@memberjunction/server 5.0.0 → 5.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@memberjunction/server",
-  "version": "5.0.0",
+  "version": "5.2.0",
   "description": "MemberJunction: This project provides API access via GraphQL to the common data store.",
   "main": "./dist/index.js",
   "types": "./src/index.ts",
@@ -26,57 +26,57 @@
     "@apollo/server": "^4.9.1",
     "@graphql-tools/schema": "latest",
     "@graphql-tools/utils": "^11.0.0",
-    "@memberjunction/actions": "5.0.0",
-    "@memberjunction/actions-base": "5.0.0",
-    "@memberjunction/actions-apollo": "5.0.0",
-    "@memberjunction/actions-bizapps-accounting": "5.0.0",
-    "@memberjunction/actions-bizapps-crm": "5.0.0",
-    "@memberjunction/actions-bizapps-formbuilders": "5.0.0",
-    "@memberjunction/actions-bizapps-lms": "5.0.0",
-    "@memberjunction/actions-bizapps-social": "5.0.0",
-    "@memberjunction/ai": "5.0.0",
-    "@memberjunction/ai-mcp-client": "5.0.0",
-    "@memberjunction/ai-agent-manager": "5.0.0",
-    "@memberjunction/ai-agent-manager-actions": "5.0.0",
-    "@memberjunction/ai-agents": "5.0.0",
-    "@memberjunction/ai-core-plus": "5.0.0",
-    "@memberjunction/ai-prompts": "5.0.0",
-    "@memberjunction/ai-provider-bundle": "5.0.0",
-    "@memberjunction/ai-vectors-pinecone": "5.0.0",
-    "@memberjunction/aiengine": "5.0.0",
-    "@memberjunction/communication-ms-graph": "5.0.0",
-    "@memberjunction/communication-sendgrid": "5.0.0",
-    "@memberjunction/communication-types": "5.0.0",
-    "@memberjunction/component-registry-client-sdk": "5.0.0",
-    "@memberjunction/config": "5.0.0",
-    "@memberjunction/core": "5.0.0",
-    "@memberjunction/core-actions": "5.0.0",
-    "@memberjunction/core-entities": "5.0.0",
-    "@memberjunction/core-entities-server": "5.0.0",
-    "@memberjunction/data-context": "5.0.0",
-    "@memberjunction/data-context-server": "5.0.0",
-    "@memberjunction/doc-utils": "5.0.0",
-    "@memberjunction/api-keys": "5.0.0",
-    "@memberjunction/encryption": "5.0.0",
-    "@memberjunction/entity-communications-base": "5.0.0",
-    "@memberjunction/entity-communications-server": "5.0.0",
-    "@memberjunction/external-change-detection": "5.0.0",
-    "@memberjunction/global": "5.0.0",
-    "@memberjunction/graphql-dataprovider": "5.0.0",
-    "@memberjunction/interactive-component-types": "5.0.0",
-    "@memberjunction/notifications": "5.0.0",
-    "@memberjunction/queue": "5.0.0",
-    "@memberjunction/scheduling-actions": "5.0.0",
-    "@memberjunction/scheduling-base-types": "5.0.0",
-    "@memberjunction/scheduling-engine": "5.0.0",
-    "@memberjunction/scheduling-engine-base": "5.0.0",
-    "@memberjunction/skip-types": "5.0.0",
-    "@memberjunction/sqlserver-dataprovider": "5.0.0",
-    "@memberjunction/storage": "5.0.0",
