@memberjunction/server 6.1.4 → 6.1.5

package/src/__tests__/magicLinkService.consume.test.ts

@@ -0,0 +1,224 @@
+import { describe, it, expect, vi, beforeEach, afterEach, type Mock } from 'vitest';
+
+// MagicLinkService is the imperative shell — importing it pulls the full
+// data-provider and communication stacks in at module load. Stub those out;
+// @memberjunction/core stays real (Metadata, RunView, LogError).
+vi.mock('@memberjunction/generic-database-provider', () => ({
+  UserCache: { Instance: { Users: [] } },
+}));
+vi.mock('@memberjunction/communication-engine', () => ({
+  CommunicationEngine: { Instance: {} },
+}));
+vi.mock('@memberjunction/communication-types', () => ({
+  Message: class {},
+}));
+vi.mock('../config.js', () => ({
+  configInfo: {},
+}));
+
+import { Metadata, RunView, type DatabaseProviderBase, type IMetadataProvider, type UserInfo } from '@memberjunction/core';
+import type { MJMagicLinkInviteEntity } from '@memberjunction/core-entities';
+import type { MagicLinkConfig } from '../config.js';
+import { MagicLinkService } from '../auth/magicLink/MagicLinkService.js';
+import { MAGIC_LINK_TOKEN_PREFIX, buildConsumeInvitePostgresSQL } from '../auth/magicLink/magicLinkCore.js';
+
+type Platform = 'sqlserver' | 'postgresql';
+
+/** Provider surface consumeInvite/RedeemInvite touch, with real-shaped dialect behavior. */
+interface FakeProvider {
+  PlatformKey: Platform;
+  MJCoreSchemaName: string;
+  Roles: { ID: string; Name: string }[];
+  Applications: { ID: string; Name: string; Path: string }[];
+  Dialect: { ProcedureCallSyntax: (schema: string, name: string, params: string[]) => string };
+  BuildParameterPlaceholder: (index: number) => string;
+  ExecuteSQL: Mock;
+}
+
+function makeProvider(platform: Platform): FakeProvider {
+  const isPg = platform === 'postgresql';
+  return {
+    PlatformKey: platform,
+    MJCoreSchemaName: '__mj',
+    Roles: [{ ID: 'role-1', Name: 'Magic Link Baseline' }],
+    Applications: [],
+    Dialect: {
+      ProcedureCallSyntax: isPg
+        ? (s, n, p) => `SELECT * FROM ${s}."${n}"(${p.join(', ')})`
+        : (s, n, p) => `EXEC [${s}].[${n}] ${p.join(', ')}`,
+    },
+    BuildParameterPlaceholder: isPg ? (i) => `$${i + 1}` : (i) => `@p${i}`,
+    ExecuteSQL: vi.fn(),
+  };
+}
+
+const INVITE_ID = '11111111-2222-3333-4444-555555555555';
+
+function makeInvite(): MJMagicLinkInviteEntity {
+  return {
+    ID: INVITE_ID,
+    Status: 'Active',
+    UseCount: 0,
+    MaxUses: 1,
+    ExpiresAt: new Date(Date.now() + 3600_000),
+    RoleID: 'role-1',
+    CreatedByUserID: 'inviter-1',
+    ApplicationID: 'app-1',
+    Email: 'g@example.com',
+  } as unknown as MJMagicLinkInviteEntity;
+}
+
+/** Private surface of MagicLinkService the tests drive or stub. */
+interface ServicePrivates {
+  consumeInvite: (invite: MJMagicLinkInviteEntity, provider: DatabaseProviderBase, contextUser: UserInfo) => Promise<string>;
+  resolveProvisioningContextUser: () => UserInfo | null;
+  isInviterActive: (id: string) => boolean;
+  recordRedemption: () => Promise<void>;
+  provisionUser: () => Promise<{ success: boolean; error?: string }>;
+}
+
+describe('MagicLinkService.consumeInvite (#4753)', () => {
+  let service: MagicLinkService;
+  let privates: ServicePrivates;
+  let invite: MJMagicLinkInviteEntity;
+  const contextUser = { ID: 'ctx-user' } as UserInfo;
+
+  beforeEach(() => {
+    service = new MagicLinkService('https://mj.example.com', {} as MagicLinkConfig);
+    privates = service as unknown as ServicePrivates;
+    invite = makeInvite();
+  });
+
+  afterEach(() => {
+    Metadata.Provider = null as unknown as IMetadataProvider;
+  });
+
+  async function consume(provider: FakeProvider): Promise<string> {
+    return privates.consumeInvite(invite, provider as unknown as DatabaseProviderBase, contextUser);
+  }
+
+  it('SQL Server: calls spConsumeMagicLinkInvite with the ID bound by name, never interpolated', async () => {
+    const provider = makeProvider('sqlserver');
+    provider.ExecuteSQL.mockResolvedValue([{ ID: INVITE_ID }]);
+    await consume(provider);
+
+    expect(provider.ExecuteSQL).toHaveBeenCalledTimes(1);
+    const [sql, params, options, user] = provider.ExecuteSQL.mock.calls[0];
+    expect(sql).toBe('EXEC [__mj].[spConsumeMagicLinkInvite] @ID=@p0');
+    expect(params).toEqual([INVITE_ID]);
+    expect(options).toEqual(expect.objectContaining({ isMutation: true }));
+    expect(user).toBe(contextUser);
+    expect(sql).not.toContain(INVITE_ID);
+    expect(String(sql).toUpperCase()).not.toContain('UPDATE');
+  });
+
+  // PG has no spConsumeMagicLinkInvite function (the release-time converter does not emit
+  // procedures) and PG's runtime roles hold table DML, so PG keeps the direct guarded UPDATE.
+  it('PostgreSQL: runs the guarded UPDATE … RETURNING directly, with the ID bound as $1', async () => {
+    const provider = makeProvider('postgresql');
+    provider.ExecuteSQL.mockResolvedValue([{ ID: INVITE_ID }]);
+    await consume(provider);
+
+    expect(provider.ExecuteSQL).toHaveBeenCalledTimes(1);
+    const [sql, params, options, user] = provider.ExecuteSQL.mock.calls[0];
+    expect(sql).toBe(buildConsumeInvitePostgresSQL('__mj.MagicLinkInvite'));
+    expect(sql).not.toContain('spConsumeMagicLinkInvite');
+    expect(params).toEqual([INVITE_ID]);
+    expect(options).toEqual(expect.objectContaining({ isMutation: true }));
+    expect(user).toBe(contextUser);
+    expect(sql).not.toContain(INVITE_ID);
+  });
+
+  it("PostgreSQL: maps one row to 'won', zero rows to 'lost', and a thrown error to 'failed'", async () => {
+    vi.spyOn(console, 'error').mockImplementation(() => undefined);
+    const provider = makeProvider('postgresql');
+    provider.ExecuteSQL.mockResolvedValueOnce([{ ID: INVITE_ID }]).mockResolvedValueOnce([]).mockRejectedValueOnce(new Error('connection reset'));
+
+    expect(await consume(provider)).toBe('won');
+    expect(await consume(provider)).toBe('lost');
+    expect(await consume(provider)).toBe('failed');
+  });
+
+  it("returns 'won' when exactly one row comes back", async () => {
+    const provider = makeProvider('sqlserver');
+    provider.ExecuteSQL.mockResolvedValue([{ ID: INVITE_ID }]);
+    expect(await consume(provider)).toBe('won');
+  });
+
+  it("returns 'lost' when zero rows come back", async () => {
+    const provider = makeProvider('sqlserver');
+    provider.ExecuteSQL.mockResolvedValue([]);
+    expect(await consume(provider)).toBe('lost');
+  });
+
+  it("returns 'failed' and logs the invite ID when ExecuteSQL throws", async () => {
+    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+    const provider = makeProvider('sqlserver');
+    provider.ExecuteSQL.mockRejectedValue(new Error("The EXECUTE permission was denied on the object 'spConsumeMagicLinkInvite'"));
+
+    expect(await consume(provider)).toBe('failed');
+    const logged = errorSpy.mock.calls.map((call) => call.map(String).join(' '));
+    expect(logged.some((line) => line.includes(INVITE_ID) && line.includes('spConsumeMagicLinkInvite'))).toBe(true);
+  });
+
+  it("returns 'failed' when ExecuteSQL returns a non-array", async () => {
+    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+    const provider = makeProvider('sqlserver');
+    provider.ExecuteSQL.mockResolvedValue(undefined);
+
+    expect(await consume(provider)).toBe('failed');
+    const logged = errorSpy.mock.calls.map((call) => call.map(String).join(' '));
+    expect(logged.some((line) => line.includes(INVITE_ID))).toBe(true);
+  });
+});
+
+describe('MagicLinkService.RedeemInvite consume outcome mapping (#4753)', () => {
+  let service: MagicLinkService;
+  let provider: FakeProvider;
+  let provisionUser: Mock;
+  const contextUser = { ID: 'ctx-user' } as UserInfo;
+  const rawToken = MAGIC_LINK_TOKEN_PREFIX + 'x';
+
+  beforeEach(() => {
+    vi.spyOn(console, 'error').mockImplementation(() => undefined);
+    provider = makeProvider('sqlserver');
+    Metadata.Provider = provider as unknown as IMetadataProvider;
+
+    service = new MagicLinkService('https://mj.example.com', {} as MagicLinkConfig);
+    const privates = service as unknown as ServicePrivates;
+    vi.spyOn(RunView.prototype, 'RunView').mockResolvedValue({ Success: true, Results: [makeInvite()] } as Awaited<ReturnType<RunView['RunView']>>);
+    vi.spyOn(privates, 'resolveProvisioningContextUser').mockReturnValue(contextUser);
+    vi.spyOn(privates, 'isInviterActive').mockReturnValue(true);
+    vi.spyOn(privates, 'recordRedemption').mockResolvedValue(undefined);
+    provisionUser = vi.fn().mockResolvedValue({ success: false, error: 'stop-here' });
+    privates.provisionUser = provisionUser;
+  });
+
+  afterEach(() => {
+    Metadata.Provider = null as unknown as IMetadataProvider;
+  });
+
+  it('RedeemInvite maps a failed consume to server_error, not consumed, and never provisions', async () => {
+    provider.ExecuteSQL.mockRejectedValue(new Error("The EXECUTE permission was denied on the object 'spConsumeMagicLinkInvite'"));
+    const result = await service.RedeemInvite(rawToken);
+
+    expect(result).toEqual(expect.objectContaining({ success: false, errorCode: 'server_error' }));
+    expect(provisionUser).not.toHaveBeenCalled();
+  });
+
+  it('RedeemInvite still reports consumed when the race is lost', async () => {
+    provider.ExecuteSQL.mockResolvedValue([]);
+    const result = await service.RedeemInvite(rawToken);
+
+    expect(result).toEqual(expect.objectContaining({ success: false, errorCode: 'consumed' }));
+    expect(provisionUser).not.toHaveBeenCalled();
+  });
+
+  it('RedeemInvite proceeds to provisioning when the consume wins', async () => {
+    provider.ExecuteSQL.mockResolvedValue([{ ID: INVITE_ID }]);
+    const result = await service.RedeemInvite(rawToken);
+
+    expect(provisionUser).toHaveBeenCalledTimes(1);
+    expect(result).toEqual(expect.objectContaining({ success: false, errorCode: 'provisioning_failed' }));
+  });
+});

package/src/__tests__/postgresqlPoolSettings.test.ts

@@ -0,0 +1,131 @@
+/**
+ * PostgreSQL pools read the same databaseSettings values as SQL Server, with the same defaults.
+ */
+import { describe, it, expect } from 'vitest';
+import {
+    BuildPostgreSQLConnectionConfig,
+    CODEGEN_STATEMENT_TIMEOUT_MS,
+    ResolvePostgreSQLEndpoint,
+    ResolvePostgreSQLReadOnlyCredentials,
+    ToPGPoolConfig
+} from '../postgresqlPoolSettings.js';
+import type { DatabaseSettingsInfo } from '../config.js';
+import { DescribeReadOnlyLoginOverreach } from '../postgresqlPoolSettings.js';
+import type { ReadOnlyLoginCheckClient, ReadOnlyLoginGrants } from '../postgresqlPoolSettings.js';
+
+const defaults: DatabaseSettingsInfo = {
+    connectionTimeout: 45000,
+    requestTimeout: 30000,
+    metadataCacheRefreshInterval: 180000,
+    connectionPool: { max: 50, min: 5, idleTimeoutMillis: 30000, acquireTimeoutMillis: 30000 }
+};
+const endpoint = { Host: 'db', Port: 5432, Database: 'mj', User: 'api', Password: 'secret' };
+
+describe('BuildPostgreSQLConnectionConfig', () => {
+    it('gives API pools requestTimeout as the statement timeout and the pool settings SQL Server uses', () => {
+        const config = BuildPostgreSQLConnectionConfig(endpoint, defaults, 'api');
+        expect(config).toMatchObject({
+            ...endpoint,
+            MaxConnections: 50,
+            MinConnections: 5,
+            IdleTimeoutMillis: 30000,
+            ConnectionTimeoutMillis: 30000,
+            StatementTimeoutMs: 30000,
+            IdleInTransactionSessionTimeoutMs: 60000
+        });
+    });
+
+    it('follows a configured requestTimeout and pool', () => {
+        const config = BuildPostgreSQLConnectionConfig(endpoint, {
+            ...defaults,
+            requestTimeout: 5000,
+            connectionPool: { max: 12, min: 1, idleTimeoutMillis: 7000, acquireTimeoutMillis: 9000 }
+        }, 'api');
+        expect(config).toMatchObject({ MaxConnections: 12, MinConnections: 1, IdleTimeoutMillis: 7000, ConnectionTimeoutMillis: 9000, StatementTimeoutMs: 5000, IdleInTransactionSessionTimeoutMs: 10000 });
+    });
+
+    it('sets no timeouts when requestTimeout is 0', () => {
+        const config = BuildPostgreSQLConnectionConfig(endpoint, { ...defaults, requestTimeout: 0 }, 'api');
+        expect(config.StatementTimeoutMs).toBe(0);
+        expect(config.IdleInTransactionSessionTimeoutMs).toBe(0);
+    });
+
+    it('keeps the read-only pool small but gives it the API timeouts', () => {
+        const config = BuildPostgreSQLConnectionConfig(endpoint, defaults, 'read-only');
+        expect(config).toMatchObject({ MaxConnections: 10, MinConnections: 0, StatementTimeoutMs: 30000, IdleInTransactionSessionTimeoutMs: 60000 });
+        expect(BuildPostgreSQLConnectionConfig(endpoint, { ...defaults, connectionPool: { max: 4, min: 1, idleTimeoutMillis: 1, acquireTimeoutMillis: 1 } }, 'read-only').MaxConnections).toBe(4);
+    });
+
+    it('gives the CodeGen pool the long timeout the SQL Server CodeGen pool has, and no idle-in-transaction limit', () => {
+        const config = BuildPostgreSQLConnectionConfig(endpoint, defaults, 'codegen');
+        expect(config.StatementTimeoutMs).toBe(CODEGEN_STATEMENT_TIMEOUT_MS);
+        expect(CODEGEN_STATEMENT_TIMEOUT_MS).toBe(600000);
+        expect(config.IdleInTransactionSessionTimeoutMs).toBe(0);
+        expect(config.MaxConnections).toBe(10);
+    });
+});
+
+describe('ToPGPoolConfig', () => {
+    it('maps the connection config onto pg.Pool option names', () => {
+        const pool = ToPGPoolConfig(BuildPostgreSQLConnectionConfig(endpoint, defaults, 'api'));
+        expect(pool).toEqual({
+            host: 'db', port: 5432, database: 'mj', user: 'api', password: 'secret',
+            max: 50, min: 5, idleTimeoutMillis: 30000, connectionTimeoutMillis: 30000,
+            statement_timeout: 30000, idle_in_transaction_session_timeout: 60000
+        });
+    });
+
+    it('leaves the timeouts out when they are 0', () => {
+        const pool = ToPGPoolConfig(BuildPostgreSQLConnectionConfig(endpoint, { ...defaults, requestTimeout: 0 }, 'api'));
+        expect(pool).not.toHaveProperty('statement_timeout');
+        expect(pool).not.toHaveProperty('idle_in_transaction_session_timeout');
+    });
+});
+
+describe('ResolvePostgreSQLEndpoint', () => {
+    it('prefers PG_* variables over DB_* ones', () => {
+        expect(ResolvePostgreSQLEndpoint({ PG_HOST: 'pg', DB_HOST: 'db', DB_PORT: '6000', DB_DATABASE: 'd', DB_USERNAME: 'u', DB_PASSWORD: 'p' }))
+            .toEqual({ Host: 'pg', Port: 6000, Database: 'd', User: 'u', Password: 'p' });
+    });
+
+    it('falls back to localhost:5432 and the postgres user', () => {
+        expect(ResolvePostgreSQLEndpoint({})).toEqual({ Host: 'localhost', Port: 5432, Database: '', User: 'postgres', Password: '' });
+    });
+});
+
+describe('ResolvePostgreSQLReadOnlyCredentials', () => {
+    it('uses the dbReadOnlyUsername / dbReadOnlyPassword settings SQL Server uses', () => {
+        expect(ResolvePostgreSQLReadOnlyCredentials({ dbReadOnlyUsername: 'ro', dbReadOnlyPassword: 'pw' }, {}))
+            .toEqual({ User: 'ro', Password: 'pw' });
+    });
+
+    it('falls back to PG_READ_ONLY_* when the settings are absent', () => {
+        expect(ResolvePostgreSQLReadOnlyCredentials({}, { PG_READ_ONLY_USERNAME: 'pgro', PG_READ_ONLY_PASSWORD: 'x' }))
+            .toEqual({ User: 'pgro', Password: 'x' });
+    });
+
+    it('returns null when no complete pair is configured', () => {
+        expect(ResolvePostgreSQLReadOnlyCredentials({ dbReadOnlyUsername: 'ro' }, { PG_READ_ONLY_USERNAME: 'pgro' })).toBeNull();
+    });
+});
+
+describe('DescribeReadOnlyLoginOverreach', () => {
+    const clientAnswering = (row: ReadOnlyLoginGrants): ReadOnlyLoginCheckClient => ({
+        query: async () => ({ rows: [row] }),
+    });
+
+    it('says nothing for a login that reads only views', async () => {
+        expect(await DescribeReadOnlyLoginOverreach(clientAnswering({ ReadsServerFiles: false, ReadableBaseTables: 0 }), '__mj')).toEqual([]);
+    });
+
+    it('warns when the login can read base tables', async () => {
+        const warnings = await DescribeReadOnlyLoginOverreach(clientAnswering({ ReadsServerFiles: false, ReadableBaseTables: 412 }), '__mj');
+        expect(warnings).toHaveLength(1);
+        expect(warnings[0]).toMatch(/can read 412 base table\(s\) in schema "__mj"/);
+    });
+
+    it('warns when the login can read server files', async () => {
+        const warnings = await DescribeReadOnlyLoginOverreach(clientAnswering({ ReadsServerFiles: true, ReadableBaseTables: 0 }), '__mj');
+        expect(warnings[0]).toMatch(/pg_read_server_files/);
+    });
+});

package/src/__tests__/translateBracketsToPG.test.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated resolvers emit SQL Server bracket-quoted identifiers; on PostgreSQL they become
+ * double-quoted. Only identifiers change: brackets inside a string literal are data.
+ */
+import { describe, it, expect } from 'vitest';
+import { TranslateBracketsToPG } from '../postgresqlCompat.js';
+
+describe('TranslateBracketsToPG', () => {
+    it('turns bracket-quoted identifiers into double-quoted ones', () => {
+        expect(TranslateBracketsToPG('SELECT [ID], [Name] FROM [__mj].[vwUsers]')).toBe('SELECT "ID", "Name" FROM "__mj"."vwUsers"');
+    });
+
+    it('leaves brackets inside a string literal alone', () => {
+        expect(TranslateBracketsToPG("SELECT [ID] FROM [t] WHERE [Note] = '[draft] copy'")).toBe(`SELECT "ID" FROM "t" WHERE "Note" = '[draft] copy'`);
+    });
+
+    it('unescapes ]] and escapes a double quote in the name', () => {
+        expect(TranslateBracketsToPG('SELECT [a]]b], [say "hi"] FROM t')).toBe('SELECT "a]b", "say ""hi""" FROM t');
+    });
+});

package/src/auth/magicLink/MagicLinkService.ts

@@ -35,7 +35,7 @@ import { CommunicationEngine } from '@memberjunction/communication-engine';
 import { Message } from '@memberjunction/communication-types';
 import { configInfo, type MagicLinkConfig } from '../../config.js';
 import { MagicLinkKeyManager } from './MagicLinkKeys.js';
-import { generateRawToken, generateSessionId, hashToken, evaluateInvite, buildSessionClaims, buildConsumeInviteSQL, canIssueInvites, isRoleGrantable, MAGIC_LINK_TOKEN_PREFIX } from './magicLinkCore.js';
+import { generateRawToken, generateSessionId, hashToken, evaluateInvite, buildSessionClaims, buildConsumeInvitePostgresSQL, canIssueInvites, isRoleGrantable, MAGIC_LINK_TOKEN_PREFIX } from './magicLinkCore.js';
 import type {
   CreateMagicLinkInviteParams,
   CreateMagicLinkInviteResult,
@@ -48,6 +48,21 @@ const REDEMPTION_ENTITY = 'MJ: Magic Link Redemptions';
 /** Shared Anonymous principal — seeded by the Phase-4 migration; must match that UUID. */
 const ANONYMOUS_USER_ID = '273910DF-28F1-45C1-A8F8-6E9AD8E5F008';
 
+/** Outcome of the atomic single-use consume — see {@link MagicLinkService.consumeInvite}. */
+type ConsumeOutcome = 'won' | 'lost' | 'failed';
+
+/**
+ * The SQL Server guarded single-use procedure (migration V202609291627__v6.2.x__MagicLink_Consume_Invite_Sproc).
+ * A procedure, not raw DML, because on SQL Server MJ grants its runtime roles EXECUTE on procedures
+ * and SELECT on views — never DML on base tables — so on any host whose MJAPI login is not db_owner
+ * a raw UPDATE is refused (#4753). Ownership chaining lets the procedure update the table on the
+ * caller's behalf. PostgreSQL has no counterpart function; see {@link buildConsumeInvitePostgresSQL}.
+ */
+const CONSUME_INVITE_PROC = 'spConsumeMagicLinkInvite';
+
+/** MagicLinkInvite base table (core schema) — the PostgreSQL consume updates it directly. */
+const INVITE_TABLE = 'MagicLinkInvite';
+
 /** Outcome of provisioning a redeeming user. */
 interface ProvisionResult {
   success: boolean;
@@ -173,9 +188,9 @@ export class MagicLinkService {
    * session JWT. Runs in the public (pre-auth) path, so it uses the global
    * provider and a configured provisioning context user.
    *
-   * Single-use is enforced by a compare-and-swap UPDATE ({@link consumeInvite})
-   * BEFORE the token is minted — two concurrent redemptions of a single-use
-   * link race on the same row and exactly one wins. The consume is the gate:
+   * Single-use is enforced by the guarded UPDATE inside the `spConsumeMagicLinkInvite`
+   * procedure ({@link consumeInvite}) BEFORE the token is minted — two concurrent
+   * redemptions of a single-use link race on the same row and exactly one wins. The consume is the gate:
    * if a later step fails, the use is already burned (fail-closed). That is the
    * correct trade-off for a single-use credential — burning a token on a server
    * error is recoverable (re-issue); allowing replay is not.
@@ -252,10 +267,14 @@ export class MagicLinkService {
         return done({ success: false, errorCode: 'server_error', error: 'Invite role not found.' });
       }
 
-      // Atomic consume BEFORE minting. If we lose the race (0 rows updated), the
-      // invite was concurrently consumed/expired — re-evaluate the now-stale
-      // in-memory copy only to surface a precise code; default to 'consumed'.
-      if (!(await this.consumeInvite(invite, provider, contextUser))) {
+      // Atomic consume BEFORE minting. A statement that never ran (permissions,
+      // missing procedure, connection) is a server fault, not a lost race — report
+      // it as such so operators aren't sent hunting a double-redeem (#4753).
+      const consume = await this.consumeInvite(invite, provider, contextUser);
+      if (consume === 'failed') {
+        return done({ success: false, errorCode: 'server_error', error: 'Could not redeem the invite due to a server error.' });
+      }
+      if (consume === 'lost') {
         // Lost the race or the invite expired between the pre-check and the
         // consume. The in-memory copy still looks eligible if only the DB-side
         // use count changed, so default that case to 'consumed'.
@@ -639,39 +658,39 @@ export class MagicLinkService {
   }
 
   /**
-   * Atomically consumes one use of the invite via a compare-and-swap UPDATE.
-   * The WHERE clause re-checks every eligibility condition (Active, not
-   * exhausted, not expired) at the DB level, so the increment and the guard are
-   * a single atomic operation. Returns true ONLY when this call updated the row
-   * (won the race); concurrent redemptions of a single-use link see 0 rows.
+   * Atomically consumes one use of the invite with a single guarded UPDATE that re-checks every
+   * eligibility condition (Active, not exhausted, not expired) at the DB level, so the increment and
+   * the guard are one atomic operation. Concurrent redemptions of a single-use link race on the row
+   * and exactly one gets the row back.
    *
-   * Dialect-aware: SQL Server uses an `OUTPUT`-into-table-variable win-detect;
-   * PostgreSQL uses `UPDATE … WHERE … RETURNING` (the WHERE guard is itself the
-   * atomic single-use gate). The platform is read from the provider itself
-   * (`PlatformKey`), not from process env, so this is correct even under a
-   * non-default per-connection provider. The invite ID always binds as a
-   * parameter (`@p0` / `$1`), never interpolated.
+   * The statement differs per platform because the grants do:
+   * - **SQL Server** calls {@link CONSUME_INVITE_PROC} (`EXEC … @ID=@p0`). Runtime roles have
+   *   EXECUTE on procedures but no DML on base tables (#4753).
+   * - **PostgreSQL** runs {@link buildConsumeInvitePostgresSQL}'s `UPDATE … RETURNING` directly.
+   *   Runtime roles hold table DML there, and no PG counterpart of the procedure exists.
+   * The ID is always a bound parameter.
    *
-   * Fail-closed: any DB error returns false and the redemption is rejected.
+   * Returns `'won'` (this call consumed a use), `'lost'` (the guard matched nothing: consumed,
+   * revoked or expired concurrently) or `'failed'` (the statement never ran — permissions, a missing
+   * procedure, a connection error). `'failed'` is kept distinct from `'lost'` on purpose: collapsing
+   * them is what made #4753's permission error surface to users as "already redeemed".
    */
-  private async consumeInvite(invite: MJMagicLinkInviteEntity, provider: DatabaseProviderBase, contextUser: UserInfo): Promise<boolean> {
+  private async consumeInvite(invite: MJMagicLinkInviteEntity, provider: DatabaseProviderBase, contextUser: UserInfo): Promise<ConsumeOutcome> {
+    const isPg = provider.PlatformKey === 'postgresql';
+    const statement = isPg ? `PostgreSQL guarded UPDATE on ${INVITE_TABLE}` : CONSUME_INVITE_PROC;
     try {
-      const entityInfo = provider.EntityByName(INVITE_ENTITY);
-      if (!entityInfo) {
-        LogError(`[MagicLink] Entity metadata for '${INVITE_ENTITY}' not found; cannot consume invite.`);
-        return false;
-      }
-      const isPg = provider.PlatformKey === 'postgresql';
-      // PG identifiers are auto-quoted by PostgreSQLDataProvider.ExecuteSQL, so
-      // pass the bare `schema.table`; SQL Server takes the bracket-quoted form.
-      const table = isPg ? `${entityInfo.SchemaName}.${entityInfo.BaseTable}` : `[${entityInfo.SchemaName}].[${entityInfo.BaseTable}]`;
-      // OUTPUT/RETURNING yields one row iff the WHERE matched — the atomic single-use gate.
-      const sql = buildConsumeInviteSQL(table, isPg ? 'postgresql' : 'sqlserver');
-      const rows = await provider.ExecuteSQL<{ ID: string }>(sql, [invite.ID], { isMutation: true }, contextUser);
-      return Array.isArray(rows) && rows.length === 1;
+      const sql = isPg
+        ? buildConsumeInvitePostgresSQL(`${provider.MJCoreSchemaName}.${INVITE_TABLE}`)
+        : provider.Dialect.ProcedureCallSyntax(provider.MJCoreSchemaName, CONSUME_INVITE_PROC, [`@ID=${provider.BuildParameterPlaceholder(0)}`]);
+      const rows = await provider.ExecuteSQL<{ ID: string }>(sql, [invite.ID], { isMutation: true, description: `MagicLink ${statement}` }, contextUser);
+      if (!Array.isArray(rows)) {
+        LogError(`[MagicLink] ${statement} returned no result set for invite ${invite.ID}; treating the consume as failed.`);
+        return 'failed';
+      }
+      return rows.length === 1 ? 'won' : 'lost';
     } catch (e) {
-      LogError(`[MagicLink] Atomic consume failed for invite ${invite.ID}: ${e instanceof Error ? e.message : String(e)}`);
-      return false;
+      LogError(`[MagicLink] ${statement} FAILED for invite ${invite.ID} — the statement never ran, so this is NOT a lost race: ${e instanceof Error ? e.message : String(e)}`);
+      return 'failed';
     }
   }
 

package/src/auth/magicLink/magicLinkCore.ts

@@ -106,75 +106,38 @@ export function evaluateInvite(invite: InviteEvaluationInput, nowMs: number): {
   return { ok: true };
 }
 
-/** SQL dialect for {@link buildConsumeInviteSQL}. */
-export type ConsumeInviteDialect = 'sqlserver' | 'postgresql';
-
-/** SQL Server table identifier — bracket-quoted `[schema].[table]` (word chars only). */
-const QUALIFIED_TABLE_PATTERN = /^\[\w+\]\.\[\w+\]$/;
 /** PostgreSQL table identifier — `schema.table` (word chars only); auto-quoted downstream. */
 const QUALIFIED_TABLE_PATTERN_PG = /^\w+\.\w+$/;
 
 /**
- * Builds the atomic compare-and-swap UPDATE that consumes one use of an invite,
- * in the given SQL dialect.
- *
- * The WHERE clause re-checks every eligibility condition at the DB level, so the
- * increment and the guard are a single atomic operation: concurrent redemptions
- * of a single-use link race on the row and exactly one matches. This is what
- * actually enforces single-use — the JS-side `evaluateInvite` is only a friendly
- * pre-check. The matched row's ID is returned to the caller (via `OUTPUT` on SQL
- * Server, `RETURNING` on PostgreSQL) so it can detect a win (exactly one row).
- *
- * The invite ID MUST be bound as a parameter by the caller (`@p0` on SQL Server,
- * `$1` on PostgreSQL) — it is never interpolated into the string, so this builder
- * is injection-safe regardless of the ID's contents.
+ * Builds the PostgreSQL atomic compare-and-swap UPDATE that consumes one use of an invite.
  *
- * **SQL Server** — `OUTPUT` goes `INTO` a table variable (not a bare OUTPUT):
- * SQL Server forbids a bare OUTPUT clause on a table that has enabled triggers,
- * and CodeGen adds an `__mj_UpdatedAt` trigger to every MJ table. The trailing
- * SELECT returns the matched row(s) regardless of trigger behavior.
+ * PostgreSQL only. SQL Server consumes through the granted `spConsumeMagicLinkInvite` procedure,
+ * because its runtime roles are never granted table DML (#4753). PostgreSQL needs neither: its
+ * runtime roles hold INSERT/UPDATE/DELETE on every `__mj` table
+ * (V202605040300__v5.33.x__Unblock_PostgreSQL_End_To_End.pg-only.sql), and no PG counterpart of
+ * the procedure exists — the release-time converter leaves `CREATE PROCEDURE` unhandled.
  *
- * **PostgreSQL** — the `UPDATE … WHERE` guard IS itself the atomic single-use
- * gate: the row is locked for the UPDATE's duration, so concurrent redemptions
- * serialize and only the first matching `Status='Active' AND UseCount < MaxUses`
- * wins; `RETURNING` yields the row iff the guard matched (equivalent to the SS
- * `OUTPUT`-into-table win-detect). PascalCase identifiers are auto-quoted by
- * `PostgreSQLDataProvider.ExecuteSQL`, so the table is passed unquoted (`schema.table`).
+ * The WHERE re-checks every eligibility condition (the same predicate as the procedure), so the
+ * increment and the guard are one atomic statement: concurrent redemptions of a single-use link
+ * serialize on the row lock and exactly one matches. `RETURNING ID` yields the row iff the guard
+ * matched. The invite ID MUST be bound by the caller as `$1` — it is never interpolated.
  *
- * `qualifiedTable` is asserted to match the dialect's whitelist pattern before
- * interpolation. The caller derives it from `EntityInfo` (never user input), so
- * this is defense-in-depth: even a future careless caller cannot turn this into
- * an injection vector — a non-conforming table throws.
- *
- * @param qualifiedTable  `[schema].[table]` (sqlserver) or `schema.table` (postgresql) for MagicLinkInvite
- * @param dialect         target SQL dialect (defaults to `'sqlserver'`)
+ * `qualifiedTable` is `schema.table` unquoted (PostgreSQLDataProvider.ExecuteSQL auto-quotes the
+ * PascalCase identifiers) and is asserted against a whitelist before interpolation — the caller
+ * never passes user input, so this is defense-in-depth.
  */
-export function buildConsumeInviteSQL(qualifiedTable: string, dialect: ConsumeInviteDialect = 'sqlserver'): string {
-  if (dialect === 'postgresql') {
-    if (!QUALIFIED_TABLE_PATTERN_PG.test(qualifiedTable)) {
-      throw new Error(`buildConsumeInviteSQL: refusing to build SQL for non-whitelisted table identifier '${qualifiedTable}'.`);
-    }
-    return (
-      `UPDATE ${qualifiedTable} ` +
-      `SET UseCount = UseCount + 1, ` +
-      `ConsumedAt = COALESCE(ConsumedAt, (now() AT TIME ZONE 'utc')), ` +
-      `Status = CASE WHEN UseCount + 1 >= MaxUses THEN 'Consumed' ELSE Status END ` +
-      `WHERE ID = $1 AND Status = 'Active' AND UseCount < MaxUses AND ExpiresAt > (now() AT TIME ZONE 'utc') ` +
-      `RETURNING ID;`
-    );
-  }
-  if (!QUALIFIED_TABLE_PATTERN.test(qualifiedTable)) {
-    throw new Error(`buildConsumeInviteSQL: refusing to build SQL for non-whitelisted table identifier '${qualifiedTable}'.`);
+export function buildConsumeInvitePostgresSQL(qualifiedTable: string): string {
+  if (!QUALIFIED_TABLE_PATTERN_PG.test(qualifiedTable)) {
+    throw new Error(`buildConsumeInvitePostgresSQL: refusing to build SQL for non-whitelisted table identifier '${qualifiedTable}'.`);
   }
   return (
-    `DECLARE @consumed TABLE (ID UNIQUEIDENTIFIER); ` +
     `UPDATE ${qualifiedTable} ` +
     `SET UseCount = UseCount + 1, ` +
-    `ConsumedAt = COALESCE(ConsumedAt, SYSUTCDATETIME()), ` +
+    `ConsumedAt = COALESCE(ConsumedAt, (now() AT TIME ZONE 'utc')), ` +
     `Status = CASE WHEN UseCount + 1 >= MaxUses THEN 'Consumed' ELSE Status END ` +
-    `OUTPUT INSERTED.ID INTO @consumed ` +
-    `WHERE ID = @p0 AND Status = 'Active' AND UseCount < MaxUses AND ExpiresAt > SYSUTCDATETIME(); ` +
-    `SELECT ID FROM @consumed;`
+    `WHERE ID = $1 AND Status = 'Active' AND UseCount < MaxUses AND ExpiresAt > (now() AT TIME ZONE 'utc') ` +
+    `RETURNING ID;`
   );
 }