@memberjunction/server 6.1.3 → 6.1.5

package/src/__tests__/RealtimeClientSessionResolver.test.ts

@@ -3,7 +3,7 @@
 // bring it in automatically — this line MUST precede any import that pulls in the resolver file.
 import 'reflect-metadata';
 
-import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 
 // --- Mock CanRun authorization (AIAgentPermissionHelper.HasPermission) plus the
 //     provider-scoped AIEngineBase whose cached metadata serves the resolver's pairing-row
@@ -210,9 +210,23 @@ interface FakeSession {
     NewRecord: () => void;
     Save: () => Promise<boolean>;
     Load: (id: string) => Promise<boolean>;
-    LatestResult?: { CompleteMessage?: string };
+    LatestResult?: { CompleteMessage?: string; Success?: boolean };
+    /** Only set on the fakes exercising `describeSaveFailure`'s "no failure detail recorded" branches. */
+    ResultHistory?: unknown[];
 }
 
+/**
+ * A `console.error` spy shared by the save-failure-log tests (#4791) below. Assigned with
+ * `vi.spyOn(console, 'error').mockImplementation(() => undefined)` inside each test that needs it
+ * — restored here so no test leaks a mocked `console.error` into the ones after it.
+ */
+let errSpy: ReturnType<typeof vi.spyOn> | undefined;
+
+afterEach(() => {
+    errSpy?.mockRestore();
+    errSpy = undefined;
+});
+
 function makeSessionEntity(overrides: Partial<FakeSession> = {}): FakeSession {
     return {
         ID: 'session-1',
@@ -848,6 +862,28 @@ describe('RealtimeClientSessionResolver.ExecuteRealtimeSessionTool', () => {
             resolver.ExecuteRealtimeSessionTool('session-1', 'call-1', 'x', '{}', makeCtx(), makePubSub()),
         ).rejects.toThrow(/no target agent configured/i);
     });
+
+    it('logs the session id and "no failure detail recorded" when updatePendingFeedbackRunID\'s save is refused silently (#4791)', async () => {
+        errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+        const session = makeSessionEntity({
+            Config_: JSON.stringify({ targetAgentID: 'target-1' }),
+            Save: vi.fn(async () => false),
+            LatestResult: undefined,
+            ResultHistory: [],
+        });
+        currentProvider = makeProvider(() => session);
+        executeRelayedToolMock.mockResolvedValue({ ResultJson: '{"q":1}', Success: true, PausedRunID: 'paused-1' });
+        const resolver = makeResolver();
+
+        await resolver.ExecuteRealtimeSessionTool('session-1', 'call-1', 'invoke-target-agent', '{}', makeCtx(), makePubSub());
+
+        const loggedLines = errSpy.mock.calls.map((call) => String(call[0]));
+        const failureLine = loggedLines.find((line) => line.includes('updatePendingFeedbackRunID'));
+        expect(failureLine).toBeDefined();
+        expect(failureLine).toContain('session-1');
+        expect(failureLine).toContain('no failure detail recorded');
+        expect(failureLine).not.toContain('unknown error');
+    });
 });
 
 describe('RealtimeClientSessionResolver.RelayRealtimeTranscript', () => {
@@ -1690,6 +1726,7 @@ describe('RealtimeClientSessionResolver.SaveSessionChannelArtifact', () => {
     });
 
     it('returns a structured failure when the artifact header save fails (no version attempted)', async () => {
+        errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
         const failingArtifact = makeSessionEntity({
             ID: 'artifact-fail',
             Save: vi.fn(async () => false),
@@ -1706,10 +1743,14 @@ describe('RealtimeClientSessionResolver.SaveSessionChannelArtifact', () => {
 
         expect(result.Success).toBe(false);
         expect(result.ErrorMessage).toMatch(/artifact save failed/i);
+        expect(result.ErrorMessage).toContain('session session-1');
+        expect(result.ErrorMessage).toContain('db down');
+        expect(errSpy.mock.calls.map((call) => String(call[0]))).toContain(result.ErrorMessage);
         expect(version.Save).not.toHaveBeenCalled();
     });
 
