@lowdefy/server-dev 6.0.0 → 7.0.0

package/lib/server/applyDataSetRedirect.test.mjs

@@ -0,0 +1,340 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { jest } from '@jest/globals';
+import { callRequest } from '@lowdefy/api';
+import { ConfigError } from '@lowdefy/errors';
+
+import applyDataSetRedirect from './applyDataSetRedirect.js';
+
+const connections = {
+  MongoDBCollection: { meta: { tenant: true, dataSet: 'redirect' } },
+  FolderRuntime: { meta: { dataSet: 'redirect' } },
+  AxiosHttp: { meta: { dataSet: 'external' } },
+  Knex: {},
+  Redis: { meta: {} },
+  PluginStore: { meta: { dataSet: 'mongo' } },
+};
+
+const artifacts = {
+  'connections/tickets.json': {
+    id: 'connection:tickets',
+    connectionId: 'tickets',
+    '~k': 'k_tickets',
+    type: 'MongoDBCollection',
+    properties: { databaseUri: { _secret: 'MONGODB_URI' }, collection: 'tickets', write: true },
+  },
+  'connections/no_uri.json': {
+    id: 'connection:no_uri',
+    connectionId: 'no_uri',
+    type: 'MongoDBCollection',
+    properties: { collection: 'tickets' },
+  },
+  'connections/nested.json': {
+    id: 'connection:nested',
+    connectionId: 'nested',
+    type: 'MongoDBCollection',
+    properties: {
+      databaseUri: { _secret: 'MONGODB_URI' },
+      collection: { _if: { test: true, then: 'a', else: 'b' } },
+      options: { appName: { '_string.concat': ['x', 'y'] } },
+    },
+  },
+  'connections/whole.json': {
+    id: 'connection:whole',
+    connectionId: 'whole',
+    '~k': 'k_whole',
+    type: 'MongoDBCollection',
+    properties: {
+      _if: { test: true, then: { databaseUri: 'mongodb://real/' }, else: {} },
+    },
+  },
+  'connections/whole_ref.json': {
+    id: 'connection:whole_ref',
+    connectionId: 'whole_ref',
+    type: 'MongoDBCollection',
+    properties: { _ref: 'connection.yaml' },
+  },
+  'connections/array.json': {
+    id: 'connection:array',
+    connectionId: 'array',
+    type: 'MongoDBCollection',
+    properties: [],
+  },
+  'connections/folders.json': {
+    id: 'connection:folders',
+    connectionId: 'folders',
+    type: 'FolderRuntime',
+    properties: { databaseUri: { _secret: 'MONGODB_URI' }, databaseName: 'app' },
+  },
+  'connections/contacts/contacts.json': {
+    id: 'connection:contacts/contacts',
+    connectionId: 'contacts/contacts',
+    type: 'MongoDBCollection',
+    properties: { databaseUri: { _secret: 'MONGODB_URI' }, collection: 'contacts' },
+  },
+  'connections/api.json': {
+    id: 'connection:api',
+    connectionId: 'api',
+    type: 'AxiosHttp',
+    properties: { baseURL: 'https://example.com' },
+  },
+  'connections/sql.json': {
+    id: 'connection:sql',
+    connectionId: 'sql',
+    '~k': 'k_sql',
+    type: 'Knex',
+    properties: { client: 'pg', connection: { _secret: 'PG_URI' } },
+  },
+  'connections/cache.json': {
+    id: 'connection:cache',
+    connectionId: 'cache',
+    type: 'Redis',
+    properties: { connection: { _secret: 'REDIS_URI' } },
+  },
+  'connections/store.json': {
+    id: 'connection:store',
+    connectionId: 'store',
+    type: 'PluginStore',
+    properties: { databaseUri: 'mongodb://real/' },
+  },
+  'connections/unknown.json': {
+    id: 'connection:unknown',
+    connectionId: 'unknown',
+    type: 'NotInstalled',
+    properties: { databaseUri: 'mongodb://real/' },
+  },
+  'pages/home.json': { id: 'page:home', properties: { databaseUri: 'not a connection' } },
+};
+
+function createContext() {
+  return { readConfigFile: async (filePath) => artifacts[filePath] ?? null };
+}
+
+const session = {
+  id: 'abc',
+  name: 'staging-sample',
+  state: 'open',
+  databaseUri: 'mongodb://127.0.0.1:5555/?replicaSet=testset',
+  databaseName: 'ld_000000000001',
+};
+
+function redirectedContext(options = {}) {
+  const context = createContext();
