@sleep2agi/commhub-server 0.9.0-preview.73 → 0.9.0-preview.74

package/src/server.ts

@@ -15,7 +15,8 @@ import { assertNodeActive } from "./lifecycle-guard.js";
 import { pendingInboxCount } from "./inbox-count.js";
 import { addAgentNetworkScope, addHumanNetworkScope, addNetworkScope, addOwnTrafficScope, canRestWriteNetwork, canRestWriteNetworkAsHuman, getUserNetworkIds, resolveRestNetworkScope, resolveRestWriteNetworkId, singleNetworkId, type RestNetworkScope } from "./network-scope.js";
 import { restrictedMemberSeesFile, restrictedMemberAttachmentsDenied } from "./restricted-files.js";
-import { listDmThread, listDmThreads, sendHumanDm } from "./human-dm.js";
+import { dmParticipantSeesFile, listDmThread, listDmThreads, sendHumanDm } from "./human-dm.js";
+import { getTaskAccessMode, isTaskScoped, listProjectGrants, replaceTaskGrants, NEW_MEMBER_TASK_ACCESS } from "./task-access.js";
 import { canMessageAgent, isAgentRestricted, listAgentGrants, listGroupGrants, getAgentAccessMode, replaceAgentGrants, restrictedNetworkIds, usernameIsAgentAlias, listAgentGroups, createAgentGroup, updateAgentGroup, replaceAgentGroupMembers, deleteAgentGroup, usersGrantedGroup } from "./agent-access.js";
 import { validateAvatarUrl } from "./avatar-validate.js";
 import { narrowTags, parseStoredTags, validateScalarAttr } from "./node-attrs-validate.js";
@@ -41,6 +42,7 @@ import {
   stripHostLocalPathsForCrossHostSafe,
   validateAttachments,
   validateIndexEntry,
+  DM_FILE_SCOPE,
 } from "./uploads.js";
 import { mkdirSync, writeFileSync, readFileSync, readdirSync, existsSync, statSync, unlinkSync, renameSync } from "fs";
 import { dirname as pathDirname, join as pathJoin } from "path";
@@ -385,15 +387,16 @@ export function resolvePrincipal(req: Request, options: RequestTokenOptions = {}
 // these two fields lives here and nowhere else, so the authz rules can be
 // read as rules rather than as string-checks.
 export function normalizeEntry(
-  entry: { owner_id?: unknown; network_id?: unknown },
-): { ownerId: string | null; networkId: string | null } {
+  entry: { owner_id?: unknown; network_id?: unknown; scope?: unknown },
+): { ownerId: string | null; networkId: string | null; dmScoped?: true } {
   const ownerId = typeof entry.owner_id === "string" && entry.owner_id.length > 0
     ? entry.owner_id
     : null;
   const networkId = typeof entry.network_id === "string" && entry.network_id.length > 0
     ? entry.network_id
     : null;
-  return { ownerId, networkId };
+  // dmScoped 只在是私信文件时出现:其余条目的形状与之前逐字相同。
+  return { ownerId, networkId, ...(entry.scope === DM_FILE_SCOPE ? { dmScoped: true as const } : {}) };
 }
 
 // #495/#503 — shared authorization gate for /api/files/:file_id downloads.
@@ -414,6 +417,13 @@ export function normalizeEntry(
 //     a task but not open its attachment is a broken product).
 //   - entry.network_id absent (legacy / unattributed) → the pre-#503
 //     rules stand unchanged: owner match, or null owner_id + DEV_OPEN.
+//   - entry.dmScoped (uploaded with ?purpose=dm — its first use is a
+//     human DM) → only the uploader and the users on either side of a DM
+//     that carries it (human-dm.ts dmParticipantSeesFile). Other members of
+//     the network and node tokens (agents) are denied. admin-utok and the
+//     legacy master token still pass above, as for every other file.
+//     Files uploaded any other way never become DM-scoped, including when
+//     they are later forwarded into a DM.
 //   - Everything else → deny (404). New uploads in production always
 //     carry a truthy owner_id (requireAuth blocks the null-owner-
 //     producing path when DEV_OPEN=off and no legacy master token is
@@ -428,7 +438,7 @@ export function normalizeEntry(
 // 所有文件在同一 network → 无实际影响, 但语义变更须明写, 不能悄悄发生.
