@memberjunction/server 5.50.0 → 6.1.0-edge.0

package/src/__tests__/multiTenancy.security.test.ts

@@ -6,9 +6,16 @@
  * in multiTenancy.test.ts.
  */
 import { describe, it, expect, vi } from 'vitest';
-import { createTenantPreRunViewHook, createTenantPreSaveHook, createTenantMiddleware } from '../multiTenancy/index.js';
+import {
+  createTenantPreRunViewHook,
+  createTenantPreSaveHook,
+  createTenantMiddleware,
+  IsValidTenantId,
+  attachTenantContext,
+} from '../multiTenancy/index.js';
 import type { MultiTenancyConfig } from '../config.js';
-import type { RunViewParams } from '@memberjunction/core';
+import { Metadata } from '@memberjunction/core';
+import type { RunViewParams, UserInfo, TenantContext } from '@memberjunction/core';
 
 // Mock @memberjunction/core Metadata for entity schema lookup.
 vi.mock('@memberjunction/core', async (importOriginal) => {
@@ -20,6 +27,31 @@ vi.mock('@memberjunction/core', async (importOriginal) => {
       { Name: 'Orders', SchemaName: 'dbo' },
       { Name: 'Users', SchemaName: '__mj' },
     ];
+
+    // The hook validates that the tenant column resolves to a real, stored
+    // (non-virtual) field before interpolating it as an identifier.
+    EntityByName(name: string) {
+      const entity = this.Entities.find(
+        e => e.Name.trim().toLowerCase() === name.trim().toLowerCase()
+      );
+      if (!entity) return undefined;
+      return {
+        ...entity,
+        Fields: [
+          { Name: 'OrganizationID', IsVirtual: false },
+          { Name: 'TenantID', IsVirtual: false },
+          // A view-only column: must be REJECTED as a tenant column target
+          { Name: 'OrganizationName', IsVirtual: true },
+        ],
+      };
+    }
+
+    // QuoteFilterIdentifier reads the STATIC Metadata.Provider, matching a real
+    // server (Metadata.Provider is a DatabaseProviderBase instance). Tests that need
+    // to exercise the no-provider-available fail-closed path override this locally.
+    static Provider: { QuoteIdentifier: (name: string) => string } | undefined = {
+      QuoteIdentifier: (name: string) => `[${name}]`,
+    };
   }
 
   return {
@@ -58,41 +90,164 @@ function makeUser(tenantId?: string, roles: string[] = []): MockUser {
 
 describe('Multi-Tenancy Security Edge Cases', () => {
   describe('SQL injection in tenant ID', () => {
-    it('should treat SQL injection attempt as literal tenant ID', () => {
+    it('should escape quotes so an injection attempt stays INSIDE the string literal', () => {
       const hook = createTenantPreRunViewHook(makeConfig());
       const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
       const user = makeUser("' OR 1=1 --");
 
       const result = hook(params, user) as RunViewParams;
 
-      // The tenant ID is inserted as-is — the SQL provider should use
-      // parameterized queries to prevent actual injection.
-      // The hook correctly generates a filter with the raw value.
-      expect(result.ExtraFilter).toContain("' OR 1=1 --");
-      expect(result.ExtraFilter).toBe("[OrganizationID] = '' OR 1=1 --'");
+      // The single quote is doubled at predicate construction, so the payload
+      // cannot terminate the literal and rewrite the WHERE clause. (The header
+      // boundary rejects this value outright via IsValidTenantId; this is the
+      // defense-in-depth layer for TenantContext attached from other sources.)
+      expect(result.ExtraFilter).toBe("[OrganizationID] = ''' OR 1=1 --'");
     });
 
