@bevel-software/platform-core-backend 0.14.0 → 0.19.0

package/src/modules/workspace/__tests__/workspace.service.move-never-overwrites.test.ts

@@ -0,0 +1,218 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import { NodeFs } from '../../kb-fs/node-fs.js';
+import { WorkspaceService } from '../workspace.service.js';
+import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
+
+/**
+ * A rename never overwrites.
+ *
+ * `fs.rename` REPLACES an existing file on every platform, and `moveEntry`
+ * used to call it unconditionally: a tester renamed a `.docx` onto the name of
+ * an existing `.md` and the markdown file silently became Word bytes, breaking
+ * the page. The destination is checked first now, on the one path every
+ * surface goes through — the sidebar rename box, a drag onto a folder, the
+ * agent's move — so the refusal is the same sentence wherever it is met.
+ */
+
+const KB = 'knowledge-base';
+const BRANCH = 'main';
+
+describe('WorkspaceService.moveEntry — a name that is taken is refused, never overwritten', () => {
+  let root: string;
+  let workspaceDir: string;
+  let workspaceId: string;
+  let svc: WorkspaceService;
+
+  const abs = (rel: string) => path.join(workspaceDir, rel);
+
+  /** Whether `rel` is there, as spelled, without following a link. */
+  const entryVisible = async (rel: string) =>
+    await fs.lstat(abs(rel)).then(() => true, () => false);
+
+  /**
+   * Whether the disk under the workspace folds case — asked of the disk, not
+   * guessed from `process.platform`: a case-sensitive APFS volume and a
+   * case-insensitive mount on Linux are both ordinary things to run on.
+   */
+  const foldsCase = async () => {
+    const probe = abs(`${KB}/.case-probe`);
+    await fs.writeFile(probe, '');
+    try {
+      return await entryVisible(`${KB}/.CASE-PROBE`);
+    } finally {
+      await fs.rm(probe, { force: true });
+    }
+  };
+
+  beforeEach(async () => {
+    root = await fs.mkdtemp(path.join(os.tmpdir(), 'bevel-move-'));
+    workspaceId = workspaceIdForBranch(BRANCH);
+    workspaceDir = path.join(root, workspaceId);
+    // The inner `.git` is what lets `resolveWorkspaceDir` accept the workspace
+    // without trying to clone.
+    await fs.mkdir(path.join(workspaceDir, KB, '.git'), { recursive: true });
+    svc = new WorkspaceService(
+      root,
+      'https://github.com/Bevel-Software/knowledge-base.git',
+      KB,
+      new NodeFs(),
+    );
+  });
+
+  afterEach(async () => {
+    await fs.rm(root, { recursive: true, force: true });
+  });
+
+  it('refuses a file onto a file, and the file already there keeps its content', async () => {
+    // The reported bug, exactly: a Word document renamed onto a note.
