@open-mercato/ai-assistant 0.6.5-develop.5337.1.534b781eac → 0.6.5

package/src/modules/ai_assistant/api/mcp-key/__tests__/route.test.ts

@@ -0,0 +1,144 @@
+/**
+ * Tests for POST /api/ai_assistant/mcp-key.
+ *
+ * The route creates a persistent MCP API key that inherits the calling user's
+ * roles. These tests pin the security-critical behavior: the key carries
+ * exactly the caller's own roles (no escalation), is scoped to the caller's
+ * tenant/organization, and degrades gracefully when the caller has no tenant.
+ */
+
+const authMock = jest.fn()
+const createRequestContainerMock = jest.fn()
+const createApiKeyMock = jest.fn()
+const findWithDecryptionMock = jest.fn()
+
+jest.mock('@open-mercato/shared/lib/auth/server', () => ({
+  getAuthFromRequest: (...args: unknown[]) => authMock(...args),
+}))
+
+jest.mock('@open-mercato/shared/lib/di/container', () => ({
+  createRequestContainer: (...args: unknown[]) => createRequestContainerMock(...args),
+}))
+
+jest.mock('@open-mercato/core/modules/api_keys/services/apiKeyService', () => ({
+  createApiKey: (...args: unknown[]) => createApiKeyMock(...args),
+}))
+
+jest.mock('@open-mercato/shared/lib/encryption/find', () => ({
+  findWithDecryption: (...args: unknown[]) => findWithDecryptionMock(...args),
+}))
+
+jest.mock('@open-mercato/core/modules/auth/data/entities', () => ({
+  UserRole: class UserRole {},
+}))
+
+import { POST } from '../route'
+
+function buildRequest(body: unknown): Request {
+  return new Request('http://localhost/api/ai_assistant/mcp-key', {
+    method: 'POST',
+    body: typeof body === 'string' ? body : JSON.stringify(body),
+    headers: { 'content-type': 'application/json' },
+  })
+}
+
+describe('POST /api/ai_assistant/mcp-key', () => {
+  let consoleErrorSpy: jest.SpyInstance
+
+  beforeEach(() => {
+    jest.clearAllMocks()
+    consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation(() => {})
+    authMock.mockResolvedValue({ sub: 'user-1', tenantId: 'tenant-1', orgId: 'org-1' })
+    createRequestContainerMock.mockResolvedValue({
+      resolve: (name: string) => (name === 'em' ? {} : null),
+    })
+    findWithDecryptionMock.mockResolvedValue([
+      { role: { id: 'role-a' } },
+      { role: { id: 'role-b' } },
+    ])
+    createApiKeyMock.mockResolvedValue({
+      record: {
+        id: 'key-1',
+        name: 'My MCP Key',
+        keyPrefix: 'omk_abc1234',
+        tenantId: 'tenant-1',
+        organizationId: 'org-1',
+      },
+      secret: 'omk_abc1234.deadbeef',
+    })
+  })
+
+  afterEach(() => {
+    consoleErrorSpy.mockRestore()
+  })
+
+  it('returns 401 when unauthenticated', async () => {
+    authMock.mockResolvedValueOnce(null)
+
+    const response = await POST(buildRequest({ name: 'My MCP Key' }) as any)
+
+    expect(response.status).toBe(401)
+    expect(createApiKeyMock).not.toHaveBeenCalled()
+  })
+
+  it('creates a key carrying exactly the caller\'s own roles (no escalation)', async () => {
+    const response = await POST(buildRequest({ name: 'My MCP Key' }) as any)
+
+    expect(response.status).toBe(200)
+    const json = (await response.json()) as Record<string, unknown>
+    expect(json.secret).toBe('omk_abc1234.deadbeef')
+    expect(json.roles).toEqual(['role-a', 'role-b'])
+
+    expect(createApiKeyMock).toHaveBeenCalledTimes(1)
+    const [, input] = createApiKeyMock.mock.calls[0]
+    expect(input.roles).toEqual(['role-a', 'role-b'])
+    expect(input.tenantId).toBe('tenant-1')
+    expect(input.organizationId).toBe('org-1')
+    expect(input.createdBy).toBe('user-1')
+  })
+
+  it('scopes the role lookup to the caller\'s tenant', async () => {
+    await POST(buildRequest({}) as any)
+
+    expect(findWithDecryptionMock).toHaveBeenCalledTimes(1)
+    const [, , where, , scope] = findWithDecryptionMock.mock.calls[0]
+    expect(where.user).toBe('user-1')
+    expect(where.role).toEqual({ tenantId: 'tenant-1' })
+    expect(scope).toEqual({ tenantId: 'tenant-1', organizationId: null })
+  })
+
+  it('assigns no roles and skips the lookup when the caller has no tenant', async () => {
+    authMock.mockResolvedValueOnce({ sub: 'user-1', tenantId: null, orgId: null })
+
+    const response = await POST(buildRequest({}) as any)
+
+    expect(response.status).toBe(200)
+    expect(findWithDecryptionMock).not.toHaveBeenCalled()
+    const [, input] = createApiKeyMock.mock.calls[0]
+    expect(input.roles).toEqual([])
+  })
+
+  it('ignores malformed role links when resolving ids', async () => {
+    findWithDecryptionMock.mockResolvedValueOnce([
+      { role: { id: 'role-a' } },
+      { role: null },
+      { role: { id: '' } },
+      {},
+    ])
+
+    await POST(buildRequest({}) as any)
+
+    const [, input] = createApiKeyMock.mock.calls[0]
+    expect(input.roles).toEqual(['role-a'])
+  })
+
+  it('returns 500 with a generic message when key creation fails', async () => {
+    createApiKeyMock.mockRejectedValueOnce(new Error('db down'))
+
+    const response = await POST(buildRequest({}) as any)
+
+    expect(response.status).toBe(500)
+    const json = (await response.json()) as Record<string, unknown>
+    expect(json.error).toBe('Failed to create MCP API key')
+  })
+})

