@memberjunction/server 5.47.0 → 5.49.0

package/src/__tests__/AdhocQueryResolver.pagination.test.ts

@@ -0,0 +1,114 @@
+/**
+ * Regression suite for the AdhocQueryResolver pagination / total-row-count bug.
+ *
+ * Bug #4 — First-page ad-hoc queries reported a TotalRowCount equal to the
+ *          returned page size, so the artifact viewer's pager never appeared
+ *          and a >100-row result looked like it only had 100 rows.
+ *
+ *          Two compounding causes in ExecuteAdhocQuery:
+ *            1. `usePaging` required `startRow > 0`, so page 1 (StartRow 0)
+ *               fell back to a TOP-N hard cap instead of OFFSET/FETCH paging.
+ *            2. `TotalRowCount` was set to `recordset.length` (the capped page),
+ *               with no COUNT(*) query — so the true total was never computed.
+ *
+ *          The fix pages whenever `MaxRows > 0` (including StartRow 0) and reads
+ *          the true total from the RenderPipeline's PagingResult.CountSQL —
+ *          matching the saved-query path (GenericDatabaseProvider → WrapWithPaging).
+ *
+ * Same hybrid strategy as AdhocQueryResolver.bugs.test.ts:
+ *   1. Source-shape contract tests — assert structural properties of the fix.
+ *   2. Pipeline behavior tests — exercise RenderPipeline.Run with the exact
+ *      first-page inputs the resolver now relies on (data OFFSET/FETCH + count).
+ */
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { readFileSync } from 'fs';
+import { resolve } from 'path';
+import { Metadata } from '@memberjunction/core';
+import { RenderPipeline } from '@memberjunction/generic-database-provider';
+
+const ADHOC_RESOLVER_PATH = resolve(__dirname, '../resolvers/AdhocQueryResolver.ts');
+
+function readResolverSource(): string {
+    return readFileSync(ADHOC_RESOLVER_PATH, 'utf8');
+}
+
+function stubMetadata(): void {
+    vi.spyOn(Metadata, 'Provider', 'get').mockReturnValue({
+        Queries: [],
+        QueryDependencies: [],
+    } as ReturnType<typeof Metadata.Provider>);
+}
+
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+
+// The real-world query from the bug report: no top-level TOP, an ORDER BY,
+// ~2,087 rows in production, requested as page 1 (StartRow 0, MaxRows 100).
+const BUG_REPORT_SQL = `SELECT
+    d.ID,
+    d.Title,
+    d.Value,
+    ISNULL(d.DealStage, 'Open (Unspecified)') AS DealStage
+FROM crm.vwDeals d
+WHERE
+    d.IsDeleted = 0
+    AND (d.DealStage NOT IN ('Closed won', 'Closed lost') OR d.DealStage IS NULL)
+ORDER BY
+    d.Value DESC,
+    d.CloseDate ASC`;
+
+// ════════════════════════════════════════════════════════════════════
+// Source-shape contract tests
+// ════════════════════════════════════════════════════════════════════
+
+describe('AdhocQueryResolver pagination source-shape contract', () => {
+
+    it('must NOT gate paging on `startRow > 0` (page 1 must still page)', () => {
+        const src = readResolverSource();
+        // The bug: `usePaging = ... && startRow > 0`. After the fix, first-page
+        // requests (StartRow 0) must page too, so no `startRow > 0` guard remains.
+        expect(/startRow\s*>\s*0/.test(src)).toBe(false);
+    });
+
+    it('must derive TotalRowCount from a COUNT query, not the returned page length', () => {
+        const src = readResolverSource();
+        // The bug: `TotalRowCount: recordset.length`. After the fix, the total
+        // comes from the count query (via a resolved variable), never directly
+        // from the page recordset length.
+        expect(/TotalRowCount:\s*recordset\.length/.test(src)).toBe(false);
+    });
+
+    it('must consume the RenderPipeline PagingResult.CountSQL', () => {
+        const src = readResolverSource();
+        expect(/PagingResult\??\.CountSQL/.test(src)).toBe(true);
+    });
+});
+
+// ════════════════════════════════════════════════════════════════════
+// Pipeline behavior — first page (StartRow 0) yields data + count SQL
+// ════════════════════════════════════════════════════════════════════
+
+describe('RenderPipeline first-page paging (the contract the resolver relies on)', () => {
+
+    it('StartRow 0 + MaxRows 100 produces a PagingResult with OFFSET/FETCH data SQL AND a COUNT(*) count SQL', () => {
+        stubMetadata();
+
+        const result = RenderPipeline.Run(BUG_REPORT_SQL, {
+            Platform: 'sqlserver',
+            Paging: { StartRow: 0, MaxRows: 100 },
+        });
+
+        // Paging must be applied even at StartRow 0 (the bug caused it to be skipped).
+        expect(result.PagingResult).not.toBeNull();
+
+        // Data SQL: OFFSET/FETCH at the first page, preserving the query's ORDER BY.
+        expect(result.FinalSQL).toMatch(/OFFSET\s+0\s+ROWS\s+FETCH\s+NEXT\s+100\s+ROWS\s+ONLY/i);
+        expect(result.PagingResult!.DataSQL).toMatch(/OFFSET\s+0\s+ROWS\s+FETCH\s+NEXT\s+100\s+ROWS\s+ONLY/i);
+
+        // Count SQL: a COUNT(*) over the full (uncapped) set — the true total the
+        // viewer's pager needs. It must NOT carry the page's OFFSET/FETCH cap.
+        expect(result.PagingResult!.CountSQL).toMatch(/COUNT\(\*\)\s+AS\s+TotalRowCount/i);
+        expect(result.PagingResult!.CountSQL).not.toMatch(/FETCH\s+NEXT\s+100\s+ROWS/i);
+    });
+});

