@memberjunction/server 5.38.0 → 5.40.0

package/src/__tests__/getDataTokenRedaction.test.ts

@@ -0,0 +1,84 @@
+import 'reflect-metadata';
+import { describe, it, expect } from 'vitest';
+import type { IMetadataProvider } from '@memberjunction/core';
+import { redactArg } from '../logging/secretRedactor.js';
+import { NoLog, getNoLogFields } from '../logging/NoLog.js';
+
+/**
+ * Test 4 (unit form): the `@NoLog`-decorated `Token` field on GetDataInputType is redacted
+ * from verbose logs, while the non-sensitive `Queries` field passes through.
+ *
+ * GetData is @RequireSystemUser (system-user-only), so this is verified at the redactor level
+ * rather than via a live request. It exercises the field-level @NoLog path: the middleware
+ * collects @NoLog field names via getNoLogFields() and passes them to redactArg as noLogFields.
+ *
+ * GetDataInputType is NOT a Create/Update/Delete*Input, so it fails the entity-binding regex and
+ * would otherwise pass through whole — the @NoLog field set is the ONLY thing protecting Token here.
+ * That's exactly the case @NoLog exists for: sensitive args metadata cannot identify.
+ */
+describe('Test 4: GetData Token redaction via field-level @NoLog', () => {
+  // Mirror the real GetDataInputType shape and apply @NoLog to Token at field level, as the source does.
+  class GetDataInputType {
+    Token = '';
+    Queries: string[] = [];
+  }
+  NoLog(GetDataInputType.prototype, 'Token');
+
+  const provider = { Entities: [] } as unknown as IMetadataProvider;
+
+  it('getNoLogFields picks up the Token field mark', () => {
+    const fields = getNoLogFields(GetDataInputType);
+    expect(fields.has('Token')).toBe(true);
+    expect(fields.has('Queries')).toBe(false);
+  });
+
+  it('masks field-level @NoLog Token on a NON-entity-bound input (the real GetData case)', () => {
+    // GetDataInput does NOT match Create/Update/Delete*Input. This is the exact case @NoLog exists
+    // for: a custom resolver input metadata cannot identify. The redactor must still honor the
+    // field-level @NoLog set and mask Token, while passing the non-sensitive Queries through.
+    const providerWithEntities = {
+      Entities: [{ ClassName: 'Something', EncryptedFields: [] }],
+    } as unknown as IMetadataProvider;
+
+    const result = redactArg({
+      inputTypeName: 'GetDataInput', // not entity-bound — regex won't match
+      rawValue: { Token: 'FAKE_SYSTEM_TOKEN_DO_NOT_USE', Queries: ['SELECT 1', 'SELECT 2'] },
+      provider: providerWithEntities,
+      noLogParameter: false,
+      noLogFields: getNoLogFields(GetDataInputType),
+    });
+
+    expect(result).toEqual({ Token: '<redacted>', Queries: ['SELECT 1', 'SELECT 2'] });
+    expect(JSON.stringify(result)).not.toContain('FAKE_SYSTEM_TOKEN_DO_NOT_USE');
+  });
+
+  it('redactArg masks Token field-by-field when input IS entity-bound (noLogFields wins over metadata)', () => {
+    // When the input type maps to an entity, redactArg walks top-level keys and applies noLogFields.
+    const providerWithEntity = {
+      Entities: [{ ClassName: 'GetDataThing', EncryptedFields: [] }],
+    } as unknown as IMetadataProvider;
+
+    const result = redactArg({
+      inputTypeName: 'CreateGetDataThingInput',
+      rawValue: { Token: 'FAKE_SYSTEM_TOKEN_DO_NOT_USE', Queries: ['SELECT 1'] },
+      provider: providerWithEntity,
+      noLogParameter: false,
+      noLogFields: new Set(['Token']),
+    });
+
+    expect(result).toEqual({ Token: '<redacted>', Queries: ['SELECT 1'] });
+    expect(JSON.stringify(result)).not.toContain('FAKE_SYSTEM_TOKEN_DO_NOT_USE');
+  });
+
+  it('parameter-level @NoLog masks the entire arg regardless of shape', () => {
+    // If Token were a top-level @Arg with @NoLog (parameter form), noLogParameter=true masks it whole.
