@memberjunction/server 5.51.0 → 6.1.0-edge.1

package/src/__tests__/TaskGraphFrameResolver.test.ts

@@ -0,0 +1,136 @@
+/**
+ * Tests for the task-graph live signal.
+ *
+ * `taskGraphFrameFilter` is the security-critical gate and is tested in isolation for the same
+ * reason `statusUpdatesFilter` is: a `parentTaskId` is a discoverable value, so without an identity
+ * check anyone holding one could watch another user's workflow — including its per-step error
+ * messages. It must fail **closed**.
+ *
+ * The broadcaster's contract is that it can never disturb the work it is describing: a frame is
+ * commentary on execution, never a step of it.
+ */
+// type-graphql's decorators evaluate at module load, and they need the metadata polyfill. Without
+// this the file fails to COLLECT — which vitest reports as zero tests rather than as a failure.
+import 'reflect-metadata';
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+vi.mock('@memberjunction/core', () => ({ LogError: vi.fn() }));
+
+import {
+    TASK_GRAPH_FRAMES_TOPIC,
+    TaskGraphFrameBroadcaster,
+    taskGraphFrameFilter,
+    type TaskGraphFramePayload,
+} from '../resolvers/TaskGraphFrameResolver';
+import type { TaskGraphFrame } from '@memberjunction/task-graph';
+import type { PubSubEngine } from 'type-graphql';
+
+const OWNER = '11111111-1111-1111-1111-111111111111';
+const OTHER = '22222222-2222-2222-2222-222222222222';
+const GRAPH = '33333333-3333-3333-3333-333333333333';
+
+const payload = (over: Partial<TaskGraphFramePayload> = {}): TaskGraphFramePayload => ({
+    Kind: 'TaskCompleted',
+    ParentTaskID: GRAPH,
+    TaskID: 'task-1',
+    TaskName: 'Summarize',
+    Status: 'Complete',
+    ownerUserId: OWNER,
+    ...over,
+});
+
+// `null` rather than `undefined` for "no identity": passing `undefined` explicitly triggers a
+// default parameter, so the case would silently test the opposite of what it claims.
+const context = (userId: string | null) => (userId ? { userPayload: { userRecord: { ID: userId } } } : {});
+
+const check = (over: Partial<TaskGraphFramePayload> = {}, args = GRAPH, userId: string | null = OWNER) =>
+    taskGraphFrameFilter({ payload: payload(over), args: { parentTaskId: args }, context: context(userId) });
+
+describe('taskGraphFrameFilter — the delivery gate', () => {
+    it('delivers a frame for the watched graph to its owner', () => {
+        expect(check()).toBe(true);
+    });
+
+    it('matches graph IDs case-insensitively — UUID casing varies by source', () => {
+        expect(check({}, GRAPH.toUpperCase())).toBe(true);
+    });
+
+    it('does NOT deliver frames from another graph', () => {
+        expect(check({ ParentTaskID: '44444444-4444-4444-4444-444444444444' })).toBe(false);
+    });
+
+    it('does NOT deliver another user\'s workflow to a subscriber holding its ID', () => {
+        // The whole reason identity is checked: parentTaskId is discoverable, and the frames carry
+        // per-step error messages.
+        expect(check({}, GRAPH, OTHER)).toBe(false);
+    });
+
+    it('fails closed when the connection has no identity', () => {
+        expect(check({}, GRAPH, null)).toBe(false);
+    });
+
+    it('fails closed when the frame has no owner', () => {
+        expect(check({ ownerUserId: '' as unknown as string })).toBe(false);
+    });
+
+    it('fails closed on a missing graph ID on either side', () => {
+        expect(check({ ParentTaskID: '' })).toBe(false);
+        expect(check({}, '')).toBe(false);
+    });
+});
+
+describe('TaskGraphFrameBroadcaster', () => {
+    let published: Array<[string, unknown]>;
+    let pubSub: PubSubEngine;
+
+    beforeEach(() => {
+        published = [];
+        pubSub = {
+            publish: vi.fn().mockImplementation(async (topic: string, p: unknown) => { published.push([topic, p]); }),
+        } as unknown as PubSubEngine;
+    });
+
+    const frame = (over: Partial<TaskGraphFrame> = {}): TaskGraphFrame => ({
+        Kind: 'TaskStarted', ParentTaskID: GRAPH, OwnerUserID: OWNER, TaskID: 'task-1', TaskName: 'Gather', ...over,
+    });
+
+    it('publishes the frame with the owner attached as the filter key', () => {
+        new TaskGraphFrameBroadcaster(pubSub).OnFrame(frame());
+
+        expect(published).toHaveLength(1);
+        const [topic, p] = published[0];
+        expect(topic).toBe(TASK_GRAPH_FRAMES_TOPIC);
+        expect((p as TaskGraphFramePayload).ownerUserId).toBe(OWNER);
+        expect((p as TaskGraphFramePayload).Kind).toBe('TaskStarted');
+    });
+
+    it('drops a frame with no owner rather than publishing one the filter would refuse', () => {
+        // Reachable for graphs submitted before ownership was recorded on the parent.
+        new TaskGraphFrameBroadcaster(pubSub).OnFrame(frame({ OwnerUserID: null }));
+        expect(published).toHaveLength(0);
+    });
+
+    it('never throws when publishing fails — a frame must not disturb the work it describes', () => {
+        const exploding = { publish: vi.fn(() => { throw new Error('pubsub down'); }) } as unknown as PubSubEngine;
+        expect(() => new TaskGraphFrameBroadcaster(exploding).OnFrame(frame())).not.toThrow();
+    });
+
+    it('carries the whole frame through, so a viewer can render without re-reading rows', () => {
+        new TaskGraphFrameBroadcaster(pubSub).OnFrame(
+            frame({ Kind: 'TaskFailed', Status: 'Failed', ErrorMessage: 'model timed out' }),
+        );
+        const p = published[0][1] as TaskGraphFramePayload;
+        expect(p.Status).toBe('Failed');
+        expect(p.ErrorMessage).toBe('model timed out');
+        expect(p.TaskName).toBe('Gather');
+    });
+
+    it('carries graph-level progress on a settled frame', () => {
+        new TaskGraphFrameBroadcaster(pubSub).OnFrame(
+            frame({ Kind: 'GraphSettled', TaskID: undefined, Status: 'Complete', CompletedCount: 7, TotalCount: 7 }),
+        );
+        const p = published[0][1] as TaskGraphFramePayload;
+        expect(p.CompletedCount).toBe(7);
+        expect(p.TotalCount).toBe(7);
+    });
+});

