@memberjunction/server 5.38.0 → 5.39.0

package/src/__tests__/bootAudit.test.ts

@@ -0,0 +1,188 @@
+import 'reflect-metadata';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+// Short-circuits config.ts's loadConfig() so this file loads in any environment, not just one
+// with DB env vars set. bootAudit.ts imports `configInfo` at module-init; without this mock,
+// `loadConfig()` runs and throws "Configuration validation failed" on a clean machine or in
+// sandboxed CI. The audit tests below call `auditResolverList` directly and don't read
+// `logVariables`, but the import chain still pulls in `configInfo`. Mirrors the same shim in
+// subscriptionRedaction.test.ts.
+vi.mock('../config', () => ({
+  configInfo: {
+    loggingSettings: { graphql: { logVariables: true } },
+  },
+}));
+vi.mock('../config.js', () => ({
+  configInfo: {
+    loggingSettings: { graphql: { logVariables: true } },
+  },
+}));
+
+import { auditResolverList } from '../logging/bootAudit.js';
+import type { AuditArgParam, AuditResolver } from '../logging/bootAudit.js';
+import { NoLog } from '../logging/NoLog.js';
+
+// --------------------------------------------------------------------------
+// Synthetic fixture types & helpers
+// --------------------------------------------------------------------------
+
+class CreateMJCredentialInput {}
+class CustomSecretInput {}
+
+function makeArgParam(opts: {
+  target: Function;
+  methodName: string;
+  index: number;
+  name: string;
+  type: Function;
+}): AuditArgParam {
+  return {
+    target: opts.target,
+    methodName: opts.methodName,
+    index: opts.index,
+    kind: 'arg',
+    name: opts.name,
+    getType: () => opts.type,
+  };
+}
+
+function makeResolver(opts: {
+  target: Function;
+  methodName: string;
+  params: AuditArgParam[];
+}): AuditResolver {
+  return {
+    target: opts.target,
+    methodName: opts.methodName,
+    params: opts.params,
+  };
+}
+
+// --------------------------------------------------------------------------
+// Tests
+// --------------------------------------------------------------------------
+
+describe('auditResolverList', () => {
+  let warnSpy: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    warnSpy.mockRestore();
+  });
+
+  it('does NOT warn for an @Arg whose type matches Create<X>Input', () => {
+    class SafeCrudResolver {
+      doCreate(_input: CreateMJCredentialInput): void {
+        // body
+      }
+    }
+    const resolver = makeResolver({
+      target: SafeCrudResolver,
+      methodName: 'doCreate',
+      params: [
+        makeArgParam({
+          target: SafeCrudResolver,
+          methodName: 'doCreate',
+          index: 0,
+          name: 'input',
+          type: CreateMJCredentialInput,
+        }),
+      ],
+    });
+
+    auditResolverList([resolver]);
+    expect(warnSpy).not.toHaveBeenCalled();
+  });
+
+  it('WARNS for an @Arg of a custom type without @NoLog', () => {
+    class CustomNoMarkResolver {
+      doCustom(_input: CustomSecretInput): void {
+        // body
+      }
+    }
+    const resolver = makeResolver({
+      target: CustomNoMarkResolver,
+      methodName: 'doCustom',
+      params: [
+        makeArgParam({
+          target: CustomNoMarkResolver,
+          methodName: 'doCustom',
+          index: 0,
+          name: 'input',
+          type: CustomSecretInput,
+        }),
+      ],
+    });
+
+    auditResolverList([resolver]);
+    expect(warnSpy).toHaveBeenCalledTimes(1);
+    const message = warnSpy.mock.calls[0][0];
+    expect(typeof message).toBe('string');
+    expect(message).toContain('CustomNoMarkResolver.doCustom');
+    expect(message).toContain("'input'");
+    expect(message).toContain('CustomSecretInput');
+  });
+
+  it('does NOT warn for an @Arg of a custom type marked @NoLog at parameter level', () => {
+    class CustomMarkedResolver {
+      doCustom(_input: CustomSecretInput): void {
+        // body
+      }
+    }
+    NoLog(CustomMarkedResolver.prototype, 'doCustom', 0);
+
+    const resolver = makeResolver({
+      target: CustomMarkedResolver,
+      methodName: 'doCustom',