 export function authorizeFileDownload(
   principal: Principal,
-  entry: { ownerId: string | null; networkId: string | null },
+  entry: { ownerId: string | null; networkId: string | null; dmScoped?: boolean },
   fileId?: string,
 ): boolean {
   if (principal.kind === "legacy-master") return true;
@@ -436,8 +446,13 @@ export function authorizeFileDownload(
 
   if (entry.networkId !== null) {
     if (principal.kind === "anonymous" || principal.kind === "dev-open-anon") return false;
-    if (principal.kind === "ntok") return principal.boundNetworkId === entry.networkId;
+    if (principal.kind === "ntok") return principal.boundNetworkId === entry.networkId && !entry.dmScoped;
     if (!getUserNetworkRole(principal.userId, entry.networkId)) return false;
+    // 私信文件:只看是不是这段私信里的人,与受限 / 不受限无关。
+    if (entry.dmScoped) {
+      if (entry.ownerId !== null && entry.ownerId === principal.userId) return true;
+      return !!fileId && dmParticipantSeesFile(principal.userId, entry.networkId, fileId);
+    }
     // 多用户 Agent 权限:受限成员只能下载自己传的,或者出现在自己与授权 Agent 往来 / 自己收件箱里的文件。
     if (!isAgentRestricted(principal.userId, entry.networkId)) return true;
     if (entry.ownerId !== null && entry.ownerId === principal.userId) return true;
@@ -1548,6 +1563,51 @@ return Bun.serve({
     // ── 多用户 Agent 权限:成员可访问的 Agent(owner/admin 管理) ──
     // GET  → { agent_access: 'all'|'granted', grants: [{node_id, alias, can_message}] }
     // PUT  { grants?: [{node_id | alias, can_message?}] | string[], agent_access?: 'all'|'granted' } → 整体替换
+    // ── 任务(需求卡)的人员权限(RFC-038 §9):成员能看 / 能改哪些卡。owner/admin/Hub 管理员管理 ──
+    // GET  → { task_access: 'all'|'scoped', restricted, project_grants: [{project_id, can_edit}] }
+    // PUT  { task_access?, project_grants?: [{project_id, can_edit?}] | string[] } → 不传的字段保持原样;传了整体替换
+    const taskGrantsMatch = url.pathname.match(/^\/api\/networks\/([^/]+)\/members\/([^/]+)\/task-grants$/);
+    if (taskGrantsMatch && (req.method === "GET" || req.method === "PUT")) {
+      const token = requestToken(req, { allowQueryToken: false });
+      const resolved = token ? resolveToken(token) : null;
+      if (!resolved) return withCors(req, Response.json({ ok: false, error: "auth required" }, { status: 401 }));
+      if (resolved.networkId) return withCors(req, Response.json({ ok: false, error: "user_token_required" }, { status: 403 }));
+      const netId = decodeURIComponent(taskGrantsMatch[1]);
+      const targetUid = decodeURIComponent(taskGrantsMatch[2]);
+      const hubAdmin = resolved.user.role === "admin";
+      const callerRole = getUserNetworkRole(resolved.user.user_id, netId);
+      if (!hubAdmin && callerRole !== "owner" && callerRole !== "admin") {
+        return withCors(req, Response.json({ ok: false, error: "owner/admin required" }, { status: 403 }));
+      }
+      const targetRole = getUserNetworkRole(targetUid, netId);
+      if (!targetRole) return withCors(req, Response.json({ ok: false, error: "member_not_found" }, { status: 404 }));
+      const view = () => ({
+        ok: true, network_id: netId, user_id: targetUid, role: targetRole,
+        task_access: getTaskAccessMode(netId, targetUid), restricted: isTaskScoped(targetUid, netId),
+        project_grants: listProjectGrants(netId, targetUid),
+      });
+      if (req.method === "GET") return withCors(req, Response.json(view()));
+      // 网络 admin 不能改 owner / 其他 admin(对他们本来也不生效)。
+      if (!hubAdmin && callerRole !== "owner" && (targetRole === "owner" || targetRole === "admin")) {
+        return withCors(req, Response.json({ ok: false, error: "owner required" }, { status: 403 }));
+      }
+      let body: any;
+      try { body = await req.json(); } catch { return withCors(req, Response.json({ ok: false, error: "invalid JSON" }, { status: 400 })); }
+      if (!body || typeof body !== "object" || Array.isArray(body)) return withCors(req, Response.json({ ok: false, error: "invalid JSON" }, { status: 400 }));
+      if (body.task_access === undefined && body.project_grants === undefined) {
+        return withCors(req, Response.json({ ok: false, error: "task_access or project_grants required" }, { status: 400 }));
+      }
+      const before = { task_access: getTaskAccessMode(netId, targetUid), project_grants: listProjectGrants(netId, targetUid) };
+      const result = replaceTaskGrants({ networkId: netId, userId: targetUid, taskAccess: body.task_access, projectGrants: body.project_grants, actorUserId: resolved.user.user_id });
+      if (!result.ok) {
+        return withCors(req, Response.json({ ok: false, error: result.error, ...(result.detail ? { detail: result.detail } : {}) }, { status: result.status }));