package/src/__tests__/EntityMapLifecycle.dagWarnings.test.ts

@@ -0,0 +1,91 @@
+import { describe, it, expect } from 'vitest';
+import { ComputeCascadeRemovalSet, ComputeRemovedDependencyWarnings } from '../integration/EntityMapLifecycle.js';
+
+/**
+ * rsuplan "adding and removing tables": removing a table another table relies on must NOT
+ * auto-remove the dependent — the broken edge is surfaced as a warning so a consumer can
+ * prompt a force-remove (or re-add). These tests pin the pure decision function.
+ */
+describe('ComputeRemovedDependencyWarnings', () => {
+    const parents = new Map<string, string[]>([
+        ['orders', ['Customers']],          // Orders depends on Customers
+        ['orderitems', ['Orders', 'Products']],
+        ['customers', []],
+        ['products', []],
+    ]);
+
+    it('warns for each still-active object that depends on a removed object', () => {
+        const w = ComputeRemovedDependencyWarnings(['Orders', 'OrderItems', 'Products'], ['Customers'], parents);
+        expect(w).toHaveLength(1);
+        expect(w[0]).toContain("'Orders'");
+        expect(w[0]).toContain("'Customers'");
+        expect(w[0]).toContain('force-remove');
+    });
+
+    it('lists every removed parent an active object depends on', () => {
+        const w = ComputeRemovedDependencyWarnings(['OrderItems'], ['Orders', 'Products'], parents);
+        expect(w).toHaveLength(1);
+        expect(w[0]).toContain("'Orders'");
+        expect(w[0]).toContain("'Products'");
+    });
+
+    it('is case-insensitive on both sides of the edge', () => {
+        const w = ComputeRemovedDependencyWarnings(['ORDERS'], ['customers'], parents);
+        expect(w).toHaveLength(1);
+    });
+
+    it('returns nothing when no active object depends on a removed one (leaf removal is clean)', () => {
+        expect(ComputeRemovedDependencyWarnings(['Customers', 'Products'], ['Orders'], parents)).toEqual([]);
+    });
+
+    it('returns nothing when nothing was removed or nothing remains active', () => {
+        expect(ComputeRemovedDependencyWarnings(['Orders'], [], parents)).toEqual([]);
+        expect(ComputeRemovedDependencyWarnings([], ['Customers'], parents)).toEqual([]);
+    });
+
+    it('tolerates objects absent from the dependency map (no persisted IO row)', () => {
+        expect(ComputeRemovedDependencyWarnings(['UnknownThing'], ['Customers'], parents)).toEqual([]);
+    });
+});
+
+/**
+ * rsuplan force-remove: "a consumer may want the user to force remove those too" — the
+ * transitive closure of dependents that cascades with a removed object when the caller opts in.
+ */
+describe('ComputeCascadeRemovalSet', () => {
+    const parents = new Map<string, string[]>([
+        ['orders', ['Customers']],
+        ['orderitems', ['Orders', 'Products']],
+        ['shipments', ['OrderItems']],          // 3 levels deep
+        ['customers', []],
+        ['products', []],
+    ]);
+
+    it('cascades direct dependents of a removed object', () => {
+        const c = ComputeCascadeRemovalSet(['Orders', 'Products', 'Customers'], ['Products'], parents);
+        // Orders depends on Customers (kept) — only OrderItems-style dependents of Products cascade;
+        // here Orders does NOT depend on Products, so nothing cascades except true dependents.
+        expect(c).toEqual([]);
+    });
+
+    it('cascades the FULL transitive closure (removed → dependent → its dependent …)', () => {
+        const c = ComputeCascadeRemovalSet(['Orders', 'OrderItems', 'Shipments', 'Products'], ['Customers'], parents);
+        // Customers removed → Orders cascades → OrderItems (depends on Orders) → Shipments (depends on OrderItems)
+        expect(c).toEqual(['Orders', 'OrderItems', 'Shipments']);
+    });
+
+    it('is case-insensitive across edges', () => {
+        const c = ComputeCascadeRemovalSet(['ORDERS'], ['customers'], parents);
+        expect(c).toEqual(['ORDERS']);
+    });
+
+    it('returns nothing when nothing was removed or nothing depends on the removed', () => {
+        expect(ComputeCascadeRemovalSet(['Orders'], [], parents)).toEqual([]);
+        expect(ComputeCascadeRemovalSet(['Customers', 'Products'], ['Orders'], parents)).toEqual([]);
+    });
+
+    it('never cascades an object that is itself already removed', () => {
+        const c = ComputeCascadeRemovalSet(['Orders', 'OrderItems'], ['Customers', 'Orders'], parents);
+        expect(c).toEqual(['OrderItems']); // Orders already in the removed set — not double-listed
+    });
+});

