@memberjunction/server 5.51.0 → 5.51.2

package/src/auth/index.ts

@@ -186,6 +186,42 @@ export const getSystemUser = async (dataSource?: sql.ConnectionPool, attemptCach
   return systemUser;
 };
 
+/**
+ * Extracts the lowercased domain portion of an email address.
+ *
+ * @returns the domain, or an empty string when the value is not an email address (e.g. an IdP that
+ *          issues a bare username). Callers MUST treat an empty result as "cannot be authorized"
+ *          rather than as a wildcard.
+ */
+const extractEmailDomain = (email: string): string => {
+  const parts = email.split('@');
+  // Reject anything that isn't exactly local@domain — a value with 0 or 2+ '@' is not an address we
+  // can make a trust decision about.
+  if (parts.length !== 2) return '';
+  return parts[1].toLowerCase().trim();
+};
+
+/**
+ * Tests a domain against `userHandling.newUserAuthorizedDomains`, honoring `*` wildcards.
+ *
+ * Note that a pattern is matched in full, so `*.example.com` matches `mail.example.com` but NOT
+ * `example.com` — list both if you need both.
+ */
+const isDomainAuthorized = (domain: string): boolean =>
+  configInfo.userHandling.newUserAuthorizedDomains.some((pattern) => {
+    // Convert wildcard domain patterns to regular expressions
+    const regex = new RegExp('^' + pattern.toLowerCase().trim().replace(/\./g, '\\.').replace(/\*/g, '.*') + '$');
+    return regex.test(domain);
+  });
+
+/**
+ * Resolves a verified identity to an MJ `UserInfo`, optionally auto-provisioning a new user.
+ *
+ * @param requestDomain the hostname parsed from the request's `Origin` header. **Not used for any
+ *        authorization decision** — it is spoofable on non-browser requests, and new-user domain
+ *        authorization runs against the verified JWT's email domain instead. Retained for audit
+ *        logging and for the recursive retry call.
+ */
 export const verifyUserRecord = async (
   email?: string,
   firstName?: string,
@@ -206,23 +242,21 @@ export const verifyUserRecord = async (
   });
 
   if (!user) {
-    if (
-      configInfo.userHandling.autoCreateNewUsers &&
-      firstName &&
-      lastName &&
-      (requestDomain || configInfo.userHandling.newUserLimitedToAuthorizedDomains === false)
-    ) {
-      // check to see if the domain that we have a request coming in from matches one of the domains in the autoCreateNewUsersDomains setting
+    // NOTE: `requestDomain` (parsed from the spoofable `Origin` header) is deliberately NOT part of
+    // this condition. It was previously required here, which meant a non-browser client sending no
+    // Origin could never auto-provision while an attacker simply forged one — it gated entry without
+    // authorizing anything. Authorization happens below, against the verified identity's email domain.
+    if (configInfo.userHandling.autoCreateNewUsers && firstName && lastName) {
+      // SECURITY: authorize against the EMAIL DOMAIN of the cryptographically-verified identity,
+      // NOT the request `Origin` header. Origin is trivially spoofable on non-browser / bearer-token
+      // requests, so gating on it let a holder of any valid IdP token auto-provision an account under
+      // an authorized domain by sending a forged Origin. The email comes from the verified JWT.
+      const emailDomain: string = extractEmailDomain(email);
       let passesDomainCheck: boolean =
         configInfo.userHandling.newUserLimitedToAuthorizedDomains ===
         false; /*in this first condition, we are set up to NOT care about domain */
-      if (!passesDomainCheck && requestDomain) {
-        /*in this second condition, we check the domain against authorized domains*/
-        passesDomainCheck = configInfo.userHandling.newUserAuthorizedDomains.some((pattern) => {
-          // Convert wildcard domain patterns to regular expressions
-          const regex = new RegExp('^' + pattern.toLowerCase().trim().replace(/\./g, '\\.').replace(/\*/g, '.*') + '$');
-          return regex.test(requestDomain?.toLowerCase().trim());
-        });
+      if (!passesDomainCheck) {
+        passesDomainCheck = emailDomain.length > 0 && isDomainAuthorized(emailDomain);
       }
 
