x
This commit is contained in:
Your Name committed
1 parent
70877882b0
commit
ce2f4cf0c8
93 files changed
+4200
-67
No files matched your search
@@ -0,0 +1,147 @@
|
||||
# Milestone 2 Backend & DB Verification Report
|
||||
|
||||
**Date/Time (UTC)**: 2026-06-29T21:35:00Z
|
||||
**Challenger**: Challenger 1 (v2)
|
||||
**Scope**: Verification of database schema, API routes, and MCP tools changes for `rootImage` on Menu, and `columnImage`/`hoverImage` on Menu Items.
|
||||
|
||||
---
|
||||
|
||||
## 1. Database Schema Verification
|
||||
|
||||
The database schema changes were inspected in `apps/backend/prisma/schema.prisma`.
|
||||
|
||||
- **Menu Model** (`schema.prisma` lines 638-647):
|
||||
```prisma
|
||||
model Menu {
|
||||
id Int @id @default(autoincrement())
|
||||
name String @unique
|
||||
payload Json?
|
||||
rootImage String? // Verified optional string
|
||||
isActive Boolean @default(true)
|
||||
items MenuItem[]
|
||||
createdAt DateTime @default(now())
|
||||
updatedAt DateTime @updatedAt
|
||||
}
|
||||
```
|
||||
- **MenuItem Model** (`schema.prisma` lines 649-661):
|
||||
```prisma
|
||||
model MenuItem {
|
||||
id Int @id @default(autoincrement())
|
||||
menuId Int
|
||||
menu Menu @relation(fields: [menuId], references: [id], onDelete: Cascade)
|
||||
label String
|
||||
url String
|
||||
order Int @default(0)
|
||||
columnImage String? // Verified optional string
|
||||
hoverImage String? // Verified optional string
|
||||
translations MenuItemTranslation[]
|
||||
createdAt DateTime @default(now())
|
||||
updatedAt DateTime @updatedAt
|
||||
}
|
||||
```
|
||||
|
||||
**Verdict**: **PASS**. The columns are correctly defined in the Prisma schema as optional strings.
|
||||
|
||||
---
|
||||
|
||||
## 2. API Routes Verification
|
||||
|
||||
The API routes in `apps/backend/src/routes/menus.ts` were reviewed:
|
||||
- **POST `/`** endpoint correctly reads `rootImage` for Menu, and `columnImage` / `hoverImage` for each item in the payload and saves them into the DB.
|
||||
- **PUT `/:name`** endpoint correctly updates `rootImage` for Menu, and updates/creates `columnImage` / `hoverImage` for Menu Items.
|
||||
- Both endpoints are typed using Elysia `t.Optional(t.Nullable(t.String()))` which ensures schema validation.
|
||||
|
||||
---
|
||||
|
||||
## 3. Empirical Execution Results
|
||||
|
||||
A verification script `apps/backend/test_menu_api_challenger.ts` was run with command:
|
||||
```bash
|
||||
bun run apps/backend/test_menu_api_challenger.ts
|
||||
```
|
||||
|
||||
### Execution Log Outputs:
|
||||
```
|
||||
=== STEP 1: Login via Auth Route ===
|
||||
Login status: 200
|
||||
Login response: { success: true, token: "...", user: { ... } }
|
||||
|
||||
=== STEP 2: Test POST /menus with login token ===
|
||||
POST /menus with login token status: 200
|
||||
POST /menus response: {
|
||||
id: 8,
|
||||
name: "challenger-test-menu",
|
||||
rootImage: "https://example.com/root.jpg",
|
||||
items: [
|
||||
{
|
||||
id: 17,
|
||||
label: "Item 1",
|
||||
url: "/item1",
|
||||
order: 1,
|
||||
columnImage: "https://example.com/column1.jpg",
|
||||
hoverImage: "https://example.com/hover1.jpg",
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
=== STEP 3: Perform correct Menu creation & retrieval ===
|
||||
Creation status: 200
|
||||
Created menu: challenger-test-1782734640214 with rootImage, columnImage, hoverImage set.