-    "@memberjunction/templates": "5.0.0",
-    "@memberjunction/testing-engine": "5.0.0",
-    "@memberjunction/testing-engine-base": "5.0.0",
-    "@memberjunction/version-history": "5.0.0",
+    "@memberjunction/actions": "5.2.0",
+    "@memberjunction/actions-base": "5.2.0",
+    "@memberjunction/actions-apollo": "5.2.0",
+    "@memberjunction/actions-bizapps-accounting": "5.2.0",
+    "@memberjunction/actions-bizapps-crm": "5.2.0",
+    "@memberjunction/actions-bizapps-formbuilders": "5.2.0",
+    "@memberjunction/actions-bizapps-lms": "5.2.0",
+    "@memberjunction/actions-bizapps-social": "5.2.0",
+    "@memberjunction/ai": "5.2.0",
+    "@memberjunction/ai-mcp-client": "5.2.0",
+    "@memberjunction/ai-agent-manager": "5.2.0",
+    "@memberjunction/ai-agent-manager-actions": "5.2.0",
+    "@memberjunction/ai-agents": "5.2.0",
+    "@memberjunction/ai-core-plus": "5.2.0",
+    "@memberjunction/ai-prompts": "5.2.0",
+    "@memberjunction/ai-provider-bundle": "5.2.0",
+    "@memberjunction/ai-vectors-pinecone": "5.2.0",
+    "@memberjunction/aiengine": "5.2.0",
+    "@memberjunction/communication-ms-graph": "5.2.0",
+    "@memberjunction/communication-sendgrid": "5.2.0",
+    "@memberjunction/communication-types": "5.2.0",
+    "@memberjunction/component-registry-client-sdk": "5.2.0",
+    "@memberjunction/config": "5.2.0",
+    "@memberjunction/core": "5.2.0",
+    "@memberjunction/core-actions": "5.2.0",
+    "@memberjunction/core-entities": "5.2.0",
+    "@memberjunction/core-entities-server": "5.2.0",
+    "@memberjunction/data-context": "5.2.0",
+    "@memberjunction/data-context-server": "5.2.0",
+    "@memberjunction/doc-utils": "5.2.0",
+    "@memberjunction/api-keys": "5.2.0",
+    "@memberjunction/encryption": "5.2.0",
+    "@memberjunction/entity-communications-base": "5.2.0",
+    "@memberjunction/entity-communications-server": "5.2.0",
+    "@memberjunction/external-change-detection": "5.2.0",
+    "@memberjunction/global": "5.2.0",
+    "@memberjunction/graphql-dataprovider": "5.2.0",
+    "@memberjunction/interactive-component-types": "5.2.0",
+    "@memberjunction/notifications": "5.2.0",
+    "@memberjunction/queue": "5.2.0",
+    "@memberjunction/scheduling-actions": "5.2.0",
+    "@memberjunction/scheduling-base-types": "5.2.0",
+    "@memberjunction/scheduling-engine": "5.2.0",
+    "@memberjunction/scheduling-engine-base": "5.2.0",
+    "@memberjunction/skip-types": "5.2.0",
+    "@memberjunction/sqlserver-dataprovider": "5.2.0",
+    "@memberjunction/storage": "5.2.0",
+    "@memberjunction/templates": "5.2.0",
+    "@memberjunction/testing-engine": "5.2.0",
+    "@memberjunction/testing-engine-base": "5.2.0",
+    "@memberjunction/version-history": "5.2.0",
     "@types/compression": "^1.8.1",
     "@types/cors": "^2.8.19",
     "@types/jsonwebtoken": "9.0.10",

