@openparachute/vault 0.7.0-rc.2 → 0.7.0-rc.4

package/src/tag-field-conflict-scope.test.ts

@@ -0,0 +1,333 @@
+/**
+ * Tag-scope scrub on cross-tag field-conflict errors (vault#554
+ * auth-and-scope review fold, refined by the wire review).
+ *
+ * Core's cross-tag field validation (`collectCrossTagFieldViolations` /
+ * `collectTagFieldViolations`, core/src/tag-schemas.ts) scans EVERY tag's
+ * schema — scope-unaware by architecture — so a tag-scoped caller updating
+ * its own in-scope tag used to receive violations NAMING an out-of-scope
+ * tag and revealing its declared type/indexed flag (proven live on both MCP
+ * and REST during review). The fix keeps the rejection (schema integrity is
+ * scope-independent) but generalizes any violation whose conflicting
+ * declarer is outside the caller's allowlist: no tag name, no declared
+ * type/flag, `other_tag` dropped (`scrubTagFieldViolationsByScope`,
+ * src/tag-scope.ts). In-scope declarers keep full detail; unscoped callers
+ * are untouched.
+ *
+ * The same information leaks through a SECOND door (wire-review
+ * interaction): a BOTH-indexed cross-tag type conflict deliberately
+ * bypasses the 422 pre-check to preserve its pre-existing `declareField` →
+ * 400 `invalid_indexed_field` contract, and declareField's message names
+ * the other declarer tag(s) + their sqlite type. `scrubIndexedFieldConflictError`
+ * generalizes that message for scoped callers — same 400, same error_type,
+ * no leak. Covered on both surfaces below.
+ *
+ * Fixture: PARACHUTE_HOME temp home + hand-built AuthResult, same pattern
+ * as mcp-list-tags-scope.test.ts.
+ */
+import { describe, test, expect, beforeEach, afterEach } from "bun:test";
+import { mkdirSync, rmSync, existsSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { writeVaultConfig } from "./config.ts";
+import { getVaultStore, clearVaultStoreCache } from "./vault-store.ts";
+import { generateScopedMcpTools } from "./mcp-tools.ts";
+import { handleTags } from "./routes.ts";
+import type { AuthResult } from "./auth.ts";
+import { TagFieldConflictError } from "../core/src/tag-schemas.ts";
+import { IndexedFieldError } from "../core/src/indexed-fields.ts";
+
+let tmpHome: string;
+let prevHome: string | undefined;
+
+beforeEach(() => {
+  tmpHome = join(tmpdir(), `vault-tagconflict-scope-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+  mkdirSync(join(tmpHome, "vault", "data"), { recursive: true });
+  prevHome = process.env.PARACHUTE_HOME;
+  process.env.PARACHUTE_HOME = tmpHome;
+  clearVaultStoreCache();
+});
+
+afterEach(() => {
+  clearVaultStoreCache();
+  if (prevHome === undefined) delete process.env.PARACHUTE_HOME;
+  else process.env.PARACHUTE_HOME = prevHome;
+  if (existsSync(tmpHome)) rmSync(tmpHome, { recursive: true, force: true });
+});
+
+function seedVault(name: string): void {
+  writeVaultConfig({ name, api_keys: [], created_at: new Date().toISOString() });
+  getVaultStore(name);
+}
+
+function authFor(vaultName: string, scopedTags: string[] | null): AuthResult {
+  return {
+    permission: "full",
+    scopes: [`vault:${vaultName}:read`, `vault:${vaultName}:write`],
+    legacyDerived: false,
+    scoped_tags: scopedTags,
+    vault_name: null,
+    caller_jti: null,
+    actor: "test-user",
+    via: "api",
+  };
+}
+
+async function updateTagTool(vaultName: string, scopedTags: string[] | null) {
+  const tools = generateScopedMcpTools(vaultName, authFor(vaultName, scopedTags));
+  return tools.find((t) => t.name === "update-tag")!;
+}
+