+  applyDataSetRedirect({ context, session: options.session ?? session, connections });
+  return context;
+}
+
+test('applyDataSetRedirect points a MongoDBCollection connection at the session database', async () => {
+  const context = redirectedContext();
+  expect(await context.readConfigFile('connections/tickets.json')).toEqual({
+    id: 'connection:tickets',
+    connectionId: 'tickets',
+    '~k': 'k_tickets',
+    type: 'MongoDBCollection',
+    properties: {
+      databaseUri: session.databaseUri,
+      databaseName: session.databaseName,
+      collection: 'tickets',
+      write: true,
+    },
+  });
+});
+
+test('applyDataSetRedirect points a module connection, written under its module folder, at the session database', async () => {
+  const context = redirectedContext();
+  const artifact = await context.readConfigFile('connections/contacts/contacts.json');
+  expect(artifact.properties).toEqual({
+    databaseUri: session.databaseUri,
+    databaseName: session.databaseName,
+    collection: 'contacts',
+  });
+});
+
+test('applyDataSetRedirect points a plugin type that declares redirect at the session database', async () => {
+  const context = redirectedContext();
+  const artifact = await context.readConfigFile('connections/folders.json');
+  expect(artifact.properties).toEqual({
+    databaseUri: session.databaseUri,
+    databaseName: session.databaseName,
+  });
+});
+
+test('applyDataSetRedirect merges the session database into a redirect connection that names no databaseUri', async () => {
+  const context = redirectedContext();
+  const artifact = await context.readConfigFile('connections/no_uri.json');
+  expect(artifact.properties).toEqual({
+    databaseUri: session.databaseUri,
+    databaseName: session.databaseName,
+    collection: 'tickets',
+  });
+});
+
+test('applyDataSetRedirect gives a connection with a _secret databaseUri and nested operators the session literal URI', async () => {
+  const context = redirectedContext();
+  const artifact = await context.readConfigFile('connections/nested.json');
+  expect(artifact.properties.databaseUri).toEqual(session.databaseUri);
+  expect(artifact.properties.databaseName).toEqual(session.databaseName);
+  expect(artifact.properties.collection).toEqual({ _if: { test: true, then: 'a', else: 'b' } });
+});
+
+test('applyDataSetRedirect refuses a redirect connection whose properties are an operator, naming the connection', async () => {
+  const context = redirectedContext();
+  const error = await context.readConfigFile('connections/whole.json').catch((caught) => caught);
+  expect(error).toBeInstanceOf(ConfigError);
+  expect(error.message).toEqual(
+    'Connection "whole" (type MongoDBCollection) cannot run under data set "staging-sample": its properties are an operator, so the redirect cannot be checked.'
+  );
+  expect(error.configKey).toEqual('k_whole');
+  for (const filePath of ['connections/whole_ref.json', 'connections/array.json']) {
+    await expect(context.readConfigFile(filePath)).rejects.toThrow(
+      'its properties are an operator, so the redirect cannot be checked.'
+    );
+  }
+});
+
+test('applyDataSetRedirect refuses a connection whose type declares no dataSet, even with a literal databaseUri', async () => {
+  const context = redirectedContext();
+  const error = await context.readConfigFile('connections/sql.json').catch((caught) => caught);
+  expect(error).toBeInstanceOf(ConfigError);
+  expect(error.message).toEqual(
+    'Connection "sql" (type Knex) cannot run under data set "staging-sample": its type does not say how to redirect it.'
+  );
+  expect(error.configKey).toEqual('k_sql');
+  await expect(context.readConfigFile('connections/cache.json')).rejects.toThrow(
+    'Connection "cache" (type Redis) cannot run under data set "staging-sample": its type does not say how to redirect it.'
+  );
+  await expect(context.readConfigFile('connections/store.json')).rejects.toThrow(
+    'Connection "store" (type PluginStore) cannot run under data set "staging-sample": its type does not say how to redirect it.'
+  );
+  await expect(context.readConfigFile('connections/unknown.json')).rejects.toThrow(
+    'Connection "unknown" (type NotInstalled) cannot run under data set "staging-sample": its type does not say how to redirect it.'
+  );
+});
+
+test('applyDataSetRedirect leaves an external connection and every other path untouched', async () => {
+  const context = redirectedContext();
+  expect(await context.readConfigFile('connections/api.json')).toBe(
+    artifacts['connections/api.json']
+  );
+  expect(await context.readConfigFile('pages/home.json')).toBe(artifacts['pages/home.json']);
+  expect(await context.readConfigFile('connections/missing.json')).toBeNull();
+});
+
+test('applyDataSetRedirect never mutates the artifact it read', async () => {
+  const context = redirectedContext();
+  await context.readConfigFile('connections/tickets.json');
+  await context.readConfigFile('connections/nested.json');
+  const plain = createContext();
+  expect((await plain.readConfigFile('connections/tickets.json')).properties.databaseUri).toEqual({
+    _secret: 'MONGODB_URI',
+  });
+  expect(artifacts['connections/tickets.json'].properties.databaseName).toBeUndefined();
+  expect(artifacts['connections/nested.json'].properties.databaseUri).toEqual({
+    _secret: 'MONGODB_URI',
+  });
+});
+
+test('applyDataSetRedirect throws on a connection read after the session has closed', async () => {
+  const context = redirectedContext({ session: { ...session, state: 'closed' } });
+  await expect(context.readConfigFile('connections/tickets.json')).rejects.toThrow(
+    'Data session abc has ended.'
+  );
+  await expect(context.readConfigFile('connections/api.json')).rejects.toThrow(
+    'Data session abc has ended.'
+  );
+  expect(await context.readConfigFile('pages/home.json')).toBe(artifacts['pages/home.json']);
+});
+
+describe('a request through callRequest under a data session', () => {
+  const resolver = jest.fn(async () => ({ ok: true }));
+  resolver.schema = {};
+  resolver.meta = { checkRead: false, checkWrite: false };
+
+  function createRequestContext({ connectionType }) {
+    const requestConnections = {
+      [connectionType]: {
+        ...connections[connectionType],
+        schema: {},
+        requests: { RunQuery: resolver },
+      },
+    };
+    const configFiles = {
+      'connections/store.json': {
+        id: 'connection:store',
+        connectionId: 'store',
+        type: connectionType,
+        properties: { databaseUri: 'mongodb://real/', collection: 'rows' },
+      },
+      'pages/home/requests/get_rows.json': {
+        id: 'request:home:get_rows',
+        type: 'RunQuery',
+        requestId: 'get_rows',
+        pageId: 'home',
+        connectionId: 'store',
+        auth: { public: true },
+        properties: {},
+      },
+    };
+    const logger = { debug: () => {}, error: () => {}, info: () => {}, warn: () => {} };
+    const context = {
+      appMeta: {},
+      authorizeOutcome: () => 'allow',
+      config: {},
+      connections: requestConnections,
+      handleError: async (error) => {
+        error.handled = true;
+      },
+      headers: {},
+      logger,
+      mode: 'dev',
+      operators: {},
+      organization: null,
+      readConfigFile: async (filePath) => configFiles[filePath] ?? null,
+      scrubSecrets: (value) => value,
+      secrets: {},
+      steps: {},
+      user: null,
+    };
+    applyDataSetRedirect({ context, session, connections: requestConnections });
+    return context;
+  }
+
+  beforeEach(() => {
+    resolver.mockClear();
+  });
+
+  test('fails and never reaches the resolver when the connection type declares no dataSet', async () => {
+    const context = createRequestContext({ connectionType: 'Knex' });
+    await expect(
+      callRequest(context, { pageId: 'home', requestId: 'get_rows', payload: {} })
+    ).rejects.toThrow(
+      'Connection "store" (type Knex) cannot run under data set "staging-sample": its type does not say how to redirect it.'
