@memberjunction/server 6.1.0-edge.0 → 6.1.0-edge.2

package/src/__tests__/TaskGraphContinuationDeliverer.test.ts

@@ -0,0 +1,249 @@
+/**
+ * Tests for `TaskGraphContinuationDeliverer`.
+ *
+ * The gap this closes: the dispatcher was constructed with no deliverer at all, so a graph that
+ * finished logged its outcome, marked itself delivered, and said nothing to the conversation that
+ * asked for it — durable execution nobody hears about.
+ *
+ * The contract that matters most is that it **never throws**. The dispatcher calls this inside the
+ * compare-and-swap that marks a completion delivered; an escaping error would either abort that
+ * guard or leave the graph looking undelivered and re-notifying on every later sweep.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+vi.mock('@memberjunction/core', () => ({
+    LogError: vi.fn(),
+    LogStatus: vi.fn(),
+}));
+
+vi.mock('@memberjunction/core-entities', () => ({
+    MJConversationDetailEntity: class {},
+    MJAIAgentRunEntity: class {},
+}));
+
+vi.mock('@memberjunction/ai-core-plus', () => ({ MJAIAgentEntityExtended: class {} }));
+vi.mock('@memberjunction/ai', () => ({ ChatMessageRole: { user: 'user' } }));
+
+const runAgent = vi.fn().mockResolvedValue({ success: true });
+vi.mock('@memberjunction/ai-agents', () => ({
+    AgentRunner: class { RunAgent = runAgent; },
+}));
+
+import { TaskGraphContinuationDeliverer } from '../services/TaskGraphContinuationDeliverer';
+import type { TaskContinuationParams } from '@memberjunction/task-graph';
+import type { UserInfo } from '@memberjunction/core';
+
+/** A conversation-detail row that can be loaded (the source) and saved (the reply). */
+function detailRow(over: Partial<{ loads: boolean; saves: boolean; conversationID: string }> = {}) {
+    const { loads = true, saves = true, conversationID = 'conv-1' } = over;
+    return {
+        ConversationID: conversationID,
+        Role: '', Status: '', HiddenToUser: true, Message: '',
+        NewRecord: vi.fn(),
+        Load: vi.fn().mockResolvedValue(loads),
+        Save: vi.fn().mockResolvedValue(saves),
+        LatestResult: { CompleteMessage: 'FK violation' },
+    };
+}
+
+function harness(over: Parameters<typeof detailRow>[0] = {}) {
+    const rows: ReturnType<typeof detailRow>[] = [];
+    const provider = {
+        GetEntityObject: vi.fn().mockImplementation(async () => {
+            const row = detailRow(over);
+            rows.push(row);
+            return row;
+        }),
+    };
+    const providerFactory = { CreateProvider: vi.fn().mockResolvedValue(provider) };
+    const deliverer = new TaskGraphContinuationDeliverer(
+        providerFactory as never,
+        { ID: 'user-1' } as UserInfo,
+    );
+    // First row is the source detail (Load), second is the reply (Save).
+    return { deliverer, providerFactory, provider, rows, reply: () => rows[1] };
+}
+
+const params = (over: Partial<TaskContinuationParams> = {}): TaskContinuationParams => ({
+    ParentTaskID: 'parent-1',
+    WorkflowName: 'Weekly digest',
+    ConversationDetailID: 'detail-1',
+    SubmittedByAgentRunID: 'run-1',
+    ReinvokeDepth: 0,
+    Tasks: [
+        { TaskID: 't1', Name: 'Gather', Status: 'Complete', Summary: '412 rows' },
+        { TaskID: 't2', Name: 'Summarize', Status: 'Complete' },
+    ],
+    Summary: '2 of 2 steps completed.',
+    ...over,
+});
+
+beforeEach(() => vi.clearAllMocks());
+
+describe('posting the outcome', () => {
+    it('writes an AI-role message into the graph\'s conversation', async () => {
+        const h = harness();
+        await h.deliverer.PostMessage(params());
+
+        const reply = h.reply();
+        expect(reply.Save).toHaveBeenCalled();
