@openparachute/vault 0.4.9-rc.9 → 0.5.0-rc.2

package/src/storage.test.ts

@@ -8,9 +8,14 @@
  */
 
 import { describe, test, expect, beforeAll, afterAll } from "bun:test";
-import { rmSync, existsSync, mkdirSync } from "fs";
+import { rmSync, existsSync, mkdirSync, writeFileSync } from "fs";
 import { join } from "path";
 import { tmpdir } from "os";
+import { Database } from "bun:sqlite";
+import { SqliteStore } from "../core/src/store.ts";
+import { initSchema } from "../core/src/schema.ts";
+import type { Store } from "../core/src/types.ts";
+import type { TagScopeCtx } from "./routes.ts";
 
 const testDir = join(
   tmpdir(),
@@ -20,6 +25,16 @@ process.env.PARACHUTE_HOME = testDir;
 process.env.ASSETS_DIR = join(testDir, "assets");
 
 const { handleStorage } = await import("./routes.ts");
+const { expandTokenTagScope } = await import("./tag-scope.ts");
+
+// The upload-allowlist tests never touch the store (POST /upload writes to
+// disk only); a fresh in-memory store satisfies the now-required param.
+function freshStore(): SqliteStore {
+  const db = new Database(":memory:");
+  initSchema(db);
+  return new SqliteStore(db);
+}
+const uploadStore = freshStore();
 
 function uploadRequest(filename: string, mimeType: string): Request {
   const form = new FormData();
@@ -33,6 +48,11 @@ function uploadRequest(filename: string, mimeType: string): Request {
   });
 }
 
+/** Build the per-request TagScopeCtx the dispatcher hands handlers. */
+async function tagScopeCtx(store: Store, scopedTags: string[] | null): Promise<TagScopeCtx> {
+  return { allowed: await expandTokenTagScope(store, scopedTags), raw: scopedTags };
+}
+
 beforeAll(() => {
   mkdirSync(testDir, { recursive: true });
   mkdirSync(join(testDir, "assets"), { recursive: true });
@@ -44,7 +64,7 @@ afterAll(() => {
 
 describe("storage upload allowlist", () => {
   test("accepts .pdf — knowledge-vault content (#127)", async () => {
-    const res = await handleStorage(uploadRequest("paper.pdf", "application/pdf"), "/upload", "default");
+    const res = await handleStorage(uploadRequest("paper.pdf", "application/pdf"), "/upload", "default", uploadStore);
     expect(res.status).toBe(201);
     const body = (await res.json()) as { mimeType: string; path: string };
     expect(body.mimeType).toBe("application/pdf");
@@ -52,7 +72,7 @@ describe("storage upload allowlist", () => {
   });
 
   test("accepts .mp4 — mobile capture default (#127)", async () => {
-    const res = await handleStorage(uploadRequest("clip.mp4", "video/mp4"), "/upload", "default");
+    const res = await handleStorage(uploadRequest("clip.mp4", "video/mp4"), "/upload", "default", uploadStore);
     expect(res.status).toBe(201);
     const body = (await res.json()) as { mimeType: string };
     expect(body.mimeType).toBe("video/mp4");
@@ -66,27 +86,132 @@ describe("storage upload allowlist", () => {
       ["photo.jpg", "image/jpeg"],
       ["clip.webm", "audio/webm"],
     ] as const) {
-      const res = await handleStorage(uploadRequest(name, mime), "/upload", "default");
+      const res = await handleStorage(uploadRequest(name, mime), "/upload", "default", uploadStore);
       expect(res.status).toBe(201);
     }
   });
 
   test("rejects .svg — XSS vector via inline <script> (#127)", async () => {
-    const res = await handleStorage(uploadRequest("evil.svg", "image/svg+xml"), "/upload", "default");
+    const res = await handleStorage(uploadRequest("evil.svg", "image/svg+xml"), "/upload", "default", uploadStore);
     expect(res.status).toBe(400);
     const body = (await res.json()) as { error: string };
     expect(body.error).toContain(".svg");
   });
 
   test("rejects .html — same XSS surface as SVG (#127)", async () => {
-    const res = await handleStorage(uploadRequest("evil.html", "text/html"), "/upload", "default");
+    const res = await handleStorage(uploadRequest("evil.html", "text/html"), "/upload", "default", uploadStore);
     expect(res.status).toBe(400);
     const body = (await res.json()) as { error: string };
     expect(body.error).toContain(".html");
   });
 
   test("rejects unknown extensions (default-deny)", async () => {
-    const res = await handleStorage(uploadRequest("payload.exe", "application/octet-stream"), "/upload", "default");
+    const res = await handleStorage(uploadRequest("payload.exe", "application/octet-stream"), "/upload", "default", uploadStore);
     expect(res.status).toBe(400);
   });
 });
+
+// ---------------------------------------------------------------------------
+// GET byte-serve tag-scope enforcement (C0 adversarial-audit finding).
+//
+// The raw `/api/storage/<date>/<file>` endpoint historically served bytes by
+// filesystem path with only a path-traversal guard — bypassing the tag-scope
+// enforcement that gates every note-keyed attachment surface. A tag-scoped
+// token could therefore fetch an out-of-scope note's attachment bytes
+// directly if it learned the (UUID-secret) storage path. These tests pin the
+// fix: in-scope → 200, out-of-scope → 404 (no existence oracle), unscoped →
+// 200 (regression), path-traversal guard intact (regression).
+// ---------------------------------------------------------------------------
+
+describe("storage GET tag-scope enforcement", () => {
+  // Each test builds its own vault assets dir + store so rows and on-disk
+  // files line up. `vault` names the assets subdir; ASSETS_DIR is global to
+  // the test process, so we point it at this vault's dir per test.
+  const VAULT = "scope-vault";
+
+  async function setup(): Promise<{
+    store: SqliteStore;
+    assets: string;
+    inScopePath: string;
+    outScopePath: string;
+  }> {
+    const store = freshStore();
+    const assets = join(testDir, "assets", VAULT, "data");
+    mkdirSync(join(assets, "2026-05-28"), { recursive: true });
+    process.env.ASSETS_DIR = assets;
+
+    // An in-scope (#work) note + attachment, and an out-of-scope (#health)
+    // note + attachment. Both files exist on disk.
+    const workNote = await store.createNote("work note", { tags: ["work"] });
+    const healthNote = await store.createNote("health note", { tags: ["health"] });
+
+    const inScopePath = "2026-05-28/work-asset.pdf";
+    const outScopePath = "2026-05-28/health-asset.pdf";
+    writeFileSync(join(assets, inScopePath), Buffer.from([0x25, 0x50, 0x44, 0x46])); // %PDF
+    writeFileSync(join(assets, outScopePath), Buffer.from([0x25, 0x50, 0x44, 0x46]));
+
+    await store.addAttachment(workNote.id, inScopePath, "application/pdf");
+    await store.addAttachment(healthNote.id, outScopePath, "application/pdf");
+
+    return { store, assets, inScopePath, outScopePath };
+  }
+
+  function getReq(reqPath: string): Request {
+    return new Request(`http://localhost:1940/storage/${reqPath}`, { method: "GET" });
+  }
+
+  test("tag-scoped token (work): GET in-scope attachment → 200 (bytes served)", async () => {
+    const { store, inScopePath } = await setup();
+    const ctx = await tagScopeCtx(store, ["work"]);
+    const res = await handleStorage(getReq(inScopePath), `/${inScopePath}`, VAULT, store, ctx);
+    expect(res.status).toBe(200);
+    expect(res.headers.get("Content-Type")).toBe("application/pdf");
+    expect((await res.arrayBuffer()).byteLength).toBe(4);
+  });
+
+  test("tag-scoped token (work): GET OUT-of-scope attachment → 404 (no existence oracle)", async () => {
+    const { store, outScopePath } = await setup();
+    const ctx = await tagScopeCtx(store, ["work"]);
+    const res = await handleStorage(getReq(outScopePath), `/${outScopePath}`, VAULT, store, ctx);
+    expect(res.status).toBe(404);
+  });
+
+  test("tag-scoped token: GET path with NO owning attachment row → 404", async () => {
+    const { store, assets } = await setup();
+    // A real on-disk file that no attachment row references — must 404 for a
+    // scoped token (would-be existence oracle otherwise).
+    const orphanPath = "2026-05-28/orphan-on-disk.pdf";
+    writeFileSync(join(assets, orphanPath), Buffer.from([0x25, 0x50, 0x44, 0x46]));
+    const ctx = await tagScopeCtx(store, ["work"]);
+    const res = await handleStorage(getReq(orphanPath), `/${orphanPath}`, VAULT, store, ctx);
+    expect(res.status).toBe(404);
+  });
+
+  test("unscoped token: GET any attachment → 200 (regression — no behavior change)", async () => {
+    const { store, outScopePath } = await setup();
+    const ctx = await tagScopeCtx(store, null); // unscoped
+    const res = await handleStorage(getReq(outScopePath), `/${outScopePath}`, VAULT, store, ctx);
+    expect(res.status).toBe(200);
+  });
+
+  test("default ctx (no tagScope arg): unscoped behavior — 200 (regression)", async () => {
+    const { store, outScopePath } = await setup();
+    const res = await handleStorage(getReq(outScopePath), `/${outScopePath}`, VAULT, store);
+    expect(res.status).toBe(200);
+  });
+
+  test("path-traversal guard still blocks ../ escapes (regression)", async () => {
+    const { store } = await setup();
+    const ctx = await tagScopeCtx(store, ["work"]);
+    // `/a/../../../etc/passwd` resolves outside assetsDir → 403 Invalid path.
+    const evil = "/a/../../../../../../etc/passwd";
+    const res = await handleStorage(
+      new Request(`http://localhost:1940/storage${evil}`, { method: "GET" }),
+      evil,
+      VAULT,
+      store,
+      ctx,
+    );
+    expect(res.status).toBe(403);
+  });
+});