package/src/__tests__/AdhocQueryResolver.test.ts

@@ -0,0 +1,175 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { SQLExpressionValidator } from '@memberjunction/global';
+
+/**
+ * Tests for AdhocQueryResolver.
+ *
+ * Since the resolver has heavy dependencies (type-graphql decorators, mssql, AppContext),
+ * we test the core logic through the SQLExpressionValidator integration and
+ * verify the resolver's structure and error-handling contracts.
+ */
+describe('AdhocQueryResolver', () => {
+  let validator: SQLExpressionValidator;
+
+  beforeEach(() => {
+    validator = SQLExpressionValidator.Instance;
+  });
+
+  describe('SQL validation gate', () => {
+    it('should accept valid SELECT query', () => {
+      const result = validator.validateFullQuery('SELECT TOP 10 * FROM __mj.vwUsers');
+      expect(result.valid).toBe(true);
+    });
+
+    it('should accept valid CTE query', () => {
+      const result = validator.validateFullQuery(`
+        WITH cte AS (SELECT ID, Name FROM __mj.vwUsers)
+        SELECT * FROM cte
+      `);
+      expect(result.valid).toBe(true);
+    });
+
+    it('should reject INSERT statement', () => {
+      const result = validator.validateFullQuery("INSERT INTO Users (Name) VALUES ('hacked')");
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('INSERT');
+    });
+
+    it('should reject DELETE statement', () => {
+      const result = validator.validateFullQuery("DELETE FROM Users WHERE 1=1");
+      expect(result.valid).toBe(false);
+    });
+
+    it('should reject UPDATE statement', () => {
+      const result = validator.validateFullQuery("UPDATE Users SET IsAdmin = 1");
+      expect(result.valid).toBe(false);
+    });
+
+    it('should reject DROP TABLE', () => {
+      const result = validator.validateFullQuery("DROP TABLE Users");
+      expect(result.valid).toBe(false);
+    });
+
+    it('should reject EXEC', () => {
+      const result = validator.validateFullQuery("EXEC sp_executesql N'SELECT 1'");
+      expect(result.valid).toBe(false);
+    });
+
+    it('should reject multi-statement injection via semicolon', () => {
+      const result = validator.validateFullQuery("SELECT 1; DROP TABLE Users");
+      expect(result.valid).toBe(false);
+    });
+
+    it('should reject empty SQL', () => {
+      const result = validator.validateFullQuery('');
+      expect(result.valid).toBe(false);
+    });
+  });
+
+  describe('buildErrorResult contract', () => {
+    it('should return the expected error shape', () => {
+      // This tests the contract that the resolver's buildErrorResult must fulfill
+      const expectedShape = {
+        QueryID: '',
+        QueryName: 'Ad-Hoc Query',
+        Success: false,
+        Results: '[]',
+        RowCount: 0,
+        TotalRowCount: 0,
+        ExecutionTime: 0,
+        ErrorMessage: 'SQL validation failed'
+      };
+
+      expect(expectedShape.Success).toBe(false);
+      expect(expectedShape.QueryID).toBe('');
+      expect(expectedShape.QueryName).toBe('Ad-Hoc Query');
+      expect(expectedShape.Results).toBe('[]');
+      expect(expectedShape.ErrorMessage).toBe('SQL validation failed');
+    });
+  });
+
+  describe('success result contract', () => {
+    it('should return the expected success shape', () => {
+      // This tests the contract that the resolver's success path must fulfill
+      const mockRecordset = [{ ID: '1', Name: 'Test' }, { ID: '2', Name: 'Other' }];
+      const expectedShape = {
+        QueryID: '',
+        QueryName: 'Ad-Hoc Query',
+        Success: true,
+        Results: JSON.stringify(mockRecordset),
+        RowCount: mockRecordset.length,
+        TotalRowCount: mockRecordset.length,
+        ExecutionTime: 42,
+        ErrorMessage: ''
+      };
+
+      expect(expectedShape.Success).toBe(true);
+      expect(expectedShape.QueryID).toBe('');
+      expect(expectedShape.QueryName).toBe('Ad-Hoc Query');
+      expect(JSON.parse(expectedShape.Results)).toHaveLength(2);
+      expect(expectedShape.RowCount).toBe(2);
+      expect(expectedShape.ErrorMessage).toBe('');
+    });
+  });
+
+  describe('timeout contract', () => {
+    it('should default to 30 seconds when TimeoutSeconds is not provided', () => {
+      const defaultTimeout = undefined ?? 30;
+      expect(defaultTimeout).toBe(30);
+      expect(defaultTimeout * 1000).toBe(30000);
+    });
+
+    it('should use provided TimeoutSeconds', () => {
+      const customTimeout = 60 ?? 30;
+      expect(customTimeout).toBe(60);
+      expect(customTimeout * 1000).toBe(60000);
+    });
+
+    it('should produce correct error message for timeout', () => {
+      const timeoutSeconds = 30;
+      const errorMessage = `Query execution exceeded ${timeoutSeconds} second timeout`;
+      expect(errorMessage).toContain('30');
+      expect(errorMessage).toContain('timeout');
+    });
+  });
+
+  describe('complex query validation', () => {
+    it('should accept query with JOINs and subqueries', () => {
+      const sql = `
+        SELECT a.Name, COUNT(r.ID) AS TotalRuns
+        FROM __mj.vwAIAgents a
+        INNER JOIN __mj.vwAIAgentRuns r ON r.AgentID = a.ID
+        WHERE EXISTS (SELECT 1 FROM __mj.vwUsers u WHERE u.ID = a.CreatedByUserID)
+        GROUP BY a.Name
+        ORDER BY TotalRuns DESC
+      `;
+      const result = validator.validateFullQuery(sql);
+      expect(result.valid).toBe(true);
+    });
+
+    it('should accept query with UNION', () => {
+      const sql = `
+        SELECT Name, 'Agent' AS Type FROM __mj.vwAIAgents
+        UNION ALL
+        SELECT Name, 'Model' AS Type FROM __mj.vwAIModels
+      `;
+      const result = validator.validateFullQuery(sql);
+      expect(result.valid).toBe(true);
+    });
+
+    it('should accept query with comments (agent-generated)', () => {
+      const sql = `
+        -- ============================================================
+        -- Agent Performance Report
+        -- ============================================================
+        SELECT TOP 100 a.Name, COUNT(*) AS RunCount
+        FROM __mj.vwAIAgents a
+        INNER JOIN __mj.vwAIAgentRuns r ON r.AgentID = a.ID
+        GROUP BY a.Name
+        ORDER BY RunCount DESC
+      `;
+      const result = validator.validateFullQuery(sql);
+      expect(result.valid).toBe(true);
+    });
+  });
+});

