@zereight/mcp-gitlab 2.1.70 → 2.2.0

package/build/test/utils/server-launcher.js

@@ -1,231 +0,0 @@
-/**
- * Server launcher utility for testing different transport modes
- * Manages server processes and provides clean shutdown
- */
-import { spawn } from "child_process";
-import * as path from "path";
-export const HOST = process.env.HOST || "127.0.0.1";
-export var TransportMode;
-(function (TransportMode) {
-    TransportMode["STDIO"] = "stdio";
-    TransportMode["SSE"] = "sse";
-    TransportMode["STREAMABLE_HTTP"] = "streamable-http";
-})(TransportMode || (TransportMode = {}));
-/**
- * Launch a server with specified configuration
- */
-export async function launchServer(config) {
-    console.log("Launcher: launchServer function entered.");
-    const { mode, port = 3002, env = {}, timeout = 3000 } = config;
-    // Prepare environment variables based on transport mode
-    // Use same configuration pattern as existing validate-api.js
-    const GITLAB_API_URL = process.env.GITLAB_API_URL || "https://gitlab.com";
-    const GITLAB_TOKEN = process.env.GITLAB_TOKEN_TEST || process.env.GITLAB_TOKEN;
-    const TEST_PROJECT_ID = process.env.TEST_PROJECT_ID;
-    // Check which auth modes are active
-    const isRemoteAuth = env.REMOTE_AUTHORIZATION === "true";
-    const isMcpOAuth = env.GITLAB_MCP_OAUTH === "true";
-    // Both REMOTE_AUTHORIZATION and GITLAB_MCP_OAUTH manage tokens at the HTTP layer;
-    // neither requires a pre-configured GITLAB_TOKEN on the server process.
-    const isServerManagedAuth = isRemoteAuth || isMcpOAuth;
-    // Validate that we have required configuration (unless using a server-managed auth mode)
-    if (!GITLAB_TOKEN && !isServerManagedAuth) {
-        throw new Error("GITLAB_TOKEN_TEST or GITLAB_TOKEN environment variable is required for server testing");
-    }
-    if (!TEST_PROJECT_ID && !isServerManagedAuth && env.ENABLE_DYNAMIC_API_URL !== "true") {
-        throw new Error("TEST_PROJECT_ID environment variable is required for server testing");
-    }
-    const serverEnv = {
-        ...process.env,
-        ...env,
-    };
-    // Only set GITLAB_PERSONAL_ACCESS_TOKEN if not using a server-managed auth mode
-    if (!isServerManagedAuth && GITLAB_TOKEN) {
-        serverEnv.GITLAB_PERSONAL_ACCESS_TOKEN = GITLAB_TOKEN;
-    }
-    // Set transport-specific environment variables
-    switch (mode) {
-        case TransportMode.SSE:
-            serverEnv.SSE = "true";
-            serverEnv.PORT = port.toString();
-            break;
-        case TransportMode.STREAMABLE_HTTP:
-            serverEnv.STREAMABLE_HTTP = "true";
-            serverEnv.PORT = port.toString();
-            break;
-        case TransportMode.STDIO:
-            // Stdio mode doesn't need port configuration - uses process communication
-            throw new Error(`${TransportMode.STDIO} mode is not supported for server testing, because it uses process communication.`);
-    }
-    const serverPath = path.resolve(process.cwd(), "build/index.js");
-    console.log("Launcher: Spawning server process", { mode, port });
-    const serverProcess = spawn("node", [serverPath], {
-        env: serverEnv,
-        stdio: ["pipe", "pipe", "pipe"],
-        shell: false,
-        detached: false,
-    });
-    console.log(`Launcher: Server process spawned with PID: ${serverProcess.pid}`);
-    console.log("Launcher: Server process spawned.");
-    // Wait for server to start
-    await waitForServerStart(serverProcess, mode, port, timeout);
-    const instance = {
-        process: serverProcess,
-        port: port,
-        mode,
-        kill: () => {
-            if (!serverProcess.killed) {
-                serverProcess.kill("SIGTERM");
-                // Force kill if not terminated within 5 seconds
-                const forceKillTimer = setTimeout(() => {
-                    if (!serverProcess.killed) {
-                        serverProcess.kill("SIGKILL");
-                    }
-                }, 5000);
-                forceKillTimer.unref();
-            }
-        },
-    };
-    return instance;
-}
-/**
- * Wait for server to start based on transport mode
- */
-async function waitForServerStart(process, mode, port, timeout) {
-    return new Promise((resolve, reject) => {
-        const timer = setTimeout(() => {
-            reject(new Error(`Server failed to start within ${timeout}ms for mode ${mode}`));
-        }, timeout);
-        let outputBuffer = "";
-        const onData = (data) => {
-            try {
-                const output = data.toString();
-                console.log(`[Server Output]: ${output}`);
-                outputBuffer += output;