+      params: [
+        makeArgParam({
+          target: CustomMarkedResolver,
+          methodName: 'doCustom',
+          index: 0,
+          name: 'input',
+          type: CustomSecretInput,
+        }),
+      ],
+    });
+
+    auditResolverList([resolver]);
+    expect(warnSpy).not.toHaveBeenCalled();
+  });
+
+  it('mixed resolver: warns for the un-decorated custom arg but not the metadata-bound one', () => {
+    class MixedResolver {
+      doMixed(_safe: CreateMJCredentialInput, _custom: CustomSecretInput): void {
+        // body
+      }
+    }
+    const resolver = makeResolver({
+      target: MixedResolver,
+      methodName: 'doMixed',
+      params: [
+        makeArgParam({
+          target: MixedResolver,
+          methodName: 'doMixed',
+          index: 0,
+          name: 'safe',
+          type: CreateMJCredentialInput,
+        }),
+        makeArgParam({
+          target: MixedResolver,
+          methodName: 'doMixed',
+          index: 1,
+          name: 'custom',
+          type: CustomSecretInput,
+        }),
+      ],
+    });
+
+    auditResolverList([resolver]);
+    expect(warnSpy).toHaveBeenCalledTimes(1);
+    const message = warnSpy.mock.calls[0][0];
+    expect(message).toContain("'custom'");
+    expect(message).not.toContain("'safe'");
+  });
+});

package/src/__tests__/boundaryLogPayload.test.ts

@@ -0,0 +1,31 @@
+import { describe, it, expect } from 'vitest';
+import { buildBoundaryLogPayload } from '../logging/boundaryLogPayload.js';
+
+/**
+ * Guards the load-bearing #2638 fix: the always-on GraphQL boundary log line emits the
+ * operation name ONLY and never a `variables` key, in any configuration. A future refactor
+ * that re-adds variables to this line (the original leak) must fail here.
+ *
+ * See docs/adr/0001-graphql-variables-logging-tiered-by-verbose.md.
+ */
+describe('buildBoundaryLogPayload', () => {
+  it('returns operation name only', () => {
+    expect(buildBoundaryLogPayload('CreateMJCredential')).toEqual({ operationName: 'CreateMJCredential' });
+  });
+
+  it('never includes a `variables` key', () => {
+    const payload = buildBoundaryLogPayload('RunViewsWithCacheCheck');
+    expect('variables' in payload).toBe(false);
+  });
+
+  it('serialized form contains no value content — only the operation name', () => {
+    // Even if someone passes a secret-shaped operation name, nothing but the name is emitted.
+    const serialized = JSON.stringify(buildBoundaryLogPayload('SomeOp'));
+    expect(serialized).toBe('{"operationName":"SomeOp"}');
+  });
+
+  it('handles undefined operation name (non-named operations)', () => {
+    expect(buildBoundaryLogPayload(undefined)).toEqual({ operationName: undefined });
+    expect('variables' in buildBoundaryLogPayload(undefined)).toBe(false);
+  });
+});

package/src/__tests__/getDataTokenRedaction.test.ts

@@ -0,0 +1,84 @@
+import 'reflect-metadata';
+import { describe, it, expect } from 'vitest';
+import type { IMetadataProvider } from '@memberjunction/core';
+import { redactArg } from '../logging/secretRedactor.js';
+import { NoLog, getNoLogFields } from '../logging/NoLog.js';
+
+/**
+ * Test 4 (unit form): the `@NoLog`-decorated `Token` field on GetDataInputType is redacted
+ * from verbose logs, while the non-sensitive `Queries` field passes through.
+ *
+ * GetData is @RequireSystemUser (system-user-only), so this is verified at the redactor level
+ * rather than via a live request. It exercises the field-level @NoLog path: the middleware
+ * collects @NoLog field names via getNoLogFields() and passes them to redactArg as noLogFields.
+ *
+ * GetDataInputType is NOT a Create/Update/Delete*Input, so it fails the entity-binding regex and
+ * would otherwise pass through whole — the @NoLog field set is the ONLY thing protecting Token here.
+ * That's exactly the case @NoLog exists for: sensitive args metadata cannot identify.
+ */
+describe('Test 4: GetData Token redaction via field-level @NoLog', () => {
+  // Mirror the real GetDataInputType shape and apply @NoLog to Token at field level, as the source does.
