mikser-io-drive 0.16.0 → 0.17.0

package/lib/files.js

@@ -30,7 +30,7 @@ import { lookup as mimeLookup } from 'mime-types'
 // Drive writes with fs directly rather than through a collection handle, so
 // it records its own paths. Without this a media replacement — the change most
 // worth taking back — falls into the unattributed sweep.
-import { looksTextual, recordChangeSetWrite, explainRefusal, actingRole, useService } from 'mikser-io'
+import { looksTextual, recordChangeSetWrite, explainRefusal, actingRole, useService, hasCapability, missingCapability } from 'mikser-io'
 import { readFile, writeFile, mkdir, rename, stat, unlink, open } from 'node:fs/promises'
 import {
     runtime, readEntity, findEntities, nextCycleId, whenCycleCompletes, checksum,
@@ -267,14 +267,25 @@ export function registerFileTools({ runtime, endpoints, capabilityOf, writeCapab
         if (!ep) return null
         return path.isAbsolute(ep.folder) ? ep.folder : path.join(workingFolder(), ep.folder)
     }
-    const holds = (principal, capability) => {
-        const held = principal?.capabilities
-        // Not capability-scoped — a static token or a loopback caller. The
-        // endpoint's own gate still applies at the transport; this cannot
-        // narrow further without guessing.
-        if (held == null) return true
-        return held.includes(capability)
-    }
+    // Both from the engine. Neither the "does this principal hold it" rule nor
+    // the "which of these is missing" rule belongs to this plugin: a private
+    // copy of the first is how the `*` wildcard came to work on the WebDAV
+    // mount and not on the tools over the same endpoint.
+    //
+    // Writing needs the pair the mount has always required:
+    //
+    //   drive:<name>          may mount and read it
+    //   drive:<name>:write    may ALSO write to it
+    //
+    // "also" means the base is a prerequisite, not an alternative. These tools
+    // checked only the second, so a grant carrying `:write` without the base
+    // was refused a PUT and allowed the identical write through here. That
+    // configuration is not hypothetical — it is what a deployment has when its
+    // editors hold `drive:documents:write` and nothing carries
+    // `drive:documents`.
+    const holds = (principal, capability) => hasCapability(principal, capability)
+    const missingForWrite = (principal, endpoint) =>
+        missingCapability(principal, [capabilityOf(endpoint), writeCapabilityOf(endpoint)])
 
     // ── add ──────────────────────────────────────────────────────────────
     mcp.registerTool(
@@ -325,8 +336,9 @@ export function registerFileTools({ runtime, endpoints, capabilityOf, writeCapab
             if (endpoints[endpoint].readOnly === true) {
                 return fail(`${endpoint} is configured readOnly, so nothing can be stored there.`)
             }
-            if (!holds(principal, writeCapabilityOf(endpoint))) {
-                return fail(`Refused: you do not hold ${writeCapabilityOf(endpoint)}. Nothing was written.`)
+            const missingToAdd = missingForWrite(principal, endpoint)
+            if (missingToAdd) {
+                return fail(`Refused: you do not hold ${missingToAdd}. Nothing was written.`)
             }
             if (!Array.isArray(files) || !files.length) return fail('files must be a non-empty array')
 
@@ -634,9 +646,8 @@ export function registerFileTools({ runtime, endpoints, capabilityOf, writeCapab
                 if (endpoints[owning].readOnly === true) {
                     refuse(`${owning} is configured readOnly, so nothing can be removed from it.`); continue
                 }
-                if (!holds(principal, writeCapabilityOf(owning))) {
-                    refuse(`You do not hold ${writeCapabilityOf(owning)}.`); continue
-                }
+                const missingToDelete = missingForWrite(principal, owning)
+                if (missingToDelete) { refuse(`You do not hold ${missingToDelete}.`); continue }
                 try { await stat(found.file) } catch {
                     refuse(`Nothing on disk at ${path.relative(workingFolder(), found.file)}.`); continue
                 }
@@ -797,9 +808,8 @@ export function registerFileTools({ runtime, endpoints, capabilityOf, writeCapab
                 if (endpoints[owning].readOnly === true) {
                     refuse(`${owning} is configured readOnly, so nothing can be moved within it.`); continue
                 }
-                if (!holds(principal, writeCapabilityOf(owning))) {
-                    refuse(`You do not hold ${writeCapabilityOf(owning)}.`); continue
-                }
+                const missingToMove = missingForWrite(principal, owning)
+                if (missingToMove) { refuse(`You do not hold ${missingToMove}.`); continue }
                 const dest = safeSegment(to, 'to')
                 if (dest.error) { refuse(dest.error); continue }
                 try { await stat(found.file) } catch {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mikser-io-drive",
-  "version": "0.16.0",
-  "description": "WebDAV for mikser-io. Exposes working-folder directories as WebDAV endpoints via Nephele, authenticated through mikser-io-auth's htpasswd identity \u2014 so content can be edited from Finder, Explorer or any DAV client and the build picks the change up.",
+  "version": "0.17.0",
+  "description": "WebDAV for mikser-io. Exposes working-folder directories as WebDAV endpoints via Nephele, authenticated through mikser-io-auth's htpasswd identity — so content can be edited from Finder, Explorer or any DAV client and the build picks the change up.",
   "main": "index.js",
   "type": "module",
   "allowScripts": {
@@ -28,7 +28,7 @@
   },
   "homepage": "https://github.com/almero-digital-marketing/mikser-io-drive#readme",
   "peerDependencies": {
-    "mikser-io": "^10.0.0",
+    "mikser-io": "^10.14.0",
     "zod": "^4.0.0"
   },
   "dependencies": {
@@ -41,7 +41,7 @@
     "bcryptjs": "^3.0.0",
     "express": "^5.2.1",
     "globby": "^15.0.0",
-    "mikser-io": "^10.0.0",
+    "mikser-io": "^10.14.0",
     "mikser-io-auth": "^0.13.0",
     "mikser-io-mcp": "^2.0.0",
     "webdav": "^5.10.0",

