@memberjunction/server 5.51.2 → 5.51.4

package/src/__tests__/SessionRunIDVerifier.test.ts

@@ -0,0 +1,255 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import type { IMetadataProvider, RunViewParams, UserInfo } from '@memberjunction/core';
+import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { SessionRunIDVerifier } from '../agentSessions/SessionRunIDVerifier.js';
+
+const SESSION_ID = 'd3d3d3d3-0000-4000-8000-000000000001';
+const CO_RUN_ID = 'd3d3d3d3-0000-4000-8000-000000000002';
+const PROMPT_RUN_ID = 'd3d3d3d3-0000-4000-8000-000000000003';
+const STEP_ID = 'd3d3d3d3-0000-4000-8000-000000000004';
+const PAUSED_RUN_ID = 'd3d3d3d3-0000-4000-8000-000000000005';
+const USER = { ID: 'd3d3d3d3-0000-4000-8000-0000000000aa' } as unknown as UserInfo;
+
+/** Rows each lookup returns, keyed by entity name. */
+type Rows = Record<string, Array<Record<string, unknown>>>;
+
+function makeProvider(rows: Rows, success = true): { provider: IMetadataProvider; runViews: ReturnType<typeof vi.fn> } {
+    const runViews = vi.fn(async (paramsList: RunViewParams[]) =>
+        paramsList.map((params) => ({
+            Success: success,
+            Results: success ? rows[params.EntityName ?? ''] ?? [] : [],
+            ErrorMessage: success ? '' : 'lookup failed',
+        })),
+    );
+    return { provider: { RunViews: runViews } as unknown as IMetadataProvider, runViews };
+}
+
+function issuedViews(runViews: ReturnType<typeof vi.fn>): RunViewParams[] {
+    return runViews.mock.calls.flatMap(([paramsList]) => paramsList as RunViewParams[]);
+}
+
+/** Stubs the cached system user; lts/5's UserCache has no SetUsers. */
+let getSystemUserSpy: ReturnType<typeof vi.spyOn>;
+
+beforeEach(() => {
+    vi.spyOn(console, 'error').mockImplementation(() => undefined);
+    getSystemUserSpy = vi.spyOn(UserCache.Instance, 'GetSystemUser').mockReturnValue(undefined as unknown as UserInfo);
+});
+
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+
+describe('SessionRunIDVerifier.Verify', () => {
+    it('keeps nothing, and runs no lookup, when no claim is a UUID', async () => {
+        const { provider, runViews } = makeProvider({});
+
+        const result = await new SessionRunIDVerifier().Verify(
+            SESSION_ID,
+            { CoAgentRunID: "x' OR '1'='1", PromptRunID: 'prompt-run-1', PendingFeedbackRunID: '' },
+            USER,
+            provider,
+        );
+
+        expect(result).toEqual({});
+        expect(runViews).not.toHaveBeenCalled();
+    });
+
+    it('looks up the claimed runs within the session and keeps only the ones it finds', async () => {
+        const { provider, runViews } = makeProvider({ 'MJ: AI Agent Runs': [{ ID: CO_RUN_ID }] });
+
+        const result = await new SessionRunIDVerifier().Verify(
+            SESSION_ID,
+            { CoAgentRunID: CO_RUN_ID, PendingFeedbackRunID: PAUSED_RUN_ID },
+            USER,
+            provider,
+        );
+
+        expect(result.CoAgentRunID).toBe(CO_RUN_ID);
+        expect(result.PendingFeedbackRunID).toBeUndefined();
+        const [runsView] = issuedViews(runViews);
+        expect(runsView.EntityName).toBe('MJ: AI Agent Runs');
+        expect(runsView.ExtraFilter).toBe(`AgentSessionID='${SESSION_ID}' AND ID IN ('${CO_RUN_ID}', '${PAUSED_RUN_ID}')`);
+        // No system user is cached here, so the lookup runs as the acting user.
+        expect(runViews.mock.calls[0][1]).toBe(USER);
+    });
+
+    it('runs the lookup as the system user when one is available', async () => {
+        // Row-level security can hide a session's own runs from its owner: a web-widget guest's
+        // delegated runs carry no ConversationID, so the guest's run filter does not match them.
+        const systemUser = { ID: UserCache.Instance.SYSTEM_USER_ID, Email: 'system@example.com' } as unknown as UserInfo;
+        getSystemUserSpy.mockReturnValue(systemUser);
+        const { provider, runViews } = makeProvider({ 'MJ: AI Agent Runs': [{ ID: PAUSED_RUN_ID }] });
+
+        const result = await new SessionRunIDVerifier().Verify(SESSION_ID, { PendingFeedbackRunID: PAUSED_RUN_ID }, USER, provider);
+
+        expect(result.PendingFeedbackRunID).toBe(PAUSED_RUN_ID);
+        expect(runViews.mock.calls[0][1]).toBe(systemUser);
+    });
+
+    it('keeps the prompt run and step that belong to the session\'s co-agent run', async () => {
+        const { provider, runViews } = makeProvider({
+            'MJ: AI Agent Runs': [{ ID: CO_RUN_ID }],
+            'MJ: AI Agent Run Steps': [{ ID: STEP_ID, StepType: 'Prompt', TargetLogID: PROMPT_RUN_ID }],
+        });
+
+        const result = await new SessionRunIDVerifier().Verify(
+            SESSION_ID,
+            { CoAgentRunID: CO_RUN_ID, PromptRunID: PROMPT_RUN_ID, CoAgentRunStepID: STEP_ID },
+            USER,
+            provider,
+        );
+
+        expect(result).toEqual({ CoAgentRunID: CO_RUN_ID, PromptRunID: PROMPT_RUN_ID, CoAgentRunStepID: STEP_ID, PendingFeedbackRunID: undefined });
+        const stepsView = issuedViews(runViews).find((view) => view.EntityName === 'MJ: AI Agent Run Steps');
+        expect(stepsView?.ExtraFilter).toBe(`AgentRunID='${CO_RUN_ID}' AND (ID='${STEP_ID}' OR TargetLogID='${PROMPT_RUN_ID}')`);
+    });
+
+    it('drops a prompt run that is the target of a step other than a Prompt step', async () => {
+        const { provider } = makeProvider({
+            'MJ: AI Agent Runs': [{ ID: CO_RUN_ID }],
+            'MJ: AI Agent Run Steps': [{ ID: STEP_ID, StepType: 'Tool', TargetLogID: PROMPT_RUN_ID }],
+        });
+
+        const result = await new SessionRunIDVerifier().Verify(SESSION_ID, { CoAgentRunID: CO_RUN_ID, PromptRunID: PROMPT_RUN_ID }, USER, provider);
+
+        expect(result.PromptRunID).toBeUndefined();
+    });
+
+    it('drops the prompt run and step when the co-agent run is not the session\'s', async () => {
+        const { provider } = makeProvider({
+            'MJ: AI Agent Runs': [],
+            'MJ: AI Agent Run Steps': [{ ID: STEP_ID, StepType: 'Prompt', TargetLogID: PROMPT_RUN_ID }],
+        });
+
+        const result = await new SessionRunIDVerifier().Verify(
+            SESSION_ID,
+            { CoAgentRunID: CO_RUN_ID, PromptRunID: PROMPT_RUN_ID, CoAgentRunStepID: STEP_ID },
+            USER,
+            provider,
+        );
+
+        expect(result).toEqual({ CoAgentRunID: undefined, PromptRunID: undefined, CoAgentRunStepID: undefined, PendingFeedbackRunID: undefined });
+    });
+
+    it('matches ids case-insensitively', async () => {
+        const { provider } = makeProvider({ 'MJ: AI Agent Runs': [{ ID: PAUSED_RUN_ID.toUpperCase() }] });
+
+        const result = await new SessionRunIDVerifier().Verify(SESSION_ID, { PendingFeedbackRunID: PAUSED_RUN_ID }, USER, provider);
+
+        expect(result.PendingFeedbackRunID).toBe(PAUSED_RUN_ID);
+    });
+
+    it('looks up the same claims again on every call', async () => {
+        const { provider, runViews } = makeProvider({ 'MJ: AI Agent Runs': [{ ID: CO_RUN_ID }] });
+        const verifier = new SessionRunIDVerifier();
+
+        await verifier.Verify(SESSION_ID, { CoAgentRunID: CO_RUN_ID }, USER, provider);
+        const second = await verifier.Verify(SESSION_ID, { CoAgentRunID: CO_RUN_ID }, USER, provider);
+
+        expect(second.CoAgentRunID).toBe(CO_RUN_ID);
+        expect(runViews).toHaveBeenCalledTimes(2);
+    });
+
+    it('reads the runs and steps from the database, not from a cached view', async () => {
+        const { provider, runViews } = makeProvider({ 'MJ: AI Agent Runs': [{ ID: CO_RUN_ID }] });
+
+        await new SessionRunIDVerifier().Verify(SESSION_ID, { CoAgentRunID: CO_RUN_ID, PromptRunID: PROMPT_RUN_ID }, USER, provider);
