@zereight/mcp-gitlab 2.1.69 → 2.2.0

package/build/test/stateless/session-id.test.js

@@ -1,157 +0,0 @@
-/**
- * Unit tests for the sealed Mcp-Session-Id helpers.
- */
-import assert from "node:assert/strict";
-import { randomBytes } from "node:crypto";
-import { describe, test } from "node:test";
-import { loadKeyMaterialFromEnv, looksLikeStatelessSessionId, mintSessionId, openSessionId, } from "../../stateless/index.js";
-function secret() {
-    return randomBytes(32).toString("base64url");
-}
-function load(current, previous) {
-    const env = {
-        OAUTH_STATELESS_SECRET: current,
-    };
-    if (previous)
-        env.OAUTH_STATELESS_SECRET_PREVIOUS = previous;
-    const m = loadKeyMaterialFromEnv(true, env);
-    assert.ok(m);
-    return m;
-}
-describe("mintSessionId / openSessionId", () => {
-    test("seals and restores a narrowed project scope", () => {
-        const s = secret();
-        const a = load(s);
-        const b = load(s);
-        const sid = mintSessionId(a, {
-            header: "Private-Token",
-            token: "glpat-ABCDEFG123456789-abcdef",
-            apiUrl: "https://gitlab.example.com/api/v4",
-            allowedProjectIds: ["42", "org/theorg"],
-        });
-        const opened = openSessionId(b, sid, 3600);
-        assert.ok(opened);
-        assert.deepEqual(opened.p, ["42", "org/theorg"]);
-    });
-    test("omits the scope field when no scope was narrowed", () => {
-        const s = secret();
-        const m = load(s);
-        const sid = mintSessionId(m, {
-            header: "Private-Token",
-            token: "glpat-ABCDEFG123456789-abcdef",
-            apiUrl: "https://gitlab.example.com/api/v4",
-        });
-        const opened = openSessionId(m, sid, 3600);
-        assert.ok(opened);
-        assert.equal(opened.p, undefined);
-    });
-    test("roundtrips across pods", () => {
-        const s = secret();
-        const a = load(s);
-        const b = load(s);
-        const sid = mintSessionId(a, {
-            header: "Authorization",
-            token: "glpat-ABCDEFG123456789-abcdef",
-            apiUrl: "https://gitlab.example.com/api/v4",
-        });
-        assert.ok(looksLikeStatelessSessionId(sid));
-        const opened = openSessionId(b, sid, 3600);
-        assert.ok(opened);
-        assert.equal(opened.h, "Authorization");
-        assert.equal(opened.t, "glpat-ABCDEFG123456789-abcdef");
-        assert.equal(opened.u, "https://gitlab.example.com/api/v4");
-    });
-    test("preserves Private-Token / JOB-TOKEN headers", () => {
-        const m = load(secret());
-        for (const h of ["Private-Token", "JOB-TOKEN"]) {
-            const sid = mintSessionId(m, {
-                header: h,
-                token: "some-token-value-at-least-20-chars",
-                apiUrl: "https://gitlab.example.com/api/v4",
-            });
-            const opened = openSessionId(m, sid, 3600);
-            assert.ok(opened);
-            assert.equal(opened.h, h);
-        }
-    });
-    test("rejects unknown header values", () => {
-        // Hand-craft a payload with a bogus header value. We do this by minting a
-        // legitimate token then mutating the decoded payload via a second mint
-        // won't work (AEAD). Instead, assert the helper rejects garbage input
-        // by tampering with an unrelated value and checking it still fails safely.
-        const m = load(secret());
-        const sid = mintSessionId(m, {
-            header: "Authorization",
-            token: "t".repeat(25),
-            apiUrl: "u",
-        });
-        // Truncate to force bad ciphertext on open.