-            }
-            catch (e) {
-                console.error("Error converting server output to string:", e);
-                reject(e);
-                return;
-            }
-            // Check for server start messages
-            const startMessages = [
-                "Starting GitLab MCP Server with stdio transport",
-                "Starting GitLab MCP Server with SSE transport",
-                "Starting GitLab MCP Server with Streamable HTTP transport",
-                "GitLab MCP Server running",
-                `port ${port}`,
-            ];
-            const hasStartMessage = startMessages.some(msg => outputBuffer.includes(msg));
-            if (hasStartMessage) {
-                clearTimeout(timer);
-                // process.stdout?.removeListener('data', onData);
-                // process.stderr?.removeListener('data', onData);
-                // Additional wait for HTTP servers to be fully ready
-                if (mode !== TransportMode.STDIO) {
-                    setTimeout(resolve, 1000);
-                }
-                else {
-                    resolve();
-                }
-            }
-        };
-        const onError = (error) => {
-            clearTimeout(timer);
-            reject(new Error(`Server process error: ${error.message}`));
-        };
-        const onExit = (code) => {
-            console.log(`[Launcher DEBUG] Process ${process.pid} exited with code ${code}`);
-            // We don't reject here immediately, we wait for 'close' to ensure streams are flushed
-        };
-        const onClose = (code) => {
-            console.log(`[Launcher DEBUG] Process ${process.pid} closed with code ${code}`);
-            clearTimeout(timer);
-            reject(new Error(`Server process exited with code ${code} before starting`));
-        };
-        process.stdout?.on("data", onData);
-        process.on("close", onClose);
-        process.stderr?.on("data", onData);
-        process.on("error", onError);
-        process.on("exit", onExit);
-    });
-}
-/**
- * Find an available port starting from a base port
- */
-export async function findAvailablePort(basePort = 3002) {
-    const net = await import("net");
-    return new Promise((resolve, reject) => {
-        const server = net.createServer();
-        server.listen(basePort, () => {
-            const address = server.address();
-            const port = typeof address === "object" && address ? address.port : basePort;
-            server.close(() => resolve(port));
-        });
-        server.on("error", (err) => {
-            if (err.code === "EADDRINUSE") {
-                // Port is in use, try next one
-                resolve(findAvailablePort(basePort + 1));
-            }
-            else {
-                reject(err);
-            }
-        });
-    });
-}
-/**
- * Clean shutdown for multiple server instances
- */
-export function cleanupServers(servers) {
-    servers.forEach(server => {
-        try {
-            server.kill();
-        }
-        catch (error) {
-            console.warn(`Failed to kill server process: ${error}`);
-        }
-    });
-}
-/**
- * Create AbortController with timeout
- */
-export function createTimeoutController(timeout) {
-    const controller = new AbortController();
-    setTimeout(() => controller.abort(), timeout);
-    return controller;
-}
-/**
- * Check if a health endpoint is responding
- */
-export async function checkHealthEndpoint(port, maxRetries = 5) {
-    let lastError;
-    for (let i = 0; i < maxRetries; i++) {
-        try {
-            const controller = createTimeoutController(5000);
-            const response = await fetch(`http://${HOST}:${port}/health`, {
-                method: "GET",
-                signal: controller.signal,
-            });
-            if (response.ok) {
-                const healthData = (await response.json());
-                return healthData;
-            }
-            else {
-                throw new Error(`Health check failed with status ${response.status}`);
-            }
-        }
-        catch (error) {
-            if (error instanceof Error && error.name === "AbortError") {
-                lastError = new Error("Request timeout after 5000ms");
-            }
-            else {
-                lastError = error instanceof Error ? error : new Error(String(error));
-            }
-            if (i < maxRetries - 1) {
-                // Wait before retry
-                await new Promise(resolve => setTimeout(resolve, 1000));
-            }
-        }
-    }
-    throw lastError;
-}

package/build/test/utils/tool-args.test.js

