@rubytech/create-sitedesk-code 0.1.519 → 0.1.520

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-assemble.test.ts

@@ -0,0 +1,143 @@
+import { describe, it, expect } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+// @ts-expect-error - .mjs helper with JSDoc types, imported for its pure core
+import { assembleTree, parseEnvFile } from '../../bin/portal-assemble.mjs'
+
+// The real template, not a hand-written copy: a test that invented its own
+// placeholder set would keep passing after the template gained one.
+const TEMPLATE = readFileSync(
+  join(__dirname, '../../skills/data-portal/template/wrangler.toml'),
+  'utf8',
+)
+
+const shared = {
+  DATA_PORTAL_DB_NAME: 'house-data-portal',
+  DATA_PORTAL_DB_ID: 'db-123',
+  DATA_PORTAL_BUCKET: 'house-data-portal',
+}
+const cfg = {
+  accountId: 'acct-a',
+  projectName: 'ecolec-data-portal',
+  portalDomain: 'ecolec-data.example',
+  storageModel: 'shared',
+}
+const installOrigin = 'https://pub.example'
+
+describe('portal assemble (Task 2099)', () => {
+  it('fills every placeholder from the shared identity and the account', () => {
+    const out = assembleTree({ toml: TEMPLATE, shared, cfg, installOrigin })
+    expect(out).toContain('database_name = "house-data-portal"')
+    expect(out).toContain('database_id = "db-123"')
+    expect(out).toContain('bucket_name = "house-data-portal"')
+    expect(out).toContain('PORTAL_ACCOUNT_ID = "acct-a"')
+    expect(out).toContain('name = "ecolec-data-portal"')
+    expect(out).toContain('PORTAL_INSTALL_ORIGIN = "https://pub.example"')
+  })
+
+  it('leaves no placeholder behind, which is the whole post-condition', () => {
+    const out = assembleTree({ toml: TEMPLATE, shared, cfg, installOrigin })
+    expect(out).not.toMatch(/__[A-Z0-9_]+__/)
+  })
+
+  it('gives two portals the same store and different account vars', () => {
+    // The shape of the shared model: one store, many portals, and the account
+    // var is the only thing that differs between two assembled trees.
+    const a = assembleTree({ toml: TEMPLATE, shared, cfg, installOrigin })
+    const b = assembleTree({
+      toml: TEMPLATE,
+      shared,
+      cfg: { ...cfg, accountId: 'acct-b', projectName: 'other-data-portal' },
+      installOrigin,
+    })
+    expect(a).toContain('database_id = "db-123"')
+    expect(b).toContain('database_id = "db-123"')
+    expect(a).toContain('PORTAL_ACCOUNT_ID = "acct-a"')
+    expect(b).toContain('PORTAL_ACCOUNT_ID = "acct-b"')
+  })
+
+  for (const key of ['DATA_PORTAL_DB_NAME', 'DATA_PORTAL_DB_ID', 'DATA_PORTAL_BUCKET']) {
+    it(`refuses when ${key} is missing rather than emitting a blank binding`, () => {
+      expect(() =>
+        assembleTree({ toml: TEMPLATE, shared: { ...shared, [key]: '' }, cfg, installOrigin }),
+      ).toThrow(new RegExp(key))
+    })
+  }
+
+  it('refuses a grandfathered account, which this template cannot serve', () => {
+    // Its database has no accountId column and every query here binds one, so
+    // assembling would deploy a portal that errors on the first request.
+    expect(() =>
+      assembleTree({ toml: TEMPLATE, shared, cfg: { ...cfg, storageModel: 'dedicated' }, installOrigin }),
+    ).toThrow(/dedicated/)
+  })
+
+  it('treats an absent storageModel as dedicated, never as shared', () => {
+    const { storageModel, ...noModel } = cfg
+    expect(() => assembleTree({ toml: TEMPLATE, shared, cfg: noModel, installOrigin })).toThrow(
+      /dedicated/,
+    )
+  })
+
+  it('refuses an unrecognised storage model rather than guessing', () => {
+    expect(() =>
+      assembleTree({ toml: TEMPLATE, shared, cfg: { ...cfg, storageModel: 'Shared' }, installOrigin }),
+    ).toThrow(/Shared/)
+  })
+
+  it('refuses a config missing its account or project', () => {
+    expect(() =>
+      assembleTree({ toml: TEMPLATE, shared, cfg: { ...cfg, accountId: '' }, installOrigin }),
+    ).toThrow(/accountId/)
+    expect(() =>
+      assembleTree({ toml: TEMPLATE, shared, cfg: { ...cfg, projectName: '' }, installOrigin }),
+    ).toThrow(/projectName/)
+  })
+
+  it('refuses an empty install origin', () => {
+    expect(() => assembleTree({ toml: TEMPLATE, shared, cfg, installOrigin: '' })).toThrow(/origin/)
+  })
+
+  it('refuses when the config account disagrees with the account directory', () => {
+    // PORTAL_ACCOUNT_ID is baked in permanently and becomes the worker's tenant
+    // scope, but the house-side loops scope by the DIRECTORY name. If the two
+    // differ the worker writes under one tenant while the pull, index push and
+    // audit read under another, and nothing reports it: the reads just return
+    // nothing and the client's uploads never arrive.
+    expect(() =>
+      assembleTree({ toml: TEMPLATE, shared, cfg, installOrigin, expectedAccountId: 'acct-b' }),
+    ).toThrow(/acct-a.*acct-b|acct-b.*acct-a/s)
+  })
+
+  it('accepts when they agree', () => {
+    const out = assembleTree({ toml: TEMPLATE, shared, cfg, installOrigin, expectedAccountId: 'acct-a' })
+    expect(out).toContain('PORTAL_ACCOUNT_ID = "acct-a"')
+  })
+
+  it('refuses an accountId the deployed key gate would reject', () => {
+    // authorizeKey enforces [a-z0-9-] on both key segments, so baking anything
+    // else means every upload 403s after deploy instead of failing here.
+    for (const bad of ['Acct-A', 'acct_a', 'acct a', 'acct/a']) {
+      expect(() =>
+        assembleTree({ toml: TEMPLATE, shared, cfg: { ...cfg, accountId: bad }, installOrigin }),
+      ).toThrow(/\[a-z0-9-\]/)
+    }
+  })
+})
+
+describe('parseEnvFile', () => {
+  it('reads KEY=value, trims the value, and ignores comments and blanks', () => {
+    const env = parseEnvFile('# c\n\nA=1\n  B=2 \nnot a pair\n')
+    expect(env.A).toBe('1')
+    expect(env.B).toBe('2')
+    expect(env['not a pair']).toBeUndefined()
+  })
+
+  it('does not accept a space before the equals, matching readHouseCredential', () => {
+    // Deliberately the same regex as lib/storage-broker's house-credential
+    // reader, because both parse the SAME file. A looser parser here would
+    // accept a line the broker silently ignores, so the two would disagree
+    // about what the house config says.
+    expect(parseEnvFile('B = 2\n').B).toBeUndefined()
+  })
+})