package/src/__tests__/OAuthCallbackHandler.xss.test.ts

@@ -0,0 +1,83 @@
+import { describe, it, expect } from 'vitest';
+import type express from 'express';
+import { OAuthCallbackHandler } from '../rest/OAuthCallbackHandler.js';
+
+/**
+ * These tests verify that query-string-derived values interpolated into the OAuth
+ * success/error HTML pages are HTML-escaped, preventing reflected XSS (audit bug B6).
+ *
+ * The page renderers are private, so we reach them through a narrowly-typed view of
+ * the instance using the codebase's established `as unknown as` double-assertion pattern.
+ */
+interface PageRenderer {
+    handleSuccessPage(req: express.Request, res: express.Response): void;
+    handleErrorPage(req: express.Request, res: express.Response): void;
+    escapeHtml(value: string): string;
+}
+
+function makeRenderer(): PageRenderer {
+    const handler = new OAuthCallbackHandler({ publicUrl: 'https://example.test' });
+    return handler as unknown as PageRenderer;
+}
+
+/** Minimal Express request/response doubles that capture the rendered body. */
+function makeReqRes(query: Record<string, string>): {
+    req: express.Request;
+    res: express.Response;
+    getBody: () => string;
+} {
+    let body = '';
+    const res = {
+        status(): express.Response {
+            return res as unknown as express.Response;
+        },
+        send(html: string): express.Response {
+            body = html;
+            return res as unknown as express.Response;
+        }
+    };
+    return {
+        req: { query } as unknown as express.Request,
+        res: res as unknown as express.Response,
+        getBody: () => body
+    };
+}
+
+describe('OAuthCallbackHandler escapeHtml', () => {
+    it('neutralizes <script>, quotes, and ampersands', () => {
+        const renderer = makeRenderer();
+        const escaped = renderer.escapeHtml(`<script>alert("x")&'y'</script>`);
+        expect(escaped).toBe('&lt;script&gt;alert(&quot;x&quot;)&amp;&#39;y&#39;&lt;/script&gt;');
+        expect(escaped).not.toContain('<script>');
+    });
+
+    it('escapes & first so no double-encoding occurs', () => {
+        const renderer = makeRenderer();
+        expect(renderer.escapeHtml('&lt;')).toBe('&amp;lt;');
+    });
+});
+
+describe('OAuthCallbackHandler reflected-XSS protection', () => {
+    it('escapes a malicious connectionId on the success page', () => {
+        const renderer = makeRenderer();
+        const { req, res, getBody } = makeReqRes({ connectionId: '<script>alert(1)</script>' });
+        renderer.handleSuccessPage(req, res);
+        const body = getBody();
+        expect(body).not.toContain('<script>alert(1)</script>');
+        expect(body).toContain('&lt;script&gt;alert(1)&lt;/script&gt;');
+    });
+
+    it('escapes malicious error code and description on the error page', () => {
+        const renderer = makeRenderer();
+        const { req, res, getBody } = makeReqRes({
+            error: '"><img src=x onerror=alert(1)>',
+            error_description: `</div><script>evil()</script>`
+        });
+        renderer.handleErrorPage(req, res);
+        const body = getBody();
+        expect(body).not.toContain('<img src=x onerror=alert(1)>');
+        expect(body).not.toContain('<script>evil()</script>');
+        expect(body).toContain('&lt;img src=x onerror=alert(1)&gt;');
+        expect(body).toContain('&lt;script&gt;evil()&lt;/script&gt;');
+    });
+});

package/src/__tests__/RealtimeProxyServer.test.ts

@@ -0,0 +1,122 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import type { IncomingMessage } from 'node:http';
+import type { Duplex } from 'node:stream';
+import { RealtimeProxyRegistry, REALTIME_PROXY_PATH } from '@memberjunction/ai';
+import { RealtimeProxyServer } from '../realtimeProxy/RealtimeProxyServer';
+
+/** A fake upgrade socket capturing whether it was written to / destroyed (the rejection path). */
+class FakeSocket {
+    public Written: string[] = [];
+    public Destroyed = false;
+    public write(data: string): boolean {
+        this.Written.push(data);
+        return true;
+    }
+    public destroy(): void {
+        this.Destroyed = true;
+    }
+}
+
+function req(url: string): IncomingMessage {
+    return { url } as unknown as IncomingMessage;
+}
+function sock(fake: FakeSocket): Duplex {
+    return fake as unknown as Duplex;
+}
+const HEAD = Buffer.alloc(0);
+
+describe('RealtimeProxyServer.TryHandleUpgrade', () => {
+    let proxy: RealtimeProxyServer;
+
+    beforeEach(() => {
+        proxy = RealtimeProxyServer.Instance;
+    });
+
+    it('does NOT claim a non-proxy path (leaves the socket for the graphql-ws server)', () => {
+        const fake = new FakeSocket();
+        const owned = proxy.TryHandleUpgrade(req('/graphql'), sock(fake), HEAD);
+        expect(owned).toBe(false);
+        expect(fake.Destroyed).toBe(false);
+        expect(fake.Written).toHaveLength(0);
+    });
+
+    it('claims the proxy path but rejects a MISSING ticket with 401 + destroy', () => {
+        const fake = new FakeSocket();
+        const owned = proxy.TryHandleUpgrade(req(REALTIME_PROXY_PATH), sock(fake), HEAD);
+        expect(owned).toBe(true);
+        expect(fake.Written[0]).toContain('401');
+        expect(fake.Destroyed).toBe(true);
+    });
+
+    it('rejects an UNKNOWN ticket with 401 + destroy', () => {
+        const fake = new FakeSocket();
+        const owned = proxy.TryHandleUpgrade(req(`${REALTIME_PROXY_PATH}?ticket=does-not-exist`), sock(fake), HEAD);
+        expect(owned).toBe(true);
+        expect(fake.Written[0]).toContain('401');
+        expect(fake.Destroyed).toBe(true);
+    });
+
+    it('consumes a valid ticket exactly once (single-use)', () => {
+        // A valid ticket exists in the shared registry until consumed. We assert single-use by consuming
+        // it here first (proving it was live), then confirming the proxy would 401 a second attempt.
+        const ticket = RealtimeProxyRegistry.Instance.Issue({ UpstreamUrl: 'ws://hf.internal/v1/realtime', TTLSeconds: 60 });
+        expect(RealtimeProxyRegistry.Instance.Consume(ticket.ID)).not.toBeNull();
+
+        const fake = new FakeSocket();
+        const owned = proxy.TryHandleUpgrade(req(`${REALTIME_PROXY_PATH}?ticket=${ticket.ID}`), sock(fake), HEAD);
+        expect(owned).toBe(true);
+        expect(fake.Destroyed).toBe(true); // already consumed → treated as invalid
+    });
+});
+
+describe('C3: Origin allowlist (MJ_REALTIME_PROXY_ALLOWED_ORIGINS)', () => {
+    const ENV_KEY = 'MJ_REALTIME_PROXY_ALLOWED_ORIGINS';
+    let saved: string | undefined;
+    let proxy: RealtimeProxyServer;
+
+    beforeEach(() => {
+        proxy = RealtimeProxyServer.Instance;
+        saved = process.env[ENV_KEY];
+    });
+    afterEach(() => {
+        if (saved === undefined) delete process.env[ENV_KEY];
+        else process.env[ENV_KEY] = saved;
+    });
+
+    function reqWithOrigin(url: string, origin?: string): IncomingMessage {
+        return { url, headers: origin ? { origin } : {} } as unknown as IncomingMessage;
+    }
+
+    it('no allowlist configured → prior behavior (origin irrelevant, ticket governs)', () => {
+        delete process.env[ENV_KEY];
+        const fake = new FakeSocket();
+        const owned = proxy.TryHandleUpgrade(reqWithOrigin(`${REALTIME_PROXY_PATH}?ticket=nope`, 'https://evil.example'), sock(fake), HEAD);
+        expect(owned).toBe(true);
+        expect(fake.Written.join('')).toContain('401'); // fell through to the ticket check
+    });
+
+    it('rejects a FOREIGN browser origin with 403 BEFORE consuming the ticket', () => {
+        process.env[ENV_KEY] = 'https://app.example.com, https://portal.example.com';
+        const ticket = RealtimeProxyRegistry.Instance.Issue({ UpstreamUrl: 'ws://internal:8000/v1/realtime', TTLSeconds: 60 });
+        const fake = new FakeSocket();
+        proxy.TryHandleUpgrade(reqWithOrigin(`${REALTIME_PROXY_PATH}?ticket=${ticket.ID}`, 'https://evil.example'), sock(fake), HEAD);
+        expect(fake.Written.join('')).toContain('403');
+        // The ticket SURVIVED the rejected foreign attempt — the legitimate page can still connect.
+        expect(RealtimeProxyRegistry.Instance.Consume(ticket.ID)).not.toBeNull();
+    });
+
+    it('accepts an allowlisted origin (normalization: case + trailing slash)', () => {
+        process.env[ENV_KEY] = 'https://App.Example.com/';
+        const fake = new FakeSocket();
+        // Unknown ticket → passes the origin gate, fails the ticket check with 401 (NOT 403).
+        proxy.TryHandleUpgrade(reqWithOrigin(`${REALTIME_PROXY_PATH}?ticket=nope`, 'https://app.example.com'), sock(fake), HEAD);
+        expect(fake.Written.join('')).toContain('401');
+    });
+
+    it('an upgrade WITHOUT an Origin header (non-browser client) passes the gate', () => {
+        process.env[ENV_KEY] = 'https://app.example.com';
+        const fake = new FakeSocket();
+        proxy.TryHandleUpgrade(reqWithOrigin(`${REALTIME_PROXY_PATH}?ticket=nope`), sock(fake), HEAD);
+        expect(fake.Written.join('')).toContain('401'); // ticket check, not the origin gate
+    });
+});

package/src/__tests__/adhoc-query-helpers.test.ts

@@ -0,0 +1,50 @@
+import { describe, it, expect } from 'vitest';
+import { exactTotalFromPage, resolveAdhocTotalRowCount } from '../resolvers/adhoc-query-helpers';
+
+describe('exactTotalFromPage', () => {
+    it('returns the row count when not paging (maxRows null) — the query was uncapped', () => {
+        expect(exactTotalFromPage(0, 47, null)).toBe(47);
+        expect(exactTotalFromPage(0, 0, null)).toBe(0);
+    });
+
+    it('returns startRow + pageLength for a SHORT page (fewer rows than the page size)', () => {
+        expect(exactTotalFromPage(0, 47, 100)).toBe(47);   // page 1, short → exact total
+        expect(exactTotalFromPage(200, 30, 100)).toBe(230); // page 3, short last page
+        expect(exactTotalFromPage(100, 0, 100)).toBe(100);  // empty page past the end
+    });
+
+    it('returns null for a FULL page — a COUNT is required because more rows may exist', () => {
+        expect(exactTotalFromPage(0, 100, 100)).toBeNull();
+        expect(exactTotalFromPage(500, 100, 100)).toBeNull();
+    });
+
+    it('treats an over-full page defensively as "needs count" (should not occur with OFFSET/FETCH)', () => {
+        expect(exactTotalFromPage(0, 150, 100)).toBeNull();
+    });
+});
+
+describe('resolveAdhocTotalRowCount', () => {
+    it('reads TotalRowCount from the count recordset', () => {
+        expect(resolveAdhocTotalRowCount([{ TotalRowCount: 2087 }], 100)).toBe(2087);
+        expect(resolveAdhocTotalRowCount([{ TotalRowCount: 0 }], 100)).toBe(0);
+    });
+
+    it('floors a fractional/stringified count', () => {
+        expect(resolveAdhocTotalRowCount([{ TotalRowCount: 42.9 }], 0)).toBe(42);
+        expect(resolveAdhocTotalRowCount([{ TotalRowCount: '2087' as unknown as number }], 0)).toBe(2087);
+    });
+
+    it('falls back when the count is absent, empty, null, or malformed', () => {
+        expect(resolveAdhocTotalRowCount(null, 100)).toBe(100);
+        expect(resolveAdhocTotalRowCount(undefined, 100)).toBe(100);
+        expect(resolveAdhocTotalRowCount([], 100)).toBe(100);
+        expect(resolveAdhocTotalRowCount([{}], 100)).toBe(100);
+        expect(resolveAdhocTotalRowCount([{ TotalRowCount: null }], 100)).toBe(100);
+    });
+
+    it('falls back on non-finite or negative counts (never reports a misleading total)', () => {
+        expect(resolveAdhocTotalRowCount([{ TotalRowCount: Number.NaN }], 100)).toBe(100);
+        expect(resolveAdhocTotalRowCount([{ TotalRowCount: -5 }], 100)).toBe(100);
+        expect(resolveAdhocTotalRowCount([{ TotalRowCount: Infinity }], 100)).toBe(100);
+    });
+});

package/src/__tests__/magicLinkService.provisionLog.test.ts

@@ -0,0 +1,106 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+// MagicLinkService is the imperative shell — importing it pulls the full
+// data-provider and communication stacks in at module load. Stub those out;
+// this suite only exercises provisioning's console-log behavior, so
+// @memberjunction/core (the logging implementation) stays real.
+vi.mock('@memberjunction/sqlserver-dataprovider', () => ({
+  UserCache: { Instance: { Users: [] } },
+}));
+vi.mock('@memberjunction/communication-engine', () => ({
+  CommunicationEngine: { Instance: {} },
+}));
+vi.mock('@memberjunction/communication-types', () => ({
+  Message: class {},
+}));
+vi.mock('../config.js', () => ({
+  configInfo: {},
+}));
+
+import { Metadata, type IMetadataProvider, type RoleInfo, type UserInfo } from '@memberjunction/core';
+import type { MJMagicLinkInviteEntity } from '@memberjunction/core-entities';
+import type { MagicLinkConfig } from '../config.js';
+import { MagicLinkService } from '../auth/magicLink/MagicLinkService.js';
+
+/** Minimal BaseEntity stand-in: NewRecord/Save/GetAll plus writable fields. */
+interface MockEntity {
+  NewRecord: () => void;
+  Save: () => Promise<boolean>;
+  GetAll: () => Record<string, unknown>;
+  LatestResult?: { CompleteMessage: string };
+  [field: string]: unknown;
+}
+
+function makeMockEntity(id: string): MockEntity {
+  const entity: MockEntity = {
+    NewRecord: () => {
+      entity.ID = id;
+    },
+    Save: async () => true,
+    GetAll: () => ({
+      ID: entity.ID,
+      Name: entity.Name,
+      Email: entity.Email,
+      FirstName: entity.FirstName,
+      LastName: entity.LastName,
+    }),
+  };
+  return entity;
+}
+
+describe('MagicLinkService provisioning log policy', () => {
+  const originalVerbose = process.env.MJ_VERBOSE;
+  let service: MagicLinkService;
+  let invite: MJMagicLinkInviteEntity;
+  let role: RoleInfo;
+  let contextUser: UserInfo;
+
+  beforeEach(() => {
+    const provider = {
+      BeginTransaction: async () => undefined,
+      CommitTransaction: async () => undefined,
+      RollbackTransaction: async () => undefined,
+      GetEntityObject: async (entityName: string) => makeMockEntity(`mock-${entityName}`),
+    };
+    Metadata.Provider = provider as unknown as IMetadataProvider;
+
+    service = new MagicLinkService('https://mj.example.com', {} as MagicLinkConfig);
+    invite = {
+      Email: 'guest@example.com',
+      RoleID: 'role-1',
+      ApplicationID: 'app-1',
+    } as unknown as MJMagicLinkInviteEntity;
+    role = { ID: 'role-1', Name: 'External Guest' } as RoleInfo;
+    contextUser = { ID: 'ctx-user' } as UserInfo;
+  });
+
+  afterEach(() => {
+    Metadata.Provider = null as unknown as IMetadataProvider;
+    if (originalVerbose === undefined) {
+      delete process.env.MJ_VERBOSE;
+    } else {
+      process.env.MJ_VERBOSE = originalVerbose;
+    }
+  });
+
+  async function provisionAndCollectLogs(): Promise<{ success: boolean; provisionLines: string[] }> {
+    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => undefined);
+    const result = await service['createScopedUser'](invite, role, contextUser);
+    const provisionLines = logSpy.mock.calls
+      .map((call) => String(call[0]))
+      .filter((line) => line.includes('[MagicLink] Provisioned'));
+    return { success: result.success, provisionLines };
+  }
+
+  // Deliberate policy (do not verbose-gate this like the startup notices in 2ddb865e40):
+  // magic-link redemption provisioning a new external account is a security-relevant
+  // event and must stay visible in the DEFAULT server log, so operators see the vector
+  // being exercised without needing MJ_VERBOSE.
+  it('emits the provisioned-user notice on the default (non-verbose) server log', async () => {
+    delete process.env.MJ_VERBOSE;
+    const { success, provisionLines } = await provisionAndCollectLogs();
+    expect(success).toBe(true);
+    expect(provisionLines).toHaveLength(1);
+    expect(provisionLines[0]).toContain("guest@example.com with role 'External Guest'");
+  });
+});