+        expect(reply.ConversationID).toBe('conv-1');
+        expect(reply.Role).toBe('AI');
+        expect(reply.Status).toBe('Complete');
+        expect(reply.HiddenToUser).toBe(false);
+    });
+
+    it('names the workflow and carries the roll-up', async () => {
+        const h = harness();
+        await h.deliverer.PostMessage(params());
+        expect(h.reply().Message).toContain('Weekly digest');
+        expect(h.reply().Message).toContain('2 of 2 steps completed.');
+    });
+
+    it('lists each step, not just an aggregate status', async () => {
+        // A graph where nine of ten steps succeeded is a materially different message from one that
+        // failed outright, and the roll-up alone cannot say which step went wrong.
+        const h = harness();
+        await h.deliverer.PostMessage(params({
+            Tasks: [
+                { TaskID: 't1', Name: 'Gather', Status: 'Complete', Summary: '412 rows' },
+                { TaskID: 't2', Name: 'Summarize', Status: 'Failed', ErrorMessage: 'model timed out' },
+            ],
+        }));
+        const message = h.reply().Message;
+        expect(message).toContain('Gather');
+        expect(message).toContain('412 rows');
+        expect(message).toContain('Summarize');
+        expect(message).toContain('model timed out');
+    });
+
+    it('truncates a long graph rather than burying the conversation', async () => {
+        const h = harness();
+        const many = Array.from({ length: 50 }, (_, i) => ({ TaskID: `t${i}`, Name: `Step ${i}`, Status: 'Complete' }));
+        await h.deliverer.PostMessage(params({ Tasks: many }));
+
+        const message = h.reply().Message;
+        expect(message).toContain('Step 0');
+        expect(message).not.toContain('Step 49');
+        // The count is stated rather than silently dropped — the task rows remain the full record.
+        expect(message).toContain('30 more');
+    });
+
+    it('mints a fresh provider per delivery', async () => {
+        // Deliveries run outside any request and concurrently with task execution; a shared provider
+        // would share one transaction scope across unrelated work.
+        const h = harness();
+        await h.deliverer.PostMessage(params());
+        expect(h.providerFactory.CreateProvider).toHaveBeenCalledTimes(1);
+    });
+});
+
+describe('it never throws — the dispatcher marks delivery inside a CAS guard', () => {
+    it('does nothing for a headless graph, without treating it as an error', async () => {
+        // A graph submitted by a schedule, an entity-change trigger or an API call has no
+        // conversation to answer. Most workflows are in this shape.
+        const h = harness();
+        await expect(h.deliverer.PostMessage(params({ ConversationDetailID: null }))).resolves.toBeUndefined();
+        expect(h.providerFactory.CreateProvider).not.toHaveBeenCalled();
+    });
+
+    it('survives a conversation detail that will not load', async () => {
+        const h = harness({ loads: false });
+        await expect(h.deliverer.PostMessage(params())).resolves.toBeUndefined();
+        expect(h.rows.length).toBe(1); // never got as far as building a reply
+    });
+
+    it('survives a failed save', async () => {
+        const h = harness({ saves: false });
+        await expect(h.deliverer.PostMessage(params())).resolves.toBeUndefined();
+    });
+
+    it('survives a provider that throws outright', async () => {
+        const deliverer = new TaskGraphContinuationDeliverer(
+            { CreateProvider: vi.fn().mockRejectedValue(new Error('pool exhausted')) } as never,
+            { ID: 'user-1' } as UserInfo,
+        );
+        await expect(deliverer.PostMessage(params())).resolves.toBeUndefined();
