@zereight/mcp-gitlab 2.3.8-next.148 → 2.3.8-next.150

package/build/downloads/proxy.js

@@ -11,6 +11,18 @@ function canonicalizeQueryParams(params) {
     }
     return JSON.stringify(normalized);
 }
+/**
+ * Check the requested project against the env allowlist (getEffectiveProjectId) and
+ * against the allowlist sealed into the download token, since the proxy runs
+ * outside the session that issued it.
+ */
+function resolveDownloadProjectId(deps, projectId, sealedProjectIds) {
+    const effectiveProjectId = deps.getEffectiveProjectId(decodeURIComponent(projectId));
+    if (sealedProjectIds.length > 0 && !sealedProjectIds.includes(effectiveProjectId)) {
+        throw new Error(`Access denied: Project ${effectiveProjectId} is outside the project scope of this download token`);
+    }
+    return effectiveProjectId;
+}
 /**
  * Register the /downloads/:type proxy endpoint on an Express app.
  * Streams GitLab API responses directly to the client. Auth is read from
@@ -46,6 +58,7 @@ export function registerDownloadProxy(app, deps) {
         // Try embedded encrypted token first (self-contained URL), then headers
         const encryptedToken = req.query._token;
         let tokenApiUrl;
+        let sealedProjectIds = [];
         if (encryptedToken) {
             const decrypted = decryptDownloadToken(encryptedToken);
             if (!decrypted) {
@@ -70,6 +83,7 @@ export function registerDownloadProxy(app, deps) {
             headers[decrypted.header] = decrypted.token;
             rateLimitKey = decrypted.token;
             tokenApiUrl = decrypted.apiUrl;
+            sealedProjectIds = decrypted.allowedProjectIds;
         }
         else {
             const privateToken = req.headers["private-token"];
@@ -119,7 +133,7 @@ export function registerDownloadProxy(app, deps) {
                         res.status(400).json({ error: "project_id and job_id are required" });
                         return;
                     }
-                    const effectiveProjectId = deps.getEffectiveProjectId(decodeURIComponent(project_id));
+                    const effectiveProjectId = resolveDownloadProjectId(deps, project_id, sealedProjectIds);
                     gitlabUrl = `${apiUrl}/projects/${deps.encodeGitLabPathSegment(effectiveProjectId)}/jobs/${deps.encodeGitLabPathSegment(job_id)}/artifacts`;
                     break;
                 }
@@ -129,7 +143,7 @@ export function registerDownloadProxy(app, deps) {
                         res.status(400).json({ error: "project_id, secret, and filename are required" });
                         return;
                     }
-                    const effectiveProjectId = deps.getEffectiveProjectId(decodeURIComponent(project_id));
+                    const effectiveProjectId = resolveDownloadProjectId(deps, project_id, sealedProjectIds);
                     // The uploads route takes one filename segment; a slash inside the name must
                     // stay inside that segment instead of turning into another route level.
                     gitlabUrl = `${apiUrl}/projects/${deps.encodeGitLabPathSegment(effectiveProjectId)}/uploads/${deps.encodeGitLabPathSegment(secret)}/${deps.encodeGitLabPathSegment(filename)}`;
@@ -143,7 +157,7 @@ export function registerDownloadProxy(app, deps) {
                             .json({ error: "project_id, tag_name, and direct_asset_path are required" });
                         return;
                     }
-                    const effectiveProjectId = deps.getEffectiveProjectId(decodeURIComponent(project_id));
+                    const effectiveProjectId = resolveDownloadProjectId(deps, project_id, sealedProjectIds);
                     gitlabUrl = `${apiUrl}/projects/${deps.encodeGitLabPathSegment(effectiveProjectId)}/releases/${deps.encodeGitLabPathSegment(tag_name)}/downloads/${deps.encodeGitLabPath(direct_asset_path)}`;
                     break;
                 }

package/build/index.js

@@ -8,25 +8,32 @@ const STREAMABLE_HTTP_AUTH_TOKEN = getConfig("streamable-http-auth-token", "STRE
  * Build a URL pointing to the download proxy endpoint.
  * Embeds an encrypted auth token (and API URL for dynamic routing)
  * from the current session so the URL works standalone.
