@memberjunction/server 5.51.2 → 5.51.4

package/src/__tests__/RunTemplateResolver.test.ts

@@ -0,0 +1,132 @@
+// type-graphql decorators call `Reflect.getMetadata`, which only exists once this polyfill is
+// loaded. MUST precede any import that pulls in the resolver file.
+import 'reflect-metadata';
+
+/**
+ * `RunTemplate` renders a stored template on demand. Its API-key scope check is a no-op for JWT,
+ * magic-link and widget sessions, so the resolver applies its own rule. These tests pin that it
+ * refuses scope-limited sessions and callers who cannot read templates before it loads anything.
+ */
+import { describe, it, expect, vi } from 'vitest';
+
+// As in RunDecisionResolver.test.ts: vitest's esbuild transform does not apply
+// `emitDecoratorMetadata`, so the decorators are no-ops and the resolver runs as a plain class.
+vi.mock('type-graphql', () => {
+  const noopDecorator = () => () => undefined;
+  return {
+    Resolver: noopDecorator, Mutation: noopDecorator, Query: noopDecorator, Subscription: noopDecorator,
+    ObjectType: noopDecorator, InputType: noopDecorator, Field: noopDecorator, Arg: noopDecorator,
+    Args: noopDecorator, Ctx: noopDecorator, PubSub: noopDecorator, Root: noopDecorator,
+    Directive: noopDecorator, Authorized: noopDecorator, UseMiddleware: noopDecorator,
+    createUnionType: () => class {},
+    AuthorizationError: class AuthorizationError extends Error {
+      constructor(message?: string) {
+        super(message);
+        this.name = 'AuthorizationError';
+      }
+    },
+    Float: class {}, Int: class {}, ID: class {},
+  };
+});
+
+import { EntityInfo, UserInfo, UserRoleInfo } from '@memberjunction/core';
+import { RunTemplateResolver } from '../resolvers/RunTemplateResolver.js';
+import type { AppContext, UserPayload } from '../types.js';
+
+const UI_ROLE_ID = '0b9b7b55-0000-4000-8000-0000000000a1';
+const TEMPLATE_ID = '0b9b7b55-0000-4000-8000-0000000000c1';
+
+/** An entity whose read permission is granted to the given roles. */
+function entityReadableBy(name: string, roleIds: string[]): EntityInfo {
+  const entityId = `entity-${name}`;
+  return new EntityInfo({
+    ID: entityId, Name: name, SchemaName: '__mj', BaseTable: name, BaseView: `vw${name}`, IncludeInAPI: true,
+    EntityPermissions: roleIds.map((roleId, index) => ({
+      ID: `${entityId}-permission-${index}`, EntityID: entityId, RoleID: roleId,
+      CanCreate: false, CanRead: true, CanUpdate: false, CanDelete: false, Type: 'Allow',
+    })),
+  });
+}
+
+/**
+ * Metadata plus the one data call the resolver makes first. The data call fails on purpose, so a
+ * test can tell whether the resolver got past authorization without needing a database.
+ */
+class FakeProvider {
+  public readonly EntityObjectRequests: string[] = [];
+
+  constructor(private readonly entities: EntityInfo[]) {}
+
+  public EntityByName(name: string): EntityInfo | undefined {
+    return this.entities.find((e) => e.Name.trim().toLowerCase() === name.trim().toLowerCase());
+  }
+
+  public async GetEntityObject(entityName: string): Promise<never> {
