cybercove-labs/shared-memory
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: address Phase 4 code review (5 findings + symmetric snippet fix)

Browse Source 
1. lib/snippets.ts + lib/memory-actions.ts (×2): shared-project key
   lookups were querying `projects` by key with no visibility scope. Since
   `projects.key` is unique per user (not global), the unscoped match
   could resolve another user's project entirely. Restricted the lookups
   to `readableProjectIds(userId, groupNames)` — own + shared only.

2. lib/access.ts getAccessibleProjects: a stray `if (existing) continue`
   inside the share-collapse loop short-circuited on the first match,
   killing the rw-beats-ro upgrade path. Two-group cases where one share
   was ro and another rw on the same project were incorrectly resolved
   as ro. Replaced with explicit owner/rw skip.

3. lib/mcp/tools.ts snippetPut: removed a dead `void exists` block that
   looked like an authorization pre-flight but was actually a no-op —
   real write authorization lives inside putSnippet, called next. Added
   a comment at the call site documenting where the check is.

4. memory.delete + snippet.delete: previously had no optimistic-lock
   CAS, so a concurrent peer edit could be silently overwritten by a
   delete on a stale view. Added optional `version` to MemoryDeleteInput
   (new) and SnippetDeleteInput (extended); UPDATE WHERE now CASes on
   version; 0-row response surfaces CONCURRENT_EDIT_ERROR. Web detail
   pages pass `version` through hidden form inputs. When the caller
   doesn't supply a version, falls back to the version we just read in
   the same handler for in-handler consistency.

5. lib/mcp/tools.ts memorySearch re-fetch: missing `isNull(deletedAt)`
   on the post-search row hydration left a TOCTOU window where a row
   soft-deleted between the search and the re-fetch would be returned.
   Visibility is still enforced by searchMemories itself.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
shadowdao
2026-05-17 10:06:10 -07:00
co-authored by Claude Opus 4.7
parent 3f17a5b2d6
commit a44b834a78
8 changed files with 151 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/web/lib/access.ts
+4 -5
View File
@@ -79,13 +79,12 @@ export async function getAccessibleProjects(
.innerJoin(projects, eq(projects.id, projectShares.projectId))
.where(inArray(groups.name, groupNames));
// If two of the user's groups both share the same project at different
// levels, keep the strongest: owner > rw > ro. The DB may emit the same
// project twice (once per group), so we collapse by taking the max.
for (const r of shared) {
const existing = ownedMap.get(r.projectId);
if (existing) continue; // owner already wins
// If two of the user's groups both share the same project at
// different levels, keep the stronger one (rw beats ro).
const prior = ownedMap.get(r.projectId);
if (prior && prior.access === "rw") continue;
if (prior?.access === "owner" || prior?.access === "rw") continue;
ownedMap.set(r.projectId, {
projectId: r.projectId,
access: r.access as "ro" | "rw",