@memberjunction/server 5.51.3 → 5.51.4

package/src/__tests__/actionAuthorization.test.ts

@@ -0,0 +1,130 @@
+/**
+ * The policy that decides who may run an action through a public entry point. It reads the
+ * `MJ: Action Authorizations` rows for the action, the caller's roles, one provider's authorizations
+ * and role grants, and whether the action's class authorizes its caller itself. It fails closed: an
+ * action that no authorization grants, and whose class does not authorize its caller, runs for
+ * Owners only.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { AuthorizationInfo, AuthorizationRoleInfo, Metadata, UserInfo, UserRoleInfo } from '@memberjunction/core';
+import { EvaluateActionRunAuthorization, IsOwner, type AuthorizationMetadata } from '../auth/actionAuthorization.js';
+
+const ANALYST_ROLE = 'A11C0000-0000-4000-8000-0000000000F1';
+const AUDITOR_ROLE = 'A11C0000-0000-4000-8000-0000000000F2';
+const BLOCKED_ROLE = 'A11C0000-0000-4000-8000-0000000000F3';
+
+const DATA_TOOLS = new AuthorizationInfo({ ID: 'auth-data-tools', Name: 'Data Tools', IsActive: true });
+const RUN_QUERIES = new AuthorizationInfo({ ID: 'auth-run-queries', Name: 'Run Queries', IsActive: true, ParentID: DATA_TOOLS.ID });
+const RETIRED_TOOL = new AuthorizationInfo({ ID: 'auth-retired-tool', Name: 'Retired Tool', IsActive: false, ParentID: DATA_TOOLS.ID });
+const SWITCHED_OFF = new AuthorizationInfo({ ID: 'auth-switched-off', Name: 'Switched Off', IsActive: false });
+const AUTHORIZATIONS = [DATA_TOOLS, RUN_QUERIES, RETIRED_TOOL, SWITCHED_OFF];
+const AUTHORIZATION_ROLES = [
+    new AuthorizationRoleInfo({ ID: 'ar-1', AuthorizationID: RUN_QUERIES.ID, RoleID: ANALYST_ROLE, Type: 'Allow' }),
+    new AuthorizationRoleInfo({ ID: 'ar-2', AuthorizationID: DATA_TOOLS.ID, RoleID: AUDITOR_ROLE, Type: 'Allow' }),
+    new AuthorizationRoleInfo({ ID: 'ar-3', AuthorizationID: RUN_QUERIES.ID, RoleID: BLOCKED_ROLE, Type: 'Deny' }),
+    new AuthorizationRoleInfo({ ID: 'ar-4', AuthorizationID: SWITCHED_OFF.ID, RoleID: ANALYST_ROLE, Type: 'Allow' }),
+];
+/** The provider metadata the decision reads. */
+const METADATA: AuthorizationMetadata = { Authorizations: AUTHORIZATIONS, AuthorizationRoles: AUTHORIZATION_ROLES };
+
+const user = (type: string, roleIDs: string[]): UserInfo =>
+    new UserInfo(null, { ID: `user-${type}-${roleIDs.join('-')}`, Type: type, UserRoles: roleIDs.map((RoleID) => new UserRoleInfo({ RoleID })) });
+
+/** Decides for an action whose class does not authorize its caller. */
+const decide = (caller: UserInfo, linkedAuthorizationIDs: string[]) =>
+    EvaluateActionRunAuthorization(caller, linkedAuthorizationIDs, METADATA, false);
+
+beforeEach(() => {
+    vi.restoreAllMocks();
+    // The decision reads only the metadata it is given, so any read of the global provider fails the test.
+    vi.spyOn(Metadata, 'Provider', 'get').mockImplementation(() => {
+        throw new Error('The decision read the global metadata provider');
+    });
+});
+
+describe('IsOwner', () => {
+    it('recognises the Owner type, padded as the nchar column stores it', () => {
+        expect(IsOwner(user('Owner     ', []))).toBe(true);
+        expect(IsOwner(user('User', [ANALYST_ROLE]))).toBe(false);
+    });
+});
+
+describe('EvaluateActionRunAuthorization', () => {
+    describe('Owners', () => {
+        it('lets an Owner run any action, linked or not', () => {
+            expect(decide(user('Owner     ', []), []).Allowed).toBe(true);
+            expect(decide(user('Owner     ', []), [RUN_QUERIES.ID]).Allowed).toBe(true);
+        });
+    });
+
+    describe('an action with no Action Authorization rows', () => {
+        it('is refused to any other user when its class does not authorize its caller', () => {
