@elytracms/forms 0.0.96 → 0.0.97

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@elytracms/forms",
   "author": "finaldream <hi@finaldream.de>",
-  "version": "0.0.96",
+  "version": "0.0.97",
   "engines": {
     "node": ">=22.18.0"
   },
@@ -28,13 +28,13 @@
   "dependencies": {
     "lucide-react": "^1.23.0",
     "zod": "^4.4.3",
-    "@elytracms/core": "^0.0.96"
+    "@elytracms/core": "^0.0.97"
   },
   "peerDependencies": {
     "convex": "^1.42.1",
     "react": "^19.0.0",
-    "@elytracms/next": "^0.0.96",
-    "@elytracms/studio": "^0.0.96"
+    "@elytracms/next": "^0.0.97",
+    "@elytracms/studio": "^0.0.97"
   },
   "peerDependenciesMeta": {
     "@elytracms/next": {
@@ -59,8 +59,8 @@
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
     "typescript": "^6.0.3",
-    "@elytracms/next": "^0.0.96",
-    "@elytracms/studio": "^0.0.96"
+    "@elytracms/studio": "^0.0.97",
+    "@elytracms/next": "^0.0.97"
   },
   "files": [
     "dist",

package/src/convex/claim-ownership.convex.test.ts

@@ -0,0 +1,262 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { convexTest } from 'convex-test'
+import type { ConvexHttpClient } from 'convex/browser'
+import { makeFunctionReference } from 'convex/server'
+import type { FunctionReference } from 'convex/server'
+import { INGEST_RECEIVER_PATH, signedIngestRequest } from '@elytracms/core/ingest'
+import type { IngestReceiverBody } from '@elytracms/core/ingest'
+import schema from '../../../studio/convex/schema'
+import * as assetsModule from '../../../studio/convex/assets'
+import * as deliveryModule from '../../../studio/convex/delivery'
+import { defineStudioHttp } from '../../../studio/convex/http'
+import { ConvexPersistenceAdapter } from '../../../studio/src/lib/persistence/convex-adapter'
+import * as formsModule from './index'
+import { submissionRecordKind } from '../shared/kind'
+import type { SubmissionRecord } from '../shared/kind'
+import { FORMS_DELIVERY_URL_ENV } from '../shared/delivery'
+import { FORMS_HONEYPOT_KEY } from '../shared/submission'
+
+/**
+ * EC-671 (Codex round 3 F20) — EC-304 Phase B's first EXECUTABLE probe: the ingest upload
+ * claim against storage ids a visitor does not own, through the real paths — the attacker's
+ * input harvested from the anonymous `delivery:snapshot`, a fresh intent of their own from
+ * the receiver, the forms addon's claim, its rollback and its removal. Every defect line
+ * says what the base (`3f9c636c`) did; the counterexample form (those lines asserted) passed
+ * 7/7 there before it was inverted. Run only inside convex-test, generated fixture ids, an
+ * unreachable `.invalid` delivery host; nothing is sent.
+ */
+
+/**
+ * The status a claim naming a file stored BEFORE its intent gets: the ownership refusal (422),
+ * before the declaration is measured (the floor alone answered the mismatch's 413).
+ */
+const REFUSED_MISMATCHING = 422
+
+const SECRET = 'ec671-ingest-secret'
+const PROJECT_ID = 'forms-test'
+const ADMIN = 'user_admin'
+const T0 = '2026-10-28T12:00:00.000Z'
+const at = (offsetMs: number) => new Date(Date.parse(T0) + offsetMs)
+
+function env(): Record<string, string | undefined> {
+  return (globalThis as { process: { env: Record<string, string | undefined> } }).process.env
+}
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.setSystemTime(new Date(T0))
+  env()['ELYTRA_INGEST_SECRET'] = SECRET
+  env()[FORMS_DELIVERY_URL_ENV] = 'https://site.invalid/api/forms'
+})
+afterEach(() => {
