@memberjunction/server 5.51.3 → 5.51.4

package/src/__tests__/ResolverBase.balancedClause.test.ts

@@ -0,0 +1,155 @@
+// ResolverBase transitively pulls in type-graphql decorators, which need the
+// Reflect.metadata polyfill at import time.
+import 'reflect-metadata';
+import { describe, it, expect } from 'vitest';
+import type { DatabaseProviderBase, IMetadataProvider, RunViewParams, RunViewResult, UserInfo } from '@memberjunction/core';
+import type { PubSubEngine } from 'type-graphql';
+import { ResolverBase } from '../generic/ResolverBase.js';
+import type { RunDynamicViewInput } from '../generic/RunViewResolver.js';
+import type { UserPayload } from '../types.js';
+
+/**
+ * The provider splices a client ExtraFilter as `(<ExtraFilter>) AND (<row-level security>)` and the
+ * tenant hook as `(<ExtraFilter>) AND (<tenant>)`. A fragment that closes a parenthesis it did not
+ * open, such as `1=1) OR (1=1`, turns that into `(1=1) OR (1=1) AND (<rls>)`. AND binds tighter than
+ * OR, so the server filter then narrows only one side of an OR the caller controls.
+ *
+ * The boundary screen parsed each fragment inside the parentheses it adds itself, which hides exactly
+ * that imbalance. These tests pin that the screen requires every fragment to be balanced on its own.
+ */
+
+const ENTITY_NAME = 'MJ: Conversations';
+
+/** Captures what the resolver asked `RunView` for. */
+type Captured = { params: RunViewParams | null };
+
+function fakeProvider(captured: Captured): DatabaseProviderBase {
+    return {
+        Entities: [
+            {
+                ID: 'E1',
+                Name: ENTITY_NAME,
+                SchemaName: '__mj',
+                BaseView: 'vwConversations',
+                BaseTable: 'Conversation',
+                Fields: [{ Name: 'Name', NeedsQuotes: true }],
+                GetUserPermisions: () => ({ CanRead: true }),
+            },
+        ],
+        RunView: async (params: RunViewParams): Promise<RunViewResult> => {
+            captured.params = params;
+            return { Success: true, Results: [], RowCount: 0, TotalRowCount: 0, ErrorMessage: '' } as RunViewResult;
+        },
+    } as unknown as DatabaseProviderBase;
+}
+
+const fakeUser = () => ({ Email: 'tester@example.com' } as UserInfo);
+const fakePayload = () => ({ email: 'tester@example.com', userRecord: fakeUser() } as UserPayload);
+
+/** Reaches the protected boundary screen and the dynamic-view entry point. */
+class Probe extends ResolverBase {
+    public ScreenClause(clause: string, label: string, provider: DatabaseProviderBase): void {
+        this.assertClientClauseUsesEntityBaseViews(clause, label, provider as unknown as IMetadataProvider);
+    }
+
+    public RunDynamic(input: RunDynamicViewInput, provider: DatabaseProviderBase) {
+        return this.RunDynamicViewGeneric(input, provider, fakePayload(), undefined as unknown as PubSubEngine);
+    }
+}
+
+describe('ResolverBase boundary screen — a client filter must be one balanced expression', () => {
+    const provider = () => fakeProvider({ params: null });
+
+    // Each of these closes the parentheses the provider wraps the fragment in. All of them parse
+    // once the screen adds its own `(` … `)`, which is why the screen must check them standalone.
