@memberjunction/server 5.51.3 → 5.51.4

package/src/__tests__/DatasetResolver.itemFilters.test.ts

@@ -0,0 +1,201 @@
+// The resolvers carry type-graphql decorators, which need the Reflect.metadata polyfill at import time.
+import 'reflect-metadata';
+import { describe, it, expect, vi } from 'vitest';
+import {
+    DatabaseProviderBase,
+    DatasetItemFilterType,
+    DatasetResultType,
+    DatasetStatusResultType,
+    EntityInfo,
+    UserInfo,
+} from '@memberjunction/core';
+import { ENCRYPTED_SENTINEL } from '@memberjunction/global';
+import { DatasetResolverExtended, DatasetStatusResolver } from '../resolvers/DatasetResolver.js';
+import type { AppContext, UserPayload } from '../types.js';
+
+// The encrypted-field policy configures the encryption engine before it inspects a value; there is
+// no key store in a unit test.
+vi.mock('@memberjunction/encryption', () => ({
+    EncryptionEngine: {
+        Instance: {
+            Config: async () => undefined,
+            GetKeyByID: () => ({ Marker: '$ENC$' }),
+            Encrypt: async (value: string) => `$ENC$${value}`,
+        },
+    },
+}));
+
+/**
+ * The GraphQL dataset queries are the network edge of security finding C6.
+ *
+ * `GetDatasetByName` / `GetDatasetStatusByName` took `ItemFilters[].Filter` from any authenticated
+ * principal and handed it to the provider unscreened, and passed no context user, so the provider
+ * could neither refuse an unreadable item nor apply row-level security. These tests pin that the
+ * resolvers screen every ItemFilter with the same AST screen as ExtraFilter before the provider is
+ * reached, pass the session user down, and apply the API encryption policy to the rows they return.
+ */
+
+const ROLE_ID = 'R0000000-0000-0000-0000-00000000000A';
+const OTHER_ROLE_ID = 'R0000000-0000-0000-0000-00000000000C';
+
+function entity(name: string, baseView: string, fields: Record<string, unknown>[] = []): EntityInfo {
+    const id = `E-${name}`;
+    return new EntityInfo({
+        ID: id, Name: name, SchemaName: '__mj', BaseTable: name, BaseView: baseView,
+        Permissions: [{ ID: `p-${name}`, EntityID: id, RoleID: ROLE_ID, CanRead: true, Type: 'Allow' }],
+        Fields: fields.map((f, i) => ({ ID: `${id}-f${i}`, EntityID: id, Entity: name, Sequence: i + 1, Type: 'nvarchar', ...f })),
+    });
+}
+
+const THINGS = entity('Things', 'vwThings', [{ Name: 'ID', IsPrimaryKey: true }, { Name: 'Name' }]);
+const SECRETS = entity('Secrets', 'vwSecrets', [
+    { Name: 'ID', IsPrimaryKey: true },
+    { Name: 'Token', Encrypt: true, EncryptionKeyID: 'K1', AllowDecryptInAPI: false, SendEncryptedValue: false },
+]);
+
+const USER = new UserInfo(undefined, {
+    ID: 'U1', Name: 'Reader', Email: 'reader@example.com', IsActive: true,
+    UserRoles: [{ UserID: 'U1', RoleID: ROLE_ID, Role: 'Reader' }],
+});
+
+type ProviderCall = {
+    Method: 'GetDatasetByName' | 'GetDatasetStatusByName';
+    DatasetName: string;
+    ItemFilters: DatasetItemFilterType[] | undefined;
+    ContextUser: UserInfo | undefined;
+};
+
+/** A provider double that records what reached it and answers with fixed rows. */
+function fakeProvider(itemEntity: EntityInfo = THINGS, rows: Record<string, unknown>[] = []) {
+    const calls: ProviderCall[] = [];
+    const provider = {
+        Entities: [THINGS, SECRETS],
+        EntityByName: (name: string) => [THINGS, SECRETS].find(e => e.Name.toLowerCase() === name?.trim().toLowerCase()),
+        GetDatasetByName: async (DatasetName: string, ItemFilters?: DatasetItemFilterType[], ContextUser?: UserInfo): Promise<DatasetResultType> => {
+            calls.push({ Method: 'GetDatasetByName', DatasetName, ItemFilters, ContextUser });
+            return {
+                DatasetID: 'DS1', DatasetName, Success: true, Status: '', LatestUpdateDate: new Date(0),