+    this.EntityObjectRequests.push(entityName);
+    throw new Error(`reached data access for ${entityName}`);
+  }
+}
+
+function makeUser(roleIds: string[]): UserInfo {
+  const userId = '0b9b7b55-0000-4000-8000-0000000000b1';
+  return new UserInfo(null, {
+    ID: userId, Name: 'Template Runner', Email: 'runner@example.com',
+    UserRoles: roleIds.map((roleId) => new UserRoleInfo({ UserID: userId, RoleID: roleId })),
+  });
+}
+
+const readableEverywhere = () => [
+  entityReadableBy('MJ: Templates', [UI_ROLE_ID]),
+  entityReadableBy('MJ: Template Contents', [UI_ROLE_ID]),
+];
+
+/** A JWT-style session (no API key), so the API-key scope check is a no-op. */
+function contextFor(user: UserInfo, provider: FakeProvider): AppContext {
+  const userPayload: UserPayload = { email: user.Email, userRecord: user, sessionId: 'session-1' };
+  return { userPayload, providers: [{ type: 'Read-Write', provider }] } as unknown as AppContext;
+}
+
+const runTemplate = (user: UserInfo, provider: FakeProvider) =>
+  new RunTemplateResolver().RunTemplate(TEMPLATE_ID, contextFor(user, provider));
+
+describe('RunTemplate authorization', () => {
+  it('refuses an anonymous magic-link guest before loading the template', async () => {
+    const provider = new FakeProvider(readableEverywhere());
+    const guest = makeUser([UI_ROLE_ID]);
+    guest.IsMagicLinkAnonymous = true;
+
+    const result = await runTemplate(guest, provider);
+
+    expect(result).toMatchObject({ success: false, error: 'Running templates is not permitted for scope-limited sessions' });
+    expect(provider.EntityObjectRequests).toEqual([]);
+  });
+
+  it('refuses a resource-scoped magic-link session before loading the template', async () => {
+    const provider = new FakeProvider(readableEverywhere());
+    const scoped = makeUser([UI_ROLE_ID]);
+    scoped.MagicLinkScope = { ResourceID: '0b9b7b55-0000-4000-8000-0000000000d1', ResourceType: 'Dashboards' };
+
+    const result = await runTemplate(scoped, provider);
+
+    expect(result).toMatchObject({ success: false, error: 'Running templates is not permitted for scope-limited sessions' });
+    expect(provider.EntityObjectRequests).toEqual([]);
+  });
+
+  it('refuses a user without read permission on MJ: Templates before loading the template', async () => {
+    const provider = new FakeProvider(readableEverywhere());
+
+    const result = await runTemplate(makeUser([]), provider);
+
+    expect(result).toMatchObject({ success: false, error: 'You do not have permission to read MJ: Templates' });
+    expect(provider.EntityObjectRequests).toEqual([]);
+  });
+
+  it('lets a user who can read templates and their content through to the template load', async () => {
+    const provider = new FakeProvider(readableEverywhere());
+
+    const result = await runTemplate(makeUser([UI_ROLE_ID]), provider);
+
+    expect(result).toMatchObject({ success: false, error: 'reached data access for MJ: Templates' });
+    expect(provider.EntityObjectRequests).toEqual(['MJ: Templates']);
+  });
+});

