@open-mercato/core 0.10.1-develop.7736.1.88e07906bf → 0.10.1-develop.7748.1.d745ba61aa

package/src/helpers/integration/attachmentAccessFixtures.ts

@@ -0,0 +1,141 @@
+import { randomUUID } from 'node:crypto'
+import { expect, type APIRequestContext } from '@playwright/test'
+import { apiRequest, clearAuthTokenCache, getAuthToken, withCredentialIsolatedRequest } from './api'
+import { createRoleFixture, createUserFixture, deleteRoleIfExists, deleteUserIfExists, setRoleAclFeatures } from './authFixtures'
+import { deleteAttachmentIfExists, uploadAttachmentFixture } from './attachmentsFixtures'
+import { expectId, getTokenContext, readJsonSafe } from './generalFixtures'
+
+export const OWNER_ACCESS_FEATURES = [
+  'documents.view', 'documents.edit', 'documents.create', 'documents.share', 'documents.delete',
+  'attachments.view', 'attachments.manage',
+]
+export const OWNER_ACCESS_PNG = Buffer.from(
+  'iVBORw0KGgoAAAANSUhEUgAAAAIAAAACCAYAAABytg0kAAAACXBIWXMAAAPoAAAD6AG1e1JrAAAAEUlEQVQImWMwSpn2H4QZYAwASOwIrfM45AsAAAAASUVORK5CYII=',
+  'base64',
+)
+
+export type OwnerAccessItem = { id: string; tags?: string[]; assignments?: Array<{ type: string; id: string; label?: string | null }> }
+export type OwnerAccessList = { items: OwnerAccessItem[]; total?: number; availableTags?: string[] }
+export type OwnerAccessActor = { id: string; token: string; refreshToken: () => Promise<string> }
+type Assignment = { type: string; id: string; label?: string }
+type Share = { id: string; updatedAt: string }
+
+export async function ownerPolicyRequest<Body = { error?: string }>(
+  method: string, path: string, token: string, data?: unknown, scheme: 'Bearer' | 'ApiKey' = 'Bearer',
+) {
+  return withCredentialIsolatedRequest(async (isolated) => {
+    const response = await isolated.fetch(path, {
+      method, headers: { Authorization: `${scheme} ${token}`, 'Content-Type': 'application/json' },
+      ...(data === undefined ? {} : { data }),
+    })
+    return {
+      status: response.status(), headers: response.headers(),
+      body: await readJsonSafe<Body>(response), bytes: await response.body(),
+    }
+  })
+}
+
+export type AttachmentOwnerFixture = {
+  admin: string
+  roleId: string
+  prefix: string
+  recipient: OwnerAccessActor
+  unshared: OwnerAccessActor
+  visible: string
+  hidden: string
+  destination: string
+  document: (label: string, token?: string) => Promise<string>
+  share: (documentId: string, permission: 'viewer' | 'editor', principalType?: 'user' | 'role', principalId?: string, token?: string) => Promise<Share>
+  upload: (documentId: string, label: string, options?: { entityId?: string; assignments?: Assignment[]; tags?: string[] }) => Promise<string>
+  uploadProxy: (documentId: string) => Promise<{ attachmentId: string; url: string }>
+  uploadPublicImage: (documentId: string) => Promise<string>
+  key: () => Promise<{ id: string; secret: string }>
+}
+
+export async function withAttachmentOwnerFixture(
+  request: APIRequestContext, run: (fixture: AttachmentOwnerFixture) => Promise<void>,
+): Promise<void> {
+  const admin = await getAuthToken(request, 'admin')
+  const scope = getTokenContext(admin)
+  const prefix = `attachment-owner-${randomUUID()}`
+  const users: string[] = [], documents: string[] = [], attachments: string[] = [], keys: string[] = []
+  let roleId: string | null = null
+  try {
+    roleId = await createRoleFixture(request, admin, { name: prefix, tenantId: scope.tenantId })
+    await setRoleAclFeatures(request, admin, { roleId, features: OWNER_ACCESS_FEATURES })
+    const actor = async (label: string): Promise<OwnerAccessActor> => {
+      const email = `${prefix}-${label}@example.com`, password = `Owner1!${randomUUID()}`
+      const id = await createUserFixture(request, admin, {
+        email, password, organizationId: scope.organizationId, roles: [roleId!], name: label,
+      })
+      users.push(id)
+      return { id, token: await getAuthToken(request, email, password), refreshToken: async () => {
+        clearAuthTokenCache()
+        return getAuthToken(request, email, password)
+      } }
+    }