+                Results: [{ Code: itemEntity.Name, EntityName: itemEntity.Name, EntityID: itemEntity.ID, Results: rows, Success: true }],
+            };
+        },
+        GetDatasetStatusByName: async (DatasetName: string, ItemFilters?: DatasetItemFilterType[], ContextUser?: UserInfo): Promise<DatasetStatusResultType> => {
+            calls.push({ Method: 'GetDatasetStatusByName', DatasetName, ItemFilters, ContextUser });
+            return { DatasetID: 'DS1', DatasetName, Success: true, Status: '', LatestUpdateDate: new Date(0), EntityUpdateDates: [] };
+        },
+    };
+    return { provider: provider as unknown as DatabaseProviderBase, calls };
+}
+
+function context(provider: DatabaseProviderBase, userPayload: Partial<UserPayload> = { email: USER.Email, userRecord: USER }): AppContext {
+    return {
+        providers: [{ provider, type: 'Read-Write' }],
+        userPayload: { sessionId: 'S1', ...userPayload } as UserPayload,
+    } as AppContext;
+}
+
+const STACKED = [{ ItemCode: 'Things', Filter: '1=0; SELECT 1' }];
+// A quote inside a bracket identifier opens a fake literal for the string-literal stripper that
+// guards the provider denylist; the AST screen tokenizes brackets and still sees the second statement.
+const STACKED_BEHIND_BRACKET = [{ ItemCode: 'Things', Filter: "[a'] = 1; SELECT 1 --'" }];
+
+describe('GetDatasetByName', () => {
+    it('refuses a stacked-statement ItemFilter before the provider is reached', async () => {
+        const { provider, calls } = fakeProvider();
+
+        await expect(new DatasetResolverExtended().GetDatasetByName('MJ_Metadata', context(provider), STACKED))
+            .rejects.toThrow(/multiple statements are not permitted/);
+        expect(calls).toEqual([]);
+    });
+
+    it('refuses a stacked statement hidden behind a bracket identifier', async () => {
+        const { provider, calls } = fakeProvider();
+
+        await expect(new DatasetResolverExtended().GetDatasetByName('MJ_Metadata', context(provider), STACKED_BEHIND_BRACKET))
+            .rejects.toThrow(/multiple statements are not permitted/);
+        expect(calls).toEqual([]);
+    });
+
+    it('refuses an ItemFilter whose subquery reads a table that is not an entity base view', async () => {
+        const { provider, calls } = fakeProvider();
+        const filters = [{ ItemCode: 'Things', Filter: 'ID IN (SELECT ID FROM __mj.[User])' }];
+
+        await expect(new DatasetResolverExtended().GetDatasetByName('MJ_Metadata', context(provider), filters))
+            .rejects.toThrow(/entity base view/);
+        expect(calls).toEqual([]);
+    });
+
+    it('passes the session user to the provider, with the screened filters', async () => {
+        const { provider, calls } = fakeProvider();
+        const filters = [{ ItemCode: 'Things', Filter: "Name = 'x'" }];
+
+        const result = await new DatasetResolverExtended().GetDatasetByName('Things_Dataset', context(provider), filters);
+
+        expect(result.Success).toBe(true);
+        expect(calls).toHaveLength(1);
+        expect(calls[0].ContextUser).toBe(USER);
+        expect(calls[0].ItemFilters).toEqual(filters);
+    });
+
+    it('refuses a session that resolves to no user rather than reading as nobody', async () => {
+        const { provider, calls } = fakeProvider();
+
+        await expect(new DatasetResolverExtended().GetDatasetByName('Things_Dataset', context(provider, { email: '', userRecord: null })))
+            .rejects.toThrow(/no user/i);
+        expect(calls).toEqual([]);
+    });
+
+    it('masks an encrypted field the entity does not allow decrypted over the API, without touching the provider rows', async () => {
+        // A context user makes the provider decrypt; the API policy decides what leaves the server.
