@openparachute/vault 0.7.6 → 0.7.7

package/src/routes.ts

@@ -68,6 +68,8 @@ import {
   filterNotesByTagScope,
   noteWithinTagScope,
   scrubIndexedFieldConflictError,
+  scrubNotesTagsByScope,
+  scrubNoteTagsByScope,
   scrubParentCycleError,
   scrubReferencingTagsByScope,
   scrubTagFieldViolationsByScope,
@@ -804,8 +806,7 @@ function parseMetadataJsonAlias(url: URL): {
 
 /**
  * Parse + validate the `?expand=` tag-expansion axis (vault tag `expand` axis).
- * Shared by `parseNotesQueryOpts` (structured + subscribe) AND the full-text
- * search branch of `handleNotes` (which bypasses `parseNotesQueryOpts`), so the
+ * Shared by `parseNotesQueryOpts` (structured, subscribe, and search) so the
  * enum lives in exactly one place and `GET /notes?search=...&expand=bogus` is
  * validated identically to the structured path.
  *
@@ -875,8 +876,10 @@ function parseSearchModeParam(url: URL): { mode?: SearchMode; error?: Response }
  * Factored out of `handleNotesInner`'s structured-query branch so the
  * `/subscribe` route evaluates the SAME predicate the snapshot query does —
  * predicate parity by construction, not copy-paste. `handleNotesInner` keeps
- * its own inline parsing for the single-note (`id`) and full-text (`search`)
- * branches; this helper covers the structured-query shape both endpoints share.
+ * its own inline parsing for the single-note (`id`) branch; the full-text
+ * (`search`) branch now reuses this helper for every structured filter
+ * (vault#647) so `exclude_tag` / date / path / metadata compose with
+ * `?search=` instead of being silently dropped.
  *
  * Returns `{ error }` (a 400 Response) on a malformed metadata filter, exactly
  * as the inline code did. `hasSearch` is surfaced from the raw `search` param
@@ -942,6 +945,7 @@ export function parseNotesQueryOpts(url: URL): {
     hasBrokenLinks: parseBoolOrUndef(parseQuery(url, "has_broken_links")),
     path: parseQuery(url, "path") ?? undefined,
     pathPrefix: parseQuery(url, "path_prefix") ?? undefined,
+    excludePathPrefix: parseQueryList(url, "exclude_path_prefix"),
     extension: parseExtensionFilter(url),
     metadata: bracket.metadata ?? metadataAlias.metadata,
     // Write-attribution filters (vault#298) — symmetric with the MCP
@@ -1191,6 +1195,10 @@ async function handleNotesInner(
         const contentRange = parseContentRangeQuery(url, includeContent);
         if (contentRange.error) return contentRange.error;
         let result: any = includeContent ? { ...note } : toNoteIndex(note);
+        // Tag-scope (vault#568): the note is visible via at least one
+        // in-scope tag, but its `.tags` array would otherwise name every
+        // out-of-scope co-tag it carries. No-op unscoped.
+        result = scrubNoteTagsByScope(result, tagScope.allowed, tagScope.raw);
         const expand = parseExpandParams(url, db, tagScope);
         if (expand && includeContent && typeof result.content === "string") {
           expand.ctx.expanded.add(note.id);
@@ -1291,6 +1299,10 @@ async function handleNotesInner(
           if (contentRange.error) return contentRange.error;
           const inclMeta = parseIncludeMetadata(url);
           let output: any[] = includeContent ? filtered.map((n) => ({ ...n })) : filtered.map(toNoteIndex);
+          // Tag-scope (vault#568): filter each surviving note's own `.tags`
+          // to the in-scope subset — being visible via one tag must not
+          // disclose the NAMES of its out-of-scope co-tags. No-op unscoped.
+          output = scrubNotesTagsByScope(output, tagScope.allowed, tagScope.raw);
           const expand = parseExpandParams(url, db, tagScope);
           if (expand && includeContent) {
             for (const n of output) expand.ctx.expanded.add(n.id);
@@ -1364,23 +1376,17 @@ async function handleNotesInner(
 
