@openparachute/vault 0.7.3-rc.13 → 0.7.3-rc.2

package/src/routes.ts

@@ -42,10 +42,6 @@ import {
   type ContentRange,
 } from "../core/src/content-range.ts";
 import { attachValidationStatus, enforceStrictWrite, applySchemaDefaults } from "../core/src/mcp.ts";
-import {
-  BLOCKED_ATTACHMENT_EXTENSIONS,
-  ATTACHMENT_MIME_TYPES,
-} from "../core/src/attachment/policy.ts";
 import type { ValidationWarning } from "../core/src/schema-defaults.ts";
 import { logStrictBypass } from "./scopes.ts";
 import * as linkOps from "../core/src/links.ts";
@@ -143,7 +139,7 @@ import {
   type ExpandMode,
 } from "../core/src/expand.ts";
 import { join, extname, normalize } from "path";
-import { existsSync, mkdirSync, statSync, unlinkSync, writeFileSync } from "fs";
+import { existsSync, mkdirSync, readFileSync, statSync, unlinkSync, writeFileSync } from "fs";
 import { assetsDir, readGlobalConfig, readVaultConfig } from "./config.ts";
 import { shouldAutoTranscribe } from "./auto-transcribe.ts";
 // usage.ts imports `assetsDir` from config.ts (neutral ground), so this import
@@ -4444,64 +4440,97 @@ export const MAX_UPLOAD_BYTES = 100 * 1024 * 1024; // 100MB
  */
 export const MAX_REQUEST_BODY_BYTES = MAX_UPLOAD_BYTES + 20 * 1024 * 1024; // 120MB
 
-// Storage upload policy (extension blocklist + MIME lookup) now lives in
-// core/src/attachment/policy.ts — the canonical source shared with the
-// attachment-ticket mint/spend path (vault attachment-tickets design,
-// "shared BLOCKED_EXTENSIONS"), so a blocked extension can never diverge
-// between REST and tickets. See that module's doc comment for the full
-// same-origin-XSS rationale and the MIME curation invariant.
-const BLOCKED_EXTENSIONS = BLOCKED_ATTACHMENT_EXTENSIONS;
-const MIME_TYPES = ATTACHMENT_MIME_TYPES;
-
-/**
- * Parse a single-range `Range: bytes=a-b` header (RFC 7233 §2.1 — single
- * range only, attachments-for-agents design D9, the REST twin of MCP's
- * `content_offset`). Returns `null` — this function's own contract is
- * "serve the full response, unranged" — for a missing header, a
- * MALFORMED value, an unrecognized unit, a multi-range list
- * (`bytes=0-10,20-30` — ignored, not an error, per D9), or a range this
- * file can't satisfy (a `start` past EOF). `start`/`end` are both
- * INCLUSIVE byte offsets; `end` is clamped to `total - 1` when the
- * request left it open (`bytes=500-`) or asked past EOF.
- *
- * IMPORTANT — this `null` contract is NOT the last word for an
- * unsatisfiable (syntactically-valid but out-of-bounds) range on a real
- * `Bun.serve()` deployment. Live-verified against an actual socket (not
- * the in-process `handleStorage()` call the test suite uses): when the
- * response body is a `Bun.file()` — which `handleStorage`'s full-response
- * branch below always hands back — Bun's OWN runtime transparently
- * reinterprets the incoming request's `Range` header a second time and,
- * for an out-of-bounds range, overrides our 200 with a native
- * **416 Range Not Satisfiable**, regardless of what this function or
- * `handleStorage` returned. That's RFC 7233-correct and is being KEPT,
- * not fought — so in practice, `null` from an out-of-bounds `start`
- * still results in a 200 from `handleStorage`'s own logic, but the byte
- * that actually reaches a real client for that specific case is a 416
- * courtesy of Bun itself. MALFORMED and multi-range headers are NOT
- * range-shaped at all, so Bun's native layer doesn't touch them — those
- * two cases genuinely serve the full 200, in-process harness and real
- * socket alike.