+/** Everything an agent-facing serialization of the error could carry. */
+function serializeError(err: TagFieldConflictError): string {
+  return JSON.stringify({ message: err.message, tag: err.tag, violations: err.violations });
+}
+
+describe("tag_field_conflict × tag scope — out-of-scope declarers scrubbed (vault#554 fold)", () => {
+  test("MCP: scoped caller + out-of-scope NON-indexed type conflict → still rejected (422 class), but the out-of-scope tag's name and schema appear NOWHERE in the error", async () => {
+    seedVault("journal");
+    const store = getVaultStore("journal");
+    // Out-of-scope declarer with a distinctive name + type (non-indexed —
+    // the both-indexed variant routes through the 400 path, tested below).
+    await store.upsertTagRecord("project-manhattan", {
+      fields: { x: { type: "string" } },
+    });
+    // Caller's own in-scope tag.
+    await store.upsertTagRecord("mine", { description: "in scope" });
+
+    const tool = await updateTagTool("journal", ["mine"]);
+    let caught: unknown;
+    try {
+      await tool.execute({ tag: "mine", fields: { x: { type: "integer" } } });
+    } catch (e) {
+      caught = e;
+    }
+
+    // The write is STILL rejected — integrity is scope-independent.
+    expect(caught).toBeInstanceOf(TagFieldConflictError);
+    const err = caught as TagFieldConflictError;
+    expect(err.violations).toHaveLength(1);
+    expect(err.violations[0]!.field).toBe("x");
+    expect(err.violations[0]!.reason).toBe("type_conflict");
+    expect(err.message).toContain("no changes were applied");
+
+    // The scrub: no tag name, no declared type, no other_tag — anywhere.
+    expect(err.violations[0]!.other_tag).toBeUndefined();
+    const serialized = serializeError(err);
+    expect(serialized).not.toContain("project-manhattan");
+    expect(serialized).not.toContain('declares "string"');
+
+    // Nothing persisted.
+    const mine = await store.getTagRecord("mine");
+    expect(mine?.fields ?? null).toBeFalsy();
+  });
+
+  test("MCP: scoped caller + IN-scope conflict keeps full detail (tag name + declared type + other_tag)", async () => {
+    seedVault("journal");
+    const store = getVaultStore("journal");
+    await store.upsertTagRecord("mine-too", {
+      fields: { x: { type: "string" } },
+    });
+    await store.upsertTagRecord("mine", { description: "in scope" });
+
+    const tool = await updateTagTool("journal", ["mine", "mine-too"]);
+    let caught: unknown;
+    try {
+      await tool.execute({ tag: "mine", fields: { x: { type: "integer" } } });
+    } catch (e) {
+      caught = e;
+    }
+
+    expect(caught).toBeInstanceOf(TagFieldConflictError);
+    const err = caught as TagFieldConflictError;
+    expect(err.violations).toHaveLength(1);
+    expect(err.violations[0]!.other_tag).toBe("mine-too");
+    expect(err.violations[0]!.message).toContain("mine-too");
+    expect(err.violations[0]!.message).toContain('declares "string"');
+  });
+
+  test("REST: scoped caller + out-of-scope NON-indexed type conflict → 422 with generalized violation, out-of-scope tag name nowhere in the body", async () => {
+    seedVault("journal");
+    const store = getVaultStore("journal");
+    await store.upsertTagRecord("project-manhattan", {
+      fields: { x: { type: "string" } },
+    });
+    await store.upsertTagRecord("mine", { description: "in scope" });
+
+    const req = new Request("http://localhost/api/tags/mine", {
+      method: "PUT",
+      body: JSON.stringify({ fields: { x: { type: "integer" } } }),