package/src/token-store.test.ts

@@ -1,17 +1,24 @@
 /**
- * Tests for the token store — scoped tokens with permissions.
- * Tokens now live inside each vault's SQLite database (schema v7).
+ * Tests for the surviving token-store surface (vault#282 Stage 2).
+ *
+ * Vault no longer mints (`generateToken`/`createToken`) or validates
+ * (`resolveToken`) opaque pvt_* tokens — it's a pure hub resource-server. What
+ * remains in token-store.ts is the vestigial-row cleanup surface
+ * (`listTokens` / `revokeToken` / `findTokensReferencingTag`) and the legacy
+ * YAML-import landing zone (`migrateVaultKeys`, raw INSERT). These tests seed
+ * rows the way the surviving code does (migrateVaultKeys + raw INSERT) rather
+ * than via the removed mint path.
  */
 
 import { describe, test, expect, beforeEach, afterEach } from "bun:test";
 import { Database } from "bun:sqlite";
 import { initSchema } from "../core/src/schema.ts";
+import { hashKey } from "./config.ts";
 import {
-  generateToken,
-  createToken,
-  resolveToken,
   listTokens,
   revokeToken,
+  findTokensReferencingTag,
+  migrateVaultKeys,
 } from "./token-store.ts";
 
 let db: Database;
@@ -25,197 +32,109 @@ afterEach(() => {
   db.close();
 });
 
-describe("token CRUD", () => {
-  test("create and resolve a full-access token", () => {
-    const { fullToken } = generateToken();
-    createToken(db, fullToken, { label: "test-token", permission: "full" });
-
-    const resolved = resolveToken(db, fullToken);
-    expect(resolved).not.toBeNull();
-    expect(resolved!.permission).toBe("full");
-  });
-
-  test("token with read permission", () => {
-    const { fullToken } = generateToken();
-    createToken(db, fullToken, {
-      label: "reader",
-      permission: "read",
-    });
-
-    const resolved = resolveToken(db, fullToken);
-    expect(resolved!.permission).toBe("read");
-  });
-
-  test("default permission is full", () => {
-    const { fullToken } = generateToken();
-    createToken(db, fullToken, { label: "default-perm" });
-
-    const resolved = resolveToken(db, fullToken);
-    expect(resolved!.permission).toBe("full");
-  });
-
-  test("legacy admin permission normalizes to full", () => {
-    const { fullToken } = generateToken();
-    // Simulate a legacy token by writing "admin" directly to DB
-    const hash = require("./config.ts").hashKey(fullToken);
-    db.prepare("INSERT INTO tokens (token_hash, label, permission, created_at) VALUES (?, ?, ?, ?)")
-      .run(hash, "legacy-admin", "admin", new Date().toISOString());
-
-    const resolved = resolveToken(db, fullToken);
-    expect(resolved!.permission).toBe("full");
-  });
-
-  test("legacy write permission normalizes to full", () => {
-    const { fullToken } = generateToken();
-    const hash = require("./config.ts").hashKey(fullToken);
-    db.prepare("INSERT INTO tokens (token_hash, label, permission, created_at) VALUES (?, ?, ?, ?)")
-      .run(hash, "legacy-write", "write", new Date().toISOString());
-
-    const resolved = resolveToken(db, fullToken);
-    expect(resolved!.permission).toBe("full");
-  });
-
-  test("expired token is rejected", () => {
-    const { fullToken } = generateToken();
-    createToken(db, fullToken, {
-      label: "expired",
-      permission: "full",
-      expires_at: "2020-01-01T00:00:00.000Z", // in the past
-    });
-
-    const resolved = resolveToken(db, fullToken);
-    expect(resolved).toBeNull();
-  });
-
-  test("non-expired token is accepted", () => {
-    const { fullToken } = generateToken();
-    const future = new Date(Date.now() + 86400000).toISOString(); // +1 day
-    createToken(db, fullToken, {
-      label: "valid",
-      permission: "read",
-      expires_at: future,
-    });
-
-    const resolved = resolveToken(db, fullToken);
-    expect(resolved).not.toBeNull();
-    expect(resolved!.permission).toBe("read");
-  });
-
-  test("invalid token returns null", () => {
-    const resolved = resolveToken(db, "pvt_does_not_exist");
-    expect(resolved).toBeNull();
-  });
-
-  test("list tokens shows all tokens", () => {
-    const { fullToken: t1 } = generateToken();
-    const { fullToken: t2 } = generateToken();
-    createToken(db, t1, { label: "first", permission: "full" });
-    createToken(db, t2, { label: "second", permission: "read" });
+/** Seed a row the way migrateVaultKeys does — raw INSERT, no mint path. */
+function seedRow(
+  label: string,
+  opts: { permission?: string; vault_name?: string | null; scoped_tags?: string[] | null } = {},
+): string {
+  const hash = hashKey(`legacy-${label}-${Math.random()}`);
+  db.prepare(
+    `INSERT INTO tokens (token_hash, label, permission, scoped_tags, created_at, vault_name)
+     VALUES (?, ?, ?, ?, ?, ?)`,
+  ).run(
+    hash,
+    label,
+    opts.permission ?? "full",
+    opts.scoped_tags ? JSON.stringify(opts.scoped_tags) : null,
+    new Date().toISOString(),
+    opts.vault_name ?? null,
+  );
+  return `t_${hash.slice(7, 19)}`;
+}
+
+describe("listTokens", () => {
+  test("lists all rows with display IDs and normalized permission", () => {
+    seedRow("first", { permission: "full" });
+    seedRow("second", { permission: "read" });
 