-    it('should handle tenant ID with SQL UNION attack', () => {
+    it('should escape quotes in a UNION attack payload', () => {
       const hook = createTenantPreRunViewHook(makeConfig());
       const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
       const user = makeUser("' UNION SELECT * FROM Users --");
 
       const result = hook(params, user) as RunViewParams;
-      expect(result.ExtraFilter).toContain("UNION SELECT");
-      // Note: This is a known limitation — the filter is string-concatenated.
-      // Defense-in-depth: the tenant ID should be validated upstream before
-      // it reaches TenantContext. Middle-layer middleware (e.g., BCSaaS)
-      // should validate that the tenant ID is a valid UUID or org ID.
+      // Leading quote doubled → the UNION text is inert literal content
+      expect(result.ExtraFilter).toBe("[OrganizationID] = ''' UNION SELECT * FROM Users --'");
     });
 
-    it('should handle tenant ID with semicolon (statement terminator)', () => {
+    it('should escape quotes in a stacked-statement payload', () => {
       const hook = createTenantPreRunViewHook(makeConfig());
       const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
       const user = makeUser("abc'; DROP TABLE Customers; --");
 
       const result = hook(params, user) as RunViewParams;
-      expect(result.ExtraFilter).toContain("DROP TABLE");
-      // Same caveat: parameterized queries at the DB layer prevent execution
+      expect(result.ExtraFilter).toBe("[OrganizationID] = 'abc''; DROP TABLE Customers; --'");
+    });
+  });
+
+  // ─── Boundary validation: IsValidTenantId ───────────────────────────────
+
+  describe('IsValidTenantId', () => {
+    it('rejects a quote-based SQL injection payload', () => {
+      expect(IsValidTenantId("x' OR '1'='1")).toBe(false);
+    });
+
+    it('rejects the empty string', () => {
+      expect(IsValidTenantId('')).toBe(false);
+    });
+
+    it('rejects a 129-character string (max is 128)', () => {
+      expect(IsValidTenantId('a'.repeat(129))).toBe(false);
+    });
+
+    it('accepts a 128-character string (boundary)', () => {
+      expect(IsValidTenantId('a'.repeat(128))).toBe(true);
+    });
+
+    it('rejects whitespace, semicolons, and comparison operators', () => {
+      expect(IsValidTenantId('tenant 1')).toBe(false);
+      expect(IsValidTenantId('a;b')).toBe(false);
+      expect(IsValidTenantId("1'='1")).toBe(false);
+      expect(IsValidTenantId('a=b')).toBe(false);
+    });
+
+    it('accepts a standard GUID', () => {
+      expect(IsValidTenantId('550e8400-e29b-41d4-a716-446655440000')).toBe(true);
+    });
+
+    it('accepts conservative identifiers with underscore, dot, and hyphen', () => {
+      expect(IsValidTenantId('tenant_1.a-b')).toBe(true);
+    });
+
+    it('KNOWN GAP: accepts consecutive hyphens (SQL line-comment token) because GUIDs need hyphens', () => {
+      // 'a--b' passes the character allowlist. This is safe today only because
+      // every consumer interpolates the value inside a quote-escaped string
+      // literal, where '--' is inert. If a future consumer places the tenant id
+      // outside a quoted literal, this becomes a comment-injection vector —
+      // flagged here so a tightening of the pattern flips this assertion.
+      expect(IsValidTenantId('a--b')).toBe(true);
+    });
+  });
+
+  // ─── attachTenantContext validation ─────────────────────────────────────
+
+  describe('attachTenantContext', () => {
+    function makePlainUser(): UserInfo {
+      return { ID: 'user-1' } as unknown as UserInfo;
+    }
+
