@open-mercato/ai-assistant 0.6.6-develop.6540.1.ae856df1ec → 0.6.6-develop.6541.1.c6f8fa5d2b

package/src/modules/ai_assistant/api/mcp-key/route.ts

@@ -5,9 +5,8 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { createApiKey } from '@open-mercato/core/modules/api_keys/services/apiKeyService'
-import { UserRole } from '@open-mercato/core/modules/auth/data/entities'
-import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { getUserRoleIds } from '../../lib/user-role-ids'
 
 const logger = createLogger('ai_assistant')
 
@@ -15,29 +14,6 @@ export const metadata = {
   POST: { requireAuth: true, requireFeatures: ['api_keys.create'] },
 }
 
-/**
- * Resolve the calling user's role ids for the active tenant. Mirrors the
- * `session-key` route so the generated key carries exactly the caller's roles.
- */
-async function getUserRoleIds(
-  em: EntityManager,
-  userId: string,
-  tenantId: string | null,
-): Promise<string[]> {
-  if (!tenantId) return []
-  const links = await findWithDecryption(
-    em,
-    UserRole,
-    { user: userId as any, role: { tenantId } } as any,
-    { populate: ['role'] },
-    { tenantId, organizationId: null },
-  )
-  const linkList = Array.isArray(links) ? links : []
-  return linkList
-    .map((link) => (link.role as any)?.id)
-    .filter((id): id is string => typeof id === 'string' && id.length > 0)
-}
-
 const bodySchema = z.object({
   name: z.string().min(1).max(120).optional(),
   description: z.string().max(1000).optional().nullable(),

package/src/modules/ai_assistant/api/session-key/route.ts

@@ -8,9 +8,8 @@ import {
   generateSessionToken,
   createSessionApiKey,
 } from '@open-mercato/core/modules/api_keys/services/apiKeyService'
-import { UserRole } from '@open-mercato/core/modules/auth/data/entities'
-import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { getUserRoleIds } from '../../lib/user-role-ids'
 
 const logger = createLogger('ai_assistant')
 
@@ -20,29 +19,6 @@ export const metadata = {
 
 const SESSION_TTL_MINUTES = 120 // 2 hours
 
-/**
- * Get user's role IDs from the database.
- */
-async function getUserRoleIds(
-  em: EntityManager,
-  userId: string,
-  tenantId: string | null
-): Promise<string[]> {
-  if (!tenantId) return []
-
-  const links = await findWithDecryption(
-    em,
-    UserRole,
-    { user: userId as any, role: { tenantId } } as any,
-    { populate: ['role'] },
-    { tenantId, organizationId: null },
-  )
-  const linkList = Array.isArray(links) ? links : []
-  return linkList
-    .map((l) => (l.role as any)?.id)
-    .filter((id): id is string => typeof id === 'string' && id.length > 0)
-}
-
 /**
  * POST /api/ai_assistant/session-key
  *

package/src/modules/ai_assistant/api/settings/route.ts

@@ -1,3 +1,4 @@
+import { existsSync, readFileSync } from 'node:fs'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 import { NextResponse, type NextRequest } from 'next/server'
 import { z } from 'zod'
@@ -6,6 +7,7 @@ import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import { findApiKeyBySecret } from '@open-mercato/core/modules/api_keys/services/apiKeyService'
 import { llmProviderRegistry } from '@open-mercato/shared/lib/ai/llm-provider-registry'
 import { joinProviderModel } from '@open-mercato/shared/lib/ai/model-id'
 import {
@@ -170,8 +172,26 @@ export async function GET(req: NextRequest) {
         ? getOpenCodeProviderConfiguredEnvKey(fallbackOpenCodeProviderId)
         : null
 
-    // Check if MCP_SERVER_API_KEY is configured (required for MCP authentication)
-    const mcpKeyConfigured = !!process.env.MCP_SERVER_API_KEY?.trim()
+    // Check if the MCP API key is configured (required for MCP authentication):
+    // either directly via MCP_SERVER_API_KEY or via the shared key file that
+    // the containerized mcp service provisions (MCP_SERVER_API_KEY_FILE).
+    // The file variant is validated against the api_keys table — the file
+    // outlives DB resets and key deletion, so mere existence would report a
+    // green badge while OpenCode -> MCP auth is actually broken.
+    const mcpKeyFilePath = process.env.MCP_SERVER_API_KEY_FILE?.trim()
+    let mcpKeyConfigured = !!process.env.MCP_SERVER_API_KEY?.trim()
+    if (!mcpKeyConfigured && mcpKeyFilePath && existsSync(mcpKeyFilePath)) {
+      try {
+        const fileSecret = readFileSync(mcpKeyFilePath, 'utf8').trim()
+        if (fileSecret.startsWith('omk_')) {
+          const keyContainer = await createRequestContainer()
+          const keyEm = keyContainer.resolve<EntityManager>('em')
+          mcpKeyConfigured = !!(await findApiKeyBySecret(keyEm, fileSecret))
+        }
+      } catch {
+        mcpKeyConfigured = false
+      }
+    }
 