+    await svc.writeFile(workspaceId, `${KB}/Sales/Notes.md`, '# Notes\n');
+    await fs.writeFile(abs(`${KB}/Sales/Report.docx`), Buffer.from('PK\u0003\u0004docx'));
+
+    await expect(
+      svc.moveEntry(workspaceId, `${KB}/Sales/Report.docx`, `${KB}/Sales/Notes.md`),
+    ).rejects.toMatchObject({
+      name: 'EntryExistsError',
+      status: 409,
+      message: 'A file named Notes.md already exists in Sales.',
+    });
+
+    expect(await fs.readFile(abs(`${KB}/Sales/Notes.md`), 'utf-8')).toBe('# Notes\n');
+    expect(await fs.readFile(abs(`${KB}/Sales/Report.docx`), 'utf-8')).toContain('docx');
+  });
+
+  it('refuses a file onto a FOLDER of that name, and says folder', async () => {
+    await svc.writeFile(workspaceId, `${KB}/Sales/Q4/deal.md`, 'deal');
+    await svc.writeFile(workspaceId, `${KB}/Sales/note.md`, 'note');
+
+    await expect(
+      svc.moveEntry(workspaceId, `${KB}/Sales/note.md`, `${KB}/Sales/Q4`),
+    ).rejects.toMatchObject({
+      name: 'EntryExistsError',
+      status: 409,
+      message: 'A folder named Q4 already exists in Sales.',
+    });
+
+    expect(await fs.readFile(abs(`${KB}/Sales/Q4/deal.md`), 'utf-8')).toBe('deal');
+    expect(await fs.readFile(abs(`${KB}/Sales/note.md`), 'utf-8')).toBe('note');
+  });
+
+  it('refuses a folder onto a file of that name, and says file', async () => {
+    await svc.writeFile(workspaceId, `${KB}/Sales/Q4/deal.md`, 'deal');
+    await svc.writeFile(workspaceId, `${KB}/Archive/Q4`, 'a file called Q4');
+
+    await expect(
+      svc.moveEntry(workspaceId, `${KB}/Sales/Q4`, `${KB}/Archive/Q4`),
+    ).rejects.toMatchObject({
+      name: 'EntryExistsError',
+      status: 409,
+      message: 'A file named Q4 already exists in Archive.',
+    });
+
+    expect(await fs.readFile(abs(`${KB}/Archive/Q4`), 'utf-8')).toBe('a file called Q4');
+    expect(await fs.readFile(abs(`${KB}/Sales/Q4/deal.md`), 'utf-8')).toBe('deal');
+  });
+
+  it('refuses a folder onto a folder — a move never merges two folders', async () => {
+    await svc.writeFile(workspaceId, `${KB}/Sales/Q4/deal.md`, 'deal');
+    await svc.writeFile(workspaceId, `${KB}/Archive/Q4/old.md`, 'old');
+
+    await expect(
+      svc.moveEntry(workspaceId, `${KB}/Sales/Q4`, `${KB}/Archive/Q4`),
+    ).rejects.toMatchObject({ message: 'A folder named Q4 already exists in Archive.' });
+
+    expect(await fs.readFile(abs(`${KB}/Archive/Q4/old.md`), 'utf-8')).toBe('old');
+    expect(await fs.readFile(abs(`${KB}/Sales/Q4/deal.md`), 'utf-8')).toBe('deal');
+  });
+
+  it('leaves no folder behind for a move it refuses', async () => {
+    // The check runs BEFORE the destination's parents are made, so a refusal
+    // does not leave an empty `New/` in everyone's tree.
+    await svc.writeFile(workspaceId, `${KB}/Sales/note.md`, 'note');
+    await svc.writeFile(workspaceId, `${KB}/Sales/New/taken.md`, 'taken');
+
+    await expect(
+      svc.moveEntry(workspaceId, `${KB}/Sales/note.md`, `${KB}/Sales/New/taken.md`),
+    ).rejects.toMatchObject({ status: 409 });
+
+    expect(await fs.readdir(abs(`${KB}/Sales/New`))).toEqual(['taken.md']);
+  });
+
+  it('allows a case-only rename, on a disk that folds the two spellings and on one that does not', async () => {
+    // The acceptance criterion is about a case-insensitive filesystem, where
+    // `Notes.md` already opens `notes.md`'s own file and the rename must not
+    // read that as a clash. On a case-sensitive one the destination is simply
+    // a free name. Both disks must let the rename through, and the disk is
+    // asked rather than guessed from `process.platform`.
+    await svc.writeFile(workspaceId, `${KB}/Sales/notes.md`, '# Notes\n');
+    // The two pre-states, each asserted where it applies: on a folding disk
+    // the destination already resolves to the source; elsewhere it is free.
+    expect(await entryVisible(`${KB}/Sales/Notes.md`)).toBe(await foldsCase());
+
+    await expect(
+      svc.moveEntry(workspaceId, `${KB}/Sales/notes.md`, `${KB}/Sales/Notes.md`),
+    ).resolves.toBeUndefined();
+
+    expect(await fs.readFile(abs(`${KB}/Sales/Notes.md`), 'utf-8')).toBe('# Notes\n');
+  });
+
+  it('refuses a move onto a hard link of the source under another name', async () => {
+    // One inode is not enough to read the destination as "the source itself".