+    const result = redactArg({
+      inputTypeName: 'String',
+      rawValue: 'FAKE_SYSTEM_TOKEN_DO_NOT_USE',
+      provider,
+      noLogParameter: true,
+      noLogFields: new Set(),
+    });
+    expect(result).toBe('<redacted>');
+  });
+});

package/src/__tests__/magicLink.test.ts

@@ -0,0 +1,387 @@
+import { describe, it, expect } from 'vitest';
+import jwt from 'jsonwebtoken';
+import { createPublicKey } from 'node:crypto';
+import {
+  generateRawToken,
+  hashToken,
+  evaluateInvite,
+  buildSessionClaims,
+  buildConsumeInviteSQL,
+  canIssueInvites,
+  isRoleGrantable,
+  unionScopes,
+  MAGIC_LINK_TOKEN_PREFIX,
+} from '../auth/magicLink/magicLinkCore.js';
+import { buildRedeemLandingHtml, escapeHtml } from '../auth/magicLink/redeemLanding.js';
+import { MagicLinkKeyManager } from '../auth/magicLink/MagicLinkKeys.js';
+
+describe('magic-link core', () => {
+  describe('generateRawToken', () => {
+    it('prefixes tokens and uses 32 bytes of hex entropy', () => {
+      const t = generateRawToken();
+      expect(t.startsWith(MAGIC_LINK_TOKEN_PREFIX)).toBe(true);
+      const body = t.slice(MAGIC_LINK_TOKEN_PREFIX.length);
+      expect(body).toMatch(/^[0-9a-f]{64}$/);
+    });
+
+    it('produces unique tokens', () => {
+      const set = new Set(Array.from({ length: 100 }, () => generateRawToken()));
+      expect(set.size).toBe(100);
+    });
+  });
+
+  describe('hashToken', () => {
+    it('is deterministic and base64url-encoded sha256 (43 chars, URL-safe alphabet)', () => {
+      const raw = 'mj_ml_abc';
+      expect(hashToken(raw)).toBe(hashToken(raw));
+      // base64url of 32 bytes = 43 chars, no padding, only [A-Za-z0-9_-]
+      expect(hashToken(raw)).toMatch(/^[A-Za-z0-9_-]{43}$/);
+    });
+
+    it('differs for different inputs and never equals the raw token', () => {
+      const raw = generateRawToken();
+      expect(hashToken(raw)).not.toBe(hashToken(generateRawToken()));
+      expect(hashToken(raw)).not.toBe(raw);
+    });
+  });
+
+  describe('evaluateInvite', () => {
+    const now = Date.UTC(2026, 0, 1);
+    const future = new Date(now + 3600_000);
+    const past = new Date(now - 3600_000);
+
+    it('accepts an active, unexpired, unused invite', () => {
+      expect(evaluateInvite({ Status: 'Active', ExpiresAt: future, MaxUses: 1, UseCount: 0 }, now)).toEqual({ ok: true });
+    });
+
+    it('rejects revoked invites first', () => {
+      expect(evaluateInvite({ Status: 'Revoked', ExpiresAt: future, MaxUses: 1, UseCount: 0 }, now)).toEqual({ ok: false, errorCode: 'revoked' });
+    });
+
+    it('rejects expired invites', () => {
+      expect(evaluateInvite({ Status: 'Active', ExpiresAt: past, MaxUses: 1, UseCount: 0 }, now)).toEqual({ ok: false, errorCode: 'expired' });
+    });
+
+    it('rejects consumed invites (by status)', () => {
+      expect(evaluateInvite({ Status: 'Consumed', ExpiresAt: future, MaxUses: 1, UseCount: 1 }, now)).toEqual({ ok: false, errorCode: 'consumed' });
+    });
+
+    it('rejects when use count reaches max', () => {
+      expect(evaluateInvite({ Status: 'Active', ExpiresAt: future, MaxUses: 3, UseCount: 3 }, now)).toEqual({ ok: false, errorCode: 'consumed' });
+    });
+
+    it('allows multi-use invites that still have uses left', () => {
+      expect(evaluateInvite({ Status: 'Active', ExpiresAt: future, MaxUses: 3, UseCount: 2 }, now)).toEqual({ ok: true });
