@bevel-software/platform-core-backend 0.13.5 → 0.14.0

package/src/core/create-core-server.ts

@@ -122,8 +122,10 @@ export async function createCoreServer(
   // `exposedHeaders` lets a BROWSER-based MCP client (e.g. MCP Inspector) read
   // the Streamable-HTTP session header off the `initialize` response — custom
   // response headers are hidden from browser JS unless exposed, so without this
-  // the client can't send `Mcp-Session-Id` back and every follow-up 400s with
-  // "session id does not match any active session". `WWW-Authenticate` is
+  // the client can't send `Mcp-Session-Id` back at all, and every follow-up
+  // 400s with "Bad Request: Mcp-Session-Id header is required" — the
+  // missing-header case, not the unknown-session one (that answers 404
+  // "Session not found"). `WWW-Authenticate` is
   // exposed so a browser client can read the 401 challenge and start the OAuth
   // discovery flow. (Native clients like Claude Code aren't subject to CORS.)
   app.use(
@@ -301,6 +303,7 @@ export async function createCoreServer(
     secretsVault: core.secretsVaultService,
     toolManualService: core.toolManualService,
     accessControl: core.accessControl,
+    connectionProbe: core.connectionProbeService,
     stateSecret: core.config.jwtSecret,
     publicBackendUrl: core.config.publicBackendUrl,
     publicFrontendUrl: core.config.publicFrontendUrl,
@@ -399,6 +402,8 @@ export async function createCoreServer(
     core.workspaceService,
     core.authService,
     core.eventBus,
+    core.accessControl,
+    core.kbDirName,
   ));
   // SSE event-bus surface. The route owns its own auth gating via the
   // injected middleware (which accepts both Bearer and the `bevel_token`

package/src/core/create-core-services.ts

@@ -46,6 +46,7 @@ import {
   McpOAuthDiscoveryService,
   registerBevelSecretsVariableLoader,
 } from '../modules/secrets-vault/index.js';
+import { ConnectionProbeService } from '../modules/connection-probe/index.js';
 import { GitService } from '../modules/workflow/git/git.service.js';
 import { PullRequestService } from '../modules/workflow/git/pull-request.service.js';
 import { WorkspaceMutex } from '../modules/kb-fs/mutex.js';
@@ -169,6 +170,7 @@ export interface CoreServices {
    */
   kbDirName: string;
   secretsVaultService: DbSecretsVaultService;
+  connectionProbeService: ConnectionProbeService;
   externalApiKeyService: ExternalApiKeyService;
   internalTokenService: InternalTokenService;
   mcpService: McpService;
@@ -562,6 +564,14 @@ export async function createCoreServices(
   // UTCP client can resolve `${VAR}` from the caller's secrets at tool-call time.
   registerBevelSecretsVariableLoader(secretsVaultService);
 
+  // The credential probe: whether a tool's stored credential actually WORKS, as
+  // distinct from whether one is stored. Built here — after the vault and the
+  // tool catalog — because a probe needs both: the catalog to know what to
+  // call, the vault to resolve the credential to call it with. Holds no state
+  // and takes no `db`: a verdict is returned to the caller that asked for it and
+  // never outlives their page (see `ProbeVerdict`).
+  const connectionProbeService = new ConnectionProbeService(toolManualService, secretsVaultService);
+
   // Zero-config OAuth for bare `type: mcp` `.tool`s: when the remote server
   // demands OAuth (MCP authorization spec), discover its authorization server,
   // dynamically register a public PKCE client, and persist the provider as the
@@ -835,6 +845,7 @@ export async function createCoreServices(
     createSyncedGroupsMaterializer,
     updateCheckService,
     secretsVaultService,
+    connectionProbeService,
     externalApiKeyService,
     internalTokenService,
     mcpService,

package/src/core-config.ts

@@ -2,6 +2,7 @@ import dotenv from 'dotenv';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { defaultKbTemplateDir } from './assets.js';
+import { assertKeyDecodesTo32Bytes } from './shared/token-crypto.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 dotenv.config({ path: path.resolve(__dirname, '../../../.env') });
@@ -337,19 +338,25 @@ export class CoreConfig {
       .split(/[\s,]+/)
       .map((d) => d.trim().toLowerCase().replace(/^[@.]+/, ''))
       .filter((d) => d.length > 0);
-    this.secretsEncKey = (
-      process.env.SECRETS_ENC_KEY ||
-      process.env.CONNECTOR_CONFIG_ENC_KEY ||
-      process.env.SHAREPOINT_TOKEN_ENC_KEY ||
-      ''
-    ).trim();
-    if (!this.secretsEncKey) {
+    // Which variable actually supplied the key decides whose name a bad key
+    // is reported under: a legacy deploy still on the fallback chain must be
+    // told to fix the variable it set, not one it never heard of.
+    const secretsKeySource = (
+      ['SECRETS_ENC_KEY', 'CONNECTOR_CONFIG_ENC_KEY', 'SHAREPOINT_TOKEN_ENC_KEY'] as const
+    ).find((name) => (process.env[name] ?? '').trim() !== '');
+    this.secretsEncKey = secretsKeySource ? process.env[secretsKeySource]!.trim() : '';
+    if (!secretsKeySource) {
       throw new Error(
         'SECRETS_ENC_KEY is required — it encrypts the secrets vault, the MCP OAuth ' +
           'tokens and the git credential saved from the setup screen. Generate one ' +
           `with: node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"`,
       );
     }
+    // Validate the LENGTH here too, while the winning variable's name is in
+    // hand. Every later `new TokenCrypto(config.secretsEncKey)` blames
+    // SECRETS_ENC_KEY by default, which is only certainly right because a bad
+    // key never gets past this line.
+    assertKeyDecodesTo32Bytes(this.secretsEncKey, secretsKeySource);
     this.internalTokenSecret = (process.env.INTERNAL_TOKEN_SECRET || '').trim();
     // Setting DOMAIN declares "the bundled Caddy `https` profile fronts this
     // deployment" — one proxy hop, and the public origin IS that domain. The

package/src/modules/access-model/kb-read-filter.ts

@@ -42,6 +42,28 @@ export function toKbRelative(p: string, kbDirName: string): string | null {
   return rel.length > 0 ? rel : null;
 }
 
+/**
+ * THE single-path read verdict every route module shares: may `userEmail`
+ * read the workspace-relative `wsPath`? Non-KB paths (outside `kbDirName`)
+ * carry no `read:` rules and pass; KB paths go through the FULL `canRead`
+ * (folder `access.md` chain + per-node frontmatter). Content, diff and
+ * history routes all gate through this one function so the rule cannot
+ * drift between the surfaces — a file's history and its diffs are its
+ * content, and must deny exactly where the content route denies. Throws
+ * whatever `canRead` throws: the caller decides how a verdict failure is
+ * reported, and MUST fail closed.
+ */
+export async function canReadWorkspacePath(
+  canRead: (workspaceId: string, userEmail: string, kbRelPath: string) => Promise<boolean>,
+  workspaceId: string,
+  userEmail: string,
+  kbDirName: string,
+  wsPath: string,
+): Promise<boolean> {
+  const rel = toKbRelative(wsPath, kbDirName);
+  return rel === null || (await canRead(workspaceId, userEmail, rel));
+}
+
 /**
  * Resolve read verdicts for a set of workspace-relative paths in ONE batched
  * access call. Non-KB paths (outside `kbDirName`) are always readable — they