@zereight/mcp-gitlab 2.3.8-next.148 → 2.3.8-next.149

package/build/index.js

@@ -63,12 +63,11 @@ import { loadKeyMaterialFromEnv, looksLikeStatelessSessionId, mintSessionId, ope
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, ListPromptsRequestSchema, GetPromptRequestSchema, ListResourcesRequestSchema, ListResourceTemplatesRequestSchema, ReadResourceRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
-import { AsyncLocalStorage } from "node:async_hooks";
 import fetchCookie from "fetch-cookie";
 import fs from "node:fs";
 import { pipeline as streamPipeline } from "node:stream/promises";
 import os from "node:os";
-import { fetch as undiciFetch, File, FormData, } from "undici";
+import { fetch as undiciFetch, File, FormData } from "undici";
 import path from "node:path";
 import { CookieJar, parse as parseCookie } from "tough-cookie";
 import { URL } from "node:url";
@@ -98,6 +97,7 @@ import { MCP_INSTRUCTIONS } from "./server/mcp-instructions.js";
 import { formatUnknownHelpTopic, getWorkflowGuide, readHelpTopic, } from "./server/mcp-help.js";
 import { isInitializationRequestBody, isUnauthenticatedDiscoveryRequestBody, readAcceptHeader, readMcpSessionIdHeader, redactSessionIdForLog, } from "./server/request-helpers.js";
 export { readMcpSessionIdHeader } from "./server/request-helpers.js";
+import { authBySession, BASE_HEADERS, bindSessionProjectScope, buildAuthHeaders, configureGitLabRequestContext, getEffectiveAllowedProjectIds, getEffectiveApiUrl, getFetchConfig, SESSION_PROJECT_SCOPE_MISMATCH, sessionAuthStore, updateSessionPublicBaseUrl, usesJobTokenHeader, withPublicBaseUrl, } from "./server/gitlab-request-context.js";
 import { apiUrlUserinfoWarning, commaSplitHint, configuredApiUrlErrors, encodeGitLabPath, encodeGitLabPathSegment, invalidListEntryError, isCleartextRemoteUrl, normalizeGitLabApiUrl, parseConfiguredGitLabApiUrls, } from "./utils/url.js";
 import { estimateMergeCommitCount, filterDiffsByPatterns, openSafeOutputWriteStream, resolveDownloadRoot, readSafeExistingFile, summarizeWebhookEvents, } from "./utils/helpers.js";
 import { graphqlQueryContainsWriteOperation, graphqlQueryContainsDeleteOperation, } from "./utils/graphql-query.js";
@@ -967,6 +967,15 @@ const clientPool = new GitLabClientPool({
     caCertPath: GITLAB_CA_CERT_PATH,
     poolMaxSize: GITLAB_POOL_MAX_SIZE,
 });
+// GITLAB_API_URL and GITLAB_ALLOWED_PROJECT_IDS are defined further down; the getters
+// read them at call time, after module evaluation.