     // Phase 4a: resolve tenant override row and per-agent resolution matrix
     let tenantOverride: {

package/src/modules/ai_assistant/cli.ts

@@ -161,6 +161,47 @@ const mcpDev: ModuleCli = {
   },
 }
 
+const mcpEnsureApiKey: ModuleCli = {
+  command: 'mcp:ensure-api-key',
+  async run(rest) {
+    const args = parseArgs(rest)
+    // A bare `--file` (no value) parses to boolean true — treat it as missing
+    // rather than provisioning into a file literally named "true".
+    const fileArg = typeof args.file === 'string' ? args.file.trim() : ''
+    const filePath =
+      fileArg || process.env.MCP_SERVER_API_KEY_FILE?.trim() || process.env.MCP_API_KEY_FILE?.trim() || ''
+    if (!filePath) {
+      console.error('Usage: mercato ai_assistant mcp:ensure-api-key --file <path> [options]')
+      console.error('')
+      console.error('Ensures a valid MCP server API key exists in the database and that its')
+      console.error('plaintext secret is stored in <path> (the idempotency anchor). The secret')
+      console.error('is never printed; consumers such as the OpenCode container read the file.')
+      console.error('')
+      console.error('Options:')
+      console.error('  --file <path>    Secret file path (or MCP_SERVER_API_KEY_FILE env)')
+      console.error('  --name <name>    API key name (default __mcp_server__)')
+      console.error('  --email <email>  Owner user email (default OM_INIT_SUPERADMIN_EMAIL, then superadmin@acme.com)')
+      console.error('  --rotate         Force rotation even when the file secret is still valid')
+      process.exitCode = 1
+      return
+    }
+
+    const keyName = typeof args.name === 'string' && args.name.length > 0 ? args.name : undefined
+    const ownerEmail = typeof args.email === 'string' && args.email.length > 0 ? args.email : undefined
+    const rotate = args.rotate === true || args.rotate === 'true'
+
+    await ensureBootstrap()
+    const container = await createRequestContainer()
+    const em = container.resolve<import('@mikro-orm/postgresql').EntityManager>('em')
+    const rbac = container.resolve('rbacService') as import('@open-mercato/core/modules/auth/services/rbacService').RbacService
+
+    const { ensureMcpApiKey } = await import('./lib/mcp-ensure-api-key')
+    const result = await ensureMcpApiKey({ em, filePath, keyName, ownerEmail, rotate, rbac })
+    const message = result.status === 'valid' ? 'Existing key is valid' : 'New key created'
+    console.log(`[mcp:ensure-api-key] ${message} (id=${result.keyId}, prefix=${result.keyPrefix})`)
+  },
+}
+
 const listTools: ModuleCli = {
   command: 'mcp:list-tools',
   async run(rest) {
@@ -377,6 +418,7 @@ export default [
   mcpServe,
   mcpServeHttp,
   mcpDev,
+  mcpEnsureApiKey,
   listTools,
   entityGraph,
   runPendingActionCleanup,