+    });
+    const res = await handleTags(req, store, "/mine", {
+      allowed: new Set(["mine"]),
+      raw: ["mine"],
+    });
+
+    expect(res.status).toBe(422);
+    const body: any = await res.json();
+    expect(body.error_type).toBe("tag_field_conflict");
+    expect(body.violations).toHaveLength(1);
+    expect(body.violations[0].field).toBe("x");
+    expect(body.violations[0].reason).toBe("type_conflict");
+    expect(body.violations[0].other_tag).toBeUndefined();
+    expect(body.message).toContain("no changes were applied");
+
+    const serialized = JSON.stringify(body);
+    expect(serialized).not.toContain("project-manhattan");
+    expect(serialized).not.toContain('declares "string"');
+
+    const mine = await store.getTagRecord("mine");
+    expect(mine?.fields ?? null).toBeFalsy();
+  });
+
+  test("REST: scoped caller + IN-scope conflict keeps full detail", async () => {
+    seedVault("journal");
+    const store = getVaultStore("journal");
+    await store.upsertTagRecord("mine-too", {
+      fields: { x: { type: "string" } },
+    });
+    await store.upsertTagRecord("mine", { description: "in scope" });
+
+    const req = new Request("http://localhost/api/tags/mine", {
+      method: "PUT",
+      body: JSON.stringify({ fields: { x: { type: "integer" } } }),
+    });
+    const res = await handleTags(req, store, "/mine", {
+      allowed: new Set(["mine", "mine-too"]),
+      raw: ["mine", "mine-too"],
+    });
+
+    expect(res.status).toBe(422);
+    const body: any = await res.json();
+    expect(body.violations).toHaveLength(1);
+    expect(body.violations[0].other_tag).toBe("mine-too");
+    expect(body.violations[0].message).toContain("mine-too");
+    expect(body.violations[0].message).toContain('declares "string"');
+  });
+
+  test("unscoped callers keep full detail everywhere (MCP + REST controls)", async () => {
+    seedVault("journal");
+    const store = getVaultStore("journal");
+    await store.upsertTagRecord("project-manhattan", {
+      fields: { x: { type: "string" } },
+    });
+
+    // MCP — unscoped session: applyTagScopeWrappers never installs, core's
+    // full-detail error passes through untouched.
+    const tool = await updateTagTool("journal", null);
+    let caught: unknown;
+    try {
+      await tool.execute({ tag: "mine", fields: { x: { type: "integer" } } });
+    } catch (e) {
+      caught = e;
+    }
+    const err = caught as TagFieldConflictError;
+    expect(err.violations[0]!.other_tag).toBe("project-manhattan");
+    expect(err.violations[0]!.message).toContain("project-manhattan");
+
+    // REST — unscoped ctx (allowed === null): scrub is a no-op.
+    const req = new Request("http://localhost/api/tags/mine", {
+      method: "PUT",
+      body: JSON.stringify({ fields: { x: { type: "integer" } } }),
+    });
+    const res = await handleTags(req, store, "/mine");
+    expect(res.status).toBe(422);
+    const body: any = await res.json();
+    expect(body.violations[0].other_tag).toBe("project-manhattan");
+    expect(body.violations[0].message).toContain("project-manhattan");
+  });
+});
+
+describe("invalid_indexed_field × tag scope — the 400 door is scrubbed too (wire-review interaction)", () => {
+  test("REST: scoped caller + BOTH-indexed type conflict vs out-of-scope tag → 400 invalid_indexed_field (status preserved) with a generalized message", async () => {
+    seedVault("journal");
+    const store = getVaultStore("journal");
+    await store.upsertTagRecord("project-manhattan", {