+  vi.useRealTimers()
+  delete env()['ELYTRA_INGEST_SECRET']
+  delete env()[FORMS_DELIVERY_URL_ENV]
+})
+
+const silentAuth = { addHttpRoutes: () => {} }
+// The consumer's files this probe needs: the engine's `assets` (the editor's upload) and
+// `delivery` (the attacker's harvest) re-exports, the addon's `forms`, and the `http.ts` line.
+const modules = {
+  '/convex/_generated/api.ts': async () => ({}),
+  '/convex/assets.ts': async () => assetsModule,
+  '/convex/delivery.ts': async () => deliveryModule,
+  '/convex/forms.ts': async () => formsModule,
+  '/convex/http.ts': async () => ({
+    default: defineStudioHttp({ auth: silentAuth, ingest: { submission: formsModule.formsIngest } }),
+  }),
+}
+
+async function backend() {
+  const t = convexTest(schema, modules)
+  await t.run(async (ctx) => {
+    await ctx.db.insert('members', { userId: ADMIN, role: 'admin', createdAt: T0, updatedAt: T0 })
+  })
+  return t
+}
+type Backend = Awaited<ReturnType<typeof backend>>
+
+const asAdmin = (t: Backend) => t.withIdentity({ subject: ADMIN, issuer: 'https://convex.test' })
+const upsertAsset = makeFunctionReference<'mutation'>('assets:upsert')
+const snapshot = makeFunctionReference<'query', { projectId: string }, { assets: { id: string; storageKey: string }[] }>(
+  'delivery:snapshot',
+)
+
+async function post(t: Backend, body: IngestReceiverBody) {
+  const signed = await signedIngestRequest(body, SECRET)
+  return t.fetch(INGEST_RECEIVER_PATH, { method: 'POST', headers: signed.headers, body: signed.body })
+}
+
+/** Bytes as an issued upload URL stores them (convex-test records size only; the real upload records the type). */
+async function storeFile(t: Backend, bytes: number, contentType: string): Promise<string> {
+  return t.run(async (ctx) => {
+    const id = await ctx.storage.store(new Blob([new Uint8Array(bytes)], { type: contentType }))
+    await (ctx.db as unknown as { patch(id: unknown, value: unknown): Promise<void> }).patch(id, { contentType })
+    return id
+  })
+}
+
+/** An editor's asset upload: the bytes stored, then the row written through `assets:upsert` (the real write path). */
+async function publishAsset(t: Backend, assetId: string, bytes: number, contentType: string): Promise<string> {
+  const storageKey = await storeFile(t, bytes, contentType)
+  const stamp = new Date().toISOString()
+  await asAdmin(t).mutation(upsertAsset, {
+    assetId,
+    filename: `${assetId}.jpg`,
+    contentType,
+    byteSize: bytes,
+    storageKey,
+    createdAt: stamp,
+    updatedAt: stamp,
+  })
+  return storageKey
+}
+
+/** The attacker's harvest: the anonymous public delivery snapshot names every asset's storage id. */
+async function harvest(t: Backend, assetId: string): Promise<string> {
+  const { assets } = await t.query(snapshot, { projectId: PROJECT_ID })
+  const asset = assets.find((entry) => entry.id === assetId)
+  if (!asset) throw new Error(`asset ${assetId} not on the public snapshot`)
+  return asset.storageKey
+}
+
+async function declare(t: Backend, contentType: string, size: number, field = 'cv'): Promise<string> {
+  const answer = await post(t, { kind: 'upload', target: 'contact', field, contentType, size })
+  expect(answer.status).toBe(200)
+  return ((await answer.json()) as { uploadId: string }).uploadId
+}
+
+const SUBMISSION = {
+  kind: 'submission',
+  target: 'contact',
+  data: { email: 'mallory@example.test', message: 'hi', [FORMS_HONEYPOT_KEY]: '' },
+} as const