     it('returns a structured failure (carrying the orphaned ArtifactID) when the version save fails', async () => {
+        errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
         const failingVersion = makeSessionEntity({
             ID: 'version-fail',
             Save: vi.fn(async () => false),
@@ -1728,6 +1769,10 @@ describe('RealtimeClientSessionResolver.SaveSessionChannelArtifact', () => {
         expect(result.Success).toBe(false);
         expect(result.ArtifactID).toBe('artifact-1');
         expect(result.ArtifactVersionID).toBeUndefined();
+        expect(result.ErrorMessage).toMatch(/artifact version save failed/i);
+        expect(result.ErrorMessage).toContain('session session-1');
+        expect(result.ErrorMessage).toContain('too big');
+        expect(errSpy.mock.calls.map((call) => String(call[0]))).toContain(result.ErrorMessage);
         expect(junction.Save).not.toHaveBeenCalled();
     });
 
@@ -2880,6 +2925,44 @@ describe('RealtimeClientSessionResolver — scoped-anonymous elevation (issue #3
         expect(executeRelayedToolMock.mock.calls[0][1]).toBe(ANON_USER);
     });
 
+    it('writes the hidden direct-action tool turn (ExecuteRealtimeSessionTool) as the CALLER, not the system user (#4791)', async () => {
+        const detail = makeSessionEntity({ ID: 'detail-1' });
+        currentProvider = {
+            GetEntityObject: vi.fn(async (name: string) =>
+                name === 'MJ: Conversation Details' ? detail : makeSessionEntity({ UserID: 'anon-1' }),
+            ),
+        };
+        executeRelayedToolMock.mockResolvedValue({ ResultJson: '{"success":true}', Success: true });
+        const resolver = makeAnonResolver();
+
+        await resolver.ExecuteRealtimeSessionTool(
+            'session-1', 'call-1', 'Some Direct Action', '{}', makeCtx(), makePubSub(),
+        );
+
+        // The dispatch itself still runs elevated (SYSTEM_USER)…
+        expect(executeRelayedToolMock.mock.calls[0][1]).toBe(SYSTEM_USER);
+        // …but the hidden Conversation Detail turn is written as the CALLER, never the system user.
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: Conversation Details', ANON_USER);
+        expect(getEntityObjectSpy()).not.toHaveBeenCalledWith('MJ: Conversation Details', SYSTEM_USER);
+        expect(detail.Save).toHaveBeenCalled();
+        expect(detail.UserID).toBe('anon-1');
+    });
+
+    it('writes the direct-action tool turn as the caller unchanged for a normal authenticated user', async () => {
+        const detail = makeSessionEntity({ ID: 'detail-2' });
+        currentProvider = {
+            GetEntityObject: vi.fn(async (name: string) => (name === 'MJ: Conversation Details' ? detail : makeSessionEntity())),
+        };
+        executeRelayedToolMock.mockResolvedValue({ ResultJson: '{"success":true}', Success: true });
+        const resolver = makeResolver();
+
+        await resolver.ExecuteRealtimeSessionTool(
+            'session-1', 'call-1', 'Some Direct Action', '{}', makeCtx(), makePubSub(),
+        );
+
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: Conversation Details', USER);
+    });
+
     it('accumulates relayed usage onto the prompt run under the SYSTEM user', async () => {
         const session = makeSessionEntity({
             UserID: 'anon-1',
@@ -2942,6 +3025,32 @@ describe('RealtimeClientSessionResolver — scoped-anonymous elevation (issue #3
         expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: AI Prompt Runs', SYSTEM_USER);
     });
 
