bug: `notes create` drops readPermission when writePermission is also set

[scode]

NOTE: This is generated by AI.

The following is AI generated. It's a real issue I ran into while using hackmd to solve a problem and I believe it to be correct. However I have basically zero experience with TypeScript so actual code suggestions may be of poor quality but I did basic interrogation of the agent about the solution and whether it's idiomatic in context.

notes create drops readPermission when writePermission is also set

hackmd-cli notes create --readPermission=guest --writePermission=owner
creates a note with owner-only read access. The parser drops
readPermission before the API request. team-notes create has the same bug.

I believe the following diff is the required fix:

diff --git a/src/commands/notes/create.ts b/src/commands/notes/create.ts
--- a/src/commands/notes/create.ts
+++ b/src/commands/notes/create.ts
@@ -46,9 +46,9 @@ export default class CreateCommand extends HackMDCommand {
     editor,
     help: Flags.help({char: 'h'}),
     parentFolderId,
-    readPermission: notePermission,
+    readPermission: notePermission(),
     title: noteTitle,
-    writePermission: notePermission,
+    writePermission: notePermission(),
     ...ux.table.flags(),
   }
 
diff --git a/src/commands/team-notes/create.ts b/src/commands/team-notes/create.ts
--- a/src/commands/team-notes/create.ts
+++ b/src/commands/team-notes/create.ts
@@ -37,10 +37,10 @@ export default class Create extends HackMDCommand {
     editor,
     help: Flags.help({char: 'h'}),
     parentFolderId,
-    readPermission: notePermission,
+    readPermission: notePermission(),
     teamPath,
     title: noteTitle,
-    writePermission: notePermission,
+    writePermission: notePermission(),
     ...ux.table.flags(),
   }
 
diff --git a/src/flags.ts b/src/flags.ts
--- a/src/flags.ts
+++ b/src/flags.ts
@@ -43,7 +43,8 @@ export const folderOrder = Flags.string({
   description: 'folder order JSON, e.g. {"root":["folder-id"]}',
 })
 
-export const notePermission = Flags.string({
+/** Return a distinct definition so one permission flag cannot replace another. */
+export const notePermission = () => Flags.string({
   description: 'set note permission: owner, signed_in, guest',
 })
 
diff --git a/test/note-permission-flags.test.ts b/test/note-permission-flags.test.ts
new file mode 100644
--- /dev/null
+++ b/test/note-permission-flags.test.ts
@@ -0,0 +1,27 @@
+import {Parser} from '@oclif/core'
+import {expect} from 'chai'
+
+import CreateNote from '../src/commands/notes/create'
+import CreateTeamNote from '../src/commands/team-notes/create'
+
+describe('note permission flags', () => {
+  for (const [name, command] of [
+    ['personal notes', CreateNote],
+    ['team notes', CreateTeamNote],
+  ] as const) {
+    it(`preserves different read and write permissions for ${name}`, async () => {
+      const {flags} = await Parser.parse(
+        ['--readPermission=guest', '--writePermission=owner'],
+        {
+          flags: {
+            readPermission: command.flags.readPermission,
+            writePermission: command.flags.writePermission,
+          },
+        },
+      )
+
+      expect(flags.readPermission).to.equal('guest')
+      expect(flags.writePermission).to.equal('owner')
+    })
+  }
+})

Why this happens

notePermission is currently one OptionFlag object. Both readPermission
and writePermission register that same object with Oclif:

readPermission: notePermission,
writePermission: notePermission,

With Oclif 2.8.2, parsing different values through the shared object produces
only the second flag:

{"writePermission":"owner"}

flags.readPermission is therefore undefined. The CLI passes that value to
@hackmd/api, JSON serialization omits it, and HackMD applies its owner-only
default. The API itself is not rejecting guest; sending the same two values
directly through @hackmd/api creates the expected public-read, owner-write
note.

The patch makes notePermission a factory. Each command option receives its
own flag definition, and the same parser input becomes:

{"readPermission":"guest","writePermission":"owner"}

This was tested against the exact v2.5.0 tag at
bea38bd5f5f4bdec51e13a02fa725ece9e02eb18.

Reproduction

The script uses authentication saved by hackmd-cli login. It creates one
disposable note, reads its actual permissions through the API, and deletes the
note in a finally block.

Save this as hackmd-cli-read-permission.mjs:

#!/usr/bin/env node

import { execFileSync } from "node:child_process";
import { readFile } from "node:fs/promises";
import { homedir } from "node:os";
import { join } from "node:path";

const configPath = join(
  process.env.HMD_CLI_CONFIG_DIR || join(homedir(), ".hackmd"),
  "config.json",
);
let config = {};
try {
  config = JSON.parse(await readFile(configPath, "utf8"));
} catch (error) {
  if (error.code !== "ENOENT") throw error;
}

const token = process.env.HMD_API_ACCESS_TOKEN || config.accessToken;
const endpoint =
  process.env.HMD_API_ENDPOINT_URL ||
  config.hackmdAPIEndpointURL ||
  "https://api.hackmd.io/v1";
const cli = process.env.HACKMD_CLI || "hackmd-cli";

if (!token) throw new Error("Run hackmd-cli login before running this repro");

const headers = { Authorization: `Bearer ${token}` };
let noteId;

try {
  const output = execFileSync(
    cli,
    [
      "notes",
      "create",
      "--title=test: readPermission repro",
      "--content=# disposable readPermission repro",
      "--readPermission=guest",
      "--writePermission=owner",
      "--output=json",
    ],
    { encoding: "utf8" },
  );
  const created = JSON.parse(output);
  noteId = (Array.isArray(created) ? created[0] : created).id;

  const response = await fetch(`${endpoint}/notes/${encodeURIComponent(noteId)}`, {
    headers,
  });
  if (!response.ok) {
    throw new Error(`GET /notes/${noteId} failed: ${response.status}`);
  }

  const note = await response.json();
  console.log(`requested readPermission: guest`);
  console.log(`actual readPermission:    ${note.readPermission}`);
  console.log(`requested writePermission: owner`);
  console.log(`actual writePermission:    ${note.writePermission}`);

  if (
    note.readPermission !== "guest" ||
    note.writePermission !== "owner"
  ) {
    throw new Error(
      "BUG REPRODUCED: hackmd-cli created the note with the wrong permissions",
    );
  }
} finally {
  if (noteId) {
    const response = await fetch(
      `${endpoint}/notes/${encodeURIComponent(noteId)}`,
      { method: "DELETE", headers },
    );
    if (!response.ok) {
      console.error(`Cleanup failed for https://hackmd.io/${noteId}`);
    }
  }
}

Before applying the patch

From a checkout of v2.5.0:

pnpm install --frozen-lockfile
pnpm build
hackmd-cli login
HACKMD_CLI="$PWD/bin/run" node /path/to/hackmd-cli-read-permission.mjs

The current release exits nonzero with:

requested readPermission: guest
actual readPermission:    owner
requested writePermission: owner
actual writePermission:    owner
Error: BUG REPRODUCED: hackmd-cli created the note with the wrong permissions

After applying the patch

Save the diff above as /tmp/hackmd-cli-read-permission.patch, then run:

git apply /tmp/hackmd-cli-read-permission.patch
pnpm build
HACKMD_CLI="$PWD/bin/run" node /path/to/hackmd-cli-read-permission.mjs

The patched build exits successfully with:

requested readPermission: guest
actual readPermission:    guest
requested writePermission: owner
actual writePermission:    owner