@open-mercato/ai-assistant 0.6.6-develop.6543.1.49fadb4c31 → 0.6.6

package/src/modules/ai_assistant/lib/__tests__/codemode-tools.test.ts

@@ -477,149 +477,3 @@ describe('mutation call cap (issue #2724)', () => {
     expect(counts()).toEqual({ apiCallCount: CODE_MODE_MAX_MUTATION_CALLS + 5, mutationCallCount: 0 })
   })
 })
-
-describe('scope enforcement (issue #2658)', () => {
-  const listCompaniesEndpoint = {
-    id: 'list_companies',
-    operationId: 'list_companies',
-    method: 'GET',
-    path: '/api/customers/companies',
-    summary: '',
-    description: '',
-    tags: [],
-    requiredFeatures: [],
-    parameters: [],
-    requestBodySchema: null,
-    deprecated: false,
-  }
-  const createCompanyEndpoint = {
-    id: 'create_company',
-    operationId: 'create_company',
-    method: 'POST',
-    path: '/api/customers/companies',
-    summary: '',
-    description: '',
-    tags: [],
-    requiredFeatures: ['customers.companies.create'],
-    parameters: [],
-    requestBodySchema: null,
-    deprecated: false,
-  }
-
-  beforeEach(() => {
-    mockedGetApiEndpoints.mockReset()
-    mockedFetchWithTimeout.mockReset()
-    mockedFetchWithTimeout.mockResolvedValue(okResponse())
-  })
-
-  function fetchedUrl(): URL {
-    const [url] = mockedFetchWithTimeout.mock.calls[0]
-    return new URL(url as string)
-  }
-  function fetchedBody(): Record<string, unknown> {
-    const [, init] = mockedFetchWithTimeout.mock.calls[0]
-    return JSON.parse((init as { body: string }).body)
-  }
-  function creatorContext(scope: Partial<McpToolContext> = {}): McpToolContext {
-    return createContext({
-      userFeatures: ['ai_assistant.view', 'customers.companies.create'],
-      ...scope,
-    })
-  }
-
-  it('drops AI-supplied query scope when ctx scope is null (fail closed)', async () => {
-    mockedGetApiEndpoints.mockResolvedValue([listCompaniesEndpoint])
-    const apiRequest = createApiRequestFn(
-      createContext({ tenantId: null, organizationId: null }),
-      () => {}
-    )
-
-    await apiRequest({
-      method: 'GET',
-      path: '/api/customers/companies',
-      query: { tenantId: 'evil', organizationId: 'evil-org', city: 'NYC' },
-    })
-
-    const params = fetchedUrl().searchParams
-    expect(params.get('tenantId')).toBeNull()
-    expect(params.get('organizationId')).toBeNull()
-    expect(params.get('city')).toBe('NYC')
-  })
-
-  it('overrides AI-supplied query scope with ctx scope', async () => {
-    mockedGetApiEndpoints.mockResolvedValue([listCompaniesEndpoint])
-    const apiRequest = createApiRequestFn(createContext(), () => {})
-
-    await apiRequest({
-      method: 'GET',
-      path: '/api/customers/companies',
-      query: { tenantId: 'evil' },
-    })
-
-    expect(fetchedUrl().searchParams.get('tenantId')).toBe('tenant-1')
-  })
-
-  it('strips AI-supplied body scope when ctx scope is null', async () => {
-    mockedGetApiEndpoints.mockResolvedValue([createCompanyEndpoint])
-    const apiRequest = createApiRequestFn(
-      creatorContext({ tenantId: null, organizationId: null }),
-      () => {}
-    )
-
-    await apiRequest({
-      method: 'POST',
-      path: '/api/customers/companies',
-      body: { name: 'Acme', tenantId: 'evil', organizationId: 'evil-org' },
-    })
-
-    const body = fetchedBody()
-    expect(body.name).toBe('Acme')
-    expect('tenantId' in body).toBe(false)
-    expect('organizationId' in body).toBe(false)
-  })
-
-  it('overrides AI-supplied body scope with ctx scope', async () => {
-    mockedGetApiEndpoints.mockResolvedValue([createCompanyEndpoint])
-    const apiRequest = createApiRequestFn(creatorContext(), () => {})
-
-    await apiRequest({
-      method: 'POST',
-      path: '/api/customers/companies',
-      body: { name: 'Acme', tenantId: 'evil' },
-    })
-
-    const body = fetchedBody()
-    expect(body.tenantId).toBe('tenant-1')
-    expect(body.organizationId).toBe('org-1')
-  })
-
-  it('enforces query scope on non-GET methods too (not only GET)', async () => {
-    mockedGetApiEndpoints.mockResolvedValue([createCompanyEndpoint])
-    const apiRequest = createApiRequestFn(creatorContext(), () => {})
-
-    await apiRequest({
-      method: 'POST',
-      path: '/api/customers/companies',
-      query: { tenantId: 'evil' },
-      body: {},
-    })
-
-    expect(fetchedUrl().searchParams.get('tenantId')).toBe('tenant-1')
-  })
-
-  it('drops dangerous prototype-pollution keys from the body', async () => {
-    mockedGetApiEndpoints.mockResolvedValue([createCompanyEndpoint])
-    const apiRequest = createApiRequestFn(creatorContext(), () => {})
-
-    await apiRequest({
-      method: 'POST',
-      path: '/api/customers/companies',
-      body: { name: 'Acme', ['__proto__']: { polluted: true } } as Record<string, unknown>,
-    })
-
-    const body = fetchedBody()
-    expect(body.name).toBe('Acme')
-    expect(Object.prototype.hasOwnProperty.call(body, '__proto__')).toBe(false)
-    expect(({} as Record<string, unknown>).polluted).toBeUndefined()
-  })
-})