+    });
+});
+
+describe('Reinvoke — restarting the submitting agent', () => {
+    /** A provider that hands out loadable agent-run and agent rows, then the reply detail. */
+    function reinvokeHarness(over: { runLoads?: boolean; agentLoads?: boolean } = {}) {
+        const { runLoads = true, agentLoads = true } = over;
+        const rows: Array<Record<string, unknown>> = [];
+        let call = 0;
+        const provider = {
+            GetEntityObject: vi.fn().mockImplementation(async () => {
+                call++;
+                if (call === 1) {
+                    const run = { AgentID: 'agent-1', Load: vi.fn().mockResolvedValue(runLoads) };
+                    rows.push(run);
+                    return run;
+                }
+                if (call === 2) {
+                    const agent = { ID: 'agent-1', Load: vi.fn().mockResolvedValue(agentLoads) };
+                    rows.push(agent);
+                    return agent;
+                }
+                const detail = detailRow();
+                rows.push(detail as unknown as Record<string, unknown>);
+                return detail;
+            }),
+        };
+        const deliverer = new TaskGraphContinuationDeliverer(
+            { CreateProvider: vi.fn().mockResolvedValue(provider) } as never,
+            { ID: 'user-1' } as UserInfo,
+        );
+        return { deliverer, provider, rows };
+    }
+
+    it('starts the submitting agent a fresh turn carrying the outcome', async () => {
+        const h = reinvokeHarness();
+        await h.deliverer.Reinvoke(params());
+
+        expect(runAgent).toHaveBeenCalledTimes(1);
+        const call = runAgent.mock.calls[0][0];
+        expect(call.agent.ID).toBe('agent-1');
+        expect(call.conversationMessages[0].content).toContain('Weekly digest');
+    });
+
+    it('stamps depth + 1 — the value that makes MAX_REINVOKE_DEPTH real', async () => {
+        // Without this the next graph the restarted run submits begins the chain at zero again, and
+        // the cap can never fire. It is the whole reason ContinuationDepth exists as a column.
+        const h = reinvokeHarness();
+        await h.deliverer.Reinvoke(params({ ReinvokeDepth: 3 }));
+        expect(runAgent.mock.calls[0][0].continuationDepth).toBe(4);
+    });
+
+    it('starts a chain at 1, not 0 — depth 0 is "not a continuation"', async () => {
+        const h = reinvokeHarness();
+        await h.deliverer.Reinvoke(params({ ReinvokeDepth: 0 }));
+        expect(runAgent.mock.calls[0][0].continuationDepth).toBe(1);
+    });
+
+    it('falls back to posting when the graph records no submitting run', async () => {
+        // A schedule- or trigger-started graph has no turn to continue.
+        const h = reinvokeHarness();
+        await h.deliverer.Reinvoke(params({ SubmittedByAgentRunID: null }));
+        expect(runAgent).not.toHaveBeenCalled();
+    });
+
+    it('falls back to posting when the submitting run cannot be loaded', async () => {
+        const h = reinvokeHarness({ runLoads: false });
+        await h.deliverer.Reinvoke(params());
+        expect(runAgent).not.toHaveBeenCalled();
+    });
+
+    it('falls back to posting when the agent cannot be loaded', async () => {
+        const h = reinvokeHarness({ agentLoads: false });
+        await h.deliverer.Reinvoke(params());
+        expect(runAgent).not.toHaveBeenCalled();
+    });
+
+    it('never throws — the dispatcher marks delivery inside a CAS guard', async () => {
+        runAgent.mockRejectedValueOnce(new Error('agent exploded'));
+        const h = reinvokeHarness();
+        await expect(h.deliverer.Reinvoke(params())).resolves.toBeUndefined();
+    });
+});