+    const escapes = [
+        '1=1) OR (1=1',
+        "Name = 'a') OR (Name = 'b'",
+        "[Name] = 'a') OR ([Name] = 'b'",
+        '(1=1)) OR ((1=1)',
+    ];
+
+    it.each(escapes)('rejects the ExtraFilter %j', (clause) => {
+        expect(() => new Probe().ScreenClause(clause, 'ExtraFilter', provider())).toThrow(/parenthesis/);
+    });
+
+    it.each(escapes)('rejects the OverrideExcludeFilter %j', (clause) => {
+        expect(() => new Probe().ScreenClause(clause, 'OverrideExcludeFilter', provider())).toThrow(/parenthesis/);
+    });
+
+    it('rejects a fragment that leaves a parenthesis open', () => {
+        expect(() => new Probe().ScreenClause('(1=1', 'ExtraFilter', provider())).toThrow();
+    });
+
+    it('allows a balanced filter, including parentheses inside string literals', () => {
+        const p = new Probe();
+        const md = provider();
+        expect(() => p.ScreenClause("(Name = 'a' OR Name = 'b') AND (Name <> 'c')", 'ExtraFilter', md)).not.toThrow();
+        expect(() => p.ScreenClause("Name = 'a) OR (b'", 'ExtraFilter', md)).not.toThrow();
+        expect(() => p.ScreenClause("Name LIKE '%(%'", 'OverrideExcludeFilter', md)).not.toThrow();
+    });
+
+    it('RunDynamicViewGeneric never reaches RunView with an ExtraFilter that closes the wrapper', async () => {
+        const captured: Captured = { params: null };
+        const input = { EntityName: ENTITY_NAME, ExtraFilter: '1=1) OR (1=1' } as RunDynamicViewInput;
+
+        await expect(new Probe().RunDynamic(input, fakeProvider(captured))).rejects.toThrow(/parenthesis/);
+        expect(captured.params).toBeNull();
+    });
+
+    it('RunDynamicViewGeneric passes a balanced ExtraFilter through unchanged', async () => {
+        const captured: Captured = { params: null };
+        const input = { EntityName: ENTITY_NAME, ExtraFilter: "Name = 'a' OR Name = 'b'" } as RunDynamicViewInput;
+
+        await new Probe().RunDynamic(input, fakeProvider(captured));
+
+        expect(captured.params?.ExtraFilter).toBe("Name = 'a' OR Name = 'b'");
+    });
+
+    it('rejects a comment', () => {
+        expect(() => new Probe().ScreenClause("Name = 'a' -- note\n", 'ExtraFilter', provider())).toThrow(/comment/);
+        expect(() => new Probe().ScreenClause("Name = 'a' /* note */", 'OrderBy', provider())).toThrow(/comment/);
+    });
+});
+
+describe('ResolverBase boundary screen — backslashes inside quotes', () => {
+    // The screen's parser reads a backslash before a quote inside a plain literal as an escaped
+    // quote; SQL Server and PostgreSQL read the quote as the end of the literal. Text after it can
+    // then be code the engine runs while the parser saw a string, so it escapes the screen's checks.
+    const provider = () => fakeProvider({ params: null });
+
+    it('rejects a filter whose hidden part the parser reads as a string constant', () => {
+        const hidesSelect = "Name = 'a\\' AND 1 = (SELECT 1) AND Name = ' + [b' + [c]";
+        expect(() => new Probe().ScreenClause(hidesSelect, 'ExtraFilter', provider())).toThrow(/backslash/);
+        expect(() => new Probe().ScreenClause(hidesSelect, 'OverrideExcludeFilter', provider())).toThrow(/backslash/);
+    });
+
+    it.each(["Path = 'C:\\temp'", '[a\\b] = 1', '"a\\b" = 1'])('rejects a backslash inside a quoted string or identifier (%#)', (clause) => {
+        expect(() => new Probe().ScreenClause(clause, 'ExtraFilter', provider())).toThrow(/backslash/);
+    });
+
+    it('allows a filter with no backslash inside quotes', () => {
+        expect(() => new Probe().ScreenClause("Path LIKE 'C:/temp%'", 'ExtraFilter', provider())).not.toThrow();
+    });
+});
+
+/** Named so the screen reads clauses with the PostgreSQL dialect, as it does for the real provider. */
+class PostgreSQLDataProviderFake {
+    public Entities = [];
+}
+
+describe('ResolverBase boundary screen — PostgreSQL', () => {
+    const pgProvider = () => new PostgreSQLDataProviderFake() as unknown as DatabaseProviderBase;
+
+    it.each([
+        ['Name = $$x$$', /dollar/],
+        ['Café = 1', /outside ASCII/],
+        ["Name = E'x'\n'y'", /escape string/],
+    ])('rejects what the lexer cannot read the way PostgreSQL does (%#)', (clause, reason) => {
+        expect(() => new Probe().ScreenClause(clause, 'ExtraFilter', pgProvider())).toThrow(reason);
+    });
+
+    it('allows text outside ASCII inside a string literal', () => {
+        expect(() => new Probe().ScreenClause("Name = 'Café'", 'ExtraFilter', pgProvider())).not.toThrow();
+    });
+});

package/src/__tests__/ResolverBase.clauseUnscopedRead.test.ts

@@ -0,0 +1,116 @@
+// ResolverBase pulls in type-graphql decorators, which need the Reflect.metadata polyfill first.
+import 'reflect-metadata';
+import { describe, it, expect } from 'vitest';
+import type { DatabaseProviderBase, RunViewParams, RunViewResult, UserInfo } from '@memberjunction/core';
+import type { PubSubEngine } from 'type-graphql';
+import { ResolverBase } from '../generic/ResolverBase.js';
+import type { RunDynamicViewInput } from '../generic/RunViewResolver.js';
+import type { UserPayload } from '../types.js';
+
+/**
+ * `RunDynamicView` is the GraphQL entry point for a client RunView over one entity. A subquery in
+ * its ExtraFilter reads an entity's base view directly, so RunView applies neither that entity's
+ * row-level security nor its denied-field projection to the subquery. These tests pin that the
+ * boundary screen refuses such a subquery when the caller's read of that entity is narrowed (the
+ * rule the ad-hoc SQL screen applies) and still passes it when the read is not. Inputs are harmless.
+ */
+
+/** How the caller's read of an entity is narrowed: a row filter, or none (lts/5 has no field-level security). */
+interface ReadScope {
+    RowFilter?: string;
+}
+
+/** What the resolver handed to RunView; null when the request never got there. */
+type Captured = { params: RunViewParams | null };
+
+const USER = { ID: 'U1', Email: 'reader@example.com' } as UserInfo;
+const OWN_ROWS = "(OwnerID = 'U1')";
+const ORDERS_SUBQUERY = `ID IN (SELECT AccountID FROM [crm].[vwOrders] WHERE [Total] > 100)`;
+
+/** Provider double: two entities the caller can read, each under `scopes[Name]`, and a RunView that records its params. */
+function fakeProvider(captured: Captured, scopes: Record<string, ReadScope> = {}): DatabaseProviderBase {
+    const entity = (id: string, name: string, baseView: string) => ({
+        ID: id,
+        Name: name,
+        SchemaName: 'crm',
+        BaseView: baseView,
+        GetUserPermisions: () => ({ CanRead: true }),
+        GetUserRowLevelSecurityWhereClause: () => scopes[name]?.RowFilter ?? '',
+    });
+    return {
+        Entities: [entity('E1', 'Accounts', 'vwAccounts'), entity('E2', 'Orders', 'vwOrders')],
+        RunView: async (params: RunViewParams): Promise<RunViewResult> => {
+            captured.params = params;
+            return { Success: true, Results: [], RowCount: 0, TotalRowCount: 0, ErrorMessage: '' } as unknown as RunViewResult;
+        },
+    } as unknown as DatabaseProviderBase;
+}
+
+/** Runs `RunDynamicViewGeneric` over Accounts as USER. */
+class Probe extends ResolverBase {
+    public RunDynamic(input: Partial<RunDynamicViewInput>, provider: DatabaseProviderBase) {
+        const payload = { email: USER.Email, userRecord: USER } as UserPayload;
+        const view = { EntityName: 'Accounts', ...input } as RunDynamicViewInput;
+        return this.RunDynamicViewGeneric(view, provider, payload, undefined as unknown as PubSubEngine);
+    }
+}
+
+describe('RunDynamicViewGeneric — a client subquery reads an entity only when the caller may read it unscoped', () => {
+    it('refuses a subquery over an entity that is row-level-security filtered for the caller, before RunView', async () => {
+        const captured: Captured = { params: null };
+
+        await expect(
+            new Probe().RunDynamic({ ExtraFilter: ORDERS_SUBQUERY }, fakeProvider(captured, { Orders: { RowFilter: OWN_ROWS } })),
+        ).rejects.toThrow(/'Orders' is row-level-security filtered for you/);
+        expect(captured.params).toBeNull();
+    });
+
+    it('passes the same subquery through when the caller reads that entity unscoped', async () => {
+        const captured: Captured = { params: null };
+
