@memberjunction/server 5.37.0 → 5.38.0

package/src/__tests__/resolverBase.rls.test.ts

@@ -0,0 +1,224 @@
+/**
+ * Tests for ResolverBase.getRowLevelSecurityWhereClause.
+ *
+ * Validates that the resolver's RLS path delegates correctly to the centralized
+ * exemption check in EntityInfo.GetUserRowLevelSecurityWhereClause. This was
+ * the code path that caused the bug: single-record GraphQL resolvers applied
+ * RLS filters even when the user held a role that exempted them.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+// ─── Hoisted mocks ────────────────────────────────────────────────────────
+const { mockUserCacheUsers } = vi.hoisted(() => ({
+    mockUserCacheUsers: [] as Array<{ Email: string; ID: string }>,
+}));
+
+// Stub external deps before imports
+vi.mock('@memberjunction/sqlserver-dataprovider', () => ({
+    SQLServerDataProvider: class {},
+    UserCache: {
+        get Users() { return mockUserCacheUsers; },
+    },
+}));
+
+vi.mock('cloudevents', () => ({
+    CloudEvent: class {},
+    httpTransport: () => () => undefined,
+    emitterFor: () => () => undefined,
+}));
+
+vi.mock('type-graphql', () => ({
+    Resolver:           () => () => undefined,
+    Mutation:           () => () => undefined,
+    Query:              () => () => undefined,
+    Subscription:       () => () => undefined,
+    Ctx:                () => () => undefined,
+    Arg:                () => () => undefined,
+    PubSub:             () => () => undefined,
+    Root:               () => () => undefined,
+    ObjectType:         () => () => undefined,
+    InputType:          () => () => undefined,
+    Field:              () => () => undefined,
+    FieldResolver:      () => () => undefined,
+    Int:                () => undefined,
+    Float:              () => undefined,
+    registerEnumType:   () => undefined,
+}));
+
+vi.mock('graphql', () => ({
+    GraphQLError: class extends Error {
+        constructor(msg: string) { super(msg); }
+    },
+}));
+
+vi.mock('mssql', () => ({}));
+
+vi.mock('@memberjunction/api-keys', () => ({
+    GetAPIKeyEngine: vi.fn(),
+}));
+
+vi.mock('@memberjunction/encryption', () => ({
+    EncryptionEngine: { Instance: {} },
+}));
+
+vi.mock('@memberjunction/graphql-dataprovider', () => ({
+    FieldMapper: class { static Instance = { MapFieldsFromCodeNamesToDBNames: vi.fn() }; },
+}));
+
+vi.mock('../generic/PubSubManager.js', () => ({
+    PubSubManager: class { static Instance = { publish: vi.fn() }; },
+}));
+
+vi.mock('../generic/PushStatusResolver.js', () => ({
+    PUSH_STATUS_UPDATES_TOPIC: 'test-push-topic',
+    PushStatusNotification: class {},
+    PushStatusResolver: class {},
+}));
+
+vi.mock('../generic/CacheInvalidationResolver.js', () => ({
+    CACHE_INVALIDATION_TOPIC: 'test-cache-topic',
+}));
+
+vi.mock('../generic/RunViewResolver.js', () => ({
+    RunViewByIDInput: class {},
+    RunViewByNameInput: class {},
+    RunDynamicViewInput: class {},
+}));
+
+vi.mock('../generic/DeleteOptionsInput.js', () => ({
+    DeleteOptionsInput: class {},
+}));
+
+vi.mock('../types.js', () => ({
+    RunViewGenericParams: class {},
+}));
+
+vi.mock('@memberjunction/core', async () => {
+    const actual = await vi.importActual<typeof import('@memberjunction/core')>('@memberjunction/core');
+    return {
+        ...actual,
+        LogError: vi.fn(),
+        LogStatus: vi.fn(),
+    };
+});
+
+vi.mock('@memberjunction/core-entities', () => ({}));
+
+// ─── Import after mocks ──────────────────────────────────────────────────
+import { ResolverBase } from '../generic/ResolverBase';
+import type { DatabaseProviderBase, EntityInfo, UserInfo } from '@memberjunction/core';
+
+/**
+ * Subclass that exposes the protected getRowLevelSecurityWhereClause for testing.
+ */
+class TestResolver extends ResolverBase {
+    public TestGetRLSWhereClause(
+        provider: DatabaseProviderBase,
