@open-mercato/ai-assistant 0.6.5-develop.4882.1.901c3aa813 → 0.6.5-develop.5033.1.c970204a3f

package/src/modules/ai_assistant/lib/__tests__/codemode-tools.test.ts

@@ -1,8 +1,13 @@
 import type { McpToolContext } from '../types'
 import { getApiEndpoints } from '../api-endpoint-index'
+import { fetchWithTimeout } from '@open-mercato/shared/lib/http/fetchWithTimeout'
 import {
   authorizeCodeModeApiRequest,
+  CODE_MODE_MAX_API_CALLS,
+  CODE_MODE_MAX_MUTATION_CALLS,
   CODE_MODE_REQUIRED_FEATURES,
+  createApiRequestFn,
+  isUnsafeHttpMethod,
   matchApiEndpointPath,
 } from '../codemode-tools'
 
@@ -11,7 +16,46 @@ jest.mock('../api-endpoint-index', () => ({
   getRawOpenApiSpec: jest.fn(),
 }))
 
+jest.mock('@open-mercato/shared/lib/http/fetchWithTimeout', () => ({
+  fetchWithTimeout: jest.fn(),
+  resolveTimeoutMs: jest.fn(() => 30000),
+}))
+
 const mockedGetApiEndpoints = jest.mocked(getApiEndpoints)
+const mockedFetchWithTimeout = jest.mocked(fetchWithTimeout)
+
+function okResponse() {
+  return {
+    ok: true,
+    status: 200,
+    text: jest.fn().mockResolvedValue('{}'),
+  } as unknown as Response
+}
+
+/**
+ * Replicate the execute() handler's per-run counters so the regression test
+ * exercises the same accounting that gates real api.request() calls.
+ */
+function createCountingOnCall() {
+  let apiCallCount = 0
+  let mutationCallCount = 0
+  const onCall = (normalizedMethod: string) => {
+    apiCallCount++
+    if (apiCallCount > CODE_MODE_MAX_API_CALLS) {
+      throw new Error(`API call limit exceeded (max ${CODE_MODE_MAX_API_CALLS})`)
+    }
+    if (isUnsafeHttpMethod(normalizedMethod)) {
+      mutationCallCount++
+      if (mutationCallCount > CODE_MODE_MAX_MUTATION_CALLS) {
+        throw new Error(`Mutation API call limit exceeded (max ${CODE_MODE_MAX_MUTATION_CALLS})`)
+      }
+    }
+  }
+  return {
+    onCall,
+    counts: () => ({ apiCallCount, mutationCallCount }),
+  }
+}
 
