@memberjunction/server 6.1.0-edge.2 → 6.1.0-edge.4

package/src/__tests__/EntityCRUDHandler.test.ts

@@ -0,0 +1,378 @@
+/**
+ * Tests for the REST entity CRUD implementation (rest/EntityCRUDHandler.ts).
+ *
+ * Verifies for every verb (create / read / update / delete):
+ *  - permission enforcement happens BEFORE any load or mutation,
+ *  - all mutations go through the BaseEntity object path (the entity returned
+ *    by Metadata.GetEntityObject — NewRecord/Set/Validate/Save/Delete), never
+ *    around it,
+ *  - input validation (entity validation errors, save-option extraction,
+ *    composite-key construction) and every error branch.
+ *
+ * The package boundary mocked is @memberjunction/core's Metadata; the real
+ * CompositeKey / EntitySaveOptions / EntityDeleteOptions / EntityPermissionType
+ * are used so the handler's contracts with them stay honest.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+// ─── Hoisted mocks ──────────────────────────────────────────────────────────
+const { mockGetEntityObject, mockLogError } = vi.hoisted(() => ({
+    mockGetEntityObject: vi.fn(),
+    mockLogError: vi.fn(),
+}));
+
+vi.mock('@memberjunction/core', async (importOriginal) => {
+    const actual = await importOriginal<typeof import('@memberjunction/core')>();
+    class MockMetadata {
+        public GetEntityObject(entityName: string, contextUser?: unknown): Promise<unknown> {
+            return mockGetEntityObject(entityName, contextUser);
+        }
+    }
+    return {
+        ...actual,
+        Metadata: MockMetadata,
+        LogError: mockLogError,
+    };
+});
+
+import {
+    CompositeKey,
+    EntityDeleteOptions,
+    EntityPermissionType,
+    EntitySaveOptions,
+    UserInfo,
+} from '@memberjunction/core';
+import { EntityCRUDHandler } from '../rest/EntityCRUDHandler.js';
+
+// ─── Mock entity ────────────────────────────────────────────────────────────
+
+interface MockEntityConfig {
+    allowed?: EntityPermissionType[];
+    loadSuccess?: boolean;
+    dirty?: boolean;
+    validateSuccess?: boolean;
+    saveSuccess?: boolean;
+    deleteSuccess?: boolean;
+    primaryKeys?: Array<{ Name: string }>;
+}
+
+interface MockEntity {
+    CheckPermissions: ReturnType<typeof vi.fn>;
+    NewRecord: ReturnType<typeof vi.fn>;
+    Set: ReturnType<typeof vi.fn>;
+    Validate: ReturnType<typeof vi.fn>;
+    Save: ReturnType<typeof vi.fn>;
+    Delete: ReturnType<typeof vi.fn>;
+    InnerLoad: ReturnType<typeof vi.fn>;
+    GetDataObject: ReturnType<typeof vi.fn>;
+    Dirty: boolean;
+    LatestResult: { Message: string };
+    EntityInfo: { PrimaryKeys: Array<{ Name: string }> };
+}
+
+const ENTITY_DATA = { ID: 'row-1', Name: 'Loaded Row' };
+
+function makeEntity(config: MockEntityConfig = {}): MockEntity {
+    const allowed = new Set(config.allowed ?? [
+        EntityPermissionType.Create,
+        EntityPermissionType.Read,
+        EntityPermissionType.Update,
+        EntityPermissionType.Delete,
+    ]);
+    return {
+        CheckPermissions: vi.fn((type: EntityPermissionType) => allowed.has(type)),
+        NewRecord: vi.fn(),
+        Set: vi.fn(),
+        Validate: vi.fn(() => ({
+            Success: config.validateSuccess ?? true,
+            Errors: config.validateSuccess === false ? [{ Message: 'Name is required' }] : [],
+        })),
+        Save: vi.fn(async () => config.saveSuccess ?? true),
+        Delete: vi.fn(async () => config.deleteSuccess ?? true),
+        InnerLoad: vi.fn(async () => config.loadSuccess ?? true),
+        GetDataObject: vi.fn(async () => ({ ...ENTITY_DATA })),
+        Dirty: config.dirty ?? true,
+        LatestResult: { Message: 'underlying save/delete failure' },
+        EntityInfo: { PrimaryKeys: config.primaryKeys ?? [{ Name: 'ID' }] },
+    };
+}
+
+function makeUser(): UserInfo {
+    return { ID: 'user-1', Name: 'Testy McTester' } as unknown as UserInfo;
+}
+
+let entity: MockEntity;
+
+beforeEach(() => {
+    vi.clearAllMocks();
+    entity = makeEntity();
+    mockGetEntityObject.mockImplementation(async () => entity);
+});
+
+// ─── createEntity ───────────────────────────────────────────────────────────
+
+describe('EntityCRUDHandler.createEntity', () => {
+    it('resolves the entity object for the requesting user and saves through it (never around it)', async () => {