package/src/__tests__/RunViewResolver.cacheCheckScreen.test.ts

@@ -0,0 +1,164 @@
+// ResolverBase pulls in type-graphql decorators, which need the Reflect.metadata polyfill first.
+import 'reflect-metadata';
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+/**
+ * `RunViewsWithCacheCheck` is the transport `RunViews` switches to when any view in the batch is
+ * `CacheLocal`, so it carries the same client-supplied clauses as `RunViews`. These tests pin that
+ * it applies the same GraphQL-boundary protections before the provider is called: the base-view
+ * AST screen on ExtraFilter / OrderBy / OverrideExcludeFilter, and the API-key scope check.
+ *
+ * Every payload here is harmless (stacked `SELECT`s); the point is only whether it reaches the
+ * provider. The provider's own keyword denylist accepts the bracket-identifier payload, because a
+ * quote inside `[a']` hides the rest of the text from its literal stripper.
+ */
+
+const { authorize } = vi.hoisted(() => ({ authorize: vi.fn() }));
+
+vi.mock('@memberjunction/api-keys', async (importOriginal) => {
+    const actual = await importOriginal<typeof import('@memberjunction/api-keys')>();
+    return { ...actual, GetAPIKeyEngine: () => ({ Authorize: authorize }) };
+});
+
+import type { DatabaseProviderBase, EntityInfo, RunViewWithCacheCheckParams, UserInfo } from '@memberjunction/core';
+import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { RunDynamicViewInput, RunViewResolver, RunViewWithCacheCheckInput } from '../generic/RunViewResolver.js';
+import type { AppContext, UserPayload } from '../types.js';
+
+/** A stacked statement hidden from the keyword denylist by a quote inside a bracket identifier. */
+const BRACKET_STACKED =
+    "1 = (SELECT 1 AS [a'])) ; SELECT 1 AS [x] ; SELECT * FROM __mj.vwUserViews WHERE (1 = (SELECT 1 AS [b'])";
+
+const USER = { ID: 'user-1', Email: 'reader@example.com', Name: 'Reader' } as UserInfo;
+
+function entity(name: string, schema: string, baseView: string): EntityInfo {
+    return {
+        Name: name,
+        SchemaName: schema,
+        BaseView: baseView,
+        PrimaryKeys: [{ Name: 'ID' }],
+        GetUserPermisions: () => ({ CanRead: true }),
+        GetUserRowLevelSecurityWhereClause: () => '',
+    } as unknown as EntityInfo;
+}
+
+/** Provider double: the metadata the screen reads, and a cache-check method that records calls. */
+function fakeProvider() {
+    const calls: RunViewWithCacheCheckParams[][] = [];
+    const entities = [
+        entity('MJ: User Views', '__mj', 'vwUserViews'),
+        entity('MJ: Users', '__mj', 'vwUsers'),
+    ];
+    const provider = {
+        Entities: entities,
+        EntityByName: (name: string) => entities.find((e) => e.Name === name),
+        RunViewsWithCacheCheck: async (params: RunViewWithCacheCheckParams[]) => {
+            calls.push(params);
+            return { success: true, results: [] };
+        },
+    };
+    return { provider: provider as unknown as DatabaseProviderBase, calls };
+}
+
+function context(provider: DatabaseProviderBase, payload: Partial<UserPayload> = {}): AppContext {
+    const userPayload = { email: USER.Email, userRecord: USER, ...payload } as UserPayload;
+    return { providers: [{ type: 'Read-Only', provider }], userPayload } as unknown as AppContext;
+}
+
+function cacheCheckInput(params: Partial<RunDynamicViewInput>): RunViewWithCacheCheckInput[] {
+    const dynamic = Object.assign(new RunDynamicViewInput(), { EntityName: 'MJ: User Views', ...params });
+    return [Object.assign(new RunViewWithCacheCheckInput(), { params: dynamic })];
+}
+
+describe('RunViewsWithCacheCheck — GraphQL-boundary clause screen', () => {