+        await new Probe().RunDynamic({ ExtraFilter: ORDERS_SUBQUERY }, fakeProvider(captured));
+
+        expect(captured.params?.ExtraFilter).toBe(ORDERS_SUBQUERY);
+    });
+
+    it("refuses a subquery over the queried entity's own base view when the caller's read of it is row-filtered", async () => {
+        const captured: Captured = { params: null };
+        const ownView = `ID IN (SELECT ID FROM [crm].[vwAccounts] WHERE [Name] LIKE 'A%')`;
+
+        await expect(
+            new Probe().RunDynamic({ ExtraFilter: ownView }, fakeProvider(captured, { Accounts: { RowFilter: OWN_ROWS } })),
+        ).rejects.toThrow(/'Accounts' is row-level-security filtered for you/);
+        expect(captured.params).toBeNull();
+    });
+
+    it('refuses a CASE-WHEN subquery over a row-filtered entity, before RunView', async () => {
+        const captured: Captured = { params: null };
+        const caseWhen = `CASE WHEN (SELECT COUNT(*) FROM [crm].[vwOrders] WHERE [Total] > 100) > 0 THEN 1 ELSE 0 END = 1`;
+
+        await expect(
+            new Probe().RunDynamic({ ExtraFilter: caseWhen }, fakeProvider(captured, { Orders: { RowFilter: OWN_ROWS } })),
+        ).rejects.toThrow(/'Orders' is row-level-security filtered for you/);
+        expect(captured.params).toBeNull();
+    });
+
+    it("refuses a subquery over a row-filtered entity in a window's ORDER BY, before RunView", async () => {
+        const captured: Captured = { params: null };
+        const window = `ID IN (SELECT ID FROM (SELECT ID, ROW_NUMBER() OVER (ORDER BY (SELECT COUNT(*) FROM [crm].[vwOrders])) AS rn FROM [crm].[vwAccounts]) x)`;
+
+        await expect(
+            new Probe().RunDynamic({ ExtraFilter: window }, fakeProvider(captured, { Orders: { RowFilter: OWN_ROWS } })),
+        ).rejects.toThrow(/'Orders' is row-level-security filtered for you/);
+        expect(captured.params).toBeNull();
+    });
+
+    it('still passes an ordinary filter and sort on an entity the caller reads under a row filter', async () => {
+        const captured: Captured = { params: null };
+
+        await new Probe().RunDynamic(
+            { ExtraFilter: `[Name] = 'Acme'`, OrderBy: '[Name] DESC' },
+            fakeProvider(captured, { Accounts: { RowFilter: OWN_ROWS } }),
+        );
+
+        expect(captured.params?.ExtraFilter).toBe(`[Name] = 'Acme'`);
+    });
+});

package/src/__tests__/ResolverBase.filterEscaping.test.ts

@@ -0,0 +1,351 @@
+// ResolverBase transitively pulls in type-graphql decorators, which need the
+// Reflect.metadata polyfill at import time.
+import 'reflect-metadata';
+import { describe, it, expect } from 'vitest';
+import type { DatabaseProviderBase, IMetadataProvider, RunViewParams, RunViewResult, UserInfo } from '@memberjunction/core';
+import { ResolverBase } from '../generic/ResolverBase.js';
+import type { UserPayload } from '../types.js';
+import type { RunDynamicViewInput, RunViewByNameInput } from '../generic/RunViewResolver.js';
+import type { PubSubEngine } from 'type-graphql';
+
+/**
+ * The GraphQL-boundary screen for client-supplied view clauses (ExtraFilter, OrderBy,
+ * OverrideExcludeFilter): a subquery may only read an entity base view, and only one the
+ * acting user can read. UserSearchString is free text and is not screened as a clause.
+ *
+ * Also pins #4037's escaping of `ResolverBase`'s own filter builders (`findBy` and the
+ * `RunViewByNameGeneric` name lookup), including the fail-closed rule on the unquoted
+ * (numeric/boolean) slot. The RunViews structured-error test on next covers a fix that is
+ * not on this line, so it is not here.