+
+        const views = issuedViews(runViews);
+        expect(views.map((view) => view.EntityName)).toEqual(['MJ: AI Agent Runs', 'MJ: AI Agent Run Steps']);
+        expect(views.every((view) => view.BypassCache === true)).toBe(true);
+    });
+
+    it('keeps nothing when a lookup fails, and looks up again next time', async () => {
+        const { provider, runViews } = makeProvider({}, false);
+        const verifier = new SessionRunIDVerifier();
+
+        const first = await verifier.Verify(SESSION_ID, { CoAgentRunID: CO_RUN_ID }, USER, provider);
+        await verifier.Verify(SESSION_ID, { CoAgentRunID: CO_RUN_ID }, USER, provider);
+
+        expect(first).toEqual({});
+        expect(runViews).toHaveBeenCalledTimes(2);
+    });
+
+    it('keeps nothing, without throwing, when the provider throws', async () => {
+        const provider = { RunViews: vi.fn(async () => { throw new Error('connection lost'); }) } as unknown as IMetadataProvider;
+
+        await expect(new SessionRunIDVerifier().Verify(SESSION_ID, { CoAgentRunID: CO_RUN_ID }, USER, provider)).resolves.toEqual({});
+    });
+});
+
+/**
+ * A run's `AgentSessionID` and a step's `AgentRunID` and `TargetLogID` can change after a lookup (the
+ * generated update mutations accept them), so each call must decide from what the rows say now.
+ */
+describe('SessionRunIDVerifier.Verify — relationships that change between calls', () => {
+    const CLAIMS = { CoAgentRunID: CO_RUN_ID, PromptRunID: PROMPT_RUN_ID, CoAgentRunStepID: STEP_ID, PendingFeedbackRunID: PAUSED_RUN_ID };
+
+    /** Both runs are records of the session, and the step is the co-agent run's Prompt step for the prompt run. */
+    function linkedRows(): Rows {
+        return {
+            'MJ: AI Agent Runs': [{ ID: CO_RUN_ID }, { ID: PAUSED_RUN_ID }],
+            'MJ: AI Agent Run Steps': [{ ID: STEP_ID, StepType: 'Prompt', TargetLogID: PROMPT_RUN_ID }],
+        };
+    }
+
+    it('drops runs that stopped being records of the session since the last call', async () => {
+        const rows = linkedRows();
+        const { provider } = makeProvider(rows);
+        const verifier = new SessionRunIDVerifier();
+        const first = await verifier.Verify(SESSION_ID, CLAIMS, USER, provider);
+
+        // The runs were moved to another session, unlinked or deleted.
+        rows['MJ: AI Agent Runs'] = [];
+        const second = await verifier.Verify(SESSION_ID, CLAIMS, USER, provider);
+
+        expect(first).toEqual(CLAIMS);
+        expect(second).toEqual({ CoAgentRunID: undefined, PromptRunID: undefined, CoAgentRunStepID: undefined, PendingFeedbackRunID: undefined });
+    });
+
+    it('drops the prompt run and step once the step is no longer linked to the co-agent run', async () => {
+        const rows = linkedRows();
+        const { provider } = makeProvider(rows);
+        const verifier = new SessionRunIDVerifier();
+        const first = await verifier.Verify(SESSION_ID, CLAIMS, USER, provider);
+
+        rows['MJ: AI Agent Run Steps'] = [];
+        const second = await verifier.Verify(SESSION_ID, CLAIMS, USER, provider);
+
+        expect(first).toEqual(CLAIMS);
+        expect(second).toEqual({ ...CLAIMS, PromptRunID: undefined, CoAgentRunStepID: undefined });
+    });
+
+    it('still keeps a relationship that has not changed on the next call', async () => {
+        const { provider } = makeProvider(linkedRows());
+        const verifier = new SessionRunIDVerifier();
+
+        await verifier.Verify(SESSION_ID, CLAIMS, USER, provider);
+        const second = await verifier.Verify(SESSION_ID, CLAIMS, USER, provider);
+
+        expect(second).toEqual(CLAIMS);
+    });
+});
+
+describe('SessionRunIDVerifier.Verify — lookups as the acting user', () => {
+    it('does not give a user the result of a lookup made for another user', async () => {
+        // No system user is cached, so each lookup runs as the acting user, and only USER can see the run.