package/src/modules/ai_assistant/api/mcp-key/route.ts

@@ -0,0 +1,125 @@
+import { NextResponse, type NextRequest } from 'next/server'
+import { z } from 'zod'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { createApiKey } from '@open-mercato/core/modules/api_keys/services/apiKeyService'
+import { UserRole } from '@open-mercato/core/modules/auth/data/entities'
+import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: ['api_keys.create'] },
+}
+
+/**
+ * Resolve the calling user's role ids for the active tenant. Mirrors the
+ * `session-key` route so the generated key carries exactly the caller's roles.
+ */
+async function getUserRoleIds(
+  em: EntityManager,
+  userId: string,
+  tenantId: string | null,
+): Promise<string[]> {
+  if (!tenantId) return []
+  const links = await findWithDecryption(
+    em,
+    UserRole,
+    { user: userId as any, role: { tenantId } } as any,
+    { populate: ['role'] },
+    { tenantId, organizationId: null },
+  )
+  const linkList = Array.isArray(links) ? links : []
+  return linkList
+    .map((link) => (link.role as any)?.id)
+    .filter((id): id is string => typeof id === 'string' && id.length > 0)
+}
+
+const bodySchema = z.object({
+  name: z.string().min(1).max(120).optional(),
+  description: z.string().max(1000).optional().nullable(),
+})
+
+/**
+ * POST /api/ai_assistant/mcp-key
+ *
+ * Creates a persistent MCP API key (`omk_...`) for use in `.mcp.json`. Unlike a
+ * raw `POST /api/api_keys/keys` call — which assigns no roles unless the client
+ * passes them — this endpoint resolves the **caller's own roles** server-side
+ * and attaches them to the key, so the key inherits the current user's ACL.
+ * The user cannot escalate: they only ever grant their own roles to their own
+ * key.
+ */
+export async function POST(req: NextRequest) {
+  const auth = await getAuthFromRequest(req)
+  if (!auth?.sub) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+
+  try {
+    const raw = await req.json().catch(() => ({}))
+    const body = bodySchema.parse(raw ?? {})
+
+    const container = await createRequestContainer()
+    const em = container.resolve<EntityManager>('em')
+
+    const roleIds = await getUserRoleIds(em, auth.sub, auth.tenantId)
+
+    const { record, secret } = await createApiKey(em, {
+      name: body.name ?? `MCP Config - ${new Date().toISOString().slice(0, 10)}`,
+      description: body.description ?? 'Generated from AI Assistant settings for MCP client',
+      tenantId: auth.tenantId ?? null,
+      organizationId: auth.orgId ?? null,
+      roles: roleIds,
+      createdBy: auth.sub,
+    })
+
+    return NextResponse.json({
+      id: record.id,
+      name: record.name,
+      keyPrefix: record.keyPrefix,
+      secret,
+      tenantId: record.tenantId ?? null,
+      organizationId: record.organizationId ?? null,
+      roles: roleIds,
+    })
+  } catch (error) {
+    console.error('[MCP Key] Error:', error)
+    return NextResponse.json(
+      { error: 'Failed to create MCP API key' },
+      { status: 500 },
+    )
+  }
+}
+
+const responseSchema = z.object({
+  id: z.string(),
+  name: z.string(),
+  keyPrefix: z.string(),
+  secret: z.string().describe('Full API key value (omk_...). Shown once.'),
+  tenantId: z.string().uuid().nullable(),
+  organizationId: z.string().uuid().nullable(),
+  roles: z.array(z.string()).describe('Role ids inherited from the calling user.'),
+})
+
+const errorSchema = z.object({ error: z.string() })
+
+export const openApi: OpenApiRouteDoc = {
+  summary: 'Create MCP API key',
+  description:
+    'Creates a persistent MCP API key that inherits the calling user\'s roles, for use in an MCP client `.mcp.json`.',
+  methods: {
+    POST: {
+      summary: 'Generate MCP API key',
+      description:
+        'Generates a persistent `omk_` API key scoped to the calling user\'s tenant/organization and carrying the caller\'s own roles, so the key has the same ACL as the user.',
+      responses: [
+        { status: 200, description: 'API key created', schema: responseSchema },
+      ],
+      errors: [
+        { status: 401, description: 'Unauthorized', schema: errorSchema },
+        { status: 500, description: 'Failed to create MCP API key', schema: errorSchema },
+      ],
+    },
+  },
+}