+    // `twin.md` is a name of its own in the tree — on every filesystem that
+    // has hard links, case-folding or not — and a move onto it would take that
+    // name away. A clash, exactly like any other.
+    await svc.writeFile(workspaceId, `${KB}/Sales/notes.md`, '# Notes\n');
+    await fs.link(abs(`${KB}/Sales/notes.md`), abs(`${KB}/Sales/twin.md`));
+
+    await expect(
+      svc.moveEntry(workspaceId, `${KB}/Sales/notes.md`, `${KB}/Sales/twin.md`),
+    ).rejects.toMatchObject({
+      name: 'EntryExistsError',
+      status: 409,
+      message: 'A file named twin.md already exists in Sales.',
+    });
+
+    expect(await fs.readFile(abs(`${KB}/Sales/twin.md`), 'utf-8')).toBe('# Notes\n');
+    expect(await fs.readFile(abs(`${KB}/Sales/notes.md`), 'utf-8')).toBe('# Notes\n');
+  });
+
+  it('renames onto a free name exactly as before', async () => {
+    await svc.writeFile(workspaceId, `${KB}/Sales/note.md`, 'note');
+
+    await svc.moveEntry(workspaceId, `${KB}/Sales/note.md`, `${KB}/Sales/renamed.md`);
+
+    expect(await fs.readFile(abs(`${KB}/Sales/renamed.md`), 'utf-8')).toBe('note');
+    await expect(fs.access(abs(`${KB}/Sales/note.md`))).rejects.toBeDefined();
+  });
+
+  it('moves into another folder, creating the folders on the way, exactly as before', async () => {
+    await svc.writeFile(workspaceId, `${KB}/Sales/note.md`, 'note');
+
+    await svc.moveEntry(workspaceId, `${KB}/Sales/note.md`, `${KB}/Archive/2026/note.md`);
+
+    expect(await fs.readFile(abs(`${KB}/Archive/2026/note.md`), 'utf-8')).toBe('note');
+  });
+
+  it('still answers ENOENT when there is nothing to move', async () => {
+    // "There is nothing at the source" is the truer answer than "the
+    // destination is taken", and it is the one this path always gave.
+    await svc.writeFile(workspaceId, `${KB}/Sales/taken.md`, 'taken');
+
+    await expect(
+      svc.moveEntry(workspaceId, `${KB}/Sales/absent.md`, `${KB}/Sales/taken.md`),
+    ).rejects.toMatchObject({ code: 'ENOENT' });
+
+    expect(await fs.readFile(abs(`${KB}/Sales/taken.md`), 'utf-8')).toBe('taken');
+  });
+
+  it('names the folder the destination is in, whichever folder that is', async () => {
+    await svc.writeFile(workspaceId, `${KB}/taken.md`, 'taken');
+    await svc.writeFile(workspaceId, `${KB}/note.md`, 'note');
+
+    await expect(
+      svc.moveEntry(workspaceId, `${KB}/note.md`, `${KB}/taken.md`),
+    ).rejects.toMatchObject({ message: `A file named taken.md already exists in ${KB}.` });
+  });
+});

package/src/modules/workspace/__tests__/workspace.service.read-filter.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { NodeFs } from '../../kb-fs/node-fs.js';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
@@ -38,9 +39,15 @@ describe('WorkspaceService.listFiles — read filter', () => {
     await mkFile(workspaceDir, 'Open/a.md');
     await mkFile(workspaceDir, 'Open/b.md');
     await mkFile(workspaceDir, 'Secret/s1.md');
+    await mkFile(workspaceDir, 'Secret/Vault/v1.md');
     await mkFile(workspaceDir, 'Mixed/hidden.md');
     await mkFile(workspaceDir, 'top.md');
-    svc = new WorkspaceService(root, 'https://example.invalid/repo.git', KB);
+    // A denied folder with a grant below it: Scopes/ itself is closed, but
+    // Scopes/Deploy/ is shared (a linked skill's folder opened to a plugin's
+    // readers, say), and its files are readable.
