@elytracms/forms 0.0.102 → 0.0.103

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@elytracms/forms",
   "author": "finaldream <hi@finaldream.de>",
-  "version": "0.0.102",
+  "version": "0.0.103",
   "engines": {
     "node": ">=22.18.0"
   },
@@ -28,13 +28,13 @@
   "dependencies": {
     "lucide-react": "^1.23.0",
     "zod": "^4.4.3",
-    "@elytracms/core": "^0.0.102"
+    "@elytracms/core": "^0.0.103"
   },
   "peerDependencies": {
     "convex": "^1.42.1",
     "react": "^19.0.0",
-    "@elytracms/next": "^0.0.102",
-    "@elytracms/studio": "^0.0.102"
+    "@elytracms/next": "^0.0.103",
+    "@elytracms/studio": "^0.0.103"
   },
   "peerDependenciesMeta": {
     "@elytracms/next": {
@@ -59,8 +59,8 @@
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
     "typescript": "^6.0.3",
-    "@elytracms/next": "^0.0.102",
-    "@elytracms/studio": "^0.0.102"
+    "@elytracms/next": "^0.0.103",
+    "@elytracms/studio": "^0.0.103"
   },
   "files": [
     "dist",

package/src/convex/dev-ingest-runner.convex.test.ts

@@ -145,7 +145,7 @@ async function leftovers(t: Backend) {
 describe('pnpm dev:ingest — every scenario against the real engine (convex-test)', () => {
   it('each scenario’s expectations hold; nothing printed holds the secret; no runner row is left', async () => {
     const core = await runner()
-    expect(core.INGEST_SCENARIOS.map((scenario) => scenario.name)).toEqual(['ec671', 'ec685-causal', 'ec685-release', 'storage-sha256', 'ec618-burst', 'ec695'])
+    expect(core.INGEST_SCENARIOS.map((scenario) => scenario.name)).toEqual(['ec671', 'ec685-causal', 'ec685-release', 'storage-sha256', 'ec618-burst', 'ec695', 'ec750'])
     for (const scenario of core.INGEST_SCENARIOS) {
       const t = await backend()
       const lines: string[] = []
@@ -195,6 +195,27 @@ describe('pnpm dev:ingest — every scenario against the real engine (convex-tes
     expect(await t.run(async (ctx) => (await ctx.db.system.query('_storage').collect()).length)).toBe(0)
   })
 
+  it('the EC-750 scenario: 11/11 — a sibling forged by forms:save with B’s files is removed, B keeps its bytes and binding (the close’s expected lines)', async () => {
+    const core = await runner()
+    const t = await backend()
+    const lines: string[] = []
+    const scenario = core.INGEST_SCENARIOS.find((entry) => entry.name === 'ec750')!
+    const result = await core.runIngestScenario(scenario, port(core, t), { say: (line) => lines.push(line), wire, runId: 'r', now: () => T0 })
+    expect(result).toEqual({ ok: true, passed: 11, failed: [] })
+    expect(lines).toEqual(
+      expect.arrayContaining([
+        '  ✓ B’s binding records B as its owner: true',
+        '  ✓ A, created by forms:save, lists B’s file: true',
+        '  ✓ removing A keeps B’s bytes: true',
+        '  ✓ …and B’s binding: true',
+        '  ✓ removing B deletes B’s file: false',
+        '✓ ec750: 11/11 expectation(s) held',
+      ]),
+    )
+    expect(await leftovers(t)).toEqual({ submissions: 0, bindings: 0, assets: 0 })
+    expect(await t.run(async (ctx) => (await ctx.db.system.query('_storage').collect()).length)).toBe(0)
+  })
+
   it('negative control: signed under ANOTHER secret, every scenario fails visibly (the receiver refuses it)', async () => {
     const core = await runner()
     for (const scenario of core.INGEST_SCENARIOS) {

