@memberjunction/server 5.50.0 → 5.51.1

package/src/__tests__/OAuthCallbackHandler.xss.test.ts

@@ -16,7 +16,10 @@ interface PageRenderer {
 }
 
 function makeRenderer(): PageRenderer {
-    const handler = new OAuthCallbackHandler({ publicUrl: 'https://example.test' });
+    const handler = new OAuthCallbackHandler({
+        publicUrl: 'https://example.test',
+        allowedFrontendOrigins: ['*'],
+    });
     return handler as unknown as PageRenderer;
 }
 

package/src/__tests__/RealtimeClientSessionResolver.test.ts

@@ -81,6 +81,16 @@ vi.mock('@memberjunction/aiengine', () => ({
 const prepareClientSessionMock = vi.fn();
 const executeRelayedToolMock = vi.fn();
 const cancelInFlightMock = vi.fn((_agentSessionID: string, _callID?: string): number => 0);
+// Recording-store helpers (module-level exports of ai-agents) — mocked so the recording mutations'
+// identity threading is observable without touching MJStorage. vi.hoisted because the factory below
+// references them as PLAIN properties (evaluated when the factory runs, unlike the deferred
+// class-property/getter references above).
+const { resolveStorageMock, storeRecordingMock, writeSegmentMock, deleteSegmentsMock } = vi.hoisted(() => ({
+    resolveStorageMock: vi.fn(async (): Promise<string | null> => 'storage-acct-1'),
+    storeRecordingMock: vi.fn(async (): Promise<string | null> => 'file-1'),
+    writeSegmentMock: vi.fn(async (): Promise<boolean> => true),
+    deleteSegmentsMock: vi.fn(async (): Promise<number> => 0),
+}));
 const onChannelStateSaveMock = vi.fn(
     async (_agentSessionID: string, _channelName: string, stateJson: string): Promise<string> => stateJson,
 );
@@ -110,6 +120,10 @@ vi.mock('@memberjunction/ai-agents', async (importOriginal) => {
                 return { OnChannelStateSave: onChannelStateSaveMock };
             },
         },
+        resolveRecordingStorageAccountID: resolveStorageMock,
+        storeRealtimeRecording: storeRecordingMock,
+        writeRealtimeRecordingSegment: writeSegmentMock,
+        deleteRealtimeRecordingSegments: deleteSegmentsMock,
     };
 });
 
@@ -131,8 +145,24 @@ vi.mock('../util.js', () => ({
     GetReadWriteProvider: () => currentProvider,
 }));
 
+// --- Partial mock: control ONLY UserCache.GetSystemUser (the scoped-anonymous elevation seam,
+//     issue #3371); everything else in the data provider stays real ---
+const getSystemUserMock = vi.fn<[], UserInfo | undefined>();
+vi.mock('@memberjunction/sqlserver-dataprovider', async (importOriginal) => {
+    const actual = await importOriginal<Record<string, unknown>>();
+    return {
+        ...actual,
+        UserCache: {
+            get Instance() {
+                return { GetSystemUser: getSystemUserMock };
+            },
+        },
+    };
+});
+
 import { RealtimeClientSessionResolver } from '../resolvers/RealtimeClientSessionResolver.js';
 import type { AppContext } from '../types.js';
+import type { UserInfo } from '@memberjunction/core';
 
 const USER = { ID: 'user-1', Email: 'tester@example.com' };
 
@@ -221,6 +251,16 @@ beforeEach(() => {
     createSessionMock.mockReset();
     closeSessionMock.mockClear();
     heartbeatMock.mockClear();
+    getSystemUserMock.mockReset();
+    getSystemUserMock.mockReturnValue(undefined);
+    resolveStorageMock.mockReset();
+    resolveStorageMock.mockResolvedValue('storage-acct-1');
+    storeRecordingMock.mockReset();
+    storeRecordingMock.mockResolvedValue('file-1');
+    writeSegmentMock.mockReset();
+    writeSegmentMock.mockResolvedValue(true);
+    deleteSegmentsMock.mockReset();
+    deleteSegmentsMock.mockResolvedValue(0);
     agentsMock.mockReturnValue([{ ID: 'co-agent-1', Name: 'Realtime Co-Agent' }]);
     agentTypesMock.mockReturnValue([]);
 });
@@ -2662,6 +2702,9 @@ describe('RealtimeClientSessionResolver — app awareness (applicationId / appCo
             }),
         );
         executeRelayedToolMock.mockResolvedValue({ ResultJson: '{"ok":true}', Success: true });
+        // The union is CanRun-gated against the caller before dispatch — grant it here so this test
+        // covers the pass-through, not the gate (which has its own describe block).
+        hasPermissionMock.mockResolvedValue(true);
         const resolver = makeResolver();
 
         await resolver.ExecuteRealtimeSessionTool(
@@ -2672,3 +2715,380 @@ describe('RealtimeClientSessionResolver — app awareness (applicationId / appCo
         expect(relayArg.AllowedAgents?.map(a => a.agentId)).toEqual(['skip-1']);
     });
 });
+
+describe('RealtimeClientSessionResolver — scoped-anonymous elevation (issue #3371)', () => {
+    /** A scoped anonymous magic-link caller (no widget context) — the elevation-eligible shape. */
+    const ANON_USER = {
+        ID: 'anon-1',
+        Email: 'anonymous@magic-link.local',
+        IsMagicLinkAnonymous: true,
+        MagicLinkScope: { ResourceID: 'scope-res-1' },
+    };
+    const SYSTEM_USER = { ID: 'system-1', Email: 'system@system.org' } as UserInfo;
+
+    /** Resolver whose caller is the scoped anonymous visitor. */
+    function makeAnonResolver(): RealtimeClientSessionResolver {
+        const resolver = new RealtimeClientSessionResolver();
+        (resolver as unknown as { GetUserFromPayload: () => unknown }).GetUserFromPayload = () => ANON_USER;
+        return resolver;
+    }
+
+    /** The provider's GetEntityObject spy, typed for call-args assertions. */
+    function getEntityObjectSpy(): ReturnType<typeof vi.fn> {
+        return (currentProvider as { GetEntityObject: ReturnType<typeof vi.fn> }).GetEntityObject;
+    }
+
+    beforeEach(() => {
+        getSystemUserMock.mockReturnValue(SYSTEM_USER);
+    });
+
+    it('dispatches the relayed tool as the SYSTEM user while the ownership gate stays on the caller', async () => {
+        currentProvider = makeProvider(() => makeSessionEntity({ UserID: 'anon-1' }));
+        executeRelayedToolMock.mockResolvedValue({ ResultJson: '{"ok":true}', Success: true });
+        const resolver = makeAnonResolver();
+
+        const out = await resolver.ExecuteRealtimeSessionTool(
+            'session-1', 'call-1', 'invoke-target-agent', '{}', makeCtx(), makePubSub(),
+        );
+
+        expect(out).toBe('{"ok":true}');
+        // The session load (ownership gate) ran as the CALLER…
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: AI Agent Sessions', ANON_USER);
+        // …the delegated dispatch ran as the SYSTEM user…
+        expect(executeRelayedToolMock.mock.calls[0][1]).toBe(SYSTEM_USER);
+        // …and the heartbeat (a session write the anon role holds) stayed on the caller.
+        expect(heartbeatMock).toHaveBeenCalledWith('session-1', ANON_USER, currentProvider);
+    });
+
+    it('attributes the delegated run to the VISITOR even though it executes as the system user', async () => {
+        currentProvider = makeProvider(() => makeSessionEntity({ UserID: 'anon-1' }));
+        executeRelayedToolMock.mockResolvedValue({ ResultJson: '{"ok":true}', Success: true });
+        const resolver = makeAnonResolver();
+
+        await resolver.ExecuteRealtimeSessionTool('session-1', 'call-1', 'invoke-target-agent', '{}', makeCtx(), makePubSub());
+
+        // Executes as system (the run entities are outside the anon role)…
+        expect(executeRelayedToolMock.mock.calls[0][1]).toBe(SYSTEM_USER);
+        // …but the run row and its context-memory scope stay the visitor's.
+        expect(executeRelayedToolMock.mock.calls[0][0].AttributionUserID).toBe('anon-1');
+    });
+
+    it('still rejects a non-owned session for a scoped anonymous caller before any elevated work', async () => {
+        currentProvider = makeProvider(() => makeSessionEntity({ UserID: 'someone-else' }));
+        const resolver = makeAnonResolver();
+
+        await expect(
+            resolver.ExecuteRealtimeSessionTool('session-1', 'call-1', 'invoke-target-agent', '{}', makeCtx(), makePubSub()),
+        ).rejects.toThrow(/do not own/i);
+        expect(executeRelayedToolMock).not.toHaveBeenCalled();
+    });
+
+    it('dispatches as the caller unchanged for a normal authenticated user', async () => {
+        currentProvider = makeProvider(() => makeSessionEntity());
+        executeRelayedToolMock.mockResolvedValue({ ResultJson: '{"ok":true}', Success: true });
+        const resolver = makeResolver();
+
+        await resolver.ExecuteRealtimeSessionTool('session-1', 'call-1', 'invoke-target-agent', '{}', makeCtx(), makePubSub());
+
+        expect(executeRelayedToolMock.mock.calls[0][1]).toBe(USER);
+        expect(getSystemUserMock).not.toHaveBeenCalled();
+    });
+
+    it('FAILS CLOSED — dispatches as the anonymous caller when no system user is available', async () => {
+        getSystemUserMock.mockReturnValue(undefined);
+        currentProvider = makeProvider(() => makeSessionEntity({ UserID: 'anon-1' }));
+        executeRelayedToolMock.mockResolvedValue({ ResultJson: '{"ok":true}', Success: true });
+        const resolver = makeAnonResolver();
+
+        await resolver.ExecuteRealtimeSessionTool('session-1', 'call-1', 'invoke-target-agent', '{}', makeCtx(), makePubSub());
+
+        expect(executeRelayedToolMock.mock.calls[0][1]).toBe(ANON_USER);
+    });
+
+    it('accumulates relayed usage onto the prompt run under the SYSTEM user', async () => {
+        const session = makeSessionEntity({
+            UserID: 'anon-1',
+            Config_: JSON.stringify({ targetAgentID: 'target-1', promptRunID: 'prompt-run-1' }),
+        });
+        const promptRun = makeSessionEntity({ ID: 'prompt-run-1', TokensPrompt: null, TokensCompletion: null, TokensUsed: null });
+        currentProvider = {
+            GetEntityObject: vi.fn(async (name: string) => (name === 'MJ: AI Prompt Runs' ? promptRun : session)),
+        };
+        const resolver = makeAnonResolver();
+
+        const ok = await resolver.RelayRealtimeUsage('session-1', 100, 25, makeCtx());
+
+        expect(ok).toBe(true);
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: AI Agent Sessions', ANON_USER);
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: AI Prompt Runs', SYSTEM_USER);
+        expect(promptRun.Save).toHaveBeenCalled();
+    });
+
+    it('mirrors the transcript turn onto the prompt run as SYSTEM while the Conversation Detail stays the caller', async () => {
+        const session = makeSessionEntity({
+            UserID: 'anon-1',
+            Config_: JSON.stringify({ targetAgentID: 'target-1', promptRunID: 'prompt-run-1' }),
+        });
+        const promptRun = makeSessionEntity({ ID: 'prompt-run-1', Messages: null });
+        const detail = makeSessionEntity({ ID: 'detail-1' });
+        currentProvider = {
+            GetEntityObject: vi.fn(async (name: string) => {
+                if (name === 'MJ: AI Prompt Runs') return promptRun;
+                if (name === 'MJ: Conversation Details') return detail;
+                return session;
+            }),
+        };
+        const resolver = makeAnonResolver();
+
+        const ok = await resolver.RelayRealtimeTranscript('session-1', 'User', 'hello there', makeCtx());
+
+        expect(ok).toBe(true);
+        // The visible chat turn is written as the CALLER (the anon role holds Conversation Details)…
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: Conversation Details', ANON_USER);
+        // …the co-agent prompt-run mirror is written as the SYSTEM user.
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: AI Prompt Runs', SYSTEM_USER);
+        expect(promptRun.Save).toHaveBeenCalled();
+    });
+
+    it('records the co-agent tool turn (RelayRealtimeToolTurn) under the SYSTEM user', async () => {
+        const session = makeSessionEntity({
+            UserID: 'anon-1',
+            Config_: JSON.stringify({ targetAgentID: 'target-1', promptRunID: 'prompt-run-1' }),
+        });
+        const promptRun = makeSessionEntity({ ID: 'prompt-run-1', Messages: null });
+        currentProvider = {
+            GetEntityObject: vi.fn(async (name: string) => (name === 'MJ: AI Prompt Runs' ? promptRun : session)),
+        };
+        const resolver = makeAnonResolver();
+
+        const ok = await resolver.RelayRealtimeToolTurn('session-1', 'browser_navigate', makeCtx(), '{"url":"x"}');
+
+        expect(ok).toBe(true);
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: AI Prompt Runs', SYSTEM_USER);
+    });
+
+    it('prepares the session with observability under the SYSTEM user while UserID stays the visitor', async () => {
+        hasPermissionMock.mockResolvedValue(true);
+        currentProvider = makeProvider(() => makeSessionEntity({ UserID: 'anon-1' }));
+        createSessionMock.mockResolvedValue(makeSessionEntity({ ID: 'session-anon', UserID: 'anon-1' }));
+        prepareClientSessionMock.mockResolvedValue({
+            Success: true,
+            ClientConfig: {
+                Provider: 'openai',
+                Model: 'gpt-realtime',
+                EphemeralToken: 'ek_abc',
+                ExpiresAt: '2026-01-01T00:00:00Z',
+                SessionConfig: {},
+            },
+        });
+        const resolver = makeAnonResolver();
+
+        await resolver.StartRealtimeClientSession('target-1', makeCtx());
+
+        // CanRun stays gated on the CALLER — elevation never widens who can start a session.
+        expect(hasPermissionMock).toHaveBeenCalledWith('target-1', ANON_USER, 'run');
+        const [prepInput, prepUser] = prepareClientSessionMock.mock.calls[0] as [
+            { UserID?: string }, unknown,
+        ];
+        // Observability creation runs as the SYSTEM user…
+        expect(prepUser).toBe(SYSTEM_USER);
+        // …but run attribution + memory scope stay the visitor's.
+        expect(prepInput.UserID).toBe('anon-1');
+    });
+
+    it('junction-links delegated artifacts under the SYSTEM user and stamps the hidden anchor with the SESSION owner', async () => {
+        const session = makeSessionEntity({ UserID: 'anon-1' });
+        const junctions: FakeSession[] = [];
+        const anchors: FakeSession[] = [];
+        currentProvider = {
+            GetEntityObject: vi.fn(async (name: string) => {
+                if (name === 'MJ: Conversation Detail Artifacts') {
+                    const junction = makeSessionEntity({ ID: `junction-${junctions.length + 1}` });
+                    junctions.push(junction);
+                    return junction;
+                }
+                if (name === 'MJ: Conversation Details') {
+                    const anchor = makeSessionEntity({ ID: 'anchor-detail-1' });
+                    anchors.push(anchor);
+                    return anchor;
+                }
+                return session;
+            }),
+            RunView: vi.fn(async () => ({ Success: true, Results: [] })),
+        };
+        executeRelayedToolMock.mockResolvedValue({
+            ResultJson: '{"ok":true}',
+            Success: true,
+            Artifacts: [{ ArtifactID: 'a-1', ArtifactVersionID: 'av-1', Name: 'Report' }],
+        });
+        const resolver = makeAnonResolver();
+
+        await resolver.ExecuteRealtimeSessionTool('session-1', 'call-1', 'invoke-target-agent', '{}', makeCtx(), makePubSub());
+
+        // The junction write (an entity the anon role does NOT hold) runs as the SYSTEM user.
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: Conversation Detail Artifacts', SYSTEM_USER);
+        expect(junctions).toHaveLength(1);
+        // The hidden anchor is attributed to the SESSION owner, not the elevated principal.
+        expect(anchors).toHaveLength(1);
+        expect(anchors[0].UserID).toBe('anon-1');
+    });
+
+    /** Provider routing the session (ownership) and the co-agent (recording storage resolution). */
+    function makeRecordingProvider(): unknown {
+        const session = makeSessionEntity({ UserID: 'anon-1' });
+        const agent = makeSessionEntity({ ID: 'co-agent-1' });
+        return {
+            GetEntityObject: vi.fn(async (name: string) => (name === 'MJ: AI Agents' ? agent : session)),
+        };
+    }
+    const AUDIO_B64 = Buffer.from('abc').toString('base64');
+
+    it('stores the consolidated recording under the SYSTEM user (ownership + consent stay caller-gated)', async () => {
+        currentProvider = makeRecordingProvider();
+        const resolver = makeAnonResolver();
+
+        const result = await resolver.UploadRealtimeRecording('session-1', AUDIO_B64, 'audio/wav', makeCtx(), 1000, true);
+
+        expect(result.Success).toBe(true);
+        // Ownership ran as the CALLER; the agent read (an entity the anon role does not hold) as SYSTEM.
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: AI Agent Sessions', ANON_USER);
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: AI Agents', SYSTEM_USER);
+        // Storage-account resolution, the MJ: Files write, and the shard cleanup all run as SYSTEM.
+        expect(resolveStorageMock.mock.calls[0][1]).toBe(SYSTEM_USER);
+        expect((storeRecordingMock.mock.calls[0][0] as { ContextUser: unknown }).ContextUser).toBe(SYSTEM_USER);
+        expect(deleteSegmentsMock).toHaveBeenCalledWith('session-1', 'storage-acct-1', SYSTEM_USER);
+    });
+
+    it('still refuses a consent-less recording upload BEFORE any elevated work', async () => {
+        currentProvider = makeRecordingProvider();
+        const resolver = makeAnonResolver();
+
+        const result = await resolver.UploadRealtimeRecording('session-1', AUDIO_B64, 'audio/wav', makeCtx(), 1000, false);
+
+        expect(result.Success).toBe(false);
+        expect(storeRecordingMock).not.toHaveBeenCalled();
+    });
+
+    it('stores a crash-recovery recording segment under the SYSTEM user', async () => {
+        currentProvider = makeRecordingProvider();
+        const resolver = makeAnonResolver();
+
+        const ok = await resolver.UploadRealtimeRecordingSegment('session-1', 0, AUDIO_B64, 'audio/wav', makeCtx());
+
+        expect(ok).toBe(true);
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: AI Agent Sessions', ANON_USER);
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: AI Agents', SYSTEM_USER);
+        expect((writeSegmentMock.mock.calls[0][0] as { ContextUser: unknown }).ContextUser).toBe(SYSTEM_USER);
+    });
+
+    it('recording writes stay entirely on the caller for a normal authenticated user', async () => {
+        currentProvider = makeRecordingProvider();
+        // A named caller owning the session (the recording provider stamps UserID 'anon-1', so re-stamp).
+        const session = makeSessionEntity({ UserID: 'user-1' });
+        const agent = makeSessionEntity({ ID: 'co-agent-1' });
+        currentProvider = {
+            GetEntityObject: vi.fn(async (name: string) => (name === 'MJ: AI Agents' ? agent : session)),
+        };
+        const resolver = makeResolver();
+
+        const result = await resolver.UploadRealtimeRecording('session-1', AUDIO_B64, 'audio/wav', makeCtx(), 1000, true);
+
+        expect(result.Success).toBe(true);
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: AI Agents', USER);
+        expect((storeRecordingMock.mock.calls[0][0] as { ContextUser: unknown }).ContextUser).toBe(USER);
+        expect(getSystemUserMock).not.toHaveBeenCalled();
+    });
+});
+
+describe('RealtimeClientSessionResolver — colleague authorization (allowedAgents)', () => {
+    /** A two-colleague session config: the lead plus a restricted and an open colleague. */
+    function makeMultiTargetSession(userID: string): FakeSession {
+        return makeSessionEntity({
+            UserID: userID,
+            Config_: JSON.stringify({
+                targetAgentID: 'target-1',
+                allowedAgents: [
+                    { agentId: 'colleague-open', label: 'Open Colleague' },
+                    { agentId: 'colleague-restricted', label: 'Restricted Colleague' },
+                ],
+            }),
+        });
+    }
+
+    /** CanRun: everything except `colleague-restricted`. */
+    function grantAllExceptRestricted(): void {
+        hasPermissionMock.mockImplementation((...args: unknown[]) =>
+            Promise.resolve(args[0] !== 'colleague-restricted'),
+        );
+    }
+
+    /** The `AllowedAgents` union the resolver actually handed to the delegation layer. */
+    function dispatchedAgentIDs(): string[] {
+        const input = executeRelayedToolMock.mock.calls[0][0] as { AllowedAgents?: { agentId: string }[] };
+        return (input.AllowedAgents ?? []).map((a) => a.agentId);
+    }
+
+    beforeEach(() => {
+        executeRelayedToolMock.mockResolvedValue({ ResultJson: '{"ok":true}', Success: true });
+        getSystemUserMock.mockReturnValue({ ID: 'system-1', Email: 'system@system.org' } as UserInfo);
+    });
+
+    it('drops colleagues the AUTHENTICATED caller cannot run', async () => {
+        currentProvider = makeProvider(() => makeMultiTargetSession('user-1'));
+        grantAllExceptRestricted();
+
+        await makeResolver().ExecuteRealtimeSessionTool(
+            'session-1', 'call-1', 'invoke-target-agent', '{}', makeCtx(), makePubSub(),
+        );
+
+        expect(dispatchedAgentIDs()).toEqual(['colleague-open']);
+    });
+
+    it('gates the union against the CALLER, not the elevated system user (issue #3371)', async () => {
+        const anonUser = {
+            ID: 'anon-1',
+            Email: 'anonymous@magic-link.local',
+            IsMagicLinkAnonymous: true,
+            MagicLinkScope: { ResourceID: 'scope-res-1' },
+        };
+        currentProvider = makeProvider(() => makeMultiTargetSession('anon-1'));
+        grantAllExceptRestricted();
+        const resolver = new RealtimeClientSessionResolver();
+        (resolver as unknown as { GetUserFromPayload: () => unknown }).GetUserFromPayload = () => anonUser;
+
+        await resolver.ExecuteRealtimeSessionTool(
+            'session-1', 'call-1', 'invoke-target-agent', '{}', makeCtx(), makePubSub(),
+        );
+
+        // Elevation must never widen agent authority: the restricted colleague is still gone…
+        expect(dispatchedAgentIDs()).toEqual(['colleague-open']);
+        // …and every CanRun verdict was asked about the visitor, never the system user.
+        for (const call of hasPermissionMock.mock.calls) {
+            expect((call as unknown[])[1]).toBe(anonUser);
+        }
+    });
+
+    it('excludes every colleague when the caller can run none of them', async () => {
+        currentProvider = makeProvider(() => makeMultiTargetSession('user-1'));
+        hasPermissionMock.mockResolvedValue(false);
+
+        await makeResolver().ExecuteRealtimeSessionTool(
+            'session-1', 'call-1', 'invoke-target-agent', '{}', makeCtx(), makePubSub(),
+        );
+
+        expect(dispatchedAgentIDs()).toEqual([]);
+    });
+
+    it('passes a single-target session through with no permission checks', async () => {
+        currentProvider = makeProvider(() => makeSessionEntity());
+        hasPermissionMock.mockResolvedValue(true);
+
+        await makeResolver().ExecuteRealtimeSessionTool(
+            'session-1', 'call-1', 'invoke-target-agent', '{}', makeCtx(), makePubSub(),
+        );
+
+        const input = executeRelayedToolMock.mock.calls[0][0] as { AllowedAgents?: unknown };
+        expect(input.AllowedAgents).toBeUndefined();
+        expect(hasPermissionMock).not.toHaveBeenCalled();
+    });
+});

package/src/__tests__/SessionManager.test.ts

@@ -40,6 +40,21 @@ vi.mock('@memberjunction/core', async (importOriginal) => {
     };
 });
 
+// --- Partial mock: control ONLY UserCache.GetSystemUser (the scoped-anonymous elevation seam,
+//     issue #3371); everything else in the data provider stays real ---
+const getSystemUserMock = vi.fn<[], UserInfo | undefined>();
+vi.mock('@memberjunction/sqlserver-dataprovider', async (importOriginal) => {
+    const actual = await importOriginal<Record<string, unknown>>();
+    return {
+        ...actual,
+        UserCache: {
+            get Instance() {
+                return { GetSystemUser: getSystemUserMock };
+            },
+        },
+    };
+});
+
 import { SessionManager, SessionAuthorizationError } from '../agentSessions/SessionManager.js';
 import type { UserInfo, IMetadataProvider } from '@memberjunction/core';
 
@@ -94,6 +109,8 @@ beforeEach(() => {
     hostSessionClosedMock.mockResolvedValue(undefined);
     runViewMock.mockReset();
     runViewMock.mockResolvedValue({ Success: true, Results: [] });
+    getSystemUserMock.mockReset();
+    getSystemUserMock.mockReturnValue(undefined);
 });
 
 describe('SessionManager.CreateSession', () => {
@@ -245,6 +262,51 @@ describe('SessionManager.CloseSession', () => {
         expect(finalizeCoAgentRunMock).toHaveBeenCalledWith('co-run-6', 'prompt-run-6', user, provider, true, 'run-step-6');
     });
 
+    it('finalizes as the SYSTEM user when a scoped anonymous owner closes their session (issue #3371)', async () => {
+        const systemUser = { ID: 'system-1', Email: 'system@system.org' } as unknown as UserInfo;
+        getSystemUserMock.mockReturnValue(systemUser);
+        const anonUser = {
+            ID: 'anon-1',
+            Email: 'anonymous@magic-link.local',
+            IsMagicLinkAnonymous: true,
+            MagicLinkScope: { ResourceID: 'res-1' },
+        } as unknown as UserInfo;
+        const session = makeSessionEntity({
+            ID: 'session-anon',
+            Status: 'Active',
+            Config_: JSON.stringify({ targetAgentID: 't1', coAgentRunID: 'co-run-9', promptRunID: 'prompt-run-9' }),
+        });
+        const { provider } = makeProvider(() => session);
+        const mgr = new SessionManager();
+
+        const ok = await mgr.CloseSession('session-anon', anonUser, provider);
+
+        expect(ok).toBe(true);
+        // The session-close writes themselves stay on the caller — only finalize elevates.
+        expect(session.Status).toBe('Closed');
+        expect(finalizeCoAgentRunMock).toHaveBeenCalledWith('co-run-9', 'prompt-run-9', systemUser, provider, true, null);
+    });
+
+    it('FAILS CLOSED — finalizes as the anonymous caller when no system user is available', async () => {
+        getSystemUserMock.mockReturnValue(undefined);
+        const anonUser = {
+            ID: 'anon-1',
+            IsMagicLinkAnonymous: true,
+            MagicLinkScope: { ResourceID: 'res-1' },
+        } as unknown as UserInfo;
+        const session = makeSessionEntity({
+            ID: 'session-anon-2',
+            Status: 'Active',
+            Config_: JSON.stringify({ targetAgentID: 't1', coAgentRunID: 'co-run-10', promptRunID: null }),
+        });
+        const { provider } = makeProvider(() => session);
+        const mgr = new SessionManager();
+
+        await mgr.CloseSession('session-anon-2', anonUser, provider);
+
+        expect(finalizeCoAgentRunMock).toHaveBeenCalledWith('co-run-10', null, anonUser, provider, true, null);
+    });
+
     it('does not finalize when the session config has no run ids (target only)', async () => {
         const session = makeSessionEntity({
             ID: 'session-no-runs',