@zereight/mcp-gitlab 2.1.69 → 2.2.0

package/build/test/streamable-http-unauthenticated-discovery.test.js

@@ -1,207 +0,0 @@
-import { after, describe, test } from "node:test";
-import assert from "node:assert";
-import { cleanupServers, findAvailablePort, HOST, launchServer, TransportMode, } from "./utils/server-launcher.js";
-async function rawMcpRequest(url, body, headers = {}) {
-    const response = await fetch(url, {
-        method: "POST",
-        headers: {
-            "Content-Type": "application/json",
-            Accept: "application/json, text/event-stream",
-            ...headers,
-        },
-        body: JSON.stringify(body),
-    });
-    const sessionId = response.headers.get("mcp-session-id");
-    if (response.status === 202 || response.status === 204) {
-        return { status: response.status, data: null, sessionId, text: "" };
-    }
-    const text = await response.text();
-    const contentType = response.headers.get("content-type") ?? "";
-    if (contentType.includes("text/event-stream")) {
-        const dataLines = text
-            .split("\n")
-            .filter(line => line.startsWith("data: "))
-            .map(line => line.slice(6));
-        return {
-            status: response.status,
-            data: dataLines.length > 0 ? JSON.parse(dataLines.at(-1)) : null,
-            sessionId,
-            text,
-        };
-    }
-    return {
-        status: response.status,
-        data: text ? JSON.parse(text) : null,
-        sessionId,
-        text,
-    };
-}
-const initializeBody = {
-    jsonrpc: "2.0",
-    id: 1,
-    method: "initialize",
-    params: {
-        protocolVersion: "2025-03-26",
-        capabilities: {},
-        clientInfo: { name: "unauth-discovery-test", version: "1.0.0" },
-    },
-};
-async function initialize(mcpUrl) {
-    const response = await rawMcpRequest(mcpUrl, initializeBody);
-    assert.strictEqual(response.status, 200, response.text);
-    assert.ok(response.sessionId, "initialize should return Mcp-Session-Id");
-    return response.sessionId;
-}
-let portOffset = 0;
-async function launchRemoteAuthServer(extraEnv = {}) {
-    // Keep above remote-auth-simple-test timeout suite (3500+) to avoid parallel bind races.
-    const port = await findAvailablePort(3600 + portOffset++ * 10);
-    const server = await launchServer({
-        mode: TransportMode.STREAMABLE_HTTP,
-        port,
-        timeout: 10_000,
-        env: {
-            STREAMABLE_HTTP: "true",
-            REMOTE_AUTHORIZATION: "true",
-            GITLAB_API_URL: "https://gitlab.example.com/api/v4",
-            ...extraEnv,
-        },
-    });
-    return { server, mcpUrl: `http://${HOST}:${port}/mcp` };
-}
-describe("Streamable HTTP unauthenticated tool discovery", { timeout: 20_000 }, () => {
-    let servers = [];
-    after(() => {
-        cleanupServers(servers);
-        servers = [];
-    });
-    test("keeps unauthenticated initialize blocked by default", async () => {
-        const { server, mcpUrl } = await launchRemoteAuthServer();
-        servers.push(server);
-        const initResponse = await rawMcpRequest(mcpUrl, initializeBody);
-        assert.strictEqual(initResponse.status, 401, initResponse.text);
-        assert.strictEqual(initResponse.sessionId, null);
-    });
-    test("rejects invalid auth headers even when unauthenticated discovery is enabled", async () => {
-        const { server, mcpUrl } = await launchRemoteAuthServer({
-            GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY: "true",
-        });
-        servers.push(server);
-        const initResponse = await rawMcpRequest(mcpUrl, initializeBody, {
-            Authorization: "Bearer definitely-not-valid",
-        });
-        assert.strictEqual(initResponse.status, 401, initResponse.text);
-        assert.strictEqual(initResponse.sessionId, null);
-    });
-    test("allows unauthenticated tools/list when explicitly enabled", async () => {
-        const { server, mcpUrl } = await launchRemoteAuthServer({
-            GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY: "true",
-        });
-        servers.push(server);
-        const sessionId = await initialize(mcpUrl);
-        const initialized = await rawMcpRequest(mcpUrl, { jsonrpc: "2.0", method: "notifications/initialized" }, { "mcp-session-id": sessionId });
-        assert.ok([200, 202, 204].includes(initialized.status), initialized.text);
