mirror of
https://github.com/supermemoryai/supermemory.git
synced 2026-08-28 05:25:33 +00:00
Cherry-picks #1582, #1583, #1584 and #1585 from @Sravanjangam (security audit #1578) onto one branch. - MCP: `get_document` scopes to the active space like its sibling read tools, `fetch-graph-data` bounds page/limit, `guided-save` caps prefill at 200k, and `whoAmI` no longer returns the transport session id. - ai-sdk: search limit clamped to 1-50 with a 30s client timeout. - validation: caps on `DocumentsWithMemoriesQuerySchema.limit` and `BulkDeleteMemoriesSchema.containerTags`. - Raycast: `metadata.url` is parsed and only http(s) is offered to the OS opener. Dropped his `add_memory` permission gate: it checked the target against the list of existing spaces, so writes to a new space failed and the no-active-space path surfaced `No write access to space "undefined"`. Write permission stays enforced in the API via `containerTagGate`. Hardening and consistency rather than a security fix, since the API already enforces every permission boundary here. Co-Authored-By: Sravanjangam <163002695+Sravanjangam@users.noreply.github.com>
177 lines
4.9 KiB
TypeScript
177 lines
4.9 KiB
TypeScript
import { describe, expect, it } from "bun:test"
|
|
import { readFileSync } from "node:fs"
|
|
import {
|
|
BulkDeleteMemoriesSchema,
|
|
DocumentsWithMemoriesQuerySchema,
|
|
ListMemoriesQuerySchema,
|
|
SearchRequestSchema,
|
|
Searchv4RequestSchema,
|
|
} from "./api"
|
|
|
|
describe("search threshold schemas", () => {
|
|
it("do not contain redundant number transforms or unreachable range guards", () => {
|
|
const source = readFileSync(new URL("./api.ts", import.meta.url), "utf8")
|
|
const searchSchemas = source.slice(
|
|
source.indexOf("export const SearchRequestSchema"),
|
|
source.indexOf("export const SearchResultSchema"),
|
|
)
|
|
|
|
expect(searchSchemas).not.toContain(".transform(Number)")
|
|
expect(searchSchemas).not.toContain("v === undefined || (v >= 0 && v <= 1)")
|
|
})
|
|
|
|
it("preserves threshold defaults", () => {
|
|
const search = SearchRequestSchema.parse({ q: "memory" })
|
|
const searchV4 = Searchv4RequestSchema.parse({ q: "memory" })
|
|
|
|
expect(search.chunkThreshold).toBe(0)
|
|
expect(search.documentThreshold).toBe(0)
|
|
expect(searchV4.threshold).toBe(0.6)
|
|
})
|
|
|
|
it.each([0, 0.5, 1])("accepts inclusive threshold value %p", (threshold) => {
|
|
expect(
|
|
SearchRequestSchema.parse({
|
|
q: "memory",
|
|
chunkThreshold: threshold,
|
|
documentThreshold: threshold,
|
|
}),
|
|
).toMatchObject({
|
|
chunkThreshold: threshold,
|
|
documentThreshold: threshold,
|
|
})
|
|
expect(
|
|
Searchv4RequestSchema.parse({ q: "memory", threshold }).threshold,
|
|
).toBe(threshold)
|
|
})
|
|
|
|
it.each([
|
|
-0.1, 1.1,
|
|
])("rejects out-of-range threshold value %p", (threshold) => {
|
|
expect(
|
|
SearchRequestSchema.safeParse({
|
|
q: "memory",
|
|
chunkThreshold: threshold,
|
|
}).success,
|
|
).toBe(false)
|
|
expect(
|
|
SearchRequestSchema.safeParse({
|
|
q: "memory",
|
|
documentThreshold: threshold,
|
|
}).success,
|
|
).toBe(false)
|
|
expect(
|
|
Searchv4RequestSchema.safeParse({ q: "memory", threshold }).success,
|
|
).toBe(false)
|
|
})
|
|
|
|
it("does not coerce threshold strings", () => {
|
|
expect(