 type MockRbacService = {
   hasAllFeatures: jest.Mock<boolean, [string[], string[]]>
@@ -242,3 +286,87 @@ describe('authorizeCodeModeApiRequest', () => {
     })
   })
 })
+
+describe('mutation call cap (issue #2724)', () => {
+  beforeEach(() => {
+    mockedGetApiEndpoints.mockReset()
+    mockedFetchWithTimeout.mockReset()
+    mockedFetchWithTimeout.mockResolvedValue(okResponse())
+    // Documented, feature-authorized POST endpoint so RBAC always allows the call.
+    mockedGetApiEndpoints.mockResolvedValue([
+      {
+        id: 'create_company',
+        operationId: 'create_company',
+        method: 'POST',
+        path: '/api/customers/companies',
+        summary: '',
+        description: '',
+        tags: [],
+        requiredFeatures: ['customers.companies.create'],
+        parameters: [],
+        requestBodySchema: null,
+        deprecated: false,
+      },
+    ])
+  })
+
+  function authorizedContext(): McpToolContext {
+    return createContext({
+      userFeatures: ['ai_assistant.view', 'customers.companies.create'],
+    })
+  }
+
+  it('counts a dynamically-built POST method against the mutation cap', async () => {
+    const { onCall, counts } = createCountingOnCall()
+    const apiRequest = createApiRequestFn(authorizedContext(), onCall)
+
+    // The method string is built at runtime — the old static regex never saw it.
+    const dynamicMethod = 'PO' + 'ST'
+    await apiRequest({ method: dynamicMethod, path: '/api/customers/companies', body: {} })
+
+    expect(counts()).toEqual({ apiCallCount: 1, mutationCallCount: 1 })
+  })
+
+  it('refuses once the dynamically-built mutation cap is exceeded', async () => {
+    const { onCall } = createCountingOnCall()
+    const apiRequest = createApiRequestFn(authorizedContext(), onCall)
+
+    const dynamicMethod = ['P', 'O', 'S', 'T'].join('')
+    for (let index = 0; index < CODE_MODE_MAX_MUTATION_CALLS; index++) {
+      await apiRequest({ method: dynamicMethod, path: '/api/customers/companies', body: {} })
+    }
+
+    await expect(
+      apiRequest({ method: dynamicMethod, path: '/api/customers/companies', body: {} })
+    ).rejects.toThrow(`Mutation API call limit exceeded (max ${CODE_MODE_MAX_MUTATION_CALLS})`)
+
+    // Authorized mutations actually hit fetch up to the cap; the cap throws before fetch on the overflow call.
+    expect(mockedFetchWithTimeout).toHaveBeenCalledTimes(CODE_MODE_MAX_MUTATION_CALLS)
+  })
+
+  it('does not charge GET reads against the mutation cap', async () => {
+    mockedGetApiEndpoints.mockResolvedValue([
+      {
+        id: 'list_companies',
+        operationId: 'list_companies',
+        method: 'GET',
+        path: '/api/customers/companies',
+        summary: '',
+        description: '',
+        tags: [],
+        requiredFeatures: [],
+        parameters: [],
+        requestBodySchema: null,
+        deprecated: false,
+      },
+    ])
+    const { onCall, counts } = createCountingOnCall()
+    const apiRequest = createApiRequestFn(createContext(), onCall)
+
+    for (let index = 0; index < CODE_MODE_MAX_MUTATION_CALLS + 5; index++) {
+      await apiRequest({ method: 'get', path: '/api/customers/companies' })
+    }
+
+    expect(counts()).toEqual({ apiCallCount: CODE_MODE_MAX_MUTATION_CALLS + 5, mutationCallCount: 0 })
+  })
+})

package/src/modules/ai_assistant/lib/__tests__/tool-test-runner-pick-default-tenant.test.ts