+
+async function rows(t: Backend): Promise<SubmissionRecord[]> {
+  return (await t.run(async (ctx) => (await ctx.db.query('records').collect()).filter((row) => row.kind === 'submission'))).map(
+    (row) => ({ ...(row.data as object), id: row.recordId }) as unknown as SubmissionRecord,
+  )
+}
+
+/** Whether stored bytes still exist (`storage.get` → a Blob, which is not a Convex value: answer a boolean). */
+const survives = (t: Backend, storageId: string) => t.run(async (ctx) => (await ctx.storage.get(storageId as never)) !== null)
+
+function editor(t: Backend) {
+  const client = {
+    query: (ref: FunctionReference<'query'>, args?: Record<string, unknown>) => asAdmin(t).query(ref, args ?? {}),
+    mutation: (ref: FunctionReference<'mutation'>, args?: Record<string, unknown>) => asAdmin(t).mutation(ref, args ?? {}),
+  } as unknown as ConvexHttpClient
+  return new ConvexPersistenceAdapter(client, PROJECT_ID).records(submissionRecordKind)
+}
+
+/** An asset an editor published a day before the attacker's intent, harvested from the public snapshot. */
+async function harvestedOldAsset(t: Backend): Promise<string> {
+  vi.setSystemTime(at(-24 * 60 * 60 * 1000))
+  await publishAsset(t, 'hero', 400, 'image/jpeg')
+  vi.setSystemTime(new Date(T0))
+  return harvest(t, 'hero')
+}
+
+/** A refused submission whose second claim is a genuine mismatch — the shape that triggers the rollback. */
+async function postWithRefusedSecondClaim(t: Backend, first: { uploadId: string; storageId: string }) {
+  const liar = await declare(t, 'image/png', 500)
+  const bad = await storeFile(t, 10, 'text/html')
+  return post(t, { ...SUBMISSION, uploads: [first, { uploadId: liar, storageId: bad }] })
+}
+
+describe('EC-671 probe — a visitor names an asset’s storage id in an upload claim', () => {
+  it('control: the anonymous delivery snapshot names the asset’s storage id (the attacker’s input is public)', async () => {
+    const t = await backend()
+    vi.setSystemTime(at(-24 * 60 * 60 * 1000))
+    const storageKey = await publishAsset(t, 'hero', 400, 'image/jpeg')
+    vi.setSystemTime(new Date(T0))
+    expect(await harvest(t, 'hero')).toBe(storageKey)
+  })
+
+  it('(1) mismatching declaration: the claim is refused and the asset’s file survives', async () => {
+    const t = await backend()
+    const victim = await harvestedOldAsset(t)
+    const uploadId = await declare(t, 'image/png', 10) // a fresh intent of the attacker's own, mismatching the asset
+    const answer = await post(t, { ...SUBMISSION, uploads: [{ uploadId, storageId: victim }] })
+    expect(answer.status).toBe(REFUSED_MISMATCHING)
+    expect(await rows(t)).toEqual([])
+    expect(await survives(t, victim)).toBe(true) // base: false — the claim deleted it (ingest.ts:256)
+  })
+
+  it('(2a) matching declaration, rollback: the asset’s file is never claimed, so a refused later claim cannot release it', async () => {
+    const t = await backend()
+    const victim = await harvestedOldAsset(t)
+    const matching = await declare(t, 'image/jpeg', 400)
+    const answer = await postWithRefusedSecondClaim(t, { uploadId: matching, storageId: victim })
+    expect(answer.status).toBe(422) // base: 415 — the first claim passed, the second refused
+    expect(await rows(t)).toEqual([])
+    expect(await survives(t, victim)).toBe(true) // base: false — claimed, then released by the rollback
+  })
+