package/src/convex/index.ts

@@ -65,8 +65,9 @@ import type { FormDeliveryRequest } from '../shared/delivery'
  *   bound, so no claimed bytes ever sit without a row and a refusal deletes nothing (a
  *   predictable file another intent stored can never be deleted through a rollback). The
  *   one deletion, `remove`, goes through the engine's `releaseIngestUploads`, which deletes
- *   only bytes a claim bound to its intent (EC-671): an id a visitor or an editor merely
- *   NAMES is never deleted;
+ *   only bytes a claim bound (EC-671) to THAT row (EC-750 — every binding records the row
+ *   that claimed it): an id a visitor or an editor merely NAMES is never deleted, even
+ *   another row's claimed file;
  * - **`deliver`** — the scheduled action per row: it asks the site's delivery route to send
  *   (`attemptFormDelivery`) and `recordDelivery` logs the answer per recipient and schedules
  *   the next attempt (`applyDeliveryOutcome`);
@@ -137,10 +138,11 @@ export const save = mutation({
 })
 
 /**
- * Delete a submission AND the files it claimed (no claimed bytes outlive their row). EC-671:
- * through `releaseIngestUploads`, which deletes only files a claim bound — a `files` entry
- * naming anything else (an editor's write can put any id there) is kept, never deleted — and,
- * EC-685, keeps a claimed file an editor has since made an asset of (the asset owns it now).
+ * Delete a submission AND the files it claimed (no claimed bytes outlive their row). EC-671 /
+ * EC-750: through `releaseIngestUploads`, asked for THIS row's id — it deletes only the files
+ * this row's claim bound, read by owner, never the row's `files` column (an editor's write can
+ * put any id there, another row's file included, or clear it) — and, EC-685, keeps a claimed
+ * file an editor has since made an asset of (the asset owns it now).
  */
 export const remove = mutation({
   args: { [kind.idKey]: v.string() },
@@ -148,13 +150,11 @@ export const remove = mutation({
     await requireCapability(ctx, kind.access.write)
     const doc = await findRecordDoc(ctx, kind, args[kind.idKey] as string)
     if (!doc) return
-    await releaseIngestUploads(ctx, storageIds((doc.data['files'] as SubmissionFile[] | undefined) ?? []))
+    await releaseIngestUploads(ctx, doc.recordId)
     await ctx.db.delete(doc._id)
   },
 })
 
-const storageIds = (files: readonly { storageId: string }[]) => files.map((file) => file.storageId)
-
 // --- The receiver's handler ------------------------------------------------------------------
 
 let mintSubmissionUuid: (() => string) | undefined
@@ -178,10 +178,15 @@ export const ingest = internalMutation({
     const read = readSubmissionPayload(body, { hasFiles: (body.uploads?.length ?? 0) > 0 })
     if (!read.ok) return { ok: false, status: read.status, message: read.message, issues: read.issues }
 
+    // EC-578: the one id factory (UUID v4) — never a clock or a counter. EC-750: minted BEFORE
+    // the claim, which binds every file to this row (a refused claim leaves the id unused; a
+    // retried request re-mints).
+    mintSubmissionUuid ??= createUuidIdFactory()
+    const id = `${kind.idPrefix}_${mintSubmissionUuid()}`
     // EC-695: every upload claimed in ONE engine call, after every check above that can refuse —
     // all bound, or none (a refused claim refuses the submission, and nothing was bound, so
     // nothing is released: this handler never deletes bytes). Nothing after it refuses.
-    const claim = await claimIngestUploads(ctx, body.uploads ?? [], body.target, receivedAt)
+    const claim = await claimIngestUploads(ctx, body.uploads ?? [], body.target, receivedAt, id)
     if (!claim.ok) return claim
     const files: SubmissionFile[] = []
     const namesUsed = new Map<string, number>()
@@ -200,9 +205,6 @@ export const ingest = internalMutation({
       })
     }
 
-    // EC-578: the one id factory (UUID v4) — never a clock or a counter.
-    mintSubmissionUuid ??= createUuidIdFactory()
-    const id = `${kind.idPrefix}_${mintSubmissionUuid()}`
     const spam = read.columns.spam !== 'clean'
     const deliveryState: DeliveryState = spam ? 'skipped' : 'pending'
     await saveRecord(

