feat(mcp): model-free document upload via signed URL (#1378)

* feat(mcp): model-free document upload via signed URL (#748) Adds gnubok_create_document_upload + gnubok_complete_document_upload so document bytes reach storage through a short-lived signed PUT URL and never pass through the model context. Fixes silent base64 corruption on real-size PDFs and the context blowup on batch uploads. - pending/ staage keys with TTL cleanup; completion validates magic bytes + SHA-256, moves bytes to the WORM key and adopts the reserved UUID as document id, making retries and concurrent completions idempotent - legacy gnubok_upload_document kept for clients without file access, description now points to the signed-URL pair; shared mime resolution and inbox-item creation extracted - both new tools mapped in TOOL_SCOPE_MAP (transactions:write) and MCP_TOOL_CAPABILITY_MAP (ai) so the paywall and scope gates hold - payload guard ceiling 58.5K to 59K after trimming the create tool's outputSchema to upload_id/upload_url/expires_at Fixes #748 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(mcp): satisfy capability-map lock and phantom-column scanner The exact-entries lock in capability-maps.test.ts now includes the signed-URL pair as dispatch-only AI tools, and the inbox insert uses a literal payload (explicit UUID instead of a conditional spread) so the no-phantom-columns scanner can resolve every column. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-03 18:41:05 +02:00
parent 00d4c8a49e
commit 5d7952a01e
9 changed files with 946 additions and 85 deletions
@@ -29,10 +29,16 @@ function makeClient(storageOverrides: Record<string, unknown> = {}) {
      createBucket: vi.fn().mockResolvedValue({ data: { name: 'documents' }, error: null }),
      from: vi.fn().mockReturnValue({
        upload: vi.fn().mockResolvedValue({ data: {}, error: null }),
+        createSignedUploadUrl: vi.fn().mockResolvedValue({
+          data: { signedUrl: 'https://example.com/signed-upload' },
+          error: null,
+        }),
        download: vi.fn().mockResolvedValue({
          data: new Blob(['test content']),
          error: null,
        }),
+        list: vi.fn().mockResolvedValue({ data: [], error: null }),
+        move: vi.fn().mockResolvedValue({ data: {}, error: null }),
        remove: vi.fn().mockResolvedValue({ data: [], error: null }),
        getPublicUrl: vi.fn().mockReturnValue({
          data: { publicUrl: 'https://example.com/file.pdf' },
@@ -59,6 +65,14 @@ import {
  verifyIntegrity,
  validateDocumentMagicBytes,
  buildDocumentStoragePath,
+  buildPendingDocumentStoragePath,
+  buildReservedDocumentStoragePath,
+  cleanupExpiredPendingDocumentUploads,
+  createPendingDocumentUpload,
+  completePendingDocumentUpload,
+  computeSHA256,
+  PENDING_DOCUMENT_UPLOAD_RETENTION_MS,
+  SIGNED_DOCUMENT_UPLOAD_TTL_MS,
  isCompanyScopedDocumentPath,
  companyScopedDocumentPath,
  legacyDocumentPath,
@@ -312,6 +326,163 @@ describe('uploadDocument', () => {
  })
 })