+  it('(2b) matching declaration, removal: the claim cannot attach the asset’s file; a row naming it by hand cannot delete it', async () => {
+    const t = await backend()
+    const victim = await harvestedOldAsset(t)
+    const matching = await declare(t, 'image/jpeg', 400)
+    const answer = await post(t, {
+      ...SUBMISSION,
+      data: { ...SUBMISSION.data, cv: 'cv.jpg' },
+      uploads: [{ uploadId: matching, storageId: victim }],
+    })
+    expect(answer.status).toBe(422) // base: 200 — claimed and attached
+    expect(await rows(t)).toEqual([])
+    // The deletion site holds on its own: a submission whose `files` name the asset's id (an
+    // editor's write — the kind's `save` takes the column) is removed, and the asset's file stays.
+    const repo = editor(t)
+    await repo.save(PROJECT_ID, {
+      id: 'submission_by_hand',
+      form: 'contact',
+      payload: [],
+      files: [{ field: 'cv', storageId: victim, contentType: 'image/jpeg', size: 400 }],
+      status: 'new',
+      spam: 'clean',
+      deliveryState: 'skipped',
+      submittedAt: T0,
+    })
+    expect((await rows(t)).map((row) => row.id)).toEqual(['submission_by_hand'])
+    await repo.remove(PROJECT_ID, 'submission_by_hand')
+    expect(await rows(t)).toEqual([])
+    expect(await survives(t, victim)).toBe(true) // base: false — removal deletes whatever `files` names
+  })
+
+  it('(3) fresh asset (critic): uploaded AFTER the intent, a matching declaration, a refused second claim → it survives', async () => {
+    const t = await backend()
+    const matching = await declare(t, 'image/jpeg', 400) // the attacker holds a fresh intent open…
+    vi.setSystemTime(at(60 * 1000))
+    await publishAsset(t, 'hero', 400, 'image/jpeg') // …an editor uploads an asset a minute later…
+    const victim = await harvest(t, 'hero') // …which is public at once
+    const answer = await postWithRefusedSecondClaim(t, { uploadId: matching, storageId: victim })
+    expect(answer.status).toBe(422) // base: 415 — the first claim passed, the second refused
+    expect(await rows(t)).toEqual([])
+    expect(await survives(t, victim)).toBe(true) // base: false — claimed, then released by the rollback
+  })
+
+  it('control: a genuine upload claims and attaches; removing its submission deletes its file (the instrument sees a deletion)', async () => {
+    const t = await backend()
+    const uploadId = await declare(t, 'application/pdf', 900)
+    const own = await storeFile(t, 800, 'application/pdf')
+    const answer = await post(t, { ...SUBMISSION, data: { ...SUBMISSION.data, cv: 'cv.pdf' }, uploads: [{ uploadId, storageId: own }] })
+    expect(answer.status).toBe(200)
+    const [row] = await rows(t)
+    expect(row!.files).toEqual([
+      { field: 'cv', name: 'cv.pdf', storageId: own, contentType: 'application/pdf', size: 800, url: expect.any(String) },
+    ])
+    expect(await survives(t, own)).toBe(true)
+    await editor(t).remove(PROJECT_ID, row!.id)
+    expect(await survives(t, own)).toBe(false)
+  })
+
+  it('control: a genuine mismatch is refused (no row); a genuine claim before it is released by the rollback', async () => {
+    const t = await backend()
+    const good = await declare(t, 'image/png', 500)
+    const goodFile = await storeFile(t, 400, 'image/png')
+    const answer = await postWithRefusedSecondClaim(t, { uploadId: good, storageId: goodFile })
+    expect(answer.status).toBe(415)
+    expect(await rows(t)).toEqual([])
+    expect(await survives(t, goodFile)).toBe(false)
+  })
+})