+    });
+
+    it('rejects unknown statuses as invalid', () => {
+      expect(evaluateInvite({ Status: 'Pending', ExpiresAt: future, MaxUses: 1, UseCount: 0 }, now)).toEqual({ ok: false, errorCode: 'invalid' });
+    });
+  });
+
+  describe('buildSessionClaims', () => {
+    it('scopes the token to exactly the given app and role and marks it magic-link', () => {
+      const claims = buildSessionClaims({
+        issuer: 'http://localhost:4051',
+        audience: 'mj-magic-link',
+        inviteId: 'INVITE-1',
+        email: 'ext@client.com',
+        firstName: 'Ext',
+        lastName: 'User',
+        applicationId: 'APP-1',
+        roleName: 'Magic Link Baseline',
+        nowSeconds: 1000,
+        ttlSeconds: 3600,
+      });
+      expect(claims.mj_app_id).toBe('APP-1');
+      expect(claims.mj_role).toBe('Magic Link Baseline');
+      expect(claims.mj_magic_link).toBe(true);
+      expect(claims.sub).toBe('magic-link|INVITE-1');
+      expect(claims.exp - claims.iat).toBe(3600);
+      expect(claims.email).toBe('ext@client.com');
+      expect(claims.name).toBe('Ext User');
+    });
+
+    it('carries mj_invited_by when an inviter is supplied (attribution claim)', () => {
+      const claims = buildSessionClaims({
+        issuer: 'i', audience: 'a', inviteId: 'INVITE-1', email: 'e@x.com',
+        applicationId: 'APP-1', roleName: 'Magic Link Baseline',
+        invitedByUserId: 'USER-42', nowSeconds: 1000, ttlSeconds: 3600,
+      });
+      expect(claims.mj_invited_by).toBe('USER-42');
+    });
+
+    it('omits mj_invited_by when no inviter is supplied', () => {
+      const claims = buildSessionClaims({
+        issuer: 'i', audience: 'a', inviteId: 'INVITE-1', email: 'e@x.com',
+        applicationId: 'APP-1', roleName: 'Magic Link Baseline',
+        nowSeconds: 1000, ttlSeconds: 3600,
+      });
+      expect(claims.mj_invited_by).toBeUndefined();
+    });
+
+    it('always emits a single-entry mj_scopes for the current link', () => {
+      const claims = buildSessionClaims({
+        issuer: 'i', audience: 'a', inviteId: 'INVITE-1', email: 'e@x.com',
+        applicationId: 'APP-1', roleName: 'Magic Link Baseline', nowSeconds: 1000, ttlSeconds: 3600,
+      });
+      expect(claims.mj_scopes).toEqual([{ inviteId: 'INVITE-1', appId: 'APP-1', role: 'Magic Link Baseline', resourceType: undefined, resourceId: undefined }]);
+    });
+
+    it('marks anonymous sessions and carries the per-session id + prior-scope union', () => {
+      const claims = buildSessionClaims({
+        issuer: 'i', audience: 'a', inviteId: 'INVITE-2', email: 'anon@x',
+        applicationId: 'APP-2', roleName: 'Guest', anonymous: true, sessionId: 'SID-9',
+        priorScopes: [{ inviteId: 'INVITE-1', appId: 'APP-1', role: 'Guest' }],
+        nowSeconds: 1000, ttlSeconds: 3600,
+      });
+      expect(claims.mj_anon).toBe(true);
+      expect(claims.mj_sid).toBe('SID-9');
+      // union = prior + this link, both apps present, no accretion duplicate
+      expect(claims.mj_scopes?.map((s) => s.appId).sort()).toEqual(['APP-1', 'APP-2']);
+    });
+
+    it('does NOT mark mj_anon for email sessions', () => {
+      const claims = buildSessionClaims({
+        issuer: 'i', audience: 'a', inviteId: 'INVITE-1', email: 'e@x.com',
+        applicationId: 'APP-1', roleName: 'Magic Link Baseline', nowSeconds: 1000, ttlSeconds: 3600,