+configureGitLabRequestContext({
+    logger,
+    getDefaultApiUrl: () => GITLAB_API_URL,
+    getDefaultAllowedProjectIds: () => GITLAB_ALLOWED_PROJECT_IDS,
+    getDispatcherForUrl: apiUrl => clientPool.getDispatcherForUrl(apiUrl),
+    getOAuthAccessToken: () => OAUTH_ACCESS_TOKEN,
+});
 // Create cookie jar with clean Netscape file parsing
 // Resolve cookie path once using os.homedir() for cross-platform support
 const resolvedCookiePath = GITLAB_AUTH_COOKIE_PATH
@@ -1093,129 +1102,6 @@ async function ensureSessionForRequest() {
         logger.debug("Session warmup request failed, will retry on next request");
     }
 }
-const sessionAuthStore = new AsyncLocalStorage();
-// Session context map for storing auth data by session ID
-// This survives async boundaries where AsyncLocalStorage might not
-const authBySession = {};
-function withPublicBaseUrl(authData, publicBaseUrl, previous) {
-    const effectivePublicBaseUrl = publicBaseUrl || previous?.publicBaseUrl;
-    return effectivePublicBaseUrl ? { ...authData, publicBaseUrl: effectivePublicBaseUrl } : authData;
-}
-function updateSessionPublicBaseUrl(sessionId, publicBaseUrl) {
-    if (sessionId && publicBaseUrl && authBySession[sessionId]) {
-        authBySession[sessionId].publicBaseUrl = publicBaseUrl;
-    }
-}
-// Base headers without authentication
-const BASE_HEADERS = {
-    Accept: "application/json",
-    "Content-Type": "application/json",
-};
-/**
- * Build authentication headers dynamically based on context
- * In REMOTE_AUTHORIZATION or GITLAB_MCP_OAUTH mode, reads from AsyncLocalStorage session context
- * Otherwise, uses environment token (OAuth token is refreshed lazily before each tool call)
- */
-function buildAuthHeaders() {
-    if (REMOTE_AUTHORIZATION || GITLAB_MCP_OAUTH) {
-        const ctx = sessionAuthStore.getStore();
-        logger.debug({
-            sidPrefix: redactSessionIdForLog(ctx?.sessionId),
-            header: ctx?.header,
-            apiUrl: ctx?.apiUrl === undefined ? undefined : redactUrlSecretsInText(ctx.apiUrl),
-        }, "buildAuthHeaders: session context");
-        if (ctx?.token) {
-            return {
-                [ctx.header]: ctx.header === "Authorization" ? `Bearer ${ctx.token}` : ctx.token,
-            };
-        }
-        return {}; // No auth headers if no session context
-    }
-    // Standard mode: PAT preferred over job token (broader permissions).
-    // OAuth token takes priority over PAT when both are set.
-    // NOTE: Changed in PR #400 — previously GITLAB_JOB_TOKEN had highest priority.
-    // If both GITLAB_PERSONAL_ACCESS_TOKEN and GITLAB_JOB_TOKEN are set, PAT wins.
-    // OAuth tokens always travel as `Authorization: Bearer`, even with GITLAB_IS_OLD: the HTTP
-    // client strips `Authorization` on cross-origin redirects but not `Private-Token`.
-    if (OAUTH_ACCESS_TOKEN) {
-        return { Authorization: `Bearer ${OAUTH_ACCESS_TOKEN}` };
-    }
-    if (GITLAB_PERSONAL_ACCESS_TOKEN) {
-        return IS_OLD
-            ? { "Private-Token": String(GITLAB_PERSONAL_ACCESS_TOKEN) }
-            : { Authorization: `Bearer ${GITLAB_PERSONAL_ACCESS_TOKEN}` };
-    }
-    // Fall back to CI job token
-    if (GITLAB_JOB_TOKEN) {
-        return { "JOB-TOKEN": String(GITLAB_JOB_TOKEN) };
-    }
-    return {};
-}
-function usesJobTokenHeader() {
-    if (GITLAB_JOB_TOKEN)
-        return true;
-    if (REMOTE_AUTHORIZATION || GITLAB_MCP_OAUTH) {
-        const ctx = sessionAuthStore.getStore();
-        return ctx?.header === "JOB-TOKEN";
-    }
-    return false;
-}
-/**
- * Get the effective GitLab API URL for the current request
- * In REMOTE_AUTHORIZATION mode with ENABLE_DYNAMIC_API_URL, reads from session context
- * Otherwise, uses environment GITLAB_API_URL
- */