+    const recipient = await actor('recipient'), unshared = await actor('unshared')
+    const document = async (label: string, token = admin): Promise<string> => {
+      const response = await apiRequest(request, 'POST', '/api/documents', { token, data: { title: `${prefix}-${label}`, folderId: null } })
+      expect(response.status()).toBe(201)
+      const body = await readJsonSafe<{ id: string }>(response)
+      const id = expectId(body?.id, 'Fixture response must include id'); documents.push(id); return id
+    }
+    const share: AttachmentOwnerFixture['share'] = async (documentId, permission, principalType = 'user', principalId = recipient.id, token = admin) => {
+      const response = await apiRequest(request, 'POST', `/api/documents/${documentId}/shares`, {
+        token, data: { principalType, principalId, permission },
+      })
+      expect(response.status()).toBe(201)
+      const body = await readJsonSafe<Share>(response)
+      expect(body?.updatedAt).toBeTruthy()
+      return { id: expectId(body?.id, 'Fixture response must include id'), updatedAt: body!.updatedAt }
+    }
+    const upload: AttachmentOwnerFixture['upload'] = async (documentId, label, options = {}) => {
+      const file = await uploadAttachmentFixture(request, admin, {
+        entityId: options.entityId ?? 'documents:document', recordId: documentId,
+        fileName: `${prefix}-${label}.txt`, mimeType: 'text/plain', buffer: Buffer.from(`${prefix}-${label}-content`),
+        assignments: options.assignments, tags: options.tags,
+      })
+      attachments.push(file.id); return file.id
+    }
+    const uploadProxy = async (documentId: string) => {
+      const route = `/api/documents/${documentId}/attachments`
+      const response = await request.fetch(process.env.BASE_URL?.trim() ? `${process.env.BASE_URL.trim()}${route}` : route, {
+        method: 'POST', headers: { Authorization: `Bearer ${admin}` },
+        multipart: { file: { name: `${prefix}-proxy.png`, mimeType: 'image/png', buffer: OWNER_ACCESS_PNG } },
+      })
+      expect(response.status()).toBe(201)
+      const body = await readJsonSafe<{ attachmentId: string; url: string }>(response)
+      return { attachmentId: expectId(body?.attachmentId, 'Document upload must include attachmentId'), url: String(body?.url) }
+    }
+    const key = async () => {
+      const response = await apiRequest(request, 'POST', '/api/api_keys/keys', {
+        token: admin, data: { name: prefix, tenantId: scope.tenantId, organizationId: scope.organizationId, roles: [roleId] },
+      })
+      expect(response.status()).toBe(201)
+      const body = await readJsonSafe<{ id: string; secret: string }>(response)
+      const id = expectId(body?.id, 'Fixture response must include id'); keys.push(id)
+      expect(body?.secret).toMatch(/^omk_/)
+      return { id, secret: body!.secret }
+    }
+    const uploadPublicImage = async (documentId: string) => {
+      const file = await uploadAttachmentFixture(request, admin, {
+        entityId: 'catalog:catalog_product', recordId: randomUUID(),
+        fileName: `${prefix}-public.png`, mimeType: 'image/png', buffer: OWNER_ACCESS_PNG,
+        assignments: [{ type: 'documents:document', id: documentId }],
+      })
+      attachments.push(file.id)
+      expect(file.partitionCode).toBe('productsMedia')
+      return file.id
+    }
+    const visible = await document('visible'), hidden = await document('hidden'), destination = await document('destination')
+    await share(visible, 'viewer')
+    await run({ admin, roleId, prefix, recipient, unshared, visible, hidden, destination, document, share, upload, uploadProxy, uploadPublicImage, key })
+  } finally {
+    for (const id of keys) await apiRequest(request, 'DELETE', `/api/api_keys/keys?id=${id}`, { token: admin }).catch(() => undefined)
+    for (const id of attachments) await deleteAttachmentIfExists(request, admin, id)
+    for (const id of documents.reverse()) await apiRequest(request, 'DELETE', `/api/documents/${id}`, { token: admin }).catch(() => undefined)
+    for (const id of users) await deleteUserIfExists(request, admin, id)
+    await deleteRoleIfExists(request, admin, roleId)
+  }
+}

