fix(search-nlp): key intent cache on privacy posture + provider chain

The NLP intent cache key was derived only from query + map center, so a
cloud-derived intent cached by a consent/cloud request could be served to a
later noCloud / privacyMode:strict request for the same query+center — a
privacy-posture leak. Fold the effective no-cloud flag (noCloud || strict) and
the configured providerChain into the key, partitioning the cache so a
no-cloud request can never read a cloud-eligible entry and a providerChain
change yields a fresh namespace. Removes the manual nlp:intent:* flush caveat.

Author: Medformatik

integrations/search-nlp/__tests__/intent-cache-key.test.ts

@@ -0,0 +1,38 @@
+import { describe, expect, it } from "vitest";
+import { intentCacheKey } from "../index.js";
+
+const Q = "coffee near me";
+const C: [number, number] = [13.3777, 52.5163];
+
+describe("intentCacheKey privacy partitioning", () => {
+  it("is stable for identical inputs", () => {
+    expect(intentCacheKey(Q, C, 2, "local,claude,keyword", false)).toBe(
+      intentCacheKey(Q, C, 2, "local,claude,keyword", false),
+    );
+  });
+
+  it("differs by the no-cloud flag (a strict/noCloud request can't hit a cloud entry)", () => {
+    const cloud = intentCacheKey(Q, C, 2, "local,claude,keyword", false);
+    const noCloud = intentCacheKey(Q, C, 2, "local,claude,keyword", true);
+    expect(cloud).not.toBe(noCloud);
+  });
+
+  it("differs by configured provider chain", () => {
+    const a = intentCacheKey(Q, C, 2, "local,claude,keyword", false);
+    const b = intentCacheKey(Q, C, 2, "local,keyword", false);
+    expect(a).not.toBe(b);
+  });
+
+  it("still varies by query and center", () => {
+    expect(intentCacheKey("tea", C, 2, "local,keyword", true)).not.toBe(
+      intentCacheKey(Q, C, 2, "local,keyword", true),
+    );
+    expect(intentCacheKey(Q, [0, 0], 2, "local,keyword", true)).not.toBe(
+      intentCacheKey(Q, C, 2, "local,keyword", true),
+    );
+  });
+
+  it("emits the nlp:intent: namespace", () => {
+    expect(intentCacheKey(Q, C, 2, "local,keyword", true)).toMatch(/^nlp:intent:[0-9a-f]{32}$/);
+  });
+});

integrations/search-nlp/index.ts

@@ -140,11 +140,18 @@ export function applyNoCloud(providers: NlpProvider[]): NlpProvider[] {
   return [...local, keywordProvider];
 }
 
-function intentCacheKey(query: string, center: [number, number], decimals: number): string {
+export function intentCacheKey(
+  query: string,
+  center: [number, number],
+  decimals: number,
+  chainId: string,
+  noCloud: boolean,
+): string {
   const normalized = query.trim().toLowerCase().replace(/\s+/g, " ");
   const lng = center[0].toFixed(decimals);
   const lat = center[1].toFixed(decimals);
-  return `nlp:intent:${createHash("sha256").update(`${normalized}|${lng},${lat}`).digest("hex").slice(0, 32)}`;
+  const material = `${normalized}|${lng},${lat}|${chainId}|${noCloud ? "nc" : "cl"}`;
+  return `nlp:intent:${createHash("sha256").update(material).digest("hex").slice(0, 32)}`;
 }
 
 /**
@@ -265,8 +272,13 @@ export function setup(ctx: IntegrationContext): void {
     const chain = createChain(active);
     const parseCtx: ParseContext = { mapCenter, mapBbox, lang };
 
+    const noCloudEffective = noCloud || strictPrivacy;
+    const chainId = (
+      (ctx.config.providerChain as string[] | undefined) ?? ["local", "keyword"]
+    ).join(",");
+
     let cached = true;
-    const key = intentCacheKey(query, mapCenter, roundDecimals);
+    const key = intentCacheKey(query, mapCenter, roundDecimals, chainId, noCloudEffective);
 
     try {
       const result = await ctx.cache.withCache(key, intentTtl, async () => {