@remnic/core 10.0.84 → 10.0.86

package/src/access-fleet-wide-work-peer.test.ts

@@ -0,0 +1,236 @@
+import assert from "node:assert/strict";
+import { mkdtemp, readdir, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import "./access-operations-batch.js"; // registration side effect: the real operations
+import { getOperation } from "./access-boundary.js";
+import { EngramAccessService } from "./access-service.js";
+import { EngramAccessForbiddenError } from "./access-errors.js";
+import { tokenCapabilityStore, type TokenCapabilities } from "./access-token-capabilities.js";
+import { Orchestrator } from "./orchestrator.js";
+import { parseConfig } from "./config.js";
+import { writePeer, writePeerProfile } from "./peers/index.js";
+import { WorkStorage } from "./work/storage.js";
+
+// Issue #3225 B3: work_task / work_project / work_board and the six peer
+// operations run against GLOBAL stores, so a namespace argument cannot
+// isolate them. They must carry fleetWide: true like the other cross-fleet
+// operations, and the HTTP peer routes must enforce the same policy.
+
+const PEER_ID = "b3-target-peer";
+const NOW = "2026-11-11T00:00:00.000Z";
+
+/** The nine operations that touch a global store (issue #3225 B3). */
+const GLOBAL_OPS = [
+  "work_task",
+  "work_project",
+  "work_board",
+  "peer_list",
+  "peer_get",
+  "peer_set",
+  "peer_delete",
+  "peer_profile_get",
+  "peer_forget",
+] as const;
+
+type GlobalOpName = (typeof GLOBAL_OPS)[number];
+
+/** Envelope fields the operations under test read; their schemas pass open objects through. */
+interface OpEnvelope {
+  action?: string;
+  id?: string;
+  title?: string;
+  name?: string;
+  projectId?: string;
+  snapshotJson?: string;
+  kind?: string;
+  displayName?: string;
+  confirm?: string;
+}
+
+/** Every registered handler answers with a `result` envelope. */
+interface OpOutput<T> {
+  result: T;
+}
+
+interface Fixture {
+  root: string;
+  service: EngramAccessService;
+  cleanup: () => Promise<void>;
+}
+
+async function createFixture(): Promise<Fixture> {
+  const root = await mkdtemp(path.join(tmpdir(), "remnic-b3-fleet-wide-"));
+  const orchestrator = new Orchestrator(
+    parseConfig({ memoryDir: root, namespacesEnabled: false, defaultNamespace: "global" }),
+  );
+  const storage = await orchestrator.getStorage();
+  await storage.ensureDirectories();
+  const service = new EngramAccessService(orchestrator);
+  return { root, service, cleanup: () => rm(root, { recursive: true, force: true }) };
+}
+
+/** Seed one synthetic record in each global store the nine operations touch. */
+async function seedGlobalRecords(root: string): Promise<void> {
+  const work = new WorkStorage(root);
+  await work.ensureDirectories();
+  await work.createTask({ title: "seeded task", description: "seeded" });
+  await work.createProject({ name: "seeded project", description: "seeded" });
+  await writePeer(root, {
+    id: PEER_ID,
+    kind: "agent",
+    displayName: "seeded peer",
+    createdAt: NOW,
+    updatedAt: NOW,
+  });
+  await writePeerProfile(root, {
+    peerId: PEER_ID,
+    updatedAt: NOW,
+    fields: { communication_style: "seeded" },
+    provenance: {},
+  });
+}
+
+/** Sorted relpath:content lines for every file under root (mutation detector). */
+async function snapshotDir(root: string): Promise<string[]> {
+  const entries = await readdir(root, { recursive: true, withFileTypes: true });
+  const lines: string[] = [];
+  for (const entry of entries) {
+    if (!entry.isFile()) continue;
+    const abs = path.join(entry.parentPath, entry.name);
+    const content = await readFile(abs, "utf8");
+    lines.push(`${path.relative(root, abs)}:${content}`);
+  }
+  return lines.sort();
+}
+
+/**
+ * Run the real registered operation under an optional capability record.
+ * The generic T names the registered handler's documented result shape.
+ */
+async function runOp<T>(
+  name: GlobalOpName,
+  input: OpEnvelope,
+  service: EngramAccessService,
+  capabilities?: TokenCapabilities,
+): Promise<OpOutput<T>> {
+  const op = getOperation(name);
+  assert.ok(op, `operation must be registered: ${name}`);
+  const run = () => op.run(input, { service });
+  // SAFETY: the boundary validates the envelope, then the handler returns its
+  // documented `{ result }` shape; T is that shape as named by the caller.
+  const output = (capabilities === undefined ? await run() : await tokenCapabilityStore.run(capabilities, run)) as OpOutput<T>;
+  return output;
+}
+
+test("B3: a one-namespace token is denied on every global work and peer op BEFORE any read or mutation", async () => {
+  const fixture = await createFixture();
+  try {
+    await seedGlobalRecords(fixture.root);
+    const before = await snapshotDir(fixture.root);
+
+    const mutatingInput = {
+      work_task: { action: "create", title: "intruder task" },
+      work_project: { action: "create", name: "intruder project" },
+      work_board: { action: "import_snapshot", projectId: "proj-x", snapshotJson: "{}" },
+      peer_list: {},
+      peer_get: { id: PEER_ID },
+      peer_set: { id: PEER_ID, displayName: "hijacked" },
+      peer_delete: { id: PEER_ID },
+      peer_profile_get: { id: PEER_ID },
+      peer_forget: { id: PEER_ID, confirm: "yes" },
+    };
+
+    for (const namespaces of [["ns_a"], []]) {
+      const caps: TokenCapabilities = { version: 1, namespaces };
+      for (const name of GLOBAL_OPS) {
+        await assert.rejects(
+          () => runOp(name, mutatingInput[name], fixture.service, caps),
+          (err: Error) =>
+            err instanceof EngramAccessForbiddenError && /scoped to specific namespaces/.test(err.message),
+          `${name} must reject a token restricted to ${JSON.stringify(namespaces)}`,
+        );
+      }
+    }
+
+    const after = await snapshotDir(fixture.root);
+    assert.deepEqual(after, before, "denials must not change any file in any global store");
+  } finally {
+    await fixture.cleanup();
+  }
+});
+
+test("B3: an ops-scoped token without a namespace axis may use its permitted global ops", async () => {
+  const fixture = await createFixture();
+  try {
+    const caps: TokenCapabilities = { version: 1, ops: [...GLOBAL_OPS] };
+
+    const created = await runOp<{ task: { id: string } }>(
+      "work_task",
+      { action: "create", title: "ops token task" },
+      fixture.service,
+      caps,
+    );
+    assert.ok(created.result.task.id, "ops-scoped token creates a work task");
+
+    const listed = await runOp<{ count: number }>("work_task", { action: "list" }, fixture.service, caps);
+    assert.equal(listed.result.count, 1, "ops-scoped token reads its own created task");
+
+    const peer = await runOp<{ created: boolean }>(
+      "peer_set",
+      { id: "ops-token-peer", kind: "agent" },
+      fixture.service,
+      caps,
+    );
+    assert.equal(peer.result.created, true, "ops-scoped token registers a peer");
+
+    const got = await runOp<{ found: boolean }>("peer_get", { id: "ops-token-peer" }, fixture.service, caps);
+    assert.equal(got.result.found, true, "ops-scoped token reads a peer");
+
+    const forgotten = await runOp<{ purged: boolean }>(
+      "peer_forget",
+      { id: "ops-token-peer", confirm: "yes" },
+      fixture.service,
+      caps,
+    );
+    assert.equal(forgotten.result.purged, true, "ops-scoped token may run the destructive purge it is granted");
+  } finally {
+    await fixture.cleanup();
+  }
+});
+
+test("B3: a legacy unrestricted token (no capability record) retains access to global ops", async () => {
+  const fixture = await createFixture();
+  try {
+    await seedGlobalRecords(fixture.root);
+
+    const listed = await runOp<{ count: number }>("work_task", { action: "list" }, fixture.service);
+    assert.equal(listed.result.count, 1, "legacy token lists work tasks");
+
+    const peers = await runOp<{ peers: { id: string }[] }>("peer_list", {}, fixture.service);
+    assert.deepEqual(
+      peers.result.peers.map((p) => p.id),
+      [PEER_ID],
+      "legacy token lists the seeded peer",
+    );
+  } finally {
+    await fixture.cleanup();
+  }
+});
+
+test("B3: peer_forget confirmation requirement is unchanged through the boundary", async () => {
+  const fixture = await createFixture();
+  try {
+    await seedGlobalRecords(fixture.root);
+    await assert.rejects(
+      () => runOp("peer_forget", { id: PEER_ID, confirm: "no" }, fixture.service),
+      (err: Error) => /confirm must be 'yes'/.test(err.message),
+    );
+    const files = await snapshotDir(fixture.root);
+    assert.ok(files.some((line) => line.includes(`${PEER_ID}/identity.md`)), "peer survives a rejected confirmation");
+  } finally {
+    await fixture.cleanup();
+  }
+});

package/src/access-http-peer-fleet-wide.test.ts

@@ -0,0 +1,192 @@
+import assert from "node:assert/strict";
+import { mkdtemp, readdir, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import { EngramAccessHttpServer } from "./access-http.js";
+import { EngramAccessService } from "./access-service.js";
+import { Orchestrator } from "./orchestrator.js";
+import { parseConfig } from "./config.js";
+import { writePeer, writePeerProfile } from "./peers/index.js";
+
+// Issue #3225 B3: the HTTP peer routes dispatch to global stores, so REST
+// must enforce the same operation policy as MCP — a namespace-scoped token
+// (any namespaces axis, including []) must be denied before any file in the
+// store changes, while ops-scoped and legacy tokens keep working.
+
+const PEER_ID = "b3-target-peer";
+const NOW = "2026-11-11T00:00:00.000Z";
+
+async function createService(): Promise<{ root: string; service: EngramAccessService; cleanup: () => Promise<void> }> {
+  const root = await mkdtemp(path.join(tmpdir(), "remnic-http-peer-fleet-wide-"));
+  const orchestrator = new Orchestrator(
+    parseConfig({ memoryDir: root, namespacesEnabled: false, defaultNamespace: "global" }),
+  );
+  const storage = await orchestrator.getStorage();
+  await storage.ensureDirectories();
+  await writePeer(root, {
+    id: PEER_ID,
+    kind: "agent",
+    displayName: "seeded peer",
+    createdAt: NOW,
+    updatedAt: NOW,
+  });
+  await writePeerProfile(root, {
+    peerId: PEER_ID,
+    updatedAt: NOW,
+    fields: { communication_style: "seeded" },
+    provenance: {},
+  });
+  return { root, service: new EngramAccessService(orchestrator), cleanup: () => rm(root, { recursive: true, force: true }) };
+}
+
+/** Sorted relpath:content lines for every file under root (mutation detector). */
+async function snapshotDir(root: string): Promise<string[]> {
+  const entries = await readdir(root, { recursive: true, withFileTypes: true });
+  const lines: string[] = [];
+  for (const entry of entries) {
+    if (!entry.isFile()) continue;
+    const abs = path.join(entry.parentPath, entry.name);
+    const content = await readFile(abs, "utf8");
+    lines.push(`${path.relative(root, abs)}:${content}`);
+  }
+  return lines.sort();
+}
+
+test("HTTP peer routes deny namespace-scoped tokens before the stores, REST policy matches MCP (issue #3225 B3)", async () => {
+  const { root, service, cleanup } = await createService();
+  const server = new EngramAccessHttpServer({
+    service,
+    port: 0,
+    authToken: "legacy-operator",
+    authTokenEntriesGetter: () => [
+      { token: "ns-scoped", capabilities: { version: 1, namespaces: ["ns_a"] } },
+      { token: "ns-empty", capabilities: { version: 1, namespaces: [] } },
+      {
+        token: "ops-peer",
+        capabilities: {
+          version: 1,
+          ops: ["peer_list", "peer_get", "peer_set", "peer_delete", "peer_profile_get", "peer_forget"],
+        },
+      },
+    ],
+    adminConsoleEnabled: false,
+  });
+  const status = await server.start();
+  const call = (token: string, pathname: string, init?: RequestInit) =>
+    fetch(`http://127.0.0.1:${status.port}${pathname}`, {
+      ...init,
+      headers: { "content-type": "application/json", authorization: `Bearer ${token}`, ...(init?.headers ?? {}) },
+    });
+
+  try {
+    const before = await snapshotDir(root);
+
+    // Namespace-scoped token (single namespace): every peer route is denied
+    // BEFORE the store is touched — including the destructive purge.
+    assert.equal((await call("ns-scoped", "/engram/v1/peers")).status, 403, "peer_list denied");
+    assert.equal((await call("ns-scoped", `/engram/v1/peers/${PEER_ID}`)).status, 403, "peer_get denied");
+    assert.equal(
+      (await call("ns-scoped", `/engram/v1/peers/${PEER_ID}`, { method: "PUT", body: JSON.stringify({ displayName: "hijack" }) })).status,
+      403,
+      "peer_set denied",
+    );
+    assert.equal((await call("ns-scoped", `/engram/v1/peers/${PEER_ID}`, { method: "DELETE" })).status, 403, "peer_delete denied");
+    assert.equal(
+      (
+        await call("ns-scoped", `/engram/v1/peers/${PEER_ID}?forget=true`, {
+          method: "DELETE",
+          body: JSON.stringify({ confirm: "yes" }),
+        })
+      ).status,
+      403,
+      "peer_forget denied",
+    );
+    assert.equal((await call("ns-scoped", `/engram/v1/peers/${PEER_ID}/profile`)).status, 403, "peer_profile_get denied");
+
+    // Empty namespace allow-list: denied too.
+    assert.equal((await call("ns-empty", "/engram/v1/peers")).status, 403, "empty namespace list denied");
+
+    // Denials never reached the stores — no file read effect, no mutation.
+    assert.deepEqual(await snapshotDir(root), before, "denied requests must not change any peer file");
+
+    // An ops-scoped token without a namespace axis keeps full peer access.
+    const listed = await call("ops-peer", "/engram/v1/peers");
+    assert.equal(listed.status, 200, "ops-scoped token lists peers");
+    // SAFETY: the peer_list REST route returns the service envelope { peers }.
+    const listedBody = (await listed.json()) as { peers: { id: string }[] };
+    assert.deepEqual(listedBody.peers.map((p) => p.id), [PEER_ID], "ops-scoped token sees the seeded peer");
+
+    const created = await call("ops-peer", "/engram/v1/peers/ops-peer-1", {
+      method: "PUT",
+      body: JSON.stringify({ displayName: "ops token peer" }),
+    });
+    assert.equal(created.status, 201, "ops-scoped token registers a peer");
+    // SAFETY: the peer_set REST route returns the upsert outcome { created, peer }.
+    const createdBody = (await created.json()) as { created: boolean; peer: { displayName: string } };
+    assert.equal(createdBody.created, true);
+    assert.equal(createdBody.peer.displayName, "ops token peer");
+
+    const purged = await call("ops-peer", "/engram/v1/peers/ops-peer-1?forget=true", {
+      method: "DELETE",
+      body: JSON.stringify({ confirm: "yes" }),
+    });
+    assert.equal(purged.status, 200, "ops-scoped token purges a peer");
+    await purged.text();
+    const afterPurge = await snapshotDir(root);
+    assert.ok(
+      !afterPurge.some((line) => line.startsWith("peers/ops-peer-1/")),
+      "the destructive purge removed the peer directory",
+    );
+
+    // Legacy unrestricted token (static authToken, no capability record).
+    const legacyList = await call("legacy-operator", "/engram/v1/peers");
+    assert.equal(legacyList.status, 200, "legacy token lists peers");
+    await legacyList.text();
+
+    // Peer-forget confirmation behavior is unchanged: no confirm body, no purge.
+    const unconfirmed = await call("legacy-operator", `/engram/v1/peers/${PEER_ID}?forget=true`, {
+      method: "DELETE",
+      body: JSON.stringify({}),
+    });
+    assert.equal(unconfirmed.status, 400, "missing confirm still fails with 400");
+    assert.match(await unconfirmed.text(), /confirm_required/);
+    const seededIntact = await snapshotDir(root);
+    assert.ok(
+      seededIntact.some((line) => line.startsWith(`peers/${PEER_ID}/identity.md`)),
+      "the seeded peer survived the rejected confirmation",
+    );
+
+    // A malformed PUT body still fails loudly instead of silently defaulting.
+    const malformed = await call("legacy-operator", "/engram/v1/peers/malformed-peer", {
+      method: "PUT",
+      body: JSON.stringify({ displayName: 5 }),
+    });
+    assert.equal(malformed.status, 400, "a non-string displayName is rejected");
+    assert.match(await malformed.text(), /displayName/);
+    assert.ok(
+      !(await snapshotDir(root)).some((line) => line.startsWith("peers/malformed-peer/")),
+      "the rejected write created no peer file",
+    );
+
+    // An explicit null is a malformed field too (rule 51): the operation
+    // schema strips nulls, so the route must reject them before dispatch
+    // instead of registering the peer with default kind/name/notes.
+    for (const field of ["kind", "displayName", "notes"]) {
+      const nullField = await call("legacy-operator", `/engram/v1/peers/null-${field}-peer`, {
+        method: "PUT",
+        body: JSON.stringify({ [field]: null }),
+      });
+      assert.equal(nullField.status, 400, `an explicit null ${field} is rejected`);
+      assert.match(await nullField.text(), new RegExp(field));
+      assert.ok(
+        !(await snapshotDir(root)).some((line) => line.startsWith(`peers/null-${field}-peer/`)),
+        `the null ${field} request created no peer file`,
+      );
+    }
+  } finally {
+    await server.stop();
+    await cleanup();
+  }
+});