     const tokens = listTokens(db);
     expect(tokens.length).toBe(2);
     expect(tokens.some((t) => t.label === "first")).toBe(true);
     expect(tokens.some((t) => t.label === "second")).toBe(true);
-    // Each token should have a display ID
     expect(tokens.every((t) => t.id.startsWith("t_"))).toBe(true);
   });
 
-  test("revoke token by display ID", () => {
-    const { fullToken } = generateToken();
-    createToken(db, fullToken, { label: "to-revoke" });
+  test("legacy admin/write permission normalizes to full", () => {
+    seedRow("legacy-admin", { permission: "admin" });
+    seedRow("legacy-write", { permission: "write" });
 
     const tokens = listTokens(db);
-    expect(tokens.length).toBe(1);
-
-    const revoked = revokeToken(db, tokens[0].id);
-    expect(revoked).toBe(true);
-
-    const after = listTokens(db);
-    expect(after.length).toBe(0);
-
-    // Token should no longer resolve
-    expect(resolveToken(db, fullToken)).toBeNull();
-  });
-
-  test("revoke non-existent token returns false", () => {
-    expect(revokeToken(db, "t_doesnotexist")).toBe(false);
+    expect(tokens.every((t) => t.permission === "full")).toBe(true);
   });
+});
 
-  test("resolve updates last_used_at", () => {
-    const { fullToken } = generateToken();
-    createToken(db, fullToken, { label: "usage-tracking" });
+describe("per-vault filter (v16, vestigial)", () => {
+  test("vaultName filter returns matching + legacy NULL rows", () => {
+    seedRow("boulder", { vault_name: "boulder" });
+    seedRow("default-vault", { vault_name: "default" });
+    seedRow("server-wide", { vault_name: null });
 
-    // Before first use
-    const before = listTokens(db);
-    expect(before[0].last_used_at).toBeNull();
+    const boulderTokens = listTokens(db, { vaultName: "boulder" });
+    expect(boulderTokens.map((t) => t.label).sort()).toEqual(["boulder", "server-wide"]);
 
-    // Resolve (which should update last_used_at)
-    resolveToken(db, fullToken);
+    const defaultTokens = listTokens(db, { vaultName: "default" });
+    expect(defaultTokens.map((t) => t.label).sort()).toEqual(["default-vault", "server-wide"]);
 
-    const after = listTokens(db);
-    expect(after[0].last_used_at).not.toBeNull();
+    // No filter → everything.
+    expect(listTokens(db).length).toBe(3);
   });
 });
 