+ * @throws {ProjectAccessDeniedError} If the project is outside the effective allowlist
  */
-function buildDownloadUrl(type, params) {
+function buildDownloadUrl(type, projectId, params) {
+    // Decoded once, like the /downloads proxy does, so both check the same value
+    const resourceParams = {
+        ...params,
+        project_id: getEffectiveProjectId(decodeURIComponent(projectId)),
+    };
     const base = MCP_SERVER_URL || sessionAuthStore.getStore()?.publicBaseUrl || `http://${HOST}:${PORT}`;
     const baseUrl = new URL(base);
     // Preserve any path prefix (e.g. /gitlab-mcp) from the base URL
     const basePath = baseUrl.pathname.replace(/\/+$/, "");
     const safeBasePath = basePath ? `/${basePath.replace(/^\/+/, "")}` : "";
     const url = new URL(`${safeBasePath}/downloads/${type}`, baseUrl.origin);
-    for (const [key, value] of Object.entries(params)) {
+    for (const [key, value] of Object.entries(resourceParams)) {
         url.searchParams.set(key, value);
     }
     // Embed auth (and apiUrl when dynamic routing is active) from current session or static config
     // Token is bound to the specific resource (type + params) to prevent URL tampering
-    const resource = { type, params };
+    const resource = { type, params: resourceParams };
+    const allowedProjectIds = getEffectiveAllowedProjectIds();
     const ctx = sessionAuthStore.getStore();
     if (ctx?.token) {
         const headerValue = ctx.header === "Authorization" ? `Bearer ${ctx.token}` : ctx.token;
         const apiUrl = ENABLE_DYNAMIC_API_URL && ctx.apiUrl !== GITLAB_API_URL ? ctx.apiUrl : undefined;
-        url.searchParams.set("_token", createDownloadToken(ctx.header, headerValue, apiUrl, resource));
+        url.searchParams.set("_token", createDownloadToken(ctx.header, headerValue, allowedProjectIds, apiUrl, resource));
     }
     else {
         // Fallback for SSE/static-token mode (no session auth context)
@@ -48,7 +55,7 @@ function buildDownloadUrl(type, params) {
                 header = "Authorization";
                 headerValue = `Bearer ${staticToken}`;
             }
-            url.searchParams.set("_token", createDownloadToken(header, headerValue, undefined, resource));
+            url.searchParams.set("_token", createDownloadToken(header, headerValue, allowedProjectIds, undefined, resource));
         }
     }
     return url.toString();
@@ -63,12 +70,11 @@ import { loadKeyMaterialFromEnv, looksLikeStatelessSessionId, mintSessionId, ope
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, ListPromptsRequestSchema, GetPromptRequestSchema, ListResourcesRequestSchema, ListResourceTemplatesRequestSchema, ReadResourceRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
-import { AsyncLocalStorage } from "node:async_hooks";
 import fetchCookie from "fetch-cookie";
 import fs from "node:fs";
 import { pipeline as streamPipeline } from "node:stream/promises";
 import os from "node:os";
-import { fetch as undiciFetch, File, FormData, } from "undici";
+import { fetch as undiciFetch, File, FormData } from "undici";
 import path from "node:path";
 import { CookieJar, parse as parseCookie } from "tough-cookie";
 import { URL } from "node:url";
@@ -98,6 +104,7 @@ import { MCP_INSTRUCTIONS } from "./server/mcp-instructions.js";
 import { formatUnknownHelpTopic, getWorkflowGuide, readHelpTopic, } from "./server/mcp-help.js";
 import { isInitializationRequestBody, isUnauthenticatedDiscoveryRequestBody, readAcceptHeader, readMcpSessionIdHeader, redactSessionIdForLog, } from "./server/request-helpers.js";
 export { readMcpSessionIdHeader } from "./server/request-helpers.js";
+import { authBySession, BASE_HEADERS, bindSessionProjectScope, buildAuthHeaders, configureGitLabRequestContext, getEffectiveAllowedProjectIds, getEffectiveApiUrl, getFetchConfig, SESSION_PROJECT_SCOPE_MISMATCH, sessionAuthStore, updateSessionPublicBaseUrl, usesJobTokenHeader, withPublicBaseUrl, } from "./server/gitlab-request-context.js";
 import { apiUrlUserinfoWarning, commaSplitHint, configuredApiUrlErrors, encodeGitLabPath, encodeGitLabPathSegment, invalidListEntryError, isCleartextRemoteUrl, normalizeGitLabApiUrl, parseConfiguredGitLabApiUrls, } from "./utils/url.js";
 import { estimateMergeCommitCount, filterDiffsByPatterns, openSafeOutputWriteStream, resolveDownloadRoot, readSafeExistingFile, summarizeWebhookEvents, } from "./utils/helpers.js";
 import { graphqlQueryContainsWriteOperation, graphqlQueryContainsDeleteOperation, } from "./utils/graphql-query.js";
@@ -967,6 +974,15 @@ const clientPool = new GitLabClientPool({
     caCertPath: GITLAB_CA_CERT_PATH,
     poolMaxSize: GITLAB_POOL_MAX_SIZE,
 });
+// GITLAB_API_URL and GITLAB_ALLOWED_PROJECT_IDS are defined further down; the getters
+// read them at call time, after module evaluation.