+        const otherUser = { ID: 'd3d3d3d3-0000-4000-8000-0000000000bb' } as unknown as UserInfo;
+        const runViews = vi.fn(async (paramsList: RunViewParams[], user: UserInfo) =>
+            paramsList.map((params) => {
+                const visible = user === USER && params.EntityName === 'MJ: AI Agent Runs';
+                return { Success: true, Results: visible ? [{ ID: CO_RUN_ID }] : [], ErrorMessage: '' };
+            }),
+        );
+        const provider = { RunViews: runViews } as unknown as IMetadataProvider;
+        const verifier = new SessionRunIDVerifier();
+
+        const forUser = await verifier.Verify(SESSION_ID, { CoAgentRunID: CO_RUN_ID }, USER, provider);
+        const forOtherUser = await verifier.Verify(SESSION_ID, { CoAgentRunID: CO_RUN_ID }, otherUser, provider);
+
+        expect(forUser.CoAgentRunID).toBe(CO_RUN_ID);
+        expect(forOtherUser.CoAgentRunID).toBeUndefined();
+        expect(runViews.mock.calls[1]?.[1]).toBe(otherUser);
+    });
+});

package/src/__tests__/UpdateMJDataContextItem.oldValues.test.ts

@@ -0,0 +1,220 @@
+// type-graphql decorators in the resolver graph need the Reflect.metadata polyfill at import time.
+import 'reflect-metadata';
+/**
+ * `UpdateMJDataContextItem` goes through `ResolverBase.UpdateRecord`. `MJ: Data Context Items` does
+ * not track record changes, so without special handling a client that sends `OldValues___` decides
+ * the record's starting state. It could repeat its new SQL as the old value, so the SQL field does
+ * not look changed. Or it could leave `Type` and `SQL` out entirely, so they are never loaded and
+ * the stored procedure keeps the stored SQL item. The server entity class for the item must still
+ * refuse a non-Owner's save of a SQL item on every one of these paths.
+ *
+ * The resolver base and the entity class are real. The provider hands out real entity objects,
+ * loads a fixed stored row, and records each save instead of writing it.
+ */
+import { describe, it, expect, vi } from 'vitest';
+import { EntityInfo, Metadata, UserInfo, UserRoleInfo } from '@memberjunction/core';
+import type { BaseEntity, DatabaseProviderBase, IEntityDataProvider, IMetadataProvider } from '@memberjunction/core';
+import { MJDataContextItemEntityServer } from '@memberjunction/core-entities-server';
+import type { PubSubEngine } from 'type-graphql';
+import { ResolverBase } from '../generic/ResolverBase.js';
+import type { UserPayload } from '../types.js';
+
+const ENTITY_ID = 'E0000000-0000-4000-8000-0000000000D2';
+const UI_ROLE_ID = 'E1000000-0000-4000-8000-000000000001';
+const DATA_CONTEXT_ID = 'B0000000-0000-4000-8000-000000000001';
+const OTHER_DATA_CONTEXT_ID = 'B0000000-0000-4000-8000-000000000002';
+const ITEM_ID = 'C0000000-0000-4000-8000-000000000001';
+const STORED_SQL = 'SELECT 1 AS One';
+const NEW_SQL = 'SELECT 2 AS Two';
+
+interface StoredRow {
+    ID: string;
+    DataContextID: string;
+    Type: string;
+    SQL: string | null;
+    DataJSON: string | null;
+    Description: string | null;
+}
+
+/** A SQL item in someone else's data context. */
+const STORED_SQL_ITEM: StoredRow = {
+    ID: ITEM_ID, DataContextID: DATA_CONTEXT_ID, Type: 'sql', SQL: STORED_SQL, DataJSON: null, Description: 'Revenue',
+};
+
+/** An item of another type, with no SQL. */
+const STORED_ENTITY_ITEM: StoredRow = {
+    ID: ITEM_ID, DataContextID: DATA_CONTEXT_ID, Type: 'full_entity', SQL: null, DataJSON: null, Description: 'Notes',
+};
+
+/**
+ * `MJ: Data Context Items` as the database describes it: record changes and field-level security
+ * off, the API open, and the UI role holding every permission with no row-level filter.