-        const broken = sid.slice(0, -3);
-        assert.equal(openSessionId(m, broken, 3600), null);
-    });
-    test("expired sid rejected", () => {
-        const m = load(secret());
-        const past = Math.floor(Date.now() / 1000) - 10_000;
-        const sid = mintSessionId(m, {
-            header: "Authorization",
-            token: "t".repeat(25),
-            apiUrl: "u",
-            now: () => past,
-        });
-        assert.equal(openSessionId(m, sid, 60), null);
-    });
-    test("different secret rejects", () => {
-        const a = load(secret());
-        const b = load(secret());
-        const sid = mintSessionId(a, {
-            header: "Authorization",
-            token: "t".repeat(25),
-            apiUrl: "u",
-        });
-        assert.equal(openSessionId(b, sid, 3600), null);
-    });
-    test("rotation: sid minted under previous secret opens on rotated pod", () => {
-        const s1 = secret();
-        const s2 = secret();
-        const old = load(s1);
-        const rotated = load(s2, s1);
-        const sid = mintSessionId(old, {
-            header: "Authorization",
-            token: "t".repeat(25),
-            apiUrl: "u",
-        });
-        const opened = openSessionId(rotated, sid, 3600);
-        assert.ok(opened);
-    });
-    test("looksLikeStatelessSessionId distinguishes legacy UUIDs", () => {
-        const m = load(secret());
-        const sid = mintSessionId(m, {
-            header: "Authorization",
-            token: "t".repeat(25),
-            apiUrl: "u",
-        });
-        assert.ok(looksLikeStatelessSessionId(sid));
-        assert.ok(!looksLikeStatelessSessionId("a4f1c2b8-f2c4-4ee6-bc14-2b7ab0e6ab11"));
-        assert.ok(!looksLikeStatelessSessionId(""));
-    });
-    test("fresh sid has different iat each time (rotation on every refresh)", () => {
-        const m = load(secret());
-        const sid1 = mintSessionId(m, {
-            header: "Authorization",
-            token: "t".repeat(25),
-            apiUrl: "u",
-            now: () => 1000,
-        });
-        const sid2 = mintSessionId(m, {
-            header: "Authorization",
-            token: "t".repeat(25),
-            apiUrl: "u",
-            now: () => 2000,
-        });
-        assert.notEqual(sid1, sid2);
-        const open1 = openSessionId(m, sid1, 3600, () => 2000);
-        const open2 = openSessionId(m, sid2, 3600, () => 2000);
-        assert.equal(open1.iat, 1000);
-        assert.equal(open2.iat, 2000);
-    });
-});

package/build/test/streamable-http-concurrent-session.test.js

@@ -1,171 +0,0 @@
-import { after, before, describe, test } from "node:test";
-import assert from "node:assert";
-import { Buffer } from "node:buffer";
-import fs from "node:fs";
-import path, { dirname } from "node:path";
-import { fileURLToPath } from "node:url";
-import { cleanupServers, findAvailablePort, HOST, launchServer, TransportMode, } from "./utils/server-launcher.js";
-import { findMockServerPort, MockGitLabServer } from "./utils/mock-gitlab-server.js";
-import { CustomHeaderClient } from "./clients/custom-header-client.js";
-const MOCK_TOKEN = "mock-concurrent-token-12345";
-const TEST_PROJECT_ID = "123";
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-const packageJsonPath = path.resolve(__dirname, "../package.json");
-const PACKAGE_VERSION = JSON.parse(fs.readFileSync(packageJsonPath, "utf8")).version;
-function fileResponse(filePath, content) {
-    return {
-        file_name: filePath.split("/").at(-1),
-        file_path: filePath,
-        encoding: "base64",
-        content: Buffer.from(content, "utf8").toString("base64"),
-    };
-}
-describe("Streamable HTTP concurrent session requests", { timeout: 20_000 }, () => {
-    let mockGitLab;
-    let server;
-    let mcpUrl;
-    before(async () => {
-        const mockPort = await findMockServerPort();
-        mockGitLab = new MockGitLabServer({
-            port: mockPort,
-            validTokens: [MOCK_TOKEN],
-            responseDelay: 100,
-        });
-        mockGitLab.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/repository/files/package.json`, (_req, res) => {
-            res.json(fileResponse("package.json", "package file"));
-        });
-        mockGitLab.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/repository/files/README.md`, (_req, res) => {