package/src/__tests__/TaskGraphFrameResolver.test.ts

@@ -0,0 +1,136 @@
+/**
+ * Tests for the task-graph live signal.
+ *
+ * `taskGraphFrameFilter` is the security-critical gate and is tested in isolation for the same
+ * reason `statusUpdatesFilter` is: a `parentTaskId` is a discoverable value, so without an identity
+ * check anyone holding one could watch another user's workflow — including its per-step error
+ * messages. It must fail **closed**.
+ *
+ * The broadcaster's contract is that it can never disturb the work it is describing: a frame is
+ * commentary on execution, never a step of it.
+ */
+// type-graphql's decorators evaluate at module load, and they need the metadata polyfill. Without
+// this the file fails to COLLECT — which vitest reports as zero tests rather than as a failure.
+import 'reflect-metadata';
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+vi.mock('@memberjunction/core', () => ({ LogError: vi.fn() }));
+
+import {
+    TASK_GRAPH_FRAMES_TOPIC,
+    TaskGraphFrameBroadcaster,
+    taskGraphFrameFilter,
+    type TaskGraphFramePayload,
+} from '../resolvers/TaskGraphFrameResolver';
+import type { TaskGraphFrame } from '@memberjunction/task-graph';
+import type { PubSubEngine } from 'type-graphql';
+
+const OWNER = '11111111-1111-1111-1111-111111111111';
+const OTHER = '22222222-2222-2222-2222-222222222222';
+const GRAPH = '33333333-3333-3333-3333-333333333333';
+
+const payload = (over: Partial<TaskGraphFramePayload> = {}): TaskGraphFramePayload => ({
+    Kind: 'TaskCompleted',
+    ParentTaskID: GRAPH,
+    TaskID: 'task-1',
+    TaskName: 'Summarize',
+    Status: 'Complete',
+    ownerUserId: OWNER,
+    ...over,
+});
+
+// `null` rather than `undefined` for "no identity": passing `undefined` explicitly triggers a
+// default parameter, so the case would silently test the opposite of what it claims.
+const context = (userId: string | null) => (userId ? { userPayload: { userRecord: { ID: userId } } } : {});
+
+const check = (over: Partial<TaskGraphFramePayload> = {}, args = GRAPH, userId: string | null = OWNER) =>
+    taskGraphFrameFilter({ payload: payload(over), args: { parentTaskId: args }, context: context(userId) });
+
+describe('taskGraphFrameFilter — the delivery gate', () => {
+    it('delivers a frame for the watched graph to its owner', () => {
+        expect(check()).toBe(true);
+    });
+
+    it('matches graph IDs case-insensitively — UUID casing varies by source', () => {
+        expect(check({}, GRAPH.toUpperCase())).toBe(true);
+    });
+
+    it('does NOT deliver frames from another graph', () => {
+        expect(check({ ParentTaskID: '44444444-4444-4444-4444-444444444444' })).toBe(false);
+    });
+
+    it('does NOT deliver another user\'s workflow to a subscriber holding its ID', () => {
+        // The whole reason identity is checked: parentTaskId is discoverable, and the frames carry
+        // per-step error messages.
+        expect(check({}, GRAPH, OTHER)).toBe(false);
+    });
+
+    it('fails closed when the connection has no identity', () => {
+        expect(check({}, GRAPH, null)).toBe(false);
+    });
+
+    it('fails closed when the frame has no owner', () => {
+        expect(check({ ownerUserId: '' as unknown as string })).toBe(false);
+    });
+
+    it('fails closed on a missing graph ID on either side', () => {
+        expect(check({ ParentTaskID: '' })).toBe(false);
+        expect(check({}, '')).toBe(false);
+    });
+});
+
+describe('TaskGraphFrameBroadcaster', () => {
+    let published: Array<[string, unknown]>;
+    let pubSub: PubSubEngine;
+
+    beforeEach(() => {
+        published = [];
+        pubSub = {
+            publish: vi.fn().mockImplementation(async (topic: string, p: unknown) => { published.push([topic, p]); }),
+        } as unknown as PubSubEngine;
+    });
+
+    const frame = (over: Partial<TaskGraphFrame> = {}): TaskGraphFrame => ({
+        Kind: 'TaskStarted', ParentTaskID: GRAPH, OwnerUserID: OWNER, TaskID: 'task-1', TaskName: 'Gather', ...over,
+    });
+
+    it('publishes the frame with the owner attached as the filter key', () => {
+        new TaskGraphFrameBroadcaster(pubSub).OnFrame(frame());
+
+        expect(published).toHaveLength(1);
+        const [topic, p] = published[0];
+        expect(topic).toBe(TASK_GRAPH_FRAMES_TOPIC);
+        expect((p as TaskGraphFramePayload).ownerUserId).toBe(OWNER);
+        expect((p as TaskGraphFramePayload).Kind).toBe('TaskStarted');
+    });
+
+    it('drops a frame with no owner rather than publishing one the filter would refuse', () => {
+        // Reachable for graphs submitted before ownership was recorded on the parent.
+        new TaskGraphFrameBroadcaster(pubSub).OnFrame(frame({ OwnerUserID: null }));
+        expect(published).toHaveLength(0);
+    });
+
+    it('never throws when publishing fails — a frame must not disturb the work it describes', () => {
+        const exploding = { publish: vi.fn(() => { throw new Error('pubsub down'); }) } as unknown as PubSubEngine;
+        expect(() => new TaskGraphFrameBroadcaster(exploding).OnFrame(frame())).not.toThrow();
+    });
+
+    it('carries the whole frame through, so a viewer can render without re-reading rows', () => {
+        new TaskGraphFrameBroadcaster(pubSub).OnFrame(
+            frame({ Kind: 'TaskFailed', Status: 'Failed', ErrorMessage: 'model timed out' }),
+        );
+        const p = published[0][1] as TaskGraphFramePayload;
+        expect(p.Status).toBe('Failed');
+        expect(p.ErrorMessage).toBe('model timed out');
+        expect(p.TaskName).toBe('Gather');
+    });
+
+    it('carries graph-level progress on a settled frame', () => {
+        new TaskGraphFrameBroadcaster(pubSub).OnFrame(
+            frame({ Kind: 'GraphSettled', TaskID: undefined, Status: 'Complete', CompletedCount: 7, TotalCount: 7 }),
+        );
+        const p = published[0][1] as TaskGraphFramePayload;
+        expect(p.CompletedCount).toBe(7);
+        expect(p.TotalCount).toBe(7);
+    });
+});