+      fields: { x: { type: "string", indexed: true } },
+    });
+    await store.upsertTagRecord("mine", { description: "in scope" });
+
+    const req = new Request("http://localhost/api/tags/mine", {
+      method: "PUT",
+      body: JSON.stringify({ fields: { x: { type: "integer", indexed: true } } }),
+    });
+    const res = await handleTags(req, store, "/mine", {
+      allowed: new Set(["mine"]),
+      raw: ["mine"],
+    });
+
+    // Status + error_type are the PRESERVED pre-existing contract; only
+    // the message prose is generalized for the scoped caller.
+    expect(res.status).toBe(400);
+    const body: any = await res.json();
+    expect(body.error_type).toBe("invalid_indexed_field");
+    expect(body.error).toContain('field "x"');
+    expect(body.error).toContain("outside your token's tag scope");
+    const serialized = JSON.stringify(body);
+    expect(serialized).not.toContain("project-manhattan");
+    expect(serialized).not.toContain("TEXT"); // the existing sqlite type stays hidden too
+
+    // Still rejected — nothing persisted.
+    const mine = await store.getTagRecord("mine");
+    expect(mine?.fields ?? null).toBeFalsy();
+  });
+
+  test("MCP: scoped caller + BOTH-indexed type conflict vs out-of-scope tag → IndexedFieldError with a generalized message", async () => {
+    seedVault("journal");
+    const store = getVaultStore("journal");
+    await store.upsertTagRecord("project-manhattan", {
+      fields: { x: { type: "string", indexed: true } },
+    });
+    await store.upsertTagRecord("mine", { description: "in scope" });
+
+    const tool = await updateTagTool("journal", ["mine"]);
+    let caught: any;
+    try {
+      await tool.execute({ tag: "mine", fields: { x: { type: "integer", indexed: true } } });
+    } catch (e) {
+      caught = e;
+    }
+
+    expect(caught).toBeInstanceOf(IndexedFieldError);
+    expect(caught.error_type).toBe("invalid_indexed_field");
+    expect(caught.message).toContain("outside your token's tag scope");
+    expect(caught.message).not.toContain("project-manhattan");
+    expect(caught.message).not.toContain("TEXT");
+    // The structured declarer context is dropped from the scrubbed error.
+    expect(caught.declarer_tags).toBeUndefined();
+  });
+
+  test("both-indexed conflict vs an IN-scope tag keeps declareField's full message on both surfaces", async () => {
+    seedVault("journal");
+    const store = getVaultStore("journal");
+    await store.upsertTagRecord("mine-too", {
+      fields: { x: { type: "string", indexed: true } },
+    });
+    await store.upsertTagRecord("mine", { description: "in scope" });
+
+    // REST
+    const req = new Request("http://localhost/api/tags/mine", {
+      method: "PUT",
+      body: JSON.stringify({ fields: { x: { type: "integer", indexed: true } } }),
+    });
+    const res = await handleTags(req, store, "/mine", {
+      allowed: new Set(["mine", "mine-too"]),
+      raw: ["mine", "mine-too"],
+    });
+    expect(res.status).toBe(400);
+    const body: any = await res.json();
+    expect(body.error_type).toBe("invalid_indexed_field");
+    expect(body.error).toContain("mine-too");
+
+    // MCP
+    const tool = await updateTagTool("journal", ["mine", "mine-too"]);
+    let caught: any;
+    try {
+      await tool.execute({ tag: "mine", fields: { x: { type: "integer", indexed: true } } });
+    } catch (e) {
+      caught = e;
+    }
+    expect(caught).toBeInstanceOf(IndexedFieldError);
+    expect(caught.message).toContain("mine-too");
+  });
+});

