@openparachute/vault 0.4.9-rc.9 → 0.5.0-rc.2

package/src/mirror-routes.test.ts

@@ -245,6 +245,37 @@ describe("handleMirrorPut", () => {
     }
   });
 
+  test("external + git not installed → 503 git_not_installed + actionable message", async () => {
+    // vault#415 nit — handleMirrorPut validates the external path via
+    // validateExternalPath, which shells `git`. On a git-less server it must
+    // return the friendly 503 (consistent with the import route), not let a
+    // raw "Executable not found" crash out. Force the preflight via the
+    // whichOverride seam against a REAL git repo so the only failure is the
+    // preflight.
+    home = tmp("mirror-put-nogit-installed-");
+    const { manager } = makeManager(home);
+    const external = tmp("mirror-put-nogit-target-");
+    initRepo(external);
+    try {
+      const req = new Request("http://x/admin/mirror", {
+        method: "PUT",
+        body: JSON.stringify({
+          enabled: true,
+          location: "external",
+          external_path: external,
+        }),
+      });
+      const res = await handleMirrorPut(req, manager, () => null);
+      expect(res.status).toBe(503);
+      const body = (await res.json()) as { error_type: string; message: string };
+      expect(body.error_type).toBe("git_not_installed");
+      expect(body.message).toContain("git is required");
+      expect(body.message).toContain("dnf install git");
+    } finally {
+      fs.rmSync(external, { recursive: true, force: true });
+    }
+  });
+
   test("accepts a valid external config, persists, restarts watch", async () => {
     home = tmp("mirror-put-happy-");
     const external = tmp("mirror-put-ext-");
@@ -506,8 +537,8 @@ describe("auth credential routes — GET /auth", () => {
 
   test("returns fully-null sanitized shape when no credentials stored", async () => {
     home = tmp("mirror-auth-empty-");
-    makeManager(home);
-    const res = handleAuthGet();
+    const { manager } = makeManager(home);
+    const res = handleAuthGet(manager);
     expect(res.status).toBe(200);
     const body = (await res.json()) as { active_method: null; github_oauth: null; pat: null };
     expect(body.active_method).toBeNull();
@@ -517,7 +548,7 @@ describe("auth credential routes — GET /auth", () => {
 
   test("returns sanitized shape when github_oauth credentials present (no token leaks)", async () => {
     home = tmp("mirror-auth-oauth-");
-    makeManager(home);
+    const { manager } = makeManager(home);
     const creds: MirrorCredentials = {
       active_method: "github_oauth",
       github_oauth: {
@@ -529,8 +560,8 @@ describe("auth credential routes — GET /auth", () => {
       },
       pat: null,
     };
-    writeCredentials(creds);
-    const res = handleAuthGet();
+    writeCredentials("default", creds);
+    const res = handleAuthGet(manager);
     expect(res.status).toBe(200);
     const text = await res.text();
     expect(text).not.toContain("gho_secret");
@@ -550,7 +581,7 @@ describe("auth credential routes — DELETE /auth", () => {
   test("wipes credentials from disk", async () => {
     home = tmp("mirror-auth-delete-");
     const { manager } = makeManager(home);
-    writeCredentials({
+    writeCredentials("default", {
       active_method: "pat",
       github_oauth: null,
       pat: {
@@ -559,10 +590,10 @@ describe("auth credential routes — DELETE /auth", () => {
         label: "test",
       },
     });
-    expect(fs.existsSync(mirrorCredentialsPath())).toBe(true);
+    expect(fs.existsSync(mirrorCredentialsPath("default"))).toBe(true);
     const res = await handleAuthDelete(manager);
     expect(res.status).toBe(200);
-    expect(fs.existsSync(mirrorCredentialsPath())).toBe(false);
+    expect(fs.existsSync(mirrorCredentialsPath("default"))).toBe(false);
   });
 