package/src/__tests__/WidgetSessionService.test.ts

@@ -8,7 +8,7 @@ import { describe, it, expect, vi } from 'vitest';
 vi.mock('../config.js', () => ({
   configInfo: {},
 }));
-vi.mock('@memberjunction/sqlserver-dataprovider', () => ({
+vi.mock('@memberjunction/generic-database-provider', () => ({
   UserCache: {
     Instance: { Users: [], UserByName: () => undefined, GetSystemUser: () => undefined },
     Users: [],

package/src/__tests__/databaseAbstraction.test.ts

@@ -100,6 +100,7 @@ vi.mock('@memberjunction/core', () => ({
 // Inline the actual implementation here so the env-var-handling tests below
 // exercise the genuine behavior (they're testing this function).
 vi.mock('@memberjunction/generic-database-provider', () => ({
+  UserCache: { Instance: { Users: [], GetSystemUser: vi.fn() } },
   resolveDbPlatformFromEnv: (envVarName: string = 'DB_PLATFORM'): 'sqlserver' | 'postgresql' | undefined => {
     const raw = process.env[envVarName];
     if (raw === undefined) return undefined;
@@ -117,7 +118,6 @@ vi.mock('@memberjunction/sqlserver-dataprovider', () => ({
   SQLServerDataProvider: vi.fn(),
   SQLServerProviderConfigData: vi.fn(),
   setupSQLServerClient: vi.fn(),
-  UserCache: { Instance: { Users: [], GetSystemUser: vi.fn() } },
 }));
 
 vi.mock('@memberjunction/api-keys', () => ({

package/src/__tests__/magicLinkService.provisionLog.test.ts

@@ -4,7 +4,7 @@ import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 // data-provider and communication stacks in at module load. Stub those out;
 // this suite only exercises provisioning's console-log behavior, so
 // @memberjunction/core (the logging implementation) stays real.
-vi.mock('@memberjunction/sqlserver-dataprovider', () => ({
+vi.mock('@memberjunction/generic-database-provider', () => ({
   UserCache: { Instance: { Users: [] } },
 }));
 vi.mock('@memberjunction/communication-engine', () => ({