package/src/modules/ai_assistant/lib/__tests__/mcp-ensure-api-key.test.ts

@@ -0,0 +1,182 @@
+import { promises as fs } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+jest.mock('@open-mercato/core/modules/api_keys/services/apiKeyService', () => ({
+  createApiKey: jest.fn(),
+  deleteApiKey: jest.fn(),
+  findApiKeyBySecret: jest.fn(),
+}))
+
+jest.mock('@open-mercato/shared/lib/encryption/find', () => ({
+  findOneWithDecryption: jest.fn(),
+  findWithDecryption: jest.fn(),
+}))
+
+import {
+  createApiKey,
+  deleteApiKey,
+  findApiKeyBySecret,
+} from '@open-mercato/core/modules/api_keys/services/apiKeyService'
+import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { ensureMcpApiKey, DEFAULT_MCP_KEY_NAME } from '../mcp-ensure-api-key'
+
+const mockedCreateApiKey = createApiKey as jest.Mock
+const mockedDeleteApiKey = deleteApiKey as jest.Mock
+const mockedFindApiKeyBySecret = findApiKeyBySecret as jest.Mock
+const mockedFindOneWithDecryption = findOneWithDecryption as jest.Mock
+const mockedFindWithDecryption = findWithDecryption as jest.Mock
+
+const owner = {
+  id: 'user-1',
+  tenantId: 'tenant-1',
+  email: 'superadmin@acme.com',
+}
+
+function createEm() {
+  return { find: jest.fn().mockResolvedValue([]) } as any
+}
+
+describe('ensureMcpApiKey', () => {
+  let workDir: string
+  let filePath: string
+
+  beforeEach(async () => {
+    jest.clearAllMocks()
+    workDir = await fs.mkdtemp(join(tmpdir(), 'mcp-key-test-'))
+    filePath = join(workDir, 'shared', 'mcp-api-key')
+    mockedFindOneWithDecryption.mockResolvedValue(owner)
+    mockedFindWithDecryption.mockResolvedValue([{ role: { id: 'role-1' } }])
+    mockedCreateApiKey.mockResolvedValue({
+      record: { id: 'key-new', keyPrefix: 'omk_new.' },
+      secret: 'omk_new1.aaaabbbbccccddddeeeeffff',
+    })
+  })
+
+  afterEach(async () => {
+    await fs.rm(workDir, { recursive: true, force: true })
+  })
+
+  it('returns valid without touching the DB when the file secret resolves to a live key of the same name', async () => {
+    await fs.mkdir(join(workDir, 'shared'), { recursive: true })
+    await fs.writeFile(filePath, 'omk_old1.secret\n')
+    mockedFindApiKeyBySecret.mockResolvedValue({
+      id: 'key-old',
+      name: DEFAULT_MCP_KEY_NAME,
+      keyPrefix: 'omk_old1.sec',
+    })
+
+    const em = createEm()
+    const result = await ensureMcpApiKey({ em, filePath })
+
+    expect(result).toEqual({ status: 'valid', keyId: 'key-old', keyPrefix: 'omk_old1.sec' })
+    expect(mockedCreateApiKey).not.toHaveBeenCalled()
+    expect(mockedDeleteApiKey).not.toHaveBeenCalled()
+    expect((await fs.readFile(filePath, 'utf8')).trim()).toBe('omk_old1.secret')
+  })
+
+  it('creates a key owned by the superadmin and writes the secret file when no file exists', async () => {
+    const em = createEm()
+    const result = await ensureMcpApiKey({ em, filePath })
+
+    expect(result).toEqual({ status: 'created', keyId: 'key-new', keyPrefix: 'omk_new.' })
+    expect(mockedCreateApiKey).toHaveBeenCalledWith(
+      em,
+      expect.objectContaining({
+        name: DEFAULT_MCP_KEY_NAME,
+        tenantId: 'tenant-1',
+        organizationId: null,
+        roles: ['role-1'],
+        createdBy: 'user-1',
+      }),
