@memberjunction/server 5.37.0 → 5.39.0

package/src/__tests__/getDataTokenRedaction.test.ts

@@ -0,0 +1,84 @@
+import 'reflect-metadata';
+import { describe, it, expect } from 'vitest';
+import type { IMetadataProvider } from '@memberjunction/core';
+import { redactArg } from '../logging/secretRedactor.js';
+import { NoLog, getNoLogFields } from '../logging/NoLog.js';
+
+/**
+ * Test 4 (unit form): the `@NoLog`-decorated `Token` field on GetDataInputType is redacted
+ * from verbose logs, while the non-sensitive `Queries` field passes through.
+ *
+ * GetData is @RequireSystemUser (system-user-only), so this is verified at the redactor level
+ * rather than via a live request. It exercises the field-level @NoLog path: the middleware
+ * collects @NoLog field names via getNoLogFields() and passes them to redactArg as noLogFields.
+ *
+ * GetDataInputType is NOT a Create/Update/Delete*Input, so it fails the entity-binding regex and
+ * would otherwise pass through whole — the @NoLog field set is the ONLY thing protecting Token here.
+ * That's exactly the case @NoLog exists for: sensitive args metadata cannot identify.
+ */
+describe('Test 4: GetData Token redaction via field-level @NoLog', () => {
+  // Mirror the real GetDataInputType shape and apply @NoLog to Token at field level, as the source does.
+  class GetDataInputType {
+    Token = '';
+    Queries: string[] = [];
+  }
+  NoLog(GetDataInputType.prototype, 'Token');
+
+  const provider = { Entities: [] } as unknown as IMetadataProvider;
+
+  it('getNoLogFields picks up the Token field mark', () => {
+    const fields = getNoLogFields(GetDataInputType);
+    expect(fields.has('Token')).toBe(true);
+    expect(fields.has('Queries')).toBe(false);
+  });
+
+  it('masks field-level @NoLog Token on a NON-entity-bound input (the real GetData case)', () => {
+    // GetDataInput does NOT match Create/Update/Delete*Input. This is the exact case @NoLog exists
+    // for: a custom resolver input metadata cannot identify. The redactor must still honor the
+    // field-level @NoLog set and mask Token, while passing the non-sensitive Queries through.
+    const providerWithEntities = {
+      Entities: [{ ClassName: 'Something', EncryptedFields: [] }],
+    } as unknown as IMetadataProvider;
+
+    const result = redactArg({
+      inputTypeName: 'GetDataInput', // not entity-bound — regex won't match
+      rawValue: { Token: 'FAKE_SYSTEM_TOKEN_DO_NOT_USE', Queries: ['SELECT 1', 'SELECT 2'] },
+      provider: providerWithEntities,
+      noLogParameter: false,
+      noLogFields: getNoLogFields(GetDataInputType),
+    });
+
+    expect(result).toEqual({ Token: '<redacted>', Queries: ['SELECT 1', 'SELECT 2'] });
+    expect(JSON.stringify(result)).not.toContain('FAKE_SYSTEM_TOKEN_DO_NOT_USE');
+  });
+
+  it('redactArg masks Token field-by-field when input IS entity-bound (noLogFields wins over metadata)', () => {
+    // When the input type maps to an entity, redactArg walks top-level keys and applies noLogFields.
+    const providerWithEntity = {
+      Entities: [{ ClassName: 'GetDataThing', EncryptedFields: [] }],
+    } as unknown as IMetadataProvider;
+
+    const result = redactArg({
+      inputTypeName: 'CreateGetDataThingInput',
+      rawValue: { Token: 'FAKE_SYSTEM_TOKEN_DO_NOT_USE', Queries: ['SELECT 1'] },
+      provider: providerWithEntity,
+      noLogParameter: false,
+      noLogFields: new Set(['Token']),
+    });
+
+    expect(result).toEqual({ Token: '<redacted>', Queries: ['SELECT 1'] });
+    expect(JSON.stringify(result)).not.toContain('FAKE_SYSTEM_TOKEN_DO_NOT_USE');
+  });
+
+  it('parameter-level @NoLog masks the entire arg regardless of shape', () => {
+    // If Token were a top-level @Arg with @NoLog (parameter form), noLogParameter=true masks it whole.