+        const providerRow = Object.freeze({ ID: 'S1', Token: 'plain-secret' });
+        const { provider } = fakeProvider(SECRETS, [providerRow]);
+
+        const result = await new DatasetResolverExtended().GetDatasetByName('Secrets_Dataset', context(provider));
+
+        const items = JSON.parse(result.Results) as DatasetResultType['Results'];
+        expect(items[0].Results[0].Token).toBe(ENCRYPTED_SENTINEL);
+        expect(result.Results).not.toContain('plain-secret');
+        expect(providerRow.Token).toBe('plain-secret');
+    });
+});
+
+describe('GetDatasetStatusByName', () => {
+    it('refuses a stacked-statement ItemFilter before the provider is reached', async () => {
+        const { provider, calls } = fakeProvider();
+
+        await expect(new DatasetStatusResolver().GetDatasetStatusByName('MJ_Metadata', context(provider), STACKED))
+            .rejects.toThrow(/multiple statements are not permitted/);
+        expect(calls).toEqual([]);
+    });
+
+    it('passes the session user to the provider', async () => {
+        const { provider, calls } = fakeProvider();
+
+        await new DatasetStatusResolver().GetDatasetStatusByName('Things_Dataset', context(provider), [{ ItemCode: 'Things', Filter: "Name = 'x'" }]);
+
+        expect(calls).toHaveLength(1);
+        expect(calls[0].ContextUser).toBe(USER);
+    });
+
+    it('refuses an ItemFilter that reads an entity the user has no read permission on', async () => {
+        const { provider, calls } = fakeProvider();
+        const outsider = new UserInfo(undefined, {
+            ID: 'U2', Name: 'Outsider', Email: 'outsider@example.com', IsActive: true,
+            UserRoles: [{ UserID: 'U2', RoleID: OTHER_ROLE_ID, Role: 'Other' }],
+        });
+        const filters = [{ ItemCode: 'Things', Filter: 'ID IN (SELECT ID FROM __mj.vwSecrets)' }];
+
+        await expect(new DatasetStatusResolver().GetDatasetStatusByName('Things_Dataset', context(provider, { email: outsider.Email, userRecord: outsider }), filters))
+            .rejects.toThrow(/read permission/);
+        expect(calls).toEqual([]);
+    });
+});
+
+describe('GetMultipleDatasetStatusByName', () => {
+    it('passes the session user to the provider for every dataset', async () => {
+        const { provider, calls } = fakeProvider();
+
+        await new DatasetStatusResolver().GetMultipleDatasetStatusByName(['A', 'B'], context(provider));
+
+        expect(calls.map(c => c.ContextUser)).toEqual([USER, USER]);
+    });
+});

package/src/__tests__/EntityRecordNameResolver.rowSecurity.test.ts

@@ -0,0 +1,152 @@
+// ResolverBase transitively pulls in type-graphql decorators, which need the
+// Reflect.metadata polyfill at import time.
+import 'reflect-metadata';
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { CompositeKey, DatabaseProviderBase, EntityInfo, EntityPermissionType, Metadata, RowLevelSecurityFilterInfo, UserInfo } from '@memberjunction/core';
+import type { DeleteSQLResult, IMetadataProvider, QueryExecutionSpec, RunQueryResult, SaveSQLResult } from '@memberjunction/core';
+import { EntityRecordNameResolver } from '../resolvers/EntityRecordNameResolver.js';
+import type { AppContext, UserPayload } from '../types.js';
+
+/**
+ * The record-name queries against a real provider whose database only records what it is sent.