+    );
+    expect(resolver).not.toHaveBeenCalled();
+  });
+
+  test('reaches the resolver with the session database when the connection type declares redirect', async () => {
+    const context = createRequestContext({ connectionType: 'FolderRuntime' });
+    await callRequest(context, { pageId: 'home', requestId: 'get_rows', payload: {} });
+    expect(resolver).toHaveBeenCalledTimes(1);
+    expect(resolver.mock.calls[0][0].connection).toEqual({
+      databaseUri: session.databaseUri,
+      databaseName: session.databaseName,
+      collection: 'rows',
+    });
+  });
+});

package/lib/server/applyDataSetRedirectTenantReach.test.mjs

@@ -0,0 +1,204 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import { callRequest } from '@lowdefy/api';
+import createReadConfigFile from '@lowdefy/api/context/createReadConfigFile.js';
+
+import applyDataSetRedirect from './applyDataSetRedirect.js';
+
+// A walled-client plugin under auth.organizations.policy: tenant, served inside a data session and
+// outside one, in both orders. The unwalled-reach verdict is memoised per process and read from the
+// build, so whichever request evaluates it first, the walled-client plugin is served everywhere and
+// a plugin that really holds the walled database's URI is refused everywhere.
+
+const walledUri = 'mongodb://app-host:27017/app';
+
+const session = {
+  id: 'abc',
+  name: 'staging-sample',
+  state: 'open',
+  databaseUri: 'mongodb://127.0.0.1:5555/?replicaSet=testset',
+  databaseName: 'ld_000000000001',
+};
+
+async function WalledRead({ connection, walled }) {
+  const bound = await walled(connection.mongoConnectionId);
+  return {
+    databaseUri: bound.connection.databaseUri,
+    databaseName: bound.connection.databaseName ?? null,
+    tenant: bound.tenant,
+  };
+}
+WalledRead.schema = {};
+WalledRead.meta = { checkRead: true, checkWrite: false };
+
+const connections = {
+  MongoDBCollection: { meta: { tenant: true, dataSet: 'redirect' }, schema: {}, requests: {} },
+  WalledRuntime: {
+    meta: { tenant: false, dataSet: 'walled' },
+    schema: {},
+    requests: { WalledRead },
+  },
+};
+
+const artifacts = {
+  'tenantConnections.json': [{ connectionId: 'fixture_db', type: 'MongoDBCollection' }],
+  'unwalledConnections.json': [
+    { connectionId: 'walled_runtime', type: 'WalledRuntime' },
+    { connectionId: 'raw_runtime', type: 'WalledRuntime' },
+  ],
+  'connections/fixture_db.json': {
+    id: 'connection:fixture_db',
+    connectionId: 'fixture_db',
+    type: 'MongoDBCollection',
+    tenantCapability: true,
+    properties: { databaseUri: walledUri, collection: 'items', read: true },
+  },
+  'connections/walled_runtime.json': {
+    id: 'connection:walled_runtime',
+    connectionId: 'walled_runtime',
+    type: 'WalledRuntime',
+    tenantCapability: false,
+    properties: { mongoConnectionId: 'fixture_db', read: true },
+  },
+  // A plugin that holds the walled database's URI itself while naming a walled connection: the
+  // reach check refuses it, in and out of sessions.