+describe('model-free signed document uploads', () => {
+  const company = '11111111-1111-4111-8111-111111111111'
+  const user = '22222222-2222-4222-8222-222222222222'
+  const uploadId = '33333333-3333-4333-8333-333333333333'
+
+  it('creates a company-scoped signed upload reservation with a two-hour expiry', async () => {
+    const now = Date.parse('2026-08-03T10:00:00.000Z')
+    const createSignedUploadUrl = vi.fn().mockResolvedValue({
+      data: { signedUrl: 'https://storage.example/upload?token=signed' },
+      error: null,
+    })
+    const supabase = makeClient({ createSignedUploadUrl })
+
+    const reservation = await createPendingDocumentUpload(
+      supabase as never,
+      company,
+      user,
+      uploadId,
+      'Leverantör faktura.pdf',
+      now,
+    )
+
+    expect(createSignedUploadUrl).toHaveBeenCalledWith(
+      `documents/${company}/${user}/pending/${uploadId}_Leverant_r_faktura.pdf`,
+      { upsert: false },
+    )
+    expect(reservation).toEqual({
+      uploadId,
+      signedUrl: 'https://storage.example/upload?token=signed',
+      expiresAt: new Date(now + SIGNED_DOCUMENT_UPLOAD_TTL_MS).toISOString(),
+    })
+  })
+
+  it('adopts uploaded bytes under the reserved UUID and permanent WORM path', async () => {
+    const buffer = pdfBuffer('presigned upload')
+    const document = makeDocumentAttachment({
+      id: uploadId,
+      user_id: user,
+      company_id: company,
+      file_name: 'invoice.pdf',
+      mime_type: 'application/pdf',
+      storage_path: buildReservedDocumentStoragePath(company, user, uploadId, 'invoice.pdf'),
+      sha256_hash: await computeSHA256(buffer),
+    })
+    results = [
+      { data: null, error: null },
+      { data: document, error: null },
+    ]
+
+    const move = vi.fn().mockResolvedValue({ data: {}, error: null })
+    const download = vi.fn().mockResolvedValue({ data: new Blob([buffer]), error: null })
+    serviceClientOverride = makeClient({ download, move })
+
+    const completed = await completePendingDocumentUpload(
+      makeClient() as never,
+      company,
+      user,
+      uploadId,
+      'invoice.pdf',
+      'application/pdf',
+    )
+
+    expect(completed.document.id).toBe(uploadId)
+    expect(move).toHaveBeenCalledWith(
+      buildPendingDocumentStoragePath(company, user, uploadId, 'invoice.pdf'),
+      buildReservedDocumentStoragePath(company, user, uploadId, 'invoice.pdf'),
+    )
+  })
+
+  it('returns the existing immutable document on retry after verifying its hash', async () => {
+    const buffer = pdfBuffer('already complete')
+    const document = makeDocumentAttachment({
+      id: uploadId,
+      user_id: user,
+      company_id: company,
+      file_name: 'invoice.pdf',
+      mime_type: 'application/pdf',
+      storage_path: buildReservedDocumentStoragePath(company, user, uploadId, 'invoice.pdf'),
+      sha256_hash: await computeSHA256(buffer),
+    })
+    results = [{ data: document, error: null }]
+
+    const move = vi.fn().mockResolvedValue({ data: {}, error: null })
+    serviceClientOverride = makeClient({
+      download: vi.fn().mockResolvedValue({ data: new Blob([buffer]), error: null }),
+      move,
+    })
+
+    const completed = await completePendingDocumentUpload(
+      makeClient() as never,
+      company,
+      user,
+      uploadId,
+      'invoice.pdf',
+      'application/pdf',
+    )
+
+    expect(completed.document).toEqual(document)
+    expect(move).not.toHaveBeenCalled()
+  })
+
+  it('removes corrupt pending bytes before rejecting completion', async () => {
+    results = [{ data: null, error: null }]
+    const pendingPath = buildPendingDocumentStoragePath(company, user, uploadId, 'invoice.pdf')
+    const remove = vi.fn().mockResolvedValue({ data: [], error: null })
+    serviceClientOverride = makeClient({
+      download: vi.fn().mockResolvedValue({ data: new Blob(['not a pdf']), error: null }),
+      remove,
+    })
+
+    await expect(
+      completePendingDocumentUpload(
+        makeClient() as never,
+        company,
+        user,
+        uploadId,
+        'invoice.pdf',
+        'application/pdf',
+      ),
+    ).rejects.toThrow(/kunde inte verifieras/)
+    expect(remove).toHaveBeenCalledWith([pendingPath])
+  })
+
+  it('cleans only expired pending objects in a bounded company and user prefix', async () => {
+    const now = Date.parse('2026-08-03T10:00:00.000Z')
+    const remove = vi.fn().mockResolvedValue({ data: [], error: null })
+    const list = vi.fn().mockResolvedValue({
+      data: [
+        {
+          id: 'old-object',
+          name: `${uploadId}_old.pdf`,
+          created_at: new Date(now - PENDING_DOCUMENT_UPLOAD_RETENTION_MS - 1).toISOString(),
+        },
+        {
+          id: 'new-object',
+          name: `${uploadId}_new.pdf`,
+          created_at: new Date(now - 60_000).toISOString(),
+        },
+      ],
+      error: null,
+    })
+    serviceClientOverride = makeClient({ list, remove })
+
+    const removed = await cleanupExpiredPendingDocumentUploads(company, user, now)
+
+    expect(list).toHaveBeenCalledWith(`documents/${company}/${user}/pending`, {
+      limit: 100,
+      offset: 0,
+      sortBy: { column: 'created_at', order: 'asc' },
+    })
+    expect(remove).toHaveBeenCalledWith([
+      `documents/${company}/${user}/pending/${uploadId}_old.pdf`,
+    ])
+    expect(removed).toBe(1)
+  })
+})
+
 describe('createNewVersion', () => {
  it('increments version and supersedes previous', async () => {
    const current = makeDocumentAttachment({
@@ -426,6 +597,16 @@ describe('storage key layout helpers', () => {
    )
  })

+  it('builds deterministic pending and permanent keys for a reserved upload', () => {
+    const uploadId = '33333333-3333-4333-8333-333333333333'
+    expect(buildPendingDocumentStoragePath(company, user, uploadId, 'faktura 1.pdf')).toBe(
+      `documents/${company}/${user}/pending/${uploadId}_faktura_1.pdf`,
+    )
+    expect(buildReservedDocumentStoragePath(company, user, uploadId, 'faktura 1.pdf')).toBe(
+      `documents/${company}/${user}/${uploadId}_faktura_1.pdf`,
+    )
+  })
+
  it('recognises company-scoped keys', () => {
    expect(isCompanyScopedDocumentPath(`documents/${company}/${user}/1_a.pdf`, company)).toBe(true)
    expect(isCompanyScopedDocumentPath(`documents/${user}/1_a.pdf`, company)).toBe(false)