+ */
+const ITEM_ENTITY = new EntityInfo({
+    ID: ENTITY_ID,
+    Name: 'MJ: Data Context Items',
+    SchemaName: '__mj',
+    BaseTable: 'DataContextItem',
+    BaseView: 'vwDataContextItems',
+    Status: 'Active',
+    IncludeInAPI: true,
+    AllowCreateAPI: true,
+    AllowUpdateAPI: true,
+    AllowDeleteAPI: true,
+    TrackRecordChanges: false,
+    EnableFieldLevelSecurity: false,
+    EntityPermissions: [{
+        ID: 'P0000000-0000-4000-8000-000000000001', EntityID: ENTITY_ID, RoleID: UI_ROLE_ID,
+        CanCreate: true, CanRead: true, CanUpdate: true, CanDelete: true,
+    }],
+    EntityFields: [
+        { Name: 'ID', Type: 'uniqueidentifier', AllowsNull: false, IsPrimaryKey: true },
+        { Name: 'DataContextID', Type: 'uniqueidentifier', AllowsNull: false },
+        { Name: 'Type', Type: 'nvarchar', AllowsNull: false },
+        { Name: 'SQL', Type: 'nvarchar', AllowsNull: true },
+        { Name: 'DataJSON', Type: 'nvarchar', AllowsNull: true },
+        { Name: 'Description', Type: 'nvarchar', AllowsNull: true },
+    ].map((c, i) => ({
+        ID: `F0000000-0000-4000-8000-00000000000${i}`,
+        EntityID: ENTITY_ID,
+        Sequence: i + 1,
+        Length: 0,
+        Precision: 0,
+        Scale: 0,
+        AllowUpdateAPI: true,
+        ...c,
+    })),
+});
+
+/** A UI-role user who is not an administrator. */
+const UI_USER = new UserInfo(null, {
+    ID: 'A0000000-0000-4000-8000-000000000002',
+    Email: 'ui-user@example.com',
+    Type: 'User',
+    UserRoles: [new UserRoleInfo({ UserID: 'A0000000-0000-4000-8000-000000000002', RoleID: UI_ROLE_ID })],
+});
+
+const PAYLOAD: UserPayload = { email: UI_USER.Email, userRecord: UI_USER, sessionId: 'test-session' };
+const PUB_SUB = { publish: async (): Promise<void> => undefined } as unknown as PubSubEngine;
+
+/** What one save would have written. */
+interface RecordedSave {
+    DataContextID: string;
+    SQL: string | null;
+    DataJSON: string | null;
+}
+
+/** A database provider whose load returns `stored`, and which records each save it receives. */
+function recordingDatabase(stored: StoredRow): { Saves: RecordedSave[]; Provider: DatabaseProviderBase } {
+    const saves: RecordedSave[] = [];
+    const entityData = {
+        async Load(): Promise<Record<string, unknown>> {
+            return { ...stored };
+        },
+        async Save(entity: BaseEntity): Promise<Record<string, unknown>> {
+            const item = entity as MJDataContextItemEntityServer;
+            saves.push({ DataContextID: item.DataContextID, SQL: item.SQL, DataJSON: item.DataJSON });
+            return entity.GetAll();
+        },
+    } as unknown as IEntityDataProvider;
+    const database = {
+        async GetEntityObject(_entityName: string, user: UserInfo): Promise<MJDataContextItemEntityServer> {
+            const item = new MJDataContextItemEntityServer(ITEM_ENTITY, entityData);
+            item.ContextCurrentUser = user;
+            return item;
+        },
+    } as unknown as DatabaseProviderBase;
+    return { Saves: saves, Provider: database };
+}
+
+/** Builds an `OldValues___` array from a plain object. */