package/src/modules/api_keys/data/entities.ts

@@ -10,6 +10,11 @@ import { Entity, Index, PrimaryKey, Property, Unique } from '@mikro-orm/decorato
   expression:
     'create unique index "api_keys_opencode_session_id_uq" on "api_keys" ("opencode_session_id") where "opencode_session_id" is not null and "deleted_at" is null',
 })
+@Index({
+  name: 'api_keys_session_token_hash_uq',
+  expression:
+    'create unique index "api_keys_session_token_hash_uq" on "api_keys" ("session_token_hash") where "session_token_hash" is not null and "deleted_at" is null',
+})
 export class ApiKey {
   @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })
   id!: string
@@ -38,7 +43,26 @@ export class ApiKey {
   @Property({ name: 'created_by', type: 'uuid', nullable: true })
   createdBy?: string | null
 
-  /** Session token for ephemeral session-scoped keys (used by AI chat) */
+  /**
+   * SHA-256 hash of the session token for ephemeral session-scoped keys (used by AI chat).
+   * The raw token is a bearer credential — the same one that unlocks the decrypted API key
+   * secret and the user's ACL on the MCP server — so, like `customer_accounts` session
+   * tokens, only its hash is persisted. It is returned to the caller once, at issuance, and
+   * never stored or logged in the clear (see #2254).
+   */
+  @Property({ name: 'session_token_hash', type: 'text', nullable: true })
+  sessionTokenHash?: string | null
+
+  /**
+   * @deprecated Superseded by `sessionTokenHash` (#2254) — nothing reads or writes this
+   * anymore and `Migration20261012202110_api_keys` nulls out every existing value as part of
+   * scrubbing the plaintext token. Kept, not dropped, per the "renamed/removed DB column" rule in
+   * `.ai/review-checklist.md` (keep old column, add new one, backfill, deprecate old) — chat
+   * sessions in flight across the deploy carry a 2-hour TTL and only mint once per
+   * conversation (`ai_assistant`'s chat route, `!sessionId` branch), so the column must survive
+   * long enough for every session minted before this ships to expire naturally. Safe to drop in
+   * a later migration once that window has passed.
+   */
   @Property({ name: 'session_token', type: 'text', nullable: true })
   sessionToken?: string | null
 