+        entityName: string,
+        userPayload: { email: string },
+        type: string,
+        returnPrefix: string,
+    ): string {
+        return (this as unknown as {
+            getRowLevelSecurityWhereClause: (
+                p: DatabaseProviderBase, e: string, u: { email: string }, t: string, r: string,
+            ) => string;
+        }).getRowLevelSecurityWhereClause(provider, entityName, userPayload, type, returnPrefix);
+    }
+}
+
+// ─── Helpers ──────────────────────────────────────────────────────────────
+
+function makeEntity(name: string, opts: {
+    exempt: boolean;
+    rlsClause: string;
+}): EntityInfo {
+    return {
+        Name: name,
+        UserExemptFromRowLevelSecurity: () => opts.exempt,
+        GetUserRowLevelSecurityWhereClause: () => opts.exempt ? '' : opts.rlsClause,
+    } as unknown as EntityInfo;
+}
+
+function makeProvider(entities: EntityInfo[]): DatabaseProviderBase {
+    return {
+        Entities: entities,
+    } as unknown as DatabaseProviderBase;
+}
+
+// ─── Tests ────────────────────────────────────────────────────────────────
+
+describe('ResolverBase.getRowLevelSecurityWhereClause', () => {
+    let resolver: TestResolver;
+
+    beforeEach(() => {
+        resolver = new TestResolver();
+        mockUserCacheUsers.length = 0;
+        mockUserCacheUsers.push({
+            Email: 'test@example.com',
+            ID: 'user-1',
+        });
+    });
+
+    it('returns empty string when user is exempt from RLS', () => {
+        const entity = makeEntity('Test Entity', { exempt: true, rlsClause: "OwnerID = 'user-1'" });
+        const provider = makeProvider([entity]);
+
+        const result = resolver.TestGetRLSWhereClause(
+            provider, 'Test Entity', { email: 'test@example.com' }, 'Read', 'AND',
+        );
+
+        expect(result).toBe('');
+    });
+
+    it('returns RLS clause when user is NOT exempt', () => {
+        const entity = makeEntity('Test Entity', { exempt: false, rlsClause: "AND OwnerID = 'user-1'" });
+        const provider = makeProvider([entity]);
+
+        const result = resolver.TestGetRLSWhereClause(
+            provider, 'Test Entity', { email: 'test@example.com' }, 'Read', 'AND',
+        );
+
+        expect(result).toContain('OwnerID');
+    });
+
+    it('throws when entity not found', () => {
+        const provider = makeProvider([]);
+
+        expect(() => resolver.TestGetRLSWhereClause(
+            provider, 'Nonexistent Entity', { email: 'test@example.com' }, 'Read', 'AND',
+        )).toThrow('Entity Nonexistent Entity not found');
+    });
+
+    it('throws when user not found in UserCache', () => {
+        const entity = makeEntity('Test Entity', { exempt: true, rlsClause: '' });
+        const provider = makeProvider([entity]);
+        mockUserCacheUsers.length = 0; // Clear cache
+
+        expect(() => resolver.TestGetRLSWhereClause(
+            provider, 'Test Entity', { email: 'unknown@example.com' }, 'Read', 'AND',
+        )).toThrow('User unknown@example.com not found');
+    });
+
+    it('matches entity name case-insensitively', () => {
+        const entity = makeEntity('MJ: AI Prompt Runs', { exempt: true, rlsClause: '' });
+        const provider = makeProvider([entity]);
+
+        const result = resolver.TestGetRLSWhereClause(
+            provider, 'mj: ai prompt runs', { email: 'test@example.com' }, 'Read', 'AND',
+        );
+
+        expect(result).toBe('');
+    });
+
+    it('matches user email case-insensitively', () => {
+        const entity = makeEntity('Test Entity', { exempt: true, rlsClause: '' });
+        const provider = makeProvider([entity]);
+
+        const result = resolver.TestGetRLSWhereClause(
+            provider, 'Test Entity', { email: 'TEST@EXAMPLE.COM' }, 'Read', 'AND',
+        );
+
+        expect(result).toBe('');
+    });
+});