-            res.json(fileResponse("README.md", "readme file"));
-        });
-        await mockGitLab.start();
-        const port = await findAvailablePort(3460);
-        server = await launchServer({
-            mode: TransportMode.STREAMABLE_HTTP,
-            port,
-            timeout: 10_000,
-            env: {
-                STREAMABLE_HTTP: "true",
-                REMOTE_AUTHORIZATION: "true",
-                GITLAB_API_URL: `${mockGitLab.getUrl()}/api/v4`,
-            },
-        });
-        mcpUrl = `http://${HOST}:${port}/mcp`;
-    });
-    after(async () => {
-        cleanupServers([server]);
-        if (mockGitLab)
-            await mockGitLab.stop();
-    });
-    test("handles concurrent SDK tool calls with the same Mcp-Session-Id", async () => {
-        const client = new CustomHeaderClient({ Authorization: `Bearer ${MOCK_TOKEN}` });
-        await client.connect(mcpUrl);
-        try {
-            const initialSessionId = client.getSessionId();
-            assert.ok(initialSessionId, "initialize should return Mcp-Session-Id");
-            let timeoutHandle;
-            try {
-                const [packageResult, readmeResult] = await Promise.race([
-                    Promise.all([
-                        client.callTool("get_file_contents", {
-                            project_id: TEST_PROJECT_ID,
-                            file_path: "package.json",
-                            ref: "main",
-                        }),
-                        client.callTool("get_file_contents", {
-                            project_id: TEST_PROJECT_ID,
-                            file_path: "README.md",
-                            ref: "main",
-                        }),
-                    ]),
-                    new Promise((_, reject) => {
-                        timeoutHandle = setTimeout(() => reject(new Error("concurrent tool calls timed out")), 5_000);
-                    }),
-                ]);
-                const packageText = packageResult.content?.[0]?.type === "text" ? packageResult.content[0].text : "";
-                const readmeText = readmeResult.content?.[0]?.type === "text" ? readmeResult.content[0].text : "";
-                assert.strictEqual(client.getSessionId(), initialSessionId, "concurrent calls should reuse the same Mcp-Session-Id");
-                assert.ok(packageText.includes("package file"), packageText);
-                assert.ok(readmeText.includes("readme file"), readmeText);
-            }
-            finally {
-                clearTimeout(timeoutHandle);
-            }
-        }
-        finally {
-            await client.disconnect();
-        }
-    });
-});
-describe("Streamable HTTP health check capacity logging", { timeout: 20_000 }, () => {
-    let mockGitLab;
-    let server;
-    let mcpUrl;
-    let baseUrl;
-    let output = "";
-    before(async () => {
-        const mockPort = await findMockServerPort();
-        mockGitLab = new MockGitLabServer({
-            port: mockPort,
-            validTokens: [MOCK_TOKEN],
-        });
-        await mockGitLab.start();
-        const port = await findAvailablePort(3470);
-        server = await launchServer({
-            mode: TransportMode.STREAMABLE_HTTP,
-            port,
-            timeout: 10_000,
-            env: {
-                STREAMABLE_HTTP: "true",
-                REMOTE_AUTHORIZATION: "true",
-                GITLAB_API_URL: `${mockGitLab.getUrl()}/api/v4`,
-                MAX_SESSIONS: "1",
-            },
-        });
-        server.process.stdout?.on("data", data => {
-            output += data.toString();
-        });
-        server.process.stderr?.on("data", data => {
-            output += data.toString();
-        });
-        baseUrl = `http://${HOST}:${port}`;
-        mcpUrl = `${baseUrl}/mcp`;
-    });
-    after(async () => {
-        cleanupServers([server]);
-        if (mockGitLab)
-            await mockGitLab.stop();
-    });
-    test("reports server version when healthy", async () => {
-        const response = await fetch(`${baseUrl}/health`);
-        const body = (await response.json());
-        assert.strictEqual(response.status, 200);
-        assert.strictEqual(body.status, "healthy");
-        assert.strictEqual(body.version, PACKAGE_VERSION);
-        assert.strictEqual(body.activeSessions, 0);
-    });
-    test("logs active session capacity when health check is degraded", async () => {
-        const client = new CustomHeaderClient({ Authorization: `Bearer ${MOCK_TOKEN}` });
-        await client.connect(mcpUrl);
-        try {
-            const response = await fetch(`${baseUrl}/health`);
-            const body = (await response.json());
-            assert.strictEqual(response.status, 503);
-            assert.strictEqual(body.status, "degraded");
-            assert.strictEqual(body.version, PACKAGE_VERSION);
-            assert.strictEqual(body.activeSessions, 1);
-            assert.strictEqual(body.maxSessions, 1);
-            // ponytail: poll stdout; fixed 100ms sleep flakes under CI jitter
-            const deadline = Date.now() + 2000;
-            while (Date.now() < deadline && !/Health check degraded/.test(output)) {
-                await new Promise(resolve => setTimeout(resolve, 50));
-            }
-            assert.match(output, /Health check degraded/);
-            assert.match(output, /activeSessions.*1/);
-            assert.match(output, /maxSessions.*1/);
-        }
-        finally {
-            await client.disconnect();
-        }
-    });
-});

package/build/test/streamable-http-dns-rebinding.test.js

@@ -1,185 +0,0 @@
-import assert from "node:assert/strict";
-import { spawn } from "node:child_process";
-import http from "node:http";
-import { afterEach, describe, test } from "node:test";
-import * as path from "node:path";
-import { findAvailablePort } from "./utils/server-launcher.js";
-import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server.js";
-const HOST = process.env.HOST || "127.0.0.1";
-const SERVER_PATH = path.resolve(process.cwd(), "build/index.js");
-const TEST_TOKEN = "test-token-123456789012345";
-const running = new Set();
-const mockGitLabServers = [];
-function hostWithPort(host, port) {
-    const normalized = host.trim();
-    if (normalized.includes(":") && !normalized.startsWith("["))
-        return `[${normalized}]:${port}`;
-    return `${normalized}:${port}`;
-}
-function startServer(env, port) {
-    const child = spawn("node", [SERVER_PATH], {
-        env: {
-            ...process.env,
-            GITLAB_API_URL: "https://gitlab.example.com",
-            HOST,
-            PORT: String(port),
-            STREAMABLE_HTTP: "true",
-            REMOTE_AUTHORIZATION: "true",
-            GITLAB_MCP_OAUTH: "false",
-            GITLAB_USE_OAUTH: "false",
-            GITLAB_PERSONAL_ACCESS_TOKEN: "",
-            GITLAB_JOB_TOKEN: "",
-            GITLAB_AUTH_COOKIE_PATH: "",
-            MCP_SERVER_URL: "",
-            GITLAB_OAUTH_APP_ID: "",
-            ...env,
-        },
-        stdio: ["ignore", "pipe", "pipe"],
-    });
-    running.add(child);
-    child.once("exit", () => running.delete(child));
-    return child;
-}
-async function startAuthenticatedServer(env, port) {
-    const mockPort = await findMockServerPort();
-    const mockGitLab = new MockGitLabServer({
-        port: mockPort,
-        validTokens: [TEST_TOKEN],
-    });
-    await mockGitLab.start();
-    mockGitLabServers.push(mockGitLab);
-    startServer({
-        GITLAB_API_URL: `${mockGitLab.getUrl()}/api/v4`,
-        ...env,
-    }, port);
-}
-async function waitForHealth(port, timeoutMs = 5000) {
-    const deadline = Date.now() + timeoutMs;
-    let lastError;
-    while (Date.now() < deadline) {
-        try {
-            const response = await fetch(`http://${hostWithPort(HOST, port)}/health`);
-            if (response.ok)
-                return;
-        }
-        catch (error) {
-            lastError = error;
-        }
-        await new Promise(resolve => setTimeout(resolve, 100));
-    }
-    throw new Error(`server did not become healthy: ${String(lastError)}`);
-}
-function postMcp(port, headers, body = JSON.stringify({
-    jsonrpc: "2.0",
-    id: 1,
-    method: "initialize",
-    params: {
-        protocolVersion: "2025-03-26",
-        capabilities: {},
-        clientInfo: { name: "dns-rebinding-test", version: "1.0.0" },
-    },
-})) {
-    return new Promise((resolve, reject) => {
-        const req = http.request({
-            host: HOST,
-            port,