package/src/__tests__/resolverBase.rls.test.ts

@@ -16,6 +16,9 @@ const { mockUserCacheUsers } = vi.hoisted(() => ({
 // Stub external deps before imports
 vi.mock('@memberjunction/sqlserver-dataprovider', () => ({
     SQLServerDataProvider: class {},
+}));
+
+vi.mock('@memberjunction/generic-database-provider', () => ({
     UserCache: {
         get Users() { return mockUserCacheUsers; },
     },

package/src/__tests__/secretRedactor.failOpen.test.ts

@@ -0,0 +1,135 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import type { IMetadataProvider } from '@memberjunction/core';
+import { redactArg, ResetUnboundCrudInputWarnings } from '../logging/secretRedactor.js';
+
+/**
+ * `redactArg` binds a GraphQL input type to an entity by NAME:
+ *
+ * ```ts
+ * const match = /^(Create|Update|Delete)(?<name>.+)Input$/.exec(inputTypeName);
+ * const entity = provider.Entities.find((e) => e.ClassName === match.groups.name);
+ * ```
+ *
+ * Codegen inputs embed the entity ClassName (`CreateMJCredentialInput` → `MJCredential`)
+ * so the lookup succeeds. Hand-written resolver inputs do not (`CreateConnectionInput`
+ * → `Connection`, which is no entity), so the lookup fails, no encrypted-field names
+ * are contributed, and the arg falls through to `shortenForLog` with values intact.
+ *
+ * The boot audit tests only the NAME pattern, so it classifies these as metadata-bound
+ * and stays silent — the reason the gap went unnoticed. These tests pin both the
+ * fail-open behaviour and the warning that now surfaces it.
+ */
+
+const SECRET = 'sk-live-CREDENTIAL-PAYLOAD';
+
+/** Minimal provider exposing one entity with one encrypted column. */
+function providerWith(entities: { ClassName: string; EncryptedFields: { Name: string }[] }[]): IMetadataProvider {
+    return { Entities: entities } as unknown as IMetadataProvider;
+}
+
+const CREDENTIAL_ENTITY = providerWith([
+    { ClassName: 'MJCredential', EncryptedFields: [{ Name: 'Values' }] },
+]);
+
+beforeEach(() => {
+    ResetUnboundCrudInputWarnings();
+    vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+});
+
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+
+describe('redactArg — entity-bound inputs (the codegen case)', () => {
+    it('redacts an encrypted column, keeping the rest', () => {
+        const out = redactArg({
+            inputTypeName: 'CreateMJCredentialInput',
+            rawValue: { Name: 'Stripe', Values: SECRET },
+            provider: CREDENTIAL_ENTITY,
+            noLogParameter: false,
+            noLogFields: new Set(),
+        }) as Record<string, unknown>;
+
+        expect(out.Values).toBe('<redacted>');
+        expect(out.Name).toBe('Stripe');
+    });
+
+    it('emits no warning, because the binding resolved', () => {
+        redactArg({
+            inputTypeName: 'CreateMJCredentialInput',
+            rawValue: { Values: SECRET },
+            provider: CREDENTIAL_ENTITY,
+            noLogParameter: false,
+            noLogFields: new Set(),
+        });
+        expect(console.warn).not.toHaveBeenCalled();
+    });
+});
+
+describe('redactArg — name matches the convention but no entity exists', () => {
+    const unbound = {
+        inputTypeName: 'CreateConnectionInput',
+        rawValue: { CredentialName: 'acme', CredentialValues: SECRET },
+        provider: CREDENTIAL_ENTITY,
+        noLogParameter: false,
+        noLogFields: new Set<string>(),
+    };
+
+    it('falls open — values are logged, which is the defect being surfaced', () => {
+        const out = redactArg({ ...unbound });
+        // Documents current behaviour: no entity binding and no @NoLog means no
+        // redaction source, so the value survives into the log.
+        expect(JSON.stringify(out)).toContain(SECRET);
+    });
+
+    it('now warns, naming the input type and what to do about it', () => {
+        redactArg({ ...unbound });
+
+        expect(console.warn).toHaveBeenCalledTimes(1);
+        const message = vi.mocked(console.warn).mock.calls[0][0] as string;
+        expect(message).toContain('CreateConnectionInput');
+        expect(message).toContain('@NoLog');
+        // The warning itself must not become a second leak.
+        expect(message).not.toContain(SECRET);
+    });
+
+    it('warns only once per input type, however hot the mutation is', () => {
+        redactArg({ ...unbound });
+        redactArg({ ...unbound });
+        redactArg({ ...unbound });
+        expect(console.warn).toHaveBeenCalledTimes(1);
+    });
+
+    it('warns separately for a different unbound input type', () => {
+        redactArg({ ...unbound });
+        redactArg({ ...unbound, inputTypeName: 'CreateScheduleInput' });
+        expect(console.warn).toHaveBeenCalledTimes(2);
+    });
+});
+
+describe('redactArg — @NoLog closes the gap the metadata cannot', () => {
+    it('redacts a marked field on an input with no entity binding', () => {
+        const out = redactArg({
+            inputTypeName: 'CreateConnectionInput',
+            rawValue: { CredentialName: 'acme', CredentialValues: SECRET },
+            provider: CREDENTIAL_ENTITY,
+            noLogParameter: false,
+            noLogFields: new Set(['CredentialValues']),
+        }) as Record<string, unknown>;
+
+        expect(out.CredentialValues).toBe('<redacted>');
+        expect(out.CredentialName).toBe('acme');
+        expect(JSON.stringify(out)).not.toContain(SECRET);
+    });
+
+    it('a parameter-level mark redacts the whole arg regardless of binding', () => {
+        const out = redactArg({
+            inputTypeName: 'CreateConnectionInput',
+            rawValue: { CredentialValues: SECRET },
+            provider: CREDENTIAL_ENTITY,
+            noLogParameter: true,
+            noLogFields: new Set(),
+        });
+        expect(out).toBe('<redacted>');
+    });
+});

