@memberjunction/server 6.1.0-edge.5 → 6.1.0-edge.7

package/src/__tests__/ResolverBase.filterEscaping.test.ts

@@ -2,10 +2,10 @@
 // Reflect.metadata polyfill at import time.
 import 'reflect-metadata';
 import { describe, it, expect } from 'vitest';
-import type { DatabaseProviderBase, RunViewParams, RunViewResult, UserInfo } from '@memberjunction/core';
+import type { DatabaseProviderBase, IMetadataProvider, RunViewParams, RunViewResult, UserInfo } from '@memberjunction/core';
 import { ResolverBase } from '../generic/ResolverBase.js';
 import type { UserPayload } from '../types.js';
-import type { RunViewByNameInput } from '../generic/RunViewResolver.js';
+import type { RunDynamicViewInput, RunViewByNameInput } from '../generic/RunViewResolver.js';
 import type { PubSubEngine } from 'type-graphql';
 
 /**
@@ -37,7 +37,11 @@ function fakeProvider(captured: Captured, rows: Record<string, unknown>[] = []):
     return {
         Entities: [
             {
+                ID: 'E1',
                 Name: ENTITY_NAME,
+                SchemaName: '__mj',
+                BaseView: 'vwUsers',
+                BaseTable: 'User',
                 Fields: [
                     { Name: 'Email', NeedsQuotes: true },
                     { Name: 'Name', NeedsQuotes: true },
@@ -47,8 +51,22 @@ function fakeProvider(captured: Captured, rows: Record<string, unknown>[] = []):
             },
             {
                 Name: 'MJ: User Views',
+                SchemaName: '__mj',
+                BaseView: 'vwUserViews',
                 Fields: [{ Name: 'Name', NeedsQuotes: true }],
             },
+            {
+                Name: 'MJ_BizApps_Tasks: Task Assignments',
+                SchemaName: '__mj_BizAppsTasks',
+                BaseView: 'vwTaskAssignments',
+                BaseTable: 'TaskAssignment',
+                Fields: [{ Name: 'TaskID', NeedsQuotes: true }],
+            },
+            { Name: 'MJ_BizApps_Tasks: Tasks', SchemaName: '__mj_BizAppsTasks', BaseView: 'vwTasks', BaseTable: 'Task', Fields: [] },
+            { Name: 'Committees: Meetings', SchemaName: '__mj_BizAppsCommittees', BaseView: 'vwMeetings', BaseTable: 'Meeting', Fields: [] },
+            { Name: 'Committees: Motions', SchemaName: '__mj_BizAppsCommittees', BaseView: 'vwMotions', BaseTable: 'Motion', Fields: [] },
+            { Name: 'Committees: Memberships', SchemaName: '__mj_BizAppsCommittees', BaseView: 'vwMemberships', BaseTable: 'Membership', Fields: [] },
+            { Name: 'Committees: Terms', SchemaName: '__mj_BizAppsCommittees', BaseView: 'vwTerms', BaseTable: 'Term', Fields: [] },
         ],
         RunView: async (params: RunViewParams): Promise<RunViewResult> => {
             captured.params = params;
@@ -60,11 +78,27 @@ function fakeProvider(captured: Captured, rows: Record<string, unknown>[] = []):
 const fakeUser = () => ({ Email: 'tester@example.com' } as UserInfo);
 const fakePayload = () => ({ email: 'tester@example.com', userRecord: fakeUser() } as UserPayload);
 
-/** Reaches the protected `findBy`. */
+/** Reaches the protected `findBy` and the client-subquery screen. */
 class Probe extends ResolverBase {
     public FindBy(provider: DatabaseProviderBase, entity: string, params: Record<string, unknown>) {
         return this.findBy(provider, entity, params, fakeUser());
     }
+
+    public ScreenClause(clause: string | undefined | null, label: string, provider: DatabaseProviderBase) {
+        return this.assertClientClauseUsesEntityBaseViews(clause, label, provider as unknown as IMetadataProvider);
+    }
+
+    public RunDynamic(input: RunDynamicViewInput, provider: DatabaseProviderBase) {
+        return this.RunDynamicViewGeneric(input, provider, fakePayload(), undefined as unknown as PubSubEngine);
+    }
+
+    /** The whole boundary screen, as the RunView* entry points call it. */
+    public ScreenAll(
+        clauses: { extraFilter?: string | null; orderBy?: string | null; userSearchString?: string | null; overrideExcludeFilter?: string | null },
+        provider: DatabaseProviderBase,
+    ) {
+        return this.screenClientViewClauses(clauses, provider as unknown as IMetadataProvider);
+    }
 }
 