+function oldValues(values: Record<string, string | null>): Array<{ Key: string; Value: string | null }> {
+    return Object.entries(values).map(([Key, Value]) => ({ Key, Value }));
+}
+
+/** Exposes ResolverBase's generic update path, which the generated `UpdateMJDataContextItem` mutation calls. */
+class UpdateHarness extends ResolverBase {
+    /** Runs the update and reports how it ended: 'saved', or the message it was refused with. */
+    public async Update(input: Record<string, unknown>, provider: DatabaseProviderBase): Promise<string> {
+        try {
+            await this.UpdateRecord('MJ: Data Context Items', input, provider, PAYLOAD, PUB_SUB);
+            return 'saved';
+        } catch (e) {
+            return e instanceof Error ? e.message : String(e);
+        }
+    }
+}
+
+const harness = new UpdateHarness();
+
+describe('UpdateMJDataContextItem — a non-Owner may not change a SQL item', () => {
+    it('refuses new SQL when the update loads the stored row (no OldValues___)', async () => {
+        const db = recordingDatabase(STORED_SQL_ITEM);
+
+        const outcome = await harness.Update({ ...STORED_SQL_ITEM, SQL: NEW_SQL }, db.Provider);
+
+        expect(db.Saves).toEqual([]);
+        expect(outcome).toMatch(/Owner-type/);
+    });
+
+    it('refuses new SQL when OldValues___ repeats the new SQL, so the field does not look changed', async () => {
+        const db = recordingDatabase(STORED_SQL_ITEM);
+        const input = {
+            ...STORED_SQL_ITEM,
+            SQL: NEW_SQL,
+            Description: 'Renamed',
+            OldValues___: oldValues({ ID: ITEM_ID, DataContextID: DATA_CONTEXT_ID, Type: 'sql', SQL: NEW_SQL, Description: 'Revenue' }),
+        };
+
+        const outcome = await harness.Update(input, db.Provider);
+
+        expect(db.Saves).toEqual([]);
+        expect(outcome).toMatch(/Owner-type/);
+    });
+
+    it('refuses moving a SQL item to another data context when Type and SQL are left out of the input and OldValues___', async () => {
+        const db = recordingDatabase(STORED_SQL_ITEM);
+        const input = {
+            ID: ITEM_ID,
+            DataContextID: OTHER_DATA_CONTEXT_ID,
+            OldValues___: oldValues({ ID: ITEM_ID, DataContextID: DATA_CONTEXT_ID }),
+        };
+
+        const outcome = await harness.Update(input, db.Provider);
+
+        expect(db.Saves).toEqual([]);
+        expect(outcome).toMatch(/Owner-type/);
+    });
+
+    it('refuses changing the cached DataJSON of a SQL item when Type and SQL are left out of the input and OldValues___', async () => {
+        const db = recordingDatabase(STORED_SQL_ITEM);
+        const input = {
+            ID: ITEM_ID,
+            DataJSON: '[{"One":2}]',
+            OldValues___: oldValues({ ID: ITEM_ID, DataJSON: null }),
+        };
+
+        const outcome = await harness.Update(input, db.Provider);
+
+        expect(db.Saves).toEqual([]);
+        expect(outcome).toMatch(/Owner-type/);
+    });
+
+    it('still saves a non-Owner\'s change to an item of another type that sends OldValues___', async () => {
+        // The success path maps the saved row back through the process-wide metadata.