   test("idempotent — missing credentials file still 200", async () => {
@@ -686,7 +717,7 @@ describe("auth credential routes — device flow", () => {
     expect(grantBody.user.id).toBe(12345);
     // Credentials persisted; no token leak in response.
     expect(JSON.stringify(grantBody)).not.toContain("gho_real");
-    const saved = readCredentials();
+    const saved = readCredentials("default");
     expect(saved?.active_method).toBe("github_oauth");
     expect(saved?.github_oauth?.access_token).toBe("gho_real1234567890");
     expect(saved?.github_oauth?.user_login).toBe("aaron");
@@ -809,7 +840,7 @@ describe("auth credential routes — credential-save side-effects (Cuts 3 + 6)",
     // Seed github_oauth credentials. select-repo doesn't probe; it just
     // sets origin to github.com/<owner>/<repo>.git. We then rewrite
     // origin to our local bare repo so pushNow has somewhere to land.
-    writeCredentials({
+    writeCredentials("default", {
       active_method: "github_oauth",
       github_oauth: {
         access_token: "gho_fake1234567890abcd",
@@ -865,7 +896,7 @@ describe("auth credential routes — credential-save side-effects (Cuts 3 + 6)",
       auto_push: false,
     });
     await manager.start();
-    writeCredentials({
+    writeCredentials("default", {
       active_method: "github_oauth",
       github_oauth: {
         access_token: "gho_anothertoken12345",
@@ -943,15 +974,15 @@ describe("auth credential routes — github repos / create-repo", () => {
 
   test("repos returns 400 when not connected to GitHub", async () => {
     home = tmp("mirror-auth-repos-noauth-");
-    makeManager(home);
-    const res = await handleAuthGithubRepos();
+    const { manager } = makeManager(home);
+    const res = await handleAuthGithubRepos(manager);
     expect(res.status).toBe(400);
   });
 
   test("repos returns list when authed", async () => {
     home = tmp("mirror-auth-repos-ok-");
-    makeManager(home);
-    writeCredentials({
+    const { manager } = makeManager(home);
+    writeCredentials("default", {
       active_method: "github_oauth",
       github_oauth: {
         access_token: "gho_test1234567890",
@@ -979,7 +1010,7 @@ describe("auth credential routes — github repos / create-repo", () => {
         ],
       },
     ]);
-    const res = await handleAuthGithubRepos(fetcher);
+    const res = await handleAuthGithubRepos(manager, fetcher);
     expect(res.status).toBe(200);
     const body = (await res.json()) as { repos: Array<{ full_name: string }> };
     expect(body.repos).toHaveLength(1);
@@ -988,8 +1019,8 @@ describe("auth credential routes — github repos / create-repo", () => {
 
   test("create-repo proxies through with mocked fetch", async () => {
     home = tmp("mirror-auth-create-repo-");
-    makeManager(home);
-    writeCredentials({
+    const { manager } = makeManager(home);
+    writeCredentials("default", {
       active_method: "github_oauth",
       github_oauth: {
         access_token: "gho_test1234567890",
@@ -1020,7 +1051,7 @@ describe("auth credential routes — github repos / create-repo", () => {
       method: "POST",
       body: JSON.stringify({ name: "new-vault" }),
     });
-    const res = await handleAuthGithubCreateRepo(req, fetcher);
+    const res = await handleAuthGithubCreateRepo(req, manager, fetcher);
     expect(res.status).toBe(200);
     const body = (await res.json()) as { full_name: string };
     expect(body.full_name).toBe("aaron/new-vault");
@@ -1258,12 +1289,41 @@ describe("handleMirrorImport", () => {
     expect(body.message).toContain("vault.yaml");
   });
 
+  test("git not installed returns 503 + git_not_installed + actionable message", async () => {
+    // vault#415 — live bug on a git-less Amazon Linux EC2 box. Force the
+    // preflight (via the whichOverride seam) to see no git; the spawn seam
+    // should never be reached.
+    home = tmp("import-route-nogit-");
+    await bootstrapVault(home);
+    let spawnCalled = false;
+    const spyingSpawn: GitSpawn = async () => {
+      spawnCalled = true;
+      return { exitCode: 0, stderr: "", timedOut: false };
+    };
+    const req = new Request("http://x/import", {
+      method: "POST",
+      body: JSON.stringify({
+        remote_url: "https://github.com/a/b.git",
+        mode: "merge",
+        credentials: { kind: "none" },
+      }),
+    });
+    const res = await handleMirrorImport(req, "default", spyingSpawn, () => null);
+    expect(res.status).toBe(503);
+    const body = (await res.json()) as { error_type: string; message: string };
+    expect(body.error_type).toBe("git_not_installed");
+    expect(body.message).toContain("git is required");
+    expect(body.message).toContain("dnf install git");
+    // Failed fast: the git spawn was never reached.
+    expect(spawnCalled).toBe(false);
+  });
+
   test("uses stored credentials when credentials: null (credentialsFile path)", async () => {
     home = tmp("import-route-stored-creds-");
     await bootstrapVault(home);
     fixture = await buildExportFixture();
     // Write a stored PAT credential matching github.com.
-    writeCredentials({
+    writeCredentials("default", {
       active_method: "pat",
       github_oauth: null,
       pat: {
@@ -1301,7 +1361,7 @@ describe("handleMirrorImport", () => {
     await bootstrapVault(home);
     fixture = await buildExportFixture();
     // Stored credentials should be IGNORED when per-call PAT is supplied.
-    writeCredentials({
+    writeCredentials("default", {
       active_method: "pat",
       github_oauth: null,
       pat: {