+    it('writes the hidden co-agent tool turn (RelayRealtimeToolTurn) as the CALLER (#4791)', async () => {
+        const session = makeSessionEntity({
+            UserID: 'anon-1',
+            Config_: JSON.stringify({ targetAgentID: 'target-1', promptRunID: 'prompt-run-1' }),
+        });
+        const promptRun = makeSessionEntity({ ID: 'prompt-run-1', Messages: null });
+        const detail = makeSessionEntity({ ID: 'detail-3' });
+        currentProvider = {
+            GetEntityObject: vi.fn(async (name: string) => {
+                if (name === 'MJ: AI Prompt Runs') return promptRun;
+                if (name === 'MJ: Conversation Details') return detail;
+                return session;
+            }),
+        };
+        const resolver = makeAnonResolver();
+
+        const ok = await resolver.RelayRealtimeToolTurn('session-1', 'browser_navigate', makeCtx(), '{"url":"x"}');
+
+        expect(ok).toBe(true);
+        // The co-agent run mirror stays SYSTEM…
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: AI Prompt Runs', SYSTEM_USER);
+        // …but the hidden Conversation Detail tool-turn is written as the CALLER, never SYSTEM.
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: Conversation Details', ANON_USER);
+        expect(getEntityObjectSpy()).not.toHaveBeenCalledWith('MJ: Conversation Details', SYSTEM_USER);
+    });
+
     it('prepares the session with observability under the SYSTEM user while UserID stays the visitor', async () => {
         hasPermissionMock.mockResolvedValue(true);
         currentProvider = makeProvider(() => makeSessionEntity({ UserID: 'anon-1' }));
@@ -3003,6 +3112,10 @@ describe('RealtimeClientSessionResolver — scoped-anonymous elevation (issue #3
         // The junction write (an entity the anon role does NOT hold) runs as the SYSTEM user.
         expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: Conversation Detail Artifacts', SYSTEM_USER);
         expect(junctions).toHaveLength(1);
+        // The hidden anchor `Conversation Detail` is written as the CALLER (#4791) — like every
+        // other `MJ: Conversation Details` write, the System user is refused as not the owner.
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: Conversation Details', ANON_USER);
+        expect(getEntityObjectSpy()).not.toHaveBeenCalledWith('MJ: Conversation Details', SYSTEM_USER);
         // The hidden anchor is attributed to the SESSION owner, not the elevated principal.
         expect(anchors).toHaveLength(1);
         expect(anchors[0].UserID).toBe('anon-1');
@@ -3102,6 +3215,107 @@ describe('RealtimeClientSessionResolver — scoped-anonymous elevation (issue #3
         expect((storeRecordingMock.mock.calls[0][0] as { ContextUser: unknown }).ContextUser).toBe(USER);
         expect(getSystemUserMock).not.toHaveBeenCalled();
     });
+
+    /** Provider routing a hidden-tool-turn RelayRealtimeToolTurn call: session, prompt run, detail. */
+    function makeToolTurnProvider(detail: FakeSession): unknown {
+        const session = makeSessionEntity({
+            UserID: 'anon-1',
+            Config_: JSON.stringify({ targetAgentID: 'target-1', promptRunID: 'prompt-run-1' }),
+        });
+        const promptRun = makeSessionEntity({ ID: 'prompt-run-1', Messages: null });
+        return {
+            GetEntityObject: vi.fn(async (name: string) => {
+                if (name === 'MJ: AI Prompt Runs') return promptRun;
+                if (name === 'MJ: Conversation Details') return detail;
+                return session;
+            }),
+        };
+    }
+
+    it('logs the session id, write user id and "no failure detail recorded" when a hidden tool turn save is refused without a LatestResult (#4791)', async () => {
+        errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+        const detail = makeSessionEntity({
+            ID: 'detail-1',
+            Save: vi.fn(async () => false),
+            LatestResult: undefined,
+            ResultHistory: [],
+        });
+        currentProvider = makeToolTurnProvider(detail);
+        const resolver = makeAnonResolver();
+
+        await resolver.RelayRealtimeToolTurn('session-1', 'browser_navigate', makeCtx(), '{}');
+
+        const loggedLines = errSpy.mock.calls.map((call) => String(call[0]));
+        const failureLine = loggedLines.find((line) => line.includes('persistDirectActionTurn'));
+        expect(failureLine).toBeDefined();
+        // Exact substrings: 'anon-1' alone is the caller, session.UserID AND detail.UserID at once,
+        // so only the labelled form proves the WRITE user is what got logged.
+        expect(failureLine).toContain('session session-1');
+        expect(failureLine).toContain('write user anon-1');
+        expect(failureLine).toContain('no failure detail recorded (LatestResult null; ResultHistory length 0)');
+        expect(failureLine).toContain('the write was refused before reaching the provider');
+        expect(failureLine).not.toContain('unknown error');
+    });
+
+    it('does not claim WHERE the write was refused when a result was registered with an empty message (#4791)', async () => {
+        errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+        const detail = makeSessionEntity({
+            ID: 'detail-1',
+            Save: vi.fn(async () => false),
+            LatestResult: { Success: false, CompleteMessage: '   ' },
+            ResultHistory: [{}],
+        });
+        currentProvider = makeToolTurnProvider(detail);
+        const resolver = makeAnonResolver();
+
+        await resolver.RelayRealtimeToolTurn('session-1', 'browser_navigate', makeCtx(), '{}');
+
+        const loggedLines = errSpy.mock.calls.map((call) => String(call[0]));
+        const failureLine = loggedLines.find((line) => line.includes('persistDirectActionTurn'));
+        expect(failureLine).toBeDefined();
+        expect(failureLine).toContain('no failure detail recorded (LatestResult empty; ResultHistory length 1)');
+        expect(failureLine).not.toContain('refused before reaching the provider');
+    });
+
+    it('never logs a PRIOR SUCCESS entry\'s text as the failure reason when the refusal registered nothing (#4791)', async () => {
+        errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+        const detail = makeSessionEntity({
+            ID: 'detail-1',
+            Save: vi.fn(async () => false),
+            LatestResult: { Success: true, CompleteMessage: 'previous save ok' },
+            ResultHistory: [{}, {}],
+        });
+        currentProvider = makeToolTurnProvider(detail);
+        const resolver = makeAnonResolver();
+
+        await resolver.RelayRealtimeToolTurn('session-1', 'browser_navigate', makeCtx(), '{}');
+
+        const loggedLines = errSpy.mock.calls.map((call) => String(call[0]));
+        const failureLine = loggedLines.find((line) => line.includes('persistDirectActionTurn'));
+        expect(failureLine).toBeDefined();
+        expect(failureLine).toContain(
+            'no failure detail recorded (latest result entry is a prior success; ResultHistory length 2)',
+        );
+        expect(failureLine).not.toContain('previous save ok');
+    });
+
+    it('logs the real CompleteMessage when present (#4791)', async () => {
+        errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+        const detail = makeSessionEntity({
+            ID: 'detail-1',
+            Save: vi.fn(async () => false),
+            LatestResult: { CompleteMessage: 'You do not have access to this conversation.' },
+        });
+        currentProvider = makeToolTurnProvider(detail);
+        const resolver = makeAnonResolver();
+
+        await resolver.RelayRealtimeToolTurn('session-1', 'browser_navigate', makeCtx(), '{}');
+
+        const loggedLines = errSpy.mock.calls.map((call) => String(call[0]));
+        const failureLine = loggedLines.find((line) => line.includes('persistDirectActionTurn'));
+        expect(failureLine).toBeDefined();
+        expect(failureLine).toContain('You do not have access to this conversation.');
+    });
 });
 
 describe('RealtimeClientSessionResolver — colleague authorization (allowedAgents)', () => {

package/src/__tests__/TaskGraphActionRunner.durablePayload.test.ts

@@ -0,0 +1,129 @@
+/**
+ * End-to-end-in-miniature regression test for #4794.
+ *
+ * The bug: `BuildDurableDeferral` persisted a durable entity action's redacted params as a
+ * `LoggedParam[]` ARRAY (`RedactParamsToJSON`'s shape), while `TaskGraphActionRunner.buildParams`
+ * reads `Task.InputPayload` back as a name→value RECORD. Every released build with durable dispatch
+ * (v6.1.0 onward, including 6.1.4) hit the same real-world failure: `TaskGraphDispatcher`'s
+ * `mergedPayload` only merges plain objects, so it silently dropped the array before `buildParams`
+ * ever saw it, and the action ran with NONE of its declared inputs. `buildParams` itself has no such
+ * guard — `Object.assign(merged, arrayValue)` treats an array's indices as keys — so params named
+ * `'0'`, `'1'`, ... would only appear if the array reached it directly, bypassing the dispatcher's
+ * drop. That narrower path is exactly what this test exercises, by calling `RunActionForTask`
+ * on its own rather than through the dispatcher.
+ *
+ * This test proves the whole pipe, not just the writer or the reader in isolation: build the
+ * payload exactly as the deferral does (`RedactParamsToRecord`), push it through the same
+ * `JSON.stringify` / `JSON.parse` round trip `TaskGraphService` performs to persist and reload
+ * `Task.InputPayload`, then run it through the real `TaskGraphActionRunner` and assert the action
+ * receives its declared parameters BY NAME.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+vi.mock('@memberjunction/actions', () => ({
+    ActionEngineServer: {
+        Instance: {
+            Config: vi.fn(),
+            Actions: [{ ID: 'A1', Name: 'Log Activity' }],
+            RunAction: vi.fn(),
+        },
+    },
+}));
+
+import { ActionEngineServer } from '@memberjunction/actions';
+import { RedactParamsToRecord, ActionParam } from '@memberjunction/actions-base';
+import type { MJActionExecutionLogEntity, MJActionParamEntity, MJEntityActionParamEntity } from '@memberjunction/core-entities';
+import type { IMetadataProvider, UserInfo } from '@memberjunction/core';
+import type { TaskActionRunParams } from '@memberjunction/task-graph';
+import { TaskGraphActionRunner } from '../services/TaskGraphActionRunner';
+
+// ── Test fixture builders — same shape as packages/Actions/Base/src/__tests__/ParamRedaction.test.ts ──
+
+function actionParam(name: string, value: unknown): ActionParam {
+    return { Name: name, Value: value, Type: 'Input' } as ActionParam;
+}
+
+function definition(id: string, name: string, logValue: boolean = true): MJActionParamEntity {
+    return { ID: id, Name: name, LogValue: logValue } as MJActionParamEntity;
+}
+
+function binding(actionParamID: string, valueType: string, logValue: boolean | null = null): MJEntityActionParamEntity {
+    return { ActionParamID: actionParamID, ValueType: valueType, LogValue: logValue } as MJEntityActionParamEntity;
+}
+
+// The declared parameters for the durable entity action under test: three that log normally, and
+// one ("InternalNotes") whose binding opts out of logging (rule 2 in ParamRedaction.ts).
+const RUNTIME_PARAMS: ActionParam[] = [
+    actionParam('TypeCode', 'SystemEvent'),
+    actionParam('Title', 'Person created'),
+    actionParam('RecordID', 'REC-123'),
+    actionParam('InternalNotes', 'do not persist this'),
+];
+const ACTION_PARAMS: MJActionParamEntity[] = [
+    definition('p1', 'TypeCode'),
+    definition('p2', 'Title'),
+    definition('p3', 'RecordID'),
+    definition('p4', 'InternalNotes'),
+];
+const ENTITY_ACTION_PARAMS: MJEntityActionParamEntity[] = [binding('p4', 'Static', false)];
+
+function baseRunParams(inputPayload: unknown): TaskActionRunParams {
+    return {
+        TaskID: 'T1',
+        ActionID: 'A1',
+        InputPayload: inputPayload,
+        DependencyOutputs: new Map(),
+        Provider: {} as IMetadataProvider,
+        ContextUser: {} as UserInfo,
+    };
+}
+
+describe('TaskGraphActionRunner — durable payload round-trips by param name (#4794)', () => {
+    beforeEach(() => {
+        // vitest's `restoreMocks: true` clears mock implementations before every test, including
+        // the ones assigned inside the `vi.mock` factory above — so the return value is (re)armed here.
+        vi.mocked(ActionEngineServer.Instance.Config).mockResolvedValue(undefined);
+        vi.mocked(ActionEngineServer.Instance.RunAction, { partial: true }).mockResolvedValue({
+            Success: true,
+            Params: [],
+            LogEntry: { ID: 'L1' } as MJActionExecutionLogEntity,
+        });
+    });
+
+    it('delivers RedactParamsToRecord\'s output to the action by name, after a JSON round trip', async () => {
+        // Exactly what the deferral writes, then exactly what TaskGraphService's JSON column does to it.
+        const stored = JSON.parse(JSON.stringify(RedactParamsToRecord(RUNTIME_PARAMS, ACTION_PARAMS, ENTITY_ACTION_PARAMS)));
+
+        const result = await new TaskGraphActionRunner().RunActionForTask(baseRunParams(stored));
+
+        expect(result.Success).toBe(true);
+        expect(result.ActionLogID).toBe('L1');
+
+        const runActionCall = vi.mocked(ActionEngineServer.Instance.RunAction).mock.calls[0][0];
+        const sentParams = runActionCall.Params as ActionParam[];
+
+        // The three logged declared names arrive, order-insensitive, with their values intact.
+        expect(sentParams.map((p) => p.Name).sort()).toEqual(['RecordID', 'Title', 'TypeCode']);
+        expect(sentParams.find((p) => p.Name === 'TypeCode')?.Value).toBe('SystemEvent');
+        expect(sentParams.find((p) => p.Name === 'Title')?.Value).toBe('Person created');
+        expect(sentParams.find((p) => p.Name === 'RecordID')?.Value).toBe('REC-123');
+
+        // The binding-suppressed parameter never reaches the action — absent, not present-with-undefined.
+        expect(sentParams.some((p) => p.Name === 'InternalNotes')).toBe(false);
+    });
+
+    it('does not turn dependency outputs into params named by the upstream task ID', async () => {
+        // The dispatcher keys DependencyOutputs by the upstream task's ID and has ALREADY merged their
+        // values into InputPayload (TaskGraphDispatcher.mergedPayload). A runner that also spread the
+        // map handed the action one extra param per dependency, named by a GUID and holding that
+        // task's whole output — which then landed, unredacted, in ActionExecutionLog.Params.
+        const upstreamID = '20924BD7-5128-4150-8404-FB44A55AEA0F';
+        const params = baseRunParams({ EntityName: 'MJ: Entities', Record: { ID: 'R1', Name: 'MJ: Tags' } });
+        params.DependencyOutputs = new Map([[upstreamID, { Record: { ID: 'R1', Name: 'MJ: Tags' } }]]);
+
+        await new TaskGraphActionRunner().RunActionForTask(params);
+
+        const sentParams = vi.mocked(ActionEngineServer.Instance.RunAction).mock.calls[0][0].Params as ActionParam[];
+        expect(sentParams.map((p) => p.Name).sort()).toEqual(['EntityName', 'Record']);
+    });
+});

package/src/__tests__/adhocTimeoutClamp.test.ts

@@ -0,0 +1,26 @@
+/**
+ * An ad-hoc query's timeout never exceeds the server's requestTimeout, so a caller cannot hold a
+ * read-only connection longer than any other request may.
+ */
+import { describe, it, expect } from 'vitest';
+import { ClampAdhocTimeoutSeconds } from '../resolvers/adhocTimeout';
+
+describe('ClampAdhocTimeoutSeconds', () => {
+    it('caps a longer request at requestTimeout', () => {
+        expect(ClampAdhocTimeoutSeconds(600, 30000)).toBe(30);
+    });
+
+    it('keeps a shorter request', () => {
+        expect(ClampAdhocTimeoutSeconds(5, 30000)).toBe(5);
+    });
+
+    it('uses 30 seconds when the caller names none, within the cap', () => {
+        expect(ClampAdhocTimeoutSeconds(undefined, 30000)).toBe(30);
+        expect(ClampAdhocTimeoutSeconds(undefined, 10000)).toBe(10);
+        expect(ClampAdhocTimeoutSeconds(0, 30000)).toBe(30);
+    });
+
+    it('leaves the request alone when the server sets no limit', () => {
+        expect(ClampAdhocTimeoutSeconds(600, 0)).toBe(600);
+    });
+});

package/src/__tests__/cacheInvalidationRecordData.test.ts

@@ -0,0 +1,177 @@
+// The gate lives beside the subscription it protects, and that module carries type-graphql
+// decorators — so the metadata shim has to be in place before it is imported.
+import 'reflect-metadata';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import {
+  ConfigureRecordDataBroadcast,
+  MayBroadcastRecordData,
+} from '../generic/CacheInvalidationResolver.js';
+
+/**
+ * The cache-invalidation subscription is delivered to every connected client with no per-user
+ * filter, so anything `MayBroadcastRecordData` lets through is readable by every signed-in session
+ * regardless of row-level security or any tenant scoping a consumer applies on the read path.
+ *
+ * The important case is the DEFAULT: an untouched deployment must broadcast no row data at all,
+ * because that is the configuration everyone upgrades into.
+ */
+describe('MayBroadcastRecordData', () => {
+  afterEach(() => ConfigureRecordDataBroadcast([]));
+
+  it('broadcasts nothing before anything has configured it', () => {
+    // No ConfigureRecordDataBroadcast call at all — the state a process starts in, and the state it
+    // stays in if bootstrap ever stops calling it. Failing closed there is the whole point.
+    expect(MayBroadcastRecordData('Users')).toBe(false);
+    expect(MayBroadcastRecordData('AI Models')).toBe(false);
+  });
+
+  it('broadcasts nothing when the deployment has not opted in', () => {
+    ConfigureRecordDataBroadcast([]);
+    expect(MayBroadcastRecordData('Users')).toBe(false);
+  });
+
+  it('broadcasts nothing when the config value is absent', () => {
+    ConfigureRecordDataBroadcast(undefined);
+    expect(MayBroadcastRecordData('Users')).toBe(false);
+  });
+
+  it('allows exactly the entities named, and no others', () => {
+    ConfigureRecordDataBroadcast(['AI Models']);
+    expect(MayBroadcastRecordData('AI Models')).toBe(true);
+    expect(MayBroadcastRecordData('Users')).toBe(false);
+    expect(MayBroadcastRecordData('AI Model Vendors')).toBe(false);
+    // The allowlisted name as a SUBSTRING of another entity must not carry it in. Written this way
+    // deliberately: 'AI Model Vendors' above does not contain 'AI Models', so it passes against a
+    // loose `includes` match too and proves nothing — a substring mutation survived it.
+    expect(MayBroadcastRecordData('Archived AI Models 2024')).toBe(false);
+    // ...and the reverse direction, where the entity name is a substring of the allowlisted one.
+    expect(MayBroadcastRecordData('AI Model')).toBe(false);
+  });
+
+  it('matches entity names case- and whitespace-insensitively', () => {
+    ConfigureRecordDataBroadcast(['  ai models  ']);
+    expect(MayBroadcastRecordData('AI Models')).toBe(true);
+  });
+
+  it("restores the previous broadcast-everything behaviour only on an explicit '*'", () => {
+    ConfigureRecordDataBroadcast(['*']);
+    expect(MayBroadcastRecordData('Users')).toBe(true);
+    expect(MayBroadcastRecordData('Organization Person Roles')).toBe(true);
+  });
+});
+
+/**
+ * Importing this module must not drag server config loading in with it.
+ *
+ * The first version of this change read `configInfo` at module scope. `config.ts` runs
+ * `loadConfig()` on import, so every test that touched the resolver — directly or through
+ * ResolverBase — died at import with "Configuration validation failed". CI caught it; this keeps
+ * it caught.
+ */
+describe('CacheInvalidationResolver module surface', () => {
+  it('imports without any server configuration present', async () => {
+    await expect(import('../generic/CacheInvalidationResolver.js')).resolves.toBeDefined();
+  });
+});
+
+/**
+ * The allowlist is normalised where it enters, not where it is compared.
+ *
+ * Raised in review: the wildcard was matched raw while entity names were trimmed and lowercased,
+ * so a hand-edited `[' * ']` matched neither branch and silently opted nothing in — a config that
+ * reads as "broadcast everything" while the gate stayed fully closed.
+ */
+describe('allowlist normalisation', () => {
+  afterEach(() => ConfigureRecordDataBroadcast([]));
+
+  it("honours a wildcard written with surrounding whitespace", () => {
+    ConfigureRecordDataBroadcast([' * ']);
+    expect(MayBroadcastRecordData('Users')).toBe(true);
+  });
+
+  it('ignores blank entries rather than letting one match something', () => {
+    ConfigureRecordDataBroadcast(['', '   ']);
+    expect(MayBroadcastRecordData('Users')).toBe(false);
+    // A blank entry must not become a wildcard by accident either.
+    expect(MayBroadcastRecordData('')).toBe(false);
+  });
+
+  it('still matches a normal name written with odd casing and padding', () => {
+    ConfigureRecordDataBroadcast(['  AI MODELS  ']);
+    expect(MayBroadcastRecordData('ai models')).toBe(true);
+    expect(MayBroadcastRecordData('Users')).toBe(false);
+  });
+});
+
+/**
+ * Entity-level delivery filtering, raised in review.
+ *
+ * An event for an entity a session cannot read at all tells that session the record exists, its
+ * stable key and when it changed — and the session could never have read it, so withholding costs
+ * nothing. This does NOT close the row-level case: two sessions that both hold read permission on
+ * an entity still see each other's keys. That is tracked separately and deliberately not faked
+ * green here.
+ */
+describe('cacheInvalidationFilter', () => {
+  const event = (entityName: string) => ({
+    entityName,
+    primaryKeyValues: '[{"FieldName":"ID","Value":"r1"}]',
+    action: 'save',
+    sourceServerId: 's1',
+    timestamp: new Date(),
+  });
+  const session = (userRecord: unknown) => ({ userPayload: { userRecord } });
+
+  const withEntities = async (entities: Array<{ Name: string; CanRead: boolean }>) => {
+    vi.resetModules();
+    vi.doMock('@memberjunction/core', () => ({
+      Metadata: class {
+        get Entities() {
+          return entities.map((e) => ({
+            Name: e.Name,
+            GetUserPermisions: () => ({ CanRead: e.CanRead }),
+          }));
+        }
+        // The real one is case-insensitive and trims — the filter relies on that, so the mock does too.
+        EntityByName(name: string) {
+          const key = name.trim().toLowerCase();
+          return this.Entities.find((e) => e.Name.toLowerCase() === key);
+        }
+      },
+    }));
+    return (await import('../generic/CacheInvalidationResolver.js')).cacheInvalidationFilter;
+  };
+
+  afterEach(() => vi.doUnmock('@memberjunction/core'));
+
+  it('delivers an event for an entity the session may read', async () => {
+    const filter = await withEntities([{ Name: 'AI Models', CanRead: true }]);
+    expect(filter({ payload: event('AI Models') as never, context: session({ ID: 'u1' }) })).toBe(true);
+  });
+
+  it('withholds an event for an entity the session may NOT read', async () => {
+    const filter = await withEntities([{ Name: 'Users', CanRead: false }]);
+    expect(filter({ payload: event('Users') as never, context: session({ ID: 'u1' }) })).toBe(false);
+  });
+
+  it('fails closed when the connection carries no user', async () => {
+    // onConnect rejects a socket whose token does not validate, so this should not arise — and it
+    // is the case least deserving of an unfiltered firehose if it does.
+    const filter = await withEntities([{ Name: 'AI Models', CanRead: true }]);
+    expect(filter({ payload: event('AI Models') as never, context: undefined })).toBe(false);
+    expect(filter({ payload: event('AI Models') as never, context: session(undefined) })).toBe(false);
+  });
+
+  it('delivers when the entity is unknown to this server, rather than silently going stale', async () => {
+    // Deliberately the opposite choice: a name absent from metadata cannot be permission-checked,
+    // and withholding would stop invalidating a legitimately cacheable entity — a correctness bug
+    // in place of a disclosure one.
+    const filter = await withEntities([{ Name: 'AI Models', CanRead: true }]);
+    expect(filter({ payload: event('Some Entity This Server Never Heard Of') as never, context: session({ ID: 'u1' }) })).toBe(true);
+  });
+
+  it('withholds an event with no entity name', async () => {
+    const filter = await withEntities([{ Name: 'AI Models', CanRead: true }]);
+    expect(filter({ payload: { ...event(''), entityName: '' } as never, context: session({ ID: 'u1' }) })).toBe(false);
+  });
+});