 describe('ResolverBase.findBy — ExtraFilter escaping', () => {
@@ -127,6 +161,159 @@ describe('ResolverBase.findBy — ExtraFilter escaping', () => {
     });
 });
 
+describe('ResolverBase — GraphQL-boundary ExtraFilter AST screen', () => {
+    // Keyword SELECT/EXISTS ban (#4253) broke first-party IN (SELECT … FROM base view).
+    // The replacement parses the fragment and allows only entity BaseViews.
+
+    const provider = () => fakeProvider({ params: null });
+
+    it('rejects an EXISTS subquery against a base table', () => {
+        expect(() =>
+            new Probe().ScreenClause(`EXISTS (SELECT 1 FROM __mj.[User] WHERE Type='Owner')`, 'ExtraFilter', provider())
+        ).toThrow(/entity base view/);
+    });
+
+    it('rejects a scalar SELECT subquery against a non-view', () => {
+        expect(() =>
+            new Probe().ScreenClause('(SELECT COUNT(*) FROM __mj.APIKey)', 'OrderBy', provider())
+        ).toThrow(/entity base view/);
+    });
+
+    it('allows IN (SELECT …) against an entity BaseView', () => {
+        expect(() =>
+            new Probe().ScreenClause(
+                `ID IN (SELECT TaskID FROM [__mj_BizAppsTasks].[vwTaskAssignments] WHERE AssigneeRecordID = 'x')`,
+                'ExtraFilter',
+                provider(),
+            )
+        ).not.toThrow();
+    });
+
+    it('allows the restored Committees ExtraFilter shapes (Command Center, workspace, tracker)', () => {
+        const p = new Probe();
+        const md = provider();
+        const clauses = [
+            `TaskID IN (SELECT ID FROM [__mj_BizAppsTasks].[vwTasks] WHERE Status IN ('Open', 'InProgress'))`,
+            `ID IN (SELECT TaskID FROM [__mj_BizAppsTasks].[vwTaskAssignments] WHERE AssigneeRecordID = 'x')`,
+            `MeetingID IN (SELECT ID FROM [__mj_BizAppsCommittees].[vwMeetings] WHERE CommitteeID='x')`,
+            `MotionID IN (SELECT ID FROM [__mj_BizAppsCommittees].[vwMotions] WHERE MeetingID = 'x')`,
+            `ID IN (SELECT m.PersonID FROM [__mj_BizAppsCommittees].[vwMemberships] m JOIN [__mj_BizAppsCommittees].[vwTerms] t ON m.TermID = t.ID WHERE t.CommitteeID = 'x' AND m.Status = 'Active')`,
+        ];
+        for (const c of clauses) {
+            expect(() => p.ScreenClause(c, 'ExtraFilter', md)).not.toThrow();
+        }
+    });
+
+    it('allows an ordinary comparison filter', () => {
+        expect(() =>
+            new Probe().ScreenClause(`Email = 'a@b.com' AND IsActive = 1`, 'ExtraFilter', provider())
+        ).not.toThrow();
+    });
+
+    it('does not false-positive on SELECT/EXISTS inside string literals', () => {
+        expect(() =>
+            new Probe().ScreenClause(`Name LIKE '%select%' OR Name = 'exists'`, 'ExtraFilter', provider())
+        ).not.toThrow();
+    });
+
+    it('allows empty/undefined clauses', () => {
+        expect(() => new Probe().ScreenClause('', 'ExtraFilter', provider())).not.toThrow();
+        expect(() => new Probe().ScreenClause(undefined, 'OrderBy', provider())).not.toThrow();
+    });
+
+    it('RunDynamicViewGeneric never reaches RunView when ExtraFilter hits a base table', async () => {
+        const captured: Captured = { params: null };
+        const input = {
+            EntityName: ENTITY_NAME,
+            ExtraFilter: `EXISTS (SELECT 1 FROM __mj.[User] WHERE Type='Owner')`,
+        } as RunDynamicViewInput;
+
+        await expect(new Probe().RunDynamic(input, fakeProvider(captured))).rejects.toThrow(
+            /entity base view/
+        );
+        expect(captured.params).toBeNull();
+    });
+
+    it('RunDynamicViewGeneric passes a BaseView subquery through to RunView', async () => {
+        const captured: Captured = { params: null };