package/src/modules/ai_assistant/cli.ts

@@ -47,30 +47,42 @@ const mcpServe: ModuleCli = {
   command: 'mcp:serve',
   async run(rest) {
     const args = parseArgs(rest)
-    const apiKey = String(args['api-key'] ?? args.apiKey ?? '') || null
+    // Prefer the OPEN_MERCATO_API_KEY env var so the secret never has to be
+    // placed on the command line (argv is world-readable via ps / /proc).
+    // The --api-key flag stays supported for backward compatibility.
+    const apiKey = String(args['api-key'] ?? args.apiKey ?? '') || process.env.OPEN_MERCATO_API_KEY || null
     const tenantId = String(args.tenant ?? args.tenantId ?? '') || null
     const organizationId = String(args.org ?? args.organizationId ?? '') || null
     const userId = String(args.user ?? args.userId ?? '') || null
     const debug = args.debug === true || args.debug === 'true'
+    const allowUnauthenticatedSuperadmin =
+      args['allow-unauthenticated-superadmin'] === true ||
+      args['allow-unauthenticated-superadmin'] === 'true'
 
     // Either API key or tenant is required
     if (!apiKey && !tenantId) {
       console.error('Usage: mercato ai_assistant mcp:serve [options]')
       console.error('')
       console.error('Authentication (choose one):')
-      console.error('  --api-key <secret>   API key secret for authentication (recommended)')
-      console.error('  --tenant <id>        Tenant ID (for manual context)')
+      console.error('  OPEN_MERCATO_API_KEY env   API key secret (recommended — keeps the secret off argv)')
+      console.error('  --api-key <secret>         API key secret for authentication (visible in process listings)')
+      console.error('  --tenant <id>              Tenant ID (for manual context)')
       console.error('')
       console.error('Options (with --tenant):')
       console.error('  --org <id>           Organization ID (optional)')
-      console.error('  --user <id>          User ID for ACL (optional, uses superadmin if not set)')
+      console.error('  --user <id>          User ID for ACL (required unless --allow-unauthenticated-superadmin is set)')
       console.error('')
       console.error('Common options:')
       console.error('  --debug              Enable debug logging')
+      console.error('  --allow-unauthenticated-superadmin')
+      console.error('                       DEV/TEST ONLY: run as superadmin with no per-user ACL when')
+      console.error('                       no --user (and no --api-key) is supplied. Never use in production.')
       console.error('')
       console.error('Examples:')
+      console.error('  OPEN_MERCATO_API_KEY=omk_xxxx.yyyy... mercato ai_assistant mcp:serve')
       console.error('  mercato ai_assistant mcp:serve --api-key omk_xxxx.yyyy...')
-      console.error('  mercato ai_assistant mcp:serve --tenant 123e4567-e89b-12d3-a456-426614174000')
+      console.error('  mercato ai_assistant mcp:serve --tenant 123e4567-e89b-12d3-a456-426614174000 --user <user-id>')
+      console.error('  mercato ai_assistant mcp:serve --tenant 123e4567-e89b-12d3-a456-426614174000 --allow-unauthenticated-superadmin')
       return
     }
 
@@ -102,6 +114,7 @@ const mcpServe: ModuleCli = {
           organizationId,
           userId,
         },
+        allowUnauthenticatedSuperadmin,
       })
     }
   },

package/src/modules/ai_assistant/components/McpConfigDialog.tsx

@@ -41,7 +41,11 @@ export default function McpConfigDialog({ open, onOpenChange, mcpUrl }: Props) {
     setIsGenerating(true)
     setError(null)
     try {
-      const res = await apiCall<ApiKeyResponse>('/api/api_keys/keys', {
+      // Use the dedicated MCP-key endpoint so the key inherits the current
+      // user's roles/ACL. A raw POST /api/api_keys/keys assigns no roles, which
+      // produced a key with zero features (the MCP server then exposes only
+      // `context_whoami`).
+      const res = await apiCall<ApiKeyResponse>('/api/ai_assistant/mcp-key', {
         method: 'POST',
         body: JSON.stringify({
           name: `MCP Config - ${new Date().toLocaleDateString()}`,

package/src/modules/ai_assistant/data/__tests__/schema-unique-indexes.test.ts

@@ -38,6 +38,45 @@ describe('AI assistant nullable organization unique indexes', () => {
     },
   )
 
+  it('declares every snapshot expression index on the participants entity (no snapshot/entity drift)', () => {
+    const snapshot = JSON.parse(
+      readFileSync(
+        new URL('../../migrations/.snapshot-open-mercato.json', import.meta.url),
+        'utf8',
+      ),
+    ) as {
+      tables: Array<{ name: string; indexes?: Array<{ keyName: string; expression?: string }> }>
+    }
+
+    const participants = snapshot.tables.find(
+      (table) => table.name === 'ai_chat_conversation_participants',
+    )
+    expect(participants).toBeDefined()
+
+    const entitySource = readFileSync(
+      new URL('../entities.ts', import.meta.url),
+      'utf8',
+    )
+
+    const expressionIndexes = (participants?.indexes ?? []).filter((index) => index.expression)
+    expect(expressionIndexes.length).toBeGreaterThan(0)
+
+    for (const index of expressionIndexes) {
+      expect(entitySource).toContain(index.keyName)
+    }
+  })
+
+  it('keeps the active-participants partial index declared on the entity', () => {
+    const entitySource = readFileSync(
+      new URL('../entities.ts', import.meta.url),
+      'utf8',
+    )
+
+    expect(entitySource).toContain(
+      'create index "ai_chat_conv_participants_active_conv_user_idx" on "ai_chat_conversation_participants" ("tenant_id", "organization_id", "conversation_id", "user_id") where "deleted_at" is null',
+    )
+  })
+
   it('keeps the module snapshot aligned with partial unique indexes', () => {
     const snapshot = JSON.parse(
       readFileSync(