package/src/__tests__/widgetGuestElevation.test.ts

@@ -4,7 +4,7 @@ import type { DatabaseProviderBase, UserInfo } from '@memberjunction/core';
 // Controls what UserCache.Instance.GetSystemUser() serves — undefined simulates an unpopulated
 // cache (no system user available), the fail-closed path.
 const getSystemUserMock = vi.fn<[], UserInfo | undefined>();
-vi.mock('@memberjunction/sqlserver-dataprovider', () => ({
+vi.mock('@memberjunction/generic-database-provider', () => ({
   UserCache: {
     get Instance() {
       return { GetSystemUser: getSystemUserMock };

package/src/auth/exampleNewUserSubClass.ts

@@ -1,7 +1,7 @@
 import { RegisterClass } from '@memberjunction/global';
 import { Metadata, RunView, LogError, EntitySaveOptions } from '@memberjunction/core';
 import { NewUserBase } from './newUsers.js';
-import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { UserCache } from '@memberjunction/generic-database-provider';
 import { configInfo } from '../config.js';
 import { MJUserEntity } from '@memberjunction/core-entities';
 

package/src/auth/index.ts

@@ -1,8 +1,8 @@
 import { JwtHeader, SigningKeyCallback, JwtPayload } from 'jsonwebtoken';
 import { configInfo } from '../config.js';
-import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { UserCache } from '@memberjunction/generic-database-provider';
 import sql from 'mssql';
-import { Metadata, RoleInfo, UserInfo } from '@memberjunction/core';
+import { DatabaseProviderBase, Metadata, RoleInfo, UserInfo } from '@memberjunction/core';
 import { NewUserBase } from './newUsers.js';
 import { MJGlobal } from '@memberjunction/global';
 import { MJUserEntity, MJUserEntityType } from '@memberjunction/core-entities';
@@ -21,9 +21,13 @@ class MissingAuthError extends Error {
   }
 }
 