@@ -1,210 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, test } from "node:test";
-import { appendFilterParam, appendFilterParams, cleanMutuallyExclusiveIdUsernameOptions, dropBlankArrayEntries, isBlankFilterValue, LIST_MERGE_REQUESTS_ID_USERNAME_PAIRS, sanitizeToolArguments, } from "../../utils/tool-args.js";
-describe("When sanitizeToolArguments runs", () => {
-    describe("with top-level null optionals", () => {
-        test("should omit null and undefined keys for generic tools", () => {
-            const result = sanitizeToolArguments("create_draft_note", {
-                project_id: "g/p",
-                merge_request_iid: "1",
-                body: "note",
-                position: null,
-                resolve_discussion: undefined,
-            });
-            assert.deepEqual(result, {
-                project_id: "g/p",
-                merge_request_iid: "1",
-                body: "note",
-            });
-        });
-    });
-    describe("with nested objects", () => {
-        test("should not strip nulls inside nested position objects", () => {
-            const position = {
-                base_sha: "abc",
-                head_sha: "def",
-                start_sha: "ghi",
-                position_type: "text",
-                old_line: null,
-                new_line: 12,
-            };
-            const result = sanitizeToolArguments("create_draft_note", {
-                project_id: "g/p",
-                merge_request_iid: "1",
-                body: "note",
-                position,
-            });
-            assert.deepEqual(result.position, position);
-        });
-        test("should preserve null entries inside execute_graphql variables", () => {
-            const variables = { milestoneId: null, title: "x" };
-            const result = sanitizeToolArguments("execute_graphql", {
-                query: "query { project { id } }",
-                variables,
-            });
-            assert.deepEqual(result.variables, variables);
-        });
-    });
-    describe("with meaningful falsy values", () => {
-        test("should preserve false and zero", () => {
-            const result = sanitizeToolArguments("update_merge_request_discussion_note", {
-                resolved: false,
-                straight: false,
-                count: 0,
-                label: "",
-            });
-            assert.deepEqual(result, {
-                resolved: false,
-                straight: false,
-                count: 0,
-                label: "",
-            });
-        });
-    });
-    describe("with create_label", () => {
-        test("should preserve explicit null priority", () => {
-            const result = sanitizeToolArguments("create_label", {
-                project_id: "g/p",
-                name: "bug",
-                color: "#ff0000",
-                priority: null,
-            });
-            assert.equal(result.priority, null);
-        });
-    });
-});
-describe("When cleanMutuallyExclusiveIdUsernameOptions runs", () => {
-    describe("with list_issues author filters", () => {
-        test("should drop author_id when author_username is also set", () => {
-            const result = cleanMutuallyExclusiveIdUsernameOptions({
-                author_id: "42",
-                author_username: "alice",
-                state: "opened",
-            });
-            assert.deepEqual(result, {
-                author_username: "alice",
-                state: "opened",
-            });
-        });
-    });
-    describe("with list_issues assignee filters", () => {
-        test("should drop assignee_id when assignee_username is also set", () => {
-            const result = cleanMutuallyExclusiveIdUsernameOptions({
-                assignee_id: "7",
-                assignee_username: ["bob"],
-            });
-            assert.deepEqual(result, {
-                assignee_username: ["bob"],
-            });
-        });
-        test("should keep assignee_id when assignee_username is an empty array", () => {
-            const result = cleanMutuallyExclusiveIdUsernameOptions({
-                assignee_id: "7",
-                assignee_username: [],
-            });
-            assert.deepEqual(result, {
-                assignee_id: "7",
-                assignee_username: [],
-            });
-        });
-        test("should keep assignee_id when assignee_username holds only blank entries", () => {
-            // The blank entries are dropped when the query is built, so counting them as a
-            // value here would delete the id filter and leave the request unfiltered.
-            const result = cleanMutuallyExclusiveIdUsernameOptions({
-                assignee_id: "7",
-                assignee_username: ["", "   "],
-            });
-            assert.deepEqual(result, {
-                assignee_id: "7",
-                assignee_username: ["", "   "],
-            });
-        });
-        test("should drop assignee_id when a username survives the blank entries", () => {
-            const result = cleanMutuallyExclusiveIdUsernameOptions({
-                assignee_id: "7",
-                assignee_username: ["", "bob"],
-            });
-            assert.deepEqual(result, {
-                assignee_username: ["", "bob"],
-            });
-        });
-        test("should keep assignee_id when assignee_username is a blank scalar", () => {
-            // Boolean(" ") is true, so a whitespace-only scalar used to delete the id and then
-            // be dropped by the blank guard, leaving the request with no filter at all.
-            for (const blank of ["", " ", "  \t "]) {
-                const result = cleanMutuallyExclusiveIdUsernameOptions({
-                    assignee_id: "7",
-                    assignee_username: blank,
-                });
-                assert.deepEqual(result, { assignee_id: "7", assignee_username: blank }, `blank scalar ${JSON.stringify(blank)} must not drop the id`);
-            }
-        });
-    });
-    describe("with list_merge_requests reviewer filters", () => {
-        test("should drop reviewer_id when reviewer_username is also set", () => {
-            const result = cleanMutuallyExclusiveIdUsernameOptions({
-                reviewer_id: "3",
-                reviewer_username: "carol",
-            }, LIST_MERGE_REQUESTS_ID_USERNAME_PAIRS);
-            assert.deepEqual(result, {
-                reviewer_username: "carol",
-            });
-        });
-    });
-});
-describe("When dropBlankArrayEntries runs", () => {
-    test("should drop blank string entries and keep meaningful ones", () => {
-        assert.deepEqual(dropBlankArrayEntries(["", "  ", "bug"]), ["bug"]);
-        assert.deepEqual(dropBlankArrayEntries(["\t", "alice", ""]), ["alice"]);
-    });
-    test("should leave non-array values untouched", () => {
-        assert.equal(dropBlankArrayEntries("bug"), "bug");
-        assert.equal(dropBlankArrayEntries("  "), "  ");
-        assert.equal(dropBlankArrayEntries(undefined), undefined);
-        assert.equal(dropBlankArrayEntries(false), false);
-    });
-    test("should keep non-string array entries", () => {
-        assert.deepEqual(dropBlankArrayEntries([0, "bug", false]), [0, "bug", false]);
-    });
-});
-describe("When isBlankFilterValue runs", () => {
-    test("should treat undefined, blank strings and empty arrays as blank", () => {
-        assert.equal(isBlankFilterValue(undefined), true);
-        assert.equal(isBlankFilterValue(""), true);
-        assert.equal(isBlankFilterValue(" \t\n"), true);
-        assert.equal(isBlankFilterValue([]), true);
-    });
-    test("should keep meaningful values, including false and zero", () => {
-        assert.equal(isBlankFilterValue("bug"), false);
-        assert.equal(isBlankFilterValue(["bug"]), false);
-        assert.equal(isBlankFilterValue(0), false);
-        assert.equal(isBlankFilterValue(false), false);
-    });
-});
-describe("When appendFilterParams runs", () => {
-    test("should omit blank scalars, blank array entries and empty arrays", () => {
-        const searchParams = new URLSearchParams();
-        appendFilterParams(searchParams, {
-            search: "",
-            ref: "  ",
-            labels: ["", "bug"],
-            iids: [],
-            omitted: undefined,
-        });
-        assert.deepEqual([...searchParams.entries()], [["labels", "bug"]]);
-    });
-    test("should keep booleans, zero and non-blank values", () => {
-        const searchParams = new URLSearchParams();