+      }
+      logAudit(resolved.user.user_id, resolved.user.username, "member_task_grants_changed", "network", netId,
+        JSON.stringify({ user_id: targetUid, before, after: { task_access: result.task_access, project_grants: result.project_grants } }).slice(0, 4000),
+        undefined, netId);
+      return withCors(req, Response.json(view()));
+    }
+
     const grantsMatch = url.pathname.match(/^\/api\/networks\/([^/]+)\/members\/([^/]+)\/agent-grants$/);
     if (grantsMatch && (req.method === "GET" || req.method === "PUT")) {
       const token = requestToken(req, { allowQueryToken: false });
@@ -1648,8 +1708,12 @@ return Bun.serve({
         if (body.agent_access !== undefined && body.agent_access !== "all" && body.agent_access !== "granted") {
           return withCors(req, Response.json({ ok: false, error: "invalid_agent_access" }, { status: 400 }));
         }
-        const result = addNetworkMember(netId, body.user_id, body.role || "member", resolved.user.user_id, { agentAccess: body.agent_access });
-        if (result.ok) logAudit(resolved.user.user_id, resolved.user.username, "member_added", "network", netId, `${body.user_id} as ${body.role || "member"} agent_access=${body.agent_access === "all" ? "all" : "granted"}`);
+        // task_access 缺省 NEW_MEMBER_TASK_ACCESS(RFC-038 §9.4);显式传 'all' / 'scoped' 覆盖。
+        if (body.task_access !== undefined && body.task_access !== "all" && body.task_access !== "scoped") {
+          return withCors(req, Response.json({ ok: false, error: "invalid_task_access" }, { status: 400 }));
+        }
+        const result = addNetworkMember(netId, body.user_id, body.role || "member", resolved.user.user_id, { agentAccess: body.agent_access, taskAccess: body.task_access });
+        if (result.ok) logAudit(resolved.user.user_id, resolved.user.username, "member_added", "network", netId, `${body.user_id} as ${body.role || "member"} agent_access=${body.agent_access === "all" ? "all" : "granted"} task_access=${body.task_access ?? NEW_MEMBER_TASK_ACCESS}`, undefined, netId);
         return withCors(req, Response.json(result, { status: result.ok ? 200 : 400 }));
       }
       if (req.method === "PUT" && targetUid) {
@@ -1657,7 +1721,7 @@ return Bun.serve({
         const body = await req.json() as any;
         const result = updateMemberRole(netId, targetUid, body.role);
         if (result.ok) {
-          logAudit(resolved.user.user_id, resolved.user.username, "member_role_changed", "network", netId, `${targetUid} → ${body.role}`);
+          logAudit(resolved.user.user_id, resolved.user.username, "member_role_changed", "network", netId, `${targetUid} → ${body.role}`, undefined, netId);
           closeUserStreamsInNetwork(netId, targetUid);
         }
         return withCors(req, Response.json(result, { status: result.ok ? 200 : 400 }));
@@ -1666,7 +1730,7 @@ return Bun.serve({
         if (!["owner", "admin"].includes(callerRole)) return withCors(req, Response.json({ ok: false, error: "owner/admin required" }, { status: 403 }));
         const result = removeNetworkMember(netId, targetUid);
         if (result.ok) {
-          logAudit(resolved.user.user_id, resolved.user.username, "member_removed", "network", netId, targetUid);
+          logAudit(resolved.user.user_id, resolved.user.username, "member_removed", "network", netId, targetUid, undefined, netId);
           closeUserStreamsInNetwork(netId, targetUid);
         }
         return withCors(req, Response.json(result, { status: result.ok ? 200 : 400 }));
@@ -2454,6 +2518,12 @@ return Bun.serve({
       // uploaded and never gets their multipart envelope parsed.
       const principal = resolvePrincipal(req);
       const requestedNetId = url.searchParams.get("network_id");
+      // ?purpose=dm:这个文件是为一条人与人私信传的(见 UploadIndexEntry.scope)。缺省 = 旧行为。
+      // 拼错的值拒掉,不静默当成缺省 —— 否则私信图会不声不响地变成全网可见。
+      const purpose = url.searchParams.get("purpose");
+      if (purpose !== null && purpose !== DM_FILE_SCOPE) {
+        return earlyReject(Response.json({ ok: false, error: "bad_purpose", message: `purpose must be "${DM_FILE_SCOPE}" or absent` }, { status: 400 }));
+      }
       let uploadNetId: string | null = null;
 
       switch (principal.kind) {
@@ -2630,6 +2700,7 @@ return Bun.serve({
             owner_id: authCtx?.userId ?? null,
             // Key omitted (not null) when unattributed — see UploadIndexEntry.
             ...(uploadNetId ? { network_id: uploadNetId } : {}),
+            ...(purpose === DM_FILE_SCOPE ? { scope: DM_FILE_SCOPE } : {}),
             uploaded_at: new Date().toISOString(),