+      });
+      expect(claims.mj_anon).toBeUndefined();
+    });
+  });
+
+  describe('unionScopes', () => {
+    const a = { inviteId: 'I1', appId: 'A1', role: 'R' };
+    const b = { inviteId: 'I2', appId: 'A2', role: 'R' };
+
+    it('appends a new scope entry', () => {
+      expect(unionScopes([a], b)).toEqual([a, b]);
+    });
+
+    it('is idempotent by inviteId — re-redeeming the same link never accretes a duplicate', () => {
+      expect(unionScopes([a, b], { inviteId: 'I1', appId: 'A1', role: 'R' })).toEqual([a, b]);
+    });
+
+    it('handles an empty/undefined prior union', () => {
+      expect(unionScopes(undefined, a)).toEqual([a]);
+      expect(unionScopes([], a)).toEqual([a]);
+    });
+  });
+
+  describe('buildConsumeInviteSQL', () => {
+    const table = '[__mj].[MagicLinkInvite]';
+    const sql = buildConsumeInviteSQL(table);
+
+    it('targets the supplied qualified table', () => {
+      expect(sql).toContain(`UPDATE ${table} `);
+    });
+
+    it('increments UseCount', () => {
+      expect(sql).toContain('UseCount = UseCount + 1');
+    });
+
+    it('stamps ConsumedAt only the first time (COALESCE preserves an existing value)', () => {
+      expect(sql).toContain('ConsumedAt = COALESCE(ConsumedAt, SYSUTCDATETIME())');
+    });
+
+    it('flips Status to Consumed exactly when the last use is taken', () => {
+      expect(sql).toContain("Status = CASE WHEN UseCount + 1 >= MaxUses THEN 'Consumed' ELSE Status END");
+    });
+
+    it('returns the affected row via OUTPUT INTO a table var so the caller can detect a win (exactly one row)', () => {
+      // Must be OUTPUT ... INTO, not a bare OUTPUT: SQL Server forbids a bare
+      // OUTPUT clause on a table with enabled triggers, and CodeGen adds an
+      // __mj_UpdatedAt trigger to every MJ table. Regression guard for that bug.
+      expect(sql).toContain('OUTPUT INSERTED.ID INTO @consumed');
+      expect(sql).not.toMatch(/OUTPUT INSERTED\.ID(?!\s+INTO)/);
+      expect(sql).toContain('SELECT ID FROM @consumed');
+    });
+
+    it('guards atomically on Active + not-exhausted + not-expired — this IS the single-use gate', () => {
+      const where = sql.slice(sql.indexOf('WHERE'));
+      expect(where).toContain("Status = 'Active'");
+      expect(where).toContain('UseCount < MaxUses');
+      expect(where).toContain('ExpiresAt > SYSUTCDATETIME()');
+    });
+
+    it('binds the invite ID as a parameter, never interpolated (injection-safe)', () => {
+      expect(sql).toContain('ID = @p0');
+      // The id must not be string-interpolated with quotes around a value.
+      expect(sql).not.toMatch(/ID = '/);
+    });
+
+    it('is a self-contained batch: declare table var, update-with-output, select', () => {
+      // Intentionally a 3-statement batch (the OUTPUT-INTO requirement). The ID is
+      // still parameterized, so the batch carries no interpolated user input.
+      expect(sql).toContain('DECLARE @consumed TABLE (ID UNIQUEIDENTIFIER)');
+      expect(sql.match(/;/g)?.length).toBe(3);
+      expect(sql.trim().endsWith(';')).toBe(true);
+    });
+
+    it('rejects a non-whitelisted table identifier (defense-in-depth against injection)', () => {
+      // Only bracket-quoted [schema].[table] of word chars is accepted, even though
+      // the caller derives the table from EntityInfo and never from user input.