+configureGitLabRequestContext({
+    logger,
+    getDefaultApiUrl: () => GITLAB_API_URL,
+    getDefaultAllowedProjectIds: () => GITLAB_ALLOWED_PROJECT_IDS,
+    getDispatcherForUrl: apiUrl => clientPool.getDispatcherForUrl(apiUrl),
+    getOAuthAccessToken: () => OAUTH_ACCESS_TOKEN,
+});
 // Create cookie jar with clean Netscape file parsing
 // Resolve cookie path once using os.homedir() for cross-platform support
 const resolvedCookiePath = GITLAB_AUTH_COOKIE_PATH
@@ -1093,129 +1109,6 @@ async function ensureSessionForRequest() {
         logger.debug("Session warmup request failed, will retry on next request");
     }
 }
-const sessionAuthStore = new AsyncLocalStorage();
-// Session context map for storing auth data by session ID
-// This survives async boundaries where AsyncLocalStorage might not
-const authBySession = {};
-function withPublicBaseUrl(authData, publicBaseUrl, previous) {
-    const effectivePublicBaseUrl = publicBaseUrl || previous?.publicBaseUrl;
-    return effectivePublicBaseUrl ? { ...authData, publicBaseUrl: effectivePublicBaseUrl } : authData;
-}
-function updateSessionPublicBaseUrl(sessionId, publicBaseUrl) {
-    if (sessionId && publicBaseUrl && authBySession[sessionId]) {
-        authBySession[sessionId].publicBaseUrl = publicBaseUrl;
-    }
-}
-// Base headers without authentication
-const BASE_HEADERS = {
-    Accept: "application/json",
-    "Content-Type": "application/json",
-};
-/**
- * Build authentication headers dynamically based on context
- * In REMOTE_AUTHORIZATION or GITLAB_MCP_OAUTH mode, reads from AsyncLocalStorage session context
- * Otherwise, uses environment token (OAuth token is refreshed lazily before each tool call)
- */
-function buildAuthHeaders() {
-    if (REMOTE_AUTHORIZATION || GITLAB_MCP_OAUTH) {
-        const ctx = sessionAuthStore.getStore();
-        logger.debug({
-            sidPrefix: redactSessionIdForLog(ctx?.sessionId),
-            header: ctx?.header,
-            apiUrl: ctx?.apiUrl === undefined ? undefined : redactUrlSecretsInText(ctx.apiUrl),
-        }, "buildAuthHeaders: session context");
-        if (ctx?.token) {
-            return {
-                [ctx.header]: ctx.header === "Authorization" ? `Bearer ${ctx.token}` : ctx.token,
-            };
-        }
-        return {}; // No auth headers if no session context
-    }
-    // Standard mode: PAT preferred over job token (broader permissions).
-    // OAuth token takes priority over PAT when both are set.
-    // NOTE: Changed in PR #400 — previously GITLAB_JOB_TOKEN had highest priority.
-    // If both GITLAB_PERSONAL_ACCESS_TOKEN and GITLAB_JOB_TOKEN are set, PAT wins.
-    // OAuth tokens always travel as `Authorization: Bearer`, even with GITLAB_IS_OLD: the HTTP
-    // client strips `Authorization` on cross-origin redirects but not `Private-Token`.
