fix(task-list): require own task fields

Author: garethpaul

packages/task-list/src/backends/markdown-dir.test.ts

@@ -187,6 +187,35 @@ Body`
     expect((task.metadata as { owner?: string }).owner).toBeUndefined();
   });
 
+  it("does not accept inherited task state fields", async () => {
+    const { fs } = createFs({
+      "/repo/tasks/planning/inherited.md": `---
+name: Inherited
+---
+
+Body`
+    });
+
+    Object.defineProperty(Object.prototype, "state", {
+      value: "draft",
+      configurable: true
+    });
+    try {
+      const taskList = await markdownDirBackend({
+        path: "/repo/tasks",
+        defaults: { metadata: {} },
+        create: false,
+        fs
+      });
+
+      await expect(taskList.list("planning").get("inherited")).rejects.toThrow(
+        new MalformedTaskError('Malformed task "/repo/tasks/planning/inherited.md": invalid "state".')
+      );
+    } finally {
+      delete (Object.prototype as Record<string, unknown>).state;
+    }
+  });
+
   it("preserves proto-named metadata through create, update, and fire", async () => {
     const { fs } = createFs();
     const taskList = await openTaskList({

packages/task-list/src/backends/markdown-dir.ts

@@ -233,15 +233,15 @@ function assertValidTaskRecord(
   filePath: string,
   validStates: ReadonlySet<string>
 ): void {
-  if ("$schema" in frontmatter && frontmatter.$schema !== TASK_SCHEMA_ID) {
+  if (hasOwnTaskField(frontmatter, "$schema") && frontmatter.$schema !== TASK_SCHEMA_ID) {
     throw malformedTask(filePath, "$schema");
   }
 
-  if ("kind" in frontmatter && frontmatter.kind !== TASK_KIND) {
+  if (hasOwnTaskField(frontmatter, "kind") && frontmatter.kind !== TASK_KIND) {
     throw malformedTask(filePath, "kind");
   }
 
-  if ("version" in frontmatter) {
+  if (hasOwnTaskField(frontmatter, "version")) {
     if (
       typeof frontmatter.version !== "number" ||
       !Number.isInteger(frontmatter.version) ||
@@ -251,19 +251,31 @@ function assertValidTaskRecord(
     }
   }
 
-  if (typeof frontmatter.name !== "string" || frontmatter.name.length === 0) {
+  if (
+    !hasOwnTaskField(frontmatter, "name") ||
+    typeof frontmatter.name !== "string" ||
+    frontmatter.name.length === 0
+  ) {
     throw malformedTask(filePath, "name");
   }
 
-  if (typeof frontmatter.state !== "string" || !validStates.has(frontmatter.state)) {
+  if (
+    !hasOwnTaskField(frontmatter, "state") ||
+    typeof frontmatter.state !== "string" ||
+    !validStates.has(frontmatter.state)
+  ) {
     throw malformedTask(filePath, "state");
   }
 
-  if ("description" in frontmatter && typeof frontmatter.description !== "string") {
+  if (hasOwnTaskField(frontmatter, "description") && typeof frontmatter.description !== "string") {
     throw malformedTask(filePath, "description");
   }
 }
 
+function hasOwnTaskField(frontmatter: TaskRecord, key: string): boolean {
+  return Object.prototype.hasOwnProperty.call(frontmatter, key);
+}
+
 function reservedFrontmatterKeys(mode: BackendDeps["frontmatterMode"]): ReadonlySet<string> {
   return mode === "passthrough" ? PASSTHROUGH_RESERVED_FRONTMATTER_KEYS : RESERVED_FRONTMATTER_KEYS;
 }

packages/task-list/src/backends/yaml-file.test.ts

@@ -191,6 +191,40 @@ describe("yamlFileBackend", () => {
     await expect(rawFs.readFile("/repo/tasks.yaml", "utf8")).resolves.toContain("__proto__:");
   });
 
+  it("does not accept inherited task state fields", async () => {
+    const { fs } = createFs({
+      "/repo/tasks.yaml": [
+        "$schema: https://poe-platform.github.io/poe-code/schemas/task-list/store.schema.json",
+        "kind: task-store",
+        "version: 1",
+        "lists:",
+        "  planning:",
+        "    inherited:",
+        "      name: Inherited",
+        ""
+      ].join("\n")
+    });
+
+    Object.defineProperty(Object.prototype, "state", {
+      value: "draft",
+      configurable: true
+    });
+    try {
+      const taskList = await yamlFileBackend({
+        path: "/repo/tasks.yaml",
+        defaults: { metadata: {} },
+        create: false,
+        fs
+      });
+
+      await expect(taskList.list("planning").get("inherited")).rejects.toThrow(
+        new MalformedTaskError('Malformed task "planning/inherited": invalid "state".')
+      );
+    } finally {
+      delete (Object.prototype as Record<string, unknown>).state;
+    }
+  });
+
   it("sets an absolute sourcePath when reading tasks", async () => {
     const { fs } = createFs({
       "/repo/tasks.yaml": [

packages/task-list/src/backends/yaml-file.ts

@@ -276,15 +276,15 @@ function assertValidTaskRecord(
     throw malformedTask(list, id, "task");
   }
 
-  if ("$schema" in taskRecord && taskRecord.$schema !== TASK_SCHEMA_ID) {
+  if (hasOwnTaskField(taskRecord, "$schema") && taskRecord.$schema !== TASK_SCHEMA_ID) {
     throw malformedTask(list, id, "$schema");
   }
 
-  if ("kind" in taskRecord && taskRecord.kind !== TASK_KIND) {
+  if (hasOwnTaskField(taskRecord, "kind") && taskRecord.kind !== TASK_KIND) {
     throw malformedTask(list, id, "kind");
   }
 
-  if ("version" in taskRecord) {
+  if (hasOwnTaskField(taskRecord, "version")) {
     if (
       typeof taskRecord.version !== "number" ||
       !Number.isInteger(taskRecord.version) ||
@@ -294,19 +294,31 @@ function assertValidTaskRecord(
     }
   }
 
-  if (typeof taskRecord.name !== "string" || taskRecord.name.length === 0) {
+  if (
+    !hasOwnTaskField(taskRecord, "name") ||
+    typeof taskRecord.name !== "string" ||
+    taskRecord.name.length === 0
+  ) {
     throw malformedTask(list, id, "name");
   }
 
-  if (typeof taskRecord.state !== "string" || !validStates.has(taskRecord.state)) {
+  if (
+    !hasOwnTaskField(taskRecord, "state") ||
+    typeof taskRecord.state !== "string" ||
+    !validStates.has(taskRecord.state)
+  ) {
     throw malformedTask(list, id, "state");
   }
 
-  if ("description" in taskRecord && typeof taskRecord.description !== "string") {
+  if (hasOwnTaskField(taskRecord, "description") && typeof taskRecord.description !== "string") {
     throw malformedTask(list, id, "description");
   }
 }
 
+function hasOwnTaskField(taskRecord: TaskRecord, key: string): boolean {
+  return Object.prototype.hasOwnProperty.call(taskRecord, key);
+}
+
 function validateStoreEntries(
   store: StoreRecord,
   filePath: string,