+    const result = redactArg({
+      inputTypeName: 'String',
+      rawValue: 'FAKE_SYSTEM_TOKEN_DO_NOT_USE',
+      provider,
+      noLogParameter: true,
+      noLogFields: new Set(),
+    });
+    expect(result).toBe('<redacted>');
+  });
+});

package/src/__tests__/resolverBase.rls.test.ts

@@ -0,0 +1,224 @@
+/**
+ * Tests for ResolverBase.getRowLevelSecurityWhereClause.
+ *
+ * Validates that the resolver's RLS path delegates correctly to the centralized
+ * exemption check in EntityInfo.GetUserRowLevelSecurityWhereClause. This was
+ * the code path that caused the bug: single-record GraphQL resolvers applied
+ * RLS filters even when the user held a role that exempted them.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+// ─── Hoisted mocks ────────────────────────────────────────────────────────
+const { mockUserCacheUsers } = vi.hoisted(() => ({
+    mockUserCacheUsers: [] as Array<{ Email: string; ID: string }>,
+}));
+
+// Stub external deps before imports
+vi.mock('@memberjunction/sqlserver-dataprovider', () => ({
+    SQLServerDataProvider: class {},
+    UserCache: {
+        get Users() { return mockUserCacheUsers; },
+    },
+}));
+
+vi.mock('cloudevents', () => ({
+    CloudEvent: class {},
+    httpTransport: () => () => undefined,
+    emitterFor: () => () => undefined,
+}));
+
+vi.mock('type-graphql', () => ({
+    Resolver:           () => () => undefined,
+    Mutation:           () => () => undefined,
+    Query:              () => () => undefined,
+    Subscription:       () => () => undefined,
+    Ctx:                () => () => undefined,
+    Arg:                () => () => undefined,
+    PubSub:             () => () => undefined,
+    Root:               () => () => undefined,
+    ObjectType:         () => () => undefined,
+    InputType:          () => () => undefined,
+    Field:              () => () => undefined,
+    FieldResolver:      () => () => undefined,
+    Int:                () => undefined,
+    Float:              () => undefined,
+    registerEnumType:   () => undefined,
+}));
+
+vi.mock('graphql', () => ({
+    GraphQLError: class extends Error {
+        constructor(msg: string) { super(msg); }
+    },
+}));
+
+vi.mock('mssql', () => ({}));
+
+vi.mock('@memberjunction/api-keys', () => ({
+    GetAPIKeyEngine: vi.fn(),
+}));
+
+vi.mock('@memberjunction/encryption', () => ({
+    EncryptionEngine: { Instance: {} },
+}));
+
+vi.mock('@memberjunction/graphql-dataprovider', () => ({
+    FieldMapper: class { static Instance = { MapFieldsFromCodeNamesToDBNames: vi.fn() }; },
+}));
+
+vi.mock('../generic/PubSubManager.js', () => ({
+    PubSubManager: class { static Instance = { publish: vi.fn() }; },
+}));
+
+vi.mock('../generic/PushStatusResolver.js', () => ({
+    PUSH_STATUS_UPDATES_TOPIC: 'test-push-topic',
+    PushStatusNotification: class {},
+    PushStatusResolver: class {},
+}));
+
+vi.mock('../generic/CacheInvalidationResolver.js', () => ({
+    CACHE_INVALIDATION_TOPIC: 'test-cache-topic',
+}));
+
+vi.mock('../generic/RunViewResolver.js', () => ({
+    RunViewByIDInput: class {},
+    RunViewByNameInput: class {},
+    RunDynamicViewInput: class {},
+}));
+
+vi.mock('../generic/DeleteOptionsInput.js', () => ({
+    DeleteOptionsInput: class {},
+}));
+
+vi.mock('../types.js', () => ({
+    RunViewGenericParams: class {},
+}));
+
+vi.mock('@memberjunction/core', async () => {
+    const actual = await vi.importActual<typeof import('@memberjunction/core')>('@memberjunction/core');
+    return {
+        ...actual,
+        LogError: vi.fn(),
+        LogStatus: vi.fn(),
+    };
+});
+
+vi.mock('@memberjunction/core-entities', () => ({}));
+
+// ─── Import after mocks ──────────────────────────────────────────────────
+import { ResolverBase } from '../generic/ResolverBase';
+import type { DatabaseProviderBase, EntityInfo, UserInfo } from '@memberjunction/core';
+
+/**
+ * Subclass that exposes the protected getRowLevelSecurityWhereClause for testing.
