@mulmoclaude/collection-plugin 0.5.1 → 0.5.2

package/dist/server.js

@@ -69,6 +69,20 @@ function safeSlugName(slug) {
 	if (basename !== slug) return null;
 	return basename;
 }
+var SAFE_RECORD_ID_PATTERN = /^[a-zA-Z0-9](?:[a-zA-Z0-9_.-]*[a-zA-Z0-9])?$/;
+/** Sanitise a user-supplied record id into a safe filename stem. Like
+*  `safeSlugName` but tolerates interior dots (so natural keys work),
+*  while still rejecting any `..` substring, path separators, and
+*  leading/trailing dots. The `path.basename` round-trip is the same
+*  `js/path-injection` sanitiser CodeQL recognises on `safeSlugName`. */
+function safeRecordId(recordId) {
+	if (typeof recordId !== "string") return null;
+	if (!SAFE_RECORD_ID_PATTERN.test(recordId)) return null;
+	if (recordId.includes("..")) return null;
+	const basename = path.basename(recordId);
+	if (basename !== recordId) return null;
+	return basename;
+}
 /** Realpath the closest existing ancestor of `absPath` and return it.
 *  Returns null if no ancestor exists or if the realpath call fails
 *  for a non-ENOENT reason (permissions, etc.). Used by
@@ -302,7 +316,7 @@ async function listItems(dataDir, opts = {}) {
 *  when the record file itself is a symlink (file-disclosure
 *  defense — see `isRegularFile`). */
 async function readItem(dataDir, itemId, opts = {}) {
-	const safeId = safeSlugName(itemId);
+	const safeId = safeRecordId(itemId);
 	if (safeId === null) return null;
 	if (!isContainedInRoot(dataDir, opts.workspaceRoot ?? getWorkspaceRoot())) return null;
 	const filePath = itemFilePath(dataDir, safeId);
@@ -332,7 +346,7 @@ async function readItem(dataDir, itemId, opts = {}) {
 *  Update path (`refuseOverwrite: false`) uses `writeFileAtomic` so
 *  PUT remains crash-atomic. No race there — the URL pins the id. */
 async function writeItem(dataDir, itemId, item, opts = {}) {
-	const safeId = safeSlugName(itemId);
+	const safeId = safeRecordId(itemId);
 	if (safeId === null) return {
 		kind: "invalid-id",
 		itemId
@@ -391,7 +405,7 @@ async function writeItem(dataDir, itemId, item, opts = {}) {
 	};
 }
 async function deleteItem(dataDir, itemId, opts = {}) {
-	const safeId = safeSlugName(itemId);
+	const safeId = safeRecordId(itemId);
 	if (safeId === null) return {
 		kind: "invalid-id",
 		itemId
@@ -845,8 +859,8 @@ var CollectionSchemaZ = z.object({
 	views: z.array(CustomViewSchema).optional(),
 	notifyWhen: WhenSchema.optional(),
 	ingest: IngestSchemaZ.optional()
-}).refine((schema) => schema.singleton === void 0 || safeSlugName(schema.singleton) !== null, {
-	message: "schema `singleton` must be a valid item id (alphanumeric / hyphen / underscore, no path separators)",
+}).refine((schema) => schema.singleton === void 0 || safeRecordId(schema.singleton) !== null, {
+	message: "schema `singleton` must be a valid item id (alphanumeric / hyphen / underscore / interior dot, no `..` or path separators)",
 	path: ["singleton"]
 }).refine((schema) => schema.actions === void 0 || new Set(schema.actions.map((action) => action.id)).size === schema.actions.length, {
 	message: "schema `actions` must have unique `id`s",
@@ -937,6 +951,45 @@ function applyFeedSchemaDefaults(parsed, slug) {
 		dataPath: `data/feeds/${slug}`
 	};
 }
+/** The acceptance gates discovery applies AFTER `CollectionSchemaZ` parses,
+*  before a schema becomes a live collection:
+*
+*  - the `primaryKey` must be a declared field flagged `primary: true` —
+*    without the flag CollectionView renders the field editable, and a
+*    rename is silently pinned back to the URL itemId on save, so the user's
+*    edit is dropped with no error;
+*  - a `feed` schema must declare an `ingest` block (else it's a dead,
+*    non-refreshable card);
+*  - `dataPath` must resolve INSIDE the workspace.
+*
+*  Exported so `manageCollection`'s `putSchema` can run the SAME gates before
+*  it reports success — a schema that passes `CollectionSchemaZ` but fails one
+*  of these would otherwise write cleanly yet be skipped on the next discovery,
+*  hiding the collection (the exact failure that tool exists to prevent). */
