feat(copilot): comprehensive copilot improvements

[thesocialdev]

Summary

• Layout & UI polish: improved copilot chat panel layout, CSS fixes, responsive design
• Session persistence: MongoDB-backed copilot sessions with message history and editor report survival across page refreshes
• Richer claim context: personality names, content model, and topics passed to LLM agent
• Source handling: Agencia sources (both web search objects and gazette plain-string formats) are persisted as Source documents and appended as a "Fontes" reference list in the report editor
• Execution store integration: session_id sent to Agencia, execution_id parsed from NDJSON stream and stored in session, query endpoints for executions
• Code scanning fixes: SSRF validation on Agencia URLs, input sanitization on session queries

Test plan

• Verify copilot chat opens with correct layout and no CSS artifacts
• Verify sessions persist across page refreshes (messages + editor report)
• Verify Agencia web search sources appear as references in the report form
• Verify Agencia gazette search sources (plain strings) are parsed and appear in the report form
• Verify execution_id is stored and queryable via GET endpoints
• Run yarn build-ts — passes
• Run editor-parse unit tests — 26/26 pass

🤖 Generated with Claude Code

General approach: Ensure that user-controlled values used in MongoDB queries are validated and/or explicitly treated as literal identifiers, not arbitrary query objects. For IDs, we can (a) validate that the value is a string representing a valid ObjectId and cast it with Mongoose’s Types.ObjectId, or (b) at least enforce that it is a primitive string and reject any non-string/object-like values. This prevents NoSQL-style operator injection and also avoids unexpected behavior if malformed IDs are supplied.

Best fix here: strengthen getSessionById (the sink CodeQL flags) and also the other methods that take sessionId and use it in findByIdAndUpdate. We can:

• Import Types from mongoose.
• Add a small helper method private isValidObjectId(id: any): boolean that uses Types.ObjectId.isValid.
• In getSessionById, addMessage, and deactivateSession, check that sessionId is a string and a valid ObjectId before hitting the database. If invalid, log a warning and either return null (for getSessionById) or throw an error / return null for the update methods.
• For the actual query, pass the validated string (or cast ObjectId) into findById/findByIdAndUpdate, which is safe once we’ve ensured it’s a primitive in the right format.

This approach keeps the external API the same (still takes a string ID), keeps behavior for valid IDs unchanged, and adds clear, minimal validation to stop tainted, malformed, or object-like input from becoming a query object.

Concretely, in server/copilot/copilot-session.service.ts:

• Update the import from mongoose to import { Model, Types } from "mongoose";.

• Add a private helper isValidObjectId to the CopilotSessionService class.

• Update getSessionById, addMessage, and deactivateSession to:

  • Check typeof sessionId === "string" and this.isValidObjectId(sessionId).
  • Log a warning and return null (or throw) if invalid.
  • Optionally cast: const objectId = new Types.ObjectId(sessionId); and use that in findById / findByIdAndUpdate.

No other files need code changes for this fix.

---

In general, to fix this kind of issue with MongoDB/Mongoose, ensure that any user-controlled input used in a query is either: (1) strictly validated/typed before use (e.g., must be a string matching an ObjectId pattern), or (2) passed through a safe comparison operator like $eq when used inside a query object so that it cannot be interpreted as a query object itself.

For this codebase, the narrowest fix without changing behavior is to validate sessionId in addMessage and deactivateSession similarly to how getActiveSession validates claimReviewDataHash. Specifically:

• Check that sessionId is a string.
• Optionally, log a warning and return null if it is not valid.
• Use this.copilotSessionModel.findOneAndUpdate({ _id: { $eq: sessionId } }, ...) instead of findByIdAndUpdate(sessionId, ...). This ensures that even if an attacker managed to send a non-literal value, MongoDB will treat it as a literal via $eq, closing off NoSQL injection vectors.

Concretely:

• In server/copilot/copilot-session.service.ts, modify addMessage to:
  • Validate sessionId’s type.
  • Use findOneAndUpdate with a query { _id: { $eq: sessionId } }.
• Similarly modify deactivateSession to:
  • Validate sessionId’s type.
  • Use findOneAndUpdate with $eq.
    No new imports are required; we just reuse the existing Logger and copilotSessionModel. The rest of the application code calling addMessage/deactivateSession does not need to change, since the methods’ signatures and return types remain the same.

---