- */
-export function parseByteRangeHeader(header: string | null, total: number): { start: number; end: number } | null {
-  if (!header || total <= 0) return null;
-  const match = header.match(/^bytes=(\d*)-(\d*)$/);
-  if (!match) return null; // malformed, unrecognized unit, or a multi-range list
-  const [, startRaw, endRaw] = match;
-  if (startRaw === "" && endRaw === "") return null;
-
-  if (startRaw === "") {
-    // Suffix range: last N bytes (`bytes=-500`).
-    const suffixLength = Number(endRaw);
-    if (!Number.isSafeInteger(suffixLength) || suffixLength <= 0) return null;
-    return { start: Math.max(0, total - suffixLength), end: total - 1 };
-  }
-
-  const start = Number(startRaw);
-  if (!Number.isSafeInteger(start) || start < 0 || start >= total) return null;
-  const end = endRaw === "" ? total - 1 : Math.min(Number(endRaw), total - 1);
-  if (!Number.isSafeInteger(end) || end < start) return null;
-  return { start, end };
-}
+// Storage upload policy: DENY-LIST (vault#517). A knowledge vault stores
+// arbitrary files — ebooks, office docs, datasets, archives, binaries — so we
+// accept ANY upload EXCEPT the handful of types a browser can execute as
+// active content in our origin when served back from /storage/. (The prior
+// allowlist rejected the long tail: .epub/.csv/.zip/… all came back "File type
+// not allowed".)
+//
+// BLOCKED — same-origin-XSS / active-content set:
+//   .html/.htm/.xhtml/.shtml/.xht  HTML — embeds <script>
+//   .svg                           XML image — embeds <script>
+//   .xml                           can carry XSLT / be parsed as XHTML
+//   .js/.mjs/.cjs                  JavaScript
+//   .css                           style-injection / UI-redress vector
+//
+// Two independent guards keep every STORED file inert when served:
+//   1. Only the curated MIME_TYPES below map to a real (always passive) type;
+//      every other extension serves as application/octet-stream — a download,
+//      never rendered.
+//   2. The GET byte-serve response pins `X-Content-Type-Options: nosniff`, so
+//      a browser can't sniff an octet-stream body into an executable type.
+// The blocklist is belt-and-suspenders on top of those: even if a future MIME
+// entry or an upstream proxy weakened (1) or (2), these extensions still never
+// land on disk. If a future use case needs SVG, sanitize on read (strip
+// <script>/<foreignObject>) and revisit.
+const BLOCKED_EXTENSIONS = new Set([
+  ".html", ".htm", ".xhtml", ".shtml", ".xht",
+  ".svg",
+  ".xml",
+  ".js", ".mjs", ".cjs",
+  ".css",
+]);
+
+// Explicit MIME types for the commonly-previewed formats. Anything accepted
+// but absent here serves as application/octet-stream — a download, never
+// rendered (e.g. .pages/.key/.numbers/.azw3/.exe/arbitrary binaries). None of
+// these map to an active type (text/html, image/svg+xml), so a served asset
+// can't execute script; `nosniff` on the GET response makes that ironclad.
+//
+// INVARIANT: never add an entry that maps to a browser-active type —
+// text/html, image/svg+xml, application/xhtml+xml, text/javascript,
+// application/wasm, text/css. Doing so re-enables same-origin execution for
+// that extension (and would mean it must also join BLOCKED_EXTENSIONS).