+  class GetDataInputType {
+    Token = '';
+    Queries: string[] = [];
+  }
+  NoLog(GetDataInputType.prototype, 'Token');
+
+  const provider = { Entities: [] } as unknown as IMetadataProvider;
+
+  it('getNoLogFields picks up the Token field mark', () => {
+    const fields = getNoLogFields(GetDataInputType);
+    expect(fields.has('Token')).toBe(true);
+    expect(fields.has('Queries')).toBe(false);
+  });
+
+  it('masks field-level @NoLog Token on a NON-entity-bound input (the real GetData case)', () => {
+    // GetDataInput does NOT match Create/Update/Delete*Input. This is the exact case @NoLog exists
+    // for: a custom resolver input metadata cannot identify. The redactor must still honor the
+    // field-level @NoLog set and mask Token, while passing the non-sensitive Queries through.
+    const providerWithEntities = {
+      Entities: [{ ClassName: 'Something', EncryptedFields: [] }],
+    } as unknown as IMetadataProvider;
+
+    const result = redactArg({
+      inputTypeName: 'GetDataInput', // not entity-bound — regex won't match
+      rawValue: { Token: 'FAKE_SYSTEM_TOKEN_DO_NOT_USE', Queries: ['SELECT 1', 'SELECT 2'] },
+      provider: providerWithEntities,
+      noLogParameter: false,
+      noLogFields: getNoLogFields(GetDataInputType),
+    });
+
+    expect(result).toEqual({ Token: '<redacted>', Queries: ['SELECT 1', 'SELECT 2'] });
+    expect(JSON.stringify(result)).not.toContain('FAKE_SYSTEM_TOKEN_DO_NOT_USE');
+  });
+
+  it('redactArg masks Token field-by-field when input IS entity-bound (noLogFields wins over metadata)', () => {
+    // When the input type maps to an entity, redactArg walks top-level keys and applies noLogFields.
+    const providerWithEntity = {
+      Entities: [{ ClassName: 'GetDataThing', EncryptedFields: [] }],
+    } as unknown as IMetadataProvider;
+
+    const result = redactArg({
+      inputTypeName: 'CreateGetDataThingInput',
+      rawValue: { Token: 'FAKE_SYSTEM_TOKEN_DO_NOT_USE', Queries: ['SELECT 1'] },
+      provider: providerWithEntity,
+      noLogParameter: false,
+      noLogFields: new Set(['Token']),
+    });
+
+    expect(result).toEqual({ Token: '<redacted>', Queries: ['SELECT 1'] });
+    expect(JSON.stringify(result)).not.toContain('FAKE_SYSTEM_TOKEN_DO_NOT_USE');
+  });
+
+  it('parameter-level @NoLog masks the entire arg regardless of shape', () => {
+    // If Token were a top-level @Arg with @NoLog (parameter form), noLogParameter=true masks it whole.
+    const result = redactArg({
+      inputTypeName: 'String',
+      rawValue: 'FAKE_SYSTEM_TOKEN_DO_NOT_USE',
+      provider,
+      noLogParameter: true,
+      noLogFields: new Set(),
+    });
+    expect(result).toBe('<redacted>');
+  });
+});

package/src/__tests__/secretRedactor.test.ts

@@ -0,0 +1,163 @@
+import { describe, it, expect } from 'vitest';
+import type { IMetadataProvider } from '@memberjunction/core';
+import { redactArg } from '../logging/secretRedactor.js';
+
+type EncryptedField = { Name: string };
+type FakeEntity = { ClassName: string; EncryptedFields: EncryptedField[] };
+
+function makeProvider(entities: FakeEntity[]): IMetadataProvider {
+  return {
+    Entities: entities,
+  } as unknown as IMetadataProvider;
+}
+
+describe('redactArg', () => {
+  const credentialEntity: FakeEntity = {
+    ClassName: 'MJCredential',
+    EncryptedFields: [{ Name: 'Values' }],
+  };
+  const userEntity: FakeEntity = {
+    ClassName: 'User',
+    EncryptedFields: [],
+  };
+
+  it('returns "<redacted>" when noLogParameter is set, regardless of other inputs', () => {
+    const result = redactArg({
+      inputTypeName: 'CreateMJCredentialInput',
+      rawValue: { Values: 'FAKE_SECRET_VALUE_DO_NOT_USE' },
+      provider: makeProvider([credentialEntity]),
