test: credential redaction verification and metadata filter fuzz hardening

Author: zho

docs/SECURITY.md

@@ -10,11 +10,18 @@
 `src/logger.ts` implements `redactApiKey` and recursive redaction for structured log data:
 
 - UUID-shaped tokens (`xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`) → `***`
+- Modern Pinecone keys (`pcsk_…`) → `***`
 - Substrings after `apiKey` / `api_key` / similar patterns → masked
 - `Authorization: Bearer …` tokens → masked
 
 Logs go to **stderr**; use `PINECONE_READ_ONLY_MCP_LOG_FORMAT=json` for pipelines and ensure downstream sinks treat stderr as sensitive.
 
+## MCP response redaction
+
+Tool responses returned to MCP clients (and LLM consumers) are sanitized in `src/core/server/tool-response.ts` via `redactSensitiveFields()` before JSON serialization. Only known sensitive keys are masked (`message`, `suggestion`, `degradation_reason`); document metadata UUIDs and other non-sensitive fields are preserved.
+
+This covers tool error payloads, hybrid degradation reasons, and SDK error text surfaced in DEBUG log mode — not only stderr logs.
+
 ## Docker image
 
 The multi-stage [`Dockerfile`](../Dockerfile):

package-lock.json

@@ -86,6 +86,7 @@
     "@vitest/coverage-v8": "^4.0.18",
     "eslint": "^10.0.2",
     "eslint-config-prettier": "^10.1.8",
+    "fast-check": "^4.8.0",
     "prettier": "^3.5.3",
     "tsx": "^4.19.2",
     "typescript": "^6.0.3",

package.json

@@ -3,7 +3,7 @@
  */
 
 import type { Pinecone } from '@pinecone-database/pinecone';
-import { error as logError } from '../../logger.js';
+import { error as logError, redactApiKey } from '../../logger.js';
 import type { MergedHit, SearchResult } from '../../types.js';
 
 export type RerankOutcome = {
@@ -59,7 +59,7 @@ export async function rerankResults(
     return { results: reranked, degraded: false };
   } catch (error) {
     logError('Error reranking results', error);
-    const msg = error instanceof Error ? error.message : String(error);
+    const msg = redactApiKey(error instanceof Error ? error.message : String(error));
     return {
       results: results.slice(0, topN).map((result) => ({
         id: result._id || '',

src/core/pinecone/rerank.ts

@@ -0,0 +1,116 @@
+import * as fc from 'fast-check';
+import { describe, expect, it } from 'vitest';
+import { MAX_FILTER_DEPTH, validateMetadataFilterDetailed } from './metadata-filter.js';
+
+const primitiveArb = fc.oneof(fc.string(), fc.integer(), fc.boolean());
+
+const validLeafArb: fc.Arbitrary<Record<string, unknown>> = fc
+  .record({
+    field: fc
+      .string({ minLength: 1 })
+      .filter((s) => !s.startsWith('$'))
+      .map((name) => name || 'f'),
+    op: fc.constantFrom('$eq', '$ne', '$gt', '$gte', '$lt', '$lte'),
+    value: primitiveArb,
+  })
+  .map(({ field, op, value }) => ({ [field]: { [op]: value } }));
+
+const { filter: validFilterArb } = fc.letrec<{ filter: fc.Arbitrary<Record<string, unknown>> }>(
+  (tie) => ({
+    filter: fc.oneof(
+      validLeafArb,
+      fc.array(tie('filter'), { minLength: 1, maxLength: 3 }).map((items) => ({ $and: items })),
+      fc.array(tie('filter'), { minLength: 1, maxLength: 3 }).map((items) => ({ $or: items }))
+    ),
+  })
+);
+
+function deepAnd(levels: number): Record<string, unknown> {
+  if (levels === 0) return { leaf: { $eq: 1 } };
+  return { $and: [deepAnd(levels - 1)] };
+}
+
+describe('validateMetadataFilterDetailed fuzz', () => {
+  it('never throws on arbitrary JSON-like input', () => {
+    fc.assert(
+      fc.property(fc.jsonValue(), (value) => {
+        if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+          expect(() =>
+            validateMetadataFilterDetailed(value as Record<string, unknown>)
+          ).not.toThrow();
+        }
+      }),
+      { numRuns: 100 }
+    );
+  });
+
+  it('returns structured errors for known malformed filters', () => {
+    const malformed = [
+      { year: { $regex: '^202' } },
+      { tags: { $in: [] } },
+      { tags: { $nin: [] } },
+      { $and: [] },
+      { $or: [] },
+      { tags: { $in: [1, {} as unknown as number] } },
+      { tags: { $and: 'not-array' } },
+      { x: deepAnd(MAX_FILTER_DEPTH + 1) },
+    ];
+
+    for (const filter of malformed) {
+      const result = validateMetadataFilterDetailed(filter);
+      expect(result).not.toBeNull();
+      expect(result!.message.length).toBeGreaterThan(0);
+    }
+  });
+
+  it('accepts valid complex generated filters unchanged', () => {
+    fc.assert(
+      fc.property(validFilterArb, (filter) => {
+        const result = validateMetadataFilterDetailed(filter);
+        expect(result).toBeNull();
+      }),
+      { numRuns: 100 }
+    );
+  });
+
+  it('accepts hand-crafted deeply nested valid filters within depth limit', () => {
+    const valid = {
+      $and: [
+        { status: { $eq: 'published' } },
+        {
+          $or: [
+            { year: { $gte: 2020 } },
+            {
+              tags: {
+                $in: ['cpp', 'contracts'],
+              },
+            },
+          ],
+        },
+      ],
+    };
+    expect(validateMetadataFilterDetailed(valid)).toBeNull();
+    expect(validateMetadataFilterDetailed({ x: deepAnd(MAX_FILTER_DEPTH) })).toBeNull();
+  });
+
+  it('handles special field names without throwing', () => {
+    fc.assert(
+      fc.property(fc.string({ minLength: 0, maxLength: 20 }), primitiveArb, (fieldName, value) => {
+        const filter = { [fieldName]: { $eq: value } };
+        expect(() => validateMetadataFilterDetailed(filter)).not.toThrow();
+      }),
+      { numRuns: 100 }
+    );
+  });
+
+  it('rejects empty $in and accepts large primitive $in arrays', () => {
+    expect(validateMetadataFilterDetailed({ tags: { $in: [] } })!.field).toBe('tags.$in');
+
+    const largeIn = {
+      tags: { $in: Array.from({ length: 1000 }, (_, i) => (i % 3 === 0 ? i : `v${i}`)) },
+    };
+    expect(validateMetadataFilterDetailed(largeIn)).toBeNull();
+
+    expect(validateMetadataFilterDetailed({ tags: { $in: ['only'] } })).toBeNull();
+  });
+});