package/src/modules/ai_assistant/lib/codemode-tools.ts

@@ -16,7 +16,6 @@ import { registerMcpTool } from './tool-registry'
 import type { McpToolContext } from './types'
 import { createSandbox } from './sandbox'
 import { truncateResult } from './truncate'
-import { applyContextScopeToQuery, applyContextScopeToBody } from './scope-injection'
 import { hasRequiredFeatures } from './auth'
 import { getApiEndpoints, getRawOpenApiSpec, type ApiEndpoint } from './api-endpoint-index'
 import {
@@ -793,19 +792,25 @@ export function createApiRequestFn(
 
     let url = `${baseUrl}${apiPath}`
 
-    // Build query parameters — scope is enforced from ctx for every method, not only
-    // GET, so AI-supplied tenantId/organizationId can never survive (see scope-injection).
-    const queryParams = applyContextScopeToQuery(query, ctx)
+    // Build query parameters
+    const queryParams: Record<string, string> = { ...query }
+
+    if (normalizedMethod === 'GET') {
+      if (ctx.tenantId) queryParams.tenantId = ctx.tenantId
+      if (ctx.organizationId) queryParams.organizationId = ctx.organizationId
+    }
 
     if (Object.keys(queryParams).length > 0) {
       const separator = url.includes('?') ? '&' : '?'
       url += separator + new URLSearchParams(queryParams).toString()
     }
 
-    // Build request body with context-enforced scope
+    // Build request body with context injection
     let requestBody: Record<string, unknown> | undefined
     if (['POST', 'PUT', 'PATCH'].includes(normalizedMethod)) {
-      requestBody = applyContextScopeToBody(body, ctx)
+      requestBody = { ...body }
+      if (ctx.tenantId) requestBody.tenantId = ctx.tenantId
+      if (ctx.organizationId) requestBody.organizationId = ctx.organizationId
     }
 
     // Build headers

package/dist/modules/ai_assistant/lib/mcp-ensure-api-key.js

@@ -1,89 +0,0 @@
-import { promises as fs } from "node:fs";
-import { dirname } from "node:path";
-import { ApiKey } from "@open-mercato/core/modules/api_keys/data/entities";
-import {
-  createApiKey,
-  deleteApiKey,
-  findApiKeyBySecret
-} from "@open-mercato/core/modules/api_keys/services/apiKeyService";
-import { User } from "@open-mercato/core/modules/auth/data/entities";
-import { emailHashLookupValues } from "@open-mercato/core/modules/auth/lib/emailHash";
-import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
-import { getUserRoleIds } from "./user-role-ids.js";
-const DEFAULT_MCP_KEY_NAME = "__mcp_server__";
-const DEFAULT_MCP_KEY_OWNER_EMAIL = "superadmin@acme.com";
-async function readSecretFile(filePath) {
-  try {
-    const raw = await fs.readFile(filePath, "utf8");
-    const trimmed = raw.trim();
-    return trimmed.length > 0 ? trimmed : null;
-  } catch {
-    return null;
-  }
-}
-async function writeSecretFile(filePath, secret) {
-  await fs.mkdir(dirname(filePath), { recursive: true });
-  const tmpPath = `${filePath}.tmp`;
-  await fs.writeFile(tmpPath, `${secret}
-`, { mode: 420 });
-  await fs.rename(tmpPath, filePath);
-  await fs.chmod(filePath, 420);
-}
-async function ensureMcpApiKey(options) {
-  const keyName = options.keyName?.trim() || DEFAULT_MCP_KEY_NAME;
-  const existingSecret = await readSecretFile(options.filePath);
-  if (existingSecret && existingSecret.startsWith("omk_") && !options.rotate) {
-    const existingKey = await findApiKeyBySecret(options.em, existingSecret);
-    if (existingKey && existingKey.name === keyName) {
-      return { status: "valid", keyId: existingKey.id, keyPrefix: existingKey.keyPrefix };
-    }
-  }
-  const ownerEmail = options.ownerEmail?.trim() || process.env.OM_INIT_SUPERADMIN_EMAIL?.trim() || DEFAULT_MCP_KEY_OWNER_EMAIL;
-  const owner = await findOneWithDecryption(
-    options.em,
-    User,
-    {
-      deletedAt: null,
-      $or: [
-        { email: ownerEmail },
-        { emailHash: { $in: emailHashLookupValues(ownerEmail) } }
-      ]
-    },
-    {},
-    { tenantId: null, organizationId: null }
-  );
-  if (!owner) {
-    throw new Error(
-      `[internal] MCP API key owner not found: no active user with email "${ownerEmail}". Run "mercato init" first or pass --email pointing at an existing admin user.`
-    );
-  }
-  const roleIds = await getUserRoleIds(options.em, owner.id, owner.tenantId ?? null);
-  const staleKeys = await options.em.find(ApiKey, {
-    name: keyName,
-    tenantId: owner.tenantId ?? null,
-    deletedAt: null
-  });
-  for (const staleKey of staleKeys) {
-    await deleteApiKey(options.em, staleKey.id, { rbac: options.rbac });
-  }
-  const { record, secret } = await createApiKey(
-    options.em,
-    {
-      name: keyName,
-      description: "MCP server key provisioned by mcp:ensure-api-key",
-      tenantId: owner.tenantId ?? null,
-      organizationId: null,
-      roles: roleIds,
-      createdBy: owner.id
-    },
-    { rbac: options.rbac }
-  );
-  await writeSecretFile(options.filePath, secret);
-  return { status: "created", keyId: record.id, keyPrefix: record.keyPrefix };
-}
-export {
-  DEFAULT_MCP_KEY_NAME,
-  DEFAULT_MCP_KEY_OWNER_EMAIL,
-  ensureMcpApiKey
-};
-//# sourceMappingURL=mcp-ensure-api-key.js.map

