@memberjunction/server 6.1.0-edge.5 → 6.1.0-edge.6

package/src/__tests__/RemoteBrowserAudioStream.test.ts

@@ -2,7 +2,7 @@
 // polyfill is loaded first. MUST precede any import that pulls in the resolver file.
 import 'reflect-metadata';
 
-import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { RemoteBrowserCapabilityNotSupportedError } from '@memberjunction/remote-browser-base';
 
 // type-graphql's `@Field()`/`@ObjectType()`/`@Mutation()` decorators need `emitDecoratorMetadata`
@@ -32,14 +32,21 @@ vi.mock('type-graphql', () => {
 });
 
 // --- Mock the live-session engine the resolver drives. A single mutable session object lets each
-//     test script what StartAudioStream/StopAudioStream do (succeed / throw a capability error). ---
+//     test script what StartAudioStream/StopAudioStream (and, for the TTL-sweep tests below,
+//     StartScreencast/StopScreencast) do (succeed / throw a capability error). ---
 interface FakeLiveSession {
   StartAudioStream: ReturnType<typeof vi.fn>;
   StopAudioStream: ReturnType<typeof vi.fn>;
+  StartScreencast: ReturnType<typeof vi.fn>;
+  StopScreencast: ReturnType<typeof vi.fn>;
+  GetCurrentUrl: ReturnType<typeof vi.fn>;
 }
 const liveSession: FakeLiveSession = {
   StartAudioStream: vi.fn(async () => undefined),
   StopAudioStream: vi.fn(async () => undefined),
+  StartScreencast: vi.fn(async () => undefined),
+  StopScreencast: vi.fn(async () => undefined),
+  GetCurrentUrl: vi.fn(() => 'https://example.com'),
 };
 const startSessionMock = vi.fn(async () => liveSession);
 const getSessionMock = vi.fn(() => liveSession as FakeLiveSession | undefined);
@@ -116,6 +123,8 @@ describe('RemoteBrowserActionResolver — audio stream', () => {
     resolver = new TestableResolver();
     liveSession.StartAudioStream.mockReset().mockResolvedValue(undefined);
     liveSession.StopAudioStream.mockReset().mockResolvedValue(undefined);
+    liveSession.StartScreencast.mockReset().mockResolvedValue(undefined);
+    liveSession.StopScreencast.mockReset().mockResolvedValue(undefined);
     startSessionMock.mockReset().mockResolvedValue(liveSession);
     getSessionMock.mockReset().mockReturnValue(liveSession);
   });
@@ -194,3 +203,73 @@ describe('RemoteBrowserActionResolver — audio stream', () => {
     await expect(resolver.StopRemoteBrowserAudioStream('sess-1', ctx)).resolves.toBe(true);
   });
 });
+
+describe('RemoteBrowserActionResolver — stream idempotency-map TTL sweep', () => {
+  // Regression coverage for the Round 13 memory-leak-audit finding: `startedScreencasts` /
+  // `startedAudioStreams` are process-lifetime maps (the resolver is instantiated once per process by
+  // type-graphql's default container) that only ever shrink via an explicit Stop call. A session that
+  // crashes/disconnects/times out before calling Stop — a normal occurrence, not an edge case — used to
+  // leave its entry behind forever. These tests drive the maps past their internal TTL (see
+  // MAX_STREAM_ENTRY_AGE_MS in RemoteBrowserActionResolver.ts) WITHOUT ever calling Stop, and assert the
+  // swept entry no longer blocks a fresh Start — proving the leak is now bounded rather than permanent.
+  let resolver: TestableResolver;
+
+  beforeEach(() => {
+    resolver = new TestableResolver();
+    liveSession.StartAudioStream.mockReset().mockResolvedValue(undefined);
+    liveSession.StopAudioStream.mockReset().mockResolvedValue(undefined);
+    liveSession.StartScreencast.mockReset().mockResolvedValue(undefined);
+    liveSession.StopScreencast.mockReset().mockResolvedValue(undefined);
+    startSessionMock.mockReset().mockResolvedValue(liveSession);
+    getSessionMock.mockReset().mockReturnValue(liveSession);
+    vi.useFakeTimers();
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  it('audio stream: a crashed session (no Stop call) is forgotten after the TTL, so a later Start re-invokes StartAudioStream', async () => {
+    const pubSub = makePubSub();
+    await resolver.StartRemoteBrowserAudioStream('sess-crash-1', ctx, pubSub as never);
+    expect(liveSession.StartAudioStream).toHaveBeenCalledTimes(1);
+
+    // Well under the TTL: still idempotent, exactly like a legitimately long-lived active stream.
+    vi.advanceTimersByTime(60 * 60 * 1000); // +1h
+    await resolver.StartRemoteBrowserAudioStream('sess-crash-1', ctx, pubSub as never);
+    expect(liveSession.StartAudioStream).toHaveBeenCalledTimes(1);
+
+    // Past the TTL, with Stop NEVER called (simulating a crash/disconnect): the stale entry is swept,
+    // and a fresh Start is treated as a real (re)start rather than trusting the dead flag forever.
+    vi.advanceTimersByTime(5 * 60 * 60 * 1000); // +5h more (6h total, past the 4h TTL)
+    await resolver.StartRemoteBrowserAudioStream('sess-crash-1', ctx, pubSub as never);
+    expect(liveSession.StartAudioStream).toHaveBeenCalledTimes(2);
+  });
+
+  it('screencast: a crashed session (no Stop call) is forgotten after the TTL, so a later Start re-invokes StartScreencast', async () => {
+    const pubSub = makePubSub();
+    await resolver.StartRemoteBrowserScreencast('sess-crash-2', ctx, pubSub as never);
+    expect(liveSession.StartScreencast).toHaveBeenCalledTimes(1);
+
+    vi.advanceTimersByTime(6 * 60 * 60 * 1000); // 6h, past the 4h TTL
+    await resolver.StartRemoteBrowserScreencast('sess-crash-2', ctx, pubSub as never);
+    expect(liveSession.StartScreencast).toHaveBeenCalledTimes(2);
+  });
+
+  it('sweeping one stale surface does not evict an unrelated surface still inside the TTL', async () => {
+    const pubSub = makePubSub();
+    await resolver.StartRemoteBrowserAudioStream('sess-old', ctx, pubSub as never);
+
+    vi.advanceTimersByTime(3 * 60 * 60 * 1000); // +3h — sess-old is now 3h old, sess-new is fresh
+    await resolver.StartRemoteBrowserAudioStream('sess-new', ctx, pubSub as never);
+    expect(liveSession.StartAudioStream).toHaveBeenCalledTimes(2);
+
+    vi.advanceTimersByTime(2 * 60 * 60 * 1000); // +2h more — sess-old is 5h old (past TTL), sess-new is 2h old (within TTL)
+    // Triggering the sweep via a third session's Start must not evict sess-new's still-valid entry.
+    await resolver.StartRemoteBrowserAudioStream('sess-trigger', ctx, pubSub as never);
+    await resolver.StartRemoteBrowserAudioStream('sess-new', ctx, pubSub as never);
+    // sess-old, sess-new(first call), sess-trigger all real starts = 3 so far; the second sess-new
+    // call must still be idempotent (no 4th real start).
+    expect(liveSession.StartAudioStream).toHaveBeenCalledTimes(3);
+  });
+});

package/src/__tests__/ResolverBase.filterEscaping.test.ts

@@ -2,10 +2,10 @@
 // Reflect.metadata polyfill at import time.
 import 'reflect-metadata';
 import { describe, it, expect } from 'vitest';
-import type { DatabaseProviderBase, RunViewParams, RunViewResult, UserInfo } from '@memberjunction/core';
+import type { DatabaseProviderBase, IMetadataProvider, RunViewParams, RunViewResult, UserInfo } from '@memberjunction/core';
 import { ResolverBase } from '../generic/ResolverBase.js';
 import type { UserPayload } from '../types.js';
-import type { RunViewByNameInput } from '../generic/RunViewResolver.js';
+import type { RunDynamicViewInput, RunViewByNameInput } from '../generic/RunViewResolver.js';
 import type { PubSubEngine } from 'type-graphql';
 
 /**
@@ -37,7 +37,11 @@ function fakeProvider(captured: Captured, rows: Record<string, unknown>[] = []):
     return {
         Entities: [
             {
+                ID: 'E1',
                 Name: ENTITY_NAME,
+                SchemaName: '__mj',
+                BaseView: 'vwUsers',
+                BaseTable: 'User',
                 Fields: [
                     { Name: 'Email', NeedsQuotes: true },
                     { Name: 'Name', NeedsQuotes: true },
@@ -47,8 +51,22 @@ function fakeProvider(captured: Captured, rows: Record<string, unknown>[] = []):
             },
             {
                 Name: 'MJ: User Views',
+                SchemaName: '__mj',
+                BaseView: 'vwUserViews',
                 Fields: [{ Name: 'Name', NeedsQuotes: true }],
             },
+            {
+                Name: 'MJ_BizApps_Tasks: Task Assignments',
+                SchemaName: '__mj_BizAppsTasks',
+                BaseView: 'vwTaskAssignments',
+                BaseTable: 'TaskAssignment',
+                Fields: [{ Name: 'TaskID', NeedsQuotes: true }],
+            },
+            { Name: 'MJ_BizApps_Tasks: Tasks', SchemaName: '__mj_BizAppsTasks', BaseView: 'vwTasks', BaseTable: 'Task', Fields: [] },
+            { Name: 'Committees: Meetings', SchemaName: '__mj_BizAppsCommittees', BaseView: 'vwMeetings', BaseTable: 'Meeting', Fields: [] },
+            { Name: 'Committees: Motions', SchemaName: '__mj_BizAppsCommittees', BaseView: 'vwMotions', BaseTable: 'Motion', Fields: [] },
+            { Name: 'Committees: Memberships', SchemaName: '__mj_BizAppsCommittees', BaseView: 'vwMemberships', BaseTable: 'Membership', Fields: [] },
+            { Name: 'Committees: Terms', SchemaName: '__mj_BizAppsCommittees', BaseView: 'vwTerms', BaseTable: 'Term', Fields: [] },
         ],
         RunView: async (params: RunViewParams): Promise<RunViewResult> => {
             captured.params = params;
@@ -60,11 +78,19 @@ function fakeProvider(captured: Captured, rows: Record<string, unknown>[] = []):
 const fakeUser = () => ({ Email: 'tester@example.com' } as UserInfo);
 const fakePayload = () => ({ email: 'tester@example.com', userRecord: fakeUser() } as UserPayload);
 
-/** Reaches the protected `findBy`. */
+/** Reaches the protected `findBy` and the client-subquery screen. */
 class Probe extends ResolverBase {
     public FindBy(provider: DatabaseProviderBase, entity: string, params: Record<string, unknown>) {
         return this.findBy(provider, entity, params, fakeUser());
     }
+
+    public ScreenClause(clause: string | undefined | null, label: string, provider: DatabaseProviderBase) {
+        return this.assertClientClauseUsesEntityBaseViews(clause, label, provider as unknown as IMetadataProvider);
+    }
+
+    public RunDynamic(input: RunDynamicViewInput, provider: DatabaseProviderBase) {
+        return this.RunDynamicViewGeneric(input, provider, fakePayload(), undefined as unknown as PubSubEngine);
+    }
 }
 
 describe('ResolverBase.findBy — ExtraFilter escaping', () => {
@@ -127,6 +153,104 @@ describe('ResolverBase.findBy — ExtraFilter escaping', () => {
     });
 });
 
+describe('ResolverBase — GraphQL-boundary ExtraFilter AST screen', () => {
+    // Keyword SELECT/EXISTS ban (#4253) broke first-party IN (SELECT … FROM base view).
+    // The replacement parses the fragment and allows only entity BaseViews.
+
+    const provider = () => fakeProvider({ params: null });
+
+    it('rejects an EXISTS subquery against a base table', () => {
+        expect(() =>
+            new Probe().ScreenClause(`EXISTS (SELECT 1 FROM __mj.[User] WHERE Type='Owner')`, 'ExtraFilter', provider())
+        ).toThrow(/entity base view/);
+    });
+
+    it('rejects a scalar SELECT subquery against a non-view', () => {
+        expect(() =>
+            new Probe().ScreenClause('(SELECT COUNT(*) FROM __mj.APIKey)', 'OrderBy', provider())
+        ).toThrow(/entity base view/);
+    });
+
+    it('allows IN (SELECT …) against an entity BaseView', () => {
+        expect(() =>
+            new Probe().ScreenClause(
+                `ID IN (SELECT TaskID FROM [__mj_BizAppsTasks].[vwTaskAssignments] WHERE AssigneeRecordID = 'x')`,
+                'ExtraFilter',
+                provider(),
+            )
+        ).not.toThrow();
+    });
+
+    it('allows the restored Committees ExtraFilter shapes (Command Center, workspace, tracker)', () => {
+        const p = new Probe();
+        const md = provider();
+        const clauses = [
+            `TaskID IN (SELECT ID FROM [__mj_BizAppsTasks].[vwTasks] WHERE Status IN ('Open', 'InProgress'))`,
+            `ID IN (SELECT TaskID FROM [__mj_BizAppsTasks].[vwTaskAssignments] WHERE AssigneeRecordID = 'x')`,
+            `MeetingID IN (SELECT ID FROM [__mj_BizAppsCommittees].[vwMeetings] WHERE CommitteeID='x')`,
+            `MotionID IN (SELECT ID FROM [__mj_BizAppsCommittees].[vwMotions] WHERE MeetingID = 'x')`,
+            `ID IN (SELECT m.PersonID FROM [__mj_BizAppsCommittees].[vwMemberships] m JOIN [__mj_BizAppsCommittees].[vwTerms] t ON m.TermID = t.ID WHERE t.CommitteeID = 'x' AND m.Status = 'Active')`,
+        ];
+        for (const c of clauses) {
+            expect(() => p.ScreenClause(c, 'ExtraFilter', md)).not.toThrow();
+        }
+    });
+
+    it('allows an ordinary comparison filter', () => {
+        expect(() =>
+            new Probe().ScreenClause(`Email = 'a@b.com' AND IsActive = 1`, 'ExtraFilter', provider())
+        ).not.toThrow();
+    });
+
+    it('does not false-positive on SELECT/EXISTS inside string literals', () => {
+        expect(() =>
+            new Probe().ScreenClause(`Name LIKE '%select%' OR Name = 'exists'`, 'ExtraFilter', provider())
+        ).not.toThrow();
+    });
+
+    it('allows empty/undefined clauses', () => {
+        expect(() => new Probe().ScreenClause('', 'ExtraFilter', provider())).not.toThrow();
+        expect(() => new Probe().ScreenClause(undefined, 'OrderBy', provider())).not.toThrow();
+    });
+
+    it('RunDynamicViewGeneric never reaches RunView when ExtraFilter hits a base table', async () => {
+        const captured: Captured = { params: null };
+        const input = {
+            EntityName: ENTITY_NAME,
+            ExtraFilter: `EXISTS (SELECT 1 FROM __mj.[User] WHERE Type='Owner')`,
+        } as RunDynamicViewInput;
+
+        await expect(new Probe().RunDynamic(input, fakeProvider(captured))).rejects.toThrow(
+            /entity base view/
+        );
+        expect(captured.params).toBeNull();
+    });
+
+    it('RunDynamicViewGeneric passes a BaseView subquery through to RunView', async () => {
+        const captured: Captured = { params: null };
+        const input = {
+            EntityName: ENTITY_NAME,
+            ExtraFilter: `ID IN (SELECT ID FROM [__mj].[vwUsers] WHERE Email = 'a@b.com')`,
+        } as RunDynamicViewInput;
+
+        await new Probe().RunDynamic(input, fakeProvider(captured));
+
+        expect(captured.params?.ExtraFilter).toBe(`ID IN (SELECT ID FROM [__mj].[vwUsers] WHERE Email = 'a@b.com')`);
+    });
+
+    it('RunDynamicViewGeneric passes a benign ExtraFilter through to RunView', async () => {
+        const captured: Captured = { params: null };
+        const input = {
+            EntityName: ENTITY_NAME,
+            ExtraFilter: `Email = 'a@b.com'`,
+        } as RunDynamicViewInput;
+
+        await new Probe().RunDynamic(input, fakeProvider(captured));
+
+        expect(captured.params?.ExtraFilter).toBe(`Email = 'a@b.com'`);
+    });
+});
+
 describe('ResolverBase.RunViewByNameGeneric — view-name escaping', () => {
     it('escapes the client-supplied view name', async () => {
         const captured: Captured = { params: null };

package/src/__tests__/UserViewResolver.updateWhereClause.test.ts

@@ -0,0 +1,114 @@
+/**
+ * UserViewResolver.updateWhereClause.test.ts — the `UpdateWhereClause` query.
+ *
+ * The endpoint exists so a dev can FORCE a view's WhereClause to be regenerated. Three things
+ * have to hold for it to actually do that:
+ *   1. it must use the READ-WRITE provider (it calls Save(); on a read-replica deployment the
+ *      read-only provider would route the write to the replica);
+ *   2. it must AWAIT the forced `UpdateWhereClause(true)` before saving — the un-awaited call it
+ *      used to make raced `Save()`, and `Save()` itself will not trigger a second pass because no
+ *      filter field is dirty;
+ *   3. it must fail clearly when the view cannot be loaded instead of saving a blank record.
+ */
+import 'reflect-metadata';
+import { describe, it, expect, vi } from 'vitest';
+import type { UserInfo } from '@memberjunction/core';
+import type { DatabaseProviderBase } from '@memberjunction/core';
+
+// The resolver's import chain reaches the 88k-line generated GraphQL schema (which loads server
+// config at import time) and the type-graphql decorators. None of that is under test here — the
+// provider selection (`../util.js`) and the resolver body are — so neutralize the chain.
+vi.mock('@memberjunction/server', () => {
+    const noopDecorator = () => () => undefined;
+    return { Arg: noopDecorator, Ctx: noopDecorator, Query: noopDecorator, Resolver: noopDecorator, Int: {} };
+});
+vi.mock('../generated/generated.js', () => ({
+    MJUserView_: class {},
+    // Only the one ResolverBase member the query uses.
+    MJUserViewResolverBase: class {
+        protected GetUserFromPayload(userPayload: { userRecord?: unknown } | undefined) {
+            return userPayload?.userRecord;
+        }
+    },
+}));
+vi.mock('../resolvers/UserResolver.js', () => ({ UserResolver: class {} }));
+
+import { UserViewResolver } from '../resolvers/UserViewResolver.js';
+import type { AppContext, ProviderInfo, UserPayload } from '../types.js';
+
+const VIEW_ID = '0F8FAD5B-D9CB-469F-A165-70867728950E';
+const USER = { ID: 'user-1', Email: 'dev@example.com' } as unknown as UserInfo;
+
+interface FakeView {
+    Load: ReturnType<typeof vi.fn>;
+    UpdateWhereClause: ReturnType<typeof vi.fn>;
+    Save: ReturnType<typeof vi.fn>;
+    GetAll: ReturnType<typeof vi.fn>;
+}
+
+function makeView(opts: { loadOk: boolean; saveOk?: boolean }): { view: FakeView; order: string[] } {
+    const order: string[] = [];
+    const view: FakeView = {
+        Load: vi.fn(async () => { order.push('load'); return opts.loadOk; }),
+        // Resolve on a later tick so an un-awaited call would let Save() run first.
+        UpdateWhereClause: vi.fn(() => new Promise<void>(resolve => setTimeout(() => { order.push('update'); resolve(); }, 5))),
+        Save: vi.fn(async () => { order.push('save'); return opts.saveOk ?? true; }),
+        GetAll: vi.fn(() => ({ ID: VIEW_ID, WhereClause: '[IsActive] = 1' })),
+    };
+    return { view, order };
+}
+
+function makeProvider(view: FakeView): DatabaseProviderBase & { GetEntityObject: ReturnType<typeof vi.fn> } {
+    return { GetEntityObject: vi.fn(async () => view) } as unknown as DatabaseProviderBase & { GetEntityObject: ReturnType<typeof vi.fn> };
+}
+
+function makeContext(providers: ProviderInfo[]): AppContext {
+    return {
+        providers,
+        userPayload: { userRecord: USER } as unknown as UserPayload,
+    } as unknown as AppContext;
+}
+
+describe('UserViewResolver.UpdateWhereClause', () => {
+    it('uses the READ-WRITE provider, awaits the forced regeneration, then saves and returns the record', async () => {
+        const { view, order } = makeView({ loadOk: true });
+        const readOnly = makeProvider(makeView({ loadOk: true }).view);
+        const readWrite = makeProvider(view);
+        const ctx = makeContext([
+            { provider: readOnly, type: 'Read-Only' },
+            { provider: readWrite, type: 'Read-Write' },
+        ]);
+
+        const result = await new UserViewResolver().UpdateWhereClause(VIEW_ID, ctx);
+
+        expect(readWrite.GetEntityObject).toHaveBeenCalledWith('MJ: User Views', USER);
+        expect(readOnly.GetEntityObject).not.toHaveBeenCalled();
+        expect(view.Load).toHaveBeenCalledWith(VIEW_ID);
+        expect(view.UpdateWhereClause).toHaveBeenCalledWith(true);
+        // The regeneration must complete BEFORE Save() runs.
+        expect(order).toEqual(['load', 'update', 'save']);
+        expect(result).toEqual({ ID: VIEW_ID, WhereClause: '[IsActive] = 1' });
+    });
+
+    it('falls back to the only provider available when no read-write provider is registered', async () => {
+        const { view } = makeView({ loadOk: true });
+        const only = makeProvider(view);
+        await new UserViewResolver().UpdateWhereClause(VIEW_ID, makeContext([{ provider: only, type: 'Read-Only' }]));
+        expect(only.GetEntityObject).toHaveBeenCalledTimes(1);
+        expect(view.Save).toHaveBeenCalledTimes(1);
+    });
+
+    it('throws and never regenerates or saves when the view cannot be loaded', async () => {
+        const { view } = makeView({ loadOk: false });
+        const ctx = makeContext([{ provider: makeProvider(view), type: 'Read-Write' }]);
+        await expect(new UserViewResolver().UpdateWhereClause(VIEW_ID, ctx)).rejects.toThrow(/not found or access denied/);
+        expect(view.UpdateWhereClause).not.toHaveBeenCalled();
+        expect(view.Save).not.toHaveBeenCalled();
+    });
+
+    it('throws when Save() reports failure', async () => {
+        const { view } = makeView({ loadOk: true, saveOk: false });
+        const ctx = makeContext([{ provider: makeProvider(view), type: 'Read-Write' }]);
+        await expect(new UserViewResolver().UpdateWhereClause(VIEW_ID, ctx)).rejects.toThrow(/Failed to update where clause/);
+    });
+});

package/src/__tests__/WidgetSessionService.test.ts

@@ -10,7 +10,10 @@ vi.mock('../config.js', () => ({
 }));
 vi.mock('@memberjunction/generic-database-provider', () => ({
   UserCache: {
-    Instance: { Users: [], UserByName: () => undefined, GetSystemUser: () => undefined },
+    // The subject reads exactly these two through `ResolveConfiguredPrincipal`. It no longer
+    // calls `UserByName`/`GetSystemUser`, and stubbing members nobody calls hides the day a
+    // test does reach `resolveLookupUser` and trips the resolver's missing-system-id guard.
+    Instance: { Users: [], SYSTEM_USER_ID: 'ECAFCCEC-6A37-EF11-86D4-000D3A4E707E' },
     Users: [],
   },
 }));

package/src/__tests__/newUserRolesDefault.test.ts

@@ -0,0 +1,81 @@
+/**
+ * Config-contract regression test for the shipped `userHandling.newUserRoles` default (issue #4260).
+ *
+ * THE DEFECT. `DEFAULT_SERVER_CONFIG` shipped `newUserRoles: ['UI', 'Developer']`. On the baseline
+ * seed the `Developer` role holds `CanUpdate` on 439 of the database's 446 entities with no row-level filter —
+ * `MJ: Users` among them, where `AllowUpdateAPI` is true and both `Type` and `Name` are
+ * `AllowUpdateAPI` fields. Every gate in the chain passes:
+ *
+ *   config default -> newUsers.ts assigns the role -> EntityPermission grants Update
+ *   -> Entity/Field AllowUpdateAPI allow it -> BaseEntity.CheckPermissions passes
+ *   -> GRANT EXECUTE ON __mj.spUpdateUser TO cdp_Developer
+ *
+ * So anyone who obtained an account through JWT auto-provisioning or a magic-link redeem could
+ * write any row of `MJ: Users` — including setting their own `Type` to `'Owner'`, the column MJ's
+ * superuser checks read (`SqlLoggingConfigResolver`, `canIssueInvites`, the backup-system-user
+ * fallback). That is privilege escalation from "can obtain a token" to "platform Owner".
+ *
+ * WHY THE DEFAULT IS THE FIX. The value is not merely the fallback for a host with no config file.
+ * `loadConfig()` deep-merges through `mergeConfigs`, so a host writing a PARTIAL `userHandling`
+ * block (`{ autoCreateNewUsers: true }`, say) inherits this array — the Zod `.default([])` on the
+ * schema never fires, because the key is never absent after the merge. The shipped default is
+ * therefore the effective posture of every deployment that does not name `newUserRoles` explicitly.
+ *
+ * These assertions pin the CONTRACT, not just the literal: the shipped default must grant an
+ * auto-provisioned user no more than the end-user surface.
+ */
+import { describe, it, expect, vi } from 'vitest';
+
+// config.ts evaluates `configInfo = loadConfig()` at module load, and `loadConfig` rejects a
+// configuration carrying no database credentials. Stubbing the cosmiconfig search — and ONLY that —
+// supplies them so the module imports, while leaving `DEFAULT_SERVER_CONFIG` itself completely
+// untouched. These assertions therefore run against the constant the server actually ships rather
+// than against a copy of it, which is the whole point of a shipped-default contract test.
+vi.mock('cosmiconfig', () => ({
+  cosmiconfigSync: () => ({
+    search: () => ({
+      filepath: '/test/mj.config.cjs',
+      isEmpty: false,
+      config: { dbUsername: 'test-user', dbPassword: 'test-password', dbDatabase: 'test-db' },
+    }),
+  }),
+}));
+
+import { DEFAULT_SERVER_CONFIG } from '../config.js';
+
+/**
+ * Seeded roles that carry platform-wide write on the baseline database, and so must never appear
+ * in a default handed to a party the host has not vetted. `Integration`'s own seed Description
+ * says it "shouldn't be applied to end-users"; `Developer` is the role this issue was filed about.
+ */
+const PLATFORM_WRITE_ROLES = ['Developer', 'Integration'];
+
+describe('DEFAULT_SERVER_CONFIG.userHandling.newUserRoles (issue #4260)', () => {
+  const newUserRoles = DEFAULT_SERVER_CONFIG.userHandling?.newUserRoles;
+
+  it('grants auto-provisioned users the end-user role only', () => {
+    expect(newUserRoles).toEqual(['UI']);
+  });
+
+  it.each(PLATFORM_WRITE_ROLES)('does not include the platform-write role %j', role => {
+    // The regression itself. Before the fix, 'Developer' was present here and every
+    // auto-provisioned user could UPDATE MJ: Users, Type and Name included.
+    expect(newUserRoles).not.toContain(role);
+  });
+
+  it('is not empty — an auto-provisioned user must still be able to use the product', () => {
+    // The opposite failure mode: locking the default down to [] would provision users who
+    // cannot read their own conversations, views or dashboards. 'UI' is the seeded role that
+    // carries exactly that end-user surface (48 update grants, none of them on MJ: Users).
+    expect(newUserRoles?.length).toBeGreaterThan(0);
+  });
+
+  it('stays minimal because auto-provisioning is ON by default with no domain restriction', () => {
+    // This is the linkage that makes the role list security-relevant rather than a convenience
+    // setting. A stock server auto-creates an account for ANY identity its configured IdP will
+    // issue a token for. If either of these defaults is ever tightened, the role list may be
+    // reconsidered — but not before, and never in the other order.
+    expect(DEFAULT_SERVER_CONFIG.userHandling?.autoCreateNewUsers).toBe(true);
+    expect(DEFAULT_SERVER_CONFIG.userHandling?.newUserLimitedToAuthorizedDomains).toBe(false);
+  });
+});

package/src/__tests__/newUsers.test.ts

@@ -21,7 +21,7 @@ import type { UserInfo } from '@memberjunction/core';
 const {
     mockConfig,
     mockCacheUsers,
-    mockUserByName,
+    mockSystemUserId,
     mockRefresh,
     mockGetEntityObject,
     mockRunViewFn,
@@ -39,6 +39,7 @@ const {
         Name: string;
         Email: string;
         Type: string;
+        IsActive?: boolean;
     }
     return {
         mockConfig: {
@@ -55,7 +56,11 @@ const {
             },
         },
         mockCacheUsers: [] as HoistedCacheUser[],
-        mockUserByName: vi.fn(),
+        // The system user's ID as the cache reports it. A well-formed UUID that matches NO fixture
+        // below, so the resolver's system rung stays inert unless a test opts into it. Well-formed
+        // matters: `UUIDsEqual` is a string compare with no shape check, so a malformed value here
+        // would read as real data while being unrepresentable in the column it stands for.
+        mockSystemUserId: { value: '00000000-0000-0000-0000-00000000d1f5' },
         mockRefresh: vi.fn(),
         mockGetEntityObject: vi.fn(),
         mockRunViewFn: vi.fn(),
@@ -76,10 +81,12 @@ vi.mock('../config.js', () => ({ configInfo: mockConfig }));
 
 vi.mock('@memberjunction/generic-database-provider', () => {
     const instance = {
-        UserByName: mockUserByName,
         get Users() {
             return mockCacheUsers;
         },
+        get SYSTEM_USER_ID() {
+            return mockSystemUserId.value;
+        },
         Refresh: mockRefresh,
         GetSystemUser: vi.fn(),
     };
@@ -234,7 +241,9 @@ function entitiesOf(name: string): MockEntity[] {
     return createdEntities.filter((e) => e.TestEntityName === name);
 }
 
-const CONTEXT_USER = { ID: 'sys-1', Name: 'system@test.com', Email: 'system@test.com', Type: 'Owner' } as unknown as UserInfo;
+/** The cache row for the configured context user; `CONTEXT_USER` is the same object, typed. */
+const CONTEXT_USER_ROW = { ID: 'sys-1', Name: 'system@test.com', Email: 'system@test.com', Type: 'Owner', IsActive: true };
+const CONTEXT_USER = CONTEXT_USER_ROW as unknown as UserInfo;
 
 function resetConfig(): void {
     mockConfig.userHandling = {
@@ -261,14 +270,22 @@ beforeEach(() => {
     getEntityObjectCalls = [];
     saveBehavior = {};
     entitySeq = 0;
+    // defineProperty rather than assignment: one test replaces this with a throwing getter.
+    Object.defineProperty(mockSystemUserId, 'value', {
+        value: '00000000-0000-0000-0000-00000000d1f5',
+        writable: true,
+        configurable: true,
+    });
+    // The configured context user must be IN the cache: resolution reads the cache directly rather
+    // than going through a UserByName stub that answered regardless of what the cache held.
     mockCacheUsers.length = 0;
+    mockCacheUsers.push(CONTEXT_USER_ROW);
 
     mockRolesArray.length = 0;
     mockRolesArray.push({ ID: 'role-ui', Name: 'UI' }, { ID: 'role-dev', Name: 'Developer' });
     mockApplicationsArray.length = 0;
     mockApplicationsArray.push({ ID: 'app-crm', Name: ' CRM ' }, { ID: 'app-admin', Name: 'Admin' });
 
-    mockUserByName.mockImplementation((name: string) => (name === 'system@test.com' ? CONTEXT_USER : undefined));
     mockGetEntityObject.mockImplementation(async (entityName: string, contextUser?: UserInfo) => {
         const entity = makeMockEntity(entityName);
         createdEntities.push(entity);
@@ -290,7 +307,6 @@ describe('NewUserBase.createNewUser', () => {
             const user = await create();
 
             expect(user).not.toBeNull();
-            expect(mockUserByName).toHaveBeenCalledWith('system@test.com');
             expect(getEntityObjectCalls[0]).toEqual({ entityName: 'MJ: Users', contextUser: CONTEXT_USER });
             // Role records are scoped to the same creation context user
             for (const call of getEntityObjectCalls) {
@@ -299,9 +315,9 @@ describe('NewUserBase.createNewUser', () => {
         });
 
         it('falls back to an Owner-typed cache user (case-insensitive, trimmed) when the configured user is missing', async () => {
-            mockUserByName.mockReturnValue(undefined);
-            const owner = { ID: 'owner-9', Name: 'Fallback Owner', Email: 'owner@x.com', Type: '  OWNER  ' };
-            mockCacheUsers.push({ ID: 'u-1', Name: 'Plain', Email: 'p@x.com', Type: 'User' }, owner);
+            const owner = { ID: 'owner-9', Name: 'Fallback Owner', Email: 'owner@x.com', Type: '  OWNER  ', IsActive: true };
+            mockCacheUsers.length = 0; // the configured user is absent from this deployment
+            mockCacheUsers.push({ ID: 'u-1', Name: 'Plain', Email: 'p@x.com', Type: 'User', IsActive: true }, owner);
 
             const user = await create();
 
@@ -311,8 +327,8 @@ describe('NewUserBase.createNewUser', () => {
         });
 
         it('returns null without opening a transaction when no context user can be resolved at all', async () => {
-            mockUserByName.mockReturnValue(undefined);
-            mockCacheUsers.push({ ID: 'u-1', Name: 'Plain', Email: 'p@x.com', Type: 'User' });
+            mockCacheUsers.length = 0; // no configured user, no system user, no Owner
+            mockCacheUsers.push({ ID: 'u-1', Name: 'Plain', Email: 'p@x.com', Type: 'User', IsActive: true });
 
             const user = await create();
 
@@ -322,8 +338,12 @@ describe('NewUserBase.createNewUser', () => {
         });
 
         it('returns undefined (outer catch) when context resolution throws', async () => {
-            mockUserByName.mockImplementation(() => {
-                throw new Error('cache exploded');
+            // A cache that cannot report its own system user id fails resolution outright.
+            Object.defineProperty(mockSystemUserId, 'value', {
+                get() {
+                    throw new Error('cache exploded');
+                },
+                configurable: true,
             });
 
             const user = await create();
@@ -604,7 +624,9 @@ describe('verifyUserRecord', () => {
             const user = await verifyUserRecord('new@example.com', 'New', 'User');
 
             expect(user).toBeUndefined();
-            expect(mockCacheUsers).toHaveLength(0);
+            // The cache is no longer empty at rest (it holds the configured context user), so
+            // assert the thing that actually matters: the failed user was not added to it.
+            expect(mockCacheUsers.some((u) => u.Email === 'new@example.com')).toBe(false);
         });
     });