package/src/agents/skip-sdk.ts

@@ -25,7 +25,7 @@ import {
 } from '@memberjunction/skip-types';
 import { DataContext } from '@memberjunction/data-context';
 import { IMetadataProvider, UserInfo, LogStatus, LogError, Metadata, RunQuery, RunView, EntityInfo, EntityFieldInfo, EntityFieldValueInfo, DatabaseProviderBase } from '@memberjunction/core';
-import { MJConversationDetailEntity } from '@memberjunction/core-entities';
+import { MJConversationDetailEntity, QueryEngine } from '@memberjunction/core-entities';
 import { request as httpRequest } from 'http';
 import { request as httpsRequest } from 'https';
 import { gzip as gzipCompress, createGunzip } from 'zlib';
@@ -483,15 +483,15 @@ export class SkipSDK {
      * Build saved queries for Skip
      */
     private buildQueries(status: "Pending" | "In-Review" | "Approved" | "Rejected" | "Obsolete" = 'Approved'): SkipQueryInfo[] {
-        const md = this.Provider;
-        const approvedQueries = md.Queries.filter((q) => q.Status === status);
+        const qe = QueryEngine.Instance;
+        const approvedQueries = qe.Queries.filter((q) => q.Status === status);
 
         return approvedQueries.map((q) => ({
             ID: q.ID,
             Name: q.Name,
             Description: q.Description,
             Category: q.Category,
-            CategoryPath: this.buildQueryCategoryPath(md, q.CategoryID),
+            CategoryPath: this.buildQueryCategoryPath(qe, q.CategoryID),
             CategoryID: q.CategoryID,
             SQL: q.SQL,
             Status: q.Status,
@@ -501,7 +501,7 @@ export class SkipSDK {
             EmbeddingModelID: q.EmbeddingModelID,
             EmbeddingModelName: q.EmbeddingModel,
             TechnicalDescription: q.TechnicalDescription,
-            Fields: q.Fields.map((f) => ({
+            Fields: qe.GetQueryFields(q.ID).map((f) => ({
                 ID: f.ID,
                 QueryID: f.QueryID,
                 Name: f.Name,
@@ -517,7 +517,7 @@ export class SkipSDK {
                 IsSummary: f.IsSummary,
                 SummaryDescription: f.SummaryDescription
             })),
-            Parameters: q.Parameters.map((p) => ({
+            Parameters: qe.GetQueryParameters(q.ID).map((p) => ({
                 ID: p.ID,
                 QueryID: p.QueryID,
                 Name: p.Name,
@@ -528,12 +528,15 @@ export class SkipSDK {
                 SampleValue: p.SampleValue,
                 ValidationFilters: p.ValidationFilters
             })),
-            Entities: q.Entities.map((e) => ({
+            Entities: qe.QueryEntities.filter(e => UUIDsEqual(e.QueryID, q.ID)).map((e) => ({
                 ID: e.ID,
                 QueryID: e.QueryID,
                 EntityID: e.EntityID,
                 Entity: e.Entity
             })),
+            SQLDialectID: q.SQLDialectID,
+            UsesTemplate: q.UsesTemplate,
+            IsApproved: q.IsApproved,
             CacheEnabled: q.CacheEnabled,
             CacheMaxSize: q.CacheMaxSize,
             CacheTTLMinutes: q.CacheTTLMinutes,
@@ -544,11 +547,11 @@ export class SkipSDK {
     /**
      * Recursively build category path for a query
      */
-    private buildQueryCategoryPath(md: IMetadataProvider, categoryID: string): string {
-        const cat = md.QueryCategories.find((c) => UUIDsEqual(c.ID, categoryID));
+    private buildQueryCategoryPath(qe: QueryEngine, categoryID: string): string {
+        const cat = qe.Categories.find((c) => UUIDsEqual(c.ID, categoryID));
         if (!cat) return '';
         if (!cat.ParentID) return cat.Name;
-        const parentPath = this.buildQueryCategoryPath(md, cat.ParentID);
+        const parentPath = this.buildQueryCategoryPath(qe, cat.ParentID);
         return parentPath ? `${parentPath}/${cat.Name}` : cat.Name;
     }
 
@@ -560,11 +563,11 @@ export class SkipSDK {
      * across all queries, not just approved ones.
      */
     private buildQueryCatalog(): SkipQueryCatalogEntry[] {
-        const md = this.Provider;
+        const qe = QueryEngine.Instance;
 
-        return md.Queries.map((q) => ({
+        return qe.Queries.map((q) => ({
             Name: q.Name,
-            CategoryPath: this.buildQueryCategoryPath(md, q.CategoryID)
+            CategoryPath: this.buildQueryCategoryPath(qe, q.CategoryID)
         }));
     }