+      expect(() => buildConsumeInviteSQL('__mj.MagicLinkInvite')).toThrow();
+      expect(() => buildConsumeInviteSQL('[__mj].[MagicLinkInvite]; DROP TABLE x;--')).toThrow();
+      expect(() => buildConsumeInviteSQL('[__mj].[Magic Link]')).toThrow();
+      expect(() => buildConsumeInviteSQL(table)).not.toThrow();
+    });
+  });
+
+  describe('canIssueInvites', () => {
+    it('always allows Owners, regardless of issuer-role config (case/space-insensitive)', () => {
+      expect(canIssueInvites('Owner', [], [])).toBe(true);
+      expect(canIssueInvites('  owner ', [], [])).toBe(true);
+    });
+
+    it('Owner-only by default: a non-Owner with no configured issuer roles is denied', () => {
+      expect(canIssueInvites('User', ['Developer', 'Magic Link Baseline'], [])).toBe(false);
+    });
+
+    it('denies an external user holding the restricted role (the escalation we are blocking)', () => {
+      // restricted role is never an issuer role, so this stays false even if someone
+      // mistakenly leaves issuerRoleNames empty
+      expect(canIssueInvites('User', ['Magic Link Baseline'], [])).toBe(false);
+    });
+
+    it('allows a non-Owner only when one of their roles is a configured issuer role', () => {
+      expect(canIssueInvites('User', ['Sales Admin'], ['Sales Admin'])).toBe(true);
+      expect(canIssueInvites('User', ['sales admin'], ['Sales Admin'])).toBe(true); // case-insensitive
+      expect(canIssueInvites('User', ['Marketing'], ['Sales Admin'])).toBe(false);
+    });
+
+    it('handles null/undefined type and empty role lists safely', () => {
+      expect(canIssueInvites(null, [], ['X'])).toBe(false);
+      expect(canIssueInvites(undefined, ['X'], ['X'])).toBe(true);
+    });
+  });
+
+  describe('isRoleGrantable', () => {
+    const restricted = 'Magic Link Baseline';
+
+    it('always allows the restricted role (case/space-insensitive)', () => {
+      expect(isRoleGrantable('Magic Link Baseline', restricted, [])).toBe(true);
+      expect(isRoleGrantable(' magic link baseline ', restricted, [])).toBe(true);
+    });
+
+    it('rejects a privileged role by default — blocks roleId=Owner escalation', () => {
+      expect(isRoleGrantable('Owner', restricted, [])).toBe(false);
+      expect(isRoleGrantable('Administrator', restricted, [])).toBe(false);
+    });
+
+    it('allows additional roles only when explicitly opted in', () => {
+      expect(isRoleGrantable('Read Only Guest', restricted, ['Read Only Guest'])).toBe(true);
+      expect(isRoleGrantable('read only guest', restricted, ['Read Only Guest'])).toBe(true);
+      expect(isRoleGrantable('Owner', restricted, ['Read Only Guest'])).toBe(false);
+    });
+
+    it('rejects empty/null role names', () => {
+      expect(isRoleGrantable('', restricted, [])).toBe(false);
+      expect(isRoleGrantable(null, restricted, [])).toBe(false);
+    });
+  });
+
+  describe('escapeHtml', () => {
+    it('escapes the five significant HTML characters', () => {
+      expect(escapeHtml(`<>&"'`)).toBe('&lt;&gt;&amp;&quot;&#39;');
+    });
+
+    it('leaves a normal magic-link token untouched', () => {
+      const t = generateRawToken();
+      expect(escapeHtml(t)).toBe(t);
+    });
+  });
+
+  describe('buildRedeemLandingHtml', () => {
+    const token = generateRawToken();
+    const html = buildRedeemLandingHtml(token, '/magic-link/redeem');
+
+    it('renders a POST form to the redeem path (GET stays side-effect-free)', () => {
+      expect(html).toContain('method="POST"');
+      expect(html).toContain('action="/magic-link/redeem"');
+    });
+
+    it('carries the token in a hidden field for the click-to-continue submit', () => {
+      expect(html).toContain(`name="token" value="${token}"`);
+    });
+
+    it('requires a human click — it does NOT auto-submit (defeats link scanners)', () => {
+      expect(html).not.toContain('.submit()');
+      expect(html).not.toContain('onload');
+    });
+
+    it('discourages indexing', () => {
+      expect(html).toContain('name="robots"');
+    });
+
+    it('escapes a token containing HTML metacharacters into the form value', () => {
+      const evil = buildRedeemLandingHtml('a"><script>x</script>', '/magic-link/redeem');
+      expect(evil).not.toContain('<script>x</script>');
+      expect(evil).toContain('&lt;script&gt;');
+    });
+  });
+});
+
+describe('MagicLinkKeyManager', () => {
+  it('mints an RS256 token verifiable against the published JWKS, with a matching kid', () => {
+    const km = MagicLinkKeyManager.Instance;
+    km.Initialize(); // ephemeral keypair
+
+    const claims = buildSessionClaims({
+      issuer: 'http://localhost:4051',
+      audience: 'mj-magic-link',
+      inviteId: 'INVITE-1',
+      email: 'ext@client.com',
+      applicationId: 'APP-1',
+      roleName: 'Magic Link Baseline',
+      nowSeconds: Math.floor(Date.now() / 1000),
+      ttlSeconds: 3600,
+    });
+    const token = km.Sign(claims);
+
+    const jwks = km.GetJWKS();
+    expect(jwks.keys).toHaveLength(1);
+    const jwk = jwks.keys[0];
+    expect(jwk.alg).toBe('RS256');
+    expect(jwk.use).toBe('sig');
+
+    // Token header kid must match the published key id (so jwks-rsa resolves it).
