refactor(api): add unified GitLab REST API client and OAuth storage backends by polaz · Pull Request #18 · structured-world/gitlab-mcp

polaz · 2026-01-18T15:33:24Z

Summary

Introduces a unified GitLab REST API client, pluggable OAuth session storage backends, and fixes all ESLint errors.

Closes #17

Changes

Unified GitLab REST API Client (`src/utils/gitlab-api.ts`)

Centralized URL building with base URL from config
Query parameters serialization with undefined/null filtering
Request body encoding (JSON or form-urlencoded)
Automatic GID cleanup from responses
Handle 204 No Content responses correctly

OAuth Session Storage Backends

New pluggable storage architecture:

Memory Backend (default) - In-memory, sessions lost on restart
File Backend - JSON file persistence with configurable save interval
PostgreSQL Backend - Production-grade storage via Prisma ORM

OAuth Dual Flow Support

Authorization Code Flow - For Claude.ai Custom Connectors (with redirect_uri)
Device Flow - For CLI clients and Claude Desktop (without redirect_uri)
Auto-selection based on redirect_uri presence

New Endpoints

/oauth/callback - GitLab OAuth callback
/oauth/poll - Device flow polling
/register - Dynamic client registration (RFC 7591)

Lint Fixes

All 101 ESLint errors fixed without eslint-disable comments
Prisma type resolution with GenericPrismaClient pattern
Logger mocks fixed in tests

Test plan

yarn lint - 0 errors
yarn build - builds successfully
yarn test - 1285/1290 tests pass (5 integration timing issues)
Unit tests cover all new storage backends
Registry handlers use new gitlab-api utility

Introduces gitlab-api.ts utility for consistent GitLab API interactions and resolves all 101 ESLint errors without using eslint-disable comments. API CLIENT CHANGES: - Add src/utils/gitlab-api.ts with unified request handling - Centralized URL building, query params, and error handling - Support for JSON and form-urlencoded content types - Automatic GID cleanup from responses - Handle 204 No Content responses correctly OAUTH STORAGE BACKEND: - Add PostgreSQL storage backend via Prisma ORM - Add file-based storage backend for persistence - Add memory storage backend (default) - Storage factory for runtime selection - Dynamic Prisma import to avoid compile-time dependency REGISTRY REFACTORING: - Refactor labels, wiki, variables, milestones registries - Use new gitlab-api utility for cleaner request handling - Consistent pattern across all entity registries LINT FIXES: - Fix unnecessary type assertion in gitlab-api.ts - Fix Prisma type resolution with explicit interfaces - Fix logger mocks in integration and unit tests - All 101 errors resolved with proper typing Closes #17

codecov · 2026-01-18T15:34:33Z

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

ℹ️ You can also turn on project coverage checks and project coverage reporting on Pull Request comment

Thanks for integrating Codecov - We've got you covered ☂️

Copilot

Pull request overview

This PR introduces a unified GitLab REST API client, pluggable OAuth session storage backends, and resolves ESLint errors. The changes support both authorization code flow (for Claude.ai) and device flow (for CLI/Desktop), with backend options including memory, file-based, and PostgreSQL storage.

Changes:

Added unified GitLab REST API client with centralized URL building, query parameter handling, and GID cleanup
Implemented OAuth session storage backends (memory, file, PostgreSQL) with automatic flow detection
Fixed all ESLint errors and improved OAuth-aware authentication handling

Reviewed changes

Copilot reviewed 52 out of 61 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
tests/unit/oauth/endpoints/authorize.test.ts	Updated tests to support dual OAuth flows with redirect-based and device flow paths
tests/unit/entities/wiki/registry.test.ts	ESLint formatting fixes (quotes, line breaks)
tests/unit/entities/variables/registry.test.ts	ESLint formatting fixes and test expectations for 204 responses
tests/unit/entities/pipelines/registry.test.ts	ESLint formatting fixes and simplified API call expectations
tests/unit/entities/mrs/registry.test.ts	ESLint formatting fixes with consistent quote style
tests/unit/entities/milestones/registry.test.ts	ESLint formatting fixes and updated delete expectations for 204 responses
src/utils/smart-user-search.ts	Removed redundant Authorization header (now handled by enhancedFetch)
src/utils/namespace.ts	Removed redundant Authorization header
src/utils/idConversion.ts	Removed unnecessary eslint-disable comment
src/utils/gitlab-api.ts	New unified GitLab API client with query building and error handling
src/utils/fetch.ts	Added OAuth token context warnings and removed unused eslint-disable
src/types.ts	Removed unnecessary eslint-disable comment
src/services/ToolAvailability.ts	Improved OAuth mode handling to allow tools before introspection
src/services/ConnectionManager.ts	Added deferred introspection support for OAuth mode with unauthenticated version detection