-const refreshUserCache = async (dataSource?: sql.ConnectionPool) => {
+const refreshUserCache = async () => {
   const startTime: number = Date.now();
-  await UserCache.Instance.Refresh(dataSource);
+  // UserCache is process-global in this phase, and so is the provider MJServer configures at
+  // bootstrap — the callers below only hold a ConnectionPool, which they use purely as a
+  // "the database is reachable" gate before asking for a refresh.
+  const provider = Metadata.Provider as unknown as DatabaseProviderBase; // global-provider-ok: server auth path; runs under the server's single default provider
+  await UserCache.Instance.Refresh(provider);
   const endTime: number = Date.now();
   const elapsed: number = endTime - startTime;
 
@@ -179,7 +183,7 @@ export const getSystemUser = async (dataSource?: sql.ConnectionPool, attemptCach
     if (dataSource && attemptCacheUpdateIfNeeded) {
       console.warn(`System user not found in cache. Updating cache in attempt to find the user...`);
 
-      await refreshUserCache(dataSource);
+      await refreshUserCache();
       return getSystemUser(dataSource, false); // try one more time but do not update cache next time if not found
     }
     throw new Error(`System user ID '${UserCache.Instance.SYSTEM_USER_ID}' not found in database`);
@@ -260,7 +264,7 @@ export const verifyUserRecord = async (
       // if we get here that means in the above, if we were attempting to create a new user, it did not work, or it wasn't attempted and we have a config that asks us to auto update the cache
       console.warn(`User ${email} not found in cache. Updating cache in attempt to find the user...`);
 
-      await refreshUserCache(dataSource);
+      await refreshUserCache();
 
       return verifyUserRecord(email, firstName, lastName, requestDomain, dataSource, false); // try one more time but do not update cache next time if not found
     }

package/src/auth/magicLink/MagicLinkService.ts

@@ -29,7 +29,7 @@ import {
   type MJUserEntityType,
   type MJApplicationRoleEntity,
 } from '@memberjunction/core-entities';
-import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { UserCache } from '@memberjunction/generic-database-provider';
 import { CommunicationEngine } from '@memberjunction/communication-engine';
 import { Message } from '@memberjunction/communication-types';
 import { configInfo, type MagicLinkConfig } from '../../config.js';

package/src/auth/newUsers.ts

@@ -1,6 +1,6 @@
 import { ApplicationInfo, DatabaseProviderBase, EntitySaveOptions, LogError, LogStatus, Metadata, RunView, RunViewResult, UserInfo } from "@memberjunction/core";
 import { RegisterClass } from "@memberjunction/global";
-import { UserCache } from "@memberjunction/sqlserver-dataprovider";
+import { UserCache } from "@memberjunction/generic-database-provider";
 import { configInfo } from "../config.js";
 import { MJUserEntity, MJUserRoleEntity, MJUserApplicationEntity, MJUserApplicationEntityEntity, MJApplicationEntityType, MJApplicationEntityEntityType, UserInfoEngine } from "@memberjunction/core-entities";
 

package/src/context.ts

@@ -19,10 +19,10 @@ import { v4 as uuidv4 } from 'uuid';
 import e from 'express';
 import type { RequestHandler, Request, Response, NextFunction } from 'express';
 import { DatabaseProviderBase, UserInfo, type MagicLinkScope, type ReturningVisitorContext, type WidgetGuestContext } from '@memberjunction/core';
-import { SQLServerDataProvider, SQLServerProviderConfigData, UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { SQLServerDataProvider, SQLServerProviderConfigData } from '@memberjunction/sqlserver-dataprovider';
 import { Metadata } from '@memberjunction/core';
 import { UUIDsEqual } from '@memberjunction/global';
-import { resolveDbPlatformFromEnv } from '@memberjunction/generic-database-provider';
+import { UserCache, resolveDbPlatformFromEnv } from '@memberjunction/generic-database-provider';
 import { GetAPIKeyEngine } from '@memberjunction/api-keys';
 
 // ── Session / login audit (Phase 3) ───────────────────────────────────────────