@open-mercato/ai-assistant 0.6.6 → 0.6.7-develop.6553.1.2ec7246e04

package/src/modules/ai_assistant/lib/mcp-ensure-api-key.ts

@@ -0,0 +1,132 @@
+import { promises as fs } from 'node:fs'
+import { dirname } from 'node:path'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import { ApiKey } from '@open-mercato/core/modules/api_keys/data/entities'
+import {
+  createApiKey,
+  deleteApiKey,
+  findApiKeyBySecret,
+} from '@open-mercato/core/modules/api_keys/services/apiKeyService'
+import { User } from '@open-mercato/core/modules/auth/data/entities'
+import { emailHashLookupValues } from '@open-mercato/core/modules/auth/lib/emailHash'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { getUserRoleIds } from './user-role-ids'
+
+export const DEFAULT_MCP_KEY_NAME = '__mcp_server__'
+export const DEFAULT_MCP_KEY_OWNER_EMAIL = 'superadmin@acme.com'
+
+export type EnsureMcpApiKeyOptions = {
+  em: EntityManager
+  filePath: string
+  keyName?: string
+  ownerEmail?: string
+  rotate?: boolean
+  rbac?: RbacService
+}
+
+export type EnsureMcpApiKeyResult = {
+  status: 'valid' | 'created'
+  keyId: string
+  keyPrefix: string
+}
+
+async function readSecretFile(filePath: string): Promise<string | null> {
+  try {
+    const raw = await fs.readFile(filePath, 'utf8')
+    const trimmed = raw.trim()
+    return trimmed.length > 0 ? trimmed : null
+  } catch {
+    return null
+  }
+}
+
+async function writeSecretFile(filePath: string, secret: string): Promise<void> {
+  await fs.mkdir(dirname(filePath), { recursive: true })
+  const tmpPath = `${filePath}.tmp`
+  // World-readable on purpose: the file lives in a dedicated named volume
+  // mounted only into this stack's containers, and the consumer (the OpenCode
+  // container) runs as a non-root user that cannot read a root-owned 0600
+  // file. The volume boundary, not the file mode, is the security boundary.
+  await fs.writeFile(tmpPath, `${secret}\n`, { mode: 0o644 })
+  await fs.rename(tmpPath, filePath)
+  await fs.chmod(filePath, 0o644)
+}
+
+/**
+ * Ensure a valid MCP server API key exists and its plaintext secret is stored
+ * in `filePath`. The DB only holds a bcrypt hash, so the secret file is the
+ * idempotency anchor: when it still resolves to a live key of the expected
+ * name, nothing changes. Otherwise stale keys with that name are soft-deleted
+ * and a fresh key is created, owned by the superadmin user so header-only MCP
+ * calls resolve an ACL context via `createdBy`.
+ */
+export async function ensureMcpApiKey(options: EnsureMcpApiKeyOptions): Promise<EnsureMcpApiKeyResult> {
+  const keyName = options.keyName?.trim() || DEFAULT_MCP_KEY_NAME
+  const existingSecret = await readSecretFile(options.filePath)
+
+  if (existingSecret && existingSecret.startsWith('omk_') && !options.rotate) {
+    const existingKey = await findApiKeyBySecret(options.em, existingSecret)
+    if (existingKey && existingKey.name === keyName) {
+      return { status: 'valid', keyId: existingKey.id, keyPrefix: existingKey.keyPrefix }
+    }
+  }
+
+  const ownerEmail =
+    options.ownerEmail?.trim() ||
+    process.env.OM_INIT_SUPERADMIN_EMAIL?.trim() ||
+    DEFAULT_MCP_KEY_OWNER_EMAIL
+  // User.email is encrypted at rest with an email_hash lookup column, and
+  // findOneWithDecryption does not rewrite filters — a plaintext { email }
+  // match would find nothing once encryption is on. Mirror the $or pattern
+  // from AuthService.findUserByEmail so both modes resolve the owner.
+  const owner = await findOneWithDecryption(
+    options.em,
+    User,
+    {
+      deletedAt: null,
+      $or: [
+        { email: ownerEmail },
+        { emailHash: { $in: emailHashLookupValues(ownerEmail) } },
+      ],
+    },
+    {},
+    { tenantId: null, organizationId: null },
+  )
+  if (!owner) {
+    throw new Error(
+      `[internal] MCP API key owner not found: no active user with email "${ownerEmail}". ` +
+        'Run "mercato init" first or pass --email pointing at an existing admin user.',
+    )
+  }
+
+  const roleIds = await getUserRoleIds(options.em, owner.id, owner.tenantId ?? null)
+
+  // Scope the cleanup to the owner's tenant: keys with the same name in other
+  // tenants belong to other stacks/tenants and must never be revoked here.
+  const staleKeys = await options.em.find(ApiKey, {
+    name: keyName,
+    tenantId: owner.tenantId ?? null,
+    deletedAt: null,
+  })
+  for (const staleKey of staleKeys) {
+    await deleteApiKey(options.em, staleKey.id, { rbac: options.rbac })
+  }
+
+  const { record, secret } = await createApiKey(
+    options.em,
+    {
+      name: keyName,
+      description: 'MCP server key provisioned by mcp:ensure-api-key',
+      tenantId: owner.tenantId ?? null,
+      organizationId: null,
+      roles: roleIds,
+      createdBy: owner.id,
+    },
+    { rbac: options.rbac },
+  )
+
+  await writeSecretFile(options.filePath, secret)
+
+  return { status: 'created', keyId: record.id, keyPrefix: record.keyPrefix }
+}