+        vi.spyOn(Metadata, 'Provider', 'get').mockReturnValue(
+            { Entities: [ITEM_ENTITY], EntityByName: () => ITEM_ENTITY } as unknown as IMetadataProvider,
+        );
+        const db = recordingDatabase(STORED_ENTITY_ITEM);
+        const input = {
+            ID: ITEM_ID,
+            Description: 'Renamed',
+            OldValues___: oldValues({ ID: ITEM_ID, Description: 'Notes' }),
+        };
+
+        const outcome = await harness.Update(input, db.Provider);
+
+        expect(outcome).toBe('saved');
+        expect(db.Saves).toEqual([{ DataContextID: DATA_CONTEXT_ID, SQL: null, DataJSON: null }]);
+    });
+});

package/src/__tests__/ViewOperationsHandler.clauseScreen.test.ts

@@ -0,0 +1,155 @@
+/**
+ * The REST view routes (`POST /views/:entityName`, `POST /views/batch`, `GET /entities/:entityName`)
+ * hand client `ExtraFilter` / `OrderBy` / `OverrideExcludeFilter` text to `RunView` through
+ * `ViewOperationsHandler`. These tests pin that the text passes the same base-view AST screen as
+ * the GraphQL RunView resolvers before any view runs. Payloads are harmless (stacked `SELECT`s);
+ * the point is only whether they reach `RunView`.
+ *
+ * `@memberjunction/core`'s `Metadata` and `RunView` are replaced at the module boundary, as in
+ * ViewOperationsHandler.test.ts; the screen itself runs unmodified.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+const { mockRunViewFn, mockRunViewsFn, mockEntityList } = vi.hoisted(() => ({
+    mockRunViewFn: vi.fn(),
+    mockRunViewsFn: vi.fn(),
+    mockEntityList: [] as Array<{
+        Name: string;
+        SchemaName: string;
+        BaseView: string;
+        GetUserPermisions: (u: unknown) => { CanRead: boolean };
+        GetUserRowLevelSecurityWhereClause: () => string;
+    }>,
+}));
+
+vi.mock('@memberjunction/core', async (importOriginal) => {
+    const actual = await importOriginal<typeof import('@memberjunction/core')>();
+    class MockMetadata {
+        public get Entities() {
+            return mockEntityList;
+        }
+    }
+    class MockRunView {
+        public RunView(params: unknown, contextUser?: unknown): Promise<unknown> {
+            return mockRunViewFn(params, contextUser);
+        }
+        public RunViews(params: unknown[], contextUser?: unknown): Promise<unknown> {
+            return mockRunViewsFn(params, contextUser);
+        }
+    }
+    return { ...actual, Metadata: MockMetadata, RunView: MockRunView, LogError: vi.fn() };
+});
+
+import type { BaseEntity, PlatformSQL, RunViewParams, UserInfo } from '@memberjunction/core';
+import { ViewOperationsHandler } from '../rest/ViewOperationsHandler.js';
+
+const BRACKET_STACKED =
+    "1 = (SELECT 1 AS [a'])) ; SELECT 1 AS [x] ; SELECT * FROM sales.vwCustomers WHERE (1 = (SELECT 1 AS [b'])";
+
+const USER = { ID: 'user-1', Name: 'Reader' } as unknown as UserInfo;
+const OK_RESULT = { Success: true, Results: [{ ID: '1' }] };
+
+beforeEach(() => {
+    vi.clearAllMocks();
+    mockEntityList.length = 0;
+    const unscoped = { GetUserRowLevelSecurityWhereClause: () => '' };
+    mockEntityList.push(
+        { Name: 'Customers', SchemaName: 'sales', BaseView: 'vwCustomers', GetUserPermisions: () => ({ CanRead: true }), ...unscoped },
+        { Name: 'Ledger', SchemaName: 'sales', BaseView: 'vwLedger', GetUserPermisions: () => ({ CanRead: false }), ...unscoped },
+        {
+            Name: 'Orders',
+            SchemaName: 'sales',
+            BaseView: 'vwOrders',
+            GetUserPermisions: () => ({ CanRead: true }),
+            GetUserRowLevelSecurityWhereClause: () => "(OwnerID = 'user-1')",
+        },
+    );
+    mockRunViewFn.mockResolvedValue(OK_RESULT);
+    mockRunViewsFn.mockResolvedValue([OK_RESULT]);
+});
+
+describe('ViewOperationsHandler — REST clause screen', () => {
+    it('RunView refuses a stacked statement hidden behind a bracket identifier, before RunView', async () => {
+        const outcome = await ViewOperationsHandler.runView({ EntityName: 'Customers', ExtraFilter: BRACKET_STACKED }, USER);
