Cross-validate numeric project IDs in MCP get_repository_file

Mohamed Elsayedrequested to merge
gitlab-community/gitlab-org/gitlab:629556-get-repository-file-project-id-validation into master

What does this MR do and why?

When get_repository_file receives a URL for project A and a numeric project_id for project B, it silently reads from project A.

This change compares the numeric ID with the already-resolved URL project's ID and returns Project mismatch when they differ. Validation runs after authorization and before ref extraction, without looking up the conflicting project.

Regression specs cover an inaccessible conflicting project, matching numeric IDs, zero-padded IDs, and numeric-ID-only requests.

References

Closes #629556 (closed)

Follows the approach in !254573 (merged)

Screenshots or screen recordings

Not applicable. This changes backend input validation only.

How to set up and validate locally

Run in a configured GitLab development environment:

  1. Run bin/rspec spec/services/mcp/tools/repositories/get_repository_file_service_spec.rb ee/spec/services/ee/mcp/tools/repositories/get_repository_file_service_spec.rb.
  2. Run bundle exec rubocop app/services/mcp/tools/repositories/get_repository_file_tool.rb spec/services/mcp/tools/repositories/get_repository_file_service_spec.rb.
  3. Run git diff --check.

Ruby syntax checks and commit whitespace checks pass locally. RSpec and RuboCop could not start because the local bundle dependencies are missing. Runtime validation remains pending in CI or a configured GitLab environment.

MR acceptance checklist

  • Regression specs added.
  • Existing authorization checks retained; no additional database queries.
  • No schema, dependency, or UI changes.
  • Documentation is unchanged because this enforces consistency between existing inputs.
  • Runtime tests and lint remain pending.

Merge request reports