+            const decision = decide(user('User', [ANALYST_ROLE]), []);
+
+            expect(decision.Allowed).toBe(false);
+            expect(decision.Reason).toMatch(/no action authorization/i);
+        });
+
+        it('runs for any user when its class authorizes its caller, so the action\'s own check decides', () => {
+            expect(EvaluateActionRunAuthorization(user('User', [ANALYST_ROLE]), [], METADATA, true).Allowed).toBe(true);
+        });
+    });
+
+    describe('an action with Action Authorization rows', () => {
+        it('is decided by its links, even when its class authorizes its caller', () => {
+            expect(EvaluateActionRunAuthorization(user('User', ['some-other-role']), [RUN_QUERIES.ID], METADATA, true).Allowed).toBe(false);
+        });
+
+        it('runs for a user whose role holds a linked authorization', () => {
+            expect(decide(user('User', [ANALYST_ROLE]), [RUN_QUERIES.ID]).Allowed).toBe(true);
+        });
+
+        it('runs for a user whose role holds an ancestor of a linked authorization', () => {
+            expect(decide(user('User', [AUDITOR_ROLE]), [RUN_QUERIES.ID]).Allowed).toBe(true);
+        });
+
+        it('is refused to a user whose roles hold none of the linked authorizations', () => {
+            expect(decide(user('User', ['some-other-role']), [RUN_QUERIES.ID]).Allowed).toBe(false);
+        });
+
+        it('is refused when the linked authorization is inactive', () => {
+            expect(decide(user('User', [ANALYST_ROLE]), [SWITCHED_OFF.ID]).Allowed).toBe(false);
+        });
+
+        it('is refused when the linked authorization is inactive, even to a holder of its parent', () => {
+            expect(decide(user('User', [AUDITOR_ROLE]), [RETIRED_TOOL.ID]).Allowed).toBe(false);
+        });
+
+        it('is refused when one of the user\'s roles is denied the linked authorization', () => {
+            expect(decide(user('User', [ANALYST_ROLE, BLOCKED_ROLE]), [RUN_QUERIES.ID]).Allowed).toBe(false);
+        });
+
+        it('is refused when a role is denied the linked authorization, even if another role holds its parent', () => {
+            expect(decide(user('User', [AUDITOR_ROLE, BLOCKED_ROLE]), [RUN_QUERIES.ID]).Allowed).toBe(false);
+        });
+
+        it('ignores a linked authorization that no longer exists in metadata', () => {
+            expect(decide(user('User', [ANALYST_ROLE]), ['auth-deleted']).Allowed).toBe(false);
+        });
+
+        it('matches authorization IDs regardless of case', () => {
+            expect(decide(user('User', [ANALYST_ROLE]), [RUN_QUERIES.ID.toUpperCase()]).Allowed).toBe(true);
+        });
+    });
+
+    describe('the metadata it reads', () => {
+        it('decides from the role grants it is given, never from the global provider', () => {
+            const sameTreeWithoutGrants: AuthorizationMetadata = { Authorizations: AUTHORIZATIONS, AuthorizationRoles: [] };
+
+            expect(decide(user('User', [ANALYST_ROLE]), [RUN_QUERIES.ID]).Allowed).toBe(true);
+            expect(EvaluateActionRunAuthorization(user('User', [ANALYST_ROLE]), [RUN_QUERIES.ID], sameTreeWithoutGrants, false).Allowed).toBe(false);
+        });
+
+        it('walks to the parent within the authorizations it is given', () => {
+            const treeWithoutParent: AuthorizationMetadata = { Authorizations: [RUN_QUERIES], AuthorizationRoles: AUTHORIZATION_ROLES };
+
+            expect(decide(user('User', [AUDITOR_ROLE]), [RUN_QUERIES.ID]).Allowed).toBe(true);
+            expect(EvaluateActionRunAuthorization(user('User', [AUDITOR_ROLE]), [RUN_QUERIES.ID], treeWithoutParent, false).Allowed).toBe(false);
+        });
+    });
+});