package/src/modules/api_keys/migrations/.snapshot-open-mercato.json

@@ -1,29 +1,63 @@
 {
+  "name": "public",
   "namespaces": [
     "public"
   ],
-  "name": "public",
   "tables": [
     {
+      "name": "api_keys",
+      "schema": "public",
       "columns": {
-        "id": {
-          "name": "id",
-          "type": "uuid",
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamptz(6)",
           "unsigned": false,
           "autoincrement": false,
           "primary": false,
           "nullable": false,
-          "default": "gen_random_uuid()",
+          "unique": false,
+          "length": 6,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
+          "mappedType": "datetime"
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "uuid",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
           "mappedType": "uuid"
         },
-        "name": {
-          "name": "name",
-          "type": "text",
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamptz(6)",
           "unsigned": false,
           "autoincrement": false,
           "primary": false,
-          "nullable": false,
-          "mappedType": "text"
+          "nullable": true,
+          "unique": false,
+          "length": 6,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
+          "mappedType": "datetime"
         },
         "description": {
           "name": "description",
@@ -32,24 +66,48 @@
           "autoincrement": false,
           "primary": false,
           "nullable": true,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
           "mappedType": "text"
         },
-        "tenant_id": {
-          "name": "tenant_id",
-          "type": "uuid",
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamptz(6)",
           "unsigned": false,
           "autoincrement": false,
           "primary": false,
           "nullable": true,
-          "mappedType": "uuid"
+          "unique": false,
+          "length": 6,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
+          "mappedType": "datetime"
         },
-        "organization_id": {
-          "name": "organization_id",
+        "id": {
+          "name": "id",
           "type": "uuid",
           "unsigned": false,
           "autoincrement": false,
-          "primary": false,
-          "nullable": true,
+          "primary": true,
+          "nullable": false,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": "gen_random_uuid()",
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
           "mappedType": "uuid"
         },
         "key_hash": {
@@ -59,6 +117,14 @@
           "autoincrement": false,
           "primary": false,
           "nullable": false,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
           "mappedType": "text"
         },
         "key_prefix": {
@@ -68,44 +134,101 @@
           "autoincrement": false,
           "primary": false,
           "nullable": false,
+          "unique": true,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
           "mappedType": "text"
         },
-        "roles_json": {
-          "name": "roles_json",
-          "type": "jsonb",
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamptz(6)",
           "unsigned": false,
           "autoincrement": false,
           "primary": false,
           "nullable": true,
-          "mappedType": "json"
+          "unique": false,
+          "length": 6,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
+          "mappedType": "datetime"
         },
-        "created_by": {
-          "name": "created_by",
-          "type": "uuid",
+        "name": {
+          "name": "name",
+          "type": "text",
           "unsigned": false,
           "autoincrement": false,
           "primary": false,
-          "nullable": true,
-          "mappedType": "uuid"
+          "nullable": false,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
+          "mappedType": "text"
         },
-        "session_token": {
-          "name": "session_token",
+        "opencode_session_id": {
+          "name": "opencode_session_id",
           "type": "text",
           "unsigned": false,
           "autoincrement": false,
           "primary": false,
           "nullable": true,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
           "mappedType": "text"
         },
-        "session_user_id": {
-          "name": "session_user_id",
+        "organization_id": {
+          "name": "organization_id",
           "type": "uuid",
           "unsigned": false,
           "autoincrement": false,
           "primary": false,
           "nullable": true,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
           "mappedType": "uuid"
         },
+        "roles_json": {
+          "name": "roles_json",
+          "type": "jsonb",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
+          "mappedType": "json"
+        },
         "session_secret_encrypted": {
           "name": "session_secret_encrypted",
           "type": "text",
@@ -113,88 +236,129 @@
           "autoincrement": false,
           "primary": false,
           "nullable": true,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
           "mappedType": "text"
         },
-        "opencode_session_id": {
-          "name": "opencode_session_id",
+        "session_token": {
+          "name": "session_token",
           "type": "text",
           "unsigned": false,
           "autoincrement": false,
           "primary": false,
           "nullable": true,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
           "mappedType": "text"
         },
-        "last_used_at": {
-          "name": "last_used_at",
-          "type": "timestamptz",
+        "session_token_hash": {
+          "name": "session_token_hash",
+          "type": "text",
           "unsigned": false,
           "autoincrement": false,
           "primary": false,
           "nullable": true,
-          "length": 6,
-          "mappedType": "datetime"
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
+          "mappedType": "text"
         },
-        "expires_at": {
-          "name": "expires_at",
-          "type": "timestamptz",
+        "session_user_id": {
+          "name": "session_user_id",
+          "type": "uuid",
           "unsigned": false,
           "autoincrement": false,
           "primary": false,
           "nullable": true,
-          "length": 6,
-          "mappedType": "datetime"
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
+          "mappedType": "uuid"
         },
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamptz",
+        "tenant_id": {
+          "name": "tenant_id",
+          "type": "uuid",
           "unsigned": false,
           "autoincrement": false,
           "primary": false,
-          "nullable": false,
-          "length": 6,
-          "mappedType": "datetime"
+          "nullable": true,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
+          "mappedType": "uuid"
         },
         "updated_at": {
           "name": "updated_at",
-          "type": "timestamptz",
-          "unsigned": false,
-          "autoincrement": false,
-          "primary": false,
-          "nullable": true,
-          "length": 6,
-          "mappedType": "datetime"
-        },
-        "deleted_at": {
-          "name": "deleted_at",
-          "type": "timestamptz",
+          "type": "timestamptz(6)",
           "unsigned": false,
           "autoincrement": false,
           "primary": false,
           "nullable": true,
+          "unique": false,
           "length": 6,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
           "mappedType": "datetime"
         }
       },
-      "name": "api_keys",
-      "schema": "public",
       "indexes": [
         {
-          "keyName": "api_keys_key_prefix_unique",
           "columnNames": [
             "key_prefix"
           ],
           "composite": false,
           "constraint": true,
+          "keyName": "api_keys_key_prefix_unique",
           "primary": false,
           "unique": true
         },
         {
-          "keyName": "api_keys_pkey",
+          "columnNames": [],
+          "composite": false,
+          "constraint": false,
+          "keyName": "api_keys_opencode_session_id_uq",
+          "primary": false,
+          "unique": false,
+          "expression": "create unique index \"api_keys_opencode_session_id_uq\" on \"api_keys\" (\"opencode_session_id\") where \"opencode_session_id\" is not null and \"deleted_at\" is null"
+        },
+        {
           "columnNames": [
             "id"
           ],
           "composite": false,
           "constraint": true,
+          "keyName": "api_keys_pkey",
           "primary": true,
           "unique": true
         },
@@ -202,16 +366,18 @@
           "columnNames": [],
           "composite": false,
           "constraint": false,
-          "keyName": "api_keys_opencode_session_id_uq",
+          "keyName": "api_keys_session_token_hash_uq",
           "primary": false,
           "unique": false,
-          "expression": "create unique index \"api_keys_opencode_session_id_uq\" on \"api_keys\" (\"opencode_session_id\") where \"opencode_session_id\" is not null and \"deleted_at\" is null"
+          "expression": "create unique index \"api_keys_session_token_hash_uq\" on \"api_keys\" (\"session_token_hash\") where \"session_token_hash\" is not null and \"deleted_at\" is null"
         }
       ],
       "checks": [],
+      "triggers": [],
       "foreignKeys": {},
-      "nativeEnums": {}
+      "comment": null
     }
   ],
+  "views": [],
   "nativeEnums": {}
-}
+}