+        const user = makeUser();
+        const result = await EntityCRUDHandler.createEntity('Customers', { Name: 'Acme' }, user);
+
+        expect(result.success).toBe(true);
+        expect(result.entity).toEqual(ENTITY_DATA);
+        // Entity-object path: acquired via Metadata for THIS user, then mutated via the object
+        expect(mockGetEntityObject).toHaveBeenCalledWith('Customers', user);
+        expect(entity.NewRecord).toHaveBeenCalledTimes(1);
+        expect(entity.Set).toHaveBeenCalledWith('Name', 'Acme');
+        expect(entity.Validate).toHaveBeenCalledTimes(1);
+        expect(entity.Save).toHaveBeenCalledTimes(1);
+        expect(entity.Save.mock.calls[0][0]).toBeInstanceOf(EntitySaveOptions);
+    });
+
+    it('denies without touching the record when the user lacks Create permission', async () => {
+        entity = makeEntity({ allowed: [EntityPermissionType.Read] });
+
+        const result = await EntityCRUDHandler.createEntity('Customers', { Name: 'Acme' }, makeUser());
+
+        expect(result.success).toBe(false);
+        expect(result.error).toBe('User Testy McTester does not have permission to create Customers records');
+        // Permission check must precede ANY mutation of the entity object
+        expect(entity.NewRecord).not.toHaveBeenCalled();
+        expect(entity.Set).not.toHaveBeenCalled();
+        expect(entity.Save).not.toHaveBeenCalled();
+    });
+
+    it('extracts save options from data.options and never writes "options" as a field', async () => {
+        const data: Record<string, unknown> = {
+            Name: 'Acme',
+            options: { IgnoreDirtyState: true, SkipEntityAIActions: 1, ReplayOnly: false },
+        };
+
+        const result = await EntityCRUDHandler.createEntity('Customers', data, makeUser());
+
+        expect(result.success).toBe(true);
+        const savedOptions = entity.Save.mock.calls[0][0] as EntitySaveOptions;
+        expect(savedOptions.IgnoreDirtyState).toBe(true);
+        expect(savedOptions.SkipEntityAIActions).toBe(true); // coerced with !!
+        expect(savedOptions.ReplayOnly).toBe(false);
+        const setKeys = entity.Set.mock.calls.map((call) => call[0] as string);
+        expect(setKeys).toEqual(['Name']); // 'options' was consumed, not persisted
+    });
+
+    it('returns validation errors without calling Save when Validate fails', async () => {
+        entity = makeEntity({ validateSuccess: false });
+
+        const result = await EntityCRUDHandler.createEntity('Customers', { Name: '' }, makeUser());
+
+        expect(result.success).toBe(false);
+        expect(result.error).toBe('Validation failed');
+        expect(result.validationErrors).toEqual([{ Message: 'Name is required' }]);
+        expect(entity.Save).not.toHaveBeenCalled();
+    });
+
+    it('surfaces the entity LatestResult when Save returns false', async () => {
+        entity = makeEntity({ saveSuccess: false });
+
+        const result = await EntityCRUDHandler.createEntity('Customers', { Name: 'Acme' }, makeUser());
+
+        expect(result.success).toBe(false);
+        expect(result.error).toBe('underlying save/delete failure');
+        expect(result.details).toBe(entity.LatestResult);
+    });
+
+    it('catches thrown errors (e.g. unknown entity) and returns them as failures', async () => {
+        mockGetEntityObject.mockRejectedValue(new Error('Entity Nope not found in metadata'));
+
+        const result = await EntityCRUDHandler.createEntity('Nope', {}, makeUser());
+
+        expect(result.success).toBe(false);
+        expect(result.error).toBe('Entity Nope not found in metadata');
+        expect(mockLogError).toHaveBeenCalled();
+    });
+});
+
+// ─── getEntity ──────────────────────────────────────────────────────────────
+
+describe('EntityCRUDHandler.getEntity', () => {
+    it('loads through InnerLoad with a single-PK composite key built from the id', async () => {
+        const result = await EntityCRUDHandler.getEntity('Customers', 42, null, makeUser());
+
+        expect(result.success).toBe(true);
+        expect(result.entity).toEqual(ENTITY_DATA);
+        const [key, related] = entity.InnerLoad.mock.calls[0] as [CompositeKey, string[] | null];
+        expect(key).toBeInstanceOf(CompositeKey);