+      expect.anything(),
+    )
+    expect((await fs.readFile(filePath, 'utf8')).trim()).toBe('omk_new1.aaaabbbbccccddddeeeeffff')
+  })
+
+  it('resolves the owner with an encrypted-email-aware $or filter', async () => {
+    const em = createEm()
+    await ensureMcpApiKey({ em, filePath })
+
+    expect(mockedFindOneWithDecryption).toHaveBeenCalledWith(
+      em,
+      expect.anything(),
+      expect.objectContaining({
+        deletedAt: null,
+        $or: expect.arrayContaining([
+          { email: 'superadmin@acme.com' },
+          expect.objectContaining({ emailHash: expect.anything() }),
+        ]),
+      }),
+      expect.anything(),
+      expect.anything(),
+    )
+  })
+
+  it('scopes stale-key cleanup to the owner tenant', async () => {
+    const em = createEm()
+    await ensureMcpApiKey({ em, filePath })
+
+    expect(em.find).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ name: DEFAULT_MCP_KEY_NAME, tenantId: 'tenant-1', deletedAt: null }),
+    )
+  })
+
+  it('soft-deletes stale keys with the same name before creating a replacement', async () => {
+    await fs.mkdir(join(workDir, 'shared'), { recursive: true })
+    await fs.writeFile(filePath, 'omk_stale.secret\n')
+    mockedFindApiKeyBySecret.mockResolvedValue(null)
+
+    const em = createEm()
+    em.find.mockResolvedValue([{ id: 'stale-1' }, { id: 'stale-2' }])
+
+    const result = await ensureMcpApiKey({ em, filePath })
+
+    expect(result.status).toBe('created')
+    expect(mockedDeleteApiKey).toHaveBeenCalledTimes(2)
+    expect(mockedDeleteApiKey).toHaveBeenCalledWith(em, 'stale-1', expect.anything())
+    expect(mockedDeleteApiKey).toHaveBeenCalledWith(em, 'stale-2', expect.anything())
+  })
+
+  it('rotates even when the file secret is valid if rotate is set', async () => {
+    await fs.mkdir(join(workDir, 'shared'), { recursive: true })
+    await fs.writeFile(filePath, 'omk_old1.secret\n')
+    mockedFindApiKeyBySecret.mockResolvedValue({
+      id: 'key-old',
+      name: DEFAULT_MCP_KEY_NAME,
+      keyPrefix: 'omk_old1.sec',
+    })
+
+    const em = createEm()
+    const result = await ensureMcpApiKey({ em, filePath, rotate: true })
+
+    expect(result.status).toBe('created')
+    expect(mockedFindApiKeyBySecret).not.toHaveBeenCalled()
+    expect((await fs.readFile(filePath, 'utf8')).trim()).toBe('omk_new1.aaaabbbbccccddddeeeeffff')
+  })
+
+  it('rotates when the file secret resolves to a key with a different name', async () => {
+    await fs.mkdir(join(workDir, 'shared'), { recursive: true })
+    await fs.writeFile(filePath, 'omk_old1.secret\n')
+    mockedFindApiKeyBySecret.mockResolvedValue({
+      id: 'key-other',
+      name: '__session_something__',
+      keyPrefix: 'omk_old1.sec',
+    })
+
+    const em = createEm()
+    const result = await ensureMcpApiKey({ em, filePath })
+
+    expect(result.status).toBe('created')
+    expect(mockedCreateApiKey).toHaveBeenCalled()
+  })
+
+  it('throws a clear error when the owner user does not exist', async () => {
+    mockedFindOneWithDecryption.mockResolvedValue(null)
+
+    const em = createEm()
+    await expect(ensureMcpApiKey({ em, filePath })).rejects.toThrow(/owner not found/)
+    expect(mockedCreateApiKey).not.toHaveBeenCalled()
+  })
+})

