@openparachute/vault 0.7.0-rc.3 → 0.7.0-rc.4

package/src/mcp-query-notes-search-scope.test.ts

@@ -0,0 +1,136 @@
+/**
+ * Combined tag-scope × full-text-search enforcement (vault#554 carry-forward
+ * — "auth-561" review traced the code clean; this commits the self-verifying
+ * test the review promised).
+ *
+ * `applyTagScopeWrappers`'s `query-notes` wrapper (`src/mcp-tools.ts`) runs
+ * the ENTIRE search — content matching, `search_mode` escaping, `sort` — via
+ * core (scope-unaware by architecture), then filters the returned notes
+ * against the token's allowlist as a post-hoc array `.filter()`
+ * (`noteWithinTagScope`, `src/tag-scope.ts`). Because the filter is applied
+ * uniformly AFTER core returns, in principle no single (mode, sort)
+ * combination is special — but a regression in one code path (e.g. a search
+ * branch that bypasses the wrapper, or a shape the filter doesn't recognize)
+ * could still slip an out-of-scope note through for SOME combination. This
+ * test exercises the full `search_mode × sort` matrix and asserts the
+ * out-of-scope note never appears in any of them.
+ *
+ * Fixture: two notes both match the search term "widget" in punctuation-
+ * bearing content (so literal-mode escaping and advanced-mode raw FTS5 both
+ * still match it) — one tagged in-scope (`health`), one out-of-scope
+ * (`work`). A tag-scoped session ["health"] must see only the in-scope note
+ * across every (search_mode, sort) pairing.
+ */
+import { describe, test, expect, beforeEach, afterEach } from "bun:test";
+import { mkdirSync, rmSync, existsSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { writeVaultConfig } from "./config.ts";
+import { getVaultStore, clearVaultStoreCache } from "./vault-store.ts";
+import { generateScopedMcpTools } from "./mcp-tools.ts";
+import type { AuthResult } from "./auth.ts";
+import { SEARCH_MODES } from "../core/src/search-query.ts";
+
+let tmpHome: string;
+let prevHome: string | undefined;
+
+beforeEach(() => {
+  tmpHome = join(tmpdir(), `vault-search-scope-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+  mkdirSync(join(tmpHome, "vault", "data"), { recursive: true });
+  prevHome = process.env.PARACHUTE_HOME;
+  process.env.PARACHUTE_HOME = tmpHome;
+  clearVaultStoreCache();
+});
+
+afterEach(() => {
+  clearVaultStoreCache();
+  if (prevHome === undefined) delete process.env.PARACHUTE_HOME;
+  else process.env.PARACHUTE_HOME = prevHome;
+  if (existsSync(tmpHome)) rmSync(tmpHome, { recursive: true, force: true });
+});
+
+function seedVault(name: string): void {
+  writeVaultConfig({ name, api_keys: [], created_at: new Date().toISOString() });
+  getVaultStore(name);
+}
+
+function authFor(vaultName: string, scopedTags: string[] | null): AuthResult {
+  return {
+    permission: "full",
+    scopes: [`vault:${vaultName}:read`, `vault:${vaultName}:write`],
+    legacyDerived: false,
+    scoped_tags: scopedTags,
+    vault_name: null,
+    caller_jti: null,
+    actor: "test-user",
+    via: "api",
+  };
+}
+
+async function queryNotesTool(vaultName: string, scopedTags: string[] | null) {
+  const tools = generateScopedMcpTools(vaultName, authFor(vaultName, scopedTags));
+  return tools.find((t) => t.name === "query-notes")!;
+}
+
+// Normalize the tool's response (bare array, or {notes, next_cursor?,
+// warnings?} in cursor/warnings mode) down to the note-id list actually
+// returned — search is never cursor mode, but stays defensive to shape.
+function idsOf(result: unknown): string[] {
+  if (Array.isArray(result)) return result.map((n: any) => n.id);
+  const notes = (result as any)?.notes;
+  return Array.isArray(notes) ? notes.map((n: any) => n.id) : [];
+}
+
+describe("MCP query-notes search × tag-scope — combined enforcement (vault#554 carry-forward)", () => {
+  test("out-of-scope notes never appear across every search_mode × sort combination", async () => {
+    seedVault("journal");
+    const store = getVaultStore("journal");
+
+    // Punctuation-bearing content so literal-mode's escaping and
+    // advanced-mode's raw FTS5 passthrough both still match "widget"
+    // cleanly (advanced mode has no operator characters to trip on here).
+    const inScope = await store.createNote("didn't fix the widget yet", { tags: ["health"] });
+    const outOfScope = await store.createNote("ordered a replacement widget", { tags: ["work"] });
+
+    const tool = await queryNotesTool("journal", ["health"]);
+
+    const sorts: (undefined | "asc" | "desc")[] = [undefined, "asc", "desc"];
+    const modes: (undefined | (typeof SEARCH_MODES)[number])[] = [undefined, ...SEARCH_MODES];
+
+    for (const search_mode of modes) {
+      for (const sort of sorts) {
+        const params: Record<string, unknown> = { search: "widget" };
+        if (search_mode !== undefined) params.search_mode = search_mode;
+        if (sort !== undefined) params.sort = sort;
+
+        const result = await tool.execute(params);
+        const ids = idsOf(result);
+
+        expect(ids).toContain(inScope.id);
+        expect(ids).not.toContain(outOfScope.id);
+      }
+    }
+  });
+
+  test("unscoped session sees both notes across the same matrix (control)", async () => {
+    seedVault("journal");
+    const store = getVaultStore("journal");
+
+    const a = await store.createNote("didn't fix the widget yet", { tags: ["health"] });
+    const b = await store.createNote("ordered a replacement widget", { tags: ["work"] });
+
+    const tool = await queryNotesTool("journal", null);
+
+    for (const search_mode of [undefined, ...SEARCH_MODES]) {
+      for (const sort of [undefined, "asc", "desc"] as const) {
+        const params: Record<string, unknown> = { search: "widget" };
+        if (search_mode !== undefined) params.search_mode = search_mode;
+        if (sort !== undefined) params.sort = sort;
+
+        const ids = idsOf(await tool.execute(params));
+        expect(ids).toContain(a.id);
+        expect(ids).toContain(b.id);
+      }
+    }
+  });
+});