           }, null, 2));
         } else {

package/src/task-access-http.test.ts

@@ -0,0 +1,375 @@
+// 任务(需求卡)的人员权限(RFC-038 §9)—— HTTP 集成测试(真实 Bun.serve,私有端口,临时库)。
+//
+// 场景:Hub 管理员 admin 的网络 NET。成员:
+//   alice —— 新建成员,经授权接口显式设成 scoped,授权 P1(只看)、P2(可改);
+//            (新成员默认值 NEW_MEMBER_TASK_ACCESS 暂时是 'all',见「默认值与授权接口」)
+//   carol —— 升级前的老成员(task_access='all'):行为必须与今天逐字相同;
+//   vic   —— 经授权接口显式设成 scoped 的 viewer,授权 P3(只看)。
+// admin 建的卡:c_own(负责人 alice)、c_part(参与人 alice)、c_p1 / c_p2 / c_p3(在项目里)、c_other(与 alice 无关)。
+// 正向:相关卡与授权项目看得见;负责 / 自建 / can_edit 能改;老成员与 owner 照旧;MCP 与 REST 一致。
+// 反向:看不见的卡在 GET / PATCH / DELETE / 勾子任务 / #N 上与不存在的卡逐字节相同;只读卡 403;
+//       往没授权的项目建卡、挂到看不见的父卡、撞别人的 client_id、external_ref / upsert、项目管理都被挡。
+
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { issueUserToken, register } from "./auth.js";
+import { db } from "./db.js";
+import { NEW_MEMBER_TASK_ACCESS } from "./task-access.js";
+
+const DIR = mkdtempSync(join(tmpdir(), "anet-task-access-"));
+let BASE = "";
+let hub: any = null;
+const PW = "TaskAccessPassw0rd!x";
+let NET = "";
+let admin = { token: "", id: "" };
+let alice = { token: "", id: "" };
+let carol = { token: "", id: "" };
+let vic = { token: "", id: "" };
+const P: Record<string, string> = {};
+const C: Record<string, { id: string; seq: number }> = {};
+
+type R = { status: number; body: any; text: string };
+async function send(token: string, method: string, path: string, payload?: unknown): Promise<R> {
+  const res = await fetch(`${BASE}${path}`, {
+    method,
+    headers: { ...(token ? { Authorization: `Bearer ${token}` } : {}), "Content-Type": "application/json" },
+    body: payload === undefined ? undefined : JSON.stringify(payload),
+  });
+  const text = await res.text();
+  let body: any = null;
+  try { body = JSON.parse(text); } catch {}
+  return { status: res.status, body, text };
+}
+const get = (t: string, p: string) => send(t, "GET", p);
+const listIds = async (t: string, qs = "") => {
+  const r = await get(t, `/api/requirements?network_id=${NET}${qs}`);
+  expect(r.status).toBe(200);
+  return (r.body.requirements as any[]).map(x => x.name).filter((n: string) => n.startsWith("ta-")).sort();
+};
+async function mcp(token: string, name: string, args: Record<string, unknown>): Promise<any> {
+  const res = await fetch(`${BASE}/mcp`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json", Accept: "application/json, text/event-stream", "MCP-Protocol-Version": "2025-03-26" },
+    body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/call", params: { name, arguments: args } }),
+  });
+  const raw = await res.text();
+  const lines = raw.split("\n").filter(x => x.startsWith("data:"));
+  const payload = lines.length ? JSON.parse(lines.at(-1)!.slice(5).trim()) : JSON.parse(raw);
+  return JSON.parse(payload.result.content[0].text);
+}
+const userRef = (id: string) => ({ kind: "user", id });
+
+beforeAll(async () => {
+  process.env.COMMHUB_DB ||= join(DIR, "hub.db");
+  process.env.COMMHUB_UPLOADS_DIR = join(DIR, "uploads");
+  process.env.HOST = "127.0.0.1";
+  const a = register(`ta_admin_${Date.now()}`, PW, undefined, "Admin");
+  expect(a.ok).toBe(true);
+  admin = { token: a.token!, id: a.user!.user_id };
+  NET = a.network_id!;
+  db.run("UPDATE users SET role = 'admin' WHERE user_id = ?1", [admin.id]);
+  const mod: any = await import("./server.js");
+  hub = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${hub.port}`;
+
+  const mk = async (username: string, role: string) => {
+    const r = await send(admin.token, "POST", "/api/admin/users", { username, password: PW, network_id: NET, role });
+    expect(r.status).toBe(200);
+    const login = await send("", "POST", "/api/auth/login", { username, password: PW });
+    expect(login.status).toBe(200);
+    return { token: login.body.token as string, id: login.body.user.user_id as string };
+  };
+  const stamp = Date.now();
+  alice = await mk(`ta_alice_${stamp}`, "member");
+  carol = await mk(`ta_carol_${stamp}`, "member");
+  vic = await mk(`ta_vic_${stamp}`, "viewer");
+  // carol = 升级前就在网络里的成员(ALTER 默认 'all')。
+  db.run("UPDATE network_members SET task_access = 'all' WHERE network_id = ?1 AND user_id = ?2", [NET, carol.id]);
+
+  for (const name of ["ta-P1", "ta-P2", "ta-P3", "ta-P4"]) {
+    const r = await send(admin.token, "POST", "/api/requirements/projects", { network_id: NET, name });
+    expect(r.status).toBe(201);
+    P[name] = r.body.project.id;
+  }
+  const card = async (name: string, extra: Record<string, unknown> = {}) => {
+    const r = await send(admin.token, "POST", "/api/requirements", { network_id: NET, name, ...extra });
+    expect(r.status).toBe(201);
+    C[name] = { id: r.body.requirement.id, seq: r.body.requirement.seq };
+  };
+  await card("ta-own", { owner: userRef(alice.id), checklist: [{ id: "i1", text: "x", done: false }] });
+  await card("ta-part", { participants: [userRef(alice.id)], checklist: [{ id: "i1", text: "x", done: false }] });
+  await card("ta-p1", { project_id: P["ta-P1"] });
+  await card("ta-p2", { project_id: P["ta-P2"] });
+  await card("ta-p3", { project_id: P["ta-P3"] });
+  await card("ta-other", { tags: ["secret-tag"], client_id: "admin-client-1" });
+
+  const g = await send(admin.token, "PUT", `/api/networks/${NET}/members/${alice.id}/task-grants`, { task_access: "scoped", project_grants: [{ project_id: P["ta-P1"] }, { project_id: P["ta-P2"], can_edit: true }] });
+  expect(g.status).toBe(200);
+  const gv = await send(admin.token, "PUT", `/api/networks/${NET}/members/${vic.id}/task-grants`, { task_access: "scoped", project_grants: [P["ta-P3"]] });
+  expect(gv.status).toBe(200);
+}, 30_000);
+
+afterAll(() => {
+  try { hub?.stop?.(true); } catch {}
+  try { rmSync(DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("默认值与授权接口", () => {
+  test("新成员默认 all:常量是 'all';管理员建号 / POST members / 邀请码加入都落在 all 且看得见全部卡", async () => {
+    expect(NEW_MEMBER_TASK_ACCESS).toBe("all");
+    const all = ["ta-other", "ta-own", "ta-p1", "ta-p2", "ta-p3", "ta-part"];
+    const stamp = Date.now();
+    // 管理员建号
+    const u1 = { username: `ta_new1_${stamp}`, password: PW, network_id: NET, role: "member" };
+    expect((await send(admin.token, "POST", "/api/admin/users", u1)).status).toBe(200);
+    const l1 = await send("", "POST", "/api/auth/login", { username: u1.username, password: PW });
+    // POST /members 不带 task_access
+    const u2 = register(`ta_new2_${stamp}`, PW);
+    expect((await send(admin.token, "POST", `/api/networks/${NET}/members`, { user_id: u2.user!.user_id, role: "member" })).status).toBe(200);
+    // 邀请码加入
+    const inv = await send(admin.token, "POST", `/api/networks/${NET}/invite`, { role: "member" });
+    const u3 = register(`ta_new3_${stamp}`, PW);
+    expect((await send(u3.token!, "POST", "/api/networks/join", { invite_code: inv.body.invite_code })).status).toBe(200);
+    for (const [id, token] of [[l1.body.user.user_id, l1.body.token], [u2.user!.user_id, u2.token!], [u3.user!.user_id, u3.token!]] as [string, string][]) {
+      const g = await get(admin.token, `/api/networks/${NET}/members/${id}/task-grants`);
+      expect(g.body.task_access).toBe("all");
+      expect(g.body.restricted).toBe(false);
+      expect(await listIds(token)).toEqual(all);
+      const me = await get(token, "/api/auth/me");
+      expect(me.body.networks.find((n: any) => n.network_id === NET).task_access).toBe("all");
+    }
+    // POST /members 显式传 scoped 仍然生效
+    const u4 = register(`ta_new4_${stamp}`, PW);
+    expect((await send(admin.token, "POST", `/api/networks/${NET}/members`, { user_id: u4.user!.user_id, role: "member", task_access: "scoped" })).status).toBe(200);
+    expect((await get(admin.token, `/api/networks/${NET}/members/${u4.user!.user_id}/task-grants`)).body.task_access).toBe("scoped");
+    expect(await listIds(u4.token!)).toEqual([]);
+    for (const id of [l1.body.user.user_id, u2.user!.user_id, u3.user!.user_id, u4.user!.user_id]) {
+      expect((await send(admin.token, "DELETE", `/api/networks/${NET}/members/${id}`)).status).toBe(200);
+    }
+  });
+
+  test("经授权接口显式设成 scoped 的成员:task_access / restricted / 授权与改默认值之前逐字相同;升级前的行是 'all'", async () => {
+    const r = await get(admin.token, `/api/networks/${NET}/members/${alice.id}/task-grants`);
+    expect(r.body.task_access).toBe("scoped");
+    expect(r.body.restricted).toBe(true);
+    expect(r.body.project_grants).toEqual([{ project_id: P["ta-P1"], can_edit: false }, { project_id: P["ta-P2"], can_edit: true }].sort((x, y) => x.project_id.localeCompare(y.project_id)));
+    expect((await get(admin.token, `/api/networks/${NET}/members/${carol.id}/task-grants`)).body.task_access).toBe("all");
+  });
+
+  test("/members 与 /auth/me 带上 task_access;owner 恒 all", async () => {
+    const m = await get(admin.token, `/api/networks/${NET}/members`);
+    const row = (id: string) => m.body.members.find((x: any) => x.user_id === id);
+    expect(row(alice.id).task_access).toBe("scoped");
+    expect(row(alice.id).task_project_count).toBe(2);
+    expect(row(carol.id).task_access).toBe("all");
+    expect(row(admin.id).task_access).toBe("all");
+    const me = await get(alice.token, "/api/auth/me");
+    expect(me.body.networks.find((n: any) => n.network_id === NET).task_access).toBe("scoped");
+  });
+
+  test("授权接口:外网 / 不存在的项目 400 且整批不写;不传的字段保持原样;普通成员与节点令牌 403;审计", async () => {
+    const bad = await send(admin.token, "PUT", `/api/networks/${NET}/members/${alice.id}/task-grants`, { project_grants: [P["ta-P4"], "proj_does_not_exist"] });
+    expect(bad.status).toBe(400);
+    expect(bad.body.error).toBe("project_not_in_network");
+    expect((await get(admin.token, `/api/networks/${NET}/members/${alice.id}/task-grants`)).body.project_grants.length).toBe(2);
+    const keep = await send(admin.token, "PUT", `/api/networks/${NET}/members/${alice.id}/task-grants`, { task_access: "scoped" });
+    expect(keep.body.project_grants.length).toBe(2);
+    expect((await send(alice.token, "GET", `/api/networks/${NET}/members/${alice.id}/task-grants`)).status).toBe(403);
+    expect((await send(carol.token, "PUT", `/api/networks/${NET}/members/${alice.id}/task-grants`, { task_access: "all" })).status).toBe(403);
+    const nt = await send(admin.token, "POST", "/api/auth/node-token", { network_id: NET, node_name: "ta-node", node_id: "node_ta_1" });
+    expect((await get(nt.body.token, `/api/networks/${NET}/members/${alice.id}/task-grants`)).status).toBe(403);
+    expect(db.get("SELECT 1 FROM audit_log WHERE action = 'member_task_grants_changed' AND network_id = ?1", NET)).toBeTruthy();
+  });
+});
+
+describe("可见性", () => {
+  test("alice 只看见:负责 / 参与 / 授权项目的卡;不看见无关的与没授权项目的", async () => {
+    expect(await listIds(alice.token)).toEqual(["ta-own", "ta-p1", "ta-p2", "ta-part"]);
+  });
+  test("viewer_can:scoped 调用者每张卡带上能不能改 / 删;老成员与 owner 不带", async () => {
+    const r = await get(alice.token, `/api/requirements?network_id=${NET}`);
+    const by = (n: string) => (r.body.requirements as any[]).find(x => x.name === n)?.viewer_can;
+    expect(by("ta-own")).toEqual({ edit: true, delete: true });
+    expect(by("ta-part")).toEqual({ edit: false, delete: false });
+    expect(by("ta-p1")).toEqual({ edit: false, delete: false });
+    expect(by("ta-p2")).toEqual({ edit: true, delete: false });
+    expect((await get(vic.token, `/api/requirements/${C["ta-p3"].id}?network_id=${NET}`)).body.requirement.viewer_can).toEqual({ edit: false, delete: false });
+    const carolList = await get(carol.token, `/api/requirements?network_id=${NET}`);
+    expect((carolList.body.requirements as any[]).every(x => x.viewer_can === undefined)).toBe(true);
+    expect((await get(admin.token, `/api/requirements/${C["ta-own"].id}`)).body.requirement.viewer_can).toBeUndefined();
+  });
+  test("viewer vic 只看见授权项目 P3 的卡", async () => {
+    expect(await listIds(vic.token)).toEqual(["ta-p3"]);
+  });
+  test("老成员 carol 与 owner 照旧看全部", async () => {
+    const all = ["ta-other", "ta-own", "ta-p1", "ta-p2", "ta-p3", "ta-part"];
+    expect(await listIds(carol.token)).toEqual(all);
+    expect(await listIds(admin.token)).toEqual(all);
+  });
+  test("搜索也按可见性过滤", async () => {
+    expect(await listIds(alice.token, "&q=ta-other")).toEqual([]);
+    expect(await listIds(carol.token, "&q=ta-other")).toEqual(["ta-other"]);
+  });
+  test("看不见的卡:GET / #N 与不存在的卡逐字节相同", async () => {
+    const hidden = await get(alice.token, `/api/requirements/${C["ta-other"].id}?network_id=${NET}`);
+    const ghost = await get(alice.token, `/api/requirements/req_does_not_exist?network_id=${NET}`);
+    expect(hidden.status).toBe(404);
+    expect(hidden.text).toBe(ghost.text);
+    const bySeq = await get(alice.token, `/api/requirements/%23${C["ta-other"].seq}?network_id=${NET}`);
+    const noSeq = await get(alice.token, `/api/requirements/%2399999?network_id=${NET}`);
+    expect(bySeq.status).toBe(404);
+    expect(bySeq.text).toBe(noSeq.text);
+    expect((await get(carol.token, `/api/requirements/${C["ta-other"].id}?network_id=${NET}`)).status).toBe(200);
+  });
+  test("标签只从看得见的卡汇总", async () => {
+    expect((await get(alice.token, `/api/requirements/tags?network_id=${NET}`)).body.tags).not.toContain("secret-tag");
+    expect((await get(carol.token, `/api/requirements/tags?network_id=${NET}`)).body.tags).toContain("secret-tag");
+  });
+  test("项目列表:alice 只看授权的 P1 / P2", async () => {
+    const r = await get(alice.token, `/api/requirements/projects?network_id=${NET}`);
+    expect(r.body.projects.map((p: any) => p.name).sort()).toEqual(["ta-P1", "ta-P2"]);
+    expect((await get(carol.token, `/api/requirements/projects?network_id=${NET}`)).body.projects.length).toBe(4);
+  });
+});
+
+describe("写入", () => {
+  test("能改:负责的、可改项目里的;只读:参与的、只看项目里的(403 task_read_only);看不见的与不存在的同一个 404", async () => {
+    expect((await send(alice.token, "PATCH", `/api/requirements/${C["ta-own"].id}?network_id=${NET}`, { column: "doing" })).status).toBe(200);
+    expect((await send(alice.token, "PATCH", `/api/requirements/${C["ta-p2"].id}?network_id=${NET}`, { column: "doing" })).status).toBe(200);
+    for (const n of ["ta-part", "ta-p1"]) {
+      const r = await send(alice.token, "PATCH", `/api/requirements/${C[n].id}?network_id=${NET}`, { column: "doing" });
+      expect(r.status).toBe(403);
+      expect(r.body.error).toBe("task_read_only");
+    }
+    const hidden = await send(alice.token, "PATCH", `/api/requirements/${C["ta-other"].id}?network_id=${NET}`, { column: "doing" });
+    const ghost = await send(alice.token, "PATCH", `/api/requirements/req_does_not_exist?network_id=${NET}`, { column: "doing" });
+    expect(hidden.status).toBe(404);
+    expect(hidden.text).toBe(ghost.text);
+  });
+
+  test("勾子任务:负责的能勾,参与的 403,看不见的 404", async () => {
+    expect((await send(alice.token, "PATCH", `/api/requirements/${C["ta-own"].id}/checklist/i1?network_id=${NET}`, { done: true })).status).toBe(200);
+    const part = await send(alice.token, "PATCH", `/api/requirements/${C["ta-part"].id}/checklist/i1?network_id=${NET}`, { done: true });
+    expect(part.status).toBe(403);
+    expect(part.body.error).toBe("task_read_only");
+    expect((await send(alice.token, "PATCH", `/api/requirements/${C["ta-other"].id}/checklist/i1?network_id=${NET}`, { done: true })).status).toBe(404);
+  });
+
+  test("挪项目:只能挪进 can_edit 的项目;没授权的与不存在的同一个错误", async () => {
+    const r = await send(alice.token, "PATCH", `/api/requirements/${C["ta-own"].id}?network_id=${NET}`, { project_id: P["ta-P1"] });
+    const ghost = await send(alice.token, "PATCH", `/api/requirements/${C["ta-own"].id}?network_id=${NET}`, { project_id: "proj_nope" });
+    expect(r.status).toBe(400);
+    expect(r.text).toBe(ghost.text);
+  });
+
+  test("新建:能建;自建的卡看得见也能改;建进只看项目 / 看不见的父卡 / 别人的 client_id / external_ref 都被挡", async () => {
+    const mine = await send(alice.token, "POST", "/api/requirements", { network_id: NET, name: "ta-alice-own" });
+    expect(mine.status).toBe(201);
+    expect(await listIds(alice.token)).toContain("ta-alice-own");
+    expect((await send(alice.token, "PATCH", `/api/requirements/${mine.body.requirement.id}?network_id=${NET}`, { priority: "high" })).status).toBe(200);
+    expect((await send(alice.token, "POST", "/api/requirements", { network_id: NET, name: "ta-into-p2", project_id: P["ta-P2"] })).status).toBe(201);
+    const intoP1 = await send(alice.token, "POST", "/api/requirements", { network_id: NET, name: "ta-into-p1", project_id: P["ta-P1"] });
+    const intoNone = await send(alice.token, "POST", "/api/requirements", { network_id: NET, name: "ta-into-none", project_id: "proj_nope" });
+    expect(intoP1.status).toBe(400);
+    expect(intoP1.text).toBe(intoNone.text);
+    const hiddenParent = await send(alice.token, "POST", "/api/requirements", { network_id: NET, name: "ta-child", parent_id: C["ta-other"].id });
+    const ghostParent = await send(alice.token, "POST", "/api/requirements", { network_id: NET, name: "ta-child", parent_id: "req_does_not_exist" });
+    expect(hiddenParent.status).toBe(400);
+    expect(hiddenParent.text).toBe(ghostParent.text);
+    const replay = await send(alice.token, "POST", "/api/requirements", { network_id: NET, name: "ta-replay", client_id: "admin-client-1" });
+    expect(replay.status).toBe(409);
+    expect(replay.body.error).toBe("client_id_taken");
+    expect(replay.text).not.toContain("ta-other");
+    const ext = await send(alice.token, "POST", "/api/requirements", { network_id: NET, name: "ta-ext", external_ref: "github:o/r#1" });
+    expect(ext.status).toBe(403);
+    expect(ext.body.error).toBe("external_ref_not_allowed");
+  });
+
+  test("upsert 与项目管理:scoped 成员 403(固定错误,不看参数)", async () => {
+    const up = await send(alice.token, "POST", "/api/requirements/upsert", { network_id: NET, name: "x", external_ref: "github:o/r#2" });
+    expect(up.status).toBe(403);
+    expect(up.body.error).toBe("upsert_not_allowed");
+    expect((await send(alice.token, "POST", `/api/requirements/projects?network_id=${NET}`, { name: "ta-alice-proj" })).status).toBe(403);
+    expect((await send(alice.token, "PATCH", `/api/requirements/projects/${P["ta-P2"]}?network_id=${NET}`, { name: "renamed" })).status).toBe(403);
+  });
+
+  test("删除:只能删负责 / 自建的;可改项目里的也不能删(403 task_delete_denied);删卡写审计", async () => {
+    const p2 = await send(alice.token, "DELETE", `/api/requirements/${C["ta-p2"].id}?network_id=${NET}`);
+    expect(p2.status).toBe(403);
+    expect(p2.body.error).toBe("task_delete_denied");
+    const hidden = await send(alice.token, "DELETE", `/api/requirements/${C["ta-other"].id}?network_id=${NET}`);
+    const ghost = await send(alice.token, "DELETE", `/api/requirements/req_does_not_exist?network_id=${NET}`);
+    expect(hidden.status).toBe(404);
+    expect(hidden.text).toBe(ghost.text);
+    expect((await send(alice.token, "DELETE", `/api/requirements/${C["ta-own"].id}?network_id=${NET}`)).status).toBe(200);
+    const audit = db.get<{ detail: string; network_id: string }>("SELECT detail, network_id FROM audit_log WHERE action = 'requirement_deleted' AND target_id = ?1", C["ta-own"].id);
+    expect(audit?.network_id).toBe(NET);
+    expect(audit?.detail).toContain("ta-own");
+  });
+
+  test("被拒的写入审计限频:同一 (用户, 卡) 连续两次只记一条", async () => {
+    await send(alice.token, "PATCH", `/api/requirements/${C["ta-p1"].id}?network_id=${NET}`, { name: "a" });
+    await send(alice.token, "PATCH", `/api/requirements/${C["ta-p1"].id}?network_id=${NET}`, { name: "b" });
+    const n = db.get<{ c: number }>("SELECT COUNT(*) AS c FROM audit_log WHERE action = 'task_access_denied' AND user_id = ?1 AND target_id = ?2", alice.id, C["ta-p1"].id)?.c;
+    expect(n).toBe(1);
+  });
+
+  test("viewer 什么都不能写(沿用 permission_denied)", async () => {
+    expect((await send(vic.token, "PATCH", `/api/requirements/${C["ta-p3"].id}?network_id=${NET}`, { column: "doing" })).status).toBe(403);
+  });
+
+  test("老成员 carol 照旧:能改、能删别人的卡、能管项目、能 upsert", async () => {
+    expect((await send(carol.token, "PATCH", `/api/requirements/${C["ta-other"].id}?network_id=${NET}`, { column: "doing" })).status).toBe(200);
+    expect((await send(carol.token, "POST", `/api/requirements/projects?network_id=${NET}`, { name: "ta-carol-proj" })).status).toBe(201);
+    expect((await send(carol.token, "POST", "/api/requirements/upsert", { network_id: NET, name: "ta-carol-up", external_ref: "github:o/r#3" })).status).toBe(201);
+    expect((await send(carol.token, "DELETE", `/api/requirements/${C["ta-p3"].id}?network_id=${NET}`)).status).toBe(200);
+  });
+});
+
+describe("MCP 与 REST 一致", () => {
+  test("requirements_list / requirements_get 对 alice 同样过滤", async () => {
+    const list = await mcp(alice.token, "requirements_list", { network_id: NET });
+    const names = (list.requirements as any[]).map(x => x.name).filter((n: string) => n.startsWith("ta-")).sort();
+    expect(names).toEqual(await listIds(alice.token));
+    const hidden = await mcp(alice.token, "requirements_get", { id: C["ta-other"].id, network_id: NET });
+    expect(hidden.ok).toBe(false);
+    expect(hidden.error).toBe("requirement_not_found");
+  });
+});
+
+describe("LIKE 通配符不越权(参与人 / 负责人 id 里有 % 或 _)", () => {
+  // 可见性子句用 LIKE … ESCAPE 匹配 `"kind":"user","id":"<uid>"`;id 里的 % / _ 必须按字面匹配。
+  // 造两个用户:pct 的 id 带 % 与 _,twin 的 id 在「不转义」时恰好能被 pct 的模式匹配上。
+  const PCT = "u_ta%pct_1";
+  const TWIN = "u_taXpctA1";
+  let pctToken = "";
+  beforeAll(async () => {
+    for (const [id, name] of [[PCT, "ta_pct"], [TWIN, "ta_twin"]] as const) {
+      db.run("INSERT INTO users (user_id, username, password_hash, display_name, role) VALUES (?1, ?2, 'x', ?2, 'user')", [id, `${name}_${Date.now()}`]);
+      db.run("INSERT INTO network_members (network_id, user_id, role, agent_access, task_access) VALUES (?1, ?2, 'member', 'granted', 'scoped')", [NET, id]);
+    }
+    pctToken = issueUserToken(PCT).token;
+    for (const [name, ref] of [["ta-twin-owned", TWIN], ["ta-pct-owned", PCT]] as const) {
+      const r = await send(admin.token, "POST", "/api/requirements", { network_id: NET, name, owner: userRef(ref), participants: [userRef(ref)] });
+      expect(r.status).toBe(201);
+      C[name] = { id: r.body.requirement.id, seq: r.body.requirement.seq };
+    }
+  });
+  test("id 带 % / _ 的成员只看见自己的卡,看不见被通配符「撞上」的那张", async () => {
+    const mine = await listIds(pctToken);
+    expect(mine).toContain("ta-pct-owned");
+    expect(mine).not.toContain("ta-twin-owned");
+    expect((await get(pctToken, `/api/requirements/${C["ta-twin-owned"].id}?network_id=${NET}`)).status).toBe(404);
+  });
+});
+
+describe("清理", () => {
+  test("删项目清掉项目授权;移出成员清掉他的全部授权", async () => {
+    expect((await send(admin.token, "DELETE", `/api/requirements/projects/${P["ta-P1"]}?network_id=${NET}`)).status).toBe(200);
+    expect(db.get("SELECT 1 FROM network_member_project_grants WHERE project_id = ?1", P["ta-P1"])).toBeFalsy();
+    expect((await send(admin.token, "DELETE", `/api/networks/${NET}/members/${vic.id}`)).status).toBe(200);
+    expect(db.get("SELECT 1 FROM network_member_project_grants WHERE user_id = ?1", vic.id)).toBeFalsy();
+  });
+});