+ */
+class TestResolver extends ResolverBase {
+    public TestGetRLSWhereClause(
+        provider: DatabaseProviderBase,
+        entityName: string,
+        userPayload: { email: string },
+        type: string,
+        returnPrefix: string,
+    ): string {
+        return (this as unknown as {
+            getRowLevelSecurityWhereClause: (
+                p: DatabaseProviderBase, e: string, u: { email: string }, t: string, r: string,
+            ) => string;
+        }).getRowLevelSecurityWhereClause(provider, entityName, userPayload, type, returnPrefix);
+    }
+}
+
+// ─── Helpers ──────────────────────────────────────────────────────────────
+
+function makeEntity(name: string, opts: {
+    exempt: boolean;
+    rlsClause: string;
+}): EntityInfo {
+    return {
+        Name: name,
+        UserExemptFromRowLevelSecurity: () => opts.exempt,
+        GetUserRowLevelSecurityWhereClause: () => opts.exempt ? '' : opts.rlsClause,
+    } as unknown as EntityInfo;
+}
+
+function makeProvider(entities: EntityInfo[]): DatabaseProviderBase {
+    return {
+        Entities: entities,
+    } as unknown as DatabaseProviderBase;
+}
+
+// ─── Tests ────────────────────────────────────────────────────────────────
+
+describe('ResolverBase.getRowLevelSecurityWhereClause', () => {
+    let resolver: TestResolver;
+
+    beforeEach(() => {
+        resolver = new TestResolver();
+        mockUserCacheUsers.length = 0;
+        mockUserCacheUsers.push({
+            Email: 'test@example.com',
+            ID: 'user-1',
+        });
+    });
+
+    it('returns empty string when user is exempt from RLS', () => {
+        const entity = makeEntity('Test Entity', { exempt: true, rlsClause: "OwnerID = 'user-1'" });
+        const provider = makeProvider([entity]);
+
+        const result = resolver.TestGetRLSWhereClause(
+            provider, 'Test Entity', { email: 'test@example.com' }, 'Read', 'AND',
+        );
+
+        expect(result).toBe('');
+    });
+
+    it('returns RLS clause when user is NOT exempt', () => {
+        const entity = makeEntity('Test Entity', { exempt: false, rlsClause: "AND OwnerID = 'user-1'" });
+        const provider = makeProvider([entity]);
+
+        const result = resolver.TestGetRLSWhereClause(
+            provider, 'Test Entity', { email: 'test@example.com' }, 'Read', 'AND',
+        );
+
+        expect(result).toContain('OwnerID');
+    });
+
+    it('throws when entity not found', () => {
+        const provider = makeProvider([]);
+
+        expect(() => resolver.TestGetRLSWhereClause(
+            provider, 'Nonexistent Entity', { email: 'test@example.com' }, 'Read', 'AND',
+        )).toThrow('Entity Nonexistent Entity not found');
+    });
+
+    it('throws when user not found in UserCache', () => {
+        const entity = makeEntity('Test Entity', { exempt: true, rlsClause: '' });
+        const provider = makeProvider([entity]);
+        mockUserCacheUsers.length = 0; // Clear cache
+
+        expect(() => resolver.TestGetRLSWhereClause(
+            provider, 'Test Entity', { email: 'unknown@example.com' }, 'Read', 'AND',
+        )).toThrow('User unknown@example.com not found');
+    });
+