-    if (OAUTH_ACCESS_TOKEN) {
-        return { Authorization: `Bearer ${OAUTH_ACCESS_TOKEN}` };
-    }
-    if (GITLAB_PERSONAL_ACCESS_TOKEN) {
-        return IS_OLD
-            ? { "Private-Token": String(GITLAB_PERSONAL_ACCESS_TOKEN) }
-            : { Authorization: `Bearer ${GITLAB_PERSONAL_ACCESS_TOKEN}` };
-    }
-    // Fall back to CI job token
-    if (GITLAB_JOB_TOKEN) {
-        return { "JOB-TOKEN": String(GITLAB_JOB_TOKEN) };
-    }
-    return {};
-}
-function usesJobTokenHeader() {
-    if (GITLAB_JOB_TOKEN)
-        return true;
-    if (REMOTE_AUTHORIZATION || GITLAB_MCP_OAUTH) {
-        const ctx = sessionAuthStore.getStore();
-        return ctx?.header === "JOB-TOKEN";
-    }
-    return false;
-}
-/**
- * Get the effective GitLab API URL for the current request
- * In REMOTE_AUTHORIZATION mode with ENABLE_DYNAMIC_API_URL, reads from session context
- * Otherwise, uses environment GITLAB_API_URL
- */
-function getEffectiveApiUrl() {
-    if (ENABLE_DYNAMIC_API_URL) {
-        const ctx = sessionAuthStore.getStore();
-        if (ctx?.apiUrl) {
-            return ctx.apiUrl;
-        }
-        logger.warn({
-            sidPrefix: redactSessionIdForLog(ctx?.sessionId),
-            header: ctx?.header,
-            apiUrl: ctx?.apiUrl === undefined ? undefined : redactUrlSecretsInText(ctx.apiUrl),
-        }, "getEffectiveApiUrl: No context or apiUrl found, falling back to default");
-    }
-    return GITLAB_API_URL;
-}
-/**
- * Get the effective project allowlist for the current request
- * In REMOTE_AUTHORIZATION mode with ENABLE_DYNAMIC_PROJECT_SCOPE, reads the scope
- * narrowed via the X-GitLab-Allowed-Project-Ids header from session context
- * (already validated against GITLAB_ALLOWED_PROJECT_IDS by parseAuthHeaders)
- * Otherwise, uses environment GITLAB_ALLOWED_PROJECT_IDS
- */
-function getEffectiveAllowedProjectIds() {
-    if (ENABLE_DYNAMIC_PROJECT_SCOPE) {
-        const ctx = sessionAuthStore.getStore();
-        if (ctx?.allowedProjectIds && ctx.allowedProjectIds.length > 0) {
-            return ctx.allowedProjectIds;
-        }
-    }
-    return GITLAB_ALLOWED_PROJECT_IDS;
-}
-/**
- * Keep a dynamic project scope bound to its session
- * A request that omits X-GitLab-Allowed-Project-Ids keeps the session scope, and a
- * request naming a different scope is refused (null). An unscoped session may be
- * narrowed. Re-initialize to change the scope.
- */
-function bindSessionProjectScope(requested, sessionScope) {
-    if (!sessionScope || sessionScope.length === 0) {
-        return requested;
-    }
-    if (requested === undefined) {
-        return sessionScope;
-    }
-    const want = new Set(requested);
-    const have = new Set(sessionScope);
-    return want.size === have.size && [...want].every(id => have.has(id)) ? sessionScope : null;
-}
-const SESSION_PROJECT_SCOPE_MISMATCH = {
-    error: "Project scope mismatch",
-    message: "X-GitLab-Allowed-Project-Ids does not match the project scope of this session. Re-initialize to change it.",
-};
 /**
  * Reject tools that cannot be limited to allowed projects when
  * ENABLE_STRICT_PROJECT_SCOPE is set and an allowlist is in effect
@@ -1241,24 +1134,6 @@ function filterProjectsByAllowlist(projects) {
     return projects.filter(project => allowedProjectIds.includes(String(project.id)) ||
         allowedProjectIds.includes(project.path_with_namespace));
 }
-/**
- * Get fetch configuration with proper client from pool
- * Uses connection pooling when dynamic API URLs are enabled
- */
-/**
- * Constructs the fetch configuration dynamically.
