@zereight/mcp-gitlab 2.1.70 → 2.2.1

package/build/test/test-mr-file-diffs.js

@@ -1,251 +0,0 @@
-import { describe, test, before, after } from 'node:test';
-import assert from 'node:assert';
-import { spawn } from 'child_process';
-import { MockGitLabServer, findMockServerPort } from './utils/mock-gitlab-server.js';
-const MOCK_TOKEN = 'glpat-mock-token-12345';
-const TEST_PROJECT_ID = '123';
-const TEST_MR_IID = '1';
-// Helper to call list_merge_request_changed_files
-async function callListMergeRequestChangedFiles(args = {}, env) {
-    return new Promise((resolve, reject) => {
-        const proc = spawn('node', ['build/index.js'], {
-            stdio: ['pipe', 'pipe', 'pipe'],
-            env: {
-                ...process.env,
-                ...env,
-                GITLAB_READ_ONLY_MODE: 'true'
-            }
-        });
-        let output = '';
-        let errorOutput = '';
-        proc.stdout?.on('data', d => output += d);
-        proc.stderr?.on('data', d => errorOutput += d);
-        proc.on('close', (code) => {
-            if (code !== 0)
-                return reject(new Error(`Process exited with code ${code}: ${errorOutput}`));
-            // Find the JSON line in stdout
-            const line = output.split('\n').find(l => l.startsWith('{'));
-            if (!line)
-                return reject(new Error('No JSON output found'));
-            try {
-                const response = JSON.parse(line);
-                if (response.error) {
-                    reject(response.error);
-                }
-                else {
-                    // Parse the tool result content
-                    const content = response.result?.content?.[0]?.text;
-                    if (content) {
-                        try {
-                            resolve(JSON.parse(content));
-                        }
-                        catch (e) {
-                            reject(new Error(`Failed to parse tool output JSON: ${content}`));
-                        }
-                    }
-                    else {
-                        resolve(response.result);
-                    }
-                }
-            }
-            catch (e) {
-                reject(e);
-            }
-        });
-        proc.stdin?.end(JSON.stringify({
-            jsonrpc: "2.0", id: 1, method: "tools/call",
-            params: { name: "list_merge_request_changed_files", arguments: args }
-        }) + '\n');
-    });
-}
-// Helper to call get_merge_request_file_diff
-async function callGetMergeRequestFileDiff(args = {}, env) {
-    return new Promise((resolve, reject) => {
-        const proc = spawn('node', ['build/index.js'], {
-            stdio: ['pipe', 'pipe', 'pipe'],
-            env: {
-                ...process.env,
-                ...env,
-                GITLAB_READ_ONLY_MODE: 'true'
-            }
-        });
-        let output = '';
-        let errorOutput = '';
-        proc.stdout?.on('data', d => output += d);
-        proc.stderr?.on('data', d => errorOutput += d);
-        proc.on('close', (code) => {
-            if (code !== 0)
-                return reject(new Error(`Process exited with code ${code}: ${errorOutput}`));
-            // Find the JSON line in stdout
-            const line = output.split('\n').find(l => l.startsWith('{'));
-            if (!line)
-                return reject(new Error('No JSON output found'));
-            try {
-                const response = JSON.parse(line);
-                if (response.error) {
-                    reject(response.error);
-                }
-                else {
-                    // Parse the tool result content
-                    const content = response.result?.content?.[0]?.text;
-                    if (content) {
-                        try {
-                            resolve(JSON.parse(content));
-                        }
-                        catch (e) {
-                            reject(new Error(`Failed to parse tool output JSON: ${content}`));
-                        }
-                    }
-                    else {
-                        resolve(response.result);
-                    }
-                }
-            }
-            catch (e) {
-                reject(e);
-            }
-        });
-        proc.stdin?.end(JSON.stringify({
-            jsonrpc: "2.0", id: 1, method: "tools/call",
-            params: { name: "get_merge_request_file_diff", arguments: args }
-        }) + '\n');
-    });
-}
-describe('list_merge_request_changed_files', () => {
-    let mockGitLab;
-    let mockGitLabUrl;
-    before(async () => {
-        const mockPort = await findMockServerPort();
-        mockGitLab = new MockGitLabServer({