package/src/mirror-routes.ts

@@ -62,6 +62,7 @@ import {
   type ImportResult,
 } from "./mirror-import.ts";
 import { redactToken } from "./export-watch.ts";
+import { GitNotInstalledError, ensureGitAvailable } from "./git-preflight.ts";
 import { getVaultStore } from "./vault-store.ts";
 import { assetsDir } from "./routes.ts";
 
@@ -75,7 +76,11 @@ import { assetsDir } from "./routes.ts";
  * any persistence has happened yet.
  */
 export function handleMirrorGet(manager: MirrorManager): Response {
-  const config = manager.getConfig();
+  // Per-vault (vault#400): `getEffectiveConfig()` returns THIS vault's
+  // persisted config even when the lazily-built manager hasn't started yet,
+  // so a non-default vault's page shows ITS config — never the default
+  // vault's. That's the exact "same remote on every vault page" symptom.
+  const config = manager.getEffectiveConfig();
   const status = manager.getStatus();
   return Response.json(
     {
@@ -116,6 +121,10 @@ export function handleMirrorGet(manager: MirrorManager): Response {
 export async function handleMirrorPut(
   req: Request,
   manager: MirrorManager,
+  // Test seam for the external-path git-presence preflight (default
+  // `Bun.which` inside `validateExternalPath`). Inject a fn returning `null`
+  // to exercise the git_not_installed 503 path without uninstalling git.
+  whichOverride?: (cmd: string) => string | null,
 ): Promise<Response> {
   let body: unknown;
   try {
@@ -130,7 +139,9 @@ export async function handleMirrorPut(
     );
   }
 
-  const shape = validateMirrorConfigShape(body);
+  // Per-vault (vault#399): bind the auto_push/internal credential gate to
+  // the mirror-owning vault so it reads that vault's own credentials file.
+  const shape = validateMirrorConfigShape(body, { vaultName: manager.getVaultName() });
   if (!shape.ok) {
     return Response.json(
       {
@@ -148,7 +159,25 @@ export async function handleMirrorPut(
   // to *do* something with an external path. Disabling the mirror by-
   // flipping enabled to false shouldn't fail because the path went away.
   if (config.enabled && config.location === "external" && config.external_path) {
-    const pathCheck = await validateExternalPath(config.external_path);
+    let pathCheck;
+    try {
+      pathCheck = await validateExternalPath(config.external_path, whichOverride);
+    } catch (err) {
+      if (err instanceof GitNotInstalledError) {
+        // 503 git_not_installed — consistent with the import route. The
+        // server can't validate (or later sync) an external git mirror
+        // without git installed; the message tells the operator how to fix.
+        return Response.json(
+          {
+            error: "git not installed",
+            error_type: "git_not_installed",
+            message: err.message,
+          },
+          { status: 503 },
+        );
+      }
+      throw err;
+    }
     if (!pathCheck.ok) {
       return Response.json(
         {
@@ -456,7 +485,8 @@ export async function handleAuthGithubPoll(
       );
     }
     // Persist credentials. Keep any existing PAT — only swap active method.
-    const existing = readCredentials() ?? emptyCredentials();
+    const vaultName = manager.getVaultName();
+    const existing = readCredentials(vaultName) ?? emptyCredentials();
     const next: MirrorCredentials = {
       ...existing,
       active_method: "github_oauth",
@@ -469,7 +499,7 @@ export async function handleAuthGithubPoll(
       },
     };
     try {
-      writeCredentials(next);
+      writeCredentials(vaultName, next);
     } catch (err) {
       return Response.json(
         {
@@ -590,6 +620,26 @@ export async function handleAuthPat(
     );
   }
 