+const MIME_TYPES: Record<string, string> = {
+  // Audio
+  ".wav": "audio/wav",
+  ".mp3": "audio/mpeg",
+  ".m4a": "audio/mp4",
+  ".ogg": "audio/ogg",
+  ".oga": "audio/ogg",
+  ".opus": "audio/opus",
+  ".aac": "audio/aac",
+  ".flac": "audio/flac",
+  ".webm": "audio/webm",
+  // Image
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".bmp": "image/bmp",
+  ".tiff": "image/tiff",
+  ".tif": "image/tiff",
+  ".heic": "image/heic",
+  ".heif": "image/heif",
+  ".avif": "image/avif",
+  // Video
+  ".mp4": "video/mp4",
+  ".m4v": "video/x-m4v",
+  ".mov": "video/quicktime",
+  // Documents / ebooks / data
+  ".pdf": "application/pdf",
+  ".epub": "application/epub+zip",
+  ".mobi": "application/x-mobipocket-ebook",
+  ".txt": "text/plain; charset=utf-8",
+  ".md": "text/markdown; charset=utf-8",
+  ".markdown": "text/markdown; charset=utf-8",
+  ".rtf": "application/rtf",
+  ".csv": "text/csv; charset=utf-8",
+  ".tsv": "text/tab-separated-values; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".doc": "application/msword",
+  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".ppt": "application/vnd.ms-powerpoint",
+  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  ".xls": "application/vnd.ms-excel",
+  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ".odt": "application/vnd.oasis.opendocument.text",
+  ".ods": "application/vnd.oasis.opendocument.spreadsheet",
+  ".odp": "application/vnd.oasis.opendocument.presentation",
+  ".zip": "application/zip",
+};
 
 export async function handleStorage(
   req: Request,
@@ -4665,38 +4694,12 @@ export async function handleStorage(
     const stat = statSync(filePath);
     const ext = extname(filePath).toLowerCase();
     const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
-    const total = stat.size;
-
-    // vault attachments-for-agents design (D9) — the REST twin of MCP's
-    // `content_offset`. `Bun.file(filePath)` resolves lazily: `.slice()`
-    // creates a bounded view and only the requested bytes are actually read
-    // on `.arrayBuffer()`/streaming, replacing the prior whole-file
-    // `readFileSync` (a standing memory smell on a large attachment, e.g. a
-    // 90 MB video) on BOTH the ranged and full-file paths below.
-    const bunFile = Bun.file(filePath);
-    const range = parseByteRangeHeader(req.headers.get("range"), total);
-
-    if (range) {
-      const { start, end } = range; // inclusive
-      return new Response(bunFile.slice(start, end + 1), {
-        status: 206,
-        headers: {
-          "Content-Type": contentType,
-          "Content-Length": String(end - start + 1),
-          "Content-Range": `bytes ${start}-${end}/${total}`,
-          "Accept-Ranges": "bytes",
-          // Defense-in-depth: never let a browser MIME-sniff a stored asset
-          // into an active type — see the full-response branch below.
-          "X-Content-Type-Options": "nosniff",
-        },
-      });
-    }
+    const fileBuffer = readFileSync(filePath);
 
-    return new Response(bunFile, {
+    return new Response(fileBuffer, {
       headers: {
         "Content-Type": contentType,
-        "Content-Length": String(total),
-        "Accept-Ranges": "bytes",
+        "Content-Length": String(stat.size),
         // Defense-in-depth: never let a browser MIME-sniff a stored asset into
         // an active type (e.g. an octet-stream body sniffed as text/html).
         // Combined with the upload blocklist (no .svg/.html) this closes the

package/src/routing.test.ts

@@ -10,10 +10,8 @@
  *  3. `/vault/<name>/...` — per-vault routing (OAuth, MCP, view, API).
  *  4. The RFC 9728 WWW-Authenticate challenge that decorates MCP 401s.
  *
- * No unscoped `/api/*` or `/oauth/*` routes exist — those per-vault resources
- * must name the vault in the URL. The canonical root `/mcp` (U1) is the one
- * vault-agnostic exception: it derives the target vault from the token, then
- * re-dispatches through the same per-vault machinery.
+ * No unscoped `/mcp`, `/api/*`, `/oauth/*` routes exist — every per-vault
+ * resource must name the vault it targets.
  *
  * Uses PARACHUTE_HOME override so each test's vaults live in a tmp dir and
  * never touch ~/.parachute.