+    it('matches entity name case-insensitively', () => {
+        const entity = makeEntity('MJ: AI Prompt Runs', { exempt: true, rlsClause: '' });
+        const provider = makeProvider([entity]);
+
+        const result = resolver.TestGetRLSWhereClause(
+            provider, 'mj: ai prompt runs', { email: 'test@example.com' }, 'Read', 'AND',
+        );
+
+        expect(result).toBe('');
+    });
+
+    it('matches user email case-insensitively', () => {
+        const entity = makeEntity('Test Entity', { exempt: true, rlsClause: '' });
+        const provider = makeProvider([entity]);
+
+        const result = resolver.TestGetRLSWhereClause(
+            provider, 'Test Entity', { email: 'TEST@EXAMPLE.COM' }, 'Read', 'AND',
+        );
+
+        expect(result).toBe('');
+    });
+});

package/src/__tests__/secretRedactor.test.ts

@@ -0,0 +1,163 @@
+import { describe, it, expect } from 'vitest';
+import type { IMetadataProvider } from '@memberjunction/core';
+import { redactArg } from '../logging/secretRedactor.js';
+
+type EncryptedField = { Name: string };
+type FakeEntity = { ClassName: string; EncryptedFields: EncryptedField[] };
+
+function makeProvider(entities: FakeEntity[]): IMetadataProvider {
+  return {
+    Entities: entities,
+  } as unknown as IMetadataProvider;
+}
+
+describe('redactArg', () => {
+  const credentialEntity: FakeEntity = {
+    ClassName: 'MJCredential',
+    EncryptedFields: [{ Name: 'Values' }],
+  };
+  const userEntity: FakeEntity = {
+    ClassName: 'User',
+    EncryptedFields: [],
+  };
+
+  it('returns "<redacted>" when noLogParameter is set, regardless of other inputs', () => {
+    const result = redactArg({
+      inputTypeName: 'CreateMJCredentialInput',
+      rawValue: { Values: 'FAKE_SECRET_VALUE_DO_NOT_USE' },
+      provider: makeProvider([credentialEntity]),
+      noLogParameter: true,
+      noLogFields: new Set(),
+    });
+    expect(result).toBe('<redacted>');
+  });
+
+  it('returns "<metadata-not-ready>" when the provider has no entities (bootstrap window)', () => {
+    const result = redactArg({
+      inputTypeName: 'CreateMJCredentialInput',
+      rawValue: { Values: 'FAKE_SECRET_VALUE_DO_NOT_USE' },
+      provider: makeProvider([]),
+      noLogParameter: false,
+      noLogFields: new Set(),
+    });
+    expect(result).toBe('<metadata-not-ready>');
+  });
+
+  it('fails open (passes through) when input type does not match Create/Update<X>Input regex', () => {
+    const result = redactArg({
+      inputTypeName: 'SomeCustomArgs',
+      rawValue: { accessToken: 'FAKE_TOKEN' },
+      provider: makeProvider([credentialEntity]),
+      noLogParameter: false,
+      noLogFields: new Set(),
+    });
+    expect(result).toEqual('{"accessToken":"FAKE_TOKEN"}');
+  });
+
+  it('fails open when input type matches regex but no entity is found', () => {
+    const result = redactArg({
+      inputTypeName: 'CreateUnknownEntityInput',
+      rawValue: { Foo: 'bar' },
+      provider: makeProvider([credentialEntity]),
+      noLogParameter: false,
+      noLogFields: new Set(),
+    });
+    expect(result).toEqual('{"Foo":"bar"}');
+  });
+
+  it('redacts top-level keys matching EntityFieldInfo.Encrypt=true on entity-bound CRUD inputs', () => {