-            port: mockPort,
-            validTokens: [MOCK_TOKEN]
-        });
-        await mockGitLab.start();
-        mockGitLabUrl = mockGitLab.getUrl();
-    });
-    after(async () => {
-        await mockGitLab.stop();
-    });
-    test('returns all changed files without filtering', async () => {
-        const files = await callListMergeRequestChangedFiles({ project_id: TEST_PROJECT_ID, merge_request_iid: TEST_MR_IID }, {
-            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
-            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN
-        });
-        assert.ok(Array.isArray(files), 'Response should be an array');
-        assert.strictEqual(files.length, 4, 'Should return 4 files');
-        // Check structure of returned files
-        for (const file of files) {
-            assert.ok(file.new_path !== undefined, 'Each file should have new_path');
-            assert.ok(file.old_path !== undefined, 'Each file should have old_path');
-        }
-        assert.strictEqual(files[0].new_path, 'src/index.ts');
-        assert.strictEqual(files[1].new_path, 'vendor/package/file.js');
-        assert.strictEqual(files[2].new_path, 'README.md');
-        assert.strictEqual(files[3].new_path, 'package-lock.json');
-    });
-    test('filters out vendor folder with ^vendor/ pattern', async () => {
-        const files = await callListMergeRequestChangedFiles({
-            project_id: TEST_PROJECT_ID,
-            merge_request_iid: TEST_MR_IID,
-            excluded_file_patterns: ['^vendor/']
-        }, {
-            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
-            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN
-        });
-        assert.ok(Array.isArray(files), 'Response should be an array');
-        assert.strictEqual(files.length, 3, 'Should return 3 files (vendor filtered out)');
-        assert.strictEqual(files[0].new_path, 'src/index.ts');
-        assert.strictEqual(files[1].new_path, 'README.md');
-        assert.strictEqual(files[2].new_path, 'package-lock.json');
-    });
-    test('filters multiple patterns at once', async () => {
-        const files = await callListMergeRequestChangedFiles({
-            project_id: TEST_PROJECT_ID,
-            merge_request_iid: TEST_MR_IID,
-            excluded_file_patterns: ['^vendor/', 'package-lock\\.json']
-        }, {
-            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
-            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN
-        });
-        assert.ok(Array.isArray(files), 'Response should be an array');
-        assert.strictEqual(files.length, 2, 'Should return 2 files (vendor and package-lock filtered out)');
-        assert.strictEqual(files[0].new_path, 'src/index.ts');
-        assert.strictEqual(files[1].new_path, 'README.md');
-    });
-});
-describe('get_merge_request_file_diff', () => {
-    let mockGitLab;
-    let mockGitLabUrl;
-    before(async () => {
-        const mockPort = await findMockServerPort();
-        mockGitLab = new MockGitLabServer({
-            port: mockPort,
-            validTokens: [MOCK_TOKEN]
-        });
-        await mockGitLab.start();
-        mockGitLabUrl = mockGitLab.getUrl();
-    });
-    after(async () => {
-        await mockGitLab.stop();
-    });
-    test('returns diffs for existing files in single page', async () => {
-        // Request only first few files that fit in one page (per_page=20)
-        const fileDiff = await callGetMergeRequestFileDiff({
-            project_id: TEST_PROJECT_ID,
-            merge_request_iid: TEST_MR_IID,
-            file_paths: ['src/index.ts', 'README.md']
-        }, {
-            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
-            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN
-        });
-        assert.ok(Array.isArray(fileDiff), 'Response should be an array');
-        assert.strictEqual(fileDiff.length, 2, 'Should return 2 diff results');
-        // Check that we got the correct files
-        const paths = fileDiff.map((f) => f.new_path || f.old_path).sort();
-        assert.deepStrictEqual(paths, ['README.md', 'src/index.ts'].sort());
-    });
-    test('handles pagination when result spans multiple pages', async () => {
-        // Request more files than fit in one page (we have 15 total, per_page defaults to 20)
-        // but let's use a smaller per_page by testing with unidiff param
-        const fileDiff = await callGetMergeRequestFileDiff({
-            project_id: TEST_PROJECT_ID,
-            merge_request_iid: TEST_MR_IID,
-            file_paths: [
-                'src/index.ts',
-                'config/settings.yml',
-                'models/user.go'
-            ]
-        }, {
-            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
-            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN
-        });
-        assert.ok(Array.isArray(fileDiff), 'Response should be an array');
-        assert.strictEqual(fileDiff.length, 3, 'Should return 3 diff results');
-    });
-    test('returns error objects for not-found files', async () => {
-        // Request some existing + non-existing files
-        const fileDiff = await callGetMergeRequestFileDiff({
-            project_id: TEST_PROJECT_ID,
-            merge_request_iid: TEST_MR_IID,
-            file_paths: ['src/index.ts', 'nonexistent/file.txt', 'also_missing.py']
-        }, {
-            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
-            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN
-        });
-        assert.ok(Array.isArray(fileDiff), 'Response should be an array');
-        // Should return 3 results: 1 success + 2 errors
-        assert.strictEqual(fileDiff.length, 3);
-        // Find the error entries
-        const errorEntries = fileDiff.filter((f) => f.error !== undefined);
-        const successEntries = fileDiff.filter((f) => f.error === undefined);
-        assert.strictEqual(errorEntries.length, 2, 'Should have 2 error entries');
-        assert.strictEqual(successEntries.length, 1, 'Should have 1 success entry');
-        // Verify error messages are helpful
-        const errorMsgs = errorEntries.map((e) => e.error);
-        assert.ok(errorMsgs.some(msg => msg.includes('nonexistent/file.txt')), 'Error message should mention nonexistent file');
-        assert.ok(errorMsgs.some(msg => msg.includes('also_missing.py')), 'Error message should mention other missing file');
-        // Check hint is present in at least one error
-        const hints = errorEntries.map((e) => e.hint).filter(Boolean);
-        assert.ok(hints.length > 0, 'Errors should include hints to check list_merge_request_changed_files');
-    });
-});

package/build/test/test-oauth-proxy-rate-limit.js

@@ -1,133 +0,0 @@
-/**
- * Regression tests for OAuth endpoint rate limiting behind trusted proxies.
- */
-import { describe, test, after, before } from "node:test";
-import assert from "node:assert";
-import { launchServer, findAvailablePort, cleanupServers, TransportMode, HOST, } from "./utils/server-launcher.js";
-import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server.js";
-const MOCK_GITLAB_PORT_BASE = 9210;
-const MCP_SERVER_PORT_BASE = 3210;
-const MOCK_CLIENT_ID = "mock-app-uid-from-dcr";
-function addOAuthEndpoints(mockGitLab, baseUrl) {
-    mockGitLab.addRootHandler("post", "/oauth/register", (req, res) => {
-        res.status(201).json({
-            client_id: MOCK_CLIENT_ID,
-            client_name: req.body?.client_name ?? "test",
-            redirect_uris: req.body?.redirect_uris ?? [],
-            token_endpoint_auth_method: "none",
-            require_pkce: true,
-        });
-    });
-    mockGitLab.addRootHandler("get", "/.well-known/oauth-authorization-server", (_req, res) => {
-        res.json({
-            issuer: baseUrl,
-            authorization_endpoint: `${baseUrl}/oauth/authorize`,
-            token_endpoint: `${baseUrl}/oauth/token`,
-            registration_endpoint: `${baseUrl}/oauth/register`,
-            revocation_endpoint: `${baseUrl}/oauth/revoke`,
-            scopes_supported: ["api", "read_api", "read_user"],
-            response_types_supported: ["code"],
-            grant_types_supported: ["authorization_code", "refresh_token"],
-            code_challenge_methods_supported: ["S256"],
-        });
-    });
-}
-describe("When MCP OAuth runs behind a trusted proxy", () => {
-    describe("with X-Forwarded-For containing client ports", () => {
-        let mcpBaseUrl;
-        let mockGitLab;
-        let servers = [];
-        before(async () => {
-            const mockPort = await findMockServerPort();
-            mockGitLab = new MockGitLabServer({ port: mockPort, validTokens: [] });
-            await mockGitLab.start();
-            const mockGitLabUrl = mockGitLab.getUrl();
-            addOAuthEndpoints(mockGitLab, mockGitLabUrl);
-            const mcpPort = await findAvailablePort(MCP_SERVER_PORT_BASE);
-            mcpBaseUrl = `http://${HOST}:${mcpPort}`;
-            const server = await launchServer({
-                mode: TransportMode.STREAMABLE_HTTP,
-                port: mcpPort,
-                timeout: 5000,
-                env: {
-                    STREAMABLE_HTTP: "true",
-                    GITLAB_MCP_OAUTH: "true",
-                    MCP_TRUST_PROXY: "true",
-                    GITLAB_OAUTH_APP_ID: "test-oauth-app-id",
-                    GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
-                    MCP_SERVER_URL: mcpBaseUrl,
-                    MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL: "true",
-                },
-            });
-            servers.push(server);
-        });
-        after(async () => {
-            cleanupServers(servers);
-            if (mockGitLab) {
-                await mockGitLab.stop();
-            }
-        });
-        test("should not return 500 from /register", async () => {
-            const res = await fetch(`${mcpBaseUrl}/register`, {
-                method: "POST",
-                headers: {
-                    "Content-Type": "application/json",
-                    "X-Forwarded-For": "160.79.106.36:38914",
-                },
-                body: JSON.stringify({
-                    redirect_uris: ["https://client.example/callback"],
-                    client_name: "proxy-rate-limit-test",
-                }),
-            });
-            assert.notEqual(res.status, 500, "rate-limit key generation should not crash /register");
-            assert.strictEqual(res.status, 201, "DCR should succeed behind forwarded IPv4:port");
-        });
-        test("should not return 500 from /authorize", async () => {
-            const params = new URLSearchParams({
-                response_type: "code",
-                client_id: MOCK_CLIENT_ID,
-                redirect_uri: "https://client.example/callback",
-                code_challenge: "challenge",
-                code_challenge_method: "S256",
-                state: "proxy-rate-limit-state",
-                scope: "api",
-            });
-            const res = await fetch(`${mcpBaseUrl}/authorize?${params}`, {
-                redirect: "manual",
-                headers: {
-                    "X-Forwarded-For": "[2001:db8::1]:5678",
-                },
-            });
-            assert.notEqual(res.status, 500, "rate-limit key generation should not crash /authorize");
-        });
-        test("should not return 500 from /token", async () => {
-            const res = await fetch(`${mcpBaseUrl}/token`, {
-                method: "POST",
-                headers: {
-                    "Content-Type": "application/x-www-form-urlencoded",
-                    "X-Forwarded-For": "160.79.106.36:38914",
-                },
-                body: new URLSearchParams({
-                    grant_type: "authorization_code",
-                    client_id: MOCK_CLIENT_ID,
-                    code: "invalid-code",
-                    redirect_uri: "https://client.example/callback",
-                }),
-            });
-            assert.notEqual(res.status, 500, "rate-limit key generation should not crash /token");
-        });
-        test("should not return 500 from /revoke", async () => {
-            const res = await fetch(`${mcpBaseUrl}/revoke`, {
-                method: "POST",
-                headers: {
-                    "Content-Type": "application/x-www-form-urlencoded",
-                    "X-Forwarded-For": "[2001:db8::1]",
-                },
-                body: new URLSearchParams({
-                    token: "invalid-token",
-                }),
-            });
-            assert.notEqual(res.status, 500, "rate-limit key generation should not crash /revoke");
-        });
-    });
-});

package/build/test/test-orbit.js

@@ -1,155 +0,0 @@
-import { describe, test, before, after } from "node:test";
-import assert from "node:assert";
-import { spawn } from "child_process";
-import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server.js";
-const MOCK_TOKEN = "glpat-mock-token-12345";
-const mockSchema = {
-    nodes: [{ name: "Project", properties: ["id", "name"] }],
-    edges: [{ name: "HAS_MERGE_REQUEST", from: "Project", to: "MergeRequest" }],
-};
-const mockStatus = {
-    status: "ready",
-    last_indexed_at: "2026-09-05T10:00:00Z",
-    indexed_groups: 3,
-};
-const mockTools = {
-    tools: [{ name: "orbit_query", description: "Execute a graph query" }],
-};
-const mockQueryRaw = {
-    results: [{ project: "group/a", failures: 7 }],
-};
-const mockQueryLlm = "Top failing project: group/a (7 failures).";
-function baseEnv(mockGitLabUrl) {
-    return {
-        GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
-        GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
-        GITLAB_TOOLSETS: "orbit",
-    };
-}
-async function callToolAsync(env, name, args) {
-    return new Promise((resolve, reject) => {
-        const proc = spawn("node", ["build/index.js"], {
-            stdio: ["pipe", "pipe", "pipe"],
-            env: { ...process.env, ...env },
-        });
-        let output = "";
-        let errorOutput = "";