-function getEffectiveApiUrl() {
-    if (ENABLE_DYNAMIC_API_URL) {
-        const ctx = sessionAuthStore.getStore();
-        if (ctx?.apiUrl) {
-            return ctx.apiUrl;
-        }
-        logger.warn({
-            sidPrefix: redactSessionIdForLog(ctx?.sessionId),
-            header: ctx?.header,
-            apiUrl: ctx?.apiUrl === undefined ? undefined : redactUrlSecretsInText(ctx.apiUrl),
-        }, "getEffectiveApiUrl: No context or apiUrl found, falling back to default");
-    }
-    return GITLAB_API_URL;
-}
-/**
- * Get the effective project allowlist for the current request
- * In REMOTE_AUTHORIZATION mode with ENABLE_DYNAMIC_PROJECT_SCOPE, reads the scope
- * narrowed via the X-GitLab-Allowed-Project-Ids header from session context
- * (already validated against GITLAB_ALLOWED_PROJECT_IDS by parseAuthHeaders)
- * Otherwise, uses environment GITLAB_ALLOWED_PROJECT_IDS
- */
-function getEffectiveAllowedProjectIds() {
-    if (ENABLE_DYNAMIC_PROJECT_SCOPE) {
-        const ctx = sessionAuthStore.getStore();
-        if (ctx?.allowedProjectIds && ctx.allowedProjectIds.length > 0) {
-            return ctx.allowedProjectIds;
-        }
-    }
-    return GITLAB_ALLOWED_PROJECT_IDS;
-}
-/**
- * Keep a dynamic project scope bound to its session
- * A request that omits X-GitLab-Allowed-Project-Ids keeps the session scope, and a
- * request naming a different scope is refused (null). An unscoped session may be
- * narrowed. Re-initialize to change the scope.
- */
-function bindSessionProjectScope(requested, sessionScope) {
-    if (!sessionScope || sessionScope.length === 0) {
-        return requested;
-    }
-    if (requested === undefined) {
-        return sessionScope;
-    }
-    const want = new Set(requested);
-    const have = new Set(sessionScope);
-    return want.size === have.size && [...want].every(id => have.has(id)) ? sessionScope : null;
-}
-const SESSION_PROJECT_SCOPE_MISMATCH = {
-    error: "Project scope mismatch",
-    message: "X-GitLab-Allowed-Project-Ids does not match the project scope of this session. Re-initialize to change it.",
-};
 /**
  * Reject tools that cannot be limited to allowed projects when
  * ENABLE_STRICT_PROJECT_SCOPE is set and an allowlist is in effect
@@ -1241,24 +1127,6 @@ function filterProjectsByAllowlist(projects) {
     return projects.filter(project => allowedProjectIds.includes(String(project.id)) ||
         allowedProjectIds.includes(project.path_with_namespace));
 }
-/**
- * Get fetch configuration with proper client from pool
- * Uses connection pooling when dynamic API URLs are enabled
- */
-/**
- * Constructs the fetch configuration dynamically.
- * This function is called immediately before each `fetch` to ensure it runs
- * within the correct AsyncLocalStorage context, capturing the necessary auth
- * and API URL information for the current request.
- */
-const getFetchConfig = () => {
-    const effectiveApiUrl = getEffectiveApiUrl();
-    const dispatcher = clientPool.getDispatcherForUrl(effectiveApiUrl);
-    return {
-        headers: { ...BASE_HEADERS, ...buildAuthHeaders() },
-        dispatcher,
-    };
-};
 /**
  * Options for the download sinks that stream a file through `fetchWithValidatedRedirects`.
  *

package/build/server/gitlab-request-context.js

@@ -0,0 +1,166 @@
+/**
+ * Per-request GitLab context shared by the tool handlers: the session auth store,
+ * the auth headers, the effective API URL and project allowlist, and the fetch
+ * config built from them.
+ *
+ * index.ts owns the values this module reads (the default API URL, the allowlist,
+ * the client pool, the OAuth token, and the logger) and hands them over once with
+ * configureGitLabRequestContext(). The getters are read at call time, as the free
+ * variables they replace were.
+ */
+import { AsyncLocalStorage } from "node:async_hooks";
+import { ENABLE_DYNAMIC_API_URL, ENABLE_DYNAMIC_PROJECT_SCOPE, GITLAB_JOB_TOKEN, GITLAB_MCP_OAUTH, GITLAB_PERSONAL_ACCESS_TOKEN, IS_OLD, REMOTE_AUTHORIZATION, } from "../config.js";
+import { redactUrlSecretsInText } from "../utils/redact-url.js";
+import { redactSessionIdForLog } from "./request-helpers.js";
+let deps;
+export function configureGitLabRequestContext(next) {
+    deps = next;
+}
+function requireDeps() {
+    if (!deps) {
+        throw new Error("GitLab request context used before configureGitLabRequestContext()");
+    }
+    return deps;
+}
+export const sessionAuthStore = new AsyncLocalStorage();
+// Session context map for storing auth data by session ID
+// This survives async boundaries where AsyncLocalStorage might not
+export const authBySession = {};
+export function withPublicBaseUrl(authData, publicBaseUrl, previous) {
+    const effectivePublicBaseUrl = publicBaseUrl || previous?.publicBaseUrl;
+    return effectivePublicBaseUrl ? { ...authData, publicBaseUrl: effectivePublicBaseUrl } : authData;
+}
+export function updateSessionPublicBaseUrl(sessionId, publicBaseUrl) {
+    if (sessionId && publicBaseUrl && authBySession[sessionId]) {
+        authBySession[sessionId].publicBaseUrl = publicBaseUrl;
+    }
+}
+// Base headers without authentication
+export const BASE_HEADERS = {
+    Accept: "application/json",
+    "Content-Type": "application/json",
+};
+/**
+ * Build authentication headers dynamically based on context
+ * In REMOTE_AUTHORIZATION or GITLAB_MCP_OAUTH mode, reads from AsyncLocalStorage session context
+ * Otherwise, uses environment token (OAuth token is refreshed lazily before each tool call)
+ */
+export function buildAuthHeaders() {
+    const { logger, getOAuthAccessToken } = requireDeps();
+    if (REMOTE_AUTHORIZATION || GITLAB_MCP_OAUTH) {
+        const ctx = sessionAuthStore.getStore();
+        logger.debug({
+            sidPrefix: redactSessionIdForLog(ctx?.sessionId),
+            header: ctx?.header,
+            apiUrl: ctx?.apiUrl === undefined ? undefined : redactUrlSecretsInText(ctx.apiUrl),
+        }, "buildAuthHeaders: session context");
+        if (ctx?.token) {
+            return {
+                [ctx.header]: ctx.header === "Authorization" ? `Bearer ${ctx.token}` : ctx.token,
+            };
+        }
+        return {}; // No auth headers if no session context
+    }
+    // Standard mode: PAT preferred over job token (broader permissions).
+    // OAuth token takes priority over PAT when both are set.
+    // NOTE: Changed in PR #400 — previously GITLAB_JOB_TOKEN had highest priority.
+    // If both GITLAB_PERSONAL_ACCESS_TOKEN and GITLAB_JOB_TOKEN are set, PAT wins.
+    // OAuth tokens always travel as `Authorization: Bearer`, even with GITLAB_IS_OLD: the HTTP
+    // client strips `Authorization` on cross-origin redirects but not `Private-Token`.