+        const input = {
+            EntityName: ENTITY_NAME,
+            ExtraFilter: `ID IN (SELECT ID FROM [__mj].[vwUsers] WHERE Email = 'a@b.com')`,
+        } as RunDynamicViewInput;
+
+        await new Probe().RunDynamic(input, fakeProvider(captured));
+
+        expect(captured.params?.ExtraFilter).toBe(`ID IN (SELECT ID FROM [__mj].[vwUsers] WHERE Email = 'a@b.com')`);
+    });
+
+    it('RunDynamicViewGeneric passes a benign ExtraFilter through to RunView', async () => {
+        const captured: Captured = { params: null };
+        const input = {
+            EntityName: ENTITY_NAME,
+            ExtraFilter: `Email = 'a@b.com'`,
+        } as RunDynamicViewInput;
+
+        await new Probe().RunDynamic(input, fakeProvider(captured));
+
+        expect(captured.params?.ExtraFilter).toBe(`Email = 'a@b.com'`);
+    });
+});
+
+describe('ResolverBase.screenClientViewClauses — UserSearchString is free text, not a clause (#4392)', () => {
+    // The base-view AST screen wraps its argument as `SELECT 1 FROM x WHERE (<clause>)` and fails
+    // closed when that does not parse. Applied to UserSearchString it rejected everything that
+    // wasn't coincidentally valid SQL — which is most of what people type into a search box.
+    // UserSearchString never reaches SQL as a fragment: createViewUserSearchSQL builds the
+    // predicate and lands the text as an escaped literal, so the screen has nothing to screen.
+
+    const provider = () => fakeProvider({ params: null });
+
+    const searchTerms = [
+        'Marcus Chen',            // a space — parses as nothing
+        "O'Leary",                // unterminated literal
+        "Marcus O'Leary Chen",    // both
+        'Smith, John',            // punctuation
+        '50% off',                // LIKE metacharacter
+        'a_b [c]',                // more LIKE metacharacters
+        'select',                 // a keyword as a term
+        'drop table users',       // keywords with spaces
+        'Union Pacific',          // a real company name
+        "x' OR '1'='1",           // an injection attempt — escaped as a literal downstream
+        '  spaced  out  ',
+        'café ☕',
+    ];
+
+    it.each(searchTerms)('lets %j through the boundary screen', (term) => {
+        expect(() => new Probe().ScreenAll({ userSearchString: term }, provider())).not.toThrow();
+    });
+
+    it('still screens the three real clause fragments alongside it', () => {
+        const p = new Probe();
+        const md = provider();
+
+        expect(() =>
+            p.ScreenAll({ userSearchString: 'Marcus Chen', extraFilter: `EXISTS (SELECT 1 FROM __mj.[User])` }, md)
+        ).toThrow(/entity base view/);
+
+        expect(() =>
+            p.ScreenAll({ userSearchString: 'Marcus Chen', orderBy: '(SELECT COUNT(*) FROM __mj.APIKey)' }, md)
+        ).toThrow(/entity base view/);
+
+        expect(() =>
+            p.ScreenAll({ userSearchString: 'Marcus Chen', overrideExcludeFilter: `EXISTS (SELECT 1 FROM __mj.[User])` }, md)
+        ).toThrow(/entity base view/);
+    });
+
+    it('RunDynamicViewGeneric carries a multi-word search term through to RunView', async () => {
+        const captured: Captured = { params: null };
+        const input = { EntityName: ENTITY_NAME, UserSearchString: "Marcus O'Leary" } as RunDynamicViewInput;
+
+        await new Probe().RunDynamic(input, fakeProvider(captured));
+
+        expect(captured.params?.UserSearchString).toBe("Marcus O'Leary");
+    });
+});
+
 describe('ResolverBase.RunViewByNameGeneric — view-name escaping', () => {
     it('escapes the client-supplied view name', async () => {
         const captured: Captured = { params: null };

package/src/__tests__/ResolverBase.readableFieldsTransport.test.ts

@@ -0,0 +1,106 @@
+// ResolverBase transitively pulls in type-graphql decorators, which need the
+// Reflect.metadata polyfill at import time.
+import 'reflect-metadata';
+import { describe, it, expect } from 'vitest';
+import { ReadableFieldsTransportKey } from '@memberjunction/core';
+import type { EntityInfo, IMetadataProvider, UserInfo } from '@memberjunction/core';
+import { ResolverBase } from '../generic/ResolverBase.js';
+
+/**
+ * The server states IN-BAND which fields the caller may read.
+ *
+ * Deleting a denied key from the response object is not sufficient on its own: GraphQL emits
+ * every field the client SELECTED, so a denied field the client asked for arrives as an explicit
+ * `null` that is indistinguishable from a genuine one. The client must not settle that from its
+ * own metadata — that copy is wrong in the window right after a permission change, and will be
+ * wrong permanently once metadata is filtered for restricted users (issue #3485).
+ *
+ * The list names READABLE fields rather than denied ones, deliberately: naming denied fields
+ * would hand back precisely what metadata filtering exists to withhold.
+ */
+class TransportProbe extends ResolverBase {
+    public Build(entityInfo: EntityInfo, denied: Set<string> | null | undefined): string[] | null {
+        return this.BuildReadableFieldsTransportValue(entityInfo, denied);
+    }
+    public MapOne(entityName: string, row: unknown, provider: IMetadataProvider, user?: UserInfo, denied?: Set<string>) {
+        return this.MapFieldNamesToCodeNames(entityName, row, user, provider, denied);
+    }
+}
+
+const ENTITY_NAME = 'Employees';
+
+const FIELDS = [
+    { Name: 'ID', CodeName: 'ID' },
+    { Name: 'Name', CodeName: 'Name' },
+    { Name: 'Salary', CodeName: 'Salary' },
+    { Name: '__mj_CreatedAt', CodeName: '__mj_CreatedAt' },
+];
+
+function fakeEntityInfo(): EntityInfo {
+    return { Name: ENTITY_NAME, Fields: FIELDS, EncryptedFields: [] } as unknown as EntityInfo;
+}
+
+function fakeProvider(): IMetadataProvider {
+    return {
+        EntityByName: (name: string) => (name === ENTITY_NAME ? fakeEntityInfo() : undefined),
+    } as unknown as IMetadataProvider;
+}
+
+function row(): Record<string, unknown> {
+    return { ID: 'e-1', Name: 'Ada', Salary: 120000, __mj_CreatedAt: 'T0' };
+}
+
+describe('BuildReadableFieldsTransportValue', () => {
+    it('returns null when the caller is denied nothing — nothing to state', () => {
+        const probe = new TransportProbe();
+        expect(probe.Build(fakeEntityInfo(), null)).toBeNull();
+        expect(probe.Build(fakeEntityInfo(), undefined)).toBeNull();
+        expect(probe.Build(fakeEntityInfo(), new Set())).toBeNull();
+    });
+
+    it('lists the readable fields and never the denied one', () => {
+        const readable = new TransportProbe().Build(fakeEntityInfo(), new Set(['salary']));
+
+        expect(readable).toEqual(['ID', 'Name', '__mj_CreatedAt']);
+        // The whole point of the readable-list direction: a denied field's NAME is not disclosed.
+        expect(readable).not.toContain('Salary');
+    });
+
+    it('carries entity field NAMES, not the _mj__ transport shape', () => {
+        // The client consumes this AFTER reversing the transport rename and matches against
+        // EntityFieldInfo.Name — the same key the denied set is built from. Sending the shape
+        // both sides already agree on avoids a second mapping that could drift.
+        const readable = new TransportProbe().Build(fakeEntityInfo(), new Set(['salary']));
+        expect(readable).toContain('__mj_CreatedAt');
+        expect(readable).not.toContain('_mj__CreatedAt');
+    });
+});
+
+describe('MapFieldNamesToCodeNames attaches the transport key', () => {
+    it('strips the denied value AND says what remained readable', async () => {
+        const mapped = (await new TransportProbe().MapOne(
+            ENTITY_NAME, row(), fakeProvider(), undefined, new Set(['salary']),
+        )) as Record<string, unknown>;
+
+        expect(mapped.Salary).toBeUndefined();
+        expect(mapped[ReadableFieldsTransportKey]).toEqual(['ID', 'Name', '__mj_CreatedAt']);
+    });
+
+    it('omits the key entirely for an unrestricted caller', async () => {
+        // Nearly every request. A null here keeps the addition free where it is not needed.
+        const mapped = (await new TransportProbe().MapOne(
+            ENTITY_NAME, row(), fakeProvider(), undefined, new Set(),
+        )) as Record<string, unknown>;
+
+        expect(mapped[ReadableFieldsTransportKey]).toBeUndefined();
+        expect(mapped.Salary).toBe(120000);
+    });
+
+    it('does not write the key onto the caller\'s row', async () => {
+        const source = row();
+        await new TransportProbe().MapOne(ENTITY_NAME, source, fakeProvider(), undefined, new Set(['salary']));
+
+        expect(source[ReadableFieldsTransportKey]).toBeUndefined();
+        expect(source.Salary).toBe(120000);
+    });
+});

package/src/__tests__/UserViewResolver.updateWhereClause.test.ts

@@ -0,0 +1,114 @@
+/**
+ * UserViewResolver.updateWhereClause.test.ts — the `UpdateWhereClause` query.
+ *
+ * The endpoint exists so a dev can FORCE a view's WhereClause to be regenerated. Three things
+ * have to hold for it to actually do that:
+ *   1. it must use the READ-WRITE provider (it calls Save(); on a read-replica deployment the
+ *      read-only provider would route the write to the replica);
+ *   2. it must AWAIT the forced `UpdateWhereClause(true)` before saving — the un-awaited call it
+ *      used to make raced `Save()`, and `Save()` itself will not trigger a second pass because no
+ *      filter field is dirty;
+ *   3. it must fail clearly when the view cannot be loaded instead of saving a blank record.
+ */
+import 'reflect-metadata';
+import { describe, it, expect, vi } from 'vitest';
+import type { UserInfo } from '@memberjunction/core';
+import type { DatabaseProviderBase } from '@memberjunction/core';
+
+// The resolver's import chain reaches the 88k-line generated GraphQL schema (which loads server
+// config at import time) and the type-graphql decorators. None of that is under test here — the
+// provider selection (`../util.js`) and the resolver body are — so neutralize the chain.
+vi.mock('@memberjunction/server', () => {
+    const noopDecorator = () => () => undefined;
+    return { Arg: noopDecorator, Ctx: noopDecorator, Query: noopDecorator, Resolver: noopDecorator, Int: {} };
+});
+vi.mock('../generated/generated.js', () => ({
+    MJUserView_: class {},
+    // Only the one ResolverBase member the query uses.
+    MJUserViewResolverBase: class {
+        protected GetUserFromPayload(userPayload: { userRecord?: unknown } | undefined) {
+            return userPayload?.userRecord;
+        }
+    },
+}));
+vi.mock('../resolvers/UserResolver.js', () => ({ UserResolver: class {} }));
+
+import { UserViewResolver } from '../resolvers/UserViewResolver.js';
+import type { AppContext, ProviderInfo, UserPayload } from '../types.js';
+
+const VIEW_ID = '0F8FAD5B-D9CB-469F-A165-70867728950E';
+const USER = { ID: 'user-1', Email: 'dev@example.com' } as unknown as UserInfo;
+
+interface FakeView {
+    Load: ReturnType<typeof vi.fn>;
+    UpdateWhereClause: ReturnType<typeof vi.fn>;
+    Save: ReturnType<typeof vi.fn>;
+    GetAll: ReturnType<typeof vi.fn>;
+}
+
+function makeView(opts: { loadOk: boolean; saveOk?: boolean }): { view: FakeView; order: string[] } {
+    const order: string[] = [];
+    const view: FakeView = {
+        Load: vi.fn(async () => { order.push('load'); return opts.loadOk; }),
+        // Resolve on a later tick so an un-awaited call would let Save() run first.
+        UpdateWhereClause: vi.fn(() => new Promise<void>(resolve => setTimeout(() => { order.push('update'); resolve(); }, 5))),
+        Save: vi.fn(async () => { order.push('save'); return opts.saveOk ?? true; }),
+        GetAll: vi.fn(() => ({ ID: VIEW_ID, WhereClause: '[IsActive] = 1' })),
+    };
+    return { view, order };
+}
+
+function makeProvider(view: FakeView): DatabaseProviderBase & { GetEntityObject: ReturnType<typeof vi.fn> } {
+    return { GetEntityObject: vi.fn(async () => view) } as unknown as DatabaseProviderBase & { GetEntityObject: ReturnType<typeof vi.fn> };
+}
+
+function makeContext(providers: ProviderInfo[]): AppContext {
+    return {
+        providers,
+        userPayload: { userRecord: USER } as unknown as UserPayload,
+    } as unknown as AppContext;
+}
+
+describe('UserViewResolver.UpdateWhereClause', () => {
+    it('uses the READ-WRITE provider, awaits the forced regeneration, then saves and returns the record', async () => {
+        const { view, order } = makeView({ loadOk: true });
+        const readOnly = makeProvider(makeView({ loadOk: true }).view);
+        const readWrite = makeProvider(view);
+        const ctx = makeContext([
+            { provider: readOnly, type: 'Read-Only' },
+            { provider: readWrite, type: 'Read-Write' },
+        ]);
+
+        const result = await new UserViewResolver().UpdateWhereClause(VIEW_ID, ctx);
+
+        expect(readWrite.GetEntityObject).toHaveBeenCalledWith('MJ: User Views', USER);
+        expect(readOnly.GetEntityObject).not.toHaveBeenCalled();
+        expect(view.Load).toHaveBeenCalledWith(VIEW_ID);
+        expect(view.UpdateWhereClause).toHaveBeenCalledWith(true);
+        // The regeneration must complete BEFORE Save() runs.
+        expect(order).toEqual(['load', 'update', 'save']);
+        expect(result).toEqual({ ID: VIEW_ID, WhereClause: '[IsActive] = 1' });
+    });
+
+    it('falls back to the only provider available when no read-write provider is registered', async () => {
+        const { view } = makeView({ loadOk: true });
+        const only = makeProvider(view);
+        await new UserViewResolver().UpdateWhereClause(VIEW_ID, makeContext([{ provider: only, type: 'Read-Only' }]));
+        expect(only.GetEntityObject).toHaveBeenCalledTimes(1);
+        expect(view.Save).toHaveBeenCalledTimes(1);
+    });
+
+    it('throws and never regenerates or saves when the view cannot be loaded', async () => {
+        const { view } = makeView({ loadOk: false });
+        const ctx = makeContext([{ provider: makeProvider(view), type: 'Read-Write' }]);
+        await expect(new UserViewResolver().UpdateWhereClause(VIEW_ID, ctx)).rejects.toThrow(/not found or access denied/);
+        expect(view.UpdateWhereClause).not.toHaveBeenCalled();
+        expect(view.Save).not.toHaveBeenCalled();
+    });
+
+    it('throws when Save() reports failure', async () => {
+        const { view } = makeView({ loadOk: true, saveOk: false });
+        const ctx = makeContext([{ provider: makeProvider(view), type: 'Read-Write' }]);
+        await expect(new UserViewResolver().UpdateWhereClause(VIEW_ID, ctx)).rejects.toThrow(/Failed to update where clause/);
+    });
+});

package/src/__tests__/WidgetSessionService.test.ts

@@ -10,7 +10,10 @@ vi.mock('../config.js', () => ({
 }));
 vi.mock('@memberjunction/generic-database-provider', () => ({
   UserCache: {
-    Instance: { Users: [], UserByName: () => undefined, GetSystemUser: () => undefined },
+    // The subject reads exactly these two through `ResolveConfiguredPrincipal`. It no longer
+    // calls `UserByName`/`GetSystemUser`, and stubbing members nobody calls hides the day a
+    // test does reach `resolveLookupUser` and trips the resolver's missing-system-id guard.
+    Instance: { Users: [], SYSTEM_USER_ID: 'ECAFCCEC-6A37-EF11-86D4-000D3A4E707E' },
     Users: [],
   },
 }));

package/src/__tests__/generatedGraphQLSchema.structural.test.ts

@@ -0,0 +1,46 @@
+import { describe, it, expect } from 'vitest';
+import { readFileSync, existsSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import ts from 'typescript';
+
+describe('Generated GraphQL Schema Structural Rules', () => {
+    it('requires every entity ObjectType declaring _mj__CreatedAt to also declare ReadableFields___', () => {
+        const schemaPath = fileURLToPath(new URL('../generated/graphql-schemas/__mj.ts', import.meta.url));
+        expect(existsSync(schemaPath), `Schema file must exist at ${schemaPath}`).toBe(true);
+
+        const sourceCode = readFileSync(schemaPath, 'utf8');
+        const sourceFile = ts.createSourceFile('__mj.ts', sourceCode, ts.ScriptTarget.Latest, true);
+
+        const violations: string[] = [];
+        let checkedEntitiesCount = 0;
+
+        ts.forEachChild(sourceFile, (node) => {
+            if (ts.isClassDeclaration(node) && node.name) {
+                const className = node.name.text;
+                const memberNames = new Set<string>();
+
+                for (const member of node.members) {
+                    if (member.name) {
+                        if (ts.isIdentifier(member.name)) {
+                            memberNames.add(member.name.text);
+                        } else {
+                            memberNames.add(member.name.getText(sourceFile));
+                        }
+                    }
+                }
+
+                if (memberNames.has('_mj__CreatedAt')) {
+                    checkedEntitiesCount++;
+                    if (!memberNames.has('ReadableFields___')) {
+                        violations.push(className);
+                    }
+                }
+            }
+        });
+
+        // Sanity guard: make sure we actually inspected entity classes in the file
+        expect(checkedEntitiesCount).toBeGreaterThan(0);
+        // Per-class rule: no entity ObjectType declaring _mj__CreatedAt may omit ReadableFields___
+        expect(violations).toEqual([]);
+    });
+});

package/src/__tests__/newUserRolesDefault.test.ts

@@ -0,0 +1,81 @@
+/**
+ * Config-contract regression test for the shipped `userHandling.newUserRoles` default (issue #4260).
+ *
+ * THE DEFECT. `DEFAULT_SERVER_CONFIG` shipped `newUserRoles: ['UI', 'Developer']`. On the baseline
+ * seed the `Developer` role holds `CanUpdate` on 439 of the database's 446 entities with no row-level filter —
+ * `MJ: Users` among them, where `AllowUpdateAPI` is true and both `Type` and `Name` are
+ * `AllowUpdateAPI` fields. Every gate in the chain passes:
+ *
+ *   config default -> newUsers.ts assigns the role -> EntityPermission grants Update
+ *   -> Entity/Field AllowUpdateAPI allow it -> BaseEntity.CheckPermissions passes
+ *   -> GRANT EXECUTE ON __mj.spUpdateUser TO cdp_Developer
+ *
+ * So anyone who obtained an account through JWT auto-provisioning or a magic-link redeem could
+ * write any row of `MJ: Users` — including setting their own `Type` to `'Owner'`, the column MJ's
+ * superuser checks read (`SqlLoggingConfigResolver`, `canIssueInvites`, the backup-system-user
+ * fallback). That is privilege escalation from "can obtain a token" to "platform Owner".
+ *
+ * WHY THE DEFAULT IS THE FIX. The value is not merely the fallback for a host with no config file.
+ * `loadConfig()` deep-merges through `mergeConfigs`, so a host writing a PARTIAL `userHandling`
+ * block (`{ autoCreateNewUsers: true }`, say) inherits this array — the Zod `.default([])` on the
+ * schema never fires, because the key is never absent after the merge. The shipped default is
+ * therefore the effective posture of every deployment that does not name `newUserRoles` explicitly.
+ *
+ * These assertions pin the CONTRACT, not just the literal: the shipped default must grant an
+ * auto-provisioned user no more than the end-user surface.
+ */
+import { describe, it, expect, vi } from 'vitest';
+
+// config.ts evaluates `configInfo = loadConfig()` at module load, and `loadConfig` rejects a
+// configuration carrying no database credentials. Stubbing the cosmiconfig search — and ONLY that —
+// supplies them so the module imports, while leaving `DEFAULT_SERVER_CONFIG` itself completely
+// untouched. These assertions therefore run against the constant the server actually ships rather
+// than against a copy of it, which is the whole point of a shipped-default contract test.
+vi.mock('cosmiconfig', () => ({
+  cosmiconfigSync: () => ({
+    search: () => ({
+      filepath: '/test/mj.config.cjs',
+      isEmpty: false,
+      config: { dbUsername: 'test-user', dbPassword: 'test-password', dbDatabase: 'test-db' },
+    }),
+  }),
+}));
+
+import { DEFAULT_SERVER_CONFIG } from '../config.js';
+
+/**
+ * Seeded roles that carry platform-wide write on the baseline database, and so must never appear
+ * in a default handed to a party the host has not vetted. `Integration`'s own seed Description
+ * says it "shouldn't be applied to end-users"; `Developer` is the role this issue was filed about.
+ */
+const PLATFORM_WRITE_ROLES = ['Developer', 'Integration'];
+
+describe('DEFAULT_SERVER_CONFIG.userHandling.newUserRoles (issue #4260)', () => {
+  const newUserRoles = DEFAULT_SERVER_CONFIG.userHandling?.newUserRoles;
+
+  it('grants auto-provisioned users the end-user role only', () => {
+    expect(newUserRoles).toEqual(['UI']);
+  });
+
+  it.each(PLATFORM_WRITE_ROLES)('does not include the platform-write role %j', role => {
+    // The regression itself. Before the fix, 'Developer' was present here and every
+    // auto-provisioned user could UPDATE MJ: Users, Type and Name included.
+    expect(newUserRoles).not.toContain(role);
+  });
+
+  it('is not empty — an auto-provisioned user must still be able to use the product', () => {
+    // The opposite failure mode: locking the default down to [] would provision users who
+    // cannot read their own conversations, views or dashboards. 'UI' is the seeded role that
+    // carries exactly that end-user surface (48 update grants, none of them on MJ: Users).
+    expect(newUserRoles?.length).toBeGreaterThan(0);
+  });
+
+  it('stays minimal because auto-provisioning is ON by default with no domain restriction', () => {
+    // This is the linkage that makes the role list security-relevant rather than a convenience
+    // setting. A stock server auto-creates an account for ANY identity its configured IdP will
+    // issue a token for. If either of these defaults is ever tightened, the role list may be
+    // reconsidered — but not before, and never in the other order.
+    expect(DEFAULT_SERVER_CONFIG.userHandling?.autoCreateNewUsers).toBe(true);
+    expect(DEFAULT_SERVER_CONFIG.userHandling?.newUserLimitedToAuthorizedDomains).toBe(false);
+  });
+});