Add GitLab Duo auth and executor support

Author: LuxVTZ

README.md

@@ -8,6 +8,8 @@ All third-party provider support is maintained by community contributors; CLIPro
 
 The Plus release stays in lockstep with the mainline features.
 
+GitLab Duo is supported here via OAuth or personal access token login, with model discovery and provider-native routing through the GitLab AI gateway when managed credentials are available.
+
 ## Contributing
 
 This project only accepts pull requests that relate to third-party provider support. Any pull requests unrelated to third-party provider support will be rejected.

internal/auth/gitlab/gitlab.go

@@ -426,7 +426,7 @@ func ExtractDiscoveredModels(metadata map[string]any) []DiscoveredModel {
 		if name == "" {
 			return
 		}
-		key := strings.ToLower(provider + "\x00" + name)
+		key := strings.ToLower(name)
 		if _, ok := seen[key]; ok {
 			return
 		}

internal/auth/gitlab/gitlab_test.go

@@ -2,71 +2,137 @@ package gitlab
 
 import (
 	"context"
+	"encoding/json"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
+	"strings"
 	"testing"
 )
 
-func TestNormalizeBaseURL(t *testing.T) {
-	tests := []struct {
-		name string
-		in   string
-		want string
-	}{
-		{name: "default", in: "", want: DefaultBaseURL},
-		{name: "plain host", in: "gitlab.example.com", want: "https://gitlab.example.com"},
-		{name: "trim trailing slash", in: "https://gitlab.example.com/", want: "https://gitlab.example.com"},
+func TestAuthClientGenerateAuthURLIncludesPKCE(t *testing.T) {
+	client := NewAuthClient(nil)
+	pkce, err := GeneratePKCECodes()
+	if err != nil {
+		t.Fatalf("GeneratePKCECodes() error = %v", err)
 	}
 
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			if got := NormalizeBaseURL(tc.in); got != tc.want {
-				t.Fatalf("NormalizeBaseURL(%q) = %q, want %q", tc.in, got, tc.want)
-			}
-		})
+	rawURL, err := client.GenerateAuthURL("https://gitlab.example.com", "client-id", RedirectURL(17171), "state-123", pkce)
+	if err != nil {
+		t.Fatalf("GenerateAuthURL() error = %v", err)
+	}
+
+	parsed, err := url.Parse(rawURL)
+	if err != nil {
+		t.Fatalf("Parse(authURL) error = %v", err)
+	}
+	if got := parsed.Path; got != "/oauth/authorize" {
+		t.Fatalf("expected /oauth/authorize path, got %q", got)
+	}
+	query := parsed.Query()
+	if got := query.Get("client_id"); got != "client-id" {
+		t.Fatalf("expected client_id, got %q", got)
+	}
+	if got := query.Get("scope"); got != defaultOAuthScope {
+		t.Fatalf("expected scope %q, got %q", defaultOAuthScope, got)
+	}
+	if got := query.Get("code_challenge_method"); got != "S256" {
+		t.Fatalf("expected PKCE method S256, got %q", got)
+	}
+	if got := query.Get("code_challenge"); got == "" {
+		t.Fatal("expected non-empty code_challenge")
 	}
 }
 
-func TestFetchDirectAccess_ParsesModelDetails(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method != http.MethodPost {
-			t.Fatalf("expected POST, got %s", r.Method)
+func TestAuthClientExchangeCodeForTokens(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/oauth/token" {
+			t.Fatalf("unexpected path %q", r.URL.Path)
 		}
-		if got := r.Header.Get("Authorization"); got != "Bearer pat-123" {
-			t.Fatalf("expected Authorization header, got %q", got)
+		if err := r.ParseForm(); err != nil {
+			t.Fatalf("ParseForm() error = %v", err)
 		}
-		w.Header().Set("Content-Type", "application/json")
-		_, _ = w.Write([]byte(`{
-			"base_url":"https://gateway.gitlab.example.com/v1",
-			"token":"duo-gateway-token",
-			"expires_at":2000000000,
-			"headers":{
-				"X-Gitlab-Realm":"saas",
-				"X-Gitlab-Host-Name":"gitlab.example.com"
-			},
-			"model_details":{
-				"model_provider":"anthropic",
-				"model_name":"claude-sonnet-4-5"
-			}
-		}`))
+		if got := r.Form.Get("grant_type"); got != "authorization_code" {
+			t.Fatalf("expected authorization_code grant, got %q", got)
+		}
+		if got := r.Form.Get("code_verifier"); got != "verifier-123" {
+			t.Fatalf("expected code_verifier, got %q", got)
+		}
+		_ = json.NewEncoder(w).Encode(map[string]any{
+			"access_token":  "oauth-access",
+			"refresh_token": "oauth-refresh",
+			"token_type":    "Bearer",
+			"scope":         "api read_user",
+			"created_at":    1710000000,
+			"expires_in":    3600,
+		})
 	}))
-	defer server.Close()
+	defer srv.Close()
 