+    await mkFile(workspaceDir, 'Scopes/Deploy/SKILL.md');
+    await mkFile(workspaceDir, 'Scopes/other.md');
+    svc = new WorkspaceService(root, 'https://example.invalid/repo.git', KB, new NodeFs());
     await svc.getWorkspacePath(workspaceId);
   });
 
@@ -64,27 +71,51 @@ describe('WorkspaceService.listFiles — read filter', () => {
     expect(filtered).toEqual(unfiltered);
   });
 
-  it('drops denied files and denied directories (subtree skipped)', async () => {
-    const asked: string[] = [];
-    const filter: ReadTreeFilter = async (ps) => {
-      asked.push(...ps);
-      return new Map(ps.map((p) => [p, !(p.includes('Secret') || p.endsWith('hidden.md'))]));
-    };
-    const tree = await svc.listFiles(workspaceId, filter);
-    const all = paths(tree);
+  it('drops denied files, and a denied directory with nothing readable beneath it', async () => {
+    const filter: ReadTreeFilter = async (ps) =>
+      new Map(ps.map((p) => [p, !(p.includes('Secret') || p.includes('Scopes') || p.endsWith('hidden.md'))]));
+    const all = paths(await svc.listFiles(workspaceId, filter));
 
     // Readable files survive.
     expect(all).toContain('Open/a.md');
     expect(all).toContain('Open/b.md');
     expect(all).toContain('top.md');
-    // Denied directory and its whole subtree are gone.
+    // A denied directory whose whole subtree is denied is gone, with the
+    // subtree — including a nested folder the walk did look into.
     expect(all).not.toContain('Secret');
     expect(all).not.toContain('Secret/s1.md');
+    expect(all).not.toContain('Secret/Vault');
+    expect(all).not.toContain('Scopes');
     // Denied file is gone.
     expect(all).not.toContain('Mixed/hidden.md');
-    // The denied directory's subtree is never walked — the filter is never
-    // asked about a path inside Secret/.
-    expect(asked.some((p) => p.startsWith('Secret/'))).toBe(false);
+  });
+
+  it('keeps a denied directory as the way to what is readable beneath it', async () => {
+    // Scopes/ is closed; Scopes/Deploy/ and its file are shared. The closed
+    // folder shows as a container — the reader can reach the skill through
+    // the tree — with its own contents still filtered (other.md is gone).
+    const filter: ReadTreeFilter = async (ps) =>
+      new Map(ps.map((p) => [p, p.startsWith('Scopes/Deploy') || (!p.includes('Secret') && !p.includes('Scopes') && !p.endsWith('hidden.md'))]));
+    const all = paths(await svc.listFiles(workspaceId, filter));
+    expect(all).toContain('Scopes');
+    expect(all).toContain('Scopes/Deploy');
+    expect(all).toContain('Scopes/Deploy/SKILL.md');
+    expect(all).not.toContain('Scopes/other.md');
+    // Unchanged for a subtree with nothing readable in it.
+    expect(all).not.toContain('Secret');
+  });
+
+  it('keeps a closed folder whose only readable content is an EMPTY sub-folder', async () => {
+    // A readable folder is kept on its own verdict, children or not — so the
+    // closed folder above it has a child, and stays as the way there.