+    it('refuses a stacked statement hidden behind a bracket identifier, before the provider runs', async () => {
+        const { provider, calls } = fakeProvider();
+
+        const result = await new RunViewResolver().RunViewsWithCacheCheck(
+            cacheCheckInput({ ExtraFilter: BRACKET_STACKED }),
+            context(provider),
+        );
+
+        expect(calls).toHaveLength(0);
+        expect(result.success).toBe(false);
+        expect(result.errorMessage).toMatch(/Invalid ExtraFilter: multiple statements/);
+    });
+
+    it('refuses a subquery against a base table', async () => {
+        const { provider, calls } = fakeProvider();
+
+        const result = await new RunViewResolver().RunViewsWithCacheCheck(
+            cacheCheckInput({ ExtraFilter: `EXISTS (SELECT 1 FROM __mj.[User] WHERE [Type] = 'Owner')` }),
+            context(provider),
+        );
+
+        expect(calls).toHaveLength(0);
+        expect(result.success).toBe(false);
+        expect(result.errorMessage).toMatch(/entity base view/);
+    });
+
+    it('screens OrderBy and OverrideExcludeFilter too', async () => {
+        for (const params of [
+            { OrderBy: "[a'] ; SELECT 1 AS [x] ; SELECT 1 AS [b']" },
+            { OverrideExcludeFilter: BRACKET_STACKED },
+        ]) {
+            const { provider, calls } = fakeProvider();
+
+            const result = await new RunViewResolver().RunViewsWithCacheCheck(cacheCheckInput(params), context(provider));
+
+            expect(calls).toHaveLength(0);
+            expect(result.success).toBe(false);
+        }
+    });
+
+    it('passes a filter that only reads entity base views through to the provider', async () => {
+        const { provider, calls } = fakeProvider();
+        const filter = `UserID IN (SELECT ID FROM [__mj].[vwUsers] WHERE Email = 'o''brien@example.com')`;
+
+        const result = await new RunViewResolver().RunViewsWithCacheCheck(
+            cacheCheckInput({ ExtraFilter: filter, OrderBy: '[Name] DESC' }),
+            context(provider),
+        );
+
+        expect(result.success).toBe(true);
+        expect(calls).toHaveLength(1);
+        expect(calls[0][0].params.ExtraFilter).toBe(filter);
+    });
+});
+
+describe('RunViewsWithCacheCheck — API-key scope', () => {
+    beforeEach(() => {
+        authorize.mockReset();
+        vi.spyOn(UserCache.Instance, 'GetSystemUser').mockReturnValue({ ID: 'system', Email: 'system@example.com' } as UserInfo);
+    });
+
+    it('refuses an API key without the batch view scope, before the provider runs', async () => {
+        authorize.mockResolvedValue({ Allowed: false, Reason: 'scope not granted' });
+        const { provider, calls } = fakeProvider();
+
+        const result = await new RunViewResolver().RunViewsWithCacheCheck(
+            cacheCheckInput({ ExtraFilter: `Name = 'x'` }),
+            context(provider, { apiKeyHash: 'hash-of-a-narrow-key' }),
+        );
+
+        expect(calls).toHaveLength(0);
+        expect(result.success).toBe(false);
+        expect(result.errorMessage).toMatch(/'view:batch' scope/);
+    });
+
+    it('lets an API key holding the scope through', async () => {
+        authorize.mockImplementation(async (_hash: string, _app: string, scope: string) => ({
+            Allowed: scope === 'view:batch',
+            Reason: scope === 'view:batch' ? 'granted' : 'not full access',
+        }));
+        const { provider, calls } = fakeProvider();
+
+        const result = await new RunViewResolver().RunViewsWithCacheCheck(
+            cacheCheckInput({ ExtraFilter: `Name = 'x'` }),
+            context(provider, { apiKeyHash: 'hash-of-a-batch-key' }),
+        );
+
+        expect(result.success).toBe(true);
+        expect(calls).toHaveLength(1);
+    });
+});