+    const result = redactArg({
+      inputTypeName: 'CreateMJCredentialInput',
+      rawValue: { ID: 'abc-123', Name: 'HubSpot', Values: 'FAKE_SECRET_VALUE_DO_NOT_USE' },
+      provider: makeProvider([credentialEntity]),
+      noLogParameter: false,
+      noLogFields: new Set(),
+    });
+    expect(result).toEqual({
+      ID: 'abc-123',
+      Name: 'HubSpot',
+      Values: '<redacted>',
+    });
+  });
+
+  it('redacts top-level keys in noLogFields even when EncryptedFields does not include them', () => {
+    const result = redactArg({
+      inputTypeName: 'CreateUserInput',
+      rawValue: { Name: 'Alice', SecretToken: 'oops' },
+      provider: makeProvider([userEntity]),
+      noLogParameter: false,
+      noLogFields: new Set(['SecretToken']),
+    });
+    expect(result).toEqual({
+      Name: 'Alice',
+      SecretToken: '<redacted>',
+    });
+  });
+
+  it('Update<X>Input is also handled (not just Create<X>Input)', () => {
+    const result = redactArg({
+      inputTypeName: 'UpdateMJCredentialInput',
+      rawValue: { ID: 'abc-123', Values: 'NEW_FAKE_SECRET' },
+      provider: makeProvider([credentialEntity]),
+      noLogParameter: false,
+      noLogFields: new Set(),
+    });
+    expect(result).toEqual({
+      ID: 'abc-123',
+      Values: '<redacted>',
+    });
+  });
+
+  it('Delete<X>Input resolves to its entity and walks keys (PK only — no encrypted values to redact)', () => {
+    // Delete is matched by the regex (alongside Create/Update) so the boot audit treats DeleteMJ*
+    // resolvers as metadata-bound instead of flooding with false positives. Security is identical:
+    // delete inputs carry PK + Options only — no encrypted field, so nothing is redacted, the keys
+    // just pass through. See docs/adr/0001-graphql-variables-logging-tiered-by-verbose.md.
+    const result = redactArg({
+      inputTypeName: 'DeleteMJCredentialInput',
+      rawValue: { ID: 'abc-123' },
+      provider: makeProvider([credentialEntity]),
+      noLogParameter: false,
+      noLogFields: new Set(),
+    });
+    expect(result).toEqual({ ID: 'abc-123' });
+  });
+
+  it('Delete<X>Input never exposes an encrypted value even if one were somehow present', () => {
+    // Defense-in-depth: even if a delete input carried an encrypted field name, it must still mask.
+    const result = redactArg({
+      inputTypeName: 'DeleteMJCredentialInput',
+      rawValue: { ID: 'abc-123', Values: 'FAKE_SECRET_VALUE_DO_NOT_USE' },
+      provider: makeProvider([credentialEntity]),
+      noLogParameter: false,
+      noLogFields: new Set(),
+    });
+    expect(result).toEqual({ ID: 'abc-123', Values: '<redacted>' });
+  });
+
+  it('only walks TOP-level keys — nested objects with encrypted-field names are not recursed', () => {
+    const result = redactArg({
+      inputTypeName: 'CreateMJCredentialInput',
+      rawValue: {
+        Name: 'HubSpot',
+        Nested: { Values: 'NESTED_FAKE_SECRET' },
+      },
+      provider: makeProvider([credentialEntity]),
+      noLogParameter: false,
+      noLogFields: new Set(),
+    });
+    // Top-level `Values` would be redacted; nested `Values` is not.