package/src/__tests__/multiTenancy.security.test.ts

@@ -6,9 +6,16 @@
  * in multiTenancy.test.ts.
  */
 import { describe, it, expect, vi } from 'vitest';
-import { createTenantPreRunViewHook, createTenantPreSaveHook, createTenantMiddleware } from '../multiTenancy/index.js';
+import {
+  createTenantPreRunViewHook,
+  createTenantPreSaveHook,
+  createTenantMiddleware,
+  IsValidTenantId,
+  attachTenantContext,
+} from '../multiTenancy/index.js';
 import type { MultiTenancyConfig } from '../config.js';
-import type { RunViewParams } from '@memberjunction/core';
+import { Metadata } from '@memberjunction/core';
+import type { RunViewParams, UserInfo, TenantContext } from '@memberjunction/core';
 
 // Mock @memberjunction/core Metadata for entity schema lookup.
 vi.mock('@memberjunction/core', async (importOriginal) => {
@@ -20,6 +27,31 @@ vi.mock('@memberjunction/core', async (importOriginal) => {
       { Name: 'Orders', SchemaName: 'dbo' },
       { Name: 'Users', SchemaName: '__mj' },
     ];
+
+    // The hook validates that the tenant column resolves to a real, stored
+    // (non-virtual) field before interpolating it as an identifier.
+    EntityByName(name: string) {
+      const entity = this.Entities.find(
+        e => e.Name.trim().toLowerCase() === name.trim().toLowerCase()
+      );
+      if (!entity) return undefined;
+      return {
+        ...entity,
+        Fields: [
+          { Name: 'OrganizationID', IsVirtual: false },
+          { Name: 'TenantID', IsVirtual: false },
+          // A view-only column: must be REJECTED as a tenant column target
+          { Name: 'OrganizationName', IsVirtual: true },
+        ],
+      };
+    }
+
+    // QuoteFilterIdentifier reads the STATIC Metadata.Provider, matching a real
+    // server (Metadata.Provider is a DatabaseProviderBase instance). Tests that need
+    // to exercise the no-provider-available fail-closed path override this locally.
+    static Provider: { QuoteIdentifier: (name: string) => string } | undefined = {
+      QuoteIdentifier: (name: string) => `[${name}]`,
+    };
   }
 
   return {
@@ -58,41 +90,164 @@ function makeUser(tenantId?: string, roles: string[] = []): MockUser {
 
 describe('Multi-Tenancy Security Edge Cases', () => {
   describe('SQL injection in tenant ID', () => {
-    it('should treat SQL injection attempt as literal tenant ID', () => {
+    it('should escape quotes so an injection attempt stays INSIDE the string literal', () => {
       const hook = createTenantPreRunViewHook(makeConfig());
       const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
       const user = makeUser("' OR 1=1 --");
 
       const result = hook(params, user) as RunViewParams;
 
-      // The tenant ID is inserted as-is — the SQL provider should use
-      // parameterized queries to prevent actual injection.
-      // The hook correctly generates a filter with the raw value.
-      expect(result.ExtraFilter).toContain("' OR 1=1 --");
-      expect(result.ExtraFilter).toBe("[OrganizationID] = '' OR 1=1 --'");
+      // The single quote is doubled at predicate construction, so the payload
+      // cannot terminate the literal and rewrite the WHERE clause. (The header
+      // boundary rejects this value outright via IsValidTenantId; this is the
+      // defense-in-depth layer for TenantContext attached from other sources.)
+      expect(result.ExtraFilter).toBe("[OrganizationID] = ''' OR 1=1 --'");
     });
 
-    it('should handle tenant ID with SQL UNION attack', () => {
+    it('should escape quotes in a UNION attack payload', () => {
       const hook = createTenantPreRunViewHook(makeConfig());
       const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
       const user = makeUser("' UNION SELECT * FROM Users --");
 
       const result = hook(params, user) as RunViewParams;
-      expect(result.ExtraFilter).toContain("UNION SELECT");
-      // Note: This is a known limitation — the filter is string-concatenated.
-      // Defense-in-depth: the tenant ID should be validated upstream before
-      // it reaches TenantContext. Middle-layer middleware (e.g., BCSaaS)
-      // should validate that the tenant ID is a valid UUID or org ID.
+      // Leading quote doubled → the UNION text is inert literal content
+      expect(result.ExtraFilter).toBe("[OrganizationID] = ''' UNION SELECT * FROM Users --'");
     });
 
-    it('should handle tenant ID with semicolon (statement terminator)', () => {
+    it('should escape quotes in a stacked-statement payload', () => {
       const hook = createTenantPreRunViewHook(makeConfig());
       const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
       const user = makeUser("abc'; DROP TABLE Customers; --");
 