- * This function is called immediately before each `fetch` to ensure it runs
- * within the correct AsyncLocalStorage context, capturing the necessary auth
- * and API URL information for the current request.
- */
-const getFetchConfig = () => {
-    const effectiveApiUrl = getEffectiveApiUrl();
-    const dispatcher = clientPool.getDispatcherForUrl(effectiveApiUrl);
-    return {
-        headers: { ...BASE_HEADERS, ...buildAuthHeaders() },
-        dispatcher,
-    };
-};
 /**
  * Options for the download sinks that stream a file through `fetchWithValidatedRedirects`.
  *
@@ -10227,7 +10102,7 @@ async function handleToolCall(params) {
                     if (local_path) {
                         throw new Error("local_path cannot be used in remote mode — use the returned download_url instead");
                     }
-                    const downloadUrl = buildDownloadUrl("job-artifacts", { project_id, job_id });
+                    const downloadUrl = buildDownloadUrl("job-artifacts", project_id, { job_id });
                     return {
                         content: [
                             {
@@ -10746,8 +10621,7 @@ async function handleToolCall(params) {
                 // In remote mode for non-image files, return proxy URL
                 const mimeType = getImageMimeType(args.filename);
                 if (IS_REMOTE && !mimeType) {
-                    const downloadUrl = buildDownloadUrl("attachment", {
-                        project_id: args.project_id,
+                    const downloadUrl = buildDownloadUrl("attachment", args.project_id, {
                         secret: args.secret,
                         filename: args.filename,
                     });
@@ -10885,8 +10759,7 @@ async function handleToolCall(params) {
             case "download_release_asset": {
                 const args = DownloadReleaseAssetSchema.parse(params.arguments);
                 if (IS_REMOTE) {
-                    const downloadUrl = buildDownloadUrl("release-asset", {
-                        project_id: args.project_id,
+                    const downloadUrl = buildDownloadUrl("release-asset", args.project_id, {
                         tag_name: args.tag_name,
                         direct_asset_path: args.direct_asset_path,
                     });

package/build/server/gitlab-request-context.js

@@ -0,0 +1,166 @@
+/**
+ * Per-request GitLab context shared by the tool handlers: the session auth store,
+ * the auth headers, the effective API URL and project allowlist, and the fetch
+ * config built from them.
+ *
+ * index.ts owns the values this module reads (the default API URL, the allowlist,
+ * the client pool, the OAuth token, and the logger) and hands them over once with
+ * configureGitLabRequestContext(). The getters are read at call time, as the free
+ * variables they replace were.
+ */
+import { AsyncLocalStorage } from "node:async_hooks";
+import { ENABLE_DYNAMIC_API_URL, ENABLE_DYNAMIC_PROJECT_SCOPE, GITLAB_JOB_TOKEN, GITLAB_MCP_OAUTH, GITLAB_PERSONAL_ACCESS_TOKEN, IS_OLD, REMOTE_AUTHORIZATION, } from "../config.js";
+import { redactUrlSecretsInText } from "../utils/redact-url.js";
+import { redactSessionIdForLog } from "./request-helpers.js";
+let deps;
+export function configureGitLabRequestContext(next) {
+    deps = next;
+}
+function requireDeps() {
+    if (!deps) {
+        throw new Error("GitLab request context used before configureGitLabRequestContext()");
+    }
+    return deps;
+}
+export const sessionAuthStore = new AsyncLocalStorage();
+// Session context map for storing auth data by session ID
+// This survives async boundaries where AsyncLocalStorage might not
+export const authBySession = {};
+export function withPublicBaseUrl(authData, publicBaseUrl, previous) {
+    const effectivePublicBaseUrl = publicBaseUrl || previous?.publicBaseUrl;
+    return effectivePublicBaseUrl ? { ...authData, publicBaseUrl: effectivePublicBaseUrl } : authData;
+}
+export function updateSessionPublicBaseUrl(sessionId, publicBaseUrl) {
+    if (sessionId && publicBaseUrl && authBySession[sessionId]) {
+        authBySession[sessionId].publicBaseUrl = publicBaseUrl;
+    }
+}
+// Base headers without authentication
+export const BASE_HEADERS = {
+    Accept: "application/json",
+    "Content-Type": "application/json",
+};
+/**
+ * Build authentication headers dynamically based on context
+ * In REMOTE_AUTHORIZATION or GITLAB_MCP_OAUTH mode, reads from AsyncLocalStorage session context
+ * Otherwise, uses environment token (OAuth token is refreshed lazily before each tool call)
+ */
+export function buildAuthHeaders() {
+    const { logger, getOAuthAccessToken } = requireDeps();
+    if (REMOTE_AUTHORIZATION || GITLAB_MCP_OAUTH) {
+        const ctx = sessionAuthStore.getStore();
+        logger.debug({
+            sidPrefix: redactSessionIdForLog(ctx?.sessionId),
+            header: ctx?.header,
+            apiUrl: ctx?.apiUrl === undefined ? undefined : redactUrlSecretsInText(ctx.apiUrl),
+        }, "buildAuthHeaders: session context");
+        if (ctx?.token) {
+            return {
+                [ctx.header]: ctx.header === "Authorization" ? `Bearer ${ctx.token}` : ctx.token,
+            };
+        }
+        return {}; // No auth headers if no session context
+    }
+    // Standard mode: PAT preferred over job token (broader permissions).
