amal66 puts a safety net under Mike's access controls

A new test suite targets the backend rules that decide which projects and documents a user can see.

securityinfrastructure

This is not a new feature for lawyers to click on. It is a reliability move in the parts of Mike where a small regression could expose the wrong matter or hide the right document.

amal66 has added focused checks around:

project and document access decisions, including shared access;
storage locations and identifiers, which keep documents connected to the right records;
users' own AI service keys; and
selecting the right document in a chat.

The work also adds coverage reporting with a modest no-backsliding floor. That does not make the system comprehensively tested overnight, but it means future changes should not quietly reduce protection in these core areas.

So what Legal teams assessing Mike's operational maturity should care because this strengthens the guardrails around matter access before more product changes accumulate.

View this fork on GitHub →

Spotted something wrong? Or know the PR text has fresher detail than the writeup above?

Commits in this thread

2 commits from amal66/mike, oldest first. Source extracted verbatim from the harvested git log.

SHA	Subject	Author	Date
`4039b949`	test: minimal vitest harness for backend and frontend	QA Runner	2026-07-20	↗ GitHub
commit body Ported from amal66/mike#24 onto current main; lockfiles regenerated against this tree. Adds vitest as a dev dependency with a `test` script in both packages, excludes test files from the backend tsc build, and seeds one suite per package (backend: downloadTokens, 12 tests; frontend: cn() utils, 8 tests). Verified locally: backend 12/12, frontend 8/8 passing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
`c139acc3`	test: unit tests for access, storage, userApiKeys, chat doc resolution	QA Runner	2026-07-20	↗ GitHub
commit body Ported from the amal66 fork (see index Open-Legal-Products/mike#205) onto current main, adapted to this repo's backend/ layout (apps/api/src/lib -> backend/src/lib), plus a v8 coverage ratchet. Suites ported (51 new tests, verified locally): - access.test.ts (7): owner/shared/private project access, doc access, review sharing, document-ID filtering. Dropped the fork's "org RBAC" describe block (7 cases) - org_id/org_members multi-tenancy and the role/canManage fields do not exist in this repo's access.ts. - storage.test.ts (25): filename normalization/sanitization, RFC 5987 encoding, Content-Disposition, storage key helpers. Dropped the fork's vi.mock of lib/env - this repo has no env module; storage reads process.env directly and the tested helpers are pure. - userApiKeys.test.ts (10): normalizeApiKeyProvider + hasEnvApiKey. Added a beforeEach env clear so shell-exported API keys can't leak into assertions. - chatTypes.test.ts (9): resolveDoc/resolveDocLabel, which live in lib/chat/types.ts here (the fork's lib/chatTools.ts equivalent). Dropped generateSpotlightNonce cases (2) - no such export here. Suites dropped entirely (subject not present in this repo): - upload.test.ts - tested hasMagicBytes; this repo's lib/upload.ts is only the multer middleware and exports no magic-byte checker. - userSettings.test.ts - tested resolveTabularModel (fork-only keyed- provider fallback); this repo resolves tabular_model via resolveModel with a static default. Coverage ratchet: vitest.config.mts adds v8 coverage over src/lib/** with floors measured against this tree (2.58% stmts, 2.00% branches, 4.61% funcs, 2.58% lines -> floors 2/2/4/2). Full suite: 5 files, 63 tests passing (incl. the pre-existing 12 in downloadTokens.test.ts); npm run test:coverage and npm run build both pass. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Capture this thread into my fork

Download a single Markdown prompt that tells Claude how to port every commit above into your working tree — adapting paths and structure to match your repo. Run it via claude -p < capture-thread-1343.md from inside the repo you want the changes in.

⬇ Download capture-thread-1343.md