+function acceptParsedSchema(schema, opts) {
+	const primaryField = schema.fields[schema.primaryKey];
+	if (!primaryField) return {
+		ok: false,
+		reason: `primaryKey '${schema.primaryKey}' is not one of the declared fields`
+	};
+	if (primaryField.primary !== true) return {
+		ok: false,
+		reason: `the primaryKey field '${schema.primaryKey}' must be flagged \`primary: true\``
+	};
+	if (opts.source === "feed" && !schema.ingest) return {
+		ok: false,
+		reason: "a feed schema must declare an `ingest` block"
+	};
+	const dataDir = resolveDataDir(schema.dataPath, opts.workspaceRoot);
+	if (dataDir === null) return {
+		ok: false,
+		reason: `dataPath '${schema.dataPath}' escapes the workspace`
+	};
+	return {
+		ok: true,
+		dataDir
+	};
+}
 async function loadOneCollection(skillsRoot, slug, source, workspaceRoot) {
 	const safeName = safeSlugName(slug);
 	if (safeName === null) return null;
@@ -973,31 +1026,14 @@ async function loadOneCollection(skillsRoot, slug, source, workspaceRoot) {
 		return null;
 	}
 	const schema = parsed.data;
-	const primaryField = schema.fields[schema.primaryKey];
-	if (!primaryField) {
-		log.warn("collections", "schema.json primaryKey not found in fields, skipping", {
-			slug: safeName,
-			primaryKey: schema.primaryKey
-		});
-		return null;
-	}
-	if (primaryField.primary !== true) {
-		log.warn("collections", "schema.json primaryKey field is not flagged primary: true, skipping", {
-			slug: safeName,
-			primaryKey: schema.primaryKey
-		});
-		return null;
-	}
-	if (source === "feed" && !schema.ingest) {
-		log.warn("collections", "feed schema.json has no `ingest` block, skipping", { slug: safeName });
-		return null;
-	}
-	const dataDir = resolveDataDir(schema.dataPath, workspaceRoot);
-	if (dataDir === null) {
-		log.warn("collections", "schema.json dataPath escapes workspace, skipping", {
+	const acceptance = acceptParsedSchema(schema, {
+		source,
+		workspaceRoot
+	});
+	if (!acceptance.ok) {
+		log.warn("collections", "schema.json rejected after validation, skipping", {
 			slug: safeName,
-			dataPath: schema.dataPath,
-			workspaceRoot
+			reason: acceptance.reason
 		});
 		return null;
 	}
@@ -1005,7 +1041,7 @@ async function loadOneCollection(skillsRoot, slug, source, workspaceRoot) {
 		slug: safeName,
 		source,
 		schema,
-		dataDir,
+		dataDir: acceptance.dataDir,
 		skillDir: path.join(skillsRoot, safeName)
 	};
 }
@@ -1571,6 +1607,6 @@ async function deleteCustomView(collection, viewId, opts = {}) {
 	};
 }
 //#endregion
-export { COMPUTED_TYPES, CollectionSchemaZ, SCHEMA_FILE, advanceTriggerDate, buildActionSeedPrompt, buildCollectionActionSeedPrompt, computeSuccessor, configureCollectionHost, daysInMonth, deleteCollection, deleteCollectionRefusalMessage, deleteCustomView, deleteItem, discoverCollections, enrichItems, formatCivil, generateItemId, getWorkspaceRoot, isContainedInRoot, isContainedInWorkspace, isSafeActionTemplatePath, isSafeCustomViewPath, isSafeTemplatePath, isTriggerDue, itemFilePath, listItems, loadCollection, log, maybeSpawnSuccessor, parseCivil, readCustomViewHtml, readItem, readSkillTemplate, resolveCreateItemId, resolveDataDir, resolveTemplatePath, safeSlugName, successorId, toDetail, toSummary, validateCollectionRecords, validateRecordObject, writeItem };
+export { COMPUTED_TYPES, CollectionSchemaZ, SCHEMA_FILE, acceptParsedSchema, advanceTriggerDate, buildActionSeedPrompt, buildCollectionActionSeedPrompt, computeSuccessor, configureCollectionHost, daysInMonth, deleteCollection, deleteCollectionRefusalMessage, deleteCustomView, deleteItem, discoverCollections, enrichItems, formatCivil, generateItemId, getWorkspaceRoot, isContainedInRoot, isContainedInWorkspace, isSafeActionTemplatePath, isSafeCustomViewPath, isSafeTemplatePath, isTriggerDue, itemFilePath, listItems, loadCollection, log, maybeSpawnSuccessor, parseCivil, readCustomViewHtml, readItem, readSkillTemplate, resolveCreateItemId, resolveDataDir, resolveTemplatePath, safeRecordId, safeSlugName, successorId, toDetail, toSummary, validateCollectionRecords, validateRecordObject, writeItem };
 
 //# sourceMappingURL=server.js.map