|
||||
GET /menus/:name status: 200
|
||||
Retrieved menu matches:
|
||||
- rootImage correct: true
|
||||
- columnImage correct: true
|
||||
- hoverImage correct: true
|
||||
|
||||
=== STEP 4: Perform PUT update menu ===
|
||||
PUT status: 200
|
||||
Updated menu retrieved matches new rootImage, columnImage, and hoverImage values.
|
||||
|
||||
=== STEP 5: Verify Validation Errors for Incorrect Types ===
|
||||
POST invalid payload status: 422
|
||||
POST invalid payload response (expected validation error):
|
||||
- rootImage should be string or null (Got: 12345) -> Verified block!
|
||||
- items[0].order should be number (Got: "not-a-number") -> Verified block!
|
||||
- items[0].columnImage should be string or null (Got: true) -> Verified block!
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 4. MCP Tools Review & Audit (Adversarial Challenge)
|
||||
|
||||
### Overall Risk Assessment: HIGH
|
||||
|
||||
### Challenges & Findings
|
||||
|
||||
#### 🔴 Critical Challenge 1: Missing Fields in MCP Tool Schema Definitions
|
||||
- **Assumption Challenged**: The MCP server and tools have been successfully updated to expose the database and API improvements to LLM agents.
|
||||
- **Attack Scenario / Issue**:
|
||||
- The schema file `/home/ti/.gemini/antigravity/mcp/homaroma_mcp/upsert_menu.json` defines the parameters for the `upsert_menu` tool. It lists: `dryRun`, `isActive`, `items`, `name`, and `payload`.
|
||||
- **There is no `rootImage` parameter in the schema.**
|
||||
- Under `items` properties, it lists: `id`, `label`, `order`, `translations`, and `url`.
|
||||
- **There are no `columnImage` or `hoverImage` properties in the schema.**
|
||||
- **Blast Radius**: Any AI agent trying to interact with the menus using the `upsert_menu` tool will be unable to set `rootImage` on the menu or `columnImage`/`hoverImage` on the items because the validation schema will reject them or simply drop them. This prevents AI agents from executing content updates for these new visual fields.
|
||||
- **Mitigation**: Update `/home/ti/.gemini/antigravity/mcp/homaroma_mcp/upsert_menu.json` (and the corresponding server code in `apps/mcp-server/menu-tools.ts`) to include `rootImage` at the root level, and `columnImage` and `hoverImage` within the `items` object schema.
|
||||
|
||||
#### 🟡 Medium Challenge 2: Agent Tool Calling Capability Limitation
|
||||
- **Assumption Challenged**: Agents can execute and test MCP tools via standard client integrations.
|
||||
- **Attack Scenario / Issue**:
|
||||
- There is no `call_mcp_tool` tool or eager `mcp_homaroma_mcp_*` tools registered in this agent instance's declarations.
|
||||
- This prevents agents from direct blackbox testing of the MCP tools.
|
||||
- **Mitigation**: Ensure that the framework registers `call_mcp_tool` or exposes eager MCP bindings to challenger/tester agents.
|
||||
|
||||
---
|
||||
|
||||
## 5. Stress Test Results
|
||||
|
||||
- **Insert Valid Image URLs** → Correct storage & retrieval → Pass
|
||||
- **Insert Null Images** → Allowed (nullable field validation) → Pass
|
||||
- **Insert Invalid Types** (Number, Boolean, String order) → Rejected with `422 Unprocessable Entity` → Pass
|
||||
- **Update Existing Menu Fields** → Modifies `rootImage`, `columnImage`, and `hoverImage` successfully → Pass
|
||||
- **Sync via MCP Tool** → Not possible due to schema omissions → **FAIL**
|
||||
|
||||
---
|
||||
|
||||
## 6. Conclusion
|
||||
The changes to the **database schema** (Prisma) and **Elysia.js API routes** are fully correct, verified, and work as expected. They block invalid types and properly store/retrieve image fields.
|
||||
However, there is a **critical schema-level regression/omission in the MCP tools definitions** where `rootImage`, `columnImage`, and `hoverImage` are completely missing from the schemas. This must be corrected so that MCP tools are fully operational for AI agents.
|
||||
Reference in new issue
Block a user