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

tests/unit/oauth/endpoints/authorize.test.ts

tests/unit/entities/variables/registry.test.ts

src/utils/gitlab-api.ts

src/services/ConnectionManager.ts

FIXES: - Fix ConnectionManager tier detection: default enterprise tier to "premium" instead of "ultimate" (will be refined on authenticated request) - Fix gitlab-api.ts comment: contentType default is "form" not "json" - Add explanatory comment for 204 No Content type assertion behavior TEST IMPROVEMENTS: - Fix authorize.test.ts mock to use correct buildGitLabAuthUrl signature (config, callbackUri, internalState) for proper state verification - Add state consistency assertion verifying stored state matches redirect URL - Add explicit per_page test in variables/registry.test.ts BUILD FIX: - Regenerate yarn.lock with correct bin path (dist/src/main.js)

Copilot

Pull request overview

Copilot reviewed 52 out of 61 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

tests/unit/entities/variables/registry.test.ts

tests/unit/entities/milestones/registry.test.ts

src/utils/gitlab-api.ts

- Update pr-test.yml to use Yarn 4 with corepack - Update npm-publish.yml to use Yarn 4 for dependencies - Update Node.js version matrix to 20.x, 22.x, 24.x - Fix Docker test to use correct dist path (dist/src/main.js) - Remove deprecated npm audit and security checks (handled by CodeQL)

- Expand 204 No Content comment to mention PUT/POST operations - Add explicit per_page test for milestone burndown events

src/server.ts

Add Prisma and @prisma/client dependencies that were missing for the PostgreSQL OAuth storage backend. Update CI workflows to run `npx prisma generate` before build to create the typed client.

- Initialize lastError variable to satisfy definite assignment check - Remove unsupported STDIO transport mode case and check - Simplify HTTP server wait logic since all modes are HTTP-based now

- Add STDIO back to TransportMode enum (was missing, not removed) - Restore STDIO case handler and mode check in server-launcher - Use yarn prisma generate instead of npx in CI workflows

Implements rate limiting per issue #6 to address CodeQL security findings. Design: - Per-IP rate limiting for anonymous requests (enabled by default) - Authenticated users skip rate limiting (trusted, no friction) - Standard X-RateLimit-* headers on responses - HTTP 429 with Retry-After for exceeded limits - Configurable via environment variables Config (all optional): - RATE_LIMIT_IP_ENABLED=false to disable - RATE_LIMIT_IP_WINDOW_MS (default: 60000) - RATE_LIMIT_IP_MAX_REQUESTS (default: 100) - RATE_LIMIT_SESSION_ENABLED=true for optional session limits Closes #6

Add comprehensive unit tests for the new rate-limiter middleware: - Health check endpoint bypass - OAuth session authentication bypass - MCP session header authentication bypass - IP-based rate limiting for anonymous requests - Rate limit headers verification - IP fallback handling (socket.remoteAddress, unknown) - getRateLimitStats function - stopCleanup function Coverage for rate-limiter.ts improved from 17% to 84%.

src/server.ts

Copilot

Pull request overview

Copilot reviewed 57 out of 68 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

The ci-cd.yml workflow was missing the `yarn prisma generate` step, causing tests to fail with "Cannot find module '../../../generated/prisma/client'". This was already added to pr-test.yml but missing from ci-cd.yml.

Copilot

Pull request overview

Copilot reviewed 58 out of 69 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

github-actions · 2026-01-18T20:18:53Z

📊 Test Coverage Report

Overall Coverage: 72.75%

Coverage Details

Metric	Percentage
Statements	$(cat coverage/lcov-report/index.html
Branches	$(cat coverage/lcov-report/index.html
Functions	$(cat coverage/lcov-report/index.html
Lines	$(cat coverage/lcov-report/index.html

📈 Coverage Report: View detailed coverage report

This report was generated automatically from your PR changes.

Make prisma generate only run when schema.prisma exists, allowing Docker builds to succeed when the dependencies stage doesn't have the prisma schema copied yet.

…ibility Ensures Prisma client is generated in Docker builder stage where schema is available, since postinstall skips generation when schema.prisma isn't present (dependencies stage).

The builder stage needs the prisma schema to generate the Prisma client during the build step. Without it, `prisma generate` fails and TypeScript compilation cannot find the generated client imports.

The rate limiting middleware is applied globally before OAuth endpoints are registered. Adding lgtm suppression comment to document this and suppress false positive CodeQL alerts.

- Create CodeQL workflow that uses custom config file - Exclude js/missing-rate-limiting (false positive - middleware applied globally) - Exclude js/insufficient-password-hash (false positive - JWT HMAC signing, not password hashing) - Remove ineffective lgtm comment from server.ts

Copilot AI review requested due to automatic review settings January 18, 2026 15:33

Copilot AI reviewed Jan 18, 2026

View reviewed changes

polaz requested a review from Copilot January 18, 2026 15:41

Copilot AI reviewed Jan 18, 2026

View reviewed changes

tests/unit/entities/variables/registry.test.ts Show resolved Hide resolved

tests/unit/entities/milestones/registry.test.ts Show resolved Hide resolved

src/utils/gitlab-api.ts Outdated Show resolved Hide resolved

polaz added 2 commits January 18, 2026 17:43

fix: address additional Copilot review comments

8759662

- Expand 204 No Content comment to mention PUT/POST operations - Add explicit per_page test for milestone burndown events

github-advanced-security bot found potential problems Jan 18, 2026

View reviewed changes

src/server.ts Dismissed Show dismissed Hide dismissed

src/server.ts Dismissed Show dismissed Hide dismissed

src/server.ts Dismissed Show dismissed Hide dismissed

polaz added 5 commits January 18, 2026 17:50

fix(ci): add Prisma dependencies and generate step to workflows

76e2233

Add Prisma and @prisma/client dependencies that were missing for the PostgreSQL OAuth storage backend. Update CI workflows to run `npx prisma generate` before build to create the typed client.

fix(types): resolve TypeScript errors in server-launcher.ts

c06a097

- Initialize lastError variable to satisfy definite assignment check - Remove unsupported STDIO transport mode case and check - Simplify HTTP server wait logic since all modes are HTTP-based now

fix: restore STDIO transport mode and use yarn for prisma

0fadedf

- Add STDIO back to TransportMode enum (was missing, not removed) - Restore STDIO case handler and mode check in server-launcher - Use yarn prisma generate instead of npx in CI workflows

polaz requested a review from Copilot January 18, 2026 20:06

github-advanced-security bot found potential problems Jan 18, 2026

View reviewed changes

src/server.ts Dismissed Show dismissed Hide dismissed

src/server.ts Dismissed Show dismissed Hide dismissed

src/server.ts Dismissed Show dismissed Hide dismissed

Copilot AI reviewed Jan 18, 2026

View reviewed changes

fix(ci): add Prisma client generation to ci-cd workflow

7f11e80

The ci-cd.yml workflow was missing the `yarn prisma generate` step, causing tests to fail with "Cannot find module '../../../generated/prisma/client'". This was already added to pr-test.yml but missing from ci-cd.yml.

polaz requested a review from Copilot January 18, 2026 20:12

Copilot AI reviewed Jan 18, 2026

View reviewed changes

fix(deps): add prisma generate to postinstall script

1c41931

polaz added 6 commits January 18, 2026 22:25

fix(deps): make postinstall conditional for Docker compatibility

185a9a3

Make prisma generate only run when schema.prisma exists, allowing Docker builds to succeed when the dependencies stage doesn't have the prisma schema copied yet.

fix(build): include prisma generate in build script for Docker compat…

3a094be

…ibility Ensures Prisma client is generated in Docker builder stage where schema is available, since postinstall skips generation when schema.prisma isn't present (dependencies stage).

fix(docker): copy prisma schema to builder stage

42200fd

The builder stage needs the prisma schema to generate the Prisma client during the build step. Without it, `prisma generate` fails and TypeScript compilation cannot find the generated client imports.

fix(security): add CodeQL suppression for rate limiting false positives

a1be5c4

The rate limiting middleware is applied globally before OAuth endpoints are registered. Adding lgtm suppression comment to document this and suppress false positive CodeQL alerts.

revert: remove custom CodeQL workflow due to SARIF upload conflict

aa47e12

polaz merged commit 1e23bdd into main Jan 18, 2026
19 of 20 checks passed

polaz deleted the refactor/#17-unified-gitlab-api-client branch January 19, 2026 14:56

Conversation

polaz commented Jan 18, 2026

Summary

Changes

Unified GitLab REST API Client (src/utils/gitlab-api.ts)

OAuth Session Storage Backends

OAuth Dual Flow Support

New Endpoints

Lint Fixes

Test plan

Uh oh!

codecov bot commented Jan 18, 2026

Welcome to Codecov 🎉

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

github-actions bot commented Jan 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📊 Test Coverage Report

Coverage Details

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Unified GitLab REST API Client (`src/utils/gitlab-api.ts`)

github-actions bot commented Jan 18, 2026 •

edited

Loading