       // Full-text search
       if (search) {
-        const searchTags = parseQueryList(url, "tag");
-        const limit = parseInt10(parseQuery(url, "limit")) ?? 50;
-        // Tag-expansion axis (vault tag `expand` axis). This branch bypasses
-        // `parseNotesQueryOpts`, so validate `?expand=` here too — otherwise
-        // `GET /notes?search=x&expand=bogus` would silently ignore the bad
-        // value. The validated mode is threaded into the search tag-narrowing.
-        const tagExpand = parseExpandParam(url);
-        if (tagExpand.error) return tagExpand.error;
-        // `search_mode` (vault#551) — same loud-validation policy as
-        // `expand` above; also bypasses `parseNotesQueryOpts` so it needs
-        // its own check here.
+        // vault#647: parse the structured filter grammar here too. Pre-fix
+        // this branch bypassed `parseNotesQueryOpts` and only forwarded
+        // tag/limit/expand/mode/sort, so `exclude_tag` and date/path/metadata
+        // were silently dropped — a well-formed result set answering a
+        // different question. `search_mode` is still parsed here because it
+        // is search-specific (the helper does not know about it).
+        const parsed = parseNotesQueryOpts(url);
+        if (parsed.error) return parsed.error;
         const searchModeParsed = parseSearchModeParam(url);
         if (searchModeParsed.error) return searchModeParsed.error;
         const mode: SearchMode = searchModeParsed.mode ?? "literal";
-        // `sort` under search (vault#551 item 3): omit for FTS5 relevance
-        // (default, unchanged); explicit asc/desc switches to created_at.
-        const sort = (parseQuery(url, "sort") as "asc" | "desc" | null) ?? undefined;
 
         const searchWarnings: QueryWarning[] = [...nearTextIgnored];
         // `offset` under full-text search (vault contracts-brief V1.2):
@@ -1414,11 +1420,13 @@ async function handleNotesInner(
             // the pre-#551 silent `[]` — caught below and formatted the
             // same way the structured-query path formats a `QueryError`.
             rawResults = await store.searchNotes(search, {
-              tags: searchTags,
-              limit,
-              expand: tagExpand.expand,
+              ...parsed.queryOpts,
               mode,
-              sort,
+              // Search has no offset/cursor/orderBy contract (offset is
+              // warned above; cursor is rejected before this branch).
+              offset: undefined,
+              cursor: undefined,
+              orderBy: undefined,
             });
           } catch (e: any) {
             if (e && e.name === "QueryError") {
@@ -1467,6 +1475,9 @@ async function handleNotesInner(
         if (contentRange.error) return contentRange.error;
         const inclMeta = parseIncludeMetadata(url);
         let output: any[] = includeContent ? results.map((n) => ({ ...n })) : results.map(toNoteIndex);
+        // Tag-scope (vault#568): filter each surviving note's own `.tags` to
+        // the in-scope subset — see the structured-query branch below.
+        output = scrubNotesTagsByScope(output, tagScope.allowed, tagScope.raw);
         const expand = parseExpandParams(url, db, tagScope);
         if (expand && includeContent) {
           for (const n of output) expand.ctx.expanded.add(n.id);
@@ -1711,7 +1722,9 @@ async function handleNotesInner(
       // `limit` (i.e. there may be more rows the caller never saw). Cursor
       // mode is exempt — it already carries `next_cursor` as the honest
       // "more may follow" signal, so a second warning would be redundant.
-      if (!cursorMode && results.length === queryOpts.limit) {
+      // Explicit offset is also exempt (vault#601): the caller is already
+      // paging, not hitting an accidental full default page.
+      if (!cursorMode && queryOpts.offset === undefined && results.length === queryOpts.limit) {
         queryWarnings.push(truncatedResultsWarning(queryOpts.limit));
       }
 