+ */
+
+const ENTITY_NAME = 'MJ: Users';
+
+/** Captures what the resolver asked `RunView` for. */
+type Captured = { params: RunViewParams | null };
+
+/**
+ * Minimal provider: the entity/field metadata `findBy` reads, plus a `RunView` that records
+ * its params. `Sequence` stands in for a numeric field (`NeedsQuotes` is false only for
+ * Number and Boolean TS types).
+ */
+function fakeProvider(captured: Captured, rows: Record<string, unknown>[] = [], unreadableEntities: string[] = []): DatabaseProviderBase {
+    const withPerms = (e: Record<string, unknown>) => ({
+        ...e,
+        // Real EntityInfo aggregates per-user permissions; the boundary screen consults CanRead,
+        // the row filter and the denied fields for every subquery target, so the mock answers
+        // them (an unscoped read).
+        GetUserPermisions: () => ({ CanRead: !unreadableEntities.includes(e.Name as string) }),
+        GetUserRowLevelSecurityWhereClause: () => '',
+    });
+    return {
+        Entities: [
+            {
+                ID: 'E1',
+                Name: ENTITY_NAME,
+                SchemaName: '__mj',
+                BaseView: 'vwUsers',
+                BaseTable: 'User',
+                Fields: [
+                    { Name: 'Email', NeedsQuotes: true },
+                    { Name: 'Name', NeedsQuotes: true },
+                    { Name: 'Sequence', NeedsQuotes: false },
+                    { Name: 'IsActive', NeedsQuotes: false },
+                ],
+            },
+            {
+                Name: 'MJ: User Views',
+                SchemaName: '__mj',
+                BaseView: 'vwUserViews',
+                Fields: [{ Name: 'Name', NeedsQuotes: true }],
+            },
+            {
+                Name: 'MJ_BizApps_Tasks: Task Assignments',
+                SchemaName: '__mj_BizAppsTasks',
+                BaseView: 'vwTaskAssignments',
+                BaseTable: 'TaskAssignment',
+                Fields: [{ Name: 'TaskID', NeedsQuotes: true }],
+            },
+            { Name: 'MJ_BizApps_Tasks: Tasks', SchemaName: '__mj_BizAppsTasks', BaseView: 'vwTasks', BaseTable: 'Task', Fields: [] },
+            { Name: 'Committees: Meetings', SchemaName: '__mj_BizAppsCommittees', BaseView: 'vwMeetings', BaseTable: 'Meeting', Fields: [] },
+            { Name: 'Committees: Motions', SchemaName: '__mj_BizAppsCommittees', BaseView: 'vwMotions', BaseTable: 'Motion', Fields: [] },
+            { Name: 'Committees: Memberships', SchemaName: '__mj_BizAppsCommittees', BaseView: 'vwMemberships', BaseTable: 'Membership', Fields: [] },
+            { Name: 'Committees: Terms', SchemaName: '__mj_BizAppsCommittees', BaseView: 'vwTerms', BaseTable: 'Term', Fields: [] },
+        ].map(withPerms),
+        RunView: async (params: RunViewParams): Promise<RunViewResult> => {
+            captured.params = params;
+            return { Success: true, Results: rows, RowCount: rows.length, TotalRowCount: rows.length, ErrorMessage: '' } as RunViewResult;
+        },
+    } as unknown as DatabaseProviderBase;
+}
+
+const fakeUser = () => ({ Email: 'tester@example.com' } as UserInfo);
+const fakePayload = () => ({ email: 'tester@example.com', userRecord: fakeUser() } as UserPayload);
+
+/** Reaches the protected `findBy` and the client-subquery screen. */
+class Probe extends ResolverBase {
+    public FindBy(provider: DatabaseProviderBase, entity: string, params: Record<string, unknown>) {
+        return this.findBy(provider, entity, params, fakeUser());
+    }
+
+    public ScreenClause(clause: string | undefined | null, label: string, provider: DatabaseProviderBase) {
+        return this.assertClientClauseUsesEntityBaseViews(clause, label, provider as unknown as IMetadataProvider);
+    }
+
+    public RunDynamic(input: RunDynamicViewInput, provider: DatabaseProviderBase) {
+        return this.RunDynamicViewGeneric(input, provider, fakePayload(), undefined as unknown as PubSubEngine);
+    }
+
+    /** The whole boundary screen, as the RunView* entry points call it. */
+    public ScreenAll(
+        clauses: { extraFilter?: string | null; orderBy?: string | null; userSearchString?: string | null; overrideExcludeFilter?: string | null },
+        provider: DatabaseProviderBase,
+    ) {
+        return this.screenClientViewClauses(clauses, provider as unknown as IMetadataProvider);
+    }
+}
+
+describe('ResolverBase.findBy — ExtraFilter escaping', () => {
+    it('doubles a single quote in a quoted value', async () => {
+        const captured: Captured = { params: null };
+        await new Probe().FindBy(fakeProvider(captured), ENTITY_NAME, { Email: "o'brien@example.com" });
+
+        expect(captured.params?.ExtraFilter).toBe("Email = 'o''brien@example.com'");
+    });
+
+    it('renders a tautology attempt inert instead of terminating the literal', async () => {
+        const captured: Captured = { params: null };
+        // The payload closes the literal and appends its own predicate. Escaped, every quote
+        // it carries stays *inside* the literal, so the clause matches a (non-existent)
+        // address rather than every row.
