk.toString();
-        });
-        response.on("end", () => resolveEnded());
-        response.on("close", () => resolveEnded());
-    });
-    request.on("error", () => resolveEnded());
-    return {
-        get statusCode() {
-            return statusCode;
-        },
-        streamText: () => text,
-        close: () => {
-            request.destroy();
-            resolveEnded();
-        },
-        ended,
-    };
-}
-async function waitFor(predicate, timeoutMs = 5000, stepMs = 50) {
-    const deadline = Date.now() + timeoutMs;
-    while (Date.now() < deadline) {
-        if (predicate())
-            return true;
-        await new Promise(resolve => setTimeout(resolve, stepMs));
-    }
-    return predicate();
-}
-/** Resolves true when the server ends the stream within the window. */
-async function endedWithin(connection, ms) {
-    return Promise.race([
-        connection.ended.then(() => true),
-        new Promise(resolve => setTimeout(() => resolve(false), ms)),
-    ]);
-}
-/** Reads the session id the transport advertises in its opening `endpoint` event. */
-async function readSessionId(connection, timeoutMs = 5000) {
-    const deadline = Date.now() + timeoutMs;
-    while (Date.now() < deadline) {
-        const match = /data: \/messages\?sessionId=([^\s]+)/.exec(connection.streamText());
-        if (match)
-            return match[1];
-        await new Promise(resolve => setTimeout(resolve, 25));
-    }
-    throw new Error(`SSE stream did not advertise a session id: ${connection.streamText()}`);
-}
-async function postSseMessage(port, sessionId, body) {
-    const response = await fetch(`http://${LOOPBACK}:${port}/messages?sessionId=${sessionId}`, {
-        method: "POST",
-        headers: { Authorization: `Bearer ${SSE_TOKEN}`, "Content-Type": "application/json" },
-        body: JSON.stringify(body),
-    });
-    await response.arrayBuffer();
-    return response.status;
-}
-async function getSseStatus(port) {
-    const response = await fetch(`http://${LOOPBACK}:${port}/sse`, {
-        headers: { Authorization: `Bearer ${SSE_TOKEN}`, Accept: "text/event-stream" },
-    });
-    await response.arrayBuffer();
-    return response.status;
-}
-/**
- * Connection attempts are rate-limited per IP, so a capacity slot released
- * asynchronously has to be polled for instead of raced with a single request.
- */
-async function waitForAcceptedConnection(port, timeoutMs = 5000) {
-    const deadline = Date.now() + timeoutMs;
-    let connection = openSseConnection(port);
-    for (;;) {
-        await waitFor(() => connection.statusCode !== undefined, 2000, 25);
-        if (connection.statusCode === 200)
-            return connection;
-        connection.close();
-        if (Date.now() >= deadline)
-            return connection;
-        await new Promise(resolve => setTimeout(resolve, 100));
-        connection = openSseConnection(port);
-    }
-}
-afterEach(() => {
-    for (const child of running) {
-        if (!child.killed)
-            child.kill("SIGTERM");
-    }
-    running.clear();
-});
-describe("SSE session limits", { concurrency: 1 }, () => {
-    test("rejects new SSE connections once MAX_SESSIONS is reached", async () => {
-        const port = await findAvailablePort(4500);
-        startSseServer({ MAX_SESSIONS: "2", MAX_REQUESTS_PER_MINUTE: UNTHROTTLED }, port);
-        await waitForHealth(port);
-        const first = openSseConnection(port);
-        const second = openSseConnection(port);
-        const bothConnected = await waitFor(() => first.statusCode === 200 && second.statusCode === 200, 5000);
-        assert.ok(bothConnected, "expected the first two SSE connections to be accepted");
-        const rejected = await fetch(`http://${LOOPBACK}:${port}/sse`, {
-            headers: { Authorization: `Bearer ${SSE_TOKEN}`, Accept: "text/event-stream" },
-        });
-        assert.equal(rejected.status, 503);
-        const body = (await rejected.json());
-        assert.match(body.error ?? "", /capacity/i);
-        first.close();
-        second.close();
-    });
-    test("frees the capacity slot when a client closes the stream", async () => {
-        const port = await findAvailablePort(4510);
-        startSseServer({ MAX_SESSIONS: "2", MAX_REQUESTS_PER_MINUTE: UNTHROTTLED }, port);
-        await waitForHealth(port);
-        const first = openSseConnection(port);
-        const second = openSseConnection(port);
-        assert.ok(await waitFor(() => first.statusCode === 200 && second.statusCode === 200, 5000), "expected the first two SSE connections to be accepted");
-        assert.equal(await getSseStatus(port), 503, "expected the server to be at capacity");
-        first.close();
-        // SESSION_TIMEOUT_SECONDS is left at its 3600s default, so the slot can
-        // only come back through the response "close" handler - not the idle sweep.