@@ -0,0 +1,70 @@
+import type { AwilixContainer } from 'awilix'
+import { pickDefaultTenant } from '../tool-test-runner'
+
+type ExecuteCall = { sql: string; params?: unknown[] }
+
+function makeContainer(
+  rowsBySql: (sql: string) => Record<string, unknown>[],
+  calls: ExecuteCall[],
+): AwilixContainer {
+  const connection = {
+    execute: async (sql: string, params?: unknown[]) => {
+      calls.push({ sql, params })
+      return rowsBySql(sql)
+    },
+  }
+  const em = { getConnection: () => connection }
+  return {
+    resolve: (token: string) => {
+      if (token === 'em') return em
+      throw new Error(`[internal] unexpected resolve token: ${token}`)
+    },
+  } as unknown as AwilixContainer
+}
+
+describe('pickDefaultTenant SQL safety (#2725)', () => {
+  it('binds the tenant id as a query parameter instead of interpolating it', async () => {
+    const calls: ExecuteCall[] = []
+    const tenantId = '11111111-2222-3333-4444-555555555555'
+    const orgId = 'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee'
+    const userId = 'ffffffff-0000-1111-2222-333333333333'
+    const container = makeContainer((sql) => {
+      if (sql.includes('FROM tenants')) return [{ id: tenantId }]
+      if (sql.includes('FROM organizations')) return [{ id: orgId }]
+      if (sql.includes('FROM users')) return [{ id: userId }]
+      return []
+    }, calls)
+
+    const result = await pickDefaultTenant(container)
+
+    expect(result).toEqual({ tenantId, organizationId: orgId, userId })
+
+    const orgCall = calls.find((call) => call.sql.includes('FROM organizations'))
+    const userCall = calls.find((call) => call.sql.includes('FROM users'))
+    expect(orgCall).toBeDefined()
+    expect(userCall).toBeDefined()
+
+    // Tenant value flows through bound parameters, never string-interpolated.
+    expect(orgCall?.params).toEqual([tenantId])
+    expect(userCall?.params).toEqual([tenantId])
+    expect(orgCall?.sql).toContain('tenant_id = ?')
+    expect(userCall?.sql).toContain('tenant_id = ?')
+
+    // No call may embed the tenant value or hand-rolled quote-escaping in SQL.
+    for (const call of calls) {
+      expect(call.sql).not.toContain(tenantId)
+      expect(call.sql).not.toContain("''")
+    }
+  })
+
+  it('returns null when no tenant exists without issuing scoped lookups', async () => {
+    const calls: ExecuteCall[] = []
+    const container = makeContainer(() => [], calls)
+
+    const result = await pickDefaultTenant(container)
+
+    expect(result).toBeNull()
+    expect(calls).toHaveLength(1)
+    expect(calls[0]?.sql).toContain('FROM tenants')
+  })
+})

package/src/modules/ai_assistant/lib/codemode-tools.ts

@@ -550,22 +550,10 @@ function buildEntitySchemas(graph: EntityGraph) {
   })
 }
 
-/**
- * Detect mutation HTTP methods in code via static analysis.
- * Returns which methods were found (POST, PUT, PATCH, DELETE).
- */
-function detectMutationInCode(code: string): { hasMutation: boolean; methods: string[] } {
-  const methods: string[] = []
-  const pattern = /method:\s*['"](\w+)['"]/gi
-  let match
-  while ((match = pattern.exec(code)) !== null) {
-    const method = match[1].toUpperCase()
-    if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(method)) {
-      methods.push(method)
-    }
-  }
-  return { hasMutation: methods.length > 0, methods }
-}
+/** Maximum api.request() calls allowed per execute() run, regardless of method. */
+export const CODE_MODE_MAX_API_CALLS = 50
+/** Maximum mutation (non-GET/HEAD/OPTIONS) api.request() calls allowed per execute() run. */
+export const CODE_MODE_MAX_MUTATION_CALLS = 20
 
 /**
  * Load and register the two Code Mode tools.
@@ -701,19 +689,24 @@ RULES: For FIND/LIST → GET only (1 call). For UPDATE → PUT to collection pat
           }
         }
 
-        // Detect mutations via static analysis — cap API calls for safety
-        const mutationInfo = detectMutationInCode(input.code)
-        const maxApiCalls = mutationInfo.hasMutation ? 20 : 50
-        if (mutationInfo.hasMutation) {
-          console.error(`[AI Usage] execute: MUTATION DETECTED (${mutationInfo.methods.join(',')}) — capping API calls to ${maxApiCalls}`)
-        }
+        // Cap API calls for safety. The mutation cap is enforced against the
+        // actually-observed HTTP method, not a static scan of the source — so a
+        // dynamically-built method (e.g. 'PO' + 'ST') can never escape it.
+        const maxApiCalls = CODE_MODE_MAX_API_CALLS
         let apiCallCount = 0
+        let mutationCallCount = 0
 