package/src/convex/forms.convex.test.ts

@@ -406,7 +406,7 @@ describe('uploads, claimed by the submission', () => {
     expect(await t.run((ctx) => ctx.storage.get(storageId as never))).toBeNull()
   })
 
-  it('a claim that fails refuses the submission AND deletes the files it had already claimed', async () => {
+  it('a claim that fails refuses the submission AND deletes the files it had already claimed (never the refused one)', async () => {
     const t = await backend()
     site()
     const good = await declareUpload(t, 'image/png', 500, 'photo')
@@ -423,7 +423,8 @@ describe('uploads, claimed by the submission', () => {
     expect(answer.status).toBe(415)
     expect(await rows(t)).toEqual([])
     expect(await t.run((ctx) => ctx.storage.get(goodFile as never))).toBeNull() // claimed, then released
-    expect(await t.run((ctx) => ctx.storage.get(wrongType as never))).toBeNull() // EC-617's claim deletes a mismatch
+    // EC-671: the refused claim never deletes the id it names (the visitor's word, not an ownership fact).
+    expect(await t.run(async (ctx) => (await ctx.storage.get(wrongType as never)) !== null)).toBe(true)
     expect(await scheduled(t)).toEqual([])
   })
 

package/src/convex/index.ts

@@ -16,6 +16,7 @@ import {
   ingestUploadRecordKind,
   parseIngestPayload,
   recordIngestUpload,
+  releaseIngestUploads,
 } from '@elytracms/studio/convex/ingest'
 import {
   defineRecordFunctions,
@@ -60,7 +61,9 @@ import type { FormDeliveryRequest } from '../shared/delivery'
  *   under the forms upload policy and its intent recorded; a `submission` is read
  *   (`readSubmissionPayload`), its uploads claimed, the row written and its delivery
  *   scheduled. A claim that fails refuses the submission and deletes the files already
- *   claimed for it — no claimed bytes ever sit without a row;
+ *   claimed for it — no claimed bytes ever sit without a row. Every deletion goes through
+ *   the engine's `releaseIngestUploads`, which deletes only bytes a claim bound to its
+ *   intent (EC-671): an id a visitor or an editor merely NAMES is never deleted;
  * - **`deliver`** — the scheduled action per row: it asks the site's delivery route to send
  *   (`attemptFormDelivery`) and `recordDelivery` logs the answer per recipient and schedules
  *   the next attempt (`applyDeliveryOutcome`);
@@ -130,24 +133,23 @@ export const save = mutation({
   },
 })
 
-/** Delete a submission AND the files it claimed (no bytes outlive their row). */
+/**
+ * Delete a submission AND the files it claimed (no claimed bytes outlive their row). EC-671:
+ * through `releaseIngestUploads`, which deletes only files a claim bound — a `files` entry
+ * naming anything else (an editor's write can put any id there) is kept, never deleted.
+ */
 export const remove = mutation({
   args: { [kind.idKey]: v.string() },
   handler: async (ctx, args: Record<string, unknown>) => {
     await requireCapability(ctx, kind.access.write)
     const doc = await findRecordDoc(ctx, kind, args[kind.idKey] as string)
     if (!doc) return
-    await deleteFiles(ctx, (doc.data['files'] as SubmissionFile[] | undefined) ?? [])
+    await releaseIngestUploads(ctx, storageIds((doc.data['files'] as SubmissionFile[] | undefined) ?? []))
     await ctx.db.delete(doc._id)
   },
 })
 
-async function deleteFiles(ctx: MutationCtx, files: readonly { storageId: string }[]): Promise<void> {
-  for (const file of files) {
-    const id = file.storageId as GenericId<'_storage'>
-    if (await ctx.db.system.get(id).catch(() => null)) await ctx.storage.delete(id)
-  }
-}
+const storageIds = (files: readonly { storageId: string }[]) => files.map((file) => file.storageId)
 
 // --- The receiver's handler ------------------------------------------------------------------
 
@@ -172,13 +174,14 @@ export const ingest = internalMutation({
     const read = readSubmissionPayload(body, { hasFiles: (body.uploads?.length ?? 0) > 0 })
     if (!read.ok) return { ok: false, status: read.status, message: read.message, issues: read.issues }
 
-    // Claim every upload; on the first refusal, delete what this submission already claimed.
+    // Claim every upload; on the first refusal, release what this submission already claimed
+    // (bound in this transaction — EC-671: nothing else is ever deleted here).
     const files: SubmissionFile[] = []
     const namesUsed = new Map<string, number>()
     for (const claim of body.uploads ?? []) {
       const claimed = await claimIngestUpload(ctx, claim, body.target, receivedAt)
       if (!claimed.ok) {
-        await deleteFiles(ctx, files)
+        await releaseIngestUploads(ctx, storageIds(files))
         return claimed
       }
       const index = namesUsed.get(claimed.field) ?? 0