+        await new Probe().FindBy(fakeProvider(captured), ENTITY_NAME, { Email: "x' OR '1'='1" });
+
+        expect(captured.params?.ExtraFilter).toBe("Email = 'x'' OR ''1''=''1'");
+        // Nothing outside the literal: exactly two unescaped quotes, the delimiters.
+        expect(captured.params?.ExtraFilter?.replace(/''/g, '')).toBe("Email = 'x OR 1=1'");
+    });
+
+    it('joins multiple params with AND, escaping each', async () => {
+        const captured: Captured = { params: null };
+        await new Probe().FindBy(fakeProvider(captured), ENTITY_NAME, { Email: "a'b", Name: "c'd" });
+
+        expect(captured.params?.ExtraFilter).toBe("Email = 'a''b' AND Name = 'c''d'");
+    });
+
+    it('leaves a genuinely numeric value unquoted', async () => {
+        const captured: Captured = { params: null };
+        await new Probe().FindBy(fakeProvider(captured), ENTITY_NAME, { Sequence: 42 });
+
+        expect(captured.params?.ExtraFilter).toBe('Sequence = 42');
+    });
+
+    it('rejects a string aimed at an unquoted (numeric) field rather than emitting it as SQL', async () => {
+        const captured: Captured = { params: null };
+        // There is no quote to escape in an unquoted slot — the value lands in the clause as
+        // SQL. The only safe handling is to refuse it.
+        await expect(
+            new Probe().FindBy(fakeProvider(captured), ENTITY_NAME, { Sequence: '1 OR 1=1' })
+        ).rejects.toThrow(/Sequence/);
+
+        expect(captured.params).toBeNull(); // never reached RunView
+    });
+
+    it('rejects a non-finite number in an unquoted field', async () => {
+        const captured: Captured = { params: null };
+        await expect(
+            new Probe().FindBy(fakeProvider(captured), ENTITY_NAME, { Sequence: Number.NaN })
+        ).rejects.toThrow(/Sequence/);
+    });
+
+    it('still rejects an unknown field name', async () => {
+        // Pre-existing behavior, pinned so the escaping rework cannot quietly drop it.
+        await expect(
+            new Probe().FindBy(fakeProvider({ params: null }), ENTITY_NAME, { NotAField: 'x' })
+        ).rejects.toThrow(/NotAField/);
+    });
+});
+
+describe('ResolverBase — GraphQL-boundary ExtraFilter AST screen', () => {
+    // Keyword SELECT/EXISTS ban (#4253) broke first-party IN (SELECT … FROM base view).
+    // The replacement parses the fragment and allows only entity BaseViews.