package/dist/modules/ai_assistant/lib/mcp-ensure-api-key.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/ai_assistant/lib/mcp-ensure-api-key.ts"],
-  "sourcesContent": ["import { promises as fs } from 'node:fs'\nimport { dirname } from 'node:path'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { ApiKey } from '@open-mercato/core/modules/api_keys/data/entities'\nimport {\n  createApiKey,\n  deleteApiKey,\n  findApiKeyBySecret,\n} from '@open-mercato/core/modules/api_keys/services/apiKeyService'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport { emailHashLookupValues } from '@open-mercato/core/modules/auth/lib/emailHash'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { getUserRoleIds } from './user-role-ids'\n\nexport const DEFAULT_MCP_KEY_NAME = '__mcp_server__'\nexport const DEFAULT_MCP_KEY_OWNER_EMAIL = 'superadmin@acme.com'\n\nexport type EnsureMcpApiKeyOptions = {\n  em: EntityManager\n  filePath: string\n  keyName?: string\n  ownerEmail?: string\n  rotate?: boolean\n  rbac?: RbacService\n}\n\nexport type EnsureMcpApiKeyResult = {\n  status: 'valid' | 'created'\n  keyId: string\n  keyPrefix: string\n}\n\nasync function readSecretFile(filePath: string): Promise<string | null> {\n  try {\n    const raw = await fs.readFile(filePath, 'utf8')\n    const trimmed = raw.trim()\n    return trimmed.length > 0 ? trimmed : null\n  } catch {\n    return null\n  }\n}\n\nasync function writeSecretFile(filePath: string, secret: string): Promise<void> {\n  await fs.mkdir(dirname(filePath), { recursive: true })\n  const tmpPath = `${filePath}.tmp`\n  // World-readable on purpose: the file lives in a dedicated named volume\n  // mounted only into this stack's containers, and the consumer (the OpenCode\n  // container) runs as a non-root user that cannot read a root-owned 0600\n  // file. The volume boundary, not the file mode, is the security boundary.\n  await fs.writeFile(tmpPath, `${secret}\\n`, { mode: 0o644 })\n  await fs.rename(tmpPath, filePath)\n  await fs.chmod(filePath, 0o644)\n}\n\n/**\n * Ensure a valid MCP server API key exists and its plaintext secret is stored\n * in `filePath`. The DB only holds a bcrypt hash, so the secret file is the\n * idempotency anchor: when it still resolves to a live key of the expected\n * name, nothing changes. Otherwise stale keys with that name are soft-deleted\n * and a fresh key is created, owned by the superadmin user so header-only MCP\n * calls resolve an ACL context via `createdBy`.\n */\nexport async function ensureMcpApiKey(options: EnsureMcpApiKeyOptions): Promise<EnsureMcpApiKeyResult> {\n  const keyName = options.keyName?.trim() || DEFAULT_MCP_KEY_NAME\n  const existingSecret = await readSecretFile(options.filePath)\n\n  if (existingSecret && existingSecret.startsWith('omk_') && !options.rotate) {\n    const existingKey = await findApiKeyBySecret(options.em, existingSecret)\n    if (existingKey && existingKey.name === keyName) {\n      return { status: 'valid', keyId: existingKey.id, keyPrefix: existingKey.keyPrefix }\n    }\n  }\n\n  const ownerEmail =\n    options.ownerEmail?.trim() ||\n    process.env.OM_INIT_SUPERADMIN_EMAIL?.trim() ||\n    DEFAULT_MCP_KEY_OWNER_EMAIL\n  // User.email is encrypted at rest with an email_hash lookup column, and\n  // findOneWithDecryption does not rewrite filters \u2014 a plaintext { email }\n  // match would find nothing once encryption is on. Mirror the $or pattern\n  // from AuthService.findUserByEmail so both modes resolve the owner.