+      noLogParameter: true,
+      noLogFields: new Set(),
+    });
+    expect(result).toBe('<redacted>');
+  });
+
+  it('returns "<metadata-not-ready>" when the provider has no entities (bootstrap window)', () => {
+    const result = redactArg({
+      inputTypeName: 'CreateMJCredentialInput',
+      rawValue: { Values: 'FAKE_SECRET_VALUE_DO_NOT_USE' },
+      provider: makeProvider([]),
+      noLogParameter: false,
+      noLogFields: new Set(),
+    });
+    expect(result).toBe('<metadata-not-ready>');
+  });
+
+  it('fails open (passes through) when input type does not match Create/Update<X>Input regex', () => {
+    const result = redactArg({
+      inputTypeName: 'SomeCustomArgs',
+      rawValue: { accessToken: 'FAKE_TOKEN' },
+      provider: makeProvider([credentialEntity]),
+      noLogParameter: false,
+      noLogFields: new Set(),
+    });
+    expect(result).toEqual('{"accessToken":"FAKE_TOKEN"}');
+  });
+
+  it('fails open when input type matches regex but no entity is found', () => {
+    const result = redactArg({
+      inputTypeName: 'CreateUnknownEntityInput',
+      rawValue: { Foo: 'bar' },
+      provider: makeProvider([credentialEntity]),
+      noLogParameter: false,
+      noLogFields: new Set(),
+    });
+    expect(result).toEqual('{"Foo":"bar"}');
+  });
+
+  it('redacts top-level keys matching EntityFieldInfo.Encrypt=true on entity-bound CRUD inputs', () => {
+    const result = redactArg({
+      inputTypeName: 'CreateMJCredentialInput',
+      rawValue: { ID: 'abc-123', Name: 'HubSpot', Values: 'FAKE_SECRET_VALUE_DO_NOT_USE' },
+      provider: makeProvider([credentialEntity]),
+      noLogParameter: false,
+      noLogFields: new Set(),
+    });
+    expect(result).toEqual({
+      ID: 'abc-123',
+      Name: 'HubSpot',
+      Values: '<redacted>',
+    });
+  });
+
+  it('redacts top-level keys in noLogFields even when EncryptedFields does not include them', () => {
+    const result = redactArg({
+      inputTypeName: 'CreateUserInput',
+      rawValue: { Name: 'Alice', SecretToken: 'oops' },
+      provider: makeProvider([userEntity]),
+      noLogParameter: false,
+      noLogFields: new Set(['SecretToken']),
+    });
+    expect(result).toEqual({
+      Name: 'Alice',
+      SecretToken: '<redacted>',
+    });
+  });
+
+  it('Update<X>Input is also handled (not just Create<X>Input)', () => {
+    const result = redactArg({
+      inputTypeName: 'UpdateMJCredentialInput',
+      rawValue: { ID: 'abc-123', Values: 'NEW_FAKE_SECRET' },
+      provider: makeProvider([credentialEntity]),
+      noLogParameter: false,
+      noLogFields: new Set(),
+    });
+    expect(result).toEqual({
+      ID: 'abc-123',
+      Values: '<redacted>',
+    });
+  });
+
+  it('Delete<X>Input resolves to its entity and walks keys (PK only — no encrypted values to redact)', () => {
+    // Delete is matched by the regex (alongside Create/Update) so the boot audit treats DeleteMJ*
+    // resolvers as metadata-bound instead of flooding with false positives. Security is identical:
+    // delete inputs carry PK + Options only — no encrypted field, so nothing is redacted, the keys
+    // just pass through. See docs/adr/0001-graphql-variables-logging-tiered-by-verbose.md.
+    const result = redactArg({
+      inputTypeName: 'DeleteMJCredentialInput',
+      rawValue: { ID: 'abc-123' },
+      provider: makeProvider([credentialEntity]),
+      noLogParameter: false,
+      noLogFields: new Set(),
+    });
+    expect(result).toEqual({ ID: 'abc-123' });
+  });
+
+  it('Delete<X>Input never exposes an encrypted value even if one were somehow present', () => {
+    // Defense-in-depth: even if a delete input carried an encrypted field name, it must still mask.