+
+    const provider = () => fakeProvider({ params: null });
+
+    it('rejects an EXISTS subquery against a base table', () => {
+        expect(() =>
+            new Probe().ScreenClause(`EXISTS (SELECT 1 FROM __mj.[User] WHERE Type='Owner')`, 'ExtraFilter', provider())
+        ).toThrow(/entity base view/);
+    });
+
+    it('rejects a scalar SELECT subquery against a non-view', () => {
+        expect(() =>
+            new Probe().ScreenClause('(SELECT COUNT(*) FROM __mj.APIKey)', 'OrderBy', provider())
+        ).toThrow(/entity base view/);
+    });
+
+    it('allows IN (SELECT …) against an entity BaseView', () => {
+        expect(() =>
+            new Probe().ScreenClause(
+                `ID IN (SELECT TaskID FROM [__mj_BizAppsTasks].[vwTaskAssignments] WHERE AssigneeRecordID = 'x')`,
+                'ExtraFilter',
+                provider(),
+            )
+        ).not.toThrow();
+    });
+
+    it('allows the restored Committees ExtraFilter shapes (Command Center, workspace, tracker)', () => {
+        const p = new Probe();
+        const md = provider();
+        const clauses = [
+            `TaskID IN (SELECT ID FROM [__mj_BizAppsTasks].[vwTasks] WHERE Status IN ('Open', 'InProgress'))`,
+            `ID IN (SELECT TaskID FROM [__mj_BizAppsTasks].[vwTaskAssignments] WHERE AssigneeRecordID = 'x')`,
+            `MeetingID IN (SELECT ID FROM [__mj_BizAppsCommittees].[vwMeetings] WHERE CommitteeID='x')`,
+            `MotionID IN (SELECT ID FROM [__mj_BizAppsCommittees].[vwMotions] WHERE MeetingID = 'x')`,
+            `ID IN (SELECT m.PersonID FROM [__mj_BizAppsCommittees].[vwMemberships] m JOIN [__mj_BizAppsCommittees].[vwTerms] t ON m.TermID = t.ID WHERE t.CommitteeID = 'x' AND m.Status = 'Active')`,
+        ];
+        for (const c of clauses) {
+            expect(() => p.ScreenClause(c, 'ExtraFilter', md)).not.toThrow();
+        }
+    });
+
+    it('allows an ordinary comparison filter', () => {
+        expect(() =>
+            new Probe().ScreenClause(`Email = 'a@b.com' AND IsActive = 1`, 'ExtraFilter', provider())
+        ).not.toThrow();
+    });
+
+    it('does not false-positive on SELECT/EXISTS inside string literals', () => {
+        expect(() =>
+            new Probe().ScreenClause(`Name LIKE '%select%' OR Name = 'exists'`, 'ExtraFilter', provider())
+        ).not.toThrow();
+    });
+
+    it('allows empty/undefined clauses', () => {
+        expect(() => new Probe().ScreenClause('', 'ExtraFilter', provider())).not.toThrow();
+        expect(() => new Probe().ScreenClause(undefined, 'OrderBy', provider())).not.toThrow();
+    });
+
+    it('RunDynamicViewGeneric never reaches RunView when ExtraFilter hits a base table', async () => {
+        const captured: Captured = { params: null };
+        const input = {
+            EntityName: ENTITY_NAME,
+            ExtraFilter: `EXISTS (SELECT 1 FROM __mj.[User] WHERE Type='Owner')`,
+        } as RunDynamicViewInput;
+
+        await expect(new Probe().RunDynamic(input, fakeProvider(captured))).rejects.toThrow(
+            /entity base view/
+        );
+        expect(captured.params).toBeNull();
+    });
+
+    it('RunDynamicViewGeneric passes a BaseView subquery through to RunView', async () => {
+        const captured: Captured = { params: null };
+        const input = {
+            EntityName: ENTITY_NAME,
+            ExtraFilter: `ID IN (SELECT ID FROM [__mj].[vwUsers] WHERE Email = 'a@b.com')`,
+        } as RunDynamicViewInput;
+
+        await new Probe().RunDynamic(input, fakeProvider(captured));
+
+        expect(captured.params?.ExtraFilter).toBe(`ID IN (SELECT ID FROM [__mj].[vwUsers] WHERE Email = 'a@b.com')`);
+    });
+
+    it('RunDynamicViewGeneric rejects a subquery into an entity the caller cannot read', async () => {
+        const captured: Captured = { params: null };
+        const input = {
+            EntityName: ENTITY_NAME,
+            ExtraFilter: `ID IN (SELECT TaskID FROM [__mj_BizAppsTasks].[vwTaskAssignments])`,
+        } as RunDynamicViewInput;
+
+        await expect(
+            new Probe().RunDynamic(input, fakeProvider(captured, [], ['MJ_BizApps_Tasks: Task Assignments']))
+        ).rejects.toThrow(/read permission/);
+        expect(captured.params).toBeNull();
+    });
+
+    it('RunDynamicViewGeneric passes a benign ExtraFilter through to RunView', async () => {
+        const captured: Captured = { params: null };
+        const input = {
+            EntityName: ENTITY_NAME,
+            ExtraFilter: `Email = 'a@b.com'`,
+        } as RunDynamicViewInput;
+
+        await new Probe().RunDynamic(input, fakeProvider(captured));
+
+        expect(captured.params?.ExtraFilter).toBe(`Email = 'a@b.com'`);
+    });
+});
+
+describe('ResolverBase.screenClientViewClauses — UserSearchString is free text, not a clause (#4392)', () => {
+    // The base-view AST screen wraps its argument as `SELECT 1 FROM x WHERE (<clause>)` and fails
+    // closed when that does not parse. Applied to UserSearchString it rejected everything that
+    // wasn't coincidentally valid SQL — which is most of what people type into a search box.
+    // UserSearchString never reaches SQL as a fragment: createViewUserSearchSQL builds the
+    // predicate and lands the text as an escaped literal, so the screen has nothing to screen.
+
+    const provider = () => fakeProvider({ params: null });
+
+    const searchTerms = [
+        'Marcus Chen',            // a space — parses as nothing
+        "O'Leary",                // unterminated literal
+        "Marcus O'Leary Chen",    // both
+        'Smith, John',            // punctuation
+        '50% off',                // LIKE metacharacter
+        'a_b [c]',                // more LIKE metacharacters
+        'select',                 // a keyword as a term
+        'drop table users',       // keywords with spaces
+        'Union Pacific',          // a real company name
+        "x' OR '1'='1",           // an injection attempt — escaped as a literal downstream
+        '  spaced  out  ',
+        'café ☕',
+    ];
+
+    it.each(searchTerms)('lets %j through the boundary screen', (term) => {
+        expect(() => new Probe().ScreenAll({ userSearchString: term }, provider())).not.toThrow();
+    });
+
+    it('still screens the three real clause fragments alongside it', () => {
+        const p = new Probe();
+        const md = provider();
+
+        expect(() =>
+            p.ScreenAll({ userSearchString: 'Marcus Chen', extraFilter: `EXISTS (SELECT 1 FROM __mj.[User])` }, md)
+        ).toThrow(/entity base view/);
+
+        expect(() =>
+            p.ScreenAll({ userSearchString: 'Marcus Chen', orderBy: '(SELECT COUNT(*) FROM __mj.APIKey)' }, md)
+        ).toThrow(/entity base view/);
+
+        expect(() =>
+            p.ScreenAll({ userSearchString: 'Marcus Chen', overrideExcludeFilter: `EXISTS (SELECT 1 FROM __mj.[User])` }, md)
+        ).toThrow(/entity base view/);
+    });
+
+    it('RunDynamicViewGeneric carries a multi-word search term through to RunView', async () => {
+        const captured: Captured = { params: null };
+        const input = { EntityName: ENTITY_NAME, UserSearchString: "Marcus O'Leary" } as RunDynamicViewInput;
+
+        await new Probe().RunDynamic(input, fakeProvider(captured));
+
+        expect(captured.params?.UserSearchString).toBe("Marcus O'Leary");
+    });
+});
+
+describe('ResolverBase.RunViewByNameGeneric — view-name escaping', () => {
+    it('escapes the client-supplied view name', async () => {
+        const captured: Captured = { params: null };
+        const input = { ViewName: "My View' OR '1'='1" } as RunViewByNameInput;
+
+        // Empty Results short-circuits the method (returns null) once the lookup filter is built.
+        const result = await new Probe().RunViewByNameGeneric(
+            input,
+            fakeProvider(captured),
+            fakePayload(),
+            undefined as unknown as PubSubEngine // unused: the empty-result path returns before it is passed on
+        );
+
+        expect(result).toBeNull();
+        expect(captured.params?.EntityName).toBe('MJ: User Views');
+        expect(captured.params?.ExtraFilter).toBe("Name='My View'' OR ''1''=''1'");
+    });
+});