+    // OAuth token takes priority over PAT when both are set.
+    // NOTE: Changed in PR #400 — previously GITLAB_JOB_TOKEN had highest priority.
+    // If both GITLAB_PERSONAL_ACCESS_TOKEN and GITLAB_JOB_TOKEN are set, PAT wins.
+    // OAuth tokens always travel as `Authorization: Bearer`, even with GITLAB_IS_OLD: the HTTP
+    // client strips `Authorization` on cross-origin redirects but not `Private-Token`.
+    const oauthAccessToken = getOAuthAccessToken();
+    if (oauthAccessToken) {
+        return { Authorization: `Bearer ${oauthAccessToken}` };
+    }
+    if (GITLAB_PERSONAL_ACCESS_TOKEN) {
+        return IS_OLD
+            ? { "Private-Token": String(GITLAB_PERSONAL_ACCESS_TOKEN) }
+            : { Authorization: `Bearer ${GITLAB_PERSONAL_ACCESS_TOKEN}` };
+    }
+    // Fall back to CI job token
+    if (GITLAB_JOB_TOKEN) {
+        return { "JOB-TOKEN": String(GITLAB_JOB_TOKEN) };
+    }
+    return {};
+}
+export function usesJobTokenHeader() {
+    if (GITLAB_JOB_TOKEN)
+        return true;
+    if (REMOTE_AUTHORIZATION || GITLAB_MCP_OAUTH) {
+        const ctx = sessionAuthStore.getStore();
+        return ctx?.header === "JOB-TOKEN";
+    }
+    return false;
+}
+/**
+ * Get the effective GitLab API URL for the current request
+ * In REMOTE_AUTHORIZATION mode with ENABLE_DYNAMIC_API_URL, reads from session context
+ * Otherwise, uses environment GITLAB_API_URL
+ */
+export function getEffectiveApiUrl() {
+    const { logger, getDefaultApiUrl } = requireDeps();
+    if (ENABLE_DYNAMIC_API_URL) {
+        const ctx = sessionAuthStore.getStore();
+        if (ctx?.apiUrl) {
+            return ctx.apiUrl;
+        }
+        logger.warn({
+            sidPrefix: redactSessionIdForLog(ctx?.sessionId),
+            header: ctx?.header,
+            apiUrl: ctx?.apiUrl === undefined ? undefined : redactUrlSecretsInText(ctx.apiUrl),
+        }, "getEffectiveApiUrl: No context or apiUrl found, falling back to default");
+    }
+    return getDefaultApiUrl();
+}
+/**
+ * Get the effective project allowlist for the current request
+ * In REMOTE_AUTHORIZATION mode with ENABLE_DYNAMIC_PROJECT_SCOPE, reads the scope
+ * narrowed via the X-GitLab-Allowed-Project-Ids header from session context
+ * (already validated against GITLAB_ALLOWED_PROJECT_IDS by parseAuthHeaders)
+ * Otherwise, uses environment GITLAB_ALLOWED_PROJECT_IDS
+ */
+export function getEffectiveAllowedProjectIds() {
+    const { getDefaultAllowedProjectIds } = requireDeps();
+    if (ENABLE_DYNAMIC_PROJECT_SCOPE) {
+        const ctx = sessionAuthStore.getStore();
+        if (ctx?.allowedProjectIds && ctx.allowedProjectIds.length > 0) {
+            return ctx.allowedProjectIds;
+        }
+    }
+    return getDefaultAllowedProjectIds();
+}
+/**
+ * Keep a dynamic project scope bound to its session
+ * A request that omits X-GitLab-Allowed-Project-Ids keeps the session scope, and a
+ * request naming a different scope is refused (null). An unscoped session may be
+ * narrowed. Re-initialize to change the scope.