-        const listResponse = await rawMcpRequest(mcpUrl, { jsonrpc: "2.0", id: 2, method: "tools/list", params: {} }, { "mcp-session-id": sessionId });
-        assert.strictEqual(listResponse.status, 200, listResponse.text);
-        assert.ok(Array.isArray(listResponse.data.result?.tools), "tools/list should return tools");
-        assert.ok(listResponse.data.result.tools.length > 0, "tools/list should not be empty");
-    });
-    test("allows unauthenticated server/discover in individual and batch requests", async () => {
-        const { server, mcpUrl } = await launchRemoteAuthServer({
-            GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY: "true",
-        });
-        servers.push(server);
-        const preInitDiscover = await rawMcpRequest(mcpUrl, {
-            jsonrpc: "2.0",
-            id: 10,
-            method: "server/discover",
-            params: {},
-        });
-        assert.strictEqual(preInitDiscover.status, 400, preInitDiscover.text);
-        assert.match(preInitDiscover.data?.error?.message ?? "", /Server not initialized/i, "server/discover should pass the auth gate before MCP initialization errors");
-        const sessionId = await initialize(mcpUrl);
-        const initialized = await rawMcpRequest(mcpUrl, { jsonrpc: "2.0", method: "notifications/initialized" }, { "mcp-session-id": sessionId });
-        assert.ok([200, 202, 204].includes(initialized.status), initialized.text);
-        const discoverResponse = await rawMcpRequest(mcpUrl, { jsonrpc: "2.0", id: 11, method: "server/discover", params: {} }, { "mcp-session-id": sessionId });
-        assert.strictEqual(discoverResponse.status, 200, discoverResponse.text);
-        assert.strictEqual(discoverResponse.data?.id, 11);
-        assert.strictEqual(discoverResponse.data?.error?.code, -32601);
-        assert.match(discoverResponse.data?.error?.message ?? "", /Method not found/i);
-        const batchResponse = await rawMcpRequest(mcpUrl, [
-            { jsonrpc: "2.0", id: 12, method: "server/discover", params: {} },
-            { jsonrpc: "2.0", id: 13, method: "tools/list", params: {} },
-        ], { "mcp-session-id": sessionId });
-        assert.strictEqual(batchResponse.status, 200, batchResponse.text);
-        assert.ok(Array.isArray(batchResponse.data.result?.tools), "batch tools/list should return tools");
-        assert.ok(batchResponse.data.result.tools.length > 0, "batch tools/list should not be empty");
-    });
-    test("rejects unauthenticated discovery batch when tools/call is included", async () => {
-        const { server, mcpUrl } = await launchRemoteAuthServer({
-            GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY: "true",
-        });
-        servers.push(server);
-        const response = await rawMcpRequest(mcpUrl, [
-            { jsonrpc: "2.0", id: 20, method: "server/discover", params: {} },
-            {
-                jsonrpc: "2.0",
-                id: 21,
-                method: "tools/call",
-                params: {
-                    name: "get_project",
-                    arguments: { project_id: "123" },
-                },
-            },
-        ]);
-        assert.strictEqual(response.status, 401, response.text);
-    });
-    test("expires unauthenticated discovery sessions and frees capacity", async () => {
-        const { server, mcpUrl } = await launchRemoteAuthServer({
-            GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY: "true",
-            MAX_SESSIONS: "1",
-            MAX_REQUESTS_PER_MINUTE: "1",
-            MCP_TRUST_PROXY: "true",
-            SESSION_TIMEOUT_SECONDS: "1",
-        });
-        servers.push(server);
-        const expiredSessionId = await initialize(mcpUrl);
-        await new Promise(resolve => setTimeout(resolve, 2_000));
-        const expiredResponse = await rawMcpRequest(mcpUrl, { jsonrpc: "2.0", id: 2, method: "tools/list", params: {} }, { "mcp-session-id": expiredSessionId });
-        assert.strictEqual(expiredResponse.status, 404, expiredResponse.text);
-        assert.deepStrictEqual(expiredResponse.data, { error: "Session not found" });
-        const healthResponse = await fetch(mcpUrl.replace("/mcp", "/health"));
-        assert.strictEqual(healthResponse.status, 200);
-        const nextSession = await rawMcpRequest(mcpUrl, initializeBody, {
-            "x-forwarded-for": "192.0.2.10",
-        });
-        assert.strictEqual(nextSession.status, 200, nextSession.text);
-        assert.ok(nextSession.sessionId, "expired discovery session should free capacity");
-    });
-    test("rejects inherited object-property names as unknown session IDs", async () => {
-        const { server, mcpUrl } = await launchRemoteAuthServer({
-            GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY: "true",
-        });
-        servers.push(server);
-        for (const sessionId of ["constructor", "toString", "__proto__"]) {
-            const response = await rawMcpRequest(mcpUrl, { jsonrpc: "2.0", id: 2, method: "tools/list", params: {} }, { "mcp-session-id": sessionId });
-            assert.strictEqual(response.status, 404, `${sessionId}: ${response.text}`);
-            assert.deepStrictEqual(response.data, { error: "Session not found" });
-        }
-    });
-    test("still blocks unauthenticated tools/call when discovery is enabled", async () => {
-        const { server, mcpUrl } = await launchRemoteAuthServer({
-            GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY: "true",
-        });
-        servers.push(server);
-        const sessionId = await initialize(mcpUrl);
-        const callResponse = await rawMcpRequest(mcpUrl, {
-            jsonrpc: "2.0",
-            id: 3,
-            method: "tools/call",
-            params: {
-                name: "get_project",
-                arguments: { project_id: "123" },
-            },
-        }, { "mcp-session-id": sessionId });
-        assert.strictEqual(callResponse.status, 401, callResponse.text);
-    });
-});

package/build/test/test-all-transport-server.js

@@ -1,255 +0,0 @@
-/**
- * GitLab MCP Server Transport Tests
- * Tests all three transport modes: stdio, SSE, and streamable-http
- */
-import * as path from 'path';
-import { describe, test, after, before } from 'node:test';
-import assert from 'node:assert';
-import { launchServer, findAvailablePort, cleanupServers, TransportMode, checkHealthEndpoint, HOST } from './utils/server-launcher.js';
-import { StdioTestClient } from './clients/stdio-client.js';
-import { SSETestClient } from './clients/sse-client.js';
-import { StreamableHTTPTestClient } from './clients/streamable-http-client.js';
-console.log('🚀 GitLab MCP Server Tests');
-console.log('');
-// Configuration check
-const GITLAB_API_URL = process.env.GITLAB_API_URL || "https://gitlab.com";
-const GITLAB_TOKEN = process.env.GITLAB_TOKEN_TEST || process.env.GITLAB_TOKEN;
-const TEST_PROJECT_ID = process.env.TEST_PROJECT_ID;
-console.log('🔧 Test Configuration:');
-console.log(`  GitLab URL: ${GITLAB_API_URL}`);
-console.log(`  Token: ${GITLAB_TOKEN ? '✅ Provided' : '❌ Missing'}`);
-console.log(`  Project ID: ${TEST_PROJECT_ID || '❌ Missing'}`);
-// Validate required configuration
-if (!GITLAB_TOKEN) {
-    console.error('❌ Error: GITLAB_TOKEN_TEST or GITLAB_TOKEN environment variable is required for testing');
-    console.error('   Set one of these variables to your GitLab API token');
-    process.exit(1);
-}
-if (!TEST_PROJECT_ID) {
-    console.error('❌ Error: TEST_PROJECT_ID environment variable is required for testing');
-    console.error('   Set this variable to a valid GitLab project ID (e.g., "123" or "group/project")');
-    process.exit(1);
-}
-console.log('✅ Configuration validated');
-console.log('');
-let servers = [];
-// Cleanup function for all tests
-const cleanup = () => {
-    cleanupServers(servers);
-    servers = [];
-};
-// Handle process termination
-process.on('SIGINT', cleanup);
-process.on('SIGTERM', cleanup);
-process.on('exit', cleanup);
-describe('GitLab MCP Server - Stdio Transport', () => {
-    let client;
-    // Prepare environment variables for stdio server
-    const stdioEnv = {
-        GITLAB_PERSONAL_ACCESS_TOKEN: GITLAB_TOKEN,
-        GITLAB_API_URL: `${GITLAB_API_URL}/api/v4`,
-        GITLAB_PROJECT_ID: TEST_PROJECT_ID,
-        GITLAB_READ_ONLY_MODE: 'true',
-        // Explicitly disable other transport modes to ensure stdio mode
-        SSE: 'false',
-        STREAMABLE_HTTP: 'false'
-    };
-    before(async () => {
-        client = new StdioTestClient();
-        const serverPath = path.resolve(process.cwd(), 'build/index.js');
-        await client.connect(serverPath, stdioEnv);
-        assert.ok(client.isConnected, 'Client should be connected');
-        console.log('Client connected to stdio server');
-    });
-    after(async () => {
-        if (client && client.isConnected) {
-            await client.disconnect();
-        }
-    });
-    test('should list tools via stdio', async () => {
-        const tools = await client.listTools();