package/test/files.test.js

@@ -500,3 +500,84 @@ describe('read capability', () => {
         assert.notEqual(r.isError, true)
     })
 })
+
+// Who may write, decided once in the engine rather than per plugin.
+//
+// Two bugs lived here, and both were invisible because nothing exercised the
+// tool surface against a credential the WebDAV mount would have judged
+// differently.
+//
+// The first: `holds` was a private `capabilities.includes(...)`, so the `*`
+// wildcard reached the mount — which asks the engine — and stopped at these
+// tools. One endpoint, two surfaces, opposite answers.
+//
+// The second: writing checked only `drive:<name>:write`, while the mount has
+// always required `drive:<name>` to reach the endpoint at all. "may ALSO
+// write" makes the base a prerequisite, not an alternative — so a grant
+// carrying `:write` alone was refused a PUT and allowed the identical write
+// through the tool. That is not a hypothetical configuration; it is what a
+// deployment has when its editors hold `drive:documents:write` and nothing
+// carries `drive:documents`.
+describe('writing is gated the way the mount gates it', () => {
+    const write = (substrate, name) => substrate.call('mikser_drive_add', {
+        endpoint: 'media', files: [{ name, base64: b64('x') }],
+    })
+    const refusal = (r) => r?.content?.find(c => c.type === 'text')?.text ?? JSON.stringify(r)
+
+    const toolsAs = async (capabilities) => {
+        const substrate = fakeSubstrate({ subject: 'u', roles: [], capabilities })
+        resetServices()
+        provideService('mcp', substrate)
+        registerFileTools({
+            runtime: { options: { ...runtime.options }, refs: runtime.refs },
+            endpoints: { media: { folder: 'media' } },
+            capabilityOf: readCapability, writeCapabilityOf: writeCapability,
+        })
+        return substrate
+    }
+
+    it('lets a wildcard holder write, as the mount already did', async () => {
+        const substrate = await toolsAs(['*'])
+        const r = await write(substrate, 'wildcard.txt')
+        assert.doesNotMatch(refusal(r), /do not hold/, refusal(r))
+    })
+
+    it('refuses `:write` held without the base, and names the base', async () => {
+        const substrate = await toolsAs(['drive:media:write'])
+        const r = await write(substrate, 'half.txt')
+        assert.match(refusal(r), /do not hold drive:media\b/,
+            'the missing capability is the base, and the refusal must say which')
+        assert.doesNotMatch(refusal(r), /drive:media:write/,
+            'naming the one they DO hold sends them to fix the wrong grant')
+    })
+
+    it('allows the pair, which is what the mount requires', async () => {
+        const substrate = await toolsAs(['drive:media', 'drive:media:write'])
+        const r = await write(substrate, 'both.txt')
+        assert.doesNotMatch(refusal(r), /do not hold/, refusal(r))
+    })
+
+    it('still refuses a reader', async () => {
+        const substrate = await toolsAs(['drive:media'])
+        assert.match(refusal(await write(substrate, 'reader.txt')), /do not hold drive:media:write/)
+    })
+
+    it('lets a wildcard holder READ, which is the other gate', async () => {
+        // The read tool asks `holds`; writing asks the engine's
+        // missingCapability. They are different call paths, and a test that
+        // only writes leaves the read gate uncovered — which is how a private
+        // `includes` survived there while the mount had already been fixed.
+        const seeded = await toolsAs(['drive:media', 'drive:media:write'])
+        await write(seeded, 'readable-by-wildcard.txt')
+        const substrate = await toolsAs(['*'])
+        const r = await substrate.call('mikser_drive_read', { path: 'media/readable-by-wildcard.txt' })
+        assert.doesNotMatch(refusal(r), /lacks|do not hold/, refusal(r))
+    })
+
+    it('leaves an unscoped credential alone', async () => {
+        // A bare static token declares nothing; the endpoint's own gate is
+        // what bounds it. That is a different rule and stays different.
+        const substrate = await toolsAs(null)
+        assert.doesNotMatch(refusal(await write(substrate, 'token.txt')), /do not hold/)
+    })
+})