@zereight/mcp-gitlab 2.3.8-next.149 → 2.3.8-next.150

package/build/downloads/proxy.js

@@ -11,6 +11,18 @@ function canonicalizeQueryParams(params) {
     }
     return JSON.stringify(normalized);
 }
+/**
+ * Check the requested project against the env allowlist (getEffectiveProjectId) and
+ * against the allowlist sealed into the download token, since the proxy runs
+ * outside the session that issued it.
+ */
+function resolveDownloadProjectId(deps, projectId, sealedProjectIds) {
+    const effectiveProjectId = deps.getEffectiveProjectId(decodeURIComponent(projectId));
+    if (sealedProjectIds.length > 0 && !sealedProjectIds.includes(effectiveProjectId)) {
+        throw new Error(`Access denied: Project ${effectiveProjectId} is outside the project scope of this download token`);
+    }
+    return effectiveProjectId;
+}
 /**
  * Register the /downloads/:type proxy endpoint on an Express app.
  * Streams GitLab API responses directly to the client. Auth is read from
@@ -46,6 +58,7 @@ export function registerDownloadProxy(app, deps) {
         // Try embedded encrypted token first (self-contained URL), then headers
         const encryptedToken = req.query._token;
         let tokenApiUrl;
+        let sealedProjectIds = [];
         if (encryptedToken) {
             const decrypted = decryptDownloadToken(encryptedToken);
             if (!decrypted) {
@@ -70,6 +83,7 @@ export function registerDownloadProxy(app, deps) {
             headers[decrypted.header] = decrypted.token;
             rateLimitKey = decrypted.token;
             tokenApiUrl = decrypted.apiUrl;
+            sealedProjectIds = decrypted.allowedProjectIds;
         }
         else {
             const privateToken = req.headers["private-token"];
@@ -119,7 +133,7 @@ export function registerDownloadProxy(app, deps) {
                         res.status(400).json({ error: "project_id and job_id are required" });
                         return;
                     }
-                    const effectiveProjectId = deps.getEffectiveProjectId(decodeURIComponent(project_id));
+                    const effectiveProjectId = resolveDownloadProjectId(deps, project_id, sealedProjectIds);
                     gitlabUrl = `${apiUrl}/projects/${deps.encodeGitLabPathSegment(effectiveProjectId)}/jobs/${deps.encodeGitLabPathSegment(job_id)}/artifacts`;
                     break;
                 }
@@ -129,7 +143,7 @@ export function registerDownloadProxy(app, deps) {
                         res.status(400).json({ error: "project_id, secret, and filename are required" });
                         return;
                     }
-                    const effectiveProjectId = deps.getEffectiveProjectId(decodeURIComponent(project_id));
+                    const effectiveProjectId = resolveDownloadProjectId(deps, project_id, sealedProjectIds);
                     // The uploads route takes one filename segment; a slash inside the name must
                     // stay inside that segment instead of turning into another route level.
                     gitlabUrl = `${apiUrl}/projects/${deps.encodeGitLabPathSegment(effectiveProjectId)}/uploads/${deps.encodeGitLabPathSegment(secret)}/${deps.encodeGitLabPathSegment(filename)}`;
@@ -143,7 +157,7 @@ export function registerDownloadProxy(app, deps) {
                             .json({ error: "project_id, tag_name, and direct_asset_path are required" });
                         return;
                     }
-                    const effectiveProjectId = deps.getEffectiveProjectId(decodeURIComponent(project_id));
+                    const effectiveProjectId = resolveDownloadProjectId(deps, project_id, sealedProjectIds);
                     gitlabUrl = `${apiUrl}/projects/${deps.encodeGitLabPathSegment(effectiveProjectId)}/releases/${deps.encodeGitLabPathSegment(tag_name)}/downloads/${deps.encodeGitLabPath(direct_asset_path)}`;
                     break;
                 }