-        assert.ok(tools !== null && tools !== undefined, 'Tools response should be defined');
-        assert.ok('tools' in tools, 'Response should have tools property');
-        assert.ok(Array.isArray(tools.tools) && tools.tools.length > 0, 'Tools array should not be empty');
-        // Check for specific GitLab tools with proper typing
-        const toolNames = tools.tools.map(tool => tool.name);
-        assert.ok(toolNames.includes('list_merge_requests'), 'Should have list_merge_requests tool');
-        assert.ok(toolNames.includes('get_project'), 'Should have get_project tool');
-        // Verify tools have proper structure
-        const gitlabTools = tools.tools.filter(tool => tool.name === 'list_merge_requests' || tool.name === 'get_project');
-        assert.ok(gitlabTools.length >= 2, 'Should have at least 2 GitLab tools');
-        for (const tool of gitlabTools) {
-            assert.ok(tool.description !== null && tool.description !== undefined, `Tool ${tool.name} should have description`);
-            assert.ok('inputSchema' in tool, `Tool ${tool.name} should have input schema`);
-        }
-    });
-    test('should call list_merge_requests tool via stdio', async () => {
-        const result = await client.callTool('list_merge_requests', {
-            project_id: TEST_PROJECT_ID
-        });
-        assert.ok(result !== null && result !== undefined, 'Tool call result should be defined');
-        assert.ok('content' in result, 'Result should have content property');
-    });
-    test('should call get_project tool via stdio', async () => {
-        const result = await client.callTool('get_project', {
-            project_id: TEST_PROJECT_ID
-        });
-        // Verify proper CallToolResult structure
-        assert.ok(result !== null && result !== undefined, 'Tool call result should be defined');
-        assert.ok('content' in result, 'Result should have content property');
-        assert.ok(Array.isArray(result.content), 'Content should be an array');
-        assert.ok(result.content.length > 0, 'Content array should not be empty');
-        // Check content structure
-        const firstContent = result.content[0];
-        assert.ok(firstContent !== null && firstContent !== undefined, 'First content item should be defined');
-        assert.ok('type' in firstContent, 'Content item should have type');
-        assert.strictEqual(firstContent.type, 'text', 'Content type should be text');
-        assert.ok('text' in firstContent, 'Text content should have text property');
-        // Verify it's valid JSON containing project info
-        const projectData = JSON.parse(firstContent.text);
-        assert.ok(projectData !== null && projectData !== undefined, 'Project data should be parseable JSON');
-        assert.ok('id' in projectData, 'Project should have id');
-        assert.ok('name' in projectData, 'Project should have name');
-    });
-});
-describe('GitLab MCP Server - SSE Transport', () => {
-    let server;
-    let client;
-    let port;
-    before(async () => {
-        port = await findAvailablePort();
-        server = await launchServer({
-            mode: TransportMode.SSE,
-            port,
-            timeout: 3000,
-            env: {
-                SSE: 'true',
-                STREAMABLE_HTTP: 'false'
-            }
-        });
-        servers.push(server);
-        // Verify server started successfully
-        assert.ok(server.process.pid !== undefined, 'Server process should have PID');
-        assert.strictEqual(server.mode, TransportMode.SSE, 'Server mode should be SSE');
-        assert.strictEqual(server.port, port, 'Server should use correct port');
-        // Verify health check
-        const health = await checkHealthEndpoint(server.port);
-        assert.strictEqual(health.status, 'healthy', 'Health status should be healthy');
-        assert.strictEqual(health.transport, 'sse', 'Transport should be SSE');
-        assert.ok(health.version !== null && health.version !== undefined, 'Version should be defined');
-        // Create and connect client
-        client = new SSETestClient();
-        await client.connect(`http://${HOST}:${port}/sse`);
-        assert.ok(client.isConnected, 'Client should be connected');
-        assert.ok(await client.testConnection(), 'Connection test should pass');
-        console.log('Client connected to SSE server');
-    });
-    after(async () => {
-        if (client && client.isConnected) {
-            await client.disconnect();
-        }
