Press n or j to go to the next uncovered block, b, p or k for the previous block.
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 | 22x 22x 22x 22x 22x 27x 4x 1x 12x 12x 3x 9x 26x 15x 4x 11x 10x 52x 7x 5x 4x 3x 10x 23x 22x 3x 55x 28x 27x 27x 26x 26x 16x 16x 4x 12x 1x 11x 10x 10x 9x 8x 7x 7x 7x 7x 7x 14x 7x | import { gitlab } from '../utils/gitlab-api';
import { normalizeProjectId } from '../utils/projectIdentifier';
import { hasExplicitScopeTarget } from '../profiles/scope-enforcer';
import { readAllowedProject } from './operator-projects';
import type { ReadResource } from './scope-ids';
import { canonicalProjectPath } from '../utils/api-path';
type Args = Record<string, unknown>;
interface DefaultedProject {
args: Args;
read: ReadResource;
}
function projectField(declared: ReadonlySet<string>): string | undefined {
if (declared.has('project_id')) return 'project_id';
if (declared.has('projectId')) return 'projectId';
return undefined;
}
function numericDefault(value: string): number {
const id = Number(value);
if (!Number.isSafeInteger(id) || id <= 0)
throw new TypeError('Default project ID must be a positive safe integer');
return id;
}
function projectFormat(tool: string, args: Args): 'identifier' | 'number' | 'path' {
if (tool === 'browse_todos') return 'number';
// These handlers pass their project target to GraphQL project(fullPath:).
if (tool === 'browse_vulnerabilities' || tool === 'browse_registry' || tool === 'browse_runners')
return 'path';
if (tool === 'manage_runner' && args.runner_type === 'PROJECT_TYPE') return 'path';
return 'identifier';
}
function omissionSelectsResourceScope(tool: string, args: Args): boolean {
// For these actions an omitted owner selects the resource scope, not a default project.
switch (tool) {
case 'browse_audit_events':
case 'browse_access_tokens':
return args.action === 'get';
case 'manage_access_token':
return args.action === 'rotate' || args.action === 'revoke';
case 'browse_snippets':
return args.action === 'get' || args.scope !== 'project';
case 'manage_snippet':
return true;
case 'browse_deploy_keys':
return args.action === 'list' && args.public !== undefined;
default:
return false;
}
}
/** Fill only an omitted project, preserving the tool's declared numeric or path contract. */
export async function withDefaultProject(
tool: string,
args: Args,
declared: ReadonlySet<string> | undefined,
defaultProject: string | undefined,
expired: () => boolean,
read: ReadResource = (path) => gitlab.get(path),
): Promise<DefaultedProject> {
if (
!defaultProject ||
args.scope === 'group' ||
!declared ||
omissionSelectsResourceScope(tool, args) ||
hasExplicitScopeTarget(args, declared)
)
return { args, read };
const field = projectField(declared);
if (!field) return { args, read };
const format = projectFormat(tool, args);
if (format === 'identifier') return { args: { ...args, [field]: defaultProject }, read };
const numeric = /^\d+$/.test(defaultProject);
if (format === 'number' && numeric)
return { args: { ...args, [field]: numericDefault(defaultProject) }, read };
if (format === 'path' && !numeric)
return { args: { ...args, [field]: canonicalProjectPath(defaultProject) }, read };
if (expired()) throw new Error('Tool call expired during default project verification');
const project = await readAllowedProject(defaultProject, read);
if (expired()) throw new Error('Tool call expired during default project verification');
if (!project) throw new Error('Default project not found or not accessible');
const id = numericDefault(project.id);
const identity = { id, path_with_namespace: project.path, name_with_namespace: project.name };
const requested = `projects/${normalizeProjectId(defaultProject)}`;
const canonical = `projects/${normalizeProjectId(project.path)}`;
const numericPath = `projects/${id}`;
// Reuse this call's verified identity when its allowlist or working scope names an alias.
const withIdentity: ReadResource = (path) =>
path === requested || path === canonical || path === numericPath
? Promise.resolve(identity)
: read(path);
return { args: { ...args, [field]: format === 'path' ? project.path : id }, read: withIdentity };
}
|