package/src/convex/sibling-release.convex.test.ts

@@ -0,0 +1,247 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { convexTest } from 'convex-test'
+import type { ConvexHttpClient } from 'convex/browser'
+import { makeFunctionReference } from 'convex/server'
+import type { FunctionReference } from 'convex/server'
+import { INGEST_RECEIVER_PATH, ingestUploadSha256, signedIngestRequest } from '@elytracms/core/ingest'
+import type { IngestReceiverBody } from '@elytracms/core/ingest'
+import schema from '../../../studio/convex/schema'
+import * as assetsModule from '../../../studio/convex/assets'
+import { defineStudioHttp } from '../../../studio/convex/http'
+import { ConvexPersistenceAdapter } from '../../../studio/src/lib/persistence/convex-adapter'
+import * as formsModule from './index'
+import { submissionRecordKind } from '../shared/kind'
+import type { SubmissionFile, SubmissionRecord } from '../shared/kind'
+import { FORMS_DELIVERY_URL_ENV } from '../shared/delivery'
+import { FORMS_HONEYPOT_KEY } from '../shared/submission'
+
+/**
+ * EC-750 (Codex round 9 F46) — the first EXECUTABLE probe of F46's static trace: removing one
+ * submission deleted ANOTHER submission's claimed file, because a binding recorded that a file
+ * was claimed, not which submission owned it, and release trusted the removed row's mutable
+ * `files` ids.
+ *
+ * 1. Submission B claims file f (a genuine upload: an ingest binding exists, no asset owns f).
+ * 2. A content writer creates submission A through the public `forms:save`, carrying B's `files`.
+ * 3. Removing A must delete only what A claimed — nothing — and keep B's bytes AND B's binding
+ *    (the binding is also what keeps `assets:deleteBlob` off the bytes).
+ *
+ * Run only inside convex-test, generated fixture ids, an unreachable `.invalid` delivery host;
+ * honeypot filled, so nothing is ever sent.
+ */
+
+const SECRET = 'ec750-ingest-secret'
+const PROJECT_ID = 'forms-test'
+const ADMIN = 'user_admin'
+const T0 = '2026-11-03T12:00:00.000Z'
+
+function env(): Record<string, string | undefined> {
+  return (globalThis as { process: { env: Record<string, string | undefined> } }).process.env
+}
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.setSystemTime(new Date(T0))
+  env()['ELYTRA_INGEST_SECRET'] = SECRET
+  env()[FORMS_DELIVERY_URL_ENV] = 'https://site.invalid/api/forms'
+})
+afterEach(() => {
+  vi.useRealTimers()
+  delete env()['ELYTRA_INGEST_SECRET']
+  delete env()[FORMS_DELIVERY_URL_ENV]
+})
+
+const silentAuth = { addHttpRoutes: () => {} }
+const modules = {
+  '/convex/_generated/api.ts': async () => ({}),
+  '/convex/assets.ts': async () => assetsModule,
+  '/convex/forms.ts': async () => formsModule,
+  '/convex/http.ts': async () => ({
+    default: defineStudioHttp({ auth: silentAuth, ingest: { submission: formsModule.formsIngest } }),
+  }),
+}
+
+async function backend() {
+  const t = convexTest(schema, modules)
+  await t.run(async (ctx) => {
+    await ctx.db.insert('members', { userId: ADMIN, role: 'admin', createdAt: T0, updatedAt: T0 })
+  })
+  return t
+}
+type Backend = Awaited<ReturnType<typeof backend>>
+
+const asAdmin = (t: Backend) => t.withIdentity({ subject: ADMIN, issuer: 'https://convex.test' })
+
+async function post(t: Backend, body: IngestReceiverBody) {
+  const signed = await signedIngestRequest(body, SECRET)
+  return t.fetch(INGEST_RECEIVER_PATH, { method: 'POST', headers: signed.headers, body: signed.body })
+}
+
+/** Bytes as an issued upload URL stores them (convex-test records size only; the real upload records the type). */
+async function storeFile(t: Backend, bytes: number, contentType: string): Promise<string> {
+  return t.run(async (ctx) => {
+    const id = await ctx.storage.store(new Blob([new Uint8Array(bytes)], { type: contentType }))
+    await (ctx.db as unknown as { patch(id: unknown, value: unknown): Promise<void> }).patch(id, { contentType })
+    return id
+  })
+}
+
