@memberjunction/server 5.48.0 → 5.50.0

package/src/__tests__/AdhocQueryResolver.pagination.test.ts

@@ -0,0 +1,114 @@
+/**
+ * Regression suite for the AdhocQueryResolver pagination / total-row-count bug.
+ *
+ * Bug #4 — First-page ad-hoc queries reported a TotalRowCount equal to the
+ *          returned page size, so the artifact viewer's pager never appeared
+ *          and a >100-row result looked like it only had 100 rows.
+ *
+ *          Two compounding causes in ExecuteAdhocQuery:
+ *            1. `usePaging` required `startRow > 0`, so page 1 (StartRow 0)
+ *               fell back to a TOP-N hard cap instead of OFFSET/FETCH paging.
+ *            2. `TotalRowCount` was set to `recordset.length` (the capped page),
+ *               with no COUNT(*) query — so the true total was never computed.
+ *
+ *          The fix pages whenever `MaxRows > 0` (including StartRow 0) and reads
+ *          the true total from the RenderPipeline's PagingResult.CountSQL —
+ *          matching the saved-query path (GenericDatabaseProvider → WrapWithPaging).
+ *
+ * Same hybrid strategy as AdhocQueryResolver.bugs.test.ts:
+ *   1. Source-shape contract tests — assert structural properties of the fix.
+ *   2. Pipeline behavior tests — exercise RenderPipeline.Run with the exact
+ *      first-page inputs the resolver now relies on (data OFFSET/FETCH + count).
+ */
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { readFileSync } from 'fs';
+import { resolve } from 'path';
+import { Metadata } from '@memberjunction/core';
+import { RenderPipeline } from '@memberjunction/generic-database-provider';
+
+const ADHOC_RESOLVER_PATH = resolve(__dirname, '../resolvers/AdhocQueryResolver.ts');
+
+function readResolverSource(): string {
+    return readFileSync(ADHOC_RESOLVER_PATH, 'utf8');
+}
+
+function stubMetadata(): void {
+    vi.spyOn(Metadata, 'Provider', 'get').mockReturnValue({
+        Queries: [],
+        QueryDependencies: [],
+    } as ReturnType<typeof Metadata.Provider>);
+}
+
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+
+// The real-world query from the bug report: no top-level TOP, an ORDER BY,
+// ~2,087 rows in production, requested as page 1 (StartRow 0, MaxRows 100).
+const BUG_REPORT_SQL = `SELECT
+    d.ID,
+    d.Title,
+    d.Value,
+    ISNULL(d.DealStage, 'Open (Unspecified)') AS DealStage
+FROM crm.vwDeals d
+WHERE
+    d.IsDeleted = 0
+    AND (d.DealStage NOT IN ('Closed won', 'Closed lost') OR d.DealStage IS NULL)
+ORDER BY
+    d.Value DESC,
+    d.CloseDate ASC`;
+
+// ════════════════════════════════════════════════════════════════════
+// Source-shape contract tests
+// ════════════════════════════════════════════════════════════════════
+
+describe('AdhocQueryResolver pagination source-shape contract', () => {
+
+    it('must NOT gate paging on `startRow > 0` (page 1 must still page)', () => {
+        const src = readResolverSource();
+        // The bug: `usePaging = ... && startRow > 0`. After the fix, first-page
+        // requests (StartRow 0) must page too, so no `startRow > 0` guard remains.
+        expect(/startRow\s*>\s*0/.test(src)).toBe(false);
+    });
+
+    it('must derive TotalRowCount from a COUNT query, not the returned page length', () => {
+        const src = readResolverSource();
+        // The bug: `TotalRowCount: recordset.length`. After the fix, the total
+        // comes from the count query (via a resolved variable), never directly
+        // from the page recordset length.
+        expect(/TotalRowCount:\s*recordset\.length/.test(src)).toBe(false);
+    });
+
+    it('must consume the RenderPipeline PagingResult.CountSQL', () => {
+        const src = readResolverSource();
+        expect(/PagingResult\??\.CountSQL/.test(src)).toBe(true);
+    });
+});
+
+// ════════════════════════════════════════════════════════════════════
+// Pipeline behavior — first page (StartRow 0) yields data + count SQL
+// ════════════════════════════════════════════════════════════════════
+
+describe('RenderPipeline first-page paging (the contract the resolver relies on)', () => {
+
+    it('StartRow 0 + MaxRows 100 produces a PagingResult with OFFSET/FETCH data SQL AND a COUNT(*) count SQL', () => {
+        stubMetadata();
+
+        const result = RenderPipeline.Run(BUG_REPORT_SQL, {
+            Platform: 'sqlserver',
+            Paging: { StartRow: 0, MaxRows: 100 },
+        });
+
+        // Paging must be applied even at StartRow 0 (the bug caused it to be skipped).
+        expect(result.PagingResult).not.toBeNull();
+
+        // Data SQL: OFFSET/FETCH at the first page, preserving the query's ORDER BY.
+        expect(result.FinalSQL).toMatch(/OFFSET\s+0\s+ROWS\s+FETCH\s+NEXT\s+100\s+ROWS\s+ONLY/i);
+        expect(result.PagingResult!.DataSQL).toMatch(/OFFSET\s+0\s+ROWS\s+FETCH\s+NEXT\s+100\s+ROWS\s+ONLY/i);
+
+        // Count SQL: a COUNT(*) over the full (uncapped) set — the true total the
+        // viewer's pager needs. It must NOT carry the page's OFFSET/FETCH cap.
+        expect(result.PagingResult!.CountSQL).toMatch(/COUNT\(\*\)\s+AS\s+TotalRowCount/i);
+        expect(result.PagingResult!.CountSQL).not.toMatch(/FETCH\s+NEXT\s+100\s+ROWS/i);
+    });
+});

package/src/__tests__/EntityMapLifecycle.dagWarnings.test.ts

@@ -0,0 +1,91 @@
+import { describe, it, expect } from 'vitest';
+import { ComputeCascadeRemovalSet, ComputeRemovedDependencyWarnings } from '../integration/EntityMapLifecycle.js';
+
+/**
+ * rsuplan "adding and removing tables": removing a table another table relies on must NOT
+ * auto-remove the dependent — the broken edge is surfaced as a warning so a consumer can
+ * prompt a force-remove (or re-add). These tests pin the pure decision function.
+ */
+describe('ComputeRemovedDependencyWarnings', () => {
+    const parents = new Map<string, string[]>([
+        ['orders', ['Customers']],          // Orders depends on Customers
+        ['orderitems', ['Orders', 'Products']],
+        ['customers', []],
+        ['products', []],
+    ]);
+
+    it('warns for each still-active object that depends on a removed object', () => {
+        const w = ComputeRemovedDependencyWarnings(['Orders', 'OrderItems', 'Products'], ['Customers'], parents);
+        expect(w).toHaveLength(1);
+        expect(w[0]).toContain("'Orders'");
+        expect(w[0]).toContain("'Customers'");
+        expect(w[0]).toContain('force-remove');
+    });
+
+    it('lists every removed parent an active object depends on', () => {
+        const w = ComputeRemovedDependencyWarnings(['OrderItems'], ['Orders', 'Products'], parents);
+        expect(w).toHaveLength(1);
+        expect(w[0]).toContain("'Orders'");
+        expect(w[0]).toContain("'Products'");
+    });
+
+    it('is case-insensitive on both sides of the edge', () => {
+        const w = ComputeRemovedDependencyWarnings(['ORDERS'], ['customers'], parents);
+        expect(w).toHaveLength(1);
+    });
+
+    it('returns nothing when no active object depends on a removed one (leaf removal is clean)', () => {
+        expect(ComputeRemovedDependencyWarnings(['Customers', 'Products'], ['Orders'], parents)).toEqual([]);
+    });
+
+    it('returns nothing when nothing was removed or nothing remains active', () => {
+        expect(ComputeRemovedDependencyWarnings(['Orders'], [], parents)).toEqual([]);
+        expect(ComputeRemovedDependencyWarnings([], ['Customers'], parents)).toEqual([]);
+    });
+
+    it('tolerates objects absent from the dependency map (no persisted IO row)', () => {
+        expect(ComputeRemovedDependencyWarnings(['UnknownThing'], ['Customers'], parents)).toEqual([]);
+    });
+});
+
+/**
+ * rsuplan force-remove: "a consumer may want the user to force remove those too" — the
+ * transitive closure of dependents that cascades with a removed object when the caller opts in.
+ */
+describe('ComputeCascadeRemovalSet', () => {
+    const parents = new Map<string, string[]>([
+        ['orders', ['Customers']],
+        ['orderitems', ['Orders', 'Products']],
+        ['shipments', ['OrderItems']],          // 3 levels deep
+        ['customers', []],
+        ['products', []],
+    ]);
+
+    it('cascades direct dependents of a removed object', () => {
+        const c = ComputeCascadeRemovalSet(['Orders', 'Products', 'Customers'], ['Products'], parents);
+        // Orders depends on Customers (kept) — only OrderItems-style dependents of Products cascade;
+        // here Orders does NOT depend on Products, so nothing cascades except true dependents.
+        expect(c).toEqual([]);
+    });
+
+    it('cascades the FULL transitive closure (removed → dependent → its dependent …)', () => {
+        const c = ComputeCascadeRemovalSet(['Orders', 'OrderItems', 'Shipments', 'Products'], ['Customers'], parents);
+        // Customers removed → Orders cascades → OrderItems (depends on Orders) → Shipments (depends on OrderItems)
+        expect(c).toEqual(['Orders', 'OrderItems', 'Shipments']);
+    });
+
+    it('is case-insensitive across edges', () => {
+        const c = ComputeCascadeRemovalSet(['ORDERS'], ['customers'], parents);
+        expect(c).toEqual(['ORDERS']);
+    });
+
+    it('returns nothing when nothing was removed or nothing depends on the removed', () => {
+        expect(ComputeCascadeRemovalSet(['Orders'], [], parents)).toEqual([]);
+        expect(ComputeCascadeRemovalSet(['Customers', 'Products'], ['Orders'], parents)).toEqual([]);
+    });
+
+    it('never cascades an object that is itself already removed', () => {
+        const c = ComputeCascadeRemovalSet(['Orders', 'OrderItems'], ['Customers', 'Orders'], parents);
+        expect(c).toEqual(['OrderItems']); // Orders already in the removed set — not double-listed
+    });
+});

package/src/__tests__/OAuthCallbackHandler.xss.test.ts

@@ -0,0 +1,83 @@
+import { describe, it, expect } from 'vitest';
+import type express from 'express';
+import { OAuthCallbackHandler } from '../rest/OAuthCallbackHandler.js';
+
+/**
+ * These tests verify that query-string-derived values interpolated into the OAuth
+ * success/error HTML pages are HTML-escaped, preventing reflected XSS (audit bug B6).
+ *
+ * The page renderers are private, so we reach them through a narrowly-typed view of
+ * the instance using the codebase's established `as unknown as` double-assertion pattern.
+ */
+interface PageRenderer {
+    handleSuccessPage(req: express.Request, res: express.Response): void;
+    handleErrorPage(req: express.Request, res: express.Response): void;
+    escapeHtml(value: string): string;
+}
+
+function makeRenderer(): PageRenderer {
+    const handler = new OAuthCallbackHandler({ publicUrl: 'https://example.test' });
+    return handler as unknown as PageRenderer;
+}
+
+/** Minimal Express request/response doubles that capture the rendered body. */
+function makeReqRes(query: Record<string, string>): {
+    req: express.Request;
+    res: express.Response;
+    getBody: () => string;
+} {
+    let body = '';
+    const res = {
+        status(): express.Response {
+            return res as unknown as express.Response;
+        },
+        send(html: string): express.Response {
+            body = html;
+            return res as unknown as express.Response;
+        }
+    };
+    return {
+        req: { query } as unknown as express.Request,
+        res: res as unknown as express.Response,
+        getBody: () => body
+    };
+}
+
+describe('OAuthCallbackHandler escapeHtml', () => {
+    it('neutralizes <script>, quotes, and ampersands', () => {
+        const renderer = makeRenderer();
+        const escaped = renderer.escapeHtml(`<script>alert("x")&'y'</script>`);
+        expect(escaped).toBe('&lt;script&gt;alert(&quot;x&quot;)&amp;&#39;y&#39;&lt;/script&gt;');
+        expect(escaped).not.toContain('<script>');
+    });
+
+    it('escapes & first so no double-encoding occurs', () => {
+        const renderer = makeRenderer();
+        expect(renderer.escapeHtml('&lt;')).toBe('&amp;lt;');
+    });
+});
+
+describe('OAuthCallbackHandler reflected-XSS protection', () => {
+    it('escapes a malicious connectionId on the success page', () => {
+        const renderer = makeRenderer();
+        const { req, res, getBody } = makeReqRes({ connectionId: '<script>alert(1)</script>' });
+        renderer.handleSuccessPage(req, res);
+        const body = getBody();
+        expect(body).not.toContain('<script>alert(1)</script>');
+        expect(body).toContain('&lt;script&gt;alert(1)&lt;/script&gt;');
+    });
+
+    it('escapes malicious error code and description on the error page', () => {
+        const renderer = makeRenderer();
+        const { req, res, getBody } = makeReqRes({
+            error: '"><img src=x onerror=alert(1)>',
+            error_description: `</div><script>evil()</script>`
+        });
+        renderer.handleErrorPage(req, res);
+        const body = getBody();
+        expect(body).not.toContain('<img src=x onerror=alert(1)>');
+        expect(body).not.toContain('<script>evil()</script>');
+        expect(body).toContain('&lt;img src=x onerror=alert(1)&gt;');
+        expect(body).toContain('&lt;script&gt;evil()&lt;/script&gt;');
+    });
+});

package/src/__tests__/RealtimeProxyServer.test.ts

@@ -1,4 +1,4 @@
-import { describe, it, expect, beforeEach } from 'vitest';
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
 import type { IncomingMessage } from 'node:http';
 import type { Duplex } from 'node:stream';
 import { RealtimeProxyRegistry, REALTIME_PROXY_PATH } from '@memberjunction/ai';
@@ -68,3 +68,55 @@ describe('RealtimeProxyServer.TryHandleUpgrade', () => {
         expect(fake.Destroyed).toBe(true); // already consumed → treated as invalid
     });
 });
+
+describe('C3: Origin allowlist (MJ_REALTIME_PROXY_ALLOWED_ORIGINS)', () => {
+    const ENV_KEY = 'MJ_REALTIME_PROXY_ALLOWED_ORIGINS';
+    let saved: string | undefined;
+    let proxy: RealtimeProxyServer;
+
+    beforeEach(() => {
+        proxy = RealtimeProxyServer.Instance;
+        saved = process.env[ENV_KEY];
+    });
+    afterEach(() => {
+        if (saved === undefined) delete process.env[ENV_KEY];
+        else process.env[ENV_KEY] = saved;
+    });
+
+    function reqWithOrigin(url: string, origin?: string): IncomingMessage {
+        return { url, headers: origin ? { origin } : {} } as unknown as IncomingMessage;
+    }
+
+    it('no allowlist configured → prior behavior (origin irrelevant, ticket governs)', () => {
+        delete process.env[ENV_KEY];
+        const fake = new FakeSocket();
+        const owned = proxy.TryHandleUpgrade(reqWithOrigin(`${REALTIME_PROXY_PATH}?ticket=nope`, 'https://evil.example'), sock(fake), HEAD);
+        expect(owned).toBe(true);
+        expect(fake.Written.join('')).toContain('401'); // fell through to the ticket check
+    });
+
+    it('rejects a FOREIGN browser origin with 403 BEFORE consuming the ticket', () => {
+        process.env[ENV_KEY] = 'https://app.example.com, https://portal.example.com';
+        const ticket = RealtimeProxyRegistry.Instance.Issue({ UpstreamUrl: 'ws://internal:8000/v1/realtime', TTLSeconds: 60 });
+        const fake = new FakeSocket();
+        proxy.TryHandleUpgrade(reqWithOrigin(`${REALTIME_PROXY_PATH}?ticket=${ticket.ID}`, 'https://evil.example'), sock(fake), HEAD);
+        expect(fake.Written.join('')).toContain('403');
+        // The ticket SURVIVED the rejected foreign attempt — the legitimate page can still connect.
+        expect(RealtimeProxyRegistry.Instance.Consume(ticket.ID)).not.toBeNull();
+    });
+
+    it('accepts an allowlisted origin (normalization: case + trailing slash)', () => {
+        process.env[ENV_KEY] = 'https://App.Example.com/';
+        const fake = new FakeSocket();
+        // Unknown ticket → passes the origin gate, fails the ticket check with 401 (NOT 403).
+        proxy.TryHandleUpgrade(reqWithOrigin(`${REALTIME_PROXY_PATH}?ticket=nope`, 'https://app.example.com'), sock(fake), HEAD);
+        expect(fake.Written.join('')).toContain('401');
+    });
+
+    it('an upgrade WITHOUT an Origin header (non-browser client) passes the gate', () => {
+        process.env[ENV_KEY] = 'https://app.example.com';
+        const fake = new FakeSocket();
+        proxy.TryHandleUpgrade(reqWithOrigin(`${REALTIME_PROXY_PATH}?ticket=nope`), sock(fake), HEAD);
+        expect(fake.Written.join('')).toContain('401'); // ticket check, not the origin gate
+    });
+});

package/src/__tests__/WidgetSessionService.test.ts

@@ -0,0 +1,96 @@
+import { describe, it, expect, vi } from 'vitest';
+
+// WidgetSessionService is the imperative shell for public widget sessions — importing it pulls in
+// config.ts (which eagerly validates DB env vars at module load) plus the full magic-link /
+// returning-visitor / communication stacks. This suite only exercises the `ResolvePerInstanceRateLimit`
+// cache-bounding behavior, so stub those transitive deps out (mirrors the pattern already established
+// in `magicLinkService.provisionLog.test.ts` for testing another imperative-shell class).
+vi.mock('../config.js', () => ({
+  configInfo: {},
+}));
+vi.mock('@memberjunction/sqlserver-dataprovider', () => ({
+  UserCache: {
+    Instance: { Users: [], UserByName: () => undefined, GetSystemUser: () => undefined },
+    Users: [],
+  },
+}));
+vi.mock('../auth/magicLink/MagicLinkService.js', () => ({
+  MagicLinkService: class {},
+}));
+vi.mock('../agentSessions/ReturningVisitorRecap.js', () => ({
+  writeReturningVisitorRecap: async () => undefined,
+}));
+vi.mock('../realtimeWidget/visitorIdentity.js', () => ({
+  resolveIdentityByEmail: async () => null,
+  mergeVisitorIdentity: async () => 0,
+  forgetVisitor: async () => ({ notesArchived: 0, conversationsCleared: 0 }),
+}));
+
+import { WidgetSessionService } from '../realtimeWidget/WidgetSessionService.js';
+import type { WidgetConfig } from '../config.js';
+
+/**
+ * Minimal `WidgetConfig` matching the zod schema's post-parse (defaulted) shape —
+ * enough for `ResolvePerInstanceRateLimit`, which never dereferences most of these.
+ */
+function makeConfig(overrides: Partial<WidgetConfig> = {}): WidgetConfig {
+  return {
+    enabled: true,
+    signingReuse: 'magic-link',
+    audience: 'mj-magic-link',
+    anonymousEmail: 'anonymous@magic-link.local',
+    defaultSessionTtlMinutes: 15,
+    defaultRateLimitPerMinute: 30,
+    rateLimitWindowMs: 60_000,
+    voiceDefaultMaxSessionMinutes: 10,
+    hostPublicKeys: {},
+    ...overrides,
+  };
+}
+
+describe('WidgetSessionService — ResolvePerInstanceRateLimit', () => {
+  it('returns the deployment-wide default for an empty widget key without touching the cache', async () => {
+    const service = new WidgetSessionService('https://mj.example.com', makeConfig({ defaultRateLimitPerMinute: 42 }));
+    await expect(service.ResolvePerInstanceRateLimit('')).resolves.toBe(42);
+    expect(service.RateLimitCacheSize).toBe(0);
+  });
+
+  it('falls back to the default (and still caches) when the widget key cannot be resolved (no DB in unit tests)', async () => {
+    const service = new WidgetSessionService('https://mj.example.com', makeConfig({ defaultRateLimitPerMinute: 30 }));
+    await expect(service.ResolvePerInstanceRateLimit('pk_live_unknown')).resolves.toBe(30);
+    expect(service.RateLimitCacheSize).toBe(1);
+  });
+
+  it('caches a resolved limit per key instead of re-resolving on every call', async () => {
+    const service = new WidgetSessionService('https://mj.example.com', makeConfig());
+    await service.ResolvePerInstanceRateLimit('pk_live_same_key');
+    await service.ResolvePerInstanceRateLimit('pk_live_same_key');
+    await service.ResolvePerInstanceRateLimit('pk_live_same_key');
+    expect(service.RateLimitCacheSize).toBe(1);
+  });
+
+  it(
+    'never grows the rate-limit cache past its configured bound, even under an unbounded stream of ' +
+      'distinct attacker-supplied widget keys (Memory Leak Audit Round 8, Critical finding — the cache ' +
+      'key is unauthenticated request input on the public /widget/session endpoint)',
+    async () => {
+      const service = new WidgetSessionService('https://mj.example.com', makeConfig());
+      // Far more distinct keys than any real deployment's widget-instance count, and comfortably
+      // more than the cache's configured max size — simulates an attacker sending a fresh garbage
+      // widgetKey on every request.
+      const distinctKeyCount = 12_000;
+      for (let i = 0; i < distinctKeyCount; i++) {
+        await service.ResolvePerInstanceRateLimit(`pk_live_attacker_${i}`);
+      }
+      expect(service.RateLimitCacheSize).toBeLessThan(distinctKeyCount);
+      expect(service.RateLimitCacheSize).toBeLessThanOrEqual(10_000);
+    },
+  );
+
+  it('trims whitespace before using the key to look up / populate the cache', async () => {
+    const service = new WidgetSessionService('https://mj.example.com', makeConfig());
+    await service.ResolvePerInstanceRateLimit('  pk_live_padded  ');
+    await service.ResolvePerInstanceRateLimit('pk_live_padded');
+    expect(service.RateLimitCacheSize).toBe(1);
+  });
+});

package/src/__tests__/adhoc-query-helpers.test.ts

@@ -0,0 +1,50 @@
+import { describe, it, expect } from 'vitest';
+import { exactTotalFromPage, resolveAdhocTotalRowCount } from '../resolvers/adhoc-query-helpers';
+
+describe('exactTotalFromPage', () => {
+    it('returns the row count when not paging (maxRows null) — the query was uncapped', () => {
+        expect(exactTotalFromPage(0, 47, null)).toBe(47);
+        expect(exactTotalFromPage(0, 0, null)).toBe(0);
+    });
+
+    it('returns startRow + pageLength for a SHORT page (fewer rows than the page size)', () => {
+        expect(exactTotalFromPage(0, 47, 100)).toBe(47);   // page 1, short → exact total
+        expect(exactTotalFromPage(200, 30, 100)).toBe(230); // page 3, short last page
+        expect(exactTotalFromPage(100, 0, 100)).toBe(100);  // empty page past the end
+    });
+
+    it('returns null for a FULL page — a COUNT is required because more rows may exist', () => {
+        expect(exactTotalFromPage(0, 100, 100)).toBeNull();
+        expect(exactTotalFromPage(500, 100, 100)).toBeNull();
+    });
+
+    it('treats an over-full page defensively as "needs count" (should not occur with OFFSET/FETCH)', () => {
+        expect(exactTotalFromPage(0, 150, 100)).toBeNull();
+    });
+});
+
+describe('resolveAdhocTotalRowCount', () => {
+    it('reads TotalRowCount from the count recordset', () => {
+        expect(resolveAdhocTotalRowCount([{ TotalRowCount: 2087 }], 100)).toBe(2087);
+        expect(resolveAdhocTotalRowCount([{ TotalRowCount: 0 }], 100)).toBe(0);
+    });
+
+    it('floors a fractional/stringified count', () => {
+        expect(resolveAdhocTotalRowCount([{ TotalRowCount: 42.9 }], 0)).toBe(42);
+        expect(resolveAdhocTotalRowCount([{ TotalRowCount: '2087' as unknown as number }], 0)).toBe(2087);
+    });
+
+    it('falls back when the count is absent, empty, null, or malformed', () => {
+        expect(resolveAdhocTotalRowCount(null, 100)).toBe(100);
+        expect(resolveAdhocTotalRowCount(undefined, 100)).toBe(100);
+        expect(resolveAdhocTotalRowCount([], 100)).toBe(100);
+        expect(resolveAdhocTotalRowCount([{}], 100)).toBe(100);
+        expect(resolveAdhocTotalRowCount([{ TotalRowCount: null }], 100)).toBe(100);
+    });
+
+    it('falls back on non-finite or negative counts (never reports a misleading total)', () => {
+        expect(resolveAdhocTotalRowCount([{ TotalRowCount: Number.NaN }], 100)).toBe(100);
+        expect(resolveAdhocTotalRowCount([{ TotalRowCount: -5 }], 100)).toBe(100);
+        expect(resolveAdhocTotalRowCount([{ TotalRowCount: Infinity }], 100)).toBe(100);
+    });
+});

package/src/__tests__/magicLinkService.provisionLog.test.ts

@@ -0,0 +1,106 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+// MagicLinkService is the imperative shell — importing it pulls the full
+// data-provider and communication stacks in at module load. Stub those out;
+// this suite only exercises provisioning's console-log behavior, so
+// @memberjunction/core (the logging implementation) stays real.
+vi.mock('@memberjunction/sqlserver-dataprovider', () => ({
+  UserCache: { Instance: { Users: [] } },
+}));
+vi.mock('@memberjunction/communication-engine', () => ({
+  CommunicationEngine: { Instance: {} },
+}));
+vi.mock('@memberjunction/communication-types', () => ({
+  Message: class {},
+}));
+vi.mock('../config.js', () => ({
+  configInfo: {},
+}));
+
+import { Metadata, type IMetadataProvider, type RoleInfo, type UserInfo } from '@memberjunction/core';
+import type { MJMagicLinkInviteEntity } from '@memberjunction/core-entities';
+import type { MagicLinkConfig } from '../config.js';
+import { MagicLinkService } from '../auth/magicLink/MagicLinkService.js';
+
+/** Minimal BaseEntity stand-in: NewRecord/Save/GetAll plus writable fields. */
+interface MockEntity {
+  NewRecord: () => void;
+  Save: () => Promise<boolean>;
+  GetAll: () => Record<string, unknown>;
+  LatestResult?: { CompleteMessage: string };
+  [field: string]: unknown;
+}
+
+function makeMockEntity(id: string): MockEntity {
+  const entity: MockEntity = {
+    NewRecord: () => {
+      entity.ID = id;
+    },
+    Save: async () => true,
+    GetAll: () => ({
+      ID: entity.ID,
+      Name: entity.Name,
+      Email: entity.Email,
+      FirstName: entity.FirstName,
+      LastName: entity.LastName,
+    }),
+  };
+  return entity;
+}
+
+describe('MagicLinkService provisioning log policy', () => {
+  const originalVerbose = process.env.MJ_VERBOSE;
+  let service: MagicLinkService;
+  let invite: MJMagicLinkInviteEntity;
+  let role: RoleInfo;
+  let contextUser: UserInfo;
+
+  beforeEach(() => {
+    const provider = {
+      BeginTransaction: async () => undefined,
+      CommitTransaction: async () => undefined,
+      RollbackTransaction: async () => undefined,
+      GetEntityObject: async (entityName: string) => makeMockEntity(`mock-${entityName}`),
+    };
+    Metadata.Provider = provider as unknown as IMetadataProvider;
+
+    service = new MagicLinkService('https://mj.example.com', {} as MagicLinkConfig);
+    invite = {
+      Email: 'guest@example.com',
+      RoleID: 'role-1',
+      ApplicationID: 'app-1',
+    } as unknown as MJMagicLinkInviteEntity;
+    role = { ID: 'role-1', Name: 'External Guest' } as RoleInfo;
+    contextUser = { ID: 'ctx-user' } as UserInfo;
+  });
+
+  afterEach(() => {
+    Metadata.Provider = null as unknown as IMetadataProvider;
+    if (originalVerbose === undefined) {
+      delete process.env.MJ_VERBOSE;
+    } else {
+      process.env.MJ_VERBOSE = originalVerbose;
+    }
+  });
+
+  async function provisionAndCollectLogs(): Promise<{ success: boolean; provisionLines: string[] }> {
+    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => undefined);
+    const result = await service['createScopedUser'](invite, role, contextUser);
+    const provisionLines = logSpy.mock.calls
+      .map((call) => String(call[0]))
+      .filter((line) => line.includes('[MagicLink] Provisioned'));
+    return { success: result.success, provisionLines };
+  }
+
+  // Deliberate policy (do not verbose-gate this like the startup notices in 2ddb865e40):
+  // magic-link redemption provisioning a new external account is a security-relevant
+  // event and must stay visible in the DEFAULT server log, so operators see the vector
+  // being exercised without needing MJ_VERBOSE.
+  it('emits the provisioned-user notice on the default (non-verbose) server log', async () => {
+    delete process.env.MJ_VERBOSE;
+    const { success, provisionLines } = await provisionAndCollectLogs();
+    expect(success).toBe(true);
+    expect(provisionLines).toHaveLength(1);
+    expect(provisionLines[0]).toContain("guest@example.com with role 'External Guest'");
+  });
+});

package/src/__tests__/media-upgrade-router.test.ts

@@ -0,0 +1,43 @@
+import { describe, it, expect } from 'vitest';
+import { IsGraphQLWsPath } from '../telephony/media-upgrade-router.js';
+
+describe('IsGraphQLWsPath', () => {
+    describe('bare-root default (GRAPHQL_ROOT_PATH unset — the stock-install case)', () => {
+        it('accepts an exact match on the bare root', () => {
+            expect(IsGraphQLWsPath('/', '/')).toBe(true);
+        });
+
+        it('accepts the conventional /graphql suffix as an alias of the bare root', () => {
+            // This is the fix: MJExplorer's shipped environment.ts hardcodes
+            // GRAPHQL_WS_URI: 'ws://<host>/graphql', which never matched the server's
+            // bare-root default before this alias existed — every subscription upgrade
+            // was silently rejected (400) on a stock install with no .env overrides.
+            expect(IsGraphQLWsPath('/graphql', '/')).toBe(true);
+        });
+
+        it('rejects an unrelated path', () => {
+            expect(IsGraphQLWsPath('/telephony/twilio/media', '/')).toBe(false);
+        });
+
+        it('rejects a path that merely starts with /graphql (no accidental prefix match)', () => {
+            expect(IsGraphQLWsPath('/graphql-admin', '/')).toBe(false);
+        });
+    });
+
+    describe('non-default configured root (custom GRAPHQL_ROOT_PATH — unchanged behavior)', () => {
+        it('accepts an exact match on the configured root', () => {
+            expect(IsGraphQLWsPath('/api/graphql', '/api/graphql')).toBe(true);
+        });
+
+        it('does NOT apply the /graphql alias when the configured root is not the bare root', () => {
+            // The alias is scoped to the bare-root default only — a deployment that has
+            // deliberately set a custom root keeps requiring an exact match, so this
+            // fix can't silently widen what a custom-configured server accepts.
+            expect(IsGraphQLWsPath('/graphql', '/api/graphql')).toBe(false);
+        });
+
+        it('rejects a mismatched custom path', () => {
+            expect(IsGraphQLWsPath('/', '/api/graphql')).toBe(false);
+        });
+    });
+});