@@ -1762,6 +1775,15 @@ async function handleNotesInner(
       const includeLinkCount = parseBool(parseQuery(url, "include_link_count"), false);
       const inclMeta = parseIncludeMetadata(url);
       let output: any[] = includeContent ? results.map((n) => ({ ...n })) : results.map(toNoteIndex);
+      // Tag-scope (vault#568): filter each surviving note's own `.tags` to
+      // the in-scope subset. Deliberately applied to `output`, NOT `results`:
+      // `results` still feeds `store.validateNoteAgainstSchemas` below (which
+      // needs the FULL tag set to compute the status that then gets its own
+      // scope scrub) and the graph-edge walk. Because `nodes` (graph format),
+      // `enrichedOut`, and the cursor/plain envelopes are all derived from
+      // `output`, this one call covers every shape this branch can return.
+      // No-op unscoped.
+      output = scrubNotesTagsByScope(output, tagScope.allowed, tagScope.raw);
       const expand = parseExpandParams(url, db, tagScope);
       if (expand && includeContent) {
         for (const n of output) expand.ctx.expanded.add(n.id);
@@ -2298,6 +2320,19 @@ async function handleNotesInner(
         let out: any = validated;
         if (warnings && warnings.length > 0) out = { ...out, warnings };
         if (existed !== undefined) out = { ...out, existed };
+        // Tag-scope (vault#568): a create response echoes the STORED note,
+        // and under `if_exists: ignore|update|replace` that's a note that
+        // already existed with tags this token never supplied. Without the
+        // scrub a scoped caller could recover any co-tagged note's full tag
+        // set through the write door. Same treatment on the validation_status
+        // this response carries — the #555 scrub was only wired to the read
+        // paths, so the write door still named out-of-scope schemas.
+        out = scrubNoteTagsByScope(out, tagScope.allowed, tagScope.raw);
+        if (out.validation_status) {
+          const vs = scrubValidationStatusByScope(out.validation_status, tagScope.allowed, tagScope.raw);
+          if (vs === undefined) { const { validation_status: _d, ...rest } = out; out = rest; }
+          else out = { ...out, validation_status: vs };
+        }
         return out;
       });
 
@@ -2538,6 +2573,11 @@ async function handleNotesInner(
     const contentRange = parseContentRangeQuery(url, includeContent);
     if (contentRange.error) return contentRange.error;
     let result: any = includeContent ? { ...note } : toNoteIndex(note);
+    // Tag-scope (vault#568): filter `.tags` to the in-scope subset. Placed
+    // before the validation_status block on purpose — that block reads
+    // `note.tags` (the full set) to COMPUTE the status and then scrubs the
+    // status itself, so the two scrubs are independent.
+    result = scrubNoteTagsByScope(result, tagScope.allowed, tagScope.raw);
     // vault#555 fix 3 — mirror the MCP query-notes fix: attach
     // validation_status on reads too, not just on the one-time create/update
     // write response. See core/src/mcp.ts's query-notes handler for the
@@ -2692,8 +2732,20 @@ async function handleNotesInner(
           }
           const final = await store.getNote(created.id);
           if (!final) return json({ error: "Note disappeared", error_type: "internal_error" }, 500);
-          const validated: any = attachValidationStatus(store, db, final);
+          let validated: any = attachValidationStatus(store, db, final);
           if (createWarnings.length > 0) validated.warnings = createWarnings;
+          // Tag-scope (vault#568): scrub the echoed note so create-then-read
+          // returns the SAME shape. A scoped token may legitimately attach an
+          // out-of-scope co-tag on write (`tagsWithinScope` only requires ONE
+          // in-scope tag), so this isn't a leak of anything it didn't send —
+          // but leaving it unscrubbed would make the write door the one place
+          // the full tag set is observable. Same for validation_status.
+          validated = scrubNoteTagsByScope(validated, tagScope.allowed, tagScope.raw);
+          if (validated.validation_status) {
+            const vs = scrubValidationStatusByScope(validated.validation_status, tagScope.allowed, tagScope.raw);
+            if (vs === undefined) { const { validation_status: _d, ...rest } = validated; validated = rest; }
+            else validated = { ...validated, validation_status: vs };
+          }
           const includeContentResp = body.include_content !== false;
           if (includeContentResp) return json({ ...validated, created: true });
           const lean: any = toNoteIndex(validated);
@@ -3013,7 +3065,18 @@ async function handleNotesInner(
       if (contentChanged) {
         linkWarnings.push(...getContentWikilinkWarnings(db, note.id, updatedNote.content));
       }
-      const validated: any = attachValidationStatus(store, db, updatedNote);
+      let validated: any = attachValidationStatus(store, db, updatedNote);
+      // Tag-scope (vault#568): the update response echoes the STORED note, so
+      // without this a scoped caller could recover a co-tagged note's full tag
+      // set with a no-op PATCH — the read-path scrub would be trivially
+      // bypassable. The validation_status scrub rides along for the same
+      // reason (#555 only wired it to the read paths).
+      validated = scrubNoteTagsByScope(validated, tagScope.allowed, tagScope.raw);
+      if (validated.validation_status) {
+        const vs = scrubValidationStatusByScope(validated.validation_status, tagScope.allowed, tagScope.raw);
+        if (vs === undefined) { const { validation_status: _d, ...rest } = validated; validated = rest; }
+        else validated = { ...validated, validation_status: vs };
+      }
       // Echo hydrated links when a link mutation was part of this request,
       // OR the caller explicitly asked for them via `?include_links=true`
       // (vault feedback #8). Previously the update response omitted links

package/src/routing.test.ts

@@ -678,6 +678,30 @@ describe("per-vault routing under /vault/<name>/", () => {
     expect(res.status).toBe(401);
   });
 