-        appendFilterParams(searchParams, { with_labels_details: false, page: 0, search: "bug" });
-        assert.deepEqual([...searchParams.entries()], [
-            ["with_labels_details", "false"],
-            ["page", "0"],
-            ["search", "bug"],
-        ]);
-    });
-    test("should append a single parameter without dropping a meaningful value", () => {
-        const searchParams = new URLSearchParams();
-        appendFilterParam(searchParams, "filter[environment_scope]", "production");
-        assert.deepEqual([...searchParams.entries()], [["filter[environment_scope]", "production"]]);
-    });
-});

package/build/test/utils/url.test.js

@@ -1,141 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, test } from "node:test";
-import { encodeGitLabPath, encodeGitLabPathSegment, isCleartextRemoteUrl, normalizeGitLabApiUrl, } from "../../utils/url.js";
-describe("When isCleartextRemoteUrl runs", () => {
-    test("should flag http to a remote host", () => {
-        assert.equal(isCleartextRemoteUrl("http://gitlab.example.com/api/v4"), true);
-    });
-    test("should allow https", () => {
-        assert.equal(isCleartextRemoteUrl("https://gitlab.example.com/api/v4"), false);
-    });
-    test("should allow http to loopback hosts", () => {
-        assert.equal(isCleartextRemoteUrl("http://127.0.0.1:8080/api/v4"), false);
-        assert.equal(isCleartextRemoteUrl("http://localhost/api/v4"), false);
-        assert.equal(isCleartextRemoteUrl("http://[::1]:3000/api/v4"), false);
-    });
-});
-describe("When normalizeGitLabApiUrl runs", () => {
-    test("should default to gitlab.com", () => {
-        assert.equal(normalizeGitLabApiUrl(""), "https://gitlab.com/api/v4");
-    });
-    test("should append the API path", () => {
-        assert.equal(normalizeGitLabApiUrl("https://gitlab.example.com"), "https://gitlab.example.com/api/v4");
-    });
-});
-describe("When encodeGitLabPathSegment runs", () => {
-    describe("with ordinary values", () => {
-        test("should keep plain segments", () => {
-            assert.equal(encodeGitLabPathSegment("feature-branch"), "feature-branch");
-        });
-        test("should encode spaces and reserved characters", () => {
-            assert.equal(encodeGitLabPathSegment("a b"), "a%20b");
-            assert.equal(encodeGitLabPathSegment("a?b#c"), "a%3Fb%23c");
-        });
-        test("should keep an encoded separator inside one segment", () => {
-            // GitLab accepts percent-encoded slashes for branch names such as release/1.0
-            assert.equal(encodeGitLabPathSegment("release%2F1.0"), "release%2F1.0");
-        });
-        test("should keep values that only look like dot segments", () => {
-            assert.equal(encodeGitLabPathSegment("..."), "...");
-            assert.equal(encodeGitLabPathSegment("v1.0.0"), "v1.0.0");
-        });
-        test("should encode a project path as one segment", () => {
-            assert.equal(encodeGitLabPathSegment("group/project"), "group%2Fproject");
-        });
-    });
-    describe("with traversal payloads", () => {
-        const payloads = [
-            ".",
-            "..",
-            "../user",
-            "..%2F..%2Fuser",
-            "%2E%2E%2Fuser",
-            "..%5C..%5Cuser",
-            "/etc/passwd",
-            "a/../b",
-        ];
-        for (const payload of payloads) {
-            test(`should reject ${JSON.stringify(payload)}`, () => {
-                assert.throws(() => encodeGitLabPathSegment(payload), /Cannot use value as a GitLab URL path segment/);
-            });
-        }
-    });
-    describe("with payloads that are not visible after one decode", () => {
-        // One decode is not enough to recognize these: "%252E" only becomes "." on the
-        // second pass, so a single-decode guard passes the payload through and the
-        // receiving server sees a traversal sequence.
