probe-scope.ts

scripts/probe-scope.ts

1. #!/usr/bin/env tsx
2. /**
3. * Scope probe. Read-only.
4. *
5. * The question: POST /todos/query returns only the token holder's to-dos on a
6. * company where several people hold them. Either
7. *
8. * (A) the Personal Access Token is hard-scoped to its owner, in which case
9. * the query needs a different credential, or
10. * (B) the endpoint merely defaults to the current user and some parameter
11. * widens it.
12. *
13. * This script fires a matrix of request bodies at the live endpoint and reports,
14. * for each, how many rows came back and how many distinct owners appear. The
15. * moment any variant returns a second owner id, the answer is (B) and the
16. * variant that did it is the fix.
17. *
18. * pnpm probe:scope
19. *
20. * Speculative parameter names are included on purpose. An unknown field is
21. * usually ignored rather than rejected, so the cost of guessing is one request.
22. * (For the company view, GET /todos/company is the answer; see TodosResource.)
23. */
25. import { clientFromEnv } from '@meridian/ninety-client'
26. import { errorMessage } from '@meridian/shared'
28. interface Variant {
29. label: string
30. body: Record<string, unknown>
31. /** What a widened result would prove. */
32. meaning: string
33. }
35. const BASE = {
36. page: 1,
37. pageSize: 100,
38. sort: 'dueDate',
39. order: 'asc',
40. completed: false,
41. archived: false,
42. }
44. async function main(): Promise<void> {
45. const client = clientFromEnv(process.env)
46. const http = client.http
48. // Discover ids to test with: owners and creators seen in a baseline sweep.
49. const baseline = (await http.post('/todos/query', { body: BASE })) as Record<string, unknown>[]
50. const owners = new Set<string>()
51. const creators = new Set<string>()
52. for (const t of baseline) {
53. if (typeof t.userId === 'string') owners.add(t.userId)
54. if (typeof t.createdByUserId === 'string') creators.add(t.createdByUserId)
55. }
56. // Someone who creates work but does not own any of the rows we can see is the
57. // ideal test subject: if a variant surfaces their to-dos, scoping is not hard.
58. const otherUser = [...creators].find((id) => !owners.has(id))
60. console.log('Scope probe')
61. console.log(`baseline rows: ${baseline.length}`)
62. console.log(`distinct owners in baseline: ${owners.size} -> ${[...owners].join(', ') || 'none'}`)
63. console.log(`creators not seen as owners: ${[...creators].filter((c) => !owners.has(c)).join(', ') || 'none'}`)
64. if (!otherUser) {
65. console.log('\nNo second user id available to test with. Ask a colleague for their Ninety user id')
66. console.log('and re-run with: pnpm probe:scope -- --user <id>')
67. }
68. console.log()
70. const teams = await client.teams.list()
72. const variants: Variant[] = [
73. { label: 'baseline', body: { ...BASE }, meaning: 'control' },
74. { label: 'isPersonal: false', body: { ...BASE, isPersonal: false }, meaning: 'excludes personal to-dos' },
75. { label: 'isPersonal: true', body: { ...BASE, isPersonal: true }, meaning: 'personal only' },
76. { label: 'no completed/archived filters', body: { page: 1, pageSize: 100 }, meaning: 'filters were narrowing it' },
77. ...teams.map((t) => ({
78. label: `teamId: ${t.name}`,
79. body: { ...BASE, teamId: t.id },
80. meaning: 'team filter widens beyond the caller',
81. })),
82. // Speculative widening flags. Harmless if ignored.
83. { label: 'userId: <other user>', body: { ...BASE, userId: otherUser ?? '' }, meaning: 'userId works server-side -> (B)' },
84. { label: 'userIds: [<other user>]', body: { ...BASE, userIds: otherUser ? [otherUser] : [] }, meaning: 'plural filter exists' },
85. { label: 'includeAllUsers: true', body: { ...BASE, includeAllUsers: true }, meaning: 'an explicit widen flag' },
86. { label: 'allUsers: true', body: { ...BASE, allUsers: true }, meaning: 'an explicit widen flag' },
87. { label: 'showAll: true', body: { ...BASE, showAll: true }, meaning: 'an explicit widen flag' },
88. { label: 'teamView: true', body: { ...BASE, teamView: true }, meaning: 'team view vs my view' },
89. { label: 'personalOnly: false', body: { ...BASE, personalOnly: false }, meaning: 'inverse of a my-view default' },
90. ].filter((v) => !v.label.includes('other user') || otherUser)
92. const results: { label: string; status: string; rows: number; distinctOwners: number; newOwners: string[] }[] = []
94. for (const v of variants) {
95. try {
96. const rows = (await http.post('/todos/query', { body: v.body })) as Record<string, unknown>[]
97. const seen = new Set<string>()
98. for (const t of rows) if (typeof t.userId === 'string') seen.add(t.userId)
99. const newOwners = [...seen].filter((id) => !owners.has(id))
100. results.push({ label: v.label, status: 'ok', rows: rows.length, distinctOwners: seen.size, newOwners })
101. } catch (err) {
102. const msg = err instanceof Error ? err.message.split('\n')[0]! : String(err)
103. results.push({ label: v.label, status: msg.slice(0, 60), rows: 0, distinctOwners: 0, newOwners: [] })
104. }
105. }
107. console.log('VARIANT'.padEnd(34) + 'ROWS'.padStart(6) + 'OWNERS'.padStart(8) + ' NEW OWNER IDS')
108. console.log('-'.repeat(78))
109. for (const r of results) {
110. const flag = r.newOwners.length ? ' <-- WIDENED' : ''
111. console.log(
112. r.label.padEnd(34) +
113. String(r.rows).padStart(6) +
114. String(r.distinctOwners).padStart(8) +
115. ` ${r.newOwners.join(', ')}${flag}` +
116. (r.status !== 'ok' ? ` [${r.status}]` : ''),
117. )
118. }
120. const winner = results.find((r) => r.newOwners.length > 0)
121. console.log('\n' + '='.repeat(78))
122. if (winner) {
123. console.log(`ANSWER: (B). "${winner.label}" returned owners the baseline could not see.`)
124. console.log('The token is not hard-scoped. Add that parameter to toWire() in resources/todos.ts')
125. console.log('and re-run the smoke test; the dashboard is unblocked.')
126. } else {
127. console.log('ANSWER: likely (A). No variant surfaced a second owner.')
128. console.log('')
129. console.log('Before treating this as settled, rule out the boring explanation: confirm in the')
130. console.log('Ninety UI that other people actually have open to-dos right now. A quiet week')
131. console.log('looks identical to a scoping wall from here.')
132. console.log('')
133. console.log('If they do have open to-dos and this probe cannot see them, the PAT is scoped to')
134. console.log('its owner and the dashboard needs either a service account or one token per')
135. console.log('person fanned out at sync time. That is a question for Ninety support, and it is')
136. console.log('the kind of answer that changes the dashboard architecture, so ask before')
137. console.log('building further.')
138. }
139. }
141. main().catch((err) => {
142. console.error('\nProbe failed:', errorMessage(err))
143. process.exit(1)
144. })