@indigoai-us/hq-cloud 6.12.1 → 6.12.3

package/src/object-io.test.ts

@@ -19,6 +19,7 @@ import {
 } from "./object-io.js";
 import type { EntityContext } from "./types.js";
 import type { PresignResultRow, VaultListedObject } from "./vault-client.js";
+import { isAccessDenied } from "./sync-core.js";
 
 const COMPANY = "cmp_test";
 
@@ -205,6 +206,59 @@ describe("PresignObjectIO.putObject", () => {
     expect(fetchMock).not.toHaveBeenCalled();
   });
 
+  it("a write denial (FILES_PRESIGN_FORBIDDEN) throws the access-denied shape so the push skips it like a denied GET", async () => {
+    const { vault, setPresign } = makeVault();
+    // The server refuses to MINT a PUT URL for a key the caller can't write
+    // (private-by-default: members hold read-only on a shared knowledge prefix).
+    setPresign([
+      {
+        key: "knowledge/clients/acme/brief.md",
+        op: "put",
+        error: "Caller lacks write permission on 'knowledge/clients/acme/brief.md'",
+        code: "FILES_PRESIGN_FORBIDDEN",
+      },
+    ]);
+    const io = new PresignObjectIO(vault, COMPANY);
+    let caught: unknown;
+    await io
+      .putObject({
+        key: "knowledge/clients/acme/brief.md",
+        body: Buffer.from("z"),
+        contentType: "text/markdown",
+      })
+      .catch((e) => {
+        caught = e;
+      });
+    // Same shape a denied GET/HEAD already throws (name === "Forbidden"), so the
+    // share.ts push catch routes it through `isAccessDenied` into the silent
+    // per-path skip (scopeExcludedSet) + the "N paths skipped — outside your
+    // granted access" aggregate, instead of a fatal `type:"error"` that exits
+    // the runner non-zero and floods Sentry. This is the PUT/GET symmetry that
+    // fixes the fleet-wide presign-put-denied crash-loop.
+    expect((caught as Error).name).toBe("Forbidden");
+    expect(isAccessDenied(caught)).toBe(true);
+    // Denied at mint time — the byte-moving PUT is never attempted.
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("a non-authorization presign failure stays a generic (fatal) error — not silently skipped", async () => {
+    const { vault, setPresign } = makeVault();
+    setPresign([
+      { key: "secret/x", op: "put", error: "boom", code: "PRESIGN_INTERNAL" },
+    ]);
+    const io = new PresignObjectIO(vault, COMPANY);
+    let caught: unknown;
+    await io
+      .putObject({ key: "secret/x", body: Buffer.from("z"), contentType: "x" })
+      .catch((e) => {
+        caught = e;
+      });
+    // Only `*_FORBIDDEN` authorization denials are reclassified; a real backend
+    // failure must still surface loudly so it is not masked as an expected skip.
+    expect(isAccessDenied(caught)).toBe(false);
+    expect((caught as Error).message).toMatch(/denied for secret\/x.*PRESIGN_INTERNAL/);
+  });
+
   it("throws when the PUT itself fails", async () => {
     const { vault, setPresign } = makeVault();
     setPresign([{ key: "k", op: "put", url: "https://s3/put" }]);

package/src/object-io.ts

@@ -354,6 +354,24 @@ function firstRowOrThrow(
     throw new Error(`presign ${op} returned no row for ${key}`);
   }
   if (row.error || !row.url) {
+    // An authorization denial (server `*_FORBIDDEN` code — e.g.
+    // FILES_PRESIGN_FORBIDDEN when the caller lacks write on a shared prefix,
+    // or FILES_RAW_FORBIDDEN) must throw the SAME `name: "Forbidden"` shape the
+    // GET/HEAD path uses (see {@link accessDeniedError}) so it routes through
+    // the `isAccessDenied` skip in sync.ts / share.ts. Without this, a denied
+    // PUT presign fell to the generic Error below — `isAccessDenied` returned
+    // false — and the per-file ACL skip the GET path handles gracefully became
+    // a FATAL sync error: the crash-loop + Sentry flood behind the fleet-wide
+    // "presign put denied" incident (members pushing net-new keys to a
+    // company-wide-read prefix under private-by-default). The denial is
+    // expected; only the fatal handling of it was the bug.
+    if (typeof row.code === "string" && row.code.endsWith("_FORBIDDEN")) {
+      throw accessDeniedError(
+        key,
+        `no write access to '${key}' (server ${op} denied: ${row.code}) — ` +
+          `ask an admin to grant write on this shared prefix`,
+      );
+    }
     throw new Error(
       `presign ${op} denied for ${key}: ${row.error ?? "no url"}${
         row.code ? ` (${row.code})` : ""