+  // Preflight: the validation probe (`git ls-remote`) and every later push
+  // shell `git`. On a git-less server, surface the friendly, actionable
+  // 503 instead of letting the probe's `Bun.spawn` throw a raw
+  // "Executable not found in $PATH: \"git\"".
+  try {
+    ensureGitAvailable();
+  } catch (err) {
+    if (err instanceof GitNotInstalledError) {
+      return Response.json(
+        {
+          error: "git not installed",
+          error_type: "git_not_installed",
+          message: err.message,
+        },
+        { status: 503 },
+      );
+    }
+    throw err;
+  }
+
   // Validate via `git ls-remote <embedded-auth-url>` — uses the same
   // x-access-token shape we'd embed at push time so the probe exercises
   // the actual auth path. If the operator pasted a URL that already has
@@ -615,9 +665,12 @@ export async function handleAuthPat(
   }
 
   // Save the userinfo'd URL — that's what gets embedded as `origin` so
-  // bare `git push` works without needing GIT_ASKPASS etc.
+  // bare `git push` works without needing GIT_ASKPASS etc. Per-vault
+  // (vault#399): the PAT + remote_url land in this vault's own file, not a
+  // server-wide one — so configuring vault B never reuses vault A's remote.
+  const vaultName = manager.getVaultName();
   const next: MirrorCredentials = {
-    ...(readCredentials() ?? emptyCredentials()),
+    ...(readCredentials(vaultName) ?? emptyCredentials()),
     active_method: "pat",
     pat: {
       token,
@@ -626,7 +679,7 @@ export async function handleAuthPat(
     },
   };
   try {
-    writeCredentials(next);
+    writeCredentials(vaultName, next);
   } catch (err) {
     return Response.json(
       {
@@ -721,10 +774,11 @@ async function probeGitLsRemote(
 }
 
 /**
- * `GET /.parachute/mirror/auth` — connection status (no secrets).
+ * `GET /.parachute/mirror/auth` — connection status (no secrets). Reads the
+ * mirror-owning vault's per-vault credentials (vault#399).
  */
-export function handleAuthGet(): Response {
-  const creds = readCredentials();
+export function handleAuthGet(manager: MirrorManager): Response {
+  const creds = readCredentials(manager.getVaultName());
   return Response.json(sanitizeCredentials(creds), {
     headers: { "Access-Control-Allow-Origin": "*" },
   });
@@ -735,7 +789,7 @@ export function handleAuthGet(): Response {
  * remote URL on the mirror dir.
  */
 export async function handleAuthDelete(manager: MirrorManager): Promise<Response> {
-  deleteCredentials();
+  deleteCredentials(manager.getVaultName());
   // Strip origin from the mirror dir if one is set.
   const status = manager.getStatus();
   if (status.mirror_path) {
@@ -757,9 +811,10 @@ export async function handleAuthDelete(manager: MirrorManager): Promise<Response
  * the stored OAuth token. Requires `active_method === "github_oauth"`.
  */
 export async function handleAuthGithubRepos(
+  manager: MirrorManager,
   fetchImpl?: FetchLike,
 ): Promise<Response> {
-  const creds = readCredentials();
+  const creds = readCredentials(manager.getVaultName());
   if (!creds || creds.active_method !== "github_oauth" || !creds.github_oauth) {
     return Response.json(
       {
@@ -794,9 +849,10 @@ export async function handleAuthGithubRepos(
  */
 export async function handleAuthGithubCreateRepo(
   req: Request,
+  manager: MirrorManager,
   fetchImpl?: FetchLike,
 ): Promise<Response> {
-  const creds = readCredentials();
+  const creds = readCredentials(manager.getVaultName());
   if (!creds || creds.active_method !== "github_oauth" || !creds.github_oauth) {
     return Response.json(
       {
@@ -849,7 +905,7 @@ export async function handleAuthGithubSelectRepo(
   req: Request,
   manager: MirrorManager,
 ): Promise<Response> {
-  const creds = readCredentials();
+  const creds = readCredentials(manager.getVaultName());
   if (!creds || creds.active_method !== "github_oauth" || !creds.github_oauth) {
     return Response.json(
       {
@@ -1023,7 +1079,7 @@ export async function applyCredentialsToMirror(
 ): Promise<void> {
   const status = manager.getStatus();
   if (!status.mirror_path) return;
-  const creds = readCredentials();
+  const creds = readCredentials(manager.getVaultName());
   if (!creds || !creds.active_method) {
     await unsetGitRemote(status.mirror_path);
     return;
@@ -1076,11 +1132,16 @@ export async function applyCredentialsToMirror(
  *
  * `spawnOverride` is a test seam: lets the test inject a fake git binary.
  * Production callers omit it; `cloneAndImport` falls back to `defaultGitSpawn`.
+ *
+ * `whichOverride` is a test seam for the git-presence preflight (default
+ * `Bun.which` inside `cloneAndImport`). Inject a fn returning `null` to
+ * exercise the git_not_installed 503 path without uninstalling git.
  */
 export async function handleMirrorImport(
   req: Request,
   vaultName: string,
   spawnOverride?: GitSpawn,
+  whichOverride?: (cmd: string) => string | null,
 ): Promise<Response> {
   let body: {
     remote_url?: unknown;
@@ -1195,8 +1256,21 @@ export async function handleMirrorImport(
       store,
       assetsDir: assets,
       spawn: spawnOverride,
+      which: whichOverride,
     });
   } catch (err) {
+    if (err instanceof GitNotInstalledError) {
+      // 503 Service Unavailable — the server isn't configured to do this
+      // yet (git missing). The message tells the operator how to fix it.
+      return Response.json(
+        {
+          error: "git not installed",
+          error_type: "git_not_installed",
+          message: err.message,
+        },
+        { status: 503 },
+      );
+    }
     if (err instanceof ImportConflictError) {
       return Response.json(
         {