+    await fs.mkdir(path.join(workspaceDir, 'Scopes', 'Empty'), { recursive: true });
+    const filter: ReadTreeFilter = async (ps) =>
+      new Map(ps.map((p) => [p, p === 'Scopes/Empty' || (!p.includes('Secret') && !p.includes('Scopes') && !p.endsWith('hidden.md'))]));
+    const all = paths(await svc.listFiles(workspaceId, filter));
+    expect(all).toContain('Scopes');
+    expect(all).toContain('Scopes/Empty');
+    expect(all).not.toContain('Scopes/Deploy');
+    expect(all).not.toContain('Scopes/other.md');
   });
 
   it('keeps a readable directory left empty after filtering (D4)', async () => {
@@ -107,6 +138,60 @@ describe('WorkspaceService.listFiles — read filter', () => {
     expect((mixed!.children ?? []).length).toBe(0);
   });
 
+  describe('withheld — how many entries the read rules kept out, never which', () => {
+    it('is absent when nothing was filtered out (no filter, or everything readable)', async () => {
+      const allowAll: ReadTreeFilter = async (ps) => new Map(ps.map((p) => [p, true]));
+      expect((await svc.listFiles(workspaceId)).withheld).toBeUndefined();
+      expect((await svc.listFiles(workspaceId, allowAll)).withheld).toBeUndefined();
+    });
+
+    it('counts exactly the dropped entries: denied files and denied folders with nothing readable beneath', async () => {
+      // Denied: Mixed/hidden.md, and Secret/ with its whole subtree —
+      // Secret, Secret/s1.md, Secret/Vault, Secret/Vault/v1.md. Everything
+      // else, Mixed/ included, is readable.
+      const filter: ReadTreeFilter = async (ps) =>
+        new Map(ps.map((p) => [p, !(p.includes('Secret') || p.endsWith('hidden.md'))]));
+      expect((await svc.listFiles(workspaceId, filter)).withheld).toBe(5);
+    });
+
+    it('counts per folder as well: each folder that stays carries what was kept out beneath it', async () => {
+      const filter: ReadTreeFilter = async (ps) =>
+        new Map(ps.map((p) => [p, !(p.includes('Secret') || p.endsWith('hidden.md'))]));
+      const tree = await svc.listFiles(workspaceId, filter);
+      const byPath = new Map(tree.children!.map((c) => [c.relativePath, c]));
+      // Mixed/ lost its one file; Open/ lost nothing and says nothing.
+      expect(byPath.get('Mixed')?.withheld).toBe(1);
+      expect(byPath.get('Open')?.withheld).toBeUndefined();
+      // The root has the total: Secret/ (4, its subtree included) + Mixed/hidden.md.
+      expect(tree.withheld).toBe(5);
+    });
+
+    it('does not count a closed folder kept as the way to a grant below it', async () => {
+      // Scopes/ is closed but stays as a container; only Scopes/other.md is dropped.
+      const filter: ReadTreeFilter = async (ps) =>
+        new Map(ps.map((p) => [p, p !== 'Scopes' && p !== 'Scopes/other.md']));
+      const tree = await svc.listFiles(workspaceId, filter);
+      expect(paths(tree)).toContain('Scopes');
+      expect(tree.withheld).toBe(1);
+    });
+
+    it('does not count an entry the filter marks unlisted', async () => {
+      const filter: ReadTreeFilter = async (ps) =>
+        new Map(ps.map((p) => [p, p === 'top.md' ? 'unlisted' : true]));
+      const tree = await svc.listFiles(workspaceId, filter);
+      expect(paths(tree)).not.toContain('top.md');
+      expect(tree.withheld).toBeUndefined();
+    });
+
+    it('counts every entry of a tree the caller may read none of', async () => {
+      const filter: ReadTreeFilter = async () => new Map();
+      const tree = await svc.listFiles(workspaceId, filter);
+      expect(tree.children).toEqual([]);
+      // Every entry below the root, exactly — the root itself is never withheld.
+      expect(tree.withheld).toBe(paths(await svc.listFiles(workspaceId)).length - 1);
+    });
+  });
+
   it('fails closed: a path not marked readable is dropped', async () => {
     // Filter returns an empty verdict for everything → nothing readable.
     const filter: ReadTreeFilter = async () => new Map();