+    const header = (jwt.decode(token, { complete: true }) as { header: { kid?: string; alg?: string } }).header;
+    expect(header.alg).toBe('RS256');
+    expect(header.kid).toBe(jwk.kid);
+
+    // Full verification against the public key reconstructed from the JWK.
+    const publicKey = createPublicKey({ key: jwk as object, format: 'jwk' });
+    const decoded = jwt.verify(token, publicKey, {
+      algorithms: ['RS256'],
+      issuer: 'http://localhost:4051',
+      audience: 'mj-magic-link',
+    }) as Record<string, unknown>;
+    expect(decoded.mj_magic_link).toBe(true);
+    expect(decoded.mj_app_id).toBe('APP-1');
+  });
+
+  it('rejects a tampered token', () => {
+    const km = MagicLinkKeyManager.Instance;
+    km.Initialize();
+    const claims = buildSessionClaims({
+      issuer: 'http://localhost:4051',
+      audience: 'mj-magic-link',
+      inviteId: 'INVITE-2',
+      email: 'ext@client.com',
+      applicationId: 'APP-1',
+      roleName: 'Magic Link Baseline',
+      nowSeconds: Math.floor(Date.now() / 1000),
+      ttlSeconds: 3600,
+    });
+    const token = km.Sign(claims);
+    const publicKey = createPublicKey({ key: km.GetJWKS().keys[0] as object, format: 'jwk' });
+
+    // Flip a character in the payload segment.
+    const parts = token.split('.');
+    parts[1] = parts[1].slice(0, -2) + (parts[1].endsWith('A') ? 'BB' : 'AA');
+    const tampered = parts.join('.');
+
+    expect(() => jwt.verify(tampered, publicKey, { algorithms: ['RS256'] })).toThrow();
+  });
+});

package/src/__tests__/secretRedactor.test.ts

@@ -0,0 +1,163 @@
+import { describe, it, expect } from 'vitest';
+import type { IMetadataProvider } from '@memberjunction/core';
+import { redactArg } from '../logging/secretRedactor.js';
+
+type EncryptedField = { Name: string };
+type FakeEntity = { ClassName: string; EncryptedFields: EncryptedField[] };
+
+function makeProvider(entities: FakeEntity[]): IMetadataProvider {
+  return {
+    Entities: entities,
+  } as unknown as IMetadataProvider;
+}
+
+describe('redactArg', () => {
+  const credentialEntity: FakeEntity = {
+    ClassName: 'MJCredential',
+    EncryptedFields: [{ Name: 'Values' }],
+  };
+  const userEntity: FakeEntity = {
+    ClassName: 'User',
+    EncryptedFields: [],
+  };
+
+  it('returns "<redacted>" when noLogParameter is set, regardless of other inputs', () => {
+    const result = redactArg({
+      inputTypeName: 'CreateMJCredentialInput',
+      rawValue: { Values: 'FAKE_SECRET_VALUE_DO_NOT_USE' },
+      provider: makeProvider([credentialEntity]),
+      noLogParameter: true,
+      noLogFields: new Set(),
+    });
+    expect(result).toBe('<redacted>');
+  });
+
+  it('returns "<metadata-not-ready>" when the provider has no entities (bootstrap window)', () => {
+    const result = redactArg({
+      inputTypeName: 'CreateMJCredentialInput',
+      rawValue: { Values: 'FAKE_SECRET_VALUE_DO_NOT_USE' },
+      provider: makeProvider([]),
+      noLogParameter: false,
+      noLogFields: new Set(),
+    });
+    expect(result).toBe('<metadata-not-ready>');
+  });
+
+  it('fails open (passes through) when input type does not match Create/Update<X>Input regex', () => {
+    const result = redactArg({
+      inputTypeName: 'SomeCustomArgs',
+      rawValue: { accessToken: 'FAKE_TOKEN' },
+      provider: makeProvider([credentialEntity]),
+      noLogParameter: false,
+      noLogFields: new Set(),
+    });
+    expect(result).toEqual('{"accessToken":"FAKE_TOKEN"}');
+  });
+
+  it('fails open when input type matches regex but no entity is found', () => {
+    const result = redactArg({
+      inputTypeName: 'CreateUnknownEntityInput',
+      rawValue: { Foo: 'bar' },
+      provider: makeProvider([credentialEntity]),
+      noLogParameter: false,
+      noLogFields: new Set(),