package/src/modules/ai_assistant/data/entities.ts

@@ -789,6 +789,11 @@ export class AiChatConversation {
   expression:
     'create unique index "ai_chat_conv_participants_tenant_conv_user_null_org_uq" on "ai_chat_conversation_participants" ("tenant_id", "conversation_id", "user_id") where "organization_id" is null',
 })
+@Index({
+  name: 'ai_chat_conv_participants_active_conv_user_idx',
+  expression:
+    'create index "ai_chat_conv_participants_active_conv_user_idx" on "ai_chat_conversation_participants" ("tenant_id", "organization_id", "conversation_id", "user_id") where "deleted_at" is null',
+})
 @Index({
   name: 'ai_chat_conv_participants_tenant_org_user_conv_idx',
   properties: ['tenantId', 'organizationId', 'userId', 'conversationId'],

package/src/modules/ai_assistant/lib/__tests__/ai-overrides.test.ts

@@ -2,7 +2,7 @@
  * Coverage for the AI override pipeline. The pipeline is the only public
  * way for downstream modules (or app-level code) to replace or disable
  * an AI agent / AI tool registered by another module — see spec
- * `.ai/specs/2026-04-30-ai-overrides-and-module-disable.md`.
+ * `.ai/specs/implemented/2026-04-30-ai-overrides-and-module-disable.md`.
  *
  * The pipeline has three tiers (highest precedence first):
  *   1. programmatic — `applyAiAgentOverrides` / `applyAiToolOverrides`

package/src/modules/ai_assistant/lib/__tests__/attachment-parts.test.ts

@@ -349,6 +349,118 @@ describe('resolveAttachmentParts — tenant / org scope enforcement', () => {
     expect(parts).toEqual([])
     expect(console.warn).toHaveBeenCalledWith(expect.stringContaining('not found'))
   })
+
+  // Regression for #2663 — null-scoped rows used to bypass the tenant check via
+  // a truthiness short-circuit and leak into the caller's LLM context.
+  it('drops a null-tenant (global) record for a non super-admin caller', async () => {
+    findOneWithDecryptionMock.mockResolvedValueOnce(
+      makeRow({
+        id: 'null-tenant-1',
+        tenantId: null,
+        organizationId: null,
+        mimeType: 'image/png',
+        fileSize: 64,
+        content: 'secret OCR text',
+      }),
+    )
+
+    const parts = await resolveAttachmentParts({
+      attachmentIds: ['null-tenant-1'],
+      authContext: makeAuth({ tenantId: 'tenant-1', organizationId: 'org-1' }),
+      container: makeContainer(),
+    })
+
+    expect(parts).toEqual([])
+    expect(fsReadFileMock).not.toHaveBeenCalled()
+    expect(console.warn).toHaveBeenCalledWith(expect.stringContaining('out of scope'))
+  })
+
+  // Regression for #2663 — `tenantId='X', organizationId=null` used to be
+  // readable by every org within tenant X.
+  it('drops a null-org record in the caller tenant for an org-scoped caller', async () => {
+    findOneWithDecryptionMock.mockResolvedValueOnce(
+      makeRow({
+        id: 'null-org-1',
+        tenantId: 'tenant-1',