-describe("per-vault binding (v16)", () => {
-  test("createToken without vault_name leaves the column NULL (legacy / server-wide)", () => {
-    const { fullToken } = generateToken();
-    createToken(db, fullToken, { label: "legacy" });
-
-    const resolved = resolveToken(db, fullToken);
-    expect(resolved!.vault_name).toBeNull();
+describe("revokeToken", () => {
+  test("revokes by display ID", () => {
+    const id = seedRow("to-revoke");
+    expect(listTokens(db).length).toBe(1);
 
-    const [row] = listTokens(db);
-    expect(row!.vault_name).toBeNull();
+    expect(revokeToken(db, id)).toBe(true);
+    expect(listTokens(db).length).toBe(0);
   });
 
-  test("createToken with vault_name binds the token to that vault", () => {
-    const { fullToken } = generateToken();
-    createToken(db, fullToken, { label: "boulder-bound", vault_name: "boulder" });
-
-    const resolved = resolveToken(db, fullToken);
-    expect(resolved!.vault_name).toBe("boulder");
-
-    const [row] = listTokens(db);
-    expect(row!.vault_name).toBe("boulder");
+  test("returns false for a non-existent id", () => {
+    expect(revokeToken(db, "t_doesnotexist")).toBe(false);
   });
+});
 
-  test("listTokens with vaultName filter returns matching + legacy NULL tokens", () => {
-    // Per the contract: per-vault listings show tokens bound to THIS vault
-    // plus any server-wide (NULL) tokens. The latter authenticate cross-vault
-    // by design, so the operator should be able to see + revoke them in any
-    // vault's admin UI. Tokens bound to OTHER vaults are excluded.
-    const { fullToken: tA } = generateToken();
-    const { fullToken: tB } = generateToken();
-    const { fullToken: tLegacy } = generateToken();
-    createToken(db, tA, { label: "boulder", vault_name: "boulder" });
-    createToken(db, tB, { label: "default-vault", vault_name: "default" });
-    createToken(db, tLegacy, { label: "server-wide" });
-
-    const boulderTokens = listTokens(db, { vaultName: "boulder" });
-    expect(boulderTokens.map((t) => t.label).sort()).toEqual(["boulder", "server-wide"]);
-
-    const defaultTokens = listTokens(db, { vaultName: "default" });
-    expect(defaultTokens.map((t) => t.label).sort()).toEqual(["default-vault", "server-wide"]);
+describe("findTokensReferencingTag", () => {
+  test("matches rows whose scoped_tags allowlist names the root tag", () => {
+    seedRow("health-scoped", { scoped_tags: ["health"] });
+    seedRow("work-scoped", { scoped_tags: ["work"] });
+    seedRow("unscoped");
 
-    // No filter → everything.
-    const all = listTokens(db);
-    expect(all.length).toBe(3);
+    const matches = findTokensReferencingTag(db, "health");
+    expect(matches.map((m) => m.label)).toEqual(["health-scoped"]);
   });
 });
 
-describe("token generation", () => {
-  test("generated tokens have pvt_ prefix", () => {
-    const { fullToken, tokenHash } = generateToken();
-    expect(fullToken.startsWith("pvt_")).toBe(true);
-    expect(tokenHash.startsWith("sha256:")).toBe(true);
-  });
+describe("migrateVaultKeys — legacy YAML import landing zone", () => {
+  test("imports per-vault + global YAML keys via raw INSERT (idempotent)", () => {
+    const vaultKeys = [
+      { key_hash: hashKey("yaml-vault-key"), label: "vault-key", scope: "read", created_at: "2026-01-01T00:00:00Z" },
+    ];
+    const globalKeys = [
+      { key_hash: hashKey("yaml-global-key"), label: "global-key", created_at: "2026-01-01T00:00:00Z" },
+    ];
+
+    const migrated = migrateVaultKeys(db, vaultKeys, globalKeys);
+    expect(migrated).toBe(2);
 
-  test("generated tokens are unique", () => {
-    const t1 = generateToken();
-    const t2 = generateToken();
-    expect(t1.fullToken).not.toBe(t2.fullToken);
-    expect(t1.tokenHash).not.toBe(t2.tokenHash);
+    const tokens = listTokens(db);
+    expect(tokens.map((t) => t.label).sort()).toEqual(["global-key", "vault-key"]);
+    // Per-vault read key keeps read permission; global key becomes full.
+    expect(tokens.find((t) => t.label === "vault-key")?.permission).toBe("read");
+    expect(tokens.find((t) => t.label === "global-key")?.permission).toBe("full");
+
+    // Re-running skips already-imported hashes (idempotent).
+    expect(migrateVaultKeys(db, vaultKeys, globalKeys)).toBe(0);
+    expect(listTokens(db).length).toBe(2);
   });
 });
-