+
+        expect(mockRunViewFn).not.toHaveBeenCalled();
+        expect(outcome.success).toBe(false);
+        expect(outcome.error).toMatch(/Invalid ExtraFilter: multiple statements/);
+    });
+
+    it('RunView screens OrderBy and OverrideExcludeFilter too', async () => {
+        const cases: RunViewParams[] = [
+            { EntityName: 'Customers', OrderBy: "[a'] ; SELECT 1 AS [x] ; SELECT 1 AS [b']" },
+            { EntityName: 'Customers', OverrideExcludeFilter: BRACKET_STACKED },
+        ];
+        for (const params of cases) {
+            const outcome = await ViewOperationsHandler.runView(params, USER);
+            expect(outcome.success).toBe(false);
+        }
+        expect(mockRunViewFn).not.toHaveBeenCalled();
+    });
+
+    it('RunView refuses a subquery against a base table or an entity the caller cannot read', async () => {
+        for (const filter of [
+            `EXISTS (SELECT 1 FROM __mj.[User] WHERE [Type] = 'Owner')`,
+            `ID IN (SELECT CustomerID FROM sales.vwLedger)`,
+        ]) {
+            const outcome = await ViewOperationsHandler.runView({ EntityName: 'Customers', ExtraFilter: filter }, USER);
+            expect(outcome.success).toBe(false);
+        }
+        expect(mockRunViewFn).not.toHaveBeenCalled();
+    });
+
+    it('RunView refuses a subquery over an entity that is row-level-security filtered for the caller', async () => {
+        const outcome = await ViewOperationsHandler.runView({ EntityName: 'Customers', ExtraFilter: `ID IN (SELECT CustomerID FROM sales.vwOrders)` }, USER);
+
+        expect(mockRunViewFn).not.toHaveBeenCalled();
+        expect(outcome.success).toBe(false);
+        expect(outcome.error).toMatch(/'Orders' is row-level-security filtered for you/);
+    });
+
+    it('RunView screens every variant of a platform-specific filter', async () => {
+        const filter: PlatformSQL = { default: `Name = 'x'`, sqlserver: BRACKET_STACKED };
+
+        const outcome = await ViewOperationsHandler.runView({ EntityName: 'Customers', ExtraFilter: filter }, USER);
+
+        expect(mockRunViewFn).not.toHaveBeenCalled();
+        expect(outcome.success).toBe(false);
+    });
+
+    it('RunViews refuses the whole batch when one entry carries a payload', async () => {
+        const outcome = await ViewOperationsHandler.runViews(
+            [{ EntityName: 'Customers' }, { EntityName: 'Customers', ExtraFilter: BRACKET_STACKED }],
+            USER,
+        );
+
+        expect(mockRunViewsFn).not.toHaveBeenCalled();
+        expect(outcome.success).toBe(false);
+    });
+
+    it('ListEntities refuses a payload in the query-string filter', async () => {
+        await expect(
+            ViewOperationsHandler.listEntities({ EntityName: 'Customers', ExtraFilter: BRACKET_STACKED }, USER),
+        ).rejects.toThrow(/multiple statements/);
+        expect(mockRunViewFn).not.toHaveBeenCalled();
+    });
+
+    it('refuses a ViewEntity that was not loaded as an entity (its ID would be spliced into SQL)', async () => {
+        const forged = { ID: '0) ; SELECT 1 AS [x] ; SELECT 1 WHERE (1=1', EntityID: 'any' } as unknown as BaseEntity;
+
+        const outcome = await ViewOperationsHandler.runView({ EntityName: 'Customers', ViewEntity: forged, ExcludeDataFromAllPriorViewRuns: true }, USER);
+
+        expect(mockRunViewFn).not.toHaveBeenCalled();
+        expect(outcome.success).toBe(false);
+        expect(outcome.error).toMatch(/ViewEntity is not accepted over REST/);
+    });
+
+    it('passes a filter that only reads entity base views through to RunView', async () => {
+        const filter = `Name = 'O''Brien' AND ID IN (SELECT ID FROM sales.vwCustomers WHERE Region = 'West')`;
+
+        const outcome = await ViewOperationsHandler.runView({ EntityName: 'Customers', ExtraFilter: filter, OrderBy: '[Name] DESC' }, USER);
+
+        expect(outcome.success).toBe(true);
+        expect((mockRunViewFn.mock.calls[0][0] as RunViewParams).ExtraFilter).toBe(filter);
+    });
+});