package/src/modules/ai_assistant/lib/scope-injection.ts

@@ -0,0 +1,47 @@
+import type { McpToolContext } from './types'
+
+/**
+ * Tenant/org scope for outgoing api.request() calls is derived strictly from the
+ * operating context — never from sandbox (AI-authored) code. Any tenantId/organizationId
+ * the sandbox placed in query/body is stripped first, then re-applied from ctx only when
+ * present. When the ctx scope is null the fields stay removed (fail closed), so AI-supplied
+ * scope can never survive regardless of whether the context is tenant-bound.
+ *
+ * Path safety (traversal, percent-encoded separators, embedded query strings) is handled
+ * upstream by normalizeApiRequestPath / isUnsafeApiRequestPath in codemode-tools.
+ */
+
+const SCOPE_FIELDS = ['tenantId', 'organizationId'] as const
+
+// Dropped from any sandbox-supplied payload defensively so a top-level "__proto__" (etc.)
+// can never ride along to a downstream handler that merges request data unsafely.
+const DANGEROUS_KEYS = ['__proto__', 'constructor', 'prototype'] as const
+
+type ContextScope = Pick<McpToolContext, 'tenantId' | 'organizationId'>
+
+export function applyContextScopeToQuery(
+  query: Record<string, string> | undefined,
+  ctx: ContextScope
+): Record<string, string> {
+  const result: Record<string, string> = { ...query }
+  for (const field of DANGEROUS_KEYS) delete result[field]
+  for (const field of SCOPE_FIELDS) delete result[field]
+  if (ctx.tenantId) result.tenantId = ctx.tenantId
+  if (ctx.organizationId) result.organizationId = ctx.organizationId
+  return result
+}
+
+export function applyContextScopeToBody(
+  body: Record<string, unknown> | undefined,
+  ctx: ContextScope
+): Record<string, unknown> {
+  // Object spread copies own enumerable props via data-property definition (not the
+  // `__proto__` setter), so the result is a plain object; deleting the dangerous keys
+  // then removes any that rode in as own properties.
+  const result: Record<string, unknown> = { ...body }
+  for (const field of DANGEROUS_KEYS) delete result[field]
+  for (const field of SCOPE_FIELDS) delete result[field]
+  if (ctx.tenantId) result.tenantId = ctx.tenantId
+  if (ctx.organizationId) result.organizationId = ctx.organizationId
+  return result
+}

package/src/modules/ai_assistant/lib/user-role-ids.ts

@@ -0,0 +1,30 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { UserRole } from '@open-mercato/core/modules/auth/data/entities'
+import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+
+/**
+ * Resolve a user's role ids for the given tenant.
+ *
+ * Single source for every AI-assistant surface that mints a role-carrying
+ * API key (the mcp-key and session-key routes, the chat route's ephemeral
+ * session keys, and the mcp:ensure-api-key CLI), so all of those keys
+ * inherit exactly the same ACL for the same user.
+ */
+export async function getUserRoleIds(
+  em: EntityManager,
+  userId: string,
+  tenantId: string | null,
+): Promise<string[]> {
+  if (!tenantId) return []
+  const links = await findWithDecryption(
+    em,
+    UserRole,
+    { user: userId, role: { tenantId } },
+    { populate: ['role'] },
+    { tenantId, organizationId: null },
+  )
+  const linkList = Array.isArray(links) ? links : []
+  return linkList
+    .map((link) => link.role?.id)
+    .filter((id): id is string => typeof id === 'string' && id.length > 0)
+}