       if (passesDomainCheck) {
@@ -248,9 +282,16 @@ export const verifyUserRecord = async (
           UserCache.Instance.Users.push(user);
           console.warn(`   >>> New user ${email} created successfully!`);
         }
+      } else if (emailDomain.length === 0) {
+        // The verified identity carries no email domain at all — typically an IdP that issues a bare
+        // `preferred_username` with no `email` claim. There is nothing to match against, so the gate
+        // denies rather than falling back to anything spoofable.
+        console.warn(
+          `User ${email} not found in cache and will NOT be auto-created: the verified identity has no email domain (no '@'), so it cannot be matched against newUserAuthorizedDomains. This usually means the identity provider issues a username rather than an email address — configure it to emit an 'email' claim, or set newUserLimitedToAuthorizedDomains to false to disable domain checking.`
+        );
       } else {
         console.warn(
-          `User ${email} not found in cache. Request domain '${requestDomain}' does not match any of the domains in the newUserAuthorizedDomains setting. To ignore domain, make sure you set the newUserLimitedToAuthorizedDomains setting to false. In this case we are NOT creating a new user.`
+          `User ${email} not found in cache. Email domain '${emailDomain}' does not match any of the domains in the newUserAuthorizedDomains setting. NOTE: this check is against the EMAIL DOMAIN of the verified identity, NOT the browser Origin — if newUserAuthorizedDomains lists frontend hostnames (e.g. 'app.example.com'), replace them with email domains (e.g. 'example.com'). To ignore domain, make sure you set the newUserLimitedToAuthorizedDomains setting to false. In this case we are NOT creating a new user.`
         );
       }
     }

package/src/config.ts

@@ -7,7 +7,19 @@ const explorer = cosmiconfigSync('mj', { searchStrategy: 'global' });
 
 const userHandlingInfoSchema = z.object({
   autoCreateNewUsers: z.boolean().optional().default(false),
+  /** When true, auto-provisioning is restricted to the domains in `newUserAuthorizedDomains`. */
   newUserLimitedToAuthorizedDomains: z.boolean().optional().default(false),
+  /**
+   * Authorized **email domains** for auto-provisioned users — e.g. `['example.com', '*.example.org']`.
+   *
+   * These are matched against the domain of the email address in the verified identity token, NOT
+   * against the browser `Origin` / frontend hostname. If you are upgrading from a build that
+   * compared these to the request origin, replace any frontend hostnames here (`app.example.com`,
+   * `localhost`) with the email domains your users actually sign in with.
+   *
+   * `*` wildcards are supported and match in full: `*.example.com` matches `mail.example.com` but
+   * NOT `example.com` — list both if you need both.
+   */
   newUserAuthorizedDomains: z.array(z.string()).optional().default([]),
   newUserRoles: z.array(z.string()).optional().default([]),
   updateCacheWhenNotFound: z.boolean().optional().default(false),

package/src/context.ts

@@ -1,4 +1,5 @@
 import { IncomingMessage } from 'http';
+import { createHash, timingSafeEqual } from 'crypto';
 import { default as jwt } from 'jsonwebtoken';
 import 'reflect-metadata';
 import { Subject, firstValueFrom } from 'rxjs';
@@ -319,7 +320,13 @@ const verifyAsync = async (issuer: string, token: string): Promise<jwt.JwtPayloa
       return;
     }
 
-    const verifyOptions: jwt.VerifyOptions = {};
+    const verifyOptions: jwt.VerifyOptions = {
+      // SECURITY: explicitly pin the accepted signature algorithms to the asymmetric family.
+      // The signing key here comes from the issuer's JWKS (an RSA/EC public key), so without an
+      // explicit allow-list a future key-format change or library regression could reintroduce
+      // classic `alg=none` / RS256->HS256 confusion attacks. Pinning fails such tokens closed.
+      algorithms: ['RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'ES512', 'PS256'],
+    };
     if (Array.isArray(options.audience)) {
       verifyOptions.audience = options.audience as [string, ...string[]];
     } else {
@@ -420,7 +427,17 @@ export const getUserPayload = async (
     // Check for system API key (x-mj-api-key header)
     // This authenticates as the system user for system-level operations
     if (systemApiKey && systemApiKey != String(undefined)) {
-      if (systemApiKey === apiKey) {
+      // SECURITY: compare the superadmin system API key in constant time. A plain `===`
+      // short-circuits on the first differing byte, leaking a timing side-channel that could
+      // be used to recover the key byte-by-byte. Hash both sides to fixed-length digests so
+      // timingSafeEqual never throws on length mismatch and the comparison is length-agnostic.
+      // The Uint8Array wrappers are required by the @types/node version this line is pinned to
+      // (20.14.2, via the root `overrides`), whose `timingSafeEqual` takes NodeJS.ArrayBufferView —
+      // a type its own non-generic `Buffer` does not satisfy under TypeScript 5.9's lib. Copying
+      // two fixed-length 32-byte digests is content-independent, so the comparison stays constant time.
+      const systemKeyDigest = new Uint8Array(createHash('sha256').update(String(systemApiKey)).digest());
+      const providedKeyDigest = new Uint8Array(createHash('sha256').update(String(apiKey)).digest());
+      if (timingSafeEqual(systemKeyDigest, providedKeyDigest)) {
         const systemUser = await getSystemUser(readOnlyDataSource);
         return {
           userRecord: systemUser,