-        proc.stdout?.on("data", (chunk) => (output += chunk));
-        proc.stderr?.on("data", (chunk) => (errorOutput += chunk));
-        proc.on("close", code => {
-            if (code !== 0) {
-                return reject(new Error(`Process exited with code ${code}: ${errorOutput}`));
-            }
-            const line = output.split("\n").find(entry => entry.startsWith("{"));
-            if (!line) {
-                return reject(new Error("No JSON output found"));
-            }
-            try {
-                const response = JSON.parse(line);
-                if (response.error) {
-                    reject(new Error(JSON.stringify(response.error)));
-                    return;
-                }
-                const content = response.result?.content?.[0]?.text;
-                if (content === undefined) {
-                    reject(new Error("No tool result content"));
-                    return;
-                }
-                resolve(content);
-            }
-            catch (error) {
-                reject(error);
-            }
-        });
-        proc.stdin?.end(JSON.stringify({
-            jsonrpc: "2.0",
-            id: 1,
-            method: "tools/call",
-            params: { name, arguments: args },
-        }) + "\n");
-    });
-}
-describe("orbit tools", () => {
-    let mockGitLab;
-    let mockGitLabUrl;
-    let lastQueryBody = null;
-    before(async () => {
-        const mockPort = await findMockServerPort();
-        mockGitLab = new MockGitLabServer({
-            port: mockPort,
-            validTokens: [MOCK_TOKEN],
-        });
-        mockGitLab.addMockHandler("get", "/orbit/schema", (_req, res) => {
-            res.json(mockSchema);
-        });
-        mockGitLab.addMockHandler("get", "/orbit/status", (_req, res) => {
-            res.json(mockStatus);
-        });
-        mockGitLab.addMockHandler("get", "/orbit/tools", (_req, res) => {
-            res.json(mockTools);
-        });
-        mockGitLab.addMockHandler("post", "/orbit/query", (req, res) => {
-            lastQueryBody = req.body;
-            if (req.body?.format === "raw") {
-                res.json(mockQueryRaw);
-                return;
-            }
-            res.type("text/plain").send(mockQueryLlm);
-        });
-        await mockGitLab.start();
-        mockGitLabUrl = mockGitLab.getUrl();
-    });
-    after(async () => {
-        await mockGitLab.stop();
-    });
-    test("orbit_get_schema returns the graph schema", async () => {
-        const text = await callToolAsync(baseEnv(mockGitLabUrl), "orbit_get_schema", {});
-        assert.deepEqual(JSON.parse(text), mockSchema);
-    });
-    test("orbit_get_status returns indexing status", async () => {
-        const text = await callToolAsync(baseEnv(mockGitLabUrl), "orbit_get_status", {});
-        assert.deepEqual(JSON.parse(text), mockStatus);
-    });
-    test("orbit_list_tools returns tool definitions", async () => {
-        const text = await callToolAsync(baseEnv(mockGitLabUrl), "orbit_list_tools", {});
-        assert.deepEqual(JSON.parse(text), mockTools);
-    });
-    test("orbit_query with format=raw returns structured JSON", async () => {
-        const query = { node: "Project", limit: 5 };
-        const text = await callToolAsync(baseEnv(mockGitLabUrl), "orbit_query", {
-            query,
-            format: "raw",
-        });
-        assert.deepEqual(JSON.parse(text), mockQueryRaw);
-        assert.deepEqual(lastQueryBody, { query, format: "raw" });
-    });
-    test("orbit_query defaults to llm format and passes text through", async () => {
-        const query = { node: "Project", limit: 5 };
-        const text = await callToolAsync(baseEnv(mockGitLabUrl), "orbit_query", { query });
-        assert.equal(text, mockQueryLlm);
-        assert.deepEqual(lastQueryBody, { query, format: "llm" });
-    });
-    for (const toolName of [
-        "orbit_query",
-        "orbit_get_schema",
-        "orbit_get_status",
-        "orbit_list_tools",
-    ]) {
-        test(`${toolName} is refused under strict project scope`, async () => {
-            const env = {
-                ...baseEnv(mockGitLabUrl),
-                ENABLE_STRICT_PROJECT_SCOPE: "true",
-                GITLAB_ALLOWED_PROJECT_IDS: "1,2",
-            };
-            const args = toolName === "orbit_query" ? { query: {} } : {};
-            let message = "";
-            try {
-                message = await callToolAsync(env, toolName, args);
-            }
-            catch (error) {
-                message = error.message;
-            }
-            assert.match(message, /not allowed while a project allowlist is in effect/);
-        });
-    }
-});