+    expect((result as Record<string, unknown>).Nested).toEqual('{"Values":"NESTED_FAKE_SECRET"}');
+  });
+
+  it('passes non-object raw values through to shortenForLog', () => {
+    const result = redactArg({
+      inputTypeName: 'CreateMJCredentialInput',
+      rawValue: 'plain-string',
+      provider: makeProvider([credentialEntity]),
+      noLogParameter: false,
+      noLogFields: new Set(),
+    });
+    expect(result).toBe('plain-string');
+  });
+});

package/src/__tests__/subscriptionRedaction.test.ts

@@ -0,0 +1,217 @@
+/**
+ * Middleware wiring test.
+ *
+ * Locks the assumption that `variablesLoggingMiddleware` correctly:
+ *   - Skips field resolvers (info.path.prev !== undefined)
+ *   - Short-circuits when logVariables=false
+ *   - Emits a redacted variables block when logVariables=true
+ *   - Respects @NoLog field-level marks via the input class lookup
+ *
+ * We invoke the middleware directly with a synthetic ResolverData rather than booting a real
+ * GraphQL execution — that would force two copies of `graphql` (CJS via type-graphql + ESM via
+ * the test runner) into the same realm and fail with "Cannot use GraphQLSchema from another
+ * module or realm." The wiring at schema-build time (which IS what we want to lock for future
+ * type-graphql upgrades) is exercised in the end-to-end verification described in the PRD;
+ * here we just lock the per-call redaction logic.
+ *
+ * `globalMiddlewares` covers `@Query`, `@Mutation`, and `@Subscription` resolvers identically
+ * — they all go through the same `applyMiddlewares` chain inside type-graphql. Asserting the
+ * middleware fires once for a representative root resolver covers all three.
+ */
+import 'reflect-metadata';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+vi.mock('../config', () => ({
+  configInfo: {
+    loggingSettings: {
+      graphql: {
+        logVariables: true,
+      },
+    },
+  },
+}));
+vi.mock('../config.js', () => ({
+  configInfo: {
+    loggingSettings: {
+      graphql: {
+        logVariables: true,
+      },
+    },
+  },
+}));
+
+import { variablesLoggingMiddleware } from '../logging/variablesLoggingMiddleware.js';
+
+/**
+ * Build a synthetic GraphQLResolveInfo-shaped object that matches what type-graphql passes
+ * to a middleware at runtime. Only the subset we read is populated.
+ */
+function makeInfo(opts: {
+  fieldName: string;
+  argTypeName: string;
+  argName: string;
+  isFieldResolver?: boolean;
+}): unknown {
+  const fakeArg = {
+    name: opts.argName,
+    type: { name: opts.argTypeName },
+  };
+  const fakeField = {
+    args: [fakeArg],
+  };
+  const parentType = {
+    getFields: () => ({ [opts.fieldName]: fakeField }),
+  };
+  const path = opts.isFieldResolver
+    ? { prev: { prev: undefined, key: 'parent' }, key: opts.fieldName }
+    : { prev: undefined, key: opts.fieldName };
+  return {
+    fieldName: opts.fieldName,
+    parentType,
+    path,
+  };
+}
+
+// Stub `getNamedType` is unnecessary — middleware uses graphql's `getNamedType` against the
+// type we pass. Our `argTypeName` value is wrapped in a plain `{ name }` object below; we need
+// the middleware's `getNamedType` to read `.name` directly. The `graphql` library's
+// `getNamedType` unwraps NonNull/List wrappers; a plain `{ name }` object survives unwrapping
+// because none of those wrapper shapes are present.