-        cleanup();
-        console.log('Client disconnected from SSE server');
-    });
-    test('should list tools via SSE', async () => {
-        const tools = await client.listTools();
-        assert.ok(tools !== null && tools !== undefined, 'Tools response should be defined');
-        assert.ok('tools' in tools, 'Response should have tools property');
-        assert.ok(Array.isArray(tools.tools) && tools.tools.length > 0, 'Tools array should not be empty');
-        // Check for specific GitLab tools
-        const toolNames = tools.tools.map((tool) => tool.name);
-        assert.ok(toolNames.includes('list_merge_requests'), 'Should have list_merge_requests tool');
-        assert.ok(toolNames.includes('get_project'), 'Should have get_project tool');
-    });
-    test('should call list_merge_requests tool via SSE', async () => {
-        const result = await client.callTool('list_merge_requests', {
-            project_id: TEST_PROJECT_ID
-        });
-        assert.ok(result !== null && result !== undefined, 'Tool call result should be defined');
-        assert.ok('content' in result, 'Result should have content property');
-    });
-    test('should call get_project tool via SSE', async () => {
-        const result = await client.callTool('get_project', {
-            project_id: TEST_PROJECT_ID
-        });
-        assert.ok(result !== null && result !== undefined, 'Tool call result should be defined');
-        assert.ok('content' in result, 'Result should have content property');
-    });
-});
-describe('GitLab MCP Server - Streamable HTTP Transport', () => {
-    let server;
-    let client;
-    let port;
-    before(async () => {
-        port = await findAvailablePort();
-        server = await launchServer({
-            mode: TransportMode.STREAMABLE_HTTP,
-            port,
-            timeout: 3000,
-            env: {
-                SSE: 'false',
-                STREAMABLE_HTTP: 'true'
-            }
-        });
-        servers.push(server);
-        // Verify server started successfully
-        assert.ok(server.process.pid !== undefined, 'Server process should have PID');
-        assert.strictEqual(server.mode, TransportMode.STREAMABLE_HTTP, 'Server mode should be streamable-http');
-        assert.strictEqual(server.port, port, 'Server should use correct port');
-        // Verify health check
-        const health = await checkHealthEndpoint(server.port);
-        assert.strictEqual(health.status, 'healthy', 'Health status should be healthy');
-        assert.strictEqual(health.transport, 'streamable-http', 'Transport should be streamable-http');
-        assert.ok(health.version !== null && health.version !== undefined, 'Version should be defined');
-        assert.ok(health.activeSessions !== null && health.activeSessions !== undefined, 'Active sessions should be defined');
-        // Create and connect client
-        client = new StreamableHTTPTestClient();
-        await client.connect(`http://${HOST}:${port}/mcp`);
-        assert.ok(client.isConnected, 'Client should be connected');
-        assert.ok(await client.testConnection(), 'Connection test should pass');
-        console.log('Client connected to Streamable HTTP server');
-    });
-    after(async () => {
-        if (client && client.isConnected) {
-            await client.disconnect();
-        }
-        cleanup();
-        console.log('Client disconnected from Streamable HTTP server');
-    });
-    test('should return 406 for GET /mcp without Accept: text/event-stream', async () => {
-        const response = await fetch(`http://${HOST}:${port}/mcp`);
-        assert.strictEqual(response.status, 406, 'GET /mcp should respond with 406 when Accept header is missing text/event-stream');
-        const body = await response.json();
-        assert.strictEqual(body?.error, 'Not Acceptable');
-    });
-    test('should return 405 for unsupported HTTP methods like PUT /mcp', async () => {
-        const response = await fetch(`http://${HOST}:${port}/mcp`, { method: 'PUT' });
-        assert.strictEqual(response.status, 405, 'PUT /mcp should respond with 405');
-        const allowHeader = response.headers.get('allow');
-        assert.ok(allowHeader?.includes('GET') && allowHeader?.includes('POST') && allowHeader?.includes('DELETE'), 'Allow header should contain GET, POST, DELETE');
-    });
-    test('should list tools via Streamable HTTP', async () => {
-        const tools = await client.listTools();