@@ -708,27 +706,14 @@ describe("per-vault routing under /vault/<name>/", () => {
     }
   });
 
-  test("no /api, /oauth unscoped routes — all 404", async () => {
+  test("no /mcp, /api, /oauth unscoped routes — all 404", async () => {
     createVault("journal");
-    for (const path of ["/api/notes", "/oauth/register", "/oauth/authorize"]) {
+    for (const path of ["/mcp", "/api/notes", "/oauth/register", "/oauth/authorize"]) {
       const res = await route(new Request(`http://localhost:1940${path}`), path);
       expect(res.status).toBe(404);
     }
   });
 
-  test("root /mcp is NOT a 404 — it's the token-derived MCP endpoint (401 unauthenticated)", async () => {
-    // The old unscoped `/mcp` compat prefix returned 404. The canonical root
-    // `/mcp` (U1) replaces it: unauthenticated it 401s + carries the root PRM
-    // challenge, exactly like the per-vault endpoint but pointed at the root
-    // metadata document.
-    createVault("journal");
-    const res = await route(new Request("http://localhost:1940/mcp", { method: "POST" }), "/mcp");
-    expect(res.status).toBe(401);
-    expect(res.headers.get("WWW-Authenticate")).toBe(
-      'Bearer resource_metadata="http://localhost:1940/.well-known/oauth-protected-resource/mcp"',
-    );
-  });
-
   test("bare /vault/<name> returns metadata for authenticated callers", async () => {
     createVault("journal", "My journal vault");
     const path = "/vault/journal";
@@ -825,216 +810,6 @@ describe("MCP 401 WWW-Authenticate challenge (RFC 9728)", () => {
   });
 });
 
-// ---------------------------------------------------------------------------
-// Canonical root MCP endpoint — token-derived vault dispatch (U1).
-//
-// `/mcp` at the origin root derives the target vault from the TOKEN, not the
-// URL, then re-dispatches through the identical per-vault machinery. These
-// tests pin the two load-bearing properties: (1) a token for vault A behaves
-// byte-identically at root `/mcp` and at `/vault/A/mcp` (equivalence), and
-// (2) the vault is ALWAYS the one the token names — a token can't be steered
-// to another vault, and an unnameable/ambiguous token is refused with the root
-// discovery challenge rather than a guess (derivation honesty).
-// ---------------------------------------------------------------------------
-
-describe("canonical root /mcp — token-derived vault dispatch (U1)", () => {
-  const INIT = {
-    jsonrpc: "2.0",
-    id: 1,
-    method: "initialize",
-    params: {
-      protocolVersion: "2025-06-18",
-      capabilities: {},
-      clientInfo: { name: "u1-test", version: "0" },
-    },
-  };
-  const LIST = { jsonrpc: "2.0", id: 2, method: "tools/list" };
-  const QUERY = {
-    jsonrpc: "2.0",
-    id: 3,
-    method: "tools/call",
-    params: { name: "query-notes", arguments: {} },
-  };
-
-  async function mcpPost(path: string, token: string | null, rpc: object): Promise<Response> {
-    const headers: Record<string, string> = {
-      "content-type": "application/json",
-      accept: "application/json, text/event-stream",
-    };
-    if (token) headers.authorization = `Bearer ${token}`;
-    return route(
-      new Request(`http://localhost:1940${path}`, {
-        method: "POST",
-        headers,
-        body: JSON.stringify(rpc),
-      }),
-      path,
-    );
-  }
-
-  /** Parse a JSON-RPC frame off an MCP response, tolerating either the JSON
-   *  body (enableJsonResponse) or an SSE `data:` framing. */
-  async function rpcFrame(res: Response): Promise<unknown> {
-    const text = await res.text();
-    const trimmed = text.trimStart();
-    if (trimmed.startsWith("{") || trimmed.startsWith("[")) return JSON.parse(trimmed);
-    const dataLine = text.split("\n").find((l) => l.startsWith("data:"));
-    return JSON.parse(dataLine!.slice("data:".length).trim());
-  }
-
-  /** Sign a token directly (bypassing `mintJwt`'s `aud=vault.<name>` coupling)
-   *  so a test can craft a token whose sources name no vault, or disagree. */
-  async function signRaw(payload: Record<string, unknown>, aud: string): Promise<string> {
-    const iat = Math.floor(Date.now() / 1000);
-    return new SignJWT({ client_id: "u1-test", ...payload })
-      .setProtectedHeader({ alg: "RS256", kid: KID })
-      .setIssuer(`http://127.0.0.1:${hubServer.port}`)
-      .setSubject("u1-test-user")
-      .setAudience(aud)
-      .setIssuedAt(iat)
-      .setExpirationTime(iat + 60)
-      .setJti(`jti-${Math.random().toString(36).slice(2)}`)
-      .sign(signingKey);
-  }
-
-  test("root PRM mirrors the per-vault PRM shape (root resource, un-narrowed scopes)", async () => {
-    createVault("journal");
-    const path = "/.well-known/oauth-protected-resource/mcp";
-    const res = await route(new Request(`http://localhost:1940${path}`), path);
-    expect(res.status).toBe(200);
-    const prm = (await res.json()) as {
-      resource: string;
-      authorization_servers: string[];
-      scopes_supported: string[];
-      bearer_methods_supported: string[];
-    };
-    expect(prm.resource).toBe("http://localhost:1940/mcp");
-    // Un-narrowed forms — the hub's consent picker narrows them to a vault.
-    expect(prm.scopes_supported).toEqual(["vault:read", "vault:write"]);
-    expect(prm.bearer_methods_supported).toEqual(["header"]);
-    expect(Array.isArray(prm.authorization_servers)).toBe(true);
-    expect(prm.authorization_servers.length).toBe(1);
-  });
-
-  test("unauthenticated → 401 whose challenge names the root PRM (self-consistent pointer)", async () => {
-    createVault("journal");
-    const res = await mcpPost("/mcp", null, INIT);
-    expect(res.status).toBe(401);
-    const header = res.headers.get("WWW-Authenticate")!;
-    const prmUrl = header.match(/resource_metadata="([^"]+)"/)![1]!;
-    const prmPath = new URL(prmUrl).pathname;
-    expect(prmPath).toBe("/.well-known/oauth-protected-resource/mcp");
-    // The pointer resolves to a real PRM that names the root resource.
-    const prmRes = await route(new Request(prmUrl), prmPath);
-    expect(prmRes.status).toBe(200);
-    expect(((await prmRes.json()) as { resource: string }).resource).toBe(
-      "http://localhost:1940/mcp",
-    );
-  });
-
-  test("x-forwarded-* shape the root challenge URL", async () => {
-    createVault("journal");
-    const req = new Request("http://127.0.0.1:1940/mcp", {
-      method: "POST",
-      headers: {
-        "x-forwarded-host": "vault.example.com",
-        "x-forwarded-proto": "https",
-      },
-    });
-    const res = await route(req, "/mcp");
-    expect(res.status).toBe(401);
-    expect(res.headers.get("WWW-Authenticate")).toBe(
-      'Bearer resource_metadata="https://vault.example.com/.well-known/oauth-protected-resource/mcp"',
-    );
-  });
-
-  test("token for A at root /mcp === same token at /vault/A/mcp (initialize, tools/list, tool call)", async () => {
-    createVault("journal");
-    const store = getVaultStore("journal");
-    await store.createNote("root-mcp equivalence fixture", { path: "fixture", tags: ["probe"] });
-    const token = await mintJwt({ vaultName: "journal", scopes: ["vault:journal:admin"] });
-
-    for (const rpc of [INIT, LIST, QUERY]) {
-      const rootRes = await mcpPost("/mcp", token, rpc);
-      const perVaultRes = await mcpPost("/vault/journal/mcp", token, rpc);
-      expect(rootRes.status).toBe(200);
-      expect(perVaultRes.status).toBe(200);
-      // Byte-identical JSON-RPC frame — the root path derived `journal`, so the
-      // server name, tool list, and tool result all match the URL-addressed
-      // endpoint exactly.
-      expect(await rpcFrame(rootRes)).toEqual(await rpcFrame(perVaultRes));
-    }
-  });
-
-  test("a read-only token narrows the root tool list identically to the per-vault endpoint", async () => {
-    createVault("journal");
-    getVaultStore("journal");
-    const readToken = await mintJwt({ vaultName: "journal", scopes: ["vault:journal:read"] });
-    const rootList = await rpcFrame(await mcpPost("/mcp", readToken, LIST));
-    const perVaultList = await rpcFrame(await mcpPost("/vault/journal/mcp", readToken, LIST));
-    expect(rootList).toEqual(perVaultList);
-    // Sanity: a read token sees the read tools but not write/admin ones.
-    const names = (rootList as { result: { tools: { name: string }[] } }).result.tools.map(
-      (t) => t.name,
-    );
-    expect(names).toContain("query-notes");
-    expect(names).not.toContain("create-note");
-    expect(names).not.toContain("manage-token");
-  });
-
-  test("a vault-A token ALWAYS lands in A through root /mcp — never another vault's data", async () => {
-    createVault("alpha");
-    createVault("beta");
-    // Seed a secret in BETA. A token minted for ALPHA must never surface it.
-    await getVaultStore("beta").createNote("BETA-ONLY-SECRET", { path: "secret" });
-    getVaultStore("alpha");
-    const alphaToken = await mintJwt({ vaultName: "alpha", scopes: ["vault:alpha:admin"] });
-
-    const res = await mcpPost("/mcp", alphaToken, QUERY);
-    expect(res.status).toBe(200);
-    // The vault is derived from the token (alpha); beta's note is unreachable.
-    expect(JSON.stringify(await rpcFrame(res))).not.toContain("BETA-ONLY-SECRET");
-  });
-
-  test("scope and aud naming DIFFERENT vaults → 401 (disagreement, never guess)", async () => {
-    createVault("alpha");
-    createVault("beta");
-    // aud=vault.alpha (from vaultName) but the scope names beta — two sources
-    // disagree, so derivation refuses rather than picking a winner.
-    const token = await mintJwt({ vaultName: "alpha", scopes: ["vault:beta:admin"] });
-    const res = await mcpPost("/mcp", token, INIT);
-    expect(res.status).toBe(401);
-    expect(res.headers.get("WWW-Authenticate")).toContain("/.well-known/oauth-protected-resource/mcp");
-  });
-
-  test("a token that names NO vault (broad scope, non-vault aud, no vault_scope) → 401", async () => {
-    createVault("journal");
-    // Broad `vault:read` names no vault; aud is not `vault.<name>`; no
-    // vault_scope claim. Nothing derives a target → the discovery challenge.
-    const token = await signRaw({ scope: "vault:read" }, "some-other-resource");
-    const res = await mcpPost("/mcp", token, INIT);
-    expect(res.status).toBe(401);
-    expect(res.headers.get("WWW-Authenticate")).toContain("/.well-known/oauth-protected-resource/mcp");
-  });
-
-  test("an invalid / unverifiable token → 401 + root challenge (no vault leaked)", async () => {
-    createVault("journal");
-    const res = await mcpPost("/mcp", "not-a-real-jwt", INIT);
-    expect(res.status).toBe(401);
-    expect(res.headers.get("WWW-Authenticate")).toContain("/.well-known/oauth-protected-resource/mcp");
-  });
-
-  test("a validly-signed token naming a vault absent on THIS server → 404 (mirrors per-vault)", async () => {
-    createVault("journal");
-    // Token is real (signed by the fixture hub) but names a vault that isn't
-    // installed here. The per-vault URL 404s for a missing vault; root matches.
-    const token = await mintJwt({ vaultName: "ghost", scopes: ["vault:ghost:admin"] });
-    const res = await mcpPost("/mcp", token, INIT);
-    expect(res.status).toBe(404);
-    expect(((await res.json()) as { error: string }).error).toBe("Vault not found");
-  });
-});
-
 // ---------------------------------------------------------------------------
 // Per-vault OAuth discovery (RFC 8414 / RFC 9728, path-append form).
 //