+/** A genuine submission with one upload of its own: intent, bytes, claim. Returns the row's id and its file. */
+async function genuineSubmission(t: Backend, bytes = 800): Promise<{ id: string; file: string }> {
+  const digest = await ingestUploadSha256(new Uint8Array(bytes))
+  if (!digest.ok) throw new Error(digest.message)
+  const intent = await post(t, { kind: 'upload', target: 'contact', field: 'cv', contentType: 'application/pdf', size: bytes, sha256: digest.sha256 })
+  expect(intent.status).toBe(200)
+  const { uploadId } = (await intent.json()) as { uploadId: string }
+  const file = await storeFile(t, bytes, 'application/pdf')
+  const answer = await post(t, {
+    kind: 'submission',
+    target: 'contact',
+    data: { email: 'bea@example.test', cv: 'cv.pdf', [FORMS_HONEYPOT_KEY]: 'filled' },
+    uploads: [{ uploadId, storageId: file }],
+  })
+  expect(answer.status).toBe(200)
+  const { id } = (await answer.json()) as { id: string }
+  return { id, file }
+}
+
+/** The editor's client — the record store's own adapter over `forms:save` / `forms:remove`. */
+function editor(t: Backend) {
+  const client = {
+    query: (ref: FunctionReference<'query'>, args?: Record<string, unknown>) => asAdmin(t).query(ref, args ?? {}),
+    mutation: (ref: FunctionReference<'mutation'>, args?: Record<string, unknown>) => asAdmin(t).mutation(ref, args ?? {}),
+  } as unknown as ConvexHttpClient
+  return new ConvexPersistenceAdapter(client, PROJECT_ID).records(submissionRecordKind)
+}
+
+async function row(t: Backend, id: string): Promise<SubmissionRecord | undefined> {
+  return (await editor(t).find(PROJECT_ID, id)) as SubmissionRecord | undefined
+}
+
+/** A content writer's whole-record create through `forms:save`, carrying `files` it did not claim. */
+async function forgeSibling(t: Backend, id: string, files: readonly SubmissionFile[]) {
+  await editor(t).save(PROJECT_ID, {
+    id,
+    form: 'contact',
+    payload: [],
+    files: [...files],
+    status: 'new',
+    spam: 'clean',
+    deliveryState: 'skipped',
+    submittedAt: T0,
+  })
+}
+
+const survives = (t: Backend, storageId: string) => t.run(async (ctx) => (await ctx.storage.get(storageId as never)) !== null)
+const bindings = (t: Backend) =>
+  t.run(async (ctx) =>
+    (await ctx.db.query('records').collect())
+      .filter((record) => record.kind === 'ingestBinding')
+      .map((record) => ({ storageId: record.recordId, owner: (record.data as { owner?: string }).owner })),
+  )
+const deleteBlob = makeFunctionReference<'mutation', { storageKey: string }, unknown>('assets:deleteBlob')
+
+/** An asset an editor makes over stored bytes (`assets:upsert`, the real write path). */
+async function promote(t: Backend, assetId: string, storageKey: string) {
+  await asAdmin(t).mutation(makeFunctionReference<'mutation'>('assets:upsert'), {
+    assetId,
+    filename: `${assetId}.pdf`,
+    contentType: 'application/pdf',
+    byteSize: 800,
+    storageKey,
+    createdAt: T0,
+    updatedAt: T0,
+  })
+}
+
+describe('EC-750 probe — removing a submission deletes only the files THAT submission claimed', () => {
+  it('a claim binds each file to the submission that claimed it (the owner, not the form)', async () => {
+    const t = await backend()
+    const b = await genuineSubmission(t)
+    expect(await bindings(t)).toEqual([{ storageId: b.file, owner: b.id }]) // base: owner undefined (the form key only)
+  })
+
+  it('Codex’s trace: A is created by forms:save carrying B’s files; removing A keeps B’s bytes and B’s binding', async () => {
+    const t = await backend()
+    const b = await genuineSubmission(t)
+    const bFiles = (await row(t, b.id))!.files!
+    expect(bFiles.map((file) => file.storageId)).toEqual([b.file])
+    await forgeSibling(t, 'submission_forged', bFiles)
+    await editor(t).remove(PROJECT_ID, 'submission_forged')
+    expect(await row(t, 'submission_forged')).toBeUndefined()
+    // Measured on the base (0b7bb049), counterexample form: both lines below read false / [].