+    });
+    expect(result).toEqual('{"Foo":"bar"}');
+  });
+
+  it('redacts top-level keys matching EntityFieldInfo.Encrypt=true on entity-bound CRUD inputs', () => {
+    const result = redactArg({
+      inputTypeName: 'CreateMJCredentialInput',
+      rawValue: { ID: 'abc-123', Name: 'HubSpot', Values: 'FAKE_SECRET_VALUE_DO_NOT_USE' },
+      provider: makeProvider([credentialEntity]),
+      noLogParameter: false,
+      noLogFields: new Set(),
+    });
+    expect(result).toEqual({
+      ID: 'abc-123',
+      Name: 'HubSpot',
+      Values: '<redacted>',
+    });
+  });
+
+  it('redacts top-level keys in noLogFields even when EncryptedFields does not include them', () => {
+    const result = redactArg({
+      inputTypeName: 'CreateUserInput',
+      rawValue: { Name: 'Alice', SecretToken: 'oops' },
+      provider: makeProvider([userEntity]),
+      noLogParameter: false,
+      noLogFields: new Set(['SecretToken']),
+    });
+    expect(result).toEqual({
+      Name: 'Alice',
+      SecretToken: '<redacted>',
+    });
+  });
+
+  it('Update<X>Input is also handled (not just Create<X>Input)', () => {
+    const result = redactArg({
+      inputTypeName: 'UpdateMJCredentialInput',
+      rawValue: { ID: 'abc-123', Values: 'NEW_FAKE_SECRET' },
+      provider: makeProvider([credentialEntity]),
+      noLogParameter: false,
+      noLogFields: new Set(),
+    });
+    expect(result).toEqual({
+      ID: 'abc-123',
+      Values: '<redacted>',
+    });
+  });
+
+  it('Delete<X>Input resolves to its entity and walks keys (PK only — no encrypted values to redact)', () => {
+    // Delete is matched by the regex (alongside Create/Update) so the boot audit treats DeleteMJ*
+    // resolvers as metadata-bound instead of flooding with false positives. Security is identical:
+    // delete inputs carry PK + Options only — no encrypted field, so nothing is redacted, the keys
+    // just pass through. See docs/adr/0001-graphql-variables-logging-tiered-by-verbose.md.
+    const result = redactArg({
+      inputTypeName: 'DeleteMJCredentialInput',
+      rawValue: { ID: 'abc-123' },
+      provider: makeProvider([credentialEntity]),
+      noLogParameter: false,
+      noLogFields: new Set(),
+    });
+    expect(result).toEqual({ ID: 'abc-123' });
+  });
+
+  it('Delete<X>Input never exposes an encrypted value even if one were somehow present', () => {
+    // Defense-in-depth: even if a delete input carried an encrypted field name, it must still mask.
+    const result = redactArg({
+      inputTypeName: 'DeleteMJCredentialInput',
+      rawValue: { ID: 'abc-123', Values: 'FAKE_SECRET_VALUE_DO_NOT_USE' },
+      provider: makeProvider([credentialEntity]),
+      noLogParameter: false,
+      noLogFields: new Set(),
+    });
+    expect(result).toEqual({ ID: 'abc-123', Values: '<redacted>' });
+  });
+
+  it('only walks TOP-level keys — nested objects with encrypted-field names are not recursed', () => {
+    const result = redactArg({
+      inputTypeName: 'CreateMJCredentialInput',
+      rawValue: {
+        Name: 'HubSpot',
+        Nested: { Values: 'NESTED_FAKE_SECRET' },
+      },
+      provider: makeProvider([credentialEntity]),
+      noLogParameter: false,
+      noLogFields: new Set(),
+    });
+    // Top-level `Values` would be redacted; nested `Values` is not.
+    expect((result as Record<string, unknown>).Nested).toEqual('{"Values":"NESTED_FAKE_SECRET"}');
+  });
+
+  it('passes non-object raw values through to shortenForLog', () => {
+    const result = redactArg({
+      inputTypeName: 'CreateMJCredentialInput',
+      rawValue: 'plain-string',
+      provider: makeProvider([credentialEntity]),
+      noLogParameter: false,
+      noLogFields: new Set(),
+    });
+    expect(result).toBe('plain-string');
+  });
+});