package/src/generic/ResolverBase.ts

@@ -62,16 +62,27 @@ export class ResolverBase {
    * - AllowDecryptInAPI=false + SendEncryptedValue=true: Keep encrypted ciphertext
    * - AllowDecryptInAPI=false + SendEncryptedValue=false: Replace with sentinel
    *
+   * Returns a COPY — `dataObject` is never written to. Callers routinely pass rows straight
+   * from `findBy`/`RunView`, which are the server cache's own objects held by reference under a
+   * reference-sharing storage provider. Renaming in place therefore rewrote the cached row's
+   * keys, so later readers were served transport-shaped rows that `BaseEntity.SetMany` rejects —
+   * and because that cache is process-wide, one response corrupted every subsequent request
+   * across all workers. It bit every `UserByEmail` / `UserByID` / `UserByEmployeeID` call and
+   * every generated single-record resolver whose entity has caching enabled. Copying here fixes
+   * every call site at once and makes the hazard unreachable for future ones.
+   *
    * @param entityName - The entity name
-   * @param dataObject - The data object with field values
+   * @param dataObject - The data object with field values. Not modified.
    * @param contextUser - Optional user context for decryption (required for encrypted fields)
-   * @returns The processed data object
+   * @returns A new object in transport shape, or null when there is nothing to map
    */
   protected async MapFieldNamesToCodeNames(entityName: string, dataObject: any, contextUser?: UserInfo, provider?: IMetadataProvider): Promise<any> {
     // Return null for empty objects (e.g. when no rows found due to RLS filtering)
     if (!dataObject || Object.keys(dataObject).length === 0) {
       return null;
     }
+    // Shallow copy up front so every write below lands on our object, never the caller's.
+    dataObject = { ...dataObject };
 
     // for the given entity name provided, check to see if there are any fields
     // where the code name is different from the field name, and for just those
@@ -184,14 +195,21 @@ export class ResolverBase {
     return true;
   }
 
-  protected async ArrayMapFieldNamesToCodeNames(entityName: string, dataObjectArray: any[], contextUser?: UserInfo): Promise<any[]> {
-    // iterate through the array and call MapFieldNamesToCodeNames for each element
-    if (dataObjectArray && dataObjectArray.length > 0) {
-      for (const element of dataObjectArray) {
-        await this.MapFieldNamesToCodeNames(entityName, element, contextUser);
-      }
+  /**
+   * Array form of {@link MapFieldNamesToCodeNames}. Returns a NEW array of NEW objects; neither
+   * the input array nor its rows are modified. Both matter: a reference-sharing cache hands back
+   * the stored array itself, not a copy of it, so collecting the mapped copies (rather than
+   * mapping in place and returning the original) is what makes this safe on cache-served input.
+   */
+  protected async ArrayMapFieldNamesToCodeNames(entityName: string, dataObjectArray: any[], contextUser?: UserInfo, provider?: IMetadataProvider): Promise<any[]> {
+    if (!dataObjectArray || dataObjectArray.length === 0) {
+      return dataObjectArray;
     }
-    return dataObjectArray;
+    const mapped: any[] = [];
+    for (const element of dataObjectArray) {
+      mapped.push(await this.MapFieldNamesToCodeNames(entityName, element, contextUser, provider));
+    }
+    return mapped;
   }
 
   /**
@@ -819,12 +837,24 @@ export class ResolverBase {
         LogStatus(`[ResolverBase] RunView result aggregate info: entityName=${viewInfo.Entity}, hasAggregateResults=${!!result?.AggregateResults}, aggregateResultCount=${result?.AggregateResults?.length || 0}, aggregateExecutionTime=${result?.AggregateExecutionTime}, aggregateResults=${JSON.stringify(result?.AggregateResults)}`);
       }
 
-      // Process results for GraphQL transport
+      // Process results for GraphQL transport.
+      //
+      // Map onto COPIES, never in place. `FieldMapper.MapFields` renames keys by
+      // mutating (`obj[mapped] = obj[k]; delete obj[k]`), and these rows are the
+      // provider's own result objects — which the server cache holds BY REFERENCE
+      // under a reference-sharing storage provider. Mapping them in place rewrote
+      // `__mj_CreatedAt` to the transport alias `_mj__CreatedAt` inside the live
+      // cache, and because that cache is process-wide, one GraphQL response made
+      // every later read hand back transport-shaped rows that `BaseEntity.SetMany`
+      // rejects. `ArrayFilterEncryptedFieldsForAPI` mutates too, so it must also
+      // see the copies. (FileResolver already maps a spread copy.)
+      //
+      // `{ ...r }` is a SHALLOW copy, which is sufficient here because the only
+      // post-map mutators rename top-level keys and redact scalar fields; nothing
+      // below writes through to a nested value.
       const mapper = new FieldMapper();
       if (result?.Success && result.Results?.length) {
-        for (const r of result.Results) {
-          mapper.MapFields(r);
-        }
+        result.Results = result.Results.map(r => mapper.MapFields({ ...r }));
         // Filter encrypted fields before sending to API client
         await this.ArrayFilterEncryptedFieldsForAPI(
           viewInfo.Entity,
@@ -941,9 +971,9 @@ export class ResolverBase {
       for (let i = 0; i < runViewResults.length; i++) {
         const runViewResult = runViewResults[i];
         if (runViewResult?.Success && runViewResult.Results?.length) {
-          for (const result of runViewResult.Results) {
-            mapper.MapFields(result);
-          }
+          // Copy-then-map, same reason as the single-view path above: these rows
+          // are cache-held references and MapFields renames keys in place.
+          runViewResult.Results = runViewResult.Results.map(r => mapper.MapFields({ ...r }));
           // Filter encrypted fields before sending to API client
           // Use the corresponding param's entity name
           const entityName = params[i]?.viewInfo?.Entity;

package/src/index.ts

@@ -1038,7 +1038,9 @@ export const serve = async (resolverPaths: Array<string>, app: Application = cre
     const { callbackRouter, authenticatedRouter } = createOAuthCallbackHandler({
       publicUrl: oauthPublicUrl,
       successRedirectUrl: `${oauthPublicUrl}/oauth/success`,
-      errorRedirectUrl: `${oauthPublicUrl}/oauth/error`
+      errorRedirectUrl: `${oauthPublicUrl}/oauth/error`,
+      // Constrains where a caller-supplied frontendReturnUrl may point (open-redirect guard).
+      allowedFrontendOrigins: configInfo.cors?.allowedOrigins ?? ['*']
     });
     oauthAuthenticatedRouter = authenticatedRouter;
 

package/src/resolvers/ReportResolver.ts

@@ -98,9 +98,10 @@ export class ReportResolverExtended extends ResolverBase {
                    ON
                       cd.ConversationID = c.ID
                    WHERE
-                      cd.ID='${ConversationDetailID}'`;
+                      cd.ID=@ConversationDetailID`;
 
       const request = new mssql.Request(dataSource);
+      request.input('ConversationDetailID', mssql.UniqueIdentifier, ConversationDetailID);
       const result = await request.query(sql);
       if (!result || !result.recordset || result.recordset.length === 0) throw new Error('Unable to retrieve converation details');
       const skipData: { title?: string; reportTitle?: string; userExplanation?: string; messages?: unknown[] } = JSON.parse(result.recordset[0].Message);

package/src/resolvers/__tests__/ReportResolver.test.ts

@@ -0,0 +1,232 @@
+/**
+ * Tests for ReportResolverExtended.CreateReportFromConversationDetailID.
+ *
+ * Regression coverage for a SQL injection fix: ConversationDetailID (a plain GraphQL
+ * String arg) used to be interpolated directly into the WHERE clause. It is now bound
+ * via mssql's parameterized `request.input(...)`, so a hostile value must never appear
+ * spliced into the executed SQL text, and query structure must stay identical regardless
+ * of what the value contains.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+// ─── Hoisted mocks ────────────────────────────────────────────────────────
+const { mockUserCacheUsers, mssqlState } = vi.hoisted(() => ({
+    mockUserCacheUsers: [] as Array<{ Email: string; ID: string }>,
+    mssqlState: {
+        inputCalls: [] as Array<{ name: string; type: unknown; value: unknown }>,
+        queryCalls: [] as string[],
+        poolArgs: [] as unknown[],
+        recordset: [] as Array<Record<string, unknown>>,
+    },
+}));
+
+// Stub external deps before imports (mirrors resolverBase.rls.test.ts)
+vi.mock('@memberjunction/sqlserver-dataprovider', () => ({
+    SQLServerDataProvider: class {},
+    UserCache: {
+        get Users() { return mockUserCacheUsers; },
+    },
+}));
+
+vi.mock('cloudevents', () => ({
+    CloudEvent: class {},
+    httpTransport: () => () => undefined,
+    emitterFor: () => () => undefined,
+}));
+
+vi.mock('type-graphql', () => ({
+    Resolver:           () => () => undefined,
+    Mutation:           () => () => undefined,
+    Query:              () => () => undefined,
+    Subscription:       () => () => undefined,
+    Ctx:                () => () => undefined,
+    Arg:                () => () => undefined,
+    PubSub:             () => () => undefined,
+    Root:               () => () => undefined,
+    ObjectType:         () => () => undefined,
+    InputType:          () => () => undefined,
+    Field:              () => () => undefined,
+    FieldResolver:      () => () => undefined,
+    Int:                () => undefined,
+    Float:              () => undefined,
+    registerEnumType:   () => undefined,
+}));
+
+vi.mock('graphql', () => ({
+    GraphQLError: class extends Error {
+        constructor(msg: string) { super(msg); }
+    },
+}));
+
+vi.mock('mssql', () => {
+    const UniqueIdentifier = { __marker: 'UniqueIdentifier' };
+    class Request {
+        constructor(pool: unknown) {
+            mssqlState.poolArgs.push(pool);
+        }
+        input(name: string, type: unknown, value: unknown) {
+            mssqlState.inputCalls.push({ name, type, value });
+        }
+        async query(sql: string) {
+            mssqlState.queryCalls.push(sql);
+            return { recordset: mssqlState.recordset };
+        }
+    }
+    return { default: { Request, UniqueIdentifier }, Request, UniqueIdentifier };
+});
+
+vi.mock('@memberjunction/data-context', () => {
+    class DataContext {
+        LoadMetadata = vi.fn(async () => true);
+    }
+    (DataContext as unknown as { Clone: unknown }).Clone = vi.fn(async () => ({ ID: 'dctx-clone-1' }));
+    return { DataContext };
+});
+
+vi.mock('@memberjunction/api-keys', () => ({
+    GetAPIKeyEngine: vi.fn(),
+}));
+
+vi.mock('@memberjunction/encryption', () => ({
+    EncryptionEngine: { Instance: {} },
+}));
+
+vi.mock('@memberjunction/graphql-dataprovider', () => ({
+    FieldMapper: class { static Instance = { MapFieldsFromCodeNamesToDBNames: vi.fn() }; },
+}));
+
+vi.mock('../../generic/PubSubManager.js', () => ({
+    PubSubManager: class { static Instance = { publish: vi.fn() }; },
+}));
+
+vi.mock('../../generic/PushStatusResolver.js', () => ({
+    PUSH_STATUS_UPDATES_TOPIC: 'test-push-topic',
+    PushStatusNotification: class {},
+    PushStatusResolver: class {},
+}));
+
+vi.mock('../../generic/CacheInvalidationResolver.js', () => ({
+    CACHE_INVALIDATION_TOPIC: 'test-cache-topic',
+}));
+
+vi.mock('../../generic/RunViewResolver.js', () => ({
+    RunViewByIDInput: class {},
+    RunViewByNameInput: class {},
+    RunDynamicViewInput: class {},
+}));
+
+vi.mock('../../generic/DeleteOptionsInput.js', () => ({
+    DeleteOptionsInput: class {},
+}));
+
+vi.mock('../../types.js', () => ({
+    RunViewGenericParams: class {},
+}));
+
+vi.mock('@memberjunction/core', async () => {
+    const actual = await vi.importActual<typeof import('@memberjunction/core')>('@memberjunction/core');
+    return {
+        ...actual,
+        LogError: vi.fn(),
+        LogStatus: vi.fn(),
+    };
+});
+
+vi.mock('@memberjunction/core-entities', () => ({}));
+
+// ─── Import after mocks ──────────────────────────────────────────────────
+import { ReportResolverExtended } from '../ReportResolver';
+
+// ─── Helpers ──────────────────────────────────────────────────────────────
+
+function makeReportEntity() {
+    return {
+        ID: 'report-1',
+        Name: '',
+        Description: '',
+        ConversationID: '',
+        ConversationDetailID: '',
+        DataContextID: '',
+        Configuration: '',
+        SharingScope: '',
+        UserID: '',
+        NewRecord: vi.fn(),
+        Save: vi.fn(async () => true),
+    };
+}
+
+function makeContext(getEntityObject: () => ReturnType<typeof makeReportEntity>) {
+    const md = {
+        Entities: [
+            { Name: 'MJ: Conversation Details', SchemaName: 'dbo', BaseView: 'vwConversationDetails' },
+            { Name: 'MJ: Conversations', SchemaName: 'dbo', BaseView: 'vwConversations' },
+        ],
+        GetEntityObject: vi.fn(async () => getEntityObject()),
+    };
+    return {
+        dataSource: { __fakePool: true },
+        userPayload: { email: 'test@example.com' }, // no apiKeyHash -> scope check no-ops
+        providers: [{ type: 'Read-Write', provider: md }],
+    } as unknown as Parameters<ReportResolverExtended['CreateReportFromConversationDetailID']>[1];
+}
+
+describe('ReportResolverExtended.CreateReportFromConversationDetailID', () => {
+    let resolver: ReportResolverExtended;
+
+    beforeEach(() => {
+        resolver = new ReportResolverExtended();
+        mssqlState.inputCalls.length = 0;
+        mssqlState.queryCalls.length = 0;
+        mssqlState.poolArgs.length = 0;
+        mssqlState.recordset.length = 0;
+        mssqlState.recordset.push({
+            Message: JSON.stringify({ title: 'Test Report', userExplanation: 'exp' }),
+            ConversationID: 'conv-1',
+            DataContextID: 'dctx-1',
+        });
+
+        mockUserCacheUsers.length = 0;
+        mockUserCacheUsers.push({ Email: 'test@example.com', ID: 'user-1' });
+    });
+
+    it('binds ConversationDetailID as a query parameter rather than splicing it into the SQL text', async () => {
+        const maliciousID = "1'; DROP TABLE MJ_Reports; --";
+        const context = makeContext(makeReportEntity);
+
+        const result = await resolver.CreateReportFromConversationDetailID(maliciousID, context);
+
+        expect(result.Success).toBe(true);
+
+        // The query text must use a bound parameter, never the raw value.
+        expect(mssqlState.queryCalls).toHaveLength(1);
+        expect(mssqlState.queryCalls[0]).toContain('@ConversationDetailID');
+        expect(mssqlState.queryCalls[0]).not.toContain(maliciousID);
+        expect(mssqlState.queryCalls[0]).not.toContain('DROP TABLE');
+
+        // The value must be bound through request.input, not string concatenation.
+        expect(mssqlState.inputCalls).toHaveLength(1);
+        expect(mssqlState.inputCalls[0].name).toBe('ConversationDetailID');
+        expect(mssqlState.inputCalls[0].value).toBe(maliciousID);
+    });
+
+    it('does not alter query structure for values containing quotes, --, or OR 1=1', async () => {
+        const hostileID = "abc' OR '1'='1' --";
+        const context = makeContext(makeReportEntity);
+
+        await resolver.CreateReportFromConversationDetailID(hostileID, context);
+
+        expect(mssqlState.queryCalls[0]).toMatch(/WHERE\s+cd\.ID=@ConversationDetailID\s*$/);
+        expect(mssqlState.inputCalls[0].value).toBe(hostileID);
+    });
+
+    it('still succeeds end to end for a normal GUID-shaped value', async () => {
+        const normalID = '12345678-1234-1234-1234-123456789012';
+        const context = makeContext(makeReportEntity);
+
+        const result = await resolver.CreateReportFromConversationDetailID(normalID, context);
+
+        expect(result.Success).toBe(true);
+        expect(result.ReportName).toBe('Test Report');
+        expect(mssqlState.inputCalls[0].value).toBe(normalID);
+    });
+});