+        expect(key.KeyValuePairs).toEqual([{ FieldName: 'ID', Value: '42' }]); // numeric id stringified
+        expect(related).toBeNull();
+    });
+
+    it('passes requested related entities through to InnerLoad', async () => {
+        await EntityCRUDHandler.getEntity('Customers', 'row-1', ['Orders', 'Invoices'], makeUser());
+
+        expect(entity.InnerLoad.mock.calls[0][1]).toEqual(['Orders', 'Invoices']);
+    });
+
+    it('denies before loading when the user lacks Read permission', async () => {
+        entity = makeEntity({ allowed: [EntityPermissionType.Create] });
+
+        const result = await EntityCRUDHandler.getEntity('Customers', 'row-1', null, makeUser());
+
+        expect(result.success).toBe(false);
+        expect(result.error).toContain('does not have permission to read Customers');
+        expect(entity.InnerLoad).not.toHaveBeenCalled();
+    });
+
+    it('returns a not-found error when InnerLoad fails', async () => {
+        entity = makeEntity({ loadSuccess: false });
+
+        const result = await EntityCRUDHandler.getEntity('Customers', 'ghost', null, makeUser());
+
+        expect(result.success).toBe(false);
+        expect(result.error).toBe('Customers with ID ghost not found');
+    });
+
+    it('fails cleanly for composite-primary-key entities instead of guessing', async () => {
+        entity = makeEntity({ primaryKeys: [{ Name: 'A' }, { Name: 'B' }] });
+
+        const result = await EntityCRUDHandler.getEntity('LinkTable', 'a|b', null, makeUser());
+
+        expect(result.success).toBe(false);
+        expect(result.error).toContain('Composite primary keys are not supported');
+        expect(entity.InnerLoad).not.toHaveBeenCalled();
+    });
+});
+
+// ─── updateEntity ───────────────────────────────────────────────────────────
+
+describe('EntityCRUDHandler.updateEntity', () => {
+    it('loads, sets fields, validates, and saves via the entity object', async () => {
+        const user = makeUser();
+        const result = await EntityCRUDHandler.updateEntity('Customers', 'row-1', { Name: 'New Name' }, user);
+
+        expect(result.success).toBe(true);
+        expect(mockGetEntityObject).toHaveBeenCalledWith('Customers', user);
+        expect(entity.InnerLoad).toHaveBeenCalledTimes(1);
+        expect(entity.Set).toHaveBeenCalledWith('Name', 'New Name');
+        expect(entity.Validate).toHaveBeenCalledTimes(1);
+        expect(entity.Save).toHaveBeenCalledTimes(1);
+        expect(entity.Save.mock.calls[0][0]).toBeInstanceOf(EntitySaveOptions);
+    });
+
+    it('denies before loading when the user lacks Update permission', async () => {
+        entity = makeEntity({ allowed: [EntityPermissionType.Read] });
+
+        const result = await EntityCRUDHandler.updateEntity('Customers', 'row-1', { Name: 'X' }, makeUser());
+
+        expect(result.success).toBe(false);
+        expect(result.error).toContain('does not have permission to update Customers');
+        expect(entity.InnerLoad).not.toHaveBeenCalled();
+        expect(entity.Save).not.toHaveBeenCalled();
+    });
+
+    it('returns not-found when the target record does not exist', async () => {
+        entity = makeEntity({ loadSuccess: false });
+
+        const result = await EntityCRUDHandler.updateEntity('Customers', 'ghost', { Name: 'X' }, makeUser());
+
+        expect(result.success).toBe(false);
+        expect(result.error).toBe('Customers with ID ghost not found');
+        expect(entity.Save).not.toHaveBeenCalled();
+    });
+
+    it('short-circuits a no-op update (not dirty) as success WITHOUT saving', async () => {
+        entity = makeEntity({ dirty: false });
+
+        const result = await EntityCRUDHandler.updateEntity('Customers', 'row-1', { Name: 'Loaded Row' }, makeUser());
+
+        expect(result.success).toBe(true);
+        expect(result.entity).toEqual(ENTITY_DATA);
+        expect(entity.Save).not.toHaveBeenCalled();
+    });
+
+    it('saves a clean entity anyway when options.IgnoreDirtyState is set', async () => {
+        entity = makeEntity({ dirty: false });
+
+        const result = await EntityCRUDHandler.updateEntity(
+            'Customers', 'row-1',
+            { Name: 'Same', options: { IgnoreDirtyState: true } },
+            makeUser(),
+        );
+
+        expect(result.success).toBe(true);
+        expect(entity.Save).toHaveBeenCalledTimes(1);
+        expect((entity.Save.mock.calls[0][0] as EntitySaveOptions).IgnoreDirtyState).toBe(true);
+    });
+
+    it('returns validation errors without saving', async () => {
+        entity = makeEntity({ validateSuccess: false });
+
+        const result = await EntityCRUDHandler.updateEntity('Customers', 'row-1', { Name: '' }, makeUser());
+
+        expect(result.success).toBe(false);
+        expect(result.validationErrors).toEqual([{ Message: 'Name is required' }]);
+        expect(entity.Save).not.toHaveBeenCalled();
+    });
+
+    it('surfaces the entity LatestResult when Save returns false', async () => {
+        entity = makeEntity({ saveSuccess: false });
+
+        const result = await EntityCRUDHandler.updateEntity('Customers', 'row-1', { Name: 'X' }, makeUser());
+
+        expect(result.success).toBe(false);
+        expect(result.error).toBe('underlying save/delete failure');
+    });
+});
+
+// ─── deleteEntity ───────────────────────────────────────────────────────────
+
+describe('EntityCRUDHandler.deleteEntity', () => {
+    it('loads then deletes via the entity object, passing the delete options through', async () => {
+        const options = new EntityDeleteOptions();
+        options.SkipEntityActions = true;
+
+        const result = await EntityCRUDHandler.deleteEntity('Customers', 'row-1', options, makeUser());
+
+        expect(result.success).toBe(true);
+        expect(entity.InnerLoad).toHaveBeenCalledTimes(1);
+        expect(entity.Delete).toHaveBeenCalledTimes(1);
+        expect(entity.Delete.mock.calls[0][0]).toBe(options); // the same options object, not a copy
+    });
+
+    it('denies before loading or deleting when the user lacks Delete permission', async () => {
+        entity = makeEntity({ allowed: [EntityPermissionType.Read, EntityPermissionType.Update] });
+
+        const result = await EntityCRUDHandler.deleteEntity('Customers', 'row-1', new EntityDeleteOptions(), makeUser());
+
+        expect(result.success).toBe(false);
+        expect(result.error).toBe('User Testy McTester does not have permission to delete Customers records');
+        expect(entity.InnerLoad).not.toHaveBeenCalled();
+        expect(entity.Delete).not.toHaveBeenCalled();
+    });
+
+    it('returns not-found without deleting when the record does not exist', async () => {
+        entity = makeEntity({ loadSuccess: false });
+
+        const result = await EntityCRUDHandler.deleteEntity('Customers', 'ghost', new EntityDeleteOptions(), makeUser());
+
+        expect(result.success).toBe(false);
+        expect(result.error).toBe('Customers with ID ghost not found');
+        expect(entity.Delete).not.toHaveBeenCalled();
+    });
+
+    it('surfaces the entity LatestResult when Delete returns false', async () => {
+        entity = makeEntity({ deleteSuccess: false });
+
+        const result = await EntityCRUDHandler.deleteEntity('Customers', 'row-1', new EntityDeleteOptions(), makeUser());
+
+        expect(result.success).toBe(false);
+        expect(result.error).toBe('underlying save/delete failure');
+        expect(result.details).toBe(entity.LatestResult);
+    });
+
+    it('catches thrown infrastructure errors and reports them', async () => {
+        mockGetEntityObject.mockRejectedValue(new Error('connection lost'));
+
+        const result = await EntityCRUDHandler.deleteEntity('Customers', 'row-1', new EntityDeleteOptions(), makeUser());
+
+        expect(result.success).toBe(false);
+        expect(result.error).toBe('connection lost');
+        expect(mockLogError).toHaveBeenCalled();
+    });
+});

package/src/__tests__/InactiveRowWarnings.test.ts

@@ -0,0 +1,87 @@
+/**
+ * An apply rebuilds its source schema from ACTIVE IntegrationObject/IntegrationObjectField rows
+ * only. Declared rows that a rediscovery deactivated are therefore dropped from the schema it
+ * materializes — the column never appears, or a requested object is never created — and the apply
+ * output said nothing about it. These tests pin what the operator is now told, and what they are
+ * deliberately NOT told, since an unfiltered apply on a large catalog can carry hundreds of
+ * legitimately deactivated objects.
+ */
+import { describe, it, expect } from 'vitest';
+import { ComputeInactiveRowWarnings, SummarizeNames } from '../integration/InactiveRowWarnings.js';
+
+const active = (Name: string) => ({ Name, Status: 'Active' });
+const disabled = (Name: string) => ({ Name, Status: 'Disabled' });
+
+describe('ComputeInactiveRowWarnings', () => {
+    it('says nothing when every declared row in scope is Active', () => {
+        expect(ComputeInactiveRowWarnings({
+            RequestedNames: ['Contacts'],
+            AllObjects: [active('Contacts')],
+            FieldsByObjectName: { Contacts: [active('ID'), active('Email')] },
+        })).toEqual([]);
+    });
+
+    it('names the deactivated fields of an object it DOES materialize', () => {
+        const [warning, ...rest] = ComputeInactiveRowWarnings({
+            RequestedNames: ['Contacts'],
+            AllObjects: [active('Contacts')],
+            FieldsByObjectName: { Contacts: [active('ID'), disabled('MiddleName')] },
+        });
+        expect(rest).toEqual([]);
+        expect(warning).toContain('Contacts:');
+        expect(warning).toContain('1 declared field(s)');
+        expect(warning).toContain('MiddleName (Disabled)');
+    });
+
+    it('reports a requested object that is not Active — the caller named it and got nothing', () => {
+        const warnings = ComputeInactiveRowWarnings({
+            RequestedNames: ['Contacts', 'Invoices'],
+            AllObjects: [active('Contacts'), disabled('Invoices')],
+            FieldsByObjectName: { Contacts: [active('ID')] },
+        });
+        expect(warnings).toHaveLength(1);
+        expect(warnings[0]).toContain('Invoices (Disabled)');
+        expect(warnings[0]).toContain('1 requested object(s)');
+    });
+
+    it('matches requested names case-insensitively, the way the apply path resolves them', () => {
+        const warnings = ComputeInactiveRowWarnings({
+            RequestedNames: ['invoices'],
+            AllObjects: [disabled('Invoices')],
+            FieldsByObjectName: {},
+        });
+        expect(warnings[0]).toContain('Invoices (Disabled)');
+    });
+
+    it('stays quiet about deactivated objects when nothing was requested by name', () => {
+        // The unfiltered apply: hundreds of deactivated audit objects are the normal state of a
+        // large catalog, and announcing them on every apply is noise that buries the field warning.
+        const warnings = ComputeInactiveRowWarnings({
+            RequestedNames: null,
+            AllObjects: [active('Contacts'), disabled('Invoices'), disabled('Invoices__History')],
+            FieldsByObjectName: { Contacts: [active('ID')] },
+        });
+        expect(warnings).toEqual([]);
+    });
+
+    it('treats any non-Active status as not materialized, and shows which one it is', () => {
+        const warnings = ComputeInactiveRowWarnings({
+            RequestedNames: null,
+            AllObjects: [active('Contacts')],
+            FieldsByObjectName: { Contacts: [{ Name: 'Legacy', Status: 'Deprecated' }, { Name: 'Blank', Status: null }] },
+        });
+        expect(warnings[0]).toContain('Legacy (Deprecated)');
+        expect(warnings[0]).toContain('Blank (no status)');
+    });
+});
+
+describe('SummarizeNames', () => {
+    it('lists everything when the list is short', () => {
+        expect(SummarizeNames(['a', 'b', 'c'])).toBe('a, b, c');
+    });
+
+    it('caps a long list and says how many were left out', () => {
+        const names = Array.from({ length: 15 }, (_, i) => `f${i}`);
+        expect(SummarizeNames(names)).toBe(`${names.slice(0, 12).join(', ')}, and 3 more`);
+    });
+});