package/src/entitySubclasses/{entityPermissions.server.ts → MJEntityPermissionEntityServer.server.ts}

@@ -12,7 +12,7 @@ import { ___codeGenAPIPort, ___codeGenAPISubmissionDelay, ___codeGenAPIURL } fro
  * happens in the server. That's why it is not in the core-entities-server package.
  */
 @RegisterClass(BaseEntity, 'MJ: Entity Permissions')
-export class EntityPermissionsEntity_Server extends MJEntityPermissionEntity {
+export class MJEntityPermissionEntityServer extends MJEntityPermissionEntity {
   protected static _entityIDQueue: string[] = [];
   protected static _lastModifiedTime: Date | null = null;
   protected static _submissionTimer: NodeJS.Timeout | null = null;
@@ -89,7 +89,7 @@ export class EntityPermissionsEntity_Server extends MJEntityPermissionEntity {
 
   override Save(options?: EntitySaveOptions): Promise<boolean> {
     // simply queue up the entity ID
-    if (this.Dirty || options?.IgnoreDirtyState) EntityPermissionsEntity_Server.AddToQueue(this.EntityID);
+    if (this.Dirty || options?.IgnoreDirtyState) MJEntityPermissionEntityServer.AddToQueue(this.EntityID);
 
     return super.Save(options);
   }
@@ -98,7 +98,7 @@ export class EntityPermissionsEntity_Server extends MJEntityPermissionEntity {
     const success = await super.Delete(options);
 
     // simply queue up the entity ID if the delete worked
-    if (success) EntityPermissionsEntity_Server.AddToQueue(this.EntityID);
+    if (success) MJEntityPermissionEntityServer.AddToQueue(this.EntityID);
 
     return success;
   }