-        assert.ok(tools !== null && tools !== undefined, 'Tools response should be defined');
-        assert.ok('tools' in tools, 'Response should have tools property');
-        assert.ok(Array.isArray(tools.tools) && tools.tools.length > 0, 'Tools array should not be empty');
-        // Check for specific GitLab tools
-        const toolNames = tools.tools.map((tool) => tool.name);
-        assert.ok(toolNames.includes('list_merge_requests'), 'Should have list_merge_requests tool');
-        assert.ok(toolNames.includes('get_project'), 'Should have get_project tool');
-    });
-    test('should call list_merge_requests tool via Streamable HTTP', async () => {
-        const result = await client.callTool('list_merge_requests', {
-            project_id: TEST_PROJECT_ID
-        });
-        assert.ok(result !== null && result !== undefined, 'Tool call result should be defined');
-        assert.ok('content' in result, 'Result should have content property');
-    });
-    test('should call get_project tool via Streamable HTTP', async () => {
-        const result = await client.callTool('get_project', {
-            project_id: TEST_PROJECT_ID
-        });
-        assert.ok(result !== null && result !== undefined, 'Tool call result should be defined');
-        assert.ok('content' in result, 'Result should have content property');
-    });
-});

package/build/test/test-auth-retry.js

@@ -1,195 +0,0 @@
-/**
- * Auth Retry Tests
- * Unit tests for headersToPlainObject, isNonReplayableBody, and wrapWithAuthRetry.
- *
- * These are pure-function / DI-based tests — no env vars or external services needed.
- */
-import { describe, test } from "node:test";
-import assert from "node:assert";
-import { Readable } from "node:stream";
-import { Response } from "undici";
-import { headersToPlainObject, isNonReplayableBody, wrapWithAuthRetry, } from "../auth-retry.js";
-function mockFetch(status) {
-    return async () => new Response("", { status });
-}
-function mockFetchThenRetry() {
-    let callCount = 0;
-    return async () => {
-        callCount++;
-        return new Response("", { status: callCount === 1 ? 401 : 200 });
-    };
-}
-function makeConfig(overrides) {
-    return {
-        isOAuthEnabled: () => true,
-        refreshToken: async () => "new-token",
-        onTokenRefreshed: () => { },
-        buildAuthHeaders: () => ({ Authorization: "Bearer new-token" }),
-        ...overrides,
-    };
-}
-describe("headersToPlainObject", () => {
-    test("null returns empty object", () => {
-        assert.deepStrictEqual(headersToPlainObject(null), {});
-    });
-    test("undefined returns empty object", () => {
-        assert.deepStrictEqual(headersToPlainObject(undefined), {});
-    });
-    test("plain object passed through", () => {
-        const obj = { "Content-Type": "application/json", Accept: "text/html" };
-        assert.deepStrictEqual(headersToPlainObject(obj), obj);
-    });
-    test("Headers instance normalized", () => {
-        const h = new Headers();
-        h.set("x-custom", "value1");
-        h.set("authorization", "Bearer tok");
-        const result = headersToPlainObject(h);
-        assert.strictEqual(result["x-custom"], "value1");
-        assert.strictEqual(result["authorization"], "Bearer tok");
-    });
-    test("array of tuples normalized", () => {
-        const arr = [
-            ["x-foo", "bar"],
-            ["x-baz", "qux"],
-        ];
-        assert.deepStrictEqual(headersToPlainObject(arr), {
-            "x-foo": "bar",
-            "x-baz": "qux",
-        });
-    });
-});
-describe("isNonReplayableBody", () => {
-    test("null returns false", () => {
-        assert.strictEqual(isNonReplayableBody(null), false);
-    });
-    test("undefined returns false", () => {
-        assert.strictEqual(isNonReplayableBody(undefined), false);
-    });
-    test("empty string returns false", () => {
-        assert.strictEqual(isNonReplayableBody(""), false);
-    });
-    test("plain string returns false", () => {
-        assert.strictEqual(isNonReplayableBody("hello"), false);
-    });
-    test("object with .pipe() returns true (stream-like)", () => {
-        assert.strictEqual(isNonReplayableBody({ pipe: () => { } }), true);
-    });
-    test("object with .read() returns true (stream-like)", () => {
-        assert.strictEqual(isNonReplayableBody({ read: () => { } }), true);
-    });
-    test("Web ReadableStream returns true", () => {
-        const stream = new ReadableStream({
-            start(controller) {