+    const result = redactArg({
+      inputTypeName: 'DeleteMJCredentialInput',
+      rawValue: { ID: 'abc-123', Values: 'FAKE_SECRET_VALUE_DO_NOT_USE' },
+      provider: makeProvider([credentialEntity]),
+      noLogParameter: false,
+      noLogFields: new Set(),
+    });
+    expect(result).toEqual({ ID: 'abc-123', Values: '<redacted>' });
+  });
+
+  it('only walks TOP-level keys — nested objects with encrypted-field names are not recursed', () => {
+    const result = redactArg({
+      inputTypeName: 'CreateMJCredentialInput',
+      rawValue: {
+        Name: 'HubSpot',
+        Nested: { Values: 'NESTED_FAKE_SECRET' },
+      },
+      provider: makeProvider([credentialEntity]),
+      noLogParameter: false,
+      noLogFields: new Set(),
+    });
+    // Top-level `Values` would be redacted; nested `Values` is not.
+    expect((result as Record<string, unknown>).Nested).toEqual('{"Values":"NESTED_FAKE_SECRET"}');
+  });
+
+  it('passes non-object raw values through to shortenForLog', () => {
+    const result = redactArg({
+      inputTypeName: 'CreateMJCredentialInput',
+      rawValue: 'plain-string',
+      provider: makeProvider([credentialEntity]),
+      noLogParameter: false,
+      noLogFields: new Set(),
+    });
+    expect(result).toBe('plain-string');
+  });
+});

package/src/__tests__/subscriptionRedaction.test.ts

@@ -0,0 +1,217 @@
+/**
+ * Middleware wiring test.
+ *
+ * Locks the assumption that `variablesLoggingMiddleware` correctly:
+ *   - Skips field resolvers (info.path.prev !== undefined)
+ *   - Short-circuits when logVariables=false
+ *   - Emits a redacted variables block when logVariables=true
+ *   - Respects @NoLog field-level marks via the input class lookup
+ *
+ * We invoke the middleware directly with a synthetic ResolverData rather than booting a real
+ * GraphQL execution — that would force two copies of `graphql` (CJS via type-graphql + ESM via
+ * the test runner) into the same realm and fail with "Cannot use GraphQLSchema from another
+ * module or realm." The wiring at schema-build time (which IS what we want to lock for future
+ * type-graphql upgrades) is exercised in the end-to-end verification described in the PRD;
+ * here we just lock the per-call redaction logic.
+ *
+ * `globalMiddlewares` covers `@Query`, `@Mutation`, and `@Subscription` resolvers identically
+ * — they all go through the same `applyMiddlewares` chain inside type-graphql. Asserting the
+ * middleware fires once for a representative root resolver covers all three.
+ */
+import 'reflect-metadata';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+vi.mock('../config', () => ({
+  configInfo: {
+    loggingSettings: {
+      graphql: {
+        logVariables: true,
+      },
+    },
+  },
+}));
+vi.mock('../config.js', () => ({
+  configInfo: {
+    loggingSettings: {
+      graphql: {
+        logVariables: true,
+      },
+    },
+  },
+}));
+
+import { variablesLoggingMiddleware } from '../logging/variablesLoggingMiddleware.js';
+
+/**
+ * Build a synthetic GraphQLResolveInfo-shaped object that matches what type-graphql passes
+ * to a middleware at runtime. Only the subset we read is populated.
+ */
+function makeInfo(opts: {
+  fieldName: string;
+  argTypeName: string;
+  argName: string;
+  isFieldResolver?: boolean;
+}): unknown {
+  const fakeArg = {
+    name: opts.argName,
+    type: { name: opts.argTypeName },
+  };
+  const fakeField = {
+    args: [fakeArg],
+  };
+  const parentType = {
+    getFields: () => ({ [opts.fieldName]: fakeField }),
+  };
+  const path = opts.isFieldResolver
+    ? { prev: { prev: undefined, key: 'parent' }, key: opts.fieldName }
+    : { prev: undefined, key: opts.fieldName };
+  return {
+    fieldName: opts.fieldName,
+    parentType,
+    path,
+  };
+}
+
+// Stub `getNamedType` is unnecessary — middleware uses graphql's `getNamedType` against the
+// type we pass. Our `argTypeName` value is wrapped in a plain `{ name }` object below; we need
+// the middleware's `getNamedType` to read `.name` directly. The `graphql` library's
+// `getNamedType` unwraps NonNull/List wrappers; a plain `{ name }` object survives unwrapping
+// because none of those wrapper shapes are present.