       const result = hook(params, user) as RunViewParams;
-      expect(result.ExtraFilter).toContain("DROP TABLE");
-      // Same caveat: parameterized queries at the DB layer prevent execution
+      expect(result.ExtraFilter).toBe("[OrganizationID] = 'abc''; DROP TABLE Customers; --'");
+    });
+  });
+
+  // ─── Boundary validation: IsValidTenantId ───────────────────────────────
+
+  describe('IsValidTenantId', () => {
+    it('rejects a quote-based SQL injection payload', () => {
+      expect(IsValidTenantId("x' OR '1'='1")).toBe(false);
+    });
+
+    it('rejects the empty string', () => {
+      expect(IsValidTenantId('')).toBe(false);
+    });
+
+    it('rejects a 129-character string (max is 128)', () => {
+      expect(IsValidTenantId('a'.repeat(129))).toBe(false);
+    });
+
+    it('accepts a 128-character string (boundary)', () => {
+      expect(IsValidTenantId('a'.repeat(128))).toBe(true);
+    });
+
+    it('rejects whitespace, semicolons, and comparison operators', () => {
+      expect(IsValidTenantId('tenant 1')).toBe(false);
+      expect(IsValidTenantId('a;b')).toBe(false);
+      expect(IsValidTenantId("1'='1")).toBe(false);
+      expect(IsValidTenantId('a=b')).toBe(false);
+    });
+
+    it('accepts a standard GUID', () => {
+      expect(IsValidTenantId('550e8400-e29b-41d4-a716-446655440000')).toBe(true);
+    });
+
+    it('accepts conservative identifiers with underscore, dot, and hyphen', () => {
+      expect(IsValidTenantId('tenant_1.a-b')).toBe(true);
+    });
+
+    it('KNOWN GAP: accepts consecutive hyphens (SQL line-comment token) because GUIDs need hyphens', () => {
+      // 'a--b' passes the character allowlist. This is safe today only because
+      // every consumer interpolates the value inside a quote-escaped string
+      // literal, where '--' is inert. If a future consumer places the tenant id
+      // outside a quoted literal, this becomes a comment-injection vector —
+      // flagged here so a tightening of the pattern flips this assertion.
+      expect(IsValidTenantId('a--b')).toBe(true);
+    });
+  });
+
+  // ─── attachTenantContext validation ─────────────────────────────────────
+
+  describe('attachTenantContext', () => {
+    function makePlainUser(): UserInfo {
+      return { ID: 'user-1' } as unknown as UserInfo;
+    }
+
+    it('throws on an invalid tenant id instead of attaching it', () => {
+      const user = makePlainUser();
+      expect(() => attachTenantContext(user, "x' OR '1'='1", 'header')).toThrow(/Invalid tenant identifier/);
+      expect(user.TenantContext).toBeUndefined();
+    });
+
+    it('throws on empty and oversized tenant ids', () => {
+      const user = makePlainUser();
+      expect(() => attachTenantContext(user, '', 'custom')).toThrow(/Invalid tenant identifier/);
+      expect(() => attachTenantContext(user, 'a'.repeat(129), 'custom')).toThrow(/Invalid tenant identifier/);
+    });
+
+    it('attaches a valid tenant id with the given source', () => {
+      const user = makePlainUser();
+      attachTenantContext(user, 'tenant_1.a-b', 'linkedEntity');
+      expect(user.TenantContext).toEqual<TenantContext>({ TenantID: 'tenant_1.a-b', Source: 'linkedEntity' });
+    });
+  });
+
+  // ─── Tenant column resolution (identifier position) ─────────────────────
+
+  describe('tenant column must resolve to a stored field', () => {
+    it('produces an escaped-value predicate with a quoted identifier for a valid setup', () => {
+      const hook = createTenantPreRunViewHook(makeConfig());
+      const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
+      const user = makeUser("t'1"); // legal only via non-header sources; must still be escaped
+
+      const result = hook(params, user) as RunViewParams;
+      expect(result.ExtraFilter).toBe("[OrganizationID] = 't''1'");
+    });
+
+    it('throws when the configured tenant column does not exist on the entity', () => {
+      const hook = createTenantPreRunViewHook(makeConfig({ defaultTenantColumn: 'NoSuchColumn' }));
+      const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
+      const user = makeUser('tenant-1');
+
+      expect(() => hook(params, user)).toThrow(/does not resolve to a stored field/);
+    });
+
+    it('throws when the tenant column resolves only to a VIRTUAL field', () => {
+      const hook = createTenantPreRunViewHook(makeConfig({ defaultTenantColumn: 'OrganizationName' }));
+      const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
+      const user = makeUser('tenant-1');
+
+      expect(() => hook(params, user)).toThrow(/does not resolve to a stored field/);
+    });
+
+    it('throws when an entityColumnMappings override points at a nonexistent column', () => {
+      const hook = createTenantPreRunViewHook(makeConfig({
+        entityColumnMappings: { 'Customers': "Bad]Column" },
+      }));
+      const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
+      const user = makeUser('tenant-1');
+
+      expect(() => hook(params, user)).toThrow(/does not resolve to a stored field/);
+    });
+
+    it('throws (fails closed) rather than falling back to hardcoded bracket quoting when no provider is available', () => {
+      const savedProvider = Metadata.Provider;
+      // @ts-expect-error — simulating the no-provider-available case
+      Metadata.Provider = undefined;
+      try {
+        const hook = createTenantPreRunViewHook(makeConfig());
+        const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
+        const user = makeUser('tenant-1');
+
+        // A silent bracket-quoting fallback would produce invalid SQL on PostgreSQL
+        // without ever surfacing an error — refusing to build the query at all is the
+        // correct fail-closed behavior for a security-relevant identifier quote.
+        expect(() => hook(params, user)).toThrow(/no database provider available to quote/);
+      } finally {
+        Metadata.Provider = savedProvider;
+      }
     });
   });
 
@@ -232,12 +387,13 @@ describe('Multi-Tenancy Security Edge Cases', () => {
       expect(next).toHaveBeenCalledTimes(1);
     });
 
-    it('should attach TenantContext when userPayload and header are present', () => {
+    it('should attach TenantContext to a CLONED userRecord when userPayload and header are present', () => {
       const middleware = createTenantMiddleware(makeConfig());
       const userRecord = { ID: 'u1' } as Record<string, unknown>;
+      const userPayload = { userRecord, email: 'test@test.com', sessionId: 's1' };
       const req = {
         headers: { 'x-tenant-id': 'tenant-abc' },
-        userPayload: { userRecord, email: 'test@test.com', sessionId: 's1' },
+        userPayload,
       } as unknown as Parameters<typeof middleware>[0];
       const res = {} as Parameters<typeof middleware>[1];
       const next = vi.fn();
@@ -245,26 +401,56 @@ describe('Multi-Tenancy Security Edge Cases', () => {
       middleware(req, res, next);
 
       expect(next).toHaveBeenCalledTimes(1);
-      expect(userRecord['TenantContext']).toEqual({
+      // Clone-before-stamp: the SHARED cached record must never be mutated —
+      // stamping it in place leaks one session's tenant to concurrent sessions.
+      expect(userRecord['TenantContext']).toBeUndefined();
+      const stamped = userPayload.userRecord as unknown as UserInfo;
+      expect(stamped).not.toBe(userRecord);
+      expect(stamped.ID).toBe('u1');
+      expect(stamped.TenantContext).toEqual({
         TenantID: 'tenant-abc',
         Source: 'header',
       });
     });
 
+    it('should reject an invalid tenant header with 400 and never attach or continue', () => {
+      const middleware = createTenantMiddleware(makeConfig());
+      const userRecord = { ID: 'u1' } as Record<string, unknown>;
+      const userPayload = { userRecord, email: 'test@test.com', sessionId: 's1' };
+      const req = {
+        headers: { 'x-tenant-id': "x' OR '1'='1" },
+        userPayload,
+      } as unknown as Parameters<typeof middleware>[0];
+      const json = vi.fn();
+      const status = vi.fn().mockReturnValue({ json });
+      const res = { status } as unknown as Parameters<typeof middleware>[1];
+      const next = vi.fn();
+
+      middleware(req, res, next);
+
+      // Reject the REQUEST — never degrade to an unscoped (fail-open) session
+      expect(status).toHaveBeenCalledWith(400);
+      expect(json).toHaveBeenCalledWith({ error: 'Invalid tenant identifier' });
+      expect(next).not.toHaveBeenCalled();
+      expect(userPayload.userRecord).toBe(userRecord);
+      expect(userRecord['TenantContext']).toBeUndefined();
+    });
+
     it('should handle case-insensitive header name', () => {
       const middleware = createTenantMiddleware(makeConfig({ tenantHeader: 'X-Tenant-ID' }));
       const userRecord = { ID: 'u1' } as Record<string, unknown>;
+      const userPayload = { userRecord, email: 'test@test.com', sessionId: 's1' };
       const req = {
         // Express normalizes headers to lowercase
         headers: { 'x-tenant-id': 'tenant-xyz' },
-        userPayload: { userRecord, email: 'test@test.com', sessionId: 's1' },
+        userPayload,
       } as unknown as Parameters<typeof middleware>[0];
       const res = {} as Parameters<typeof middleware>[1];
       const next = vi.fn();
 
       middleware(req, res, next);
 
-      expect(userRecord['TenantContext']).toEqual({
+      expect((userPayload.userRecord as unknown as UserInfo).TenantContext).toEqual({
         TenantID: 'tenant-xyz',
         Source: 'header',
       });
@@ -284,6 +470,52 @@ describe('Multi-Tenancy Security Edge Cases', () => {
 
       expect(userRecord['TenantContext']).toBeUndefined();
     });
+
+    it('should reject a repeated header (array value) with 400 rather than guessing which value applies', () => {
+      const middleware = createTenantMiddleware(makeConfig());
+      const userRecord = { ID: 'u1' } as Record<string, unknown>;
+      const userPayload = { userRecord, email: 'test@test.com', sessionId: 's1' };
+      const req = {
+        // Express delivers a repeated header as string[]
+        headers: { 'x-tenant-id': ['tenant-A', 'tenant-B'] },
+        userPayload,
+      } as unknown as Parameters<typeof middleware>[0];
+      const json = vi.fn();
+      const status = vi.fn().mockReturnValue({ json });
+      const res = { status } as unknown as Parameters<typeof middleware>[1];
+      const next = vi.fn();
+
+      middleware(req, res, next);
+
+      expect(status).toHaveBeenCalledWith(400);
+      expect(next).not.toHaveBeenCalled();
+      expect(userPayload.userRecord).toBe(userRecord);
+      expect(userRecord['TenantContext']).toBeUndefined();
+    });
+
+    it('two concurrent requests for the same shared user with different headers do not cross-contaminate', () => {
+      const middleware = createTenantMiddleware(makeConfig());
+      const sharedUserRecord = { ID: 'u1', UserRoles: [] } as unknown as Record<string, unknown>;
+
+      const reqA = {
+        headers: { 'x-tenant-id': 'tenant-A' },
+        userPayload: { userRecord: sharedUserRecord, email: 'a@test.com', sessionId: 'sA' },
+      } as unknown as Parameters<typeof middleware>[0];
+      const reqB = {
+        headers: { 'x-tenant-id': 'tenant-B' },
+        userPayload: { userRecord: sharedUserRecord, email: 'b@test.com', sessionId: 'sB' },
+      } as unknown as Parameters<typeof middleware>[0];
+      const res = { status: vi.fn().mockReturnThis(), json: vi.fn() } as unknown as Parameters<typeof middleware>[1];
+
+      middleware(reqA, res, vi.fn());
+      middleware(reqB, res, vi.fn());
+
+      const userA = (reqA as unknown as { userPayload: { userRecord: UserInfo } }).userPayload.userRecord;
+      const userB = (reqB as unknown as { userPayload: { userRecord: UserInfo } }).userPayload.userRecord;
+      expect(userA.TenantContext?.TenantID).toBe('tenant-A');
+      expect(userB.TenantContext?.TenantID).toBe('tenant-B');
+      expect((sharedUserRecord as unknown as UserInfo).TenantContext).toBeUndefined();
+    });
   });
 
   // ─── PreSave security edge cases ──────────────────────────────────────

package/src/__tests__/multiTenancy.test.ts

@@ -15,6 +15,28 @@ vi.mock('@memberjunction/core', async (importOriginal) => {
       { Name: 'AI Models', SchemaName: '__mj' },
       { Name: 'Users', SchemaName: '__mj' },
     ];
+
+    // The hook validates that the tenant column resolves to a real, stored
+    // (non-virtual) field on the entity before interpolating it as an identifier.
+    EntityByName(name: string) {
+      const entity = this.Entities.find(
+        e => e.Name.trim().toLowerCase() === name.trim().toLowerCase()
+      );
+      if (!entity) return undefined;
+      return {
+        ...entity,
+        Fields: [
+          { Name: 'OrganizationID', IsVirtual: false },
+          { Name: 'TenantID', IsVirtual: false },
+        ],
+      };
+    }
+
+    // QuoteFilterIdentifier reads the STATIC Metadata.Provider, matching a real
+    // server (Metadata.Provider is a DatabaseProviderBase instance).
+    static Provider = {
+      QuoteIdentifier: (name: string) => `[${name}]`,
+    };
   }
 
   return {

package/src/__tests__/pushStatusResolver.filter.test.ts

@@ -0,0 +1,56 @@
+/**
+ * pushStatusResolver.filter.test.ts — locks the security-critical subscription filter for B49.
+ *
+ * `statusUpdatesFilter` is the gate that fixes the `statusUpdates` session-hijack: a push is
+ * delivered only when the push's `sessionId` matches the subscriber's requested session AND the
+ * push's `ownerUserId` matches the subscriber CONNECTION's server-authenticated identity. Knowing
+ * a victim's client-chosen `sessionId` must no longer be sufficient to receive their pushes.
+ *
+ * The filter is a pure function (no DB / config / transport), so these are plain unit tests.
+ */
+import 'reflect-metadata';
+import { describe, it, expect } from 'vitest';
+import { statusUpdatesFilter, type PushStatusNotificationPayload, type StatusUpdatesFilterContext } from '../generic/PushStatusResolver';
+import type { UserPayload } from '../types';
+
+const OWNER = 'AA11BB22-0000-4000-8000-000000000001';
+const ATTACKER = 'CC33DD44-0000-4000-8000-000000000002';
+const SESSION = 'session-abc-123';
+
+function ctxFor(userId: string | undefined): StatusUpdatesFilterContext {
+  // userRecord is `any` in UserPayload; a minimal shape with ID is all the filter reads.
+  return { userPayload: (userId ? { userRecord: { ID: userId } } : {}) as unknown as UserPayload };
+}
+
+function push(overrides: Partial<PushStatusNotificationPayload> = {}): PushStatusNotificationPayload {
+  return { sessionId: SESSION, ownerUserId: OWNER, message: 'progress', ...overrides };
+}
+
+describe('statusUpdatesFilter (B49 session-hijack gate)', () => {
+  it('delivers when sessionId matches AND the connection identity owns the push', () => {
+    expect(statusUpdatesFilter({ payload: push(), args: { sessionId: SESSION }, context: ctxFor(OWNER) })).toBe(true);
+  });
+
+  it('THE FIX: rejects a matching sessionId when the connection identity is a DIFFERENT user (hijack)', () => {
+    // Attacker lifted the victim's sessionId and subscribes with it — but their authenticated
+    // connection identity is their own, so delivery must be denied.
+    expect(statusUpdatesFilter({ payload: push({ ownerUserId: OWNER }), args: { sessionId: SESSION }, context: ctxFor(ATTACKER) })).toBe(false);
+  });
+
+  it('rejects when the requested sessionId does not match the push', () => {
+    expect(statusUpdatesFilter({ payload: push(), args: { sessionId: 'some-other-session' }, context: ctxFor(OWNER) })).toBe(false);
+  });
+
+  it('fails closed when the push carries no ownerUserId', () => {
+    expect(statusUpdatesFilter({ payload: push({ ownerUserId: '' }), args: { sessionId: SESSION }, context: ctxFor(OWNER) })).toBe(false);
+  });
+
+  it('fails closed when the connection has no authenticated identity', () => {
+    expect(statusUpdatesFilter({ payload: push(), args: { sessionId: SESSION }, context: ctxFor(undefined) })).toBe(false);
+    expect(statusUpdatesFilter({ payload: push(), args: { sessionId: SESSION }, context: undefined })).toBe(false);
+  });
+
+  it('matches identity case-insensitively (SQL Server upper vs PostgreSQL lower UUIDs)', () => {
+    expect(statusUpdatesFilter({ payload: push({ ownerUserId: OWNER.toUpperCase() }), args: { sessionId: SESSION }, context: ctxFor(OWNER.toLowerCase()) })).toBe(true);
+  });
+});

package/src/__tests__/resolverBase.rls.test.ts

@@ -136,7 +136,11 @@ function makeEntity(name: string, opts: {
     return {
         Name: name,
         UserExemptFromRowLevelSecurity: () => opts.exempt,
+        // ResolverBase now delegates to GetEffectiveRowFilterWhereClause (role RLS
+        // + API-key row filters); the deprecated role-only method is kept in the
+        // mock shape for completeness but is no longer what the resolver calls.
         GetUserRowLevelSecurityWhereClause: () => opts.exempt ? '' : opts.rlsClause,
+        GetEffectiveRowFilterWhereClause: () => opts.exempt ? '' : opts.rlsClause,
     } as unknown as EntityInfo;
 }