-        const apiRequestFn = createApiRequestFn(ctx, () => {
+        const apiRequestFn = createApiRequestFn(ctx, (normalizedMethod) => {
           apiCallCount++
           if (apiCallCount > maxApiCalls) {
             throw new Error(`API call limit exceeded (max ${maxApiCalls})`)
           }
+          if (isUnsafeHttpMethod(normalizedMethod)) {
+            mutationCallCount++
+            if (mutationCallCount > CODE_MODE_MAX_MUTATION_CALLS) {
+              throw new Error(`Mutation API call limit exceeded (max ${CODE_MODE_MAX_MUTATION_CALLS})`)
+            }
+          }
         })
 
         const context = {
@@ -761,9 +754,9 @@ RULES: For FIND/LIST → GET only (1 call). For UPDATE → PUT to collection pat
 /**
  * Create the api.request() function for the execute sandbox.
  */
-function createApiRequestFn(
+export function createApiRequestFn(
   ctx: McpToolContext,
-  onCall: () => void
+  onCall: (normalizedMethod: string) => void
 ): (params: {
   method: string
   path: string
@@ -777,11 +770,10 @@ function createApiRequestFn(
     'http://localhost:3000'
 
   return async (params) => {
-    onCall()
-
     const { method, path, query, body } = params
     const callStart = Date.now()
-    const normalizedMethod = method.toUpperCase()
+    const normalizedMethod = String(method ?? '').toUpperCase()
+    onCall(normalizedMethod)
     const apiPath = normalizeApiRequestPath(path)
     const authorization = await authorizeCodeModeApiRequest(ctx, normalizedMethod, apiPath)
 
@@ -995,7 +987,7 @@ function isPathParameterSegment(segment: string): boolean {
   )
 }
 
-function isUnsafeHttpMethod(method: string): boolean {
+export function isUnsafeHttpMethod(method: string): boolean {
   return !['GET', 'HEAD', 'OPTIONS'].includes(method.toUpperCase())
 }
 

package/src/modules/ai_assistant/lib/tool-test-runner.ts

@@ -212,14 +212,18 @@ async function loadGeneratedTools(): Promise<{ moduleId: string; tools: AiToolDe
   return result
 }
 
-async function pickDefaultTenant(
+export async function pickDefaultTenant(
   container: AwilixContainer,
 ): Promise<{ tenantId: string; organizationId: string | null; userId: string | null } | null> {
   try {
     const em = container.resolve<{
-      getConnection: () => { execute: (sql: string) => Promise<unknown[]> }
+      getConnection: () => {
+        execute: (sql: string, params?: unknown[]) => Promise<Record<string, unknown>[]>
+      }
     }>('em') as unknown as {
-      getConnection: () => { execute: (sql: string) => Promise<Record<string, unknown>[]> }
+      getConnection: () => {
+        execute: (sql: string, params?: unknown[]) => Promise<Record<string, unknown>[]>
+      }
     }
     const conn = em.getConnection()
     const tenantRows = await conn.execute(
@@ -230,16 +234,17 @@ async function pickDefaultTenant(
         ? String((tenantRows[0] as Record<string, unknown>).id)
         : null
     if (!tenantId) return null
-    const escaped = tenantId.replace(/'/g, "''")
     const orgRows = await conn.execute(
-      `SELECT id FROM organizations WHERE tenant_id = '${escaped}' AND deleted_at IS NULL ORDER BY created_at ASC LIMIT 1`,
+      `SELECT id FROM organizations WHERE tenant_id = ? AND deleted_at IS NULL ORDER BY created_at ASC LIMIT 1`,
+      [tenantId],
     )
     const organizationId =
       Array.isArray(orgRows) && orgRows[0]
         ? String((orgRows[0] as Record<string, unknown>).id)
         : null
     const userRows = await conn.execute(
-      `SELECT id FROM users WHERE tenant_id = '${escaped}' AND deleted_at IS NULL ORDER BY created_at ASC LIMIT 1`,
+      `SELECT id FROM users WHERE tenant_id = ? AND deleted_at IS NULL ORDER BY created_at ASC LIMIT 1`,
+      [tenantId],
     )
     const userId =
       Array.isArray(userRows) && userRows[0]