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-delete-withdraw.test.ts

@@ -10,6 +10,9 @@ function harness(row: { devicePath: string } | null) {
   const lines: string[] = []
 
   const env = {
+    // The portal's own account, baked in at assemble time. It scopes every
+    // manifest statement and is the first segment of every key below.
+    PORTAL_ACCOUNT_ID: 'acct',
     BUCKET: {
       async delete() {
         state.objectDeleted = true
@@ -25,6 +28,8 @@ function harness(row: { devicePath: string } | null) {
             return {
               async first() {
                 if (sql.includes('FROM sessions')) {
+                  // The people row's account has to match the portal's, or
+                  // resolveSession returns null and every case below 401s.
                   return { ownerId: 'alice', accountId: 'acct', folders: '' }
                 }
                 if (sql.includes('SELECT devicePath')) return row
@@ -51,7 +56,7 @@ function harness(row: { devicePath: string } | null) {
 describe('delete branches on whether the file has moved', () => {
   it('deletes object and row outright when the file is still in transit', async () => {
     const h = harness({ devicePath: '' })
-    const res = await processDelete('s', 'alice/a.pdf', h.env, h.log, () => 1)
+    const res = await processDelete('s', 'acct/alice/a.pdf', h.env, h.log, () => 1)
     expect(res.status).toBe(200)
     expect(h.state.objectDeleted).toBe(true)
     expect(h.state.rowDeleted).toBe(true)
@@ -63,7 +68,7 @@ describe('delete branches on whether the file has moved', () => {
     // here would report success while the client's file stayed on the device
     // forever — the exact failure this branch exists to prevent.
     const h = harness({ devicePath: 'jobs/a.pdf' })
-    const res = await processDelete('s', 'alice/jobs/a.pdf', h.env, h.log, () => 1)
+    const res = await processDelete('s', 'acct/alice/jobs/a.pdf', h.env, h.log, () => 1)
     expect(res.status).toBe(200)
     expect(h.state.marked).toBe(true)
     expect(h.state.rowDeleted).toBe(false)
@@ -73,13 +78,13 @@ describe('delete branches on whether the file has moved', () => {
 
   it('tells the client the withdrawal is pending, not complete', async () => {
     const h = harness({ devicePath: 'jobs/a.pdf' })
-    const res = await processDelete('s', 'alice/jobs/a.pdf', h.env, h.log, () => 1)
+    const res = await processDelete('s', 'acct/alice/jobs/a.pdf', h.env, h.log, () => 1)
     expect(res.payload).toMatchObject({ ok: true, pending: true })
   })
 
   it('reports an unknown key as not found without writing anything', async () => {
     const h = harness(null)
-    const res = await processDelete('s', 'alice/nope.pdf', h.env, h.log, () => 1)
+    const res = await processDelete('s', 'acct/alice/nope.pdf', h.env, h.log, () => 1)
     expect(res.status).toBe(404)
     expect(h.state.objectDeleted).toBe(false)
     expect(h.state.marked).toBe(false)
@@ -87,8 +92,10 @@ describe('delete branches on whether the file has moved', () => {
   })
 
   it('still refuses another person key before reading anything', async () => {
+    // Same account, different owner segment: the owner half of the check is
+    // what has to reject this one.
     const h = harness({ devicePath: '' })
-    const res = await processDelete('s', 'bob/a.pdf', h.env, h.log, () => 1)
+    const res = await processDelete('s', 'acct/bob/a.pdf', h.env, h.log, () => 1)
     expect(res.status).toBe(403)
     expect(h.state.objectDeleted).toBe(false)
   })

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-directory-listing.test.ts

@@ -21,6 +21,10 @@ function makeEnv(
   onQuery: (query: string) => void = () => {},
 ) {
   return {
+    // The tenant scope, baked into wrangler.toml at assemble time (Task 2099).
+    // One shared store backs every portal, so this is what the directory read
+    // binds, and what the session's own account has to agree with.
+    PORTAL_ACCOUNT_ID: 'acc-a',
     DB: {
       prepare(query: string) {
         onQuery(query)
@@ -34,12 +38,17 @@ function makeEnv(
             return { meta: { changes: 0 } }
           },
           async all<T>() {
+            // The directory read binds the portal's own account id, so `bound[0]`
+            // is PORTAL_ACCOUNT_ID rather than anything off the session.
             if (/FROM directory/i.test(query)) {
               return { results: DIRECTORY.filter((d) => d.accountId === bound[0]) as T[] }
             }
             return { results: [] as T[] }
           },
           async first<T>() {
+            // resolveSession binds (sessionId, accountId, nowMs) and reads the
+            // sessions/people join, so the row's `accountId` is the person's.
+            // It has to equal the portal's or the session does not resolve.
             if (/FROM sessions/i.test(query)) return (sessions[bound[0] as string] ?? null) as T | null
             return null as T | null
           },
@@ -149,11 +158,14 @@ describe('processFiles directory listing', () => {
     expect(JSON.stringify(r.payload)).not.toContain('secret.pdf')
   })
 
-  it('returns an empty entries list when the person has no account bound', async () => {
+  // A person with no account bound used to resolve and simply see no folders.
+  // On the shared store an absent tenant is a contradiction, not a narrower
+  // scope, so resolveSession fails closed and nothing is listed at all.
+  it('denies when the person has no account bound', async () => {
     const env = makeEnv({ 'sess-a': { ownerId: 'alice', accountId: '' } })
     const r = await processFiles('sess-a', env, () => {}, 0, '')
-    expect(r.status).toBe(200)
-    expect(r.payload.entries).toEqual([])
+    expect(r.status).toBe(401)
+    expect(r.payload).toEqual({ ok: false, error: 'denied' })
   })
 
   it('still denies without a session', async () => {

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-enrol.test.ts

@@ -12,10 +12,11 @@ import {
 const run = promisify(execFile)
 const SCRIPT = resolve(dirname(fileURLToPath(import.meta.url)), '../../bin/portal-enrol.mjs')
 
-/** `--account` is required (it binds the person to the sub-account whose folders
- * they may read), but it is irrelevant to the passcode behaviour most of these
- * tests cover, so the helper supplies one unless the caller names its own. Tests
- * that assert the requirement itself call `run` directly. */
+/** `--account` is required (it names the portal's own account, which is half the
+ * person's key on the shared store and decides whose folders they read), but it
+ * is irrelevant to the passcode behaviour most of these tests cover, so the
+ * helper supplies one unless the caller names its own. Tests that assert the
+ * requirement itself call `run` directly. */
 const enrol = (args: string[]) =>
   run('node', [SCRIPT, ...(args.includes('--account') ? args : [...args, '--account', 'acc-1'])])
 
@@ -173,6 +174,72 @@ describe('portal-enrol', () => {
     await expect(enrol(['--owner', 'alice', '--name', 'Bob\nDROP'])).rejects.toThrow()
   })
 
+  describe('the conflict target follows the storage model (Task 2099)', () => {
+    /** A pre-2099 portal's own database: `people` keyed on ownerId alone. */
+    async function legacyDb(dir: string) {
+      const { mkdtemp } = await import('node:fs/promises')
+      const { tmpdir } = await import('node:os')
+      const root = await mkdtemp(resolve(tmpdir(), dir))
+      const db = resolve(root, 'portal.db')
+      await run('sqlite3', [
+        db,
+        'CREATE TABLE people (ownerId TEXT PRIMARY KEY, name TEXT NOT NULL, salt TEXT NOT NULL, ' +
+          "hash TEXT NOT NULL, createdAt TEXT NOT NULL, accountId TEXT NOT NULL DEFAULT '', " +
+          "folders TEXT NOT NULL DEFAULT '');",
+      ])
+      return {
+        exec: (sql: string) => run('sqlite3', [db, sql]),
+        query: async (sql: string) => (await run('sqlite3', [db, sql])).stdout.trim(),
+      }
+    }
+
+    it('lets two tenants each enrol the same person on the shared store', async () => {
+      const db = await d1('enrol-two-tenants-')
+      await db.exec(parse(await enrol(['--owner', 'rob', '--name', 'Rob', '--account', 'acct-a'])).sql!)
+      await db.exec(parse(await enrol(['--owner', 'rob', '--name', 'Rob', '--account', 'acct-b'])).sql!)
+      expect(await db.query('SELECT COUNT(*) FROM people;')).toBe('2')
+    })
+
+    it('still rotates on a grandfathered database, which the composite target cannot', async () => {
+      // The regression this test exists for. A pre-2099 people table has no
+      // unique index on (accountId, ownerId), and SQLite does not degrade: it
+      // refuses the whole statement with "ON CONFLICT clause does not match any
+      // PRIMARY KEY or UNIQUE constraint". That would take passcode rotation
+      // away from every existing portal, and rotation is the one remedy for a
+      // leaked passcode.
+      const db = await legacyDb('enrol-legacy-')
+      const first = await enrol(['--owner', 'dale', '--name', 'Dale', '--account', 'acct-a', '--storage-model', 'dedicated'])
+      await db.exec(parse(first).sql!)
+      const second = await enrol(['--owner', 'dale', '--name', 'Dale', '--account', 'acct-a', '--storage-model', 'dedicated'])
+      await db.exec(parse(second).sql!)
+
+      expect(await db.query('SELECT COUNT(*) FROM people;')).toBe('1')
+      const [salt, hash] = (await db.query("SELECT salt, hash FROM people WHERE ownerId='dale';")).split('|')
+      expect(await verifyPasscode(parse(second).passcode!, salt, hash)).toBe(true)
+      expect(await verifyPasscode(parse(first).passcode!, salt, hash)).toBe(false)
+    })
+
+    it('names the composite target only on the shared model', async () => {
+      const shared = parse(await enrol(['--owner', 'a', '--name', 'A', '--account', 'acct-a'])).sql!
+      const dedicated = parse(
+        await enrol(['--owner', 'a', '--name', 'A', '--account', 'acct-a', '--storage-model', 'dedicated']),
+      ).sql!
+      expect(shared).toContain('ON CONFLICT(accountId, ownerId)')
+      expect(dedicated).toContain('ON CONFLICT(ownerId)')
+      // The dedicated path keeps moving a person between sub-accounts, exactly
+      // as it did before 2099. The shared path must not: accountId is half the
+      // key there, so it cannot also be a field the match rewrites.
+      expect(dedicated).toContain('accountId=excluded.accountId')
+      expect(shared).not.toContain('accountId=excluded.accountId')
+    })
+
+    it('refuses an unrecognised storage model', async () => {
+      await expect(
+        enrol(['--owner', 'a', '--name', 'A', '--account', 'acct-a', '--storage-model', 'Shared']),
+      ).rejects.toThrow()
+    })
+  })
+
   describe('against a real SQLite database built from schema.sql', () => {
     it('applies cleanly', async () => {
       const db = await d1('enrol-apply-')
@@ -183,9 +250,10 @@ describe('portal-enrol', () => {
 
     it('rotates a passcode by re-running, which is the ONLY sanctioned rotation path', async () => {
       // SKILL.md: "Rotating a passcode is a re-run of the script for that person."
-      // A bare INSERT cannot do that — ownerId is TEXT PRIMARY KEY, so the second
-      // run dies on a UNIQUE violation in a SEPARATE process, AFTER the script has
-      // already printed a new passcode and exited 0. The operator hands out a
+      // A bare INSERT cannot do that: (accountId, ownerId) is the primary key, so
+      // the second run for the same person at the same portal dies on a UNIQUE
+      // violation in a SEPARATE process, AFTER the script has already printed a
+      // new passcode and exited 0. The operator hands out a
       // passcode that never worked while the leaked one still does, and pcCheck
       // revocation never fires. Rotation is exactly the case where a remedy that
       // silently no-ops is worse than no remedy.
@@ -223,13 +291,39 @@ describe('portal-enrol', () => {
       await db.exec(parse(await enrol(['--owner', 'alice', '--name', 'Alice', '--account', 'acc-a'])).sql!)
       expect(await db.query("SELECT accountId FROM people WHERE ownerId='alice';")).toBe('acc-a')
 
-      // Re-enrolling to a different account moves the binding rather than
-      // leaving the person pointed at folders they no longer belong to.
-      await db.exec(parse(await enrol(['--owner', 'alice', '--name', 'Alice', '--account', 'acc-b'])).sql!)
-      expect(await db.query("SELECT accountId FROM people WHERE ownerId='alice';")).toBe('acc-b')
+      // Re-enrolling the same person at the same portal is the rotation path, and
+      // the binding survives it: accountId is half the conflict key, so the DO
+      // UPDATE no longer names it and cannot blank it back to the column default.
+      await db.exec(parse(await enrol(['--owner', 'alice', '--name', 'Alice', '--account', 'acc-a'])).sql!)
+      expect(await db.query("SELECT accountId FROM people WHERE ownerId='alice';")).toBe('acc-a')
       expect(await db.query('SELECT COUNT(*) FROM people;')).toBe('1')
     })
 
+    it('enrols the same ownerId at a second portal as a separate person', async () => {
+      // The shared store holds every portal's people, so two clients may each
+      // enrol someone called `alice` (Task 2099). Keyed on ownerId alone the
+      // second enrolment would read as a rotation of the first client's person
+      // and overwrite their passcode, their grant, and the ownership of their
+      // files; keyed on (accountId, ownerId) it is a different person entirely.
+      // `--account` names the portal, so re-running with a different one no
+      // longer MOVES a person, and neither passcode is disturbed by the other.
+      const db = await d1('enrol-account-split-')
+      const a = await enrol(['--owner', 'alice', '--name', 'Alice', '--account', 'acc-a'])
+      await db.exec(parse(a).sql!)
+      const b = await enrol(['--owner', 'alice', '--name', 'Alice', '--account', 'acc-b'])
+      await db.exec(parse(b).sql!)
+
+      expect(await db.query("SELECT accountId FROM people WHERE ownerId='alice' ORDER BY accountId;"))
+        .toBe('acc-a\nacc-b')
+      expect(await db.query('SELECT COUNT(*) FROM people;')).toBe('2')
+
+      const [saltA, hashA] = (
+        await db.query("SELECT salt, hash FROM people WHERE ownerId='alice' AND accountId='acc-a';")
+      ).split('|')
+      expect(await verifyPasscode(parse(a).passcode!, saltA, hashA)).toBe(true)
+      expect(await verifyPasscode(parse(b).passcode!, saltA, hashA)).toBe(false)
+    })
+
     it('declares a directory table keyed uniquely on account and path', async () => {
       const db = await d1('enrol-directory-')
       await db.exec(

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-indexed-download.test.ts

@@ -35,11 +35,15 @@ function makeEnv(
           },
           async first<T>() {
             if (/FROM sessions/i.test(query)) {
+              // The people row carries this portal's own account, which is what
+              // resolveSession requires: on the shared store a session resolves
+              // only against the account baked into PORTAL_ACCOUNT_ID.
               return (bound[0] === 'sess-a'
                 ? { ownerId: 'alice', accountId, folders }
                 : null) as T | null
             }
             if (/FROM directory/i.test(query)) {
+              // Bound (accountId, relPath), so the path is the second bind.
               const rel = bound[1] as string
               if (dirPaths.includes(rel)) return { relPath: rel, isDir: 1 } as T
               return (paths.includes(rel) ? { relPath: rel, isDir: 0 } : null) as T | null
@@ -50,6 +54,9 @@ function makeEnv(
         return stmt
       },
     },
+    // This portal's own tenant scope, baked into wrangler.toml at assemble time.
+    // Every query and every object key binds it; the store itself is shared.
+    PORTAL_ACCOUNT_ID: accountId,
     PORTAL_FETCH_SECRET: 'secret' in opts ? opts.secret : 'a-secret',
     PORTAL_INSTALL_ORIGIN: 'origin' in opts ? opts.origin : 'https://install.example',
   } as unknown as PortalEnv
@@ -154,7 +161,12 @@ describe('processIndexedDownload', () => {
     expect(r.status).toBe(401)
   })
 
-  it('404s when the person has no account bound', async () => {
+  // The account is the portal's own PORTAL_ACCOUNT_ID now, not a property of the
+  // person, so "no account bound" means an unconfigured portal. That is caught a
+  // step earlier than it used to be: a session resolves only against this
+  // portal's account and the empty string is never a match, so the refusal reads
+  // as denied. Either way no link is minted against an unscoped store.
+  it('refuses when the portal has no account bound', async () => {
     const r = await processIndexedDownload(
       'sess-a',
       PATH,
@@ -163,7 +175,8 @@ describe('processIndexedDownload', () => {
       1000,
       okHead as never,
     )
-    expect(r.status).toBe(404)
+    expect(r.status).toBe(401)
+    expect(r.url).toBeUndefined()
   })
 
   it('never mints a link when the secret or origin is unconfigured', async () => {

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-moved-download.test.ts

@@ -32,6 +32,10 @@ function harness(row: { devicePath: string } | null, opts: { configured?: boolea
         }
       },
     },
+    // Baked in at assemble time, and the tenant scope for the session lookup,
+    // the key check and the manifest read. The store is shared, so this is what
+    // separates this portal's rows and objects from another client's.
+    PORTAL_ACCOUNT_ID: ACC,
     PORTAL_FETCH_SECRET: configured ? 'test-secret-value' : undefined,
     PORTAL_INSTALL_ORIGIN: configured ? 'https://install.example' : undefined,
   } as unknown as PortalEnv
@@ -41,7 +45,7 @@ function harness(row: { devicePath: string } | null, opts: { configured?: boolea
 describe('downloading an upload that has moved to the device', () => {
   it('streams R2 bytes while the row is still in transit', async () => {
     const h = harness({ devicePath: '' })
-    const res = await processDownload('s', 'alice/a.pdf', h.env, h.log, 1000)
+    const res = await processDownload('s', `${ACC}/alice/a.pdf`, h.env, h.log, 1000)
     expect(res.status).toBe(200)
     expect(res.body).not.toBeNull()
     expect(res.url).toBeUndefined()
@@ -51,7 +55,7 @@ describe('downloading an upload that has moved to the device', () => {
     // The object is gone from R2. Without this branch the client's own upload
     // would 404 the moment the device collected it.
     const h = harness({ devicePath: 'uploads/alice/a.pdf' })
-    const res = await processDownload('s', 'alice/a.pdf', h.env, h.log, 1000)
+    const res = await processDownload('s', `${ACC}/alice/a.pdf`, h.env, h.log, 1000)
     expect(res.status).toBe(200)
     expect(res.url).toContain('/api/portal/fetch')
     expect(new URL(res.url!).searchParams.get('owner')).toBe('alice')
@@ -61,7 +65,7 @@ describe('downloading an upload that has moved to the device', () => {
 
   it('refuses another person key before anything is minted', async () => {
     const h = harness({ devicePath: 'uploads/bob/a.pdf' })
-    const res = await processDownload('s', 'bob/a.pdf', h.env, h.log, 1000)
+    const res = await processDownload('s', `${ACC}/bob/a.pdf`, h.env, h.log, 1000)
     expect(res.status).toBe(403)
     expect(res.url).toBeUndefined()
   })
@@ -70,14 +74,14 @@ describe('downloading an upload that has moved to the device', () => {
     // Same reasoning as the indexed path: from the client's side the file
     // genuinely is unreachable, and the operator's signal is the log line.
     const h = harness({ devicePath: 'uploads/alice/a.pdf' }, { configured: false })
-    const res = await processDownload('s', 'alice/a.pdf', h.env, h.log, 1000)
+    const res = await processDownload('s', `${ACC}/alice/a.pdf`, h.env, h.log, 1000)
     expect(res.status).toBe(503)
     expect(h.lines.some((l) => l.includes('result=unconfigured'))).toBe(true)
   })
 
   it('reports absent for a key with no manifest row at all', async () => {
     const h = harness(null)
-    const res = await processDownload('s', 'alice/gone.pdf', h.env, h.log, 1000)
+    const res = await processDownload('s', `${ACC}/alice/gone.pdf`, h.env, h.log, 1000)
     expect(res.status).toBe(404)
   })
 })

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-schema-shape.test.ts

@@ -10,6 +10,17 @@ const SQL = readFileSync(
   'utf8',
 )
 
+// accountId appears on several tables, so asserting it against the whole file
+// proves nothing about which table has it. No CREATE TABLE body in this schema
+// contains a semicolon, so the statement terminator bounds the block.
+const tableBody = (name: string): string => {
+  const found = SQL.match(
+    new RegExp(`CREATE TABLE IF NOT EXISTS ${name} \\(([^;]*)\\)`),
+  )
+  expect(found, `no CREATE TABLE for ${name}`).not.toBeNull()
+  return found![1]
+}
+
 describe('portal schema shape', () => {
   it('carries the manifest lifecycle columns', () => {
     expect(SQL).toMatch(/targetPath\s+TEXT\s+NOT NULL\s+DEFAULT\s+''/)
@@ -23,11 +34,42 @@ describe('portal schema shape', () => {
     expect(SQL).toMatch(/currentGeneration\s+INTEGER\s+NOT NULL/)
   })
 
-  it('keeps objectKey UNIQUE, which the upsert conflict target still needs', () => {
-    // objectKey is now ownerId/targetPath/filename. The upsert still conflicts
-    // on it, so this pins that the constraint was not dropped by accident while
-    // the key shape changed underneath it.
-    expect(SQL).toMatch(/objectKey\s+TEXT\s+UNIQUE\s+NOT NULL/)
+  it('scopes objectKey uniqueness by account, which the upsert conflict target now needs', () => {
+    // objectKey is now accountId/ownerId/targetPath/filename, and on the shared
+    // store it is unique only within an account. The upsert conflicts on
+    // (accountId, objectKey), so this pins that the constraint moved to the
+    // table level rather than being dropped while the key shape changed
+    // underneath it. The bare column-level UNIQUE must be gone: it is account
+    // blind, so one client uploading at another client's key would take over
+    // the existing row, reset its ingested flag, and redirect the file.
+    expect(SQL).toMatch(/objectKey\s+TEXT\s+NOT NULL/)
+    expect(SQL).not.toMatch(/objectKey\s+TEXT\s+UNIQUE/)
+    expect(SQL).toMatch(/UNIQUE\s*\(\s*accountId,\s*objectKey\s*\)/)
+  })
+
+  it('carries the tenant discriminator on every table holding client data', () => {
+    // One shared house-owned database backs every portal (Task 2099), so
+    // accountId is the only thing separating one client's rows from another's.
+    // A missing discriminator here is not a loud "no such column" like the
+    // lifecycle columns above; it is a silent cross-tenant read.
+    expect(tableBody('sessions')).toMatch(/accountId\s+TEXT\s+NOT NULL/)
+    expect(tableBody('manifest')).toMatch(/accountId\s+TEXT\s+NOT NULL/)
+    // people is keyed on the pair, not on ownerId alone: two clients may each
+    // enrol a person called `rob`, and a bare ownerId key would either reject
+    // the second enrolment or let its upsert overwrite the first client's
+    // person, handing over their passcode and their folder grant.
+    expect(tableBody('people')).toMatch(
+      /PRIMARY KEY\s*\(\s*accountId,\s*ownerId\s*\)/,
+    )
+    expect(tableBody('people')).not.toMatch(/ownerId\s+TEXT\s+PRIMARY KEY/)
+    // The pull and the audit both filter by account, so it carries its own
+    // index rather than riding the owner one.
+    expect(SQL).toMatch(
+      /CREATE INDEX IF NOT EXISTS manifest_account ON manifest \(accountId\)/,
+    )
+    // auth_attempts is the deliberate exception: its tenant rides inside the
+    // scope string, which is now accountId|ownerId|clientIp.
+    expect(tableBody('auth_attempts')).not.toMatch(/accountId/)
   })
 
   it('scopes the directory uniqueness by generation', () => {

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-session-grant.test.ts

@@ -32,20 +32,44 @@ describe('resolveSession folders', () => {
     const s = await resolveSession(
       db({ ownerId: 'alice', accountId: 'acc-a', folders: 'quotes,output' }),
       'sess',
+      'acc-a',
       1,
     )
     expect(s?.folders).toEqual(['quotes', 'output'])
   })
 
   it('returns an empty array for an empty grant', async () => {
-    const s = await resolveSession(db({ ownerId: 'alice', accountId: 'acc-a', folders: '' }), 'sess', 1)
+    const s = await resolveSession(
+      db({ ownerId: 'alice', accountId: 'acc-a', folders: '' }),
+      'sess',
+      'acc-a',
+      1,
+    )
     expect(s?.folders).toEqual([])
   })
 
   it('returns an empty array when the column is absent', async () => {
-    const s = await resolveSession(db({ ownerId: 'alice', accountId: 'acc-a' }), 'sess', 1)
+    const s = await resolveSession(db({ ownerId: 'alice', accountId: 'acc-a' }), 'sess', 'acc-a', 1)
     expect(s?.folders).toEqual([])
   })
+
+  it('refuses a row whose account disagrees with the portal own account', async () => {
+    // The query already scopes by account, so a row coming back for a different
+    // tenant is a contradiction. On a shared store the safe reading of a
+    // contradiction is nothing, never the row.
+    const s = await resolveSession(
+      db({ ownerId: 'alice', accountId: 'acc-b', folders: 'quotes' }),
+      'sess',
+      'acc-a',
+      1,
+    )
+    expect(s).toBeNull()
+  })
+
+  it('refuses a legacy row that carries no account at all', async () => {
+    const s = await resolveSession(db({ ownerId: 'alice', folders: 'quotes' }), 'sess', 'acc-a', 1)
+    expect(s).toBeNull()
+  })
 })
 
 describe('grantAllows', () => {

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-target.test.ts

@@ -48,13 +48,21 @@ describe('isSafeTargetSegment', () => {
 })
 
 describe('uploadKey', () => {
-  it('collapses to owner/filename when untargeted', () => {
-    expect(uploadKey('alice', '', 'a.pdf')).toBe('alice/a.pdf')
+  it('collapses to account/owner/filename when untargeted', () => {
+    expect(uploadKey('acct-a', 'alice', '', 'a.pdf')).toBe('acct-a/alice/a.pdf')
   })
 
   it('carries the target so two folders never collide', () => {
-    expect(uploadKey('alice', 'jobs', 'a.pdf')).toBe('alice/jobs/a.pdf')
-    expect(uploadKey('alice', 'jobs/2026', 'a.pdf')).toBe('alice/jobs/2026/a.pdf')
+    expect(uploadKey('acct-a', 'alice', 'jobs', 'a.pdf')).toBe('acct-a/alice/jobs/a.pdf')
+    expect(uploadKey('acct-a', 'alice', 'jobs/2026', 'a.pdf')).toBe('acct-a/alice/jobs/2026/a.pdf')
+  })
+
+  it('separates two tenants that share an owner id and a filename', () => {
+    // The store is shared and objectKey is unique per account, so this pair
+    // must differ or one client upload would take over the other client row.
+    expect(uploadKey('acct-a', 'alice', '', 'a.pdf')).not.toBe(
+      uploadKey('acct-b', 'alice', '', 'a.pdf'),
+    )
   })
 })