|
|
SearchRequestSchema.safeParse({
|
|
q: "memory",
|
|
chunkThreshold: "0.5",
|
|
}).success,
|
|
).toBe(false)
|
|
expect(
|
|
SearchRequestSchema.safeParse({
|
|
q: "memory",
|
|
documentThreshold: "0.5",
|
|
}).success,
|
|
).toBe(false)
|
|
expect(
|
|
Searchv4RequestSchema.safeParse({
|
|
q: "memory",
|
|
threshold: "0.5",
|
|
}).success,
|
|
).toBe(false)
|
|
})
|
|
})
|
|
|
|
describe("pagination query schemas", () => {
|
|
it("preserve page/limit defaults", () => {
|
|
const listed = ListMemoriesQuerySchema.parse({})
|
|
expect(listed.page).toBe(1)
|
|
expect(listed.limit).toBe(10)
|
|
|
|
const docs = DocumentsWithMemoriesQuerySchema.parse({})
|
|
expect(docs.page).toBe(1)
|
|
expect(docs.limit).toBe(10)
|
|
})
|
|
|
|
it.each([
|
|
1, 50, 1100,
|
|
])("ListMemoriesQuerySchema accepts numeric limit %p", (limit) => {
|
|
expect(ListMemoriesQuerySchema.parse({ limit }).limit).toBe(limit)
|
|
})
|
|
|
|
it("ListMemoriesQuerySchema accepts numeric string page/limit", () => {
|
|
const parsed = ListMemoriesQuerySchema.parse({ page: "3", limit: "25" })
|
|
expect(parsed.page).toBe(3)
|
|
expect(parsed.limit).toBe(25)
|
|
})
|
|
|
|
it.each([
|
|
0, -5, 2.5,
|
|
])("ListMemoriesQuerySchema rejects non-positive or fractional numeric limit %p", (limit) => {
|
|
expect(ListMemoriesQuerySchema.safeParse({ limit }).success).toBe(false)
|
|
})
|
|
|
|
it.each([
|
|
0, -1, 1.5,
|
|
])("ListMemoriesQuerySchema rejects non-positive or fractional numeric page %p", (page) => {
|
|
expect(ListMemoriesQuerySchema.safeParse({ page }).success).toBe(false)
|
|
})
|
|
|
|
it("ListMemoriesQuerySchema still caps limit at 1100", () => {
|
|
expect(ListMemoriesQuerySchema.safeParse({ limit: 1101 }).success).toBe(
|
|
false,
|
|
)
|
|
})
|
|
|
|
it.each([
|
|
0, -1, 2.5,
|
|
])("DocumentsWithMemoriesQuerySchema rejects invalid page %p", (page) => {
|
|
expect(DocumentsWithMemoriesQuerySchema.safeParse({ page }).success).toBe(
|
|
false,
|
|
)
|
|
})
|
|
|
|
it.each([
|
|
0, -10, 2.5,
|
|
])("DocumentsWithMemoriesQuerySchema rejects invalid limit %p", (limit) => {
|
|
expect(DocumentsWithMemoriesQuerySchema.safeParse({ limit }).success).toBe(
|
|
false,
|
|
)
|
|
})
|
|
|
|
it("DocumentsWithMemoriesQuerySchema accepts a normal request", () => {
|
|
const parsed = DocumentsWithMemoriesQuerySchema.parse({
|
|
page: 2,
|
|
limit: 50,
|
|
})
|
|
expect(parsed.page).toBe(2)
|
|
expect(parsed.limit).toBe(50)
|
|
})
|
|
|
|
it("DocumentsWithMemoriesQuerySchema caps limit at 1000", () => {
|
|
expect(
|
|
DocumentsWithMemoriesQuerySchema.safeParse({ limit: 1001 }).success,
|
|
).toBe(false)
|
|
expect(
|
|
DocumentsWithMemoriesQuerySchema.safeParse({ limit: 200 }).success,
|
|
).toBe(true)
|
|
})
|
|
|
|
it("BulkDeleteMemoriesSchema caps containerTags at 100 entries of bounded length", () => {
|
|
const tooMany = {
|
|
containerTags: Array.from({ length: 101 }, (_, i) => `tag_${i}`),
|
|
}
|
|
expect(BulkDeleteMemoriesSchema.safeParse(tooMany).success).toBe(false)
|
|
|
|
const tagTooLong = { containerTags: ["x".repeat(257)] }
|
|
expect(BulkDeleteMemoriesSchema.safeParse(tagTooLong).success).toBe(false)
|
|
|
|
const ok = { containerTags: ["tag_a", "tag_b"] }
|
|
expect(BulkDeleteMemoriesSchema.safeParse(ok).success).toBe(true)
|
|
})
|
|
})
|