package/src/__tests__/SessionManager.test.ts

@@ -27,15 +27,18 @@ vi.mock('@memberjunction/ai-agents', () => ({
     },
 }));
 
-// --- Mock RunView.FromMetadataProvider so channel sweeps are controllable, while leaving the
-//     rest of @memberjunction/core intact. ---
+// --- Mock RunView.FromMetadataProvider so channel sweeps and run-id lookups are controllable,
+//     while leaving the rest of @memberjunction/core intact. RunViews runs each view through runViewMock. ---
 const runViewMock = vi.fn();
 vi.mock('@memberjunction/core', async (importOriginal) => {
     const actual = await importOriginal<typeof import('@memberjunction/core')>();
     return {
         ...actual,
         RunView: {
-            FromMetadataProvider: () => ({ RunView: runViewMock }),
+            FromMetadataProvider: () => ({
+                RunView: runViewMock,
+                RunViews: (paramsList: unknown[]) => Promise.all(paramsList.map((params) => runViewMock(params))),
+            }),
         },
     };
 });
@@ -100,6 +103,27 @@ function makeSessionEntity(overrides: Partial<FakeEntity> = {}): FakeEntity {
     };
 }
 
+/** Co-agent observability ids as a voice session's Config holds them. */
+const CO_RUN_ID = 'a5a5a5a5-0000-4000-8000-0000000000c0';
+const PROMPT_RUN_ID = 'a5a5a5a5-0000-4000-8000-0000000000b0';
+const RUN_STEP_ID = 'a5a5a5a5-0000-4000-8000-0000000000a0';
+
+/**
+ * Makes the given runs records of the session for the run-id lookups: `runIDs` carry the session's
+ * id, and `promptRunID` (when given) is the TargetLogID of the co-agent run's Prompt step.
+ */
+function mockSessionRunRecords(runIDs: string[], promptRunID?: string): void {
+    runViewMock.mockImplementation(async (params: { EntityName?: string }) => {
+        if (params.EntityName === 'MJ: AI Agent Runs') {
+            return { Success: true, Results: runIDs.map((ID) => ({ ID })) };
+        }
+        if (params.EntityName === 'MJ: AI Agent Run Steps') {
+            return { Success: true, Results: promptRunID ? [{ ID: RUN_STEP_ID, StepType: 'Prompt', TargetLogID: promptRunID }] : [] };
+        }
+        return { Success: true, Results: [] };
+    });
+}
+
 beforeEach(() => {
     hasPermissionMock.mockReset();
     finalizeCoAgentRunMock.mockClear();
@@ -228,8 +252,9 @@ describe('SessionManager.CloseSession', () => {
         const session = makeSessionEntity({
             ID: 'session-voice',
             Status: 'Active',
-            Config_: JSON.stringify({ targetAgentID: 't1', coAgentRunID: 'co-run-5', promptRunID: 'prompt-run-5' }),
+            Config_: JSON.stringify({ targetAgentID: 't1', coAgentRunID: CO_RUN_ID, promptRunID: PROMPT_RUN_ID }),
         });
+        mockSessionRunRecords([CO_RUN_ID], PROMPT_RUN_ID);
         const { provider } = makeProvider(() => session);
         const mgr = new SessionManager();
         const user = makeUser();
@@ -238,7 +263,7 @@ describe('SessionManager.CloseSession', () => {
 
         expect(ok).toBe(true);
         expect(finalizeCoAgentRunMock).toHaveBeenCalledTimes(1);
-        expect(finalizeCoAgentRunMock).toHaveBeenCalledWith('co-run-5', 'prompt-run-5', user, provider, true, null);
+        expect(finalizeCoAgentRunMock).toHaveBeenCalledWith(CO_RUN_ID, PROMPT_RUN_ID, user, provider, true, null);
     });
 
     it('threads the co-agent run-step id into finalize when the session config carries it', async () => {
@@ -247,11 +272,12 @@ describe('SessionManager.CloseSession', () => {
             Status: 'Active',
             Config_: JSON.stringify({
                 targetAgentID: 't1',
-                coAgentRunID: 'co-run-6',
-                promptRunID: 'prompt-run-6',
-                coAgentRunStepID: 'run-step-6',
+                coAgentRunID: CO_RUN_ID,
+                promptRunID: PROMPT_RUN_ID,
+                coAgentRunStepID: RUN_STEP_ID,
             }),
         });
+        mockSessionRunRecords([CO_RUN_ID], PROMPT_RUN_ID);
         const { provider } = makeProvider(() => session);
         const mgr = new SessionManager();
         const user = makeUser();
@@ -259,7 +285,7 @@ describe('SessionManager.CloseSession', () => {
         const ok = await mgr.CloseSession('session-voice-step', user, provider);
 
         expect(ok).toBe(true);
-        expect(finalizeCoAgentRunMock).toHaveBeenCalledWith('co-run-6', 'prompt-run-6', user, provider, true, 'run-step-6');
+        expect(finalizeCoAgentRunMock).toHaveBeenCalledWith(CO_RUN_ID, PROMPT_RUN_ID, user, provider, true, RUN_STEP_ID);
     });
 
     it('finalizes as the SYSTEM user when a scoped anonymous owner closes their session (issue #3371)', async () => {
@@ -274,8 +300,9 @@ describe('SessionManager.CloseSession', () => {
         const session = makeSessionEntity({
             ID: 'session-anon',
             Status: 'Active',
-            Config_: JSON.stringify({ targetAgentID: 't1', coAgentRunID: 'co-run-9', promptRunID: 'prompt-run-9' }),
+            Config_: JSON.stringify({ targetAgentID: 't1', coAgentRunID: CO_RUN_ID, promptRunID: PROMPT_RUN_ID }),
         });
+        mockSessionRunRecords([CO_RUN_ID], PROMPT_RUN_ID);
         const { provider } = makeProvider(() => session);
         const mgr = new SessionManager();
 