+ * The lookup the resolver causes carries the acting user's read row filter, binds the key value,
+ * refuses a key that is not the entity's primary key, and never runs without an acting user.
+ */
+
+const CLIENTS_ID = 'E0000000-0000-0000-0000-0000000000C1';
+const ACCOUNT_MANAGER_ROLE_ID = 'B0000000-0000-0000-0000-0000000000C1';
+const OWN_CLIENTS_FILTER_ID = 'F0000000-0000-0000-0000-0000000000C1';
+const MANAGER_ID = 'C0000000-0000-0000-0000-0000000000C1';
+const CLIENT_ID_VALUE = '33333333-3333-3333-3333-333333333333';
+
+const ROW_FILTERS: RowLevelSecurityFilterInfo[] = [
+    new RowLevelSecurityFilterInfo({ ID: OWN_CLIENTS_FILTER_ID, Name: 'Own clients', FilterText: "AccountManagerID = '{{UserID}}'" }),
+];
+
+/** `Clients`: account managers read only the clients they manage. */
+function clientsEntity(): EntityInfo {
+    return new EntityInfo({
+        ID: CLIENTS_ID, Name: 'Clients', SchemaName: 'dbo', BaseTable: 'Client', BaseView: 'vwClients',
+        Permissions: [
+            { ID: 'perm-manager', EntityID: CLIENTS_ID, RoleID: ACCOUNT_MANAGER_ROLE_ID, CanRead: true, ReadRLSFilterID: OWN_CLIENTS_FILTER_ID, Type: 'Allow' },
+        ],
+        Fields: [
+            { ID: 'cl-id', EntityID: CLIENTS_ID, Sequence: 1, Name: 'ID', Type: 'uniqueidentifier', IsPrimaryKey: true, NeedsQuotes: true },
+            { ID: 'cl-name', EntityID: CLIENTS_ID, Sequence: 2, Name: 'Name', Type: 'nvarchar', IsNameField: true, NeedsQuotes: true },
+            { ID: 'cl-tier', EntityID: CLIENTS_ID, Sequence: 3, Name: 'Tier', Type: 'int', NeedsQuotes: false },
+            { ID: 'cl-manager', EntityID: CLIENTS_ID, Sequence: 4, Name: 'AccountManagerID', Type: 'uniqueidentifier', NeedsQuotes: true },
+        ],
+    });
+}
+
+interface SentQuery {
+    SQL: string;
+    Parameters: unknown[] | undefined;
+}
+
+/** A SQL Server-shaped provider over `Clients`, whose database answers every query with one row. */
+class RecordingProvider extends DatabaseProviderBase {
+    public Sent: SentQuery[] = [];
+    private readonly entities = [clientsEntity()];
+
+    public override get Entities(): EntityInfo[] {
+        return this.entities;
+    }
+
+    public override get RowLevelSecurityFilters(): RowLevelSecurityFilterInfo[] {
+        return ROW_FILTERS;
+    }
+
+    async ExecuteSQL<T>(sql: string, parameters?: unknown[]): Promise<Array<T>> {
+        this.Sent.push({ SQL: sql, Parameters: parameters });
+        return [{ Name: 'Acme Manufacturing' }] as T[];
+    }
+
+    public override BuildParameterPlaceholder(index: number): string { return `@p${index}`; }
+    protected get UUIDFunctionPattern(): RegExp { return /^newid\(\)$/i; }
+    protected get DBDefaultFunctionPattern(): RegExp { return /^getdate\(\)$/i; }
+    public QuoteIdentifier(name: string): string { return `[${name}]`; }
+    public QuoteSchemaAndView(schema: string, obj: string): string { return `[${schema}].[${obj}]`; }
+    protected BuildChildDiscoverySQL(): string { return ''; }
+    protected BuildHardLinkDependencySQL(): string { return ''; }
+    protected BuildSoftLinkDependencySQL(): string { return ''; }
+    protected async GenerateSaveSQL(): Promise<SaveSQLResult> { return { fullSQL: '' }; }
+    protected GenerateDeleteSQL(): DeleteSQLResult { return { fullSQL: '' }; }
+    protected BuildRecordChangeSQL(): { sql: string; parameters?: unknown[] } | null { return null; }