+    expect(await survives(t, b.file)).toBe(true) // base: false — A's removal deleted B's bytes
+    expect(await bindings(t)).toEqual([{ storageId: b.file, owner: b.id }]) // base: [] — B's binding stripped
+    // B still holds its file: its row is intact, and its own removal deletes it (below).
+    expect((await row(t, b.id))!.files!.map((file) => file.storageId)).toEqual([b.file])
+  })
+
+  it('control: removing B itself deletes B’s file and its binding (the instrument sees a deletion)', async () => {
+    const t = await backend()
+    const b = await genuineSubmission(t)
+    await editor(t).remove(PROJECT_ID, b.id)
+    expect(await survives(t, b.file)).toBe(false)
+    expect(await bindings(t)).toEqual([])
+  })
+
+  it('…and after the forged A is removed, removing B still deletes its file (no residue)', async () => {
+    const t = await backend()
+    const b = await genuineSubmission(t)
+    await forgeSibling(t, 'submission_forged', (await row(t, b.id))!.files!)
+    await editor(t).remove(PROJECT_ID, 'submission_forged')
+    await editor(t).remove(PROJECT_ID, b.id)
+    expect(await survives(t, b.file)).toBe(false)
+    expect(await bindings(t)).toEqual([])
+  })
+
+  it('release reads the OWNER, never the row’s files: B with `files: null` written by an editor still deletes its file on removal', async () => {
+    const t = await backend()
+    const b = await genuineSubmission(t)
+    await editor(t).save(PROJECT_ID, { id: b.id, files: null })
+    expect((await row(t, b.id))!.files).toBeUndefined()
+    await editor(t).remove(PROJECT_ID, b.id)
+    expect(await survives(t, b.file)).toBe(false) // base: true — release got [] and B's bytes stayed forever
+    expect(await bindings(t)).toEqual([])
+  })
+
+  it('a LEGACY binding (bound before bindings recorded their owner) is never deleted — residue, never loss', async () => {
+    const t = await backend()
+    const legacyFile = await storeFile(t, 300, 'application/pdf')
+    // The binding a claim wrote before EC-750: no owner column, no key slot.
+    await t.run(async (ctx) => {
+      await ctx.db.insert('records', {
+        kind: 'ingestBinding',
+        recordId: legacyFile,
+        data: { uploadId: 'upload_legacy', target: 'contact', boundAt: T0 },
+        at: T0,
+        createdAt: T0,
+        updatedAt: T0,
+      })
+    })
+    await forgeSibling(t, 'submission_legacy', [{ field: 'cv', storageId: legacyFile, contentType: 'application/pdf', size: 300 }])
+    await editor(t).remove(PROJECT_ID, 'submission_legacy')
+    expect(await survives(t, legacyFile)).toBe(true) // base: false — any bound id the row named was deleted
+    expect(await bindings(t)).toEqual([{ storageId: legacyFile, owner: undefined }])
+  })
+
+  it('assets:deleteBlob still keeps bytes a binding holds — after the forged A’s removal, B’s binding still protects f', async () => {
+    const t = await backend()
+    const b = await genuineSubmission(t)
+    await forgeSibling(t, 'submission_forged', (await row(t, b.id))!.files!)
+    await editor(t).remove(PROJECT_ID, 'submission_forged')
+    // An editor then makes an asset over f and deletes that asset's bytes: B's binding keeps them.
+    await promote(t, 'cv-asset', b.file)
+    expect(await asAdmin(t).mutation(deleteBlob, { storageKey: b.file })).toEqual({ deleted: false, heldBy: 'ingest' }) // base: the bytes were already gone
+    expect(await survives(t, b.file)).toBe(true)
+  })
+
+  it('control: release keeps an owner’s file an asset references now (EC-685) — the binding is spent, the bytes stay', async () => {
+    const t = await backend()
+    const b = await genuineSubmission(t)
+    await promote(t, 'cv-asset', b.file)
+    await editor(t).remove(PROJECT_ID, b.id)
+    expect(await survives(t, b.file)).toBe(true)
+    expect(await bindings(t)).toEqual([])
+    expect(await asAdmin(t).mutation(deleteBlob, { storageKey: b.file })).toEqual({ deleted: true })
+  })
+})