+    it('throws on an invalid tenant id instead of attaching it', () => {
+      const user = makePlainUser();
+      expect(() => attachTenantContext(user, "x' OR '1'='1", 'header')).toThrow(/Invalid tenant identifier/);
+      expect(user.TenantContext).toBeUndefined();
+    });
+
+    it('throws on empty and oversized tenant ids', () => {
+      const user = makePlainUser();
+      expect(() => attachTenantContext(user, '', 'custom')).toThrow(/Invalid tenant identifier/);
+      expect(() => attachTenantContext(user, 'a'.repeat(129), 'custom')).toThrow(/Invalid tenant identifier/);
+    });
+
+    it('attaches a valid tenant id with the given source', () => {
+      const user = makePlainUser();
+      attachTenantContext(user, 'tenant_1.a-b', 'linkedEntity');
+      expect(user.TenantContext).toEqual<TenantContext>({ TenantID: 'tenant_1.a-b', Source: 'linkedEntity' });
+    });
+  });
+
+  // ─── Tenant column resolution (identifier position) ─────────────────────
+
+  describe('tenant column must resolve to a stored field', () => {
+    it('produces an escaped-value predicate with a quoted identifier for a valid setup', () => {
+      const hook = createTenantPreRunViewHook(makeConfig());
+      const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
+      const user = makeUser("t'1"); // legal only via non-header sources; must still be escaped
+
+      const result = hook(params, user) as RunViewParams;
+      expect(result.ExtraFilter).toBe("[OrganizationID] = 't''1'");
+    });
+
+    it('throws when the configured tenant column does not exist on the entity', () => {
+      const hook = createTenantPreRunViewHook(makeConfig({ defaultTenantColumn: 'NoSuchColumn' }));
+      const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
+      const user = makeUser('tenant-1');
+
+      expect(() => hook(params, user)).toThrow(/does not resolve to a stored field/);
+    });
+
+    it('throws when the tenant column resolves only to a VIRTUAL field', () => {
+      const hook = createTenantPreRunViewHook(makeConfig({ defaultTenantColumn: 'OrganizationName' }));
+      const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
+      const user = makeUser('tenant-1');
+
+      expect(() => hook(params, user)).toThrow(/does not resolve to a stored field/);
+    });
+
+    it('throws when an entityColumnMappings override points at a nonexistent column', () => {
+      const hook = createTenantPreRunViewHook(makeConfig({
+        entityColumnMappings: { 'Customers': "Bad]Column" },
+      }));
+      const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
+      const user = makeUser('tenant-1');
+
+      expect(() => hook(params, user)).toThrow(/does not resolve to a stored field/);
+    });
+
+    it('throws (fails closed) rather than falling back to hardcoded bracket quoting when no provider is available', () => {
+      const savedProvider = Metadata.Provider;
+      // @ts-expect-error — simulating the no-provider-available case
+      Metadata.Provider = undefined;
+      try {
+        const hook = createTenantPreRunViewHook(makeConfig());
+        const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
+        const user = makeUser('tenant-1');
+
+        // A silent bracket-quoting fallback would produce invalid SQL on PostgreSQL
+        // without ever surfacing an error — refusing to build the query at all is the
+        // correct fail-closed behavior for a security-relevant identifier quote.
+        expect(() => hook(params, user)).toThrow(/no database provider available to quote/);
+      } finally {
+        Metadata.Provider = savedProvider;
+      }
     });
   });
 
@@ -232,12 +387,13 @@ describe('Multi-Tenancy Security Edge Cases', () => {
       expect(next).toHaveBeenCalledTimes(1);
     });
 
-    it('should attach TenantContext when userPayload and header are present', () => {
+    it('should attach TenantContext to a CLONED userRecord when userPayload and header are present', () => {
       const middleware = createTenantMiddleware(makeConfig());
       const userRecord = { ID: 'u1' } as Record<string, unknown>;
+      const userPayload = { userRecord, email: 'test@test.com', sessionId: 's1' };
       const req = {
         headers: { 'x-tenant-id': 'tenant-abc' },
-        userPayload: { userRecord, email: 'test@test.com', sessionId: 's1' },
+        userPayload,
       } as unknown as Parameters<typeof middleware>[0];
       const res = {} as Parameters<typeof middleware>[1];
       const next = vi.fn();
@@ -245,26 +401,56 @@ describe('Multi-Tenancy Security Edge Cases', () => {
       middleware(req, res, next);
 
       expect(next).toHaveBeenCalledTimes(1);
-      expect(userRecord['TenantContext']).toEqual({
+      // Clone-before-stamp: the SHARED cached record must never be mutated —
+      // stamping it in place leaks one session's tenant to concurrent sessions.
+      expect(userRecord['TenantContext']).toBeUndefined();
+      const stamped = userPayload.userRecord as unknown as UserInfo;
+      expect(stamped).not.toBe(userRecord);
+      expect(stamped.ID).toBe('u1');
+      expect(stamped.TenantContext).toEqual({
         TenantID: 'tenant-abc',
         Source: 'header',
       });
     });
 
+    it('should reject an invalid tenant header with 400 and never attach or continue', () => {
+      const middleware = createTenantMiddleware(makeConfig());
+      const userRecord = { ID: 'u1' } as Record<string, unknown>;
+      const userPayload = { userRecord, email: 'test@test.com', sessionId: 's1' };
+      const req = {
+        headers: { 'x-tenant-id': "x' OR '1'='1" },
+        userPayload,
+      } as unknown as Parameters<typeof middleware>[0];
+      const json = vi.fn();
+      const status = vi.fn().mockReturnValue({ json });
+      const res = { status } as unknown as Parameters<typeof middleware>[1];
+      const next = vi.fn();
+
+      middleware(req, res, next);
+
+      // Reject the REQUEST — never degrade to an unscoped (fail-open) session
+      expect(status).toHaveBeenCalledWith(400);
+      expect(json).toHaveBeenCalledWith({ error: 'Invalid tenant identifier' });
+      expect(next).not.toHaveBeenCalled();
+      expect(userPayload.userRecord).toBe(userRecord);
+      expect(userRecord['TenantContext']).toBeUndefined();
+    });
+
     it('should handle case-insensitive header name', () => {
       const middleware = createTenantMiddleware(makeConfig({ tenantHeader: 'X-Tenant-ID' }));
       const userRecord = { ID: 'u1' } as Record<string, unknown>;
+      const userPayload = { userRecord, email: 'test@test.com', sessionId: 's1' };
       const req = {
         // Express normalizes headers to lowercase
         headers: { 'x-tenant-id': 'tenant-xyz' },
-        userPayload: { userRecord, email: 'test@test.com', sessionId: 's1' },
+        userPayload,
       } as unknown as Parameters<typeof middleware>[0];
       const res = {} as Parameters<typeof middleware>[1];
       const next = vi.fn();
 
       middleware(req, res, next);
 
-      expect(userRecord['TenantContext']).toEqual({
+      expect((userPayload.userRecord as unknown as UserInfo).TenantContext).toEqual({
         TenantID: 'tenant-xyz',
         Source: 'header',
       });
@@ -284,6 +470,52 @@ describe('Multi-Tenancy Security Edge Cases', () => {
 
       expect(userRecord['TenantContext']).toBeUndefined();
     });
+
+    it('should reject a repeated header (array value) with 400 rather than guessing which value applies', () => {
+      const middleware = createTenantMiddleware(makeConfig());
+      const userRecord = { ID: 'u1' } as Record<string, unknown>;
+      const userPayload = { userRecord, email: 'test@test.com', sessionId: 's1' };
+      const req = {
+        // Express delivers a repeated header as string[]
+        headers: { 'x-tenant-id': ['tenant-A', 'tenant-B'] },
+        userPayload,
+      } as unknown as Parameters<typeof middleware>[0];
+      const json = vi.fn();
+      const status = vi.fn().mockReturnValue({ json });
+      const res = { status } as unknown as Parameters<typeof middleware>[1];
+      const next = vi.fn();
+
+      middleware(req, res, next);
+
+      expect(status).toHaveBeenCalledWith(400);
+      expect(next).not.toHaveBeenCalled();
+      expect(userPayload.userRecord).toBe(userRecord);
+      expect(userRecord['TenantContext']).toBeUndefined();
+    });
+
+    it('two concurrent requests for the same shared user with different headers do not cross-contaminate', () => {
+      const middleware = createTenantMiddleware(makeConfig());
+      const sharedUserRecord = { ID: 'u1', UserRoles: [] } as unknown as Record<string, unknown>;
+
+      const reqA = {
+        headers: { 'x-tenant-id': 'tenant-A' },
+        userPayload: { userRecord: sharedUserRecord, email: 'a@test.com', sessionId: 'sA' },
+      } as unknown as Parameters<typeof middleware>[0];
+      const reqB = {
+        headers: { 'x-tenant-id': 'tenant-B' },
+        userPayload: { userRecord: sharedUserRecord, email: 'b@test.com', sessionId: 'sB' },
+      } as unknown as Parameters<typeof middleware>[0];
+      const res = { status: vi.fn().mockReturnThis(), json: vi.fn() } as unknown as Parameters<typeof middleware>[1];
+
+      middleware(reqA, res, vi.fn());
+      middleware(reqB, res, vi.fn());
+
+      const userA = (reqA as unknown as { userPayload: { userRecord: UserInfo } }).userPayload.userRecord;
+      const userB = (reqB as unknown as { userPayload: { userRecord: UserInfo } }).userPayload.userRecord;
+      expect(userA.TenantContext?.TenantID).toBe('tenant-A');
+      expect(userB.TenantContext?.TenantID).toBe('tenant-B');
+      expect((sharedUserRecord as unknown as UserInfo).TenantContext).toBeUndefined();
+    });
   });
 
   // ─── PreSave security edge cases ──────────────────────────────────────

package/src/__tests__/multiTenancy.test.ts

@@ -15,6 +15,28 @@ vi.mock('@memberjunction/core', async (importOriginal) => {
       { Name: 'AI Models', SchemaName: '__mj' },
       { Name: 'Users', SchemaName: '__mj' },
     ];
+
+    // The hook validates that the tenant column resolves to a real, stored
+    // (non-virtual) field on the entity before interpolating it as an identifier.
+    EntityByName(name: string) {
+      const entity = this.Entities.find(
+        e => e.Name.trim().toLowerCase() === name.trim().toLowerCase()
+      );
+      if (!entity) return undefined;
+      return {
+        ...entity,
+        Fields: [
+          { Name: 'OrganizationID', IsVirtual: false },
+          { Name: 'TenantID', IsVirtual: false },
+        ],
+      };
+    }
+
+    // QuoteFilterIdentifier reads the STATIC Metadata.Provider, matching a real
+    // server (Metadata.Provider is a DatabaseProviderBase instance).
+    static Provider = {
+      QuoteIdentifier: (name: string) => `[${name}]`,
+    };
   }
 
   return {

package/src/__tests__/pushStatusResolver.filter.test.ts

@@ -0,0 +1,56 @@
+/**
+ * pushStatusResolver.filter.test.ts — locks the security-critical subscription filter for B49.
+ *
+ * `statusUpdatesFilter` is the gate that fixes the `statusUpdates` session-hijack: a push is
+ * delivered only when the push's `sessionId` matches the subscriber's requested session AND the
+ * push's `ownerUserId` matches the subscriber CONNECTION's server-authenticated identity. Knowing
+ * a victim's client-chosen `sessionId` must no longer be sufficient to receive their pushes.
+ *
+ * The filter is a pure function (no DB / config / transport), so these are plain unit tests.
+ */
+import 'reflect-metadata';
+import { describe, it, expect } from 'vitest';
+import { statusUpdatesFilter, type PushStatusNotificationPayload, type StatusUpdatesFilterContext } from '../generic/PushStatusResolver';
+import type { UserPayload } from '../types';
+
+const OWNER = 'AA11BB22-0000-4000-8000-000000000001';
+const ATTACKER = 'CC33DD44-0000-4000-8000-000000000002';
+const SESSION = 'session-abc-123';
+
+function ctxFor(userId: string | undefined): StatusUpdatesFilterContext {
+  // userRecord is `any` in UserPayload; a minimal shape with ID is all the filter reads.
+  return { userPayload: (userId ? { userRecord: { ID: userId } } : {}) as unknown as UserPayload };
+}
+
+function push(overrides: Partial<PushStatusNotificationPayload> = {}): PushStatusNotificationPayload {
+  return { sessionId: SESSION, ownerUserId: OWNER, message: 'progress', ...overrides };
+}
+
+describe('statusUpdatesFilter (B49 session-hijack gate)', () => {
+  it('delivers when sessionId matches AND the connection identity owns the push', () => {
+    expect(statusUpdatesFilter({ payload: push(), args: { sessionId: SESSION }, context: ctxFor(OWNER) })).toBe(true);
+  });
+
+  it('THE FIX: rejects a matching sessionId when the connection identity is a DIFFERENT user (hijack)', () => {
+    // Attacker lifted the victim's sessionId and subscribes with it — but their authenticated
+    // connection identity is their own, so delivery must be denied.
+    expect(statusUpdatesFilter({ payload: push({ ownerUserId: OWNER }), args: { sessionId: SESSION }, context: ctxFor(ATTACKER) })).toBe(false);
+  });
+
+  it('rejects when the requested sessionId does not match the push', () => {
+    expect(statusUpdatesFilter({ payload: push(), args: { sessionId: 'some-other-session' }, context: ctxFor(OWNER) })).toBe(false);
+  });
+
+  it('fails closed when the push carries no ownerUserId', () => {
+    expect(statusUpdatesFilter({ payload: push({ ownerUserId: '' }), args: { sessionId: SESSION }, context: ctxFor(OWNER) })).toBe(false);
+  });
+
+  it('fails closed when the connection has no authenticated identity', () => {
+    expect(statusUpdatesFilter({ payload: push(), args: { sessionId: SESSION }, context: ctxFor(undefined) })).toBe(false);
+    expect(statusUpdatesFilter({ payload: push(), args: { sessionId: SESSION }, context: undefined })).toBe(false);
+  });
+
+  it('matches identity case-insensitively (SQL Server upper vs PostgreSQL lower UUIDs)', () => {
+    expect(statusUpdatesFilter({ payload: push({ ownerUserId: OWNER.toUpperCase() }), args: { sessionId: SESSION }, context: ctxFor(OWNER.toLowerCase()) })).toBe(true);
+  });
+});

package/src/__tests__/resolverBase.rls.test.ts

@@ -136,7 +136,11 @@ function makeEntity(name: string, opts: {
     return {
         Name: name,
         UserExemptFromRowLevelSecurity: () => opts.exempt,
+        // ResolverBase now delegates to GetEffectiveRowFilterWhereClause (role RLS
+        // + API-key row filters); the deprecated role-only method is kept in the
+        // mock shape for completeness but is no longer what the resolver calls.
         GetUserRowLevelSecurityWhereClause: () => opts.exempt ? '' : opts.rlsClause,
+        GetEffectiveRowFilterWhereClause: () => opts.exempt ? '' : opts.rlsClause,
     } as unknown as EntityInfo;
 }
 

package/src/__tests__/search-knowledge-tags.test.ts

@@ -10,19 +10,41 @@ import { describe, it, expect, vi, beforeEach } from 'vitest';
 
 // ── Mocks ──────────────────────────────────────────────────────────────
 
-const { mockSearch, mockPreviewSearch } = vi.hoisted(() => ({
-    mockSearch: vi.fn(),
-    mockPreviewSearch: vi.fn(),
-}));
-
+const { mockSearch, mockPreviewSearch, mockResolveEffectivePermission, mockLogForbiddenSearch } =
+    vi.hoisted(() => ({
+        mockSearch: vi.fn(),
+        mockPreviewSearch: vi.fn(),
+        mockResolveEffectivePermission: vi.fn(),
+        mockLogForbiddenSearch: vi.fn(),
+    }));
+
+// `SearchKnowledgeResolver` obtains its permission resolver through the pluggable seam —
+// `GetSearchScopePermissionResolver()` — so this mock has to provide that accessor even though
+// no test below currently reaches it: every case here passes `undefined` for scope IDs, and
+// `rejectForbiddenScopes` is guarded by `if (scopeIDs && scopeIDs.length)`.
+//
+// It is here because of how this omission fails. The missing export is simply `undefined`,
+// calling it throws a TypeError, and the resolver's catch-all reports a result code unrelated
+// to the thing under test — the same trap that made 11 failures in the CoreActions suite read
+// like a permissions regression. The first person to add a test case WITH scope IDs would pay
+// that diagnosis cost again, for no reason.
+//
+// The default is permissive (applied in beforeEach, so it survives a reset as well as a clear)
+// so such a test exercises its own subject rather than tripping over an unconfigured double.
+// Override `mockResolveEffectivePermission` in the test to drive the denial paths.
 vi.mock('@memberjunction/search-engine', () => ({
     SearchEngine: {
         Instance: {
             Config: vi.fn().mockResolvedValue(undefined),
             Search: (...args: unknown[]) => mockSearch(...args),
             PreviewSearch: (...args: unknown[]) => mockPreviewSearch(...args),
+            // Called only on the denial branch, to log a Status='Forbidden' execution row.
+            LogForbiddenSearch: (...args: unknown[]) => mockLogForbiddenSearch(...args),
         }
-    }
+    },
+    GetSearchScopePermissionResolver: () => ({
+        ResolveEffectivePermission: (...args: unknown[]) => mockResolveEffectivePermission(...args),
+    }),
 }));
 
 vi.mock('@memberjunction/global', async (importOriginal) => {
@@ -120,6 +142,52 @@ const fakeContext = { userPayload: { email: 'test@test.com' } };
 describe('SearchKnowledgeResolver', () => {
     beforeEach(() => {
         vi.clearAllMocks();
+        mockResolveEffectivePermission.mockResolvedValue({
+            Allowed: true, Level: 'Search', Source: 'DirectGrant',
+            Reason: 'test double', toSqlPredicate: () => '1=1',
+        });
+        mockLogForbiddenSearch.mockResolvedValue(undefined);
+    });
+
+    // ── Scope authorization ────────────────────────────────────────────
+    //
+    // This is the branch `rejectForbiddenScopes` guards, and it had no coverage at all — every
+    // other case here passes `undefined` for scope IDs, so the whole authorization path was
+    // unexercised. These two tests are also what make the resolver entry in the module mock
+    // above load-bearing rather than decorative: remove it and both fail.
+    describe('scope authorization', () => {
+        it('runs the search when every requested scope resolves to Allowed', async () => {
+            const resolver = createResolver();
+            mockSearch.mockResolvedValue(createMockSearchResult());
+
+            const result = await resolver.SearchKnowledge(
+                'test', 20, undefined, undefined, ['scope-a', 'scope-b'], undefined, undefined,
+                fakeContext as never);
+
+            expect(result.Success).toBe(true);
+            expect(mockSearch).toHaveBeenCalled();
+            // One resolution per requested scope — the check is per-scope, not per-call.
+            expect(mockResolveEffectivePermission).toHaveBeenCalledTimes(2);
+        });
+
+        it('REFUSES the whole call on the first denied scope, and never reaches the search', async () => {
+            const resolver = createResolver();
+            mockSearch.mockResolvedValue(createMockSearchResult());
+            mockResolveEffectivePermission.mockResolvedValue({
+                Allowed: false, Level: 'None', Source: 'NoGrant',
+                Reason: 'no grant for this scope', toSqlPredicate: () => '1=0',
+            });
+
+            const result = await resolver.SearchKnowledge(
+                'test', 20, undefined, undefined, ['scope-a'], undefined, undefined,
+                fakeContext as never);
+
+            expect(result.Success).toBe(false);
+            // The point of the branch: a forbidden scope aborts rather than being silently
+            // dropped, because dropping it masks bugs in scope authoring.
+            expect(mockSearch).not.toHaveBeenCalled();
+            expect(mockLogForbiddenSearch).toHaveBeenCalled();
+        });
     });
 
     describe('SearchKnowledge mutation', () => {