+ */
+export function bindSessionProjectScope(requested, sessionScope) {
+    if (!sessionScope || sessionScope.length === 0) {
+        return requested;
+    }
+    if (requested === undefined) {
+        return sessionScope;
+    }
+    const want = new Set(requested);
+    const have = new Set(sessionScope);
+    return want.size === have.size && [...want].every(id => have.has(id)) ? sessionScope : null;
+}
+export const SESSION_PROJECT_SCOPE_MISMATCH = {
+    error: "Project scope mismatch",
+    message: "X-GitLab-Allowed-Project-Ids does not match the project scope of this session. Re-initialize to change it.",
+};
+/**
+ * Constructs the fetch configuration dynamically.
+ * This function is called immediately before each `fetch` to ensure it runs
+ * within the correct AsyncLocalStorage context, capturing the necessary auth
+ * and API URL information for the current request.
+ * Uses connection pooling when dynamic API URLs are enabled.
+ */
+export const getFetchConfig = () => {
+    const effectiveApiUrl = getEffectiveApiUrl();
+    const dispatcher = requireDeps().getDispatcherForUrl(effectiveApiUrl);
+    return {
+        headers: { ...BASE_HEADERS, ...buildAuthHeaders() },
+        dispatcher,
+    };
+};

package/build/utils/download-token.js

@@ -21,14 +21,17 @@ const DOWNLOAD_TOKEN_TTL = Number.isFinite(parsedDownloadTokenTtl) && parsedDown
     : DEFAULT_DOWNLOAD_TOKEN_TTL;
 /**
  * Create a self-contained encrypted download token for a specific GitLab resource.
+ * `allowedProjectIds` is the project allowlist of the issuing request (session scope
+ * or GITLAB_ALLOWED_PROJECT_IDS), because the download proxy runs outside that request.
  */
-export function createDownloadToken(header, token, apiUrl, resource) {
+export function createDownloadToken(header, token, allowedProjectIds, apiUrl, resource) {
     const iv = randomBytes(12);
     const cipher = createCipheriv("aes-256-gcm", DOWNLOAD_TOKEN_KEY, iv);
     const payload = JSON.stringify({
         h: header,
         t: token,
         e: Math.floor(Date.now() / 1000) + DOWNLOAD_TOKEN_TTL,
+        s: allowedProjectIds,
         ...(apiUrl ? { u: apiUrl } : {}),
         ...(resource ? { r: resource.type, p: resource.params } : {}),
     });
@@ -36,8 +39,13 @@ export function createDownloadToken(header, token, apiUrl, resource) {
     const tag = cipher.getAuthTag();
     return Buffer.concat([iv, tag, encrypted]).toString("base64url");
 }
+function isStringArray(value) {
+    return Array.isArray(value) && value.every(item => typeof item === "string");
+}
 /**
  * Decrypt and validate a download token, returning null when it is invalid or expired.
+ * A token without a sealed project allowlist was issued by an older release, which
+ * did not check the session scope, so it is invalid too.
  */
 export function decryptDownloadToken(tokenStr) {
     try {
@@ -58,9 +66,12 @@ export function decryptDownloadToken(tokenStr) {
             return null;
         if (typeof payload.t !== "string" || payload.t.length === 0)
             return null;
+        if (!isStringArray(payload.s))
+            return null;
         return {
             header: payload.h,
             token: payload.t,
+            allowedProjectIds: payload.s,
             ...(payload.u ? { apiUrl: payload.u } : {}),
             ...(payload.r ? { resourceType: payload.r, resourceParams: payload.p } : {}),
         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.3.8-next.148",
+  "version": "2.3.8-next.150",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [