@open-mercato/ai-assistant 0.6.6 → 0.6.7-develop.6553.1.2ec7246e04

package/src/modules/ai_assistant/api/session-key/route.ts

@@ -8,9 +8,8 @@ import {
   generateSessionToken,
   createSessionApiKey,
 } from '@open-mercato/core/modules/api_keys/services/apiKeyService'
-import { UserRole } from '@open-mercato/core/modules/auth/data/entities'
-import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { getUserRoleIds } from '../../lib/user-role-ids'
 
 const logger = createLogger('ai_assistant')
 
@@ -20,29 +19,6 @@ export const metadata = {
 
 const SESSION_TTL_MINUTES = 120 // 2 hours
 
-/**
- * Get user's role IDs from the database.
- */
-async function getUserRoleIds(
-  em: EntityManager,
-  userId: string,
-  tenantId: string | null
-): Promise<string[]> {
-  if (!tenantId) return []
-
-  const links = await findWithDecryption(
-    em,
-    UserRole,
-    { user: userId as any, role: { tenantId } } as any,
-    { populate: ['role'] },
-    { tenantId, organizationId: null },
-  )
-  const linkList = Array.isArray(links) ? links : []
-  return linkList
-    .map((l) => (l.role as any)?.id)
-    .filter((id): id is string => typeof id === 'string' && id.length > 0)
-}
-
 /**
  * POST /api/ai_assistant/session-key
  *

package/src/modules/ai_assistant/api/settings/route.ts

@@ -1,3 +1,4 @@
+import { existsSync, readFileSync } from 'node:fs'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 import { NextResponse, type NextRequest } from 'next/server'
 import { z } from 'zod'
@@ -6,6 +7,7 @@ import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import { findApiKeyBySecret } from '@open-mercato/core/modules/api_keys/services/apiKeyService'
 import { llmProviderRegistry } from '@open-mercato/shared/lib/ai/llm-provider-registry'
 import { joinProviderModel } from '@open-mercato/shared/lib/ai/model-id'
 import {
@@ -170,8 +172,26 @@ export async function GET(req: NextRequest) {
         ? getOpenCodeProviderConfiguredEnvKey(fallbackOpenCodeProviderId)
         : null
 
-    // Check if MCP_SERVER_API_KEY is configured (required for MCP authentication)
-    const mcpKeyConfigured = !!process.env.MCP_SERVER_API_KEY?.trim()
+    // Check if the MCP API key is configured (required for MCP authentication):
+    // either directly via MCP_SERVER_API_KEY or via the shared key file that
+    // the containerized mcp service provisions (MCP_SERVER_API_KEY_FILE).
+    // The file variant is validated against the api_keys table — the file
+    // outlives DB resets and key deletion, so mere existence would report a
+    // green badge while OpenCode -> MCP auth is actually broken.
+    const mcpKeyFilePath = process.env.MCP_SERVER_API_KEY_FILE?.trim()
+    let mcpKeyConfigured = !!process.env.MCP_SERVER_API_KEY?.trim()
+    if (!mcpKeyConfigured && mcpKeyFilePath && existsSync(mcpKeyFilePath)) {
+      try {
+        const fileSecret = readFileSync(mcpKeyFilePath, 'utf8').trim()
+        if (fileSecret.startsWith('omk_')) {
+          const keyContainer = await createRequestContainer()
+          const keyEm = keyContainer.resolve<EntityManager>('em')
+          mcpKeyConfigured = !!(await findApiKeyBySecret(keyEm, fileSecret))
+        }
+      } catch {
+        mcpKeyConfigured = false
+      }
+    }
 
     // Phase 4a: resolve tenant override row and per-agent resolution matrix
     let tenantOverride: {

package/src/modules/ai_assistant/cli.ts

@@ -161,6 +161,47 @@ const mcpDev: ModuleCli = {
   },
 }
 
+const mcpEnsureApiKey: ModuleCli = {
+  command: 'mcp:ensure-api-key',
+  async run(rest) {
+    const args = parseArgs(rest)
+    // A bare `--file` (no value) parses to boolean true — treat it as missing
+    // rather than provisioning into a file literally named "true".
+    const fileArg = typeof args.file === 'string' ? args.file.trim() : ''
+    const filePath =
+      fileArg || process.env.MCP_SERVER_API_KEY_FILE?.trim() || process.env.MCP_API_KEY_FILE?.trim() || ''
+    if (!filePath) {
+      console.error('Usage: mercato ai_assistant mcp:ensure-api-key --file <path> [options]')
+      console.error('')
+      console.error('Ensures a valid MCP server API key exists in the database and that its')
+      console.error('plaintext secret is stored in <path> (the idempotency anchor). The secret')
+      console.error('is never printed; consumers such as the OpenCode container read the file.')
+      console.error('')
+      console.error('Options:')
+      console.error('  --file <path>    Secret file path (or MCP_SERVER_API_KEY_FILE env)')
+      console.error('  --name <name>    API key name (default __mcp_server__)')
+      console.error('  --email <email>  Owner user email (default OM_INIT_SUPERADMIN_EMAIL, then superadmin@acme.com)')
+      console.error('  --rotate         Force rotation even when the file secret is still valid')
+      process.exitCode = 1
+      return
+    }
+
+    const keyName = typeof args.name === 'string' && args.name.length > 0 ? args.name : undefined
+    const ownerEmail = typeof args.email === 'string' && args.email.length > 0 ? args.email : undefined
+    const rotate = args.rotate === true || args.rotate === 'true'
+
+    await ensureBootstrap()
+    const container = await createRequestContainer()
+    const em = container.resolve<import('@mikro-orm/postgresql').EntityManager>('em')
+    const rbac = container.resolve('rbacService') as import('@open-mercato/core/modules/auth/services/rbacService').RbacService
+
+    const { ensureMcpApiKey } = await import('./lib/mcp-ensure-api-key')
+    const result = await ensureMcpApiKey({ em, filePath, keyName, ownerEmail, rotate, rbac })
+    const message = result.status === 'valid' ? 'Existing key is valid' : 'New key created'
+    console.log(`[mcp:ensure-api-key] ${message} (id=${result.keyId}, prefix=${result.keyPrefix})`)
+  },
+}
+
 const listTools: ModuleCli = {
   command: 'mcp:list-tools',
   async run(rest) {
@@ -377,6 +418,7 @@ export default [
   mcpServe,
   mcpServeHttp,
   mcpDev,
+  mcpEnsureApiKey,
   listTools,
   entityGraph,
   runPendingActionCleanup,

package/src/modules/ai_assistant/lib/__tests__/codemode-tools.test.ts

@@ -477,3 +477,149 @@ describe('mutation call cap (issue #2724)', () => {
     expect(counts()).toEqual({ apiCallCount: CODE_MODE_MAX_MUTATION_CALLS + 5, mutationCallCount: 0 })
   })
 })
+
+describe('scope enforcement (issue #2658)', () => {
+  const listCompaniesEndpoint = {
+    id: 'list_companies',
+    operationId: 'list_companies',
+    method: 'GET',
+    path: '/api/customers/companies',
+    summary: '',
+    description: '',
+    tags: [],
+    requiredFeatures: [],
+    parameters: [],
+    requestBodySchema: null,
+    deprecated: false,
+  }
+  const createCompanyEndpoint = {
+    id: 'create_company',
+    operationId: 'create_company',
+    method: 'POST',
+    path: '/api/customers/companies',
+    summary: '',
+    description: '',
+    tags: [],
+    requiredFeatures: ['customers.companies.create'],
+    parameters: [],
+    requestBodySchema: null,
+    deprecated: false,
+  }
+
+  beforeEach(() => {
+    mockedGetApiEndpoints.mockReset()
+    mockedFetchWithTimeout.mockReset()
+    mockedFetchWithTimeout.mockResolvedValue(okResponse())
+  })
+
+  function fetchedUrl(): URL {
+    const [url] = mockedFetchWithTimeout.mock.calls[0]
+    return new URL(url as string)
+  }
+  function fetchedBody(): Record<string, unknown> {
+    const [, init] = mockedFetchWithTimeout.mock.calls[0]
+    return JSON.parse((init as { body: string }).body)
+  }
+  function creatorContext(scope: Partial<McpToolContext> = {}): McpToolContext {
+    return createContext({
+      userFeatures: ['ai_assistant.view', 'customers.companies.create'],
+      ...scope,
+    })
+  }
+
+  it('drops AI-supplied query scope when ctx scope is null (fail closed)', async () => {
+    mockedGetApiEndpoints.mockResolvedValue([listCompaniesEndpoint])
+    const apiRequest = createApiRequestFn(
+      createContext({ tenantId: null, organizationId: null }),
+      () => {}
+    )
+
+    await apiRequest({
+      method: 'GET',
+      path: '/api/customers/companies',
+      query: { tenantId: 'evil', organizationId: 'evil-org', city: 'NYC' },
+    })
+
+    const params = fetchedUrl().searchParams
+    expect(params.get('tenantId')).toBeNull()
+    expect(params.get('organizationId')).toBeNull()
+    expect(params.get('city')).toBe('NYC')
+  })
+
+  it('overrides AI-supplied query scope with ctx scope', async () => {
+    mockedGetApiEndpoints.mockResolvedValue([listCompaniesEndpoint])
+    const apiRequest = createApiRequestFn(createContext(), () => {})
+
+    await apiRequest({
+      method: 'GET',
+      path: '/api/customers/companies',
+      query: { tenantId: 'evil' },
+    })
+
+    expect(fetchedUrl().searchParams.get('tenantId')).toBe('tenant-1')
+  })
+
+  it('strips AI-supplied body scope when ctx scope is null', async () => {
+    mockedGetApiEndpoints.mockResolvedValue([createCompanyEndpoint])
+    const apiRequest = createApiRequestFn(
+      creatorContext({ tenantId: null, organizationId: null }),
+      () => {}
+    )
+
+    await apiRequest({
+      method: 'POST',
+      path: '/api/customers/companies',
+      body: { name: 'Acme', tenantId: 'evil', organizationId: 'evil-org' },
+    })
+
+    const body = fetchedBody()
+    expect(body.name).toBe('Acme')
+    expect('tenantId' in body).toBe(false)
+    expect('organizationId' in body).toBe(false)
+  })
+
+  it('overrides AI-supplied body scope with ctx scope', async () => {
+    mockedGetApiEndpoints.mockResolvedValue([createCompanyEndpoint])
+    const apiRequest = createApiRequestFn(creatorContext(), () => {})
+
+    await apiRequest({
+      method: 'POST',
+      path: '/api/customers/companies',
+      body: { name: 'Acme', tenantId: 'evil' },
+    })
+
+    const body = fetchedBody()
+    expect(body.tenantId).toBe('tenant-1')
+    expect(body.organizationId).toBe('org-1')
+  })
+
+  it('enforces query scope on non-GET methods too (not only GET)', async () => {
+    mockedGetApiEndpoints.mockResolvedValue([createCompanyEndpoint])
+    const apiRequest = createApiRequestFn(creatorContext(), () => {})
+
+    await apiRequest({
+      method: 'POST',
+      path: '/api/customers/companies',
+      query: { tenantId: 'evil' },
+      body: {},
+    })
+
+    expect(fetchedUrl().searchParams.get('tenantId')).toBe('tenant-1')
+  })
+
+  it('drops dangerous prototype-pollution keys from the body', async () => {
+    mockedGetApiEndpoints.mockResolvedValue([createCompanyEndpoint])
+    const apiRequest = createApiRequestFn(creatorContext(), () => {})
+
+    await apiRequest({
+      method: 'POST',
+      path: '/api/customers/companies',
+      body: { name: 'Acme', ['__proto__']: { polluted: true } } as Record<string, unknown>,
+    })
+
+    const body = fetchedBody()
+    expect(body.name).toBe('Acme')
+    expect(Object.prototype.hasOwnProperty.call(body, '__proto__')).toBe(false)
+    expect(({} as Record<string, unknown>).polluted).toBeUndefined()
+  })
+})

package/src/modules/ai_assistant/lib/__tests__/mcp-ensure-api-key.test.ts

@@ -0,0 +1,182 @@
+import { promises as fs } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+jest.mock('@open-mercato/core/modules/api_keys/services/apiKeyService', () => ({
+  createApiKey: jest.fn(),
+  deleteApiKey: jest.fn(),
+  findApiKeyBySecret: jest.fn(),
+}))
+
+jest.mock('@open-mercato/shared/lib/encryption/find', () => ({
+  findOneWithDecryption: jest.fn(),
+  findWithDecryption: jest.fn(),
+}))
+
+import {
+  createApiKey,
+  deleteApiKey,
+  findApiKeyBySecret,
+} from '@open-mercato/core/modules/api_keys/services/apiKeyService'
+import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { ensureMcpApiKey, DEFAULT_MCP_KEY_NAME } from '../mcp-ensure-api-key'
+
+const mockedCreateApiKey = createApiKey as jest.Mock
+const mockedDeleteApiKey = deleteApiKey as jest.Mock
+const mockedFindApiKeyBySecret = findApiKeyBySecret as jest.Mock
+const mockedFindOneWithDecryption = findOneWithDecryption as jest.Mock
+const mockedFindWithDecryption = findWithDecryption as jest.Mock
+
+const owner = {
+  id: 'user-1',
+  tenantId: 'tenant-1',
+  email: 'superadmin@acme.com',
+}
+
+function createEm() {
+  return { find: jest.fn().mockResolvedValue([]) } as any
+}
+
+describe('ensureMcpApiKey', () => {
+  let workDir: string
+  let filePath: string
+
+  beforeEach(async () => {
+    jest.clearAllMocks()
+    workDir = await fs.mkdtemp(join(tmpdir(), 'mcp-key-test-'))
+    filePath = join(workDir, 'shared', 'mcp-api-key')
+    mockedFindOneWithDecryption.mockResolvedValue(owner)
+    mockedFindWithDecryption.mockResolvedValue([{ role: { id: 'role-1' } }])
+    mockedCreateApiKey.mockResolvedValue({
+      record: { id: 'key-new', keyPrefix: 'omk_new.' },
+      secret: 'omk_new1.aaaabbbbccccddddeeeeffff',
+    })
+  })
+
+  afterEach(async () => {
+    await fs.rm(workDir, { recursive: true, force: true })
+  })
+
+  it('returns valid without touching the DB when the file secret resolves to a live key of the same name', async () => {
+    await fs.mkdir(join(workDir, 'shared'), { recursive: true })
+    await fs.writeFile(filePath, 'omk_old1.secret\n')
+    mockedFindApiKeyBySecret.mockResolvedValue({
+      id: 'key-old',
+      name: DEFAULT_MCP_KEY_NAME,
+      keyPrefix: 'omk_old1.sec',
+    })
+
+    const em = createEm()
+    const result = await ensureMcpApiKey({ em, filePath })
+
+    expect(result).toEqual({ status: 'valid', keyId: 'key-old', keyPrefix: 'omk_old1.sec' })
+    expect(mockedCreateApiKey).not.toHaveBeenCalled()
+    expect(mockedDeleteApiKey).not.toHaveBeenCalled()
+    expect((await fs.readFile(filePath, 'utf8')).trim()).toBe('omk_old1.secret')
+  })
+
+  it('creates a key owned by the superadmin and writes the secret file when no file exists', async () => {
+    const em = createEm()
+    const result = await ensureMcpApiKey({ em, filePath })
+
+    expect(result).toEqual({ status: 'created', keyId: 'key-new', keyPrefix: 'omk_new.' })
+    expect(mockedCreateApiKey).toHaveBeenCalledWith(
+      em,
+      expect.objectContaining({
+        name: DEFAULT_MCP_KEY_NAME,
+        tenantId: 'tenant-1',
+        organizationId: null,
+        roles: ['role-1'],
+        createdBy: 'user-1',
+      }),
+      expect.anything(),
+    )
+    expect((await fs.readFile(filePath, 'utf8')).trim()).toBe('omk_new1.aaaabbbbccccddddeeeeffff')
+  })
+
+  it('resolves the owner with an encrypted-email-aware $or filter', async () => {
+    const em = createEm()
+    await ensureMcpApiKey({ em, filePath })
+
+    expect(mockedFindOneWithDecryption).toHaveBeenCalledWith(
+      em,
+      expect.anything(),
+      expect.objectContaining({
+        deletedAt: null,
+        $or: expect.arrayContaining([
+          { email: 'superadmin@acme.com' },
+          expect.objectContaining({ emailHash: expect.anything() }),
+        ]),
+      }),
+      expect.anything(),
+      expect.anything(),
+    )
+  })
+
+  it('scopes stale-key cleanup to the owner tenant', async () => {
+    const em = createEm()
+    await ensureMcpApiKey({ em, filePath })
+
+    expect(em.find).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ name: DEFAULT_MCP_KEY_NAME, tenantId: 'tenant-1', deletedAt: null }),
+    )
+  })
+
+  it('soft-deletes stale keys with the same name before creating a replacement', async () => {
+    await fs.mkdir(join(workDir, 'shared'), { recursive: true })
+    await fs.writeFile(filePath, 'omk_stale.secret\n')
+    mockedFindApiKeyBySecret.mockResolvedValue(null)
+
+    const em = createEm()
+    em.find.mockResolvedValue([{ id: 'stale-1' }, { id: 'stale-2' }])
+
+    const result = await ensureMcpApiKey({ em, filePath })
+
+    expect(result.status).toBe('created')
+    expect(mockedDeleteApiKey).toHaveBeenCalledTimes(2)
+    expect(mockedDeleteApiKey).toHaveBeenCalledWith(em, 'stale-1', expect.anything())
+    expect(mockedDeleteApiKey).toHaveBeenCalledWith(em, 'stale-2', expect.anything())
+  })
+
+  it('rotates even when the file secret is valid if rotate is set', async () => {
+    await fs.mkdir(join(workDir, 'shared'), { recursive: true })
+    await fs.writeFile(filePath, 'omk_old1.secret\n')
+    mockedFindApiKeyBySecret.mockResolvedValue({
+      id: 'key-old',
+      name: DEFAULT_MCP_KEY_NAME,
+      keyPrefix: 'omk_old1.sec',
+    })
+
+    const em = createEm()
+    const result = await ensureMcpApiKey({ em, filePath, rotate: true })
+
+    expect(result.status).toBe('created')
+    expect(mockedFindApiKeyBySecret).not.toHaveBeenCalled()
+    expect((await fs.readFile(filePath, 'utf8')).trim()).toBe('omk_new1.aaaabbbbccccddddeeeeffff')
+  })
+
+  it('rotates when the file secret resolves to a key with a different name', async () => {
+    await fs.mkdir(join(workDir, 'shared'), { recursive: true })
+    await fs.writeFile(filePath, 'omk_old1.secret\n')
+    mockedFindApiKeyBySecret.mockResolvedValue({
+      id: 'key-other',
+      name: '__session_something__',
+      keyPrefix: 'omk_old1.sec',
+    })
+
+    const em = createEm()
+    const result = await ensureMcpApiKey({ em, filePath })
+
+    expect(result.status).toBe('created')
+    expect(mockedCreateApiKey).toHaveBeenCalled()
+  })
+
+  it('throws a clear error when the owner user does not exist', async () => {
+    mockedFindOneWithDecryption.mockResolvedValue(null)
+
+    const em = createEm()
+    await expect(ensureMcpApiKey({ em, filePath })).rejects.toThrow(/owner not found/)
+    expect(mockedCreateApiKey).not.toHaveBeenCalled()
+  })
+})

package/src/modules/ai_assistant/lib/__tests__/scope-injection.test.ts

@@ -0,0 +1,66 @@
+import { applyContextScopeToQuery, applyContextScopeToBody } from '../scope-injection'
+
+const NULL_SCOPE = { tenantId: null, organizationId: null }
+const BOUND_SCOPE = { tenantId: 'ctx-tenant', organizationId: 'ctx-org' }
+
+describe('applyContextScopeToQuery', () => {
+  it('strips AI-supplied scope when ctx scope is null (fail closed)', () => {
+    const result = applyContextScopeToQuery(
+      { tenantId: 'evil', organizationId: 'evil-org', city: 'NYC' },
+      NULL_SCOPE
+    )
+    expect('tenantId' in result).toBe(false)
+    expect('organizationId' in result).toBe(false)
+    expect(result.city).toBe('NYC')
+  })
+
+  it('overrides AI-supplied scope with ctx scope', () => {
+    const result = applyContextScopeToQuery({ tenantId: 'evil' }, BOUND_SCOPE)
+    expect(result.tenantId).toBe('ctx-tenant')
+    expect(result.organizationId).toBe('ctx-org')
+  })
+
+  it('handles undefined query', () => {
+    expect(applyContextScopeToQuery(undefined, NULL_SCOPE)).toEqual({})
+  })
+
+  it('drops dangerous prototype-pollution keys', () => {
+    const result = applyContextScopeToQuery(
+      { ['__proto__']: 'x', city: 'NYC' } as Record<string, string>,
+      NULL_SCOPE
+    )
+    expect(Object.prototype.hasOwnProperty.call(result, '__proto__')).toBe(false)
+    expect(result.city).toBe('NYC')
+  })
+})
+
+describe('applyContextScopeToBody', () => {
+  it('strips AI-supplied scope when ctx scope is null', () => {
+    const result = applyContextScopeToBody(
+      { name: 'Acme', tenantId: 'evil', organizationId: 'evil-org' },
+      NULL_SCOPE
+    )
+    expect(result.name).toBe('Acme')
+    expect('tenantId' in result).toBe(false)
+    expect('organizationId' in result).toBe(false)
+  })
+
+  it('applies ctx tenant even when only tenantId is scoped', () => {
+    const result = applyContextScopeToBody(
+      { tenantId: 'evil' },
+      { tenantId: 'ctx-tenant', organizationId: null }
+    )
+    expect(result.tenantId).toBe('ctx-tenant')
+    expect('organizationId' in result).toBe(false)
+  })
+
+  it('handles undefined body', () => {
+    expect(applyContextScopeToBody(undefined, NULL_SCOPE)).toEqual({})
+  })
+
+  it('does not mutate the original body object', () => {
+    const original = { tenantId: 'evil' }
+    applyContextScopeToBody(original, BOUND_SCOPE)
+    expect(original.tenantId).toBe('evil')
+  })
+})

package/src/modules/ai_assistant/lib/codemode-tools.ts

@@ -16,6 +16,7 @@ import { registerMcpTool } from './tool-registry'
 import type { McpToolContext } from './types'
 import { createSandbox } from './sandbox'
 import { truncateResult } from './truncate'
+import { applyContextScopeToQuery, applyContextScopeToBody } from './scope-injection'
 import { hasRequiredFeatures } from './auth'
 import { getApiEndpoints, getRawOpenApiSpec, type ApiEndpoint } from './api-endpoint-index'
 import {
@@ -792,25 +793,19 @@ export function createApiRequestFn(
 
     let url = `${baseUrl}${apiPath}`
 
-    // Build query parameters
-    const queryParams: Record<string, string> = { ...query }
-
-    if (normalizedMethod === 'GET') {
-      if (ctx.tenantId) queryParams.tenantId = ctx.tenantId
-      if (ctx.organizationId) queryParams.organizationId = ctx.organizationId
-    }
+    // Build query parameters — scope is enforced from ctx for every method, not only
+    // GET, so AI-supplied tenantId/organizationId can never survive (see scope-injection).
+    const queryParams = applyContextScopeToQuery(query, ctx)
 
     if (Object.keys(queryParams).length > 0) {
       const separator = url.includes('?') ? '&' : '?'
       url += separator + new URLSearchParams(queryParams).toString()
     }
 
-    // Build request body with context injection
+    // Build request body with context-enforced scope
     let requestBody: Record<string, unknown> | undefined
     if (['POST', 'PUT', 'PATCH'].includes(normalizedMethod)) {
-      requestBody = { ...body }
-      if (ctx.tenantId) requestBody.tenantId = ctx.tenantId
-      if (ctx.organizationId) requestBody.organizationId = ctx.organizationId
+      requestBody = applyContextScopeToBody(body, ctx)
     }
 
     // Build headers