@rubytech/create-maxy-code 0.1.488 → 0.1.490

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-index-push.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest'
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync, unlinkSync } from 'node:fs'
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, unlinkSync, utimesSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { walkExposed, pushAccount } from '../../bin/portal-index-push.mjs'
@@ -12,6 +12,10 @@ function file(rel: string, body = 'x') {
   writeFileSync(abs, body)
 }
 
+function emptyDir(rel: string) {
+  mkdirSync(join(dir, rel), { recursive: true })
+}
+
 const SCHEMA = [
   '```allowed-top-level',
   'output',
@@ -45,12 +49,13 @@ function fakeClient() {
     calls,
     async query(sql: string, params: unknown[] = []) {
       calls.push({ sql, params })
-      if (/DELETE FROM directory/i.test(sql)) {
-        rows.clear()
+      // The open paren is load-bearing: `INSERT INTO directory_state` would
+      // otherwise register as a row insert and inflate every count.
+      if (/INSERT INTO directory \(/i.test(sql)) {
+        rows.add(String(params[1]))
         return []
       }
-      if (/INSERT INTO directory/i.test(sql)) {
-        rows.add(String(params[1]))
+      if (/DELETE FROM directory\b/i.test(sql)) {
         return []
       }
       if (/SELECT COUNT/i.test(sql)) return [{ n: rows.size }]
@@ -71,8 +76,11 @@ const push = (client: unknown, overrides: Record<string, unknown> = {}) =>
   })
 
 describe('walkExposed', () => {
-  it('returns files only from exposed dirs, at any depth', async () => {
-    const paths = (await walkExposed(dir, ['output', 'quotes'])).map((r) => r.relPath).sort()
+  it('returns files from exposed dirs, at any depth', async () => {
+    const paths = (await walkExposed(dir, ['output', 'quotes']))
+      .filter((r) => !r.isDir)
+      .map((r) => r.relPath)
+      .sort()
     expect(paths).toEqual(['output/report.pdf', 'quotes/CR2969/quote.pdf', 'quotes/CR2974/quote.pdf'])
   })
 
@@ -89,29 +97,93 @@ describe('walkExposed', () => {
   })
 
   it('carries size and an iso modified time', async () => {
-    const row = (await walkExposed(dir, ['output']))[0]
+    const row = (await walkExposed(dir, ['output'])).find((r) => !r.isDir)!
     expect(row.sizeBytes).toBe(1)
     expect(row.modifiedAt).toMatch(/^\d{4}-\d{2}-\d{2}T/)
   })
+
+  // An exposed folder holding no files at any depth is the case the client
+  // could not see at all: nothing derived a folder name from a file prefix.
+  it('emits exactly one row for an exposed dir holding no files, marked isDir', async () => {
+    emptyDir('jobs')
+    const rows = await walkExposed(dir, ['jobs'])
+    expect(rows.length).toBe(1)
+    expect(rows[0].relPath).toBe('jobs')
+    expect(rows[0].isDir).toBe(true)
+    expect(rows[0].sizeBytes).toBe(0)
+    expect(rows[0].modifiedAt).toMatch(/^\d{4}-\d{2}-\d{2}T/)
+  })
+
+  it('emits the dir row and the file row for a dir holding a nested file', async () => {
+    const rows = await walkExposed(dir, ['quotes'])
+    const byPath = new Map(rows.map((r) => [r.relPath, r]))
+    expect(byPath.get('quotes')?.isDir).toBe(true)
+    expect(byPath.get('quotes/CR2969')?.isDir).toBe(true)
+    expect(byPath.get('quotes/CR2969/quote.pdf')?.isDir).toBe(false)
+  })
+
+  // The dir row's time is the directory's own, not the walk's: a folder whose
+  // contents changed is what the operator reads, and `new Date()` here would
+  // make every row look freshly touched every cycle.
+  it('takes the dir mtime rather than the time of the walk', async () => {
+    emptyDir('jobs')
+    const past = new Date('2020-03-04T05:06:07.000Z')
+    utimesSync(join(dir, 'jobs'), past, past)
+    const rows = await walkExposed(dir, ['jobs'])
+    expect(rows[0].modifiedAt).toBe('2020-03-04T05:06:07.000Z')
+  })
+
+  it('emits no row for a dot-prefixed dir at any level', async () => {
+    const paths = (await walkExposed(dir, ['output'])).map((r) => r.relPath)
+    expect(paths).not.toContain('output/.uploads-tmp')
+  })
 })
 
 describe('pushAccount', () => {
-  it('deletes the account rows then inserts the current walk', async () => {
+  // 7 rows: the 3 files plus output/, quotes/, quotes/CR2969/, quotes/CR2974/.
+  it('stages the current walk, then flips the pointer to it', async () => {
+    // Task 1910 replaced delete-then-insert with stage-flip-sweep. The first
+    // statement now READS the pointer rather than emptying the table, which is
+    // what removes the window where a client saw nothing.
     const c = fakeClient()
     const r = await push(c)
     expect(r.exposed).toEqual(['output', 'quotes'])
-    expect(r.rows).toBe(3)
-    expect(/DELETE FROM directory/i.test(c.calls[0].sql)).toBe(true)
+    expect(r.rows).toBe(7)
+    expect(/SELECT currentGeneration/i.test(c.calls[0].sql)).toBe(true)
     expect(c.calls[0].params).toEqual(['acc-1'])
-    expect(c.calls.filter((x) => /INSERT INTO directory/i.test(x.sql)).length).toBe(3)
+    expect(c.calls.filter((x) => /INSERT INTO directory \(/i.test(x.sql)).length).toBe(7)
   })
 
+  // The folder itself survives its last file: emptied is not the same as gone,
+  // and the client still needs somewhere to put the next one.
   it('converges on a delete: a removed file leaves no stale row', async () => {
     const c = fakeClient()
     await push(c)
     unlinkSync(join(dir, 'quotes/CR2974/quote.pdf'))
+    // The fake accumulates calls across pushes; only the second one is the
+    // converged state.
+    const before = c.calls.length
     const second = await push(c)
-    expect(second.rows).toBe(2)
+    expect(second.rows).toBe(6)
+    const inserted = c.calls
+      .slice(before)
+      .filter((x) => /INSERT INTO directory/i.test(x.sql))
+      .map((x) => String(x.params[1]))
+    expect(inserted).toContain('quotes/CR2974')
+    expect(inserted).not.toContain('quotes/CR2974/quote.pdf')
+  })
+
+  it('marks each inserted row as a directory or not', async () => {
+    const c = fakeClient()
+    await push(c)
+    const byPath = new Map(
+      c.calls
+        .filter((x) => /INSERT INTO directory/i.test(x.sql))
+        .map((x) => [String(x.params[1]), x.params[5]]),
+    )
+    expect(byPath.get('quotes')).toBe(1)
+    expect(byPath.get('quotes/CR2969')).toBe(1)
+    expect(byPath.get('quotes/CR2969/quote.pdf')).toBe(0)
   })
 
   it('binds every value as a param rather than interpolating it', async () => {
@@ -133,13 +205,14 @@ describe('pushAccount', () => {
     expect(c.calls.length).toBe(0)
   })
 
-  it('logs resolve, replace and verify lines', async () => {
+  it('logs resolve, stage, flip and verify lines', async () => {
     const lines: string[] = []
     const c = fakeClient()
     await push(c, { log: (l: string) => lines.push(l) })
     expect(lines.some((l) => l.includes('op=resolve') && l.includes('exposed=output,quotes'))).toBe(true)
-    expect(lines.some((l) => l.includes('op=replace') && l.includes('inserted=3'))).toBe(true)
-    expect(lines.some((l) => l.includes('op=verify') && l.includes('rowsAfter=3') && l.includes('expected=3'))).toBe(true)
+    expect(lines.some((l) => l.includes('op=stage') && l.includes('inserted=7'))).toBe(true)
+    expect(lines.some((l) => l.includes('op=flip') && l.includes('generation=1'))).toBe(true)
+    expect(lines.some((l) => l.includes('op=verify') && l.includes('rowsAfter=7') && l.includes('expected=7'))).toBe(true)
   })
 
   it('reports an exposed-set change only when it actually changes', async () => {
@@ -197,3 +270,130 @@ describe('pushAccount', () => {
     expect(lines.some((l) => /op=resolve .*extraFolders=0/.test(l))).toBe(true)
   })
 })
+
+// The atomic replace (Task 1910), superseding backlog Task 1842.
+//
+// A generation-aware client: rows carry a generation, and a reader sees only
+// the generation the pointer names. That is what makes "never a half-built
+// tree" a measurable property rather than an assertion.
+function generationClient() {
+  const calls: { sql: string; params: unknown[] }[] = []
+  /** @type {{accountId: string, relPath: string, generation: number}[]} */
+  const rows: { accountId: string; relPath: string; generation: number }[] = []
+  let pointer: number | null = null
+  return {
+    calls,
+    rows,
+    /** What a client listing right now would see. */
+    visible() {
+      return pointer === null ? [] : rows.filter((r) => r.generation === pointer)
+    },
+    pointerValue() {
+      return pointer
+    },
+    async query(sql: string, params: unknown[] = []) {
+      calls.push({ sql, params })
+      if (/SELECT\s+currentGeneration/i.test(sql)) {
+        return pointer === null ? [] : [{ currentGeneration: pointer }]
+      }
+      if (/INSERT INTO directory_state|UPDATE directory_state/i.test(sql)) {
+        pointer = Number(params[1] ?? params[0])
+        return []
+      }
+      if (/INSERT INTO directory\b/i.test(sql)) {
+        rows.push({
+          accountId: String(params[0]),
+          relPath: String(params[1]),
+          generation: Number(params[6]),
+        })
+        return []
+      }
+      if (/DELETE FROM directory\b/i.test(sql)) {
+        const keep = Number(params[1])
+        for (let i = rows.length - 1; i >= 0; i--) {
+          if (rows[i].generation !== keep) rows.splice(i, 1)
+        }
+        return []
+      }
+      if (/SELECT COUNT/i.test(sql)) {
+        return [{ n: rows.filter((r) => r.generation === pointer).length }]
+      }
+      return []
+    },
+  }
+}
+
+describe('the index replace is atomic', () => {
+  it('never issues a delete before the pointer flip', async () => {
+    // The delete-then-insert window this replaces was Task 1842: a client
+    // listing mid-push saw an empty or half-built tree. At 60s cadence that
+    // window would be hit sixty times more often than it was hourly.
+    const c = generationClient()
+    await push(c)
+    const flipAt = c.calls.findIndex((x) => /INSERT INTO directory_state/i.test(x.sql))
+    const deleteAt = c.calls.findIndex((x) => /^DELETE FROM directory\b/i.test(x.sql.trim()))
+    expect(flipAt).toBeGreaterThanOrEqual(0)
+    expect(deleteAt).toBeGreaterThan(flipAt)
+  })
+
+  it('writes every row before the flip', async () => {
+    const c = generationClient()
+    await push(c)
+    const flipAt = c.calls.findIndex((x) => /INSERT INTO directory_state/i.test(x.sql))
+    const lastInsert = c.calls.map((x) => /INSERT INTO directory\b/i.test(x.sql)).lastIndexOf(true)
+    expect(lastInsert).toBeLessThan(flipAt)
+  })
+
+  it('a reader mid-push sees the old tree, never a partial one', async () => {
+    // First publish establishes generation 1.
+    const c = generationClient()
+    await push(c)
+    const first = c.visible().map((r) => r.relPath).sort()
+    expect(first.length).toBeGreaterThan(0)
+
+    // A second publish stages generation 2. Until the flip, `visible()` must
+    // still be exactly the first tree — not a mixture, not an empty set.
+    const seen: string[][] = []
+    const watched = {
+      ...c,
+      async query(sql: string, params: unknown[] = []) {
+        const out = await c.query(sql, params)
+        seen.push(c.visible().map((r) => r.relPath).sort())
+        return out
+      },
+    }
+    await push(watched)
+
+    const flipIdx = c.calls.findIndex(
+      (x, i) => i > first.length && /INSERT INTO directory_state/i.test(x.sql),
+    )
+    for (let i = 0; i < flipIdx; i++) {
+      expect(seen[i]).toEqual(first)
+    }
+  })
+
+  it('advances the generation on each publish', async () => {
+    const c = generationClient()
+    await push(c)
+    expect(c.pointerValue()).toBe(1)
+    await push(c)
+    expect(c.pointerValue()).toBe(2)
+  })
+
+  it('deletes superseded generations after the flip', async () => {
+    const c = generationClient()
+    await push(c)
+    await push(c)
+    expect(c.rows.every((r) => r.generation === 2)).toBe(true)
+  })
+
+  it('writes nothing at all when the exposed set is empty', async () => {
+    // Fail closed must not delete the account rows: that state would be
+    // indistinguishable from a successful publish of an account with no
+    // deliverables.
+    rmSync(join(dir, 'SCHEMA.md'))
+    const c = generationClient()
+    await push(c)
+    expect(c.calls.filter((x) => /INSERT|DELETE|directory_state/i.test(x.sql))).toEqual([])
+  })
+})

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-indexed-download.test.ts

@@ -10,14 +10,17 @@ function makeEnv(
     secret?: string
     origin?: string
     paths?: string[]
+    dirPaths?: string[]
     folders?: string
+    onQuery?: (query: string) => void
   } = {},
 ) {
-  const { accountId = 'acc-a', paths = [PATH] } = opts
+  const { accountId = 'acc-a', paths = [PATH], dirPaths = [], onQuery = () => {} } = opts
   const folders = 'folders' in opts ? opts.folders : ''
   return {
     DB: {
       prepare(query: string) {
+        onQuery(query)
         let bound: unknown[] = []
         const stmt = {
           bind(...v: unknown[]) {
@@ -37,7 +40,9 @@ function makeEnv(
                 : null) as T | null
             }
             if (/FROM directory/i.test(query)) {
-              return (paths.includes(bound[1] as string) ? { relPath: bound[1] } : null) as T | null
+              const rel = bound[1] as string
+              if (dirPaths.includes(rel)) return { relPath: rel, isDir: 1 } as T
+              return (paths.includes(rel) ? { relPath: rel, isDir: 0 } : null) as T | null
             }
             return null as T | null
           },
@@ -100,6 +105,37 @@ describe('processIndexedDownload', () => {
     expect(touched).toBe(false)
   })
 
+  // Folders are in the index now, so a client can name one here. A folder has
+  // no bytes and must never mint a signed link. result=is-directory separates
+  // it from result=not-granted and result=absent, the only readings before.
+  it('refuses a directory rather than signing a link for it', async () => {
+    let touched = false
+    const spy = async () => {
+      touched = true
+      return { ok: true, status: 200 }
+    }
+    const lines: string[] = []
+    const r = await processIndexedDownload(
+      'sess-a',
+      'quotes/CR2969',
+      makeEnv({ paths: [PATH], dirPaths: ['quotes/CR2969'] }),
+      (l) => lines.push(l),
+      1000,
+      spy as never,
+    )
+    expect(r.status).toBe(404)
+    expect(r.url).toBeUndefined()
+    expect(touched).toBe(false)
+    expect(lines.some((l) => l.includes('result=is-directory'))).toBe(true)
+  })
+
+  it('reads isDir in the directory select', async () => {
+    const queries: string[] = []
+    const env = makeEnv({ onQuery: (q) => queries.push(q) })
+    await processIndexedDownload('sess-a', PATH, env, () => {}, 1000, okHead as never)
+    expect(queries.some((q) => /FROM directory/i.test(q) && /isDir/.test(q))).toBe(true)
+  })
+
   it('401s without a session', async () => {
     const r = await processIndexedDownload('nope', PATH, makeEnv(), () => {}, 1000, okHead as never)
     expect(r.status).toBe(401)

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-moved-download.test.ts

@@ -0,0 +1,83 @@
+import { describe, expect, it } from 'vitest'
+import { processDownload } from '../../skills/data-portal/template/functions/api/download'
+import type { PortalEnv } from '../../skills/data-portal/template/functions/api/_lib/types'
+
+const ACC = '098a18a3-1741-447f-9778-65470645d57d'
+
+function harness(row: { devicePath: string } | null, opts: { configured?: boolean } = {}) {
+  const configured = opts.configured ?? true
+  const lines: string[] = []
+  const env = {
+    BUCKET: {
+      async get(key: string) {
+        // Only an in-transit object exists. A moved row's bytes are gone from
+        // R2 entirely, which is what makes reading them here the wrong move.
+        return row && !row.devicePath ? { body: null, size: 4, key } : null
+      },
+    },
+    DB: {
+      prepare(sql: string) {
+        return {
+          bind() {
+            return {
+              async first() {
+                if (sql.includes('FROM sessions')) {
+                  return { ownerId: 'alice', accountId: ACC, folders: '' }
+                }
+                if (sql.includes('devicePath')) return row
+                return null
+              },
+            }
+          },
+        }
+      },
+    },
+    PORTAL_FETCH_SECRET: configured ? 'test-secret-value' : undefined,
+    PORTAL_INSTALL_ORIGIN: configured ? 'https://install.example' : undefined,
+  } as unknown as PortalEnv
+  return { env, lines, log: (l: string) => lines.push(l) }
+}
+
+describe('downloading an upload that has moved to the device', () => {
+  it('streams R2 bytes while the row is still in transit', async () => {
+    const h = harness({ devicePath: '' })
+    const res = await processDownload('s', 'alice/a.pdf', h.env, h.log, 1000)
+    expect(res.status).toBe(200)
+    expect(res.body).not.toBeNull()
+    expect(res.url).toBeUndefined()
+  })
+
+  it('mints an own-upload link once the row has moved', async () => {
+    // The object is gone from R2. Without this branch the client's own upload
+    // would 404 the moment the device collected it.
+    const h = harness({ devicePath: 'uploads/alice/a.pdf' })
+    const res = await processDownload('s', 'alice/a.pdf', h.env, h.log, 1000)
+    expect(res.status).toBe(200)
+    expect(res.url).toContain('/api/portal/fetch')
+    expect(new URL(res.url!).searchParams.get('owner')).toBe('alice')
+    expect(new URL(res.url!).searchParams.get('path')).toBe('uploads/alice/a.pdf')
+    expect(h.lines.some((l) => l.includes('op=download') && l.includes('result=moved'))).toBe(true)
+  })
+
+  it('refuses another person key before anything is minted', async () => {
+    const h = harness({ devicePath: 'uploads/bob/a.pdf' })
+    const res = await processDownload('s', 'bob/a.pdf', h.env, h.log, 1000)
+    expect(res.status).toBe(403)
+    expect(res.url).toBeUndefined()
+  })
+
+  it('reports device-offline rather than a server error when unconfigured', async () => {
+    // Same reasoning as the indexed path: from the client's side the file
+    // genuinely is unreachable, and the operator's signal is the log line.
+    const h = harness({ devicePath: 'uploads/alice/a.pdf' }, { configured: false })
+    const res = await processDownload('s', 'alice/a.pdf', h.env, h.log, 1000)
+    expect(res.status).toBe(503)
+    expect(h.lines.some((l) => l.includes('result=unconfigured'))).toBe(true)
+  })
+
+  it('reports absent for a key with no manifest row at all', async () => {
+    const h = harness(null)
+    const res = await processDownload('s', 'alice/gone.pdf', h.env, h.log, 1000)
+    expect(res.status).toBe(404)
+  })
+})

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-schema-shape.test.ts

@@ -0,0 +1,48 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+
+// The schema is applied by the skill, not by any code this suite can call, so
+// its shape is asserted textually. A missing column here is not a test failure
+// in some other file — it is an upload naming a column D1 does not have.
+const SQL = readFileSync(
+  join(__dirname, '../../skills/data-portal/schema.sql'),
+  'utf8',
+)
+
+describe('portal schema shape', () => {
+  it('carries the manifest lifecycle columns', () => {
+    expect(SQL).toMatch(/targetPath\s+TEXT\s+NOT NULL\s+DEFAULT\s+''/)
+    expect(SQL).toMatch(/devicePath\s+TEXT\s+NOT NULL\s+DEFAULT\s+''/)
+    expect(SQL).toMatch(/deleted\s+INTEGER\s+NOT NULL\s+DEFAULT\s+0/)
+  })
+
+  it('carries the directory generation and its pointer table', () => {
+    expect(SQL).toMatch(/generation\s+INTEGER\s+NOT NULL\s+DEFAULT\s+0/)
+    expect(SQL).toMatch(/CREATE TABLE IF NOT EXISTS directory_state/)
+    expect(SQL).toMatch(/currentGeneration\s+INTEGER\s+NOT NULL/)
+  })
+
+  it('keeps objectKey UNIQUE, which the upsert conflict target still needs', () => {
+    // objectKey is now ownerId/targetPath/filename. The upsert still conflicts
+    // on it, so this pins that the constraint was not dropped by accident while
+    // the key shape changed underneath it.
+    expect(SQL).toMatch(/objectKey\s+TEXT\s+UNIQUE\s+NOT NULL/)
+  })
+
+  it('scopes the directory uniqueness by generation', () => {
+    // Two generations hold the same relPath at once between the write and the
+    // flip. UNIQUE (accountId, relPath) would reject the second write and the
+    // push could never stage a new generation at all.
+    expect(SQL).toMatch(/UNIQUE\s*\(\s*accountId,\s*relPath,\s*generation\s*\)/)
+  })
+
+  it('documents the hand-run ALTER for every added column', () => {
+    // IF NOT EXISTS adds no column to an existing table, so a portal deployed
+    // before this needs each one by hand. An undocumented column is an operator
+    // reading "no such column" with nothing telling them what to run.
+    for (const col of ['targetPath', 'devicePath', 'deleted', 'generation']) {
+      expect(SQL).toMatch(new RegExp(`ALTER TABLE \\w+ ADD COLUMN ${col}\\b`))
+    }
+  })
+})

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-sign.test.ts

@@ -4,6 +4,9 @@ import {
   signPath,
   verifyPath,
   buildSignedUrl,
+  signOwnUpload,
+  verifyOwnUpload,
+  buildOwnUploadUrl,
 } from '../../skills/data-portal/template/functions/api/_lib/portal-sign.mjs'
 
 const SECRET = 'test-secret-value'
@@ -66,3 +69,62 @@ describe('portal-sign', () => {
     expect(url.searchParams.get('sig')).toMatch(/^[0-9a-f]{64}$/)
   })
 })
+
+// The second link type (Task 1910). An untargeted upload moves to
+// `uploads/<ownerId>/`, which the exposed set never contains, so the ordinary
+// signature cannot reach it and the device has no way to know whose folder is
+// being asked for. Binding the owner INSIDE the HMAC is what makes that safe.
+describe('own-upload signatures', () => {
+  const OWNER = 'alice'
+  const PATH = 'uploads/alice/invoice.pdf'
+
+  it('verifies a link minted for the same owner', async () => {
+    const exp = NOW + 1000
+    const sig = await signOwnUpload(SECRET, ACC, OWNER, PATH, exp)
+    expect(await verifyOwnUpload(SECRET, ACC, OWNER, PATH, exp, sig, NOW)).toBe(true)
+  })
+
+  it('refuses the same path claimed under a different owner', async () => {
+    // The whole point: bob must not be able to present alice's link, and a
+    // portal must not be able to mint one into her folder.
+    const exp = NOW + 1000
+    const sig = await signOwnUpload(SECRET, ACC, OWNER, PATH, exp)
+    expect(await verifyOwnUpload(SECRET, ACC, 'bob', PATH, exp, sig, NOW)).toBe(false)
+  })
+
+  it('is a DIFFERENT message from the exposed-folder signature', async () => {
+    // If the two shapes collided, an ordinary signed link would admit an
+    // uploads path and the owner binding would be decorative.
+    const exp = NOW + 1000
+    const own = await signOwnUpload(SECRET, ACC, OWNER, PATH, exp)
+    const plain = await signPath(SECRET, ACC, PATH, exp)
+    expect(own).not.toBe(plain)
+  })
+
+  it('does not verify under the ordinary scheme', async () => {
+    const exp = NOW + 1000
+    const own = await signOwnUpload(SECRET, ACC, OWNER, PATH, exp)
+    expect(await verifyPath(SECRET, ACC, PATH, exp, own, NOW)).toBe(false)
+  })
+
+  it('refuses an expired link', async () => {
+    const exp = NOW - 1
+    const sig = await signOwnUpload(SECRET, ACC, OWNER, PATH, exp)
+    expect(await verifyOwnUpload(SECRET, ACC, OWNER, PATH, exp, sig, NOW)).toBe(false)
+  })
+
+  it('refuses a wrong secret', async () => {
+    const exp = NOW + 1000
+    const sig = await signOwnUpload(SECRET, ACC, OWNER, PATH, exp)
+    expect(await verifyOwnUpload('other-secret', ACC, OWNER, PATH, exp, sig, NOW)).toBe(false)
+  })
+
+  it('carries the owner as a query parameter so the device can name it', async () => {
+    const raw = await buildOwnUploadUrl('https://install.example', SECRET, ACC, OWNER, PATH, NOW + 1000)
+    const url = new URL(raw)
+    expect(url.pathname).toBe('/api/portal/fetch')
+    expect(url.searchParams.get('owner')).toBe(OWNER)
+    expect(url.searchParams.get('path')).toBe(PATH)
+    expect(url.searchParams.get('sig')).toMatch(/^[0-9a-f]{64}$/)
+  })
+})

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-target.test.ts

@@ -0,0 +1,103 @@
+import { describe, expect, it } from 'vitest'
+import {
+  checkTarget,
+  isSafeTargetSegment,
+  uploadKey,
+} from '../../skills/data-portal/template/functions/api/_lib/target'
+
+/** A D1 fake whose `first()` answers from a set of published folder rows. It
+ *  models the real query's constraint rather than its happy path: a row is a
+ *  folder only when isDir = 1, so a fake that ignored the filter would let a
+ *  file path pass as an upload target. */
+function fakeDb(folders: string[]) {
+  return {
+    prepare(sql: string) {
+      return {
+        bind(_accountId: string, relPath: string) {
+          return {
+            async first() {
+              if (!sql.includes('isDir = 1')) throw new Error('query must filter isDir')
+              return folders.includes(relPath) ? { relPath } : null
+            },
+          }
+        },
+      }
+    },
+  } as never
+}
+
+/** Any query at all is a failure for the cases that must refuse before the
+ *  index is read. Refusing early is not an optimisation here: it is what keeps
+ *  an out-of-grant probe from costing a database round trip. */
+const noQueryDb = {
+  prepare() {
+    throw new Error('must not query')
+  },
+} as never
+
+describe('isSafeTargetSegment', () => {
+  it('rejects traversal, separators, empties and NUL', () => {
+    for (const bad of ['', '.', '..', 'a/b', 'a\\b', 'a\0b']) {
+      expect(isSafeTargetSegment(bad)).toBe(false)
+    }
+  })
+
+  it('accepts an ordinary folder name', () => {
+    expect(isSafeTargetSegment('jobs')).toBe(true)
+  })
+})
+
+describe('uploadKey', () => {
+  it('collapses to owner/filename when untargeted', () => {
+    expect(uploadKey('alice', '', 'a.pdf')).toBe('alice/a.pdf')
+  })
+
+  it('carries the target so two folders never collide', () => {
+    expect(uploadKey('alice', 'jobs', 'a.pdf')).toBe('alice/jobs/a.pdf')
+    expect(uploadKey('alice', 'jobs/2026', 'a.pdf')).toBe('alice/jobs/2026/a.pdf')
+  })
+})
+
+describe('checkTarget', () => {
+  it('admits the empty target without touching the index', async () => {
+    expect(await checkTarget(noQueryDb, 'acct', [], '')).toEqual({ ok: true })
+  })
+
+  it('admits a granted folder that the index publishes', async () => {
+    expect(await checkTarget(fakeDb(['jobs']), 'acct', [], 'jobs')).toEqual({ ok: true })
+  })
+
+  it('admits a nested path under a granted top-level folder', async () => {
+    expect(await checkTarget(fakeDb(['jobs/2026']), 'acct', ['jobs'], 'jobs/2026')).toEqual({
+      ok: true,
+    })
+  })
+
+  it('refuses a folder outside the grant before reading the index', async () => {
+    expect(await checkTarget(noQueryDb, 'acct', ['output'], 'jobs')).toEqual({
+      ok: false,
+      reason: 'grant',
+    })
+  })
+
+  it('refuses a folder the index does not publish', async () => {
+    expect(await checkTarget(fakeDb(['jobs']), 'acct', [], 'output')).toEqual({
+      ok: false,
+      reason: 'index',
+    })
+  })
+
+  it('refuses a traversal segment before any lookup', async () => {
+    expect(await checkTarget(noQueryDb, 'acct', [], 'jobs/../secrets')).toEqual({
+      ok: false,
+      reason: 'segment',
+    })
+  })
+
+  it('refuses a trailing separator, which is an empty segment', async () => {
+    expect(await checkTarget(noQueryDb, 'acct', [], 'jobs/')).toEqual({
+      ok: false,
+      reason: 'segment',
+    })
+  })
+})