+  'connections/raw_runtime.json': {
+    id: 'connection:raw_runtime',
+    connectionId: 'raw_runtime',
+    type: 'WalledRuntime',
+    '~k': 'k_raw_runtime',
+    tenantCapability: false,
+    properties: { mongoConnectionId: 'fixture_db', uri: walledUri, read: true },
+  },
+  'pages/home/requests/accept_match.json': {
+    id: 'request:home:accept_match',
+    type: 'WalledRead',
+    requestId: 'accept_match',
+    pageId: 'home',
+    connectionId: 'walled_runtime',
+    auth: { public: true },
+    properties: {},
+  },
+  'pages/home/requests/raw_read.json': {
+    id: 'request:home:raw_read',
+    type: 'WalledRead',
+    requestId: 'raw_read',
+    pageId: 'home',
+    connectionId: 'raw_runtime',
+    auth: { public: true },
+    properties: {},
+  },
+};
+
+const rawRefusal =
+  'Connection "raw_runtime" (WalledRuntime) holds a URI to the database of walled connection "fixture_db".';
+
+let buildDirectory;
+
+beforeAll(() => {
+  buildDirectory = fs.mkdtempSync(path.join(os.tmpdir(), 'lowdefy-walled-reach-'));
+  Object.entries(artifacts).forEach(([name, value]) => {
+    const filePath = path.join(buildDirectory, name);
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, JSON.stringify(value));
+  });
+});
+
+afterAll(() => {
+  fs.rmSync(buildDirectory, { recursive: true, force: true });
+});
+
+// The context createLowdefyContext composes: createApiContext's base reader over the build, and
+// for a data-session request the gate over it.
+function createContext({ config, dataSession }) {
+  const logger = { debug: () => {}, error: () => {}, info: () => {}, warn: () => {} };
+  const context = {
+    appMeta: {},
+    authorizeOutcome: () => 'allow',
+    buildDirectory,
+    config,
+    connections,
+    fileCache: new Map(),
+    handleError: async (error) => {
+      error.handled = true;
+    },
+    headers: {},
+    logger,
+    mode: 'dev',
+    operators: {},
+    organization: { policy: 'tenant' },
+    scrubSecrets: (value) => value,
+    secrets: {},
+    steps: {},
+    user: { id: 'u_member', organization_id: 'org_a' },
+  };
+  context.readConfigFile = createReadConfigFile(context);
+  if (dataSession) {
+    applyDataSetRedirect({ context, session, connections });
+  }
+  return context;
+}
+
+async function acceptMatch(context) {
+  const result = await callRequest(context, {
+    pageId: 'home',
+    requestId: 'accept_match',
+    payload: {},
+  });
+  return result.response;
+}
+
+const servedInSession = {
+  databaseUri: session.databaseUri,
+  databaseName: session.databaseName,
+  tenant: { field: 'organization_id', value: 'org_a' },
+};
+const servedOutside = {
+  databaseUri: walledUri,
+  databaseName: null,
+  tenant: { field: 'organization_id', value: 'org_a' },
+};
+
+test('a walled-client plugin is served in a data session first and outside one afterwards', async () => {
+  const config = {};
+  expect(await acceptMatch(createContext({ config, dataSession: true }))).toEqual(servedInSession);
+  expect(await acceptMatch(createContext({ config, dataSession: false }))).toEqual(servedOutside);
+  await expect(
+    callRequest(createContext({ config, dataSession: false }), {
+      pageId: 'home',
+      requestId: 'raw_read',
+      payload: {},
+    })
+  ).rejects.toThrow(rawRefusal);
+});
+
+test('a walled-client plugin is served outside a data session first and in one afterwards', async () => {
+  const config = {};
+  expect(await acceptMatch(createContext({ config, dataSession: false }))).toEqual(servedOutside);
+  expect(await acceptMatch(createContext({ config, dataSession: true }))).toEqual(servedInSession);
+  await expect(
+    callRequest(createContext({ config, dataSession: true }), {
+      pageId: 'home',
+      requestId: 'raw_read',
+      payload: {},
+    })
+  ).rejects.toThrow(rawRefusal);
+});

package/lib/server/applyDataSetRedirectWalled.test.mjs

@@ -0,0 +1,131 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import createEvaluateOperators from '@lowdefy/api/context/createEvaluateOperators.js';
+import createWalledResolver from '@lowdefy/api/routes/request/createWalledResolver.js';
+import { ConfigError } from '@lowdefy/errors';