-        const reclaimed = await waitForAcceptedConnection(port);
-        assert.equal(reclaimed.statusCode, 200, "closing a client connection should free its capacity slot");
-        reclaimed.close();
-        second.close();
-    });
-    test("rate-limits SSE connection creation per client IP", async () => {
-        const port = await findAvailablePort(4520);
-        startSseServer({ MAX_REQUESTS_PER_MINUTE: "2" }, port);
-        await waitForHealth(port);
-        const first = openSseConnection(port);
-        const second = openSseConnection(port);
-        assert.ok(await waitFor(() => first.statusCode === 200 && second.statusCode === 200, 5000), "expected the first two SSE connections to be accepted");
-        const rejected = await fetch(`http://${LOOPBACK}:${port}/sse`, {
-            headers: { Authorization: `Bearer ${SSE_TOKEN}`, Accept: "text/event-stream" },
-        });
-        assert.equal(rejected.status, 429);
-        const body = (await rejected.json());
-        assert.equal(body.error, "Rate limit exceeded");
-        assert.match(body.message ?? "", /per minute/i);
-        first.close();
-        second.close();
-    });
-    test("closes SSE sessions that stay idle", async () => {
-        const port = await findAvailablePort(4530);
-        startSseServer({ SESSION_TIMEOUT_SECONDS: "2" }, port);
-        await waitForHealth(port);
-        const connection = openSseConnection(port);
-        assert.ok(await waitFor(() => connection.statusCode === 200, 5000), "expected the SSE connection to be accepted");
-        const closedByIdleTimeout = await Promise.race([
-            connection.ended.then(() => true),
-            new Promise(resolve => setTimeout(() => resolve(false), 12000)),
-        ]);
-        assert.equal(closedByIdleTimeout, true, "idle SSE session should be closed by the server");
-        connection.close();
-    });
-    test("POST /messages keeps an SSE session alive past the idle timeout", async () => {
-        const port = await findAvailablePort(4540);
-        startSseServer({ SESSION_TIMEOUT_SECONDS: "2" }, port);
-        await waitForHealth(port);
-        const connection = openSseConnection(port);
-        assert.ok(await waitFor(() => connection.statusCode === 200, 5000), "expected the SSE connection to be accepted");
-        const sessionId = await readSessionId(connection);
-        // Ping across several idle windows; every POST /messages must reset activity.
-        const pingStatuses = [];
-        const keepAlive = setInterval(() => {
-            void postSseMessage(port, sessionId, { jsonrpc: "2.0", id: 1, method: "ping" })
-                .then(status => pingStatuses.push(status))
-                .catch(() => undefined);
-        }, 400);
-        try {
-            await new Promise(resolve => setTimeout(resolve, 6000));
-        }
-        finally {
-            clearInterval(keepAlive);
-        }
-        assert.ok(pingStatuses.length >= 8, `expected keep-alive pings to be sent, saw ${pingStatuses.length}`);
-        assert.ok(pingStatuses.every(status => status === 202), `expected every ping to be accepted, saw ${JSON.stringify(pingStatuses)}`);
-        assert.match(connection.streamText(), /"result"/, "expected a ping response on the stream");
-        assert.equal(await endedWithin(connection, 300), false, "POST /messages activity should keep the SSE session open");
-        assert.equal(await endedWithin(connection, 8000), true, "the session should close once POST /messages activity stops");
-        connection.close();
-    });
-    test("treats inherited object keys as unknown SSE sessions", async () => {
-        const port = await findAvailablePort(4560);
-        startSseServer({}, port);
-        await waitForHealth(port);
-        const response = await fetch(`http://${LOOPBACK}:${port}/messages?sessionId=constructor`, {
-            method: "POST",
-            headers: { Authorization: `Bearer ${SSE_TOKEN}`, "Content-Type": "application/json" },
-            body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "ping" }),
-            signal: AbortSignal.timeout(3000),
-        });
-        assert.equal(response.status, 400);
-        assert.match(await response.text(), /No transport found/);
-    });
-    test("reports degraded health while SSE capacity is exhausted", async () => {
-        const port = await findAvailablePort(4550);
-        startSseServer({ MAX_SESSIONS: "1" }, port);
-        await waitForHealth(port);
-        const connection = openSseConnection(port);
-        assert.ok(await waitFor(() => connection.statusCode === 200, 5000), "expected the SSE connection to be accepted");
-        const degraded = await fetch(`http://${LOOPBACK}:${port}/health`);
-        const body = (await degraded.json());
-        assert.equal(degraded.status, 503);
-        assert.equal(body.status, "degraded");
-        assert.equal(body.activeSessions, 1);
-        assert.equal(body.maxSessions, 1);
-        connection.close();
-    });
-});