package/src/routes.ts

@@ -564,7 +564,7 @@ async function handleNotesInner(
       //
       //   - **Flat date params** (DEPRECATED): `?date_field=created_at&
       //     date_from=…&date_to=…` and the legacy `?date_from=…&date_to=…`.
-      //     Still functional through 0.5.x; planned removal in 0.6.0
+      //     Still functional through 0.5.x; planned removal in a later 0.x
       //     (vault#288). New consumers should use bracket-style.
       //
       // Precedence on overlap: bracket-style wins. If a caller passes both
@@ -2077,7 +2077,13 @@ const MIME_TYPES: Record<string, string> = {
   ".mp4": "video/mp4",
 };
 
-export async function handleStorage(req: Request, path: string, vault: string): Promise<Response> {
+export async function handleStorage(
+  req: Request,
+  path: string,
+  vault: string,
+  store: Store,
+  tagScope: TagScopeCtx = NO_TAG_SCOPE,
+): Promise<Response> {
   const assets = assetsDir(vault);
 
   if (req.method === "POST" && path === "/upload") {
@@ -2121,6 +2127,37 @@ export async function handleStorage(req: Request, path: string, vault: string):
       return json({ error: "Not found" }, 404);
     }
 
+    // Tag-scope gate (C0 adversarial-audit finding). The note-keyed
+    // attachment surfaces (GET /notes/:id?include_attachments, GET
+    // /notes/:id/attachments, query results) are all gated behind
+    // `noteWithinTagScope`, but this raw byte-serve endpoint historically
+    // shipped bytes purely by filesystem path with only a path-traversal
+    // guard — so a tag-scoped token (scoped to e.g. ["work"]) could fetch
+    // an out-of-scope note's attachment bytes directly if it learned the
+    // storage path. Path secrecy (the 122-bit UUID in the filename) is NOT
+    // an access control. When the token is tag-scoped, reverse-lookup the
+    // requested path → owning attachment row(s) → note_id, and serve only
+    // if at least one owning note is within scope. Unscoped tokens
+    // (tagScope.raw === null) keep the prior behavior verbatim.
+    //
+    // 404 (not 403) on out-of-scope / no-owning-row, matching the
+    // note-level surfaces — don't create an existence oracle that confirms
+    // "this path exists but you can't see it."
+    if (tagScope.raw !== null) {
+      const rows = await store.getAttachmentsByPath(reqPath);
+      let allowed = false;
+      for (const att of rows) {
+        const note = await store.getNote(att.noteId);
+        if (note && noteWithinTagScope(note, tagScope.allowed, tagScope.raw)) {
+          allowed = true;
+          break;
+        }
+      }
+      if (!allowed) {
+        return json({ error: "Not found" }, 404);
+      }
+    }
+
     const stat = statSync(filePath);
     const ext = extname(filePath).toLowerCase();
     const contentType = MIME_TYPES[ext] ?? "application/octet-stream";