package/src/mcp-tools.ts

@@ -22,8 +22,12 @@ import {
   expandTokenTagScope,
   filterHydratedLinksByTagScope,
   noteWithinTagScope,
+  scrubIndexedFieldConflictError,
+  scrubTagFieldViolationsByScope,
   tagsWithinScope,
 } from "./tag-scope.ts";
+import { TagFieldConflictError } from "../core/src/tag-schemas.ts";
+import { IndexedFieldError } from "../core/src/indexed-fields.ts";
 import {
   findTokensReferencingTag,
   recordMcpMintLedger,
@@ -344,7 +348,7 @@ function applyTagScopeWrappers(
     if (result && typeof result === "object" && "id" in result && "tags" in result) {
       return noteWithinTagScope(result as any, allowed, rawTags)
         ? scrubNoteLinks(result)
-        : { error: "Note not found", id: (result as any).id };
+        : { error: "Note not found", error_type: "not_found", id: (result as any).id };
     }
     return result;
   });
@@ -470,7 +474,7 @@ function applyTagScopeWrappers(
       if (!id) continue;
       const existing = await store.getNote(id as string);
       if (!existing || !noteWithinTagScope(existing, allowed, rawTags)) {
-        return { error: "Note not found", id };
+        return { error: "Note not found", error_type: "not_found", id };
       }
       const removed = new Set<string>((item as any).tags?.remove ?? []);
       const projected = new Set<string>((existing.tags ?? []).filter((t) => !removed.has(t)));
@@ -489,7 +493,7 @@ function applyTagScopeWrappers(
     if (id) {
       const existing = await store.getNote(id as string);
       if (!existing || !noteWithinTagScope(existing, allowed, rawTags)) {
-        return { error: "Note not found", id };
+        return { error: "Note not found", error_type: "not_found", id };
       }
     }
     return await orig(params);
@@ -502,7 +506,37 @@ function applyTagScopeWrappers(
     if (typeof tag === "string" && !allowed.has(tag)) {
       return forbidden(`update-tag: tag "${tag}" is outside the token's allowlist`);
     }
-    return await orig(params);
+    try {
+      return await orig(params);
+    } catch (err: any) {
+      // Tag-scope scrub for cross-tag field conflicts (vault#554
+      // auth-and-scope fold). Core's validation scans EVERY tag's schema
+      // (scope-unaware by architecture), so its TagFieldConflictError can
+      // name an OUT-OF-SCOPE tag and reveal its declared type/flag in both
+      // the violation entries and the error message. The write stays
+      // rejected — schema integrity is scope-independent — but re-throw
+      // with scrubbed violations (out-of-scope declarers generalized, no
+      // tag name / declared type, `other_tag` dropped; in-scope declarers
+      // keep full detail). Rebuilding via the constructor also rebuilds
+      // the top-level message from the scrubbed entries. Same pattern as
+      // the list-tags `did_you_mean` scrub above.
+      if (err && err.code === "TAG_FIELD_CONFLICT" && Array.isArray(err.violations)) {
+        throw new TagFieldConflictError(
+          err.tag ?? (tag as string),
+          scrubTagFieldViolationsByScope(err.violations, allowed),
+        );
+      }
+      // Same leak through the OTHER door (wire-review interaction): a
+      // both-indexed cross-tag type conflict deliberately bypasses the
+      // pre-check (preserving its declareField → invalid_indexed_field
+      // contract), and declareField's IndexedFieldError message names the
+      // other declarer tag(s). Generalize for scoped callers; solo
+      // own-field IndexedFieldErrors (no declarer_tags) pass untouched.
+      if (err instanceof IndexedFieldError) {
+        throw scrubIndexedFieldConflictError(err, allowed);
+      }
+      throw err;
+    }
   });
 
   wrapReadTool(tools, "delete-tag", async (orig, params) => {
@@ -542,6 +576,16 @@ function overrideVaultInfo(
   if (!vaultInfo) return;
 
   vaultInfo.execute = async (params) => {
+    // NOTE (vault#554): these two throws are deliberately left as plain,
+    // unstructured `Error`s — NOT given `error_type` — even though the rest
+    // of this file's sweep attaches one everywhere else. Attaching one here
+    // routes the throw through mcp-http.ts's structured-error mapping, which
+    // surfaces it as a JSON-RPC protocol-level error (`response.error`)
+    // instead of the in-band tool result the existing contract test asserts
+    // (`response.result.isError === true`, `response.result.content[0].text`
+    // containing the scope name) — see "tools/call of vault-info with
+    // description arg and vault:read scope is refused" in src/vault.test.ts.
+    // Changing that transport shape is out of scope for this wave.
     const config = readVaultConfig(vaultName);
     if (!config) throw new Error(`Vault "${vaultName}" not found`);