@@ -284,7 +311,7 @@ describe('SessionManager.CloseSession', () => {
         expect(ok).toBe(true);
         // The session-close writes themselves stay on the caller — only finalize elevates.
         expect(session.Status).toBe('Closed');
-        expect(finalizeCoAgentRunMock).toHaveBeenCalledWith('co-run-9', 'prompt-run-9', systemUser, provider, true, null);
+        expect(finalizeCoAgentRunMock).toHaveBeenCalledWith(CO_RUN_ID, PROMPT_RUN_ID, systemUser, provider, true, null);
     });
 
     it('FAILS CLOSED — finalizes as the anonymous caller when no system user is available', async () => {
@@ -297,14 +324,15 @@ describe('SessionManager.CloseSession', () => {
         const session = makeSessionEntity({
             ID: 'session-anon-2',
             Status: 'Active',
-            Config_: JSON.stringify({ targetAgentID: 't1', coAgentRunID: 'co-run-10', promptRunID: null }),
+            Config_: JSON.stringify({ targetAgentID: 't1', coAgentRunID: CO_RUN_ID, promptRunID: null }),
         });
+        mockSessionRunRecords([CO_RUN_ID]);
         const { provider } = makeProvider(() => session);
         const mgr = new SessionManager();
 
         await mgr.CloseSession('session-anon-2', anonUser, provider);
 
-        expect(finalizeCoAgentRunMock).toHaveBeenCalledWith('co-run-10', null, anonUser, provider, true, null);
+        expect(finalizeCoAgentRunMock).toHaveBeenCalledWith(CO_RUN_ID, null, anonUser, provider, true, null);
     });
 
     it('does not finalize when the session config has no run ids (target only)', async () => {
@@ -527,3 +555,50 @@ describe('SessionManager — server-side channel plugin lifecycle notifications'
         expect(session.Status).toBe('Closed');
     });
 });
+
+// A session's Config is writable by its owner (generic CRUD on MJ: AI Agent Sessions), so the run
+// ids in it are acted on only when they are UUIDs of records that belong to the session.
+describe('SessionManager — run ids in the owner-writable session Config', () => {
+    const SESSION_ID = 'c3c3c3c3-1000-4000-8000-000000000001';
+    const FOREIGN_RUN_ID = 'c3c3c3c3-1000-4000-8000-0000000000f1';
+    const FOREIGN_PROMPT_RUN_ID = 'c3c3c3c3-1000-4000-8000-0000000000f2';
+    const FOREIGN_STEP_ID = 'c3c3c3c3-1000-4000-8000-0000000000f3';
+    /** Harmless text that is not a UUID and would change the meaning of a quoted filter. */
+    const NOT_A_UUID = "x' OR '1'='1";
+
+    function issuedFilters(): string[] {
+        return runViewMock.mock.calls.map(([params]) => (params as { ExtraFilter?: string }).ExtraFilter ?? '');
+    }
+
+    it('CloseSession does not finalize run ids that are not records of the session', async () => {
+        const session = makeSessionEntity({
+            ID: SESSION_ID,
+            Status: 'Active',
+            Config_: JSON.stringify({
+                targetAgentID: 't1',
+                coAgentRunID: FOREIGN_RUN_ID,
+                promptRunID: FOREIGN_PROMPT_RUN_ID,
+                coAgentRunStepID: FOREIGN_STEP_ID,
+            }),
+        });
+        const { provider } = makeProvider(() => session);
+
+        await new SessionManager().CloseSession(SESSION_ID, makeUser(), provider);
+
+        expect(finalizeCoAgentRunMock).not.toHaveBeenCalled();
+    });
+
+    it('CloseSession does not finalize run ids that are not UUIDs, and never puts them in a filter', async () => {
+        const session = makeSessionEntity({
+            ID: SESSION_ID,
+            Status: 'Active',
+            Config_: JSON.stringify({ targetAgentID: 't1', coAgentRunID: NOT_A_UUID, promptRunID: NOT_A_UUID }),
+        });
+        const { provider } = makeProvider(() => session);
+
+        await new SessionManager().CloseSession(SESSION_ID, makeUser(), provider);
+
+        expect(finalizeCoAgentRunMock).not.toHaveBeenCalled();
+        expect(issuedFilters().filter((f) => f.includes(NOT_A_UUID))).toEqual([]);
+    });
+});