-        const payloads = [
-            "..%252Fuser",
-            "%252E%252E%252Fuser",
-            "%252E%252E%252F%252E%252E%252Fuser",
-            "..%25252Fuser",
-            "..%252F..%252F..%252Fuser",
-        ];
-        for (const payload of payloads) {
-            test(`should reject ${JSON.stringify(payload)}`, () => {
-                assert.throws(() => encodeGitLabPathSegment(payload), /Cannot use value as a GitLab URL path segment/);
-            });
-        }
-    });
-    describe("with control characters", () => {
-        const payloads = ["..%00", "%00../user", "a%0Ab", "%7F..%2Fuser"];
-        for (const payload of payloads) {
-            test(`should reject ${JSON.stringify(payload)}`, () => {
-                assert.throws(() => encodeGitLabPathSegment(payload), /Cannot use value as a GitLab URL path segment/);
-            });
-        }
-    });
-    describe("with a literal percent sign", () => {
-        test("should encode a percent that starts no escape instead of rejecting it", () => {
-            // decodeURIComponent throws for these too, but a percent sign is valid in a
-            // file or branch name. Only a broken escape next to a valid one is a payload
-            // the guard cannot inspect.
-            assert.equal(encodeGitLabPathSegment("report-100%.pdf"), "report-100%25.pdf");
-            assert.equal(encodeGitLabPathSegment("100%"), "100%25");
-            assert.equal(encodeGitLabPathSegment("bad%zz/path"), "bad%25zz%2Fpath");
-            // The encoded form of such a name decodes back to the literal sign.
-            assert.equal(encodeGitLabPathSegment("save%20100%25.txt"), "save%20100%25.txt");
-        });
-    });
-    describe("with a value that cannot be decoded", () => {
-        test("should reject a malformed escape sequence next to a valid one", () => {
-            // These must not be treated as safe just because decodeURIComponent threw:
-            // the valid escape may still hide a separator or a dot segment.
-            for (const payload of ["%2E%2E%2F%ZZ", "%2E%2E%2F%..", "%2E%GG"]) {
-                assert.throws(() => encodeGitLabPathSegment(payload), /Cannot use value as a GitLab URL path segment/, payload);
-            }
-        });
-        test("should reject a value with more encoding layers than it will unwrap", () => {
-            assert.throws(() => encodeGitLabPathSegment("%25252525252F"), /Cannot use value as a GitLab URL path segment/);
-        });
-    });
-});
-describe("When encodeGitLabPath runs", () => {
-    test("should encode every slash-separated segment", () => {
-        assert.equal(encodeGitLabPath("docs/read me.txt"), "docs/read%20me.txt");
-    });
-    test("should keep an encoded separator", () => {
-        assert.equal(encodeGitLabPath("release%2F1.0"), "release%2F1.0");
-    });
-    test("should reject a traversal payload", () => {
-        for (const payload of [
-            "../../../user",
-            "1/../../../../admin/ci/variables",
-            "..%2F..%2Fuser",
-            "a/..%2F..%2Fb",
-            "a/..%252F..%252Fb",
-        ]) {
-            assert.throws(() => encodeGitLabPath(payload), /Cannot use value as a GitLab URL path segment/, payload);
-        }
-    });
-    test("should reject an absolute path instead of collapsing the leading segment", () => {
-        for (const payload of ["/etc/passwd", "/", "/project/-/raw/main/x"]) {
-            assert.throws(() => encodeGitLabPath(payload), /Cannot use value as a GitLab URL path/, payload);
-        }
-    });
-    test("should reject empty and empty-segment paths", () => {
-        for (const payload of ["", "a//b", "a/"]) {
-            assert.throws(() => encodeGitLabPath(payload), /Cannot use value as a GitLab URL path/, payload);
-        }
-    });
-});