+
+describe('variablesLoggingMiddleware', () => {
+  let dirSpy: ReturnType<typeof vi.spyOn>;
+  let warnSpy: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    dirSpy = vi.spyOn(console, 'dir').mockImplementation(() => {});
+    warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    dirSpy.mockRestore();
+    warnSpy.mockRestore();
+  });
+
+  it('skips field resolvers (info.path.prev !== undefined) without logging', async () => {
+    const next = vi.fn(async () => 'next-result');
+    const result = await variablesLoggingMiddleware(
+      {
+        root: undefined,
+        args: { x: 1 },
+        context: {} as never,
+        info: makeInfo({
+          fieldName: 'nestedThing',
+          argTypeName: 'CreateMJCredentialInput',
+          argName: 'input',
+          isFieldResolver: true,
+        }) as never,
+      },
+      next,
+    );
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(result).toBe('next-result');
+    expect(dirSpy).not.toHaveBeenCalled();
+  });
+
+  it('emits a redacted variables block for a root resolver with an entity-bound CRUD input', async () => {
+    const next = vi.fn(async () => 'next-result');
+    const fakeProvider = {
+      Entities: [
+        { ClassName: 'MJCredential', EncryptedFields: [{ Name: 'Values' }] },
+      ],
+    };
+
+    await variablesLoggingMiddleware(
+      {
+        root: undefined,
+        args: { input: { ID: 'abc', Name: 'HubSpot', Values: 'FAKE_SECRET' } },
+        context: {
+          providers: [{ provider: fakeProvider, type: 'Read-Write' }],
+        } as never,
+        info: makeInfo({
+          fieldName: 'CreateMJCredential',
+          argTypeName: 'CreateMJCredentialInput',
+          argName: 'input',
+        }) as never,
+      },
+      next,
+    );
+
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(dirSpy).toHaveBeenCalledTimes(1);
+    const [logged] = dirSpy.mock.calls[0];
+    expect(logged).toEqual({
+      operation: 'CreateMJCredential',
+      args: {
+        input: {
+          ID: 'abc',
+          Name: 'HubSpot',
+          Values: '<redacted>',
+        },
+      },
+    });
+  });
+
+  it('logs a custom-resolver plaintext arg (no metadata redaction available for it)', async () => {
+    const next = vi.fn(async () => undefined);
+    // Populate Entities (non-empty) so the redactor does not fall into the bootstrap fail-closed branch.
+    // The String-typed arg doesn't match Create/Update<X>Input, so it falls through to shortenForLog.
+    const fakeProvider = {
+      Entities: [{ ClassName: 'SomeUnrelatedEntity', EncryptedFields: [] }],
+    };
+
+    await variablesLoggingMiddleware(
+      {
+        root: undefined,
+        args: { token: 'plaintext-leak' },
+        context: {
+          providers: [{ provider: fakeProvider, type: 'Read-Write' }],
+        } as never,
+        info: makeInfo({
+          fieldName: 'VoiceTestHubSpotCredential',
+          argTypeName: 'String',
+          argName: 'token',
+        }) as never,
+      },
+      next,
+    );
+
+    expect(dirSpy).toHaveBeenCalledTimes(1);
+    // Arg is logged as-is because String type doesn't match Create/Update<X>Input, so the
+    // redactor's fail-open branch passes the value through shortenForLog (plain string passthrough).
+    // This is the gap that @NoLog discipline plus the boot audit are designed to surface.
+    const [logged] = dirSpy.mock.calls[0];
+    expect(logged).toMatchObject({
+      operation: 'VoiceTestHubSpotCredential',
+      args: { token: 'plaintext-leak' },
+    });
+  });
+
+  it('fails closed (<metadata-not-ready>) when provider.Entities is empty', async () => {
+    const next = vi.fn(async () => undefined);
+    const fakeProvider = { Entities: [] };
+
+    await variablesLoggingMiddleware(
+      {
+        root: undefined,
+        args: { input: { Values: 'FAKE_SECRET' } },
+        context: {
+          providers: [{ provider: fakeProvider, type: 'Read-Write' }],
+        } as never,
+        info: makeInfo({
+          fieldName: 'CreateMJCredential',
+          argTypeName: 'CreateMJCredentialInput',
+          argName: 'input',
+        }) as never,
+      },
+      next,
+    );
+
+    expect(dirSpy).toHaveBeenCalledTimes(1);
+    const [logged] = dirSpy.mock.calls[0];
+    expect(logged).toEqual({
+      operation: 'CreateMJCredential',
+      args: { input: '<metadata-not-ready>' },
+    });
+  });
+});