+        organizationId: null,
+        mimeType: 'image/png',
+        fileSize: 64,
+      }),
+    )
+
+    const parts = await resolveAttachmentParts({
+      attachmentIds: ['null-org-1'],
+      authContext: makeAuth({ tenantId: 'tenant-1', organizationId: 'org-1' }),
+      container: makeContainer(),
+    })
+
+    expect(parts).toEqual([])
+    expect(console.warn).toHaveBeenCalledWith(expect.stringContaining('out of scope'))
+  })
+
+  it('lets a tenant-wide caller (null org) read any org within its tenant', async () => {
+    findOneWithDecryptionMock.mockResolvedValueOnce(
+      makeRow({
+        id: 'same-tenant-other-org',
+        tenantId: 'tenant-1',
+        organizationId: 'org-OTHER',
+        mimeType: 'application/zip',
+        fileSize: 64,
+        content: null,
+      }),
+    )
+
+    const parts = await resolveAttachmentParts({
+      attachmentIds: ['same-tenant-other-org'],
+      authContext: makeAuth({ tenantId: 'tenant-1', organizationId: null }),
+      container: makeContainer(),
+    })
+
+    expect(parts).toHaveLength(1)
+    expect(parts[0].attachmentId).toBe('same-tenant-other-org')
+  })
+
+  it('scopes the ORM query by tenant + org for a non super-admin caller', async () => {
+    findOneWithDecryptionMock.mockResolvedValueOnce(makeRow({ id: 'att-scope-1', fileSize: 0 }))
+
+    await resolveAttachmentParts({
+      attachmentIds: ['att-scope-1'],
+      authContext: makeAuth({ tenantId: 'tenant-1', organizationId: 'org-1' }),
+      container: makeContainer(),
+    })
+
+    const whereArg = findOneWithDecryptionMock.mock.calls[0][2]
+    expect(whereArg).toEqual({ id: 'att-scope-1', tenantId: 'tenant-1', organizationId: 'org-1' })
+  })
+
+  it('omits org from the ORM query for a tenant-wide caller (null org)', async () => {
+    findOneWithDecryptionMock.mockResolvedValueOnce(makeRow({ id: 'att-scope-2', fileSize: 0 }))
+
+    await resolveAttachmentParts({
+      attachmentIds: ['att-scope-2'],
+      authContext: makeAuth({ tenantId: 'tenant-1', organizationId: null }),
+      container: makeContainer(),
+    })
+
+    const whereArg = findOneWithDecryptionMock.mock.calls[0][2]
+    expect(whereArg).toEqual({ id: 'att-scope-2', tenantId: 'tenant-1' })
+    expect(whereArg).not.toHaveProperty('organizationId')
+  })
+
+  it('does not scope the ORM query for super-admin callers', async () => {
+    findOneWithDecryptionMock.mockResolvedValueOnce(
+      makeRow({ id: 'att-scope-3', tenantId: 'tenant-OTHER', organizationId: 'org-OTHER', fileSize: 0 }),
+    )
+
+    await resolveAttachmentParts({
+      attachmentIds: ['att-scope-3'],
+      authContext: makeAuth({ isSuperAdmin: true }),
+      container: makeContainer(),
+    })
+
+    const whereArg = findOneWithDecryptionMock.mock.calls[0][2]
+    expect(whereArg).toEqual({ id: 'att-scope-3' })
+  })
 })
 