package/src/__tests__/media-upgrade-router.test.ts

@@ -0,0 +1,43 @@
+import { describe, it, expect } from 'vitest';
+import { IsGraphQLWsPath } from '../telephony/media-upgrade-router.js';
+
+describe('IsGraphQLWsPath', () => {
+    describe('bare-root default (GRAPHQL_ROOT_PATH unset — the stock-install case)', () => {
+        it('accepts an exact match on the bare root', () => {
+            expect(IsGraphQLWsPath('/', '/')).toBe(true);
+        });
+
+        it('accepts the conventional /graphql suffix as an alias of the bare root', () => {
+            // This is the fix: MJExplorer's shipped environment.ts hardcodes
+            // GRAPHQL_WS_URI: 'ws://<host>/graphql', which never matched the server's
+            // bare-root default before this alias existed — every subscription upgrade
+            // was silently rejected (400) on a stock install with no .env overrides.
+            expect(IsGraphQLWsPath('/graphql', '/')).toBe(true);
+        });
+
+        it('rejects an unrelated path', () => {
+            expect(IsGraphQLWsPath('/telephony/twilio/media', '/')).toBe(false);
+        });
+
+        it('rejects a path that merely starts with /graphql (no accidental prefix match)', () => {
+            expect(IsGraphQLWsPath('/graphql-admin', '/')).toBe(false);
+        });
+    });
+
+    describe('non-default configured root (custom GRAPHQL_ROOT_PATH — unchanged behavior)', () => {
+        it('accepts an exact match on the configured root', () => {
+            expect(IsGraphQLWsPath('/api/graphql', '/api/graphql')).toBe(true);
+        });
+
+        it('does NOT apply the /graphql alias when the configured root is not the bare root', () => {
+            // The alias is scoped to the bare-root default only — a deployment that has
+            // deliberately set a custom root keeps requiring an exact match, so this
+            // fix can't silently widen what a custom-configured server accepts.
+            expect(IsGraphQLWsPath('/graphql', '/api/graphql')).toBe(false);
+        });
+
+        it('rejects a mismatched custom path', () => {
+            expect(IsGraphQLWsPath('/', '/api/graphql')).toBe(false);
+        });
+    });
+});

package/src/__tests__/unifiedAuth.test.ts

@@ -258,9 +258,11 @@ describe('createUnifiedAuthMiddleware', () => {
   });
 
   describe('Authentication failures', () => {
-    it('should return 401 when no authorization header is provided', async () => {
+    it('should return 401 when no authorization header is provided, quietly (no stack-trace log)', async () => {
       mockGetReadOnlyDS.mockReturnValue(MOCK_POOL);
       mockGetReadWriteDS.mockReturnValue(MOCK_POOL);
+      const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+      const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
       // No auth header → empty bearer token → empty token after strip → "Missing token"
       const req = makeMockReq({ headers: {} });
       const res = makeMockRes();
@@ -270,7 +272,14 @@ describe('createUnifiedAuthMiddleware', () => {
 
       expect(next).not.toHaveBeenCalled();
       expect(res._status).toBe(401);
-      expect(res._json).toEqual({ error: 'Authentication failed' });
+      expect(res._json).toEqual({ error: 'Authentication required' });
+      // An anonymous/unauthenticated request (health check, CORS-preflight-adjacent probe,
+      // a client mid-handshake) is routine — it must NOT log a warning or a stack trace.
+      // Same treatment as the existing TokenExpiredError branch.
+      expect(warnSpy).not.toHaveBeenCalled();
+      expect(errorSpy).not.toHaveBeenCalled();
+      warnSpy.mockRestore();
+      errorSpy.mockRestore();
     });
 
     it('should return 401 with JWT_EXPIRED code for expired tokens', async () => {
@@ -301,10 +310,11 @@ describe('createUnifiedAuthMiddleware', () => {
       });
     });
 
-    it('should return 401 when jwt.decode returns null (corrupt token)', async () => {
+    it('should return 401 when jwt.decode returns null (corrupt token), and still log it in full', async () => {
       mockGetReadOnlyDS.mockReturnValue(MOCK_POOL);
       mockGetReadWriteDS.mockReturnValue(MOCK_POOL);
       mockJwtDecode.mockReturnValue(null);
+      const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
 
       const req = makeMockReq({
         headers: { authorization: 'Bearer corrupt-token' },
@@ -317,6 +327,11 @@ describe('createUnifiedAuthMiddleware', () => {
       expect(next).not.toHaveBeenCalled();
       expect(res._status).toBe(401);
       expect(res._json).toEqual({ error: 'Authentication failed' });
+      // Unlike a bare "no credentials supplied" request, a token that IS present but
+      // fails to decode is worth a human's attention — the quiet path above is scoped
+      // to the "Missing token" case only, not a blanket suppression of auth logging.
+      expect(errorSpy).toHaveBeenCalledWith('Auth error:', expect.any(Error));
+      errorSpy.mockRestore();
     });
 
     it('should return 401 when verifyUserRecord returns null', async () => {