package/src/modules/ai_assistant/lib/mcp-ensure-api-key.ts

@@ -0,0 +1,132 @@
+import { promises as fs } from 'node:fs'
+import { dirname } from 'node:path'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import { ApiKey } from '@open-mercato/core/modules/api_keys/data/entities'
+import {
+  createApiKey,
+  deleteApiKey,
+  findApiKeyBySecret,
+} from '@open-mercato/core/modules/api_keys/services/apiKeyService'
+import { User } from '@open-mercato/core/modules/auth/data/entities'
+import { emailHashLookupValues } from '@open-mercato/core/modules/auth/lib/emailHash'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { getUserRoleIds } from './user-role-ids'
+
+export const DEFAULT_MCP_KEY_NAME = '__mcp_server__'
+export const DEFAULT_MCP_KEY_OWNER_EMAIL = 'superadmin@acme.com'
+
+export type EnsureMcpApiKeyOptions = {
+  em: EntityManager
+  filePath: string
+  keyName?: string
+  ownerEmail?: string
+  rotate?: boolean
+  rbac?: RbacService
+}
+
+export type EnsureMcpApiKeyResult = {
+  status: 'valid' | 'created'
+  keyId: string
+  keyPrefix: string
+}
+
+async function readSecretFile(filePath: string): Promise<string | null> {
+  try {
+    const raw = await fs.readFile(filePath, 'utf8')
+    const trimmed = raw.trim()
+    return trimmed.length > 0 ? trimmed : null
+  } catch {
+    return null
+  }
+}
+
+async function writeSecretFile(filePath: string, secret: string): Promise<void> {
+  await fs.mkdir(dirname(filePath), { recursive: true })
+  const tmpPath = `${filePath}.tmp`
+  // World-readable on purpose: the file lives in a dedicated named volume
+  // mounted only into this stack's containers, and the consumer (the OpenCode
+  // container) runs as a non-root user that cannot read a root-owned 0600
+  // file. The volume boundary, not the file mode, is the security boundary.
+  await fs.writeFile(tmpPath, `${secret}\n`, { mode: 0o644 })
+  await fs.rename(tmpPath, filePath)
+  await fs.chmod(filePath, 0o644)
+}
+
+/**
+ * Ensure a valid MCP server API key exists and its plaintext secret is stored
+ * in `filePath`. The DB only holds a bcrypt hash, so the secret file is the
+ * idempotency anchor: when it still resolves to a live key of the expected
+ * name, nothing changes. Otherwise stale keys with that name are soft-deleted
+ * and a fresh key is created, owned by the superadmin user so header-only MCP
+ * calls resolve an ACL context via `createdBy`.
+ */
+export async function ensureMcpApiKey(options: EnsureMcpApiKeyOptions): Promise<EnsureMcpApiKeyResult> {
+  const keyName = options.keyName?.trim() || DEFAULT_MCP_KEY_NAME
+  const existingSecret = await readSecretFile(options.filePath)
+
+  if (existingSecret && existingSecret.startsWith('omk_') && !options.rotate) {
+    const existingKey = await findApiKeyBySecret(options.em, existingSecret)
+    if (existingKey && existingKey.name === keyName) {
+      return { status: 'valid', keyId: existingKey.id, keyPrefix: existingKey.keyPrefix }
+    }
+  }
+
+  const ownerEmail =
+    options.ownerEmail?.trim() ||
+    process.env.OM_INIT_SUPERADMIN_EMAIL?.trim() ||
+    DEFAULT_MCP_KEY_OWNER_EMAIL
+  // User.email is encrypted at rest with an email_hash lookup column, and
+  // findOneWithDecryption does not rewrite filters — a plaintext { email }
+  // match would find nothing once encryption is on. Mirror the $or pattern
+  // from AuthService.findUserByEmail so both modes resolve the owner.
+  const owner = await findOneWithDecryption(
+    options.em,
+    User,
+    {
+      deletedAt: null,
+      $or: [
+        { email: ownerEmail },
+        { emailHash: { $in: emailHashLookupValues(ownerEmail) } },
+      ],
+    },
+    {},
+    { tenantId: null, organizationId: null },
+  )
+  if (!owner) {
+    throw new Error(
+      `[internal] MCP API key owner not found: no active user with email "${ownerEmail}". ` +
+        'Run "mercato init" first or pass --email pointing at an existing admin user.',
+    )
+  }
+
+  const roleIds = await getUserRoleIds(options.em, owner.id, owner.tenantId ?? null)
+
+  // Scope the cleanup to the owner's tenant: keys with the same name in other
+  // tenants belong to other stacks/tenants and must never be revoked here.
+  const staleKeys = await options.em.find(ApiKey, {
+    name: keyName,
+    tenantId: owner.tenantId ?? null,
+    deletedAt: null,
+  })
+  for (const staleKey of staleKeys) {
+    await deleteApiKey(options.em, staleKey.id, { rbac: options.rbac })
+  }
+
+  const { record, secret } = await createApiKey(
+    options.em,
+    {
+      name: keyName,
+      description: 'MCP server key provisioned by mcp:ensure-api-key',
+      tenantId: owner.tenantId ?? null,
+      organizationId: null,
+      roles: roleIds,
+      createdBy: owner.id,
+    },
+    { rbac: options.rbac },
+  )
+
+  await writeSecretFile(options.filePath, secret)
+
+  return { status: 'created', keyId: record.id, keyPrefix: record.keyPrefix }
+}

package/src/modules/ai_assistant/lib/user-role-ids.ts

@@ -0,0 +1,30 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { UserRole } from '@open-mercato/core/modules/auth/data/entities'
+import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+
+/**
+ * Resolve a user's role ids for the given tenant.
+ *
+ * Single source for every AI-assistant surface that mints a role-carrying
+ * API key (the mcp-key and session-key routes, the chat route's ephemeral
+ * session keys, and the mcp:ensure-api-key CLI), so all of those keys
+ * inherit exactly the same ACL for the same user.
+ */
+export async function getUserRoleIds(
+  em: EntityManager,
+  userId: string,
+  tenantId: string | null,
+): Promise<string[]> {
+  if (!tenantId) return []
+  const links = await findWithDecryption(
+    em,
+    UserRole,
+    { user: userId, role: { tenantId } },
+    { populate: ['role'] },
+    { tenantId, organizationId: null },
+  )
+  const linkList = Array.isArray(links) ? links : []
+  return linkList
+    .map((link) => link.role?.id)
+    .filter((id): id is string => typeof id === 'string' && id.length > 0)
+}