 describe('resolveAttachmentParts — unavailable service graceful skip', () => {

package/src/modules/ai_assistant/lib/__tests__/client-factory.test.ts

@@ -0,0 +1,42 @@
+import { createMcpClient } from '../client-factory'
+
+const mockConnect = jest.fn(async () => ({ listTools: jest.fn(), callTool: jest.fn(), close: jest.fn() }))
+
+jest.mock('../mcp-client', () => ({
+  McpClient: {
+    connect: (...args: unknown[]) => mockConnect(...args),
+  },
+}))
+
+describe('createMcpClient stdio mode (issue #2669)', () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+  })
+
+  it('never places the API key on the default argv', async () => {
+    await createMcpClient({ mode: 'stdio', apiKeySecret: 'omk_secret.value' })
+
+    expect(mockConnect).toHaveBeenCalledTimes(1)
+    const options = mockConnect.mock.calls[0][0] as { apiKeySecret: string; args?: string[] }
+
+    // The secret is forwarded to McpClient.connect, which delivers it via env.
+    expect(options.apiKeySecret).toBe('omk_secret.value')
+
+    // The factory must not build default args that embed the secret. Leaving
+    // args undefined lets connectStdio use its secret-free default.
+    expect(options.args).toBeUndefined()
+    expect(JSON.stringify(options.args ?? [])).not.toContain('--api-key')
+    expect(JSON.stringify(options.args ?? [])).not.toContain('omk_secret.value')
+  })
+
+  it('honors explicitly provided stdio args without injecting the secret', async () => {
+    await createMcpClient({
+      mode: 'stdio',
+      apiKeySecret: 'omk_secret.value',
+      stdioArgs: ['node', 'custom-server.js'],
+    })
+
+    const options = mockConnect.mock.calls[0][0] as { args?: string[] }
+    expect(options.args).toEqual(['node', 'custom-server.js'])
+  })
+})