+    protected BuildSiblingRecordChangeSQL(): string { return ''; }
+    async BeginTransaction(): Promise<void> {}
+    async CommitTransaction(): Promise<void> {}
+    async RollbackTransaction(): Promise<void> {}
+    protected async InternalExecuteQueryFromSpec(_spec: QueryExecutionSpec): Promise<RunQueryResult> {
+        throw new Error('Not supported.');
+    }
+}
+
+const MANAGER = new UserInfo(null, {
+    ID: MANAGER_ID, Name: 'Morgan', Email: 'morgan@example.com', IsActive: true,
+    UserRoles: [{ UserID: MANAGER_ID, RoleID: ACCOUNT_MANAGER_ROLE_ID, Role: 'Account Managers' }],
+});
+
+function key(fieldName: string, value: string): CompositeKey {
+    return new CompositeKey([{ FieldName: fieldName, Value: value }]);
+}
+
+describe('EntityRecordNameResolver lookups under row-level security', () => {
+    let provider: RecordingProvider;
+    let savedProvider: IMetadataProvider;
+    let context: AppContext;
+    const resolver = new EntityRecordNameResolver();
+
+    beforeEach(() => {
+        provider = new RecordingProvider();
+        // Row filters resolve through the global provider.
+        savedProvider = Metadata.Provider;
+        Metadata.Provider = provider;
+        const userPayload: UserPayload = { email: MANAGER.Email, userRecord: MANAGER, sessionId: 'session-1' };
+        context = { dataSource: undefined, dataSources: [], providers: [{ provider, type: 'Read-Only' }], userPayload };
+    });
+
+    afterEach(() => {
+        Metadata.Provider = savedProvider;
+    });
+
+    function managerRowFilter(): string {
+        return provider.EntityByName('Clients').GetUserRowLevelSecurityWhereClause(MANAGER, EntityPermissionType.Read, '');
+    }
+
+    it("looks the name up under the acting user's read row filter, with the key value bound", async () => {
+        const rowFilter = managerRowFilter();
+        expect(rowFilter).toContain(MANAGER_ID);
+
+        const result = await resolver.GetEntityRecordName('Clients', key('ID', CLIENT_ID_VALUE), context);
+
+        expect(result.Success).toBe(true);
+        expect(provider.Sent).toEqual([
+            { SQL: `SELECT [Name] FROM [dbo].[vwClients] WHERE [ID]=@p0 AND (${rowFilter})`, Parameters: [CLIENT_ID_VALUE] },
+        ]);
+    });
+
+    it('applies the row filter to each item of a batch', async () => {
+        const rowFilter = managerRowFilter();
+
+        const results = await resolver.GetEntityRecordNames([{ EntityName: 'Clients', CompositeKey: key('ID', CLIENT_ID_VALUE) }], context);
+
+        expect(results.map(r => r.Success)).toEqual([true]);
+        expect(provider.Sent.map(q => q.SQL)).toEqual([`SELECT [Name] FROM [dbo].[vwClients] WHERE [ID]=@p0 AND (${rowFilter})`]);
+    });
+
+    it('refuses a key field that is not a primary key, without querying', async () => {
+        const result = await resolver.GetEntityRecordName('Clients', key('Tier', '1'), context);
+
+        expect(result.Success).toBe(false);
+        expect(result.RecordName).toBeUndefined();
+        expect(provider.Sent).toHaveLength(0);
+    });
+
+    it('looks no name up when there is no acting user', async () => {
+        const result = await resolver.InnerGetEntityRecordName(provider, 'Clients', key('ID', CLIENT_ID_VALUE));
+
+        expect(result.Success).toBe(false);
+        expect(provider.Sent).toHaveLength(0);
+    });
+});