package/src/__tests__/adhocTimeoutClamp.test.ts

@@ -0,0 +1,26 @@
+/**
+ * An ad-hoc query's timeout never exceeds the server's requestTimeout, so a caller cannot hold a
+ * read-only connection longer than any other request may.
+ */
+import { describe, it, expect } from 'vitest';
+import { ClampAdhocTimeoutSeconds } from '../resolvers/adhocTimeout';
+
+describe('ClampAdhocTimeoutSeconds', () => {
+    it('caps a longer request at requestTimeout', () => {
+        expect(ClampAdhocTimeoutSeconds(600, 30000)).toBe(30);
+    });
+
+    it('keeps a shorter request', () => {
+        expect(ClampAdhocTimeoutSeconds(5, 30000)).toBe(5);
+    });
+
+    it('uses 30 seconds when the caller names none, within the cap', () => {
+        expect(ClampAdhocTimeoutSeconds(undefined, 30000)).toBe(30);
+        expect(ClampAdhocTimeoutSeconds(undefined, 10000)).toBe(10);
+        expect(ClampAdhocTimeoutSeconds(0, 30000)).toBe(30);
+    });
+
+    it('leaves the request alone when the server sets no limit', () => {
+        expect(ClampAdhocTimeoutSeconds(600, 0)).toBe(600);
+    });
+});

package/src/__tests__/cacheInvalidationRecordData.test.ts

@@ -0,0 +1,241 @@
+// The gate lives beside the subscription it protects, and that module carries type-graphql
+// decorators — so the metadata shim has to be in place before it is imported.
+import 'reflect-metadata';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import {
+  ConfigureRecordDataBroadcast,
+  MayBroadcastRecordData,
+  ReadIsRowFiltered,
+  ShapeCacheInvalidationEvent,
+} from '../generic/CacheInvalidationResolver.js';
+
+/**
+ * The cache-invalidation subscription is delivered to every connected client with no per-user
+ * filter, so anything `MayBroadcastRecordData` lets through is readable by every signed-in session
+ * regardless of row-level security or any tenant scoping a consumer applies on the read path.
+ *
+ * The important case is the DEFAULT: an untouched deployment must broadcast no row data at all,
+ * because that is the configuration everyone upgrades into.
+ */
+describe('MayBroadcastRecordData', () => {
+  afterEach(() => ConfigureRecordDataBroadcast([]));
+
+  it('broadcasts nothing before anything has configured it', () => {
+    // No ConfigureRecordDataBroadcast call at all — the state a process starts in, and the state it
+    // stays in if bootstrap ever stops calling it. Failing closed there is the whole point.
+    expect(MayBroadcastRecordData('Users')).toBe(false);
+    expect(MayBroadcastRecordData('AI Models')).toBe(false);
+  });
+
+  it('broadcasts nothing when the deployment has not opted in', () => {
+    ConfigureRecordDataBroadcast([]);
+    expect(MayBroadcastRecordData('Users')).toBe(false);
+  });
+
+  it('broadcasts nothing when the config value is absent', () => {
+    ConfigureRecordDataBroadcast(undefined);
+    expect(MayBroadcastRecordData('Users')).toBe(false);
+  });
+
+  it('allows exactly the entities named, and no others', () => {
+    ConfigureRecordDataBroadcast(['AI Models']);
+    expect(MayBroadcastRecordData('AI Models')).toBe(true);
+    expect(MayBroadcastRecordData('Users')).toBe(false);
+    expect(MayBroadcastRecordData('AI Model Vendors')).toBe(false);
+    // The allowlisted name as a SUBSTRING of another entity must not carry it in. Written this way
+    // deliberately: 'AI Model Vendors' above does not contain 'AI Models', so it passes against a
+    // loose `includes` match too and proves nothing — a substring mutation survived it.
+    expect(MayBroadcastRecordData('Archived AI Models 2024')).toBe(false);
+    // ...and the reverse direction, where the entity name is a substring of the allowlisted one.
+    expect(MayBroadcastRecordData('AI Model')).toBe(false);
+  });
+
+  it('matches entity names case- and whitespace-insensitively', () => {
+    ConfigureRecordDataBroadcast(['  ai models  ']);
+    expect(MayBroadcastRecordData('AI Models')).toBe(true);
+  });
+
+  it("restores the previous broadcast-everything behaviour only on an explicit '*'", () => {
+    ConfigureRecordDataBroadcast(['*']);
+    expect(MayBroadcastRecordData('Users')).toBe(true);
+    expect(MayBroadcastRecordData('Organization Person Roles')).toBe(true);
+  });
+});
+
+/**
+ * Importing this module must not drag server config loading in with it.
+ *
+ * The first version of this change read `configInfo` at module scope. `config.ts` runs
+ * `loadConfig()` on import, so every test that touched the resolver — directly or through
+ * ResolverBase — died at import with "Configuration validation failed". CI caught it; this keeps
+ * it caught.
+ */
+describe('CacheInvalidationResolver module surface', () => {
+  it('imports without any server configuration present', async () => {
+    await expect(import('../generic/CacheInvalidationResolver.js')).resolves.toBeDefined();
+  });
+});
+
+/**
+ * The allowlist is normalised where it enters, not where it is compared.
+ *
+ * Raised in review: the wildcard was matched raw while entity names were trimmed and lowercased,
+ * so a hand-edited `[' * ']` matched neither branch and silently opted nothing in — a config that
+ * reads as "broadcast everything" while the gate stayed fully closed.
+ */
+describe('allowlist normalisation', () => {
+  afterEach(() => ConfigureRecordDataBroadcast([]));
+
+  it("honours a wildcard written with surrounding whitespace", () => {
+    ConfigureRecordDataBroadcast([' * ']);
+    expect(MayBroadcastRecordData('Users')).toBe(true);
+  });
+
+  it('ignores blank entries rather than letting one match something', () => {
+    ConfigureRecordDataBroadcast(['', '   ']);
+    expect(MayBroadcastRecordData('Users')).toBe(false);
+    // A blank entry must not become a wildcard by accident either.
+    expect(MayBroadcastRecordData('')).toBe(false);
+  });
+
+  it('still matches a normal name written with odd casing and padding', () => {
+    ConfigureRecordDataBroadcast(['  AI MODELS  ']);
+    expect(MayBroadcastRecordData('ai models')).toBe(true);
+    expect(MayBroadcastRecordData('Users')).toBe(false);
+  });
+});
+
+/**
+ * Entity-level delivery filtering, raised in review.
+ *
+ * An event for an entity a session cannot read at all tells that session the record exists, its
+ * stable key and when it changed — and the session could never have read it, so withholding costs
+ * nothing. This does NOT close the row-level case: two sessions that both hold read permission on
+ * an entity still see each other's keys. That is tracked separately and deliberately not faked
+ * green here.
+ */
+describe('cacheInvalidationFilter', () => {
+  const event = (entityName: string) => ({
+    entityName,
+    primaryKeyValues: '[{"FieldName":"ID","Value":"r1"}]',
+    action: 'save',
+    sourceServerId: 's1',
+    timestamp: new Date(),
+  });
+  const session = (userRecord: unknown) => ({ userPayload: { userRecord } });
+
+  const withEntities = async (entities: Array<{ Name: string; CanRead: boolean }>) => {
+    vi.resetModules();
+    vi.doMock('@memberjunction/core', () => ({
+      Metadata: class {
+        get Entities() {
+          return entities.map((e) => ({
+            Name: e.Name,
+            GetUserPermisions: () => ({ CanRead: e.CanRead }),
+          }));
+        }
+        // The real one is case-insensitive and trims — the filter relies on that, so the mock does too.
+        EntityByName(name: string) {
+          const key = name.trim().toLowerCase();
+          return this.Entities.find((e) => e.Name.toLowerCase() === key);
+        }
+      },
+    }));
+    return (await import('../generic/CacheInvalidationResolver.js')).cacheInvalidationFilter;
+  };
+
+  afterEach(() => vi.doUnmock('@memberjunction/core'));
+
+  it('delivers an event for an entity the session may read', async () => {
+    const filter = await withEntities([{ Name: 'AI Models', CanRead: true }]);
+    expect(filter({ payload: event('AI Models') as never, context: session({ ID: 'u1' }) })).toBe(true);
+  });
+
+  it('withholds an event for an entity the session may NOT read', async () => {
+    const filter = await withEntities([{ Name: 'Users', CanRead: false }]);
+    expect(filter({ payload: event('Users') as never, context: session({ ID: 'u1' }) })).toBe(false);
+  });
+
+  it('fails closed when the connection carries no user', async () => {
+    // onConnect rejects a socket whose token does not validate, so this should not arise — and it
+    // is the case least deserving of an unfiltered firehose if it does.
+    const filter = await withEntities([{ Name: 'AI Models', CanRead: true }]);
+    expect(filter({ payload: event('AI Models') as never, context: undefined })).toBe(false);
+    expect(filter({ payload: event('AI Models') as never, context: session(undefined) })).toBe(false);
+  });
+
+  it('delivers when the entity is unknown to this server, rather than silently going stale', async () => {
+    // Deliberately the opposite choice: a name absent from metadata cannot be permission-checked,
+    // and withholding would stop invalidating a legitimately cacheable entity — a correctness bug
+    // in place of a disclosure one.
+    const filter = await withEntities([{ Name: 'AI Models', CanRead: true }]);
+    expect(filter({ payload: event('Some Entity This Server Never Heard Of') as never, context: session({ ID: 'u1' }) })).toBe(true);
+  });
+
+  it('withholds an event with no entity name', async () => {
+    const filter = await withEntities([{ Name: 'AI Models', CanRead: true }]);
+    expect(filter({ payload: { ...event(''), entityName: '' } as never, context: session({ ID: 'u1' }) })).toBe(false);
+  });
+});
+
+/**
+ * Row-level narrowing (MJ#5241): a subscriber who reads the entity only through a row-level security filter learns that a
+ * row changed, not which one; a subscriber with an unfiltered read keeps the key; a subscriber with no read is the entity-level
+ * filter's business and gets nothing here to shape.
+ */
+describe('ReadIsRowFiltered and ShapeCacheInvalidationEvent', () => {
+  const FILTERED_ROLE = 'role-participant';
+  const OPEN_ROLE = 'role-staff';
+  const entity = {
+    Permissions: [
+      { RoleID: FILTERED_ROLE, CanRead: true, Type: 'Allow', ReadRLSFilterID: 'filter-1' },
+      { RoleID: OPEN_ROLE, CanRead: true, Type: 'Allow', ReadRLSFilterID: null },
+      { RoleID: 'role-denied', CanRead: true, Type: 'Deny', ReadRLSFilterID: null },
+    ],
+  };
+  const payload = {
+    entityName: 'Spaces',
+    primaryKeyValues: 'ID|abc',
+    action: 'save',
+    sourceServerId: 'srv',
+    timestamp: new Date('2026-10-07T00:00:00Z'),
+    originSessionId: 'sess',
+    recordData: '{"Name":"x"}',
+  };
+
+  it('is row-filtered when every read the user holds carries a filter', () => {
+    expect(ReadIsRowFiltered(entity, { UserRoles: [{ RoleID: FILTERED_ROLE }] })).toBe(true);
+  });
+
+  it('is not row-filtered when any read the user holds is unfiltered, whichever role brings it', () => {
+    expect(ReadIsRowFiltered(entity, { UserRoles: [{ RoleID: OPEN_ROLE }] })).toBe(false);
+    expect(ReadIsRowFiltered(entity, { UserRoles: [{ RoleID: FILTERED_ROLE }, { RoleID: OPEN_ROLE }] })).toBe(false);
+  });
+
+  it('is not row-filtered when the user holds no read at all (the entity-level filter owns that case), and a Deny row grants nothing', () => {
+    expect(ReadIsRowFiltered(entity, { UserRoles: [{ RoleID: 'role-stranger' }] })).toBe(false);
+    expect(ReadIsRowFiltered(entity, { UserRoles: [{ RoleID: 'role-denied' }] })).toBe(false);
+    expect(ReadIsRowFiltered(entity, { UserRoles: null })).toBe(false);
+  });
+
+  it('matches role ids without regard to case or whitespace', () => {
+    expect(ReadIsRowFiltered(entity, { UserRoles: [{ RoleID: ` ${FILTERED_ROLE.toUpperCase()} ` }] })).toBe(true);
+  });
+
+  it('withholds the key and the row from a row-filtered subscriber, and keeps the rest of the event', () => {
+    const shaped = ShapeCacheInvalidationEvent(payload, { UserRoles: [{ RoleID: FILTERED_ROLE }] }, entity);
+    expect(shaped.PrimaryKeyValues).toBeUndefined();
+    expect(shaped.RecordData).toBeUndefined();
+    expect(shaped.EntityName).toBe('Spaces');
+    expect(shaped.Action).toBe('save');
+    expect(shaped.SourceServerID).toBe('srv');
+    expect(shaped.OriginSessionID).toBe('sess');
+  });
+
+  it('delivers the event whole to an unfiltered reader, and when the entity or the user is unknown', () => {
+    expect(ShapeCacheInvalidationEvent(payload, { UserRoles: [{ RoleID: OPEN_ROLE }] }, entity).PrimaryKeyValues).toBe('ID|abc');
+    expect(ShapeCacheInvalidationEvent(payload, { UserRoles: [{ RoleID: OPEN_ROLE }] }, entity).RecordData).toBe('{"Name":"x"}');
+    expect(ShapeCacheInvalidationEvent(payload, { UserRoles: [{ RoleID: FILTERED_ROLE }] }, null).PrimaryKeyValues).toBe('ID|abc');
+    expect(ShapeCacheInvalidationEvent(payload, undefined, entity).PrimaryKeyValues).toBe('ID|abc');
+  });
+});

package/src/__tests__/multiTenancy.postgresRewrite.test.ts

@@ -0,0 +1,180 @@
+/**
+ * The tenant PreRunView hook checks the caller's ExtraFilter and builds
+ * `(<ExtraFilter>) AND (<tenant predicate>)`. On PostgreSQL the provider then rewrites the whole
+ * filter (identifier quoting, T-SQL date functions, boolean literals), and that rewrite can change
+ * the caller's part after the hook checked it. These tests run the real hook, the real PostgreSQL
+ * rewrite and the real view query builder, with only ExecuteSQL recorded, and pin that the tenant
+ * predicate stays a separate AND term whatever the rewrite does to the caller's term. The last
+ * block runs the same path with no hook and pins that the per-term rewrite keeps a SQL Server
+ * bracket name whole.
+ */
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import {
+    ClearAllDataHooks,
+    Metadata,
+    RegisterDataHook,
+    UserInfo,
+    type EntityInfo,
+    type IMetadataProvider,
+} from '@memberjunction/core';
+import { PostgreSQLDataProvider } from '@memberjunction/postgresql-dataprovider';
+import type { SQLParserDialect } from '@memberjunction/sql-dialect';
+import { IsBalancedSQLFragment, SplitTopLevelAndTerms } from '@memberjunction/sql-parser';
+import { createTenantPreRunViewHook } from '../multiTenancy/index.js';
+import type { MultiTenancyConfig } from '../config.js';
+
+const TENANT_TERM = `(("OrganizationID" = 't1'))`;
+
+/** The real PostgreSQL provider over one entity fixture, with every executed statement recorded. */
+class RecordingPostgreSQLProvider extends PostgreSQLDataProvider {
+    public readonly ExecutedSQL: string[] = [];
+
+    constructor(private readonly testEntities: EntityInfo[]) {
+        super();
+    }
+
+    public override get Entities(): EntityInfo[] {
+        return this.testEntities;
+    }
+
+    public override async ExecuteSQL<T>(sql: string): Promise<T[]> {
+        this.ExecutedSQL.push(sql);
+        return [];
+    }
+}
+
+/** A tenant-scoped entity with a boolean field, which the PostgreSQL rewrite coerces. */
+function customersEntity(): EntityInfo {
+    const field = (name: string, tsType: string) => ({ Name: name, CodeName: name, TSType: tsType, IsVirtual: false });
+    const fields = [field('ID', 'string'), field('Name', 'string'), field('OrganizationID', 'string'), field('IsActive', 'boolean')];
+    return {
+        ID: 'ENT-CUSTOMERS',
+        Name: 'Customers',
+        SchemaName: 'app',
+        BaseView: 'vwCustomers',
+        Fields: fields,
+        PrimaryKeys: [fields[0]],
+        FirstPrimaryKey: fields[0],
+        FieldByName: (n: string) => fields.find((f) => f.Name.toLowerCase() === n.trim().toLowerCase()),
+        DatetimeFields: [],
+        ExternalDataSourceID: null,
+        UserViewMaxRows: 0,
+        AuditViewRuns: false,
+        GetUserPermisions: () => ({ CanRead: true }),
+        GetUserRowLevelSecurityWhereClause: () => '',
+    } as unknown as EntityInfo;
+}
+
+function tenantConfig(): MultiTenancyConfig {
+    return {
+        enabled: true,
+        contextSource: 'header',
+        tenantHeader: 'x-tenant-id',
+        scopingStrategy: 'allowlist',
+        scopedEntities: ['Customers'],
+        autoExcludeCoreEntities: true,
+        defaultTenantColumn: 'OrganizationID',
+        entityColumnMappings: {},
+        adminRoles: ['Admin'],
+        writeProtection: 'strict',
+    };
+}
+
+/** The WHERE clause of the one statement the provider ran. */
+function whereOf(provider: RecordingPostgreSQLProvider): string {
+    expect(provider.ExecutedSQL).toHaveLength(1);
+    const sql = provider.ExecutedSQL[0];
+    return sql.substring(sql.indexOf(' WHERE ') + ' WHERE '.length);
+}
+
+/**
+ * Whether `term` is one of the top-level AND terms inside the one pair of parentheses around
+ * `where`. Only then does it narrow every row the query returns.
+ */
+function isTopLevelAndTerm(where: string, term: string, dialect: SQLParserDialect): boolean {
+    const inner = where.slice(1, -1);
+    const wrapped = where.startsWith('(') && where.endsWith(')') && IsBalancedSQLFragment(inner, dialect).IsBalanced;
+    return wrapped && (SplitTopLevelAndTerms(inner, dialect) ?? []).some((t) => t.trim() === term);
+}
+
+describe('Multi-tenancy on PostgreSQL — the provider rewrite cannot reach the tenant predicate', () => {
+    let provider: RecordingPostgreSQLProvider;
+    let savedProvider: IMetadataProvider;
+    let user: UserInfo;
+
+    beforeEach(() => {
+        provider = new RecordingPostgreSQLProvider([customersEntity()]);
+        savedProvider = Metadata.Provider;
+        Metadata.Provider = provider;
+        ClearAllDataHooks();
+        RegisterDataHook('PreRunView', createTenantPreRunViewHook(tenantConfig()));
+        user = new UserInfo(provider, { ID: 'U1', Email: 'u1@example.com' });
+        user.TenantContext = { TenantID: 't1', Source: 'header' };
+    });
+
+    afterEach(() => {
+        ClearAllDataHooks();
+        Metadata.Provider = savedProvider;
+    });
+
+    it('keeps the tenant predicate a separate AND term when the rewrite changes the caller term', async () => {
+        // The rewrite turns the caller's quoted text into boolean literals and changes where its
+        // parentheses close. Each term is rewritten and wrapped on its own, so that change stays
+        // inside the caller's term.
+        const result = await provider.RunView({ EntityName: 'Customers', ExtraFilter: `"IsActive" = '1) AND ("IsActive" = 1'` }, user);
+
+        expect(result.Success).toBe(true);
+        expect(whereOf(provider)).toBe(`((("IsActive" = TRUE) AND ("IsActive" = TRUE)) AND ${TENANT_TERM})`);
+    });
+
+    it('keeps the tenant predicate its own AND term after a quote the boolean rewrite drops, followed by a top-level OR', async () => {
+        // The rewrite drops the quote, so text the hook read inside a string literal becomes code
+        // with a top-level OR. The tenant predicate must still narrow every row.
+        const result = await provider.RunView({ EntityName: 'Customers', ExtraFilter: `"IsActive" = '1) OR (1=1) OR ("IsActive" = 1'` }, user);
+
+        expect(result.Success).toBe(true);
+        const where = whereOf(provider);
+        expect(isTopLevelAndTerm(where, TENANT_TERM, provider.Dialect), `tenant predicate is not a top-level AND term of ${where}`).toBe(true);
+        expect(where).toBe(`((("IsActive" = TRUE) OR (1=1) OR ("IsActive" = TRUE)) AND ${TENANT_TERM})`);
+    });
+
+    it('refuses a caller term that the rewrite leaves unbalanced, and runs no SQL', async () => {
+        const result = await provider.RunView({ EntityName: 'Customers', ExtraFilter: `"IsActive" = '1) AND (1 = 1'` }, user);
+
+        expect(provider.ExecutedSQL).toEqual([]);
+        expect(result.Success).toBe(false);
+        expect(result.ErrorMessage).toMatch(/ExtraFilter/);
+    });
+
+    it('leaves an ordinary filter and the tenant predicate as written, each in its own term', async () => {
+        const result = await provider.RunView({ EntityName: 'Customers', ExtraFilter: `"IsActive" = 1 OR "Name" = 'a'` }, user);
+
+        expect(result.Success).toBe(true);
+        expect(whereOf(provider)).toBe(`((("IsActive" = TRUE OR "Name" = 'a')) AND ${TENANT_TERM})`);
+    });
+});
+
+describe('PostgreSQL ExtraFilter rewrite with no PreRunView hook', () => {
+    let provider: RecordingPostgreSQLProvider;
+    let savedProvider: IMetadataProvider;
+
+    beforeEach(() => {
+        provider = new RecordingPostgreSQLProvider([customersEntity()]);
+        savedProvider = Metadata.Provider;
+        Metadata.Provider = provider;
+        ClearAllDataHooks();
+    });
+
+    afterEach(() => {
+        Metadata.Provider = savedProvider;
+    });
+
+    it('keeps a SQL Server bracket name that contains AND whole when it rewrites each AND term', async () => {
+        const user = new UserInfo(provider, { ID: 'U1', Email: 'u1@example.com' });
+
+        const result = await provider.RunView({ EntityName: 'Customers', ExtraFilter: '[Profit and Loss] > 0 AND [IsActive] = 1' }, user);
+
+        expect(result.Success).toBe(true);
+        expect(whereOf(provider)).toBe('(("Profit and Loss" > 0) AND ("IsActive" = TRUE))');
+    });
+});

package/src/__tests__/multiTenancy.security.test.ts

@@ -286,6 +286,57 @@ describe('Multi-Tenancy Security Edge Cases', () => {
     });
   });
 
+  // ─── Client ExtraFilter containment ───────────────────────────────────
+
+  describe('client ExtraFilter must stay inside its parentheses', () => {
+    // The hook builds `(<ExtraFilter>) AND (<tenant>)`. A filter that closes a parenthesis it did
+    // not open turns that into `(1=1) OR (1=1) AND (<tenant>)`: AND binds tighter than OR, so the
+    // tenant predicate would narrow only one side of an OR the caller controls.
+    const escapes = [
+      '1=1) OR (1=1',
+      "Name = 'a') OR (Name = 'b'",
+      '1=1)) OR ((1=1',
+    ];
+
+    it.each(escapes)('refuses the ExtraFilter %j instead of ANDing the tenant predicate onto it', (extraFilter) => {
+      const hook = createTenantPreRunViewHook(makeConfig());
+      const params = { EntityName: 'Customers', ExtraFilter: extraFilter } as RunViewParams;
+
+      expect(() => hook(params, makeUser('tenant-abc'))).toThrow(/parenthesis/);
+    });
+
+    it('refuses an ExtraFilter that ends inside an unterminated string literal', () => {
+      const hook = createTenantPreRunViewHook(makeConfig());
+      const params = { EntityName: 'Customers', ExtraFilter: "Name = 'a" } as RunViewParams;
+
+      expect(() => hook(params, makeUser('tenant-abc'))).toThrow(/unterminated/);
+    });
+
+    it('refuses an ExtraFilter that contains a comment', () => {
+      const hook = createTenantPreRunViewHook(makeConfig());
+      const params = { EntityName: 'Customers', ExtraFilter: "Name = 'a' -- note\n" } as RunViewParams;
+
+      expect(() => hook(params, makeUser('tenant-abc'))).toThrow(/comment/);
+    });
+
+    it('applies the PostgreSQL rules too when the provider dialect is unknown', () => {
+      // The mocked Metadata.Provider here is not a database provider, so the hook reads the filter
+      // with every supported dialect.
+      const hook = createTenantPreRunViewHook(makeConfig());
+      const params = { EntityName: 'Customers', ExtraFilter: 'Name = $$x$$' } as RunViewParams;
+
+      expect(() => hook(params, makeUser('tenant-abc'))).toThrow(/dollar/);
+    });
+
+    it('keeps a balanced ExtraFilter and the tenant predicate as separate parenthesized terms', () => {
+      const hook = createTenantPreRunViewHook(makeConfig());
+      const params = { EntityName: 'Customers', ExtraFilter: "Name = 'a) OR (b' OR Name = 'c'" } as RunViewParams;
+
+      const result = hook(params, makeUser('tenant-abc')) as RunViewParams;
+      expect(result.ExtraFilter).toBe("(Name = 'a) OR (b' OR Name = 'c') AND ([OrganizationID] = 'tenant-abc')");
+    });
+  });
+
   // ─── PreSave security edge cases ──────────────────────────────────────
 
   describe('PreSave security', () => {

package/src/__tests__/multiTenancy.test.ts

@@ -65,7 +65,7 @@ describe('Multi-Tenancy Hooks', () => {
 
       const result = hook(params, user);
       expect((result as RunViewParams).ExtraFilter).toBe(
-        "(Status = 'Active') AND [OrganizationID] = 'tenant-abc'"
+        "(Status = 'Active') AND ([OrganizationID] = 'tenant-abc')"
       );
     });