-	client := &AuthClient{httpClient: server.Client()}
-	direct, err := client.FetchDirectAccess(context.Background(), server.URL, "pat-123")
+	client := NewAuthClient(nil)
+	token, err := client.ExchangeCodeForTokens(context.Background(), srv.URL, "client-id", "client-secret", RedirectURL(17171), "auth-code", "verifier-123")
 	if err != nil {
-		t.Fatalf("FetchDirectAccess returned error: %v", err)
+		t.Fatalf("ExchangeCodeForTokens() error = %v", err)
 	}
-	if direct.BaseURL != "https://gateway.gitlab.example.com/v1" {
-		t.Fatalf("unexpected base_url %q", direct.BaseURL)
+	if token.AccessToken != "oauth-access" {
+		t.Fatalf("expected access token, got %q", token.AccessToken)
 	}
-	if direct.Token != "duo-gateway-token" {
-		t.Fatalf("unexpected token %q", direct.Token)
+	if token.RefreshToken != "oauth-refresh" {
+		t.Fatalf("expected refresh token, got %q", token.RefreshToken)
 	}
-	if direct.ModelDetails == nil || direct.ModelDetails.ModelName != "claude-sonnet-4-5" {
-		t.Fatalf("unexpected model details: %+v", direct.ModelDetails)
+}
+
+func TestExtractDiscoveredModels(t *testing.T) {
+	models := ExtractDiscoveredModels(map[string]any{
+		"model_details": map[string]any{
+			"model_provider": "anthropic",
+			"model_name":     "claude-sonnet-4-5",
+		},
+		"supported_models": []any{
+			map[string]any{"model_provider": "openai", "model_name": "gpt-4.1"},
+			"claude-sonnet-4-5",
+		},
+	})
+	if len(models) != 2 {
+		t.Fatalf("expected 2 unique models, got %d", len(models))
+	}
+	if models[0].ModelName != "claude-sonnet-4-5" {
+		t.Fatalf("unexpected first model %q", models[0].ModelName)
+	}
+	if models[1].ModelName != "gpt-4.1" {
+		t.Fatalf("unexpected second model %q", models[1].ModelName)
+	}
+}
+
+func TestFetchDirectAccessDecodesModelDetails(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/v4/code_suggestions/direct_access" {
+			t.Fatalf("unexpected path %q", r.URL.Path)
+		}
+		if got := r.Header.Get("Authorization"); !strings.Contains(got, "token-123") {
+			t.Fatalf("expected bearer token, got %q", got)
+		}
+		_ = json.NewEncoder(w).Encode(map[string]any{
+			"base_url":   "https://cloud.gitlab.example.com",
+			"token":      "gateway-token",
+			"expires_at": 1710003600,
+			"headers": map[string]string{
+				"X-Gitlab-Realm": "saas",
+			},
+			"model_details": map[string]any{
+				"model_provider": "anthropic",
+				"model_name":     "claude-sonnet-4-5",
+			},
+		})
+	}))
+	defer srv.Close()
+
+	client := NewAuthClient(nil)
+	direct, err := client.FetchDirectAccess(context.Background(), srv.URL, "token-123")
+	if err != nil {
+		t.Fatalf("FetchDirectAccess() error = %v", err)
 	}
-	if direct.Headers["X-Gitlab-Realm"] != "saas" {
-		t.Fatalf("expected X-Gitlab-Realm header, got %+v", direct.Headers)
+	if direct.ModelDetails == nil || direct.ModelDetails.ModelName != "claude-sonnet-4-5" {
+		t.Fatalf("expected model details, got %+v", direct.ModelDetails)
 	}
 }

internal/runtime/executor/gitlab_executor.go

@@ -21,10 +21,10 @@ import (
 )
 
 const (
-	gitLabProviderKey            = "gitlab"
-	gitLabAuthMethodOAuth        = "oauth"
-	gitLabAuthMethodPAT          = "pat"
-	gitLabChatEndpoint           = "/api/v4/chat/completions"
+	gitLabProviderKey             = "gitlab"
+	gitLabAuthMethodOAuth         = "oauth"
+	gitLabAuthMethodPAT           = "pat"
+	gitLabChatEndpoint            = "/api/v4/chat/completions"
 	gitLabCodeSuggestionsEndpoint = "/api/v4/code_suggestions/completions"
 )
 
@@ -33,10 +33,10 @@ type GitLabExecutor struct {
 }
 
 type gitLabPrompt struct {
-	Instruction          string
-	FileName             string
-	ContentAboveCursor   string
-	ChatContext          []map[string]any
+	Instruction           string
+	FileName              string
+	ContentAboveCursor    string
+	ChatContext           []map[string]any
 	CodeSuggestionContext []map[string]any
 }
 
@@ -246,10 +246,10 @@ func (e *GitLabExecutor) requestCodeSuggestions(ctx context.Context, auth *clipr
 			"content_above_cursor": contentAbove,
 			"content_below_cursor": "",
 		},
-		"intent":          "generation",
-		"generation_type": "small_file",
+		"intent":           "generation",
+		"generation_type":  "small_file",
 		"user_instruction": prompt.Instruction,
-		"stream":          false,
+		"stream":           false,
 	}
 	if len(prompt.CodeSuggestionContext) > 0 {
 		body["context"] = prompt.CodeSuggestionContext