package/src/modules/api_keys/migrations/Migration20261012202110_api_keys.ts

@@ -0,0 +1,47 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20261012202110_api_keys extends Migration {
+
+  override name = 'Migration20261012202110';
+
+  override async up(): Promise<void> {
+    this.addSql(`alter table "api_keys" add "session_token_hash" text null;`);
+
+    // Backfill before switching any lookup to the hash column (#2254). AI-chat session keys
+    // carry a 2-hour TTL and mint once per conversation (ai_assistant chat route, `!sessionId`
+    // branch) — a session already in flight when this deploys must keep resolving, or the
+    // conversation silently loses its MCP tool-call auth with no automatic re-mint. `sha256()`
+    // is a PostgreSQL 13+ built-in (no pgcrypto dependency) and matches
+    // `hashSessionToken`'s `createHash('sha256').update(token).digest('hex')` byte for byte.
+    this.addSql(`
+      update "api_keys"
+      set "session_token_hash" = encode(sha256("session_token"::bytea), 'hex')
+      where "session_token" is not null and "session_token_hash" is null;
+    `);
+
+    // Legacy rows embedded the raw token in `name` (`__session_<token>__`, for operator
+    // visibility in an admin listing) — the same credential leaking a second way. Replace it
+    // with a hash-derived, non-secret label before the token itself is cleared below.
+    this.addSql(`
+      update "api_keys"
+      set "name" = '__session_' || substr("session_token_hash", 1, 12) || '__'
+      where "session_token" is not null and "name" = '__session_' || "session_token" || '__';
+    `);
+
+    // Stop storing the plaintext bearer credential. The column is kept, not dropped, per the
+    // "renamed/removed DB column" rule in `.ai/review-checklist.md` (keep old column, add new
+    // one, backfill, deprecate old) — see `ApiKey.sessionToken`'s `@deprecated` doc comment for
+    // the removal criteria for a later migration.
+    this.addSql(`update "api_keys" set "session_token" = null where "session_token" is not null;`);
+
+    this.addSql(`create unique index "api_keys_session_token_hash_uq" on "api_keys" ("session_token_hash") where "session_token_hash" is not null and "deleted_at" is null;`);
+  }
+
+  override down(): void | Promise<void> {
+    // Schema-only reversal. The plaintext `session_token` values cleared above cannot be
+    // restored — that data loss is the point of the migration, not an oversight.
+    this.addSql(`drop index "api_keys_session_token_hash_uq";`);
+    this.addSql(`alter table "api_keys" drop column "session_token_hash";`);
+  }
+
+}