package/build/index.js

@@ -8,25 +8,32 @@ const STREAMABLE_HTTP_AUTH_TOKEN = getConfig("streamable-http-auth-token", "STRE
  * Build a URL pointing to the download proxy endpoint.
  * Embeds an encrypted auth token (and API URL for dynamic routing)
  * from the current session so the URL works standalone.
+ * @throws {ProjectAccessDeniedError} If the project is outside the effective allowlist
  */
-function buildDownloadUrl(type, params) {
+function buildDownloadUrl(type, projectId, params) {
+    // Decoded once, like the /downloads proxy does, so both check the same value
+    const resourceParams = {
+        ...params,
+        project_id: getEffectiveProjectId(decodeURIComponent(projectId)),
+    };
     const base = MCP_SERVER_URL || sessionAuthStore.getStore()?.publicBaseUrl || `http://${HOST}:${PORT}`;
     const baseUrl = new URL(base);
     // Preserve any path prefix (e.g. /gitlab-mcp) from the base URL
     const basePath = baseUrl.pathname.replace(/\/+$/, "");
     const safeBasePath = basePath ? `/${basePath.replace(/^\/+/, "")}` : "";
     const url = new URL(`${safeBasePath}/downloads/${type}`, baseUrl.origin);
-    for (const [key, value] of Object.entries(params)) {
+    for (const [key, value] of Object.entries(resourceParams)) {
         url.searchParams.set(key, value);
     }
     // Embed auth (and apiUrl when dynamic routing is active) from current session or static config
     // Token is bound to the specific resource (type + params) to prevent URL tampering
-    const resource = { type, params };
+    const resource = { type, params: resourceParams };
+    const allowedProjectIds = getEffectiveAllowedProjectIds();
     const ctx = sessionAuthStore.getStore();
     if (ctx?.token) {
         const headerValue = ctx.header === "Authorization" ? `Bearer ${ctx.token}` : ctx.token;
         const apiUrl = ENABLE_DYNAMIC_API_URL && ctx.apiUrl !== GITLAB_API_URL ? ctx.apiUrl : undefined;
-        url.searchParams.set("_token", createDownloadToken(ctx.header, headerValue, apiUrl, resource));
+        url.searchParams.set("_token", createDownloadToken(ctx.header, headerValue, allowedProjectIds, apiUrl, resource));
     }
     else {
         // Fallback for SSE/static-token mode (no session auth context)
@@ -48,7 +55,7 @@ function buildDownloadUrl(type, params) {
                 header = "Authorization";
                 headerValue = `Bearer ${staticToken}`;
             }
-            url.searchParams.set("_token", createDownloadToken(header, headerValue, undefined, resource));
+            url.searchParams.set("_token", createDownloadToken(header, headerValue, allowedProjectIds, undefined, resource));
         }
     }
     return url.toString();
@@ -10095,7 +10102,7 @@ async function handleToolCall(params) {
                     if (local_path) {
                         throw new Error("local_path cannot be used in remote mode — use the returned download_url instead");
                     }
-                    const downloadUrl = buildDownloadUrl("job-artifacts", { project_id, job_id });
+                    const downloadUrl = buildDownloadUrl("job-artifacts", project_id, { job_id });
                     return {
                         content: [
                             {
@@ -10614,8 +10621,7 @@ async function handleToolCall(params) {
                 // In remote mode for non-image files, return proxy URL
                 const mimeType = getImageMimeType(args.filename);
                 if (IS_REMOTE && !mimeType) {
-                    const downloadUrl = buildDownloadUrl("attachment", {
-                        project_id: args.project_id,
+                    const downloadUrl = buildDownloadUrl("attachment", args.project_id, {
                         secret: args.secret,
                         filename: args.filename,
                     });
@@ -10753,8 +10759,7 @@ async function handleToolCall(params) {
             case "download_release_asset": {
                 const args = DownloadReleaseAssetSchema.parse(params.arguments);
                 if (IS_REMOTE) {
-                    const downloadUrl = buildDownloadUrl("release-asset", {
-                        project_id: args.project_id,
+                    const downloadUrl = buildDownloadUrl("release-asset", args.project_id, {
                         tag_name: args.tag_name,
                         direct_asset_path: args.direct_asset_path,
                     });

package/build/utils/download-token.js

@@ -21,14 +21,17 @@ const DOWNLOAD_TOKEN_TTL = Number.isFinite(parsedDownloadTokenTtl) && parsedDown
     : DEFAULT_DOWNLOAD_TOKEN_TTL;
 /**
  * Create a self-contained encrypted download token for a specific GitLab resource.
+ * `allowedProjectIds` is the project allowlist of the issuing request (session scope
+ * or GITLAB_ALLOWED_PROJECT_IDS), because the download proxy runs outside that request.
  */
-export function createDownloadToken(header, token, apiUrl, resource) {
+export function createDownloadToken(header, token, allowedProjectIds, apiUrl, resource) {
     const iv = randomBytes(12);
     const cipher = createCipheriv("aes-256-gcm", DOWNLOAD_TOKEN_KEY, iv);
     const payload = JSON.stringify({
         h: header,
         t: token,
         e: Math.floor(Date.now() / 1000) + DOWNLOAD_TOKEN_TTL,
+        s: allowedProjectIds,
         ...(apiUrl ? { u: apiUrl } : {}),
         ...(resource ? { r: resource.type, p: resource.params } : {}),
     });
@@ -36,8 +39,13 @@ export function createDownloadToken(header, token, apiUrl, resource) {
     const tag = cipher.getAuthTag();
     return Buffer.concat([iv, tag, encrypted]).toString("base64url");
 }
+function isStringArray(value) {
+    return Array.isArray(value) && value.every(item => typeof item === "string");
+}
 /**
  * Decrypt and validate a download token, returning null when it is invalid or expired.
+ * A token without a sealed project allowlist was issued by an older release, which
+ * did not check the session scope, so it is invalid too.
  */
 export function decryptDownloadToken(tokenStr) {
     try {
@@ -58,9 +66,12 @@ export function decryptDownloadToken(tokenStr) {
             return null;
         if (typeof payload.t !== "string" || payload.t.length === 0)
             return null;
+        if (!isStringArray(payload.s))
+            return null;
         return {
             header: payload.h,
             token: payload.t,
+            allowedProjectIds: payload.s,
             ...(payload.u ? { apiUrl: payload.u } : {}),
             ...(payload.r ? { resourceType: payload.r, resourceParams: payload.p } : {}),
         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.3.8-next.149",
+  "version": "2.3.8-next.150",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [