@memberjunction/server 6.1.3 → 6.1.5

package/src/__tests__/magicLink.test.ts

@@ -6,7 +6,7 @@ import {
   hashToken,
   evaluateInvite,
   buildSessionClaims,
-  buildConsumeInviteSQL,
+  buildConsumeInvitePostgresSQL,
   canIssueInvites,
   isRoleGrantable,
   unionScopes,
@@ -168,71 +168,13 @@ describe('magic-link core', () => {
     });
   });
 
-  describe('buildConsumeInviteSQL', () => {
-    const table = '[__mj].[MagicLinkInvite]';
-    const sql = buildConsumeInviteSQL(table);
-
-    it('targets the supplied qualified table', () => {
-      expect(sql).toContain(`UPDATE ${table} `);
-    });
-
-    it('increments UseCount', () => {
-      expect(sql).toContain('UseCount = UseCount + 1');
-    });
-
-    it('stamps ConsumedAt only the first time (COALESCE preserves an existing value)', () => {
-      expect(sql).toContain('ConsumedAt = COALESCE(ConsumedAt, SYSUTCDATETIME())');
-    });
-
-    it('flips Status to Consumed exactly when the last use is taken', () => {
-      expect(sql).toContain("Status = CASE WHEN UseCount + 1 >= MaxUses THEN 'Consumed' ELSE Status END");
-    });
-
-    it('returns the affected row via OUTPUT INTO a table var so the caller can detect a win (exactly one row)', () => {
-      // Must be OUTPUT ... INTO, not a bare OUTPUT: SQL Server forbids a bare
-      // OUTPUT clause on a table with enabled triggers, and CodeGen adds an
-      // __mj_UpdatedAt trigger to every MJ table. Regression guard for that bug.
-      expect(sql).toContain('OUTPUT INSERTED.ID INTO @consumed');
-      expect(sql).not.toMatch(/OUTPUT INSERTED\.ID(?!\s+INTO)/);
-      expect(sql).toContain('SELECT ID FROM @consumed');
-    });
-
-    it('guards atomically on Active + not-exhausted + not-expired — this IS the single-use gate', () => {
-      const where = sql.slice(sql.indexOf('WHERE'));
-      expect(where).toContain("Status = 'Active'");
-      expect(where).toContain('UseCount < MaxUses');
-      expect(where).toContain('ExpiresAt > SYSUTCDATETIME()');
-    });
-
-    it('binds the invite ID as a parameter, never interpolated (injection-safe)', () => {
-      expect(sql).toContain('ID = @p0');
-      // The id must not be string-interpolated with quotes around a value.
-      expect(sql).not.toMatch(/ID = '/);
-    });
-
-    it('is a self-contained batch: declare table var, update-with-output, select', () => {
-      // Intentionally a 3-statement batch (the OUTPUT-INTO requirement). The ID is
-      // still parameterized, so the batch carries no interpolated user input.
-      expect(sql).toContain('DECLARE @consumed TABLE (ID UNIQUEIDENTIFIER)');
-      expect(sql.match(/;/g)?.length).toBe(3);
-      expect(sql.trim().endsWith(';')).toBe(true);
-    });
-
-    it('rejects a non-whitelisted table identifier (defense-in-depth against injection)', () => {
-      // Only bracket-quoted [schema].[table] of word chars is accepted, even though
-      // the caller derives the table from EntityInfo and never from user input.
-      expect(() => buildConsumeInviteSQL('__mj.MagicLinkInvite')).toThrow();
-      expect(() => buildConsumeInviteSQL('[__mj].[MagicLinkInvite]; DROP TABLE x;--')).toThrow();
-      expect(() => buildConsumeInviteSQL('[__mj].[Magic Link]')).toThrow();
-      expect(() => buildConsumeInviteSQL(table)).not.toThrow();
-    });
-  });
-
-  describe('buildConsumeInviteSQL (postgresql dialect)', () => {
-    // PG uses `schema.table` (unquoted — PostgreSQLDataProvider.ExecuteSQL auto-quotes
-    // the PascalCase identifiers). SS uses the bracket-quoted `[schema].[table]` form.
+  describe('buildConsumeInvitePostgresSQL', () => {
+    // PostgreSQL only: SQL Server consumes through spConsumeMagicLinkInvite (#4753), but PG has no
+    // such function and its runtime roles hold table DML, so PG keeps this direct guarded UPDATE.
+    // PG uses `schema.table` unquoted — PostgreSQLDataProvider.ExecuteSQL auto-quotes the
+    // PascalCase identifiers.
     const pgTable = '__mj.MagicLinkInvite';
-    const pgSql = buildConsumeInviteSQL(pgTable, 'postgresql');
+    const pgSql = buildConsumeInvitePostgresSQL(pgTable);
 
     it('targets the supplied unquoted schema.table', () => {
       expect(pgSql).toContain(`UPDATE ${pgTable} `);
@@ -246,35 +188,32 @@ describe('magic-link core', () => {
 
     it('binds the invite ID as PG positional param $1, not T-SQL @p0 (injection-safe)', () => {
       expect(pgSql).toContain('ID = $1');
-      expect(pgSql).not.toContain('@p0');
-      expect(pgSql).not.toMatch(/@/); // no T-SQL @-anything survives on PG
+      expect(pgSql).not.toMatch(/@/);
       expect(pgSql).not.toMatch(/ID = '/);
     });
 
     it('uses PG timestamp expressions, not T-SQL SYSUTCDATETIME()', () => {
       expect(pgSql).not.toContain('SYSUTCDATETIME');
-      expect(pgSql).toContain("(now() AT TIME ZONE 'utc')");
       expect(pgSql).toContain("ConsumedAt = COALESCE(ConsumedAt, (now() AT TIME ZONE 'utc'))");
     });
 
-    it('guards atomically on Active + not-exhausted + not-expired (same predicate as SS)', () => {
+    it('guards atomically on Active + not-exhausted + not-expired (same predicate as spConsumeMagicLinkInvite)', () => {
       const where = pgSql.slice(pgSql.indexOf('WHERE'));
       expect(where).toContain("Status = 'Active'");
       expect(where).toContain('UseCount < MaxUses');
       expect(where).toContain("ExpiresAt > (now() AT TIME ZONE 'utc')");
     });
 
-    it('increments UseCount and flips Status on the last use (same semantics as SS)', () => {
+    it('increments UseCount and flips Status on the last use (same semantics as spConsumeMagicLinkInvite)', () => {
       expect(pgSql).toContain('UseCount = UseCount + 1');
       expect(pgSql).toContain("Status = CASE WHEN UseCount + 1 >= MaxUses THEN 'Consumed' ELSE Status END");
     });
 
-    it('rejects a non-whitelisted PG table identifier (defense-in-depth against injection)', () => {
-      // Bracket-quoted (SS) form is not a valid PG identifier here.
-      expect(() => buildConsumeInviteSQL('[__mj].[MagicLinkInvite]', 'postgresql')).toThrow();
-      expect(() => buildConsumeInviteSQL('__mj.MagicLinkInvite; DROP TABLE x;--', 'postgresql')).toThrow();
-      expect(() => buildConsumeInviteSQL('__mj.Magic Link', 'postgresql')).toThrow();
-      expect(() => buildConsumeInviteSQL(pgTable, 'postgresql')).not.toThrow();
+    it('rejects a non-whitelisted table identifier (defense-in-depth against injection)', () => {
+      expect(() => buildConsumeInvitePostgresSQL('[__mj].[MagicLinkInvite]')).toThrow();
+      expect(() => buildConsumeInvitePostgresSQL('__mj.MagicLinkInvite; DROP TABLE x;--')).toThrow();
+      expect(() => buildConsumeInvitePostgresSQL('__mj.Magic Link')).toThrow();
+      expect(() => buildConsumeInvitePostgresSQL(pgTable)).not.toThrow();
     });
   });
 

package/src/__tests__/magicLinkService.consume.test.ts

@@ -0,0 +1,224 @@
+import { describe, it, expect, vi, beforeEach, afterEach, type Mock } from 'vitest';
+
+// MagicLinkService is the imperative shell — importing it pulls the full
+// data-provider and communication stacks in at module load. Stub those out;
+// @memberjunction/core stays real (Metadata, RunView, LogError).
+vi.mock('@memberjunction/generic-database-provider', () => ({
+  UserCache: { Instance: { Users: [] } },
+}));
+vi.mock('@memberjunction/communication-engine', () => ({
+  CommunicationEngine: { Instance: {} },
+}));
+vi.mock('@memberjunction/communication-types', () => ({
+  Message: class {},
+}));
+vi.mock('../config.js', () => ({
+  configInfo: {},
+}));
+
+import { Metadata, RunView, type DatabaseProviderBase, type IMetadataProvider, type UserInfo } from '@memberjunction/core';
+import type { MJMagicLinkInviteEntity } from '@memberjunction/core-entities';
+import type { MagicLinkConfig } from '../config.js';
+import { MagicLinkService } from '../auth/magicLink/MagicLinkService.js';
+import { MAGIC_LINK_TOKEN_PREFIX, buildConsumeInvitePostgresSQL } from '../auth/magicLink/magicLinkCore.js';
+
+type Platform = 'sqlserver' | 'postgresql';
+
+/** Provider surface consumeInvite/RedeemInvite touch, with real-shaped dialect behavior. */
+interface FakeProvider {
+  PlatformKey: Platform;
+  MJCoreSchemaName: string;
+  Roles: { ID: string; Name: string }[];
+  Applications: { ID: string; Name: string; Path: string }[];
+  Dialect: { ProcedureCallSyntax: (schema: string, name: string, params: string[]) => string };
+  BuildParameterPlaceholder: (index: number) => string;
+  ExecuteSQL: Mock;
+}
+
+function makeProvider(platform: Platform): FakeProvider {
+  const isPg = platform === 'postgresql';
+  return {
+    PlatformKey: platform,
+    MJCoreSchemaName: '__mj',
+    Roles: [{ ID: 'role-1', Name: 'Magic Link Baseline' }],
+    Applications: [],
+    Dialect: {
+      ProcedureCallSyntax: isPg
+        ? (s, n, p) => `SELECT * FROM ${s}."${n}"(${p.join(', ')})`
+        : (s, n, p) => `EXEC [${s}].[${n}] ${p.join(', ')}`,
+    },
+    BuildParameterPlaceholder: isPg ? (i) => `$${i + 1}` : (i) => `@p${i}`,
+    ExecuteSQL: vi.fn(),
+  };
+}
+
+const INVITE_ID = '11111111-2222-3333-4444-555555555555';
+
+function makeInvite(): MJMagicLinkInviteEntity {
+  return {
+    ID: INVITE_ID,
+    Status: 'Active',
+    UseCount: 0,
+    MaxUses: 1,
+    ExpiresAt: new Date(Date.now() + 3600_000),
+    RoleID: 'role-1',
+    CreatedByUserID: 'inviter-1',
+    ApplicationID: 'app-1',
+    Email: 'g@example.com',
+  } as unknown as MJMagicLinkInviteEntity;
+}
+
+/** Private surface of MagicLinkService the tests drive or stub. */
+interface ServicePrivates {
+  consumeInvite: (invite: MJMagicLinkInviteEntity, provider: DatabaseProviderBase, contextUser: UserInfo) => Promise<string>;
+  resolveProvisioningContextUser: () => UserInfo | null;
+  isInviterActive: (id: string) => boolean;
+  recordRedemption: () => Promise<void>;
+  provisionUser: () => Promise<{ success: boolean; error?: string }>;
+}
+
+describe('MagicLinkService.consumeInvite (#4753)', () => {
+  let service: MagicLinkService;
+  let privates: ServicePrivates;
+  let invite: MJMagicLinkInviteEntity;
+  const contextUser = { ID: 'ctx-user' } as UserInfo;
+
+  beforeEach(() => {
+    service = new MagicLinkService('https://mj.example.com', {} as MagicLinkConfig);
+    privates = service as unknown as ServicePrivates;
+    invite = makeInvite();
+  });
+
+  afterEach(() => {
+    Metadata.Provider = null as unknown as IMetadataProvider;
+  });
+
+  async function consume(provider: FakeProvider): Promise<string> {
+    return privates.consumeInvite(invite, provider as unknown as DatabaseProviderBase, contextUser);
+  }
+
+  it('SQL Server: calls spConsumeMagicLinkInvite with the ID bound by name, never interpolated', async () => {
+    const provider = makeProvider('sqlserver');
+    provider.ExecuteSQL.mockResolvedValue([{ ID: INVITE_ID }]);
+    await consume(provider);
+
+    expect(provider.ExecuteSQL).toHaveBeenCalledTimes(1);
+    const [sql, params, options, user] = provider.ExecuteSQL.mock.calls[0];
+    expect(sql).toBe('EXEC [__mj].[spConsumeMagicLinkInvite] @ID=@p0');
+    expect(params).toEqual([INVITE_ID]);
+    expect(options).toEqual(expect.objectContaining({ isMutation: true }));
+    expect(user).toBe(contextUser);
+    expect(sql).not.toContain(INVITE_ID);
+    expect(String(sql).toUpperCase()).not.toContain('UPDATE');
+  });
+
+  // PG has no spConsumeMagicLinkInvite function (the release-time converter does not emit
+  // procedures) and PG's runtime roles hold table DML, so PG keeps the direct guarded UPDATE.
+  it('PostgreSQL: runs the guarded UPDATE … RETURNING directly, with the ID bound as $1', async () => {
+    const provider = makeProvider('postgresql');
+    provider.ExecuteSQL.mockResolvedValue([{ ID: INVITE_ID }]);
+    await consume(provider);
+
+    expect(provider.ExecuteSQL).toHaveBeenCalledTimes(1);
+    const [sql, params, options, user] = provider.ExecuteSQL.mock.calls[0];
+    expect(sql).toBe(buildConsumeInvitePostgresSQL('__mj.MagicLinkInvite'));
+    expect(sql).not.toContain('spConsumeMagicLinkInvite');
+    expect(params).toEqual([INVITE_ID]);
+    expect(options).toEqual(expect.objectContaining({ isMutation: true }));
+    expect(user).toBe(contextUser);
+    expect(sql).not.toContain(INVITE_ID);
+  });
+
+  it("PostgreSQL: maps one row to 'won', zero rows to 'lost', and a thrown error to 'failed'", async () => {
+    vi.spyOn(console, 'error').mockImplementation(() => undefined);
+    const provider = makeProvider('postgresql');
+    provider.ExecuteSQL.mockResolvedValueOnce([{ ID: INVITE_ID }]).mockResolvedValueOnce([]).mockRejectedValueOnce(new Error('connection reset'));
+
+    expect(await consume(provider)).toBe('won');
+    expect(await consume(provider)).toBe('lost');
+    expect(await consume(provider)).toBe('failed');
+  });
+
+  it("returns 'won' when exactly one row comes back", async () => {
+    const provider = makeProvider('sqlserver');
+    provider.ExecuteSQL.mockResolvedValue([{ ID: INVITE_ID }]);
+    expect(await consume(provider)).toBe('won');
+  });
+
+  it("returns 'lost' when zero rows come back", async () => {
+    const provider = makeProvider('sqlserver');
+    provider.ExecuteSQL.mockResolvedValue([]);
+    expect(await consume(provider)).toBe('lost');
+  });
+
+  it("returns 'failed' and logs the invite ID when ExecuteSQL throws", async () => {
+    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+    const provider = makeProvider('sqlserver');
+    provider.ExecuteSQL.mockRejectedValue(new Error("The EXECUTE permission was denied on the object 'spConsumeMagicLinkInvite'"));
+
+    expect(await consume(provider)).toBe('failed');
+    const logged = errorSpy.mock.calls.map((call) => call.map(String).join(' '));
+    expect(logged.some((line) => line.includes(INVITE_ID) && line.includes('spConsumeMagicLinkInvite'))).toBe(true);
+  });
+
+  it("returns 'failed' when ExecuteSQL returns a non-array", async () => {
+    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+    const provider = makeProvider('sqlserver');
+    provider.ExecuteSQL.mockResolvedValue(undefined);
+
+    expect(await consume(provider)).toBe('failed');
+    const logged = errorSpy.mock.calls.map((call) => call.map(String).join(' '));
+    expect(logged.some((line) => line.includes(INVITE_ID))).toBe(true);
+  });
+});
+
+describe('MagicLinkService.RedeemInvite consume outcome mapping (#4753)', () => {
+  let service: MagicLinkService;
+  let provider: FakeProvider;
+  let provisionUser: Mock;
+  const contextUser = { ID: 'ctx-user' } as UserInfo;
+  const rawToken = MAGIC_LINK_TOKEN_PREFIX + 'x';
+
+  beforeEach(() => {
+    vi.spyOn(console, 'error').mockImplementation(() => undefined);
+    provider = makeProvider('sqlserver');
+    Metadata.Provider = provider as unknown as IMetadataProvider;
+
+    service = new MagicLinkService('https://mj.example.com', {} as MagicLinkConfig);
+    const privates = service as unknown as ServicePrivates;
+    vi.spyOn(RunView.prototype, 'RunView').mockResolvedValue({ Success: true, Results: [makeInvite()] } as Awaited<ReturnType<RunView['RunView']>>);
+    vi.spyOn(privates, 'resolveProvisioningContextUser').mockReturnValue(contextUser);
+    vi.spyOn(privates, 'isInviterActive').mockReturnValue(true);
+    vi.spyOn(privates, 'recordRedemption').mockResolvedValue(undefined);
+    provisionUser = vi.fn().mockResolvedValue({ success: false, error: 'stop-here' });
+    privates.provisionUser = provisionUser;
+  });
+
+  afterEach(() => {
+    Metadata.Provider = null as unknown as IMetadataProvider;
+  });
+
+  it('RedeemInvite maps a failed consume to server_error, not consumed, and never provisions', async () => {
+    provider.ExecuteSQL.mockRejectedValue(new Error("The EXECUTE permission was denied on the object 'spConsumeMagicLinkInvite'"));
+    const result = await service.RedeemInvite(rawToken);
+
+    expect(result).toEqual(expect.objectContaining({ success: false, errorCode: 'server_error' }));
+    expect(provisionUser).not.toHaveBeenCalled();
+  });
+
+  it('RedeemInvite still reports consumed when the race is lost', async () => {
+    provider.ExecuteSQL.mockResolvedValue([]);
+    const result = await service.RedeemInvite(rawToken);
+
+    expect(result).toEqual(expect.objectContaining({ success: false, errorCode: 'consumed' }));
+    expect(provisionUser).not.toHaveBeenCalled();
+  });
+
+  it('RedeemInvite proceeds to provisioning when the consume wins', async () => {
+    provider.ExecuteSQL.mockResolvedValue([{ ID: INVITE_ID }]);
+    const result = await service.RedeemInvite(rawToken);
+
+    expect(provisionUser).toHaveBeenCalledTimes(1);
+    expect(result).toEqual(expect.objectContaining({ success: false, errorCode: 'provisioning_failed' }));
+  });
+});

package/src/__tests__/postgresqlPoolSettings.test.ts

@@ -0,0 +1,131 @@
+/**
+ * PostgreSQL pools read the same databaseSettings values as SQL Server, with the same defaults.
+ */
+import { describe, it, expect } from 'vitest';
+import {
+    BuildPostgreSQLConnectionConfig,
+    CODEGEN_STATEMENT_TIMEOUT_MS,
+    ResolvePostgreSQLEndpoint,
+    ResolvePostgreSQLReadOnlyCredentials,
+    ToPGPoolConfig
+} from '../postgresqlPoolSettings.js';
+import type { DatabaseSettingsInfo } from '../config.js';
+import { DescribeReadOnlyLoginOverreach } from '../postgresqlPoolSettings.js';
+import type { ReadOnlyLoginCheckClient, ReadOnlyLoginGrants } from '../postgresqlPoolSettings.js';
+
+const defaults: DatabaseSettingsInfo = {
+    connectionTimeout: 45000,
+    requestTimeout: 30000,
+    metadataCacheRefreshInterval: 180000,
+    connectionPool: { max: 50, min: 5, idleTimeoutMillis: 30000, acquireTimeoutMillis: 30000 }
+};
+const endpoint = { Host: 'db', Port: 5432, Database: 'mj', User: 'api', Password: 'secret' };
+
+describe('BuildPostgreSQLConnectionConfig', () => {
+    it('gives API pools requestTimeout as the statement timeout and the pool settings SQL Server uses', () => {
+        const config = BuildPostgreSQLConnectionConfig(endpoint, defaults, 'api');
+        expect(config).toMatchObject({
+            ...endpoint,
+            MaxConnections: 50,
+            MinConnections: 5,
+            IdleTimeoutMillis: 30000,
+            ConnectionTimeoutMillis: 30000,
+            StatementTimeoutMs: 30000,
+            IdleInTransactionSessionTimeoutMs: 60000
+        });
+    });
+
+    it('follows a configured requestTimeout and pool', () => {
+        const config = BuildPostgreSQLConnectionConfig(endpoint, {
+            ...defaults,
+            requestTimeout: 5000,
+            connectionPool: { max: 12, min: 1, idleTimeoutMillis: 7000, acquireTimeoutMillis: 9000 }
+        }, 'api');
+        expect(config).toMatchObject({ MaxConnections: 12, MinConnections: 1, IdleTimeoutMillis: 7000, ConnectionTimeoutMillis: 9000, StatementTimeoutMs: 5000, IdleInTransactionSessionTimeoutMs: 10000 });
+    });
+
+    it('sets no timeouts when requestTimeout is 0', () => {
+        const config = BuildPostgreSQLConnectionConfig(endpoint, { ...defaults, requestTimeout: 0 }, 'api');
+        expect(config.StatementTimeoutMs).toBe(0);
+        expect(config.IdleInTransactionSessionTimeoutMs).toBe(0);
+    });
+
+    it('keeps the read-only pool small but gives it the API timeouts', () => {
+        const config = BuildPostgreSQLConnectionConfig(endpoint, defaults, 'read-only');
+        expect(config).toMatchObject({ MaxConnections: 10, MinConnections: 0, StatementTimeoutMs: 30000, IdleInTransactionSessionTimeoutMs: 60000 });
+        expect(BuildPostgreSQLConnectionConfig(endpoint, { ...defaults, connectionPool: { max: 4, min: 1, idleTimeoutMillis: 1, acquireTimeoutMillis: 1 } }, 'read-only').MaxConnections).toBe(4);
+    });
+
+    it('gives the CodeGen pool the long timeout the SQL Server CodeGen pool has, and no idle-in-transaction limit', () => {
+        const config = BuildPostgreSQLConnectionConfig(endpoint, defaults, 'codegen');
+        expect(config.StatementTimeoutMs).toBe(CODEGEN_STATEMENT_TIMEOUT_MS);
+        expect(CODEGEN_STATEMENT_TIMEOUT_MS).toBe(600000);
+        expect(config.IdleInTransactionSessionTimeoutMs).toBe(0);
+        expect(config.MaxConnections).toBe(10);
+    });
+});
+
+describe('ToPGPoolConfig', () => {
+    it('maps the connection config onto pg.Pool option names', () => {
+        const pool = ToPGPoolConfig(BuildPostgreSQLConnectionConfig(endpoint, defaults, 'api'));
+        expect(pool).toEqual({
+            host: 'db', port: 5432, database: 'mj', user: 'api', password: 'secret',
+            max: 50, min: 5, idleTimeoutMillis: 30000, connectionTimeoutMillis: 30000,
+            statement_timeout: 30000, idle_in_transaction_session_timeout: 60000
+        });
+    });
+
+    it('leaves the timeouts out when they are 0', () => {
+        const pool = ToPGPoolConfig(BuildPostgreSQLConnectionConfig(endpoint, { ...defaults, requestTimeout: 0 }, 'api'));
+        expect(pool).not.toHaveProperty('statement_timeout');
+        expect(pool).not.toHaveProperty('idle_in_transaction_session_timeout');
+    });
+});
+
+describe('ResolvePostgreSQLEndpoint', () => {
+    it('prefers PG_* variables over DB_* ones', () => {
+        expect(ResolvePostgreSQLEndpoint({ PG_HOST: 'pg', DB_HOST: 'db', DB_PORT: '6000', DB_DATABASE: 'd', DB_USERNAME: 'u', DB_PASSWORD: 'p' }))
+            .toEqual({ Host: 'pg', Port: 6000, Database: 'd', User: 'u', Password: 'p' });
+    });
+
+    it('falls back to localhost:5432 and the postgres user', () => {
+        expect(ResolvePostgreSQLEndpoint({})).toEqual({ Host: 'localhost', Port: 5432, Database: '', User: 'postgres', Password: '' });
+    });
+});
+
+describe('ResolvePostgreSQLReadOnlyCredentials', () => {
+    it('uses the dbReadOnlyUsername / dbReadOnlyPassword settings SQL Server uses', () => {
+        expect(ResolvePostgreSQLReadOnlyCredentials({ dbReadOnlyUsername: 'ro', dbReadOnlyPassword: 'pw' }, {}))
+            .toEqual({ User: 'ro', Password: 'pw' });
+    });
+
+    it('falls back to PG_READ_ONLY_* when the settings are absent', () => {
+        expect(ResolvePostgreSQLReadOnlyCredentials({}, { PG_READ_ONLY_USERNAME: 'pgro', PG_READ_ONLY_PASSWORD: 'x' }))
+            .toEqual({ User: 'pgro', Password: 'x' });
+    });
+
+    it('returns null when no complete pair is configured', () => {
+        expect(ResolvePostgreSQLReadOnlyCredentials({ dbReadOnlyUsername: 'ro' }, { PG_READ_ONLY_USERNAME: 'pgro' })).toBeNull();
+    });
+});
+
+describe('DescribeReadOnlyLoginOverreach', () => {
+    const clientAnswering = (row: ReadOnlyLoginGrants): ReadOnlyLoginCheckClient => ({
+        query: async () => ({ rows: [row] }),
+    });
+
+    it('says nothing for a login that reads only views', async () => {
+        expect(await DescribeReadOnlyLoginOverreach(clientAnswering({ ReadsServerFiles: false, ReadableBaseTables: 0 }), '__mj')).toEqual([]);
+    });
+
+    it('warns when the login can read base tables', async () => {
+        const warnings = await DescribeReadOnlyLoginOverreach(clientAnswering({ ReadsServerFiles: false, ReadableBaseTables: 412 }), '__mj');
+        expect(warnings).toHaveLength(1);
+        expect(warnings[0]).toMatch(/can read 412 base table\(s\) in schema "__mj"/);
+    });
+
+    it('warns when the login can read server files', async () => {
+        const warnings = await DescribeReadOnlyLoginOverreach(clientAnswering({ ReadsServerFiles: true, ReadableBaseTables: 0 }), '__mj');
+        expect(warnings[0]).toMatch(/pg_read_server_files/);
+    });
+});

package/src/__tests__/translateBracketsToPG.test.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated resolvers emit SQL Server bracket-quoted identifiers; on PostgreSQL they become
+ * double-quoted. Only identifiers change: brackets inside a string literal are data.
+ */
+import { describe, it, expect } from 'vitest';
+import { TranslateBracketsToPG } from '../postgresqlCompat.js';
+
+describe('TranslateBracketsToPG', () => {
+    it('turns bracket-quoted identifiers into double-quoted ones', () => {
+        expect(TranslateBracketsToPG('SELECT [ID], [Name] FROM [__mj].[vwUsers]')).toBe('SELECT "ID", "Name" FROM "__mj"."vwUsers"');
+    });
+
+    it('leaves brackets inside a string literal alone', () => {
+        expect(TranslateBracketsToPG("SELECT [ID] FROM [t] WHERE [Note] = '[draft] copy'")).toBe(`SELECT "ID" FROM "t" WHERE "Note" = '[draft] copy'`);
+    });
+
+    it('unescapes ]] and escapes a double quote in the name', () => {
+        expect(TranslateBracketsToPG('SELECT [a]]b], [say "hi"] FROM t')).toBe('SELECT "a]b", "say ""hi""" FROM t');
+    });
+});

package/src/auth/magicLink/MagicLinkService.ts

@@ -35,7 +35,7 @@ import { CommunicationEngine } from '@memberjunction/communication-engine';
 import { Message } from '@memberjunction/communication-types';
 import { configInfo, type MagicLinkConfig } from '../../config.js';
 import { MagicLinkKeyManager } from './MagicLinkKeys.js';
-import { generateRawToken, generateSessionId, hashToken, evaluateInvite, buildSessionClaims, buildConsumeInviteSQL, canIssueInvites, isRoleGrantable, MAGIC_LINK_TOKEN_PREFIX } from './magicLinkCore.js';
+import { generateRawToken, generateSessionId, hashToken, evaluateInvite, buildSessionClaims, buildConsumeInvitePostgresSQL, canIssueInvites, isRoleGrantable, MAGIC_LINK_TOKEN_PREFIX } from './magicLinkCore.js';
 import type {
   CreateMagicLinkInviteParams,
   CreateMagicLinkInviteResult,
@@ -48,6 +48,21 @@ const REDEMPTION_ENTITY = 'MJ: Magic Link Redemptions';
 /** Shared Anonymous principal — seeded by the Phase-4 migration; must match that UUID. */
 const ANONYMOUS_USER_ID = '273910DF-28F1-45C1-A8F8-6E9AD8E5F008';
 
+/** Outcome of the atomic single-use consume — see {@link MagicLinkService.consumeInvite}. */
+type ConsumeOutcome = 'won' | 'lost' | 'failed';
+
+/**
+ * The SQL Server guarded single-use procedure (migration V202609291627__v6.2.x__MagicLink_Consume_Invite_Sproc).
+ * A procedure, not raw DML, because on SQL Server MJ grants its runtime roles EXECUTE on procedures
+ * and SELECT on views — never DML on base tables — so on any host whose MJAPI login is not db_owner
+ * a raw UPDATE is refused (#4753). Ownership chaining lets the procedure update the table on the
+ * caller's behalf. PostgreSQL has no counterpart function; see {@link buildConsumeInvitePostgresSQL}.
+ */
+const CONSUME_INVITE_PROC = 'spConsumeMagicLinkInvite';
+
+/** MagicLinkInvite base table (core schema) — the PostgreSQL consume updates it directly. */
+const INVITE_TABLE = 'MagicLinkInvite';
+
 /** Outcome of provisioning a redeeming user. */
 interface ProvisionResult {
   success: boolean;
@@ -173,9 +188,9 @@ export class MagicLinkService {
    * session JWT. Runs in the public (pre-auth) path, so it uses the global
    * provider and a configured provisioning context user.
    *
-   * Single-use is enforced by a compare-and-swap UPDATE ({@link consumeInvite})
-   * BEFORE the token is minted — two concurrent redemptions of a single-use
-   * link race on the same row and exactly one wins. The consume is the gate:
+   * Single-use is enforced by the guarded UPDATE inside the `spConsumeMagicLinkInvite`
+   * procedure ({@link consumeInvite}) BEFORE the token is minted — two concurrent
+   * redemptions of a single-use link race on the same row and exactly one wins. The consume is the gate:
    * if a later step fails, the use is already burned (fail-closed). That is the
    * correct trade-off for a single-use credential — burning a token on a server
    * error is recoverable (re-issue); allowing replay is not.
@@ -252,10 +267,14 @@ export class MagicLinkService {
         return done({ success: false, errorCode: 'server_error', error: 'Invite role not found.' });
       }
 
-      // Atomic consume BEFORE minting. If we lose the race (0 rows updated), the
-      // invite was concurrently consumed/expired — re-evaluate the now-stale
-      // in-memory copy only to surface a precise code; default to 'consumed'.
-      if (!(await this.consumeInvite(invite, provider, contextUser))) {
+      // Atomic consume BEFORE minting. A statement that never ran (permissions,
+      // missing procedure, connection) is a server fault, not a lost race — report
+      // it as such so operators aren't sent hunting a double-redeem (#4753).
+      const consume = await this.consumeInvite(invite, provider, contextUser);
+      if (consume === 'failed') {
+        return done({ success: false, errorCode: 'server_error', error: 'Could not redeem the invite due to a server error.' });
+      }
+      if (consume === 'lost') {
         // Lost the race or the invite expired between the pre-check and the
         // consume. The in-memory copy still looks eligible if only the DB-side
         // use count changed, so default that case to 'consumed'.
@@ -639,39 +658,39 @@ export class MagicLinkService {
   }
 
   /**
-   * Atomically consumes one use of the invite via a compare-and-swap UPDATE.
-   * The WHERE clause re-checks every eligibility condition (Active, not
-   * exhausted, not expired) at the DB level, so the increment and the guard are
-   * a single atomic operation. Returns true ONLY when this call updated the row
-   * (won the race); concurrent redemptions of a single-use link see 0 rows.
+   * Atomically consumes one use of the invite with a single guarded UPDATE that re-checks every
+   * eligibility condition (Active, not exhausted, not expired) at the DB level, so the increment and
+   * the guard are one atomic operation. Concurrent redemptions of a single-use link race on the row
+   * and exactly one gets the row back.
    *
-   * Dialect-aware: SQL Server uses an `OUTPUT`-into-table-variable win-detect;
-   * PostgreSQL uses `UPDATE … WHERE … RETURNING` (the WHERE guard is itself the
-   * atomic single-use gate). The platform is read from the provider itself
-   * (`PlatformKey`), not from process env, so this is correct even under a
-   * non-default per-connection provider. The invite ID always binds as a
-   * parameter (`@p0` / `$1`), never interpolated.
+   * The statement differs per platform because the grants do:
+   * - **SQL Server** calls {@link CONSUME_INVITE_PROC} (`EXEC … @ID=@p0`). Runtime roles have
+   *   EXECUTE on procedures but no DML on base tables (#4753).
+   * - **PostgreSQL** runs {@link buildConsumeInvitePostgresSQL}'s `UPDATE … RETURNING` directly.
+   *   Runtime roles hold table DML there, and no PG counterpart of the procedure exists.
+   * The ID is always a bound parameter.
    *
-   * Fail-closed: any DB error returns false and the redemption is rejected.
+   * Returns `'won'` (this call consumed a use), `'lost'` (the guard matched nothing: consumed,
+   * revoked or expired concurrently) or `'failed'` (the statement never ran — permissions, a missing
+   * procedure, a connection error). `'failed'` is kept distinct from `'lost'` on purpose: collapsing
+   * them is what made #4753's permission error surface to users as "already redeemed".
    */
-  private async consumeInvite(invite: MJMagicLinkInviteEntity, provider: DatabaseProviderBase, contextUser: UserInfo): Promise<boolean> {
+  private async consumeInvite(invite: MJMagicLinkInviteEntity, provider: DatabaseProviderBase, contextUser: UserInfo): Promise<ConsumeOutcome> {
+    const isPg = provider.PlatformKey === 'postgresql';
+    const statement = isPg ? `PostgreSQL guarded UPDATE on ${INVITE_TABLE}` : CONSUME_INVITE_PROC;
     try {
-      const entityInfo = provider.EntityByName(INVITE_ENTITY);
-      if (!entityInfo) {
-        LogError(`[MagicLink] Entity metadata for '${INVITE_ENTITY}' not found; cannot consume invite.`);
-        return false;
-      }
-      const isPg = provider.PlatformKey === 'postgresql';
-      // PG identifiers are auto-quoted by PostgreSQLDataProvider.ExecuteSQL, so
-      // pass the bare `schema.table`; SQL Server takes the bracket-quoted form.
-      const table = isPg ? `${entityInfo.SchemaName}.${entityInfo.BaseTable}` : `[${entityInfo.SchemaName}].[${entityInfo.BaseTable}]`;
-      // OUTPUT/RETURNING yields one row iff the WHERE matched — the atomic single-use gate.
-      const sql = buildConsumeInviteSQL(table, isPg ? 'postgresql' : 'sqlserver');
-      const rows = await provider.ExecuteSQL<{ ID: string }>(sql, [invite.ID], { isMutation: true }, contextUser);
-      return Array.isArray(rows) && rows.length === 1;
+      const sql = isPg
+        ? buildConsumeInvitePostgresSQL(`${provider.MJCoreSchemaName}.${INVITE_TABLE}`)
+        : provider.Dialect.ProcedureCallSyntax(provider.MJCoreSchemaName, CONSUME_INVITE_PROC, [`@ID=${provider.BuildParameterPlaceholder(0)}`]);
+      const rows = await provider.ExecuteSQL<{ ID: string }>(sql, [invite.ID], { isMutation: true, description: `MagicLink ${statement}` }, contextUser);
+      if (!Array.isArray(rows)) {
+        LogError(`[MagicLink] ${statement} returned no result set for invite ${invite.ID}; treating the consume as failed.`);
+        return 'failed';
+      }
+      return rows.length === 1 ? 'won' : 'lost';
     } catch (e) {
-      LogError(`[MagicLink] Atomic consume failed for invite ${invite.ID}: ${e instanceof Error ? e.message : String(e)}`);
-      return false;
+      LogError(`[MagicLink] ${statement} FAILED for invite ${invite.ID} — the statement never ran, so this is NOT a lost race: ${e instanceof Error ? e.message : String(e)}`);
+      return 'failed';
     }
   }