package/src/tag-scope.ts

@@ -20,6 +20,8 @@
  */
 
 import type { Store, Note, HydratedLink, NoteSummary } from "../core/src/types.ts";
+import type { TagFieldViolation } from "../core/src/tag-schemas.ts";
+import { IndexedFieldError } from "../core/src/indexed-fields.ts";
 
 /**
  * Build the effective tag-allowlist for a token: union of `{root} ∪
@@ -167,6 +169,70 @@ export function filterHydratedLinksByTagScope(
   );
 }
 
+/**
+ * Scrub `tag_field_conflict` violations for a tag-scoped caller
+ * (vault#554 auth-and-scope review fold). Core's cross-tag field
+ * validation (`collectCrossTagFieldViolations` / `collectTagFieldViolations`
+ * in core/src/tag-schemas.ts) scans EVERY tag's schema — scope-unaware by
+ * architecture — so a scoped caller updating its own in-scope tag can
+ * receive a violation whose `message` names an OUT-OF-SCOPE tag and
+ * reveals its declared type/indexed flag (proven live on both MCP and
+ * REST). Policy: the write is STILL rejected (schema integrity is
+ * scope-independent — do not weaken the check), but the violation entry
+ * for an out-of-scope conflicting declarer is generalized: no tag name,
+ * no declared type/flag, `other_tag` dropped. In-scope conflicting
+ * declarers keep full detail; solo own-field violations (no `other_tag`)
+ * pass through untouched; unscoped callers (`allowed === null`) keep full
+ * detail everywhere.
+ *
+ * Membership is `allowed.has(other_tag)` — the same convention the
+ * `did_you_mean` scrub and the update-tag/delete-tag wrappers use in
+ * src/mcp-tools.ts (no string-form root fallback: when in doubt, scrub —
+ * the fail-closed direction only costs detail, never correctness).
+ */
+export function scrubTagFieldViolationsByScope(
+  violations: TagFieldViolation[],
+  allowed: Set<string> | null,
+): TagFieldViolation[] {
+  if (allowed === null) return violations;
+  return violations.map((v) => {
+    if (v.other_tag === undefined || allowed.has(v.other_tag)) return v;
+    const generalized =
+      v.reason === "type_conflict"
+        ? `field "${v.field}" type conflict: another tag (outside your token's tag scope) declares this field with a different type. Types must agree across all declarers.`
+        : `field "${v.field}" indexed-flag conflict: another tag (outside your token's tag scope) declares this field with a different indexed flag. Must match across all declarers.`;
+    const { other_tag: _dropped, ...rest } = v;
+    return { ...rest, message: generalized };
+  });
+}
+
+/**
+ * Companion scrub for the OTHER door the same information can leak
+ * through (vault#554 auth-and-scope × wire-review interaction): a
+ * both-indexed cross-tag type conflict deliberately bypasses the
+ * `tag_field_conflict` pre-check (preserving its pre-existing
+ * `declareField` → 400 `invalid_indexed_field` contract — see
+ * `collectCrossTagFieldViolations`'s doc comment), and declareField's
+ * message names the other declarer tag(s) plus their sqlite type. For a
+ * tag-scoped caller with any out-of-scope declarer, return a REPLACEMENT
+ * `IndexedFieldError` with a generalized message (no tag names, no
+ * existing type) — same rejection, same 400 status, same `error_type`,
+ * just no leak. If every declarer is in scope (or the error carries no
+ * `declarer_tags` — the solo own-field throws), or the caller is unscoped
+ * (`allowed === null`), the original error is returned untouched.
+ */
+export function scrubIndexedFieldConflictError(
+  err: IndexedFieldError & { field?: string; declarer_tags?: string[] },
+  allowed: Set<string> | null,
+): IndexedFieldError {
+  if (allowed === null) return err;
+  if (!Array.isArray(err.declarer_tags) || err.declarer_tags.length === 0) return err;
+  if (err.declarer_tags.every((t) => allowed.has(t))) return err;
+  return new IndexedFieldError(
+    `field "${err.field ?? "?"}" is already indexed by another tag (outside your token's tag scope) with a conflicting type. Types must agree across all declarers.`,
+  );
+}
+
 /**
  * Standard 403 response shape for tag-scope rejections. Mirrors the
  * `insufficient_scope` 403 shape used elsewhere in the API so clients

package/src/ws-subscribe.test.ts

@@ -440,6 +440,20 @@ describe("WS live-query — bad query + cap", () => {
     expect((await res.json()).code).toBe("UNSUPPORTED_SUBSCRIPTION_QUERY");
   });
 
+  // vault#551 — literal-by-default search + `search_mode` are a
+  // snapshot/REST-only concept (escaping happens in `core/src/notes.ts`
+  // `searchNotes`, which the live matcher never calls). `search` itself
+  // stays categorically unsupported for live subscriptions regardless of
+  // mode — confirms `search_mode` doesn't accidentally open a bypass.
+  it("rejects an unsupported query with search_mode present too — search_mode doesn't bypass the search rejection", async () => {
+    const { server } = makeServer();
+    const res = await fetch(`http://localhost:${server.port}/vault/${VAULT}/api/subscribe?search=hi&search_mode=advanced`, {
+      headers: { Upgrade: "websocket", Connection: "Upgrade", "Sec-WebSocket-Key": "x", "Sec-WebSocket-Version": "13" },
+    });
+    expect(res.status).toBe(400);
+    expect((await res.json()).code).toBe("UNSUPPORTED_SUBSCRIPTION_QUERY");
+  });
+
   it("refuses over the per-vault cap (503) and self-heals when a socket closes", async () => {
     const { binding } = makeServer({ maxSubscriptions: 2 });
     const fakeWs = (): { data: SubscribeWsData; close(): void; send(): void } => ({