+import { operatorsServer } from '@lowdefy/operators-js';
+
+import applyDataSetRedirect from './applyDataSetRedirect.js';
+
+const connections = {
+  MongoDBCollection: { meta: { tenant: true, dataSet: 'redirect' }, requests: {} },
+  WalledRuntime: { meta: { tenant: false, dataSet: 'walled' }, requests: {} },
+};
+
+const artifacts = {
+  'connections/runtime.json': {
+    id: 'connection:runtime',
+    connectionId: 'runtime',
+    type: 'WalledRuntime',
+    properties: { mongoConnectionIds: ['matches'], apiKey: { _secret: 'RUNTIME_KEY' } },
+  },
+  'connections/runtime_operator.json': {
+    id: 'connection:runtime_operator',
+    connectionId: 'runtime_operator',
+    type: 'WalledRuntime',
+    properties: { _if: { test: true, then: { mongoConnectionIds: ['matches'] }, else: {} } },
+  },
+  'connections/matches.json': {
+    id: 'connection:matches',
+    connectionId: 'matches',
+    '~k': 'k_matches',
+    type: 'MongoDBCollection',
+    properties: { databaseUri: { _secret: 'MONGODB_URI' }, collection: 'matches', write: true },
+  },
+  'connections/matches_operator.json': {
+    id: 'connection:matches_operator',
+    connectionId: 'matches_operator',
+    '~k': 'k_matches_operator',
+    type: 'MongoDBCollection',
+    properties: {
+      _if: { test: true, then: { databaseUri: 'mongodb://real/', collection: 'matches' } },
+    },
+  },
+};
+
+const session = {
+  id: 'abc',
+  name: 'staging-sample',
+  state: 'open',
+  databaseUri: 'mongodb://127.0.0.1:5555/?replicaSet=testset',
+  databaseName: 'ld_000000000001',
+};
+
+function createContext({ sessionState = 'open' } = {}) {
+  const context = {
+    appMeta: {},
+    config: {},
+    connections,
+    logger: { debug: () => {}, error: () => {}, info: () => {}, warn: () => {} },
+    operators: { ...operatorsServer },
+    organization: null,
+    payload: {},
+    readConfigFile: async (filePath) => artifacts[filePath] ?? null,
+    secrets: { MONGODB_URI: 'mongodb://real-host/app', RUNTIME_KEY: 'key' },
+    user: null,
+  };
+  context.evaluateOperators = createEvaluateOperators(context);
+  applyDataSetRedirect({
+    context,
+    session: { ...session, state: sessionState },
+    connections,
+  });
+  return context;
+}
+
+const requestConfig = { '~k': 'r.0', requestId: 'accept_match', connectionId: 'runtime' };
+
+test('applyDataSetRedirect passes a connection whose type declares walled through with its properties untouched', async () => {
+  const context = createContext();
+  expect(await context.readConfigFile('connections/runtime.json')).toEqual(
+    artifacts['connections/runtime.json']
+  );
+  expect(await context.readConfigFile('connections/runtime_operator.json')).toEqual(
+    artifacts['connections/runtime_operator.json']
+  );
+});
+
+test('applyDataSetRedirect throws on a walled connection read after the session has closed', async () => {
+  const context = createContext({ sessionState: 'closed' });
+  await expect(context.readConfigFile('connections/runtime.json')).rejects.toThrow(
+    'Data session abc has ended.'
+  );
+});
+
+test('the walled resolver under a data session gives the named MongoDBCollection the session database', async () => {
+  const context = createContext();
+  const walled = createWalledResolver(context, { requestConfig });
+  const bound = await walled('matches');
+  expect(bound.connection).toEqual({
+    databaseUri: session.databaseUri,
+    databaseName: session.databaseName,
+    collection: 'matches',
+    write: true,
+  });
+  expect(bound.connectionId).toEqual('matches');
+});
+
+test('the walled resolver under a data session refuses a named MongoDBCollection whose properties are an operator', async () => {
+  const context = createContext();
+  const walled = createWalledResolver(context, { requestConfig });
+  const error = await walled('matches_operator').catch((caught) => caught);
+  expect(error).toBeInstanceOf(ConfigError);
+  expect(error.message).toEqual(
+    'Connection "matches_operator" (type MongoDBCollection) cannot run under data set "staging-sample": its properties are an operator, so the redirect cannot be checked.'
+  );
+  expect(error.configKey).toEqual('k_matches_operator');
+});