+    const oauthAccessToken = getOAuthAccessToken();
+    if (oauthAccessToken) {
+        return { Authorization: `Bearer ${oauthAccessToken}` };
+    }
+    if (GITLAB_PERSONAL_ACCESS_TOKEN) {
+        return IS_OLD
+            ? { "Private-Token": String(GITLAB_PERSONAL_ACCESS_TOKEN) }
+            : { Authorization: `Bearer ${GITLAB_PERSONAL_ACCESS_TOKEN}` };
+    }
+    // Fall back to CI job token
+    if (GITLAB_JOB_TOKEN) {
+        return { "JOB-TOKEN": String(GITLAB_JOB_TOKEN) };
+    }
+    return {};
+}
+export function usesJobTokenHeader() {
+    if (GITLAB_JOB_TOKEN)
+        return true;
+    if (REMOTE_AUTHORIZATION || GITLAB_MCP_OAUTH) {
+        const ctx = sessionAuthStore.getStore();
+        return ctx?.header === "JOB-TOKEN";
+    }
+    return false;
+}
+/**
+ * Get the effective GitLab API URL for the current request
+ * In REMOTE_AUTHORIZATION mode with ENABLE_DYNAMIC_API_URL, reads from session context
+ * Otherwise, uses environment GITLAB_API_URL
+ */
+export function getEffectiveApiUrl() {
+    const { logger, getDefaultApiUrl } = requireDeps();
+    if (ENABLE_DYNAMIC_API_URL) {
+        const ctx = sessionAuthStore.getStore();
+        if (ctx?.apiUrl) {
+            return ctx.apiUrl;
+        }
+        logger.warn({
+            sidPrefix: redactSessionIdForLog(ctx?.sessionId),
+            header: ctx?.header,
+            apiUrl: ctx?.apiUrl === undefined ? undefined : redactUrlSecretsInText(ctx.apiUrl),
+        }, "getEffectiveApiUrl: No context or apiUrl found, falling back to default");
+    }
+    return getDefaultApiUrl();
+}
+/**
+ * Get the effective project allowlist for the current request
+ * In REMOTE_AUTHORIZATION mode with ENABLE_DYNAMIC_PROJECT_SCOPE, reads the scope
+ * narrowed via the X-GitLab-Allowed-Project-Ids header from session context
+ * (already validated against GITLAB_ALLOWED_PROJECT_IDS by parseAuthHeaders)
+ * Otherwise, uses environment GITLAB_ALLOWED_PROJECT_IDS
+ */
+export function getEffectiveAllowedProjectIds() {
+    const { getDefaultAllowedProjectIds } = requireDeps();
+    if (ENABLE_DYNAMIC_PROJECT_SCOPE) {
+        const ctx = sessionAuthStore.getStore();
+        if (ctx?.allowedProjectIds && ctx.allowedProjectIds.length > 0) {
+            return ctx.allowedProjectIds;
+        }
+    }
+    return getDefaultAllowedProjectIds();
+}
+/**
+ * Keep a dynamic project scope bound to its session
+ * A request that omits X-GitLab-Allowed-Project-Ids keeps the session scope, and a
+ * request naming a different scope is refused (null). An unscoped session may be
+ * narrowed. Re-initialize to change the scope.
+ */
+export function bindSessionProjectScope(requested, sessionScope) {
+    if (!sessionScope || sessionScope.length === 0) {
+        return requested;
+    }
+    if (requested === undefined) {
+        return sessionScope;
+    }
+    const want = new Set(requested);
+    const have = new Set(sessionScope);
+    return want.size === have.size && [...want].every(id => have.has(id)) ? sessionScope : null;
+}
+export const SESSION_PROJECT_SCOPE_MISMATCH = {
+    error: "Project scope mismatch",
+    message: "X-GitLab-Allowed-Project-Ids does not match the project scope of this session. Re-initialize to change it.",
+};
+/**
+ * Constructs the fetch configuration dynamically.
+ * This function is called immediately before each `fetch` to ensure it runs
+ * within the correct AsyncLocalStorage context, capturing the necessary auth
+ * and API URL information for the current request.
+ * Uses connection pooling when dynamic API URLs are enabled.
+ */
+export const getFetchConfig = () => {
+    const effectiveApiUrl = getEffectiveApiUrl();
+    const dispatcher = requireDeps().getDispatcherForUrl(effectiveApiUrl);
+    return {
+        headers: { ...BASE_HEADERS, ...buildAuthHeaders() },
+        dispatcher,
+    };
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.3.8-next.148",
+  "version": "2.3.8-next.149",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [