@memberjunction/server 5.51.3 → 5.51.4

package/src/__tests__/newUserRolesDefault.test.ts

@@ -0,0 +1,81 @@
+/**
+ * Config-contract regression test for the shipped `userHandling.newUserRoles` default (issue #4260).
+ *
+ * THE DEFECT. `DEFAULT_SERVER_CONFIG` shipped `newUserRoles: ['UI', 'Developer']`. On the baseline
+ * seed the `Developer` role holds `CanUpdate` on 439 of the database's 446 entities with no row-level filter —
+ * `MJ: Users` among them, where `AllowUpdateAPI` is true and both `Type` and `Name` are
+ * `AllowUpdateAPI` fields. Every gate in the chain passes:
+ *
+ *   config default -> newUsers.ts assigns the role -> EntityPermission grants Update
+ *   -> Entity/Field AllowUpdateAPI allow it -> BaseEntity.CheckPermissions passes
+ *   -> GRANT EXECUTE ON __mj.spUpdateUser TO cdp_Developer
+ *
+ * So anyone who obtained an account through JWT auto-provisioning or a magic-link redeem could
+ * write any row of `MJ: Users` — including setting their own `Type` to `'Owner'`, the column MJ's
+ * superuser checks read (`SqlLoggingConfigResolver`, `canIssueInvites`, the backup-system-user
+ * fallback). That is privilege escalation from "can obtain a token" to "platform Owner".
+ *
+ * WHY THE DEFAULT IS THE FIX. The value is not merely the fallback for a host with no config file.
+ * `loadConfig()` deep-merges through `mergeConfigs`, so a host writing a PARTIAL `userHandling`
+ * block (`{ autoCreateNewUsers: true }`, say) inherits this array — the Zod `.default([])` on the
+ * schema never fires, because the key is never absent after the merge. The shipped default is
+ * therefore the effective posture of every deployment that does not name `newUserRoles` explicitly.
+ *
+ * These assertions pin the CONTRACT, not just the literal: the shipped default must grant an
+ * auto-provisioned user no more than the end-user surface.
+ */
+import { describe, it, expect, vi } from 'vitest';
+
+// config.ts evaluates `configInfo = loadConfig()` at module load, and `loadConfig` rejects a
+// configuration carrying no database credentials. Stubbing the cosmiconfig search — and ONLY that —
+// supplies them so the module imports, while leaving `DEFAULT_SERVER_CONFIG` itself completely
+// untouched. These assertions therefore run against the constant the server actually ships rather
+// than against a copy of it, which is the whole point of a shipped-default contract test.
+vi.mock('cosmiconfig', () => ({
+  cosmiconfigSync: () => ({
+    search: () => ({
+      filepath: '/test/mj.config.cjs',
+      isEmpty: false,
+      config: { dbUsername: 'test-user', dbPassword: 'test-password', dbDatabase: 'test-db' },
+    }),
+  }),
+}));
+
+import { DEFAULT_SERVER_CONFIG } from '../config.js';
+
+/**
+ * Seeded roles that carry platform-wide write on the baseline database, and so must never appear
+ * in a default handed to a party the host has not vetted. `Integration`'s own seed Description
+ * says it "shouldn't be applied to end-users"; `Developer` is the role this issue was filed about.
+ */
+const PLATFORM_WRITE_ROLES = ['Developer', 'Integration'];
+
+describe('DEFAULT_SERVER_CONFIG.userHandling.newUserRoles (issue #4260)', () => {
+  const newUserRoles = DEFAULT_SERVER_CONFIG.userHandling?.newUserRoles;
+
+  it('grants auto-provisioned users the end-user role only', () => {
+    expect(newUserRoles).toEqual(['UI']);
+  });
+
+  it.each(PLATFORM_WRITE_ROLES)('does not include the platform-write role %j', role => {
+    // The regression itself. Before the fix, 'Developer' was present here and every
+    // auto-provisioned user could UPDATE MJ: Users, Type and Name included.
+    expect(newUserRoles).not.toContain(role);
+  });
+
+  it('is not empty — an auto-provisioned user must still be able to use the product', () => {
+    // The opposite failure mode: locking the default down to [] would provision users who
+    // cannot read their own conversations, views or dashboards. 'UI' is the seeded role that
+    // carries exactly that end-user surface (48 update grants, none of them on MJ: Users).
+    expect(newUserRoles?.length).toBeGreaterThan(0);
+  });
+
+  it('stays minimal because auto-provisioning is ON by default with no domain restriction', () => {
+    // This is the linkage that makes the role list security-relevant rather than a convenience
+    // setting. A stock server auto-creates an account for ANY identity its configured IdP will
+    // issue a token for. If either of these defaults is ever tightened, the role list may be
+    // reconsidered — but not before, and never in the other order.
+    expect(DEFAULT_SERVER_CONFIG.userHandling?.autoCreateNewUsers).toBe(true);
+    expect(DEFAULT_SERVER_CONFIG.userHandling?.newUserLimitedToAuthorizedDomains).toBe(false);
+  });
+});

package/src/__tests__/postgresqlPoolSettings.test.ts

@@ -0,0 +1,131 @@
+/**
+ * PostgreSQL pools read the same databaseSettings values as SQL Server, with the same defaults.
+ */
+import { describe, it, expect } from 'vitest';
+import {
+    BuildPostgreSQLConnectionConfig,
+    CODEGEN_STATEMENT_TIMEOUT_MS,
+    ResolvePostgreSQLEndpoint,
+    ResolvePostgreSQLReadOnlyCredentials,
+    ToPGPoolConfig
+} from '../postgresqlPoolSettings.js';
+import type { DatabaseSettingsInfo } from '../config.js';
+import { DescribeReadOnlyLoginOverreach } from '../postgresqlPoolSettings.js';
+import type { ReadOnlyLoginCheckClient, ReadOnlyLoginGrants } from '../postgresqlPoolSettings.js';
+
+const defaults: DatabaseSettingsInfo = {
+    connectionTimeout: 45000,
+    requestTimeout: 30000,
+    metadataCacheRefreshInterval: 180000,
+    connectionPool: { max: 50, min: 5, idleTimeoutMillis: 30000, acquireTimeoutMillis: 30000 }
+};
+const endpoint = { Host: 'db', Port: 5432, Database: 'mj', User: 'api', Password: 'secret' };
+
+describe('BuildPostgreSQLConnectionConfig', () => {
+    it('gives API pools requestTimeout as the statement timeout and the pool settings SQL Server uses', () => {
+        const config = BuildPostgreSQLConnectionConfig(endpoint, defaults, 'api');
+        expect(config).toMatchObject({
+            ...endpoint,
+            MaxConnections: 50,
+            MinConnections: 5,
+            IdleTimeoutMillis: 30000,
+            ConnectionTimeoutMillis: 30000,
+            StatementTimeoutMs: 30000,
+            IdleInTransactionSessionTimeoutMs: 60000
+        });
+    });
+
+    it('follows a configured requestTimeout and pool', () => {
+        const config = BuildPostgreSQLConnectionConfig(endpoint, {
+            ...defaults,
+            requestTimeout: 5000,
+            connectionPool: { max: 12, min: 1, idleTimeoutMillis: 7000, acquireTimeoutMillis: 9000 }
+        }, 'api');
+        expect(config).toMatchObject({ MaxConnections: 12, MinConnections: 1, IdleTimeoutMillis: 7000, ConnectionTimeoutMillis: 9000, StatementTimeoutMs: 5000, IdleInTransactionSessionTimeoutMs: 10000 });
+    });
+
+    it('sets no timeouts when requestTimeout is 0', () => {
+        const config = BuildPostgreSQLConnectionConfig(endpoint, { ...defaults, requestTimeout: 0 }, 'api');
+        expect(config.StatementTimeoutMs).toBe(0);
+        expect(config.IdleInTransactionSessionTimeoutMs).toBe(0);
+    });
+
+    it('keeps the read-only pool small but gives it the API timeouts', () => {
+        const config = BuildPostgreSQLConnectionConfig(endpoint, defaults, 'read-only');
+        expect(config).toMatchObject({ MaxConnections: 10, MinConnections: 0, StatementTimeoutMs: 30000, IdleInTransactionSessionTimeoutMs: 60000 });
+        expect(BuildPostgreSQLConnectionConfig(endpoint, { ...defaults, connectionPool: { max: 4, min: 1, idleTimeoutMillis: 1, acquireTimeoutMillis: 1 } }, 'read-only').MaxConnections).toBe(4);
+    });
+
+    it('gives the CodeGen pool the long timeout the SQL Server CodeGen pool has, and no idle-in-transaction limit', () => {
+        const config = BuildPostgreSQLConnectionConfig(endpoint, defaults, 'codegen');
+        expect(config.StatementTimeoutMs).toBe(CODEGEN_STATEMENT_TIMEOUT_MS);
+        expect(CODEGEN_STATEMENT_TIMEOUT_MS).toBe(600000);
+        expect(config.IdleInTransactionSessionTimeoutMs).toBe(0);
+        expect(config.MaxConnections).toBe(10);
+    });
+});
+
+describe('ToPGPoolConfig', () => {
+    it('maps the connection config onto pg.Pool option names', () => {
+        const pool = ToPGPoolConfig(BuildPostgreSQLConnectionConfig(endpoint, defaults, 'api'));
+        expect(pool).toEqual({
+            host: 'db', port: 5432, database: 'mj', user: 'api', password: 'secret',
+            max: 50, min: 5, idleTimeoutMillis: 30000, connectionTimeoutMillis: 30000,
+            statement_timeout: 30000, idle_in_transaction_session_timeout: 60000
+        });
+    });
+
+    it('leaves the timeouts out when they are 0', () => {
+        const pool = ToPGPoolConfig(BuildPostgreSQLConnectionConfig(endpoint, { ...defaults, requestTimeout: 0 }, 'api'));
+        expect(pool).not.toHaveProperty('statement_timeout');
+        expect(pool).not.toHaveProperty('idle_in_transaction_session_timeout');
+    });
+});
+
+describe('ResolvePostgreSQLEndpoint', () => {
+    it('prefers PG_* variables over DB_* ones', () => {
+        expect(ResolvePostgreSQLEndpoint({ PG_HOST: 'pg', DB_HOST: 'db', DB_PORT: '6000', DB_DATABASE: 'd', DB_USERNAME: 'u', DB_PASSWORD: 'p' }))
+            .toEqual({ Host: 'pg', Port: 6000, Database: 'd', User: 'u', Password: 'p' });
+    });
+
+    it('falls back to localhost:5432 and the postgres user', () => {
+        expect(ResolvePostgreSQLEndpoint({})).toEqual({ Host: 'localhost', Port: 5432, Database: '', User: 'postgres', Password: '' });
+    });
+});
+
+describe('ResolvePostgreSQLReadOnlyCredentials', () => {
+    it('uses the dbReadOnlyUsername / dbReadOnlyPassword settings SQL Server uses', () => {
+        expect(ResolvePostgreSQLReadOnlyCredentials({ dbReadOnlyUsername: 'ro', dbReadOnlyPassword: 'pw' }, {}))
+            .toEqual({ User: 'ro', Password: 'pw' });
+    });
+
+    it('falls back to PG_READ_ONLY_* when the settings are absent', () => {
+        expect(ResolvePostgreSQLReadOnlyCredentials({}, { PG_READ_ONLY_USERNAME: 'pgro', PG_READ_ONLY_PASSWORD: 'x' }))
+            .toEqual({ User: 'pgro', Password: 'x' });
+    });
+
+    it('returns null when no complete pair is configured', () => {
+        expect(ResolvePostgreSQLReadOnlyCredentials({ dbReadOnlyUsername: 'ro' }, { PG_READ_ONLY_USERNAME: 'pgro' })).toBeNull();
+    });
+});
+
+describe('DescribeReadOnlyLoginOverreach', () => {
+    const clientAnswering = (row: ReadOnlyLoginGrants): ReadOnlyLoginCheckClient => ({
+        query: async () => ({ rows: [row] }),
+    });
+
+    it('says nothing for a login that reads only views', async () => {
+        expect(await DescribeReadOnlyLoginOverreach(clientAnswering({ ReadsServerFiles: false, ReadableBaseTables: 0 }), '__mj')).toEqual([]);
+    });
+
+    it('warns when the login can read base tables', async () => {
+        const warnings = await DescribeReadOnlyLoginOverreach(clientAnswering({ ReadsServerFiles: false, ReadableBaseTables: 412 }), '__mj');
+        expect(warnings).toHaveLength(1);
+        expect(warnings[0]).toMatch(/can read 412 base table\(s\) in schema "__mj"/);
+    });
+
+    it('warns when the login can read server files', async () => {
+        const warnings = await DescribeReadOnlyLoginOverreach(clientAnswering({ ReadsServerFiles: true, ReadableBaseTables: 0 }), '__mj');
+        expect(warnings[0]).toMatch(/pg_read_server_files/);
+    });
+});

package/src/__tests__/pushStatusResolver.filter.test.ts

@@ -0,0 +1,56 @@
+/**
+ * pushStatusResolver.filter.test.ts — locks the security-critical subscription filter for B49.
+ *
+ * `statusUpdatesFilter` is the gate that fixes the `statusUpdates` session-hijack: a push is
+ * delivered only when the push's `sessionId` matches the subscriber's requested session AND the
+ * push's `ownerUserId` matches the subscriber CONNECTION's server-authenticated identity. Knowing
+ * a victim's client-chosen `sessionId` must no longer be sufficient to receive their pushes.
+ *
+ * The filter is a pure function (no DB / config / transport), so these are plain unit tests.
+ */
+import 'reflect-metadata';
+import { describe, it, expect } from 'vitest';
+import { statusUpdatesFilter, type PushStatusNotificationPayload, type StatusUpdatesFilterContext } from '../generic/PushStatusResolver';
+import type { UserPayload } from '../types';
+
+const OWNER = 'AA11BB22-0000-4000-8000-000000000001';
+const ATTACKER = 'CC33DD44-0000-4000-8000-000000000002';
+const SESSION = 'session-abc-123';
+
+function ctxFor(userId: string | undefined): StatusUpdatesFilterContext {
+  // userRecord is `any` in UserPayload; a minimal shape with ID is all the filter reads.
+  return { userPayload: (userId ? { userRecord: { ID: userId } } : {}) as unknown as UserPayload };
+}
+
+function push(overrides: Partial<PushStatusNotificationPayload> = {}): PushStatusNotificationPayload {
+  return { sessionId: SESSION, ownerUserId: OWNER, message: 'progress', ...overrides };
+}
+
+describe('statusUpdatesFilter (B49 session-hijack gate)', () => {
+  it('delivers when sessionId matches AND the connection identity owns the push', () => {
+    expect(statusUpdatesFilter({ payload: push(), args: { sessionId: SESSION }, context: ctxFor(OWNER) })).toBe(true);
+  });
+
+  it('THE FIX: rejects a matching sessionId when the connection identity is a DIFFERENT user (hijack)', () => {
+    // Attacker lifted the victim's sessionId and subscribes with it — but their authenticated
+    // connection identity is their own, so delivery must be denied.
+    expect(statusUpdatesFilter({ payload: push({ ownerUserId: OWNER }), args: { sessionId: SESSION }, context: ctxFor(ATTACKER) })).toBe(false);
+  });
+
+  it('rejects when the requested sessionId does not match the push', () => {
+    expect(statusUpdatesFilter({ payload: push(), args: { sessionId: 'some-other-session' }, context: ctxFor(OWNER) })).toBe(false);
+  });
+
+  it('fails closed when the push carries no ownerUserId', () => {
+    expect(statusUpdatesFilter({ payload: push({ ownerUserId: '' }), args: { sessionId: SESSION }, context: ctxFor(OWNER) })).toBe(false);
+  });
+
+  it('fails closed when the connection has no authenticated identity', () => {
+    expect(statusUpdatesFilter({ payload: push(), args: { sessionId: SESSION }, context: ctxFor(undefined) })).toBe(false);
+    expect(statusUpdatesFilter({ payload: push(), args: { sessionId: SESSION }, context: undefined })).toBe(false);
+  });
+
+  it('matches identity case-insensitively (SQL Server upper vs PostgreSQL lower UUIDs)', () => {
+    expect(statusUpdatesFilter({ payload: push({ ownerUserId: OWNER.toUpperCase() }), args: { sessionId: SESSION }, context: ctxFor(OWNER.toLowerCase()) })).toBe(true);
+  });
+});

package/src/__tests__/resolverBase.refusalMessage.test.ts

@@ -0,0 +1,88 @@
+/**
+ * What the API says when a save or a delete is REFUSED.
+ *
+ * The three write resolvers all end the same way — `throw new GraphQLError(<a string off
+ * LatestResult> ?? 'Unknown error')` — and they did not agree on which string. `CreateRecord` read
+ * `CompleteMessage`; `UpdateRecord` and `DeleteRecord` read `Message`. A validation refusal puts its
+ * reasons in `Errors` and leaves `Message` null, so the same rule on the same entity explained itself
+ * on a create and produced the literal text "Unknown error" on an update.
+ *
+ * Nothing could catch it: both properties exist, both are strings, and the `??` fallback renders the
+ * failure as a plausible-looking error rather than a crash. It is visible only by refusing an update
+ * and reading what comes back.
+ *
+ * The first two cases below guard the direction of RISK in the change — that swapping the property
+ * cannot lose a plain `Message`, and cannot blank out the `'Unknown error'` fallback. The last case
+ * is the only one that fails if a resolver is switched back, and it has to read the source to do it:
+ * any test that restates what a resolver reads stays green through the regression, which is exactly
+ * how this survived (a create-path test proved nothing about update).
+ */
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { describe, expect, it } from 'vitest';
+import { BaseEntityResult } from '@memberjunction/core';
+
+/** The shape a validation refusal leaves: `Message` untouched, reasons in `Errors`. */
+function refusedByValidation(...messages: string[]): BaseEntityResult {
+    const result = new BaseEntityResult();
+    result.Success = false;
+    result.Errors = messages.map((Message) => ({
+        Source: 'SomeField',
+        Message,
+        Value: null,
+        Type: 'Failure',
+    })) as unknown as BaseEntityResult['Errors'];
+    return result;
+}
+
+/** Exactly what the update/delete resolvers hand to `GraphQLError`, fallback included. */
+const asReported = (r: BaseEntityResult) => r.CompleteMessage ?? 'Unknown error';
+
+describe('switching the update/delete throws to CompleteMessage', () => {
+    it('does NOT lose a plain Message — it is a superset, not a replacement', () => {
+        // The risk in the change: a non-validation failure (a provider/SQL error) sets `Message` and
+        // no `Errors`. The new property must still report it.
+        const result = new BaseEntityResult();
+        result.Success = false;
+        result.Message = 'Timeout expired while saving.';
+
+        expect(asReported(result)).toBe('Timeout expired while saving.');
+    });
+
+    it('still falls back to "Unknown error" when there is genuinely nothing to say', () => {
+        // The other direction: if CompleteMessage returned '' rather than undefined for an empty
+        // result, `??` would not fire and the user would get a blank error.
+        expect(asReported(new BaseEntityResult())).toBe('Unknown error');
+    });
+
+    it('carries the validation prose that "Unknown error" used to replace', () => {
+        const prose = 'Record what this contract says instead of the standard clause.';
+        const result = refusedByValidation(prose);
+
+        expect(result.Message, 'a refusal leaves Message unset — this is why reading it failed').toBeFalsy();
+        expect(asReported(result)).toBe(prose);
+    });
+});
+
+describe('ResolverBase selects CompleteMessage on every write-refusal throw', () => {
+    const source = readFileSync(fileURLToPath(new URL('../generic/ResolverBase.ts', import.meta.url)), 'utf8');
+
+    it('no refusal throw reads the bare LatestResult.Message', () => {
+        // `\b` so the longer `CompleteMessage` does not match.
+        const offenders = source
+            .split('\n')
+            .map((line, i) => ({ line: line.trim(), n: i + 1 }))
+            .filter(({ line }) => /LatestResult\??\.Message\b/.test(line));
+
+        expect(
+            offenders,
+            `these lines still read the bare Message:\n${offenders.map((o) => `  ${o.n}: ${o.line}`).join('\n')}`,
+        ).toEqual([]);
+    });
+
+    it('keeps the three error codes distinct — the fix must not have collapsed the paths', () => {
+        for (const code of ['CREATE_ENTITY_ERROR', 'SAVE_ENTITY_ERROR', 'DELETE_ENTITY_ERROR']) {
+            expect(source, code).toContain(code);
+        }
+    });
+});

package/src/__tests__/resolverBase.rls.test.ts

@@ -103,6 +103,8 @@ vi.mock('@memberjunction/core', async () => {
 });
 
 vi.mock('@memberjunction/core-entities', () => ({}));
+// ResolverBase imports the client clause screen from generic-database-provider; these tests do not reach it.
+vi.mock('@memberjunction/generic-database-provider', () => ({}));
 
 // ─── Import after mocks ──────────────────────────────────────────────────
 import { ResolverBase } from '../generic/ResolverBase';

package/src/__tests__/translateBracketsToPG.test.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated resolvers emit SQL Server bracket-quoted identifiers; on PostgreSQL they become
+ * double-quoted. Only identifiers change: brackets inside a string literal are data.
+ */
+import { describe, it, expect } from 'vitest';
+import { TranslateBracketsToPG } from '../postgresqlCompat.js';
+
+describe('TranslateBracketsToPG', () => {
+    it('turns bracket-quoted identifiers into double-quoted ones', () => {
+        expect(TranslateBracketsToPG('SELECT [ID], [Name] FROM [__mj].[vwUsers]')).toBe('SELECT "ID", "Name" FROM "__mj"."vwUsers"');
+    });
+
+    it('leaves brackets inside a string literal alone', () => {
+        expect(TranslateBracketsToPG("SELECT [ID] FROM [t] WHERE [Note] = '[draft] copy'")).toBe(`SELECT "ID" FROM "t" WHERE "Note" = '[draft] copy'`);
+    });
+
+    it('unescapes ]] and escapes a double quote in the name', () => {
+        expect(TranslateBracketsToPG('SELECT [a]]b], [say "hi"] FROM t')).toBe('SELECT "a]b", "say ""hi""" FROM t');
+    });
+});

package/src/agentSessions/SessionManager.ts

@@ -8,6 +8,7 @@ import { AIAgentPermissionHelper } from '@memberjunction/ai-engine-base';
 import { RealtimeClientSessionService, RealtimeChannelServerHost } from '@memberjunction/ai-agents';
 import { GetHostInstanceID } from './HostInstance.js';
 import { writeReturningVisitorRecap } from './ReturningVisitorRecap.js';
+import { SessionRunIDVerifier, SessionRunIDs } from './SessionRunIDVerifier.js';
 import { ResolveScopedAnonymousRunUser } from '../realtimeWidget/widgetGuestElevation.js';
 
 /** Entity names — centralised so the `MJ:`-prefix convention is applied in exactly one place. */
@@ -15,18 +16,6 @@ const SESSION_ENTITY = 'MJ: AI Agent Sessions';
 const SESSION_CHANNEL_ENTITY = 'MJ: AI Agent Session Channels';
 const CONVERSATION_ENTITY = 'MJ: Conversations';
 
-/**
- * Shape of the observability run ids a realtime voice session persists in `AIAgentSession.Config_`.
- * Read on {@link SessionManager.CloseSession} to finalize the co-agent runs. All fields optional —
- * a non-voice session (or one whose run creation was skipped) carries none of them.
- */
-interface SessionRunConfig {
-    coAgentRunID?: string;
-    promptRunID?: string;
-    /** The co-agent run's single system-prompt `MJ: AI Agent Run Steps` row id (its Timeline entry). */
-    coAgentRunStepID?: string;
-}
-
 /**
  * Inputs for {@link SessionManager.CreateSession}. `conversationID`/`lastSessionID`/`config`
  * are optional — when no `conversationID` is supplied a fresh Conversation is created and linked.
@@ -96,6 +85,9 @@ export class SessionManager {
     /** session ID (lowercased) → epoch ms of its last persisted `LastActiveAt` write. */
     private heartbeatLastWrite = new Map<string, number>();
 
+    /** Checks the run ids read from a session's owner-editable `Config_` before they are used. */
+    private readonly runIDVerifier = new SessionRunIDVerifier();
+
     /**
      * Authorize and create a new session. Flow:
      * 1. `CanRun` check on the agent — denied → {@link SessionAuthorizationError}, no row written.
@@ -218,7 +210,8 @@ export class SessionManager {
 
     /**
      * Finalizes the co-agent observability runs a realtime voice session stored in its `Config_`
-     * (see `RealtimeClientSessionResolver`). No-op when the config carries no run ids. Tolerant: a
+     * (see `RealtimeClientSessionResolver`). Only run ids that are records of the session are
+     * finalized, because the owner can edit `Config_`. No-op when none remain. Tolerant: a
      * malformed config or a finalize failure is swallowed so it can never break session close.
      */
     private async finalizeObservabilityRuns(
@@ -226,8 +219,8 @@ export class SessionManager {
         contextUser: UserInfo,
         provider: IMetadataProvider,
     ): Promise<void> {
-        const config = this.parseSessionRunConfig(session.Config_);
-        if (!config.coAgentRunID && !config.promptRunID && !config.coAgentRunStepID) {
+        const claimed = this.parseSessionRunConfig(session.Config_);
+        if (!claimed.CoAgentRunID && !claimed.PromptRunID && !claimed.CoAgentRunStepID) {
             return;
         }
         try {
@@ -235,36 +228,42 @@ export class SessionManager {
             // for a scoped anonymous session, so an owner-initiated (or error) close must finalize
             // under it too — the caller's role holds no grants on the AI run entities. Janitor and
             // shutdown sweeps already close as the system user and pass through unchanged.
+            const runUser = ResolveScopedAnonymousRunUser(contextUser);
+            const runIDs = await this.runIDVerifier.Verify(session.ID, claimed, runUser, provider);
+            if (!runIDs.CoAgentRunID && !runIDs.PromptRunID && !runIDs.CoAgentRunStepID) {
+                return;
+            }
             await new RealtimeClientSessionService().FinalizeCoAgentRun(
-                config.coAgentRunID ?? null,
-                config.promptRunID ?? null,
-                ResolveScopedAnonymousRunUser(contextUser),
+                runIDs.CoAgentRunID ?? null,
+                runIDs.PromptRunID ?? null,
+                runUser,
                 provider,
                 true,
-                config.coAgentRunStepID ?? null,
+                runIDs.CoAgentRunStepID ?? null,
             );
         } catch (e) {
             LogError(`SessionManager.finalizeObservabilityRuns failed: ${e instanceof Error ? e.message : String(e)}`);
         }
     }
 
-    /** Parses the session's `Config_` for observability run ids; returns an empty config on any error. */
-    private parseSessionRunConfig(raw: string | null): SessionRunConfig {
+    /** Parses the session's `Config_` for observability run ids; returns none on any error. */
+    private parseSessionRunConfig(raw: string | null): SessionRunIDs {
         if (!raw) {
             return {};
         }
         try {
-            const parsed = JSON.parse(raw) as Partial<SessionRunConfig>;
+            const parsed = JSON.parse(raw) as { coAgentRunID?: unknown; promptRunID?: unknown; coAgentRunStepID?: unknown };
             return {
-                coAgentRunID: typeof parsed.coAgentRunID === 'string' ? parsed.coAgentRunID : undefined,
-                promptRunID: typeof parsed.promptRunID === 'string' ? parsed.promptRunID : undefined,
-                coAgentRunStepID: typeof parsed.coAgentRunStepID === 'string' ? parsed.coAgentRunStepID : undefined,
+                CoAgentRunID: typeof parsed.coAgentRunID === 'string' ? parsed.coAgentRunID : undefined,
+                PromptRunID: typeof parsed.promptRunID === 'string' ? parsed.promptRunID : undefined,
+                CoAgentRunStepID: typeof parsed.coAgentRunStepID === 'string' ? parsed.coAgentRunStepID : undefined,
             };
         } catch {
             return {};
         }
     }
 
+
     /**
      * Record activity on a session. Coalesces persisted writes so at most one `LastActiveAt` update
      * lands per session per {@link HEARTBEAT_MIN_WRITE_INTERVAL_MS}; intervening calls return `true`