@memberjunction/server 6.1.0-edge.5 → 6.1.0-edge.7

package/src/__tests__/newUsers.test.ts

@@ -21,7 +21,7 @@ import type { UserInfo } from '@memberjunction/core';
 const {
     mockConfig,
     mockCacheUsers,
-    mockUserByName,
+    mockSystemUserId,
     mockRefresh,
     mockGetEntityObject,
     mockRunViewFn,
@@ -39,6 +39,7 @@ const {
         Name: string;
         Email: string;
         Type: string;
+        IsActive?: boolean;
     }
     return {
         mockConfig: {
@@ -55,7 +56,11 @@ const {
             },
         },
         mockCacheUsers: [] as HoistedCacheUser[],
-        mockUserByName: vi.fn(),
+        // The system user's ID as the cache reports it. A well-formed UUID that matches NO fixture
+        // below, so the resolver's system rung stays inert unless a test opts into it. Well-formed
+        // matters: `UUIDsEqual` is a string compare with no shape check, so a malformed value here
+        // would read as real data while being unrepresentable in the column it stands for.
+        mockSystemUserId: { value: '00000000-0000-0000-0000-00000000d1f5' },
         mockRefresh: vi.fn(),
         mockGetEntityObject: vi.fn(),
         mockRunViewFn: vi.fn(),
@@ -76,10 +81,12 @@ vi.mock('../config.js', () => ({ configInfo: mockConfig }));
 
 vi.mock('@memberjunction/generic-database-provider', () => {
     const instance = {
-        UserByName: mockUserByName,
         get Users() {
             return mockCacheUsers;
         },
+        get SYSTEM_USER_ID() {
+            return mockSystemUserId.value;
+        },
         Refresh: mockRefresh,
         GetSystemUser: vi.fn(),
     };
@@ -234,7 +241,9 @@ function entitiesOf(name: string): MockEntity[] {
     return createdEntities.filter((e) => e.TestEntityName === name);
 }
 
-const CONTEXT_USER = { ID: 'sys-1', Name: 'system@test.com', Email: 'system@test.com', Type: 'Owner' } as unknown as UserInfo;
+/** The cache row for the configured context user; `CONTEXT_USER` is the same object, typed. */
+const CONTEXT_USER_ROW = { ID: 'sys-1', Name: 'system@test.com', Email: 'system@test.com', Type: 'Owner', IsActive: true };
+const CONTEXT_USER = CONTEXT_USER_ROW as unknown as UserInfo;
 
 function resetConfig(): void {
     mockConfig.userHandling = {
@@ -261,14 +270,22 @@ beforeEach(() => {
     getEntityObjectCalls = [];
     saveBehavior = {};
     entitySeq = 0;
+    // defineProperty rather than assignment: one test replaces this with a throwing getter.
+    Object.defineProperty(mockSystemUserId, 'value', {
+        value: '00000000-0000-0000-0000-00000000d1f5',
+        writable: true,
+        configurable: true,
+    });
+    // The configured context user must be IN the cache: resolution reads the cache directly rather
+    // than going through a UserByName stub that answered regardless of what the cache held.
     mockCacheUsers.length = 0;
+    mockCacheUsers.push(CONTEXT_USER_ROW);
 
     mockRolesArray.length = 0;
     mockRolesArray.push({ ID: 'role-ui', Name: 'UI' }, { ID: 'role-dev', Name: 'Developer' });
     mockApplicationsArray.length = 0;
     mockApplicationsArray.push({ ID: 'app-crm', Name: ' CRM ' }, { ID: 'app-admin', Name: 'Admin' });
 
-    mockUserByName.mockImplementation((name: string) => (name === 'system@test.com' ? CONTEXT_USER : undefined));
     mockGetEntityObject.mockImplementation(async (entityName: string, contextUser?: UserInfo) => {
         const entity = makeMockEntity(entityName);
         createdEntities.push(entity);
@@ -290,7 +307,6 @@ describe('NewUserBase.createNewUser', () => {
             const user = await create();
 
             expect(user).not.toBeNull();
-            expect(mockUserByName).toHaveBeenCalledWith('system@test.com');
             expect(getEntityObjectCalls[0]).toEqual({ entityName: 'MJ: Users', contextUser: CONTEXT_USER });
             // Role records are scoped to the same creation context user
             for (const call of getEntityObjectCalls) {
@@ -299,9 +315,9 @@ describe('NewUserBase.createNewUser', () => {
         });
 
         it('falls back to an Owner-typed cache user (case-insensitive, trimmed) when the configured user is missing', async () => {
-            mockUserByName.mockReturnValue(undefined);
-            const owner = { ID: 'owner-9', Name: 'Fallback Owner', Email: 'owner@x.com', Type: '  OWNER  ' };
-            mockCacheUsers.push({ ID: 'u-1', Name: 'Plain', Email: 'p@x.com', Type: 'User' }, owner);
+            const owner = { ID: 'owner-9', Name: 'Fallback Owner', Email: 'owner@x.com', Type: '  OWNER  ', IsActive: true };
+            mockCacheUsers.length = 0; // the configured user is absent from this deployment
+            mockCacheUsers.push({ ID: 'u-1', Name: 'Plain', Email: 'p@x.com', Type: 'User', IsActive: true }, owner);
 
             const user = await create();
 
@@ -311,8 +327,8 @@ describe('NewUserBase.createNewUser', () => {
         });
 
         it('returns null without opening a transaction when no context user can be resolved at all', async () => {
-            mockUserByName.mockReturnValue(undefined);
-            mockCacheUsers.push({ ID: 'u-1', Name: 'Plain', Email: 'p@x.com', Type: 'User' });
+            mockCacheUsers.length = 0; // no configured user, no system user, no Owner
+            mockCacheUsers.push({ ID: 'u-1', Name: 'Plain', Email: 'p@x.com', Type: 'User', IsActive: true });
 
             const user = await create();
 
@@ -322,8 +338,12 @@ describe('NewUserBase.createNewUser', () => {
         });
 
         it('returns undefined (outer catch) when context resolution throws', async () => {
-            mockUserByName.mockImplementation(() => {
-                throw new Error('cache exploded');
+            // A cache that cannot report its own system user id fails resolution outright.
+            Object.defineProperty(mockSystemUserId, 'value', {
+                get() {
+                    throw new Error('cache exploded');
+                },
+                configurable: true,
             });
 
             const user = await create();
@@ -604,7 +624,9 @@ describe('verifyUserRecord', () => {
             const user = await verifyUserRecord('new@example.com', 'New', 'User');
 
             expect(user).toBeUndefined();
-            expect(mockCacheUsers).toHaveLength(0);
+            // The cache is no longer empty at rest (it holds the configured context user), so
+            // assert the thing that actually matters: the failed user was not added to it.
+            expect(mockCacheUsers.some((u) => u.Email === 'new@example.com')).toBe(false);
         });
     });
 

package/src/__tests__/principals.callSites.test.ts

@@ -0,0 +1,112 @@
+/**
+ * There is ONE resolver for the three config-named context users — issue #4209, second half.
+ *
+ * The bug was not that a lookup used the wrong column; it was that the lookup was written out by
+ * hand at every consumer. Six copies existed across MJServer in three mutually inconsistent
+ * variants, and two of them could not resolve the value MJ itself ships. `auth/principals.ts`
+ * exists to make that impossible, and this test is what keeps it that way: any file that reads
+ * one of the three settings must go through the ladder rather than growing a fourth variant.
+ *
+ * Source-scanning rather than behavioural because the failure mode is *a new call site*, which no
+ * behavioural test of the existing call sites can see. Same technique as
+ * `AdhocQueryResolver.scopeGuard.test.ts` and `serverExtensionReservedRoots.test.ts`.
+ */
+import { describe, it, expect } from 'vitest';
+import { readdirSync, readFileSync, statSync } from 'fs';
+import { dirname, join, relative, sep } from 'path';
+import { fileURLToPath } from 'url';
+
+const SRC_ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+
+/** The three settings that name a principal in config. `config.ts` DEFINES them; it does not resolve them. */
+const CONTEXT_USER_SETTINGS = [
+    'contextUserForNewUserCreation',
+    'contextUserForProvisioning',
+    'contextUserForLookup',
+] as const;
+
+/**
+ * Files that legitimately mention a setting without resolving it, as paths RELATIVE TO `src/`.
+ * Deliberately not basenames: exempting every file called `config.ts` anywhere under `src/` would
+ * let a future `realtimeWidget/config.ts` hand-roll a lookup and still pass this guard.
+ */
+const NOT_CONSUMERS = ['config.ts', 'auth/principals.ts'];
+
+/** `src/`-relative, forward-slashed, so the assertions below read the same on every platform. */
+function relativeToSrc(absolutePath: string): string {
+    return relative(SRC_ROOT, absolutePath).split(sep).join('/');
+}
+
+function everyTsFileUnder(dir: string): string[] {
+    return readdirSync(dir).flatMap((name) => {
+        const full = join(dir, name);
+        if (statSync(full).isDirectory()) {
+            return name === '__tests__' || name === 'generated' ? [] : everyTsFileUnder(full);
+        }
+        return name.endsWith('.ts') && !name.endsWith('.d.ts') ? [full] : [];
+    });
+}
+
+/** Files that READ one of the settings — i.e. resolve it to a user, rather than declaring it. */
+function consumersOfAContextUserSetting(): { path: string; source: string }[] {
+    return everyTsFileUnder(SRC_ROOT)
+        .filter((p) => !NOT_CONSUMERS.includes(relativeToSrc(p)))
+        .map((path) => ({ path: relativeToSrc(path), source: readFileSync(path, 'utf8') }))
+        .filter(({ source }) => CONTEXT_USER_SETTINGS.some((s) => source.includes(`.${s}`)));
+}
+
+describe('context-user resolution has exactly one implementation', () => {
+    it('finds the known consumers, so the scan itself is not silently matching nothing', () => {
+        const found = consumersOfAContextUserSetting().map((c) => c.path);
+
+        expect(found).toContain('auth/newUsers.ts');
+        expect(found).toContain('auth/magicLink/MagicLinkService.ts');
+    });
+
+    it('routes every consumer through auth/principals.ts', () => {
+        const handRolled = consumersOfAContextUserSetting()
+            .filter(({ source }) => !source.includes('ResolveConfiguredPrincipal'))
+            .map(({ path }) => path);
+
+        expect(handRolled).toEqual([]);
+    });
+
+    it('leaves no consumer matching the setting against a single column by hand', () => {
+        // The two shapes that produced #4209: `UserByName(candidate)` and `u.Email === candidate`.
+        //
+        // Scoped to the statement that READS the setting, not the whole file: MagicLinkService
+        // also resolves the INVITEE by Email (`provisionUser`, ~270 lines away), which is tier-1
+        // identity and correct. A file-wide grep would condemn it, and a guard that cries wolf
+        // gets deleted.
+        const COLUMN_MATCH = /UserByName\s*\(|\.(Email|Name)\b[^\n]*===/;
+        const handRolled = consumersOfAContextUserSetting()
+            .filter(({ source }) =>
+                source.split('\n').some(
+                    (line) => CONTEXT_USER_SETTINGS.some((s) => line.includes(`.${s}`)) && COLUMN_MATCH.test(line),
+                ),
+            )
+            .map(({ path }) => path);
+
+        expect(handRolled).toEqual([]);
+    });
+});
+
+describe('the ladder is reachable by the integrators the example is written for', () => {
+    // `exampleNewUserSubClass.ts` exists to be COPIED into a deployment's own package — its header
+    // says so, and it tells you to uncomment `@RegisterClass` in your code. Now that it resolves
+    // through `ResolveConfiguredPrincipal`, an integrator who copies it needs to be able to import
+    // that. `package.json` publishes only `"."`, so the package index is the whole public surface,
+    // and this guard cannot see downstream code — it can only make sure the door exists.
+    it('exports ResolveConfiguredPrincipal from the package index', () => {
+        const index = readFileSync(join(SRC_ROOT, 'index.ts'), 'utf8');
+
+        expect(index).toMatch(/ResolveConfiguredPrincipal/);
+    });
+
+    it('exports the types a caller needs to hold the result', () => {
+        const index = readFileSync(join(SRC_ROOT, 'index.ts'), 'utf8');
+
+        expect(index).toMatch(/ResolvablePrincipal/);
+        expect(index).toMatch(/PrincipalResolution/);
+    });
+});

package/src/__tests__/principals.logging.test.ts

@@ -0,0 +1,160 @@
+/**
+ * Log policy for context-user resolution — the second half of issue #4209.
+ *
+ * The defect had two costs. One was attribution (covered by principals.test.ts). The other was
+ * volume: because the shipped default could never resolve, EVERY magic-link redeem and EVERY
+ * auto-provisioned user emitted an error-level line, on every host that took the default. Real
+ * errors were buried under it.
+ *
+ * Resolution is a pure function; this file covers the impure shell around it — reading the user
+ * cache and deciding how often a misconfiguration is worth saying out loud.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+const { mockLogError, mockUsers, SYSTEM_USER_ID } = vi.hoisted(() => ({
+    mockLogError: vi.fn(),
+    mockUsers: [] as Array<Record<string, unknown>>,
+    SYSTEM_USER_ID: 'ECAFCCEC-6A37-EF11-86D4-000D3A4E707E',
+}));
+
+vi.mock('@memberjunction/core', () => ({
+    LogError: mockLogError,
+    UserInfo: class {},
+}));
+
+vi.mock('@memberjunction/generic-database-provider', () => ({
+    UserCache: {
+        get Users() {
+            return mockUsers;
+        },
+        Instance: {
+            get Users() {
+                return mockUsers;
+            },
+            get SYSTEM_USER_ID() {
+                return SYSTEM_USER_ID;
+            },
+        },
+    },
+}));
+
+/** Stock seed: the system user MJ's own default is aiming at, plus a human Owner. */
+const SYSTEM = { ID: SYSTEM_USER_ID, Name: 'System', Email: 'not.set@nowhere.com', Type: 'Owner          ', IsActive: true };
+const HOST_ADMIN = { ID: 'AAAA1111-0000-0000-0000-000000000001', Name: 'jane.admin@acme.com', Email: 'jane.admin@acme.com', Type: 'Owner', IsActive: true };
+
+/** Fresh module per test: the de-duplication state is module-scoped by design. */
+async function loadSubject() {
+    vi.resetModules();
+    return import('../auth/principals.js');
+}
+
+beforeEach(() => {
+    vi.clearAllMocks();
+    mockUsers.length = 0;
+    mockUsers.push(SYSTEM, HOST_ADMIN);
+});
+
+describe('ResolveConfiguredPrincipal', () => {
+    it('resolves MJ\'s own shipped default without logging anything', async () => {
+        const { ResolveConfiguredPrincipal } = await loadSubject();
+
+        const user = ResolveConfiguredPrincipal('not.set@nowhere.com', 'MagicLink');
+
+        expect(user).toBe(SYSTEM);
+        expect(mockLogError).not.toHaveBeenCalled();
+    });
+
+    it('logs an unresolvable candidate ONCE however many times it is asked for', async () => {
+        const { ResolveConfiguredPrincipal } = await loadSubject();
+
+        for (let i = 0; i < 25; i++) {
+            ResolveConfiguredPrincipal('ghost@nowhere.example', 'MagicLink');
+        }
+
+        expect(mockLogError).toHaveBeenCalledTimes(1);
+    });
+
+    it('names both the purpose and the candidate so the operator can find the setting', async () => {
+        const { ResolveConfiguredPrincipal } = await loadSubject();
+
+        ResolveConfiguredPrincipal('ghost@nowhere.example', 'MagicLink');
+
+        const logged = String(mockLogError.mock.calls[0][0]);
+        expect(logged).toContain('MagicLink');
+        expect(logged).toContain('ghost@nowhere.example');
+    });
+
+    it('still reports a DIFFERENT misconfiguration rather than swallowing it', async () => {
+        const { ResolveConfiguredPrincipal } = await loadSubject();
+
+        ResolveConfiguredPrincipal('ghost@nowhere.example', 'MagicLink');
+        ResolveConfiguredPrincipal('other@nowhere.example', 'MagicLink');
+
+        expect(mockLogError).toHaveBeenCalledTimes(2);
+    });
+
+    it('reports the same candidate separately for a different purpose', async () => {
+        const { ResolveConfiguredPrincipal } = await loadSubject();
+
+        ResolveConfiguredPrincipal('ghost@nowhere.example', 'MagicLink');
+        ResolveConfiguredPrincipal('ghost@nowhere.example', 'Widget');
+
+        expect(mockLogError).toHaveBeenCalledTimes(2);
+    });
+
+    it('does not treat an unset candidate as a misconfiguration', async () => {
+        const { ResolveConfiguredPrincipal } = await loadSubject();
+
+        const user = ResolveConfiguredPrincipal(undefined, 'NewUser');
+
+        expect(user).toBe(SYSTEM);
+        expect(mockLogError).not.toHaveBeenCalled();
+    });
+
+    it('returns null and says so when the deployment offers no principal at all', async () => {
+        mockUsers.length = 0;
+        const { ResolveConfiguredPrincipal } = await loadSubject();
+
+        const user = ResolveConfiguredPrincipal('ghost@nowhere.example', 'MagicLink');
+
+        expect(user).toBeNull();
+        expect(mockLogError).toHaveBeenCalledTimes(1);
+    });
+});
+
+describe('the misconfiguration report stays bounded WITHOUT regressing to per-request logging', () => {
+    it('publishes its bound, so this test cannot silently pass against a different one', async () => {
+        const { MAX_REPORTED_MISCONFIGURATIONS } = await loadSubject();
+
+        expect(typeof MAX_REPORTED_MISCONFIGURATIONS).toBe('number');
+        expect(MAX_REPORTED_MISCONFIGURATIONS).toBeGreaterThan(0);
+    });
+
+    it('still says a NEW misconfiguration exactly once after the bound is reached', async () => {
+        // The bound exists so a caller passing a per-request candidate cannot grow the tracker
+        // forever. But whatever it does at the limit must not be "log every time" — that is
+        // precisely the per-request error line issue #4209 was filed about, reintroduced for the
+        // one caller the bound was added for.
+        const { ResolveConfiguredPrincipal, MAX_REPORTED_MISCONFIGURATIONS } = await loadSubject();
+        expect(typeof MAX_REPORTED_MISCONFIGURATIONS).toBe('number'); // else the loop below is a no-op and this passes for free
+        for (let i = 0; i < MAX_REPORTED_MISCONFIGURATIONS + 5; i++) {
+            ResolveConfiguredPrincipal(`filler-${i}@nowhere.example`, 'MagicLink');
+        }
+        mockLogError.mockClear();
+
+        ResolveConfiguredPrincipal('late@nowhere.example', 'MagicLink');
+        ResolveConfiguredPrincipal('late@nowhere.example', 'MagicLink');
+        ResolveConfiguredPrincipal('late@nowhere.example', 'MagicLink');
+
+        expect(mockLogError).toHaveBeenCalledTimes(1);
+    });
+
+    it('does not grow without bound', async () => {
+        const { ResolveConfiguredPrincipal, ReportedMisconfigurationCount, MAX_REPORTED_MISCONFIGURATIONS } = await loadSubject();
+        for (let i = 0; i < MAX_REPORTED_MISCONFIGURATIONS * 3; i++) {
+            ResolveConfiguredPrincipal(`filler-${i}@nowhere.example`, 'MagicLink');
+        }
+
+        expect(ReportedMisconfigurationCount()).toBeLessThanOrEqual(MAX_REPORTED_MISCONFIGURATIONS);
+    });
+});