+
+describe('variablesLoggingMiddleware', () => {
+  let dirSpy: ReturnType<typeof vi.spyOn>;
+  let warnSpy: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    dirSpy = vi.spyOn(console, 'dir').mockImplementation(() => {});
+    warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    dirSpy.mockRestore();
+    warnSpy.mockRestore();
+  });
+
+  it('skips field resolvers (info.path.prev !== undefined) without logging', async () => {
+    const next = vi.fn(async () => 'next-result');
+    const result = await variablesLoggingMiddleware(
+      {
+        root: undefined,
+        args: { x: 1 },
+        context: {} as never,
+        info: makeInfo({
+          fieldName: 'nestedThing',
+          argTypeName: 'CreateMJCredentialInput',
+          argName: 'input',
+          isFieldResolver: true,
+        }) as never,
+      },
+      next,
+    );
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(result).toBe('next-result');
+    expect(dirSpy).not.toHaveBeenCalled();
+  });
+
+  it('emits a redacted variables block for a root resolver with an entity-bound CRUD input', async () => {
+    const next = vi.fn(async () => 'next-result');
+    const fakeProvider = {
+      Entities: [
+        { ClassName: 'MJCredential', EncryptedFields: [{ Name: 'Values' }] },
+      ],
+    };
+
+    await variablesLoggingMiddleware(
+      {
+        root: undefined,
+        args: { input: { ID: 'abc', Name: 'HubSpot', Values: 'FAKE_SECRET' } },
+        context: {
+          providers: [{ provider: fakeProvider, type: 'Read-Write' }],
+        } as never,
+        info: makeInfo({
+          fieldName: 'CreateMJCredential',
+          argTypeName: 'CreateMJCredentialInput',
+          argName: 'input',
+        }) as never,
+      },
+      next,
+    );
+
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(dirSpy).toHaveBeenCalledTimes(1);
+    const [logged] = dirSpy.mock.calls[0];
+    expect(logged).toEqual({
+      operation: 'CreateMJCredential',
+      args: {
+        input: {
+          ID: 'abc',
+          Name: 'HubSpot',
+          Values: '<redacted>',
+        },
+      },
+    });
+  });
+
+  it('logs a custom-resolver plaintext arg (no metadata redaction available for it)', async () => {
+    const next = vi.fn(async () => undefined);
+    // Populate Entities (non-empty) so the redactor does not fall into the bootstrap fail-closed branch.
+    // The String-typed arg doesn't match Create/Update<X>Input, so it falls through to shortenForLog.
+    const fakeProvider = {
+      Entities: [{ ClassName: 'SomeUnrelatedEntity', EncryptedFields: [] }],
+    };
+
+    await variablesLoggingMiddleware(
+      {
+        root: undefined,
+        args: { token: 'plaintext-leak' },
+        context: {
+          providers: [{ provider: fakeProvider, type: 'Read-Write' }],
+        } as never,
+        info: makeInfo({
+          fieldName: 'VoiceTestHubSpotCredential',
+          argTypeName: 'String',
+          argName: 'token',
+        }) as never,
+      },
+      next,
+    );
+
+    expect(dirSpy).toHaveBeenCalledTimes(1);
+    // Arg is logged as-is because String type doesn't match Create/Update<X>Input, so the
+    // redactor's fail-open branch passes the value through shortenForLog (plain string passthrough).
+    // This is the gap that @NoLog discipline plus the boot audit are designed to surface.
+    const [logged] = dirSpy.mock.calls[0];
+    expect(logged).toMatchObject({
+      operation: 'VoiceTestHubSpotCredential',
+      args: { token: 'plaintext-leak' },
+    });
+  });
+
+  it('fails closed (<metadata-not-ready>) when provider.Entities is empty', async () => {
+    const next = vi.fn(async () => undefined);
+    const fakeProvider = { Entities: [] };
+
+    await variablesLoggingMiddleware(
+      {
+        root: undefined,
+        args: { input: { Values: 'FAKE_SECRET' } },
+        context: {
+          providers: [{ provider: fakeProvider, type: 'Read-Write' }],
+        } as never,
+        info: makeInfo({
+          fieldName: 'CreateMJCredential',
+          argTypeName: 'CreateMJCredentialInput',
+          argName: 'input',
+        }) as never,
+      },
+      next,
+    );
+
+    expect(dirSpy).toHaveBeenCalledTimes(1);
+    const [logged] = dirSpy.mock.calls[0];
+    expect(logged).toEqual({
+      operation: 'CreateMJCredential',
+      args: { input: '<metadata-not-ready>' },
+    });
+  });
+});