-                controller.close();
-            },
-        });
-        assert.strictEqual(isNonReplayableBody(stream), true);
-    });
-});
-describe("wrapWithAuthRetry", () => {
-    test("non-401 response passes through unchanged", async () => {
-        const wrapped = wrapWithAuthRetry(mockFetch(200), makeConfig());
-        const res = await wrapped("http://example.com");
-        assert.strictEqual(res.status, 200);
-    });
-    test("401 when OAuth disabled passes through unchanged", async () => {
-        const config = makeConfig({ isOAuthEnabled: () => false });
-        const wrapped = wrapWithAuthRetry(mockFetch(401), config);
-        const res = await wrapped("http://example.com");
-        assert.strictEqual(res.status, 401);
-    });
-    test("401 with OAuth enabled triggers refresh and retry", async () => {
-        let refreshCalled = false;
-        let tokenSet = null;
-        const config = makeConfig({
-            refreshToken: async () => {
-                refreshCalled = true;
-                return "refreshed-token";
-            },
-            onTokenRefreshed: (token) => {
-                tokenSet = token;
-            },
-            buildAuthHeaders: () => ({ Authorization: "Bearer refreshed-token" }),
-        });
-        const base = mockFetchThenRetry();
-        const wrapped = wrapWithAuthRetry(base, config);
-        const res = await wrapped("http://example.com");
-        assert.strictEqual(res.status, 200);
-        assert.strictEqual(refreshCalled, true);
-        assert.strictEqual(tokenSet, "refreshed-token");
-    });
-    test("401 with non-replayable body skips retry", async () => {
-        let refreshCalled = false;
-        const config = makeConfig({
-            refreshToken: async () => {
-                refreshCalled = true;
-                return "tok";
-            },
-        });
-        const wrapped = wrapWithAuthRetry(mockFetch(401), config);
-        const res = await wrapped("http://example.com", {
-            body: Readable.from([]),
-            duplex: "half",
-        });
-        assert.strictEqual(res.status, 401);
-        assert.strictEqual(refreshCalled, false);
-    });
-    test("401 with Web ReadableStream body skips retry", async () => {
-        let refreshCalled = false;
-        const config = makeConfig({
-            refreshToken: async () => {
-                refreshCalled = true;
-                return "tok";
-            },
-        });
-        const stream = new ReadableStream({
-            start(controller) {
-                controller.close();
-            },
-        });
-        const wrapped = wrapWithAuthRetry(mockFetch(401), config);
-        const res = await wrapped("http://example.com", {
-            body: stream,
-            duplex: "half",
-        });
-        assert.strictEqual(res.status, 401);
-        assert.strictEqual(refreshCalled, false);
-    });
-    test("concurrent 401s only trigger one refresh (stampede test)", async () => {
-        let refreshCount = 0;
-        let resolveRefresh = () => { };
-        const config = makeConfig({
-            refreshToken: () => {
-                refreshCount++;
-                return new Promise(resolve => {
-                    resolveRefresh = resolve;
-                });
-            },
-            buildAuthHeaders: () => ({ Authorization: "Bearer stamped" }),
-        });
-        let callCount = 0;
-        const base = async () => {
-            callCount++;
-            return new Response("", { status: callCount <= 2 ? 401 : 200 });
-        };
-        const wrapped = wrapWithAuthRetry(base, config);
-        const p1 = wrapped("http://example.com/a");
-        const p2 = wrapped("http://example.com/b");
-        await new Promise(r => setTimeout(r, 10));
-        resolveRefresh("stamped-token");
-        const [r1, r2] = await Promise.all([p1, p2]);
-        assert.strictEqual(r1.status, 200);
-        assert.strictEqual(r2.status, 200);
-        assert.strictEqual(refreshCount, 1, "refresh should be called exactly once");
-    });
-    test("token refresh failure returns original 401 response", async () => {
-        const config = makeConfig({
-            refreshToken: async () => {
-                throw new Error("refresh exploded");
-            },
-        });
-        const wrapped = wrapWithAuthRetry(mockFetch(401), config);
-        const res = await wrapped("http://example.com");
-        assert.strictEqual(res.status, 401);
-    });
-});