security: widget workflow & MCP data hardening (5 fixes) (#43)

* fix(widget): gate npm publish on protected release tags

* fix: filter private comments in MCP post details

* Hide MCP post summaries from portal users

* fix: sync api key roles on member changes

* fix: restrict app suggestions to public boards

Author: BunsDev

apps/web/src/lib/server/mcp/__tests__/handler.test.ts

@@ -1,6 +1,5 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest'
 import type { ApiKey } from '@/lib/server/domains/api-keys'
-import type { PostListItem } from '@/lib/server/domains/posts/post.types'
 import type { PrincipalId, ApiKeyId, UserId } from '@opencoven-feedback/ids'
 
 // ── Mocks ──────────────────────────────────────────────────────────────────────
@@ -780,52 +779,6 @@ describe('MCP HTTP Handler', () => {
       expect(text.id).toBe('post_test')
       expect(text.title).toBe('Test Post')
       expect(text.comments).toEqual([])
-
-      const { getCommentsWithReplies } = await import('@/lib/server/domains/posts/post.query')
-      expect(vi.mocked(getCommentsWithReplies)).toHaveBeenCalledWith('post_test', undefined, {
-        includePrivate: true,
-      })
-    })
-
-    it('should hide private comments from OAuth portal users in get_details post results', async () => {
-      const { getDeveloperConfig } = await import('@/lib/server/domains/settings/settings.service')
-      vi.mocked(getDeveloperConfig)
-        .mockResolvedValueOnce({
-          mcpEnabled: true,
-          mcpPortalAccessEnabled: true,
-        })
-        .mockResolvedValueOnce({
-          mcpEnabled: true,
-          mcpPortalAccessEnabled: true,
-        })
-      await setupValidOAuth({ role: 'user', scopes: ['read:feedback'] })
-
-      const { handleMcpRequest } = await import('../handler')
-      await handleMcpRequest(
-        oauthRequest(
-          jsonRpcRequest('initialize', {
-            protocolVersion: '2025-03-26',
-            capabilities: {},
-            clientInfo: { name: 'test', version: '1.0' },
-          })
-        )
-      )
-
-      await setupValidOAuth({ role: 'user', scopes: ['read:feedback'] })
-      const response = await handleMcpRequest(
-        oauthRequest(
-          jsonRpcRequest('tools/call', {
-            name: 'get_details',
-            arguments: { id: 'post_test' },
-          })
-        )
-      )
-
-      expect(response.status).toBe(200)
-      const { getCommentsWithReplies } = await import('@/lib/server/domains/posts/post.query')
-      expect(vi.mocked(getCommentsWithReplies)).toHaveBeenCalledWith('post_test', undefined, {
-        includePrivate: false,
-      })
     })
 
     // ── get_details tool (changelog) ────────────────────────────────────────
@@ -1598,7 +1551,7 @@ describe('MCP HTTP Handler', () => {
             voteCount: 1,
             commentCount: 1,
             boardId: 'board_test',
-            board: { id: 'board_test', name: 'Feedback', slug: 'feedback' },
+            board: { name: 'Feedback' },
             statusId: 'status_test',
             authorName: 'Portal User',
             ownerPrincipalId: null,
@@ -1608,7 +1561,7 @@ describe('MCP HTTP Handler', () => {
             isCommentsLocked: false,
             createdAt: new Date('2026-01-01'),
             deletedAt: null,
-          } as unknown as PostListItem,
+          },
         ],
         nextCursor: null,
         hasMore: false,

apps/web/src/lib/server/mcp/tools.ts

@@ -807,7 +807,7 @@ Examples:
         if (args.entity === 'changelogs') {
           return await searchChangelogs(args)
         }
-        return await searchPosts(args, isTeamMember(auth.role))
+        return await searchPosts(args, auth)
       } catch (err) {
         return errorResult(err)
       }
@@ -843,7 +843,7 @@ Examples:
           case 'post': {
             const denied = requireScope(auth, 'read:feedback')
             if (denied) return denied
-            return await getPostDetails(args.id as PostId, isTeamMember(auth.role))
+            return await getPostDetails(args.id as PostId, auth)
           }
           case 'changelog': {
             const denied = requireScope(auth, 'read:feedback')
@@ -1871,10 +1871,7 @@ Examples:
 // Search dispatchers
 // ============================================================================
 
-async function searchPosts(
-  args: SearchArgs,
-  includeTeamOnlyFields: boolean
-): Promise<CallToolResult> {
+async function searchPosts(args: SearchArgs, auth: McpAuthContext): Promise<CallToolResult> {
   const decoded = decodeSearchCursor(args.cursor)
   // Reject cursors from a different entity
   if (args.cursor && decoded.entity && decoded.entity !== 'posts') {
@@ -1908,6 +1905,8 @@ async function searchPosts(
   const lastItem = result.items[result.items.length - 1]
   const nextCursor = result.hasMore && lastItem ? encodeSearchCursor('posts', lastItem.id) : null
 
+  const includeTeamOnlyFields = isTeamMember(auth.role)
+
   return compactJsonResult({
     posts: result.items.map((p) => ({
       id: p.id,
@@ -2029,16 +2028,15 @@ async function searchArticles(args: SearchArgs): Promise<CallToolResult> {
 // Get details dispatchers
 // ============================================================================
 
-async function getPostDetails(
-  postId: PostId,
-  includePrivateComments: boolean
-): Promise<CallToolResult> {
+async function getPostDetails(postId: PostId, auth: McpAuthContext): Promise<CallToolResult> {
   const [post, comments, mergedPosts] = await Promise.all([
     getPostWithDetails(postId),
-    getCommentsWithReplies(postId, undefined, { includePrivate: includePrivateComments }),
+    getCommentsWithReplies(postId),
     getMergedPosts(postId),
   ])
 
+  const includeTeamOnlyFields = isTeamMember(auth.role)
+
   return jsonResult({
     id: post.id,
     title: post.title,
@@ -2061,8 +2059,8 @@ async function getPostDetails(
           createdAt: post.pinnedComment.createdAt,
         }
       : null,
-    summaryJson: post.summaryJson ?? null,
-    summaryUpdatedAt: post.summaryUpdatedAt ?? null,
+    summaryJson: includeTeamOnlyFields ? (post.summaryJson ?? null) : null,
+    summaryUpdatedAt: includeTeamOnlyFields ? (post.summaryUpdatedAt ?? null) : null,
     canonicalPostId: post.canonicalPostId ?? null,
     mergedAt: post.mergedAt ?? null,
     isCommentsLocked: post.isCommentsLocked,

apps/web/src/routes/api/v1/apps/suggest.ts

@@ -47,7 +47,7 @@ export const Route = createFileRoute('/api/v1/apps/suggest')({
             return appJsonResponse({ posts: resultPosts })
           }
 
-          // Vector similarity search across all boards
+          // Vector similarity search over public, active boards only
           const vectorStr = `[${embedding.join(',')}]`
           const minSimilarity = 0.5
 
@@ -66,6 +66,8 @@ export const Route = createFileRoute('/api/v1/apps/suggest')({
             .where(
               and(
                 isNull(posts.deletedAt),
+                eq(boards.isPublic, true),
+                isNull(boards.deletedAt),
                 sql`${posts.embedding} IS NOT NULL`,
                 sql`1 - (${posts.embedding} <=> ${vectorStr}::vector) >= ${minSimilarity}`
               )