-            path: "/mcp",
-            method: "POST",
-            headers: {
-                Host: hostWithPort(HOST, port),
-                "Content-Type": "application/json",
-                Accept: "application/json, text/event-stream",
-                "Private-Token": TEST_TOKEN,
-                "Content-Length": Buffer.byteLength(body).toString(),
-                ...headers,
-            },
-        }, res => {
-            let responseBody = "";
-            res.setEncoding("utf8");
-            res.on("data", chunk => {
-                responseBody += chunk;
-            });
-            res.on("end", () => resolve({ status: res.statusCode ?? 0, body: responseBody }));
-        });
-        req.on("error", reject);
-        req.end(body);
-    });
-}
-afterEach(async () => {
-    for (const child of running) {
-        if (!child.killed)
-            child.kill("SIGTERM");
-    }
-    running.clear();
-    while (mockGitLabServers.length > 0) {
-        const mockGitLab = mockGitLabServers.pop();
-        if (mockGitLab) {
-            await mockGitLab.stop();
-        }
-    }
-});
-describe("Streamable HTTP DNS rebinding protection", () => {
-    test("rejects forged Host and Origin headers before handling /mcp", async () => {
-        const port = await findAvailablePort(4700);
-        await startAuthenticatedServer({}, port);
-        await waitForHealth(port);
-        const validHost = hostWithPort(HOST, port);
-        const badJson = await postMcp(port, {
-            Host: "attacker.example.test",
-            Origin: `http://${validHost}`,
-        }, "{");
-        assert.equal(badJson.status, 403);
-        assert.match(badJson.body, /Host header is not allowed/);
-        assert.match(badJson.body, /MCP_ALLOWED_HOSTS/);
-        const badHost = await postMcp(port, {
-            Host: "attacker.example.test",
-            Origin: `http://${validHost}`,
-        });
-        assert.equal(badHost.status, 403);
-        assert.match(badHost.body, /Host header is not allowed/);
-        assert.match(badHost.body, /MCP_ALLOWED_HOSTS/);
-        const badOrigin = await postMcp(port, {
-            Host: validHost,
-            Origin: "https://attacker.example.test",
-        });
-        assert.equal(badOrigin.status, 403);
-        assert.match(badOrigin.body, /Origin header is not allowed/);
-        assert.match(badOrigin.body, /MCP_ALLOWED_ORIGINS/);
-        const ok = await postMcp(port, { Host: validHost });
-        assert.equal(ok.status, 200);
-    });
-    test("allows loopback Host and Origin on any port (Docker port mapping)", async () => {
-        const port = await findAvailablePort(4720);
-        await startAuthenticatedServer({}, port);
-        await waitForHealth(port);
-        // e.g. docker run -p 3333:3002 -> client sends Host: localhost:3333
-        const remappedHost = await postMcp(port, { Host: `localhost:${port + 1000}` });
-        assert.equal(remappedHost.status, 200);
-        const remappedIpv4 = await postMcp(port, { Host: `127.0.0.1:${port + 1000}` });
-        assert.equal(remappedIpv4.status, 200);
-        const remappedOrigin = await postMcp(port, {
-            Host: `localhost:${port + 1000}`,
-            Origin: `http://localhost:${port + 1000}`,
-        });
-        assert.equal(remappedOrigin.status, 200);
-        const bareLoopback = await postMcp(port, { Host: "localhost" });
-        assert.equal(bareLoopback.status, 200);
-        const loopbackHostBadOrigin = await postMcp(port, {
-            Host: `localhost:${port + 1000}`,
-            Origin: "http://attacker.example.test",
-        });
-        assert.equal(loopbackHostBadOrigin.status, 403);
-        assert.match(loopbackHostBadOrigin.body, /Origin header is not allowed/);
-        assert.match(loopbackHostBadOrigin.body, /MCP_ALLOWED_ORIGINS/);
-    });
-    test("allows the configured MCP_SERVER_URL host and origin", async () => {
-        const port = await findAvailablePort(4710);
-        await startAuthenticatedServer({ MCP_SERVER_URL: "https://mcp.example.test" }, port);
-        await waitForHealth(port);
-        const ok = await postMcp(port, {
-            Host: "mcp.example.test",
-            Origin: "https://mcp.example.test",
-        });
-        assert.equal(ok.status, 200);
-    });
-});