+  test("authed GET /api/subscribe without Upgrade → 410 SSE_TRANSPORT_REMOVED (vault#543)", async () => {
+    createVault("journal");
+    const token = await mintJwt({ vaultName: "journal", scopes: ["vault:journal:read"] });
+    const path = "/vault/journal/api/subscribe";
+    const res = await route(
+      new Request(`http://localhost:1940${path}`, {
+        headers: { authorization: `Bearer ${token}` },
+      }),
+      path,
+    );
+    expect(res.status).toBe(410);
+    const body = (await res.json()) as { code?: string };
+    expect(body.code).toBe("SSE_TRANSPORT_REMOVED");
+  });
+
+  test("anon GET /api/subscribe → 401, not the SSE tombstone (vault#543)", async () => {
+    createVault("journal");
+    const path = "/vault/journal/api/subscribe";
+    const res = await route(new Request(`http://localhost:1940${path}`), path);
+    expect(res.status).toBe(401);
+    const body = (await res.json()) as { code?: string };
+    expect(body.code).not.toBe("SSE_TRANSPORT_REMOVED");
+  });
+
   test("/vault/<name>/oauth/* returns 410 Gone (standalone issuer retired — workstream E)", async () => {
     // The standalone OAuth issuer on vault was removed in vault#366 once hub
     // became required. The 410 carries a pointer to the protected-resource

package/src/routing.ts

@@ -1156,6 +1156,8 @@ export async function route(
   // straggler on a cached pre-WS notes-ui bundle — gets a clean 410 Gone
   // pointing at the WS binding so its consumer degrades to polling gracefully;
   // NEVER a 500 or an unhandled path.
+  // Not method-gated: a POST here is still a straggler on the removed SSE
+  // transport, not a missing verb on a live resource, so 410 (not 405).
   if (apiPath === "/subscribe") {
     return Response.json(
       {

package/src/subscriptions.ts

@@ -65,7 +65,7 @@ import type { DeletedNoteRef, HookEvent, NoteHookPayload } from "../core/src/hoo
 import { defaultHookRegistry } from "../core/src/hooks.ts";
 import { toNoteIndex } from "../core/src/notes.ts";
 import { getVaultNameForStore } from "./vault-store.ts";
-import { noteWithinTagScope } from "./tag-scope.ts";
+import { noteWithinTagScope, scrubNoteTagsByScope } from "./tag-scope.ts";
 import type { LiveMatcher } from "./live-match.ts";
 
 /** Default per-vault concurrent-subscription cap. Over it → 503. */
@@ -332,7 +332,23 @@ export class SubscriptionManager {
       if (matches) {
         // A lean subscription (list view, `include_content=false`) carries the
         // same `NoteIndex` projection REST lists return — never the full body.
-        this.emit(sub, "upsert", { note: sub.lean ? toNoteIndex(note) : note });
+        //
+        // vault#568 — then scrub `.tags` to this subscriber's in-scope subset.
+        // A live event is a read: a `mine`-scoped socket watching a co-tagged
+        // note must not receive `project-manhattan` in the payload any more
+        // than `GET /api/notes/:id` would hand it over. Order matters twice:
+        // the matcher and the scope gate above both read the FULL tag set (a
+        // live predicate must evaluate against what's actually stored), and
+        // the scrub is NON-MUTATING — `note` is ONE payload fanned out to
+        // every subscriber in this loop, each with its own allowlist, so
+        // mutating it would cross-contaminate the next subscriber's frame.
+        this.emit(sub, "upsert", {
+          note: scrubNoteTagsByScope(
+            sub.lean ? toNoteIndex(note) : note,
+            sub.tagScopeAllowed,
+            sub.tagScopeRaw,
+          ),
+        });
       } else if (event === "updated" && inScope) {
         // Left the set (predicate no longer true) BUT still within this
         // token's scope, so the sub could have held it — idempotent remove