\n  const owner = await findOneWithDecryption(\n    options.em,\n    User,\n    {\n      deletedAt: null,\n      $or: [\n        { email: ownerEmail },\n        { emailHash: { $in: emailHashLookupValues(ownerEmail) } },\n      ],\n    },\n    {},\n    { tenantId: null, organizationId: null },\n  )\n  if (!owner) {\n    throw new Error(\n      `[internal] MCP API key owner not found: no active user with email \"${ownerEmail}\". ` +\n        'Run \"mercato init\" first or pass --email pointing at an existing admin user.',\n    )\n  }\n\n  const roleIds = await getUserRoleIds(options.em, owner.id, owner.tenantId ?? null)\n\n  // Scope the cleanup to the owner's tenant: keys with the same name in other\n  // tenants belong to other stacks/tenants and must never be revoked here.\n  const staleKeys = await options.em.find(ApiKey, {\n    name: keyName,\n    tenantId: owner.tenantId ?? null,\n    deletedAt: null,\n  })\n  for (const staleKey of staleKeys) {\n    await deleteApiKey(options.em, staleKey.id, { rbac: options.rbac })\n  }\n\n  const { record, secret } = await createApiKey(\n    options.em,\n    {\n      name: keyName,\n      description: 'MCP server key provisioned by mcp:ensure-api-key',\n      tenantId: owner.tenantId ?? null,\n      organizationId: null,\n      roles: roleIds,\n      createdBy: owner.id,\n    },\n    { rbac: options.rbac },\n  )\n\n  await writeSecretFile(options.filePath, secret)\n\n  return { status: 'created', keyId: record.id, keyPrefix: record.keyPrefix }\n}\n"],
-  "mappings": "AAAA,SAAS,YAAY,UAAU;AAC/B,SAAS,eAAe;AAGxB,SAAS,cAAc;AACvB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,YAAY;AACrB,SAAS,6BAA6B;AACtC,SAAS,6BAA6B;AACtC,SAAS,sBAAsB;AAExB,MAAM,uBAAuB;AAC7B,MAAM,8BAA8B;AAiB3C,eAAe,eAAe,UAA0C;AACtE,MAAI;AACF,UAAM,MAAM,MAAM,GAAG,SAAS,UAAU,MAAM;AAC9C,UAAM,UAAU,IAAI,KAAK;AACzB,WAAO,QAAQ,SAAS,IAAI,UAAU;AAAA,EACxC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,gBAAgB,UAAkB,QAA+B;AAC9E,QAAM,GAAG,MAAM,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AACrD,QAAM,UAAU,GAAG,QAAQ;AAK3B,QAAM,GAAG,UAAU,SAAS,GAAG,MAAM;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AAC1D,QAAM,GAAG,OAAO,SAAS,QAAQ;AACjC,QAAM,GAAG,MAAM,UAAU,GAAK;AAChC;AAUA,eAAsB,gBAAgB,SAAiE;AACrG,QAAM,UAAU,QAAQ,SAAS,KAAK,KAAK;AAC3C,QAAM,iBAAiB,MAAM,eAAe,QAAQ,QAAQ;AAE5D,MAAI,kBAAkB,eAAe,WAAW,MAAM,KAAK,CAAC,QAAQ,QAAQ;AAC1E,UAAM,cAAc,MAAM,mBAAmB,QAAQ,IAAI,cAAc;AACvE,QAAI,eAAe,YAAY,SAAS,SAAS;AAC/C,aAAO,EAAE,QAAQ,SAAS,OAAO,YAAY,IAAI,WAAW,YAAY,UAAU;AAAA,IACpF;AAAA,EACF;AAEA,QAAM,aACJ,QAAQ,YAAY,KAAK,KACzB,QAAQ,IAAI,0BAA0B,KAAK,KAC3C;AAKF,QAAM,QAAQ,MAAM;AAAA,IAClB,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,MACE,WAAW;AAAA,MACX,KAAK;AAAA,QACH,EAAE,OAAO,WAAW;AAAA,QACpB,EAAE,WAAW,EAAE,KAAK,sBAAsB,UAAU,EAAE,EAAE;AAAA,MAC1D;AAAA,IACF;AAAA,IACA,CAAC;AAAA,IACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC;AACA,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR,sEAAsE,UAAU;AAAA,IAElF;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,eAAe,QAAQ,IAAI,MAAM,IAAI,MAAM,YAAY,IAAI;AAIjF,QAAM,YAAY,MAAM,QAAQ,GAAG,KAAK,QAAQ;AAAA,IAC9C,MAAM;AAAA,IACN,UAAU,MAAM,YAAY;AAAA,IAC5B,WAAW;AAAA,EACb,CAAC;AACD,aAAW,YAAY,WAAW;AAChC,UAAM,aAAa,QAAQ,IAAI,SAAS,IAAI,EAAE,MAAM,QAAQ,KAAK,CAAC;AAAA,EACpE;AAEA,QAAM,EAAE,QAAQ,OAAO,IAAI,MAAM;AAAA,IAC/B,QAAQ;AAAA,IACR;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU,MAAM,YAAY;AAAA,MAC5B,gBAAgB;AAAA,MAChB,OAAO;AAAA,MACP,WAAW,MAAM;AAAA,IACnB;AAAA,IACA,EAAE,MAAM,QAAQ,KAAK;AAAA,EACvB;AAEA,QAAM,gBAAgB,QAAQ,UAAU,MAAM;AAE9C,SAAO,EAAE,QAAQ,WAAW,OAAO,OAAO,IAAI,WAAW,OAAO,UAAU;AAC5E;",
-  "names": []
-}

package/dist/modules/ai_assistant/lib/scope-injection.js

@@ -1,23 +0,0 @@
-const SCOPE_FIELDS = ["tenantId", "organizationId"];
-const DANGEROUS_KEYS = ["__proto__", "constructor", "prototype"];
-function applyContextScopeToQuery(query, ctx) {
-  const result = { ...query };
-  for (const field of DANGEROUS_KEYS) delete result[field];
-  for (const field of SCOPE_FIELDS) delete result[field];
-  if (ctx.tenantId) result.tenantId = ctx.tenantId;
-  if (ctx.organizationId) result.organizationId = ctx.organizationId;
-  return result;
-}
-function applyContextScopeToBody(body, ctx) {
-  const result = { ...body };
-  for (const field of DANGEROUS_KEYS) delete result[field];
-  for (const field of SCOPE_FIELDS) delete result[field];
-  if (ctx.tenantId) result.tenantId = ctx.tenantId;
-  if (ctx.organizationId) result.organizationId = ctx.organizationId;
-  return result;
-}
-export {
-  applyContextScopeToBody,
-  applyContextScopeToQuery
-};
-//# sourceMappingURL=scope-injection.js.map

package/dist/modules/ai_assistant/lib/scope-injection.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/ai_assistant/lib/scope-injection.ts"],
-  "sourcesContent": ["import type { McpToolContext } from './types'\n\n/**\n * Tenant/org scope for outgoing api.request() calls is derived strictly from the\n * operating context \u2014 never from sandbox (AI-authored) code. Any tenantId/organizationId\n * the sandbox placed in query/body is stripped first, then re-applied from ctx only when\n * present. When the ctx scope is null the fields stay removed (fail closed), so AI-supplied\n * scope can never survive regardless of whether the context is tenant-bound.\n *\n * Path safety (traversal, percent-encoded separators, embedded query strings) is handled\n * upstream by normalizeApiRequestPath / isUnsafeApiRequestPath in codemode-tools.\n */\n\nconst SCOPE_FIELDS = ['tenantId', 'organizationId'] as const\n\n// Dropped from any sandbox-supplied payload defensively so a top-level \"__proto__\" (etc.)\n// can never ride along to a downstream handler that merges request data unsafely.\nconst DANGEROUS_KEYS = ['__proto__', 'constructor', 'prototype'] as const\n\ntype ContextScope = Pick<McpToolContext, 'tenantId' | 'organizationId'>\n\nexport function applyContextScopeToQuery(\n  query: Record<string, string> | undefined,\n  ctx: ContextScope\n): Record<string, string> {\n  const result: Record<string, string> = { ...query }\n  for (const field of DANGEROUS_KEYS) delete result[field]\n  for (const field of SCOPE_FIELDS) delete result[field]\n  if (ctx.tenantId) result.tenantId = ctx.tenantId\n  if (ctx.organizationId) result.organizationId = ctx.organizationId\n  return result\n}\n\nexport function applyContextScopeToBody(\n  body: Record<string, unknown> | undefined,\n  ctx: ContextScope\n): Record<string, unknown> {\n  // Object spread copies own enumerable props via data-property definition (not the\n  // `__proto__` setter), so the result is a plain object; deleting the dangerous keys\n  // then removes any that rode in as own properties.\n  const result: Record<string, unknown> = { ...body }\n  for (const field of DANGEROUS_KEYS) delete result[field]\n  for (const field of SCOPE_FIELDS) delete result[field]\n  if (ctx.tenantId) result.tenantId = ctx.tenantId\n  if (ctx.organizationId) result.organizationId = ctx.organizationId\n  return result\n}\n"],
-  "mappings": "AAaA,MAAM,eAAe,CAAC,YAAY,gBAAgB;AAIlD,MAAM,iBAAiB,CAAC,aAAa,eAAe,WAAW;AAIxD,SAAS,yBACd,OACA,KACwB;AACxB,QAAM,SAAiC,EAAE,GAAG,MAAM;AAClD,aAAW,SAAS,eAAgB,QAAO,OAAO,KAAK;AACvD,aAAW,SAAS,aAAc,QAAO,OAAO,KAAK;AACrD,MAAI,IAAI,SAAU,QAAO,WAAW,IAAI;AACxC,MAAI,IAAI,eAAgB,QAAO,iBAAiB,IAAI;AACpD,SAAO;AACT;AAEO,SAAS,wBACd,MACA,KACyB;AAIzB,QAAM,SAAkC,EAAE,GAAG,KAAK;AAClD,aAAW,SAAS,eAAgB,QAAO,OAAO,KAAK;AACvD,aAAW,SAAS,aAAc,QAAO,OAAO,KAAK;AACrD,MAAI,IAAI,SAAU,QAAO,WAAW,IAAI;AACxC,MAAI,IAAI,eAAgB,QAAO,iBAAiB,IAAI;AACpD,SAAO;AACT;",
-  "names": []
-}

package/dist/modules/ai_assistant/lib/user-role-ids.js

@@ -1,18 +0,0 @@
-import { UserRole } from "@open-mercato/core/modules/auth/data/entities";
-import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
-async function getUserRoleIds(em, userId, tenantId) {
-  if (!tenantId) return [];
-  const links = await findWithDecryption(
-    em,
-    UserRole,
-    { user: userId, role: { tenantId } },
-    { populate: ["role"] },
-    { tenantId, organizationId: null }
-  );
-  const linkList = Array.isArray(links) ? links : [];
-  return linkList.map((link) => link.role?.id).filter((id) => typeof id === "string" && id.length > 0);
-}
-export {
-  getUserRoleIds
-};
-//# sourceMappingURL=user-role-ids.js.map

package/dist/modules/ai_assistant/lib/user-role-ids.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/ai_assistant/lib/user-role-ids.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { UserRole } from '@open-mercato/core/modules/auth/data/entities'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\n/**\n * Resolve a user's role ids for the given tenant.\n *\n * Single source for every AI-assistant surface that mints a role-carrying\n * API key (the mcp-key and session-key routes, the chat route's ephemeral\n * session keys, and the mcp:ensure-api-key CLI), so all of those keys\n * inherit exactly the same ACL for the same user.\n */\nexport async function getUserRoleIds(\n  em: EntityManager,\n  userId: string,\n  tenantId: string | null,\n): Promise<string[]> {\n  if (!tenantId) return []\n  const links = await findWithDecryption(\n    em,\n    UserRole,\n    { user: userId, role: { tenantId } },\n    { populate: ['role'] },\n    { tenantId, organizationId: null },\n  )\n  const linkList = Array.isArray(links) ? links : []\n  return linkList\n    .map((link) => link.role?.id)\n    .filter((id): id is string => typeof id === 'string' && id.length > 0)\n}\n"],
-  "mappings": "AACA,SAAS,gBAAgB;AACzB,SAAS,0BAA0B;AAUnC,eAAsB,eACpB,IACA,QACA,UACmB;AACnB,MAAI,CAAC,SAAU,QAAO,CAAC;AACvB,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA,EAAE,MAAM,QAAQ,MAAM,EAAE,SAAS,EAAE;AAAA,IACnC,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,IACrB,EAAE,UAAU,gBAAgB,KAAK;AAAA,EACnC;AACA,QAAM,WAAW,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;AACjD,SAAO,SACJ,IAAI,CAAC,SAAS,KAAK,MAAM,EAAE,EAC3B,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AACzE;",
-  "names": []
-}

package/src/modules/ai_assistant/lib/__tests__/mcp-ensure-api-key.test.ts

@@ -1,182 +0,0 @@
-import { promises as fs } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-
-jest.mock('@open-mercato/core/modules/api_keys/services/apiKeyService', () => ({
-  createApiKey: jest.fn(),
-  deleteApiKey: jest.fn(),
-  findApiKeyBySecret: jest.fn(),
-}))
-
-jest.mock('@open-mercato/shared/lib/encryption/find', () => ({
-  findOneWithDecryption: jest.fn(),
-  findWithDecryption: jest.fn(),
-}))
-
-import {
-  createApiKey,
-  deleteApiKey,
-  findApiKeyBySecret,
-} from '@open-mercato/core/modules/api_keys/services/apiKeyService'
-import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import { ensureMcpApiKey, DEFAULT_MCP_KEY_NAME } from '../mcp-ensure-api-key'
-
-const mockedCreateApiKey = createApiKey as jest.Mock
-const mockedDeleteApiKey = deleteApiKey as jest.Mock
-const mockedFindApiKeyBySecret = findApiKeyBySecret as jest.Mock
-const mockedFindOneWithDecryption = findOneWithDecryption as jest.Mock
-const mockedFindWithDecryption = findWithDecryption as jest.Mock
-
-const owner = {
-  id: 'user-1',
-  tenantId: 'tenant-1',
-  email: 'superadmin@acme.com',
-}
-
-function createEm() {
-  return { find: jest.fn().mockResolvedValue([]) } as any
-}
-
-describe('ensureMcpApiKey', () => {
-  let workDir: string
-  let filePath: string
-
-  beforeEach(async () => {
-    jest.clearAllMocks()
-    workDir = await fs.mkdtemp(join(tmpdir(), 'mcp-key-test-'))
-    filePath = join(workDir, 'shared', 'mcp-api-key')
-    mockedFindOneWithDecryption.mockResolvedValue(owner)
-    mockedFindWithDecryption.mockResolvedValue([{ role: { id: 'role-1' } }])
-    mockedCreateApiKey.mockResolvedValue({
-      record: { id: 'key-new', keyPrefix: 'omk_new.' },
-      secret: 'omk_new1.aaaabbbbccccddddeeeeffff',
-    })
-  })
-
-  afterEach(async () => {
-    await fs.rm(workDir, { recursive: true, force: true })
-  })
-
-  it('returns valid without touching the DB when the file secret resolves to a live key of the same name', async () => {
-    await fs.mkdir(join(workDir, 'shared'), { recursive: true })
-    await fs.writeFile(filePath, 'omk_old1.secret\n')
-    mockedFindApiKeyBySecret.mockResolvedValue({
-      id: 'key-old',
-      name: DEFAULT_MCP_KEY_NAME,
-      keyPrefix: 'omk_old1.sec',
-    })
-
-    const em = createEm()
-    const result = await ensureMcpApiKey({ em, filePath })
-
-    expect(result).toEqual({ status: 'valid', keyId: 'key-old', keyPrefix: 'omk_old1.sec' })
-    expect(mockedCreateApiKey).not.toHaveBeenCalled()
-    expect(mockedDeleteApiKey).not.toHaveBeenCalled()
-    expect((await fs.readFile(filePath, 'utf8')).trim()).toBe('omk_old1.secret')
-  })
-
-  it('creates a key owned by the superadmin and writes the secret file when no file exists', async () => {
-    const em = createEm()
-    const result = await ensureMcpApiKey({ em, filePath })
-
-    expect(result).toEqual({ status: 'created', keyId: 'key-new', keyPrefix: 'omk_new.' })
-    expect(mockedCreateApiKey).toHaveBeenCalledWith(
-      em,
-      expect.objectContaining({
-        name: DEFAULT_MCP_KEY_NAME,
-        tenantId: 'tenant-1',
-        organizationId: null,
-        roles: ['role-1'],
-        createdBy: 'user-1',
-      }),
-      expect.anything(),
-    )
-    expect((await fs.readFile(filePath, 'utf8')).trim()).toBe('omk_new1.aaaabbbbccccddddeeeeffff')
-  })
-
-  it('resolves the owner with an encrypted-email-aware $or filter', async () => {
-    const em = createEm()
-    await ensureMcpApiKey({ em, filePath })
-
-    expect(mockedFindOneWithDecryption).toHaveBeenCalledWith(
-      em,
-      expect.anything(),
-      expect.objectContaining({
-        deletedAt: null,
-        $or: expect.arrayContaining([
-          { email: 'superadmin@acme.com' },
-          expect.objectContaining({ emailHash: expect.anything() }),
-        ]),
-      }),
-      expect.anything(),
-      expect.anything(),
-    )
-  })
-
-  it('scopes stale-key cleanup to the owner tenant', async () => {
-    const em = createEm()
-    await ensureMcpApiKey({ em, filePath })
-
-    expect(em.find).toHaveBeenCalledWith(
-      expect.anything(),
-      expect.objectContaining({ name: DEFAULT_MCP_KEY_NAME, tenantId: 'tenant-1', deletedAt: null }),
-    )
-  })
-
-  it('soft-deletes stale keys with the same name before creating a replacement', async () => {
-    await fs.mkdir(join(workDir, 'shared'), { recursive: true })
-    await fs.writeFile(filePath, 'omk_stale.secret\n')
-    mockedFindApiKeyBySecret.mockResolvedValue(null)
-
-    const em = createEm()
-    em.find.mockResolvedValue([{ id: 'stale-1' }, { id: 'stale-2' }])
-
-    const result = await ensureMcpApiKey({ em, filePath })
-
-    expect(result.status).toBe('created')
-    expect(mockedDeleteApiKey).toHaveBeenCalledTimes(2)
-    expect(mockedDeleteApiKey).toHaveBeenCalledWith(em, 'stale-1', expect.anything())
-    expect(mockedDeleteApiKey).toHaveBeenCalledWith(em, 'stale-2', expect.anything())
-  })
-
-  it('rotates even when the file secret is valid if rotate is set', async () => {
-    await fs.mkdir(join(workDir, 'shared'), { recursive: true })
-    await fs.writeFile(filePath, 'omk_old1.secret\n')
-    mockedFindApiKeyBySecret.mockResolvedValue({
-      id: 'key-old',
-      name: DEFAULT_MCP_KEY_NAME,
-      keyPrefix: 'omk_old1.sec',
-    })
-
-    const em = createEm()
-    const result = await ensureMcpApiKey({ em, filePath, rotate: true })
-
-    expect(result.status).toBe('created')
-    expect(mockedFindApiKeyBySecret).not.toHaveBeenCalled()
-    expect((await fs.readFile(filePath, 'utf8')).trim()).toBe('omk_new1.aaaabbbbccccddddeeeeffff')
-  })
-
-  it('rotates when the file secret resolves to a key with a different name', async () => {
-    await fs.mkdir(join(workDir, 'shared'), { recursive: true })
-    await fs.writeFile(filePath, 'omk_old1.secret\n')
-    mockedFindApiKeyBySecret.mockResolvedValue({
-      id: 'key-other',
-      name: '__session_something__',
-      keyPrefix: 'omk_old1.sec',
-    })
-
-    const em = createEm()
-    const result = await ensureMcpApiKey({ em, filePath })
-
-    expect(result.status).toBe('created')
-    expect(mockedCreateApiKey).toHaveBeenCalled()
-  })
-
-  it('throws a clear error when the owner user does not exist', async () => {
-    mockedFindOneWithDecryption.mockResolvedValue(null)
-
-    const em = createEm()
-    await expect(ensureMcpApiKey({ em, filePath })).rejects.toThrow(/owner not found/)
-    expect(mockedCreateApiKey).not.toHaveBeenCalled()
-  })
-})

package/src/modules/ai_assistant/lib/__tests__/scope-injection.test.ts

@@ -1,66 +0,0 @@
-import { applyContextScopeToQuery, applyContextScopeToBody } from '../scope-injection'
-
-const NULL_SCOPE = { tenantId: null, organizationId: null }
-const BOUND_SCOPE = { tenantId: 'ctx-tenant', organizationId: 'ctx-org' }
-
-describe('applyContextScopeToQuery', () => {
-  it('strips AI-supplied scope when ctx scope is null (fail closed)', () => {
-    const result = applyContextScopeToQuery(
-      { tenantId: 'evil', organizationId: 'evil-org', city: 'NYC' },
-      NULL_SCOPE
-    )
-    expect('tenantId' in result).toBe(false)
-    expect('organizationId' in result).toBe(false)
-    expect(result.city).toBe('NYC')
-  })
-
-  it('overrides AI-supplied scope with ctx scope', () => {
-    const result = applyContextScopeToQuery({ tenantId: 'evil' }, BOUND_SCOPE)
-    expect(result.tenantId).toBe('ctx-tenant')
-    expect(result.organizationId).toBe('ctx-org')
-  })
-
-  it('handles undefined query', () => {
-    expect(applyContextScopeToQuery(undefined, NULL_SCOPE)).toEqual({})
-  })
-
-  it('drops dangerous prototype-pollution keys', () => {
-    const result = applyContextScopeToQuery(
-      { ['__proto__']: 'x', city: 'NYC' } as Record<string, string>,
-      NULL_SCOPE
-    )
-    expect(Object.prototype.hasOwnProperty.call(result, '__proto__')).toBe(false)
-    expect(result.city).toBe('NYC')
-  })
-})
-
-describe('applyContextScopeToBody', () => {
-  it('strips AI-supplied scope when ctx scope is null', () => {
-    const result = applyContextScopeToBody(
-      { name: 'Acme', tenantId: 'evil', organizationId: 'evil-org' },
-      NULL_SCOPE
-    )
-    expect(result.name).toBe('Acme')
-    expect('tenantId' in result).toBe(false)
-    expect('organizationId' in result).toBe(false)
-  })
-
-  it('applies ctx tenant even when only tenantId is scoped', () => {
-    const result = applyContextScopeToBody(
-      { tenantId: 'evil' },
-      { tenantId: 'ctx-tenant', organizationId: null }
-    )
-    expect(result.tenantId).toBe('ctx-tenant')
-    expect('organizationId' in result).toBe(false)
-  })
-
-  it('handles undefined body', () => {
-    expect(applyContextScopeToBody(undefined, NULL_SCOPE)).toEqual({})
-  })
-
-  it('does not mutate the original body object', () => {
-    const original = { tenantId: 'evil' }
-    applyContextScopeToBody(original, BOUND_SCOPE)
-    expect(original.tenantId).toBe('evil')
-  })
-})